@keboola/api-client 53.0.0 → 54.0.0

package/dist/{types-DNldEa7i.d.ts → types-COb2O9c1.d.ts}

@@ -2273,6 +2273,66 @@ type paths = {
     patch: operations['patch_/manage/projects/{projectId}/users/{userId}::ProjectUpdateAdministratorAction'];
     trace?: never;
   };
+  '/manage/search': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Search projects, organizations, maintainers and users
+     * @description Looks up the entities an admin navigates to across the whole stack, by name (and email for users).
+     *
+     *     #### Access
+     *
+     *     Each type is searched only when the caller may read it; a type it may not read is **absent** from the
+     *     response, not an empty collection, so "not allowed" and "no hits" can be told apart.
+     *
+     *     * super admin — every type
+     *     * `project`, `organization`, `maintainer` — any L1 support feature (such as `can-manage-features`
+     *       or `can-disable-projects`)
+     *     * `user` — feature `can-manage-users` (the rule of `GET /manage/users`)
+     *
+     *     Any other admin gets 403; membership in a project, organization or maintainer grants nothing here.
+     *     Admin and session tokens are accepted.
+     *
+     *     #### Matching
+     *
+     *     * *q* - required, trimmed, 2 to 255 characters. Matched as a case-insensitive substring of the name,
+     *       and of the email for users. `%` and `_` match themselves. An all-digit `q` also matches the row with
+     *       that exact `id`.
+     *     * Deleted projects, organizations and maintainers and anonymized users are never found. Disabled
+     *       projects are found and carry `isDisabled: true`.
+     *     * *filter[types]* - comma-separated subset of `project`, `organization`, `maintainer`, `user`;
+     *       omitted, every type the caller may read is searched. A listed type the caller may not read is
+     *       left out like an unlisted one.
+     *
+     *     #### Ranking and pagination
+     *
+     *     Each type is its own cursor-paginated collection (`data`, `meta`, `links`). Every item carries its
+     *     `rank`: `0` exact id match, `1` the name (or user email) starts with `q`, `2` any other match.
+     *     Items are ordered `rank ASC, id DESC`.
+     *
+     *     * *page[limit]* - items returned per type; default value: 10, maximum: 50
+     *     * *page[after]* - cursor of the last item already read, for a single type: it requires exactly one
+     *       type in `filter[types]`. It is the base64url (padding optional) of `{"rank": <integer>, "id": <integer>}`
+     *       copied from that item, e.g. `{"rank":2,"id":4088}` → `eyJyYW5rIjoyLCJpZCI6NDA4OH0`.
+     *       Each type's `links.next` already carries its next page, with `filter[types]` narrowed to that type.
+     *
+     *     A `q` that is missing or too short or long, an unknown or repeated type, an undecodable cursor,
+     *     `page[after]` without exactly one type, and bare `limit` / `offset` or `page[offset]` are rejected
+     *     with a validation error.
+     */
+    get: operations['get_/manage/search::SearchAction'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/manage/storage-backend/{backendId}/activate': {
     parameters: {
       query?: never;
@@ -6228,6 +6288,92 @@ type components = {
         email: string;
       } | null;
     };
+    ProjectSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 4088 */
+      id: number;
+      /** @example Sales reporting */
+      name: string;
+      organization: {
+        /** @example 123 */
+        id: number;
+        /** @example Acme */
+        name: string;
+      };
+      /** @description The project is disabled; it is still found. */
+      isDisabled: boolean;
+    };
+    OrganizationSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 123 */
+      id: number;
+      /** @example Acme */
+      name: string;
+      maintainer: {
+        /** @example 1 */
+        id: number;
+        /** @example Keboola */
+        name: string | null;
+      };
+    };
+    MaintainerSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name prefix, `2` name substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 1 */
+      id: number;
+      /** @example Keboola */
+      name: string | null;
+    };
+    UserSearchItem: {
+      /**
+       * @description Match rank: `0` exact id, `1` name or email prefix, `2` name or email substring.
+       * @enum {integer}
+       */
+      rank: 0 | 1 | 2;
+      /** @example 42 */
+      id: number;
+      /** @example John Doe */
+      name: string;
+      /** @example john.doe@keboola.com */
+      email: string;
+    };
+    SearchResponse: {
+      /** @description Projects matching `q`; absent when the caller may not read projects or `filter[types]` leaves them out. */
+      project?: {
+        data: components['schemas']['ProjectSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Organizations matching `q`; absent when the caller may not read organizations or `filter[types]` leaves them out. */
+      organization?: {
+        data: components['schemas']['OrganizationSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Maintainers matching `q`; absent when the caller may not read maintainers or `filter[types]` leaves them out. */
+      maintainer?: {
+        data: components['schemas']['MaintainerSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+      /** @description Users matching `q`; absent when the caller may not read users or `filter[types]` leaves them out. */
+      user?: {
+        data: components['schemas']['UserSearchItem'][];
+        meta: components['schemas']['PaginationMeta'];
+        links: components['schemas']['PaginationLinks'];
+      };
+    };
     StorageBackendResponse: {
       /** @description Root credentials identifier. */
       id: number;
@@ -15448,6 +15594,117 @@ interface operations {
       };
     };
   };
+  'get_/manage/search::SearchAction': {
+    parameters: {
+      query: {
+        /**
+         * @description Search term: 2 to 255 characters after trimming. An all-digit term also matches by exact `id`.
