@keboola/api-client 29.0.0 → 32.0.0

package/CHANGELOG.md

@@ -0,0 +1,1890 @@
+# @keboola/api-client
+
+## 32.0.0
+
+### Major Changes
+
+- Adopt Connection's OpenAPI spec fixes across the storage, management and auth clients.
+
+  Breaking changes to the storage surface:
+  - `workspaceId` is a `number` on all nine workspace operations, and `versionId` a `number` on the
+    configuration-version ones — both were `string` on some and `number` on others.
+  - `branchId` is the `string` the spec declares, and is now required: `configurations`,
+    `configurationRows`, `configurationVersions`, `configurationMetadata`, `components` and `events`
+    no longer default it to `'default'`. `components.getComponents` and
+    `configurations.searchComponentConfigurations` therefore take an argument.
+  - `metadataId` is the spec's integer on all nine metadata deletes; the `MetadataId` alias is gone.
+  - `DevBranch` is a union discriminated on `isDefault`, since the default branch carries no
+    `creatorToken`.
+  - `deleteWorkspaceJob` is renamed `deleteWorkspaceAsync`.
+  - `File.sizeBytes` is nullable, as the serializer returns.
+  - `BranchMetadataEntry`, `BranchMetadataRaw` and `PreparedFile` are removed — all three unused.
+
+  New: a per-call `parseAs` option on every client method (`'auto' | 'text' | 'json' | 'blob'`),
+  defaulting to the existing content-type dispatch. `storage.files.getFileContent` uses it to return
+  a file's exact bytes instead of re-serialising JSON files.
+
+- `STACKS` is typed by its own key set instead of `Record<string, …>`. A name the registry does not
+  carry is now a compile error at the call site, so code can read `STACKS.US_EAST_1_AWS.host` without
+  an `undefined` to fall back from. The entries and their `KeboolaStack` value type are unchanged.
+
+  Breaking for typed consumers: a lookup by a non-literal key — `STACKS[someRuntimeString]` — stops
+  type-checking. Narrow the key first (`if (key in STACKS)`), or iterate `Object.values(STACKS)` when
+  the name itself does not matter.
+
+### Minor Changes
+
+- Let a bearer session hand out the headers for a request the client does not make itself.
+
+  `session.getAuthHeaders()` resolves `Authorization: Bearer <token>` plus `X-KBC-ProjectId`, going through the credential on every call — so a near-expiry token rotates and a revoked one is never re-sent. It exists for transports this package does not own, chiefly the chat SSE stream whose `fetch` the AI SDK holds; anything with a service client on `api` should keep using that.
+
+  It returns the assembled bag rather than the access token, so no caller handles the credential as a bare string and the project header is composed in one place. An anonymous or unscoped session throws instead of emitting a half-formed `Bearer null`.
+
+- Microsoft Graph joins the SDK as a standalone client on two new sub-paths, `@keboola/api-client/microsoftGraph` and `@keboola/api-client/microsoftGraph/types`.
+
+  ```ts
+  import {
+    createMicrosoftGraphAuthMiddleware,
+    createMicrosoftGraphClient,
+  } from "@keboola/api-client/microsoftGraph";
+
+  // The client holds no credential — auth arrives as a middleware. Not a singleton either: a Graph
+  // token is minted per user interaction by your own OAuth flow (MSAL in the browser) and is scoped
+  // to one account, so build a client where you hold it. There is no `sdks/microsoftGraph/` because
+  // MSAL owns refresh; this package has no token state to manage.
+  const graph = createMicrosoftGraphClient({
+    middlewares: [createMicrosoftGraphAuthMiddleware(accessToken)],
+  });
+  const item = await graph.getFile(driveId, fileId, signal);
+  ```
+
+  It exposes `getMySite`, `getMyDrive`, `getFile` and `getDriveItemBySharingUrl` (which redeems a sharing URL into the real `DriveItem`, for "Shared with me" SharePoint files the picker returns with empty ids). Graph is not a Keboola service, so — like `assets` and `status` — it is **not** on `api.*` and is never registered in `createServiceClients.ts`; it also defaults its own `baseUrl`, since a vendor's host and version prefix are part of its API contract rather than something we discover, and it carries no `healthCheck`.
+
+  Types come from Microsoft's own OpenAPI document, but **vendored as a slice** rather than fetched whole: the published v1.0 description covers all of Graph at ~41MB and generates 35MB of `.d.ts`, which this package's declaration emit crashes on (`rolldown-plugin-dts` throws; the previous tsup build hit `ERR_WORKER_OUT_OF_MEMORY` on the same file) and which would ship in the tarball. A `gen:types` run that selects `microsoftGraph` vendors a slice of only the operations the client calls, then generates from it (~650KB of declarations); runs that don't select it never touch the slice. Adding an operation means listing its path in `scripts/vendor-microsoft-graph-spec.mjs`; see `docs/regenerate-api-types.md`.
+
+  The client wires **no transport-level retry**, matching every other client here — where superagent
+  applied 3 attempts (network errors, and 5xx on GET), a transient Graph 503 now surfaces to the caller
+  on the first failure. Consumers that want retry choose it per call site: TanStack Query's `retry` for
+  a query, or `createRetryMiddleware` in `middlewares` for a client whose every call should retry. The
+  OneDrive pickers deliberately take neither — they run inside an interactive MSAL flow where a silent
+  multi-second retry is worse than a prompt failure the user can act on.
+
+  One fix reaches beyond this client: `OpenapiSuccessType` now understands OpenAPI 3 **range** response codes (`2XX`). Operations declaring a range instead of an explicit status previously resolved to `unknown`; ranges are checked after the explicit codes, so a spec declaring both still resolves to the precise one.
+
+- Consumers can now import the kai-agent client directly from `@keboola/api-client/kaiAgent` instead of going through the main barrel.
+
+- `@keboola/api-client/kaiAgent/types` is now its own subpath, exporting `ChatWithMessages` for the `/api/chat/{id}` response — so consumers can derive the chat-detail shape from kai-agent's spec instead of transcribing it.
+
+### Patch Changes
+
+- Add organization-admin permission predicates (AI-3738).
+
+  `domain/permissions/organization.ts` (previously an empty placeholder) now exports
+  `isOrganizationMember`, `isOrganizationAdmin`, `canWriteKaiSpendCaps`, plus
+  `assertCanAdministerOrganization`/`assertCanWriteKaiSpendCaps` (`isOrganizationMember` is a raw
+  signal with no assert pair), mirroring `admin.ts`'s conventions — `canWriteKaiSpendCaps` is
+  strictly stricter than the existing `canWriteKaiSettings` (admin/share only vs. organization-admin
+  only).
+
+- Shrink the permission tests' `StorageToken` fixture to the fields they read.
+
+  `buildStorageToken` transcribed all ~40 fields of the contract shape so it could be annotated `: StorageToken`. Its consumers read three of them — `isMasterToken`, `admin.{role,isOrganizationMember}` — plus `owner.{features,hasSnowflake,hasBigquery}` via `createProject()`, and its `features` / `adminFeatures` options were passed by no caller. The fixture now builds only that, cast at the boundary; the contract-typed `StorageToken` fixtures live in `@keboola/api-fixtures`, which is where a field the backend adds should fail to compile. No published behaviour changes.
+
+- Add a `storage.bootstrap` fixture slice — the three responses a client's ready gate needs before
+  it is usable (`GET /v2/storage`, `/v2/storage/tokens/verify`, `/v2/storage/dev-branches`).
+
+  `getStackInfo()`, `verifyStorageToken()` and `getDevBranches()` are typed by
+  `@keboola/api-client/storage/types`, so a field the backend adds arrives with `pnpm gen:types`
+  rather than being transcribed into every MSW test that bootstraps a client. `getStackInfo()`
+  announces every service by default, which is what keeps a test's queue / data-science / vault
+  client from being a dummy that throws `ServiceUnavailableError`; pass `services` to narrow it.
+
+  `@keboola/api-client` gains a runtime `ServiceId` const in `@keboola/api-client/constants`, with
+  the `ServiceId` type now derived from it. Announcing every service is exhaustive by construction:
+  a service added to the client flows into the fixture without an edit.
+
+  `@keboola/api-client-react`'s test fixtures now come from the slice; its published output is unchanged.
+
+## 31.0.0
+
+### Minor Changes
+
+- Add `URLS.CLIENT_CHATGPT_DOWNLOAD` to `@keboola/api-client/constants`. The connect surfaces send a reader to the ChatGPT app itself now that its plugins view is where the Keboola plugin is installed, so the "do not have it yet?" link needs a download page alongside the existing `CLIENT_CODEX_QUICKSTART`, which points at the Codex CLI docs and is still the right link for the CLI.
+
+- The storage and auth clients reject a successful response that carries an HTML page instead of data.
+
+  Connection serves the storage, management and auth APIs off one host, and answers an expired session with a redirect to the login screen. `fetch` follows it, so the request resolves `200 text/html` — a success as far as the status code goes. `parseData` hands a non-JSON body back as a string, and `createOpenapiFetchClient` asserts its return type (`createFetchClient(...) as FetchClient<Paths>`), so that string reached the caller typed as the endpoint's DTO. Nothing failed at the request; the first Immutable accessor to read the value did, modules away and with no trace of the response that caused it.
+
+  Such a response is now an `HtmlResponseError` (an `ApiError`, with an `isHtmlResponseError` guard), raised where the request completes. HTML on a _failed_ response stays an ordinary `ApiError`: that is a real error page, such as a proxy's 502, and reading it as a broken payload would relabel a transient upstream blip.
+
+  What this buys is diagnosability, not a new recovery path. The user-facing outcome on an expired session is unchanged in kind — a generic error toast — but the error now names the request instead of surfacing as a `TypeError` in an unrelated module.
+
+  The check is opted into per client rather than added to `defaultValidateStatus`, because some APIs do serve HTML from a 200 on purpose: the Swagger documentation pages, and developer-portal's `acceptVendorInvitation`. The management client already guarded this condition; the check it used is now `isHtmlResponse`, shared from the fetch client, and management keeps its own `ManagementClientAuthError` and the session-expiry handling that goes with it.
+
+  Still reachable, and not addressed here: `parseData` returns `null` for a 204 and for an empty JSON body, which the same type assertion turns into a DTO.
+
+- Carry a login MFA challenge's passkey options through `login.withPassword` / `login.withOidc`.
+
+  `mfaChallengeSchema` gained a `webauthn` field, so the serialized `PublicKeyCredentialRequestOptionsJSON` the auth service inlines for a passkey challenge survive parsing instead of being stripped. It is typed `unknown` on purpose: the field sits inside a union the client hard-parses, so validating its shape here would let one unexpected key fail both branches and block sign-in entirely rather than just the passkey path — whoever runs the ceremony validates it instead.
+
+  Also exported: `MFA_METHOD` (`totp` / `webauthn` / `recovery_code`, bound to the generated spec with `satisfies`) and the `MfaChallenge` type, so callers can branch on `mfaType` and `allowedMethods` rather than assuming TOTP.
+
+- kai-agent grows `GET /api/chat/{id}/sandbox/file/download` — the binary counterpart of the `/sandbox/file` text preview, for deliverables the agent renders in its sandbox (a `.docx`, a `.pptx`) that the preview returns as empty `encoding: "binary"` content. Same three-layer path policy as the preview (normalize + ignored-segment filter + parent-listing allowlist, now shared via the extracted `assertListedInParent`/`readFileBytes` helpers), with two download-only tightenings: `.env*` files are refused (a raw env download is a credential-exfiltration primitive even where the text preview stays convenient), and files over a 50 MiB ceiling are refused with 413 rather than silently truncated. Responses are always `application/octet-stream` + `Content-Disposition: attachment` (RFC 5987 for non-ASCII names) + `nosniff`. `api-client` adds the matching `kaiAgent.downloadSandboxFile(chatId, path)` returning a `Blob`, riding the normal fetch pipeline (auth middlewares, refresh+replay) — `parseData` now hands a declared `application/octet-stream` body back as a `Blob` instead of UTF-8-decoding it via `text()`.
+
+  Alongside it, session-token chat binding: `Principal` gains optional `boundChatId`, the jwt host sets it from its `scope_id` claim (which is the chat id its host minted the token for), and a `requireChatScope` middleware on every `/api/chat/{id}*` route (plus `POST /api/chat`'s `body.id`) refuses a token bound to one chat acting on another — previously `scope_id` was attribution only, so a session token for chat A could stop, approve, or browse the sandbox of chat B owned by the same user. The Keboola host never sets the binding (its token id is a Storage token id), so Keboola-host behavior is unchanged.
+
+  Also fixes the sandbox file service's E2B connect to pass `E2B_DOMAIN`, matching the orchestrator — on a non-default E2B domain the file browser previously targeted the wrong control plane.
+
+## 30.0.0
+
+### Minor Changes
+
+- Add passkey (WebAuthn) enrollment for the signed-in admin.
+
+  `@keboola/api-client` gains `api.auth.webauthn` — `getAll()`, `registerOptions()`, `register({ credential, deviceName?, revokeOtherSessions? })` and `remove({ id, revokeOtherSessions? })` over `/v1/auth/webauthn*`. `registerOptions()` widens the spec's free-form `options` object (which the generator flattens to `Record<string, never>`) so callers can read the serialized `PublicKeyCredentialCreationOptions` out of it.
+
+  `@keboola/auth` gains `PasskeyList` — a card listing the admin's registered passkeys with add and remove, host-agnostic like its siblings: the browser ceremony (`navigator.credentials.create()`) runs behind the `onRegister` prop. It reveals the recovery codes once when the passkey enabled the account's first MFA factor.
+
+  `MfaCard` takes a new optional `hasMfaFactor` prop. The card cannot read whether the account has a factor, so it used to offer "Regenerate recovery codes" only in the just-enrolled state — unreachable for an admin whose only factor is a passkey, whose codes are shown exactly once. A host that knows a factor exists (a non-empty passkey list is proof) now unlocks the button up front. Regeneration also actually renders its codes again: it answers `codes`, not the `recoveryCodes` the payload guard read, so a regenerated set was dropped while the server had already invalidated the previous one.
+
+  The create modals in `PasskeyList` and `PatList` no longer dismiss on an outside interaction. A host's step-up prompt is a sibling dialog layer, so cancelling it reached these modals as an outside click — after their in-flight guard had cleared, since Radix defers that decision to the document `click` — discarding the typed name.
+
+- Export `Provider` and `Continent` from `@keboola/api-client/constants` as const objects, not only as types. Both were union type aliases, so a consumer that needed the runtime values — validating that an authored string names a real cloud, say — had to retype the vocabulary and let the two copies drift. They now follow the same const-object-plus-derived-type shape as `Backend` and `AdminRole`, so `Object.values(Provider)` is the single source and `Provider.Azure` is available at call sites. Type-only usage (`provider?: Provider`) is unchanged.
+
+### Patch Changes
+
+- The published tarball now carries a `CHANGELOG.md`, so a consumer can read what changed in a release — breaking changes included — without leaving their `node_modules`.
+
+  It could not simply be added to `files`. This repo is private, so every reference `@changesets/changelog-github` emits is a dead link for anyone reading from npm: PR links, commit SHAs, author handles, and the Linear and cross-repo links that changeset prose carries. Across the publishable packages that came to 490 PR links, 863 commit links, 490 author credits and 102 dependency-bump blocks.
+
+  The published file is generated, not maintained. `scripts/public-changelog.mjs` removes those links ahead of the publish and leaves the prose. An identifier the author typed themselves stays as text — `UT-4009`, `connection#8040` — because it is part of the sentence and, without its URL, resolves to nothing outside Keboola. The repo-side `CHANGELOG.md` keeps every link, because that is how a release gets traced internally. It is rewritten only for the moment the tarballs are packed, then restored — which the release also depends on: `changesets/action` reads each changelog back off disk _after_ the publish command returns, to build that version's GitHub Release body, so without the restore the internal releases would carry the public text. A reference the rules do not cover fails the publish rather than shipping.
+
+  One incidental fix: a hex colour written as `#222529` in changeset prose had been autolinked into a link to issue 222529. Unwrapping restores the colour, so the published notes read as the author wrote them.
+
+- Correct the `QueueJobStatus` documentation: `terminating` **is** a member of the union.
+
+  The generated `JobStatus` enum lists it, but the doc comment claimed it was only a `desiredStatus`
+  value. Reading it that way makes the natural "terminal or killable" split look exhaustive, so a
+  caller waiting for a job to stop treats `terminating` as an end state and continues while the
+  daemon is still shutting the job down. The comment now names it as the third case — neither
+  terminal nor killable — and separates it from the same-named `desiredStatus` value.
+
+  Comment only; no type or runtime change.
+
+## 29.0.0
+
+### Major Changes
+
+- Model job statuses per service and add `jobStatus`.
+
+  The three services that expose jobs use separate status vocabularies, which
+  overlap by label only (`processing` belongs to all three), and the storage
+  client's `JobStatus` conflated them — it carried the queue's nine values, five of
+  which a storage job cannot report. It is replaced by `StorageJobStatus`,
+  `QueueJobStatus` and `QueryJobStatus`, the latter two derived from their specs.
+
+  `jobStatus.storage` / `.queue` / `.query` answer `isRunning(status)` /
+  `isTerminal` / `isSuccessful` / `isFailed` about one job, over that service's
+  `statuses.running` / `.successful` / `.failed` / `.terminal` — so a poll loop or a
+  UI check no longer restates a status list at every call site. A warning queue job
+  counts as successful: the run produced its output and only added a non-fatal
+  notice. `describe(status)` answers all four at once. Spread a group where an array is
+  wanted (an API `status` filter), `named.SUCCESS` gives a status by name, and
+  `isKnown` narrows an untyped string to a status of that service.
+
+  **Breaking:** `JobStatus` is gone from `@keboola/api-client/storage/types`; use
+  the per-service type. `JobResult` and the `storage_job_status` /
+  `excluded_storage_job_status` filters on `GetJobsQuery` are narrowed to
+  `StorageJobStatus`, so a queue-only value such as `terminated` or `cancelled` no
+  longer type-checks against a storage job.
+
+- One poll engine, and a registry of what a client is waiting on.
+
+  `poll` replaces the previous engine and answers with a `PollResult` rather than
+  throwing: `done`, `timedOut`, `exhausted`, `aborted` or `errored`, each carrying
+  the attempt it ended on, the time it took, and the last answer it saw. A caller
+  whose contract is to throw calls `.unwrap()`, optionally with a mapper for an
+  error of its own.
+  - `isDone` becomes `until`, which is also the tick a subscriber reads; `interval`
+    becomes `backoff` (`constant`, `linear` or `exponential`, with jitter and a
+    ceiling, floored at 500ms and bounded by what a timer can hold); `isFailed` has
+    no equivalent — a failure state ends the wait like any other terminal one, and
+    the caller raises the error it deserves.
+  - `timeout` is a deadline rather than a check between attempts: it is linked into
+    the signal `pollFn` receives and raced against the request, so a request that
+    ignores its signal cannot outlast it.
+  - `isRetryable` decides whether a failed request ends the poll or spends an
+    attempt; it defaults to ending, as before.
+  - `poller` is the same poll before it runs, for a caller that starts it later or
+    watches it from elsewhere; `pollRegistry` lists every poll a client has going,
+    and is optional — collecting starts when a client asks for it.
+  - `PollException` is gone, along with `poll`'s result envelope: `{ data }` is now
+    `result.data` on `done`, or `await poll(…).unwrap()`.
+
+  `Result` gains a namespace over the same `{ success, data | error }` shape:
+  `Result.tryCatch`, `Result.tryCatchAsync`, `Result.fromThrowable` and
+  `Result.fromThrowableAsync`, with `createEmitter` beside `createStore` as the
+  half of it that announces.
+
+### Minor Changes
+
+- New **Developer Portal** support for `apps-api.keboola.com` — the backend behind `components.keboola.com`. Paths and types are generated from the published spec (`https://apps-api.keboola.com/docs/openapi.yaml`, now registered in `redocly.yaml`), so `pnpm gen:types` refreshes them like every other client.
+
+  Two layers, matching the rest of the package:
+
+  ```ts
+  // The client plus the session that keeps it authenticated. Start here.
+  import { createDeveloperPortalSdk } from "@keboola/api-client/sdk/developerPortal";
+  // The pure client: one method per endpoint, no state. Enough for every `security: []` operation.
