@keboola/api-client 36.0.0 → 40.0.0

package/dist/{queue-DyotLFJi.js → queue-Cowbg6bR.js}

@@ -1,7 +1,7 @@
-import { a as poller, f as createAbortError, t as jobStatus } from "./jobStatus-PSZJMTiA.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-rxvUUbap.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-BVSc9ibR.js";
-import { t as createAuthHeaders } from "./auth-aItmDu45.js";
+import { a as poller, f as createAbortError, t as jobStatus } from "./jobStatus-CfRtsIpv.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-Dg1rgzmG.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DZUOVupy.js";
+import { t as createAuthHeaders } from "./auth-DworfoPy.js";
 //#region src/utils/async/collect.ts
 /**
 * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when
@@ -33,12 +33,9 @@ const DEFAULT_POLL_INTERVAL = 2e3;
 /**
 * Waits on a queue job.
 *
-* - Takes the job, not its id: the component is what makes a poll legible in dev tools, and only the
-*   job carries it.
-* - The request reads the id off the key rather than out of a closure, which is what makes the key
-*   the whole input.
-* - Terminal is terminal: a job that ended as `error` is a `done` poll carrying a failed job, and
-*   what that means is the caller's business.
+* - Takes the job, not its id: the component makes the poll legible in dev tools.
+* - `pollFn` reads the id off the key, so the key is the whole input.
+* - A job that ended as `error` is a `done` poll; interpreting it is the caller's job.
 */
 const createJobPoller = ({ getJob }) => ({ id, component }, { interval, maxAttempts, timeout, signal } = {}) => poller({
 	pollKey: ["queue.job", {
@@ -123,4 +120,4 @@ const createQueueClient = ({ baseUrl, middlewares, auth }) => {
 //#endregion
 export { collect as n, createQueueClient as t };
 
-//# sourceMappingURL=queue-DyotLFJi.js.map
+//# sourceMappingURL=queue-Cowbg6bR.js.map

