@keboola/api-client 40.0.0 → 42.0.0

package/dist/{types-FwRmjsNN.d.ts → types-CigD_EF5.d.ts}

@@ -1,8 +1,8 @@
-import { i as CreateMetaObjectInput } from "./types-B_iLJlp4.js";
-import { n as createMetastoreClient } from "./index-BDZvaRud.js";
+import { i as CreateMetaObjectInput } from "./types-CwZgZqrA.js";
+import { n as createMetastoreClient } from "./index-B72LTF-k.js";
 //#region src/sdks/semanticLayer/vocabulary.d.ts
 /**
- * The closed value sets the metastore accepts inside a semantic object's `data`.
+ * The closed value sets the metastore accepts on a semantic object.
  *
  * - The single runtime source for the unions `./types` derives from these arrays.
  * - Imports nothing: `./types` reads it, never the reverse.
@@ -22,6 +22,8 @@ declare const CONSTRAINT_SEVERITIES: readonly ['error', 'warning', 'info'];
 declare const CONSTRAINT_SCOPES: readonly ['global', 'per_location', 'per_date', 'per_category'];
 declare const RULE_OPERATORS: readonly ['<', '<=', '=', '>=', '>', '!=', 'between', 'in', 'sum_equals', 'ratio_between'];
 declare const RELATIONSHIP_JOIN_TYPES: readonly ['left', 'inner'];
+/** Who can read an object, narrowest first; an envelope `meta` field, not part of `data`. */
+declare const SEMANTIC_OBJECT_SCOPES: readonly ['project', 'targeted', 'organization'];
 //#endregion
 //#region src/sdks/semanticLayer/types.d.ts
 type MetastoreClient = ReturnType<typeof createMetastoreClient>;
@@ -133,16 +135,24 @@ type SemanticChildObjectDataMap = {
 };
 type SemanticChildObjectType = keyof SemanticChildObjectDataMap;
 type SemanticObjectType = SemanticChildObjectType | 'semantic-model';
+type SemanticObjectScope = (typeof SEMANTIC_OBJECT_SCOPES)[number];
 type SemanticObjectMeta = {
   name?: string;
   branch?: string;
-  projectId?: number;
+  projectId?: number | null;
   organizationId?: string;
   revision?: number;
   schemaVersion?: string;
   createdAt?: string;
   lastUpdated?: string;
   revisionCreatedAt?: string;
+  scope?: SemanticObjectScope;
+  sourceProjectId?: number;
+  /** The projects a `targeted` object is shared with, read-only. */
+  targetProjectIds?: number[];
+  /** Set while a `project`-scope object awaits an org-admin decision. Cleared by promoting
+   *  (PATCH `{scope:"organization"}`) or withdrawing the request. */
+  scopeElevationRequestedAt?: string;
 };
 /**
  * Normalized metastore object as returned by this SDK. Matches the live metastore
@@ -171,6 +181,8 @@ type SemanticModelChildRef = {
   objectType: SemanticChildObjectType;
   objectUUID: string;
   name: string | undefined;
+  /** What sibling objects point at it by: a dataset's `tableId`, a metric's `name`; else absent. */
+  referenceKey?: string;
 };
 /**
  * An object a read could not parse, as far as the raw envelope can be trusted to say.