+         * @example acme
+         */
+        q: string;
+        /**
+         * @description Pagination: `page[limit]` (default 10, maximum 50) and `page[after]`, the cursor of the last row read — base64url(json) of `{"rank": integer, "id": integer}`, rows ordered `rank ASC, id DESC`. Omit `page[after]` for the first page; `links.next` carries the next one.
+         * @example {
+         *       "limit": 10
+         *     }
+         */
+        page?: {
+          /** @description base64url(json) of `{"rank": integer, "id": integer}`. */
+          after?: string;
+          /** @default 10 */
+          limit?: number;
+        };
+        /** @description Filters, JSON:API style: `filter[<name>]=<value>`. Filters combine with AND. */
+        filter?: {
+          /**
+           * @description Comma-separated subset of `project`, `organization`, `maintainer`, `user`; omitted, every type the caller may read.
+           * @example project,organization
+           */
+          types?: string;
+        };
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Hits grouped by type; only the types the caller may read and asked for are present. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          /**
+           * @example {
+           *       "project": {
+           *         "data": [
+           *           {
+           *             "rank": 1,
+           *             "id": 4088,
+           *             "name": "Acme reporting",
+           *             "organization": {
+           *               "id": 123,
+           *               "name": "Acme"
+           *             },
+           *             "isDisabled": false
+           *           }
+           *         ],
+           *         "meta": {
+           *           "total": 1,
+           *           "limit": 10,
+           *           "cursor": {
+           *             "param": "page[after]",
+           *             "encoding": "base64url(json)",
+           *             "fields": [
+           *               {
+           *                 "name": "rank",
+           *                 "type": "integer",
+           *                 "nullable": false
+           *               },
+           *               {
+           *                 "name": "id",
+           *                 "type": "integer",
+           *                 "nullable": false
+           *               }
+           *             ],
+           *             "order": "rank ASC, id DESC"
+           *           }
+           *         },
+           *         "links": {
+           *           "self": "https://connection.keboola.com/manage/search?q=acme&filter[types]=project&page[limit]=10",
+           *           "first": "https://connection.keboola.com/manage/search?q=acme&filter[types]=project&page[limit]=10",
+           *           "next": null
+           *         }
+           *       }
+           *     }
+           */
+          'application/json': components['schemas']['SearchResponse'];
+        };
+      };
+      /** @description Returned when `q`, `filter[types]` or the `page` parameters are invalid. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the Manage token is missing or invalid. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Returned when the token is not an admin or session token, or its admin may search no type. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'post_/manage/storage-backend/{backendId}/activate::StorageBackendActivateAction': {
     parameters: {
       query?: never;
@@ -18456,6 +18713,14 @@ type ChangeProjectUserRoleBody = {
   role: User['role'];
 };
 type ChangeProjectUserRoleInput = ChangeProjectUserRolePath & ChangeProjectUserRoleBody;
+/** Query parameters of `GET /manage/search`: `q` plus the `filter[types]` and `page` deep objects. */
+type SearchQuery = OpenapiQueryType<paths['/manage/search']['get']>;
+/** `GET /manage/search`: one cursor-paginated collection per type the caller may read and asked for. */
+type SearchResult = OpenapiReturnType<paths['/manage/search']['get']>;
+type ProjectSearchItem = components['schemas']['ProjectSearchItem'];
+type OrganizationSearchItem = components['schemas']['OrganizationSearchItem'];
+type MaintainerSearchItem = components['schemas']['MaintainerSearchItem'];
+type UserSearchItem = components['schemas']['UserSearchItem'];
 /**
  * A storage backend as returned by `GET /manage/storage-backend/{id}`.
  *
@@ -18475,6 +18740,9 @@ type StorageBackend = Omit<components['schemas']['StorageBackendDetailResponse']
   /** BigQuery detail only; `null` = never configured. Overlay until connection#9129 deploys and
    * the schema is regenerated. */
   policyTagCapability?: PolicyTagCapability | null;
+  /** BigQuery only, on detail and list: the GCP folder id, `null` when the backend has none.
