@keboola/api-client 52.0.0 → 54.0.0

package/dist/sdk/dataAppServer/index.js

@@ -0,0 +1,228 @@
+import { _ as HttpStatus, m as APP_USER_TOKEN_HEADER } from "../../createFetchClient-Dc_ZMuq7.js";
+import { t as createStorageClient } from "../../storage--2FvvLAw.js";
+import { n as isRowLevelSecurityError } from "../../RowLevelSecurityError-CObFqj3E.js";
+import { u as lazy } from "../../transientRetries-BORv47mH.js";
+import { t as isPlainObject } from "../../isPlainObject-BxsT8_t2.js";
+import { t as ServiceId } from "../../serviceIds-RAVtP4nK.js";
+import { t as createQueryServiceClient } from "../../queryService-DQHtHy2-.js";
+import { n as createQueryServiceSdk, t as cellParser } from "../../queryService-DE_yE_S4.js";
+import { t as readJwtClaims } from "../../readJwtClaims-CMZ3cNC_.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { readFile } from "node:fs/promises";
+// src/sdks/dataAppServer/express.ts
+/** Answers a row-level security refusal with 403 and passes any other error on. */
+const createExpressErrorHandler = () => (err, _req, res, next) => {
+	if (res.headersSent || !isRowLevelSecurityError(err)) {
+		next(err);
+		return;
+	}
+	res.status(HttpStatus.FORBIDDEN).json({
+		error: err.message,
+		code: "ROW_LEVEL_SECURITY"
+	});
+};
+// src/sdks/dataAppServer/requestContext.ts
+const isHeadersLike = (headers) => "get" in headers && typeof headers.get === "function";
+const appUserTokenOf = (request) => {
+	const headers = "headers" in request ? request.headers : request;
+	if (isHeadersLike(headers)) return headers.get("X-Kbc-App-User-Token") || void 0;
+	const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];
+	return (Array.isArray(value) ? value[0] : value) || void 0;
+};
+const userOf = (token) => {
+	const { idp, sub, email } = readJwtClaims(token) ?? {};
+	if (typeof idp !== "string" || typeof sub !== "string" || !idp || !sub) return void 0;
+	return typeof email === "string" && email ? {
+		idp,
+		sub,
+		email
+	} : {
+		idp,
+		sub
+	};
+};
+/**
+* The signed-in user of the request being handled, kept across every `await` the request makes.
+*
+* - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.
+* - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.
+* - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.
+*/
+const createRequestContext = () => {
+	const storage = new AsyncLocalStorage();
+	const current = () => storage.getStore();
+	return {
+		runWithRequest: (request, fn) => {
+			const appUserToken = appUserTokenOf(request);
+			return storage.run({
+				appUserToken,
+				user: appUserToken ? userOf(appUserToken) : void 0
+			}, fn);
+		},
+		current,
+		currentUser: () => current()?.user,
+		currentUserKey: () => {
+			const user = current()?.user;
+			return user && JSON.stringify([user.idp, user.sub]);
+		}
+	};
+};
+// src/sdks/dataAppServer/runQuery.ts
+const PAGE_SIZE = 1e4;
+const TIMEOUT = 6e4;
+const refusalWarning = (scope) => {
+	const prefix = "[dataAppServer] row-level security refused";
+	if (scope?.appUserToken) return `${prefix} the query for this user`;
+	return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${scope ? "the request has none" : "it ran outside a user request (startup, timer, background job)"}`;
+};
+const toRecords = ({ columns = [], data = [], numberOfRows }, capped) => {
+	const parsers = columns.map(({ name, type }) => ({
+		key: name.toLowerCase(),
+		parse: cellParser(type)
+	}));
+	const keys = /* @__PURE__ */ new Set();
+	for (const { key } of parsers) {
+		if (keys.has(key)) throw new Error(`runQuery: two columns are named "${key}"; alias one with AS`);
+		keys.add(key);
+	}
+	const rows = data.map((row) => {
+		const record = {};
+		parsers.forEach(({ key, parse }, i) => {
+			const cell = row[i];
+			record[key] = cell == null ? null : parse(cell);
+		});
+		return record;
+	});
+	if (!capped && numberOfRows !== void 0 && rows.length < numberOfRows) throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);
+	return rows;
+};
+/**
+* Runs one SQL statement in the app's workspace and resolves every row as a record.
+*
+* - Sends the request's user token with the app's Storage token; without a user, the Storage token.
+* - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.
