@keboola/api-client 44.0.0 → 46.0.0

package/dist/types-Btb8r9iw.d.ts

@@ -0,0 +1,1467 @@
+import { c as OpenapiReturnType, o as OpenapiPathType, r as OpenapiBodyType } from "./index-PyTPrtaL.js";
+//#region src/clients/oauth/__generated__/schema.d.ts
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+type paths = {
+  '/authorize/{componentId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Authorization init
+     * @description Call the endpoint to initiate the authorization process. It starts the authorization sessions and redirects
+     *     client to the OAuth provider.
+     */
+    post: operations['authorizeInit'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/authorize/{componentId}/callback': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Authorization callback
+     * @description The endpoint is called by OAuth provider after the authorization process is finished. It uses parameters passed
+     *     in query to retrieve the access token and stores the authorization. Finally it redirects the client back to the
+     *     return URL.
+     */
+    get: operations['authorizeCallback'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/credentials': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Credentials list
+     * @description Returns list of component credentials.
+     */
+    get: operations['credentialsList'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/credentials/{componentId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Component credentials list
+     * @description Returns list of component credentials.
+     */
+    get: operations['componentCredentialsList'];
+    put?: never;
+    /**
+     * Create credentials
+     * @description Call the endpoint to create new credentials for given component.
+     */
+    post: operations['componentCredentialsCreate'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/credentials/{componentId}/{name}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Credentials detail
+     * @description Returns the credentials detail.
+     */
+    get: operations['credentialsDetail'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete credentials
+     * @description Delete existing credentials.
+     */
+    delete: operations['credentialsDelete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/manage': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List consumers
+     * @description Returns list of all registered consumers.
+     */
+    get: operations['consumersList'];
+    put?: never;
+    /**
+     * Create consumer
+     * @description Register a new OAuth consumer (component).
+     */
+    post: operations['consumerCreate'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/manage/{componentId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Consumer detail
+     * @description Returns the consumer detail for given component.
+     */
+    get: operations['consumerDetail'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete consumer
+     * @description Delete an existing consumer.
+     */
+    delete: operations['consumerDelete'];
+    options?: never;
+    head?: never;
+    /**
+     * Update consumer
+     * @description Update an existing consumer. All fields are optional.
+     */
+    patch: operations['consumerUpdate'];
+    trace?: never;
+  };
+  '/platform-consumers': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Register a platform application
+     * @description Registers a platform-level external application, currently a GitHub App. Done once per
+     *     stack **and per GitHub deployment** by an operator. Requires the
+     *     `oauth:platform-consumers-manage` scope.
+     *
+     *     The private key and the client secret are stored encrypted and are never returned by any
+     *     endpoint.
+     *
+     *     **GitHub App prerequisites** (a human must do these in GitHub Developer Settings before the
+     *     registration is usable):
+     *
+     *     * Repository permissions: Contents → Read-only; Organization permissions: Members →
+     *       Read-only (the install callback needs it to confirm the installer owns the GitHub
+     *       organization).
+     *     * "Where can this GitHub App be installed?" → Any account.
+     *     * **"Request user authorization (OAuth) during installation" must be enabled**, and the
+     *       App's Callback URL set to this service's
+     *       `/platform-consumers/github-app/callback`. Without it GitHub sends no `code` with the
+     *       install redirect, the callback cannot prove the installer owns the installation they
+     *       returned with, and every connection attempt fails there.
+     *     * `clientId` / `clientSecret` come from the same App's page ("Client ID", "Generate a new
+     *       client secret") — they are not the App ID and private key.
+     *
+     *     `apiBaseUrl` / `webBaseUrl` default to the stack's `GITHUB_API_URL` / `GITHUB_WEB_URL`.
+     *     Register a GitHub Enterprise App by stating them: `https://api.acme.ghe.com` +
+     *     `https://acme.ghe.com` for GitHub Enterprise Cloud, or
+     *     `https://github.acme.internal/api/v3` + `https://github.acme.internal` for a self-hosted
+     *     GitHub Enterprise Server.