@@ -190,5 +202,5 @@ type SemanticModelChildDeleteFailure = SemanticModelChildRef & {
   error: unknown;
 };
 //#endregion
-export { CONSTRAINT_TYPES as A, SemanticRuleExpression as C, UpdateSemanticObjectMeta as D, SemanticValidationQuery as E, RELATIONSHIP_JOIN_TYPES as M, RULE_OPERATORS as N, CONSTRAINT_SCOPES as O, SQL_DIALECTS as P, SemanticRelationshipJoinType as S, SemanticUnreadableObjectRef as T, SemanticModelData as _, SemanticChildObjectType as a, SemanticObjectType as b, SemanticConstraintSeverity as c, SemanticFieldData as d, SemanticFieldRole as f, SemanticModelChildRef as g, SemanticModelChildDeleteFailure as h, SemanticChildObjectDataMap as i, FIELD_ROLES as j, CONSTRAINT_SEVERITIES as k, SemanticConstraintType as l, SemanticMetricData as m, MetastoreClient as n, SemanticConstraintData as o, SemanticGlossaryData as p, SemanticAiMetadata as r, SemanticConstraintScope as s, CreateSemanticObjectMeta as t, SemanticDatasetData as u, SemanticObject as v, SemanticRuleOperator as w, SemanticRelationshipData as x, SemanticObjectMeta as y };
-//# sourceMappingURL=types-FwRmjsNN.d.ts.map
+export { CONSTRAINT_SEVERITIES as A, SemanticRelationshipJoinType as C, SemanticValidationQuery as D, SemanticUnreadableObjectRef as E, SEMANTIC_OBJECT_SCOPES as F, SQL_DIALECTS as I, FIELD_ROLES as M, RELATIONSHIP_JOIN_TYPES as N, UpdateSemanticObjectMeta as O, RULE_OPERATORS as P, SemanticRelationshipData as S, SemanticRuleOperator as T, SemanticModelData as _, SemanticChildObjectType as a, SemanticObjectScope as b, SemanticConstraintSeverity as c, SemanticFieldData as d, SemanticFieldRole as f, SemanticModelChildRef as g, SemanticModelChildDeleteFailure as h, SemanticChildObjectDataMap as i, CONSTRAINT_TYPES as j, CONSTRAINT_SCOPES as k, SemanticConstraintType as l, SemanticMetricData as m, MetastoreClient as n, SemanticConstraintData as o, SemanticGlossaryData as p, SemanticAiMetadata as r, SemanticConstraintScope as s, CreateSemanticObjectMeta as t, SemanticDatasetData as u, SemanticObject as v, SemanticRuleExpression as w, SemanticObjectType as x, SemanticObjectMeta as y };
+//# sourceMappingURL=types-CigD_EF5.d.ts.map

package/dist/{types-B_iLJlp4.d.ts → types-CwZgZqrA.d.ts}

@@ -1663,7 +1663,12 @@ type components = {
 };
 //#endregion
 //#region src/clients/metastore/repository/types.d.ts
-type MetaObjectMeta = NonNullable<components['schemas']['handlers.JSONAPIMetaObjectResource']['meta']>;
+type MetaObjectScope = 'project' | 'organization' | 'targeted';
+type MetaObjectMeta = Omit<NonNullable<components['schemas']['handlers.JSONAPIMetaObjectResource']['meta']>, 'projectId' | 'scope'> & {
+  targetProjectIds?: number[];
+  projectId?: number | null;
+  scope?: MetaObjectScope;
+};
 type MetaObject<TData extends Record<string, unknown>, TDataOptional extends boolean = false> = {
   uuid: string;
   meta: MetaObjectMeta;
@@ -1675,14 +1680,30 @@ type MetaObject<TData extends Record<string, unknown>, TDataOptional extends boo
 type GetMetaObjectsPath = OpenapiPathType<paths['/api/v1/repository/{objectType}']['get']>;
 type GetMetaObjectsSchemaQuery = OpenapiQueryType<paths['/api/v1/repository/{objectType}']['get']>;
 type GetMetaObjectsQuery = GetMetaObjectsSchemaQuery & Record<string, string | number | boolean>;
+/**
+ * `GetMetaObjectsPath` plus the dynamic-filter `query` hybrid, plus the server-side filters this
+ * list endpoint supports beyond what the generated query type expresses (`limit`/`offset` only —
+ * swaggo can't declare a dynamic per-field query key in its annotations).
