@keboola/api-client 53.0.0 → 54.0.0

package/dist/{oauth-CSBChWuf.cjs → oauth-CXcrilOp.cjs}

@@ -87,11 +87,57 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getOrganizationConnections
 	};
 };
+// src/clients/oauth/organizationCredentialsClient.ts
+/**
+* oauth-service's GitHub connections of a Keboola organization, managed by its administrator.
+*
+* - Each call takes the caller's Manage API token (with a user behind it); Storage tokens are refused.
+* - Connecting is a top-level form POST, so `getConnectForm` describes the form instead of sending it.
+*/
+const createOrganizationCredentialsClient = ({ baseUrl }) => {
+	const client = require_createOpenapiFetchClient.createOpenapiFetchClient({ baseUrl });
+	const manageTokenHeaders = (manageToken) => ({ [require_createFetchClient.KeboolaHttpHeader.MANAGEMENT_API_TOKEN]: manageToken });
+	const getOrganizationCredentials = async ({ manageToken, ...path }, signal) => {
+		const { data } = await client.get("/organizations/{organizationId}/credentials", { path }, {
+			signal,
+			headers: manageTokenHeaders(manageToken)
+		});
+		return data;
+	};
+	const deleteOrganizationCredentials = async ({ manageToken, ...path }, signal) => {
+		await client.delete("/organizations/{organizationId}/credentials/{id}", { path }, {
+			signal,
+			headers: manageTokenHeaders(manageToken)
+		});
+	};
+	/**
+	* The form that starts connecting a GitHub organization.
+	*
+	* - The browser submits it as a top-level navigation: the response sets a cookie and redirects to GitHub.
+	* - oauth-service accepts it only from the stack's Connection origin.
+	* - Empty optional fields are left out.
+	*/
+	const getConnectForm = ({ organizationId, ...fields }) => ({
+		action: `${baseUrl}/authorize/organizations/${encodeURIComponent(organizationId)}`,
+		fields: Object.entries(fields).filter((entry) => Boolean(entry[1]))
+	});
+	return {
+		getOrganizationCredentials,
+		deleteOrganizationCredentials,
+		getConnectForm
+	};
+};
 Object.defineProperty(exports, "createOauthClient", {
 	enumerable: true,
 	get: function() {
 		return createOauthClient;
 	}
 });
+Object.defineProperty(exports, "createOrganizationCredentialsClient", {
+	enumerable: true,
+	get: function() {
+		return createOrganizationCredentialsClient;
+	}
+});
 
-//# sourceMappingURL=oauth-CSBChWuf.cjs.map
+//# sourceMappingURL=oauth-CXcrilOp.cjs.map

package/dist/oauth-CXcrilOp.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-CXcrilOp.cjs","names":["createOpenapiFetchClient","createAuthHeaders","createGenericFetchClient","isApiError","HttpStatus","createOpenapiFetchClient","KeboolaHttpHeader"],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts","../src/clients/oauth/organizationCredentialsClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  DeleteOrganizationCredentialsInput,\n  GetOrganizationConnectFormInput,\n  GetOrganizationCredentialsInput,\n} from './types';\n\n/**\n * oauth-service's GitHub connections of a Keboola organization, managed by its administrator.\n *\n * - Each call takes the caller's Manage API token (with a user behind it); Storage tokens are refused.\n * - Connecting is a top-level form POST, so `getConnectForm` describes the form instead of sending it.\n */\nexport const createOrganizationCredentialsClient = ({ baseUrl }: { baseUrl: string }) => {\n  const client = createOpenapiFetchClient<paths>({ baseUrl });\n\n  const manageTokenHeaders = (manageToken: string) => ({\n    [KeboolaHttpHeader.MANAGEMENT_API_TOKEN]: manageToken,\n  });\n\n  const getOrganizationCredentials = async (\n    { manageToken, ...path }: GetOrganizationCredentialsInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/organizations/{organizationId}/credentials',\n      { path },\n      { signal, headers: manageTokenHeaders(manageToken) },\n    );\n    return data;\n  };\n\n  const deleteOrganizationCredentials = async (\n    { manageToken, ...path }: DeleteOrganizationCredentialsInput,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/organizations/{organizationId}/credentials/{id}',\n      { path },\n      { signal, headers: manageTokenHeaders(manageToken) },\n    );\n  };\n\n  /**\n   * The form that starts connecting a GitHub organization.\n   *\n   * - The browser submits it as a top-level navigation: the response sets a cookie and redirects to GitHub.\n   * - oauth-service accepts it only from the stack's Connection origin.\n   * - Empty optional fields are left out.\n   */\n  const getConnectForm = ({ organizationId, ...fields }: GetOrganizationConnectFormInput) => ({\n    action: `${baseUrl}/authorize/organizations/${encodeURIComponent(organizationId)}`,\n    fields: Object.entries(fields).filter((entry): entry is [string, string] => Boolean(entry[1])),\n  });\n\n  return { getOrganizationCredentials, deleteOrganizationCredentials, getConnectForm };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAASA,iCAAAA,yBAAgC;EAC7C;EACA;EACA,SAASC,aAAAA,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgBC,iCAAAA,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAIC,0BAAAA,WAAW,KAAK,KAAK,MAAM,SAAS,WAAWC,0BAAAA,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;ACjFA,MAAa,uCAAuC,EAAE,cAAmC;CACvF,MAAM,SAASC,iCAAAA,yBAAgC,EAAE,QAAQ,CAAC;CAE1D,MAAM,sBAAsB,iBAAyB,GAClDC,0BAAAA,kBAAkB,uBAAuB,YAC5C;CAEA,MAAM,6BAA6B,OACjC,EAAE,aAAa,GAAG,QAClB,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,+CACA,EAAE,KAAK,GACP;GAAE;GAAQ,SAAS,mBAAmB,WAAW;EAAE,CACrD;EACA,OAAO;CACT;CAEA,MAAM,gCAAgC,OACpC,EAAE,aAAa,GAAG,QAClB,WACG;EACH,MAAM,OAAO,OACX,oDACA,EAAE,KAAK,GACP;GAAE;GAAQ,SAAS,mBAAmB,WAAW;EAAE,CACrD;CACF;;;;;;;;CASA,MAAM,kBAAkB,EAAE,gBAAgB,GAAG,cAA+C;EAC1F,QAAQ,GAAG,QAAQ,2BAA2B,mBAAmB,cAAc;EAC/E,QAAQ,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,UAAqC,QAAQ,MAAM,EAAE,CAAC;CAC/F;CAEA,OAAO;EAAE;EAA4B;EAA+B;CAAe;AACrF"}