package/dist/queue-Cowbg6bR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-Cowbg6bR.js","names":[],"sources":["../src/utils/async/collect.ts","../src/clients/queue/poller.ts","../src/clients/queue/queueClient.ts"],"sourcesContent":["import { createAbortError } from '../createAbortError';\n\nexport type CollectOptions<T> = {\n  fetchFrom: (offset: number, pageSize?: number, signal?: AbortSignal) => Promise<T[]>;\n  pageSize?: number;\n  limit?: number;\n  signal?: AbortSignal;\n};\n\n/**\n * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when\n * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of\n * items received, and hands it `pageSize` so the request and the traversal agree on one value.\n *\n * Traversal ends on a page shorter than `pageSize`, or — when `pageSize` is omitted — only on an\n * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the\n * endpoint returns fewer items per page than asked for.\n */\nexport const collect = async <T>({\n  fetchFrom,\n  pageSize,\n  limit,\n  signal,\n}: CollectOptions<T>): Promise<T[]> => {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  if (limit !== undefined && limit < 0) throw new Error('Invalid collect limit');\n  if (pageSize !== undefined && pageSize < 1) throw new Error('Invalid collect pageSize');\n\n  const items: T[] = [];\n\n  if (limit === 0) return items;\n\n  let offset = 0;\n\n  while (true) {\n    const batch = await fetchFrom(offset, pageSize, signal);\n\n    items.push(...batch);\n    offset += batch.length;\n\n    if (limit !== undefined && items.length >= limit) return items.slice(0, limit);\n    if (pageSize === undefined ? batch.length === 0 : batch.length < pageSize) return items;\n  }\n};\n","import { jobStatus } from '../../domain/jobStatus';\nimport { poller } from '../../utils/async';\n\nimport type { GetQueueJobPath, QueueJob } from './types';\n\nconst DEFAULT_POLL_INTERVAL = 2000;\n\ntype QueueJobPollOptions = {\n  interval?: number;\n  maxAttempts?: number;\n  timeout?: number;\n  signal?: AbortSignal;\n};\n\ntype GetJob = (jobId: GetQueueJobPath['jobId'], signal?: AbortSignal) => Promise<QueueJob>;\n\n/**\n * Waits on a queue job.\n *\n * - Takes the job, not its id: the component makes the poll legible in dev tools.\n * - `pollFn` reads the id off the key, so the key is the whole input.\n * - A job that ended as `error` is a `done` poll; interpreting it is the caller's job.\n */\nexport const createJobPoller =\n  ({ getJob }: { getJob: GetJob }) =>\n  (\n    { id, component }: { id: GetQueueJobPath['jobId']; component: string },\n    { interval, maxAttempts, timeout, signal }: QueueJobPollOptions = {},\n  ) =>\n    poller({\n      pollKey: ['queue.job', { jobId: id, component }] as const,\n      pollFn: ({ pollKey: [, params], signal: pollSignal }) => getJob(params.jobId, pollSignal),\n      until: ({ data }) => jobStatus.queue.isTerminal(data.status),\n      backoff: { type: 'constant', interval: interval ?? DEFAULT_POLL_INTERVAL },\n      maxAttempts,\n      timeout,\n      signal,\n    });\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport { collect } from '../../utils';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createJobPoller } from './poller';\nimport type {\n  CreateJobBody,\n  GetQueueJobPath,\n  KillJobPath,\n  OrchestrationRerunPlanPath,\n  SearchAllJobsQuery,\n  SearchGroupedJobsQuery,\n  SearchJobsQuery,\n} from './types';\n\nexport const createQueueClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getJob = async (jobId: GetQueueJobPath['jobId'], signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/jobs/{jobId}',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchJobs = async (query?: SearchJobsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/search/jobs',\n      {\n        query,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchAllJobs = (query: SearchAllJobsQuery, signal?: AbortSignal) => {\n    return collect({\n      pageSize: query.limit,\n      signal,\n      fetchFrom: (offset, pageSize, batchSignal) => {\n        return searchJobs({ ...query, limit: pageSize, offset }, batchSignal);\n      },\n    });\n  };\n\n  const createJob = async (body: CreateJobBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/jobs', { body }, { signal });\n\n    return data;\n  };\n\n  const killJob = async (jobId: KillJobPath['jobId'], signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/jobs/{jobId}/kill',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchGroupedJobs = async (query: SearchGroupedJobsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/search/grouped-jobs',\n      {\n        query,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getOrchestrationRerunPlan = async (\n    jobId: OrchestrationRerunPlanPath['jobId'],\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/orchestration-rerun-plan/{jobId}',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  // Every wait on a queue job is the same wait, so it is the client's rather than a caller's.\n  const poller = createJobPoller({ getJob });\n\n  return {\n    healthCheck,\n    poller,\n    getJob,\n    searchJobs,\n    searchAllJobs,\n    createJob,\n    killJob,\n    searchGroupedJobs,\n    getOrchestrationRerunPlan,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAa,UAAU,OAAU,EAC/B,WACA,UACA,OACA,aACqC;CACrC,IAAI,QAAQ,SAAS,MAAM,iBAAiB,OAAO,MAAM;CACzD,IAAI,UAAU,KAAA,KAAa,QAAQ,GAAG,MAAM,IAAI,MAAM,uBAAuB;CAC7E,IAAI,aAAa,KAAA,KAAa,WAAW,GAAG,MAAM,IAAI,MAAM,0BAA0B;CAEtF,MAAM,QAAa,CAAC;CAEpB,IAAI,UAAU,GAAG,OAAO;CAExB,IAAI,SAAS;CAEb,OAAO,MAAM;EACX,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,MAAM;EAEtD,MAAM,KAAK,GAAG,KAAK;EACnB,UAAU,MAAM;EAEhB,IAAI,UAAU,KAAA,KAAa,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,GAAG,KAAK;EAC7E,IAAI,aAAa,KAAA,IAAY,MAAM,WAAW,IAAI,MAAM,SAAS,UAAU,OAAO;CACpF;AACF;;;ACtCA,MAAM,wBAAwB;;;;;;;;AAkB9B,MAAa,mBACV,EAAE,cAED,EAAE,IAAI,aACN,EAAE,UAAU,aAAa,SAAS,WAAgC,CAAC,MAEnE,OAAO;CACL,SAAS,CAAC,aAAa;EAAE,OAAO;EAAI;CAAU,CAAC;CAC/C,SAAS,EAAE,SAAS,GAAG,SAAS,QAAQ,iBAAiB,OAAO,OAAO,OAAO,UAAU;CACxF,QAAQ,EAAE,WAAW,UAAU,MAAM,WAAW,KAAK,MAAM;CAC3D,SAAS;EAAE,MAAM;EAAY,UAAU,YAAY;CAAsB;CACzE;CACA;CACA;AACF,CAAC;;;ACpBL,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,SAAS,OAAO,OAAiC,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,iBACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,OAAyB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EACE,MACF,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,OAA2B,WAAyB;EACzE,OAAO,QAAQ;GACb,UAAU,MAAM;GAChB;GACA,YAAY,QAAQ,UAAU,gBAAgB;IAC5C,OAAO,WAAW;KAAE,GAAG;KAAO,OAAO;KAAU;IAAO,GAAG,WAAW;GACtE;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAAO,MAAqB,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,OAA6B,WAAyB;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sBACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAO,OAA+B,WAAyB;EACvF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,wBACA,EACE,MACF,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,4BAA4B,OAChC,OACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAKA,OAAO;EACL;EACA,QAJa,gBAAgB,EAAE,OAAO,CAIjC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/{queue-OJJUUqc2.cjs → queue-UG_BWKIC.cjs}