+   * Overlay until connection#9187 deploys and the schema is regenerated. */
+  folderId?: string | null;
 };
 /** The stored policy-tag capability of a BigQuery backend, as the console `--status` shows it. */
 type PolicyTagCapability = {
@@ -18589,5 +18857,5 @@ type ProjectRetentionWorkspace = {
   } | null;
 };
 type ManagementToken = components['schemas']['ManageTokenVerifyResponse'];
-export { MoveProjectBody as $, OrganizationProject as $n, PayAsYouGoBillingConfiguration as $t, UpdateStorageBackendBody as A, SamlConfigPath as An, GetAllFeaturesQuery as Ar, UpdateProjectInput as At, CreateProjectFeaturePath as B, AdminUser as Bn, ProjectInvitation as Br, User as Bt, StorageBackend as C, MaintainerInvitationPath as Cn, RotateFileStorageS3Input as Cr, SetProjectLimitsBody as Ct, StorageBackendProject as D, MaintainerUserPath as Dn, FeatureAdmin as Dr, SetProjectReviewersBody as Dt, StorageBackendPath as E, MaintainerUser as En, Feature as Er, SetProjectMetadataPath as Et, AssignProjectTemplateFeatureInput as F, UpdateMaintainerInput as Fn, DeletedProjectsPage as Fr, RemoveUserFeaturePath as Ft, GetProjectMetadataPath as G, Organization as Gn, CreatedApplicationToken as Gr, UserPath as Gt, CreateProjectInvitationPath as H, CreateOrganizationInvitationInput as Hn, ApplicationToken as Hr, UserListItem as Ht, ChangeProjectUserRoleBody as I, UpdateSamlConfigBody as In, DeletedProjectsStats as Ir, SetUserMetadataBody as It, JoinProjectBody as J, OrganizationInvitationPath as Jn, ConfirmProgrammaticProjectResult as Jt, GetProjectPath as K, OrganizationDetail as Kn, components as Kr, UserProjectMembership as Kt, ChangeProjectUserRoleInput as L, UpdateSamlConfigInput as Ln, DeletedProjectsStatus as Lr, SetUserMetadataInput as Lt, AddProjectUserBody as M, SetMaintainerMetadataBody as Mn, DeletedProjectPurgeResult as Mr, AddUserFeaturePath as Mt, AddProjectUserPath as N, SetMaintainerMetadataInput as Nn, DeletedProjectsListFilter as Nr, DeleteUserMetadataPath as Nt, UpdateBigqueryStorageBackendBody as O, MetadataItem as On, FeatureProject as Or, SetProjectReviewersPath as Ot, AssignFeatureBody as P, UpdateMaintainerBody as Pn, DeletedProjectsListQuery as Pr, GetUsersQuery as Pt, ListProjectUsersPath as Q, OrganizationPath as Qn, CreditPurchase as Qt, ChangeProjectUserRolePath as R, AddOrganizationUserBody as Rn, MaintainerInvitation as Rr, UpdateUserBody as Rt, PolicyTagEnablementGuideSchemaQuery as S, MaintainerInvitationDetail as Sn, RotateFileStorageS3Body as Sr, SetProjectDisabledInput as St, StorageBackendMaintainer as T, MaintainerPath as Tn, UpdateFileStorageBody as Tr, SetProjectMetadataBody as Tt, DeleteProjectInvitationPath as U, CreateOrganizationProjectBody as Un, ApplicationTokenScope as Ur, UserMaintainerMembership as Ut, CreateProjectInvitationBody as V, CreateOrganizationInvitationBody as Vn, ProjectJoinRequest as Vr, UserDetail as Vt, DeleteProjectMetadataPath as W, CreateOrganizationProjectInput as Wn, CreateApplicationTokenBody as Wr, UserOrganizationMembership as Wt, ListProjectInvitationsPath as X, OrganizationMaintainer as Xn, CreatePaymentRequestBody as Xt, JoinProjectInput as Y, OrganizationListItem as Yn, ProgrammaticProjectClaim as Yt, ListProjectJoinRequestsPath as Z, OrganizationMetadataItemPath as Zn, CreditPaymentRequest as Zt, PolicyTagCapability as _, CreateSamlConfigBody as _n, RotateFileStorageAbsInput as _r, RemoveProjectUserPath as _t, GetUiAppsQuery as a, X402PaymentStatus as an, SetUpBigQueryBody as ar, ProjectInvitationDetail as at, PolicyTagEnablementGuidePath as b, Maintainer as bn, RotateFileStorageGcsInput as br, Reviewer as bt, UiApp as c, AddMaintainerUserBody as cn, CreateFileStorageS3Body as cr, ProjectMetadataInput as ct, UiAppVersion as d, CompleteSamlSetupInput as dn, FileStorageGcs as dr, ProjectTemplate as dt, StripeCustomer as en, OrganizationUserPath as er, MoveProjectInput as et, CreateBigqueryServerSideStorageBackendBody as f, CreateMaintainerBody as fn, FileStorageProject as fr, ProjectTemplatePath as ft, GetStorageBackendProjectsQuery as g, CreateMaintainerOrganizationInput as gn, RotateFileStorageAbsBody as gr, RemoveProjectTemplateFeaturePath as gt, CreateSnowflakeStorageBackendResponse as h, CreateMaintainerOrganizationBody as hn, FileStorageS3 as hr, RemoveProjectLimitPath as ht, ReactivateWorkspaceResult as i, UpdateTopUpSettingBody as