package/dist/{oauth-DOveZKUv.js → oauth-Ci0qeaS2.js}

@@ -1,4 +1,4 @@
-import { _ as HttpStatus, r as isApiError } from "./createFetchClient-Dc_ZMuq7.js";
+import { _ as HttpStatus, r as isApiError, v as KeboolaHttpHeader } from "./createFetchClient-Dc_ZMuq7.js";
 import { t as createGenericFetchClient } from "./createGenericFetchClient-Ba4E4T-Y.js";
 import { t as createOpenapiFetchClient } from "./createOpenapiFetchClient-DSk29o_s.js";
 import { t as createAuthHeaders } from "./auth-ZBQWCJPM.js";
@@ -87,6 +87,46 @@ const createOauthClient = ({ baseUrl, middlewares, auth }) => {
 		getOrganizationConnections
 	};
 };
-export { createOauthClient as t };
+// src/clients/oauth/organizationCredentialsClient.ts
+/**
+* oauth-service's GitHub connections of a Keboola organization, managed by its administrator.
+*
+* - Each call takes the caller's Manage API token (with a user behind it); Storage tokens are refused.
+* - Connecting is a top-level form POST, so `getConnectForm` describes the form instead of sending it.
+*/
+const createOrganizationCredentialsClient = ({ baseUrl }) => {
+	const client = createOpenapiFetchClient({ baseUrl });
+	const manageTokenHeaders = (manageToken) => ({ [KeboolaHttpHeader.MANAGEMENT_API_TOKEN]: manageToken });
+	const getOrganizationCredentials = async ({ manageToken, ...path }, signal) => {
+		const { data } = await client.get("/organizations/{organizationId}/credentials", { path }, {
+			signal,
+			headers: manageTokenHeaders(manageToken)
+		});
+		return data;
+	};
+	const deleteOrganizationCredentials = async ({ manageToken, ...path }, signal) => {
+		await client.delete("/organizations/{organizationId}/credentials/{id}", { path }, {
+			signal,
+			headers: manageTokenHeaders(manageToken)
+		});
+	};
+	/**
+	* The form that starts connecting a GitHub organization.
+	*
+	* - The browser submits it as a top-level navigation: the response sets a cookie and redirects to GitHub.
+	* - oauth-service accepts it only from the stack's Connection origin.
+	* - Empty optional fields are left out.
+	*/
+	const getConnectForm = ({ organizationId, ...fields }) => ({
+		action: `${baseUrl}/authorize/organizations/${encodeURIComponent(organizationId)}`,
+		fields: Object.entries(fields).filter((entry) => Boolean(entry[1]))
+	});
+	return {
+		getOrganizationCredentials,
+		deleteOrganizationCredentials,
+		getConnectForm
+	};
+};
+export { createOauthClient as n, createOrganizationCredentialsClient as t };
 
-//# sourceMappingURL=oauth-DOveZKUv.js.map
+//# sourceMappingURL=oauth-Ci0qeaS2.js.map