@@ -1,7 +1,7 @@
-const require_jobStatus = require("./jobStatus-0_Y3Sr4i.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-o3cPJeRn.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DhUU3M1W.cjs");
-const require_auth = require("./auth-JQ33o3nU.cjs");
+const require_jobStatus = require("./jobStatus-BMlsyXWI.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-Dl9cqTvR.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-BYqW-9tm.cjs");
+const require_auth = require("./auth-Dm0F2rOh.cjs");
 //#region src/utils/async/collect.ts
 /**
 * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when
@@ -33,12 +33,9 @@ const DEFAULT_POLL_INTERVAL = 2e3;
 /**
 * Waits on a queue job.
 *
-* - Takes the job, not its id: the component is what makes a poll legible in dev tools, and only the
-*   job carries it.
-* - The request reads the id off the key rather than out of a closure, which is what makes the key
-*   the whole input.
-* - Terminal is terminal: a job that ended as `error` is a `done` poll carrying a failed job, and
-*   what that means is the caller's business.
+* - Takes the job, not its id: the component makes the poll legible in dev tools.
+* - `pollFn` reads the id off the key, so the key is the whole input.
+* - A job that ended as `error` is a `done` poll; interpreting it is the caller's job.
 */
 const createJobPoller = ({ getJob }) => ({ id, component }, { interval, maxAttempts, timeout, signal } = {}) => require_jobStatus.poller({
 	pollKey: ["queue.job", {
@@ -134,4 +131,4 @@ Object.defineProperty(exports, "createQueueClient", {
 	}
 });
 
-//# sourceMappingURL=queue-OJJUUqc2.cjs.map
+//# sourceMappingURL=queue-UG_BWKIC.cjs.map

