@keboola/api-client 46.0.0 → 48.0.0

package/dist/middleware-GOfx8Apu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-GOfx8Apu.js","names":[],"sources":["../src/keboola/bearer/credentials/middleware.ts"],"sourcesContent":["import { ApiError } from '../../../errors';\nimport { HttpHeader, type MiddlewareFn } from '../../../fetchClient';\nimport { HttpStatus } from '../../../internal';\n\nexport const isUnauthorized = (error: unknown): boolean =>\n  error instanceof ApiError && error.response.status === HttpStatus.UNAUTHORIZED;\n\n/** Where the middleware gets its token; whether the credential behind it is dead is not its call. */\nexport type AccessTokenSource = {\n  /** `null` while anonymous — nothing to stamp. */\n  getAccessToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n};\n\n/**\n * Bearer auth: stamps the access token; on a 401, force-refreshes and replays once.\n *\n * - A replay that still 401s passes on, not as expiry: an unreachable project gets the same 401.\n * - Anonymous (`null` token): passes through untouched, so `login` / `refresh` work.\n * - A `forceRefresh` answering `null` stops the replay.\n */\nexport const createBearerAuthMiddleware = (source: AccessTokenSource): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await source.getAccessToken({ forceRefresh: false });\n    if (token === null) return next(request);\n\n    // Cloned for the replay: the first attempt may consume the body.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${token}`);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await source.getAccessToken({ forceRefresh: true });\n      // Went anonymous mid-flight — surface the original 401.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, `Bearer ${refreshed}`);\n\n      return await next({ ...request, request: retryRequest });\n    }\n  };\n};\n"],"mappings":";;AAIA,MAAa,kBAAkB,UAC7B,iBAAiB,YAAY,MAAM,SAAS,WAAW,WAAW;;;;;;;;AAepE,MAAa,8BAA8B,WAA4C;CACrF,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,OAAO,eAAe,EAAE,cAAc,MAAM,CAAC;EACjE,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAGvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,UAAU,OAAO;EAEvE,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,OAAO,eAAe,EAAE,cAAc,KAAK,CAAC;GAEpE,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,UAAU,WAAW;GAExE,OAAO,MAAM,KAAK;IAAE,GAAG;IAAS,SAAS;GAAa,CAAC;EACzD;CACF;AACF"}

package/dist/notifications/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_concurrent = require("../concurrent-CdVfR1N5.cjs");
-const require_createGenericFetchClient = require("../createGenericFetchClient-B81Iezpb.cjs");
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-CioTX11-.cjs");
-const require_auth = require("../auth-C9o_0bft.cjs");
+const require_createGenericFetchClient = require("../createGenericFetchClient-MOx97wi-.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DHYo_k3t.cjs");
+const require_auth = require("../auth-C8Pjl0Mu.cjs");
 //#region src/clients/notifications/notificationsClient.ts
 const createNotificationsClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({

package/dist/notifications/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BksK2Eo0.cjs";
-import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-XHNJRi3-.cjs";
+import { n as ClientInitOptions } from "../types-sOM2_KPc.cjs";
+import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-CrJIILXf.cjs";
 //#region src/clients/notifications/notificationsClient.d.ts
 declare const createNotificationsClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/notifications/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BuKviWct.js";
-import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-qWA5iU0j.js";
+import { n as ClientInitOptions } from "../types-D3H3EAre.js";
+import { a as SubscriptionId, n as ListSubscriptionsQuery, s as components, t as CreateSubscriptionBody } from "../types-BTy_FFSu.js";
 //#region src/clients/notifications/notificationsClient.d.ts
 declare const createNotificationsClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;

package/dist/notifications/index.js

@@ -1,7 +1,7 @@
 import { t as concurrent } from "../concurrent-BacWxPwi.js";
-import { t as createGenericFetchClient } from "../createGenericFetchClient-KqiJhw8G.js";
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-wq8iGLZM.js";
-import { t as createAuthHeaders } from "../auth-C6cHWIWx.js";
+import { t as createGenericFetchClient } from "../createGenericFetchClient-CQdNcPC3.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "../auth-4coY1uwo.js";
 //#region src/clients/notifications/notificationsClient.ts
 const createNotificationsClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({

