@keboola/api-client 39.0.0 → 41.0.0

package/dist/sdk/configurations/index.d.ts

@@ -1,7 +1,7 @@
-import { B as createStorageClient, I as RegisteredComponentId, L as registry, Wt as createDefaultBranch } from "../../index-GfKzh267.js";
-import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-B95uNQ9o.js";
-import { t as createEncryptionClient } from "../../index-1r_CskjU.js";
-import { t as Project } from "../../project-DCHOxRWd.js";
+import { H as createStorageClient, I as RegisteredComponentId, L as registry, tn as createDefaultBranch } from "../../index-CaaTOANF.js";
+import { Dn as UpdateConfigurationInput, Xt as BaseComponentConfig, an as ConfigurationPath, sn as CreateConfigurationInput } from "../../types-CKmTZSPG.js";
+import { t as createEncryptionClient } from "../../index-D7-o-oGa.js";
+import { t as Project } from "../../project-B15gStbM.js";
 import { z } from "zod";
 //#region src/sdks/configurations/configurationsSdk.d.ts
 type ConfigurationSdkContext = {
@@ -21,13 +21,10 @@ type TypedConfiguration<ComponentId extends RegisteredComponentId> = {
 };
 /**
  * How an update writes the patch against the stored configuration:
- * - `'merge'` (default) — schema-guided deep merge: object fields patch individually, while a
- *   credential union or array subtree is replaced wholesale (so switching auth variants deletes
- *   the abandoned secret). Untouched leaves and out-of-schema keys are preserved. Reads the
- *   current config first to merge onto.
- * - `'replace'` — store exactly what the caller sends (after validation + encryption); no read,
- *   no merge. Completeness is on the caller — any field or sibling key (e.g. `storage`) it omits
- *   is gone.
+ * - `'merge'` (default) — reads the config, deep-merges by schema; credential unions and arrays are
+ *   replaced wholesale (dropping an abandoned secret), out-of-schema keys kept.
+ * - `'replace'` — stores exactly what is sent (validated + encrypted); anything omitted,
+ *   e.g. `storage`, is gone.
  */
 type UpdateMode = 'merge' | 'replace';
 declare const createConfigurationSdk: ({ storageClient, encryptionClient, context }: Options) => {
@@ -906,6 +903,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -1922,6 +1920,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{
@@ -2940,6 +2939,7 @@ declare const createConfigurationSdk: ({ storageClient, encryptionClient, contex
       parameters: z.ZodObject<{
         customerId: z.ZodArray<z.ZodString>;
         onlyEnabledCustomers: z.ZodOptional<z.ZodBoolean>;
+        continueOnFailure: z.ZodOptional<z.ZodBoolean>;
         getAccountChildren: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
     }, z.core.$strip>> & Record<"keboola.ex-http", z.ZodObject<{

package/dist/sdk/configurations/index.js

@@ -1,2 +1,2 @@
-import { t as createConfigurationSdk } from "../../configurations-VtNE0nrT.js";
+import { t as createConfigurationSdk } from "../../configurations-CF3xz7RB.js";
 export { createConfigurationSdk };

package/dist/sdk/developerPortal/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dedupe = require("../../dedupe-CiskLkGR.cjs");
+const require_dedupe = require("../../dedupe-OSnnst2u.cjs");
 const require_store = require("../../store-xS-Cu_VS.cjs");
-const require_createFetchClient = require("../../createFetchClient-BlgPbjFj.cjs");
-const require_credential = require("../../credential-CAulvfZ-.cjs");
-const require_developerPortalClient = require("../../developerPortalClient-CutPqoAa.cjs");
+const require_createFetchClient = require("../../createFetchClient-Cwp8max9.cjs");
+const require_middleware = require("../../middleware-IjYx3d5u.cjs");
+const require_developerPortalClient = require("../../developerPortalClient-CLPpBksD.cjs");
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -38,7 +38,7 @@ const createDeveloperPortalCredential = ({ refresh, getTokens, onSessionExpired,
 		try {
 			return await refresh();
 		} catch (error) {
-			if (require_credential.isUnauthorized(error)) onSessionExpired?.();
+			if (require_middleware.isUnauthorized(error)) onSessionExpired?.();
 			throw error;
 		}
 	};
@@ -75,7 +75,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 		try {
 			return await next(request);
 		} catch (error) {
-			if (!require_credential.isUnauthorized(error)) throw error;
+			if (!require_middleware.isUnauthorized(error)) throw error;
 			const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);
 			if (refreshed === null) throw error;
 			retryRequest.headers.set(require_createFetchClient.HttpHeader.AUTHORIZATION, refreshed);
@@ -85,7 +85,7 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 					request: retryRequest
 				});
 			} catch (retryError) {
-				if (require_credential.isUnauthorized(retryError)) credential.notifyExpired();
+				if (require_middleware.isUnauthorized(retryError)) credential.notifyExpired();
 				throw retryError;
 			}
 		}
@@ -94,13 +94,9 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 //#endregion
 //#region src/sdks/developerPortal/developerPortalSdk.ts
 /**
-* `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
-* credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+* `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
-* It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
-* needs the credential, the credential needs the session, and the session needs a client to rotate
-* with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
-* apps-api is its own identity domain.
+* - Builds its own client: middleware, credential and session depend on each other in a cycle.
 */
 const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
 	const store = require_store.createStore(initialTokens);
@@ -185,11 +181,7 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 			ensureFresh: async () => {
 				await credential.getIdToken();
 			},
-			/**
-			* Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-			* matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-			* Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-			*/
+			/** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
 			refresh: async () => {
 				await credential.getIdToken({ forceRefresh: true });
 			},