in, UpdateOrganizationInput as ir, ProjectInvitableRole as it, UpdateStorageBackendInput as j, SamlConfigSummary as jn, DeletedProject as jr, AddUserFeatureBody as jt, UpdateBigqueryStorageBackendInput as k, SamlConfigDetail as kn, FeatureType as kr, UpdateProjectBody as kt, UiAppDetail as l, AddMaintainerUserInput as ln, FileStorage as lr, ProjectMetadataItem as lt, CreateSnowflakeStorageBackendBody as m, CreateMaintainerInvitationInput as mn, FileStorageProjectsQuery as mr, RemoveProjectFeaturePath as mt, ProjectRetentionWorkspace as n, TopUpSetting as nn, SetOrganizationMetadataInput as nr, ProjectBase as nt, RegisterUiAppBody as o, X402_PAYMENT_STATUS as on, CreateFileStorageAbsBody as or, ProjectJoinRequestDetail as ot, CreateBigqueryStorageBackendBody as p, CreateMaintainerInvitationBody as pn, FileStorageProjectsPage as pr, ProjectWithFeatureWarnings as pt, GetProjectReviewersPath as q, OrganizationInvitationDetail as qn, paths as qr, ConfirmProgrammaticProjectBody as qt, ProjectRetentionWorkspaceState as r, UpdateStripeCustomerBody as rn, UpdateOrganizationBody as rr, ProjectFeatureWarning as rt, RenameUiAppBody as s, X402_TOP_UP_TYPE as sn, CreateFileStorageGcsBody as sr, ProjectJoinRequestPath as st, ManagementToken as t, StripeCustomerCard as tn, SetOrganizationMetadataBody as tr, Project as tt, UiAppRegistrationResult as u, CompleteSamlSetupBody as un, FileStorageAbs as ur, ProjectPath as ut, PolicyTagEnablementGuide as v, CreateSamlConfigInput as vn, RotateFileStorageAbsPath as vr, RequestProjectAccessBody as vt, StorageBackendBigquery as w, MaintainerMetadataItemPath as wn, RotateFileStorageS3Path as wr, SetProjectLimitsInput as wt, PolicyTagEnablementGuideQuery as x, MaintainerDetail as xn, RotateFileStorageGcsPath as xr, SetProjectDisabledBody as xt, PolicyTagEnablementGuideInput as y, CreateSamlConfigPath as yn, RotateFileStorageGcsBody as yr, RequestProjectAccessInput as yt, CreateProjectFeatureBody as z, AddOrganizationUserInput as zn, OrganizationInvitation as zr, UpdateUserInput as zt };
-//# sourceMappingURL=types-DNldEa7i.d.ts.map
+export { GetProjectReviewersPath as $, OrganizationInvitationDetail as $n, paths as $r, ConfirmProgrammaticProjectBody as $t, UpdateStorageBackendBody as A, MaintainerMetadataItemPath as An, RotateFileStorageS3Path as Ar, SetProjectLimitsInput as At, AssignFeatureBody as B, UpdateMaintainerBody as Bn, DeletedProjectsListQuery as Br, GetUsersQuery as Bt, StorageBackend as C, CreateSamlConfigBody as Cn, RotateFileStorageAbsInput as Cr, RemoveProjectUserPath as Ct, StorageBackendProject as D, MaintainerDetail as Dn, RotateFileStorageGcsPath as Dr, SetProjectDisabledBody as Dt, StorageBackendPath as E, Maintainer as En, RotateFileStorageGcsInput as Er, Reviewer as Et, SearchQuery as F, SamlConfigDetail as Fn, FeatureType as Fr, UpdateProjectBody as Ft, CreateProjectFeatureBody as G, AddOrganizationUserInput as Gn, OrganizationInvitation as Gr, UpdateUserInput as Gt, ChangeProjectUserRoleBody as H, UpdateSamlConfigBody as Hn, DeletedProjectsStats as Hr, SetUserMetadataBody as Ht, SearchResult as I, SamlConfigPath as In, GetAllFeaturesQuery as Ir, UpdateProjectInput as It, CreateProjectInvitationPath as J, CreateOrganizationInvitationInput as Jn, ApplicationToken as Jr, UserListItem as Jt, CreateProjectFeaturePath as K, AdminUser as Kn, ProjectInvitation as Kr, User as Kt, UserSearchItem as L, SamlConfigSummary as Ln, DeletedProject as Lr, AddUserFeatureBody as Lt, MaintainerSearchItem as M, MaintainerUser as Mn, Feature as Mr, SetProjectMetadataPath as Mt, OrganizationSearchItem as N, MaintainerUserPath as Nn, FeatureAdmin as Nr, SetProjectReviewersBody as Nt, UpdateBigqueryStorageBackendBody as O, MaintainerInvitationDetail as On, RotateFileStorageS3Body as Or, SetProjectDisabledInput as Ot, ProjectSearchItem as P, MetadataItem as Pn, FeatureProject as Pr, SetProjectReviewersPath as Pt, GetProjectPath as Q, OrganizationDetail as Qn, components as Qr, UserProjectMembership as Qt, AddProjectUserBody as R, SetMaintainerMetadataBody as Rn, DeletedProjectPurgeResult as Rr, AddUserFeaturePath as Rt, PolicyTagEnablementGuideSchemaQuery as S, CreateMaintainerOrganizationInput as Sn, RotateFileStorageAbsBody as Sr, RemoveProjectTemplateFeaturePath as St, StorageBackendMaintainer as T, CreateSamlConfigPath as Tn, RotateFileStorageGcsBody as Tr, RequestProjectAccessInput