@keboola/api-client 52.0.0 → 54.0.0

package/dist/{types-CsVRsObb.d.ts → types-DFcj9YyQ.d.ts}

@@ -210,14 +210,15 @@ type paths = {
      *     registration is usable):
      *
      *     * Repository permissions: Contents → Read-only; Organization permissions: Members →
-     *       Read-only (the install callback needs it to confirm the installer owns the GitHub
+     *       Read-only (the callback needs it to confirm the user connecting owns the GitHub
      *       organization).
-     *     * "Where can this GitHub App be installed?" → Any account.
-     *     * **"Request user authorization (OAuth) during installation" must be enabled**, and the
-     *       App's Callback URL set to this service's
-     *       `/platform-consumers/github-app/callback`. Without it GitHub sends no `code` with the
-     *       install redirect, the callback cannot prove the installer owns the installation they
-     *       returned with, and every connection attempt fails there.
+     *     * "Where can this GitHub App be installed?" → Any account, for an App that third parties
+     *       install.
+     *     * The App's Callback URL list must include this service's
+     *       `/platform-consumers/github-app/callback`: connecting goes through the App's OAuth web
+     *       flow with that URL as `redirect_uri`. "Request user authorization (OAuth) during
+     *       installation" is not needed; when it is on, the redirect GitHub sends right after an
+     *       install has no `state` and is answered with directions to connect from Keboola.
      *     * `clientId` / `clientSecret` come from the same App's page ("Client ID", "Generate a new
      *       client secret") — they are not the App ID and private key.
      *
@@ -265,10 +266,11 @@ type paths = {
       cookie?: never;
     };
     /**
-     * GitHub App install callback
-     * @description Invoked by GitHub, not by API consumers. This is the App's Callback URL, configured once on
-     *     the GitHub side and identical for every install, which is why it carries no organization
-     *     segment — the organization is recovered from the install session that `state` resolves to.
+     * GitHub App OAuth callback
+     * @description Invoked by GitHub, not by API consumers. This is one of the App's Callback URLs, configured
+     *     once on the GitHub side and identical for every connection, which is why it carries no
+     *     organization segment — the organization is recovered from the install session that `state`
+     *     resolves to.
      *
      *     It is the only endpoint that records an installation, and it requires no Keboola credential.
      *     Three things authorise it, all of them necessary:
@@ -276,22 +278,29 @@ type paths = {
      *     1. `state` must match the `__Host-orgInstallSession` cookie set when the flow started (the
      *        legacy `oauthSessionId` cookie is ignored here);
      *     2. `state` must resolve to an unexpired install session;
-     *     3. the installing user must own the account the installation belongs to. GitHub, asked as
-     *        the App, says which account that is (`GET /app/installations/{id}`); asked with the
-     *        user-to-server token obtained from `code`, it says whether the installer is an active
-     *        owner of that organization (`GET /user/memberships/orgs/{login}` → `role: admin`,
-     *        `state: active`) or, for a personal account, that very user (`GET /user`). Being a
-     *        collaborator or an ordinary member is not enough.
+     *     3. the user who authorized (`code`, exchanged for a user-to-server token) must own the
+     *        account the bound installation belongs to: an active owner of that organization
+     *        (`GET /user/memberships/orgs/{login}` → `role: admin`, `state: active`) or, for a
+     *        personal account, that very user (`GET /user`). Being a collaborator or an ordinary
+     *        member is not enough. This is why the App needs "Organization members: read".
      *
-     *     Point 3 is why the App needs "Request user authorization (OAuth) during installation" and
-     *     the "Organization members: read" permission. Installation ids are small sequential
-     *     integers, so without that confirmation anyone able to start an install for an organization
-     *     they do administer could bind a stranger's installation and mint read tokens on that
-     *     stranger's private repositories.
+     *     Which installation is bound:
      *
-     *     When the installer is not a GitHub organization owner, GitHub returns
-     *     `setup_action=request` with no installation id: the installation is pending an owner's
-     *     approval and nothing is recorded.
+     *     * **OAuth web flow** (started by `POST /authorize/organizations/{organizationId}`; only
+     *       `code` and `state` come back): the App's installations the user can reach
+     *       (`GET /user/installations`, all pages), narrowed to the `account` given at the start if
+     *       any, each run through check 3. Exactly one owned installation is connected. None
+     *       installed is a `400` and none owned a `403`, both naming the App's install page
+     *       `{webBaseUrl}/apps/{slug}/installations/new`; several owned without `account` is a `400`
+     *       naming them — start again with `account`.
