@keboola/api-client 51.0.0 → 52.0.0

package/AGENTS.md

@@ -39,7 +39,7 @@ const { data } = useQuery({
 **Scripts / CLIs / non-React.** Create one directly — pick the smallest that covers you:
 
 - **`createStorageClient`** — Storage-only. Needs only `baseUrl` + `token`, skipping the stack-info round-trip. Start here when in doubt; upgrading later is mechanical, downgrading is not. (React apps still get their client via `ProjectApiProvider` + `useProjectApi()` — see above; this section is about the non-React/single-service case.)
-- **`createLegacyKeboola` / `createKeboola`** — full SDK across all stack services. `createLegacyKeboola` returns `{ api, session }` and `createKeboola` returns `{ session, getStackApi, getProjectApi }`; drive the `session` to ready, then use the product surface. Bootstrap (`getStackInfo`, to discover services against the actual stack) runs while the storage build resolves, after which `api.stack` is synchronous. The verified token and the dev branches are the consumer's to fetch (`api.storage.tokens.verify()`, `api.storage.branches.getDevBranches()`) and derive with `createProject` / `createDefaultBranch` — kbc-ui holds them in TanStack queries (`useProject` reads the token). Every stack service — including `metastore` — is resolved from the stack's advertised service URLs. See the lifecycle section below for the per-flow `session` verbs. The token-less public clients `createAssetsClient` / `createStatusClient` are **not** part of this — import them directly from `@keboola/api-client/assets` and `@keboola/api-client/status`.
+- **`createLegacyKeboola` / `createKeboola`** — full SDK across all stack services. `createLegacyKeboola` returns `{ api, session }` and `createKeboola` returns `{ session, getStackApi, getProjectApi }`; drive the `session` to ready, then use the product surface. Bootstrap (`getStackInfo`, to discover services against the actual stack) runs while the storage build resolves, after which `api.stack` is synchronous. The verified token and the dev branches are the consumer's to fetch (`api.storage.tokens.verify()`, `api.storage.branches.getDevBranches()`) and derive with `createProject` / `createBranchRefs` — kbc-ui holds them in TanStack queries (`useProject` reads the token). Every stack service — including `metastore` — is resolved from the stack's advertised service URLs. See the lifecycle section below for the per-flow `session` verbs. The token-less public clients `createAssetsClient` / `createStatusClient` are **not** part of this — import them directly from `@keboola/api-client/assets` and `@keboola/api-client/status`.
 
 **`clients/` also holds clients for third-party APIs the platform talks to directly** (`microsoftGraph` today): a vendor API is still HTTP that must run through the shared fetch client, its middleware chain and its error guards, so it gets a client here rather than a hand-rolled `fetch` in the consuming app. They differ from stack clients in three ways, and a new one should follow the same rules: **never** registered in `createServiceClients.ts` (they are not stack services, so they must not appear on `api.*`), they default their own `baseUrl` (a vendor's host and version prefix are part of its API contract, not something we discover or configure), and they carry no `healthCheck` (we don't own the service's liveness). Consumers construct them directly from the sub-path, like the token-less clients above.
 
@@ -255,6 +255,43 @@ Import paths:
 | `@keboola/api-client/sdk/configurations`  | Core configuration SDK                                           |
 | `@keboola/api-client/domain/permissions`  | Permission primitives                                            |
 
+### Query Service credentials
+
+`createQueryServiceClient` takes `auth` as a credential or as a provider. It sends these headers:
+
+| Credential                                        | Headers sent                                    |
+| ------------------------------------------------- | ----------------------------------------------- |
+| `{ type: 'sapi-token', token }`                   | `X-StorageApi-Token`                            |
+| `{ type: 'bearer', token, projectId }`            | `Authorization: Bearer …`, `X-KBC-ProjectId`    |
+| `{ type: 'app-user-token', token, storageToken }` | `X-Kbc-App-User-Token` and `X-StorageApi-Token` |
+
+```ts
+import { readFileSync } from 'node:fs';
+
+// Static token
+createQueryServiceClient({ baseUrl, auth: { type: 'sapi-token', token } });
+
+// Rotating token: re-read the token file before every request
+const storageToken = () => readFileSync(process.env.STORAGE_API_TOKEN_PATH!, 'utf8').trim();
+createQueryServiceClient({ baseUrl, auth: { type: 'sapi-token', token: storageToken } });
+
+// Request-scoped: the signed-in user when there is one, the app otherwise
+createQueryServiceClient({
+  baseUrl,
+  auth: () =>
+    userToken()
+      ? { type: 'app-user-token', token: userToken(), storageToken }
+      : { type: 'sapi-token', token: storageToken },
+});
+```
+
+- Every token field is a value or a callback (`TokenSource`, sync or async). A provider (`QueryServiceCredentialProvider`) picks the credential. Both are resolved before every request, retries included.
+- A provider or a token callback: every token is checked before each request (empty, spaces, non-ASCII → `ValidationError`, nothing sent), and so is a `bearer` project id. The request carries only that credential's headers; any other credential header is removed.
+- A credential with only string tokens is sent as fixed default headers, as `createAuthHeaders` does; a header that a middleware sets still goes out. Its `app-user-token` tokens are checked when the client is created; `sapi-token` / `bearer` strings are not.
+- Types: `QueryServiceCredential`, `QueryServiceCredentialProvider`, `AppUserTokenAuth`, `TokenSource` from `@keboola/api-client/queryService`. The app user token is a Query Service credential only, and it always travels with the app's Storage token.
+- The app user token works on any workspace; row-level security is a separate matter (`RowLevelSecurityError`).
+- `healthCheck` sends no credential. `middlewares` is optional here (default `[]`).
+
 ## Consumption Hierarchy
 