+     */
+    post: operations['platformConsumerCreate'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/platform-consumers/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Platform consumer detail */
+    get: operations['platformConsumerDetail'];
+    put?: never;
+    post?: never;
+    /**
+     * Delete a platform consumer
+     * @description Refused while any organization is still connected through this registration. There is no
+     *     force flag: cascading would silently disconnect every organization on the stack, and the
+     *     operator cannot tell from here whose connections those are.
+     */
+    delete: operations['platformConsumerDelete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/platform-consumers/github-app/callback': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * GitHub App install callback
+     * @description Invoked by GitHub, not by API consumers. This is the App's Callback URL, configured once on
+     *     the GitHub side and identical for every install, which is why it carries no organization
+     *     segment — the organization is recovered from the install session that `state` resolves to.
+     *
+     *     It is the only endpoint that records an installation, and it requires no Keboola credential.
+     *     Three things authorise it, all of them necessary:
+     *
+     *     1. `state` must match the `__Host-orgInstallSession` cookie set when the flow started (the
+     *        legacy `oauthSessionId` cookie is ignored here);
+     *     2. `state` must resolve to an unexpired install session;
+     *     3. the installing user must own the account the installation belongs to. GitHub, asked as
+     *        the App, says which account that is (`GET /app/installations/{id}`); asked with the
+     *        user-to-server token obtained from `code`, it says whether the installer is an active
+     *        owner of that organization (`GET /user/memberships/orgs/{login}` → `role: admin`,
+     *        `state: active`) or, for a personal account, that very user (`GET /user`). Being a
+     *        collaborator or an ordinary member is not enough.
+     *
+     *     Point 3 is why the App needs "Request user authorization (OAuth) during installation" and
+     *     the "Organization members: read" permission. Installation ids are small sequential
+     *     integers, so without that confirmation anyone able to start an install for an organization
+     *     they do administer could bind a stranger's installation and mint read tokens on that
+     *     stranger's private repositories.
+     *
+     *     When the installer is not a GitHub organization owner, GitHub returns
+     *     `setup_action=request` with no installation id: the installation is pending an owner's
+     *     approval and nothing is recorded.
+     *
+     *     An organization holds at most one connection per GitHub account and registration. When the
+     *     account is already connected under a *different* installation id — the App was
+     *     uninstalled and installed again — the stale connection is replaced by the new one.
+     *     Connecting the very same installation twice is a `409`.
+     */
+    get: operations['platformConsumerInstallCallback'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/authorize/organizations/{organizationId}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Connect a GitHub organization
+     * @description Starts the GitHub App install flow and redirects to GitHub.
+     *
+     *     Submitted by the browser as a form — a top-level navigation — exactly like
+     *     `POST /authorize/{componentId}`, with the caller's Storage API token in the `token` form
+     *     field, verified with Storage API by this service. The token may belong to any project the
+     *     caller can reach: it establishes only *who* the caller is. A token without an admin
+     *     (component or legacy token) is refused with `403`.
+     *
+     *     The organization is taken from the URL and the caller must be an administrator of it — `GET /manage/organizations/{id}/users` is
+     *     Connection's organization administrators listing, so appearing in it is the admin check.
+     *     Deriving the organization from the token instead would be unsafe — users belong to projects
+     *     across several organizations and the project-to-organization link is invisible in the UI.
+     *
+     *     The credentials row is created incomplete and only becomes usable once the install
+     *     callback records the installation. Starting again under the name of an incomplete row (an
+     *     abandoned tab, or an install that became an owner-approval request) replaces that row and
+     *     its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
+     *     already taken by a completed connection is a `409`.
+     *
+     *     The response sets the session cookie `__Host-orgInstallSession` (Secure, HttpOnly,
+     *     `Path=/`, no `Domain`, `SameSite=Lax`) and redirects to GitHub. The browser must be
+     *     able to send the cookie back to the callback, so the install has to be started as a
+     *     top-level navigation (a form POST cannot carry a token header, and `fetch()` fails on the
+     *     cross-origin redirect and does not store the cookie). There is no header-authenticated
+     *     variant: a non-browser client could not complete the install anyway.
