@keboola/api-client 36.0.0 → 40.0.0

package/dist/apps/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/clients/apps/appsClient.ts"],"sourcesContent":["import { readAppLogsDownload, readAppLogsTail } from '../../domain/appLogs';\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  App,\n  AppId,\n  CreateAppBody,\n  CreateCredentialBody,\n  CreateDeploymentBody,\n  CredentialId,\n  DeploymentId,\n  GetAppRunsQuery,\n  GetAppsQuery,\n  GetDeploymentsQuery,\n  GetLogsTailQuery,\n  RunId,\n} from './types';\n\n/**\n * Options every write takes.\n *\n * - No `idempotencyKey`: the service accepts no `Idempotency-Key`, so every create here is a\n *   genuine create and a caller that retries one owns the duplicate it may produce.\n */\ntype WriteOptions = {\n  signal?: AbortSignal;\n};\n\ntype LogsTailOptions = {\n  query?: GetLogsTailQuery;\n  signal?: AbortSignal;\n};\n\n/**\n * `/v2` App Deployments — data apps plus the immutable deployment history behind them. Sibling of\n * the `dataScience` client, which wraps the same service's `/v1` surface.\n *\n * `baseUrl` must already point past the `/v2` prefix (`https://<data-science-host>/v2`); the\n * registry composes it — see `createServiceClients`.\n *\n * One documented endpoint is deliberately absent: `POST /apps/{appId}/activity` is apps-proxy's\n * heartbeat, authenticated by a Manage API token with the `apps:proxy` scope that this\n * storage-token client cannot supply.\n */\nexport const createAppsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const writeOptions = ({ signal }: WriteOptions) => ({ signal });\n\n  /** Service metadata (`appName`, `appVersion`, `apiDocs`) — the `/v2` surface has no `/health-check`. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps', { query }, { signal });\n\n    return data;\n  };\n\n  const getApp = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Reserves the app and its Storage configuration only. Content (`parameters`) and auth\n   * (`authorization.app_proxy`) are written afterwards through the Storage API, on the config named\n   * by the response's `componentId`/`branchId`/`configId`.\n   */\n  const createApp = async (body: CreateAppBody, options: WriteOptions = {}) => {\n    const { data } = await client.post('/apps', { body }, writeOptions(options));\n\n    return data;\n  };\n\n  const deleteApp = async (appId: AppId, signal?: AbortSignal) => {\n    await client.delete('/apps/{appId}', { path: { appId } }, { signal });\n  };\n\n  /**\n   * Drops production routing — the app's URL 404s afterwards. A no-op (already unpublished, or\n   * never deployed) returns the app unchanged rather than failing.\n   */\n  const unpublishApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/unpublish', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Sleeps the app now instead of waiting for the idle timer, and disarms wake-on-request: a\n   * visitor gets a `503` until an explicit {@link resumeApp}. A no-op on an already suspended app.\n   */\n  const suspendApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/suspend', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Wakes the app now and re-arms wake-on-request. A no-op on an already running app.\n   * The returned app reports `starting` — the operator has not confirmed it serving yet.\n   */\n  const resumeApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/resume', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** `password` is `null` until one is minted — by the app's first deployment or {@link resetAppPassword}. */\n  const getAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/password', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Mints a fresh password, replacing any existing one. Read it back with {@link getAppPassword}. */\n  const resetAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/apps/{appId}/password/reset',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Runs of the app, newest first — app-wide, so this is where a failed deployment's cause lives\n   * (`failureReason`, `startupLogs`). Narrow to one deployment with `query.deploymentId`.\n   */\n  const getAppRuns = async (appId: AppId, query: GetAppRunsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/runs', { path: { appId }, query }, { signal });\n\n    return data;\n  };\n\n  const getAppRun = async (appId: AppId, runId: RunId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/runs/{runId}',\n      { path: { appId, runId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deploys the app's current config version as a new immutable deployment, promoting it unless\n   * `body.promote` is `false` (a staged release never runs until promoted). Pin an older config\n   * version with `body.configVersion`. The deployment comes back synchronously; readiness does not.\n   */\n  const createDeployment = async (\n    appId: AppId,\n    body?: CreateDeploymentBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  /**\n   * Deployment history, newest page first.\n   *\n   * - `query.archived` filters on whether the deployment was deleted; omitting it returns both.\n   * - A deleted deployment keeps its row — history outlives the workload.\n   */\n  const getDeployments = async (\n    appId: AppId,\n    query: GetDeploymentsQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments',\n      { path: { appId }, query },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getDeployment = async (appId: AppId, deploymentId: DeploymentId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deletes the deployment: its running resources and credentials go, the row stays in history as\n   * `archived`. Rejected with a `409` while the app's `production` still names it.\n   */\n  const deleteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n  };\n\n  /**\n   * Makes this deployment production — the same call rolls back, applied to an older one. The route\n   * switches only once the target serves, so the returned app's `production.desiredDeploymentId`\n   * and `.actualDeploymentId` differ until it converges.\n   */\n  const promoteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ): Promise<App> => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments/{deploymentId}/promote',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Container output of the app's currently serving member. `query.since` and `query.lines` are\n   * mutually exclusive; passing neither returns the log from its start.\n   */\n  const getAppLogsTail = (appId: AppId, { query, signal }: LogsTailOptions = {}) =>\n    readAppLogsTail(() =>\n      client.get('/apps/{appId}/logs/tail', { path: { appId }, query }, { signal }),\n    );\n\n  const getAppLogsDownload = (appId: AppId, signal?: AbortSignal) =>\n    readAppLogsDownload(() =>\n      client.get('/apps/{appId}/logs/download', { path: { appId } }, { signal }),\n    );\n\n  const getDeploymentLogsTail = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    { query, signal }: LogsTailOptions = {},\n  ) =>\n    readAppLogsTail(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/tail',\n        { path: { appId, deploymentId }, query },\n        { signal },\n      ),\n    );\n\n  const getDeploymentLogsDownload = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) =>\n    readAppLogsDownload(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/download',\n        { path: { appId, deploymentId } },\n        { signal },\n      ),\n    );\n\n  /** The app's Git repository — managed or external. `409` when it has none configured. */\n  const getAppGitRepo = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/git-repo', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Credentials of the app's managed repository, per app rather than per deployment. */\n  const getAppGitRepoCredentials = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** An `http_token` credential returns its `secret` here and nowhere else — store it now or lose it. */\n  const createAppGitRepoCredential = async (\n    appId: AppId,\n    body: CreateCredentialBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  const deleteAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n  };\n\n  return {\n    healthCheck,\n    getApps,\n    getApp,\n    createApp,\n    deleteApp,\n    unpublishApp,\n    suspendApp,\n    resumeApp,\n    getAppPassword,\n    resetAppPassword,\n    getAppRuns,\n    getAppRun,\n    createDeployment,\n    getDeployments,\n    getDeployment,\n    deleteDeployment,\n    promoteDeployment,\n    getAppLogsTail,\n    getAppLogsDownload,\n    getDeploymentLogsTail,\n    getDeploymentLogsDownload,\n    getAppGitRepo,\n    getAppGitRepoCredentials,\n    getAppGitRepoCredential,\n    createAppGitRepoCredential,\n    deleteAppGitRepoCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;AA+CA,MAAa,oBAAoB,EAAE,SAAS,aAAa,WAA8B;CACrF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,gBAAgB,EAAE,cAA4B,EAAE,OAAO;;CAG7D,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAc,WAAyB;EAC3D,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAElF,OAAO;CACT;;;;;;CAOA,MAAM,YAAY,OAAO,MAAqB,UAAwB,CAAC,MAAM;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,aAAa,OAAO,CAAC;EAE3E,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,WAAyB;EAC9D,MAAM,OAAO,OAAO,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACtE;;;;;CAMA,MAAM,eAAe,OAAO,OAAc,WAAuC;EAC/E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE7F,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,WAAuC;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;;;;CAMA,MAAM,YAAY,OAAO,OAAc,WAAuC;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE1F,OAAO;CACT;;CAGA,MAAM,iBAAiB,OAAO,OAAc,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAAO,OAAc,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,gCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,aAAa,OAAO,OAAc,QAAyB,CAAC,GAAG,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,sBAAsB;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,OAAc,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,8BACA,EAAE,MAAM;GAAE;GAAO;EAAM,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;CAOA,MAAM,mBAAmB,OACvB,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;;;;;;;CAQA,MAAM,iBAAiB,OACrB,OACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,OAAc,cAA4B,WAAyB;EAC9F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,mBAAmB,OACvB,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;;;;;CAOA,MAAM,oBAAoB,OACxB,OACA,cACA,WACiB;EACjB,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,oDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;CAMA,MAAM,kBAAkB,OAAc,EAAE,OAAO,WAA4B,CAAC,MAC1E,sBACE,OAAO,IAAI,2BAA2B;EAAE,MAAM,EAAE,MAAM;EAAG;CAAM,GAAG,EAAE,OAAO,CAAC,CAC9E;CAEF,MAAM,sBAAsB,OAAc,WACxC,0BACE,OAAO,IAAI,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAC3E;CAEF,MAAM,yBACJ,OACA,cACA,EAAE,OAAO,WAA4B,CAAC,MAEtC,sBACE,OAAO,IACL,sDACA;EAAE,MAAM;GAAE;GAAO;EAAa;EAAG;CAAM,GACvC,EAAE,OAAO,CACX,CACF;CAEF,MAAM,6BACJ,OACA,cACA,WAEA,0BACE,OAAO,IACL,0DACA,EAAE,MAAM;EAAE;EAAO;CAAa,EAAE,GAChC,EAAE,OAAO,CACX,CACF;;CAGF,MAAM,gBAAgB,OAAO,OAAc,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,2BAA2B,OAAO,OAAc,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,sCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,0BAA0B,OAC9B,OACA,cACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,6BAA6B,OACjC,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sCACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;CAEA,MAAM,6BAA6B,OACjC,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/clients/apps/appsClient.ts"],"sourcesContent":["import { readAppLogsDownload, readAppLogsTail } from '../../domain/appLogs';\nimport { createOpenapiFetchClient } from '../../fetchClient';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  App,\n  AppId,\n  CreateAppBody,\n  CreateCredentialBody,\n  CreateDeploymentBody,\n  CredentialId,\n  DeploymentId,\n  GetAppRunsQuery,\n  GetAppsQuery,\n  GetDeploymentsQuery,\n  GetLogsTailQuery,\n  RunId,\n} from './types';\n\n/**\n * Options every write takes.