+ */
 type GetMetaObjectsInput = GetMetaObjectsPath & {
   query?: GetMetaObjectsQuery;
+  /** Every child object schema declares this `x-filterable: true` server-side. Passed as a real
+   * query filter instead of fetching the whole type's list and filtering client-side. */
+  modelUUID?: string;
+  /** Filters to project-scope objects with a pending request. Backs "my pending requests" for
+   * the requester, on the regular per-project list — the org-wide queue filters `/organization`. */
+  pendingElevationOnly?: boolean;
+  /** Opt-in: sorts `scope[order]=asc` (organization, targeted, project). Off by default —
+   * `getMetaObjects` backs every object-type SDK, not just semantic-layer's. */
+  sortByScope?: boolean;
 };
 type CreateMetaObjectPath = OpenapiPathType<paths['/api/v1/repository/{objectType}']['post']>;
 type CreateMetaObjectBody = OpenapiBodyType<paths['/api/v1/repository/{objectType}']['post']>;
 type CreateMetaObjectReturn = OpenapiReturnType<paths['/api/v1/repository/{objectType}']['post']>;
-type CreateMetaObjectInput<TData extends Record<string, unknown> = Record<string, unknown>> = CreateMetaObjectPath & Omit<CreateMetaObjectBody, 'data'> & {
+type CreateMetaObjectInput<TData extends Record<string, unknown> = Record<string, unknown>> = CreateMetaObjectPath & Omit<CreateMetaObjectBody, 'data' | 'scope'> & {
   data: TData;
+  scope?: MetaObjectScope;
+  dropSourceProject?: boolean;
 };
 type GetMetaObjectPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/{UUID}']['get']>;
 type DeleteMetaObjectPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/{UUID}']['delete']>;
@@ -1703,9 +1724,10 @@ type UpdateMetaObjectContentPatch<TData extends Record<string, unknown>> = {
   scope?: never;
 };
 type UpdateMetaObjectScopeStepUp = {
-  scope: NonNullable<UpdateMetaObjectBody['scope']>;
+  scope: 'organization';
   data?: never;
   name?: never;
+  dropSourceProject?: boolean;
 };
 /**
  * A PATCH is exactly one of two operations, and the metastore enforces the split server-side: a
@@ -1719,6 +1741,10 @@ type UpdateMetaObjectInput<TData extends Record<string, unknown> = Record<string
 type ReplaceTargetProjectsPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/{UUID}/target-projects']['put']>;
 type ReplaceTargetProjectsBody = OpenapiBodyType<paths['/api/v1/repository/{objectType}/{UUID}/target-projects']['put']>;
 type ReplaceTargetProjectsInput = ReplaceTargetProjectsPath & ReplaceTargetProjectsBody;
+type ScopeElevationRequestPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/{UUID}/scope-elevation-request']['put']>;
+type GetOrganizationMetaObjectsPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/organization']['get']>;
+type GetOrganizationMetaObjectsSchemaQuery = OpenapiQueryType<paths['/api/v1/repository/{objectType}/organization']['get']>;
+type GetOrganizationMetaObjectsQuery = GetOrganizationMetaObjectsSchemaQuery & Record<string, string | number | boolean>;
 type ReplaceMetaObjectPath = OpenapiPathType<paths['/api/v1/repository/{objectType}/{UUID}']['put']>;
 type ReplaceMetaObjectBody = OpenapiBodyType<paths['/api/v1/repository/{objectType}/{UUID}']['put']>;
 type ReplaceMetaObjectInput<TData extends Record<string, unknown> = Record<string, unknown>> = ReplaceMetaObjectPath & Omit<ReplaceMetaObjectBody, 'data'> & {
@@ -1749,5 +1775,5 @@ type MetaStoreListResponse<TData extends Record<string, unknown>> = {
 type GetSchemaPath = OpenapiPathType<paths['/api/v1/schema/{objectType}']['get']>;
 type GetVersionedSchemaPath = OpenapiPathType<paths['/api/v1/schema/{objectType}/{version}']['get']>;
 //#endregion