 When implementing an action that talks to a Keboola API, pick the highest layer that already covers it:
@@ -272,10 +309,10 @@ When a caller writes a component configuration on a user's behalf — an agent-g
 2. **Encrypt** — hands every `#`-prefixed secret field to the encryption service (a remote call) and writes back the ciphertext, so a **plaintext secret is never sent to Storage**.
 3. **Write** — only then calls Storage.
 
-`createConfigurationSdk` (`@keboola/api-client/sdk/configurations`) takes the storage and encryption clients plus the project context the permission guard reads — the verified token as `createProject` builds it, and the default branch as `createDefaultBranch` builds it. It is not on `api.sdk`: the token is the consumer's to fetch.
+`createConfigurationSdk` (`@keboola/api-client/sdk/configurations`) takes the storage and encryption clients plus the project context the permission guard reads — the verified token as `createProject` builds it, and the branch refs as `createBranchRefs` builds them. It is not on `api.sdk`: the token is the consumer's to fetch.
 
 ```ts
-import { createDefaultBranch, createLegacyKeboola, createProject } from '@keboola/api-client';
+import { createBranchRefs, createLegacyKeboola, createProject } from '@keboola/api-client';
 import { createConfigurationSdk } from '@keboola/api-client/sdk/configurations';
 
 const { api, session } = createLegacyKeboola({ baseUrl });
@@ -289,7 +326,7 @@ const configuration = createConfigurationSdk({
   encryptionClient: api.encryption,
   context: {
     project: createProject({ sapiToken: token }),
-    defaultBranch: createDefaultBranch({ devBranches }),
+    branchRefs: createBranchRefs({ devBranches }),
   },
 });
 
@@ -317,7 +354,7 @@ Two boundaries to know before relying on it:
 ```ts
 // PREFERRED — tree-shakes correctly
 import type { Table, Bucket } from '@keboola/api-client/storage/types';
-import type { DataApp } from '@keboola/api-client/dataScience/types';
+import type { App } from '@keboola/api-client/apps/types';
 
 // ACCEPTABLE for runtime values / error guards (no type-only equivalent)
 import { isApiError, isAbortError, isFetchClientError } from '@keboola/api-client';
@@ -342,7 +379,7 @@ import { skipToken } from '@tanstack/react-query';
 
 queryOptions({
   queryKey: sandboxesApiKey.getSandbox(id ?? ''),
-  queryFn: !id ? skipToken : async ({ signal }) => api.dataScience.getApp(id, signal),
+  queryFn: !id ? skipToken : async ({ signal }) => api.dataScience.getSandbox(id, signal),
 });
 ```
 
@@ -394,9 +431,10 @@ Error classes the SDK can throw — branch on these instead of a catch-all `unkn
 | `UserError`                 | `@keboola/api-client`                    | You want to surface `err.message` verbatim — already phrased for users      |
 | `ServiceUnavailableError`   | `@keboola/api-client`                    | A namespace was accessed on a stack that doesn't host it — hide the feature |
 | `ManagementClientAuthError` | `@keboola/api-client`                    | Session expired (management redirected to login) — global re-login UX       |
+| `RowLevelSecurityError`     | `@keboola/api-client`                    | Row-level security refused the query for the caller — show "no access"      |
 | `PermissionDeniedError`     | `@keboola/api-client/domain/permissions` | A client-side `assertCan*` refused before any HTTP round-trip               |
 
-There is **no** `ServerError` class — server-originated failures surface as `ApiError`; discriminate 5xx from 4xx via `err.response.status` inside `isApiError(err)`. `ManagementClientAuthError` extends `ApiError`, so check `isManagementClientAuthError` first.
+There is **no** `ServerError` class — server-originated failures surface as `ApiError`; discriminate 5xx from 4xx via `err.response.status` inside `isApiError(err)`. `ManagementClientAuthError` and `RowLevelSecurityError` extend `ApiError`, so check `isManagementClientAuthError` / `isRowLevelSecurityError` first.
 
 Canonical try/catch — order guards most-specific first:
 
@@ -503,7 +541,7 @@ api.stream.*         api.omnisearch.*     api.apps.*
 api.sdk.tag.*        api.sdk.storage.*
 ```
 
-`api.apps` is the data-apps `/v2` App Deployments surface (apps + deployments); `api.dataScience` is the same service's `/v1` surface, which still owns workspaces (`/sandboxes`, `/runtimes`) and the data-app endpoints the UI has not moved off yet.
+`api.apps` is the data-apps `/v2` App Deployments surface (apps + deployments); `api.dataScience` is the same service's `/v1` surface, which owns workspaces (`/sandboxes`, `/runtimes`, `keboola.sandboxes` apps) and what `/v2` lacks — the dev-mode preview link.
 