+     *
+     *     Login-CSRF guard: the request must carry an `Origin` header exactly equal to an allowed
+     *     origin — `ORGANIZATION_INSTALL_ALLOWED_ORIGINS`, by default the stack's own UI
+     *     `https://connection.<HOSTNAME_SUFFIX>`. A missing, `null` or other origin is a `403`, with
+     *     nothing verified or written.
+     */
+    post: operations['organizationCredentialsInit'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/organizations/{organizationId}/credentials': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List connected GitHub organizations
+     * @description Lists the GitHub accounts this Keboola organization has connected. Connections whose
+     *     install never completed are omitted.
+     */
+    get: operations['organizationCredentialsList'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/organizations/{organizationId}/credentials/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Disconnect a GitHub organization
+     * @description Removes the connection on the Keboola side. The App stays installed on GitHub until an
+     *     owner removes it there.
+     */
+    delete: operations['organizationCredentialsDelete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/organization-credentials/token': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Mint a repository-scoped GitHub token
+     * @description Issues a short-lived GitHub token for a single repository, read-only, using the
+     *     organization's GitHub App installation. Requires the `oauth:mint` scope.
+     *
+     *     Application token only. A project Storage API token is present inside every data app
+     *     container, so accepting one here would let application code mint tokens for any
+     *     repository the installation covers.
+     *
+     *     Keyed by repository, not by credential ID: the caller supplies the organization and the
+     *     repository URL, and the owner is resolved to a connected installation here. A caller
+     *     therefore cannot name a credential, nor reach one belonging to another organization. The
+     *     repository URL's host also selects which GitHub App registration is used, so github.com and
+     *     a GitHub Enterprise host can both be served by one stack.
+     *
+     *     `projectId` must belong to `organizationId`; both come from the payload, so neither is
+     *     trusted alone.
+     *
+     *     The returned `#token` is encrypted for the supplied `projectId` and `componentId`; it is
+     *     never returned in plaintext. It is a project-scoped ciphertext with no branch type, so it
+     *     decrypts in every branch of that project. The token is always scoped to the single supplied
+     *     repository with `contents: read`, whatever else the installation covers.
+     *
+     *     The token lives about an hour. Every call mints a fresh one; keboola-operator calls again
+     *     before the previous token expires, so a long-running app keeps a valid token.
+     *
+     *     `403` means only that the caller's own application token was refused (e.g. it lacks the
+     *     `oauth:mint` scope). Problems with the requested project or repository are `404`/`412`/
+     *     `422`; upstream trouble is `429`/`502`/`503`. keboola-operator treats `400`/`404`/`412`/
+     *     `422` as terminal (it stops the app) and retries `401`/`403`/`408`/`409`/`429`/`5xx`.
+     */
+    post: operations['organizationCredentialsMintToken'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/health-check': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Health-check endpoint
+     * @description Checks the service is up & running.
+     */
+    get: operations['healthCheck'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+};
+type components = {
+  schemas: {
+    PlatformConsumerCreateRequest: {
+      /** @enum {string} */
+      type: 'githubApp';
+      /**
+       * @description GitHub App ID (numeric, as shown in the App's settings).
+       * @example 123456
+       */
+      appId: string;
+      /**
+       * @description GitHub App slug, used to build the install URL `{webBaseUrl}/apps/{slug}/installations/new`.
+       * @example keboola-data-apps
+       */
+      slug: string;
+      /** @description PEM private key generated for the App. Stored encrypted and never returned. */
+      privateKey: string;
+      /**
+       * @description OAuth client ID of the same App. Used only by the install callback, to exchange the install `code` for a user-to-server token and verify installation ownership.
+       * @example Iv1.0123456789abcdef
+       */
+      clientId: string;
+      /** @description OAuth client secret of the same App. Stored encrypted and never returned. */
+      clientSecret: string;
+      /**
+       * Format: url
+       * @description REST API root. Defaults to the stack's `GITHUB_API_URL`. GitHub Enterprise Server needs the `/api/v3` suffix.
+       * @example https://api.github.com
+       */
+      apiBaseUrl?: string | null;
+      /**
+       * Format: url
+       * @description Web root. Defaults to the stack's `GITHUB_WEB_URL`. Its host is the only host repository URLs may name for this registration, and only one registration per type may exist for a given host.