package/dist/notifications/types.d.cts

@@ -1,2 +1,2 @@
-import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-XHNJRi3-.cjs";
+import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-CrJIILXf.cjs";
 export { CreateSubscriptionBody, ListSubscriptionsQuery, ProjectSubscription, SubscriptionFilter, SubscriptionId, SubscriptionRecipient };

package/dist/notifications/types.d.ts

@@ -1,2 +1,2 @@
-import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-qWA5iU0j.js";
+import { a as SubscriptionId, i as SubscriptionFilter, n as ListSubscriptionsQuery, o as SubscriptionRecipient, r as ProjectSubscription, t as CreateSubscriptionBody } from "../types-BTy_FFSu.js";
 export { CreateSubscriptionBody, ListSubscriptionsQuery, ProjectSubscription, SubscriptionFilter, SubscriptionId, SubscriptionRecipient };

package/dist/oauth/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_oauth = require("../oauth-DyUwTqHJ.cjs");
+const require_oauth = require("../oauth-DKZPuUlt.cjs");
 exports.createOauthClient = require_oauth.createOauthClient;

package/dist/oauth/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BksK2Eo0.cjs";
-import { a as CredentialInput, r as CreateCredentialInput, s as GetCredentialsInput } from "../types-sg2xnYlr.cjs";
+import { n as ClientInitOptions } from "../types-sOM2_KPc.cjs";
+import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-Cfc-fYbq.cjs";
 //#region src/clients/oauth/oauthClient.d.ts
 declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;
@@ -46,6 +46,10 @@ declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOpti
     '#data': string;
   }>;
   deleteCredential: ({ componentId, id }: CredentialInput, signal?: AbortSignal) => Promise<void>;
+  getOrganizationConnections: (signal?: AbortSignal) => Promise<{
+    accountLogin: string;
+    host: string;
+  }[]>;
 };
 //#endregion
 export { createOauthClient };

package/dist/oauth/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BuKviWct.js";
-import { a as CredentialInput, r as CreateCredentialInput, s as GetCredentialsInput } from "../types-Btb8r9iw.js";
+import { n as ClientInitOptions } from "../types-D3H3EAre.js";
+import { a as CredentialInput, c as GetCredentialsInput, r as CreateCredentialInput } from "../types-BYFU_6Iz.js";
 //#region src/clients/oauth/oauthClient.d.ts
 declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<unknown>;
@@ -46,6 +46,10 @@ declare const createOauthClient: ({ baseUrl, middlewares, auth }: ClientInitOpti
     '#data': string;
   }>;
   deleteCredential: ({ componentId, id }: CredentialInput, signal?: AbortSignal) => Promise<void>;
+  getOrganizationConnections: (signal?: AbortSignal) => Promise<{
+    accountLogin: string;
+    host: string;
+  }[]>;
 };
 //#endregion
 export { createOauthClient };

package/dist/oauth/index.js

@@ -1,2 +1,2 @@
-import { t as createOauthClient } from "../oauth-Ck_Fe14o.js";
+import { t as createOauthClient } from "../oauth-GXmZ9agP.js";
 export { createOauthClient };

package/dist/oauth/types.d.cts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as GetCredentialsInput, t as ComponentPath } from "../types-sg2xnYlr.cjs";
-export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput };
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-Cfc-fYbq.cjs";
+export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/oauth/types.d.ts

@@ -1,2 +1,2 @@
-import { a as CredentialInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as GetCredentialsInput, t as ComponentPath } from "../types-Btb8r9iw.js";
-export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput };
+import { a as CredentialInput, c as GetCredentialsInput, i as Credential, n as CreateCredentialBody, o as CredentialPath, r as CreateCredentialInput, s as OrganizationConnection, t as ComponentPath } from "../types-BYFU_6Iz.js";
+export { ComponentPath, CreateCredentialBody, CreateCredentialInput, Credential, CredentialInput, CredentialPath, type GetCredentialsInput, OrganizationConnection };