 **`api.apps` needs no availability check.** Every stack's sandboxes-service serves `/v2` from the same image as `/v1`, and `api.apps` resolves off the `data-science` service id like `api.dataScience`. When probing a stack by hand, only an authenticated call answers:
 

package/API-SURFACE.md

@@ -4,7 +4,7 @@
 
 Every namespace and method reachable from a ready `ProjectApi` — one project's api (`createKeboola(...).getProjectApi(id)` / `createLegacyKeboola(...).api`, or `useProjectApi()`). Generated from the TypeScript type checker — see `scripts/gen-surface.mjs`.
 
-26 top-level namespaces, 710 methods. This index lists method **names** only — full signatures live per namespace under [`surface/`](./surface). Open `surface/<namespace>.md` for the one you need.
+26 top-level namespaces, 701 methods. This index lists method **names** only — full signatures live per namespace under [`surface/`](./surface). Open `surface/<namespace>.md` for the one you need.
 
 ## [`api.ai`](./surface/ai.md)
 
@@ -127,22 +127,13 @@ Every namespace and method reachable from a ready `ProjectApi` — one project's
 
 ## [`api.dataScience`](./surface/dataScience.md)
 
-- `createApp`
 - `createAppPreviewLink`
-- `deleteApp`
 - `deleteSandbox`
 - `getApp`
-- `getAppLogsDownload`
-- `getAppLogsTail`
-- `getAppPassword`
-- `getAppRun`
-- `getAppRuns`
 - `getApps`
 - `getRuntimes`
 - `getSandbox`
 - `healthCheck`
-- `patchApp`
-- `resetAppPassword`
 
 ## [`api.editor`](./surface/editor.md)
 

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @keboola/api-client
 
+## 52.0.0
+
+### Major Changes
+
+- `api.dataScience` keeps only what the `/v2` App Deployments API (`api.apps`) does not cover: workspace apps (`getApp`, `getApps`), `createAppPreviewLink`, runtimes and sandboxes.
+  - **Breaking:** `api.dataScience.createApp`, `patchApp`, `deleteApp`, `getAppPassword`, `resetAppPassword`, `getAppRuns`, `getAppRun`, `getAppLogsTail` and `getAppLogsDownload` are gone — `api.apps` has each of them.
+  - **Breaking:** `@keboola/api-client/dataScience/types` no longer exports `CreateDataAppBody`, `DeleteDataAppPath`, `PatchDataAppPath`, `PatchDataAppBody`, `GetDataAppPasswordPath`, `ResetDataAppPasswordPath`, `GetDataAppRunsPath`, `GetDataAppRunsQuery`, `GetDataAppRunPath`, `RawAppRun`, `DataAppRun`, `GetDataAppLogsDownloadPath`, `GetDataAppLogsTailPath`, `GetDataAppLogsTailQuery` or `LogEntry`; `LogEntry` comes from `@keboola/api-client/apps/types`.
+  - **Breaking:** `parseLogLines` is exported from `@keboola/api-client/apps` (and the package root), no longer from `@keboola/api-client/dataScience`.
+
+- `createDefaultBranch` is now `createBranchRefs`: it reads a branch ref — the `default` alias or a branch id — against the project's default branch.
+  - **Breaking:** `createDefaultBranch` and the `DefaultBranch` type are renamed `createBranchRefs` and `BranchRefs`; `id` and `name` are now `defaultId` and `defaultName`.
+  - **Breaking:** `createConfigurationSdk`'s `context.defaultBranch` is now `context.branchRefs`.
+  - `resolve(ref)` gives the id a ref points to: `default`, or no ref, is the default branch; an id is itself.
+
+### Minor Changes
+
+- `ProjectFeature.DataAppsDisabled` (`data-apps-disabled`): the project feature under which no app can be created.
+
+- `createQueryServiceClient` takes `auth` as a credential or as a provider (`QueryServiceCredentialProvider`, from `@keboola/api-client/queryService`), and accepts the new `{ type: 'app-user-token', token, storageToken }` credential, which sends `X-Kbc-App-User-Token` together with the app's `X-StorageApi-Token`. Every token field is a value or a callback (`TokenSource`), so a rotating token is read again before every request and retry; each resolved token is checked before sending. A request carries exactly the chosen credential's headers; credentials with only string tokens are sent as fixed headers, exactly as before; `middlewares` is optional for this client. Independently, a Query Service row-level security refusal now rejects with `RowLevelSecurityError` (extends `ApiError`, guard `isRowLevelSecurityError`), and `X-Kbc-App-User-Token` is redacted from errors and logs like the other credential headers (AJDA-3620)
+
+- `StorageBackend` carries the optional `policyTagCapability` (`PolicyTagCapability`) of a BigQuery backend detail: the stored policy-tag state, coordinates and last verification, or `null` when never configured.
+
+### Patch Changes
+
+- A fixed `{ type: 'app-user-token', token, storageToken }` credential with an empty or malformed token makes `createQueryServiceClient` throw `ValidationError`, as the same credential from a provider already does before each request (AJDA-3620)
+  - `sapi-token` / `bearer` strings in a fixed credential are still sent unchecked.
+
 ## 51.0.0
 