package/dist/oauth-Ci0qeaS2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-Ci0qeaS2.js","names":[],"sources":["../src/clients/oauth/utils.ts","../src/clients/oauth/oauthClient.ts","../src/clients/oauth/organizationCredentialsClient.ts"],"sourcesContent":["/**\n * Which credentials to list:\n *\n * - `all` — the whole project: branch-scoped and branchless alike.\n * - `branchless` — only what is tied to no branch at all, not even the default one.\n * - `branched` — only the branch whose id it carries.\n *\n * Discriminated on `scope`, not on `branchId` being present: a `string | 'all' | 'branchless'` union\n * collapses to `string`, so a mistyped scope would silently become a branch-id filter.\n */\nexport type GetCredentialsInput =\n  | { scope: 'all'; componentId?: string }\n  | { scope: 'branchless'; componentId?: string }\n  | { scope: 'branched'; branchId: string; componentId?: string };\n\n/**\n * All three scopes ride the one `branchId` query parameter:\n *\n * - `all` → omitted, which the service reads as no filter.\n * - `branchless` → the literal string `'null'`, which it reads as `branchId IS NULL`.\n * - `branched` → the branch id itself.\n */\nexport type CredentialsDataFormat = 'encrypted' | 'plain';\n\n/**\n * The credentials payload rides one of two fields, and only one of them is in the current spec:\n *\n * - `encrypted` — `#data`, the payload serialized to a string. The `#` marks it for the service to\n *   encrypt at rest.\n * - `plain` — `data`, the payload as an object. Only services predating the spec accept it.\n */\nexport const encodeCredentialsData = (\n  data: Record<string, unknown>,\n  format: CredentialsDataFormat,\n) => (format === 'encrypted' ? { '#data': JSON.stringify(data) } : { data });\n\nexport const getScopedBranchId = (scope: GetCredentialsInput) => {\n  switch (scope.scope) {\n    case 'all':\n      return undefined;\n    case 'branchless':\n      return 'null';\n    case 'branched':\n      return scope.branchId;\n  }\n};\n","import { createGenericFetchClient, createOpenapiFetchClient, isApiError } from '../../fetchClient';\nimport { HttpStatus } from '../../internal';\nimport { createAuthHeaders } from '../auth';\nimport type { ClientInitOptions } from '../types';\n\nimport type { paths } from './__generated__/schema';\nimport type { CreateCredentialInput, CredentialInput } from './types';\nimport type { CredentialsDataFormat, GetCredentialsInput } from './utils';\nimport { encodeCredentialsData, getScopedBranchId } from './utils';\n\nexport const createOauthClient = ({ baseUrl, middlewares, auth }: ClientInitOptions) => {\n  const client = createOpenapiFetchClient<paths>({\n    baseUrl,\n    middlewares,\n    headers: createAuthHeaders(auth),\n  });\n  const genericClient = createGenericFetchClient({ baseUrl, middlewares });\n\n  const getCredentials = async (scope: GetCredentialsInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials',\n      { query: { branchId: getScopedBranchId(scope), componentId: scope.componentId } },\n      { signal },\n    );\n    return data;\n  };\n\n  const getCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    const { data } = await client.get(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n    return data;\n  };\n\n  const createCredential = async (\n    { componentId, data, ...rest }: CreateCredentialInput,\n    signal?: AbortSignal,\n  ) => {\n    const post = (format: CredentialsDataFormat) =>\n      client\n        .post(\n          '/credentials/{componentId}',\n          {\n            path: { componentId },\n            // The plain shape predates the spec, so no schema can describe it. It borrows the\n            // encrypted field's type to get past the generated body — the one assertion here.\n            body: { ...rest, ...(encodeCredentialsData(data, format) as { '#data': string }) },\n          },\n          { signal },\n        )\n        .then((response) => response.data);\n\n    try {\n      return await post('plain');\n    } catch (error) {\n      if (isApiError(error) && error.response.status === HttpStatus.UNPROCESSABLE_ENTITY) {\n        return post('encrypted');\n      }\n      throw error;\n    }\n  };\n\n  const deleteCredential = async ({ componentId, id }: CredentialInput, signal?: AbortSignal) => {\n    await client.delete(\n      '/credentials/{componentId}/{name}',\n      { path: { componentId, name: id } },\n      { signal },\n    );\n  };\n\n  /**\n   * The GitHub connections of the project's organization; any project member's token may read them.\n   *\n   * - Empty when the organization has none.\n   * - A listed connection does not guarantee a repository: the App installation must cover it.\n   */\n  const getOrganizationConnections = async (signal?: AbortSignal) => {\n    const { data } = await client.get('/organization-credentials/connections', {}, { signal });\n    return data.connections;\n  };\n\n  const healthCheck = async (signal?: AbortSignal) => {\n    const { data } = await genericClient.get('/health-check', {}, { signal });\n\n    return data;\n  };\n\n  return {\n    healthCheck,\n    getCredentials,\n    getCredential,\n    createCredential,\n    deleteCredential,\n    getOrganizationConnections,\n  };\n};\n","import { createOpenapiFetchClient } from '../../fetchClient';\nimport { KeboolaHttpHeader } from '../../internal';\n\nimport type { paths } from './__generated__/schema';\nimport type {\n  DeleteOrganizationCredentialsInput,\n  GetOrganizationConnectFormInput,\n  GetOrganizationCredentialsInput,\n} from './types';\n\n/**\n * oauth-service's GitHub connections of a Keboola organization, managed by its administrator.\n *\n * - Each call takes the caller's Manage API token (with a user behind it); Storage tokens are refused.\n * - Connecting is a top-level form POST, so `getConnectForm` describes the form instead of sending it.\n */\nexport const createOrganizationCredentialsClient = ({ baseUrl }: { baseUrl: string }) => {\n  const client = createOpenapiFetchClient<paths>({ baseUrl });\n\n  const manageTokenHeaders = (manageToken: string) => ({\n    [KeboolaHttpHeader.MANAGEMENT_API_TOKEN]: manageToken,\n  });\n\n  const getOrganizationCredentials = async (\n    { manageToken, ...path }: GetOrganizationCredentialsInput,\n    signal?: AbortSignal,\n  ) => {\n    const { data } = await client.get(\n      '/organizations/{organizationId}/credentials',\n      { path },\n      { signal, headers: manageTokenHeaders(manageToken) },\n    );\n    return data;\n  };\n\n  const deleteOrganizationCredentials = async (\n    { manageToken, ...path }: DeleteOrganizationCredentialsInput,\n    signal?: AbortSignal,\n  ) => {\n    await client.delete(\n      '/organizations/{organizationId}/credentials/{id}',\n      { path },\n      { signal, headers: manageTokenHeaders(manageToken) },\n    );\n  };\n\n  /**\n   * The form that starts connecting a GitHub organization.\n   *\n   * - The browser submits it as a top-level navigation: the response sets a cookie and redirects to GitHub.\n   * - oauth-service accepts it only from the stack's Connection origin.\n   * - Empty optional fields are left out.\n   */\n  const getConnectForm = ({ organizationId, ...fields }: GetOrganizationConnectFormInput) => ({\n    action: `${baseUrl}/authorize/organizations/${encodeURIComponent(organizationId)}`,\n    fields: Object.entries(fields).filter((entry): entry is [string, string] => Boolean(entry[1])),\n  });\n\n  return { getOrganizationCredentials, deleteOrganizationCredentials, getConnectForm };\n};\n"],"mappings":";;;;;;;;;;;;AA+BA,MAAa,yBACX,MACA,WACI,WAAW,cAAc,EAAE,SAAS,KAAK,UAAU,IAAI,EAAE,IAAI,EAAE,KAAK;AAE1E,MAAa,qBAAqB,UAA+B;CAC/D,QAAQ,MAAM,OAAd;EACE,KAAK,OACH;EACF,KAAK,cACH,OAAO;EACT,KAAK,YACH,OAAO,MAAM;CACjB;AACF;;ACnCA,MAAa,qBAAqB,EAAE,SAAS,aAAa,WAA8B;CACtF,MAAM,SAAS,yBAAgC;EAC7C;EACA;EACA,SAAS,kBAAkB,IAAI;CACjC,CAAC;CACD,MAAM,gBAAgB,yBAAyB;EAAE;EAAS;CAAY,CAAC;CAEvE,MAAM,iBAAiB,OAAO,OAA4B,WAAyB;EACjF,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,gBACA,EAAE,OAAO;GAAE,UAAU,kBAAkB,KAAK;GAAG,aAAa,MAAM;EAAY,EAAE,GAChF,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,gBAAgB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC1F,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;EACA,OAAO;CACT;CAEA,MAAM,mBAAmB,OACvB,EAAE,aAAa,MAAM,GAAG,QACxB,WACG;EACH,MAAM,QAAQ,WACZ,OACG,KACC,8BACA;GACE,MAAM,EAAE,YAAY;GAGpB,MAAM;IAAE,GAAG;IAAM,GAAI,sBAAsB,MAAM,MAAM;GAA0B;EACnF,GACA,EAAE,OAAO,CACX,CAAC,CACA,MAAM,aAAa,SAAS,IAAI;EAErC,IAAI;GACF,OAAO,MAAM,KAAK,OAAO;EAC3B,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,KAAK,MAAM,SAAS,WAAW,WAAW,sBAC5D,OAAO,KAAK,WAAW;GAEzB,MAAM;EACR;CACF;CAEA,MAAM,mBAAmB,OAAO,EAAE,aAAa,MAAuB,WAAyB;EAC7F,MAAM,OAAO,OACX,qCACA,EAAE,MAAM;GAAE;GAAa,MAAM;EAAG,EAAE,GAClC,EAAE,OAAO,CACX;CACF;;;;;;;CAQA,MAAM,6BAA6B,OAAO,WAAyB;EACjE,MAAM,EAAE,SAAS,MAAM,OAAO,IAAI,yCAAyC,CAAC,GAAG,EAAE,OAAO,CAAC;EACzF,OAAO,KAAK;CACd;CAEA,MAAM,cAAc,OAAO,WAAyB;EAClD,MAAM,EAAE,SAAS,MAAM,cAAc,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC;EAExE,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;;ACjFA,MAAa,uCAAuC,EAAE,cAAmC;CACvF,MAAM,SAAS,yBAAgC,EAAE,QAAQ,CAAC;CAE1D,MAAM,sBAAsB,iBAAyB,GAClD,kBAAkB,uBAAuB,YAC5C;CAEA,MAAM,6BAA6B,OACjC,EAAE,aAAa,GAAG,QAClB,WACG;EACH,MAAM,EAAE,SAAS,MAAM,OAAO,IAC5B,+CACA,EAAE,KAAK,GACP;GAAE;GAAQ,SAAS,mBAAmB,WAAW;EAAE,CACrD;EACA,OAAO;CACT;CAEA,MAAM,gCAAgC,OACpC,EAAE,aAAa,GAAG,QAClB,WACG;EACH,MAAM,OAAO,OACX,oDACA,EAAE,KAAK,GACP;GAAE;GAAQ,SAAS,mBAAmB,WAAW;EAAE,CACrD;CACF;;;;;;;;CASA,MAAM,kBAAkB,EAAE,gBAAgB,GAAG,cAA+C;EAC1F,QAAQ,GAAG,QAAQ,2BAA2B,mBAAmB,cAAc;EAC/E,QAAQ,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,UAAqC,QAAQ,MAAM,EAAE,CAAC;CAC/F;CAEA,OAAO;EAAE;EAA4B;EAA+B;CAAe;AACrF"}

