@keboola/api-client 33.0.0 → 35.0.0

package/AGENTS.md

@@ -461,9 +461,9 @@ api.sdk.tag.*        api.sdk.storage.*
 
 Clients backing optional stack services (vault, queue, …) throw `ServiceUnavailableError` if absent from the current stack — check `api.context.stack.hasService(...)` before assuming a namespace exists.
 
-**Liveness: every service client exposes a root-level `healthCheck()`** (all but `telemetry`, which has no such endpoint). It resolves with the service's payload when up and throws like any other call when not, and it needs no session — every one of these endpoints answers unauthenticated, so a probe works before login and is indifferent to whether a token rides along. Probe a service that way rather than by calling a real endpoint and interpreting the failure. **A 200 means up and a throw means down — that is the whole contract.** The payload is incidental, so **never hand-roll a response type** to make it look useful. Adding a client means adding its `healthCheck` too, and which client you probe through follows from the spec:
+**Liveness: every service client exposes a root-level `healthCheck()`.** It resolves with the service's payload when up and throws like any other call when not, and it needs no session — every one of these endpoints answers unauthenticated, so a probe works before login and is indifferent to whether a token rides along. Probe a service that way rather than by calling a real endpoint and interpreting the failure. **A 200 means up and a throw means down — that is the whole contract.** The payload is incidental, so **never hand-roll a response type** to make it look useful. Adding a client means adding its `healthCheck` too, and which client you probe through follows from the spec:
 
-- the service's spec declares the probe path → **probe through the client's own OpenAPI client** (`client.get('/health-check', {}, { signal })`). The return type comes from the spec for free — no type argument, no alias in `types.ts`, and no generic client to construct. Five do today: `ai`, `editor`, `import`, `chat` (which probes `/ping`) and `apps` (which probes `/`, the only unauthenticated root the `/v2` surface declares).
+- the service's spec declares the probe path → **probe through the client's own OpenAPI client** (`client.get('/health-check', {}, { signal })`). The return type comes from the spec for free — no type argument, no alias in `types.ts`, and no generic client to construct. Six do today: `ai`, `editor`, `import`, `telemetry`, `chat` (which probes `/ping`) and `apps` (which probes `/`, the only unauthenticated root the `/v2` surface declares).
 - it doesn't → fall back to a generic fetch client over the service `baseUrl` and **pass no type argument.** The payload resolves as `unknown`, which is honest: callers only need the 200.
 
 Both clients run the same middleware chain; the OpenAPI one additionally sends auth headers, which is fine — these endpoints answer the same with a valid token, a bogus one, or none.

package/API-SURFACE.md

@@ -4,7 +4,7 @@
 
 Every namespace and method reachable from a ready `KeboolaApi` — the `api` half of a keboola client (`createKeboola(...).api` / `createLegacyKeboola(...).api`, or `useApiClient()`). Generated from the TypeScript type checker — see `scripts/gen-surface.mjs`.
 
-24 top-level namespaces, 624 methods. This index lists method **names** only — full signatures live per namespace under [`surface/`](./surface). Open `surface/<namespace>.md` for the one you need.
+25 top-level namespaces, 635 methods. This index lists method **names** only — full signatures live per namespace under [`surface/`](./surface). Open `surface/<namespace>.md` for the one you need.
 
 ## [`api.ai`](./surface/ai.md)
 
@@ -85,6 +85,12 @@ Every namespace and method reachable from a ready `KeboolaApi` — the `api` hal
 - `webauthn.registerOptions`
 - `webauthn.remove`
 
+## [`api.billing`](./surface/billing.md)
+
+- `getCredits`
+- `getCreditsAndTopUp`
+- `healthCheck`
+
 ## [`api.chat`](./surface/chat.md)
 
 - `createChat`
@@ -282,6 +288,13 @@ Every namespace and method reachable from a ready `KeboolaApi` — the `api` hal
 - `organizations.removeOrganizationUser`
 - `organizations.setOrganizationMetadata`
 - `organizations.updateOrganization`
+- `payAsYouGo.createPaymentRequest`
+- `payAsYouGo.getBillingConfiguration`
+- `payAsYouGo.getCreditPurchases`
+- `payAsYouGo.getStripeCustomer`
+- `payAsYouGo.getTopUpSetting`
+- `payAsYouGo.updateStripeCustomer`
+- `payAsYouGo.updateTopUpSetting`
 - `projects.addProjectFeature`
 - `projects.addProjectTemplateFeature`
 - `projects.addProjectUser`
@@ -691,7 +704,8 @@ Every namespace and method reachable from a ready `KeboolaApi` — the `api` hal
 