 ### Minor Changes

package/README.md

@@ -171,7 +171,7 @@ src/
     storage/                    # Storage API (buckets, tables, files, branches, ...)
     management/                 # Management API (projects, features, users)
     vault/                      # Vault secrets
-    dataScience/                # Data apps, sandboxes, runtimes
+    dataScience/                # Workspace apps, sandboxes, runtimes, preview links
     editor/                     # SQL sessions, queries
     encryption/                 # Value/secret encryption
     oauth/                      # OAuth credentials
@@ -219,7 +219,7 @@ Clients backed by OpenAPI specs are marked with (OpenAPI); the rest use the gene
 | `api.management`    | Management API           | `projects.*`, `features.*`, `users.*`                                                                                                                                                                               |
 | `api.vault`         | Vault (OpenAPI)          | `getVariables()`, `createVariable()`, `deleteVariable()`, `getVariablesByBranchId()`, `getProjectWideVariables()`                                                                                                   |
 | `api.oauth`         | OAuth                    | `getCredentials()`, `getCredential()`, `createCredential()`, `deleteCredential()`                                                                                                                                   |
-| `api.dataScience`   | Data Science (OpenAPI)   | `getApps()`, `getApp()`, `createApp()`, `patchApp()`, `deleteApp()`, `getAppRuns()`, `getAppRun()`, `getAppLogsTail()`, `getAppLogsDownload()`, `getRuntimes()`, `getSandbox()`                                     |
+| `api.dataScience`   | Data Science (OpenAPI)   | `getApps()`, `getApp()`, `createAppPreviewLink()`, `getRuntimes()`, `getSandbox()`, `deleteSandbox()`                                                                                                               |
 | `api.editor`        | SQL Editor (OpenAPI)     | `createSession()`, `getSession()`, `getSessions()`, `getSessionSchema()`, `createQueryJob()`, `tablePreview()`, `tableDefinition()`, `load()`, `unload()`                                                           |
 | `api.encryption`    | Encryption               | `encrypt()`, `encryptSecrets()`                                                                                                                                                                                     |
 | `api.chat`          | Kai Assistant (OpenAPI)  | `getHistory()`, `getChat()`, `createChat()`, `deleteChat()`, `getVotes()`, `submitVote()`, `getUsage()`, `getSuggestions()`, `getAgentSettings()`, `getToolsList()`                                                 |

package/dist/{ManagementSessionMintError-DNMbYauw.js → ManagementSessionMintError-BMHDcEqV.js}

@@ -1,4 +1,4 @@
-import { p as ApiError } from "./createFetchClient-DlGCbltR.js";
+import { p as ApiError } from "./createFetchClient-Dc_ZMuq7.js";
 // src/errors/ManagementClientAuthError.ts
 var ManagementClientAuthError = class extends ApiError {
 	title;
@@ -31,4 +31,4 @@ var ManagementSessionMintError = class extends ManagementClientAuthError {
 };
 export { ManagementClientAuthError as n, ManagementSessionMintError as t };
 
-//# sourceMappingURL=ManagementSessionMintError-DNMbYauw.js.map
+//# sourceMappingURL=ManagementSessionMintError-BMHDcEqV.js.map

package/dist/{ManagementSessionMintError-DNMbYauw.js.map → ManagementSessionMintError-BMHDcEqV.js.map}

@@ -1 +1 @@
-{"version":3,"file":"ManagementSessionMintError-DNMbYauw.js","names":[],"sources":["../src/errors/ManagementClientAuthError.ts","../src/errors/ManagementSessionMintError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.name = 'ManagementClientAuthError';\n    this.title = title;\n    this.message = message;\n  }\n}\n","import { ManagementClientAuthError } from './ManagementClientAuthError';\n\n/**\n * The Manage client has no credential of its own and could not mint a session token from the\n * login cookie.\n *\n * - Only the legacy (SAPI) entry point mints; a bearer client never raises it.\n * - The login page in place of the token: the session expired, or there is no cookie (off the\n *   stack host).\n */\nexport class ManagementSessionMintError extends ManagementClientAuthError {\n  constructor({ title, message, response, request, data }: ManagementClientAuthError) {\n    super(title, message, { response, request, data });\n    this.name = 'ManagementSessionMintError';\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+C,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF;;;;;;;;;;ACHA,IAAa,6BAAb,cAAgD,0BAA0B;CACxE,YAAY,EAAE,OAAO,SAAS,UAAU,SAAS,QAAmC;EAClF,MAAM,OAAO,SAAS;GAAE;GAAU;GAAS;EAAK,CAAC;EACjD,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"ManagementSessionMintError-BMHDcEqV.js","names":[],"sources":["../src/errors/ManagementClientAuthError.ts","../src/errors/ManagementSessionMintError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.name = 'ManagementClientAuthError';\n    this.title = title;\n    this.message = message;\n  }\n}\n","import { ManagementClientAuthError } from './ManagementClientAuthError';\n\n/**\n * The Manage client has no credential of its own and could not mint a session token from the\n * login cookie.\n *\n * - Only the legacy (SAPI) entry point mints; a bearer client never raises it.\n * - The login page in place of the token: the session expired, or there is no cookie (off the\n *   stack host).\n */\nexport class ManagementSessionMintError extends ManagementClientAuthError {\n  constructor({ title, message, response, request, data }: ManagementClientAuthError) {\n    super(title, message, { response, request, data });\n    this.name = 'ManagementSessionMintError';\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+C,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF;;;;;;;;;;ACHA,IAAa,6BAAb,cAAgD,0BAA0B;CACxE,YAAY,EAAE,OAAO,SAAS,UAAU,SAAS,QAAmC;EAClF,MAAM,OAAO,SAAS;GAAE;GAAU;GAAS;EAAK,CAAC;EACjD,KAAK,OAAO;CACd;AACF"}