+  import { createDeveloperPortalClient } from "@keboola/api-client/developerPortal";
+  import type { App, Vendor } from "@keboola/api-client/developerPortal/types";
+  ```
+
+  Covers all 58 spec operations across four namespaces — `auth`, `vendors`, `apps`, `admin` — flat inside each, named `get*` / `create*` / `update*` / `delete*` with the noun on the method (`apps.getPublishedApps`, `admin.approveVendor`), matching `management` and `storage`. `createDeveloperPortalSdk` returns `{ api, session }` the way `createKeboola` does, and for the same reason — the credential is stateful. It stays separate from `createKeboola` because apps-api is its own identity domain (its own Cognito pool, its own token trio), so it is absent from `createServiceClients.ts` and never appears on the `api` proxy.
+
+  Three properties worth knowing:
+  - `Authorization` carries the **raw token with no `Bearer` prefix** — the spec's security schemes are `type: apiKey`, so `createBearerAuthMiddleware` is not reusable and the SDK ships its own.
+  - **Two fetch clients.** The authenticated one stamps the id token; the other carries no auth and backs the operations the spec marks `security: []`, plus the four calls that supply their own `Authorization`: `GET /auth/token` (refresh token), `POST /auth/logout` (access token), and `POST /auth/mfa` + `POST /auth/mfa/confirm` (id token, alongside an access token in the body). Those four take the token as an argument, and the SDK binds them from the session, so `api.auth.logout()` needs nothing from the caller.
+  - **The spec is the source of truth.** `types.ts` derives every shape from the generated schema, with no hand-written overlay. Two vendor shapes fall out of that: `GET /vendors` returns `isTrusted` as the raw MySQL tinyint (`VendorListItem`), every other vendor endpoint converts it to a boolean (`Vendor`). Outgoing payloads are no longer validated at runtime — the generated request types replace the zod schemas, which is how every other client in the package works.
+
+  `@keboola/api-fixtures` gains `fixtures.developerPortal` — apps across every publishing state, vendors including a pending `_v`-prefixed one, users, service accounts, and an app change log. Each is `satisfies`-checked against the generated types, so a fixture cannot carry a field the API does not return.
+
+### Patch Changes
+
+- `syncActions.git` no longer demands a `username` alongside an SSH key. The component clones
+  `git@host:path` and never reads one on that path, so a deploy key has none to be sent with —
+  requiring it made the branch and entrypoint listings clone a private repository anonymously.
+  A password still requires its username, which it genuinely cannot authenticate without.
+
+## 28.0.0
+
+### Major Changes
+
+- Move `storage.events`, `storage.files`, `storage.jobs` and `storage.workspaces` onto the OpenAPI
+  client and derive their request and response types from the generated schema, so a field the backend
+  adds arrives with `pnpm gen:types` instead of being transcribed by hand.
+
+  Every path these namespaces hit is in the document, so the generic client is now confined to
+  `storage.buckets`, `storage.tables` and the host-level `healthCheck` — the one storage path the
+  document does not declare. `getStackInfo` moved too. Both clients are the same fetch client at
+  runtime, and every path string, params object and request option is unchanged, so this release is a
+  change of types and signatures rather than of behaviour.
+
+  Each operation now has its own `Path` / `Query` / `Body` alias derived over an inlined
+  `paths['…']`, composed into the `*Input` the method takes. Hand-authored types are left only where
+  the document is wrong or silent, each naming the defect it works around:
+  - `Workspace`, `StorageToken` and `StorageEvent` derive from a new `WorkspaceRaw` / `StorageTokenRaw`
+    / `StorageEventRaw` and override only the fields the document models badly. `Workspace` gains
+    `configurationVersion` and the document's `type: 'file' | 'table'`, which is stricter than the
+    `string` it replaces; `StorageEvent` gains a typed `attachments` and `project`.
+  - `WorkspaceConnection` stays hand-authored: the document's union carries neither `password`,
+    `account`, `port` nor `container`, which a workspace created through
+    `configurationWorkspaces.createConfigurationWorkspace` returns.
+  - `File`, `PreparedFile` and `CreatedEvent` stay hand-authored — no file or create-event operation
+    declares a response body, and no component schema describes one.
+  - Where the document types one id two ways, the aliases normalise to the number the payloads return
+    and the client stringifies for the operations whose segment is a `string`: `fileId` on the detail,
+    tag-create and tag-delete, `jobId` on the job detail, `workspaceId` on the delete, password and
+    public-key operations.
+  - `storage.tokens` no longer reaches into `components['schemas']`, and `CreateTokenBody` picks its
+    arm out of the operation's union by a field only the full request declares.
+
+  `storage.events` exposes only the branch-scoped endpoints. The unbranched twins answer the same
+  payloads and addressing one branch is the narrower request, so `getEvents`, `getEvent` and
+  `createEvent` all call `/v2/storage/branch/{branchId}/events…`. `branchId` is required on both reads;
+  `createEvent` keeps it optional and falls back to `default`, for writers that have no branch to
+  resolve.
+
+  Breaking, by namespace:
+  - **events** — `getEvents` and `getEvent` take a required `branchId`; `getEvents` no longer defaults
+    its argument. `TableEvent` is removed: one `StorageEvent` now types every feed, and the old
+    `StorageEvent` (the create response, keyed by `id` and `createdTime`) is `CreatedEvent`.
+    `GetObjectEventsQuery` splits into `GetTableEventsQuery` and `GetBucketEventsQuery`; `EventPath`
+    and `EventsPath` give way to per-endpoint `GetEventPath` / `GetEventsPath` / `CreateEventPath`.
+  - **files** — `DeleteFileTagPath` names the tag `tagName`, as the document's path segment does, and
+    `deleteFileTag`'s second parameter follows. `FilePath` splits into `GetFilePath`,
+    `DeleteFilePath`, `GetFileContentPath` and `AddFileTagPath`; `AddFileTagInput` is new.
+  - **jobs** — `GetJobPath` names the id `jobId`, as the document does, and `getJob`'s parameter
+    follows. `GetJobsQuery` derives every filter but the two repeatable ones, whose document names
+    carry the `[]` the serializer appends.
+  - **workspaces** — `getWorkspaces` takes `{ branchId }` rather than a positional id. `WorkspacePath`
+    and `WorkspacesPath` give way to per-endpoint paths (`GetWorkspacePath`,
+    `GetWorkspaceObjectsPath`, `DeleteWorkspacePath`, …), and `branchId` narrows from `number | string`
+    to the document's `string`, so the exported `BranchId` and `DeleteWorkspaceQuery` are gone.
+  - **mergeRequests** — `CreateMergeRequestParams` and `UpdateMergeRequestParams` are
+    `CreateMergeRequestBody` and `UpdateMergeRequestBody`, and `updateMergeRequest` takes one
+    `UpdateMergeRequestInput` (`{ id, ...body }`) rather than a positional id plus a body, matching its
+    siblings in `tokens` and `buckets`.
+  - **tokens** — `CreateTokenRequestSchema`, `UpdateTokenRequestSchema` and `ShareTokenRequestSchema`
+    are `CreateTokenSchemaBody`, `UpdateTokenSchemaBody` and `ShareTokenSchemaBody`, matching every
+    other spec-derived body in the client. `getTokenEvents` is new.
+
+- Make the `storage.tables` and `storage.columns` writes branch-aware, and fill the gaps the kbc-ui
+  table migration surfaced.
+
+  Every method whose operation the Storage document declares under `/v2/storage/branch/{branchId}/`
+  now takes an explicit `branchId` and calls that path instead of the unbranched one, so a dev-branch
+  write no longer depends on a caller-side URL rewrite: `createTableAsync`,
+  `createTableDefinitionAsync`, `importAsync`, `deleteTable`, `deleteTables`, `deleteTableRows`,
+  `columns.addTableColumnAsync`, `columns.deleteTableColumnAsync`,
+  `columns.createTablePrimaryKeyAsync` and `columns.removeTablePrimaryKeyAsync`. `updateTable`,
+  `createAliasTable`, `setAliasTableFilter` and `removeAliasTableFilter` stay unbranched — the
+  document declares no branch-scoped variant for them (and for `updateTable` / `createAliasTable`, no
+  operation at all). `exportAsync` is the one exception that _does_ have a branch-scoped path in the
+  document but keeps the unbranched one: export sits outside this migration's scope, so moving it
+  would change behaviour for a flow nothing else here touches. It is called out in place as a
+  follow-up.
+
+  Every `*Input` in `storage.tables` now derives its path parameters from the document with
+  `OpenapiPathType` instead of hand-writing them, and keeps the document's own parameter names, as
+  `columns` already did — so the table id is `id` on `getTable`, `deleteTable`, `deleteTableRows`,
+  `importAsync`, `pullTableAsync` and the two metadata methods, `tableId` on `getDataPreview`,
+  `exportAsync`, `setAliasTableFilter` and `updateTableDefinition`, and the bucket id is `id` on
+  `createTableAsync` but `bucketId` on `createTableDefinitionAsync`. The document is inconsistent and
+  mirroring it is deliberate: a call site stays diffable against the endpoint it hits. `deleteTables`
+  takes `ids`. That caught three
+  paths whose templates had drifted from the document — `createTableAsync`, `exportAsync` and the two
+  `alias-filter` methods — all of which went through the generic client, where the template is not
+  checked. The URLs they build are unchanged; only the placeholder names were wrong. Those four have
+  now moved onto the OpenAPI client, leaving `updateTable` and `createAliasTable` as the only generic
+  calls in the namespace — the two the document has no operation for.
+
+  Signature changes beyond the added `branchId`:
+  - `deleteTable` takes a `DeleteTableInput` (`{ branchId, id, force? }`) instead of a positional id,
+    so a table with aliases or links pointing at it can be dropped the way the API allows.
+    `deleteTables` takes `{ branchId, ids, force? }`.
+  - `removeTablePrimaryKeyAsync` takes `{ branchId, tableId }` instead of a positional id.
+  - `pullTableAsync` and `updateTableDefinition` require `branchId` — it used to default to `'default'`
+    inside the method. A path parameter is part of the URL, so which branch is addressed is the
+    caller's call, not a default the client picks for them.
+  - `deleteTableRows` accepts `allowTruncate`, which the endpoint requires when no filter is given —
+    without it a filterless delete is refused as an `unintendedTruncation` instead of truncating.
+  - `GetTablesQuery.include` accepts `sourceMetadata` and `sourceColumnMetadata`, both of which the
+    endpoint documents and kbc-ui asks for.
+  - `CreateTableAsyncBody` is now derived per variant, each correcting the document the same way the
+    hand-authored file variant already did: `primaryKey` and `distributionKey` are optional
+    comma-separated **strings**, not required `string[]` (the backend rejects an array), and
+    `timestampType` is optional. `CreateTableAsyncFromWorkspaceBody` additionally requires one of
+    `dataObject` / `dataTableName`. Verified against connection's `Storage/Tables/Create/Request`.
+  - `CreateTableAsyncBody` and `TableImportAsyncBody` allow exactly one source key. Both endpoints pick
+    the variant from whichever of `dataFileId` / `snapshotId` / `sourceTableId` / `dataWorkspaceId` is
+    populated and reject more than one ("Only one source can be provided"), which a union of
+    standalone per-variant schemas otherwise permits together.
+  - `deleteTableRows` resolves to `Job<'tableRowsDelete'>` rather than a bare `Job` (which widened to
+    `JobUnion`), so its `results.deletedRows` is typed. The operation joins `JobOperation`.
+  - `TableCreateJob`, `TableExportJob` and `TableImportJob` are no longer exported — the namespace
+    spells every job return `Job<'operationName'>`, as the rest of the storage client already did, and
+    these three were the only aliases used directly. `Job<'tableCreate'>` and friends resolve to the
+    identical types, so this is a rename of the import, not a change of shape.
+  - `sdk.storage.createTable`, `createTableDefinition`, `importFromFile`, `addTableColumn`,
+    `deleteTableColumn`, `createTablePrimaryKey` and `removeTablePrimaryKey` take a single `*Input`
+    object rather than positional ids plus a body, matching `createSnapshot` / `pullTable`.
+
+### Minor Changes
+
+- Add `configurations.rebaseConfigurationToDeleted({ branchId, componentId, configId, version })` — resolves a merge conflict by deleting the configuration (posts the empty `diff` envelope to the same rebase endpoint; the new head version is a tombstone). Closes the "delete resolution not modeled in the SDK" gap left by the `diff`-envelope changeset (connection#8040, DMD-1890).
+
+- `CreateTokenBody.bucketPermissions` is now typed as a map of bucket id to permission, which is what the API actually takes.
+
+  The OpenAPI spec declares `string[]`. Every real caller sends a map: kbc-ui's token form builds one in `tokenEditor/BucketsSelector` and submits it through `toJS()`, and a live create against a stack confirms the map is what the API accepts. The wrong type forced each caller into an `as unknown as string[]` cast, which hid the mismatch rather than recording it — so it is corrected here instead, alongside the two other spec corrections this file already carries for `admin` and `adminOwner`.
+
+  `UpdateTokenBody` shares the shape and moves with it. The integration smoke test's `bucketPermissions: []` becomes `{}` — the same "no bucket access" intent, in the shape the API expects.
+
+### Patch Changes
+
+- Add `URLS.CLI` for the public Keboola CLI product page, alongside the existing `URLS.MCP`.
+
+- Add `URLS.CLIENT_*` entries for the vendor client setup pages (Claude Code, Claude.ai, Claude Desktop, Cursor, VS Code, Codex, Make, Devin Desktop) linked from the connect surfaces.
+
+- Build with tsdown (rolldown) instead of tsup; declarations are emitted by the native TS 7 compiler per entry. Peak build memory drops from ~7GB to ~0.8GB, so the `DTS=false` opt-out and the inflated `--max-old-space-size` are gone — every consumer, including Docker image builds on standard runners, now gets complete declarations. Output layout, `exports` map, and shipped types are unchanged (attw-verified); `build:check` now also fails if any manifest-referenced build output or declaration is missing from the pack.
+
+## 27.0.0
+
+### Major Changes
+
+- `api.storage.bucketListings.getListing` / `getListings` now resolve to the spec's own response shapes
+  — `BucketListingDetail` and `ProjectBucketListing` — instead of a client-built `BucketListing` view
+  model. The mapping that
+  flattened `bigquery.*` up a level, injected `bucketId` and decoded subscribers is gone from the
+  client; **`BucketListing`, `RawBucketListingResponse` and `RawBucketListingRow` are removed** from
+  `@keboola/api-client/storage/types`.
+
+  Both listing endpoints are properly typed in the Storage spec, so the hand-authored `Raw*` types were
+  duplicating it — and they were duplicating it _wrongly_: they declared `bigquery` required where the
+  spec has `bigquery?: … | null` ("present only for BigQuery buckets"), so the mapper's
+  `raw.bigquery.listingId` was an unguarded read that a response without that section would have thrown
+  on. Reading `bigquery` as optional is now the caller's job, which is the point.
+
+  The subscriber codec stays here, because `user:`/`group:`-prefixed IAM principals are the wire format
+  rather than presentation, and the write path already had to know it. `toBackendSubscribers` and
+  `fromBackendSubscribers` are now **exported from `@keboola/api-client/storage`** so a consumer
+  rendering or editing subscribers decodes with the same function the writes encode with:
+
+  ```ts
+  import { fromBackendSubscribers } from "@keboola/api-client/storage";
+
+  const listing = await api.storage.bucketListings.getListing(bucketId);
+  const subscribers = fromBackendSubscribers(
+    listing?.bigquery?.subscribers ?? [],
+  );
+  ```
+
+  `fromBackendSubscribers` keeps skipping entries with an unknown prefix or an empty local part, so a
+  principal type the SDK doesn't model (`serviceAccount:`) reads as absent rather than breaking the
+  whole decode. That is a tolerance a caller now opts into explicitly instead of inheriting from a read.
+
+  `Subscriber`, `CreateBucketListingInput` and `UpdateBucketListingInput` are unchanged: the write
+  methods still take `{ type, email }` and encode on the way out.
+
+- Split `storage.buckets` into four namespaces and fill in the gaps the kbc-ui migration surfaced.
+  - `storage.bucketSharing` — share/unshare/link/unlink plus `sharedBuckets`, and a new
+    `linkBucketAsync` for the link half of `POST /v2/storage/buckets` (which the client could not
+    express before), with the `bucketLink` job type behind it.
+  - `storage.bucketListings` — marketplace exposures and the `bigquery.subscribers` codec.
+    `listListings` is now `getListings`, and `create`/`updateListingAsync` take a single `*Input`.
+  - `storage.bucketExternal` — register, refresh and scheduled refresh.
+  - `storage.buckets` keeps CRUD, owner and metadata.
+
+  Method names are otherwise unchanged, but every method taking a path plus a body or query now takes
+  one `*Input` object, so positional call sites need updating: `getBuckets`, `updateBucket`,
+  `deleteBucketAsync`, `updateBucketOwner`, `shareBucketToProjectsAsync`, `shareBucketToUsersAsync`,
+  `forceUnlinkBucketAsync`, `refreshExternalBucketAsync`.
+
+  Also: `GetBucketsQuery.include` accepts `linkedBuckets`, `UpdateBucketBody` accepts `color`, the
+  `bucketRegister` / `bucketRefresh` jobs carry typed `results` instead of `null`, and
+  `register-guide` takes a plain `path: string[]` and serializes it as the repeatable `path[]` key the
+  API expects. `sdk.storage.getBucketListing` / `listBucketListings` are removed — call
+  `storage.bucketListings.getListing` / `.getListings` directly.
+
+- Make `storage.bucketSharing`'s share/unshare/unlink operations branch-aware — they now hit
+  `/v2/storage/branch/{branchId}/buckets/…` and every one takes a single `*Input` object carrying
+  `branchId`:
+  - `shareBucketToOrganizationAsync({ branchId, bucketId })`
+  - `shareBucketToOrganizationProjectAsync({ branchId, bucketId })`
+  - `shareBucketToProjectsAsync({ branchId, bucketId, targetProjectIds })`
+  - `shareBucketToUsersAsync({ branchId, bucketId, targetUsers })`
+  - `unshareBucketAsync({ branchId, bucketId })`
+  - `forceUnlinkBucketAsync({ branchId, bucketId, linkedProjectId })`
+
+  `sdk.storage.shareBucketToOrganization` / `…OrganizationProject` / `…ToProjects` / `…ToUsers` /
+  `unshareBucket` / `forceUnlinkBucket` follow, each taking the same `*Input` in place of its
+  positional `bucketId` (+ body) arguments.
+
+  `linkBucketAsync` and `sharedBuckets` are unchanged.
+
+  The two stubbed request bodies are also typed from what the API accepts rather than the spec's
+  `Record<string, never>`: `targetProjectIds` is `number[]` and `targetUsers` is `(number | string)[]`
+  (admin ids or e-mails), where both were previously `string[]`.
+
+- `api.storage.configurations.updateConfiguration` now resolves to `{ configuration, syncJobId }`, takes an optional `workspaceId`, and no longer JSON-encodes `configuration` itself.
+
+  Storage syncs a workspace's output mapping in a background job when a configuration update carries a `workspaceId`, and reports that job in an `X-StorageApi-Job-Id` response header. `updateConfiguration` resolved to the configuration alone and discarded the rest of the response, so there was no way to know whether a sync had been enqueued — let alone whether it had landed.
+
+  ```ts
+  const { configuration, syncJobId } =
+    await api.storage.configurations.updateConfiguration({
+      branchId,
+      componentId,
+      configId,
+      configuration: { parameters },
+      workspaceId, // optional; must be linked to this component and configuration
+    });
+
+  // The configuration write is done. The output-mapping sync is not.
+  if (syncJobId)
+    await poll({ pollFn: () => api.storage.jobs.getJob(syncJobId), isDone });
+  ```
+
+  **Breaking:** callers reading the configuration off the result destructure it instead.
+
+  ```diff
+  -const config = await api.storage.configurations.updateConfiguration(input);
+  +const { configuration: config } = await api.storage.configurations.updateConfiguration(input);
+  ```
+
+  `syncJobId` is `null` whenever no `workspaceId` was sent, and also for components outside Storage's sync allow-list, which ignore the parameter entirely — neither is a failed write. A `workspaceId` not linked to the given component and configuration is rejected with 400, before the configuration is written. `'workspaceOutputMappingSync'` joins `JobOperation` for typing the poll.
