@keboola/api-client 39.0.0 → 41.0.0

package/dist/{types-Jw10xuOW.d.cts → types-BIECJYun.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-V7XKUQm9.cjs";
+import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-BgR5zcjJ.js";
 //#region src/clients/auth/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -492,7 +492,7 @@ type paths = {
     put?: never;
     /**
      * Refresh access token
-     * @description Exchanges a refresh token for a new access and refresh token pair. Implements two-phase rotation with replay detection.
+     * @description Exchanges a refresh token (API mode) or a session cookie (browser mode) for a new access token. Implements two-phase rotation with replay detection. Browser mode is opted into with the X-KBC-CSRF header and requires no Authorization header; sending one rejects the request.
      */
     post: operations['post_/v1/auth/token/refresh'];
     delete?: never;
@@ -661,6 +661,26 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/oauth/clients/validate': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Validate an MCP OAuth client
+     * @description Called by the MCP server before starting the OAuth flow, to check whether a client_id + redirect_uri pair is already registered (pre-registered or previously approved via the dynamic client-approval flow). A 404 tells the MCP server to route the user through /oauth/authorize with a pending_mcp_client payload instead. Unauthenticated by design - the caller has no Keboola identity yet - and read-only: it never registers or modifies a client.
+     */
+    post: operations['post_keboola_oauth_clientvalidationaction__invoke'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/admin/auth/pkce/authorize': {
     parameters: {
       query?: never;
@@ -711,6 +731,11 @@ type components = {
       password?: string | null;
       /** @description OIDC ID token issued by the identity provider. Required for google/microsoft grants. */
       idToken?: string | null;
+      /**
+       * @description Also mint a browser session cookie paired with the issued session, so server-rendered pages work for the same user. Requires an `Origin` header matching the stack app URL.
+       * @default false
+       */
+      browserMode: boolean;
     };
     DeviceAuthorizationCreateRequest: {
       /** @description Public CLI client identifier. */
@@ -826,6 +851,11 @@ type components = {
       requestHandle: string;
       /** @description Advisory customer slug; the handle is the authoritative config selector. */
       customerSlug?: string | null;
+      /**
+       * @description Also mint a browser session cookie paired with the issued session. Requires an `Origin` header matching the stack app URL.
+       * @default false
+       */
+      browserMode: boolean;
     };
     SamlInitiateRequest: {
       /** @description Customer slug of the multi-tenant SAML configuration. Omit for the stack-wide ENV configuration. */
@@ -844,8 +874,10 @@ type components = {
       password?: string | null;
     };
     TokenRefreshRequest: {
-      /** @description Refresh token to exchange for new token pair. */
+      /** @description API mode: refresh token to exchange for a new token pair. Mutually exclusive with sessionId — submit exactly one. */
       refreshToken: string;
+      /** @description Browser/cookie mode: session id from the login response. The refresh token itself lives in a server-side channel bound to the session cookie and is never submitted by the client. Mutually exclusive with refreshToken — submit exactly one. */
+      sessionId: string;
     };
     TokenRevokeRequest: {
       /** @description Token to revoke (access or refresh token). */
@@ -876,6 +908,18 @@ type components = {
        */
       revokeOtherSessions: boolean;
     };
+    ClientValidationRequest: {
+      /**
+       * @description The OAuth client identifier, as sent to /oauth/authorize.
+       * @example claude-ai
+       */
+      client_id: string;
+      /**
+       * @description The exact redirect URI to check. Matched verbatim, not by prefix or domain.
+       * @example https://claude.ai/api/mcp/auth_callback
+       */
+      redirect_uri: string;
+    };
     PkceAuthorizeQueryRequest: {
       /**
        * @description OAuth response type. Not enforced at the constraint level, but required to be "code" for the authorize flow to succeed.
@@ -934,6 +978,11 @@ type components = {
        * @default null
        */
       idToken: string | null;
+      /**
+       * @description Also mint a browser session cookie paired with the issued session, so server-rendered pages work for the same user. Requires an `Origin` header matching the stack app URL.