-export { UpdateMetaObjectBody as A, RawMetaObject as C, ReplaceTargetProjectsBody as D, ReplaceMetaObjectPath as E, UpdateMetaObjectPath as M, components as N, ReplaceTargetProjectsInput as O, paths as P, MetaStoreObjectResponse as S, ReplaceMetaObjectInput as T, GetMetaObjectsQuery as _, CreateMetaObjectPath as a, MetaObjectMeta as b, DeleteMetaObjectRevisionPath as c, GetMetaObjectRevisionsInput as d, GetMetaObjectRevisionsPath as f, GetMetaObjectsPath as g, GetMetaObjectsInput as h, CreateMetaObjectInput as i, UpdateMetaObjectInput as j, ReplaceTargetProjectsPath as k, GetMetaObjectPath as l, GetMetaObjectRevisionsSchemaQuery as m, GetVersionedSchemaPath as n, CreateMetaObjectReturn as o, GetMetaObjectRevisionsQuery as p, CreateMetaObjectBody as r, DeleteMetaObjectPath as s, GetSchemaPath as t, GetMetaObjectRevisionPath as u, GetMetaObjectsSchemaQuery as v, ReplaceMetaObjectBody as w, MetaStoreListResponse as x, MetaObject as y };
-//# sourceMappingURL=types-B_iLJlp4.d.ts.map
+export { ReplaceMetaObjectPath as A, MetaObjectMeta as C, RawMetaObject as D, MetaStoreObjectResponse as E, UpdateMetaObjectBody as F, UpdateMetaObjectInput as I, UpdateMetaObjectPath as L, ReplaceTargetProjectsInput as M, ReplaceTargetProjectsPath as N, ReplaceMetaObjectBody as O, ScopeElevationRequestPath as P, components as R, MetaObject as S, MetaStoreListResponse as T, GetMetaObjectsQuery as _, CreateMetaObjectPath as a, GetOrganizationMetaObjectsQuery as b, DeleteMetaObjectRevisionPath as c, GetMetaObjectRevisionsInput as d, GetMetaObjectRevisionsPath as f, GetMetaObjectsPath as g, GetMetaObjectsInput as h, CreateMetaObjectInput as i, ReplaceTargetProjectsBody as j, ReplaceMetaObjectInput as k, GetMetaObjectPath as l, GetMetaObjectRevisionsSchemaQuery as m, GetVersionedSchemaPath as n, CreateMetaObjectReturn as o, GetMetaObjectRevisionsQuery as p, CreateMetaObjectBody as r, DeleteMetaObjectPath as s, GetSchemaPath as t, GetMetaObjectRevisionPath as u, GetMetaObjectsSchemaQuery as v, MetaObjectScope as w, GetOrganizationMetaObjectsSchemaQuery as x, GetOrganizationMetaObjectsPath as y, paths as z };
+//# sourceMappingURL=types-CwZgZqrA.d.ts.map

package/dist/{types-BTK7Bv3n.d.cts → types-DgPt4LY_.d.cts}

@@ -145,7 +145,7 @@ type paths = {
     post?: never;
     /**
      * Delete a Manage API token
-     * @description Deletes a Manage API token (or session token) owned by the calling admin. Sudo is not required — deleting your own credential only reduces access. A token that does not exist or belongs to another user returns 404. Not idempotent: the row is hard-deleted, so a repeated call returns 404.
+     * @description Deletes a Manage API token (or session token) owned by the calling admin. Sudo is not required — deleting your own credential only reduces access. A token that does not exist or belongs to another user returns 404. Not idempotent: the row is hard-deleted, so a repeated call returns 404. Deleting a session token also revokes the session's Manage API access for good — the session itself stays usable for Storage, but no refresh will mint a replacement token.
      */
     delete: operations['delete_auth_manage_token_delete'];
     options?: never;
@@ -153,6 +153,86 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/me': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get the caller's identity and a preview of their organizations, maintainers and projects
+     * @description Returns the caller's user, and for organizations, maintainers and projects a total count and a preview of the first items. Page through the full lists with the /me/organizations, /me/maintainers and /me/projects endpoints.