 ## [`api.telemetry`](./surface/telemetry.md)
 
-- `provisioning.createCredentials`
+- `getProvisioningToken`
+- `healthCheck`
 
 ## [`api.vault`](./surface/vault.md)
 

package/CHANGELOG.md

@@ -1,5 +1,258 @@
 # @keboola/api-client
 
+## 35.0.0
+
+### Major Changes
+
+- **Breaking:** `Workspace` carries a required `state: 'active' | 'deactivated'`, the retention lifecycle state Storage already serves on the workspace list and detail. Reading a workspace is unaffected; code that _constructs_ a `Workspace` object literal — a test fixture, a mock — has to add the field.
+
+  Required rather than optional because the spec marks `state` required and the server always sends it, and because `Workspace` exists to model the response more accurately than the generated schema does — the neighbouring overrides already tighten `name`, `component`, `configurationId` and `platformUsageType` the same way.
+
+  `deactivated` means the backend login is disabled — no credentials, no load or unload — while the workspace stays listed so its owner can delete it. Storage collapses its internal `deactivation_notified` stage to `active`, so a workspace only scheduled for deactivation still reads as active (DMD-2101).
+
+## 34.0.0
+
+### Minor Changes
+
+- New `approvalGoneReasonSchema` / `ApprovalGoneReason` in `chat/types` — the shared wire contract for why a Kai approval slot is gone.
+
+  kai-agent now tombstones every removed approval slot and answers a POST to a gone slot with 409 carrying the reason as the error envelope's `subtype`, so the client can tell "already processed" and "the chat was stopped" apart from a genuine expiry instead of reading every 404 as one.
+
+- `session.getAuthHeaders()` takes an optional project, so a host holding several projects can
+  authorize an off-client request against one the session is not scoped to. Until now this surface
+  read `X-KBC-ProjectId` off the session's own scope and nothing else, which left the chat SSE stream
+  — its only caller, and the one transport with no service client behind it — able to _read_ another
+  project through `session.forProject(id)` but never to send to it.
+
+  ```ts
+  // The session's own scope, exactly as before.
+  await session.getAuthHeaders();
+
+  // The project the caller names, whatever the session is scoped to.
+  await session.getAuthHeaders(projectId);
+  ```
+
+  - Omitting it is unchanged, including the rule that the scope is re-read _after_ the token
+    rotation: a `setProject` mid-flight lands, and a `clearProject` refuses the call.
+  - Naming one requires the session to be authenticated, not scoped. The credential is user-level and
+    the project is a header on top of it, so a caller that names a project has said everything the
+    request needs.
+  - A named project survives the rotation as given — it is the caller's, not the session's to move —
+    and the session pin is unchanged: a call whose rotation outlived its sign-in is still refused.
+  - The project is **not** checked against an access set, because the session cannot acquire one:
+    connection collapses every bearer failure into a single `invalid_token` response, so "no access to
+    this project" and "revoked token" are indistinguishable. That is the same reason
+    `session.forProject` does not probe scope either. Whether a project is reachable is the caller's
+    knowledge, from `token.introspect`; what this guarantees is that the header names what was asked
+    for and never something else.
+
+- New `api.billing` namespace over the Billing API — the pay-as-you-go credit balance of the project
+  the token identifies.
+
+  ```ts
+  if (api.context.stack.hasService("billing")) {
+    const { remaining, stats } = await api.billing.getCredits();
+  }
+  ```
+
+  The service is a separate stack deployment (service id `billing`), not part of the Manage API that
+  `api.management.payAsYouGo` covers, and `/credits` authenticates with a Storage API token rather
+  than a Manage token — so it gets its own client rather than another method there. Types generate
+  from the service's published spec, newly registered in `redocly.yaml`.
+  - `getCredits` answers only for a project carrying the `pay-as-you-go` feature.
+  - `getCreditsAndTopUp` is the same read with an automatic top-up attempted first, which the service
+    runs only when the balance is at or below zero and the project has a top-up configuration
+    (`management.payAsYouGo.getTopUpSetting`). A charge that fails does not fail the call.
+  - `stats` is absent unless the project has consumption to report.
+
+  Three groups of endpoints stay unwrapped: `/duration/*` and `/marketplaces/{resolve-token,
+confirm-subscription}` are service-to-service calls needing a Manage _application_ token with a
+  `billing:manage` or `marketplace-subscriptions:manage` scope, `/marketplaces/azure-webhook` is
+  called by Azure Marketplace against an Azure-issued JWT, and `/` only restates what `healthCheck`
+  already reports.
+
+  The spec's `servers` block names the queue host rather than the billing one; it is ignored, since
+  every stack client resolves its base URL from the stack's service index.
+
+- `kaiAgent.getHistory` can ask for the conversations one app opened, and every history row says which
+  app opened it.
+
+  ```ts
+  // Only what this app started — a business user never sees the data team's Kai threads.
+  const { chats } = await api.kaiAgent.getHistory({ client: "business-chat" });
+  ```
+
+  kai-agent lists a project's conversations without regard to which host started them, so a second
+  host on the same agent shows its readers somebody else's chats. The service now records the host on
+  the chat and filters on it; this is the SDK half.
+  - `client` is `'kbc-ui' | 'business-chat'`, and omitting it keeps the current behaviour — every
+    conversation, whatever opened it.
+  - The row's own `client` is nullable: a chat opened before the service recorded it is unattributable,
+    and the service gives those to `kbc-ui`. So a filtered list starts from the deploy, not from the
+    project's first conversation.
+  - `POST /api/chat` accepts the same `client` on its body, which is what a host sets so its
+    conversations are attributed at all.
+
+  Regenerated from the deployed spec, so `getSpendCaps` / `updateSpendCaps` now carry
+  `defaultProjectCapPpu` in the generated schema too. Nothing changes for a caller — the method
+  already returned that field through a hand-written zod schema while the service rolled out, and the
+  fallback stays until every stack has the deploy.
+
+- Type the maintainer SAML SSO read responses (ST-4306).
+
+  `management/maintainers/types` exports `SamlConfigSummary` and `SamlConfigDetail`, derived from the
+  regenerated management schema. The two `GET /manage/maintainers/{maintainerId}/saml*` responses were
+  previously typed with every field optional and without `membershipRestriction`; the schema now marks
+  all of them required and the detail response also carries `permittedEmailDomains`, so callers no
+  longer have to guard fields the backend always sends. The list endpoint documents its 403.
+
+  The six client methods are unchanged — the two getters pick up the tightened return types on their
+  own.
+
+- `api.management.payAsYouGo` covers the pay-as-you-go billing endpoints — the credit price and tax
+  rates the checkout quotes, a project's credit purchases, its Stripe customer and saved cards, and
+  its automatic top-up configuration.
+
+  ```ts
+  const { "credit-price": creditPrice } =
+    await api.management.payAsYouGo.getBillingConfiguration();
+  const purchases =
+    await api.management.payAsYouGo.getCreditPurchases(idProject);
+  const { clientSecret } = await api.management.payAsYouGo.createPaymentRequest(
+    {
+      idProject,
+      amount: 100,
+      saveCard: true,
+    },
+  );
+  ```
+
+  Connection serves these off the same host as the Manage API but outside its `/manage` prefix, and
+  they accept a Manage token of type `admin` or `session`, so they run through the management client's
+  auth middleware like every other management method.
+  - Parameters carry the endpoint's own names: the project is `idProject` everywhere except
+    `getTopUpSetting`, whose path names it `projectId`.
+  - `getStripeCustomer` resolves `null` when the project has no Stripe customer yet — the endpoint
+    answers 204.
+  - `updateTopUpSetting` resolves `void`; the endpoint answers 202 with no body, so read the stored
+    configuration back with `getTopUpSetting`.
+  - `getTopUpSetting` throws a 404 `ApiError` when top-up was never configured for the project, which
+    is a product state rather than a failure.
+
+  Four response types are tightened past the manage OpenAPI document, which is looser than the
+  endpoints: `credit-price` and the three top-up fields and `clientSecret` are required rather than
+  optional, `stripeInvoiceStatus` and `invoiceTopUpType` are unions rather than bare strings, and
+  `moneyAmount` is nullable. They revert to plain generated types once connection's spec is corrected.
+
+  The maintainer SAML responses gained `membershipRestriction`, `getMaintainerSamlConfig` gained
+  `permittedEmailDomains`, and both configs' fields are no longer optional — the manage OpenAPI
+  document now marks them required.
+
+- New `canWriteSemanticLayer(token)` permission predicate — whether a project role may create, update
+  or delete semantic-layer objects in the metastore.
+
+  ```ts
+  if (canWriteSemanticLayer(api.context.project.sapiToken)) {
+    // offer the add / edit / delete affordances
+  }
+  ```
+
+  A denylist, unlike `canWriteKaiSettings`: the metastore's project-level ACL admits ordinary project
+  work, so only `readOnly` is refused. Organization-scope promotion stays a separate, narrower right
+  the metastore answers with a 403.
+
+- `api.telemetry` moves onto its own OpenAPI document, loses its one-method sub-namespace, and gains
+  the endpoint the embed dashboards need.
+
+  ```ts
+  const { token } = await api.telemetry.getProvisioningToken({
+    project_type: projectType,
+  });
+  ```
+
+  - **`getProvisioningToken`** returns the short-lived ES256 JWT a telemetry embed authenticates with.
+    Both response fields are optional in the spec, so check `token` before use.
+  - **`healthCheck`** joins the other service clients. The endpoint was only ever thought missing
+    because its path sits behind the ingress prefix described below.
+  - **`provisioning.createCredentials` is gone**, and with it the `provisioning` namespace, so the two
+    remaining methods sit directly on `api.telemetry`. It posted to an endpoint the service does not
+    route, document, or implement — the word `workspace` appears nowhere in
+    `keboola/gooddata-cn-provisioning`, and one ingress rule sends all of `/provisioning/*` to that
+    one backend, so there was nowhere else it could have landed. It answered 404 on every stack
+    probed and had no caller. `CreateCredentialsBody` and `WorkspaceData` go with it.
+
+  Types generate from the service's own `swagger.yaml`, newly registered in `redocly.yaml`. Its repo
+  is private and it does not serve the document over HTTP, so the spec is vendored beside the
+  generated schema — the same local-root arrangement `microsoftGraph` uses.
+
+  The client owns the `/provisioning` prefix rather than its callers: the service listens on its root,
+  and one ingress rule on the telemetry host routes that prefix to it. `baseUrl` stays the plain
+  telemetry service URL, and request paths stay the spec's own (`/token`, `/health`).
+
+  `project_type` is a free-form string passed straight into the JWT claim, not an enum — the service
+  validates it nowhere.
+
+- Expose organization membership on project users. The shared User type keeps the field optional for older stacks and endpoints that do not return project membership.
+
+### Patch Changes
+
+- A successful `text/html` response is only read as Connection's login screen when it actually carries
+  a body. Symfony's `Response::prepare()` stamps `Content-Type: text/html` on every bodyless response
+  but `204`/`304`, so a framework default was being reported to the user as an expired session.
+
+  `PUT /pay-as-you-go/billing/top-up` answers `202` with an empty body, and it is the middle call of
+  the kbc-ui Pay flow — so buying pay-as-you-go credits failed with "You will be logged out
+  automatically." for every user, on every auth strategy, and never reached Stripe. The same trap was
+  live on the invitation, join-request, password-reset and token-revoke endpoints.
+
+  Both validators are fixed, `validateManagementStatus` (`ManagementClientAuthError`) and
+  `validateConnectionStatus` (`HtmlResponseError`, used by the storage and auth clients), through a
+  new shared `isLoginPageRedirect` — `isHtmlResponse && !isContentEmpty`. `isHtmlResponse` keeps its
+  header-only meaning and `isContentEmpty` is new; calling the header check on its own is what read an
+  empty `202` as a login page. All three are workspace-internal, not part of the package's public
+  export surface.
+
+  Connection declares JSON on those responses in connection#8414; this is the client-side half
+  and holds regardless of what a service labels an empty body.
+
+- The semantic-layer SDK parses what it reads instead of asserting it, so an object that does not
+  match its declared shape is dropped rather than handed to a caller half-formed.
+
+  `listModels` and `listObjects` cast the metastore's response to the types in
+  `sdk/semanticLayer/types`. Those types declare `SemanticMetricData.name`, `.sql` and
+  `SemanticGlossaryData.term`, `.definition` as required strings, and every consumer is entitled to
+  call a method on them — the first one to do so (`.trim()`, in business-chat's openers) turns a
+  missing field into a `TypeError` thrown inside a render.
+  - Each element is validated against its object type's shape. One that fails is left out and the
+    reason logged — object type, UUID, and which field is wrong, never the payload, because a model's
+    vocabulary and its SQL are the customer's.
+  - A drop never takes its container with it, at either level: a model holding one malformed metric
+    still lists the other nine, and a dataset carrying one nameless field still lists its other
+    columns rather than disappearing from the model.
+  - A response that is not a collection still throws a `ValidationError` — reading it as an empty
+    list would say "this project has no metrics".
+  - Undeclared fields still reach callers untouched, exactly as they did under the cast.
+  - `SemanticObject.meta` stops lying: an envelope that omits it — or sends it as `null` — now
+    normalizes to `{}` rather than being typed as present and arriving `undefined`.
+  - An **optional** enum carrying a value outside the list (`role`, `severity`, `scope`, a
+    relationship's `type`) reads as absent instead of dropping its object — a new value the metastore
+    starts issuing must not delete the dataset carrying it. A required one (`constraintType`) has no
+    such reading.
+
+  **`listModelChildren` now throws `SemanticLayerUnreadableChildrenError` instead of degrading**, and
+  `deleteModel` inherits it. A list read degrades because a shorter list is still useful; this one
+  cannot, because it answers what a delete would destroy. A dropped child would otherwise be missing
+  from the cascade, leave `failedChildren` empty, and let the model be deleted — orphaning an object
+  whose `modelUUID` points at a model that no longer exists and that no list returns, so it can never
+  be found, fixed or deleted again. The throw happens before the first child delete, so a refusal
+  destroys nothing. An unreadable object is counted against the model its raw envelope names, and
+  against every model when the envelope cannot name one.
+
+  Writes are untouched: the metastore echoes back the object it has just validated and stored.
+
+  `formatValidationIssues` is now exported alongside `ValidationError`, for boundaries that degrade
+  instead of throwing and still owe a one-line reason.
+
 ## 33.0.0
 