package/dist/{project-Onf-IcPW.cjs → project-BQ2oD6IW.cjs}

@@ -1,5 +1,5 @@
 const require_adminRoles = require("./adminRoles-DnFpO_2W.cjs");
-const require_admin = require("./admin-Di-MmGFP.cjs");
+const require_admin = require("./admin-BZ7knTd0.cjs");
 // src/domain/permissions/organization.ts
 /**
 * Whether this token's admin is a member of the organization owning the project.
@@ -133,4 +133,4 @@ Object.defineProperty(exports, "isOrganizationMember", {
 	}
 });
 
-//# sourceMappingURL=project-Onf-IcPW.cjs.map
+//# sourceMappingURL=project-BQ2oD6IW.cjs.map

package/dist/{project-Onf-IcPW.cjs.map → project-BQ2oD6IW.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"project-Onf-IcPW.cjs","names":["isAdminOrShare","PermissionDeniedError","AdminRole"],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAKA,cAAAA,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAIC,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAIA,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAASC,mBAAAA,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}
+{"version":3,"file":"project-BQ2oD6IW.cjs","names":["isAdminOrShare","PermissionDeniedError","AdminRole"],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAKA,cAAAA,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAIC,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAIA,cAAAA,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAASC,mBAAAA,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/{project-DmuC0bMK.js → project-aAVAOcmx.js}

@@ -1,5 +1,5 @@
 import { t as AdminRole } from "./adminRoles-asa-MhDD.js";
-import { h as PermissionDeniedError, l as isAdminOrShare } from "./admin-CbMOsfgs.js";
+import { g as PermissionDeniedError, u as isAdminOrShare } from "./admin-xFfHSZHQ.js";
 // src/domain/permissions/organization.ts
 /**
 * Whether this token's admin is a member of the organization owning the project.
@@ -80,4 +80,4 @@ const createProject = ({ sapiToken }) => {
 };
 export { assertCanAdministerOrganization as a, isOrganizationAdmin as c, canListSharingTargets as i, isOrganizationMember as l, hasAdminFeature as n, assertCanWriteKaiSpendCaps as o, hasFeature as r, canWriteKaiSpendCaps as s, createProject as t };
 