package/dist/queue-UG_BWKIC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-UG_BWKIC.cjs","names":["createAbortError","poller","jobStatus","createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient"],"sources":["../src/utils/async/collect.ts","../src/clients/queue/poller.ts","../src/clients/queue/queueClient.ts"],"sourcesContent":["import { createAbortError } from '../createAbortError';\n\nexport type CollectOptions<T> = {\n  fetchFrom: (offset: number, pageSize?: number, signal?: AbortSignal) => Promise<T[]>;\n  pageSize?: number;\n  limit?: number;\n  signal?: AbortSignal;\n};\n\n/**\n * Collects items from an offset-paginated endpoint — up to `limit` of them, or all of them when\n * `limit` is omitted. Calls `fetchFrom` sequentially with the offset advancing by the number of\n * items received, and hands it `pageSize` so the request and the traversal agree on one value.\n *\n * Traversal ends on a page shorter than `pageSize`, or — when `pageSize` is omitted — only on an\n * empty page. Passing it therefore saves the trailing request, at the cost of stopping early if the\n * endpoint returns fewer items per page than asked for.\n */\nexport const collect = async <T>({\n  fetchFrom,\n  pageSize,\n  limit,\n  signal,\n}: CollectOptions<T>): Promise<T[]> => {\n  if (signal?.aborted) throw createAbortError(signal.reason);\n  if (limit !== undefined && limit < 0) throw new Error('Invalid collect limit');\n  if (pageSize !== undefined && pageSize < 1) throw new Error('Invalid collect pageSize');\n\n  const items: T[] = [];\n\n  if (limit === 0) return items;\n\n  let offset = 0;\n\n  while (true) {\n    const batch = await fetchFrom(offset, pageSize, signal);\n\n    items.push(...batch);\n    offset += batch.length;\n\n    if (limit !== undefined && items.length >= limit) return items.slice(0, limit);\n    if (pageSize === undefined ? batch.length === 0 : batch.length < pageSize) return items;\n  }\n};\n","import { jobStatus } from '../../domain/jobStatus';\nimport { poller } from '../../utils/async';\n\nimport type { GetQueueJobPath, QueueJob } from './types';\n\nconst DEFAULT_POLL_INTERVAL = 2000;\n\ntype QueueJobPollOptions = {\n  interval?: number;\n  maxAttempts?: number;\n  timeout?: number;\n  signal?: AbortSignal;\n};\n\ntype GetJob = (jobId: GetQueueJobPath['jobId'], signal?: AbortSignal) => Promise<QueueJob>;\n\n/**\n * Waits on a queue job.\n *\n * - Takes the job, not its id: the component makes the poll legible in dev tools.\n * - `pollFn` reads the id off the key, so the key is the whole input.\n * - A job that ended as `error` is a `done` poll; interpreting it is the caller's job.\n */\nexport const createJobPoller =\n  ({ getJob }: { getJob: GetJob }) =>\n  (\n    { id, component }: { id: GetQueueJobPath['jobId']; component: string },\n    { interval, maxAttempts, timeout, signal }: QueueJobPollOptions = {},\n  ) =>\n    poller({\n      pollKey: ['queue.job', { jobId: id, component }] as const,\n      pollFn: ({ pollKey: [, params], signal: pollSignal }) => getJob(params.jobId, pollSignal),\n      until: ({ data }) => jobStatus.queue.isTerminal(data.status),\n      backoff: { type: 'constant', interval: interval ?? DEFAULT_POLL_INTERVAL },\n      maxAttempts,\n      timeout,\n      signal,\n    });\n","import { createGenericFetchClient, createOpenapiFetchClient } from '../../fetchClient';\nimport { collect } from '../../utils';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport { createJobPoller } from './poller';\nimport type {\n  CreateJobBody,\n  GetQueueJobPath,\n  KillJobPath,\n  OrchestrationRerunPlanPath,\n  SearchAllJobsQuery,\n  SearchGroupedJobsQuery,\n  SearchJobsQuery,\n} from './types';\n\nexport const createQueueClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getJob = async (jobId: GetQueueJobPath['jobId'], signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/jobs/{jobId}',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchJobs = async (query?: SearchJobsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/search/jobs',\n      {\n        query,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchAllJobs = (query: SearchAllJobsQuery, signal?: AbortSignal) => {\n    return collect({\n      