as Tt, ChangeProjectUserRoleInput as U, UpdateSamlConfigInput as Un, DeletedProjectsStatus as Ur, SetUserMetadataInput as Ut, AssignProjectTemplateFeatureInput as V, UpdateMaintainerInput as Vn, DeletedProjectsPage as Vr, RemoveUserFeaturePath as Vt, ChangeProjectUserRolePath as W, AddOrganizationUserBody as Wn, MaintainerInvitation as Wr, UpdateUserBody as Wt, DeleteProjectMetadataPath as X, CreateOrganizationProjectInput as Xn, CreateApplicationTokenBody as Xr, UserOrganizationMembership as Xt, DeleteProjectInvitationPath as Y, CreateOrganizationProjectBody as Yn, ApplicationTokenScope as Yr, UserMaintainerMembership as Yt, GetProjectMetadataPath as Z, Organization as Zn, CreatedApplicationToken as Zr, UserPath as Zt, PolicyTagCapability as _, CompleteSamlSetupInput as _n, FileStorageGcs as _r, ProjectTemplate as _t, GetUiAppsQuery as a, PayAsYouGoBillingConfiguration as an, OrganizationProject as ar, MoveProjectBody as at, PolicyTagEnablementGuidePath as b, CreateMaintainerInvitationInput as bn, FileStorageProjectsQuery as br, RemoveProjectFeaturePath as bt, UiApp as c, TopUpSetting as cn, SetOrganizationMetadataInput as cr, ProjectBase as ct, UiAppVersion as d, X402PaymentStatus as dn, SetUpBigQueryBody as dr, ProjectInvitationDetail as dt, ConfirmProgrammaticProjectResult as en, OrganizationInvitationPath as er, JoinProjectBody as et, CreateBigqueryServerSideStorageBackendBody as f, X402_PAYMENT_STATUS as fn, CreateFileStorageAbsBody as fr, ProjectJoinRequestDetail as ft, GetStorageBackendProjectsQuery as g, CompleteSamlSetupBody as gn, FileStorageAbs as gr, ProjectPath as gt, CreateSnowflakeStorageBackendResponse as h, AddMaintainerUserInput as hn, FileStorage as hr, ProjectMetadataItem as ht, ReactivateWorkspaceResult as i, CreditPurchase as in, OrganizationPath as ir, ListProjectUsersPath as it, UpdateStorageBackendInput as j, MaintainerPath as jn, UpdateFileStorageBody as jr, SetProjectMetadataBody as jt, UpdateBigqueryStorageBackendInput as k, MaintainerInvitationPath as kn, RotateFileStorageS3Input as kr, SetProjectLimitsBody as kt, UiAppDetail as l, UpdateStripeCustomerBody as ln, UpdateOrganizationBody as lr, ProjectFeatureWarning as lt, CreateSnowflakeStorageBackendBody as m, AddMaintainerUserBody as mn, CreateFileStorageS3Body as mr, ProjectMetadataInput as mt, ProjectRetentionWorkspace as n, CreatePaymentRequestBody as nn, OrganizationMaintainer as nr, ListProjectInvitationsPath as nt, RegisterUiAppBody as o, StripeCustomer as on, OrganizationUserPath as or, MoveProjectInput as ot, CreateBigqueryStorageBackendBody as p, X402_TOP_UP_TYPE as pn, CreateFileStorageGcsBody as pr, ProjectJoinRequestPath as pt, CreateProjectInvitationBody as q, CreateOrganizationInvitationBody as qn, ProjectJoinRequest as qr, UserDetail as qt, ProjectRetentionWorkspaceState as r, CreditPaymentRequest as rn, OrganizationMetadataItemPath as rr, ListProjectJoinRequestsPath as rt, RenameUiAppBody as s, StripeCustomerCard as sn, SetOrganizationMetadataBody as sr, Project as st, ManagementToken as t, ProgrammaticProjectClaim as tn, OrganizationListItem as tr, JoinProjectInput as tt, UiAppRegistrationResult as u, UpdateTopUpSettingBody as un, UpdateOrganizationInput as ur, ProjectInvitableRole as ut, PolicyTagEnablementGuide as v, CreateMaintainerBody as vn, FileStorageProject as vr, ProjectTemplatePath as vt, StorageBackendBigquery as w, CreateSamlConfigInput as wn, RotateFileStorageAbsPath as wr, RequestProjectAccessBody as wt, PolicyTagEnablementGuideQuery as x, CreateMaintainerOrganizationBody as xn, FileStorageS3 as xr, RemoveProjectLimitPath as xt, PolicyTagEnablementGuideInput as y, CreateMaintainerInvitationBody as yn, FileStorageProjectsPage as yr, ProjectWithFeatureWarnings as yt, AddProjectUserPath as z, SetMaintainerMetadataInput as zn, DeletedProjectsListFilter as zr, DeleteUserMetadataPath as zt };
+//# sourceMappingURL=types-COb2O9c1.d.ts.map

package/dist/{types-DjWubjvP.d.cts → types-CaBcgsT2.d.cts}

@@ -210,14 +210,15 @@ type paths = {
      *     registration is usable):
      *
      *     * Repository permissions: Contents → Read-only; Organization permissions: Members →
-     *       Read-only (the install callback needs it to confirm the installer owns the GitHub
+     *       Read-only (the callback needs it to confirm the user connecting owns the GitHub
      *       organization).