+     *     * **No `state`** — GitHub's redirect after an install started on GitHub, for an App that
+     *       requests user authorization during installation: a `400` saying the connection has to
+     *       be started from Keboola. Nothing is asked of GitHub or recorded.
+     *
+     *     Any `installation_id` GitHub adds to the query is ignored. Installation ids are small
+     *     sequential integers: believing one would let anyone able to start a connection for an
+     *     organization they do administer bind a stranger's installation and mint read tokens on
+     *     that stranger's private repositories.
      *
      *     An organization holds at most one connection per GitHub account and registration. When the
      *     account is already connected under a *different* installation id — the App was
@@ -318,23 +327,30 @@ type paths = {
     put?: never;
     /**
      * Connect a GitHub organization
-     * @description Starts the GitHub App install flow and redirects to GitHub.
+     * @description Starts connecting a GitHub organization and redirects to the GitHub App's OAuth web flow,
+     *     `{webBaseUrl}/login/oauth/authorize?client_id=…&redirect_uri=…&state=…`, where
+     *     `redirect_uri` is this service's `/platform-consumers/github-app/callback`. GitHub signs
+     *     the user in, asks them to authorize the App the first time, and returns to the callback,
+     *     which connects the installation the user owns (or the one on `account`). The App must
+     *     already be installed on the GitHub organization — by anyone, from anywhere; the callback
+     *     links the install page if it is not.
      *
-     *     Submitted by the browser as a form — a top-level navigation — exactly like
-     *     `POST /authorize/{componentId}`, with the caller's Storage API token in the `token` form
-     *     field, verified with Storage API by this service. The token may belong to any project the
-     *     caller can reach: it establishes only *who* the caller is. A token without an admin
-     *     (component or legacy token) is refused with `403`.
+     *     Submitted by the browser as a form — a top-level navigation from the organization's page
+     *     in the Control Panel — with the caller's Manage API token in the `manageToken` form field,
+     *     verified by this service with `GET /manage/tokens/verify`. The token must have a user
+     *     behind it: the Control Panel's session token or a personal Manage token. An application
+     *     token is refused with `403`; a token Manage API does not know, or reports as expired or
+     *     disabled, with `401`. Storage API tokens and programmatic `kbc_pat_*` tokens are not
+     *     accepted. The token establishes only *who* the
+     *     caller is, and it is never stored.
      *
      *     The organization is taken from the URL and the caller must be an administrator of it — `GET /manage/organizations/{id}/users` is
      *     Connection's organization administrators listing, so appearing in it is the admin check.
-     *     Deriving the organization from the token instead would be unsafe — users belong to projects
-     *     across several organizations and the project-to-organization link is invisible in the UI.
+     *     Super admins who are not listed are refused.
      *
      *     The credentials row is created incomplete and only becomes usable once the install
      *     callback records the installation. Starting again under the name of an incomplete row (an
-     *     abandoned tab, or an install that became an owner-approval request) replaces that row and
-     *     its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
+     *     abandoned tab or a refused callback) replaces that row and its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
      *     already taken by a completed connection is a `409`.
      *
      *     The response sets the session cookie `__Host-orgInstallSession` (Secure, HttpOnly,
@@ -366,7 +382,8 @@ type paths = {
     /**
      * List connected GitHub organizations
      * @description Lists the GitHub accounts this Keboola organization has connected. Connections whose
-     *     install never completed are omitted.
+     *     install never completed are omitted. The caller must be an administrator of the
+     *     organization; see `ManageApiUserToken` for the accepted tokens.
      */
     get: operations['organizationCredentialsList'];
     put?: never;
@@ -423,7 +440,8 @@ type paths = {
     /**
      * Disconnect a GitHub organization
      * @description Removes the connection on the Keboola side. The App stays installed on GitHub until an
-     *     owner removes it there.
+     *     owner removes it there. The caller must be an administrator of the organization; see
+     *     `ManageApiUserToken` for the accepted tokens.
      */
     delete: operations['organizationCredentialsDelete'];
     options?: never;
@@ -555,8 +573,8 @@ type components = {
       webHost?: string;
     };
     OrganizationCredentialsInitRequest: {
-      /** @description Storage API token of the caller; identifies who they are */
-      token: string;
+      /** @description Manage API token of the caller with a user behind it (the Control Panel's session token or a personal Manage token); identifies who they are */
+      manageToken: string;
       /**
        * @description Unique within the organization.