+
+  `configuration` is sent as the object it is, rather than being JSON-stringified into a string field first. Connection accepts both forms — its request extractor re-encodes an embedded object for exactly these fields — and the object form is the one that keeps `{}` an object instead of collapsing it to `[]`. It also makes update consistent with create, which has always passed the object through.
+
+  `CreateConfigurationBody` gains the optional `configurationId` Storage has always accepted, for callers mirroring an id from elsewhere — the same configuration in another branch, or a fixed id for a first-run flow — instead of letting Storage generate one. `configuration` becomes optional on create too: omitting it creates the configuration empty, which is what a "new configuration" flow with nothing filled in yet does.
+
+- `api.syncActions.gitRepository` is replaced by `api.syncActions.git`, which covers **both** component families that serve a git repository action — the data apps (`git-repository`, settings under `parameters.dataApp.git.repository`) and the dbt transformations (`gitRepository`, under `parameters.git.repo`). Which action name and payload path a call uses is resolved from `componentId`, so a caller no longer picks a method per family:
+
+  ```ts
+  api.syncActions.git.getBranches(input, signal?); // -> GitBranch[]
+  api.syncActions.git.getEntrypoints(input, signal?); // -> GitEntrypoints
+  ```
+
+  The five previous methods (`getPublicGitRepository`, `getPrivateGitRepository`, `getDataAppPublicGitRepository`, `getDataAppPasswordPrivateGitRepository`, `getDataAppSSHKeyPrivateGitRepository`) collapse into `getBranches` because the credential is now a discriminated `auth` union rather than a method name. It keeps the components' own `#`-prefixed secret keys, so it is already the `configData` shape:
+
+  ```ts
+  type GitAuth =
+    | { type: "public" } // the default when `auth` is omitted
+    | { type: "password"; username: string; "#password": string }
+    | { type: "sshKey"; username: string; "#sshKey": string };
+  ```
+
+  `componentId` is a literal union of the ids that serve these actions, not `string` — an unsupported id is rejected before any request. The set is deliberately closed: `listBranches` / `list_branches` / `checkBranches` also exist on unrelated third-party components under a different contract, and those stay on `sendSyncAction`.
+
+  Two constraints the types cannot carry are enforced when parsing. dbt clones over HTTPS with a username and password and has no SSH key field, so `{ type: 'sshKey' }` is refused outside the data-app family. And `getBranches` accepts no `branch` at all: the component feeds one to `git clone -b <branch>`, so a stale or renamed value would fail the very call made to discover the valid branches. `getEntrypoints` does take an optional `branch`, which selects whose revision's files are enumerated; omit it for the repository's default branch.
+
+  `getBranches` resolves to the branch array directly. The components return the list both at the top level and nested under `repository`, and as an object keyed by stringified indices with gaps rather than an array — a PHP array whose integer keys are no longer contiguous serializes as an object. All of those normalise to one array, and the previous `getBranches(repository)` reader is gone. Only `branch` is required on an entry; `sha`, `date`, `comment` and `author` fall back to an empty string, so one commit with no message does not cost the caller the whole list. `GitRepository`, `GitRepositoryBranch`, `GitEntrypoints` and the five `Get*Input` types are replaced by `GitBranch`, `GitEntrypoints`, `GitAuth`, `GetBranchesInput`, `GetEntrypointsInput`, `GitComponentId` and `DataAppComponentId`.
+
+  **New: `ValidationError`, `isValidationError` and `parseOrThrow`.** A `ZodError` no longer escapes the package. Its `message` is `JSON.stringify` of the issue list — over a kilobyte for two problems — so any consumer that renders a caught error's message was putting that blob in front of a user. `parseOrThrow(schema, value)` converts it into a `ValidationError` whose `message` is one line per issue prefixed by its field (`repositoryUrl: Required`), with the structured `issues` kept for inspection rather than display. Every sync-action parse site goes through it; the rest of the package still calls `schema.parse()` directly and can migrate as it is touched.
+
+- Send the rebase request body in the new `diff` envelope (connection#8040, DMD-1890).
+  - **Breaking:** `RebaseConfigurationBody` is now `{ version, diff }` — the resolved content fields (`name`, `description`, `changeDescription`, `isDisabled`, `configuration`, `rows`) move from the top level into a `diff` object (new `RebaseConfigurationDiff` type), mirroring the shape the `/diff` endpoint returns its sides in. Callers of `rebaseConfiguration` must wrap the resolved content: `rebaseConfiguration({ ...path, version, diff: { name, rows, ... } })`.
+  - The backend accepts the new shape only (the old flat body returns a 400) and additionally supports delete resolution via an empty `diff` — not modeled in the SDK types yet.
+
+- Table snapshots move out of `api.storage.tables` into their own `api.storage.snapshots` namespace, matching how every other storage sub-resource is shaped (`columns`, `configurationRows`, `configurationVersions`, …). The delete endpoint was the tell: `DELETE /v2/storage/snapshots/{snapshotId}` is not table-scoped at all, so it never belonged under `tables`.
+
+  Every method is renamed as it moves. The two that only enqueue a storage job pick up the `Async` suffix the package requires of anything returning a `Job`; the reader takes the `get*` prefix the rest of the storage client uses:
+  - `tables.createSnapshot` → `snapshots.createSnapshotAsync`
+  - `tables.deleteSnapshot` → `snapshots.deleteSnapshotAsync`
+  - `tables.loadTableSnapshots` → `snapshots.getTableSnapshots`
+
+  `snapshots.getSnapshot(snapshotId)` is new — it reads a single snapshot off `GET /v2/storage/snapshots/{snapshotId}`, the one snapshot operation the spec documents that the client had no method for.
+
+  Signatures, endpoints and return types of the moved methods are unchanged; only the namespace and the names move. `LoadTableSnapshotsInput` is renamed `GetTableSnapshotsInput` to follow its method. `CreateSnapshotInput`, `CreateSnapshotBody`, `GetSnapshotsQuery` and `Snapshot` keep their names and are still exported from `@keboola/api-client/storage/types`.
+
+  `api.sdk.storage.createSnapshot` — which polls the job to completion — is untouched.
+
+- `api.storage.componentsAndConfigurations` is replaced by four namespaces. It carried 21 methods over four unrelated entities — the name said so out loud, and the factory's own return object already grouped its exports under four comments. Nothing about a call site told you which of the four a line touched.
+
+  **Method names and endpoints are unchanged.** For `components` and `configurations` the migration is a substitution on the namespace segment alone; `configurationRows` and `configurationWorkspaces` additionally rename the configuration path parameter (see below).
+
+  | Was `componentsAndConfigurations.…`                                                                                                                                                                                                                                                                    | Now                                   |
+  | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------- |
+  | `getComponent`, `getComponents`                                                                                                                                                                                                                                                                        | `api.storage.components`              |
+  | `createConfiguration`, `updateConfiguration`, `getConfiguration`, `getConfigurations`, `deleteConfiguration`, `deleteConfigurations`, `restoreConfiguration`, `resetConfigurationToDefault`, `rebaseConfiguration`, `getConfigurationDiff`, `getConfigurationRowDiff`, `searchComponentConfigurations` | `api.storage.configurations`          |
+  | `createConfigurationRow`, `createConfigurationRows`, `deleteConfigurationRow`, `deleteConfigurationRows`                                                                                                                                                                                               | `api.storage.configurationRows`       |
+  | `getConfigurationWorkspaces`, `createConfigurationWorkspace`, `createConfigurationWorkspaceJob`                                                                                                                                                                                                        | `api.storage.configurationWorkspaces` |
+
+  ```ts
+  // before
+  await api.storage.componentsAndConfigurations.getConfiguration({
+    componentId,
+    configId,
+    branchId,
+  });
+  await api.storage.componentsAndConfigurations.createConfigurationRow({
+    componentId,
+    configId,
+  });
+
+  // after
+  await api.storage.configurations.getConfiguration({
+    componentId,
+    configId,
+    branchId,
+  });
+  await api.storage.configurationRows.createConfigurationRow({
+    componentId,
+    configurationId,
+  }); // ← renamed
+  ```
+
+  **`configId` becomes `configurationId` on four namespaces.** Every namespace moved onto the OpenAPI
+  client now takes its path parameters from the generated schema, and the Storage document calls that
+  segment `configurationId`. This affects `configurationRows.*`, `configurationWorkspaces.*`,
+  `configurationMetadata.saveConfigurationMetadata` and all four `configurationVersions.*` methods.
+  `components.*` and `configurations.*` keep `configId`: `ConfigurationPath` is shared with the
+  `scheduler` client, so renaming it there is a separate change.
+
+  `configurationWorkspaces.getConfigurationWorkspaces` additionally requires `branchId`, which the old
+  `ConfigurationPath` left optional. The other methods keep it optional, defaulting to `default`.
+
+  **`searchComponentConfigurations` takes one object instead of two.** Its path and query arguments
+  collapse into a single `SearchComponentConfigurationsInput`, matching every other method in these
+  namespaces:
+
+  ```ts
+  // before
+  await api.storage.componentsAndConfigurations.searchComponentConfigurations(
+    { branchId },
+    { componentId },
+  );
+
+  // after
+  await api.storage.configurations.searchComponentConfigurations({
+    branchId,
+    componentId,
+  });
+  ```
+
+  Two allocations are worth knowing because they are not where the old comment grouping put them. `searchComponentConfigurations` moves to `configurations` rather than `components`: it resolves to `SearchComponentConfiguration[]`, and grouping by what a method returns is what keeps every `components` method resolving to a `Component`. `getConfigurationRowDiff` stays in `configurations` beside `getConfigurationDiff` rather than moving to `configurationRows` — the two share the `ConfigurationDiff*` type family and the same merge-request callers, so splitting them would force those callers to reach into two namespaces to render one diff view.
+
+  Configuration rows get their own namespace instead of folding into `configurations`, which would have left one namespace holding 16 of the 21 methods — the imbalance the split exists to remove. `configurationRows` also matches the sibling naming already in `configurationMetadata` and `configurationVersions`.
+
+  **No type import changes.** The types move with their methods into four per-namespace `types.ts` files, but `@keboola/api-client/storage/types` re-exports all four, so every existing `import type { Component, ComponentConfig, Row, WrDbRow, BackendType, … } from '@keboola/api-client/storage/types'` resolves exactly as before. `CreatorToken` — previously module-private and inlined into both `Row` and `BaseComponentConfig`, which now live in different files — becomes a public export as a consequence; that is additive.
+
+- Fix seven Storage client contracts that the nightly live smoke proved wrong. Three are return types
+  that promised a full configuration where the API answers with a minimal acknowledgement, two are
+  requests the client built wrong, one is a query field the API rejects, and one is a dead method.
+  - `storage.configurations.resetConfigurationToDefault` — was `Promise<ComponentConfig>`, the endpoint
+    answers with an **empty body**. Now `Promise<void>`; re-read the configuration to observe the reset.
+    (It is dev-branch only — the API answers 501 on `default`.) This settles the `UNVERIFIED RETURN`
+    question the namespace split left on the method: the spec was right.
+  - `storage.configurationVersions.rollbackConfigurationToVersion` — was `Promise<ComponentConfig>`, the
+    endpoint answers `{ version }` carrying only the new version number, **as a string** (the same field
+    is a number on `ConfigurationVersion`; the inconsistency is the API's and is now mirrored rather
+    than hidden). Now `Promise<RollbackConfigurationToVersionResult>`.
+  - `storage.configurationVersions.copyConfigurationFromVersion` — was `Promise<ComponentConfig>`, the
+    endpoint answers `{ id }` carrying only the new configuration's id. Now
+    `Promise<CopyConfigurationFromVersionResult>`.
+  - `storage.tables.pullTable` — called the unbranched `/v2/storage/tables/{id}/pull`, which is absent
+    from the Storage document and 404s for every table, because nothing in that path says which branch
+    to pull into. Now `storage.tables.pullTableAsync({ branchId, tableId })`, calling the branch-scoped
+    path the spec does define, moved onto the OpenAPI client with the rest of the migrated operations
+    and renamed per the job-returning `Async` rule in `AGENTS.md`. `sdk.storage.pullTable` keeps its
+    bare name (it awaits the job) but takes the same input.
+  - `storage.configurations.searchComponentConfigurations` — the component filter was named
+    `componentId`, which the API rejects with "This field was not expected"; it is `idComponent`.
+    `include` was typed as an array while the spec types it comma-separated, so the whole query was
+    pinned to `queryArrayFormat: 'comma'` — and that pin then destroyed `metadataKeys`, which the API
+    wants as a real array. `include` is now comma-joined by the client and the pin is gone, so all
+    three narrowing fields work.
+  - `storage.configurations.getConfigurationRowDiff` — **removed**, along with `ConfigurationRowDiff`,
+    `ConfigurationRowDiffSide` and `ConfigurationRowDiffPath`. Its path is absent from the spec and the
+    API answers 404 for every row state, and it was redundant: `ConfigurationDiffData.rows` carries each
+    row's full content, so `getConfigurationDiff` already covers the case.
+  - `storage.buckets.getBucketRegistrationGuide` — the request serialized `path[]` with the default
+    `indices` array format, producing `path[][0]=…&path[][1]=…` for an already-bracketed key, which the
+    API rejected with a 400 ("This value should be of type string"). Pinned to `repeat`, so it now sends
+    `path[]=db&path[]=schema`. No signature change; the call simply works now.
+
+  **Breaking**, in the order you are likely to hit them:
+  1. Code reading `ComponentConfig` fields off the three version/reset results stops compiling. That
+     code was already wrong at runtime — the fields were never in the response, so a read on the two
+     version methods yielded `undefined` rather than raising, and the reset's result isn't an object at
+     all. The break replaces a silent wrong value with a compile error; there is nothing to stage a
+     deprecation on, since the removed fields never existed in a response. Re-read the configuration
+     with `getConfiguration` for its body.
+  2. `tables.pullTable(tableId, signal)` becomes `tables.pullTableAsync({ branchId, tableId }, signal)`.
+     `branchId` defaults to `default`, where a pull is a no-op — pass the dev branch you are pulling
+     into. `sdk.storage.pullTable(input, options)` is the awaiting wrapper and keeps its name.
+  3. `searchComponentConfigurations({ componentId })` becomes `{ idComponent }`. Calls that passed
+     `componentId` were being rejected by the API, so this fixes them rather than changing them.
+  4. `getConfigurationRowDiff` and its three types are gone. Use `getConfigurationDiff` and read
+     `diff.rows`.
+
+  `RollbackConfigurationToVersionResult`, `CopyConfigurationFromVersionResult` and `PullTableAsyncInput` are
+  exported from `@keboola/api-client/storage/types`.
+
+- `api.storage.branches`, `buckets`, `columns`, `tables`, `search` and `stats` move onto the storage
+  OpenAPI client, so request and response types come from the spec instead of being restated as a type
+  argument per call. Where the spec is wrong or absent the types stay hand-authored and are asserted in at
+  one line, so a defect is recorded rather than spread through consumers. Each client file carries a block
+  comment listing what the Storage spec owes, per operation.
+
+  The generic client survives only where the spec declares **no such operation** — a missing endpoint, not
+  a mistyped one: `buckets.updateBucket` (no `put` on `/v2/storage/buckets/{bucketId}`, nor on the branch
+  variant), and `tables.createTableAsync`, `exportAsync`, `pullTable`, `createAliasTable`,
+  `setAliasTableFilter` / `removeAliasTableFilter` and `updateTable`. Namespaces that keep both clients now
+  take the OpenAPI one **first** — `createBuckets(openApiClient, client)`, `createTables(openApiClient,
+client)` — which only affects a caller constructing a namespace by hand.
+
+  ### Metadata is branch-aware
+
+  The six object-metadata methods call `/v2/storage/branch/{branchId}/…` instead of the unbranched path
+  and take a single `*Input`:
+  - `buckets.saveBucketMetadata({ branchId, bucketId, provider, metadata })` /
+    `buckets.deleteBucketMetadata({ branchId, bucketId, metadataId })`
+  - `tables.saveTableMetadata({ branchId, tableId, provider, metadata })` /
+    `tables.deleteTableMetadata({ branchId, tableId, metadataId })`
+  - `columns.saveColumnMetadata({ branchId, columnId, provider, metadata })` /
+    `columns.deleteColumnMetadata({ branchId, columnId, metadataId })`
+
+  A dev branch physically contains only the objects created or pulled into it, so the branch an object
+  lives in is the caller's to supply — reading or writing metadata on a production object through a dev
+  branch is a 404, never a fallback.
+
+  **`tables.saveTableMetadata`'s return type was wrong and is now correct.** It was declared `Metadata[]`,
+  but the endpoint answers `{ metadata, columnsMetadata }` — the table's own records plus the records of
+  any column the payload named. Callers reading the result as an array were reading `undefined`; they now
+  get `TableMetadataResponse` and must pick `.metadata`.
+
+  ### A method that returns a job ends in `Async`
+
+  `AGENTS.md` gains the rule: if the resolved value is a `Job`, the name ends in `Async` — never `*Job`
+  (that names the return type, not what the call does) and never a bare verb, which reads like the work is
+  finished when the promise resolves. The suffix is the only thing at a call site that says "poll this."
+
+  | before                                     | after                                           |
+  | ------------------------------------------ | ----------------------------------------------- |
+  | `branches.createDevBranchJob`              | `branches.createDevBranchAsync`                 |
+  | `branches.deleteDevBranchJob`              | `branches.deleteDevBranchAsync`                 |
+  | `buckets.createListing`                    | `buckets.createListingAsync`                    |
+  | `buckets.updateListing`                    | `buckets.updateListingAsync`                    |
+  | `buckets.deleteListing`                    | `buckets.deleteListingAsync`                    |
+  | `buckets.forceUnlinkBucket`                | `buckets.forceUnlinkBucketAsync`                |
+  | `buckets.refreshExternalBucket`            | `buckets.refreshExternalBucketAsync`            |
+  | `buckets.registerBucket`                   | `buckets.registerBucketAsync`                   |
+  | `buckets.shareBucketToOrganization`        | `buckets.shareBucketToOrganizationAsync`        |
+  | `buckets.shareBucketToOrganizationProject` | `buckets.shareBucketToOrganizationProjectAsync` |
+  | `buckets.shareBucketToProjects`            | `buckets.shareBucketToProjectsAsync`            |
+  | `buckets.shareBucketToUsers`               | `buckets.shareBucketToUsersAsync`               |
+  | `buckets.unshareBucket`                    | `buckets.unshareBucketAsync`                    |
+  | `columns.addTableColumn`                   | `columns.addTableColumnAsync`                   |
+  | `columns.deleteTableColumn`                | `columns.deleteTableColumnAsync`                |
+  | `columns.createTablePrimaryKey`            | `columns.createTablePrimaryKeyAsync`            |
+  | `columns.removeTablePrimaryKey`            | `columns.removeTablePrimaryKeyAsync`            |
+
+  `api.sdk.storage` is deliberately **not** renamed: its wrappers `await waitForJob(...)`, so they resolve
+  the finished resource and the bare name is correct there. `api.sdk.storage.registerBucket` and
+  `api.storage.buckets.registerBucketAsync` now differ by suffix precisely because they differ in what they
+  resolve to.
+
+  ### A method takes one `*Input` object
+
+  Methods that previously spread a path parameter and a body across positional arguments now take one
+  object, composed from the spec's path and body aliases:
+  - **branches** — `updateDevBranch(UpdateDevBranchInput)`,
+    `saveDevBranchMetadata(SaveDevBranchMetadataInput, signal?)`,
+    `deleteDevBranchMetadata(DeleteDevBranchMetadataPath, signal?)` (a `Path`, not an `Input` — a delete
+    has no body)
+  - **columns** — `addTableColumnAsync(AddTableColumnInput, signal?)`,
+    `deleteTableColumnAsync(DeleteTableColumnInput, signal?)`,
+    `createTablePrimaryKeyAsync(CreateTablePrimaryKeyInput, signal?)`
+  - **tables** — `getTables`, `deleteTableRows`, `exportAsync`, `importAsync`, `updateTable`,
+    `createTableAsync`, `createTableDefinitionAsync`, `createAliasTable` and `setAliasTableFilter` all take
+    their `*Input`
+
+  `tables`' `*Input` types name their path parameters `branchId` / `bucketId` / `tableId` rather than
+  taking the spec's own names, because the spec calls the same table id `id` on some paths and `tableId` on
+  others; the namespace had already settled on `tableId`, and matching the document per-endpoint would make
+  sibling methods disagree with each other. `columns` does follow the spec's names, which is why
+  `addTableColumnAsync` takes `id` while its two siblings take `tableId`.