package/dist/{ManagementSessionMintError-ByOulHQH.cjs → ManagementSessionMintError-Bc9bc7Ai.cjs}

@@ -1,4 +1,4 @@
-const require_createFetchClient = require("./createFetchClient-DEkUH662.cjs");
+const require_createFetchClient = require("./createFetchClient-CDKSkd7i.cjs");
 // src/errors/ManagementClientAuthError.ts
 var ManagementClientAuthError = class extends require_createFetchClient.ApiError {
 	title;
@@ -42,4 +42,4 @@ Object.defineProperty(exports, "ManagementSessionMintError", {
 	}
 });
 
-//# sourceMappingURL=ManagementSessionMintError-ByOulHQH.cjs.map
+//# sourceMappingURL=ManagementSessionMintError-Bc9bc7Ai.cjs.map

package/dist/{ManagementSessionMintError-ByOulHQH.cjs.map → ManagementSessionMintError-Bc9bc7Ai.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"ManagementSessionMintError-ByOulHQH.cjs","names":["ApiError"],"sources":["../src/errors/ManagementClientAuthError.ts","../src/errors/ManagementSessionMintError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.name = 'ManagementClientAuthError';\n    this.title = title;\n    this.message = message;\n  }\n}\n","import { ManagementClientAuthError } from './ManagementClientAuthError';\n\n/**\n * The Manage client has no credential of its own and could not mint a session token from the\n * login cookie.\n *\n * - Only the legacy (SAPI) entry point mints; a bearer client never raises it.\n * - The login page in place of the token: the session expired, or there is no cookie (off the\n *   stack host).\n */\nexport class ManagementSessionMintError extends ManagementClientAuthError {\n  constructor({ title, message, response, request, data }: ManagementClientAuthError) {\n    super(title, message, { response, request, data });\n    this.name = 'ManagementSessionMintError';\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+CA,0BAAAA,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF;;;;;;;;;;ACHA,IAAa,6BAAb,cAAgD,0BAA0B;CACxE,YAAY,EAAE,OAAO,SAAS,UAAU,SAAS,QAAmC;EAClF,MAAM,OAAO,SAAS;GAAE;GAAU;GAAS;EAAK,CAAC;EACjD,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"ManagementSessionMintError-Bc9bc7Ai.cjs","names":["ApiError"],"sources":["../src/errors/ManagementClientAuthError.ts","../src/errors/ManagementSessionMintError.ts"],"sourcesContent":["import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nexport class ManagementClientAuthError extends ApiError {\n  title: string;\n  message: string;\n  constructor(title: string, message: string, res: ApiResponse) {\n    super(res);\n    this.name = 'ManagementClientAuthError';\n    this.title = title;\n    this.message = message;\n  }\n}\n","import { ManagementClientAuthError } from './ManagementClientAuthError';\n\n/**\n * The Manage client has no credential of its own and could not mint a session token from the\n * login cookie.\n *\n * - Only the legacy (SAPI) entry point mints; a bearer client never raises it.\n * - The login page in place of the token: the session expired, or there is no cookie (off the\n *   stack host).\n */\nexport class ManagementSessionMintError extends ManagementClientAuthError {\n  constructor({ title, message, response, request, data }: ManagementClientAuthError) {\n    super(title, message, { response, request, data });\n    this.name = 'ManagementSessionMintError';\n  }\n}\n"],"mappings":";;AAIA,IAAa,4BAAb,cAA+CA,0BAAAA,SAAS;CACtD;CACA;CACA,YAAY,OAAe,SAAiB,KAAkB;EAC5D,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,UAAU;CACjB;AACF;;;;;;;;;;ACHA,IAAa,6BAAb,cAAgD,0BAA0B;CACxE,YAAY,EAAE,OAAO,SAAS,UAAU,SAAS,QAAmC;EAClF,MAAM,OAAO,SAAS;GAAE;GAAU;GAAS;EAAK,CAAC;EACjD,KAAK,OAAO;CACd;AACF"}