-//# sourceMappingURL=project-DmuC0bMK.js.map
+//# sourceMappingURL=project-aAVAOcmx.js.map

package/dist/{project-DmuC0bMK.js.map → project-aAVAOcmx.js.map}

@@ -1 +1 @@
-{"version":3,"file":"project-DmuC0bMK.js","names":[],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAK,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAAS,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}
+{"version":3,"file":"project-aAVAOcmx.js","names":[],"sources":["../src/domain/permissions/organization.ts","../src/domain/permissions/storage.ts","../src/domain/project.ts"],"sourcesContent":["/**\n * @module domain/permissions/organization\n *\n * Organization-scope predicates, read from `admin.isOrganizationMember`, not the project role.\n * - In Keboola, org membership is org administration of every project the org owns.\n * - `isOrganizationMember` is a raw signal; nothing asserts on bare membership.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\n\nimport { isAdminOrShare } from './admin';\nimport { PermissionDeniedError } from './errors';\n\n/**\n * Whether this token's admin is a member of the organization owning the project.\n *\n * - A limited token has no `admin` block despite the type saying required.\n * - Prefer `isOrganizationAdmin` for authorization decisions.\n */\nexport const isOrganizationMember = (token: StorageToken): boolean =>\n  token.isMasterToken && (token.admin?.isOrganizationMember ?? false);\n\n/**\n * `isOrganizationMember` AND `admin`/`share`.\n *\n * - An org member with a `readOnly` or `guest` role on this project still cannot write.\n */\nexport const isOrganizationAdmin = (token: StorageToken): boolean =>\n  isOrganizationMember(token) && isAdminOrShare(token);\n\nexport const assertCanAdministerOrganization = (token: StorageToken): void => {\n  if (!isOrganizationAdmin(token)) {\n    throw new PermissionDeniedError({\n      action: 'administer-organization',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not administer organization settings`\n        : 'a limited (non-master) token may not administer organization settings',\n    });\n  }\n};\n\n/**\n * Whether this token may write Kai's spend caps: project cap, default and per-user limits.\n *\n * - Org-admin only, stricter than `canWriteKaiSettings`: caps commit the org's money.\n * - A project whose own admin could raise its cap has no cap.\n */\nexport const canWriteKaiSpendCaps = (token: StorageToken): boolean => isOrganizationAdmin(token);\n\nexport const assertCanWriteKaiSpendCaps = (token: StorageToken): void => {\n  if (!canWriteKaiSpendCaps(token)) {\n    throw new PermissionDeniedError({\n      action: 'write-kai-spend-caps',\n      reason: token.isMasterToken\n        ? `role '${token.admin?.role ?? 'none'}' with isOrganizationMember=${token.admin?.isOrganizationMember ?? false} may not change Kai spend caps`\n        : 'a limited (non-master) token may not change Kai spend caps',\n    });\n  }\n};\n","/**\n * @module domain/permissions/storage\n *\n * Storage-scope predicates.\n */\nimport type { StorageToken } from '../../clients/storage/tokens/types';\nimport { AdminRole } from '../../constants/adminRoles';\n\nimport { isOrganizationMember } from './organization';\n\n/** Mirrors Connection's `CanListShareOptions` voter: the `share` role, or organization membership. */\nexport const canListSharingTargets = (token: StorageToken): boolean =>\n  isOrganizationMember(token) || (token.isMasterToken && token.admin?.role === AdminRole.Share);\n","import type { Backend, StorageToken } from '../clients/storage/tokens/types';\n\nimport { canListSharingTargets } from './permissions/storage';\n\ntype Options = {\n  sapiToken: StorageToken;\n};\n\nexport const hasFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const projectFeatureSet = new Set(token.owner.features);\n  return feature.every((x) => projectFeatureSet.has(x));\n};\n\n/**\n * The admin's features as the Storage token carries them.\n *\n * - The same list `createAdminAccount` reads from the Manage token: Connection serialises both\n *   from the admin row, so prefer the account where one is at hand — it also knows `isSuperAdmin`.\n */\nexport const hasAdminFeature = (token: StorageToken, ...feature: string[]): boolean => {\n  if (feature.length === 0) return false;\n  const adminFeatureSet = new Set(token.admin?.features ?? []);\n  return feature.every((x) => adminFeatureSet.has(x));\n};\n\nexport const createProject = ({ sapiToken }: Options) => {\n  const { owner, admin } = sapiToken;\n  const projectFeatureSet = new Set(owner.features);\n  // `verify` omits `admin` for a token created via `POST /v2/storage/tokens`, even though the type\n  // declares it: an admin-less token holds no admin features, rather than failing to build at all.\n  const adminFeatureSet = new Set(admin?.features ?? []);\n\n  const hasFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => projectFeatureSet.has(x));\n  };\n\n  // Same list as `createAdminAccount`'s; prefer the account where one is at hand.\n  const hasAdminFeature = (...feature: string[]) => {\n    if (feature.length === 0) return false;\n    return feature.every((x) => adminFeatureSet.has(x));\n  };\n\n  const hasBackend = (backend: Backend): boolean => {\n    if (backend === 'bigquery') return owner.hasBigquery;\n    if (backend === 'snowflake') return owner.hasSnowflake;\n    return false;\n  };\n\n  return {\n    hasFeature,\n    hasAdminFeature,\n    hasBackend,\n    canListSharingTargets: canListSharingTargets(sapiToken),\n    sapiToken,\n  };\n};\n\nexport type Project = ReturnType<typeof createProject>;\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB,UACnC,MAAM,kBAAkB,MAAM,OAAO,wBAAwB;;;;;;AAO/D,MAAa,uBAAuB,UAClC,qBAAqB,KAAK,KAAK,eAAe,KAAK;AAErD,MAAa,mCAAmC,UAA8B;CAC5E,IAAI,CAAC,oBAAoB,KAAK,GAC5B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,6CAC9G;CACN,CAAC;AAEL;;;;;;;AAQA,MAAa,wBAAwB,UAAiC,oBAAoB,KAAK;AAE/F,MAAa,8BAA8B,UAA8B;CACvE,IAAI,CAAC,qBAAqB,KAAK,GAC7B,MAAM,IAAI,sBAAsB;EAC9B,QAAQ;EACR,QAAQ,MAAM,gBACV,SAAS,MAAM,OAAO,QAAQ,OAAO,8BAA8B,MAAM,OAAO,wBAAwB,MAAM,kCAC9G;CACN,CAAC;AAEL;;;AC9CA,MAAa,yBAAyB,UACpC,qBAAqB,KAAK,KAAM,MAAM,iBAAiB,MAAM,OAAO,SAAS,UAAU;;ACJzF,MAAa,cAAc,OAAqB,GAAG,YAA+B;CAChF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,oBAAoB,IAAI,IAAI,MAAM,MAAM,QAAQ;CACtD,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;AACtD;;;;;;;AAQA,MAAa,mBAAmB,OAAqB,GAAG,YAA+B;CACrF,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,MAAM,kBAAkB,IAAI,IAAI,MAAM,OAAO,YAAY,CAAC,CAAC;CAC3D,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;AACpD;AAEA,MAAa,iBAAiB,EAAE,gBAAyB;CACvD,MAAM,EAAE,OAAO,UAAU;CACzB,MAAM,oBAAoB,IAAI,IAAI,MAAM,QAAQ;CAGhD,MAAM,kBAAkB,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;CAErD,MAAM,cAAc,GAAG,YAAsB;EAC3C,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,kBAAkB,IAAI,CAAC,CAAC;CACtD;CAGA,MAAM,mBAAmB,GAAG,YAAsB;EAChD,IAAI,QAAQ,WAAW,GAAG,OAAO;EACjC,OAAO,QAAQ,OAAO,MAAM,gBAAgB,IAAI,CAAC,CAAC;CACpD;CAEA,MAAM,cAAc,YAA8B;EAChD,IAAI,YAAY,YAAY,OAAO,MAAM;EACzC,IAAI,YAAY,aAAa,OAAO,MAAM;EAC1C,OAAO;CACT;CAEA,OAAO;EACL;EACA;EACA;EACA,uBAAuB,sBAAsB,SAAS;EACtD;CACF;AACF"}