+*/
+const createRunQuery = (settings, requestContext) => {
+	const queryService = createQueryServiceSdk({ queryServiceClient: createQueryServiceClient({
+		baseUrl: settings.queryServiceUrl,
+		auth: async () => {
+			const storageToken = await settings.storageToken();
+			const appUserToken = requestContext.current()?.appUserToken;
+			return appUserToken ? {
+				type: "app-user-token",
+				token: appUserToken,
+				storageToken
+			} : {
+				type: "sapi-token",
+				token: storageToken
+			};
+		}
+	}) });
+	return async (sql, options = {}) => {
+		const scope = requestContext.current();
+		const [result] = await queryService.executeQuery(settings.branchId(), await settings.workspaceId(), {
+			statements: [sql],
+			transactional: false
+		}, {
+			...options,
+			pageSize: PAGE_SIZE,
+			timeout: options.timeout ?? TIMEOUT
+		}).catch((error) => {
+			if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));
+			throw error;
+		});
+		return result ? toRecords(result, options.maxRows !== void 0) : [];
+	};
+};
+// src/sdks/dataAppServer/settings.ts
+/** A setting the app needs is missing or unreadable; the message names the variable or file. */
+var AppConfigError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "AppConfigError";
+	}
+};
+const STACK_INDEX_TIMEOUT = 1e4;
+const required = (env, name) => {
+	const value = env[name];
+	if (!value) throw new AppConfigError(`Missing environment variable ${name}`);
+	return value;
+};
+const storageTokenFrom = async (env) => {
+	const file = env.STORAGE_API_TOKEN_PATH;
+	if (!file) {
+		if (env.KBC_TOKEN) return env.KBC_TOKEN;
+		throw new AppConfigError("Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN");
+	}
+	const token = (await readFile(file, "utf8").catch((error) => {
+		throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, { cause: error });
+	})).trim();
+	if (!token) throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);
+	return token;
+};
+const manifestWorkspaceId = async (file) => {
+	let manifest;
+	try {
+		manifest = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, { cause: error });
+	}
+	const id = isPlainObject(manifest) ? manifest.workspaceId : void 0;
+	if (typeof id === "string" && id || typeof id === "number") return String(id);
+	throw new AppConfigError(`The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`);
+};
+const queryServiceUrlFromIndex = async (kbcUrl, token) => {
+	const { services } = await createStorageClient({
+		baseUrl: kbcUrl,
+		auth: {
+			type: "sapi-token",
+			token
+		}
+	}).getStackInfo({ exclude: "components" }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));
+	const url = services.find(({ id }) => id === ServiceId.Query)?.url;
+	if (!url) throw new AppConfigError("The stack index of KBC_URL lists no query service");
+	return url;
+};
+/**
+* What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.
+*
+* - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.
+* - The workspace ID and the Query Service URL are read once per process.
+* - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).
+*/
+const createSettings = (env) => {
+	const storageToken = () => storageTokenFrom(env);
+	const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;
+	return {
+		branchId: () => required(env, "BRANCH_ID"),
+		storageToken,
+		workspaceId: lazy(() => manifest ? manifestWorkspaceId(manifest) : required(env, "WORKSPACE_ID")),
+		queryServiceUrl: lazy(async () => env.QUERY_SERVICE_URL || queryServiceUrlFromIndex(required(env, "KBC_URL"), await storageToken())),
+		hasWorkspace: Boolean(manifest || env.WORKSPACE_ID)
+	};
+};
+// src/sdks/dataAppServer/initializeApp.ts
+/**
+* Sets up Keboola access for this data app process; call it once.
+*
+* - Synchronous, no network call, never throws: each setting is read on first use.
+* - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).
+* - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.
+*/
+const initializeApp = ({ env = process.env } = {}) => {
+	const settings = createSettings(env);
+	const requestContext = createRequestContext();
+	return {
+		server: {
+			runWithRequest: requestContext.runWithRequest,
+			currentUser: requestContext.currentUser,
+			currentUserKey: requestContext.currentUserKey,
+			expressMiddleware: () => (req, _res, next) => requestContext.runWithRequest(req, next),
+			expressErrorHandler: createExpressErrorHandler
+		},
+		workspace: settings.hasWorkspace ? { runQuery: createRunQuery(settings, requestContext) } : void 0
+	};
+};
+export { AppConfigError, initializeApp };
+
+//# sourceMappingURL=index.js.map

package/dist/sdk/dataAppServer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: object): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { cellParser, createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAAC,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAO,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQ,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAU,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAI,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AClDA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwB,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAO,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAe,sBAAsB,EACzC,oBAAoB,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAI,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;ACzEA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,MALQ,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAK,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAM,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAO,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAa,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiB,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}

package/dist/sdk/developerPortal/index.cjs

@@ -4,6 +4,7 @@ const require_dedupe = require("../../dedupe-Bf0gl9TJ.cjs");
 const require_store = require("../../store-2OyH1XOP.cjs");
 const require_middleware = require("../../middleware-vIaPDtQI.cjs");
 const require_developerPortalClient = require("../../developerPortalClient-BcK9F-Fs.cjs");
+const require_readJwtClaims = require("../../readJwtClaims-SVJgo04x.cjs");
 // src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -13,21 +14,8 @@ const require_developerPortalClient = require("../../developerPortalClient-BcK9F
 * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.