+       * @default false
+       */
+      browserMode: boolean;
     };
     UserLoggedInResponse: {
       id: number;
@@ -943,11 +992,11 @@ type components = {
     LoginResponse: {
       /** @description Opaque bearer access token for API authentication (format: kbc_at_{sessionId}_{secret}). */
       accessToken: string;
-      /** @description Refresh token for obtaining new access tokens. */
-      refreshToken: string;
+      /** @description Refresh token for obtaining new access tokens. Absent in browser mode, where the refresh token lives in a server-side cookie-bound channel instead. */
+      refreshToken?: string | null;
       /** @description Token type. Always "Bearer". */
       tokenType: string;
-      /** @description Access token lifetime in seconds. */
+      /** @description Remaining access token lifetime in seconds. */
       expiresIn: number;
       /** @description Unique session identifier. */
       sessionId: string;
@@ -1230,6 +1279,11 @@ type components = {
        * @default null
        */
       customerSlug: string | null;
+      /**
+       * @description Also mint a browser session cookie paired with the issued session. Requires an `Origin` header matching the stack app URL.
+       * @default false
+       */
+      browserMode: boolean;
     };
     SamlInitiateRequest2: {
       /**
@@ -1521,7 +1575,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Login rejected: no matching active account, identity provider tenant mismatch, SSO-enforced account, super-admin MFA required, or organization MFA required. */
+      /** @description Login rejected: no matching active account, identity provider tenant mismatch, SSO-enforced account, super-admin MFA required, organization MFA required, or a browser-mode login from a non-allowlisted origin. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1557,7 +1611,7 @@ interface operations {
       };
     };
     responses: {
-      /** @description Device authorization resolved. */
+      /** @description Bearer mode only: device authorization resolved. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -1566,7 +1620,7 @@ interface operations {
           'application/json': components['schemas']['DeviceAuthorizationApprovalResult'];
         };
       };
-      /** @description Browser/cookie mode only: the submitted project selection was empty or named a project the admin cannot reach, so the browser is sent back to the approval page with an error code. Bearer mode answers 400/403 instead. */
+      /** @description Browser/cookie mode only. A resolved authorization sends the browser back to the approval page, which renders the approved or denied confirmation. A project selection that was empty or named a project the admin cannot reach is sent back the same way, with an error code. Bearer mode answers 200 and 400/403 instead. */
       302: {
         headers: {
           [name: string]: unknown;
@@ -1827,9 +1881,11 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
+          'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -1914,6 +1970,13 @@ interface operations {
         };
         content?: never;
       };
+      /** @description The challenge completes a browser-mode login but the request does not come from an allowlisted origin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Rate limit exceeded for MFA verification attempts. */
       429: {
         headers: {
@@ -2129,9 +2192,11 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. */
+      /** @description Sudo step-up failed, or the requested scope exceeds the admin's project access. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry; `auth.pat.insufficientProjectAccess` is unrelated to step-up and means the admin lacks access to a project named in the requested scope. */
       403: {
         headers: {
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
+          'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -2237,9 +2302,11 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo step-up required for cross-admin revocation by a super admin. */
+      /** @description Sudo step-up failed for cross-admin revocation by a super admin. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
+          'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -2318,10 +2385,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Either the sudo window is not active (call POST /v1/auth/sudo first), or the admin has no MFA configured. */
+      /** @description Sudo step-up failed, or the admin has no MFA configured. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry; `auth.sudo.mfaNotConfigured` means the sudo window is satisfied but the admin has no MFA method enrolled, so there are no recovery codes to regenerate. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2372,7 +2439,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Asserted email domain not permitted, or the assertion lacks the required login role. */
+      /** @description Asserted email domain not permitted, the assertion lacks the required login role, or a browser-mode login came from a non-allowlisted origin. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -2474,10 +2541,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge. */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2511,10 +2578,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Returned when a super admin attempts to revoke another admin's session without an active sudo window. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed for a super admin revoking another admin's session. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge. */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2645,7 +2712,10 @@ interface operations {