package/dist/{oauth-DyUwTqHJ.cjs → oauth-DKZPuUlt.cjs}

@@ -1,7 +1,7 @@
-const require_createFetchClient = require("./createFetchClient-ClWD4ua3.cjs");
-const require_createGenericFetchClient = require("./createGenericFetchClient-B81Iezpb.cjs");
-const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-CioTX11-.cjs");
-const require_auth = require("./auth-C9o_0bft.cjs");
+const require_createFetchClient = require("./createFetchClient-lZ_93Yrb.cjs");
+const require_createGenericFetchClient = require("./createGenericFetchClient-MOx97wi-.cjs");
+const require_createOpenapiFetchClient = require("./createOpenapiFetchClient-DHYo_k3t.cjs");
+const require_auth = require("./auth-C8Pjl0Mu.cjs");
 //#region src/clients/oauth/utils.ts
 /**
 * The credentials payload rides one of two fields, and only one of them is in the current spec:
@@ -65,6 +65,16 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 			name: id
 		} }, { signal });
 	};
+	/**
+	* The GitHub connections of the project's organization; any project member's token may read them.
+	*
+	* - Empty when the organization has none.
+	* - A listed connection does not guarantee a repository: the App installation must cover it.
+	*/
+	const getOrganizationConnections = async (signal) => {
+		const { data } = await client.get("/organization-credentials/connections", {}, { signal });
+		return data.connections;
+	};
 	const healthCheck = async (signal) => {
 		const { data } = await genericClient.get("/health-check", {}, { signal });
 		return data;
@@ -74,7 +84,8 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getCredentials,
 		getCredential,
 		createCredential,
-		deleteCredential
+		deleteCredential,
+		getOrganizationConnections
 	};
 };
 //#endregion
@@ -85,4 +96,4 @@ Object.defineProperty(exports, "createOauthClient", {
 	}
 });
 
-//# sourceMappingURL=oauth-DyUwTqHJ.cjs.map
+//# sourceMappingURL=oauth-DKZPuUlt.cjs.map

package/dist/{oauth-DyUwTqHJ.cjs.map → oauth-DKZPuUlt.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-DyUwTqHJ.cjs","names":["createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient","isApiError","HttpStatus"],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASA,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-DKZPuUlt.cjs","names":["createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient","isApiError","HttpStatus"],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASA,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/{oauth-Ck_Fe14o.js → oauth-GXmZ9agP.js}

@@ -1,7 +1,7 @@
-import { g as HttpStatus, r as isApiError } from "./createFetchClient-DITkTV2k.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-KqiJhw8G.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-wq8iGLZM.js";
-import { t as createAuthHeaders } from "./auth-C6cHWIWx.js";
+import { g as HttpStatus, r as isApiError } from "./createFetchClient-CkHdS_IG.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-CQdNcPC3.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "./auth-4coY1uwo.js";
 //#region src/clients/oauth/utils.ts
 /**
 * The credentials payload rides one of two fields, and only one of them is in the current spec:
@@ -65,6 +65,16 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 			name: id
 		} }, { signal });
 	};
+	/**
+	* The GitHub connections of the project's organization; any project member's token may read them.
+	*
+	* - Empty when the organization has none.
+	* - A listed connection does not guarantee a repository: the App installation must cover it.
+	*/
+	const getOrganizationConnections = async (signal) => {
+		const { data } = await client.get("/organization-credentials/connections", {}, { signal });
+		return data.connections;
+	};
 	const healthCheck = async (signal) => {
 		const { data } = await genericClient.get("/health-check", {}, { signal });
 		return data;
@@ -74,10 +84,11 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getCredentials,
 		getCredential,
 		createCredential,
-		deleteCredential
+		deleteCredential,
+		getOrganizationConnections
 	};
 };
 //#endregion
 export { createOauthClient as t };
 
-//# sourceMappingURL=oauth-Ck_Fe14o.js.map
+//# sourceMappingURL=oauth-GXmZ9agP.js.map

package/dist/{oauth-Ck_Fe14o.js.map → oauth-GXmZ9agP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"oauth-Ck_Fe14o.js","names":[],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,KAAK,MAAM,SAAS,WAAW,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF"}
+{"version":3,"file":"oauth-GXmZ9agP.js","names":[],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,KAAK,MAAM,SAAS,WAAW,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/omnisearch/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-CioTX11-.cjs");
-const require_auth = require("../auth-C9o_0bft.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DHYo_k3t.cjs");
+const require_auth = require("../auth-C8Pjl0Mu.cjs");
 //#region src/clients/omnisearch/omnisearchClient.ts
 /**
 * Omnisearch — data lineage.