+
+  Methods taking a single scalar and no body keep it positional: `branches.getDevBranchMetadata`,
+  `columns.removeTablePrimaryKeyAsync`, `tables.deleteTable` / `pullTable` / `removeAliasTableFilter`,
+  `snapshots.deleteSnapshotAsync` / `getSnapshot`.
+
+  ### Removed and renamed types
+  - **`mapBranchMetadata` and `BranchMetadata` are gone.** The mapper only converted `timestamp` to a
+    `Date`, and nothing read that field. `branches.getDevBranchMetadata` and `saveDevBranchMetadata` now
+    hand back `BranchMetadataRaw[]`, with `timestamp` as the API's `string` — which also stops a
+    non-serialisable `Date` reaching consumers that put the result into a store.
+  - `CreateDevBranchJobBody` → `CreateDevBranchBody`, since the method is no longer `…Job`.
+  - `DeleteTableColumnQuery` was hand-authored as `{ force?: boolean }`, which is exactly what the spec
+    declares, so it is now derived from it.
+  - `TableImportAsyncBody` and a duplicate spec alias for the same path were collapsed into one.
+
+  ### Spec defects behind the assertions
+
+  Two recur and account for most of them. The generated `JobResponse` is a flat shape with
+  `status: string` while `Job<T>` is a discriminated union over `status` carrying typed `results`, so every
+  job return is asserted whether or not the operation declares a response body. And six bucket operations
+  are invoked with `async: true` but declare `query: never`.
+
+  The rest are per-operation and listed in the client files. The ones worth knowing here:
+  - `POST …/tables/{id}/metadata` declares its body as `CreateTableMetadataRequest`, defined as
+    `Record<string, never>` — an empty object, so it cannot describe the provider plus key/value items the
+    endpoint requires.
+  - Every `{metadataId}` path parameter is declared a `number`, while the id in a response is a `string` on
+    the branch endpoints and a `number` on the object ones — the three cannot all hold. The new
+    `MetadataId` (`string | number`) lets a record round-trip from any of them; the id is interpolated into
+    the URL, so nothing changes on the wire.
+  - Every `/v2/storage/dev-branches` operation declares a single contentless `default` response, so the
+    generated return type is the response envelope rather than a payload; both its request bodies are
+    `Record<string, never>`; and `POST` is declared twice, on `/dev-branches` and `/dev-branches/`.
+  - The add-column request variants omit `basetype` and type `definition.length` as a `number`, where the
+    UI really sends a string (a decimal length is `'38,0'`).
+  - `CreatePrimaryKeyRequest.skipDuplicatesCheck` is required despite a documented `@default false`.
+
+  One response is deliberately **not** asserted: `GET /v2/storage/shared-buckets` is typed
+  `Record<string, never>[]`, so `SharedBuckets` is an empty-object array and `buckets.sharedBuckets()` gives
+  callers nothing useful. Asserting it would have meant inventing a shape.
+
+  ### Still to standardise
+
+  `api.storage.buckets` keeps positional arguments (`getListing`, `createListingAsync`,
+  `shareBucketToProjectsAsync`, `updateBucketOwner`, `refreshExternalBucketAsync` and the rest), and job
+  returns on bare names remain in `tables` (`deleteTableRows`, `pullTable`, `updateTableDefinition`),
+  `workspaces.deleteWorkspaceJob` and `configurationWorkspaces.createConfigurationWorkspaceJob`. Those
+  follow in their own PRs.
+
+- `StorageToken` is now derived from the generated `TokenVerifyResponse` instead of being hand-written, overriding only the fields the spec models badly. 22 of its 26 fields track `pnpm gen:types`, so a flag the backend adds arrives with the schema rather than being transcribed.
+  - **Breaking:** the type gains three required fields — `creatorToken`, `canReadAllProjectEvents` and `canManageDevBranches`. Anything constructing a `StorageToken` literal (test fixtures, mocks) must supply them.
+  - **Breaking:** `description` is now `string | null | undefined`, matching what the API actually returns for a token created without one. Readers that assumed a non-null string need a fallback; this was previously a latent crash the type hid.
+  - `token` is added as optional. `verify` and `refresh` do return the secret, and the old type omitted it entirely. It is optional rather than required because the spec marks it required while its own description says "provided only in specific cases" — tighten once that is confirmed against a live stack.
+  - `expires` is now optional as well as nullable.
+
+  `owner`, `admin`, `adminOwner` and `organization` keep their hand-authored shapes: the spec models the first three as near-empty objects (`adminOwner` as `Record<string, never>`, which types every property access as an error), and `organization.id` conflicts between the two with no consumer to arbitrate it.
+
+  **Breaking: `updateToken` and `shareToken` take a single `*Input` object**, matching `GetBucketInput` and the rest of the package:
+
+  ```ts
+  api.storage.tokens.updateToken({ id, ...body }, signal?);
+  api.storage.tokens.shareToken({ id, recipientEmail, message }, signal?);
+  ```
+
+  The whole tokens client also moves onto the OpenAPI fetch client. Where the generated schema is wrong the call sites cast, with the four defects documented once above `createTokens`: id path params typed `number` though every returned id is a `string`; `UpdateTokenRequest` / `ShareTokenRequest` modelled as empty objects; the update `200` declaring no response body; and the create body marking defaulted fields required. Each cast is written to be deleted as the backend corrects the corresponding part of the spec.
+
+- `api.storage.triggers` moves onto the storage OpenAPI client, so request and response types are
+  inferred from the spec instead of being restated as a type argument per call. Two signature changes
+  come with it:
+  - `listTriggers` is renamed to `getTriggers`, matching the `get*` reader convention the rest of the
+    storage client follows (`getTables`, `getBuckets`, `getTokens`). `ListTriggersQuery` is renamed to
+    `GetTriggersQuery`. Otherwise unchanged.
+  - `updateTrigger` takes a single `UpdateTriggerInput` — `{ triggerId }` merged with the body — rather
+    than `(triggerId, body)`, following the same `*Input` shape as `updateTableDefinition` and
+    `snapshots.createSnapshotAsync`.
+
+  Two spec deviations are hand-rolled, both narrowed to the call site in the client:
+  - `PUT /v2/storage/triggers/{triggerId}` patches only the fields it receives, but the spec marks all
+    five of `UpdateTriggerRequest` `required` — which would force a caller changing a trigger's watched
+    tables to resend `component`, `configurationId` and `runWithTokenId`, and so to overwrite the
+    trigger's token with whatever id it last read. `UpdateTriggerInput` therefore carries a `Partial` of
+    the generated body; the spec's own shape stays exported as `UpdateTriggerRequest`.
+  - The `{triggerId}` path parameter is declared a `number` on both `put` and `delete` while
+    `TriggerResponse.id` is a `string`. The two cannot both hold, and taking the path at face value
+    makes `createTrigger` → `updateTrigger`/`deleteTrigger` fail to compile on the id it just returned.
+    Both methods therefore take `Trigger['id']` and cast the path object, so a fetched trigger round-trips
+    without the caller coercing. The id is interpolated into the URL, so nothing changes on the wire.
+
+  Both casts go away once the Storage spec is corrected and `pnpm gen:types` is re-run.
+
+### Minor Changes
+
+- Add an `apps` client for the sandboxes-service `/v2` App Deployments API, reachable as `api.apps` and as the `@keboola/api-client/apps` + `@keboola/api-client/apps/types` sub-paths. It covers apps (`getApps`, `getApp`, `createApp`, `deleteApp`), the deployment lifecycle (`createDeployment`, `getDeployments`, `getDeployment`, `promoteDeployment`, `deleteDeployment`), the app action verbs (`unpublishApp`, `suspendApp`, `resumeApp`), runs (`getAppRuns`, `getAppRun`), logs for both an app and a single deployment (`getAppLogsTail` / `getAppLogsDownload`, `getDeploymentLogsTail` / `getDeploymentLogsDownload`), the app password (`getAppPassword`, `resetAppPassword`) and the app's Git repository with its credentials (`getAppGitRepo`, `getAppGitRepoCredentials`, `getAppGitRepoCredential`, `createAppGitRepoCredential`, `deleteAppGitRepoCredential`).
+
+  It resolves off the already-advertised `data-science` service and the registry appends `/v2`, the same shape as `omnisearch` on the `ai` service. The `apps.<stack>` host serves the identical routes at its root — it is a vanity alias that strips the prefix — but it is absent from the stack's service index, so nothing can resolve it and no new service id is needed. `createAppsClient` therefore expects a `baseUrl` that already points past the prefix (`https://<data-science-host>/v2`).
+
+  This is a separate client from `dataScience` rather than more methods on it: the two surfaces share path names with different shapes — a `/v2` app carries `production` (`desiredId`/`actualId` and their number twins) and `undeployedChanges` — and `/v1`'s workspace endpoints (`/sandboxes`, `/runtimes`) have no `/v2` counterpart. Note that a `/v2` app carries neither `name` nor `description`: both are create-only and live in the app's Storage configuration, so a list page resolves its labels with one bulk `listComponentConfigurations` call against the `componentId`/`branchId`/`configId` each app points at.
+
+  Three behaviours worth knowing before calling it:
+  - **Creates are not idempotent, and cannot be made so.** The spec still documents an `Idempotency-Key` header that turns a replayed create into a no-op, and the service did honour it — but support was dropped on 17 Aug 2026 and the spec has yet to catch up. It was unusable from a browser in any case: the service's `Access-Control-Allow-Headers` never listed the header, so sending it failed the CORS preflight and the request never left the page. So `createApp`, `createDeployment` and `createAppGitRepoCredential` take no key, every retry is a genuine create, and a caller that retries one owns the duplicate it may produce. That matters most for `createAppGitRepoCredential`, whose one-time `secret` is returned only at creation — a duplicate there is a credential nobody knows the secret for.
+  - **The action verbs resolve to `null` on a no-op.** `promoteDeployment`, `unpublishApp`, `suspendApp` and `resumeApp` answer `202` with the updated app when they change something and `204` when there was nothing to do (already production, already suspended, never deployed), so their return type is `App | null`.
+  - **Log tails keep the `dataScience` shape** — `{ entries, nextLogTimestamp }` — and read "nothing is running" as an empty tail rather than an error, in both scopes: `400 apps.appNotRunning` for an idle app, `400 apps.deploymentNotRunning` for a deployment that isn't the one serving (the normal state of a staged or retired one). The downloads still throw there, matching `/v1` — a caller asking for a file is better off with the error than with an empty one. Runs, by contrast, are returned exactly as the service types them, `state: null` included; `/v1`'s "no state means running" fallback would mislabel a `/v2` run that never started.
+
+  `PATCH /apps/{appId}` and `POST /apps/{appId}/activity` are deliberately not exposed. The former has no patchable field yet (`name`/`description` are create-only, so `{}` is the only accepted body). The latter is apps-proxy's own heartbeat and takes a Manage API token carrying the `apps:proxy` scope, which this storage-token client cannot supply.
+
+  The spec is registered in `redocly.yaml` and pointed at canary (`https://apps.canary-orion.keboola.dev/docs/swagger.yaml`), the only stack that hosts `/v2` today; it is flagged experimental upstream, so shapes may still move. Repoint the root at the production host once `/v2` ships there.
+
+  Two changes outside the new client come with it.
+
+  `OpenapiSuccessType` now prefers a `202` that carries a body over a `204` that carries none. An endpoint declaring both used to resolve its data to `never` and hide the payload; endpoints declaring only one are unaffected. Besides the apps action verbs this also reaches storage's `202`+`204` bucket and file deletes, with no practical effect — those are called through the generic client with explicit type arguments. A `types.test.ts` now pins the precedence for every success-status combination.
+
+  Reading a data app's logs moved into one shared module (`domain/appLogs`) that both sandboxes-service surfaces call: the line parsing, where the next poll resumes, the `apps.appNotRunning` rule and the download's `Content-Disposition` filename now exist once instead of once per client. A tail is also parsed once rather than twice per poll — `parseLastLogTimestamp` used to re-parse the whole log to find its last timestamp, which cost a second pass and a second `LogEntry` array (~1 MB on a 10k-line tail) on the polled endpoint.
+
+- Add `auth.login.methods()` for `GET /v1/auth/methods` — the stack's login-methods discovery.
+
+  It answers what a visitor may sign in with on that stack: `methods` is a union discriminated on `type` (`password` with its `passwordResetEnabled`, `oidc` with its `provider` and public `clientId`, `saml` with its `customerSlug` and `displayName`), alongside `restriction` (`ssoEnforced` / `stackSsoOnly` / `null`), `emailDiscoveryEnabled` and `signUpUrl`.
+
+  The `clientId` is the reason a client needs this: `auth.login.withOidc` takes an `idToken` the browser has to mint against the provider first, and the OAuth client ID to mint it with is per-stack configuration that no other endpoint returns — so without discovery a frontend has to hardcode one per stack.
+
+  Unauthenticated, like the rest of the login surface, so it can be called on a client built for a stack the session is not (yet) pointed at.
+
+  `POST /v1/auth/methods` — the identifier-first narrowing for a given email address — is not wired yet.
+
+- `api.storage.configurations` gains `purgeConfiguration` / `purgeConfigurations`, and `deleteConfiguration` takes an optional `expectedVersion`.
+
+  Permanently removing a configuration used to mean sending `DELETE` twice: the first call trashes it, the second one — because the configuration is already in the trash — purges it. That made destructive intent implicit, so a `DELETE` from a stale view could purge a configuration another tab had just trashed (SUPPORT-16506). Storage now exposes an explicit `POST .../configs/{id}/purge` and accepts the RFC 9110 `If-Match` precondition on both endpoints.
+
+  ```ts
+  // Permanent removal, stated as such — never falls back to a soft delete.
+  await api.storage.configurations.purgeConfiguration({
+    componentId,
+    configId,
+    expectedVersion: config.version, // from the trash listing
+  });
+
+  // Trash a configuration, but only while it is still at the version the user acted on.
+  await api.storage.configurations.deleteConfiguration({
+    branchId,
+    componentId,
+    configId,
+    expectedVersion: config.version,
+  });
+  ```
+
+  `expectedVersion` is the configuration's `version`; the client wraps it into the entity-tag form the API expects. On purge it is mandatory (Storage answers 428 without it) and a configuration that moved on since it was read is rejected with 412 instead of being destroyed. Purge is default-branch only and needs the `canPurgeTrash` token permission. `deleteConfiguration` without `expectedVersion` behaves exactly as before.
+
+- Four configuration-row and configuration-state endpoints join the storage client: `configurationRows.getConfigurationRow`, `configurationRows.updateConfigurationRow`, `configurationRows.updateConfigurationRowState` and `configurations.updateConfigurationState`. All four are branch-aware, take the usual single `*Input` object with `branchId` defaulting to `default`, and forward an optional `signal`.
+
+  The spec stubs every one of these request bodies as `Record<string, never>` and every success response as `content?: never`, so the payloads stay hand-authored and bridge with a cast at the call site, matching the existing `createConfigurationRow` / `deleteConfigurationRow` pair.
+
+  `CreateConfigurationRowBody` widens `configuration` and `state` to `string | Record<string, unknown>` and `isDisabled` to `boolean | number`. Storage accepts both forms and both are in use; the value reaches the wire exactly as passed, since the client never re-encodes it. Existing callers passing objects are unaffected.
+
+- `api.storage.configurationVersions` gains the row-level counterparts of the four configuration-level
+  methods, and `api.storage.configurationMetadata` gains the two reads/writes the spec documents but the
+  client did not expose. Both namespaces now cover their full OpenAPI surface.
+
+  ```ts
+  // Row versions mirror the configuration-level methods, taking a `rowId` alongside the config path.
+  const rowPath = { branchId, componentId, configurationId, rowId };
+
+  const versions =
+    await api.storage.configurationVersions.getConfigurationRowVersions(
+      rowPath,
+    );
+  await api.storage.configurationVersions.getConfigurationRowVersion({
+    ...rowPath,
+    versionId,
+  });
+  await api.storage.configurationVersions.rollbackConfigurationRowToVersion({
+    ...rowPath,
+    versionId,
+  });
+  await api.storage.configurationVersions.copyConfigurationRowFromVersion({
+    ...rowPath,
+    versionId,
+  });
+
+  // Configuration metadata can now be listed and deleted, not only written.
+  const configPath = { branchId, componentId, configurationId };
+
+  const metadata =
+    await api.storage.configurationMetadata.getConfigurationMetadata(
+      configPath,
+    );
+  await api.storage.configurationMetadata.deleteConfigurationMetadata({
+    ...configPath,
+    metadataId,
+  });
+  ```
+
+  Every version response is declared `content?: never` in the spec, so the row-version shapes are
+  hand-authored like the configuration ones and are unverified against a live stack.
+  `deleteConfigurationMetadata` is default-branch only — a dev branch answers 501.
+
+- New `api.syncActions.dbt` namespace, covering the two artifact actions of the dbt transformations:
+
+  ```ts
+  api.syncActions.dbt.compile(input, signal?); // -> Record<modelFile, compiledSql>
+  api.syncActions.dbt.runResults(input, signal?); // -> DbtModelTiming[]
+  ```
+
+  Both read what the configuration's **last run** left behind — neither runs dbt. A configuration that has never run raises a user exception in the component, so it arrives as a `SyncActionError` carrying the sentence that tells you to run it first; render that rather than a message of your own. An absent `compiled` / `modelTiming` key resolves to an empty result instead of failing, because a validation error is nothing a caller can act on; a key that is _present_ with the wrong shape still throws, so a contract change cannot be mistaken for an empty run.
+
+  `input` is `{ componentId, configId, artifacts?, branchId, tag? }`; the `configData` the component expects is built from it (`parameters.configId` plus the configuration's own `artifacts` section, passed through untouched). Unlike the git actions, `componentId` is a plain string: every dbt component serves both actions under the same action name and the same payload, so the id names the component to run and selects nothing.
+
+  `runResults` normalises dbt's `"Thread-1"` worker label to the number consumers position a row by, falling back to `0` for a label it cannot parse rather than dropping the timeline. Timestamps stay ISO strings.
+
+- `sdk.semanticLayer.deleteModel` now settles every child delete instead of failing fast. Previously
+  a mid-cascade child failure rejected with a plain error while an unknown number of children had
+  been (or were still being) deleted behind the caller's back. Now all child deletes run to
+  completion, and a partial failure throws the new `SemanticLayerCascadeDeleteError` (extends
+  `AggregateError`), carrying `modelUUID`, `deletedChildren`, and `failedChildren`
+  (`SemanticModelChildRef` / `SemanticModelChildDeleteFailure`, both newly exported from
+  `@keboola/api-client/sdk/semanticLayer/types`). The model itself is deleted only once its whole
+  child tree is gone, so it never orphans children.
+
+- Add `lazy(task)` — a promise cache for one-shot async init (UT-5029).
+
+  The first call computes; every later call, in flight or long settled, gets that same promise back. It fills the gap next to `dedupe`, which shares only an _in-flight_ run and lets the next trigger start a fresh one:
+
+  ```ts
+  import { lazy } from "@keboola/api-client";
+
+  const getStackInfo = lazy(() =>
+    storage.getStackInfo({ exclude: "componentDetails" }),
+  );
+  await getStackInfo(); // fetches
+  await getStackInfo(); // same promise, no second request
+  ```
+
+  A success is kept forever, but a **rejection is not** — the slot clears, so the next call retries. Lazy init over the network (a stack index, JWKS, feature flags) must not be bricked permanently by one transient 503. Callers that joined the failed run all reject with its error; only a call made _after_ it settles re-runs the task.
+
+  The name is deliberate: across the JS ecosystem (`once`, lodash `_.once`, `p-once`) `once` means "run at most once, ever" — rejection included — so retry-on-failure under that name would fight the convention. `lazy` follows `Lazy<T>`/`AsyncLazy<T>`; `memoize`/`p-memoize` is the arg-keyed cousin, where evicting rejected entries is likewise the norm.