        * @example acme-github
@@ -564,7 +582,7 @@ type components = {
       name: string;
       /**
        * Format: url
-       * @description Where GitHub returns the user after the install completes. Must be https.
+       * @description Where the browser returns after the connection completes. Must be https.
        */
       returnUrl: string;
       description?: string | null;
@@ -573,6 +591,11 @@ type components = {
        * @example acme.ghe.com
        */
       host?: string | null;
+      /**
+       * @description The GitHub account (organization or user login, case-insensitive) to connect. Needed only when the caller owns several accounts the GitHub App is installed on; omitted, the callback connects the only one.
+       * @example acme
+       */
+      account?: string | null;
     };
     OrganizationCredentials: {
       /** Format: uuid */
@@ -590,8 +613,22 @@ type components = {
        */
       host?: string;
       creator?: {
+        /** @description ID of the token the connection was started with. */
         id?: string;
+        /** @description Description of that token; for the Control Panel's session token, the user's email. */
         description?: string | null;
+        /**
+         * @description Which API the token belongs to. Connections are started with a Manage API token; `storage` marks connections started with a Storage API token before that.
+         * @enum {string}
+         */
+        type?: 'manage' | 'storage';
+        /** @description The user behind the Manage API token. A session token expires after about an hour, so this is what still says who connected the organization. Null for `storage`. */
+        user?: {
+          /** @example 76 */
+          id?: string;
+          /** @example admin@keboola.com */
+          email?: string | null;
+        } | null;
       };
       /** Format: date-time */
       created?: string;
@@ -1247,15 +1284,11 @@ interface operations {
   };
   platformConsumerInstallCallback: {
     parameters: {
-      query: {
-        /** @description GitHub installation ID. */
-        installation_id?: string;
-        /** @description Temporary user authorization code. Present only when the App has "Request user authorization (OAuth) during installation" enabled; the callback exchanges it for a user-to-server token and verifies installation ownership with it. */
+      query?: {
+        /** @description Temporary user authorization code; exchanged for a user-to-server token that identifies the user and verifies installation ownership. Missing when the user did not authorize the App (`error=access_denied`). */
         code?: string;
-        /** @description What GitHub did. `request` means an owner still has to approve. */
-        setup_action?: 'install' | 'request' | 'update';
-        /** @description Opaque install-session ID issued when the flow started. */
-        state: string;
+        /** @description Opaque install-session ID issued when the flow started. Required; GitHub omits it on the redirect after an install started on GitHub, which is answered with a `400`. */
+        state?: string;
       };
       header?: never;
       path?: never;
@@ -1270,8 +1303,16 @@ interface operations {
         };
         content?: never;
       };
-      400: components['responses']['400_BadRequest'];
-      /** @description The installer is not an active owner of the GitHub organization (or not the personal account) the installation belongs to, or the App lacks "Organization members: read" */
+      /** @description No `state` (the connection has to be started from Keboola); no matching session cookie or an expired session; no `code`, or GitHub rejected it; the App is not installed on any account the user can reach (or on the requested `account`) — the message links the install page; or the user owns several accounts with the App installed and no `account` was given — the message names them */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description The user owns none of the accounts the App is installed on that they can reach (or not the requested `account`): neither an active owner of the organization nor the personal account itself. The message links the install page, or names an organization enforcing SAML SSO the user's GitHub session is not authorized for. Also when the App lacks "Organization members: read" */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1289,6 +1330,24 @@ interface operations {
           'application/json': components['schemas']['Error'];
         };
       };
+      /** @description GitHub is rate limiting requests; see `Retry-After` */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description GitHub failed or returned a malformed answer */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