+     */
+    get: operations['get_/v1/auth/me'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/me/maintainers': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the caller's maintainers
+     * @description Returns one page of the maintainers the caller belongs to. For a project-restricted session only the maintainers of its reachable organizations appear.
+     */
+    get: operations['get_/v1/auth/me/maintainers'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/me/organizations': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the caller's organizations
+     * @description Returns one page of the organizations the caller can reach, with the number of projects they can open in each.
+     */
+    get: operations['get_/v1/auth/me/organizations'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/me/projects': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the caller's projects
+     * @description Returns one page of the projects the caller can open, each with the id of its organization.
+     */
+    get: operations['get_/v1/auth/me/projects'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/v1/auth/mfa': {
     parameters: {
       query?: never;
@@ -915,7 +995,7 @@ type components = {
        */
       client_id: string;
       /**
-       * @description The exact redirect URI to check. Matched verbatim, not by prefix or domain.
+       * @description The exact redirect URI to check. Matched verbatim, not by prefix or domain -- except the port on an http://127.0.0.1 or http://[::1] loopback URI, which is ignored (RFC 8252 §7.3, see LoopbackRedirectUri).
        * @example https://claude.ai/api/mcp/auth_callback
        */
       redirect_uri: string;
@@ -1166,6 +1246,92 @@ type components = {
       token: string;
       manageToken: components['schemas']['ManageTokenItemResponse'];
     };
+    MeUser: {
+      /** @description Admin id. */
+      id: number;
+      /** @description Admin name. */
+      name: string;
+      /** @description Admin email address. */
+      email: string;
+      /** @description Whether the admin is a super admin. */
+      isSuperAdmin: boolean;
+      /** @description Whether the admin has multi-factor authentication enabled. */
+      hasMfaEnabled: boolean;
+      /** @description Feature flags assigned to the admin, sorted alphabetically without duplicates. */
+      features: string[];
+    };
+    OrganizationMaintainerReference: {
+      id: number;
+      name: string | null;
+    };
+    OrganizationAccessItem: {
+      /** @description Organization id. */
+      id: number;
+      /** @description Organization name. */
+      name: string;
+      /** @description Whether the organization enforces MFA for its admins. */
+      mfaRequired: boolean;
+      maintainer: components['schemas']['OrganizationMaintainerReference'];
+      /** @description Whether the caller administers this organization. */
+      isAdmin: boolean;
+      /** @description Whether the caller reaches this organization at all: super admin, an admin of its maintainer, or an organization admin. */
+      hasAccess: boolean;
+      /** @description Whether the caller can leave this organization (has access, and at least one other administrator remains). Meaningful together with "isAdmin": a maintainer member reaching the organization only through "hasAccess" can report canLeave=true despite isAdmin=false, since they hold no membership row to leave in the first place. */
+      canLeave: boolean;
+      /** @description Number of projects inside this organization the caller can open (live access set). */
+      projectsCount: number;
+    };
+    OrganizationProjectItem: {
+      /** @description Project id. */
+      id: number;
+      /** @description Project name. */
+      name: string;
+      /** @description Id of the organization the project belongs to. */
+      organizationId: number;
+      /** @description The caller's role in this project, or null when no active membership row backs the access. */
+      role: string | null;
+      /** @description Whether the project is disabled. */
+      isDisabled: boolean;
+      /** @description Reason the project is disabled, or null when it is not disabled or no reason was recorded. */
+      disabledReason: string | null;
+    };
+    MeResponse: {
+      user: components['schemas']['MeUser'];
+      organizations: {
+        /** @description Organizations the caller can reach. */
+        count: number;
+        /** @description The first organizations by name. */
+        preview: components['schemas']['OrganizationAccessItem'][];