+
+  Additive only — no existing behaviour changes.
+
+- Add an `omnisearch` client, reachable as `api.omnisearch` and as the `@keboola/api-client/omnisearch` + `@keboola/api-client/omnisearch/types` sub-paths. It covers data lineage: `getProjectsLineage` (`GET /v1/lineage/projects`) for project-to-project lineage across an organization, and `getTablesLineage` (`GET /v1/lineage/tables`) for table-, column- and configuration-level lineage within one project, plus the usual `healthCheck`. Both take the endpoint's query parameters (`startingPoint`, `upstream`, `downstream`, plus `project` and `columns` for tables) and an optional `signal`, and return the `{ graph }` envelope unchanged.
+
+  This is a separate client from `ai` even though it shares that service's host. The endpoints belong to `keboola/omnisearch-and-metadata-engine` — a distinct FastAPI deployment (the `omnisearch-service` Helm app) that only appears on the AI host because the ai-service ingress routes `/omnisearch` to it. It publishes its own OpenAPI document at `https://ai.keboola.com/omnisearch/openapi.json`, now registered in `redocly.yaml`, so the client is generated-typed like every other. It resolves off `serviceId: 'ai'` and authenticates with the storage token; the registry appends `/omnisearch` to that service URL, the same shape as the existing `kai-assistant` `/api` override. `createOmnisearchClient` therefore expects a `baseUrl` that already points past the ingress, so a standalone caller passes `https://<ai-host>/omnisearch` rather than the bare AI service URL.
+
+  The graph itself is fully generated-typed: `ProjectsLineage` / `TablesLineage` and the node and edge types behind them (`LineageProject`, `LineageTable`, `LineageConfiguration`, `LineageMetadata`, `LineageBucket`, `ProjectLineageRelation`, `TableLineageRelation`, and the `LineageSource` enum) all come from the service's own OpenAPI document. Read the nullability carefully before consuming a node: `fqid` is the only guaranteed field, because regular Storage tables, external tables and virtual tables each carry a different subset — external tables have `database` / `db_schema` and no `bucket`, and `columns` is populated only when the `columns` query parameter is set. Edges expose both `lineageSources` (an array) and the deprecated singular `lineageSource`, which can additionally be the aggregate `'combined'`; prefer the array.
+
+  Three fields the service returns are missing from its spec — `bucket.backend`, `rowsCount` and `dataSizeBytes`. The node schemas are `additionalProperties: true`, so the values arrive but generate as `unknown`; `LineageTable` declares them and `getTablesLineage` recasts its response accordingly, so consumers don't narrow at every call site. Each declaration can go once the spec catches up.
+
+- Add a `queryService` SDK (`createQueryServiceSdk`, `@keboola/api-client/sdk/queryService`) with `executeQuery` and `waitForJob`, composed on top of the existing `queryService` client the same way `createStorageSdk` composes on top of the `storage` client.
+
+  `createQueryServiceSdk({ queryServiceClient })` — `queryServiceClient` is a `createQueryServiceClient(...)` instance.
+
+  `executeQuery(branchId, workspaceId, body, options?)` submits a query job, waits for it to reach a terminal state, and fetches results for every statement — auto-paginating each statement's results via the client's `getQueryResults` so a result set larger than the API's default page size (500 rows) comes back in full instead of being silently truncated at the first page. `options.pageSize` controls the internal fetch page size (default 5000); `options.maxRows` optionally caps the total rows fetched per statement (default unlimited).
+
+  `waitForJob(queryJobId, options?)` polls the client's `getQueryJob` (via the existing `poll` utility) until the job reaches `completed`, `failed`, or `canceled`. It validates `options.interval`/`options.maxWaitTime` up front, throws the new `QueryJobError` if the job fails (carrying `queryJobId` and the failed statements' ids/errors), and the new `QueryJobTimeoutError` if `maxWaitTime` (default 5 min) elapses first — both exported from the package's top-level `errors` module alongside `isQueryJobError`/`isQueryJobTimeoutError` guards, matching the existing `SyncActionError`/`ValidationError` pattern. The `queryService` client itself is unchanged — still a plain collection of request methods, matching every other client in this package.
+
+  This mirrors the equivalent fix already shipped in the standalone `@keboola/query-service` SDK (see AI-3752) — that package's `getQueryResults`/pagination primitives were the model for `waitForJob`/`executeQuery` here, but this SDK's version reuses the package's own `poll`/`delay` utilities and error conventions rather than reimplementing retry/backoff, and additionally accepts an `AbortSignal` throughout.
+
+- `api.syncActions.looker.testCredentials` registers a project's Looker credentials against
+  `keboola.wr-looker-v2`. The component reports a rejection inside a 2xx body as well as via a
+  non-2xx response, and the method normalises both into a thrown `SyncActionError`, so consumers
+  branch once — on `isSyncActionError`.
+
+- `updateTableDefinition` now models `PUT /v2/storage/branch/{branchId}/tables/{tableId}/definition` as the patch it actually is, and gains the `isDescriptionSystemManaged` flag.
+
+  `displayName` and `columns` are optional on `UpdateTableDefinitionBody`. Both were typed as required, which forced a description-only edit to restate the current display name and synthesise a no-op column patch just to satisfy the type. The server takes any single field (`Assert\Optional` on each, plus a "at least one patch" callback), so `{ description }` is a complete body — and it is accepted for **non-typed tables** too, not just typed ones. Callers that always sent all three keep compiling.
+
+  `isDescriptionSystemManaged: false` marks a description user-authored. Tables default to `true` (system-managed), which lets Output Mapping overwrite the value on the next component run, so anything writing a hand-authored description should pin the flag alongside it.
+
+  The documented length cap was wrong: it is 65,535 for a table description _and_ each column description, not 16,384/1,024. Those two numbers are the backend-native truncation thresholds (Snowflake 16,384, BigQuery 1,024) applied when the description is pushed to the backend COMMENT — Storage itself stores the value in full, so they are not a reason to reject a longer one client-side.
+
+- `OAuthSessionList` renders the OAuth grants an admin has handed out, the counterpart of `SessionList`: applications rather than devices.
+
+  `GET /v1/auth/sessions` gained an `oauthSessions` array next to `sessions` (connection PR #8105), so `api.auth.session.getAll()` now returns an optional `oauthSessions: OAuthSessionItemResponse[]` alongside `sessions`. The field is **optional on purpose**: a stack whose connection predates that endpoint change omits the key entirely, which means "this stack cannot report grants", not "you hold none". Gate the surface on the key being present rather than rendering an empty list, or the page tells the user no application has access when the truth is unknown.
+
+  Each row separates a grant's _binding_ from its _reach_, because they answer different questions. `project` + `tokenId` are what the grant is bound to (both null for a project-less, MCP-style grant); `allProjects` + `projects` are which projects the application can obtain a Storage token for. `projects` is the consented list as stored — it is not intersected with current membership, so a project the admin has since lost access to still appears. `allProjects` renders as a caution badge: that grant follows live membership, including projects joined later.
+
+  The list is read-only. The auth API exposes no endpoint to revoke a grant — the legacy admin page revokes through a Zend-only route keyed on the Storage token — so a revoke button here would be a dead control.
+
+  The auth schema is regenerated from the deployed spec, which also picks up the `/v1/auth/manage-tokens` and `/admin/auth/pkce/project-select` endpoints and an optional `projectScope`/`projectIds` on `api.auth.device.approve()`. `api.auth.mfa.totp.verify()` now takes a validated input and accepts an optional `revokeOtherSessions` (defaulting to the backend's own `false`), so the SDK sends the field explicitly where it previously omitted it.
+
+- Stop handing callers a raw response body typed as the endpoint's DTO.
+
+  `parseData` compared the `content-type` header for exact equality, so `application/json; charset=utf-8` never took the JSON path, and any 200 whose body did not parse — the login page a session-expired redirect resolves to, for instance — was returned as a string typed as the endpoint's response. It only failed much later, wherever the value was first used.
+  - The media type is now parsed properly: `application/json`, a charset parameter, and the `+json` suffix family all count as JSON.
+  - The declared media type is authoritative. A body that declares JSON and does not parse throws, on success and on failure alike, rather than degrading to text; a body declared as anything else (query-service CSV exports, `text/plain` endpoints) is handed back verbatim instead of being sniffed for JSON.
+  - A 200 that declares JSON with an empty body resolves to `null`, like a 204, instead of throwing.
+  - The management client now treats a `text/html` body as `ManagementClientAuthError` ("Your session expired") on every request, not just `/admin/account/session-token`.
+    </content>
+
+- Add semantic-layer scoping to `api.sdk.semanticLayer`: `scope` and `targetProjectIds` pass through the **create** meta, plus `replaceTargetProjects` (grant a `targeted`-scope object to specific sibling projects; an empty list clears every grant) and `promoteToOrganizationScope` (step a project-scoped object up to the organization scope in place, keeping its UUID and revision history). A scope change on an existing object is deliberately NOT part of the update meta: the metastore rejects a PATCH combining scope with name/data, `UpdateMetaObjectInput` encodes that as a discriminated union (content patch XOR scope step-up), and the step-up travels only through `promoteToOrganizationScope`/`replaceTargetProjects`. Also adds `repository.replaceTargetProjects` on the metastore client for the new `PUT /api/v1/repository/{objectType}/{UUID}/target-projects` endpoint.
+
+- Every service client now exposes a root-level `healthCheck()`, so "is this service up?" is one typed call instead of a hand-rolled `fetch`.
+
+  Nineteen clients gained it — `ai`, `auth`, `chat`, `dataScience`, `editor`, `encryption`, `import`, `kaiAgent`, `management`, `notifications`, `oauth`, `queryService`, `queue`, `scheduler`, `storage`, `stream`, `syncActions`, `vault` — and `metastore` already had one. Each resolves with the service's payload when it is up and throws like any other call when it is not. No session is needed: every one of these endpoints answers unauthenticated, so a probe works before login and is unaffected by whether a token rides along.
+
+  Most services answer `GET /health-check` with `{"status":"ok"}`; `stream` answers `text/plain` `"OK"`, and `chat` probes `/ping` instead since its `/health-check` is authenticated. `storage`, `management` and `auth` share one Connection host, so all three probe the host-level `/health-check` — the prefixed variants (`/v2/storage/health-check`, `/manage/health-check`, `/v1/auth/health-check`) don't exist.
+
+  **The payload is not part of the contract.** A 200 means up, a throw means down, so no client invents a response type. Where the service's spec declares the probe path, the method is typed from it: `ai`, `editor` and `import` resolve with `{ status: 'ok' }`, and `chat` with `{ timestamp: string }`. Everywhere else the payload resolves as `unknown` rather than an asserted shape — which is the honest type, because these specs are uneven and, where present, often wrong: `vault` declares the path POST-only though a GET answers 200; `metastore` and `queryService` type the body as a bare `{ [key: string]: string }`; and `dataScience` and `oauth` declare a service-info shape with no `status` field at all, despite really answering `{"status":"ok"}`. A client starts returning a real type once its spec matches what the endpoint actually returns, confirmed by probing it.
+
+  `telemetry` is the one client without the method — it answers 404 on every probe path tried, so it has no liveness endpoint to wrap.
+
+### Patch Changes
+
+- `concurrent` no longer keeps draining its queue after the first rejection. It still fails fast
+  (Promise.all semantics — the returned promise rejects with the first error, and items already in
+  flight run to completion), but items not yet started are abandoned instead of executing detached
+  in the background after the caller has already seen the rejection.
+
+- `concurrent` and `series` now accept a mapper that returns a plain value, not just a promise
+  (`(item, index, arrayLength) => R | PromiseLike<R>`). Runtime behaviour is unchanged — both already
+  awaited whatever the mapper returned — so this only removes the need to wrap a sync result, or a
+  conditional no-op, in `Promise.resolve` to satisfy the type.
+
+- `delay` now detaches its abort listener when the timeout wins the race. `{ once: true }` only
+  removes a listener after the event fires, so every completed delay left one behind on the signal.
+  `poll` hands the same signal to `delay` on every iteration, which meant a long poll accumulated one
+  listener per interval for as long as the signal stayed alive — and made the eventual `abort()` walk
+  all of them.
+
+- Declaration emit is now opt-out via `DTS=false` (default unchanged: on).
+
+  Emitting `.d.ts` files is ~94% of this package's build memory — 5.7GB peak in CI, 7GB locally — because tsup runs a single `tsc` pass over all 52 subpath entries, so every entry's type graph is resident at once. The JS bundling is the remaining ~1%. An `ubuntu-latest` runner has ~7GB of RAM, less what dockerd and buildx hold, which is why `build` grants `--max-old-space-size=8192` and why the `kai-agent` image build was OOM-killed (exit 137) on 3 of 4 canary deploy attempts.
+
+  Setting `DTS=false` drops the same build to 0.37GB and ~2s. `apps/kai-agent`'s Dockerfile now sets it, since nothing in that image consumes declarations: Node resolves only `dist/*.js`, and the app's `build` is a bare `tsup` (esbuild, transpile-only) that never type-checks.
+
+  **Nothing changes for npm consumers, local dev, or publishing** — the default still emits all 156 declaration files. Only a build that explicitly opts out is affected, and only a build that does not type-check may do so: `next build`-style consumers must not set it, because without declarations every type-only export resolves to nothing.
+
+  The flag is declared as `env` (not `passThroughEnv`) in `packages/api-client/turbo.json`, so it participates in this package's cache key and a `DTS=false` caller cannot be served a dts-enabled cache hit. Scoping it to the package config rather than the root `build` task keeps every other workspace's cache key unchanged.
+
+- `configurations.purgeConfigurations` now runs 10 purges at a time instead of inheriting `concurrent`'s default of 2.
+
+  The method exists for the whole-trash case, where the default walked a trash of 60 configurations through 30 sequential round-trips. Callers that previously fanned out per component (a `concurrent` queue each) had a wider window than this by accident; 10 restores the throughput while keeping the peak bounded, which the per-component shape never was.
+
+- `series`' docblock now states that it resolves with the mapped results rather than with the original
+  items. No behaviour change — the resolved value is the one thing a caller has to check per site.
+
+- `createLegacyKeboola` can now bootstrap with a storage token that carries no `admin` block.
+
+  `GET /v2/storage/tokens/verify` omits `admin` for a token created via `POST /v2/storage/tokens`, but `createProject` built its admin feature set eagerly, so the session build threw `TypeError: Cannot read properties of undefined (reading 'features')` and never reached ready. The failure was also silent — `authenticateStorageAsync` awaits `settled()`, which resolves on error too, so nothing rejected and the consumer only saw `The client is not ready`.
+
+  `hasAdminFeature` now answers `false` for such a token instead of throwing. The type still declares `admin` as required, which is correct for every token connection injects; modelling the two token kinds is left for its own change.
+
+## 26.0.0
+
+### Minor Changes
+
+- `SudoBody` is now the `SudoRequest` input schema instead of the generated request-body type. The generated body resolved to `SudoRequest2`, which is derived from the PHP request object's readable properties rather than its `#[OA\Schema]` — so it required every factor field and added a `type` discriminator the endpoint does not accept. `POST /v1/auth/sudo` validates with an `Assert\Collection` (`allowExtraFields: false`, per-field `Optional([NotBlank])`), so the old type described a body that was always rejected with a 400: `type` is an extra key, and a present-but-null field fails `NotBlank`. Pass exactly the one populated factor field.
+
+### Patch Changes
+
+- These packages now ship their `AGENTS.md` usage contract to npm, so external
+  consumers (and their AI agents) can read it at
+  `node_modules/@keboola/<name>/AGENTS.md`, version-pinned to the release they
+  actually installed.
+
+  Previously only `@keboola/design` published its `AGENTS.md`; every other package
+  omitted it from `files`, so instructions that point agents at that path — such as
+  `apps/boilerplate/AGENTS.md` — silently resolved to nothing outside the monorepo.
+  No code or type changes.
+
+## 25.0.0
+
+### Major Changes
+
+- Make the table snapshot and data-preview methods branch-aware. `api.storage.tables.loadTableSnapshots`, `createSnapshot` and `getDataPreview` now call the `/v2/storage/branch/{branchId}/…` endpoints and take a single `*Input` object carrying `branchId` and `tableId`, with `signal` as the trailing argument — the shape `updateTableDefinition` already uses:
+  - `loadTableSnapshots({ branchId, tableId, ...query }: LoadTableSnapshotsInput, signal?)` — the query (`limit`, `offset`) is forwarded; previously none was sent at all.
+  - `createSnapshot({ branchId, tableId, ...body }: CreateSnapshotInput, signal?)`
+  - `getDataPreview({ branchId, tableId, ...query }: GetDataPreviewInput, signal?)`
+
+  `api.sdk.storage.createSnapshot(input: CreateSnapshotInput, options?)` takes the same input.
+
+  `loadTableSnapshots` and `createSnapshot` now go through the typed OpenAPI client, with `CreateSnapshotBody` and `GetSnapshotsQuery` derived from the regenerated storage schema. `getDataPreview` and `deleteSnapshot` stay on the generic client: the swagger declares `query?: never` for data-preview and a single bodyless `default` response for the snapshot delete, so the OpenAPI client cannot express either call.
+
+  The data-preview query type is renamed `GetDataPreview` → `GetDataPreviewQuery`, matching `GetTablesQuery` / `GetSnapshotsQuery` / `GetBucketsQuery`, and now also accepts `fulltextSearch` and `orderBy` — both supported by the endpoint but missing from the storage OpenAPI spec.
+
+  The remaining reads that a dev branch resolves per object are branch-aware too, each taking the same kind of input object:
+  - `tables.getTable({ branchId, tableId }, signal?)`
+  - `buckets.getBucket({ branchId, bucketId, include? }, signal?)` — `include` is new (`columns`, `metadata`, `columnMetadata`, `sourceMetadata`)
+  - `buckets.getBucketOwner({ branchId, bucketId }, signal?)`
+  - `events.getTableEvents({ branchId, tableId, ...query }, signal?)`
+  - `events.getBucketEvents({ branchId, bucketId, ...query }, signal?)` — new method
+
+  `GetTableEventsQuery` is renamed `GetObjectEventsQuery` since both feeds share it, and it is now derived from the schema — so it also carries `sortOrder`, `configurationId`, `runId` and `query`, which the endpoint accepts but the hand-written type omitted. `TableEvent` types the whole event payload (`description`, `context`, `token`, `idBranch`, `uri`, `attachments`, …) rather than only the fields the first consumer needed.
+
+  These five reads go through the typed OpenAPI client. `getBucketOwner` returns the schema's own shape; the others keep their hand-authored response types, because the schema models `metadata`, `columnMetadata`, `bucket`, `definition`, `params`, `results` and `performance` as bare `Record<string, never>`.
+
+  The storage schema is regenerated from the live spec, which also picks up `POST /v2/storage/tables/{tableId}/alias-filter` and its `SetAliasFilterRequest` / `AliasFilterSetResponse` models.
+
+  `deleteSnapshot(snapshotId, signal?)` keeps its signature — a snapshot id is unique across branches, so the API has no branch-scoped variant — but now returns the storage job that performs the delete (`null` when the backend answers with no content) instead of `void`.
+
+- Add a typed `syncActions.apify` namespace, and make every sync action fail as one error class.
+
+  `api.syncActions.apify.getActors(input, signal?)` and `getTasks(input, signal?)` take `{ '#token', branchId, tag?, mode? }` and answer `{ id, name }[]`, with both the request body and the response validated by zod.
+
+  **`SyncActionError`** (guard: `isSyncActionError`) is new. A component reports failure two ways — a non-2xx response, and a **2xx** whose body carries `status: 'error'` (it ran, and said no) — and the client's `validateStatus` now collapses both into it, carrying `message`, `exceptionId`, `code` and the raw `data`. It is a peer of `ApiError`, not a subclass: a component answering `status: 'error'` on a 200 gave a business answer, not a transport failure, so it deliberately does **not** satisfy `isApiError` / `isFetchClientError` — those drive retry and "network problem" handling, and `err.response.status` would read 200 and mislead every status-based branch.
+
+  Breaking:
+  - `sendSyncAction(body, signal?)` → `sendSyncAction(body, options?)`, where `options` is `{ signal?, validateStatus? }`. The per-request `validateStatus` lets a namespace recognise a failure only its own action knows about — `apify` uses it for the `{ timeout: true }` body a slow account answers with on a 200.