     };
   };
   organizationCredentialsInit: {
@@ -1307,7 +1366,7 @@ interface operations {
       };
     };
     responses: {
-      /** @description Redirect to GitHub to install the App */
+      /** @description Redirect to the GitHub App's OAuth web flow (`/login/oauth/authorize`) */
       302: {
         headers: {
           [name: string]: unknown;
@@ -1315,6 +1374,7 @@ interface operations {
         content?: never;
       };
       400: components['responses']['400_BadRequest'];
+      401: components['responses']['401_Unauthorized'];
       403: components['responses']['403_Forbidden'];
       /** @description A completed connection with this name already exists in the organization */
       409: {
@@ -1526,5 +1586,13 @@ type CredentialInput = ComponentPath & {
 type CreateCredentialInput = ComponentPath & Omit<CreateCredentialBody, '#data'> & {
   data: Record<string, unknown>;
 };
-export { CredentialInput as a, GetCredentialsInput as c, Credential as i, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, OrganizationConnection as s, ComponentPath as t };
-//# sourceMappingURL=types-CsVRsObb.d.ts.map
+type OrganizationCredentials = OpenapiReturnType<paths['/organizations/{organizationId}/credentials']['get']>[number];
+type ManageTokenInput = {
+  /** A Manage API token with a user behind it, e.g. the Control Panel's session token. */
+  manageToken: string;
+};
+type GetOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials']['get']> & ManageTokenInput;
+type DeleteOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials/{id}']['delete']> & ManageTokenInput;
+type GetOrganizationConnectFormInput = OpenapiPathType<paths['/authorize/organizations/{organizationId}']['post']> & OpenapiBodyType<paths['/authorize/organizations/{organizationId}']['post']>;
+export { CredentialInput as a, GetOrganizationConnectFormInput as c, OrganizationCredentials as d, GetCredentialsInput as f, Credential as i, GetOrganizationCredentialsInput as l, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, DeleteOrganizationCredentialsInput as s, ComponentPath as t, OrganizationConnection as u };
+//# sourceMappingURL=types-DFcj9YyQ.d.ts.map

package/dist/types-DK1bSUNr.d.ts

@@ -0,0 +1,85 @@
+import { n as createMetastoreClient } from "./index-BVe4S2CK.js";
+import { t as MetastoreObject } from "./metaObject-ClvW342q.js";
+/**
+ * The metastore's row- and column-level security vocabulary, schema version 1.2.0.
+ *
+ * - Each list is the one place a value is added; the types in `./types` derive from it.
+ */
+declare const SECURITY_POLICY_TYPES: readonly ['rls-policy', 'cls-policy'];
+declare const POLICY_SQL_DIALECTS: readonly ['snowflake', 'bigquery'];
+declare const RLS_COMPARISON_OPS: readonly ['eq', 'ne', 'gt', 'gte', 'lt', 'lte'];
+declare const RLS_LIST_OPS: readonly ['in', 'not_in'];
+declare const RLS_NULL_OPS: readonly ['is_null', 'is_not_null'];
+type MetastoreClient = ReturnType<typeof createMetastoreClient>;
+type SecurityPolicyType = (typeof SECURITY_POLICY_TYPES)[number];
+type PolicyDialect = (typeof POLICY_SQL_DIALECTS)[number];
+/** `{"$identity": "email"}`: the reading identity's email, bound as a query parameter. */
+type RlsIdentityEmail = {
+  $identity: 'email';
+};
+/** `{"$identity": "groups"}`: the reading identity's IdP groups, bound as a list. */
+type RlsIdentityGroups = {
+  $identity: 'groups';
+};
+type RlsLiteral = string | number | boolean | null;
+type RlsCondition = {
+  true: true;
+} | {
+  false: true;
+} | {
+  and: RlsCondition[];
+} | {
+  or: RlsCondition[];
+} | {
+  column: string;
+  op: (typeof RLS_COMPARISON_OPS)[number];
+  value: RlsLiteral | RlsIdentityEmail;
+} | {
+  column: string;
+  op: (typeof RLS_LIST_OPS)[number];
+  values: RlsLiteral[] | RlsIdentityGroups;
+} | {
+  column: string;
+  op: (typeof RLS_NULL_OPS)[number];
+};
+/** One selector kind per rule: IdP `groups` or `<idp>|<sub>` `subjects`. `["*"]` is everyone. */
+type PolicySelector = {
+  subjects: string[];
+} | {
+  groups: string[];
+};
+type RlsRule = PolicySelector & {
+  condition: RlsCondition;
+};
+type ClsRule = PolicySelector & {
+  visible_columns: string[];
+};
+type RlsPolicyData = {
+  table: string;
+  dialect?: PolicyDialect;
+  rules: RlsRule[];
+  default?: RlsCondition;
+};
+type ClsPolicyData = {
+  table: string;
+  dialect?: PolicyDialect;
+  rules: ClsRule[];
+};
+type SecurityPolicyDataMap = {
+  'rls-policy': RlsPolicyData;
+  'cls-policy': ClsPolicyData;
+};
+/**
+ * What a read hands back.
+ *
+ * - Rules stay untyped: policies written under schema 1.0.0 or 1.1.0 (`principal`) list too.