package/dist/omnisearch/index.d.cts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BksK2Eo0.cjs";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-ggpJFEWZ.cjs";
+import { n as ClientInitOptions } from "../types-sOM2_KPc.cjs";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-DSBrhK_K.cjs";
 //#region src/clients/omnisearch/omnisearchClient.d.ts
 /**
  * Omnisearch — data lineage.

package/dist/omnisearch/index.d.ts

@@ -1,5 +1,5 @@
-import { n as ClientInitOptions } from "../types-BuKviWct.js";
-import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-Br04cEri.js";
+import { n as ClientInitOptions } from "../types-D3H3EAre.js";
+import { h as components, m as TablesLineageResponse, n as GetTablesLineageQuery, t as GetProjectsLineageQuery } from "../types-Bt8CEZ6K.js";
 //#region src/clients/omnisearch/omnisearchClient.d.ts
 /**
  * Omnisearch — data lineage.

package/dist/omnisearch/index.js

@@ -1,5 +1,5 @@
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-wq8iGLZM.js";
-import { t as createAuthHeaders } from "../auth-C6cHWIWx.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "../auth-4coY1uwo.js";
 //#region src/clients/omnisearch/omnisearchClient.ts
 /**
 * Omnisearch — data lineage.

package/dist/omnisearch/types.d.cts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-ggpJFEWZ.cjs";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-DSBrhK_K.cjs";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/omnisearch/types.d.ts

@@ -1,2 +1,2 @@
-import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-Br04cEri.js";
+import { a as LineageMetadata, c as LineageTable, d as ProjectsLineageResponse, f as TableLineageRelation, i as LineageConfiguration, l as ProjectLineageRelation, m as TablesLineageResponse, n as GetTablesLineageQuery, o as LineageProject, p as TablesLineage, r as LineageBucket, s as LineageSource, t as GetProjectsLineageQuery, u as ProjectsLineage } from "../types-Bt8CEZ6K.js";
 export { GetProjectsLineageQuery, GetTablesLineageQuery, LineageBucket, LineageConfiguration, LineageMetadata, LineageProject, LineageSource, LineageTable, ProjectLineageRelation, ProjectsLineage, ProjectsLineageResponse, TableLineageRelation, TablesLineage, TablesLineageResponse };

package/dist/project-Dzu85cqr.d.cts

@@ -0,0 +1,74 @@
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-ChDl6ig5.cjs";
+import "./adminRoles-BgpaBE7h.cjs";
+import { t as Backend } from "./backends-DKBz5OxE.cjs";
+//#region src/clients/storage/tokens/types.d.ts
+type ProjectId = number;
+type CreateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens']['post']>;
+type UpdateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}']['put']>;
+type TokenListItem = OpenapiReturnType<paths['/v2/storage/tokens']['get']>[number];
+type GetTokenEventsPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/events']['get']>;
+type GetTokenEventsInput = GetTokenEventsPath & NonNullable<OpenapiQueryType<paths['/v2/storage/tokens/{id}/events']['get']>>;
+/**
+ * The create payload with `token` required.
+ *
+ * - The spec shares the schema with update, where `token` is omitted; create always returns it.
+ */
+type CreateTokenResponse = Omit<OpenapiReturnType<paths['/v2/storage/tokens']['post']>, 'token'> & {
+  token: string;
+};
+/** The verify payload as the spec declares it — `StorageToken` is the corrected shape. */
+type StorageTokenRaw = OpenapiReturnType<paths['/v2/storage/tokens/verify']['get']>;
+/**
+ * `StorageTokenRaw` tightened to what an admin session always gets.
+ *
+ * - `admin` and `adminOwner` are optional in the spec (a token without an admin); every token the
+ *   SDK verifies belongs to one, and `domain/permissions` narrows on `admin.role`.
+ * - `admin.role` stays the spec's enum and nullable: Connection stores memberships without a role.
+ * - `owner.assignedBackends` narrows to the backends the SDK knows; the spec types them `string`.
+ */
+type StorageToken = Omit<StorageTokenRaw, 'owner' | 'admin' | 'adminOwner'> & {
+  owner: Omit<StorageTokenRaw['owner'], 'assignedBackends'> & {
+    assignedBackends: Backend[];
+  };
+  admin: NonNullable<StorageTokenRaw['admin']>;
+  adminOwner: NonNullable<StorageTokenRaw['adminOwner']>;
+};
+/**
+ * The create body with every field optional.
+ * - Connection defaults each boolean (`?? false`) and declares no `required` list; the generator
+ *   marks a property with a `default` as required (`--default-non-nullable`), hence the `Partial`.
+ * - `canManageBuckets` only picks the full arm of the spec's union; the limited arm is a subset.
+ */
+type CreateTokenBody = Partial<Extract<CreateTokenSchemaBody, {
+  canManageBuckets: boolean;
+}>>;
+/** Update takes these five fields and ignores the rest (`allowExtraFields`); `canManageBuckets` is set at creation only. */
+type UpdateTokenBody = UpdateTokenSchemaBody;
+type UpdateTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}']['put']>;
+type UpdateTokenInput = UpdateTokenPath & UpdateTokenBody;
+type ShareTokenBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}/share']['post']>;
+type ShareTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/share']['post']>;
+type ShareTokenInput = ShareTokenPath & ShareTokenBody;
+//#endregion
+//#region src/domain/project.d.ts
+type Options = {
+  sapiToken: StorageToken;
+};
+declare const hasFeature: (token: StorageToken, ...feature: string[]) => boolean;
+/**
+ * The admin's features as the Storage token carries them.
+ *
+ * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+ *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+ */
+declare const hasAdminFeature: (token: StorageToken, ...feature: string[]) => boolean;
+declare const createProject: ({ sapiToken }: Options) => {
+  hasFeature: (...feature: string[]) => boolean;
+  hasAdminFeature: (...feature: string[]) => boolean;
+  hasBackend: (backend: Backend) => boolean;
+  sapiToken: StorageToken;
+};
+type Project = ReturnType<typeof createProject>;
+//#endregion
+export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
+//# sourceMappingURL=project-Dzu85cqr.d.cts.map