+       * @example https://github.com
+       */
+      webBaseUrl?: string | null;
+    };
+    PlatformConsumer: {
+      /** Format: uuid */
+      id?: string;
+      /** @enum {string} */
+      type?: 'githubApp';
+      appId?: string;
+      slug?: string;
+      clientId?: string;
+      /** Format: url */
+      apiBaseUrl?: string;
+      /** Format: url */
+      webBaseUrl?: string;
+      /**
+       * @description Lower-cased host of `webBaseUrl`; unique per type.
+       * @example github.com
+       */
+      webHost?: string;
+    };
+    OrganizationCredentialsInitRequest: {
+      /** @description Storage API token of the caller; identifies who they are */
+      token: string;
+      /**
+       * @description Unique within the organization.
+       * @example acme-github
+       */
+      name: string;
+      /**
+       * Format: url
+       * @description Where GitHub returns the user after the install completes. Must be https.
+       */
+      returnUrl: string;
+      description?: string | null;
+      /**
+       * @description Which registered GitHub deployment to connect, as a bare host. Omitted means the stack's default (`GITHUB_WEB_URL`).
+       * @example acme.ghe.com
+       */
+      host?: string | null;
+    };
+    OrganizationCredentials: {
+      /** Format: uuid */
+      id?: string;
+      name?: string;
+      description?: string | null;
+      /**
+       * @description The GitHub account the App is installed on.
+       * @example acme
+       */
+      accountLogin?: string;
+      /**
+       * @description GitHub deployment this connection lives on.
+       * @example github.com
+       */
+      host?: string;
+      creator?: {
+        id?: string;
+        description?: string | null;
+      };
+      /** Format: date-time */
+      created?: string;
+    };
+    MintTokenRequest: {
+      organizationId: string;
+      /** @description Project the returned token is encrypted for. Must belong to `organizationId`. */
+      projectId: string;
+      /**
+       * @description Component the returned token is encrypted for.
+       * @example keboola.data-apps
+       */
+      componentId: string;
+      /**
+       * Format: url
+       * @description Repository the token is scoped to, as `https://{host}/{owner}/{repo}`. The host must be a registered GitHub deployment and the owner a GitHub account this organization has connected on it.
+       * @example https://github.com/acme/app
+       */
+      repository: string;
+    };
+    MintedToken: {
+      /** @description GitHub token, encrypted for the supplied project and component. Scoped to the single requested repository with read-only contents. */
+      '#token'?: string;
+      /** Format: date-time */
+      expiresAt?: string;
+    };
+    Error: {
+      error: string;
+      code: number;
+      exceptionId: string;
+      /** @enum {unknown} */
+      status: 'error';
+      context?: Record<string, never>;
+    };
+    /** @description Returned when a request payload fails validation. The top-level `error` stays a short human-readable string; `context` lists every failing field exactly once. */
+    ValidationError: {
+      /** @example Request contents is not valid */
+      error: string;
+      /** @example 422 */
+      code: number;
+      exceptionId: string;
+      /** @enum {unknown} */
+      status: 'error';
+      /** @description One entry per payload field that failed mapping or validation, keyed by index ("0", "1", …). Each failing field appears exactly once. */
+      context: {
+        [key: string]: {
+          /**
+           * @description Name of the payload field that failed, as sent by the client — encrypted fields are reported under their `#`-prefixed key (e.g. `#data`).