+ */
+type SecurityPolicyReadData = {
+  table: string;
+  dialect?: PolicyDialect;
+  rules: Record<string, unknown>[];
+  default?: unknown;
+};
+type SecurityPolicy = MetastoreObject<SecurityPolicyReadData>;
+export { RLS_COMPARISON_OPS as _, PolicySelector as a, SECURITY_POLICY_TYPES as b, RlsIdentityGroups as c, RlsRule as d, SecurityPolicy as f, POLICY_SQL_DIALECTS as g, SecurityPolicyType as h, PolicyDialect as i, RlsLiteral as l, SecurityPolicyReadData as m, ClsRule as n, RlsCondition as o, SecurityPolicyDataMap as p, MetastoreClient as r, RlsIdentityEmail as s, ClsPolicyData as t, RlsPolicyData as u, RLS_LIST_OPS as v, RLS_NULL_OPS as y };
+//# sourceMappingURL=types-DK1bSUNr.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keboola/api-client",
-  "version": "52.0.0",
+  "version": "54.0.0",
   "description": "TypeScript SDK for Keboola APIs",
   "license": "MIT",
   "type": "module",
@@ -200,6 +200,12 @@
       "sdk/semanticLayer/types": [
         "./dist/sdk/semanticLayer/types.d.ts"
       ],
+      "sdk/securityPolicy": [
+        "./dist/sdk/securityPolicy/index.d.ts"
+      ],
+      "sdk/securityPolicy/types": [
+        "./dist/sdk/securityPolicy/types.d.ts"
+      ],
       "sdk/kaiMemory": [
         "./dist/sdk/kaiMemory/index.d.ts"
       ],
@@ -218,6 +224,9 @@
       "sdk/configurations": [
         "./dist/sdk/configurations/index.d.ts"
       ],
+      "sdk/dataAppServer": [
+        "./dist/sdk/dataAppServer/index.d.ts"
+      ],
       "domain/permissions": [
         "./dist/domain/permissions/index.d.ts"
       ],
@@ -874,6 +883,26 @@
         "default": "./dist/sdk/semanticLayer/types.cjs"
       }
     },
+    "./sdk/securityPolicy": {
+      "import": {
+        "types": "./dist/sdk/securityPolicy/index.d.ts",
+        "default": "./dist/sdk/securityPolicy/index.js"
+      },
+      "require": {
+        "types": "./dist/sdk/securityPolicy/index.d.cts",
+        "default": "./dist/sdk/securityPolicy/index.cjs"
+      }
+    },
+    "./sdk/securityPolicy/types": {
+      "import": {
+        "types": "./dist/sdk/securityPolicy/types.d.ts",
+        "default": "./dist/sdk/securityPolicy/types.js"
+      },
+      "require": {
+        "types": "./dist/sdk/securityPolicy/types.d.cts",
+        "default": "./dist/sdk/securityPolicy/types.cjs"
+      }
+    },
     "./sdk/kaiMemory": {
       "import": {
         "types": "./dist/sdk/kaiMemory/index.d.ts",
@@ -934,6 +963,16 @@
         "default": "./dist/sdk/configurations/index.cjs"
       }
     },
+    "./sdk/dataAppServer": {
+      "import": {
+        "types": "./dist/sdk/dataAppServer/index.d.ts",
+        "default": "./dist/sdk/dataAppServer/index.js"
+      },
+      "require": {
+        "types": "./dist/sdk/dataAppServer/index.d.cts",
+        "default": "./dist/sdk/dataAppServer/index.cjs"
+      }
+    },
     "./domain/permissions": {
       "import": {
         "types": "./dist/domain/permissions/index.d.ts",

package/surface/management.md

@@ -53,6 +53,7 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.management.fileStorage.createFileStorageGcs(body: { gcsCredentials: { type: string; project_id: string; private_key_id: string; private_key: string; client_email: string; client_id: string; auth_uri: string; token_uri: string; auth_provider_x509_cert_url: string; client_x509_cert_url: string; }; filesBucket: string; owner: "client" | "keboola"; region: string; }): Promise<FileStorageGcs>`
 - `api.management.fileStorage.createFileStorageS3(body: { awsKey: string; awsSecret: string; filesBucket: string; owner: string; region: string; }): Promise<{ id: number; awsKey: string; region: string; filesBucket: string; provider: string; owner: string; isDefault: boolean; created: string; creator: { id: number | null; name: string | null; }; }>`