   'post_/v1/auth/token/refresh': {
     parameters: {
       query?: never;
-      header?: never;
+      header?: {
+        /** @description Required for browser/cookie mode; must be "1". Absent for API mode. */
+        'X-KBC-CSRF'?: '1';
+      };
       path?: never;
       cookie?: never;
     };
@@ -2655,7 +2725,7 @@ interface operations {
       };
     };
     responses: {
-      /** @description Token refresh successful. Returns new access and refresh tokens. */
+      /** @description Token refresh successful. Returns a new access token (and a new refresh token in API mode). */
       200: {
         headers: {
           [name: string]: unknown;
@@ -2664,13 +2734,27 @@ interface operations {
           'application/json': components['schemas']['LoginResponse'];
         };
       };
-      /** @description Invalid, expired, or revoked refresh token. */
+      /** @description Invalid, expired, or revoked refresh token or session. A cookie-authenticated request (sent with the `X-KBC-CSRF` header) that fails the CSRF/Origin/session checks instead returns `{"error":"invalid_session","message":"Authentication failed.","exceptionId":"<id>"}` — every rejection reason for that path collapses to this identical payload, and `exceptionId` is a per-occurrence correlation id, not a differentiator of the reason. */
       401: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
+      /** @description Browser mode: the request does not come from an allowlisted origin. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Per-IP rate limit on failed refresh attempts exceeded. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Refresh rotation temporarily failed because of database contention. Retry-After indicates when to retry. */
       503: {
         headers: {
@@ -2738,10 +2822,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2781,10 +2865,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2835,10 +2919,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2889,10 +2973,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge. */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -2980,10 +3064,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -3030,10 +3114,10 @@ interface operations {
         };
         content?: never;
       };
-      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      /** @description Sudo step-up failed. `auth.sudo.required` (WWW-Authenticate challenge present) means call POST /v1/auth/sudo and retry; `auth.sudo.notPossible` (no challenge) means this principal can never complete sudo — do not retry. */
       403: {
         headers: {
-          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          /** @description RFC 9470 step-up challenge — present only for the retryable `auth.sudo.required` case; absent for the terminal `auth.sudo.notPossible` case. */
           'WWW-Authenticate'?: string;
           [name: string]: unknown;
         };
@@ -3055,6 +3139,49 @@ interface operations {
       };
     };
   };
+  post_keboola_oauth_clientvalidationaction__invoke: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ClientValidationRequest'];
+      };
+    };
+    responses: {
+      /** @description The client_id + redirect_uri pair is registered. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Malformed body, or a missing/empty client_id or redirect_uri. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description No active client with this client_id is registered, or its redirect_uri does not match. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Rate limit exceeded. Retry after the period given by the Retry-After header. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   get_auth_pkce_authorize: {
     parameters: {
       query?: {
@@ -3136,6 +3263,7 @@ type LoginBody = OpenapiBodyType<paths['/v1/auth/login']['post']>;
 //#endregion
 //#region src/clients/auth/mfa/types.d.ts
 type VerifyMfaBody = OpenapiBodyType<paths['/v1/auth/mfa']['post']>;
+type VerifyMfaType = OpenapiBodyType<paths['/v1/auth/mfa']['post']>['type'];
 type VerifyMfaResult = OpenapiReturnType<paths['/v1/auth/mfa']['post']>;
 type RegenerateRecoveryCodesResult = OpenapiReturnType<paths['/v1/auth/mfa/recovery-codes']['post']>;
 type TotpSetupResult = OpenapiReturnType<paths['/v1/auth/mfa/totp']['post']>;
@@ -3198,14 +3326,11 @@ type RevokeSessionPath = OpenapiPathType<paths['/v1/auth/sessions/{sessionId}'][
 /** The generated request body — what the typed client demands, not what the endpoint accepts. */
 type SudoBodyRaw = OpenapiBodyType<paths['/v1/auth/sudo']['post']>;
 /**
- * The endpoint's request body is generated as `SudoRequest2`, which is **not** the input contract:
- * the `*Request2` schemas are built from the PHP request object's readable properties, so they pick
- * up getter-only artefacts (`type` here, `requestedCredentialType` on
- * `DeviceAuthorizationCreateRequest2`) and mark every field required. The `#[OA\Schema]`-declared
- * `SudoRequest` is the accepted shape: five optional factor fields, exactly one of them populated —
- * the server infers the factor from which one is present. Its validator is an `Assert\Collection`
- * with `allowExtraFields: false` and a per-field `Optional([NotBlank])`, so an unknown key like
- * `type` and a present-but-null field are both rejected with a 400.
+ * The accepted sudo body — the generated `SudoRequest2` is not the input contract.
+ *
+ * - `*Request2` schemas include getter-only artefacts (`type`) and mark every field required.
+ * - Exactly one of the optional factor fields is set; the server infers the factor from it.
+ * - An unknown key (e.g. `type`) or a present-but-null field is rejected with a 400.