package/dist/RowLevelSecurityError-CObFqj3E.js

@@ -0,0 +1,33 @@
+import { p as ApiError } from "./createFetchClient-Dc_ZMuq7.js";
+// src/errors/QueryJobError.ts
+/**
+* A query job that reached the API's terminal `failed` state — the submit/poll round-trip
+* succeeded, the job itself did not. Distinct from {@link ApiError}, which is an HTTP-level failure
+* of the submit/poll/results requests themselves.
+*/
+var QueryJobError = class QueryJobError extends Error {
+	queryJobId;
+	failedStatements;
+	constructor(message, queryJobId, { failedStatements }) {
+		super(message);
+		this.name = "QueryJobError";
+		this.queryJobId = queryJobId;
+		this.failedStatements = failedStatements;
+		Object.setPrototypeOf(this, QueryJobError.prototype);
+	}
+};
+const isQueryJobError = (error) => error instanceof QueryJobError;
+// src/errors/RowLevelSecurityError.ts
+const exceptionOf = (data) => typeof data === "object" && data !== null && "exception" in data && typeof data.exception === "string" ? data.exception : void 0;
+/** Query Service refused a query on a governed workspace for the identity it was sent with. */
+var RowLevelSecurityError = class extends ApiError {
+	constructor(res) {
+		super(res);
+		this.name = "RowLevelSecurityError";
+		this.message = exceptionOf(res.data) ?? this.message;
+	}
+};
+const isRowLevelSecurityError = (error) => error instanceof RowLevelSecurityError;
+export { isQueryJobError as i, isRowLevelSecurityError as n, QueryJobError as r, RowLevelSecurityError as t };
+
+//# sourceMappingURL=RowLevelSecurityError-CObFqj3E.js.map

package/dist/RowLevelSecurityError-CObFqj3E.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RowLevelSecurityError-CObFqj3E.js","names":[],"sources":["../src/errors/QueryJobError.ts","../src/errors/RowLevelSecurityError.ts"],"sourcesContent":["type FailedStatement = {\n  id: string;\n  error?: string;\n};\n\ntype QueryJobErrorOptions = {\n  failedStatements: FailedStatement[];\n};\n\n/**\n * A query job that reached the API's terminal `failed` state — the submit/poll round-trip\n * succeeded, the job itself did not. Distinct from {@link ApiError}, which is an HTTP-level failure\n * of the submit/poll/results requests themselves.\n */\nexport class QueryJobError extends Error {\n  queryJobId: string;\n  failedStatements: FailedStatement[];\n\n  constructor(message: string, queryJobId: string, { failedStatements }: QueryJobErrorOptions) {\n    super(message);\n    this.name = 'QueryJobError';\n    this.queryJobId = queryJobId;\n    this.failedStatements = failedStatements;\n    Object.setPrototypeOf(this, QueryJobError.prototype);\n  }\n}\n\nexport const isQueryJobError = (error: unknown): error is QueryJobError =>\n  error instanceof QueryJobError;\n","import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nconst exceptionOf = (data: unknown) =>\n  typeof data === 'object' &&\n  data !== null &&\n  'exception' in data &&\n  typeof data.exception === 'string'\n    ? data.exception\n    : undefined;\n\n/** Query Service refused a query on a governed workspace for the identity it was sent with. */\nexport class RowLevelSecurityError extends ApiError {\n  constructor(res: ApiResponse) {\n    super(res);\n    this.name = 'RowLevelSecurityError';\n    this.message = exceptionOf(res.data) ?? this.message;\n  }\n}\n\nexport const isRowLevelSecurityError = (error: unknown): error is RowLevelSecurityError =>\n  error instanceof RowLevelSecurityError;\n"],"mappings":";;;;;;;AAcA,IAAa,gBAAb,MAAa,sBAAsB,MAAM;CACvC;CACA;CAEA,YAAY,SAAiB,YAAoB,EAAE,oBAA0C;EAC3F,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,mBAAmB;EACxB,OAAO,eAAe,MAAM,cAAc,SAAS;CACrD;AACF;AAEA,MAAa,mBAAmB,UAC9B,iBAAiB;;ACxBnB,MAAM,eAAe,SACnB,OAAO,SAAS,YAChB,SAAS,QACT,eAAe,QACf,OAAO,KAAK,cAAc,WACtB,KAAK,YACL,KAAA;;AAGN,IAAa,wBAAb,cAA2C,SAAS;CAClD,YAAY,KAAkB;EAC5B,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,UAAU,YAAY,IAAI,IAAI,KAAK,KAAK;CAC/C;AACF;AAEA,MAAa,2BAA2B,UACtC,iBAAiB"}