 - `api.management.fileStorage.deleteFileStorage(fileStorageId: number): Promise<void>`
+- `api.management.fileStorage.getFileStorageProjects(fileStorageId: number, query?: { page?: { after?: string | undefined; limit?: number | undefined; } | undefined; } | undefined, signal?: AbortSignal | undefined): Promise<{ data: { id: number; name: string; isDeleted: boolean; }[]; meta: { total: number; limit: number; cursor: { param: string; encoding: string; fields: { name: string; type: "string" | "integer" | "date-time"; nullable: boolean; }[]; order: string; }; }; links: { self: string; first: string; next: string | null; }; }>`
 - `api.management.fileStorage.getFileStoragesAbs(signal?: AbortSignal | undefined): Promise<{ id: number; accountName: string; region: string; containerName: string; provider: string; owner: string; isDefault: boolean; created: string; creator: { id: number | null; name: string | null; }; }[]>`
 - `api.management.fileStorage.getFileStoragesGcs(signal?: AbortSignal | undefined): Promise<FileStorageGcs[]>`
 - `api.management.fileStorage.getFileStoragesS3(signal?: AbortSignal | undefined): Promise<{ id: number; awsKey: string; region: string; filesBucket: string; provider: string; owner: string; isDefault: boolean; created: string; creator: { id: number | null; name: string | null; }; }[]>`
@@ -169,6 +170,10 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.management.projects.setProjectReviewers({ projectId, adminIds, }: SetProjectReviewersPath & SetProjectReviewersBody): Promise<void>`
 - `api.management.projects.updateProject({ projectId, ...body }: UpdateProjectInput): Promise<ProjectBase>`
 
+### `api.management.search`
+
+- `api.management.search.find(query: { q: string; page?: { after?: string | undefined; limit?: number | undefined; } | undefined; filter?: { types?: string | undefined; } | undefined; }, signal?: AbortSignal | undefined): Promise<{ project?: { data: { rank: 0 | 1 | 2; id: number; name: string; organization: { id: number; name: string; }; isDisabled: boolean; }[]; meta: { total: number; limit: number; cursor: { param: string; encoding: string; fields: { name: string; type: "string" | "integer" | "date-time"; nullable: boolean; }[]; order: string; }; }; links: { self: string; first: string; next: string | null; }; } | undefined; organization?: { data: { rank: 0 | 1 | 2; id: number; name: string; maintainer: { id: number; name: string | null; }; }[]; meta: { total: number; limit: number; cursor: { param: string; encoding: string; fields: { name: string; type: "string" | "integer" | "date-time"; nullable: boolean; }[]; order: string; }; }; links: { self: string; first: string; next: string | null; }; } | undefined; maintainer?: { data: { rank: 0 | 1 | 2; id: number; name: string | null; }[]; meta: { total: number; limit: number; cursor: { param: string; encoding: string; fields: { name: string; type: "string" | "integer" | "date-time"; nullable: boolean; }[]; order: string; }; }; links: { self: string; first: string; next: string | null; }; } | undefined; user?: { data: { rank: 0 | 1 | 2; id: number; name: string; email: string; }[]; meta: { total: number; limit: number; cursor: { param: string; encoding: string; fields: { name: string; type: "string" | "integer" | "date-time"; nullable: boolean; }[]; order: string; }; }; links: { self: string; first: string; next: string | null; }; } | undefined; }>`
+
 ### `api.management.snowflakePartnerConnect`
 
 - `api.management.snowflakePartnerConnect.check(projectId: number, signal?: AbortSignal | undefined): Promise<{ testPassed: boolean; queriesToRun: string[]; }>`

package/surface/sdk.md

@@ -25,6 +25,8 @@ Part of the [`@keboola/api-client` surface index](../API-SURFACE.md).