package/dist/sdk/developerPortal/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/developerPortal/index.d.cts

@@ -1,11 +1,11 @@
-import { D as MiddlewareFn } from "../../index-V7XKUQm9.cjs";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-D8Rrz51O.cjs";
-import { t as DeveloperPortalTokens } from "../../index-GjcJTCbz.cjs";
+import { O as MiddlewareFn } from "../../index-BVhHt5lx.cjs";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-tKkeLa2B.cjs";
+import { t as DeveloperPortalTokens } from "../../index-C4TNAA8-.cjs";
 import { n as Listener } from "../../emitter-dLF1Fyfg.cjs";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
-  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */
+  /** Session to restore on construction. */
   tokens?: DeveloperPortalTokens | null;
   /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */
   onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;
@@ -15,13 +15,9 @@ type DeveloperPortalSdkOptions = {
   middlewares?: MiddlewareFn[];
 };
 /**
- * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
- * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+ * `createDeveloperPortalClient` plus the session that keeps it authenticated.
  *
- * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
- * needs the credential, the credential needs the session, and the session needs a client to rotate
- * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
- * apps-api is its own identity domain.
+ * - Builds its own client: middleware, credential and session depend on each other in a cycle.
  */
 declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares }: DeveloperPortalSdkOptions) => {
   api: {
@@ -1356,11 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;
-    /**
-     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-     */
+    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
     refresh: () => Promise<void>;
     isAuthenticated: () => boolean;
   };

package/dist/sdk/developerPortal/index.d.ts

@@ -1,11 +1,11 @@
-import { D as MiddlewareFn } from "../../index-KuQ79Mnz.js";
-import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-DajzGOKB.js";
-import { t as DeveloperPortalTokens } from "../../index-pXN4LWUX.js";
+import { O as MiddlewareFn } from "../../index-BgR5zcjJ.js";
+import { A as ResetPasswordConfirmInput, E as PaginationQuery, F as UpdateAppAsAdminInput, I as UpdateAppInput, L as UpdateVendorAsAdminInput, N as SignUpInput, R as UpdateVendorInput, S as LoginSuccess, W as components, _ as GetVendorUsersQuery, b as LoginInput, c as ConfirmAccountInput, d as CreateVendorAsAdminInput, f as CreateVendorInput, g as GetChangesQuery, h as GetAppsQuery, k as RejectAppInput, l as CreateAppInput, p as DeprecateAppInput, s as ApproveVendorInput, t as AdminPaginationQuery, u as CreateServiceAccountInput } from "../../types-q-1r_9d1.js";
+import { t as DeveloperPortalTokens } from "../../index-C11JSxBY.js";
 import { n as Listener } from "../../emitter-dLF1Fyfg.js";
 //#region src/sdks/developerPortal/developerPortalSdk.d.ts
 type DeveloperPortalSdkOptions = {
   baseUrl: string;
-  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */
+  /** Session to restore on construction. */
   tokens?: DeveloperPortalTokens | null;
   /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */
   onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;
@@ -15,13 +15,9 @@ type DeveloperPortalSdkOptions = {
   middlewares?: MiddlewareFn[];
 };
 /**
- * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
- * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+ * `createDeveloperPortalClient` plus the session that keeps it authenticated.
  *
- * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
- * needs the credential, the credential needs the session, and the session needs a client to rotate
- * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
- * apps-api is its own identity domain.
+ * - Builds its own client: middleware, credential and session depend on each other in a cycle.
  */
 declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares }: DeveloperPortalSdkOptions) => {
   api: {
@@ -1356,11 +1352,7 @@ declare const createDeveloperPortalSdk: ({ baseUrl, tokens: initialTokens, onTok
     clear: () => void;
     /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */
     ensureFresh: () => Promise<void>;
-    /**
-     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-     */
+    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
     refresh: () => Promise<void>;
     isAuthenticated: () => boolean;
   };