package/dist/queryService/index.d.cts

@@ -1,2 +1,2 @@
-import { C as createQueryServiceClient, D as TokenSource, E as QueryServiceCredentialProvider, S as QueryServiceClientInitOptions, T as QueryServiceCredential, w as AppUserTokenAuth } from "../index-BUKMdbKh.cjs";
+import { C as QueryServiceClientInitOptions, D as QueryServiceCredentialProvider, E as QueryServiceCredential, O as TokenSource, T as AppUserTokenAuth, w as createQueryServiceClient } from "../index-BtvWJBYh.cjs";
 export { type AppUserTokenAuth, QueryServiceClientInitOptions, type QueryServiceCredential, type QueryServiceCredentialProvider, type TokenSource, createQueryServiceClient };

package/dist/queryService/index.d.ts

@@ -1,2 +1,2 @@
-import { C as createQueryServiceClient, D as TokenSource, E as QueryServiceCredentialProvider, S as QueryServiceClientInitOptions, T as QueryServiceCredential, w as AppUserTokenAuth } from "../index-BxgHNJ3Q.js";
+import { C as QueryServiceClientInitOptions, D as QueryServiceCredentialProvider, E as QueryServiceCredential, O as TokenSource, T as AppUserTokenAuth, w as createQueryServiceClient } from "../index-Df30jjpZ.js";
 export { type AppUserTokenAuth, QueryServiceClientInitOptions, type QueryServiceCredential, type QueryServiceCredentialProvider, type TokenSource, createQueryServiceClient };

package/dist/queryService/types.d.cts

@@ -1,2 +1,2 @@
-import { $ as GetExportResultsQuery, Q as ExportResultsResponse, Z as QueryJobPollOptions, at as JobStatusResponse, ct as PostQueryPath, dt as Statements, et as GetQueriesHistoryQuery, it as GetQueryResutsQuery, lt as QueryJobStatus, nt as GetQueryJobPath, ot as PostCancelQueryJobPath, rt as GetQueryResultsPath, st as PostQueryBody, tt as GetQueriesPath, ut as QueryResult } from "../index-BUKMdbKh.cjs";
+import { $ as ExportResultsResponse, Q as QueryJobPollOptions, at as GetQueryResutsQuery, ct as PostQueryBody, dt as QueryResult, et as GetExportResultsQuery, ft as Statements, it as GetQueryResultsPath, lt as PostQueryPath, nt as GetQueriesPath, ot as JobStatusResponse, rt as GetQueryJobPath, st as PostCancelQueryJobPath, tt as GetQueriesHistoryQuery, ut as QueryJobStatus } from "../index-BtvWJBYh.cjs";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queryService/types.d.ts