+        /** @description Whether more organizations exist than the preview carries. */
+        hasMore: boolean;
+      };
+      maintainers: {
+        /** @description Maintainers the caller is a member of. */
+        count: number;
+        /** @description The first maintainers by name. */
+        preview: components['schemas']['OrganizationMaintainerReference'][];
+        /** @description Whether more maintainers exist than the preview carries. */
+        hasMore: boolean;
+      };
+      projects: {
+        /** @description Projects the caller can open. */
+        count: number;
+        /** @description The first projects by name. */
+        preview: components['schemas']['OrganizationProjectItem'][];
+        /** @description Whether more projects exist than the preview carries. */
+        hasMore: boolean;
+      };
+    };
+    MePageResponse: {
+      /** @description Size of the whole filtered collection. */
+      count: number;
+      /** @description The items of this page; each endpoint documents their shape. */
+      items: Record<string, never>[];
+      limit: number;
+      offset: number;
+      /** @description Whether items exist beyond this page. */
+      hasMore: boolean;
+    };
     MfaRequest2: {
       /** @description MFA challenge token from login response. */
       mfaToken: string;
@@ -1711,6 +1877,17 @@ interface operations {
           'application/json': components['schemas']['CliAuthErrorResponse'];
         };
       };
+      /** @description Transient contention with concurrent device authorization requests; retry after the Retry-After header. */
+      503: {
+        headers: {
+          /** @description Seconds to wait before retrying. */
+          'Retry-After'?: number;
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['CliAuthErrorResponse'];
+        };
+      };
     };
   };
   post_auth_device_authorization_token: {
@@ -1941,6 +2118,218 @@ interface operations {
       };
     };
   };
+  'get_/v1/auth/me': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The caller's user, counts and previews. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['MeResponse'];
+        };
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/v1/auth/me/maintainers': {
+    parameters: {
+      query?: {
+        /** @description Page size, from 1 up to the configured maximum. Defaults to the configured default page size. */
+        limit?: number;
+        /** @description Number of items to skip. Defaults to 0. */
+        offset?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description A page of maintainers. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['MePageResponse'] & {
+            items?: components['schemas']['OrganizationMaintainerReference'][];
+          };
+        };
+      };
+      /** @description A paging parameter is not a single integer value, or is out of range. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/v1/auth/me/organizations': {
+    parameters: {
+      query?: {
+        /** @description Page size, from 1 up to the configured maximum. Defaults to the configured default page size. */
+        limit?: number;
+        /** @description Number of items to skip. Defaults to 0. */
+        offset?: number;
+        /** @description Keep only organizations of this maintainer. */
+        maintainerId?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description A page of organizations. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['MePageResponse'] & {
+            items?: components['schemas']['OrganizationAccessItem'][];
+          };
+        };
+      };
+      /** @description A paging or filter parameter is not a single integer value, or is out of range. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'get_/v1/auth/me/projects': {
+    parameters: {
+      query?: {
+        /** @description Page size, from 1 up to the configured maximum. Defaults to the configured default page size. */
+        limit?: number;
+        /** @description Number of items to skip. Defaults to 0. */
+        offset?: number;
+        /** @description Keep only projects of this organization. */
+        organizationId?: number;
+        /** @description Case-insensitive substring of the project name. Empty means no filter; longer than the configured maximum is rejected. */
+        q?: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description A page of projects. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['MePageResponse'] & {
+            items?: components['schemas']['OrganizationProjectItem'][];
+          };
+        };
+      };