package/dist/RowLevelSecurityError-RK_NhhAx.cjs

@@ -0,0 +1,56 @@
+const require_createFetchClient = require("./createFetchClient-CDKSkd7i.cjs");
+// src/errors/QueryJobError.ts
+/**
+* A query job that reached the API's terminal `failed` state — the submit/poll round-trip
+* succeeded, the job itself did not. Distinct from {@link ApiError}, which is an HTTP-level failure
+* of the submit/poll/results requests themselves.
+*/
+var QueryJobError = class QueryJobError extends Error {
+	queryJobId;
+	failedStatements;
+	constructor(message, queryJobId, { failedStatements }) {
+		super(message);
+		this.name = "QueryJobError";
+		this.queryJobId = queryJobId;
+		this.failedStatements = failedStatements;
+		Object.setPrototypeOf(this, QueryJobError.prototype);
+	}
+};
+const isQueryJobError = (error) => error instanceof QueryJobError;
+// src/errors/RowLevelSecurityError.ts
+const exceptionOf = (data) => typeof data === "object" && data !== null && "exception" in data && typeof data.exception === "string" ? data.exception : void 0;
+/** Query Service refused a query on a governed workspace for the identity it was sent with. */
+var RowLevelSecurityError = class extends require_createFetchClient.ApiError {
+	constructor(res) {
+		super(res);
+		this.name = "RowLevelSecurityError";
+		this.message = exceptionOf(res.data) ?? this.message;
+	}
+};
+const isRowLevelSecurityError = (error) => error instanceof RowLevelSecurityError;
+Object.defineProperty(exports, "QueryJobError", {
+	enumerable: true,
+	get: function() {
+		return QueryJobError;
+	}
+});
+Object.defineProperty(exports, "RowLevelSecurityError", {
+	enumerable: true,
+	get: function() {
+		return RowLevelSecurityError;
+	}
+});
+Object.defineProperty(exports, "isQueryJobError", {
+	enumerable: true,
+	get: function() {
+		return isQueryJobError;
+	}
+});
+Object.defineProperty(exports, "isRowLevelSecurityError", {
+	enumerable: true,
+	get: function() {
+		return isRowLevelSecurityError;
+	}
+});
+
+//# sourceMappingURL=RowLevelSecurityError-RK_NhhAx.cjs.map

package/dist/RowLevelSecurityError-RK_NhhAx.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RowLevelSecurityError-RK_NhhAx.cjs","names":["ApiError"],"sources":["../src/errors/QueryJobError.ts","../src/errors/RowLevelSecurityError.ts"],"sourcesContent":["type FailedStatement = {\n  id: string;\n  error?: string;\n};\n\ntype QueryJobErrorOptions = {\n  failedStatements: FailedStatement[];\n};\n\n/**\n * A query job that reached the API's terminal `failed` state — the submit/poll round-trip\n * succeeded, the job itself did not. Distinct from {@link ApiError}, which is an HTTP-level failure\n * of the submit/poll/results requests themselves.\n */\nexport class QueryJobError extends Error {\n  queryJobId: string;\n  failedStatements: FailedStatement[];\n\n  constructor(message: string, queryJobId: string, { failedStatements }: QueryJobErrorOptions) {\n    super(message);\n    this.name = 'QueryJobError';\n    this.queryJobId = queryJobId;\n    this.failedStatements = failedStatements;\n    Object.setPrototypeOf(this, QueryJobError.prototype);\n  }\n}\n\nexport const isQueryJobError = (error: unknown): error is QueryJobError =>\n  error instanceof QueryJobError;\n","import type { ApiResponse } from '../fetchClient/createFetchClient/types';\n\nimport { ApiError } from './ApiError';\n\nconst exceptionOf = (data: unknown) =>\n  typeof data === 'object' &&\n  data !== null &&\n  'exception' in data &&\n  typeof data.exception === 'string'\n    ? data.exception\n    : undefined;\n\n/** Query Service refused a query on a governed workspace for the identity it was sent with. */\nexport class RowLevelSecurityError extends ApiError {\n  constructor(res: ApiResponse) {\n    super(res);\n    this.name = 'RowLevelSecurityError';\n    this.message = exceptionOf(res.data) ?? this.message;\n  }\n}\n\nexport const isRowLevelSecurityError = (error: unknown): error is RowLevelSecurityError =>\n  error instanceof RowLevelSecurityError;\n"],"mappings":";;;;;;;AAcA,IAAa,gBAAb,MAAa,sBAAsB,MAAM;CACvC;CACA;CAEA,YAAY,SAAiB,YAAoB,EAAE,oBAA0C;EAC3F,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,mBAAmB;EACxB,OAAO,eAAe,MAAM,cAAc,SAAS;CACrD;AACF;AAEA,MAAa,mBAAmB,UAC9B,iBAAiB;;ACxBnB,MAAM,eAAe,SACnB,OAAO,SAAS,YAChB,SAAS,QACT,eAAe,QACf,OAAO,KAAK,cAAc,WACtB,KAAK,YACL,KAAA;;AAGN,IAAa,wBAAb,cAA2CA,0BAAAA,SAAS;CAClD,YAAY,KAAkB;EAC5B,MAAM,GAAG;EACT,KAAK,OAAO;EACZ,KAAK,UAAU,YAAY,IAAI,IAAI,KAAK,KAAK;CAC/C;AACF;AAEA,MAAa,2BAA2B,UACtC,iBAAiB"}

package/dist/{adminRoles-FFyl7Dyx.d.cts → adminRoles-BTKVwEy8.d.cts}

@@ -1,4 +1,4 @@
-import { Lr as paths, l as OpenapiReturnType } from "./index-D1mduJne.cjs";
+import { Lr as paths, l as OpenapiReturnType } from "./index-FrsEkDvX.cjs";
 type SpecAdminRole = NonNullable<NonNullable<OpenapiReturnType<paths['/v2/storage/tokens/verify']['get']>['admin']>['role']>;
 declare const AdminRole: {
   readonly Admin: 'admin';
@@ -11,4 +11,4 @@ declare const AdminRole: {
 };
 type AdminRole = SpecAdminRole;
 export { AdminRole as t };
-//# sourceMappingURL=adminRoles-FFyl7Dyx.d.cts.map
+//# sourceMappingURL=adminRoles-BTKVwEy8.d.cts.map