\n *\n * - No `idempotencyKey`: the service ignores it, so a retried create may duplicate.\n */\ntype WriteOptions = {\n  signal?: AbortSignal;\n};\n\ntype LogsTailOptions = {\n  query?: GetLogsTailQuery;\n  signal?: AbortSignal;\n};\n\n/**\n * `/v2` App Deployments — data apps and their immutable deployment history.\n *\n * - `/v1` of the same service is the `dataScience` client.\n * - `baseUrl` must already end in `/v2`; `createServiceClients` composes it.\n * - `POST /apps/{appId}/activity` is absent: it needs a Manage token with `apps:proxy` scope.\n */\nexport const createAppsClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n\n  const writeOptions = ({ signal }: WriteOptions) => ({ signal });\n\n  /** Service metadata — the `/v2` surface has no `/health-check`. */\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/', {}, { signal });\n\n    return data;\n  };\n\n  const getApps = async (query: GetAppsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps', { query }, { signal });\n\n    return data;\n  };\n\n  const getApp = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /**\n   * Reserves the app and its Storage configuration only.\n   *\n   * - `parameters` and `authorization.app_proxy` are written afterwards via the Storage API.\n   */\n  const createApp = async (body: CreateAppBody, options: WriteOptions = {}) => {\n    const { data } = await client.post('/apps', { body }, writeOptions(options));\n\n    return data;\n  };\n\n  const deleteApp = async (appId: AppId, signal?: AbortSignal) => {\n    await client.delete('/apps/{appId}', { path: { appId } }, { signal });\n  };\n\n  /** Drops production routing (URL 404s). A no-op returns the app unchanged, not an error. */\n  const unpublishApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/unpublish', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Sleeps the app and disarms wake-on-request: visitors get `503` until {@link resumeApp}. */\n  const suspendApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/suspend', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Wakes the app and re-arms wake-on-request. The returned app still reports `starting`. */\n  const resumeApp = async (appId: AppId, signal?: AbortSignal): Promise<App> => {\n    const { data } = await client.post('/apps/{appId}/resume', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** `null` until the first deployment or {@link resetAppPassword} mints one. */\n  const getAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/password', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Replaces any existing password. Read it back with {@link getAppPassword}. */\n  const resetAppPassword = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.post(\n      '/apps/{appId}/password/reset',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** App-wide runs, newest first — where a failed deployment's `failureReason` lives. */\n  const getAppRuns = async (appId: AppId, query: GetAppRunsQuery = {}, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/runs', { path: { appId }, query }, { signal });\n\n    return data;\n  };\n\n  const getAppRun = async (appId: AppId, runId: RunId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/runs/{runId}',\n      { path: { appId, runId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /**\n   * Deploys the current config version as a new immutable deployment.\n   *\n   * - Promotes it unless `body.promote` is `false`; a staged release never runs until promoted.\n   * - Returns synchronously; readiness does not.\n   */\n  const createDeployment = async (\n    appId: AppId,\n    body?: CreateDeploymentBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  /** Deployment history, newest first. Omitting `query.archived` returns deleted ones too. */\n  const getDeployments = async (\n    appId: AppId,\n    query: GetDeploymentsQuery = {},\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments',\n      { path: { appId }, query },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getDeployment = async (appId: AppId, deploymentId: DeploymentId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** Deletes the deployment, keeping its row as `archived`. `409` while it is production. */\n  const deleteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/deployments/{deploymentId}',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n  };\n\n  /**\n   * Makes this deployment production; also the rollback.\n   *\n   * - Routing switches once it serves; `desired`/`actualDeploymentId` differ until then.\n   */\n  const promoteDeployment = async (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ): Promise<App> => {\n    const { data } = await client.post(\n      '/apps/{appId}/deployments/{deploymentId}/promote',\n      { path: { appId, deploymentId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** Serving container's log. `query.since` and `query.lines` are mutually exclusive. */\n  const getAppLogsTail = (appId: AppId, { query, signal }: LogsTailOptions = {}) =>\n    readAppLogsTail(() =>\n      client.get('/apps/{appId}/logs/tail', { path: { appId }, query }, { signal }),\n    );\n\n  const getAppLogsDownload = (appId: AppId, signal?: AbortSignal) =>\n    readAppLogsDownload(() =>\n      client.get('/apps/{appId}/logs/download', { path: { appId } }, { signal }),\n    );\n\n  const getDeploymentLogsTail = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    { query, signal }: LogsTailOptions = {},\n  ) =>\n    readAppLogsTail(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/tail',\n        { path: { appId, deploymentId }, query },\n        { signal },\n      ),\n    );\n\n  const getDeploymentLogsDownload = (\n    appId: AppId,\n    deploymentId: DeploymentId,\n    signal?: AbortSignal,\n  ) =>\n    readAppLogsDownload(() =>\n      client.get(\n        '/apps/{appId}/deployments/{deploymentId}/logs/download',\n        { path: { appId, deploymentId } },\n        { signal },\n      ),\n    );\n\n  /** `409` when the app has no Git repository configured. */\n  const getAppGitRepo = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get('/apps/{appId}/git-repo', { path: { appId } }, { signal });\n\n    return data;\n  };\n\n  /** Per app, not per deployment. */\n  const getAppGitRepoCredentials = async (appId: AppId, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  const getAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n\n    return data;\n  };\n\n  /** An `http_token` credential's `secret` is returned only here. */\n  const createAppGitRepoCredential = async (\n    appId: AppId,\n    body: CreateCredentialBody,\n    options: WriteOptions = {},\n  ) => {\n    const { data } = await client.post(\n      '/apps/{appId}/git-repo/credentials',\n      { path: { appId }, body },\n      writeOptions(options),\n    );\n\n    return data;\n  };\n\n  const deleteAppGitRepoCredential = async (\n    appId: AppId,\n    credentialId: CredentialId,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/apps/{appId}/git-repo/credentials/{credentialId}',\n      { path: { appId, credentialId } },\n      { signal },\n    );\n  };\n\n  return {\n    healthCheck,\n    getApps,\n    getApp,\n    createApp,\n    deleteApp,\n    unpublishApp,\n    suspendApp,\n    resumeApp,\n    getAppPassword,\n    resetAppPassword,\n    getAppRuns,\n    getAppRun,\n    createDeployment,\n    getDeployments,\n    getDeployment,\n    deleteDeployment,\n    promoteDeployment,\n    getAppLogsTail,\n    getAppLogsDownload,\n    getDeploymentLogsTail,\n    getDeploymentLogsDownload,\n    getAppGitRepo,\n    getAppGitRepoCredentials,\n    getAppGitRepoCredential,\n    createAppGitRepoCredential,\n    deleteAppGitRepoCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;AA0CA,MAAa,oBAAoB,EAAE,SAAS,aAAa,WAA8B;CACrF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CAED,MAAM,gBAAgB,EAAE,cAA4B,EAAE,OAAO;;CAG7D,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;EAErD,OAAO;CACT;CAEA,MAAM,UAAU,OAAO,QAAsB,CAAC,GAAG,WAAyB;EACxE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;EAEhE,OAAO;CACT;CAEA,MAAM,SAAS,OAAO,OAAc,WAAyB;EAC3D,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAElF,OAAO;CACT;;;;;;CAOA,MAAM,YAAY,OAAO,MAAqB,UAAwB,CAAC,MAAM;EAC3E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,SAAS,EAAE,KAAK,GAAG,aAAa,OAAO,CAAC;EAE3E,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,WAAyB;EAC9D,MAAM,OAAO,OAAO,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;CACtE;;CAGA,MAAM,eAAe,OAAO,OAAc,WAAuC;EAC/E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE7F,OAAO;CACT;;CAGA,MAAM,aAAa,OAAO,OAAc,WAAuC;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,YAAY,OAAO,OAAc,WAAuC;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,KAAK,wBAAwB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE1F,OAAO;CACT;;CAGA,MAAM,iBAAiB,OAAO,OAAc,WAAyB;EACnE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,mBAAmB,OAAO,OAAc,WAAyB;EACrE,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,gCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,aAAa,OAAO,OAAc,QAAyB,CAAC,GAAG,WAAyB;EAC5F,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,sBAAsB;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GAAG,EAAE,OAAO,CAAC;EAE9F,OAAO;CACT;CAEA,MAAM,YAAY,OAAO,OAAc,OAAc,WAAyB;EAC5E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,8BACA,EAAE,MAAM;GAAE;GAAO;EAAM,EAAE,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;;;;;;CAQA,MAAM,mBAAmB,OACvB,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;;CAGA,MAAM,iBAAiB,OACrB,OACA,QAA6B,CAAC,GAC9B,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,6BACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAM,GACzB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,OAAc,cAA4B,WAAyB;EAC9F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,mBAAmB,OACvB,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,4CACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;;;;;;CAOA,MAAM,oBAAoB,OACxB,OACA,cACA,WACiB;EACjB,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,oDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,kBAAkB,OAAc,EAAE,OAAO,WAA4B,CAAC,MAC1E,sBACE,OAAO,IAAI,2BAA2B;EAAE,MAAM,EAAE,MAAM;EAAG;CAAM,GAAG,EAAE,OAAO,CAAC,CAC9E;CAEF,MAAM,sBAAsB,OAAc,WACxC,0BACE,OAAO,IAAI,+BAA+B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAC3E;CAEF,MAAM,yBACJ,OACA,cACA,EAAE,OAAO,WAA4B,CAAC,MAEtC,sBACE,OAAO,IACL,sDACA;EAAE,MAAM;GAAE;GAAO;EAAa;EAAG;CAAM,GACvC,EAAE,OAAO,CACX,CACF;CAEF,MAAM,6BACJ,OACA,cACA,WAEA,0BACE,OAAO,IACL,0DACA,EAAE,MAAM;EAAE;EAAO;CAAa,EAAE,GAChC,EAAE,OAAO,CACX,CACF;;CAGF,MAAM,gBAAgB,OAAO,OAAc,WAAyB;EAClE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;EAE3F,OAAO;CACT;;CAGA,MAAM,2BAA2B,OAAO,OAAc,WAAyB;EAC7E,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,sCACA,EAAE,MAAM,EAAE,MAAM,EAAE,GAClB,EAAE,OAAO,CACX;EAEA,OAAO;CACT;CAEA,MAAM,0BAA0B,OAC9B,OACA,cACA,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;EAEA,OAAO;CACT;;CAGA,MAAM,6BAA6B,OACjC,OACA,MACA,UAAwB,CAAC,MACtB;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,KAC5B,sCACA;GAAE,MAAM,EAAE,MAAM;GAAG;EAAK,GACxB,aAAa,OAAO,CACtB;EAEA,OAAO;CACT;CAEA,MAAM,6BAA6B,OACjC,OACA,cACA,WACG;EACH,MAAM,OAAO,OACX,qDACA,EAAE,MAAM;GAAE;GAAO;EAAa,EAAE,GAChC,EAAE,OAAO,CACX;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/apps/types.d.cts