pageSize: query.limit,\n      signal,\n      fetchFrom: (offset, pageSize, batchSignal) => {\n        return searchJobs({ ...query, limit: pageSize, offset }, batchSignal);\n      },\n    });\n  };\n\n  const createJob = async (body: CreateJobBody, signal?: AbortSignal) => {\n    const { data } = await client.post('/jobs', { body }, { signal });\n\n    return data;\n  };\n\n  const killJob = async (jobId: KillJobPath['jobId'], signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/jobs/{jobId}/kill',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const searchGroupedJobs = async (query: SearchGroupedJobsQuery, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/search/grouped-jobs',\n      {\n        query,\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getOrchestrationRerunPlan = async (\n    jobId: OrchestrationRerunPlanPath['jobId'],\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/orchestration-rerun-plan/{jobId}',\n      {\n        path: { jobId },\n      },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  // Every wait on a queue job is the same wait, so it is the client's rather than a caller's.\n  const poller = createJobPoller({ getJob });\n\n  return {\n    healthCheck,\n    poller,\n    getJob,\n    searchJobs,\n    searchAllJobs,\n    createJob,\n    killJob,\n    searchGroupedJobs,\n    getOrchestrationRerunPlan,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAa,UAAU,OAAU,EAC/B,WACA,UACA,OACA,aACqC;CACrC,IAAI,QAAQ,SAAS,MAAMA,kBAAAA,iBAAiB,OAAO,MAAM;CACzD,IAAI,UAAU,KAAA,KAAa,QAAQ,GAAG,MAAM,IAAI,MAAM,uBAAuB;CAC7E,IAAI,aAAa,KAAA,KAAa,WAAW,GAAG,MAAM,IAAI,MAAM,0BAA0B;CAEtF,MAAM,QAAa,CAAC;CAEpB,IAAI,UAAU,GAAG,OAAO;CAExB,IAAI,SAAS;CAEb,OAAO,MAAM;EACX,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,MAAM;EAEtD,MAAM,KAAK,GAAG,KAAK;EACnB,UAAU,MAAM;EAEhB,IAAI,UAAU,KAAA,KAAa,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,GAAG,KAAK;EAC7E,IAAI,aAAa,KAAA,IAAY,MAAM,WAAW,IAAI,MAAM,SAAS,UAAU,OAAO;CACpF;AACF;;;ACtCA,MAAM,wBAAwB;;;;;;;;AAkB9B,MAAa,mBACV,EAAE,cAED,EAAE,IAAI,aACN,EAAE,UAAU,aAAa,SAAS,WAAgC,CAAC,MAEnEC,kBAAAA,OAAO;CACL,SAAS,CAAC,aAAa;EAAE,OAAO;EAAI;CAAU,CAAC;CAC/C,SAAS,EAAE,SAAS,GAAG,SAAS,QAAQ,iBAAiB,OAAO,OAAO,OAAO,UAAU;CACxF,QAAQ,EAAE,WAAWC,kBAAAA,UAAU,MAAM,WAAW,KAAK,MAAM;CAC3D,SAAS;EAAE,MAAM;EAAY,UAAU,YAAY;CAAsB;CACzE;CACA;CACA;AACF,CAAC;;;ACpBL,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASC,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,SAAS,OAAO,OAAiC,WAAyB;EAC9E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,iBACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,aAAa,OAAO,OAAyB,WAAyB;EAC1E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EACE,MACF,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,OAA2B,WAAyB;EACzE,OAAO,QAAQ;GACb,UAAU,MAAM;GAChB;GACA,YAAY,QAAQ,UAAU,gBAAgB;IAC5C,OAAO,WAAW;KAAE,GAAG;KAAO,OAAO;KAAU;IAAO,GAAG,WAAW;GACtE;EACF,CAAC;CACH;CAEA,MAAM,YAAY,OAAO,MAAqB,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,OAA6B,WAAyB;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sBACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAO,OAA+B,WAAyB;EACvF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,wBACA,EACE,MACF,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,4BAA4B,OAChC,OACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EACE,MAAM,EAAE,MAAM,EAChB,GACA,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAKA,OAAO;EACL;EACA,QAJa,gBAAgB,EAAE,OAAO,CAIjC;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/scheduler/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_concurrent = require("../concurrent-tbiIa0UL.cjs");
-const require_createGenericFetchClient = require("../createGenericFetchClient-o3cPJeRn.cjs");
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DhUU3M1W.cjs");
-const require_auth = require("../auth-JQ33o3nU.cjs");
+const require_concurrent = require("../concurrent-CdVfR1N5.cjs");
+const require_createGenericFetchClient = require("../createGenericFetchClient-Dl9cqTvR.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-BYqW-9tm.cjs");
+const require_auth = require("../auth-Dm0F2rOh.cjs");
 //#region src/clients/scheduler/schedulerClient.ts
 const createSchedulerClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({