package/dist/{adminRoles-DAwl657q.d.ts → adminRoles-Cm513r1G.d.ts}

@@ -1,4 +1,4 @@
-import { Lr as paths, l as OpenapiReturnType } from "./index-D1mduJne.js";
+import { Lr as paths, l as OpenapiReturnType } from "./index-FrsEkDvX.js";
 type SpecAdminRole = NonNullable<NonNullable<OpenapiReturnType<paths['/v2/storage/tokens/verify']['get']>['admin']>['role']>;
 declare const AdminRole: {
   readonly Admin: 'admin';
@@ -11,4 +11,4 @@ declare const AdminRole: {
 };
 type AdminRole = SpecAdminRole;
 export { AdminRole as t };
-//# sourceMappingURL=adminRoles-DAwl657q.d.ts.map
+//# sourceMappingURL=adminRoles-Cm513r1G.d.ts.map

package/dist/ai/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-DL9w7vU-.cjs");
-const require_auth = require("../auth-CvB4MukT.cjs");
+const require_createOpenapiFetchClient = require("../createOpenapiFetchClient-dkssExkU.cjs");
+const require_auth = require("../auth-AehUDNRK.cjs");
 // src/clients/ai/aiClient.ts
 const createAiClient = ({ baseUrl, middlewares, auth }) => {
 	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({

package/dist/ai/index.d.cts

@@ -1,5 +1,5 @@
-import { a as DescribeConfigurationVersionBody, d as SuggestComponentBody, f as components, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, r as DescribeConfigurationBody, s as DocsQuestionBody } from "../types-BE8abIig.cjs";
-import { n as ClientInitOptions } from "../types-Dryq2GGE.cjs";
+import { a as DescribeConfigurationVersionBody, d as SuggestComponentBody, f as components, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, r as DescribeConfigurationBody, s as DocsQuestionBody } from "../types-DKKHKj19.cjs";
+import { n as ClientInitOptions } from "../types-B4ezB18r.cjs";
 declare const createAiClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<{
     status: 'ok';

package/dist/ai/index.d.ts

@@ -1,5 +1,5 @@
-import { a as DescribeConfigurationVersionBody, d as SuggestComponentBody, f as components, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, r as DescribeConfigurationBody, s as DocsQuestionBody } from "../types-inG9y3dP.js";
-import { n as ClientInitOptions } from "../types-DUpVIuk7.js";
+import { a as DescribeConfigurationVersionBody, d as SuggestComponentBody, f as components, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, r as DescribeConfigurationBody, s as DocsQuestionBody } from "../types-D5bxXqEU.js";
+import { n as ClientInitOptions } from "../types-Tg3euEN_.js";
 declare const createAiClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {
   healthCheck: (signal?: AbortSignal) => Promise<{
     status: 'ok';

package/dist/ai/index.js

@@ -1,5 +1,5 @@
-import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-Bhz62MUE.js";
-import { t as createAuthHeaders } from "../auth-DYfQMQCs.js";
+import { t as createOpenapiFetchClient } from "../createOpenapiFetchClient-DSk29o_s.js";
+import { t as createAuthHeaders } from "../auth-ZBQWCJPM.js";
 // src/clients/ai/aiClient.ts
 const createAiClient = ({ baseUrl, middlewares, auth }) => {
 	const client = createOpenapiFetchClient({

package/dist/ai/types.d.cts

@@ -1,2 +1,2 @@
-import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as ObjectDescription } from "../types-BE8abIig.cjs";
+import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as ObjectDescription } from "../types-DKKHKj19.cjs";
 export { ComponentDocsDetail, ComponentSuggestion, DescribeConfigurationBody, DescribeConfigurationMergeBody, DescribeConfigurationVersionBody, DocsAnswer, DocsQuestionBody, ErrorExplanation, ExplainErrorBody, ObjectDescription, SuggestComponentBody };

package/dist/ai/types.d.ts

@@ -1,2 +1,2 @@
-import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as ObjectDescription } from "../types-inG9y3dP.js";
+import { a as DescribeConfigurationVersionBody, c as ErrorExplanation, d as SuggestComponentBody, i as DescribeConfigurationMergeBody, l as ExplainErrorBody, n as ComponentSuggestion, o as DocsAnswer, r as DescribeConfigurationBody, s as DocsQuestionBody, t as ComponentDocsDetail, u as ObjectDescription } from "../types-D5bxXqEU.js";
 export { ComponentDocsDetail, ComponentSuggestion, DescribeConfigurationBody, DescribeConfigurationMergeBody, DescribeConfigurationVersionBody, DocsAnswer, DocsQuestionBody, ErrorExplanation, ExplainErrorBody, ObjectDescription, SuggestComponentBody };