@@ -1,3 +1,3 @@
-import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-DXskkNp8.cjs";
-import { t as LogEntry } from "../appLogs-D5A13Y0y.cjs";
+import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-pvQzbgNE.cjs";
+import { t as LogEntry } from "../appLogs-C9YlJ2g8.cjs";
 export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetDeploymentsQuery, GetLogsTailQuery, type LogEntry, RunId };

package/dist/apps/types.d.ts

@@ -1,3 +1,3 @@
-import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-D6UmMa6E.js";
-import { t as LogEntry } from "../appLogs-Ch7DYpzx.js";
+import { S as RunId, _ as DeploymentRunState, a as AppRun, b as GetDeploymentsQuery, c as CreateCredentialBody, d as Credential, f as CredentialId, g as DeploymentId, h as DeploymentBuildState, i as AppPassword, l as CreateDeploymentBody, m as Deployment, n as AppGitRepo, o as AppState, p as CredentialList, r as AppId, s as CreateAppBody, t as App, u as CreatedCredential, v as GetAppRunsQuery, x as GetLogsTailQuery, y as GetAppsQuery } from "../types-BZDV8DZk.js";
+import { t as LogEntry } from "../appLogs-BS6ViVGR.js";
 export { App, AppGitRepo, AppId, AppPassword, AppRun, AppState, CreateAppBody, CreateCredentialBody, CreateDeploymentBody, CreatedCredential, Credential, CredentialId, CredentialList, Deployment, DeploymentBuildState, DeploymentId, DeploymentRunState, GetAppRunsQuery, GetAppsQuery, GetDeploymentsQuery, GetLogsTailQuery, type LogEntry, RunId };

package/dist/assets/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createGenericFetchClient = require("../createGenericFetchClient-o3cPJeRn.cjs");
+const require_createGenericFetchClient = require("../createGenericFetchClient-Dl9cqTvR.cjs");
 const require_assets_schema = require("./schema.cjs");
 //#region src/clients/assets/assetsClient.ts
 const createAssetsClient = ({ baseUrl, middlewares }) => {