+           * @example authorizedFor
+           */
+          path: string;
+          /** @example Value '' is not a valid non-empty string. */
+          message: string;
+        };
+      };
+    };
+    Consumer: {
+      componentId: string;
+      friendlyName: string;
+      oauthVersion: string;
+      authUrl: string;
+      tokenUrl: string;
+      requestTokenUrl: string | null;
+      appKey: string;
+      appSecret: string;
+      appSecretDocker: string;
+      allowedEndpointHosts: string[];
+    };
+    Credentials: {
+      id: string;
+      branchId: string | null;
+      authorizedFor: string;
+      creator: {
+        id: string;
+        description: string | null;
+      };
+      /** Format: date-time */
+      created: string;
+      oauthVersion: string;
+      appKey: string;
+      '#appSecret': string;
+      '#data': string;
+    };
+  };
+  responses: {
+    /** @description Bad request */
+    '400_BadRequest': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description Validation failed - see `context` for the list of failing fields */
+    '422_UnprocessableEntity': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['ValidationError'];
+      };
+    };
+    /** @description Unauthorized */
+    '401_Unauthorized': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description Forbidden */
+    '403_Forbidden': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description Forbidden */
+    '404_NotFound': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description Keboola Manage API is temporarily unavailable; retryable */
+    '503_ServiceUnavailable': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description GitHub is rate limiting this service; retry after the number of seconds in `Retry-After` */
+    '429_TooManyRequests': {
+      headers: {
+        /** @description Seconds to wait before retrying */
+        'Retry-After'?: number;
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+    /** @description GitHub failed or could not be reached; retryable */
+    '502_BadGateway': {
+      headers: {
+        [name: string]: unknown;
+      };
+      content: {
+        'application/json': components['schemas']['Error'];
+      };
+    };
+  };
+  parameters: {
+    /** @description Platform consumer ID. */
+    PlatformConsumerId: string;
+    /** @description Numeric Keboola organization ID. Always explicit — it is never derived from the token, because a user typically belongs to projects across several organizations. */
+    OrganizationId: string;
+  };
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+};
+interface operations {
+  authorizeInit: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/x-www-form-urlencoded': {
+          /** @description Authorization ID */
+          id: string;
+          /** @description Authorization description */
+          authorizedFor: string;
+          /** @description Storage token of the requester */
+          token: string;
+          /** @description URL where to redirect the client after authorization */
+          returnUrl: string;
+          /** @description Custom application key */
+          appKey?: string | null;
+          /** @description Custom application secret */
+          appSecret?: string | null;
+          /** @description Custom authorization URL */
+          authUrl?: string | null;
+          /** @description Custom token URL */
+          tokenUrl?: string | null;
+          /**
+           * @description ID of the branch where the credentials should live. If not specified, the credentials will be
+           *     considered as project-wide.
+           *
+           *     The property is not required for now, to keep compatibility with existing clients. But it will be
+           *     required in the future (but still nullable), to ensure the client has considered if they want to
+           *     create project-wide or branch-specific credentials.
+           */
+          branchId?: string | null;
+        };
+      };
+    };
+    responses: {
+      /** @description Redirect to OAuth provider */
+      302: {
+        headers: {
+          /** @description URL to follow to authorize the component */
+          Location?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      400: components['responses']['400_BadRequest'];
+      422: components['responses']['422_UnprocessableEntity'];
+    };
+  };
+  authorizeCallback: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Redirect client back to Keboola */
+      302: {
+        headers: {
+          Location?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      400: components['responses']['400_BadRequest'];
+    };
+  };
+  credentialsList: {
+    parameters: {
+      query?: {
+        /** @description Component ID */
+        componentId?: string;
+        /**
+         * @description Branch ID
+         *
+         *     Use value `null` to get credentials without branchId.
+         */
+        branchId?: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Credentials'][];
+        };
+      };
+      400: components['responses']['400_BadRequest'];
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+    };
+  };
+  componentCredentialsList: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Credentials'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+    };
+  };
+  componentCredentialsCreate: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/x-www-form-urlencoded': {
+          /** @description Credentials ID */
+          id: string;
+          /** @description Authorization description */
+          authorizedFor: string;
+          /** @description Encrypted data, e.g. OAuth token */
+          '#data': string;
+          /**
+           * @description ID of the branch where the credentials should live. If not specified, the credentials will be
+           *     considered as project-wide.
+           *
+           *     The property is not required for now, to keep compatibility with existing clients. But it will be
+           *     required in the future (but still nullable), to ensure the client has considered if they want to
+           *     create project-wide or branch-specific credentials.