 ### Minor Changes

package/dist/{ManagementClientAuthError-DqeXL8nv.cjs → ManagementClientAuthError-DD4u0EU7.cjs}

@@ -1,4 +1,4 @@
-const require_createFetchClient = require("./createFetchClient-DvZvD31l.cjs");
+const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
 //#region src/errors/ManagementClientAuthError.ts
 var ManagementClientAuthError = class extends require_createFetchClient.ApiError {
 	title;
@@ -17,4 +17,4 @@ Object.defineProperty(exports, "ManagementClientAuthError", {
 	}
 });
 
-//# sourceMappingURL=ManagementClientAuthError-DqeXL8nv.cjs.map
+//# sourceMappingURL=ManagementClientAuthError-DD4u0EU7.cjs.map

package/dist/{ManagementClientAuthError-DqeXL8nv.cjs.map → ManagementClientAuthError-DD4u0EU7.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"ManagementClientAuthError-DqeXL8nv.cjs","names":["ApiError"],"sources":["../src/errors/ManagementClientAuthError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+CA,0BAAAA,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF"}
+{"version":3,"file":"ManagementClientAuthError-DD4u0EU7.cjs","names":["ApiError"],"sources":["../src/errors/ManagementClientAuthError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+CA,0BAAAA,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF"}

package/dist/{ManagementClientAuthError-iKbBugKC.js → ManagementClientAuthError-ey-f03vy.js}

@@ -1,4 +1,4 @@
-import { h as ApiError } from "./createFetchClient-DdyZMhxO.js";
+import { g as ApiError } from "./createFetchClient-U-ZrwPl2.js";
 //#region src/errors/ManagementClientAuthError.ts
 var ManagementClientAuthError = class extends ApiError {
 	title;
@@ -12,4 +12,4 @@ var ManagementClientAuthError = class extends ApiError {
 //#endregion
 export { ManagementClientAuthError as t };
 