package/dist/project-nbv9yjpl.d.ts

@@ -0,0 +1,74 @@
+import { Lr as paths, c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-sDHBkJhU.js";
+import "./adminRoles-DsoGQipO.js";
+import { t as Backend } from "./backends-DKBz5OxE.js";
+//#region src/clients/storage/tokens/types.d.ts
+type ProjectId = number;
+type CreateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens']['post']>;
+type UpdateTokenSchemaBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}']['put']>;
+type TokenListItem = OpenapiReturnType<paths['/v2/storage/tokens']['get']>[number];
+type GetTokenEventsPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/events']['get']>;
+type GetTokenEventsInput = GetTokenEventsPath & NonNullable<OpenapiQueryType<paths['/v2/storage/tokens/{id}/events']['get']>>;
+/**
+ * The create payload with `token` required.
+ *
+ * - The spec shares the schema with update, where `token` is omitted; create always returns it.
+ */
+type CreateTokenResponse = Omit<OpenapiReturnType<paths['/v2/storage/tokens']['post']>, 'token'> & {
+  token: string;
+};
+/** The verify payload as the spec declares it — `StorageToken` is the corrected shape. */
+type StorageTokenRaw = OpenapiReturnType<paths['/v2/storage/tokens/verify']['get']>;
+/**
+ * `StorageTokenRaw` tightened to what an admin session always gets.
+ *
+ * - `admin` and `adminOwner` are optional in the spec (a token without an admin); every token the
+ *   SDK verifies belongs to one, and `domain/permissions` narrows on `admin.role`.
+ * - `admin.role` stays the spec's enum and nullable: Connection stores memberships without a role.
+ * - `owner.assignedBackends` narrows to the backends the SDK knows; the spec types them `string`.
+ */
+type StorageToken = Omit<StorageTokenRaw, 'owner' | 'admin' | 'adminOwner'> & {
+  owner: Omit<StorageTokenRaw['owner'], 'assignedBackends'> & {
+    assignedBackends: Backend[];
+  };
+  admin: NonNullable<StorageTokenRaw['admin']>;
+  adminOwner: NonNullable<StorageTokenRaw['adminOwner']>;
+};
+/**
+ * The create body with every field optional.
+ * - Connection defaults each boolean (`?? false`) and declares no `required` list; the generator
+ *   marks a property with a `default` as required (`--default-non-nullable`), hence the `Partial`.
+ * - `canManageBuckets` only picks the full arm of the spec's union; the limited arm is a subset.
+ */
+type CreateTokenBody = Partial<Extract<CreateTokenSchemaBody, {
+  canManageBuckets: boolean;
+}>>;
+/** Update takes these five fields and ignores the rest (`allowExtraFields`); `canManageBuckets` is set at creation only. */
+type UpdateTokenBody = UpdateTokenSchemaBody;
+type UpdateTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}']['put']>;
+type UpdateTokenInput = UpdateTokenPath & UpdateTokenBody;
+type ShareTokenBody = OpenapiBodyType<paths['/v2/storage/tokens/{id}/share']['post']>;
+type ShareTokenPath = OpenapiPathType<paths['/v2/storage/tokens/{id}/share']['post']>;
+type ShareTokenInput = ShareTokenPath & ShareTokenBody;
+//#endregion
+//#region src/domain/project.d.ts
+type Options = {
+  sapiToken: StorageToken;
+};
+declare const hasFeature: (token: StorageToken, ...feature: string[]) => boolean;
+/**
+ * The admin's features as the Storage token carries them.
+ *
+ * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both
+ *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.
+ */
+declare const hasAdminFeature: (token: StorageToken, ...feature: string[]) => boolean;
+declare const createProject: ({ sapiToken }: Options) => {
+  hasFeature: (...feature: string[]) => boolean;
+  hasAdminFeature: (...feature: string[]) => boolean;
+  hasBackend: (backend: Backend) => boolean;
+  sapiToken: StorageToken;
+};
+type Project = ReturnType<typeof createProject>;
+//#endregion
+export { UpdateTokenInput as _, CreateTokenResponse as a, GetTokenEventsPath as c, ShareTokenInput as d, ShareTokenPath as f, UpdateTokenBody as g, TokenListItem as h, CreateTokenBody as i, ProjectId as l, StorageTokenRaw as m, hasAdminFeature as n, CreateTokenSchemaBody as o, StorageToken as p, hasFeature as r, GetTokenEventsInput as s, Project as t, ShareTokenBody as u, UpdateTokenPath as v, UpdateTokenSchemaBody as y };
+//# sourceMappingURL=project-nbv9yjpl.d.ts.map