package/dist/sdk/developerPortal/index.js

@@ -1,8 +1,8 @@
-import { t as dedupe } from "../../dedupe-DYIHgZoG.js";
+import { t as dedupe } from "../../dedupe-Cky1gSUu.js";
 import { t as createStore } from "../../store-C9FQCHGe.js";
-import { s as HttpHeader } from "../../createFetchClient-C-cadpBx.js";
-import { n as isUnauthorized } from "../../credential-DWXbo4IX.js";
-import { t as createDeveloperPortalClient } from "../../developerPortalClient-yHFTkKPb.js";
+import { s as HttpHeader } from "../../createFetchClient-DXHQK63w.js";
+import { n as isUnauthorized } from "../../middleware-CBwrtgQd.js";
+import { t as createDeveloperPortalClient } from "../../developerPortalClient-B1QZ1rYi.js";
 //#region src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -93,13 +93,9 @@ const createDeveloperPortalAuthMiddleware = (credential) => {
 //#endregion
 //#region src/sdks/developerPortal/developerPortalSdk.ts
 /**
-* `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the
-* credential, the auth middleware, and the tokens the four self-authenticating endpoints need.
+* `createDeveloperPortalClient` plus the session that keeps it authenticated.
 *
-* It constructs its client rather than receiving one like `createTagSdk` does, because the middleware
-* needs the credential, the credential needs the session, and the session needs a client to rotate
-* with. `createKeboola` closes the same cycle the same way, and stays separate from this one because
-* apps-api is its own identity domain.
+* - Builds its own client: middleware, credential and session depend on each other in a cycle.
 */
 const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTokensChange, onSessionExpired, refreshLeadTimeMs, middlewares = [] }) => {
 	const store = createStore(initialTokens);
@@ -184,11 +180,7 @@ const createDeveloperPortalSdk = ({ baseUrl, tokens: initialTokens = null, onTok
 			ensureFresh: async () => {
 				await credential.getIdToken();
 			},
-			/**
-			* Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that
-			* matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.
-			* Propagates failure: a caller forcing this needs to know whether the claims actually changed.
-			*/
+			/** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */
 			refresh: async () => {
 				await credential.getIdToken({ forceRefresh: true });
 			},

package/dist/sdk/developerPortal/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credential';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction — e.g. a trio read back out of `localStorage`. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated: the token store, the\n * credential, the auth middleware, and the tokens the four self-authenticating endpoints need.\n *\n * It constructs its client rather than receiving one like `createTagSdk` does, because the middleware\n * needs the credential, the credential needs the session, and the session needs a client to rotate\n * with. `createKeboola` closes the same cycle the same way, and stays separate from this one because\n * apps-api is its own identity domain.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware: `refreshTokens` sets its own header, so a rotation cannot recurse into the\n  // middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation: without this, a `clear()` that lands while the request\n    // is on the wire is undone by the response, silently signing the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store would leave the session holding\n  // tokens the server has moved past. `session.refresh()` is the supported way.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /**\n     * Rotates now, for a change of *claims* rather than age — leaving a vendor is the case that\n     * matters, since the stale `profile` claim keeps scoping requests to a vendor the user just left.\n     * Propagates failure: a caller forcing this needs to know whether the claims actually changed.\n     */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;;;;;ACZA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAIA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAI5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAID,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CAgDnE,OAAO;EAAE,KAAA;GA7CP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EA6BS;EAAG,SAAA;GAzBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;;;;;GAMA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/kaiMemory/index.cjs