+           */
+          branchId?: string | null;
+        };
+      };
+    };
+    responses: {
+      /** @description Credentials created */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Credentials'];
+        };
+      };
+      400: components['responses']['400_BadRequest'];
+      404: components['responses']['404_NotFound'];
+      422: components['responses']['422_UnprocessableEntity'];
+    };
+  };
+  credentialsDetail: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+        /** @description Credentials name (authorization ID) */
+        name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Credentials'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+    };
+  };
+  credentialsDelete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+        /** @description Credentials name (authorization ID) */
+        name: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Credentials deleted */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+    };
+  };
+  consumersList: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Consumer'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+    };
+  };
+  consumerCreate: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': {
+          componentId: string;
+          friendlyName: string;
+          oauthVersion: string;
+          authUrl: string;
+          tokenUrl: string;
+          requestTokenUrl?: string | null;
+          appKey: string;
+          appSecret: string;
+          allowedEndpointHosts?: string[];
+        };
+      };
+    };
+    responses: {
+      /** @description Consumer created */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Consumer'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      422: components['responses']['422_UnprocessableEntity'];
+    };
+  };
+  consumerDetail: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Consumer'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+    };
+  };
+  consumerDelete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Consumer deleted */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+    };
+  };
+  consumerUpdate: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Component ID */
+        componentId: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': {
+          friendlyName?: string | null;
+          authUrl?: string | null;
+          tokenUrl?: string | null;
+          requestTokenUrl?: string | null;
+          appKey?: string | null;
+          appSecret?: string | null;
+          allowedEndpointHosts?: string[] | null;
+        };
+      };
+    };
+    responses: {
+      /** @description Consumer updated */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Consumer'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+      422: components['responses']['422_UnprocessableEntity'];
+    };
+  };
+  platformConsumerCreate: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PlatformConsumerCreateRequest'];
+      };
+    };
+    responses: {
+      /** @description Platform consumer registered */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PlatformConsumer'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      /** @description A registration of this type already exists for that GitHub host */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      422: components['responses']['422_UnprocessableEntity'];
+    };
+  };
+  platformConsumerDetail: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Platform consumer ID. */
+        id: components['parameters']['PlatformConsumerId'];
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Platform consumer detail */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['PlatformConsumer'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+    };
+  };
+  platformConsumerDelete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Platform consumer ID. */
+        id: components['parameters']['PlatformConsumerId'];
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Platform consumer deleted */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      401: components['responses']['401_Unauthorized'];
+      404: components['responses']['404_NotFound'];
+      /** @description Organizations are still connected through this registration */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+    };
+  };
+  platformConsumerInstallCallback: {
+    parameters: {
+      query: {
+        /** @description GitHub installation ID. */
+        installation_id?: string;
+        /** @description Temporary user authorization code. Present only when the App has "Request user authorization (OAuth) during installation" enabled; the callback exchanges it for a user-to-server token and verifies installation ownership with it. */
+        code?: string;
+        /** @description What GitHub did. `request` means an owner still has to approve. */
+        setup_action?: 'install' | 'request' | 'update';
+        /** @description Opaque install-session ID issued when the flow started. */
+        state: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Redirect back to the `returnUrl` supplied when the flow started */
+      302: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      400: components['responses']['400_BadRequest'];
+      /** @description The installer is not an active owner of the GitHub organization (or not the personal account) the installation belongs to, or the App lacks "Organization members: read" */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description This installation is already connected to the organization (under the name the message states), the install session was already completed, or this attempt was superseded by a newer start under the same name while the callback ran (nothing is written; finish the newer attempt) */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+    };
+  };
+  organizationCredentialsInit: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Numeric Keboola organization ID. Always explicit — it is never derived from the token, because a user typically belongs to projects across several organizations. */