package/dist/scheduler/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-_RhBCj4_.cjs";
-import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-BW2BXUB4.cjs";
+import { n as ClientInitOptions } from "../types-DoZtE9tz.cjs";
+import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-DE9hgr7i.cjs";
 //#region src/clients/scheduler/schedulerClient.d.ts
 declare const createSchedulerClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/scheduler/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-Ct0YPy2w.js";
-import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-zZBxJ0P-.js";
+import { n as ClientInitOptions } from "../types-B2w2TtSA.js";
+import { a as SchedulePath, n as ConfigurationPath, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-CWyXTMwy.js";
 //#region src/clients/scheduler/schedulerClient.d.ts
 declare const createSchedulerClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/scheduler/index.js

@@ -1,7 +1,7 @@
-import { t as concurrent } from "../concurrent-CH9fbNr3.js";
-import { t as createGenericFetchClient } from "../createGenericFetchClient-rxvUUbap.js";
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-BVSc9ibR.js";
-import { t as createAuthHeaders } from "../auth-aItmDu45.js";
+import { t as concurrent } from "../concurrent-BacWxPwi.js";
+import { t as createGenericFetchClient } from "../createGenericFetchClient-Dg1rgzmG.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DZUOVupy.js";
+import { t as createAuthHeaders } from "../auth-DworfoPy.js";
 //#region src/clients/scheduler/schedulerClient.ts
 const createSchedulerClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({

package/dist/scheduler/types.d.cts

@@ -1,2 +1,2 @@
-import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-BW2BXUB4.cjs";
+import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-DE9hgr7i.cjs";
 export { ActivateScheduleBody, ConfigurationPath, GetSchedulesQuery, Schedule, SchedulePath, Schedules };

package/dist/scheduler/types.d.ts

@@ -1,2 +1,2 @@
-import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-zZBxJ0P-.js";
+import { a as SchedulePath, i as Schedule, n as ConfigurationPath, o as Schedules, r as GetSchedulesQuery, t as ActivateScheduleBody } from "../types-CWyXTMwy.js";
 export { ActivateScheduleBody, ConfigurationPath, GetSchedulesQuery, Schedule, SchedulePath, Schedules };

package/dist/sdk/configurations/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_configurations = require("../../configurations-zkNjr73Q.cjs");
+const require_configurations = require("../../configurations-IYyOvhI3.cjs");
 exports.createConfigurationSdk = require_configurations.createConfigurationSdk;

package/dist/sdk/configurations/index.d.cts

@@ -1,7 +1,7 @@
-import { B as createStorageClient, I as RegisteredComponentId, L as registry, Wt as createDefaultBranch } from "../../index-DIAyi-EZ.cjs";
-import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-DjrRmQUe.cjs";
-import { t as createEncryptionClient } from "../../index-DR4QqItd.cjs";
-import { t as Project } from "../../project-hePfzUY0.cjs";
+import { H as createStorageClient, I as RegisteredComponentId, L as registry, tn as createDefaultBranch } from "../../index-DXYASsPP.cjs";
+import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-BiMahEK8.cjs";
+import { t as createEncryptionClient } from "../../index--ZpnE3YT.cjs";
+import { t as Project } from "../../project-cHKuGvqJ.cjs";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {
@@ -21,13 +21,10 @@ type TypedConfiguration<ComponentId extends RegisteredComponentId> = {
 };
 /**
  * How an update writes the patch against the stored configuration:
- * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a
- *   credential union or array subtree is replaced wholesale (so switching auth variants deletes
- *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the
- *   current config first to merge onto.
- * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,
- *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits
- *   is gone.
+ * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are
+ *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.
+ * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,
+ *   e.g. `storage`, is gone.
  */
 type UpdateMode = 'merge' | 'replace';
 declare const createConfigurationSdk: ({ storageClient, encryptionClient, context }: Options) => {
@@ -906,6 +903,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -1922,6 +1920,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -2940,6 +2939,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{