 */
 const readTokenExpiry = (token) => {
-	const segments = token.split(".");
-	if (segments.length !== 3) return null;
-	const payload = segments[1];
-	if (payload === void 0 || payload === "") return null;
-	try {
-		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
-		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-		const claims = JSON.parse(atob(padded));
-		if (typeof claims !== "object" || claims === null || !("exp" in claims)) return null;
-		const { exp } = claims;
-		if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
-		return exp * 1e3;
-	} catch {
-		return null;
-	}
+	const exp = require_readJwtClaims.readJwtClaims(token)?.exp;
+	return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
 };
 // src/sdks/developerPortal/credential.ts
 const DEFAULT_REFRESH_LEAD_TIME_MS = 3e5;

package/dist/sdk/developerPortal/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIA,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.cjs","names":["readJwtClaims","isUnauthorized","dedupe","HttpHeader","isUnauthorized","createStore","createDeveloperPortalClient"],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["import { readJwtClaims } from '../../utils/readJwtClaims';\n\n/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const exp = readJwtClaims(token)?.exp;\n  return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;;AASA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,MAAMA,sBAAAA,cAAc,KAAK,CAAC,EAAE;CAClC,OAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AACxE;;ACOA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAIC,mBAAAA,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgBC,eAAAA,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAIC,0BAAAA,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAACC,mBAAAA,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAID,0BAAAA,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAIC,mBAAAA,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQC,cAAAA,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgBC,8BAAAA,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAASA,8BAAAA,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/developerPortal/index.js

@@ -3,6 +3,7 @@ import { t as dedupe } from "../../dedupe-Bu0d2i_w.js";
 import { t as createStore } from "../../store-HP0zRcLz.js";
 import { n as isUnauthorized } from "../../middleware-DxGv7DG8.js";
 import { t as createDeveloperPortalClient } from "../../developerPortalClient-CzCJ5sE3.js";
+import { t as readJwtClaims } from "../../readJwtClaims-CMZ3cNC_.js";
 // src/sdks/developerPortal/tokenExpiry.ts
 /**
 * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable ("expiry unknown", which the
@@ -12,21 +13,8 @@ import { t as createDeveloperPortalClient } from "../../developerPortalClient-Cz
 * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.
 */
 const readTokenExpiry = (token) => {
-	const segments = token.split(".");
-	if (segments.length !== 3) return null;
-	const payload = segments[1];
-	if (payload === void 0 || payload === "") return null;
-	try {
-		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
-		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
-		const claims = JSON.parse(atob(padded));
-		if (typeof claims !== "object" || claims === null || !("exp" in claims)) return null;
-		const { exp } = claims;
-		if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
-		return exp * 1e3;
-	} catch {
-		return null;
-	}
+	const exp = readJwtClaims(token)?.exp;
+	return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
 };
 // src/sdks/developerPortal/credential.ts
 const DEFAULT_REFRESH_LEAD_TIME_MS = 3e5;