 - `api.sdk.semanticLayer.deleteObject(objectType: keyof SemanticChildObjectDataMap, objectUUID: string): Promise<void>`
 - `api.sdk.semanticLayer.findObjectsByName<T extends SemanticChildObjectType>(objectType: T, name: string, modelUUID: string, signal?: AbortSignal | undefined): Promise<SemanticObject<SemanticChildObjectDataMap[T]>[]>`
 - `api.sdk.semanticLayer.getModel(modelUUID: string, signal?: AbortSignal | undefined): Promise<SemanticObject<SemanticModelData>>`
+- `api.sdk.semanticLayer.listAllObjects<T extends SemanticChildObjectType>(objectType: T, signal?: AbortSignal | undefined): Promise<SemanticObject<SemanticChildObjectDataMap[T]>[]>`
+- `api.sdk.semanticLayer.listAllObjectsWithUnreadable<T extends SemanticChildObjectType>(objectType: T, signal?: AbortSignal | undefined): Promise<{ objects: SemanticObject<SemanticChildObjectDataMap[T]>[]; unreadable: SemanticUnreadableObjectRef[]; }>`
 - `api.sdk.semanticLayer.listModelChildren(modelUUID: string, signal?: AbortSignal | undefined): Promise<SemanticModelChildRef[]>`
 - `api.sdk.semanticLayer.listModels(signal?: AbortSignal | undefined): Promise<SemanticObject<SemanticModelData>[]>`
 - `api.sdk.semanticLayer.listMyPendingScopeElevationRequests(objectType: SemanticObjectType, signal?: AbortSignal | undefined): Promise<SemanticObject<Record<string, unknown>>[]>`

package/dist/admin-CbMOsfgs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-CbMOsfgs.js","names":[],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin`, `productionManager` or `share` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin ||\n  token.admin?.role === AdminRole.ProductionManager ||\n  token.admin?.role === AdminRole.Share;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAM,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAM,UAAU,SAAS,KAAK,KAAK,MAAM,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAM,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAM,UAAU,aAAa,KAAK,KAAK,MAAM,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAM,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAO,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAK,UAAU;EACf,KAAK,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAAS,UAAU,SAChC,MAAM,OAAO,SAAS,UAAU,qBAChC,MAAM,OAAO,SAAS,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL"}

package/dist/admin-Di-MmGFP.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-Di-MmGFP.cjs","names":["AdminRole"],"sources":["../src/domain/permissions/errors.ts","../src/domain/permissions/admin.ts"],"sourcesContent":["/**\n * @module domain/permissions/errors\n *\n * - What every `assertCan*` throws; its public fields are SDK contract — renames break consumers.\n * - `subject` is a debugging hint only — never a `StorageToken`, raw token or secret.\n */\nexport class PermissionDeniedError extends Error {\n  public readonly action: string;\n  public readonly reason?: string;\n  public readonly subject?: string;\n\n  constructor({ action, reason, subject }: { action: string; reason?: string; subject?: string }) {\n    super(reason ? `Permission denied: ${action} (${reason})` : `Permission denied: ${action}`);\n    this.name = 'PermissionDeniedError';\n    this.action = action;\n    this.reason = reason;\n    this.subject = subject;\n  }\n}\n","/**\n * @module domain/permissions/admin\n *\n * Admin-role predicates read from `token.admin.role` alone.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { PermissionDeniedError } from './errors';\n\nconst role = (token: StorageToken): AdminRole | null => token.admin.role;\n\nexport const isAdmin = (token: StorageToken): boolean => role(token) === AdminRole.Admin;\n\nexport const isAdminOrShare = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Admin || role(token) === AdminRole.Share;\n\nexport const isProductionManager = (token: StorageToken): boolean =>\n  role(token) === AdminRole.ProductionManager;\n\nexport const isDeveloperOrReviewer = (token: StorageToken): boolean =>\n  role(token) === AdminRole.Developer || role(token) === AdminRole.Reviewer;\n\nexport const isReadOnlyRole = (token: StorageToken): boolean => role(token) === AdminRole.ReadOnly;\n\n/**\n * Whether a role string is a member of `AdminRole` at all.\n *\n * - Failing it means *unrecognized*, not denied — log it loudly.\n */\nexport const isKnownAdminRole = (adminRole: string | null | undefined): boolean =>\n  (Object.values(AdminRole) as string[]).includes(adminRole ?? '');\n\n/**\n * Whether an admin role may write Kai's project-wide settings.