-//# sourceMappingURL=ManagementClientAuthError-iKbBugKC.js.map
+//# sourceMappingURL=ManagementClientAuthError-ey-f03vy.js.map

package/dist/{ManagementClientAuthError-iKbBugKC.js.map → ManagementClientAuthError-ey-f03vy.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ManagementClientAuthError-iKbBugKC.js","names":[],"sources":["../src/errors/ManagementClientAuthError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+C,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF"}
+{"version":3,"file":"ManagementClientAuthError-ey-f03vy.js","names":[],"sources":["../src/errors/ManagementClientAuthError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.title = title;\n    this.message = message;\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+C,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF"}

package/dist/{ValidationError-CzPWydEb.js → ValidationError-BekhphAq.js}

@@ -20,11 +20,15 @@ var ValidationError = class ValidationError extends Error {
 };
 const isValidationError = (error) => error instanceof ValidationError;
 /**
-* One line per issue, prefixed by the field it belongs to. Not `z.prettifyError`, which formats for
-* a terminal — its `✖`/`→` glyphs and newlines survive a log but collapse into one run-on line in
-* HTML, where most of these end up.
+* One line per issue, prefixed by the field it belongs to.
+*
+* - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a
+*   log but collapse into one run-on line in HTML, where most of these end up.
+* - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed
+*   element still owes a reason, and it needs the same one line without a `ValidationError`.
+* - Says which field and what is wrong with it, never the value — so it is safe to log.
 */
-const formatIssues = (issues) => issues.map((issue) => {
+const formatValidationIssues = (issues) => issues.map((issue) => {
 	const path = issue.path.join(".");
 	return path ? `${path}: ${issue.message}` : issue.message;
 }).join("; ");
@@ -36,9 +40,9 @@ const formatIssues = (issues) => issues.map((issue) => {
 const parseOrThrow = (schema, value) => {
 	const result = schema.safeParse(value);
 	if (result.success) return result.data;
-	throw new ValidationError(formatIssues(result.error.issues), result.error.issues);
+	throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);
 };
 //#endregion
-export { isValidationError as n, parseOrThrow as r, ValidationError as t };
+export { parseOrThrow as i, formatValidationIssues as n, isValidationError as r, ValidationError as t };
 
-//# sourceMappingURL=ValidationError-CzPWydEb.js.map
+//# sourceMappingURL=ValidationError-BekhphAq.js.map

package/dist/ValidationError-BekhphAq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ValidationError-BekhphAq.js","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to.\n *\n * - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a\n *   log but collapse into one run-on line in HTML, where most of these end up.\n * - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed\n *   element still owes a reason, and it needs the same one line without a `ValidationError`.\n * - Says which field and what is wrong with it, never the value — so it is safe to log.\n */\nexport const formatValidationIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;;;;;AAWnB,MAAa,0BAA0B,WACrC,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,uBAAuB,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAC5F"}

package/dist/{ValidationError-h5qvwahi.cjs → ValidationError-CLVJCCwH.cjs}

@@ -20,11 +20,15 @@ var ValidationError = class ValidationError extends Error {
 };
 const isValidationError = (error) => error instanceof ValidationError;
 /**
-* One line per issue, prefixed by the field it belongs to. Not `z.prettifyError`, which formats for
-* a terminal — its `✖`/`→` glyphs and newlines survive a log but collapse into one run-on line in
-* HTML, where most of these end up.
+* One line per issue, prefixed by the field it belongs to.
+*
+* - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a
+*   log but collapse into one run-on line in HTML, where most of these end up.
+* - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed
+*   element still owes a reason, and it needs the same one line without a `ValidationError`.
+* - Says which field and what is wrong with it, never the value — so it is safe to log.
 */
-const formatIssues = (issues) => issues.map((issue) => {
+const formatValidationIssues = (issues) => issues.map((issue) => {
 	const path = issue.path.join(".");
 	return path ? `${path}: ${issue.message}` : issue.message;
 }).join("; ");
@@ -36,7 +40,7 @@ const formatIssues = (issues) => issues.map((issue) => {
 const parseOrThrow = (schema, value) => {
 	const result = schema.safeParse(value);
 	if (result.success) return result.data;
-	throw new ValidationError(formatIssues(result.error.issues), result.error.issues);
+	throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);
 };
 //#endregion
 Object.defineProperty(exports, "ValidationError", {
@@ -45,6 +49,12 @@ Object.defineProperty(exports, "ValidationError", {
 		return ValidationError;
 	}
 });
+Object.defineProperty(exports, "formatValidationIssues", {
+	enumerable: true,
+	get: function() {
+		return formatValidationIssues;
+	}
+});
 Object.defineProperty(exports, "isValidationError", {
 	enumerable: true,
 	get: function() {
@@ -58,4 +68,4 @@ Object.defineProperty(exports, "parseOrThrow", {
 	}
 });
 
-//# sourceMappingURL=ValidationError-h5qvwahi.cjs.map
+//# sourceMappingURL=ValidationError-CLVJCCwH.cjs.map

package/dist/ValidationError-CLVJCCwH.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ValidationError-CLVJCCwH.cjs","names":[],"sources":["../src/errors/ValidationError.ts"],"sourcesContent":["import type * as z from 'zod';\n\n/**\n * A payload the SDK refused to accept — an input a caller assembled wrongly, or a response that did\n * not match the shape the endpoint is documented to return.\n *\n * It exists so a `ZodError` never leaves the package. `ZodError.message` is `JSON.stringify` of its\n * issue list — over a kilobyte for two problems — and a consumer that renders a caught error's\n * message puts that blob in front of a user. `message` here is a single line built for exactly that\n * rendering, while `issues` keeps the structured detail for anyone inspecting the failure rather\n * than displaying it.\n */\nexport class ValidationError extends Error {\n  issues: z.core.$ZodIssue[];\n\n  constructor(message: string, issues: z.core.$ZodIssue[] = []) {\n    super(message);\n    this.name = 'ValidationError';\n    this.issues = issues;\n    Object.setPrototypeOf(this, ValidationError.prototype);\n  }\n}\n\nexport const isValidationError = (error: unknown): error is ValidationError =>\n  error instanceof ValidationError;\n\n/**\n * One line per issue, prefixed by the field it belongs to.\n *\n * - Not `z.prettifyError`, which formats for a terminal — its `✖`/`→` glyphs and newlines survive a\n *   log but collapse into one run-on line in HTML, where most of these end up.\n * - Exported for the boundaries that degrade instead of throwing: a read that drops one malformed\n *   element still owes a reason, and it needs the same one line without a `ValidationError`.\n * - Says which field and what is wrong with it, never the value — so it is safe to log.\n */\nexport const formatValidationIssues = (issues: readonly z.core.$ZodIssue[]) =>\n  issues\n    .map((issue) => {\n      const path = issue.path.join('.');\n\n      // A root-level issue is about the payload as a whole, and its message already says so —\n      // prefixing it with a name for \"the whole thing\" only adds noise.\n      return path ? `${path}: ${issue.message}` : issue.message;\n    })\n    .join('; ');\n\n/**\n * Parses with `schema`, converting a `ZodError` into a {@link ValidationError}. Use it instead of a\n * bare `schema.parse()` anywhere the value crosses the package boundary — every client input and\n * every response body.\n */\nexport const parseOrThrow = <T extends z.ZodType>(schema: T, value: unknown): z.output<T> => {\n  const result = schema.safeParse(value);\n\n  if (result.success) return result.data;\n\n  throw new ValidationError(formatValidationIssues(result.error.issues), result.error.issues);\n};\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,kBAAb,MAAa,wBAAwB,MAAM;CACzC;CAEA,YAAY,SAAiB,SAA6B,CAAC,GAAG;EAC5D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,OAAO,eAAe,MAAM,gBAAgB,SAAS;CACvD;AACF;AAEA,MAAa,qBAAqB,UAChC,iBAAiB;;;;;;;;;;AAWnB,MAAa,0BAA0B,WACrC,OACG,KAAK,UAAU;CACd,MAAM,OAAO,MAAM,KAAK,KAAK,GAAG;CAIhC,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,YAAY,MAAM;AACpD,CAAC,CAAC,CACD,KAAK,IAAI;;;;;;AAOd,MAAa,gBAAqC,QAAW,UAAgC;CAC3F,MAAM,SAAS,OAAO,UAAU,KAAK;CAErC,IAAI,OAAO,SAAS,OAAO,OAAO;CAElC,MAAM,IAAI,gBAAgB,uBAAuB,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,MAAM;AAC5F"}