package/dist/sdk/developerPortal/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const segments = token.split('.');\n  if (segments.length !== 3) return null;\n\n  const payload = segments[1];\n  if (payload === undefined || payload === '') return null;\n\n  try {\n    // base64url -> base64, and re-pad: `atob` requires padding, base64url omits it.\n    const base64 = payload.replaceAll('-', '+').replaceAll('_', '/');\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');\n    const claims: unknown = JSON.parse(atob(padded));\n    if (typeof claims !== 'object' || claims === null || !('exp' in claims)) return null;\n    const { exp } = claims as { exp: unknown };\n    if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;\n    return exp * 1000;\n  } catch {\n    return null;\n  }\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;AAOA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,WAAW,MAAM,MAAM,GAAG;CAChC,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,UAAU,SAAS;CACzB,IAAI,YAAY,KAAA,KAAa,YAAY,IAAI,OAAO;CAEpD,IAAI;EAEF,MAAM,SAAS,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG;EAC/D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;EACjF,MAAM,SAAkB,KAAK,MAAM,KAAK,MAAM,CAAC;EAC/C,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,SAAS,SAAS,OAAO;EAChF,MAAM,EAAE,QAAQ;EAChB,IAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,GAAG,GAAG,OAAO;EAC7D,OAAO,MAAM;CACf,QAAQ;EACN,OAAO;CACT;AACF;;ACPA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/sdks/developerPortal/tokenExpiry.ts","../../../src/sdks/developerPortal/credential.ts","../../../src/sdks/developerPortal/middleware.ts","../../../src/sdks/developerPortal/developerPortalSdk.ts"],"sourcesContent":["import { readJwtClaims } from '../../utils/readJwtClaims';\n\n/**\n * Reads a JWT's `exp` claim as milliseconds, or `null` when unparseable (\"expiry unknown\", which the\n * caller leaves to the 401 path). A read, not a verification.\n *\n * Needed because apps-api reports `expiresIn` on login but never on refresh, so it cannot keep a\n * proactive-refresh clock honest past the first rotation. The token always carries its own expiry.\n */\nexport const readTokenExpiry = (token: string): number | null => {\n  const exp = readJwtClaims(token)?.exp;\n  return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n};\n","import type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\nimport { dedupe } from '../../utils';\n\nimport { readTokenExpiry } from './tokenExpiry';\n\ntype Options = {\n  refresh: () => Promise<DeveloperPortalTokens>;\n  /** Live read from the session, so this holds no token of its own. `null` when signed out. */\n  getTokens: () => DeveloperPortalTokens | null;\n  /** May fire more than once; the caller owns any fire-once latch. */\n  onSessionExpired?: () => void;\n  /**\n   * An absolute lead time rather than `createBearerCredential`'s fractional threshold: that needs the\n   * token's full lifetime, and apps-api reports `expiresIn` on login only, never on refresh.\n   */\n  refreshLeadTimeMs?: number;\n};\n\nconst DEFAULT_REFRESH_LEAD_TIME_MS = 5 * 60 * 1000;\n\nexport type DeveloperPortalCredential = {\n  getIdToken: (options?: { forceRefresh?: boolean }) => Promise<string | null>;\n  getTokens: () => DeveloperPortalTokens | null;\n  notifyExpired: () => void;\n};\n\n/** Mirrors `createBearerCredential`, over the id token of the trio. */\nexport const createDeveloperPortalCredential = ({\n  refresh,\n  getTokens,\n  onSessionExpired,\n  refreshLeadTimeMs = DEFAULT_REFRESH_LEAD_TIME_MS,\n}: Options): DeveloperPortalCredential => {\n  const doRefresh = async (): Promise<DeveloperPortalTokens> => {\n    try {\n      return await refresh();\n    } catch (error) {\n      // Only a 401 means the refresh token is dead. Signing out over a 5xx would be a self-inflicted\n      // logout, so anything else propagates without expiring the session.\n      if (isUnauthorized(error)) onSessionExpired?.();\n      throw error;\n    }\n  };\n\n  // N concurrent 401s must cause one rotation: each extra one invalidates the tokens the others got.\n  const refreshShared = dedupe(doRefresh);\n\n  const getIdToken = async ({ forceRefresh = false } = {}): Promise<string | null> => {\n    const tokens = getTokens();\n    if (tokens === null) return null;\n    if (forceRefresh) return (await refreshShared()).token;\n\n    const expiresAt = readTokenExpiry(tokens.token);\n    // Unknown expiry is left to the 401 path; a `0` here would rotate on every request.