package/dist/assets/index.d.cts

@@ -1,4 +1,4 @@
-import { n as ClientInitOptions } from "../types-_RhBCj4_.cjs";
+import { n as ClientInitOptions } from "../types-DoZtE9tz.cjs";
 //#region src/clients/assets/assetsClient.d.ts
 declare const createAssetsClient: ({ baseUrl, middlewares }: Omit<ClientInitOptions, 'auth'>) => {
   getPublishedChangelogPosts: (signal?: AbortSignal) => Promise<{

package/dist/assets/index.d.ts

@@ -1,4 +1,4 @@
-import { n as ClientInitOptions } from "../types-Ct0YPy2w.js";
+import { n as ClientInitOptions } from "../types-B2w2TtSA.js";
 //#region src/clients/assets/assetsClient.d.ts
 declare const createAssetsClient: ({ baseUrl, middlewares }: Omit<ClientInitOptions, 'auth'>) => {
   getPublishedChangelogPosts: (signal?: AbortSignal) => Promise<{

package/dist/assets/index.js

@@ -1,4 +1,4 @@
-import { t as createGenericFetchClient } from "../createGenericFetchClient-rxvUUbap.js";
+import { t as createGenericFetchClient } from "../createGenericFetchClient-Dg1rgzmG.js";
 import { componentTemplatesSchema, publishedPostsSchema } from "./schema.js";
 //#region src/clients/assets/assetsClient.ts
 const createAssetsClient = ({ baseUrl, middlewares }) => {

package/dist/auth/index.cjs

@@ -1,15 +1,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_authClient = require("../authClient-_PpvGgZJ.cjs");
+const require_authClient = require("../authClient-BmuUo0J4.cjs");
 exports.MFA_METHOD = require_authClient.MFA_METHOD;
+exports.apiLoginResultSchema = require_authClient.apiLoginResultSchema;
+exports.apiLoginSuccessSchema = require_authClient.apiLoginSuccessSchema;
+exports.browserLoginResultSchema = require_authClient.browserLoginResultSchema;
+exports.browserLoginSuccessSchema = require_authClient.browserLoginSuccessSchema;
 exports.changeInputSchema = require_authClient.changeInputSchema;
 exports.createAuthClient = require_authClient.createAuthClient;
-exports.loginInputSchema = require_authClient.loginInputSchema;
-exports.loginResultSchema = require_authClient.loginResultSchema;
-exports.loginSuccessSchema = require_authClient.loginSuccessSchema;
 exports.mfaChallengeSchema = require_authClient.mfaChallengeSchema;
 exports.mfaCodeInputSchema = require_authClient.mfaCodeInputSchema;
 exports.mfaWebauthnInputSchema = require_authClient.mfaWebauthnInputSchema;
 exports.oidcInputSchema = require_authClient.oidcInputSchema;
+exports.passwordInputSchema = require_authClient.passwordInputSchema;
+exports.refreshSessionInputSchema = require_authClient.refreshSessionInputSchema;
+exports.refreshTokenInputSchema = require_authClient.refreshTokenInputSchema;
 exports.resetInputSchema = require_authClient.resetInputSchema;
 exports.resetRequestInputSchema = require_authClient.resetRequestInputSchema;
 exports.totpVerifyInputSchema = require_authClient.totpVerifyInputSchema;

package/dist/auth/index.d.cts

@@ -1,2 +1,2 @@
-import { C as OidcInput, D as mfaChallengeSchema, E as loginSuccessSchema, O as oidcInputSchema, S as MfaChallenge, T as loginResultSchema, _ as totpVerifyInputSchema, a as ResetInput, b as LoginSuccess, c as resetInputSchema, d as MfaCodeInput, f as MfaMethod, g as mfaWebauthnInputSchema, h as mfaCodeInputSchema, i as ChangePasswordInput, l as resetRequestInputSchema, m as TotpVerifyInput, n as AuthOpenApiFetchClient, o as ResetRequestInput, p as MfaWebauthnInput, r as createAuthClient, s as changeInputSchema, t as AuthClientInitOptions, u as MFA_METHOD, v as LoginInput, w as loginInputSchema, x as LoginUser, y as LoginResult } from "../authClient-CTHNs6Tq.cjs";
-export { AuthClientInitOptions, AuthOpenApiFetchClient, ChangePasswordInput, LoginInput, LoginResult, LoginSuccess, LoginUser, MFA_METHOD, MfaChallenge, MfaCodeInput, MfaMethod, MfaWebauthnInput, OidcInput, ResetInput, ResetRequestInput, TotpVerifyInput, changeInputSchema, createAuthClient, loginInputSchema, loginResultSchema, loginSuccessSchema, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };
+import { A as PasswordInput, C as ApiLoginSuccess, D as LoginUser, E as LoginResultFor, F as mfaChallengeSchema, I as oidcInputSchema, L as passwordInputSchema, M as apiLoginSuccessSchema, N as browserLoginResultSchema, O as MfaChallenge, P as browserLoginSuccessSchema, S as ApiLoginResult, T as BrowserLoginSuccess, _ as MfaWebauthnInput, a as RefreshTokenInput, b as mfaWebauthnInputSchema, c as ChangePasswordInput, d as changeInputSchema, f as resetInputSchema, g as MfaMethod, h as MfaCodeInput, i as RefreshSessionInput, j as apiLoginResultSchema, k as OidcInput, l as ResetInput, m as MFA_METHOD, n as AuthOpenApiFetchClient, o as refreshSessionInputSchema, p as resetRequestInputSchema, r as createAuthClient, s as refreshTokenInputSchema, t as AuthClientInitOptions, u as ResetRequestInput, v as TotpVerifyInput, w as BrowserLoginResult, x as totpVerifyInputSchema, y as mfaCodeInputSchema } from "../authClient-vEt_7_uk.cjs";
+export { ApiLoginResult, ApiLoginSuccess, AuthClientInitOptions, AuthOpenApiFetchClient, BrowserLoginResult, BrowserLoginSuccess, ChangePasswordInput, LoginResultFor, LoginUser, MFA_METHOD, MfaChallenge, MfaCodeInput, MfaMethod, MfaWebauthnInput, OidcInput, PasswordInput, RefreshSessionInput, RefreshTokenInput, ResetInput, ResetRequestInput, TotpVerifyInput, apiLoginResultSchema, apiLoginSuccessSchema, browserLoginResultSchema, browserLoginSuccessSchema, changeInputSchema, createAuthClient, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, passwordInputSchema, refreshSessionInputSchema, refreshTokenInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };

package/dist/auth/index.d.ts

@@ -1,2 +1,2 @@
-import { C as OidcInput, D as mfaChallengeSchema, E as loginSuccessSchema, O as oidcInputSchema, S as MfaChallenge, T as loginResultSchema, _ as totpVerifyInputSchema, a as ResetInput, b as LoginSuccess, c as resetInputSchema, d as MfaCodeInput, f as MfaMethod, g as mfaWebauthnInputSchema, h as mfaCodeInputSchema, i as ChangePasswordInput, l as resetRequestInputSchema, m as TotpVerifyInput, n as AuthOpenApiFetchClient, o as ResetRequestInput, p as MfaWebauthnInput, r as createAuthClient, s as changeInputSchema, t as AuthClientInitOptions, u as MFA_METHOD, v as LoginInput, w as loginInputSchema, x as LoginUser, y as LoginResult } from "../authClient-D8i3JTM-.js";
-export { AuthClientInitOptions, AuthOpenApiFetchClient, ChangePasswordInput, LoginInput, LoginResult, LoginSuccess, LoginUser, MFA_METHOD, MfaChallenge, MfaCodeInput, MfaMethod, MfaWebauthnInput, OidcInput, ResetInput, ResetRequestInput, TotpVerifyInput, changeInputSchema, createAuthClient, loginInputSchema, loginResultSchema, loginSuccessSchema, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };
+import { A as PasswordInput, C as ApiLoginSuccess, D as LoginUser, E as LoginResultFor, F as mfaChallengeSchema, I as oidcInputSchema, L as passwordInputSchema, M as apiLoginSuccessSchema, N as browserLoginResultSchema, O as MfaChallenge, P as browserLoginSuccessSchema, S as ApiLoginResult, T as BrowserLoginSuccess, _ as MfaWebauthnInput, a as RefreshTokenInput, b as mfaWebauthnInputSchema, c as ChangePasswordInput, d as changeInputSchema, f as resetInputSchema, g as MfaMethod, h as MfaCodeInput, i as RefreshSessionInput, j as apiLoginResultSchema, k as OidcInput, l as ResetInput, m as MFA_METHOD, n as AuthOpenApiFetchClient, o as refreshSessionInputSchema, p as resetRequestInputSchema, r as createAuthClient, s as refreshTokenInputSchema, t as AuthClientInitOptions, u as ResetRequestInput, v as TotpVerifyInput, w as BrowserLoginResult, x as totpVerifyInputSchema, y as mfaCodeInputSchema } from "../authClient-CHXWJ9x3.js";
+export { ApiLoginResult, ApiLoginSuccess, AuthClientInitOptions, AuthOpenApiFetchClient, BrowserLoginResult, BrowserLoginSuccess, ChangePasswordInput, LoginResultFor, LoginUser, MFA_METHOD, MfaChallenge, MfaCodeInput, MfaMethod, MfaWebauthnInput, OidcInput, PasswordInput, RefreshSessionInput, RefreshTokenInput, ResetInput, ResetRequestInput, TotpVerifyInput, apiLoginResultSchema, apiLoginSuccessSchema, browserLoginResultSchema, browserLoginSuccessSchema, changeInputSchema, createAuthClient, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, passwordInputSchema, refreshSessionInputSchema, refreshTokenInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };

package/dist/auth/index.js

@@ -1,2 +1,2 @@
-import { a as MFA_METHOD, c as totpVerifyInputSchema, d as loginSuccessSchema, f as mfaChallengeSchema, i as resetRequestInputSchema, l as loginInputSchema, n as changeInputSchema, o as mfaCodeInputSchema, p as oidcInputSchema, r as resetInputSchema, s as mfaWebauthnInputSchema, t as createAuthClient, u as loginResultSchema } from "../authClient-D7W9vWPR.js";
-export { MFA_METHOD, changeInputSchema, createAuthClient, loginInputSchema, loginResultSchema, loginSuccessSchema, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };
+import { _ as passwordInputSchema, a as resetInputSchema, c as mfaCodeInputSchema, d as apiLoginResultSchema, f as apiLoginSuccessSchema, g as oidcInputSchema, h as mfaChallengeSchema, i as changeInputSchema, l as mfaWebauthnInputSchema, m as browserLoginSuccessSchema, n as refreshSessionInputSchema, o as resetRequestInputSchema, p as browserLoginResultSchema, r as refreshTokenInputSchema, s as MFA_METHOD, t as createAuthClient, u as totpVerifyInputSchema } from "../authClient-CgcDGd30.js";
+export { MFA_METHOD, apiLoginResultSchema, apiLoginSuccessSchema, browserLoginResultSchema, browserLoginSuccessSchema, changeInputSchema, createAuthClient, mfaChallengeSchema, mfaCodeInputSchema, mfaWebauthnInputSchema, oidcInputSchema, passwordInputSchema, refreshSessionInputSchema, refreshTokenInputSchema, resetInputSchema, resetRequestInputSchema, totpVerifyInputSchema };

package/dist/auth/types.d.cts

@@ -1,2 +1,2 @@
-import { A as DisableTotpPath, B as CreateDeviceAuthorizationResult, C as CreatePatInput, D as ListPatsResult, E as ExchangePatInput, F as VerifyMfaResult, H as GetDeviceAuthorizationTokenResult, I as LoginBody, L as ApproveDeviceAuthorizationBody, M as TotpSetupResult, N as TotpVerifyResult, O as PatScopeInput, P as VerifyMfaBody, R as ApproveDeviceAuthorizationResult, S as CreatePatBodyRaw, T as ExchangePatBodyRaw, V as GetDeviceAuthorizationTokenBody, _ as AssertSamlResult, a as RemoveWebauthnInput, b as GetPkceTokenBody, c as IntrospectTokenResult, d as SudoBody, f as SudoBodyRaw, g as AssertSamlBody, h as RevokeSessionPath, i as RegisterWebauthnResult, j as RegenerateRecoveryCodesResult, k as RevokePatPath, l as RefreshTokenResult, m as SudoResult, n as RegisterWebauthnInput, o as RemoveWebauthnPath, p as SudoChallengeResult, r as RegisterWebauthnOptionsResult, s as RemoveWebauthnQuery, t as ListWebauthnCredentialsResult, u as RevokeTokenBody, v as InitiateSamlBody, w as CreatePatResult, x as GetPkceTokenResult, y as InitiateSamlResult, z as CreateDeviceAuthorizationBody } from "../types-Jw10xuOW.cjs";
-export { ApproveDeviceAuthorizationBody, ApproveDeviceAuthorizationResult, AssertSamlBody, AssertSamlResult, CreateDeviceAuthorizationBody, CreateDeviceAuthorizationResult, CreatePatBodyRaw, CreatePatInput, CreatePatResult, DisableTotpPath, ExchangePatBodyRaw, ExchangePatInput, GetDeviceAuthorizationTokenBody, GetDeviceAuthorizationTokenResult, GetPkceTokenBody, GetPkceTokenResult, InitiateSamlBody, InitiateSamlResult, IntrospectTokenResult, ListPatsResult, ListWebauthnCredentialsResult, LoginBody, PatScopeInput, RefreshTokenResult, RegenerateRecoveryCodesResult, RegisterWebauthnInput, RegisterWebauthnOptionsResult, RegisterWebauthnResult, RemoveWebauthnInput, RemoveWebauthnPath, RemoveWebauthnQuery, RevokePatPath, RevokeSessionPath, RevokeTokenBody, SudoBody, SudoBodyRaw, SudoChallengeResult, SudoResult, TotpSetupResult, TotpVerifyResult, VerifyMfaBody, VerifyMfaResult };
+import { A as PatScopeInput, B as ApproveDeviceAuthorizationBody, C as GetPkceTokenResult, D as ExchangePatBodyRaw, E as CreatePatResult, F as TotpVerifyResult, G as GetDeviceAuthorizationTokenResult, H as CreateDeviceAuthorizationBody, I as VerifyMfaBody, L as VerifyMfaResult, M as DisableTotpPath, N as RegenerateRecoveryCodesResult, O as ExchangePatInput, P as TotpSetupResult, R as VerifyMfaType, S as GetPkceTokenBody, T as CreatePatInput, U as CreateDeviceAuthorizationResult, V as ApproveDeviceAuthorizationResult, W as GetDeviceAuthorizationTokenBody, _ as RevokeSessionPath, a as RemoveWebauthnInput, b as InitiateSamlBody, c as IntrospectTokenResult, d as RefreshTokenResult, f as RevokeTokenBody, g as SudoResult, h as SudoChallengeResult, i as RegisterWebauthnResult, j as RevokePatPath, k as ListPatsResult, l as RefreshTokenBody, m as SudoBodyRaw, n as RegisterWebauthnInput, o as RemoveWebauthnPath, p as SudoBody, r as RegisterWebauthnOptionsResult, s as RemoveWebauthnQuery, t as ListWebauthnCredentialsResult, u as RefreshTokenPartialBody, v as AssertSamlBody, w as CreatePatBodyRaw, x as InitiateSamlResult, y as AssertSamlResult, z as LoginBody } from "../types-BTK7Bv3n.cjs";
+export { ApproveDeviceAuthorizationBody, ApproveDeviceAuthorizationResult, AssertSamlBody, AssertSamlResult, CreateDeviceAuthorizationBody, CreateDeviceAuthorizationResult, CreatePatBodyRaw, CreatePatInput, CreatePatResult, DisableTotpPath, ExchangePatBodyRaw, ExchangePatInput, GetDeviceAuthorizationTokenBody, GetDeviceAuthorizationTokenResult, GetPkceTokenBody, GetPkceTokenResult, InitiateSamlBody, InitiateSamlResult, IntrospectTokenResult, ListPatsResult, ListWebauthnCredentialsResult, LoginBody, PatScopeInput, RefreshTokenBody, RefreshTokenPartialBody, RefreshTokenResult, RegenerateRecoveryCodesResult, RegisterWebauthnInput, RegisterWebauthnOptionsResult, RegisterWebauthnResult, RemoveWebauthnInput, RemoveWebauthnPath, RemoveWebauthnQuery, RevokePatPath, RevokeSessionPath, RevokeTokenBody, SudoBody, SudoBodyRaw, SudoChallengeResult, SudoResult, TotpSetupResult, TotpVerifyResult, VerifyMfaBody, VerifyMfaResult, VerifyMfaType };