+        organizationId: components['parameters']['OrganizationId'];
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/x-www-form-urlencoded': components['schemas']['OrganizationCredentialsInitRequest'];
+      };
+    };
+    responses: {
+      /** @description Redirect to GitHub to install the App */
+      302: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      400: components['responses']['400_BadRequest'];
+      403: components['responses']['403_Forbidden'];
+      /** @description A completed connection with this name already exists in the organization */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description No GitHub App is registered for that host on this stack */
+      412: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      422: components['responses']['422_UnprocessableEntity'];
+      503: components['responses']['503_ServiceUnavailable'];
+    };
+  };
+  organizationCredentialsList: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Numeric Keboola organization ID. Always explicit — it is never derived from the token, because a user typically belongs to projects across several organizations. */
+        organizationId: components['parameters']['OrganizationId'];
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Connected GitHub organizations */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['OrganizationCredentials'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      503: components['responses']['503_ServiceUnavailable'];
+    };
+  };
+  organizationCredentialsDelete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Numeric Keboola organization ID. Always explicit — it is never derived from the token, because a user typically belongs to projects across several organizations. */
+        organizationId: components['parameters']['OrganizationId'];
+        /** @description Organization credentials ID. */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Connection removed */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      404: components['responses']['404_NotFound'];
+      503: components['responses']['503_ServiceUnavailable'];
+    };
+  };
+  organizationCredentialsMintToken: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['MintTokenRequest'];
+      };
+    };
+    responses: {
+      /** @description Minted token */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['MintedToken'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      /** @description The application token is valid but not authorized for this endpoint (it lacks the `oauth:mint` scope). Never returned for a problem with the requested project or repository. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description The project was not found in the organization (it does not exist or belongs to another organization), no completed GitHub connection covers the repository's owner in that organization (the connected account login is fixed at install time, so after a GitHub organization rename this holds until the connection is reinstalled), or the GitHub installation was removed on GitHub */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description No GitHub App is registered for that repository's host */
+      412: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description The repository is not covered by the organization's GitHub installation (GitHub answered `422`), or the request failed validation (see `context` for the failing fields) */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'] | components['schemas']['ValidationError'];
+        };
+      };
+      429: components['responses']['429_TooManyRequests'];
+      /** @description GitHub failed (5xx, unreachable, malformed answer), rejected the App's own credentials, or refused to issue a token for the installation at all — a plain `403` from GitHub that is not rate limiting, i.e. the installation is suspended or lacks a permission. Retryable. */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      503: components['responses']['503_ServiceUnavailable'];
+    };
+  };
+  healthCheck: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            api?: string;
+            /** Format: url */
+            documentation?: string;
+          };
+        };
+      };
+    };
+  };
+}
+//#endregion
+//#region src/clients/oauth/utils.d.ts
+/**
+ * Which credentials to list:
+ *
+ * - `all` — the whole project: branch-scoped and branchless alike.
+ * - `branchless` — only what is tied to no branch at all, not even the default one.
+ * - `branched` — only the branch whose id it carries.
+ *
+ * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union
+ * collapses to `string`, so a mistyped scope would silently become a branch-id filter.
+ */
+type GetCredentialsInput = {
+  scope: 'all';
+  componentId?: string;
+} | {
+  scope: 'branchless';
+  componentId?: string;
+} | {
+  scope: 'branched';
+  branchId: string;
+  componentId?: string;
+};
+//#endregion
+//#region src/clients/oauth/types.d.ts
+type Credential = OpenapiReturnType<paths['/credentials/{componentId}/{name}']['get']>;
+type CreateCredentialBody = OpenapiBodyType<paths['/credentials/{componentId}']['post']>;
+type CredentialPath = OpenapiPathType<paths['/credentials/{componentId}/{name}']['get']>;
+type ComponentPath = OpenapiPathType<paths['/credentials/{componentId}']['post']>;
+/** Addresses one credential. The spec calls the second segment `name`; every caller calls it `id`. */
+type CredentialInput = ComponentPath & {
+  id: CredentialPath['name'];
+};
+/**
+ * `data` is the pre-`#data` create shape, accepted only by OAuth services predating this spec, so it
+ * has no schema to generate from. The client takes the plain object either way and picks the wire
+ * shape the stack accepts.
+ */
+type CreateCredentialInput = ComponentPath & Omit<CreateCredentialBody, '#data'> & {
+  data: Record<string, unknown>;
+};
+//#endregion
+export { CredentialInput as a, Credential as i, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, GetCredentialsInput as s, ComponentPath as t };
+//# sourceMappingURL=types-Btb8r9iw.d.ts.map