-     *     * "Where can this GitHub App be installed?" → Any account.
-     *     * **"Request user authorization (OAuth) during installation" must be enabled**, and the
-     *       App's Callback URL set to this service's
-     *       `/platform-consumers/github-app/callback`. Without it GitHub sends no `code` with the
-     *       install redirect, the callback cannot prove the installer owns the installation they
-     *       returned with, and every connection attempt fails there.
+     *     * "Where can this GitHub App be installed?" → Any account, for an App that third parties
+     *       install.
+     *     * The App's Callback URL list must include this service's
+     *       `/platform-consumers/github-app/callback`: connecting goes through the App's OAuth web
+     *       flow with that URL as `redirect_uri`. "Request user authorization (OAuth) during
+     *       installation" is not needed; when it is on, the redirect GitHub sends right after an
+     *       install has no `state` and is answered with directions to connect from Keboola.
      *     * `clientId` / `clientSecret` come from the same App's page ("Client ID", "Generate a new
      *       client secret") — they are not the App ID and private key.
      *
@@ -265,10 +266,11 @@ type paths = {
       cookie?: never;
     };
     /**
-     * GitHub App install callback
-     * @description Invoked by GitHub, not by API consumers. This is the App's Callback URL, configured once on
-     *     the GitHub side and identical for every install, which is why it carries no organization
-     *     segment — the organization is recovered from the install session that `state` resolves to.
+     * GitHub App OAuth callback
+     * @description Invoked by GitHub, not by API consumers. This is one of the App's Callback URLs, configured
+     *     once on the GitHub side and identical for every connection, which is why it carries no
+     *     organization segment — the organization is recovered from the install session that `state`
+     *     resolves to.
      *
      *     It is the only endpoint that records an installation, and it requires no Keboola credential.
      *     Three things authorise it, all of them necessary:
@@ -276,22 +278,29 @@ type paths = {
      *     1. `state` must match the `__Host-orgInstallSession` cookie set when the flow started (the
      *        legacy `oauthSessionId` cookie is ignored here);
      *     2. `state` must resolve to an unexpired install session;
-     *     3. the installing user must own the account the installation belongs to. GitHub, asked as
-     *        the App, says which account that is (`GET /app/installations/{id}`); asked with the
-     *        user-to-server token obtained from `code`, it says whether the installer is an active
-     *        owner of that organization (`GET /user/memberships/orgs/{login}` → `role: admin`,
-     *        `state: active`) or, for a personal account, that very user (`GET /user`). Being a
-     *        collaborator or an ordinary member is not enough.
+     *     3. the user who authorized (`code`, exchanged for a user-to-server token) must own the
+     *        account the bound installation belongs to: an active owner of that organization
+     *        (`GET /user/memberships/orgs/{login}` → `role: admin`, `state: active`) or, for a
+     *        personal account, that very user (`GET /user`). Being a collaborator or an ordinary
+     *        member is not enough. This is why the App needs "Organization members: read".
      *
-     *     Point 3 is why the App needs "Request user authorization (OAuth) during installation" and
-     *     the "Organization members: read" permission. Installation ids are small sequential
-     *     integers, so without that confirmation anyone able to start an install for an organization
-     *     they do administer could bind a stranger's installation and mint read tokens on that
-     *     stranger's private repositories.
+     *     Which installation is bound:
      *
-     *     When the installer is not a GitHub organization owner, GitHub returns
-     *     `setup_action=request` with no installation id: the installation is pending an owner's
-     *     approval and nothing is recorded.
+     *     * **OAuth web flow** (started by `POST /authorize/organizations/{organizationId}`; only
+     *       `code` and `state` come back): the App's installations the user can reach
+     *       (`GET /user/installations`, all pages), narrowed to the `account` given at the start if
+     *       any, each run through check 3. Exactly one owned installation is connected. None
+     *       installed is a `400` and none owned a `403`, both naming the App's install page
+     *       `{webBaseUrl}/apps/{slug}/installations/new`; several owned without `account` is a `400`
+     *       naming them — start again with `account`.
+     *     * **No `state`** — GitHub's redirect after an install started on GitHub, for an App that
+     *       requests user authorization during installation: a `400` saying the connection has to
+     *       be started from Keboola. Nothing is asked of GitHub or recorded.