package/dist/auth/types.d.ts

@@ -1,2 +1,2 @@
-import { A as DisableTotpPath, B as CreateDeviceAuthorizationResult, C as CreatePatInput, D as ListPatsResult, E as ExchangePatInput, F as VerifyMfaResult, H as GetDeviceAuthorizationTokenResult, I as LoginBody, L as ApproveDeviceAuthorizationBody, M as TotpSetupResult, N as TotpVerifyResult, O as PatScopeInput, P as VerifyMfaBody, R as ApproveDeviceAuthorizationResult, S as CreatePatBodyRaw, T as ExchangePatBodyRaw, V as GetDeviceAuthorizationTokenBody, _ as AssertSamlResult, a as RemoveWebauthnInput, b as GetPkceTokenBody, c as IntrospectTokenResult, d as SudoBody, f as SudoBodyRaw, g as AssertSamlBody, h as RevokeSessionPath, i as RegisterWebauthnResult, j as RegenerateRecoveryCodesResult, k as RevokePatPath, l as RefreshTokenResult, m as SudoResult, n as RegisterWebauthnInput, o as RemoveWebauthnPath, p as SudoChallengeResult, r as RegisterWebauthnOptionsResult, s as RemoveWebauthnQuery, t as ListWebauthnCredentialsResult, u as RevokeTokenBody, v as InitiateSamlBody, w as CreatePatResult, x as GetPkceTokenResult, y as InitiateSamlResult, z as CreateDeviceAuthorizationBody } from "../types-BrYkBQo4.js";
-export { ApproveDeviceAuthorizationBody, ApproveDeviceAuthorizationResult, AssertSamlBody, AssertSamlResult, CreateDeviceAuthorizationBody, CreateDeviceAuthorizationResult, CreatePatBodyRaw, CreatePatInput, CreatePatResult, DisableTotpPath, ExchangePatBodyRaw, ExchangePatInput, GetDeviceAuthorizationTokenBody, GetDeviceAuthorizationTokenResult, GetPkceTokenBody, GetPkceTokenResult, InitiateSamlBody, InitiateSamlResult, IntrospectTokenResult, ListPatsResult, ListWebauthnCredentialsResult, LoginBody, PatScopeInput, RefreshTokenResult, RegenerateRecoveryCodesResult, RegisterWebauthnInput, RegisterWebauthnOptionsResult, RegisterWebauthnResult, RemoveWebauthnInput, RemoveWebauthnPath, RemoveWebauthnQuery, RevokePatPath, RevokeSessionPath, RevokeTokenBody, SudoBody, SudoBodyRaw, SudoChallengeResult, SudoResult, TotpSetupResult, TotpVerifyResult, VerifyMfaBody, VerifyMfaResult };
+import { A as PatScopeInput, B as ApproveDeviceAuthorizationBody, C as GetPkceTokenResult, D as ExchangePatBodyRaw, E as CreatePatResult, F as TotpVerifyResult, G as GetDeviceAuthorizationTokenResult, H as CreateDeviceAuthorizationBody, I as VerifyMfaBody, L as VerifyMfaResult, M as DisableTotpPath, N as RegenerateRecoveryCodesResult, O as ExchangePatInput, P as TotpSetupResult, R as VerifyMfaType, S as GetPkceTokenBody, T as CreatePatInput, U as CreateDeviceAuthorizationResult, V as ApproveDeviceAuthorizationResult, W as GetDeviceAuthorizationTokenBody, _ as RevokeSessionPath, a as RemoveWebauthnInput, b as InitiateSamlBody, c as IntrospectTokenResult, d as RefreshTokenResult, f as RevokeTokenBody, g as SudoResult, h as SudoChallengeResult, i as RegisterWebauthnResult, j as RevokePatPath, k as ListPatsResult, l as RefreshTokenBody, m as SudoBodyRaw, n as RegisterWebauthnInput, o as RemoveWebauthnPath, p as SudoBody, r as RegisterWebauthnOptionsResult, s as RemoveWebauthnQuery, t as ListWebauthnCredentialsResult, u as RefreshTokenPartialBody, v as AssertSamlBody, w as CreatePatBodyRaw, x as InitiateSamlResult, y as AssertSamlResult, z as LoginBody } from "../types-BIECJYun.js";
+export { ApproveDeviceAuthorizationBody, ApproveDeviceAuthorizationResult, AssertSamlBody, AssertSamlResult, CreateDeviceAuthorizationBody, CreateDeviceAuthorizationResult, CreatePatBodyRaw, CreatePatInput, CreatePatResult, DisableTotpPath, ExchangePatBodyRaw, ExchangePatInput, GetDeviceAuthorizationTokenBody, GetDeviceAuthorizationTokenResult, GetPkceTokenBody, GetPkceTokenResult, InitiateSamlBody, InitiateSamlResult, IntrospectTokenResult, ListPatsResult, ListWebauthnCredentialsResult, LoginBody, PatScopeInput, RefreshTokenBody, RefreshTokenPartialBody, RefreshTokenResult, RegenerateRecoveryCodesResult, RegisterWebauthnInput, RegisterWebauthnOptionsResult, RegisterWebauthnResult, RemoveWebauthnInput, RemoveWebauthnPath, RemoveWebauthnQuery, RevokePatPath, RevokeSessionPath, RevokeTokenBody, SudoBody, SudoBodyRaw, SudoChallengeResult, SudoResult, TotpSetupResult, TotpVerifyResult, VerifyMfaBody, VerifyMfaResult, VerifyMfaType };

package/dist/{auth-JQ33o3nU.cjs → auth-Dm0F2rOh.cjs}

@@ -1,4 +1,4 @@
-const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
+const require_createFetchClient = require("./createFetchClient-Cwp8max9.cjs");
 //#region src/clients/auth.ts
 const createAuthHeaders = (auth) => {
 	if (auth.type === "sapi-token") return { [require_createFetchClient.KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
@@ -15,4 +15,4 @@ Object.defineProperty(exports, "createAuthHeaders", {
 	}
 });
 
-//# sourceMappingURL=auth-JQ33o3nU.cjs.map
+//# sourceMappingURL=auth-Dm0F2rOh.cjs.map

package/dist/{auth-JQ33o3nU.cjs.map → auth-Dm0F2rOh.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-JQ33o3nU.cjs","names":["KeboolaHttpHeader","HttpHeader"],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAGA,0BAAAA,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJC,0BAAAA,WAAW,gBAAgB,UAAU,KAAK;GAC1CD,0BAAAA,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}
+{"version":3,"file":"auth-Dm0F2rOh.cjs","names":["KeboolaHttpHeader","HttpHeader"],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAGA,0BAAAA,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJC,0BAAAA,WAAW,gBAAgB,UAAU,KAAK;GAC1CD,0BAAAA,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/{auth-aItmDu45.js → auth-DworfoPy.js}