  */
 type SudoBody = components['schemas']['SudoRequest'];
 type SudoResult = OpenapiReturnType<paths['/v1/auth/sudo']['post']>;
@@ -3213,7 +3338,9 @@ type SudoChallengeResult = OpenapiReturnType<paths['/v1/auth/sudo/challenge']['p
 //#endregion
 //#region src/clients/auth/token/types.d.ts
 type IntrospectTokenResult = OpenapiReturnType<paths['/v1/auth/token/introspect']['get']>;
+type RefreshTokenBody = OpenapiBodyType<paths['/v1/auth/token/refresh']['post']>;
 type RefreshTokenResult = OpenapiReturnType<paths['/v1/auth/token/refresh']['post']>;
+type RefreshTokenPartialBody = Partial<RefreshTokenBody>;
 type RevokeTokenBody = OpenapiBodyType<paths['/v1/auth/token/revoke']['post']>;
 //#endregion
 //#region src/clients/auth/webauthn/types.d.ts
@@ -3237,5 +3364,5 @@ type RemoveWebauthnPath = OpenapiPathType<paths['/v1/auth/webauthn/{id}']['delet
 type RemoveWebauthnQuery = NonNullable<OpenapiQueryType<paths['/v1/auth/webauthn/{id}']['delete']>>;
 type RemoveWebauthnInput = RemoveWebauthnPath & RemoveWebauthnQuery;
 //#endregion
-export { DisableTotpPath as A, CreateDeviceAuthorizationResult as B, CreatePatInput as C, ListPatsResult as D, ExchangePatInput as E, VerifyMfaResult as F, GetDeviceAuthorizationTokenResult as H, LoginBody as I, ApproveDeviceAuthorizationBody as L, TotpSetupResult as M, TotpVerifyResult as N, PatScopeInput as O, VerifyMfaBody as P, ApproveDeviceAuthorizationResult as R, CreatePatBodyRaw as S, ExchangePatBodyRaw as T, components as U, GetDeviceAuthorizationTokenBody as V, paths as W, AssertSamlResult as _, RemoveWebauthnInput as a, GetPkceTokenBody as b, IntrospectTokenResult as c, SudoBody as d, SudoBodyRaw as f, AssertSamlBody as g, RevokeSessionPath as h, RegisterWebauthnResult as i, RegenerateRecoveryCodesResult as j, RevokePatPath as k, RefreshTokenResult as l, SudoResult as m, RegisterWebauthnInput as n, RemoveWebauthnPath as o, SudoChallengeResult as p, RegisterWebauthnOptionsResult as r, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, RevokeTokenBody as u, InitiateSamlBody as v, CreatePatResult as w, GetPkceTokenResult as x, InitiateSamlResult as y, CreateDeviceAuthorizationBody as z };
-//# sourceMappingURL=types-Jw10xuOW.d.cts.map
+export { PatScopeInput as A, ApproveDeviceAuthorizationBody as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, GetDeviceAuthorizationTokenResult as G, CreateDeviceAuthorizationBody as H, VerifyMfaBody as I, components as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, CreateDeviceAuthorizationResult as U, ApproveDeviceAuthorizationResult as V, GetDeviceAuthorizationTokenBody as W, RevokeSessionPath as _, RemoveWebauthnInput as a, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, RemoveWebauthnPath as o, SudoBody as p, paths as q, RegisterWebauthnOptionsResult as r, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, LoginBody as z };
+//# sourceMappingURL=types-BIECJYun.d.ts.map

package/dist/{types-DZk3XHiN.d.cts → types-BLNB882w.d.cts}

@@ -1,5 +1,5 @@
-import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-V7XKUQm9.cjs";
-import "./appLogs-D5A13Y0y.cjs";
+import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-BVhHt5lx.cjs";
+import "./appLogs-C9YlJ2g8.cjs";
 //#region src/clients/dataScience/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -2159,4 +2159,4 @@ type PatchDataAppBodyStopped = {
 type PatchDataAppBody = PatchDataAppBodyRunning | PatchDataAppBodyStopped;
 //#endregion
 export { Sandbox as S, PatchDataAppPath as _, DeleteSandboxPath as a, Runtime as b, GetDataAppLogsTailPath as c, GetDataAppPath as d, GetDataAppRunPath as f, PatchDataAppBody as g, GetSandboxPath as h, DeleteDataAppPath as i, GetDataAppLogsTailQuery as l, GetDataAppRunsQuery as m, DataApp as n, GetAppsQuery as o, GetDataAppRunsPath as p, DataAppRun as r, GetDataAppLogsDownloadPath as s, CreateDataAppBody as t, GetDataAppPasswordPath as u, RawAppRun as v, RuntimeImageKey as x, ResetDataAppPasswordPath as y };
-//# sourceMappingURL=types-DZk3XHiN.d.cts.map
+//# sourceMappingURL=types-BLNB882w.d.cts.map

package/dist/{types-BEe50G2r.d.cts → types-BPy5Ozee.d.cts}

@@ -1,4 +1,4 @@
-import { i as OpenapiFormDataType } from "./index-V7XKUQm9.cjs";
+import { i as OpenapiFormDataType } from "./index-BVhHt5lx.cjs";
 //#region src/clients/import/__generated__/schema.d.ts
 /**
  * This file was auto-generated by openapi-typescript.