@@ -0,0 +1,7 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_kaiMemory = require("../../kaiMemory-CClSPInt.cjs");
+exports.KAI_MEMORY_OBJECT_TYPE = require_kaiMemory.KAI_MEMORY_OBJECT_TYPE;
+exports.KAI_MEMORY_STATUSES = require_kaiMemory.KAI_MEMORY_STATUSES;
+exports.KaiMemoryReviewConflictError = require_kaiMemory.KaiMemoryReviewConflictError;
+exports.KaiMemoryUnreadableItemsError = require_kaiMemory.KaiMemoryUnreadableItemsError;
+exports.createKaiMemorySdk = require_kaiMemory.createKaiMemorySdk;

package/dist/sdk/kaiMemory/index.d.cts

@@ -0,0 +1,41 @@
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-DWiLcrxt.cjs";
+//#region src/sdks/kaiMemory/kaiMemorySdk.d.ts
+/** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
+declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
+/**
+ * Thrown by `getItemsByStatusStrict` when any `kai-memory` item — of any status, not only the
+ * one asked for — could not be parsed. See that function's docstring for why an unreadable item
+ * anywhere in the collection fails the whole read rather than being dropped.
+ */
+declare class KaiMemoryUnreadableItemsError extends Error {
+  readonly unreadableIds: string[];
+  constructor(unreadableIds: string[]);
+}
+/**
+ * Thrown by `updateStatus` when the item is no longer `pending` at write time — see that
+ * function's docstring for the race it closes.
+ */
+declare class KaiMemoryReviewConflictError extends Error {
+  readonly uuid: string;
+  readonly currentStatus: KaiMemoryStatus;
+  constructor(uuid: string, currentStatus: KaiMemoryStatus);
+}
+type Options = {
+  metastoreClient: MetastoreClient;
+};
+declare const createKaiMemorySdk: ({ metastoreClient }: Options) => {
+  getItems: (signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getItemsByStatus: (status: KaiMemoryStatus, signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getItemsByStatusStrict: (status: KaiMemoryStatus, signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getUnreadableItemIds: (signal?: AbortSignal) => Promise<string[]>;
+  deleteUnreadableItem: (uuid: string) => Promise<void>;
+  createItem: ({ content, chatId, createdBy }: {
+    content: string;
+    chatId: string;
+    createdBy?: string;
+  }, meta?: CreateKaiMemoryMeta) => Promise<KaiMemoryItem>;
+  updateStatus: (uuid: string, status: KaiMemoryStatus, meta?: UpdateKaiMemoryMeta) => Promise<KaiMemoryItem>;
+};
+//#endregion
+export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };
+//# sourceMappingURL=index.d.cts.map

package/dist/sdk/kaiMemory/index.d.ts

@@ -0,0 +1,41 @@
+import { a as KaiMemoryStatus, c as KAI_MEMORY_STATUSES, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-Cg14ncdV.js";
+//#region src/sdks/kaiMemory/kaiMemorySdk.d.ts
+/** The metastore object type this SDK addresses — see `SEMANTIC_OBJECT_TYPE` for the convention. */
+declare const KAI_MEMORY_OBJECT_TYPE = "kai-memory";
+/**
+ * Thrown by `getItemsByStatusStrict` when any `kai-memory` item — of any status, not only the
+ * one asked for — could not be parsed. See that function's docstring for why an unreadable item
+ * anywhere in the collection fails the whole read rather than being dropped.
+ */
+declare class KaiMemoryUnreadableItemsError extends Error {
+  readonly unreadableIds: string[];
+  constructor(unreadableIds: string[]);
+}
+/**
+ * Thrown by `updateStatus` when the item is no longer `pending` at write time — see that
+ * function's docstring for the race it closes.
+ */
+declare class KaiMemoryReviewConflictError extends Error {
+  readonly uuid: string;
+  readonly currentStatus: KaiMemoryStatus;
+  constructor(uuid: string, currentStatus: KaiMemoryStatus);
+}
+type Options = {
+  metastoreClient: MetastoreClient;
+};
+declare const createKaiMemorySdk: ({ metastoreClient }: Options) => {
+  getItems: (signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getItemsByStatus: (status: KaiMemoryStatus, signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getItemsByStatusStrict: (status: KaiMemoryStatus, signal?: AbortSignal) => Promise<KaiMemoryItem[]>;
+  getUnreadableItemIds: (signal?: AbortSignal) => Promise<string[]>;
+  deleteUnreadableItem: (uuid: string) => Promise<void>;
+  createItem: ({ content, chatId, createdBy }: {
+    content: string;
+    chatId: string;
+    createdBy?: string;
+  }, meta?: CreateKaiMemoryMeta) => Promise<KaiMemoryItem>;
+  updateStatus: (uuid: string, status: KaiMemoryStatus, meta?: UpdateKaiMemoryMeta) => Promise<KaiMemoryItem>;
+};
+//#endregion
+export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };
+//# sourceMappingURL=index.d.ts.map