+  - `branchId` is now **required** on every sync-action input, and `gitRepository.*` inherits that. Omitting it never changed anything: the service normalises a missing, empty or `null` value to `"default"` and resolves that to the default branch's numeric id — the same id, branch type and downstream context an explicit value resolves to, with no extra lookup either way. Both a numeric id and the literal `"default"` are accepted.
+  - `PostActionsBody` is removed. `syncActionBodySchema` is now the contract the client validates every outgoing `/actions` body against, and `SyncActionBody` is inferred from it; `configData` stays an arbitrary object, with each namespace validating the shape its own action needs. `PostActionsBodyRaw` remains, only for the `openapi-fetch` cast.
+
+  Also: `ValidateStatusFn` is exported from the `fetchClient` entry point, and `ComponentId.APIFY` is added.
+
+## 24.0.0
+
+### Major Changes
+
+- Generate the `api.oauth` types from the OAuth service's OpenAPI document.
+
+  The oauth client predates the service publishing a spec, so it was built on
+  `createGenericFetchClient` with every shape hand-written. The service now serves an OpenAPI 3.0
+  document, which is registered in `redocly.yaml` and generated into
+  `clients/oauth/__generated__/schema.d.ts`; the client moves to `createOpenapiFetchClient<paths>`.
+  Reading the spec against the hand-written types turned up three divergences:
+  - **`branchId` is a filter, not a scope.** `GET /credentials` documents the query parameter as _"Use
+    value `null` to get credentials without branchId"_ — the literal string. Omitting it applies no
+    filter and returns every credential in the project, so a caller that meant "project-wide" and
+    passed no query got the whole project back. `getCredentials` now takes a **required**
+    `CredentialsScope` — `{ scope: 'all' }`, `{ scope: 'branchless' }` or
+    `{ scope: 'branched', branchId }` — so the scope is always stated and a missing branch id is a
+    compile error instead of a silent unfiltered read. Discriminating on the `scope` literal rather
+    than on the presence of `branchId` is deliberate: a flat `string | 'all' | 'branchless'` union
+    would collapse to `string`, turning a typo into a branch-id filter that matches nothing.
+    `GetCredentialsQuery` is gone, replaced by `CredentialsScope`.
+  - **`Credential` was wrong in both directions.** It declared `componentId`, `configurationId` and
+    `data`, none of which the service returns, and omitted `oauthVersion`, `appKey`, `#appSecret` and
+    `#data`, all of which are required by the spec — and all of which kbc-ui already reads off a
+    credential.
+  - **The two create shapes were named backwards.** The `#data`-JSON-string body was called
+    `_createLegacyCredentials`, but that is the shape the current spec documents; the `data`-object
+    body tried first is the pre-spec one. Renamed accordingly. The 422 fallback and its ordering are
+    unchanged, so no stack changes which path it takes.
+
+  Every method now takes a single `*Input` object, matching the convention the storage clients already
+  use (`CopyConfigurationFromVersionInput = Path & Body`): `createCredential(input)`,
+  `getCredential({ componentId, id })`, `deleteCredential({ componentId, id })`,
+  `getCredentials(scope)`. That retires the `(componentId, id)` pairs, where two adjacent strings could
+  be swapped with no complaint from the compiler and a 404 at runtime. `CredentialInput` names the
+  second path segment `id` rather than the spec's `name` — the spec describes it as "Credentials name
+  (authorization ID)" and the resource carries it as `id`, so `name` is a URL-template label rather
+  than the domain term.
+
+  `createCredential`'s payload argument keeps the `{ id, authorizedFor, branchId?, data }` shape,
+  renamed from `CreateCredentialBody` because that name now means the generated `#data` wire shape. The
+  two wire shapes are produced by `encodeCredentialsData(data, 'encrypted' | 'plain')`, so the retry
+  differs from the first attempt by one named argument rather than by a second implementation.
+
+  `OpenapiBodyType` now also infers bodies declared as `application/x-www-form-urlencoded` (the oauth
+  create endpoint declares only that content type). Requests are still sent as JSON, which those
+  services accept.
+
+  Breaking for anyone importing `Credential` and reading `componentId` / `configurationId` / `data`,
+  naming `CreateCredentialBody` as the `createCredential` argument type, or calling `getCredentials()`
+  with no argument — that call now has to say which scope it means.
+
+- **Breaking:** the `@keboola/api-client/assets/types` sub-path is replaced by
+  `@keboola/api-client/assets/schema`. Update any `import type { Post } from '.../assets/types'` to
+  `'.../assets/schema'` — the type is unchanged, it is now inferred from a zod schema rather than
+  hand-written.
+
+  The assets client is the first client whose responses are **validated at runtime** rather than cast.
+  Assets are static JSON published to `ui.keboola-assets.com` with no OpenAPI spec behind them, so the
+  zod schemas in `assets/schema.ts` are the contract: a drifted asset now fails loudly at the boundary
+  instead of surfacing as `undefined` deep in a consumer. `getPublishedChangelogPosts` parses its
+  response, which means a malformed post rejects the call where it previously resolved with a
+  partly-broken object.
+
+  New: `assets.getComponentTemplates(componentId, signal?)` reads
+  `/kbc-ui-templates/{componentId}.json` — the configuration templates that back generic component
+  UIs, previously fetched by a hand-rolled superagent module in `kbc-ui`.
+
+  New: the `fetchFn` escape hatch is now accepted **per request**, not just when a client is
+  constructed — `client.post(url, params, { fetchFn })` swaps the transport for that one call, and an
+  endpoint-level `fetchFn` beats the client-level one. Everything above it is unchanged: the request is
+  built the same way, the middleware chain still wraps the call, and `validateStatus`, response parsing
+  and the `ApiError` / `isAbortError` / `isFetchClientError` contract all still apply. Reach for it
+  when the platform's `fetch` cannot do the job — the resolved transport travels with the request, so a
+  middleware that rebuilds the request context must spread it (`next({ ...ctx, request })`), exactly as
+  it already must for `validateStatus`.
+
+  **Breaking:** both import methods take two arguments now — **what** to import, then **how** to run
+  the request. The positional `file` moves into the input object, and `signal` / `onProgress` share the
+  options bag:
+
+  ```diff
+  - api.import.uploadFile(file, { isPermanent: true, tags }, signal, onProgress)
+  + api.import.uploadFile({ file, isPermanent: true, tags }, { signal, onProgress })
+  ```
+
+  `UploadFileParams` is renamed `UploadFileInput` (it now carries `file`).
+
+  Both inputs are derived from the spec's own multipart fields rather than restated by hand, so their
+  names, optionality and doc comments track the swagger. Two consequences: `uploadFile` accepts
+  `isPublic`, which the spec has always documented and the hand-written type omitted, and a field
+  added upstream appears without a code change. Only `data` is renamed — it is the `File` you pass as
+  `file` — and repeated `foo[]` parts are exposed unsuffixed (`tags`, `columns`), which is what the
+  old hand-written types already spelled.
+
+  New: `onProgress` reports `{ loaded, total, percent }` while the request body uploads. `fetch` cannot
+  observe upload progress across browsers (streaming request bodies are Chromium-only), so when — and
+  only when — `onProgress` is supplied, that single request is dispatched over an
+  `XMLHttpRequest`-backed `fetch` implementation via the `fetchFn` option above. In Node — where there
+  is no XHR — the call falls back to `fetch` and simply reports no progress rather than failing.
+
+  The import client is now generated from the service's own OpenAPI spec
+  (`https://import.keboola.com/docs/swagger.yaml`) and built on `createOpenapiFetchClient`, so its
+  paths and its response type come from the spec instead of hand-written generics. `UploadedFile` is
+  the spec's `FileResource` verbatim — every property is required there, so it keeps the same
+  non-optional fields it always had while the spec's rest (`fileType`, `provider`, `region`,
+  `maxAgeDays`, `isSliced`, `isEncrypted`, `runId`, `runIds`, `creatorToken`) are now typed too.
+  `maxAgeDays` and `runId` are nullable; `runId` / `runIds` are strings, not numbers.
+
+  New: `import.writeTable({ tableId, file, … }, options?)` covers the spec's other operation — a
+  single-request CSV import into an existing Storage table, with `incremental`, `columns`, `delimiter`,
+  `enclosure`, `escapedBy` and `branchId` on the input and the same `ImportRequestOptions` second
+  argument. It returns the spec's `TableResource` verbatim — `transaction` (nullable), `warnings`,
+  `newColumns`, `importedColumns`, `importedRowsCount`, `totalRowsCount` and `totalDataSizeBytes`.
+
+  Multipart endpoints are typable at last: `OpenapiBodyType` resolves an operation whose request body
+  is `multipart/form-data` to `FormData` (previously `never`, so such a path typed as `body?: never`
+  and rejected the only value you can actually send). The generated per-field shape is deliberately
+  not used as the body type — a multipart body is a `FormData` on the wire, and that is what the client
+  forwards untouched. Its complement `OpenapiFormDataType` reports the fields _inside_ that body, with
+  the wire's repeat suffix stripped (`'tags[]'?: string[]` → `tags?: string[]`), so a client can build
+  its input type from the spec.
+
+- The management client is now typed entirely by its OpenAPI schema and covers the whole manage API.
+
+  **Fixed — every admin-feature call keyed by email was sending a mangled path.**
+  `users.addUserAdminFeature` / `removeUserAdminFeature` called `encodeURIComponent` on the email, but
+  `createPath` already percent-encodes every path parameter, so it went out encoded twice:
+  `a+b@keboola.com` became `a%252Bb%2540keboola.com` instead of `a%2Bb%40keboola.com`. The manual call
+  is gone. Anything toggling an admin feature by email rather than numeric id was affected.
+
+  `features`, `projects` and `users` were the last sub-clients on `createGenericFetchClient`, where the
+  path is an untyped `string` and the response type is whatever generic argument the author wrote. All
+  three moved to the OpenAPI client, which caught two response-type mismatches the generic client had
+  been hiding:
+  - `POST /manage/projects/{projectId}/users` answers **204 No Content**, so `addProjectUser`'s
+    `Promise<User>` was a lie.
+  - `addProjectFeature` / `moveProject` / `setProjectDisabled` / `updateProject` return the _base_
+    `ProjectResponse`, not the detail — hence the new `ProjectBase` type.
+
+  Two path templates were also corrected — `/manage/features/{featureId}` → `{id}` and
+  `/manage/users/{userIdOrMail}/features/{feature}` → `{idOrEmail}/features/{featureName}` — but those
+  are internal parameter names: `createPath` substitutes `{key}` from whatever object the method passes,
+  so both spellings always produced the same URL. No request changed because of them.
+
+  **New:** 42 of the endpoints the schema declares that had no client method, so a consumer no longer
+  needs a release of this package before it can call one. Per group: projects 6, project-templates 4,
+  maintainers 8 (including 6 SAML), file storage 9 (create / rotate-credentials / set-default across
+  s3, abs, gcs), storage backends 6, users 4, current-user 1, plus a new `api.management.uiApps`
+  namespace with 4.
+
+  Fourteen declared operations are deliberately **not** exposed, each commented where a reader would look
+  for the missing method:
+  - `/manage/internal/auth-bridge/*` — internal token exchange, not client-facing.
+  - `POST /manage/current-user/session-token` — the management auth middleware owns minting and
+    refreshing this token.
+  - `/manage/commands`, `/manage/kubernetes-service-accounts` — ops surface.
+  - `/pay-as-you-go/top-up/try` — billing, and not a `/manage` path.
+  - All three feature writes — features are provisioned by migration; `POST` is deprecated upstream and
+    `PATCH`/`DELETE` edit a definition every project on the stack shares.
+  - `POST /manage/projects/{projectId}/tokens` — mints a Storage token; Storage tokens belong to
+    `api.storage.tokens`, where the permission model is visible at the call site.
+  - `POST /manage/projects/{projectId}/storage-backend` and its `DELETE`, plus
+    `POST /manage/projects/{projectId}/file-storage` — provisioning a project's infrastructure, not a
+    project setting.
+  - `POST /manage/projects/{projectId}/credits` — grants pay-as-you-go credits; a billing operation.
+
+  **Breaking:**
+  - `addProjectUser` resolves `null` instead of `User`. The endpoint returns an empty body; read the
+    member back with `getProjectUsers` if you need it.
+  - `addProjectFeature`, `moveProject`, `setProjectDisabled` and `updateProject` resolve `ProjectBase`
+    rather than `Project`. `Project` (the `GET /manage/projects/{projectId}` detail) adds
+    `organization`, `fileStorage`, `backends`, `timezone` and `usersCount`; if you read one of those off
+    a write's result, follow with `getProject`.
+  - `setProjectMetadata`'s `provider` is `'user' | 'system'`, not `string`.
+  - The `GenericFetchClient` type alias is no longer re-exported from `@keboola/api-client/management` —
+    nothing in the management client uses it any more. The `createGenericFetchClient` factory is
+    unaffected and still exported from the package root.
+
+  Types follow the package's existing Path / Body / Input convention: `XPath` and `XBody` derived via
+  `OpenapiPathType` / `OpenapiBodyType`, combined into `XInput`. The 19 pre-existing methods that
+  carried inline `{ projectId: number } & XBody` signatures were converted too, so no inline object
+  types remain in the sub-clients. Where the schema names a parameter `id` while the public argument is
+  the explicit `organizationId` / `maintainerId` / `id`, the Path type stays hand-written so call sites
+  don't have to rename anything.
+
+  Where the swagger under-models a response it is overridden with a documented `Omit<…> &` rather than
+  adopted verbatim — `fileStorage` is declared S3-only, `backends` lists only `snowflake`, `usersCount`
+  is absent, and the invite / change-role enums omit the SOX roles (`productionManager`, `developer`,
+  `reviewer`) the API really accepts. `CreateProjectInvitationBody` gained `expirationSeconds`, which
+  the schema documents and the hand-written type had omitted.
+
+### Minor Changes
+
+- `UpdateBucketOwnerBody.id` is now `number` instead of `string | number`. The endpoint validates `id` as an integer, so a string id was always rejected with a 400 at runtime — the wider type only hid the mismatch from TypeScript.
+
+- Guard the configurations SDK with permission checks. `api.sdk.configuration.createConfiguration` / `updateConfiguration` now call `assertCanCreateConfiguration` / `assertCanUpdateConfiguration` before any side effect, throwing `PermissionDeniedError` for a caller whose token can't write to the target branch (dev-vs-production derived from the input `branchId`). Adds `canUpdateConfiguration` / `assertCanUpdateConfiguration` to `@keboola/api-client/domain/permissions`.
+
+### Patch Changes
+
+- Correct the `ClientContext` doc comment describing `stack.host`. It called that field "a bare
+  hostname the stack reports about itself in its index response", which reads as a stack hostname —
+  it is not. The Storage API index's `host` is the API pod that served the request
+  (`connection-api-756b66f7c8-ql5sr`) and differs between two calls to the same stack. The comment
+  now says so and points at `STACKS` (`@keboola/api-client/constants`) for the actual hostname.
+
+  Comment only — no runtime or type change. Shipped as a patch because the text reaches consumers in
+  the published `.d.ts`, and taking that field for a hostname is a live bug it should stop recurring
+  (see the kbc-ui announcement-targeting fix).
+
+## 23.0.0
+
+### Minor Changes
+
+- Add bearer account-security auth methods for the standalone account app: `auth.password.change`, and TOTP enrollment under `auth.mfa.totp` (`setup`, `verify`, `disable`).
+
+- Regenerate the kaiAgent client schema against the current kai-agent OpenAPI spec. `GET /api/usage` now reports `messagesLimit: number | null` — `null` means the deployment enforces no monthly cap, so clients render "unlimited" instead of a number. The snapshot also picks up additive drift since the last refresh: `tableContext` and `toolRestrictions` on `POST /api/chat`, `supportsApprovalRequestedEvent`, `contextWindow` on chat detail, and the `/api/skills` endpoint.
+
+- Add the manage Users surface to the management client: `getUsers` (paginated list with `q`
+  name/email search and per-user organization/project/maintainer counts), `getUser`,
+  `getUserOrganizations`, `getUserProjects`, `getUserMaintainers` (membership sub-resources),
+  `grantSuperAdmin`, `removeSuperAdmin`, `disableUserMfa` and `deleteUser`. The list, membership and
+  grant endpoints ship with connection#8009; the calls 404 against stacks that predate it.
+
+- Regenerate the notification service types against the corrected upstream spec.
+
+  The generated `api.notifications` types previously did not describe the real wire contract, and were
+  patched by hand in `clients/notifications/types.ts`. The notification service has since published a
+  fixed OpenAPI document, so every one of those corrections is now resolved at the source:
+  - **`recipient.channel`** was typed `'RecipientChannel_Email' | 'RecipientChannel_Webhook'` because
+    the `oneOf` declared `discriminator.propertyName` without a `mapping`, which makes
+    openapi-typescript substitute the schema name. The spec now carries the `mapping`, so `'email'` and
+    `'webhook'` are generated correctly.
+  - **`filters[].operator`** (`'==' | '>='`) is now documented and generated. `filters[].field` and
+    `filters[].value` also became `required`, matching what the service actually demands.
+  - **`projectId`** has been dropped from the subscription schema entirely — the service resolves the
+    project from the authorization token, which is what consumers already relied on.
+  - **`ProjectSubscription.id`** is now `required` rather than optional, so
+    `deleteSubscription(subscription.id)` no longer needs a non-null assertion.
+  - **`subscriptionId`** path parameters were declared `type: integer` while ids are `NumericString` on
+    the wire, so `ProjectSubscription['id']` could not be passed back into `getSubscription` /
+    `deleteSubscription`. They now reference `NumericString`, and the client no longer coerces with
+    `Number()`.
+
+  Every exported type is now derived from the generated schema — `clients/notifications/types.ts`
+  contains no hand-written shapes and no corrections, and the client carries no type assertions.
+
+  Adds `createSubscriptions(bodies, signal?)` and `deleteSubscriptions(ids, signal?)`, which fan out
+  one request per subscription with a concurrency limit — the service has no bulk endpoints. Mirrors
+  the existing `storage.tables.deleteTables` / `storage.workspaces.deleteWorkspaces` shape, so
+  consumers don't re-implement the fan-out (and don't reach for bluebird to get a concurrency cap).
+
+  This is a compile-time break only for code that worked around the old, wrong types — code passing the
+  synthetic `'RecipientChannel_Email'` literal, or supplying `projectId`. Runtime behavior is unchanged.
+
+- Add `api.scheduler.deleteSchedulesForConfigurations(configurationIds, signal?)` — a bulk companion to
+  the existing single-configuration `deleteSchedulesForConfiguration`. It fans the deletes out with the
+  package's `concurrent` utility at a fixed concurrency of 3, mirroring
+  `api.storage.workspaces.deleteWorkspaces`, and resolves `void`.
+
+  Additive only — no existing method changes. Callers that were hand-rolling a `concurrent` /
+  `Promise.map` loop over `deleteSchedulesForConfiguration` (and picking their own concurrency) can drop
+  that and call this instead. Note it fails fast like `Promise.all`: the first rejected delete rejects
+  the whole call, and deletes already in flight are not rolled back.
+
+- Add `assets.getAnnouncements()` — fetches the static in-platform announcements feed
+  (`/platform-announcements/announcements.json`) from the assets host. The response is
+  deliberately typed `unknown`: the feed is hand-authored outside the repo, so the consumer owns
+  runtime validation and decides how to treat malformed entries.
+
+### Patch Changes
+
+- Add `isKaiSettingsWriterRole`, `canWriteKaiSettings` and `assertCanWriteKaiSettings` to
+  `@keboola/api-client/domain/permissions`.
+
+  `canWriteKaiSettings(token)` is `token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role)`
+  and is true only for the `admin` and `share` roles. It gates writes to Kai's project-wide custom
+  instructions, which are injected into the system prompt of every project member — `developer`,
+  `reviewer`, `productionManager`, `readOnly`, `guest` and any role added upstream are denied, as is any
+  limited (non-master) token.
+
+  The role predicate is an allowlist and takes the raw role string, so a caller holding an unparsed
+  `tokens.verify()` response can use it without constructing a `StorageToken`.