package/dist/queryService/index.cjs

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_queryService = require("../queryService-RlNYw7LG.cjs");
+const require_queryService = require("../queryService-CzK53q94.cjs");
 exports.createQueryServiceClient = require_queryService.createQueryServiceClient;

package/dist/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { t as createQueryServiceClient } from "../index-syAYY5LC.cjs";
+import { S as createQueryServiceClient } from "../index-C40Fbj-6.cjs";
 export { createQueryServiceClient };

package/dist/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { t as createQueryServiceClient } from "../index-BP3choXr.js";
+import { S as createQueryServiceClient } from "../index-B3QTeqfL.js";
 export { createQueryServiceClient };

package/dist/queryService/index.js

@@ -1,2 +1,2 @@
-import { t as createQueryServiceClient } from "../queryService-Blfz59Ms.js";
+import { t as createQueryServiceClient } from "../queryService-C-pZha5p.js";
 export { createQueryServiceClient };

package/dist/queryService/types.d.cts

@@ -1,2 +1,2 @@
-import { a as GetQueryJobPath, c as JobStatusResponse, d as PostQueryPath, f as QueryJobStatus, i as GetQueriesPath, l as PostCancelQueryJobPath, m as Statements, n as GetExportResultsQuery, o as GetQueryResultsPath, p as QueryResult, r as GetQueriesHistoryQuery, s as GetQueryResutsQuery, t as ExportResultsResponse, u as PostQueryBody } from "../types-q5lgElyc.cjs";
-export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, QueryJobStatus, QueryResult, Statements };
+import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-C40Fbj-6.cjs";
+export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queryService/types.d.ts