@@ -1,2 +1,2 @@
-import { $ as GetExportResultsQuery, Q as ExportResultsResponse, Z as QueryJobPollOptions, at as JobStatusResponse, ct as PostQueryPath, dt as Statements, et as GetQueriesHistoryQuery, it as GetQueryResutsQuery, lt as QueryJobStatus, nt as GetQueryJobPath, ot as PostCancelQueryJobPath, rt as GetQueryResultsPath, st as PostQueryBody, tt as GetQueriesPath, ut as QueryResult } from "../index-BxgHNJ3Q.js";
+import { $ as ExportResultsResponse, Q as QueryJobPollOptions, at as GetQueryResutsQuery, ct as PostQueryBody, dt as QueryResult, et as GetExportResultsQuery, ft as Statements, it as GetQueryResultsPath, lt as PostQueryPath, nt as GetQueriesPath, ot as JobStatusResponse, rt as GetQueryJobPath, st as PostCancelQueryJobPath, tt as GetQueriesHistoryQuery, ut as QueryJobStatus } from "../index-Df30jjpZ.js";
 export { ExportResultsResponse, GetExportResultsQuery, GetQueriesHistoryQuery, GetQueriesPath, GetQueryJobPath, GetQueryResultsPath, GetQueryResutsQuery, JobStatusResponse, PostCancelQueryJobPath, PostQueryBody, PostQueryPath, type QueryJobPollOptions, QueryJobStatus, QueryResult, Statements };

package/dist/queryService-B4h1Ez44.cjs

@@ -0,0 +1,117 @@
+const require_ValidationError = require("./ValidationError-BXcFX4nD.cjs");
+const require_collectByOffset = require("./collectByOffset-DgxJ3zT9.cjs");
+// src/sdks/queryService/queryServiceSdk.ts
+const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
+const DEFAULT_POLL_INTERVAL = 500;
+const DEFAULT_TIMEOUT = 3e5;
+const assertPositiveInteger = (name, value) => {
+	if (!Number.isInteger(value) || value <= 0) throw new require_ValidationError.ValidationError(`${name} must be a positive integer, got ${value}`);
+};
+/**
+* Higher-level SDK composing queryService client calls with job polling and result-page
+* auto-pagination for orchestrated workflows.
+*/
+const createQueryServiceSdk = ({ queryServiceClient }) => {
+	/**
+	* Fetches every page of a statement's results, merging them into a single {@link QueryResult}.
+	*
+	* - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off
+	*   the first page; `collectByOffset` hands back only the rows.
+	* - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`
+	*   sibling resolving `{ first, items }`, not for widening this closure.
+	*/
+	const fetchAllResultPages = async (queryJobId, statementId, pageSize, maxRows) => {
+		let firstPage;
+		const data = await require_collectByOffset.collectByOffset({
+			pageSize,
+			limit: maxRows,
+			fetchFrom: async (offset, pageSize) => {
+				const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {
+					offset,
+					pageSize
+				});
+				firstPage ??= page;
+				return page.data ?? [];
+			}
+		});
+		if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);
+		return {
+			...firstPage,
+			data
+		};
+	};
+	/**
+	* Submits a query job, waits for completion, and fetches results for every statement —
+	* auto-paginating each statement's results so sets larger than `pageSize` come back in full
+	* instead of being truncated at the API's default page size.
+	*
+	* - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.
+	* - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.
+	*/
+	const executeQuery = async (branchId, workspaceId, body, options = {}) => {
+		const { pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE, maxRows, interval = DEFAULT_POLL_INTERVAL, timeout = DEFAULT_TIMEOUT, ...pollOptions } = options;
+		assertPositiveInteger("pageSize", pageSize);
+		if (maxRows !== void 0) assertPositiveInteger("maxRows", maxRows);
+		const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);
+		const status = await queryServiceClient.poller({
+			init: { id: queryJobId },
+			interval,
+			timeout,
+			...pollOptions
+		}).wait();
+		const results = [];
+		for (const statement of status.statements) results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));
+		return results;
+	};
+	return { executeQuery };
+};
+// src/sdks/queryService/parseCell.ts
+const FLOAT_TYPE = /^(real|float|float64)$/i;
+const DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;
+const DECIMAL = /^-?\d+(\.\d+)?$/;
+const EPOCH = /^-?\d+(\.\d+)?( \d+)?$/;
+const BIGQUERY_TIMESTAMP = /^(\S+) (\S+) \+0000 UTC$/;
+const DAY_MS = 864e5;
+/** Every decimal of at most this many significant digits survives a round trip through a double. */
+const EXACT_DIGITS = 15;
+const significantDigits = (decimal) => decimal.replace(/[-.]/g, "").replace(/^0+/, "").replace(/0+$/, "").length;
+const decimalOf = (cell) => {
+	const n = Number(cell);
+	return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS) ? n : cell;
+};
+const floatOf = (cell) => {
+	const n = Number(cell);
+	return Number.isFinite(n) ? n : cell;
+};
+const epochIso = (cell) => (/* @__PURE__ */ new Date(parseFloat(cell) * 1e3)).toISOString();
+const timestampOf = (cell) => EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, "$1T$2Z");
+/**
+* The parser for a Query Service cell (always a string) of one column type.
+*
+* 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).
+* 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.
+* 3. Timestamps become ISO (`timestamp_ntz`, `datetime` without `Z`); other types keep the string.
+*/
+const cellParser = (type) => {
+	if (DECIMAL_TYPE.test(type)) return decimalOf;
+	if (FLOAT_TYPE.test(type)) return floatOf;
+	if (/^bool(ean)?$/i.test(type)) return (cell) => cell === "true";
+	if (/^date$/i.test(type)) return (cell) => EPOCH.test(cell) ? (/* @__PURE__ */ new Date(Number(cell) * DAY_MS)).toISOString().slice(0, 10) : cell;
+	if (/^(timestamp_ntz|datetime)$/i.test(type)) return (cell) => EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell;
+	if (/^timestamp/i.test(type)) return timestampOf;
+	return (cell) => cell;
+};
+Object.defineProperty(exports, "cellParser", {
+	enumerable: true,
+	get: function() {
+		return cellParser;
+	}
+});
+Object.defineProperty(exports, "createQueryServiceSdk", {
+	enumerable: true,
+	get: function() {
+		return createQueryServiceSdk;
+	}
+});
+
+//# sourceMappingURL=queryService-B4h1Ez44.cjs.map