@@ -1,4 +1,4 @@
-import { h as KeboolaHttpHeader, s as HttpHeader } from "./createFetchClient-U-ZrwPl2.js";
+import { h as KeboolaHttpHeader, s as HttpHeader } from "./createFetchClient-DXHQK63w.js";
 //#region src/clients/auth.ts
 const createAuthHeaders = (auth) => {
 	if (auth.type === "sapi-token") return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };
@@ -10,4 +10,4 @@ const createAuthHeaders = (auth) => {
 //#endregion
 export { createAuthHeaders as t };
 
-//# sourceMappingURL=auth-aItmDu45.js.map
+//# sourceMappingURL=auth-DworfoPy.js.map

package/dist/{auth-aItmDu45.js.map → auth-DworfoPy.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-aItmDu45.js","names":[],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAG,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJ,WAAW,gBAAgB,UAAU,KAAK;GAC1C,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}
+{"version":3,"file":"auth-DworfoPy.js","names":[],"sources":["../src/clients/auth.ts"],"sourcesContent":["import { HttpHeader } from '../fetchClient';\nimport { KeboolaHttpHeader } from '../internal';\n\nexport type AuthStrategy =\n  | {\n      type: 'sapi-token';\n      token: string;\n    }\n  | {\n      type: 'bearer';\n      token: string;\n      projectId: number;\n    };\n\nexport const createAuthHeaders = (auth: AuthStrategy): Record<string, string> => {\n  if (auth.type === 'sapi-token') return { [KeboolaHttpHeader.STORAGE_API_TOKEN]: auth.token };\n\n  // `auth.token` is the bare token; the `Bearer ` wire prefix is added here (mirroring the\n  // management client). In the browser bearer flow the bearer auth middleware stamps the\n  // Authorization header on every request, so this value only matters for middleware-less\n  // clients (e.g. kai-agent's storage token verification).\n  return {\n    [HttpHeader.AUTHORIZATION]: `Bearer ${auth.token}`,\n    [KeboolaHttpHeader.PROJECT_ID]: auth.projectId.toString(),\n  };\n};\n"],"mappings":";;AAcA,MAAa,qBAAqB,SAA+C;CAC/E,IAAI,KAAK,SAAS,cAAc,OAAO,GAAG,kBAAkB,oBAAoB,KAAK,MAAM;CAM3F,OAAO;GACJ,WAAW,gBAAgB,UAAU,KAAK;GAC1C,kBAAkB,aAAa,KAAK,UAAU,SAAS;CAC1D;AACF"}