package/dist/ai/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-C57Ljzi6.cjs");
-const require_auth = require("../auth-C2_JLisH.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DhUU3M1W.cjs");
+const require_auth = require("../auth-JQ33o3nU.cjs");
 //#region src/clients/ai/aiClient.ts
 const createAiClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({

package/dist/ai/index.d.cts

@@ -1,5 +1,5 @@
-import { a as DescribeConfigurationVersionBody, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, p as components, r as DescribeConfigurationBody, s as DocsQuestionBody, u as FeedbackBody } from "../types-bY6K3y0O.cjs";
-import { n as ClientInitOptions } from "../types-DHI0g51U.cjs";
+import { a as DescribeConfigurationVersionBody, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, p as components, r as DescribeConfigurationBody, s as DocsQuestionBody, u as FeedbackBody } from "../types-52irAt99.cjs";
+import { n as ClientInitOptions } from "../types-_RhBCj4_.cjs";
 //#region src/clients/ai/aiClient.d.ts
 declare const createAiClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<{

package/dist/ai/index.d.ts

@@ -1,5 +1,5 @@
-import { a as DescribeConfigurationVersionBody, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, p as components, r as DescribeConfigurationBody, s as DocsQuestionBody, u as FeedbackBody } from "../types-ZGAWRIBW.js";
-import { n as ClientInitOptions } from "../types-D-98DirB.js";
+import { a as DescribeConfigurationVersionBody, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, p as components, r as DescribeConfigurationBody, s as DocsQuestionBody, u as FeedbackBody } from "../types-BTWIPEiU.js";
+import { n as ClientInitOptions } from "../types-Ct0YPy2w.js";
 //#region src/clients/ai/aiClient.d.ts
 declare const createAiClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<{

package/dist/ai/index.js

@@ -1,5 +1,5 @@
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-E7OIVkYv.js";
-import { t as createAuthHeaders } from "../auth-CE9rQV3-.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-BVSc9ibR.js";
+import { t as createAuthHeaders } from "../auth-aItmDu45.js";
 //#region src/clients/ai/aiClient.ts
 const createAiClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({

package/dist/ai/types.d.cts

@@ -1,2 +1,2 @@
-import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as ObjectDescription, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as FeedbackBody } from "../types-bY6K3y0O.cjs";
+import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as ObjectDescription, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as FeedbackBody } from "../types-52irAt99.cjs";
 export { ComponentDocsDetail, ComponentSuggestion, DescribeConfigurationBody, DescribeConfigurationMergeBody, DescribeConfigurationVersionBody, DocsAnswer, DocsQuestionBody, ErrorExplanation, ExplainErrorBody, FeedbackBody, ObjectDescription, SuggestComponentBody };

package/dist/ai/types.d.ts

@@ -1,2 +1,2 @@
-import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as ObjectDescription, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as FeedbackBody } from "../types-ZGAWRIBW.js";
+import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as ObjectDescription, f as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as FeedbackBody } from "../types-BTWIPEiU.js";
 export { ComponentDocsDetail, ComponentSuggestion, DescribeConfigurationBody, DescribeConfigurationMergeBody, DescribeConfigurationVersionBody, DocsAnswer, DocsQuestionBody, ErrorExplanation, ExplainErrorBody, FeedbackBody, ObjectDescription, SuggestComponentBody };

package/dist/{appLogs-D8K0VeNM.cjs → appLogs-BjfUoWzs.cjs}

@@ -1,6 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
 const require_isPlainObject = require("./isPlainObject-BB3iy87C.cjs");
-const require_createFetchClient = require("./createFetchClient-DvZvD31l.cjs");
+const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
 let dayjs = require("dayjs");
@@ -150,4 +150,4 @@ Object.defineProperty(exports, "readAppLogsTail", {
 	}
 });
 
-//# sourceMappingURL=appLogs-D8K0VeNM.cjs.map
+//# sourceMappingURL=appLogs-BjfUoWzs.cjs.map