+     *
+     *     Any `installation_id` GitHub adds to the query is ignored. Installation ids are small
+     *     sequential integers: believing one would let anyone able to start a connection for an
+     *     organization they do administer bind a stranger's installation and mint read tokens on
+     *     that stranger's private repositories.
      *
      *     An organization holds at most one connection per GitHub account and registration. When the
      *     account is already connected under a *different* installation id — the App was
@@ -318,23 +327,30 @@ type paths = {
     put?: never;
     /**
      * Connect a GitHub organization
-     * @description Starts the GitHub App install flow and redirects to GitHub.
+     * @description Starts connecting a GitHub organization and redirects to the GitHub App's OAuth web flow,
+     *     `{webBaseUrl}/login/oauth/authorize?client_id=…&redirect_uri=…&state=…`, where
+     *     `redirect_uri` is this service's `/platform-consumers/github-app/callback`. GitHub signs
+     *     the user in, asks them to authorize the App the first time, and returns to the callback,
+     *     which connects the installation the user owns (or the one on `account`). The App must
+     *     already be installed on the GitHub organization — by anyone, from anywhere; the callback
+     *     links the install page if it is not.
      *
-     *     Submitted by the browser as a form — a top-level navigation — exactly like
-     *     `POST /authorize/{componentId}`, with the caller's Storage API token in the `token` form
-     *     field, verified with Storage API by this service. The token may belong to any project the
-     *     caller can reach: it establishes only *who* the caller is. A token without an admin
-     *     (component or legacy token) is refused with `403`.
+     *     Submitted by the browser as a form — a top-level navigation from the organization's page
+     *     in the Control Panel — with the caller's Manage API token in the `manageToken` form field,
+     *     verified by this service with `GET /manage/tokens/verify`. The token must have a user
+     *     behind it: the Control Panel's session token or a personal Manage token. An application
+     *     token is refused with `403`; a token Manage API does not know, or reports as expired or
+     *     disabled, with `401`. Storage API tokens and programmatic `kbc_pat_*` tokens are not
+     *     accepted. The token establishes only *who* the
+     *     caller is, and it is never stored.
      *
      *     The organization is taken from the URL and the caller must be an administrator of it — `GET /manage/organizations/{id}/users` is
      *     Connection's organization administrators listing, so appearing in it is the admin check.
-     *     Deriving the organization from the token instead would be unsafe — users belong to projects
-     *     across several organizations and the project-to-organization link is invisible in the UI.
+     *     Super admins who are not listed are refused.
      *
      *     The credentials row is created incomplete and only becomes usable once the install
      *     callback records the installation. Starting again under the name of an incomplete row (an
-     *     abandoned tab, or an install that became an owner-approval request) replaces that row and
-     *     its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
+     *     abandoned tab or a refused callback) replaces that row and its session; otherwise the `app:expire-auth-sessions` cron sweeps it after an hour. A name
      *     already taken by a completed connection is a `409`.
      *
      *     The response sets the session cookie `__Host-orgInstallSession` (Secure, HttpOnly,
@@ -366,7 +382,8 @@ type paths = {
     /**
      * List connected GitHub organizations
      * @description Lists the GitHub accounts this Keboola organization has connected. Connections whose
-     *     install never completed are omitted.
+     *     install never completed are omitted. The caller must be an administrator of the
+     *     organization; see `ManageApiUserToken` for the accepted tokens.
      */
     get: operations['organizationCredentialsList'];
     put?: never;
@@ -423,7 +440,8 @@ type paths = {
     /**
      * Disconnect a GitHub organization
      * @description Removes the connection on the Keboola side. The App stays installed on GitHub until an
-     *     owner removes it there.
+     *     owner removes it there. The caller must be an administrator of the organization; see
+     *     `ManageApiUserToken` for the accepted tokens.
      */
     delete: operations['organizationCredentialsDelete'];
     options?: never;
@@ -555,8 +573,8 @@ type components = {
       webHost?: string;
     };
     OrganizationCredentialsInitRequest: {
-      /** @description Storage API token of the caller; identifies who they are */
-      token: string;
+      /** @description Manage API token of the caller with a user behind it (the Control Panel's session token or a personal Manage token); identifies who they are */
+      manageToken: string;
       /**
        * @description Unique within the organization.
        * @example acme-github
@@ -564,7 +582,7 @@ type components = {
       name: string;
       /**
        * Format: url
-       * @description Where GitHub returns the user after the install completes. Must be https.
+       * @description Where the browser returns after the connection completes. Must be https.
        */
       returnUrl: string;
       description?: string | null;
@@ -573,6 +591,11 @@ type components = {
        * @example acme.ghe.com
        */
       host?: string | null;
+      /**
+       * @description The GitHub account (organization or user login, case-insensitive) to connect. Needed only when the caller owns several accounts the GitHub App is installed on; omitted, the callback connects the only one.
+       * @example acme
+       */
+      account?: string | null;
     };
     OrganizationCredentials: {
       /** Format: uuid */
@@ -590,8 +613,22 @@ type components = {
        */
       host?: string;
       creator?: {
+        /** @description ID of the token the connection was started with. */
         id?: string;
+        /** @description Description of that token; for the Control Panel's session token, the user's email. */
         description?: string | null;
+        /**
+         * @description Which API the token belongs to. Connections are started with a Manage API token; `storage` marks connections started with a Storage API token before that.