package/dist/{authClient-_PpvGgZJ.cjs → authClient-BmuUo0J4.cjs}

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
-const require_createFetchClient = require("./createFetchClient-DgMiqTJ8.cjs");
-const require_validateConnectionStatus = require("./validateConnectionStatus-CsvYmCOI.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-o3cPJeRn.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DhUU3M1W.cjs");
+const require_createFetchClient = require("./createFetchClient-Cwp8max9.cjs");
+const require_validateConnectionStatus = require("./validateConnectionStatus-BEYkQpu9.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-Dl9cqTvR.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-BYqW-9tm.cjs");
 let zod = require("zod");
 zod = require_rolldown_runtime.__toESM(zod, 1);
 //#region src/clients/auth/device/device.ts
@@ -27,11 +27,14 @@ const createDevice = (client) => {
 };
 //#endregion
 //#region src/clients/auth/login/schemas.ts
-const loginInputSchema = zod.object({
+const loginInputSchema = zod.object({ 
+/** Also mints a session cookie; `Origin` must be the stack app URL, else 403. */
+browserMode: zod.boolean().default(false) });
+const passwordInputSchema = loginInputSchema.extend({
 	email: zod.email(),
 	password: zod.string().min(1, "Required")
 });
-const oidcInputSchema = zod.object({
+const oidcInputSchema = loginInputSchema.extend({
 	grantType: zod.enum(["google", "microsoft"]),
 	idToken: zod.string().min(1, "Required")
 });
@@ -40,28 +43,22 @@ const userSchema = zod.object({
 	email: zod.string(),
 	name: zod.string()
 });
-const loginSuccessSchema = zod.object({
+const loginSuccessBaseSchema = zod.object({
 	mfaRequired: zod.literal(false).default(false),
 	accessToken: zod.string(),
-	refreshToken: zod.string(),
 	tokenType: zod.string(),
 	expiresIn: zod.number(),
-	sessionId: zod.string(),
-	user: userSchema
+	user: userSchema,
+	sessionId: zod.string()
 });
+const apiLoginSuccessSchema = loginSuccessBaseSchema.extend({ refreshToken: zod.string() });
+const browserLoginSuccessSchema = loginSuccessBaseSchema.extend({ refreshToken: zod.null().optional() });
 /**
-* MFA-challenge shape. `mfaRequired` is always true here — it is the discriminant.
+* MFA-challenge shape.
 *
-* - `mfaType` is the account's single active factor, `allowedMethods` everything that may satisfy
-*   it. Both stay `string`: a stack that grows a method must not fail to parse, so callers branch
-*   and handle the unknown case themselves.
-* - `webauthn` carries the serialized `PublicKeyCredentialRequestOptionsJSON` for a passkey
-*   challenge, inlined so the ceremony costs no extra round-trip. The spec declares it
-*   required-and-nullable while the serializer omits the key outright for TOTP, so it must tolerate
-*   present, `null` and absent alike.
-* - `unknown`, not a record: this sits inside the union `login` hard-parses, so a shape nobody
-*   expected here would fail *both* branches and lock every MFA user out of sign-in — not merely
-*   out of the passkey path. Whoever runs the ceremony validates it properly instead.
+* - `mfaType` / `allowedMethods` stay `string` so a new method still parses.
+* - `webauthn` is `PublicKeyCredentialRequestOptionsJSON`: present, `null` or absent (TOTP).
+* - `unknown`: a stricter shape failing would block every MFA sign-in; the ceremony validates.
 */
 const mfaChallengeSchema = zod.object({
 	mfaRequired: zod.literal(true),
@@ -71,7 +68,8 @@ const mfaChallengeSchema = zod.object({
 	allowedMethods: zod.array(zod.string()),
 	webauthn: zod.unknown().optional()
 });
-const loginResultSchema = zod.union([loginSuccessSchema, mfaChallengeSchema]);
+const apiLoginResultSchema = zod.union([apiLoginSuccessSchema, mfaChallengeSchema]);
+const browserLoginResultSchema = zod.union([browserLoginSuccessSchema, mfaChallengeSchema]);
 //#endregion
 //#region src/clients/auth/login/login.ts
 const createLogin = (client) => {
@@ -79,22 +77,30 @@ const createLogin = (client) => {
 		const { data } = await client.post("/v1/auth/login", { body }, { signal });
 		return data;
 	};
+	/**
+	* Grants parse with our own schemas — the generated response type is unreliable.
+	*
+	* - `browserMode` picks the schema: only API mode carries a refresh token.
+	* - `const Browser` keeps the literal; a `boolean` flag widens the result to the union.
+	*/
 	const withPassword = async (input, signal) => {
-		const { email, password } = loginInputSchema.parse(input);
+		const { email, password, browserMode } = passwordInputSchema.parse(input);
 		const data = await _login({
 			grantType: "password",
 			email,
-			password
+			password,
+			browserMode
 		}, signal);
-		return loginResultSchema.parse(data);
+		return (browserMode ? browserLoginResultSchema : apiLoginResultSchema).parse(data);
 	};
 	const withOidc = async (input, signal) => {
-		const { grantType, idToken } = oidcInputSchema.parse(input);
+		const { grantType, idToken, browserMode } = oidcInputSchema.parse(input);
 		const data = await _login({
 			grantType,
-			idToken
+			idToken,
+			browserMode
 		}, signal);
-		return loginResultSchema.parse(data);
+		return (browserMode ? browserLoginResultSchema : apiLoginResultSchema).parse(data);
 	};
 	const methods = async (signal) => {
 		const { data } = await client.get("/v1/auth/methods", {}, { signal });
@@ -107,15 +113,48 @@ const createLogin = (client) => {
 	};
 };
 //#endregion
+//#region src/clients/auth/manageTokens/manageTokens.ts
+const createManageTokens = (client) => {
+	/**
+	* Every Manage API token the caller owns, in two lists.
+	*
+	* - `tokens` — the ones the caller created by hand, newest first.
+	* - `sessionTokens` — the ones a browser sign-in minted, newest first.
+	* - A token carries `scopes: []` when it merely inherits the caller's own permissions.
+	*/
+	const getAll = async (signal) => {
+		const { data } = await client.get("/v1/auth/manage-tokens", {}, { signal });
+		return data;
+	};
+	/**
+	* Mint a token and read its secret.
+	*
+	* - `token` in the response is returned this once and is unreadable afterwards.
+	* - `manageToken` is the same row the list endpoint returns.
+	* - Needs an active sudo window; without one the endpoint answers `403`.
+	* - Rate-limited per caller, answering `429` with `Retry-After`.
+	*/
+	const create = async (input, signal) => {
+		const { data } = await client.post("/v1/auth/manage-tokens", { body: input }, { signal });
+		return data;
+	};
+	/** Deleting an id that is already gone answers `404` — the call is not idempotent. */
+	const revoke = async (id, signal) => {
+		await client.delete("/v1/auth/manage-tokens/{id}", { path: { id } }, { signal });
+	};
+	return {
+		getAll,
+		create,
+		revoke
+	};
+};
+//#endregion
 //#region src/clients/auth/mfa/schemas.ts
 /**
-* The methods `POST /v1/auth/mfa` accepts, and the vocabulary a login challenge reports in
-* `mfaType` / `allowedMethods`.
+* Methods `POST /v1/auth/mfa` accepts, also reported in a challenge's `mfaType` / `allowedMethods`.
 *
-* - `totp` and `recoveryCode` are verified by a typed code; `webauthn` by an assertion.
-* - `satisfies` binds the values to the generated spec, so a regenerated schema that renames or
-*   drops a method fails the build here rather than at runtime mid-sign-in.
-* - A challenge may still name a method absent from here, so the wire fields stay `string`.
+* - `satisfies` fails the build if the generated spec renames or drops one.
+* - A challenge may name a method not listed here, so the wire fields stay `string`.
 */
 const MFA_METHOD = {
 	totp: "totp",
@@ -336,12 +375,40 @@ const createSudo = (client) => {
 	};
 };
 //#endregion
+//#region src/clients/auth/token/schemas.ts
+const refreshTokenInputSchema = zod.object({ refreshToken: zod.string().min(1, "Required") });
+const refreshSessionInputSchema = zod.object({ sessionId: zod.string().min(1, "Required") });
+//#endregion
 //#region src/clients/auth/token/token.ts
 const createToken = (client) => {
-	const refresh = async (refreshToken, signal) => {
-		const { data } = await client.post("/v1/auth/token/refresh", { body: { refreshToken } }, { signal });
+	const _refresh = async (body, { signal, headers } = {}) => {
+		const { data } = await client.post("/v1/auth/token/refresh", { body }, {
+			signal,
+			headers
+		});
 		return data;
 	};
+	/** API mode: rotates the pair. The response carries the next refresh token. */
+	const refreshWithToken = async (input, signal) => {
+		const { refreshToken } = refreshTokenInputSchema.parse(input);
+		return _refresh({ refreshToken }, { signal });
+	};
+	/**
+	* Browser/cookie mode: renews the access token off the session cookie.
+	*
+	* - The `X-KBC-CSRF` header opts in; without it the request is API mode.
+	* - Its value is a constant: its presence is the CSRF proof (custom headers need a preflight).
+	* - No refresh token in the response; it stays server-side, bound to the cookie.
+	* - Works only from the stack's own origin (fetch's default `same-origin` credentials).
+	* - An `Authorization` header rejects the request — use a client with no auth middleware.
+	*/
+	const refreshWithSession = async (input, signal) => {
+		const { sessionId } = refreshSessionInputSchema.parse(input);
+		return _refresh({ sessionId }, {
+			signal,
+			headers: { [require_createFetchClient.KeboolaHttpHeader.CSRF]: "1" }
+		});
+	};
 	/**
 	* Introspects an authenticated session token.
 	*
@@ -358,7 +425,8 @@ const createToken = (client) => {
 		await client.post("/v1/auth/token/revoke", { body }, { signal });
 	};
 	return {
-		refresh,
+		refreshWithToken,
+		refreshWithSession,
 		introspect,
 		revoke
 	};
@@ -419,6 +487,7 @@ const createAuthClient = ({ baseUrl, middlewares }) => {
 		password: createPassword(client),
 		saml: createSaml(client),
 		pat: createPat(client),
+		manageTokens: createManageTokens(client),
 		device: createDevice(client),
 		sudo: createSudo(client),
 		pkce: createPkce(client),
@@ -434,34 +503,40 @@ Object.defineProperty(exports, "MFA_METHOD", {
 		return MFA_METHOD;
 	}
 });
-Object.defineProperty(exports, "changeInputSchema", {
+Object.defineProperty(exports, "apiLoginResultSchema", {
 	enumerable: true,
 	get: function() {
-		return changeInputSchema;
+		return apiLoginResultSchema;
 	}
 });
-Object.defineProperty(exports, "createAuthClient", {
+Object.defineProperty(exports, "apiLoginSuccessSchema", {
 	enumerable: true,
 	get: function() {
-		return createAuthClient;
+		return apiLoginSuccessSchema;
 	}
 });
-Object.defineProperty(exports, "loginInputSchema", {
+Object.defineProperty(exports, "browserLoginResultSchema", {
 	enumerable: true,
 	get: function() {
-		return loginInputSchema;
+		return browserLoginResultSchema;
 	}
 });
-Object.defineProperty(exports, "loginResultSchema", {
+Object.defineProperty(exports, "browserLoginSuccessSchema", {
 	enumerable: true,
 	get: function() {
-		return loginResultSchema;
+		return browserLoginSuccessSchema;
 	}
 });
-Object.defineProperty(exports, "loginSuccessSchema", {
+Object.defineProperty(exports, "changeInputSchema", {
 	enumerable: true,
 	get: function() {
-		return loginSuccessSchema;
+		return changeInputSchema;
+	}
+});
+Object.defineProperty(exports, "createAuthClient", {
+	enumerable: true,
+	get: function() {
+		return createAuthClient;
 	}
 });
 Object.defineProperty(exports, "mfaChallengeSchema", {
@@ -488,6 +563,24 @@ Object.defineProperty(exports, "oidcInputSchema", {
 		return oidcInputSchema;
 	}
 });
+Object.defineProperty(exports, "passwordInputSchema", {
+	enumerable: true,
+	get: function() {
+		return passwordInputSchema;
+	}
+});
+Object.defineProperty(exports, "refreshSessionInputSchema", {
+	enumerable: true,
+	get: function() {
+		return refreshSessionInputSchema;
+	}
+});
+Object.defineProperty(exports, "refreshTokenInputSchema", {
+	enumerable: true,
+	get: function() {
+		return refreshTokenInputSchema;
+	}
+});
 Object.defineProperty(exports, "resetInputSchema", {
 	enumerable: true,
 	get: function() {
@@ -507,4 +600,4 @@ Object.defineProperty(exports, "totpVerifyInputSchema", {
 	}
 });
 
-//# sourceMappingURL=authClient-_PpvGgZJ.cjs.map
+//# sourceMappingURL=authClient-BmuUo0J4.cjs.map