package/dist/{appLogs-D8K0VeNM.cjs.map → appLogs-BjfUoWzs.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"appLogs-D8K0VeNM.cjs","names":["utc","z","record","isPlainObject","isApiError","HttpStatus","parseContentDispositionHeader","HttpHeader"],"sources":["../src/domain/appLogs.ts"],"sourcesContent":["import dayjs from 'dayjs';\nimport utc from 'dayjs/plugin/utc.js';\nimport * as z from 'zod';\n\nimport {\n  type ApiResponse,\n  HttpHeader,\n  isApiError,\n  parseContentDispositionHeader,\n} from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { isPlainObject } from '../utils/isPlainObject';\n\n/**\n * Reading a data app's container output. Shared by the two clients wrapping sandboxes-service —\n * `dataScience` (`/v1`) and `apps` (`/v2`) — which serve the same logs under different paths, so the\n * tail contract (how a line is parsed, where the next poll resumes, and that an idle app is not an\n * error) is defined once here rather than per surface.\n */\n\ndayjs.extend(utc);\n\nexport type LogEntry = {\n  timestamp: string | null;\n  message: string;\n};\n\nconst DEFAULT_LOGS_FILE_NAME = 'logs.txt';\n\nconst ISO_TIMESTAMP_REGEX = /\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?Z/;\nconst LEADING_ISO_TIMESTAMP_REGEX = /^(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?Z)\\s?/;\n\n/** The error envelope sandboxes-service returns; the tail branches on its `code`. */\nconst TailError = z.object({\n  context: z.object({\n    code: z.string(),\n  }),\n});\n\n/**\n * There is nothing to read right now, reported per scope: an app whose serving member is asleep\n * answers `apps.appNotRunning`, a deployment that isn't running answers `apps.deploymentNotRunning` —\n * the normal state of a staged or retired one, since a deployment only runs while it is production.\n */\nconst NOTHING_RUNNING_CODES = new Set(['apps.appNotRunning', 'apps.deploymentNotRunning']);\n\nconst tryParseJsonl = (line: string): LogEntry | null => {\n  if (!line.startsWith('{')) return null;\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return null;\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) return null;\n\n  const record = parsed as Record<string, unknown>;\n  const { timestamp, message } = record;\n\n  if (typeof timestamp !== 'string' || typeof message !== 'string') return null;\n\n  return {\n    timestamp,\n    message,\n  };\n};\n\nconst parsePlainTextLine = (line: string): LogEntry => {\n  const match = line.match(LEADING_ISO_TIMESTAMP_REGEX);\n  if (match) {\n    return { timestamp: match[1]!, message: line.slice(match[0].length) };\n  }\n  return { timestamp: null, message: line };\n};\n\nexport const parseLogLine = (line: string): LogEntry =>\n  tryParseJsonl(line) ?? parsePlainTextLine(line);\n\nconst toLogEntryFromObject = (raw: Record<string, unknown>): LogEntry | null => {\n  if (typeof raw.message !== 'string') return null;\n  return {\n    timestamp: typeof raw.timestamp === 'string' ? raw.timestamp : null,\n    message: raw.message,\n  };\n};\n\nexport const parseLogLines = (raw: unknown): LogEntry[] => {\n  if (raw === null || raw === undefined || raw === '') return [];\n\n  if (Array.isArray(raw)) {\n    return raw.flatMap((item) => {\n      if (typeof item === 'string') return item === '' ? [] : [parseLogLine(item)];\n      if (isPlainObject(item)) {\n        const entry = toLogEntryFromObject(item);\n        return entry ? [entry] : [];\n      }\n      return [];\n    });\n  }\n\n  if (isPlainObject(raw)) {\n    const entry = toLogEntryFromObject(raw);\n    return entry ? [entry] : [];\n  }\n\n  if (typeof raw !== 'string') return [];\n\n  const lines = raw.split('\\n');\n  const entries: LogEntry[] = [];\n  for (const line of lines) {\n    if (line === '') continue;\n    entries.push(parseLogLine(line));\n  }\n  return entries;\n};\n\nexport const lastLogTimestamp = (entries: LogEntry[]) => {\n  for (let i = entries.length - 1; i >= 0; i--) {\n    const entry = entries[i];\n    if (!entry) continue;\n    if (entry.timestamp) return entry.timestamp;\n\n    // A plain-text line may carry a timestamp embedded mid-line (legacy format).\n    const match = entry.message.match(ISO_TIMESTAMP_REGEX);\n    if (match) return match[0];\n  }\n  return null;\n};\n\nconst calculateNextLogTimestamp = (timestamp: string | null) => {\n  if (timestamp === null) return null;\n  return dayjs(timestamp).utc().add(1, 'second').utc().format();\n};\n\n/**\n * The tail plus the timestamp a follow-up poll resumes from. A {@link NOTHING_RUNNING_CODES} `400`\n * reads as an empty tail rather than an error — an idle app between visits, or a deployment that is\n * not the one currently serving, has no logs to stream and that is its normal condition.\n */\nexport const readAppLogsTail = async (fetchTail: () => Promise<ApiResponse<string>>) => {\n  try {\n    const { data } = await fetchTail();\n    const entries = parseLogLines(data);\n\n    return {\n      entries,\n      nextLogTimestamp: calculateNextLogTimestamp(lastLogTimestamp(entries)),\n    };\n  } catch (error) {\n    if (isApiError(error) && error.response.status === HttpStatus.BAD_REQUEST) {\n      const code = TailError.safeParse(error.data).data?.context?.code;\n      if (code !== undefined && NOTHING_RUNNING_CODES.has(code)) {\n        return { entries: [], nextLogTimestamp: null };\n      }\n    }\n    throw error;\n  }\n};\n\n/** The whole log as a file download, named by the service's `Content-Disposition` where it sets one. */\nexport const readAppLogsDownload = async (fetchLogs: () => Promise<ApiResponse<string>>) => {\n  const { data, response } = await fetchLogs();\n  const contentDisposition = parseContentDispositionHeader(\n    response.headers.get(HttpHeader.CONTENT_DISPOSITION),\n  );\n\n  return {\n    logs: data,\n    fileName: contentDisposition.filename ?? DEFAULT_LOGS_FILE_NAME,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAA,QAAM,OAAOA,oBAAAA,OAAG;AAOhB,MAAM,yBAAyB;AAE/B,MAAM,sBAAsB;AAC5B,MAAM,8BAA8B;;AAGpC,MAAM,YAAYC,IAAE,OAAO,EACzB,SAASA,IAAE,OAAO,EAChB,MAAMA,IAAE,OAAO,EACjB,CAAC,EACH,CAAC;;;;;;AAOD,MAAM,wCAAwB,IAAI,IAAI,CAAC,sBAAsB,2BAA2B,CAAC;AAEzF,MAAM,iBAAiB,SAAkC;CACvD,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO;CAElC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO;CAG1D,MAAM,EAAE,WAAW,YAAYC;CAE/B,IAAI,OAAO,cAAc,YAAY,OAAO,YAAY,UAAU,OAAO;CAEzE,OAAO;EACL;EACA;CACF;AACF;AAEA,MAAM,sBAAsB,SAA2B;CACrD,MAAM,QAAQ,KAAK,MAAM,2BAA2B;CACpD,IAAI,OACF,OAAO;EAAE,WAAW,MAAM;EAAK,SAAS,KAAK,MAAM,MAAM,EAAE,CAAC,MAAM;CAAE;CAEtE,OAAO;EAAE,WAAW;EAAM,SAAS;CAAK;AAC1C;AAEA,MAAa,gBAAgB,SAC3B,cAAc,IAAI,KAAK,mBAAmB,IAAI;AAEhD,MAAM,wBAAwB,QAAkD;CAC9E,IAAI,OAAO,IAAI,YAAY,UAAU,OAAO;CAC5C,OAAO;EACL,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;EAC/D,SAAS,IAAI;CACf;AACF;AAEA,MAAa,iBAAiB,QAA6B;CACzD,IAAI,QAAQ,QAAQ,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,CAAC;CAE7D,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO,IAAI,SAAS,SAAS;EAC3B,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC;EAC3E,IAAIC,sBAAAA,cAAc,IAAI,GAAG;GACvB,MAAM,QAAQ,qBAAqB,IAAI;GACvC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;EAC5B;EACA,OAAO,CAAC;CACV,CAAC;CAGH,IAAIA,sBAAAA,cAAc,GAAG,GAAG;EACtB,MAAM,QAAQ,qBAAqB,GAAG;EACtC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;CAC5B;CAEA,IAAI,OAAO,QAAQ,UAAU,OAAO,CAAC;CAErC,MAAM,QAAQ,IAAI,MAAM,IAAI;CAC5B,MAAM,UAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,SAAS,IAAI;EACjB,QAAQ,KAAK,aAAa,IAAI,CAAC;CACjC;CACA,OAAO;AACT;AAEA,MAAa,oBAAoB,YAAwB;CACvD,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;EAC5C,MAAM,QAAQ,QAAQ;EACtB,IAAI,CAAC,OAAO;EACZ,IAAI,MAAM,WAAW,OAAO,MAAM;EAGlC,MAAM,QAAQ,MAAM,QAAQ,MAAM,mBAAmB;EACrD,IAAI,OAAO,OAAO,MAAM;CAC1B;CACA,OAAO;AACT;AAEA,MAAM,6BAA6B,cAA6B;CAC9D,IAAI,cAAc,MAAM,OAAO;CAC/B,QAAA,GAAO,MAAA,QAAA,CAAM,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;AAC9D;;;;;;AAOA,MAAa,kBAAkB,OAAO,cAAkD;CACtF,IAAI;EACF,MAAM,EAAE,SAAS,MAAM,UAAU;EACjC,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO;GACL;GACA,kBAAkB,0BAA0B,iBAAiB,OAAO,CAAC;EACvE;CACF,SAAS,OAAO;EACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,aAAa;GACzE,MAAM,OAAO,UAAU,UAAU,MAAM,IAAI,CAAC,CAAC,MAAM,SAAS;GAC5D,IAAI,SAAS,KAAA,KAAa,sBAAsB,IAAI,IAAI,GACtD,OAAO;IAAE,SAAS,CAAC;IAAG,kBAAkB;GAAK;EAEjD;EACA,MAAM;CACR;AACF;;AAGA,MAAa,sBAAsB,OAAO,cAAkD;CAC1F,MAAM,EAAE,MAAM,aAAa,MAAM,UAAU;CAK3C,OAAO;EACL,MAAM;EACN,UANyBC,0BAAAA,8BACzB,SAAS,QAAQ,IAAIC,0BAAAA,WAAW,mBAAmB,CAKxB,CAAC,CAAC,YAAY;CAC3C;AACF"}