\n *\n * - `admin` and `share` only: a shared prompt-injection surface is project administration.\n * - `developer`/`reviewer` are denied: `agent_settings` is keyed by `project_id` alone, so a dev-branch edit hits production.\n * - An allowlist, so new upstream `AdminRole` members are denied by default.\n * - Spend caps use `./organization#canWriteKaiSpendCaps`; don't widen this for them.\n */\nexport const isKaiSettingsWriterRole = (adminRole: string | null | undefined): boolean => {\n  switch (adminRole) {\n    case AdminRole.Admin:\n    case AdminRole.Share:\n      return true;\n    default:\n      return false;\n  }\n};\n\n/**\n * Whether this token may write Kai's project-wide settings.\n *\n * - A limited (non-master) token never may; its `admin` block is absent despite the type.\n */\nexport const canWriteKaiSettings = (token: StorageToken): boolean =>\n  token.isMasterToken && isKaiSettingsWriterRole(token.admin?.role);\n\nexport const assertCanWriteKaiSettings = (token: StorageToken): void => {\n  if (!canWriteKaiSettings(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-settings',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' may not write Kai settings`\n        : 'a limited (non-master) token may not write Kai settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write the project's semantic layer in the metastore.\n *\n * - Mirrors the metastore's role mapping (go-monorepo `services/metastore/internal/authz`):\n *   only a master token with the `admin`, `productionManager` or `share` role gets `project-admin`.\n * - Every other role, and a limited token (no `admin` block), gets a 403.\n * - Organization-scope promotion is left to the metastore's 403.\n */\nexport const canWriteSemanticLayer = (token: StorageToken): boolean =>\n  token.admin?.role === AdminRole.Admin ||\n  token.admin?.role === AdminRole.ProductionManager ||\n  token.admin?.role === AdminRole.Share;\n\nexport const assertCanAdmin = (token: StorageToken): void => {\n  if (!isAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin',\n      reason: `role '${role(token)}' is not admin`,\n    });\n  }\n};\n\nexport const assertCanAdminOrShare = (token: StorageToken): void => {\n  if (!isAdminOrShare(token)) {\n    throw new PermissionDeniedError({\n      action: 'admin-or-share',\n      reason: `role '${role(token)}' is not admin or share`,\n    });\n  }\n};\n\nexport const assertCanProductionManage = (token: StorageToken): void => {\n  if (!isProductionManager(token)) {\n    throw new PermissionDeniedError({\n      action: 'production-manage',\n      reason: `role '${role(token)}' is not productionManager`,\n    });\n  }\n};\n\nexport const assertCanDevelopOrReview = (token: StorageToken): void => {\n  if (!isDeveloperOrReviewer(token)) {\n    throw new PermissionDeniedError({\n      action: 'develop-or-review',\n      reason: `role '${role(token)}' is not developer or reviewer`,\n    });\n  }\n};\n"],"mappings":";;;;;;;;AAMA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CACA;CACA;CAEA,YAAY,EAAE,QAAQ,QAAQ,WAAkE;EAC9F,MAAM,SAAS,sBAAsB,OAAO,IAAI,OAAO,KAAK,sBAAsB,QAAQ;EAC1F,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,SAAS;EACd,KAAK,UAAU;CACjB;AACF;;ACRA,MAAM,QAAQ,UAA0C,MAAM,MAAM;AAEpE,MAAa,WAAW,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnF,MAAa,kBAAkB,UAC7B,KAAK,KAAK,MAAMA,mBAAAA,UAAU,SAAS,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE/D,MAAa,uBAAuB,UAClC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAE5B,MAAa,yBAAyB,UACpC,KAAK,KAAK,MAAMA,mBAAAA,UAAU,aAAa,KAAK,KAAK,MAAMA,mBAAAA,UAAU;AAEnE,MAAa,kBAAkB,UAAiC,KAAK,KAAK,MAAMA,mBAAAA,UAAU;;;;;;AAO1F,MAAa,oBAAoB,cAC9B,OAAO,OAAOA,mBAAAA,SAAS,CAAC,CAAc,SAAS,aAAa,EAAE;;;;;;;;;AAUjE,MAAa,2BAA2B,cAAkD;CACxF,QAAQ,WAAR;EACE,KAAKA,mBAAAA,UAAU;EACf,KAAKA,mBAAAA,UAAU,OACb,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;;;AAOA,MAAa,uBAAuB,UAClC,MAAM,iBAAiB,wBAAwB,MAAM,OAAO,IAAI;AAElE,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,gCACrC;CACN,CAAC;AAEL;;;;;;;;;AAUA,MAAa,yBAAyB,UACpC,MAAM,OAAO,SAASA,mBAAAA,UAAU,SAChC,MAAM,OAAO,SAASA,mBAAAA,UAAU,qBAChC,MAAM,OAAO,SAASA,mBAAAA,UAAU;AAElC,MAAa,kBAAkB,UAA8B;CAC3D,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,yBAAyB,UAA8B;CAClE,IAAI,CAAC,eAAe,KAAK,GACvB,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,6BAA6B,UAA8B;CACtE,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL;AAEA,MAAa,4BAA4B,UAA8B;CACrE,IAAI,CAAC,sBAAsB,KAAK,GAC9B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,SAAS,KAAK,KAAK,EAAE;CAC/B,CAAC;AAEL"}