@@ -460,4 +460,4 @@ type WriteTableInput = Omit<WriteTableFormData, 'data'> & {
 };
 //#endregion
 export { WriteTableInput as n, UploadFileInput as t };
-//# sourceMappingURL=types-BEe50G2r.d.cts.map
+//# sourceMappingURL=types-BPy5Ozee.d.cts.map

package/dist/{types-gi4Eay19.d.ts → types-BS4jwuMi.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-KuQ79Mnz.js";
+import { c as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiQueryType } from "./index-BgR5zcjJ.js";
 import { t as AdminRole } from "./adminRoles-C696kD_U.js";
 import { t as Backend } from "./backends-DKBz5OxE.js";
 //#region src/clients/storage/__generated__/schema.d.ts
@@ -33507,10 +33507,9 @@ type StorageTokenAdminOwner = {
 /** The verify payload as the spec declares it — `StorageToken` is the corrected shape. */
 type StorageTokenRaw = OpenapiReturnType<paths['/v2/storage/tokens/verify']['get']>;
 /**
- * Derived from `StorageTokenRaw`, overriding only the fields the spec models badly. Everything not
- * listed in the `Omit` tracks the schema, so a new flag added by the backend arrives with
- * `pnpm gen:types` instead of being transcribed by hand. Each override below names the spec bug it
- * works around — if one of them is ever fixed upstream, delete the override.
+ * `StorageTokenRaw` with only the fields the spec models badly overridden.
+ *
+ * - Delete an override once the spec is fixed upstream.
  */
 type StorageToken = Omit<StorageTokenRaw, 'token' | 'owner' | 'organization' | 'admin' | 'adminOwner' | 'componentAccess'> & {
   token?: string;
@@ -33523,19 +33522,12 @@ type StorageToken = Omit<StorageTokenRaw, 'token' | 'owner' | 'organization' | '
   adminOwner: StorageTokenAdminOwner;
   componentAccess?: string[];
 };
-/**
- * Spec: `bucketPermissions: string[]`. The API takes a map of bucket id to permission, which is what
- * kbc-ui's own token form has always sent (`tokenEditor/BucketsSelector` builds a Map, and the New
- * Token page submits it through `toJS()`), and what a live create accepts. Typing it as the spec
- * claims forces every caller into a cast, so correct it here instead — same as the two fields above.
- */
+/** Bucket id to permission — what the API takes, though the spec says `string[]`. */
 type BucketPermissions = Record<string, 'read' | 'write'>;
 /**
  * The full create body, every field optional because the API defaults each one.
  *
- * - `CreateTokenSchemaBody` is a union: the full request plus a limited arm carrying only
- *   `description` and `expiresIn`, which this one already covers.
- * - Picked by a field only the full arm declares, so the arm stays spec-derived.
+ * - Extracts the full arm of `CreateTokenSchemaBody`; the limited arm is a subset of it.
  */
 type CreateTokenBody = Omit<Partial<Extract<CreateTokenSchemaBody, {
   canManageBuckets: boolean;
@@ -33555,4 +33547,4 @@ type ShareTokenInput = {
 } & ShareTokenBody;
 //#endregion
 export { ProjectId as a, ShareTokenSchemaBody as c, TokenListItem as d, UpdateTokenBody as f, paths as g, components as h, GetTokenEventsInput as i, StorageToken as l, UpdateTokenSchemaBody as m, CreateTokenResponse as n, ShareTokenBody as o, UpdateTokenInput as p, CreateTokenSchemaBody as r, ShareTokenInput as s, CreateTokenBody as t, StorageTokenRaw as u };
-//# sourceMappingURL=types-gi4Eay19.d.ts.map
+//# sourceMappingURL=types-BS4jwuMi.d.ts.map