package/dist/sdk/configurations/index.d.ts

@@ -1,7 +1,7 @@
-import { B as createStorageClient, I as RegisteredComponentId, L as registry, Wt as createDefaultBranch } from "../../index-2JM0gyAf.js";
-import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-DEc55spK.js";
-import { t as createEncryptionClient } from "../../index-D8rcUbnk.js";
-import { t as Project } from "../../project-C2wvX0xZ.js";
+import { H as createStorageClient, I as RegisteredComponentId, L as registry, tn as createDefaultBranch } from "../../index-BkqackZf.js";
+import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-CKmTZSPG.js";
+import { t as createEncryptionClient } from "../../index-D7-o-oGa.js";
+import { t as Project } from "../../project-B15gStbM.js";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {
@@ -21,13 +21,10 @@ type TypedConfiguration<ComponentId extends RegisteredComponentId> = {
 };
 /**
  * How an update writes the patch against the stored configuration:
- * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a
- *   credential union or array subtree is replaced wholesale (so switching auth variants deletes
- *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the
- *   current config first to merge onto.
- * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,
- *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits
- *   is gone.
+ * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are
+ *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.
+ * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,
+ *   e.g. `storage`, is gone.
  */
 type UpdateMode = 'merge' | 'replace';
 declare const createConfigurationSdk: ({ storageClient, encryptionClient, context }: Options) => {
@@ -906,6 +903,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -1922,6 +1920,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -2940,6 +2939,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{

package/dist/sdk/configurations/index.js

@@ -1,2 +1,2 @@
-import { t as createConfigurationSdk } from "../../configurations-VtNE0nrT.js";
+import { t as createConfigurationSdk } from "../../configurations-BPKGGy-M.js";
 export { createConfigurationSdk };

package/dist/sdk/developerPortal/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dedupe = require("../../dedupe-CiskLkGR.cjs");
+const require_dedupe = require("../../dedupe-OSnnst2u.cjs");
 const require_store = require("../../store-xS-Cu_VS.cjs");
-const require_createFetchClient = require("../../createFetchClient-DgMiqTJ8.cjs");
-const require_credential = require("../../credential-DVWvJFJs.cjs");
-const require_developerPortalClient = require("../../developerPortalClient-ki0XS_OD.cjs");
+const require_createFetchClient = require("../../createFetchClient-Cwp8max9.cjs");
+const require_middleware = require("../../middleware-IjYx3d5u.cjs");
+const require_developerPortalClient = require("../../developerPortalClient-CLPpBksD.cjs");
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -38,7 +38,7 @@ const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired,
 		try {
 			return await refresh();
 		} catch (error) {
-			if (require_credential.isUnauthorized(error)) onSessionExpired?.();
+			if (require_middleware.isUnauthorized(error)) onSessionExpired?.();
 			throw error;
 		}
 	};
@@ -75,7 +75,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 		try {
 			return await next(request);
 		} catch (error) {
-			if (!require_credential.isUnauthorized(error)) throw error;
+			if (!require_middleware.isUnauthorized(error)) throw error;
 			const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);
 			if (refreshed === null) throw error;
 			retryRequest.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, refreshed);
@@ -85,7 +85,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 					request: retryRequest
 				});
 			} catch (retryError) {
-				if (require_credential.isUnauthorized(retryError)) credential.notifyExpired();
+				if (require_middleware.isUnauthorized(retryError)) credential.notifyExpired();
 				throw retryError;
 			}
 		}
@@ -94,13 +94,9 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 //#endregion
 //#region src/sdks/developerPortal/developerPortalSdk.ts
 /**
-* `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
-* credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+* `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
-* It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
-* needs the credential, the credential needs the session, and the session needs a client to rotate
-* with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
-* apps-api is its own identity domain.
+* - Builds its own client: middleware, credential and session depend on each other in a cycle.
 */
 const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
 	const store = require_store.createStore(initialTokens);
@@ -185,11 +181,7 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 			ensureFresh: async () => {
 				await credential.getIdToken();
 			},
-			/**
-			* Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-			* matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-			* Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-			*/
+			/** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
 			refresh: async () => {
 				await credential.getIdToken({ forceRefresh: true });
 			},

package/dist/sdk/developerPortal/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/developerPortal/index.d.cts