+{"version":3,"file":"appLogs-BjfUoWzs.cjs","names":["utc","z","record","isPlainObject","isApiError","HttpStatus","parseContentDispositionHeader","HttpHeader"],"sources":["../src/domain/appLogs.ts"],"sourcesContent":["import dayjs from 'dayjs';\nimport utc from 'dayjs/plugin/utc.js';\nimport * as z from 'zod';\n\nimport {\n  type ApiResponse,\n  HttpHeader,\n  isApiError,\n  parseContentDispositionHeader,\n} from '../fetchClient';\nimport { HttpStatus } from '../internal';\nimport { isPlainObject } from '../utils/isPlainObject';\n\n/**\n * Reading a data app's container output. Shared by the two clients wrapping sandboxes-service —\n * `dataScience` (`/v1`) and `apps` (`/v2`) — which serve the same logs under different paths, so the\n * tail contract (how a line is parsed, where the next poll resumes, and that an idle app is not an\n * error) is defined once here rather than per surface.\n */\n\ndayjs.extend(utc);\n\nexport type LogEntry = {\n  timestamp: string | null;\n  message: string;\n};\n\nconst DEFAULT_LOGS_FILE_NAME = 'logs.txt';\n\nconst ISO_TIMESTAMP_REGEX = /\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?Z/;\nconst LEADING_ISO_TIMESTAMP_REGEX = /^(\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?Z)\\s?/;\n\n/** The error envelope sandboxes-service returns; the tail branches on its `code`. */\nconst TailError = z.object({\n  context: z.object({\n    code: z.string(),\n  }),\n});\n\n/**\n * There is nothing to read right now, reported per scope: an app whose serving member is asleep\n * answers `apps.appNotRunning`, a deployment that isn't running answers `apps.deploymentNotRunning` —\n * the normal state of a staged or retired one, since a deployment only runs while it is production.\n */\nconst NOTHING_RUNNING_CODES = new Set(['apps.appNotRunning', 'apps.deploymentNotRunning']);\n\nconst tryParseJsonl = (line: string): LogEntry | null => {\n  if (!line.startsWith('{')) return null;\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return null;\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) return null;\n\n  const record = parsed as Record<string, unknown>;\n  const { timestamp, message } = record;\n\n  if (typeof timestamp !== 'string' || typeof message !== 'string') return null;\n\n  return {\n    timestamp,\n    message,\n  };\n};\n\nconst parsePlainTextLine = (line: string): LogEntry => {\n  const match = line.match(LEADING_ISO_TIMESTAMP_REGEX);\n  if (match) {\n    return { timestamp: match[1]!, message: line.slice(match[0].length) };\n  }\n  return { timestamp: null, message: line };\n};\n\nexport const parseLogLine = (line: string): LogEntry =>\n  tryParseJsonl(line) ?? parsePlainTextLine(line);\n\nconst toLogEntryFromObject = (raw: Record<string, unknown>): LogEntry | null => {\n  if (typeof raw.message !== 'string') return null;\n  return {\n    timestamp: typeof raw.timestamp === 'string' ? raw.timestamp : null,\n    message: raw.message,\n  };\n};\n\nexport const parseLogLines = (raw: unknown): LogEntry[] => {\n  if (raw === null || raw === undefined || raw === '') return [];\n\n  if (Array.isArray(raw)) {\n    return raw.flatMap((item) => {\n      if (typeof item === 'string') return item === '' ? [] : [parseLogLine(item)];\n      if (isPlainObject(item)) {\n        const entry = toLogEntryFromObject(item);\n        return entry ? [entry] : [];\n      }\n      return [];\n    });\n  }\n\n  if (isPlainObject(raw)) {\n    const entry = toLogEntryFromObject(raw);\n    return entry ? [entry] : [];\n  }\n\n  if (typeof raw !== 'string') return [];\n\n  const lines = raw.split('\\n');\n  const entries: LogEntry[] = [];\n  for (const line of lines) {\n    if (line === '') continue;\n    entries.push(parseLogLine(line));\n  }\n  return entries;\n};\n\nexport const lastLogTimestamp = (entries: LogEntry[]) => {\n  for (let i = entries.length - 1; i >= 0; i--) {\n    const entry = entries[i];\n    if (!entry) continue;\n    if (entry.timestamp) return entry.timestamp;\n\n    // A plain-text line may carry a timestamp embedded mid-line (legacy format).\n    const match = entry.message.match(ISO_TIMESTAMP_REGEX);\n    if (match) return match[0];\n  }\n  return null;\n};\n\nconst calculateNextLogTimestamp = (timestamp: string | null) => {\n  if (timestamp === null) return null;\n  return dayjs(timestamp).utc().add(1, 'second').utc().format();\n};\n\n/**\n * The tail plus the timestamp a follow-up poll resumes from. A {@link NOTHING_RUNNING_CODES} `400`\n * reads as an empty tail rather than an error — an idle app between visits, or a deployment that is\n * not the one currently serving, has no logs to stream and that is its normal condition.\n */\nexport const readAppLogsTail = async (fetchTail: () => Promise<ApiResponse<string>>) => {\n  try {\n    const { data } = await fetchTail();\n    const entries = parseLogLines(data);\n\n    return {\n      entries,\n      nextLogTimestamp: calculateNextLogTimestamp(lastLogTimestamp(entries)),\n    };\n  } catch (error) {\n    if (isApiError(error) && error.response.status === HttpStatus.BAD_REQUEST) {\n      const code = TailError.safeParse(error.data).data?.context?.code;\n      if (code !== undefined && NOTHING_RUNNING_CODES.has(code)) {\n        return { entries: [], nextLogTimestamp: null };\n      }\n    }\n    throw error;\n  }\n};\n\n/** The whole log as a file download, named by the service's `Content-Disposition` where it sets one. */\nexport const readAppLogsDownload = async (fetchLogs: () => Promise<ApiResponse<string>>) => {\n  const { data, response } = await fetchLogs();\n  const contentDisposition = parseContentDispositionHeader(\n    response.headers.get(HttpHeader.CONTENT_DISPOSITION),\n  );\n\n  return {\n    logs: data,\n    fileName: contentDisposition.filename ?? DEFAULT_LOGS_FILE_NAME,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;AAoBA,MAAA,QAAM,OAAOA,oBAAAA,OAAG;AAOhB,MAAM,yBAAyB;AAE/B,MAAM,sBAAsB;AAC5B,MAAM,8BAA8B;;AAGpC,MAAM,YAAYC,IAAE,OAAO,EACzB,SAASA,IAAE,OAAO,EAChB,MAAMA,IAAE,OAAO,EACjB,CAAC,EACH,CAAC;;;;;;AAOD,MAAM,wCAAwB,IAAI,IAAI,CAAC,sBAAsB,2BAA2B,CAAC;AAEzF,MAAM,iBAAiB,SAAkC;CACvD,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG,OAAO;CAElC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO;CAG1D,MAAM,EAAE,WAAW,YAAYC;CAE/B,IAAI,OAAO,cAAc,YAAY,OAAO,YAAY,UAAU,OAAO;CAEzE,OAAO;EACL;EACA;CACF;AACF;AAEA,MAAM,sBAAsB,SAA2B;CACrD,MAAM,QAAQ,KAAK,MAAM,2BAA2B;CACpD,IAAI,OACF,OAAO;EAAE,WAAW,MAAM;EAAK,SAAS,KAAK,MAAM,MAAM,EAAE,CAAC,MAAM;CAAE;CAEtE,OAAO;EAAE,WAAW;EAAM,SAAS;CAAK;AAC1C;AAEA,MAAa,gBAAgB,SAC3B,cAAc,IAAI,KAAK,mBAAmB,IAAI;AAEhD,MAAM,wBAAwB,QAAkD;CAC9E,IAAI,OAAO,IAAI,YAAY,UAAU,OAAO;CAC5C,OAAO;EACL,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;EAC/D,SAAS,IAAI;CACf;AACF;AAEA,MAAa,iBAAiB,QAA6B;CACzD,IAAI,QAAQ,QAAQ,QAAQ,KAAA,KAAa,QAAQ,IAAI,OAAO,CAAC;CAE7D,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO,IAAI,SAAS,SAAS;EAC3B,IAAI,OAAO,SAAS,UAAU,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC;EAC3E,IAAIC,sBAAAA,cAAc,IAAI,GAAG;GACvB,MAAM,QAAQ,qBAAqB,IAAI;GACvC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;EAC5B;EACA,OAAO,CAAC;CACV,CAAC;CAGH,IAAIA,sBAAAA,cAAc,GAAG,GAAG;EACtB,MAAM,QAAQ,qBAAqB,GAAG;EACtC,OAAO,QAAQ,CAAC,KAAK,IAAI,CAAC;CAC5B;CAEA,IAAI,OAAO,QAAQ,UAAU,OAAO,CAAC;CAErC,MAAM,QAAQ,IAAI,MAAM,IAAI;CAC5B,MAAM,UAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,SAAS,IAAI;EACjB,QAAQ,KAAK,aAAa,IAAI,CAAC;CACjC;CACA,OAAO;AACT;AAEA,MAAa,oBAAoB,YAAwB;CACvD,KAAK,IAAI,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;EAC5C,MAAM,QAAQ,QAAQ;EACtB,IAAI,CAAC,OAAO;EACZ,IAAI,MAAM,WAAW,OAAO,MAAM;EAGlC,MAAM,QAAQ,MAAM,QAAQ,MAAM,mBAAmB;EACrD,IAAI,OAAO,OAAO,MAAM;CAC1B;CACA,OAAO;AACT;AAEA,MAAM,6BAA6B,cAA6B;CAC9D,IAAI,cAAc,MAAM,OAAO;CAC/B,QAAA,GAAO,MAAA,QAAA,CAAM,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;AAC9D;;;;;;AAOA,MAAa,kBAAkB,OAAO,cAAkD;CACtF,IAAI;EACF,MAAM,EAAE,SAAS,MAAM,UAAU;EACjC,MAAM,UAAU,cAAc,IAAI;EAElC,OAAO;GACL;GACA,kBAAkB,0BAA0B,iBAAiB,OAAO,CAAC;EACvE;CACF,SAAS,OAAO;EACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,aAAa;GACzE,MAAM,OAAO,UAAU,UAAU,MAAM,IAAI,CAAC,CAAC,MAAM,SAAS;GAC5D,IAAI,SAAS,KAAA,KAAa,sBAAsB,IAAI,IAAI,GACtD,OAAO;IAAE,SAAS,CAAC;IAAG,kBAAkB;GAAK;EAEjD;EACA,MAAM;CACR;AACF;;AAGA,MAAa,sBAAsB,OAAO,cAAkD;CAC1F,MAAM,EAAE,MAAM,aAAa,MAAM,UAAU;CAK3C,OAAO;EACL,MAAM;EACN,UANyBC,0BAAAA,8BACzB,SAAS,QAAQ,IAAIC,0BAAAA,WAAW,mBAAmB,CAKxB,CAAC,CAAC,YAAY;CAC3C;AACF"}