+
+- Internal: the `STACKS` registry and its types (`KeboolaStack`, `Provider`, `Continent`) move out of
+  `constants/index.ts` into `constants/stacks.ts`, so consumers of any other constant no longer pull the
+  whole table in. Re-exported from the barrel — the `@keboola/api-client/constants` surface is unchanged
+  and no import needs updating.
+
+## 22.0.0
+
+### Minor Changes
+
+- Expose the configured stack on the client context as `api.context.baseUrl`. The SDK already held the
+  absolute URL every request is built on (injected via `session.setBaseUrl()` / the `baseUrl` option),
+  but it was only readable through `session.debug()`. It is now a first-class context field, canonical
+  form (absolute, no trailing slash — normalized with the same `normalizeBaseUrl` used at the
+  `baseUrl + path` join). No runtime behavior changes.
+
+  `ClientContext` is exported from the package root and gains a **required** property, so while this is
+  additive for the normal read path (`api.context.baseUrl`), it is a compile-time break for any
+  downstream code that _constructs_ a `ClientContext` value — hand-rolled test mocks, most likely. In
+  practice that is unlikely: the type is what `api.context` hands you, and building one already requires
+  the internal `createStack` / `createDefaultBranch` / `createStorageTable` return shapes. If you do
+  mock it, add `baseUrl`.
+
+  Prefer it over `api.context.stack.host` when you need a URL: `stack.host` is a bare hostname the
+  stack reports about itself in its index response and is never used to route a request.
+
+- Add the remaining queue endpoints to `api.queue`: `createJob` (`POST /jobs`), `killJob` (`POST /jobs/{jobId}/kill`), `searchGroupedJobs` (`GET /search/grouped-jobs`) and `getOrchestrationRerunPlan` (`GET /orchestration-rerun-plan/{jobId}`).
+
+  `SearchJobsQuery` also accepts `parentRunId` — the queue swagger omits it from `/search/jobs` although the API supports it.
+
+  Add `api.queue.searchAllJobs(query, signal?)`, which pages through `/search/jobs` and returns every match. `query.limit` keeps its documented meaning — items per page — while `offset` is omitted from the query type, since the traversal owns it.
+
+  Add the `collect` async utility behind it, which gathers items from an offset-paginated endpoint — up to `limit` of them, or all of them when `limit` is omitted. It hands `pageSize` to the fetch callback and ends on a page shorter than that; without a `pageSize` it ends only on an empty page, at the cost of one extra request.
+
+- Add the `auth.password` sub-client for the forgot-password flow:
+  - `auth.password.resetRequest({ email })` — request a reset token by e-mail
+    (`POST /v1/auth/password/reset-request`; always resolves, reveals nothing about
+    account existence).
+  - `auth.password.reset({ token, newPassword, revokeSessions? })` — set a new
+    password with the emailed reset token (`POST /v1/auth/password/reset`).
+
+  Input schemas (`resetRequestInputSchema`, `resetInputSchema`) are exported from
+  `@keboola/api-client/auth`, matching the existing `login`/`mfa` sub-clients.
+
+- Add `session.clearProject()` to the bearer flow — the inverse of `setProject`, for leaving a project without signing out.
+
+  The credential is untouched, so no refresh is triggered; only the project scope drops. The project clients are keyed on that scope, so they tear down and the storage build returns to `idle`, which means a consumer gating on `isStorageReady()` falls back to its project picker while `auth` and `management` stay usable. The persisted session is rewritten with `projectId: null`, so a reload lands on the picker rather than re-entering the project. `reset()` remains the way to sign out.
+
+  No-op unless the session is currently scoped.
+
+- Add shared semantic-layer primitives to `api.sdk.semanticLayer`, so consumers stop re-deriving them.
+  Purely additive — no runtime behavior changes, nothing removed or narrowed.
+
+  **Two new methods:**
+  - `listModelChildren(modelUUID, signal?)` — every child object of a model across all five types,
+    flattened, each with its user-facing name. This is the fan-out `deleteModel` already performed
+    internally, now callable: a caller can say what a delete _would_ destroy before asking the user to
+    confirm it. `deleteModel` is refactored to use it, with identical behavior.
+  - `findObjectsByName(objectType, name, modelUUID, signal?)` — resolve a child object by the name a
+    user would type. Returns **every** match rather than one, because a name is not unique: an agent
+    can treat that as an ambiguity error while a UI can render a picker. Glossary entries key on
+    `term`, so both are matched.
+
+  **New runtime constants** for values the metastore validates but the types leave wide:
+  `SQL_DIALECTS` (`'Snowflake' | 'BigQuery'`), `CONSTRAINT_TYPES`, and `MODEL_CHILD_OBJECT_TYPES`
+  (previously module-private).
+
+  **New zod schemas** — `semanticModelSchema`, `semanticDatasetSchema`, `semanticMetricSchema`,
+  `semanticRelationshipSchema`, `semanticGlossarySchema`, `semanticConstraintSchema`, plus
+  `SEMANTIC_CHILD_OBJECT_SCHEMAS` keyed by object type. For callers that accept untrusted or
+  hand-authored payloads (an agent tool call, a form) and want a useful error instead of the
+  metastore's opaque "Validation failed". Each declares only the fields the SDK types mark required and
+  is a `looseObject`, so unknown fields pass through untouched — the metastore stays the source of
+  truth for the full schema. **The SDK does not parse on its own writes**, so existing callers are
+  unaffected.
+
+  Worth knowing if you write models directly: `sql_dialect` is snake_case and accepts exactly
+  `'Snowflake'` or `'BigQuery'`. Anything else — camelCase key, lowercase value, `Redshift` — is a 422
+  that names neither the field nor the accepted values. `SemanticModelData.sql_dialect` stays typed
+  `string` here (narrowing it would break callers passing a `string` variable); validate with
+  `semanticModelSchema` or `SQL_DIALECTS` instead.
+
+### Patch Changes
+
+- Refresh the generated OpenAPI types across the ai, chat, dataScience, management, queryService, queue, storage, syncActions and vault clients. No runtime behavior changes — types only.
+
+  Additive: `api.queue.createJob` accepts `delayedStartTime` and `delay`; `api.ai.getComponentDetail` returns `synchronousActions`; `api.storage.triggers.listTriggers` widens a field to nullable; storage request bodies are typed rather than opaque; query service documents a 504 response.
+
+  Two removals are compile-time breaks for anyone reading them, both for endpoints/fields the platform no longer serves:
+  - `api.ai.feedback` no longer accepts `subject: { type: 'conversation', conversationId }` — the `/conversations/*` endpoints are gone from the AI service. The `component-suggestions` arm is unaffected.
+  - The data app shape behind `api.dataScience.createApp` / `getApp` / `getApps` / `patchApp` / `resetAppPassword` drops the required `provisioningStrategy: 'jobQueue' | 'operator'` field, following the data science API's v2 schema.
+
+- Validate the `GET /vote` response in the chat and kai-agent clients. `getVotes` returned whatever the
+  transport parsed, so a 200 carrying a non-JSON body (proxy error page, truncated payload) resolved to
+  a **string** typed as `Vote[]` — and the first `.find()` on it threw `TypeError: n.find is not a
+function`, taking the whole Kai chat panel down through the error boundary. The response is now parsed
+  with zod and a malformed payload rejects with `Invalid votes response format`, the same shape the
+  neighbouring `getSuggestions` / `getAgentSettings` calls already use.
+
+- Regenerate the auth OpenAPI schema from the production spec. Additive schema
+  refresh — no new client methods (those land with the features that consume them).
+
+  New typed paths:
+  - Password reset/change — `/v1/auth/password/reset-request`, `/reset`, `/change`
+  - MFA TOTP enrollment — `/v1/auth/mfa/totp`, `/totp/verify`, `/totp/{id}`
+  - PKCE authorize — `/admin/auth/pkce/authorize`
+
+  Surface change: `auth.sudo.verify`'s request body gains a `password` field
+  (`string | null`, required-nullable — the same shape as its sibling `totpCode` /
+  `recoveryCode` / `webauthnAssertion` fields), reflecting that the endpoint now
+  also accepts an account password for MFA-less accounts. No in-repo callers today.
+
+- `semanticLayer.listModelChildren` now labels each child with its display name — a constraint's `displayName` in preference to its `name`, matching what the semantic-layer tables render. Lookup via `findObjectsByName` is unchanged and still addresses objects by their unique `name`.
+
+## 21.0.0
+
+### Major Changes
+
+- Reshape the SDK lifecycle around two authentication flows behind one product surface.
+  - **Breaking:** the entry points are now `createKeboola()` (bearer / OAuth) and `createLegacyKeboola()` (legacy SAPI + management token). Each returns `{ api, session }` — `api` is the flow-agnostic product surface (`auth`, `management`, `storage`, `queue`, `context`, `sdk`, …); `session` is the flow-specific lifecycle (bearer: `authenticate(credential)` → `setProject(id)`; legacy: `authenticateStorage(sapiToken)` / `authenticateManagement(manageToken)`). The old `createApiClient()` / `init()` lifecycle and the `ApiClient` type are removed.
+  - **Breaking:** per-service factories take an `auth` strategy instead of a bare token — `createStorageClient({ baseUrl, auth: { type: 'sapi-token', token } })`, `createManagementClient({ baseUrl, auth: { type: 'management-token', token } })` (bearer: `{ type: 'bearer', token }`). `createManagementClient` keeps `withAuthMiddleware` (default `true`; pass `false` for a raw validity-check client).
+  - `@keboola/api-client-react` exposes three providers: `ApiClientProvider` (propagates `api` to `useApiClient()`), `LegacyAuthProvider` (drives the legacy session to ready and gates on a fallback), and `AuthProvider` (bearer; finished with the login flow in a follow-up). `useApiClient` / `useProject` / `useStack` return the `api` surface.
+  - **Breaking:** the token-less public clients `assets` / `status` are not part of the keboola client — import `createAssetsClient` / `createStatusClient` from `@keboola/api-client/assets` and `@keboola/api-client/status`. `metastore` is a stack-discovered service, exposed as `api.metastore`.
+  - `KeboolaError` / `isKeboolaError` are exported from the package root and are the errors the client actually throws (lifecycle gating: `NotReady`, `Unconfigured`, `NoManagementToken`, …).
+
+  Migration: `const api = createApiClient(); await api.init(opts)` → `const { api, session } = createLegacyKeboola(opts); await session.authenticateStorageAsync(token)` (or `createKeboola` for the bearer flow). Per-service: `createStorageClient({ baseUrl, token })` → `createStorageClient({ baseUrl, auth: { type: 'sapi-token', token } })`.
+
+- Surface configuration rows in the config diff and send them back on rebase.
+  - `ConfigurationDiffSide.diff` now carries a typed `rows` array (`ConfigurationDiffContent` / `ConfigurationDiffRow`) — additive on the diff response.
+  - **Breaking:** `RebaseConfigurationBody` gains a **required** `rows` field (`RebaseConfigurationRow`). Callers of `rebaseConfiguration` must now pass the resolved row set — the backend requires it for a keep rebase and reconciles rows by id (id in base → update, id absent/missing → create, base row absent from the request → delete). `[]` deletes all rows; array order is the row sort order.
+
+### Minor Changes
+
+- Add `api.management.projects.getProjectTemplates()` (`GET /manage/project-templates`) and export the `ProjectTemplate` type from `@keboola/api-client/management/types`. Returns the list of available project templates (id, name, description, …).
+
+- Add durable bearer session persistence, built on a new reusable persistor.
+  - **`createPersistor`** — a durable key/value cell over a minimal synchronous `StorageAdapter`, with adapters `createLocalStorage` / `createSessionStorage` / `createMemoryStorage` / `createNullStorage` (browser adapters degrade to memory on Node/SSR). All exported from the package root. `hydrate()` is total: empty, undecodable, or schema-invalid storage falls back to a caller-supplied default and drops the corrupt entry.
+  - **Bearer session persistence** — `createKeboola({ storage })` mirrors the durable session subset (`baseUrl`, `projectId`, `refreshToken`) into the adapter under one key; the access token and identity are never stored. `session.restore()` rehydrates on startup by exchanging the persisted refresh token for a fresh credential and re-scoping to the stored project, resolving `{ status: 'restored' | 'expired' | 'empty' }`; `session.reset()` clears the stored session.
+
+- Add `management.projects.setProjectLimits()` (POST /manage/projects/{projectId}/limits) for setting project limits, with a `SetProjectLimitsBody` type.
+
+- Add list methods for storage backends and file storages: `management.storageBackends.getStorageBackends()` (GET /manage/storage-backend) and a new `management.fileStorage` client with `getFileStoragesS3` / `getFileStoragesAbs` / `getFileStoragesGcs` (GET /manage/file-storage-{s3,abs,gcs}).
+
+- Finish the bearer (programmatic) auth flow. `AuthProvider` is now the bearer twin of `LegacyAuthProvider`: it takes `baseUrl` / `credential` / `projectId` (plus optional `onAccessTokenChange` and `fallback`), drives the session to ready on mount, mirrors the rotating access token out via `onAccessTokenChange`, and gates its children behind readiness.
+
+- Authenticate auth-service calls in the bearer flow, and expose whether a session is persisted.
+  - `api.auth` now carries the bearer auth middleware, so authenticated auth-service endpoints (`token.introspect`, `getProjects`) are authorized. Previously they went out without an `Authorization` header. Two guards keep that safe: `refresh()` / `restore()` run on a separate bare client, because routing a token refresh through the middleware re-enters the (deduped) refresh via its own near-expiry/401 path and deadlocks; and the middleware passes a request through untouched while the session is anonymous, so pre-auth `login` is not stamped and a failed login is not mistaken for session expiry.
+  - `session.hasPersistedValue()` — a synchronous check for whether a session is stored under the persistor's key, so a caller can decide up front whether a restore is worth waiting for. Safe to call during render: a throwing storage adapter (blocked or private-mode storage) reads as "nothing stored" rather than propagating.
+
+- Rework the bearer (OAuth) auth internals for a cleaner separation of concerns. Token handling now lives in a `TokenCredential`-style provider — `getAccessToken({ forceRefresh })` always returns a usable access token, refreshing (deduped) on near-expiry or when forced — consumed by a thin auth middleware that stamps the live token on every request and replays once on a 401. The bearer session config is a discriminated-union state machine (`anonymous` / `authenticated` / `scoped`) that owns its own credential model and the fire-once session-expiry latch: `session.authenticate` now takes a `TokenSet` (`accessToken`, `refreshToken`, `expiresIn`) rather than the full login credential, and `SessionSnapshot.config` is that state union. Also adds a `dedupe` (single-flight) util.
+
+- Add Storage configuration management endpoints, grouped into focused sections under `storage/`:
+  - `componentsAndConfigurations`: `restoreConfiguration`, `resetConfigurationToDefault`
+  - `configurationVersions`: `copyConfigurationFromVersion`, `rollbackConfigurationToVersion`; rename `listConfigurationVersions` → `getConfigurationVersions`
+  - `configurationMetadata` (new): `saveConfigurationMetadata`
+
+- Add `management.storageBackends.getStorageBackendProjects()` / `getStorageBackendMaintainers()` (GET /manage/storage-backend/{id}/projects and /maintainers), and extend the `StorageBackend` detail type with `assignedProjectsCount` / `assignedMaintainersCount`.
+
+- Add configuration Zod schemas for the file/connection extractor family (`ex`) to the configuration registry: `keboola.ex-http`, `keboola.ex-ftp` (+ its `keboola.ex-ftp-csas` variant), `keboola.ex-aws-s3`, `kds-team.ex-azure-blob-storage-v2`, and `kds-team.ex-azure-data-lake-gen2`. They live in a `schemas/ex/` family folder (mirroring `exDb`/`wrDb`) but share no common credential base, so each is its own schema; `ex-ftp-csas` reuses the `ex-ftp` schema. FTP and AWS-S3 model their mutually-exclusive auth (password XOR private key; access-key credentials XOR IAM role) as `forbidden`-guarded unions, so a config with both — or neither — is rejected and switching variants drops the abandoned secret. `ex-http` keeps `parameters` `.loose()` so component-managed request/job definitions pass through unchanged; `createRegistry`'s deep-partial input schema now preserves a source object's catchall to support this.
+
+- Add the `sdk/semanticLayer` SDK — typed CRUD over the metastore client for
+  semantic-layer objects (models, datasets, metrics, relationships, glossary
+  terms, constraints), exposed as `api.sdk.semanticLayer`. Returns a normalized
+  `SemanticObject<TData>` matching the live metastore envelope.
+
+### Patch Changes
+
+- Regenerate the management schema: `id`/`name` are now required on `StorageBackendProject` and `StorageBackendMaintainer` (the manage OpenAPI marks them required since connection#7970), removing the client-side response filtering that compensated for the optional typing. No runtime behavior change.
+
+- Add the `Bearer ` scheme in the shared `createAuthHeaders` for the bearer auth strategy, so `auth.token` is uniformly the bare token across the SDK (matching the management client and the bearer auth middleware). Previously the shared helper forwarded `auth.token` verbatim, so a bearer credential's `Authorization` header was emitted without the scheme.
+
+- Regenerate storage OpenAPI schema — the configuration update endpoint now documents the optional `workspaceId` query parameter and the `X-StorageApi-Job-Id` response header (workspace Direct Grant output mapping sync).
+
+- Fix the metastore tag SDK to match the live JSON:API envelope (`{ type, id, attributes, meta }`). The SDK previously read `uuid`/`data` off the wrong shape, so `getTags`, `getTagsByObjectId`, `deleteTag`, `assignTags`, `unassignTags`, `unassignAllTags`, and `createAndAssignTag` returned `undefined` UUIDs and misbehaved. The metastore repository response types now model the real envelope (`RawMetaObject`) and expose a normalized `MetaObject { uuid, data, meta }`; the stale generated schema was regenerated. `TagData.creator.name` is now required to match the server's validation (the API rejects creation without it).
+
+- Extend `SemanticConstraintData` with the remaining semantic-constraint schema fields (`scope`, `owner`, `tags`, `ruleExpression`, `validationQuery`) and add the supporting `SemanticConstraintScope`, `SemanticRuleOperator`, `SemanticRuleExpression`, and `SemanticValidationQuery` types. Mirrors the metastore JSON schema so the semantic-layer editor can round-trip every field. Types-only addition — no runtime change.
+
+## 20.0.0
+
+### Major Changes
+
+- Service-client factories now take an `auth` strategy instead of a raw `token`.
+  `createStorageClient({ baseUrl, token })` becomes
+  `createStorageClient({ baseUrl, auth: { type: 'sapi-token', token } })`, and the same
+  applies to every other service client (stream, sync-actions, telemetry, vault, …). A new
+  `AuthStrategy` type (`sapi-token` | `bearer`) is exported from the package root.
+
+  Behavior is unchanged — for the `sapi-token` strategy the emitted `X-StorageApi-Token`
+  header is byte-identical to before. `createManagementClient` likewise now takes an `auth`
+  strategy — `createManagementClient({ baseUrl, token })` becomes
+  `createManagementClient({ baseUrl, auth: { type: 'management-token', token } })` — keeping
+  its own Manage API token (`X-KBC-ManageApiToken`) semantics. The `bearer` variant is
+  defined but not yet constructed.
+
+## 19.0.0
+
+### Minor Changes
+
+- Add `ReadOnly` and `Guest` to `AdminRole` (completing the set of Storage API admin roles), and a new `isReadOnlyRole(token)` permission predicate in `domain/permissions`. Used to detect read-only-role users (AI-2736).
+
+## 18.0.1
+
+### Patch Changes
+
+- Fix `storage.tables.deleteTableRows`: `whereFilters` is now typed as `WhereFilters[]` (an array of filters) to match the API. The previous single-object type serialized as `whereFilters[column]=…`, which the backend rejects with a 400 (`whereFilters` must be an array). This mirrors `getDataPreview`, which already takes `WhereFilters[]`.
+
+## 18.0.0
+
+### Major Changes
+
+- Discover the metastore service from stack info instead of taking a `metastoreBaseUrl` option.
+  - **Breaking:** `metastoreBaseUrl` is removed from `ApiClientOptions`. `createApiClient`/`init()` no longer accept it, and `ApiClientProvider` no longer accepts the `metastoreBaseUrl` prop.