@@ -1,2 +1,2 @@
-import { a as GetQueryJobPath, c as JobStatusResponse, d as PostQueryPath, f as QueryJobStatus, i as GetQueriesPath, l as PostCancelQueryJobPath, m as Statements, n as GetExportResultsQuery, o as GetQueryResultsPath, p as QueryResult, r as GetQueriesHistoryQuery, s as GetQueryResutsQuery, t as ExportResultsResponse, u as PostQueryBody } from "../types-j30rKMe6.js";
-export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, QueryJobStatus, QueryResult, Statements };
+import { $ as PostQueryBody, G as GetExportResultsQuery, J as GetQueryJobPath, K as GetQueriesHistoryQuery, Q as PostCancelQueryJobPath, U as QueryJobPollOptions, W as ExportResultsResponse, X as GetQueryResutsQuery, Y as GetQueryResultsPath, Z as JobStatusResponse, et as PostQueryPath, nt as QueryResult, q as GetQueriesPath, rt as Statements, tt as QueryJobStatus } from "../index-B3QTeqfL.js";
+export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/{queryService-Blfz59Ms.js → queryService-C-pZha5p.js}

@@ -1,31 +1,40 @@
-import { a as poller, t as jobStatus } from "./jobStatus-BJdbZ72V.js";
-import { f as parseContentDispositionHeader, s as HttpHeader } from "./createFetchClient-DITkTV2k.js";
-import { t as createGenericFetchClient } from "./createGenericFetchClient-KqiJhw8G.js";
-import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-wq8iGLZM.js";
-import { t as createAuthHeaders } from "./auth-C6cHWIWx.js";
+import { a as poller, n as jobStatus, t as transientRetries } from "./transientRetries-B4iusp69.js";
+import { f as parseContentDispositionHeader, s as HttpHeader } from "./createFetchClient-CkHdS_IG.js";
+import { t as QueryJobError } from "./QueryJobError-ZZZ043Nm.js";
+import { t as createGenericFetchClient } from "./createGenericFetchClient-CQdNcPC3.js";
+import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DXiMv9WL.js";
+import { t as createAuthHeaders } from "./auth-4coY1uwo.js";
 //#region src/clients/queryService/poller.ts
 const DEFAULT_POLL_INTERVAL = 2e3;
-/**
-* Waits on a query job.
-*
-* - Takes the job rather than its id, so a caller hands over what `createQueryJob` gave it.
-* - The request reads the id off the key rather than out of a closure, which is what makes the key
-*   the whole input.
-* - Terminal is the job's own terminal set, not its statements': a `completed` job can still hold a
-*   statement that failed, and what that means is the caller's business.
-*/
-const createJobPoller = ({ getQueryJob }) => ({ id }, { interval, maxAttempts, timeout, signal } = {}) => poller({
-	pollKey: ["queryService.job", { queryJobId: id }],
-	pollFn: ({ pollKey: [, params], signal: pollSignal }) => getQueryJob(params.queryJobId, pollSignal),
-	until: ({ data }) => jobStatus.query.isTerminal(data.status),
-	backoff: {
-		type: "constant",
-		interval: interval ?? DEFAULT_POLL_INTERVAL
-	},
-	maxAttempts,
-	timeout,
-	signal
-});
+const createJobPoller = ({ getQueryJob }) => ({ init, interval, maxAttempts, timeout, signal }) => {
+	const retries = transientRetries();
+	return poller({
+		pollKey: ({ id }) => ["queryService.job", { id }],
+		init,
+		pollFn: async ({ init: { id }, signal: pollSignal }) => {
+			const job = await getQueryJob(id, pollSignal);
+			retries.reset();
+			return job;
+		},
+		isRetryable: retries.isRetryable,
+		until: ({ data }) => jobStatus.query.isTerminal(data.status),
+		failed: (job) => {
+			if (job.status !== "failed") return void 0;
+			const failedStatements = job.statements.filter((statement) => statement.status === "failed").map((statement) => ({
+				id: statement.id,
+				error: statement.error
+			}));
+			return new QueryJobError(failedStatements[0]?.error ?? "Job failed", job.queryJobId, { failedStatements });
+		},
+		backoff: {
+			type: "constant",
+			interval: interval ?? DEFAULT_POLL_INTERVAL
+		},
+		maxAttempts,
+		timeout,
+		signal
+	});
+};
 //#endregion
 //#region src/clients/queryService/queryServiceClient.ts
 const createQueryServiceClient = ({ baseUrl, middlewares, auth }) => {
@@ -111,4 +120,4 @@ const createQueryServiceClient = ({ baseUrl, middlewares, auth }) => {
 //#endregion
 export { createQueryServiceClient as t };
 
-//# sourceMappingURL=queryService-Blfz59Ms.js.map
+//# sourceMappingURL=queryService-C-pZha5p.js.map