package/dist/{appLogs-u0XMZLjS.d.ts → appLogs-Ch7DYpzx.d.ts}

@@ -1,4 +1,4 @@
-import "./index-DVhTNwvu.js";
+import "./index-KuQ79Mnz.js";
 //#region src/domain/appLogs.d.ts
 type LogEntry = {
   timestamp: string | null;
@@ -7,4 +7,4 @@ type LogEntry = {
 declare const parseLogLines: (raw: unknown) => LogEntry[];
 //#endregion
 export { parseLogLines as n, LogEntry as t };
-//# sourceMappingURL=appLogs-u0XMZLjS.d.ts.map
+//# sourceMappingURL=appLogs-Ch7DYpzx.d.ts.map

package/dist/{appLogs-Q4A7A_Fc.d.cts → appLogs-D5A13Y0y.d.cts}

@@ -1,4 +1,4 @@
-import "./index-DhVFuQDv.cjs";
+import "./index-V7XKUQm9.cjs";
 //#region src/domain/appLogs.d.ts
 type LogEntry = {
   timestamp: string | null;
@@ -7,4 +7,4 @@ type LogEntry = {
 declare const parseLogLines: (raw: unknown) => LogEntry[];
 //#endregion
 export { parseLogLines as n, LogEntry as t };
-//# sourceMappingURL=appLogs-Q4A7A_Fc.d.cts.map
+//# sourceMappingURL=appLogs-D5A13Y0y.d.cts.map

package/dist/{appLogs-D72eD8vP.js → appLogs-xsVkTriU.js}

@@ -1,5 +1,5 @@
 import { t as isPlainObject } from "./isPlainObject-LYW-03uB.js";
-import { d as parseContentDispositionHeader, p as HttpStatus, r as isApiError, s as HttpHeader } from "./createFetchClient-DdyZMhxO.js";
+import { f as parseContentDispositionHeader, m as HttpStatus, r as isApiError, s as HttpHeader } from "./createFetchClient-U-ZrwPl2.js";
 import * as z$1 from "zod";
 import dayjs from "dayjs";
 import utc from "dayjs/plugin/utc.js";
@@ -129,4 +129,4 @@ const readAppLogsDownload = async (fetchLogs) => {
 //#endregion
 export { readAppLogsDownload as n, readAppLogsTail as r, parseLogLines as t };
 
-//# sourceMappingURL=appLogs-D72eD8vP.js.map
+//# sourceMappingURL=appLogs-xsVkTriU.js.map