\n    if (expiresAt === null) return tokens.token;\n    if (Date.now() < expiresAt - refreshLeadTimeMs) return tokens.token;\n\n    // Proactive rotation is best-effort — a real 401 drives the mandatory one.\n    return refreshShared()\n      .then((fresh) => fresh.token)\n      .catch(() => tokens.token);\n  };\n\n  return { getIdToken, getTokens, notifyExpired: () => onSessionExpired?.() };\n};\n","import { HttpHeader, type MiddlewareFn } from '../../fetchClient';\nimport { isUnauthorized } from '../../keboola/bearer/credentials';\n\nimport type { DeveloperPortalCredential } from './credential';\n\n/**\n * Stamps the id token, and on a 401 force-refreshes and replays once. Mirrors\n * `createBearerAuthMiddleware`, minus the `Bearer ` prefix apps-api does not use.\n *\n * An anonymous session passes through unstamped, so a failed login is never read as session expiry.\n */\nexport const createDeveloperPortalAuthMiddleware = (\n  credential: DeveloperPortalCredential,\n): MiddlewareFn => {\n  return (next) => async (request) => {\n    const token = await credential.getIdToken();\n    if (token === null) return next(request);\n\n    // Cloned before the first attempt consumes the body. Cloning the `Request` carries a binary or\n    // FormData payload through byte-for-byte.\n    const retryRequest = request.request.clone();\n    request.request.headers.set(HttpHeader.AUTHORIZATION, token);\n\n    try {\n      return await next(request);\n    } catch (error) {\n      if (!isUnauthorized(error)) throw error;\n\n      const refreshed = await credential.getIdToken({ forceRefresh: true }).catch(() => null);\n      // Nothing to replay with, because a concurrent sign-out landed or the rotation failed. The\n      // caller's request failed with a 401, so that is what they see.\n      if (refreshed === null) throw error;\n      retryRequest.headers.set(HttpHeader.AUTHORIZATION, refreshed);\n\n      try {\n        return await next({ ...request, request: retryRequest });\n      } catch (retryError) {\n        if (isUnauthorized(retryError)) credential.notifyExpired();\n        throw retryError;\n      }\n    }\n  };\n};\n","import { createDeveloperPortalClient } from '../../clients/developerPortal/developerPortalClient';\nimport type { DeveloperPortalTokens } from '../../clients/developerPortal/tokens';\nimport type { LoginSuccess } from '../../clients/developerPortal/types';\nimport type { MiddlewareFn } from '../../fetchClient';\nimport { createStore } from '../../utils';\n\nimport { createDeveloperPortalCredential } from './credential';\nimport { createDeveloperPortalAuthMiddleware } from './middleware';\n\nexport type DeveloperPortalSdkOptions = {\n  baseUrl: string;\n  /** Session to restore on construction. */\n  tokens?: DeveloperPortalTokens | null;\n  /** Persistence hook, fired on sign-in, every rotation, and with `null` on sign-out or expiry. */\n  onTokensChange?: (tokens: DeveloperPortalTokens | null) => void;\n  /** The session is dead; tokens are already cleared. The consumer redirects to sign-in. */\n  onSessionExpired?: () => void;\n  refreshLeadTimeMs?: number;\n  middlewares?: MiddlewareFn[];\n};\n\n/**\n * `createDeveloperPortalClient` plus the session that keeps it authenticated.\n *\n * - Builds its own client: middleware, credential and session depend on each other in a cycle.\n */\nexport const createDeveloperPortalSdk = ({\n  baseUrl,\n  tokens: initialTokens = null,\n  onTokensChange,\n  onSessionExpired,\n  refreshLeadTimeMs,\n  middlewares = [],\n}: DeveloperPortalSdkOptions) => {\n  const store = createStore<DeveloperPortalTokens | null>(initialTokens);\n  store.subscribe((value) => onTokensChange?.(value));\n\n  const getTokens = () => store.get();\n\n  const requireTokens = (action: string): DeveloperPortalTokens => {\n    const tokens = store.get();\n    if (tokens === null) {\n      throw new Error(`Developer Portal: ${action} requires a signed-in session.