+      /** @description A paging or filter parameter is not a single value of the right type, or is out of range or too long. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'post_/v1/auth/mfa': {
     parameters: {
       query?: never;
@@ -2625,7 +3014,7 @@ interface operations {
         };
         content?: never;
       };
-      /** @description MFA is not configured for this account (MFA factor supplied), password step-up attempted on an MFA-configured account, the account is a super admin without MFA on a stack with `super-admin-mfa-required` enabled, or the account has no MFA and holds a membership in an organization with `mfaRequired`. */
+      /** @description MFA is not configured for this account (MFA factor supplied), password step-up attempted on an MFA-configured account, password step-up attempted on an account that authenticates through an IdP (the error context then carries `ssoRecoveryUrl` when a tenant was named), the account is a super admin without MFA on a stack with `super-admin-mfa-required` enabled, or the account has no MFA and holds a membership in an organization with `mfaRequired`. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -2734,6 +3123,13 @@ interface operations {
           'application/json': components['schemas']['LoginResponse'];
         };
       };
+      /** @description The session's linked Manage API token was administratively disabled (`auth.manageToken.disabled`). The refresh is refused and the session is revoked, so subsequent refreshes answer 401. Bearer access to the Manage API cannot be recovered by refreshing; a new login is required. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Invalid, expired, or revoked refresh token or session. A cookie-authenticated request (sent with the `X-KBC-CSRF` header) that fails the CSRF/Origin/session checks instead returns `{"error":"invalid_session","message":"Authentication failed.","exceptionId":"<id>"}` — every rejection reason for that path collapses to this identical payload, and `exceptionId` is a per-occurrence correlation id, not a differentiator of the reason. */
       401: {
         headers: {
@@ -3261,6 +3657,11 @@ type GetDeviceAuthorizationTokenResult = OpenapiReturnType<paths['/v1/auth/devic
 //#region src/clients/auth/login/types.d.ts
 type LoginBody = OpenapiBodyType<paths['/v1/auth/login']['post']>;
 //#endregion
+//#region src/clients/auth/me/types.d.ts
+type GetMeOrganizationsQuery = OpenapiQueryType<paths['/v1/auth/me/organizations']['get']>;
+type GetMeMaintainersQuery = OpenapiQueryType<paths['/v1/auth/me/maintainers']['get']>;
+type GetMeProjectsQuery = OpenapiQueryType<paths['/v1/auth/me/projects']['get']>;
+//#endregion
 //#region src/clients/auth/mfa/types.d.ts
 type VerifyMfaBody = OpenapiBodyType<paths['/v1/auth/mfa']['post']>;
 type VerifyMfaType = OpenapiBodyType<paths['/v1/auth/mfa']['post']>['type'];
@@ -3364,5 +3765,5 @@ type RemoveWebauthnPath = OpenapiPathType<paths['/v1/auth/webauthn/{id}']['delet
 type RemoveWebauthnQuery = NonNullable<OpenapiQueryType<paths['/v1/auth/webauthn/{id}']['delete']>>;
 type RemoveWebauthnInput = RemoveWebauthnPath & RemoveWebauthnQuery;
 //#endregion
-export { PatScopeInput as A, ApproveDeviceAuthorizationBody as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, GetDeviceAuthorizationTokenResult as G, CreateDeviceAuthorizationBody as H, VerifyMfaBody as I, components as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, CreateDeviceAuthorizationResult as U, ApproveDeviceAuthorizationResult as V, GetDeviceAuthorizationTokenBody as W, RevokeSessionPath as _, RemoveWebauthnInput as a, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, RemoveWebauthnPath as o, SudoBody as p, paths as q, RegisterWebauthnOptionsResult as r, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, LoginBody as z };
-//# sourceMappingURL=types-BTK7Bv3n.d.cts.map
+export { PatScopeInput as A, GetMeOrganizationsQuery as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, CreateDeviceAuthorizationBody as G, LoginBody as H, VerifyMfaBody as I, GetDeviceAuthorizationTokenResult as J, CreateDeviceAuthorizationResult as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, ApproveDeviceAuthorizationBody as U, GetMeProjectsQuery as V, ApproveDeviceAuthorizationResult as W, paths as X, components as Y, RevokeSessionPath as _, RemoveWebauthnInput as a, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, RemoveWebauthnPath as o, SudoBody as p, GetDeviceAuthorizationTokenBody as q, RegisterWebauthnOptionsResult as r, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, GetMeMaintainersQuery as z };
+//# sourceMappingURL=types-DgPt4LY_.d.cts.map