package/dist/sdk/kaiMemory/index.js

@@ -0,0 +1,2 @@
+import { a as KAI_MEMORY_STATUSES, i as createKaiMemorySdk, n as KaiMemoryReviewConflictError, r as KaiMemoryUnreadableItemsError, t as KAI_MEMORY_OBJECT_TYPE } from "../../kaiMemory-D0Y_16U4.js";
+export { KAI_MEMORY_OBJECT_TYPE, KAI_MEMORY_STATUSES, KaiMemoryReviewConflictError, KaiMemoryUnreadableItemsError, createKaiMemorySdk };

package/dist/sdk/kaiMemory/types.d.cts

@@ -0,0 +1,2 @@
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-DWiLcrxt.cjs";
+export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/kaiMemory/types.d.ts

@@ -0,0 +1,2 @@
+import { a as KaiMemoryStatus, i as KaiMemoryMeta, n as KaiMemoryData, o as MetastoreClient, r as KaiMemoryItem, s as UpdateKaiMemoryMeta, t as CreateKaiMemoryMeta } from "../../types-Cg14ncdV.js";
+export { CreateKaiMemoryMeta, KaiMemoryData, KaiMemoryItem, KaiMemoryMeta, KaiMemoryStatus, MetastoreClient, UpdateKaiMemoryMeta };

package/dist/sdk/kaiMemory/types.js

@@ -0,0 +1 @@
+export {};

package/dist/sdk/queryService/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_jobStatus = require("../../jobStatus-0_Y3Sr4i.cjs");
+const require_jobStatus = require("../../jobStatus-BMlsyXWI.cjs");
 const require_QueryJobTimeoutError = require("../../QueryJobTimeoutError-CVNPdCWX.cjs");
-const require_ValidationError = require("../../ValidationError-CLVJCCwH.cjs");
+const require_ValidationError = require("../../ValidationError-D65QU0uq.cjs");
 //#region src/sdks/queryService/queryServiceSdk.ts
 const DEFAULT_WAIT_FOR_JOB_INTERVAL = 500;
 const DEFAULT_MAX_WAIT_TIME = 3e5;

package/dist/sdk/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-CHXnJQ9s.cjs";
+import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-cWp_V6K5.cjs";
 export { ExecuteQueryOptions, WaitForJobOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-GfKzh267.js";
+import { i as createQueryServiceSdk, n as ExecuteQueryOptions, r as WaitForJobOptions } from "../../index-CaaTOANF.js";
 export { ExecuteQueryOptions, WaitForJobOptions, createQueryServiceSdk };

package/dist/sdk/queryService/index.js

@@ -1,6 +1,6 @@
-import { i as poll, t as jobStatus } from "../../jobStatus-PSZJMTiA.js";
+import { i as poll, t as jobStatus } from "../../jobStatus-CfRtsIpv.js";
 import { r as QueryJobError, t as QueryJobTimeoutError } from "../../QueryJobTimeoutError-C7JbNGOM.js";
-import { t as ValidationError } from "../../ValidationError-BekhphAq.js";
+import { t as ValidationError } from "../../ValidationError-DjhtNMfZ.js";
 //#region src/sdks/queryService/queryServiceSdk.ts
 const DEFAULT_WAIT_FOR_JOB_INTERVAL = 500;
 const DEFAULT_MAX_WAIT_TIME = 3e5;

package/dist/sdk/semanticLayer/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_semanticLayer = require("../../semanticLayer-9uTaU7UT.cjs");
+const require_semanticLayer = require("../../semanticLayer-CKDVkU56.cjs");
 exports.CONSTRAINT_SCOPES = require_semanticLayer.CONSTRAINT_SCOPES;
 exports.CONSTRAINT_SEVERITIES = require_semanticLayer.CONSTRAINT_SEVERITIES;
 exports.CONSTRAINT_TYPES = require_semanticLayer.CONSTRAINT_TYPES;