+  - `metastore` is now a stack-discovered service client (like `queue`, `vault`, …): its base URL comes from `getStackInfo` service discovery, exposed on the client as `api.metastore` and consumed by the tag SDK. On stacks that don't advertise a metastore service, the client resolves to a lazy no-op that throws only when a metastore method is actually called.
+
+  Migration: drop `metastoreBaseUrl` from every `createApiClient`/`init()`/`ApiClientProvider` call — the URL is resolved automatically from the stack.
+
+## 17.0.0
+
+### Major Changes
+
+- Remove the token-less public `assets` and `status` clients from `createApiClient`.
+
+  They hit static public URLs and have nothing to do with the storage token, stack-discovered services, or bootstrap. Import `createAssetsClient` / `createStatusClient` from `@keboola/api-client/assets` and `@keboola/api-client/status` and instantiate them directly instead. `assetsBaseUrl` and `statusBaseUrl` are removed from `ApiClientOptions`.
+
+  Migration: replace `api.assets.getPublishedChangelogPosts(signal)` with `createAssetsClient({ baseUrl, middlewares: [] }).getPublishedChangelogPosts(signal)` and `api.status.getSummary(signal)` with `createStatusClient({ baseUrl, middlewares: [] }).getSummary(signal)`; drop `assetsBaseUrl` / `statusBaseUrl` from the `createApiClient` / `ApiClientProvider` options.
+
+## 16.0.0
+
+### Major Changes
+
+- Remove `createDevApiClient` (and, in `@keboola/api-client-react`, `DevApiClientProvider` / `useDevApiClient`).
+
+  `createDevApiClient` was a stateless pass-through — `{ verify: { storageApiToken, managementApiToken } }` with no lifecycle, no base-URL registry, no `init()`. It doesn't fit the client model; it's just two host-parameterized verify calls. The React dev-provider layer existed only to carry that object through context.
+
+  Verify a candidate token with the real per-service clients directly (host-parameterized per call, no provider):
+  - storage: `createStorageClient({ baseUrl: host, token }).tokens.verify()`
+  - management: `createManagementClient({ baseUrl: host, token, withAuthMiddleware: false }).verifyToken()`
+
+- Remove `createVerifyClient` and the `@keboola/api-client/verify` sub-path.
+
+  It was a non-client that re-implemented `/v2/storage/tokens/verify` and `/manage/tokens/verify` with a raw `createGenericFetchClient`. The real typed clients already expose those endpoints — verify a candidate token with them instead:
+  - storage: `createStorageClient({ baseUrl, token }).tokens.verify()`
+  - management: `createManagementClient({ baseUrl, token, withAuthMiddleware: false }).verifyToken()`
+
+  `createManagementClient` gains a `withAuthMiddleware` option (default `true`). The management auth middleware keeps a long-lived session alive (verifies + mints/refreshes session tokens), which is wrong for a plain "is this token valid?" check. Pass `withAuthMiddleware: false` for a raw client that just attaches the token, so `verifyToken()` is a clean validity check. `middlewares` is now optional (default `[]`), matching `createStorageClient`. The `ManagementToken` type now ships with the management client.
+
+## 15.0.0
+
+### Minor Changes
+
+- Restructure the `auth` service client into nested namespaces — `auth.login`, `auth.mfa`, `auth.saml`, `auth.pat`, `auth.device`, `auth.sudo`, `auth.pkce`, `auth.session`, and `auth.token` — replacing the previous flat methods (e.g. `auth.createPat` → `auth.pat.create`, `auth.listPats` → `auth.pat.getAll`, `auth.refreshToken` → `auth.token.refresh`, `auth.sudo` → `auth.sudo.verify`). The login response is now validated with a zod discriminated union, and `auth.token.introspect` accepts an explicit token to introspect.
+
+## 14.0.0
+
+### Minor Changes
+
+- Add `deleteSandbox` to the data science client (`DELETE /sandboxes/{appId}`) for tearing down Python/R workspace sandboxes, plus the `DeleteSandboxPath` type.
+
+## 13.0.0
+
+### Minor Changes
+
+- Add `auth` service client wrapping the Keboola Auth API (`/v1/auth/*` — login, MFA, SAML, device/PKCE flows, personal access tokens, sessions, token introspect/refresh/revoke). Available as `api.auth.*` on the full client and standalone via `@keboola/api-client/auth`; the factory takes only `baseUrl` + `middlewares` since the API primarily issues tokens.
+
+## 12.0.0
+
+### Minor Changes
+
+- Add a configuration Zod schema for the `keboola.ex-google-ads` OAuth extractor to the configuration registry. The schema pairs the shared top-level `authorization` OAuth credential reference (`oauth_api.{id, version?}`, now extracted into a reusable `oauthAuthorizationSchema` common module) with the extractor's `parameters` (`customerId` list plus optional `onlyEnabledCustomers` / `getAccountChildren` flags). The schema lives in its own per-file module following the existing registry convention.
+
+- Storage types ergonomics (surfaced dogfooding the SDK from an external app):
+  - **Export the `JobStatus` union** from `@keboola/api-client/storage/types`. It was declared but not exported, so consumers had to re-declare it (or fall back to `Record<string, …>`) to type a job-status map.
+  - **Make `GetTablesQuery.include` optional.** `getTables` already defaults to `{ include: [] }`, so `getTables(branchId, {})` / `getTables(branchId, {}, signal)` now type-check instead of erroring on a missing required `include`.
+
+## 11.0.0
+
+### Minor Changes
+
+- Add configuration Zod schemas for two app-specific writers to the configuration registry: `keboola.app-snowflake-dwh-manager` (master Snowflake connection with password-or-key-pair auth) and `keboola.gooddata-writer` (GoodData project + login credentials, leaving the large `tables`/`dimensions` structures as pass-through). Each schema lives in its own per-file module following the existing registry convention.
+
+## 10.0.0
+
+### Minor Changes
+
+- Add configuration Zod schemas for the `ex-db-*` extractor family to the configuration registry — mysql, pgsql, redshift, mssql (+cdata), oracle, snowflake, firebird, db2 (+bata), informix, impala, hive (+csas/-csas-test), teradata, netsuite, kds netsuite, and progress-db. Per-driver SSH-tunnel / SSL support mirrors the kbc-ui contract. Reorganizes the writer and extractor schemas into `wrDb/` and `exDb/` family folders with shared `common` helpers.
+
+## 9.0.0
+
+### Minor Changes
+
+- Add `management.deletedProjects` namespace with `getDeletedProjects`, `getDeletedProject`, `restoreDeletedProject` (DELETE — cancel deletion), and `purgeDeletedProject(projectId, ignoreBackendErrors?)` (POST — permanent, irreversible purge; pass `ignoreBackendErrors: true` to purge despite backend-storage cleanup errors; returns the enqueued `{ commandExecutionId }`).
+
+- Ship a machine-readable surface index of the full `ApiClient` surface — every namespace and method with its fully resolved signature — so agents and external consumers can discover the API without cloning the repo. A compact `API-SURFACE.md` lists every method name and links to per-namespace detail files under `surface/<namespace>.md` (full signatures), so a consumer loads only the slice it needs instead of one ever-growing file. Generated from the TypeScript type checker via `pnpm --filter @keboola/api-client surface`, verified in CI by `surface:check`.
+
+- Add `ComponentId.SCHEDULER` (`keboola.scheduler`) and register a zod schema for the scheduler configuration in the configurations SDK registry, so scheduler create/update payloads can be validated.
+
+  Also expose `ComponentId`, `ProjectFeatures`, `Backends`, and `AdminRoles` from the public `@keboola/api-client/constants` sub-path (each now lives in its own file under `src/constants/`).
+
+- Export the `ComponentType` type from `@keboola/api-client/storage/types`. It was already defined (and used internally by `StackComponent`) but not part of the public surface; exporting it lets consumers treat the api-client definition as the single source of truth instead of maintaining a duplicate local union.
+
+- Add `sdk.variables` for `keboola.variables` config orchestration. `copy` clones a variables config into a fresh, independent config + values row; `merge` unions two configs' definitions and upserts their values (source wins on a name conflict) into a fresh config, rolling back the orphaned config if the values row fails.
+
+## 8.0.2
+
+### Patch Changes
+
+- fix: emit a Node-valid ESM import for the dayjs `utc` plugin (`dayjs/plugin/utc.js`) so consumers importing the SDK under Node/Vitest don't hit `Cannot find module`
+
+- docs: README now recommends `createStorageClient` as the single-service path (incl. browser SPAs) — it needs only `baseUrl` + `token`, avoiding the full client's required `assets`/`status`/`metastore` URLs
+
+## 8.0.1
+
+### Patch Changes
+
+- fix: rename the `getDataPreview` return type `PrevieData` → `PreviewData` (typo); `PrevieData` kept as a deprecated alias
+
+## 8.0.0
+
+### Minor Changes
+
+- feat: re-export error guards (`isApiError`, `isAbortError`, `isFetchClientError`) and error classes from `@keboola/api-client/storage` so storage-only consumers don't also import from the main entry
+
+### Patch Changes
+
+- docs: correct storage-client usage — `createStorageClient` takes a `token` option directly; `createStorageTokenMiddleware` does not exist
+
+## 7.0.0
+
+### Minor Changes
+
+- Add `management.storageBackends.getStorageBackend(id)` (`GET /manage/storage-backend/{id}`) and the `StorageBackend` type. Returns a storage backend's id, owner, technical owner, host/URL and related details.
+
+## 6.0.0
+
+### Minor Changes
+
+- Add a typed `notifications` service client (`api.notifications.*`) wrapping the Keboola Notification API: `listSubscriptions`, `getSubscription`, `createSubscription`, `deleteSubscription`, `postEvent`, and `sendNotification`. Types are generated from the service's OpenAPI spec and exposed via the `@keboola/api-client/notifications` and `@keboola/api-client/notifications/types` sub-paths.
+
+- Expose two documentation endpoints on the existing `ai` client: `docsQuestion` (`/docs/question`) and `getComponentDetail` (`/docs/components/{componentId}`). These cover the Keboola MCP server's remaining API needs ahead of its TypeScript rewrite (PSGO-268).
+
+- Add a typed `scheduler` service client backed by OpenAPI-generated types. Exposes `getSchedules`, `activateSchedule`, `getSchedule`, `deleteSchedule`, `refreshScheduleToken`, and `deleteSchedulesForConfiguration` via `api.scheduler.*`.
+
+## 5.0.0
+
+### Minor Changes
+
+- Management write-operation surface for the control-ui M6 entity operations:
+  - New project methods: `updateProject`, `deleteProject`, `moveProject`, `setProjectDisabled` (+ body types). `SetProjectDisabledBody` is a discriminated union — `disableReason` is required only when disabling.
+  - Extend `UpdateOrganizationBody` with the live-supported fields the generated schema omits: `mfaRequired`, `crmId`, `activityCenterProjectId`, and `maintainerId` (move an organization to a different maintainer).
+
+- Refresh the management OpenAPI types from the live spec (`/api/manage/doc.json`) and move the
+  maintainer/organization overlays out of the generated file into the types layer:
+  - `Maintainer.organizations` is `{ id; name }[]` (list endpoint); `MaintainerDetail.organizations`
+    is `Organization[]` (detail endpoint), with `getMaintainer` casting accordingly.
+  - Removes `projectsCount` from `Organization` — the management API never returns it (the field was a
+    stale hand-edit in the previously committed generated schema).
+
+- Add a generated `stream` service client (`api.stream.*`) covering the full Stream Service endpoint surface — sources, sinks, settings, statistics, versions, tasks (create/read/update/delete, enable/disable, undelete, rollback, aggregation). Types are generated from the Stream OpenAPI 3 spec via `redocly.yaml` + `gen:types`. This replaces the legacy hand-generated Stream client that lived in `apps/kbc-ui/src/scripts/api`.
+
+## 4.0.0
+
+### Minor Changes
+
+- Add `storage.componentsAndConfigurations.updateConfiguration` (PUT a configuration; `configuration` is JSON-stringified to match the Storage API contract) and expose the generic `syncActions.sendSyncAction` for running arbitrary component sync actions.
+
+## 3.0.1
+
+### Patch Changes
+
+- Fix legacy `node10` types resolution for the `@keboola/api-client/sdk/vault` subpath by adding the missing `typesVersions` entry. The `./sdk/vault` export was added in #5635 but only registered in `exports` (modern resolvers); legacy `moduleResolution: "node"` consumers and `attw --pack` reported `Resolution failed`.
+
+## 3.0.0
+
+### Minor Changes
+
+- Add the storage three-way diff endpoints for configurations and rows (DMD-1545):
+  - `componentsAndConfigurations.getConfigurationDiff({ branchId, componentId, configId }, signal?)` → `{ base, ours, theirs }`, each a snapshot of `name` + `description` + `configuration` plus version metadata and `isDisabled` / `isDeleted` flags, or `null` when the configuration is absent on that side.
+  - `componentsAndConfigurations.getConfigurationRowDiff({ branchId, componentId, configId, rowId }, signal?)` with the same `{ base, ours, theirs }` shape for a single configuration row.
+
+  Backed by the new Storage API endpoints `GET /v2/storage/branch/{branchId}/components/{componentId}/configs/{configId}/diff` and `.../rows/{rowId}/diff`. Available in dev branches only — `branchId` is required on both methods (no fallback to `'default'`) because the server returns 400 on the default branch.
+
+  Additive change — no existing exports are removed or renamed.
+
+## 2.0.0
+
+### Major Changes
+
+- **BREAKING** — `PermissionDeniedError` constructor changed from `new PermissionDeniedError(message: string)` (the scaffold form shipped in 1.0.0 via UT-4014 / PR #5770, explicitly documented as "stubs only") to `new PermissionDeniedError({ action: string; reason?: string; subject?: string })`. The new shape carries the stable kebab-case `action` field that consumers may pattern-match on. No in-repo consumer adopted the string form. External migration: `new PermissionDeniedError(msg)` → `new PermissionDeniedError({ action: '<kebab-case-action>', reason: msg })`.
+
+  Add permission primitives to `@keboola/api-client/domain/permissions` (P1.2 / UT-4015):
+  - `PermissionDeniedError` with the new stable `{ action, reason?, subject? }` public contract. `subject` is an optional debugging hint and **must not** carry the full `StorageToken`, raw tokens, secrets, or any value that could be logged or surfaced to a user without further redaction.
+  - Baseline admin role predicates against the typed `StorageToken`: `isAdmin`, `isAdminOrShare`, `isProductionManager`, `isDeveloperOrReviewer`, each paired with `assertCan*` (action strings: `admin`, `admin-or-share`, `production-manage`, `develop-or-review`).
+  - Configuration workflow predicates consumed by the upcoming Core SDK (P1.3): `canCreateConfiguration`, `canCopyConfiguration`, `canMigrateFromTemplate`, `canPurgeConfiguration`, `canAssignFolder`, each taking `(token, ctx: { isDevModeActive })` and each paired with an `assertCan*` function. `canPurgeConfiguration` is admin-only and ignores `ctx`; the other four follow the situational base rule (developer/reviewer in dev branches, productionManager in production).
+  - Standalone `hasFeature(token, ...features)` and `hasAdminFeature(token, ...features)` exported from `@keboola/api-client/domain/permissions`. The `createProject` factory continues to expose its closure-based versions unchanged.
+
+  See `packages/api-client/AGENTS.md` → "Permissions Module Conventions" for the predicate / assertCan pair pattern and the ctx-argument naming convention.
+
+### Patch Changes
+
+- Fix `isApiError` / `isFetchClientError` cross-subpath false negatives and externalise `dayjs/plugin/*` properly.
+  - UT-4084: tsup was previously built with `splitting: false`, so each subpath bundle (e.g. `@keboola/api-client/storage`) inlined its own copy of the `ApiError` class. An error thrown from a storage helper would therefore fail the `instanceof ApiError` check used inside `isApiError` imported from the package root. Enabling `splitting: true` causes tsup to emit shared chunks for both ESM and CJS so every subpath references the same class identity.
+  - UT-4089: `dayjs/plugin/utc` was being matched as external only by accident through the `'dayjs'` entry. The `external` list now contains an explicit `/^dayjs\/plugin\//` pattern so consumers' bundlers don't have to follow the import through the api-client bundle.
+
+  Regression tests in `__tests__/buildOutput.test.ts` inspect the built `dist/` to guarantee:
+  - `ApiError = class` appears exactly once per format (ESM/CJS) across the whole dist tree;
+  - no entry bundle imports `dayjs/plugin/*` directly.
+
+- Fix `create*Client` factories so a `baseUrl` ending with one or more `/`
+  no longer produces request URLs with a double slash (e.g.
+  `https://connection.keboola.com//v2/storage/buckets`), which the
+  Storage API serves as 404.
+
+  Every public `create*Client` factory now strips trailing slashes from
+  its `baseUrl` via the new `normalizeBaseUrl` helper. The fix is
+  defensive — callers that already pass the canonical form
+  (`https://connection.keboola.com`) see no behavior change.
+
+  Tracked in UT-4093.
+
+## 1.0.1
+
+### Patch Changes
+
+- Re-publish to fix unresolved `workspace:^` protocol references in the npm tarball manifests.
+
+  The initial bootstrap publishes (2026-05-18 for `@keboola/api-client` and `@keboola/api-client-react`, later for the rest) were run manually with `npm publish` from a maintainer machine. Bare `npm publish` doesn't understand yarn's `workspace:` protocol, so the published `package.json` files shipped with literal `workspace:^` strings in `dependencies`, `peerDependencies`, and `devDependencies`.
+
+  The blocker is `@keboola/api-client-react@1.0.0`'s `peerDependencies` declaring `@keboola/api-client: workspace:^`. Running `npm install @keboola/api-client-react` from outside the monorepo fails with `EUNSUPPORTEDPROTOCOL` because npm can't resolve the `workspace:` protocol. The same string also appears in `@keboola/api-client`, `@keboola/brand-registry`, and `@keboola/oxlint-config` `devDependencies` — npm ignores those for transitive installs, but they're still wrong in the published manifests and worth cleaning up in the same release.
+
+  This patch bump triggers a regular changesets-driven release. When `changeset publish` runs in CI, it rewrites `workspace:*` references to the actual resolved version ranges before calling `npm publish`, restoring a consumable npm surface for every package.
+
+  `@keboola/codemirror-lang-sql` has the same issue but is already covered by an existing pending changeset (`codemirror-lang-sql-publish.md`, minor bump for initial publish setup); the next release will fix it through that bump.
+
+  No source code or runtime behavior changes. The local `workspace:^` references in source `package.json` files stay (they're correct for monorepo workspace deps; the rewrite happens only at publish time).
+
+## 1.0.0
+
+### Minor Changes
+
+- Add `storage.mergeRequests.getMergeRequestConflicts(id, signal)` for the new `GET /v2/storage/merge-request/{id}/conflicts` endpoint. Returns the list of configurations whose dev-branch version identifier diverges from the default-branch version identifier — an empty array means the merge request is conflict-free. Also exports the `MergeRequestConflict` type from `@keboola/api-client/storage/types`.
+
+- Scaffold `sdk/configurations` and `domain/permissions` sub-path exports. Stubs only — workflow methods land in P1.2/P1.3.
+
+- Add pure parsing helpers to `@keboola/api-client/sdk/storage`: `tableIdParser`, `tableNameParsed`, `getBucketDisplayNameFromName`, `parseFQID`, `constructFQID`, `FQID_TYPES`, `parseDevBranchId`, `parseCurrentDevBranchIdFromUrl`, `prefixTagsWithDevBranchId`, `removeBranchFromUrl`. Moved from `apps/kbc-ui`; project-feature flags (`disableLegacyBucketPrefix`, `hasStorageBranches`) are now options on the helpers instead of being read from a store.
+
+### Patch Changes
+
+- Initial publish setup for `@keboola/api-client-react` — React provider + hooks (`useApiClient`, `useProject`, `useStack`, `useDevApiClient`) for the Keboola SDK. Ships dual ESM/CJS bundles via `tsup` with React 18/19 as peer dependencies. Linked with `@keboola/api-client` so both packages release together.
+
+- Regenerate storage OpenAPI types so `merge-request/{id}` GET is fully typed: `activityLog` (with `?include=activityLog`), reviewer `status`, and the `request-changes` body are now in the schema. Dropped the corresponding `@ts-expect-error` directives and the augmented `MergeRequestReviewer` shape from consumers.