`);\n    }\n    return tokens;\n  };\n\n  // No auth middleware, so a rotation cannot recurse into the middleware that triggered it.\n  const refreshClient = createDeveloperPortalClient({ baseUrl, middlewares });\n\n  const refresh = async (): Promise<DeveloperPortalTokens> => {\n    const before = store.get();\n    if (before === null) {\n      throw new Error('Cannot refresh the Developer Portal session: signed out.');\n    }\n\n    const { token, accessToken } = await refreshClient.auth.refreshTokens(before.refreshToken);\n    const next: DeveloperPortalTokens = { token, accessToken, refreshToken: before.refreshToken };\n\n    // Sign-out wins over an in-flight rotation; otherwise the response signs the user back in.\n    const after = store.get();\n    if (after === null || after.refreshToken !== before.refreshToken) {\n      throw new Error('Developer Portal session changed while refreshing; discarding the result.');\n    }\n\n    store.set(next);\n    return next;\n  };\n\n  const clear = () => store.set(null);\n\n  const credential = createDeveloperPortalCredential({\n    refresh,\n    getTokens,\n    refreshLeadTimeMs,\n    onSessionExpired: () => {\n      clear();\n      onSessionExpired?.();\n    },\n  });\n\n  const client = createDeveloperPortalClient({\n    baseUrl,\n    middlewares,\n    authMiddleware: createDeveloperPortalAuthMiddleware(credential),\n  });\n\n  // `refreshTokens` is not re-exposed: rotating outside the store leaves stale tokens.\n  const { refreshTokens: _storeBypassingRotation, ...auth } = client.auth;\n\n  const api = {\n    ...client,\n    auth: {\n      ...auth,\n      logout: async (signal?: AbortSignal) =>\n        client.auth.logout(requireTokens('sign-out').accessToken, signal),\n      // Both MFA calls bypass the reactive 401 path, so rotate proactively first.\n      setupMfa: async (signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA enrolment');\n        return client.auth.setupMfa({ idToken: token, accessToken }, signal);\n      },\n      confirmMfa: async (code: string, signal?: AbortSignal) => {\n        await credential.getIdToken();\n        const { token, accessToken } = requireTokens('MFA confirmation');\n        return client.auth.confirmMfa({ idToken: token, accessToken, code }, signal);\n      },\n    },\n  };\n\n  const session = {\n    set: (result: LoginSuccess) => {\n      store.set({\n        token: result.token,\n        accessToken: result.accessToken,\n        refreshToken: result.refreshToken,\n      });\n    },\n    get: getTokens,\n    subscribe: store.subscribe,\n    clear,\n    /** Rotates if the id token is inside the lead time. Best-effort; the 401 path is the guarantee. */\n    ensureFresh: async (): Promise<void> => {\n      await credential.getIdToken();\n    },\n    /** Rotates now, for a change of claims (e.g. leaving a vendor). Propagates failure. */\n    refresh: async (): Promise<void> => {\n      await credential.getIdToken({ forceRefresh: true });\n    },\n    isAuthenticated: () => store.get() !== null,\n  };\n\n  return { api, session };\n};\n\nexport type DeveloperPortalSdk = ReturnType<typeof createDeveloperPortalSdk>;\nexport type DeveloperPortalSession = DeveloperPortalSdk['session'];\n"],"mappings":";;;;;;;;;;;;;;AASA,MAAa,mBAAmB,UAAiC;CAC/D,MAAM,MAAM,cAAc,KAAK,CAAC,EAAE;CAClC,OAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AACxE;;ACOA,MAAM,+BAA+B;;AASrC,MAAa,mCAAmC,EAC9C,SACA,WACA,kBACA,oBAAoB,mCACoB;CACxC,MAAM,YAAY,YAA4C;EAC5D,IAAI;GACF,OAAO,MAAM,QAAQ;EACvB,SAAS,OAAO;GAGd,IAAI,eAAe,KAAK,GAAG,mBAAmB;GAC9C,MAAM;EACR;CACF;CAGA,MAAM,gBAAgB,OAAO,SAAS;CAEtC,MAAM,aAAa,OAAO,EAAE,eAAe,UAAU,CAAC,MAA8B;EAClF,MAAM,SAAS,UAAU;EACzB,IAAI,WAAW,MAAM,OAAO;EAC5B,IAAI,cAAc,QAAQ,MAAM,cAAc,EAAA,CAAG;EAEjD,MAAM,YAAY,gBAAgB,OAAO,KAAK;EAE9C,IAAI,cAAc,MAAM,OAAO,OAAO;EACtC,IAAI,KAAK,IAAI,IAAI,YAAY,mBAAmB,OAAO,OAAO;EAG9D,OAAO,cAAc,CAAC,CACnB,MAAM,UAAU,MAAM,KAAK,CAAC,CAC5B,YAAY,OAAO,KAAK;CAC7B;CAEA,OAAO;EAAE;EAAY;EAAW,qBAAqB,mBAAmB;CAAE;AAC5E;;;;;;;;ACtDA,MAAa,uCACX,eACiB;CACjB,QAAQ,SAAS,OAAO,YAAY;EAClC,MAAM,QAAQ,MAAM,WAAW,WAAW;EAC1C,IAAI,UAAU,MAAM,OAAO,KAAK,OAAO;EAIvC,MAAM,eAAe,QAAQ,QAAQ,MAAM;EAC3C,QAAQ,QAAQ,QAAQ,IAAI,WAAW,eAAe,KAAK;EAE3D,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,CAAC,eAAe,KAAK,GAAG,MAAM;GAElC,MAAM,YAAY,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,YAAY,IAAI;GAGtF,IAAI,cAAc,MAAM,MAAM;GAC9B,aAAa,QAAQ,IAAI,WAAW,eAAe,SAAS;GAE5D,IAAI;IACF,OAAO,MAAM,KAAK;KAAE,GAAG;KAAS,SAAS;IAAa,CAAC;GACzD,SAAS,YAAY;IACnB,IAAI,eAAe,UAAU,GAAG,WAAW,cAAc;IACzD,MAAM;GACR;EACF;CACF;AACF;;;;;;;AChBA,MAAa,4BAA4B,EACvC,SACA,QAAQ,gBAAgB,MACxB,gBACA,kBACA,mBACA,cAAc,CAAC,QACgB;CAC/B,MAAM,QAAQ,YAA0C,aAAa;CACrE,MAAM,WAAW,UAAU,iBAAiB,KAAK,CAAC;CAElD,MAAM,kBAAkB,MAAM,IAAI;CAElC,MAAM,iBAAiB,WAA0C;EAC/D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,qBAAqB,OAAO,+BAA+B;EAE7E,OAAO;CACT;CAGA,MAAM,gBAAgB,4BAA4B;EAAE;EAAS;CAAY,CAAC;CAE1E,MAAM,UAAU,YAA4C;EAC1D,MAAM,SAAS,MAAM,IAAI;EACzB,IAAI,WAAW,MACb,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,EAAE,OAAO,gBAAgB,MAAM,cAAc,KAAK,cAAc,OAAO,YAAY;EACzF,MAAM,OAA8B;GAAE;GAAO;GAAa,cAAc,OAAO;EAAa;EAG5F,MAAM,QAAQ,MAAM,IAAI;EACxB,IAAI,UAAU,QAAQ,MAAM,iBAAiB,OAAO,cAClD,MAAM,IAAI,MAAM,2EAA2E;EAG7F,MAAM,IAAI,IAAI;EACd,OAAO;CACT;CAEA,MAAM,cAAc,MAAM,IAAI,IAAI;CAElC,MAAM,aAAa,gCAAgC;EACjD;EACA;EACA;EACA,wBAAwB;GACtB,MAAM;GACN,mBAAmB;EACrB;CACF,CAAC;CAED,MAAM,SAAS,4BAA4B;EACzC;EACA;EACA,gBAAgB,oCAAoC,UAAU;CAChE,CAAC;CAGD,MAAM,EAAE,eAAe,yBAAyB,GAAG,SAAS,OAAO;CA4CnE,OAAO;EAAE,KAAA;GAzCP,GAAG;GACH,MAAM;IACJ,GAAG;IACH,QAAQ,OAAO,WACb,OAAO,KAAK,OAAO,cAAc,UAAU,CAAC,CAAC,aAAa,MAAM;IAElE,UAAU,OAAO,WAAyB;KACxC,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,eAAe;KAC5D,OAAO,OAAO,KAAK,SAAS;MAAE,SAAS;MAAO;KAAY,GAAG,MAAM;IACrE;IACA,YAAY,OAAO,MAAc,WAAyB;KACxD,MAAM,WAAW,WAAW;KAC5B,MAAM,EAAE,OAAO,gBAAgB,cAAc,kBAAkB;KAC/D,OAAO,OAAO,KAAK,WAAW;MAAE,SAAS;MAAO;MAAa;KAAK,GAAG,MAAM;IAC7E;GACF;EAyBS;EAAG,SAAA;GArBZ,MAAM,WAAyB;IAC7B,MAAM,IAAI;KACR,OAAO,OAAO;KACd,aAAa,OAAO;KACpB,cAAc,OAAO;IACvB,CAAC;GACH;GACA,KAAK;GACL,WAAW,MAAM;GACjB;;GAEA,aAAa,YAA2B;IACtC,MAAM,WAAW,WAAW;GAC9B;;GAEA,SAAS,YAA2B;IAClC,MAAM,WAAW,WAAW,EAAE,cAAc,KAAK,CAAC;GACpD;GACA,uBAAuB,MAAM,IAAI,MAAM;EAGrB;CAAE;AACxB"}

package/dist/sdk/queryService/index.cjs

@@ -1,71 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_ValidationError = require("../../ValidationError-BXcFX4nD.cjs");
-const require_collectByOffset = require("../../collectByOffset-DgxJ3zT9.cjs");
-// src/sdks/queryService/queryServiceSdk.ts
-const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
-const DEFAULT_POLL_INTERVAL = 500;
-const DEFAULT_TIMEOUT = 3e5;
-const assertPositiveInteger = (name, value) => {
-	if (!Number.isInteger(value) || value <= 0) throw new require_ValidationError.ValidationError(`${name} must be a positive integer, got ${value}`);
-};
-/**
-* Higher-level SDK composing queryService client calls with job polling and result-page
-* auto-pagination for orchestrated workflows.
-*/
-const createQueryServiceSdk = ({ queryServiceClient }) => {
-	/**
-	* Fetches every page of a statement's results, merging them into a single {@link QueryResult}.
-	*
-	* - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off
-	*   the first page; `collectByOffset` hands back only the rows.
-	* - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`
-	*   sibling resolving `{ first, items }`, not for widening this closure.
-	*/
-	const fetchAllResultPages = async (queryJobId, statementId, pageSize, maxRows) => {
-		let firstPage;
-		const data = await require_collectByOffset.collectByOffset({
-			pageSize,
-			limit: maxRows,
-			fetchFrom: async (offset, pageSize) => {
-				const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {
-					offset,
-					pageSize
-				});
-				firstPage ??= page;
-				return page.data ?? [];
-			}
-		});
-		if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);
-		return {
-			...firstPage,
-			data
-		};
-	};
-	/**
-	* Submits a query job, waits for completion, and fetches results for every statement —
-	* auto-paginating each statement's results so sets larger than `pageSize` come back in full
-	* instead of being truncated at the API's default page size.