@@ -1,11 +1,11 @@
-import { D as MiddlewareFn } from "../../index-V7XKUQm9.cjs";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-D8Rrz51O.cjs";
-import { t as DeveloperPortalTokens } from "../../index-GjcJTCbz.cjs";
+import { O as MiddlewareFn } from "../../index-BVhHt5lx.cjs";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-tKkeLa2B.cjs";
+import { t as DeveloperPortalTokens } from "../../index-C4TNAA8-.cjs";
 import { n as Listener } from "../../emitter-dLF1Fyfg.cjs";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
-  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */
+  /** Session to restore on construction. */
   tokens?: DeveloperPortalTokens | null;
   /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */
   onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;
@@ -15,13 +15,9 @@ type DeveloperPortalSdkOptions = {
   middlewares?: MiddlewareFn[];
 };
 /**
- * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
- * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+ * `createDeveloperPortalClient` plus the session that keeps it authenticated.
  *
- * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
- * needs the credential, the credential needs the session, and the session needs a client to rotate
- * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
- * apps-api is its own identity domain.
+ * - Builds its own client: middleware, credential and session depend on each other in a cycle.
  */
 declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares }: DeveloperPortalSdkOptions) => {
   api: {
@@ -1356,11 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;
-    /**
-     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-     */
+    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
     refresh: () => Promise<void>;
     isAuthenticated: () => boolean;
   };

package/dist/sdk/developerPortal/index.d.ts

@@ -1,11 +1,11 @@
-import { D as MiddlewareFn } from "../../index-KuQ79Mnz.js";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-DajzGOKB.js";
-import { t as DeveloperPortalTokens } from "../../index-pXN4LWUX.js";
+import { O as MiddlewareFn } from "../../index-BgR5zcjJ.js";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-q-1r_9d1.js";
+import { t as DeveloperPortalTokens } from "../../index-C11JSxBY.js";
 import { n as Listener } from "../../emitter-dLF1Fyfg.js";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
-  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */
+  /** Session to restore on construction. */
   tokens?: DeveloperPortalTokens | null;
   /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */
   onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;
@@ -15,13 +15,9 @@ type DeveloperPortalSdkOptions = {
   middlewares?: MiddlewareFn[];
 };
 /**
- * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
- * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+ * `createDeveloperPortalClient` plus the session that keeps it authenticated.
  *
- * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
- * needs the credential, the credential needs the session, and the session needs a client to rotate
- * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
- * apps-api is its own identity domain.
+ * - Builds its own client: middleware, credential and session depend on each other in a cycle.
  */
 declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares }: DeveloperPortalSdkOptions) => {
   api: {
@@ -1356,11 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;
-    /**
-     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-     */
+    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
     refresh: () => Promise<void>;
     isAuthenticated: () => boolean;
   };

package/dist/sdk/developerPortal/index.js

@@ -1,8 +1,8 @@
-import { t as dedupe } from "../../dedupe-DYIHgZoG.js";
+import { t as dedupe } from "../../dedupe-Cky1gSUu.js";
 import { t as createStore } from "../../store-C9FQCHGe.js";
-import { s as HttpHeader } from "../../createFetchClient-U-ZrwPl2.js";
-import { n as isUnauthorized } from "../../credential-CihSf_xs.js";
-import { t as createDeveloperPortalClient } from "../../developerPortalClient-C_48z8BN.js";
+import { s as HttpHeader } from "../../createFetchClient-DXHQK63w.js";
+import { n as isUnauthorized } from "../../middleware-CBwrtgQd.js";
+import { t as createDeveloperPortalClient } from "../../developerPortalClient-B1QZ1rYi.js";
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -93,13 +93,9 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 //#endregion
 //#region src/sdks/developerPortal/developerPortalSdk.ts
 /**
-* `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
-* credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+* `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
-* It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
-* needs the credential, the credential needs the session, and the session needs a client to rotate
-* with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
-* apps-api is its own identity domain.
+* - Builds its own client: middleware, credential and session depend on each other in a cycle.
 */
 const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
 	const store = createStore(initialTokens);
@@ -184,11 +180,7 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 			ensureFresh: async () => {
 				await credential.getIdToken();
 			},
-			/**
-			* Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-			* matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-			* Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-			*/
+			/** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
 			refresh: async () => {
 				await credential.getIdToken({ forceRefresh: true });
 			},