+         * @enum {string}
+         */
+        type?: 'manage' | 'storage';
+        /** @description The user behind the Manage API token. A session token expires after about an hour, so this is what still says who connected the organization. Null for `storage`. */
+        user?: {
+          /** @example 76 */
+          id?: string;
+          /** @example admin@keboola.com */
+          email?: string | null;
+        } | null;
       };
       /** Format: date-time */
       created?: string;
@@ -1247,15 +1284,11 @@ interface operations {
   };
   platformConsumerInstallCallback: {
     parameters: {
-      query: {
-        /** @description GitHub installation ID. */
-        installation_id?: string;
-        /** @description Temporary user authorization code. Present only when the App has "Request user authorization (OAuth) during installation" enabled; the callback exchanges it for a user-to-server token and verifies installation ownership with it. */
+      query?: {
+        /** @description Temporary user authorization code; exchanged for a user-to-server token that identifies the user and verifies installation ownership. Missing when the user did not authorize the App (`error=access_denied`). */
         code?: string;
-        /** @description What GitHub did. `request` means an owner still has to approve. */
-        setup_action?: 'install' | 'request' | 'update';
-        /** @description Opaque install-session ID issued when the flow started. */
-        state: string;
+        /** @description Opaque install-session ID issued when the flow started. Required; GitHub omits it on the redirect after an install started on GitHub, which is answered with a `400`. */
+        state?: string;
       };
       header?: never;
       path?: never;
@@ -1270,8 +1303,16 @@ interface operations {
         };
         content?: never;
       };
-      400: components['responses']['400_BadRequest'];
-      /** @description The installer is not an active owner of the GitHub organization (or not the personal account) the installation belongs to, or the App lacks "Organization members: read" */
+      /** @description No `state` (the connection has to be started from Keboola); no matching session cookie or an expired session; no `code`, or GitHub rejected it; the App is not installed on any account the user can reach (or on the requested `account`) — the message links the install page; or the user owns several accounts with the App installed and no `account` was given — the message names them */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description The user owns none of the accounts the App is installed on that they can reach (or not the requested `account`): neither an active owner of the organization nor the personal account itself. The message links the install page, or names an organization enforcing SAML SSO the user's GitHub session is not authorized for. Also when the App lacks "Organization members: read" */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1289,6 +1330,24 @@ interface operations {
           'application/json': components['schemas']['Error'];
         };
       };
+      /** @description GitHub is rate limiting requests; see `Retry-After` */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
+      /** @description GitHub failed or returned a malformed answer */
+      502: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['Error'];
+        };
+      };
     };
   };
   organizationCredentialsInit: {
@@ -1307,7 +1366,7 @@ interface operations {
       };
     };
     responses: {
-      /** @description Redirect to GitHub to install the App */
+      /** @description Redirect to the GitHub App's OAuth web flow (`/login/oauth/authorize`) */
       302: {
         headers: {
           [name: string]: unknown;
@@ -1315,6 +1374,7 @@ interface operations {
         content?: never;
       };
       400: components['responses']['400_BadRequest'];
+      401: components['responses']['401_Unauthorized'];
       403: components['responses']['403_Forbidden'];
       /** @description A completed connection with this name already exists in the organization */
       409: {
@@ -1526,5 +1586,13 @@ type CredentialInput = ComponentPath & {
 type CreateCredentialInput = ComponentPath & Omit<CreateCredentialBody, '#data'> & {
   data: Record<string, unknown>;
 };
-export { CredentialInput as a, GetCredentialsInput as c, Credential as i, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, OrganizationConnection as s, ComponentPath as t };
-//# sourceMappingURL=types-DjWubjvP.d.cts.map
+type OrganizationCredentials = OpenapiReturnType<paths['/organizations/{organizationId}/credentials']['get']>[number];
+type ManageTokenInput = {
+  /** A Manage API token with a user behind it, e.g. the Control Panel's session token. */
+  manageToken: string;
+};
+type GetOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials']['get']> & ManageTokenInput;
+type DeleteOrganizationCredentialsInput = OpenapiPathType<paths['/organizations/{organizationId}/credentials/{id}']['delete']> & ManageTokenInput;
+type GetOrganizationConnectFormInput = OpenapiPathType<paths['/authorize/organizations/{organizationId}']['post']> & OpenapiBodyType<paths['/authorize/organizations/{organizationId}']['post']>;
+export { CredentialInput as a, GetOrganizationConnectFormInput as c, OrganizationCredentials as d, GetCredentialsInput as f, Credential as i, GetOrganizationCredentialsInput as l, CreateCredentialBody as n, CredentialPath as o, CreateCredentialInput as r, DeleteOrganizationCredentialsInput as s, ComponentPath as t, OrganizationConnection as u };
+//# sourceMappingURL=types-CaBcgsT2.d.cts.map