-	*
-	* - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.
-	* - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.
-	*/
-	const executeQuery = async (branchId, workspaceId, body, options = {}) => {
-		const { pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE, maxRows, interval = DEFAULT_POLL_INTERVAL, timeout = DEFAULT_TIMEOUT, ...pollOptions } = options;
-		assertPositiveInteger("pageSize", pageSize);
-		if (maxRows !== void 0) assertPositiveInteger("maxRows", maxRows);
-		const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);
-		const status = await queryServiceClient.poller({
-			init: { id: queryJobId },
-			interval,
-			timeout,
-			...pollOptions
-		}).wait();
-		const results = [];
-		for (const statement of status.statements) results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));
-		return results;
-	};
-	return { executeQuery };
-};
-exports.createQueryServiceSdk = createQueryServiceSdk;
-
-//# sourceMappingURL=index.cjs.map
+const require_queryService = require("../../queryService-B4h1Ez44.cjs");
+exports.cellParser = require_queryService.cellParser;
+exports.createQueryServiceSdk = require_queryService.createQueryServiceSdk;

package/dist/sdk/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-B7el5pJU.cjs";
-export { ExecuteQueryOptions, createQueryServiceSdk };
+import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-BtvWJBYh.cjs";
+export { ExecuteQueryOptions, cellParser, createQueryServiceSdk };

package/dist/sdk/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { b as ExecuteQueryOptions, x as createQueryServiceSdk } from "../../index-C7JcNvbd.js";
-export { ExecuteQueryOptions, createQueryServiceSdk };
+import { S as createQueryServiceSdk, b as cellParser, x as ExecuteQueryOptions } from "../../index-Df30jjpZ.js";
+export { ExecuteQueryOptions, cellParser, createQueryServiceSdk };

package/dist/sdk/queryService/index.js

@@ -1,70 +1 @@
-import { t as ValidationError } from "../../ValidationError-BsdFDGY2.js";
-import { t as collectByOffset } from "../../collectByOffset-i8Tdoze7.js";
-// src/sdks/queryService/queryServiceSdk.ts
-const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
-const DEFAULT_POLL_INTERVAL = 500;
-const DEFAULT_TIMEOUT = 3e5;
-const assertPositiveInteger = (name, value) => {
-	if (!Number.isInteger(value) || value <= 0) throw new ValidationError(`${name} must be a positive integer, got ${value}`);
-};
-/**
-* Higher-level SDK composing queryService client calls with job polling and result-page
-* auto-pagination for orchestrated workflows.
-*/
-const createQueryServiceSdk = ({ queryServiceClient }) => {
-	/**
-	* Fetches every page of a statement's results, merging them into a single {@link QueryResult}.
-	*
-	* - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off
-	*   the first page; `collectByOffset` hands back only the rows.
-	* - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`
-	*   sibling resolving `{ first, items }`, not for widening this closure.
-	*/
-	const fetchAllResultPages = async (queryJobId, statementId, pageSize, maxRows) => {
-		let firstPage;
-		const data = await collectByOffset({
-			pageSize,
-			limit: maxRows,
-			fetchFrom: async (offset, pageSize) => {
-				const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {
-					offset,
-					pageSize
-				});
-				firstPage ??= page;
-				return page.data ?? [];
-			}
-		});
-		if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);
-		return {
-			...firstPage,
-			data
-		};
-	};
-	/**
-	* Submits a query job, waits for completion, and fetches results for every statement —
-	* auto-paginating each statement's results so sets larger than `pageSize` come back in full
-	* instead of being truncated at the API's default page size.
-	*
-	* - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.
-	* - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.
-	*/
-	const executeQuery = async (branchId, workspaceId, body, options = {}) => {
-		const { pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE, maxRows, interval = DEFAULT_POLL_INTERVAL, timeout = DEFAULT_TIMEOUT, ...pollOptions } = options;
-		assertPositiveInteger("pageSize", pageSize);
-		if (maxRows !== void 0) assertPositiveInteger("maxRows", maxRows);
-		const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);
-		const status = await queryServiceClient.poller({
-			init: { id: queryJobId },
-			interval,
-			timeout,
-			...pollOptions
-		}).wait();
-		const results = [];
-		for (const statement of status.statements) results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));
-		return results;
-	};
-	return { executeQuery };
-};
-export { createQueryServiceSdk };
-
-//# sourceMappingURL=index.js.map
+export { t as cellParser, n as createQueryServiceSdk } from "../../queryService-DE_yE_S4.js";