package/dist/queryService-B4h1Ez44.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryService-B4h1Ez44.cjs","names":["ValidationError","collectByOffset"],"sources":["../src/sdks/queryService/queryServiceSdk.ts","../src/sdks/queryService/parseCell.ts"],"sourcesContent":["import type { createQueryServiceClient } from '../../clients/queryService';\nimport type {\n  PostQueryBody,\n  PostQueryPath,\n  QueryJobPollOptions,\n  QueryResult,\n} from '../../clients/queryService/types';\nimport { ValidationError } from '../../errors';\nimport { collectByOffset } from '../../utils/async';\n\nconst DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5000;\nconst DEFAULT_POLL_INTERVAL = 500;\nconst DEFAULT_TIMEOUT = 300_000;\n\nconst assertPositiveInteger = (name: string, value: number) => {\n  if (!Number.isInteger(value) || value <= 0) {\n    throw new ValidationError(`${name} must be a positive integer, got ${value}`);\n  }\n};\n\nexport type ExecuteQueryOptions = Omit<QueryJobPollOptions, 'interval' | 'timeout'> & {\n  /** Poll interval in ms. Default: 500. */\n  interval?: number;\n  /** Give up after this many ms. Default: 300_000 (5 min). */\n  timeout?: number;\n  /** Page size used internally while auto-paginating each statement's results. Default: 5000. */\n  pageSize?: number;\n  /**\n   * Caps the number of rows fetched per statement. Pagination stops once this many rows have been\n   * collected. Default: unlimited (fetch every row).\n   */\n  maxRows?: number;\n};\n\ntype QueryServiceSdkOptions = {\n  queryServiceClient: ReturnType<typeof createQueryServiceClient>;\n};\n\n/**\n * Higher-level SDK composing queryService client calls with job polling and result-page\n * auto-pagination for orchestrated workflows.\n */\nexport const createQueryServiceSdk = ({ queryServiceClient }: QueryServiceSdkOptions) => {\n  /**\n   * Fetches every page of a statement's results, merging them into a single {@link QueryResult}.\n   *\n   * - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off\n   *   the first page; `collectByOffset` hands back only the rows.\n   * - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`\n   *   sibling resolving `{ first, items }`, not for widening this closure.\n   */\n  const fetchAllResultPages = async (\n    queryJobId: string,\n    statementId: string,\n    pageSize: number,\n    maxRows: number | undefined,\n  ): Promise<QueryResult> => {\n    let firstPage: QueryResult | undefined;\n\n    const data = await collectByOffset({\n      pageSize,\n      limit: maxRows,\n      fetchFrom: async (offset, pageSize) => {\n        const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {\n          offset,\n          pageSize,\n        });\n        firstPage ??= page;\n\n        return page.data ?? [];\n      },\n    });\n\n    if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);\n\n    return { ...firstPage, data };\n  };\n\n  /**\n   * Submits a query job, waits for completion, and fetches results for every statement —\n   * auto-paginating each statement's results so sets larger than `pageSize` come back in full\n   * instead of being truncated at the API's default page size.\n   *\n   * - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.\n   * - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.\n   */\n  const executeQuery = async (\n    branchId: PostQueryPath['branchId'],\n    workspaceId: PostQueryPath['workspaceId'],\n    body: PostQueryBody,\n    options: ExecuteQueryOptions = {},\n  ): Promise<QueryResult[]> => {\n    const {\n      pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE,\n      maxRows,\n      interval = DEFAULT_POLL_INTERVAL,\n      timeout = DEFAULT_TIMEOUT,\n      ...pollOptions\n    } = options;\n    assertPositiveInteger('pageSize', pageSize);\n    if (maxRows !== undefined) assertPositiveInteger('maxRows', maxRows);\n\n    const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);\n    const status = await queryServiceClient\n      .poller({ init: { id: queryJobId }, interval, timeout, ...pollOptions })\n      .wait();\n    const results: QueryResult[] = [];\n    for (const statement of status.statements) {\n      results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));\n    }\n\n    return results;\n  };\n\n  return {\n    executeQuery,\n  };\n};\n","const FLOAT_TYPE = /^(real|float|float64)$/i;\nconst DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;\nconst DECIMAL = /^-?\\d+(\\.\\d+)?$/;\nconst EPOCH = /^-?\\d+(\\.\\d+)?( \\d+)?$/;\nconst BIGQUERY_TIMESTAMP = /^(\\S+) (\\S+) \\+0000 UTC$/;\nconst DAY_MS = 86_400_000;\n/** Every decimal of at most this many significant digits survives a round trip through a double. */\nconst EXACT_DIGITS = 15;\n\nconst significantDigits = (decimal: string) =>\n  decimal.replace(/[-.]/g, '').replace(/^0+/, '').replace(/0+$/, '').length;\n\nconst decimalOf = (cell: string) => {\n  const n = Number(cell);\n  return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS)\n    ? n\n    : cell;\n};\n\nconst floatOf = (cell: string) => {\n  const n = Number(cell);\n  return Number.isFinite(n) ? n : cell;\n};\n\nconst epochIso = (cell: string) => new Date(parseFloat(cell) * 1000).toISOString();\n\nconst timestampOf = (cell: string) =>\n  EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, '$1T$2Z');\n\n/**\n * The parser for a Query Service cell (always a string) of one column type.\n *\n * 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).\n * 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.\n * 3. Timestamps become ISO (`timestamp_ntz`, `datetime` without `Z`); other types keep the string.\n */\nexport const cellParser = (type: string): ((cell: string) => unknown) => {\n  if (DECIMAL_TYPE.test(type)) return decimalOf;\n  if (FLOAT_TYPE.test(type)) return floatOf;\n  if (/^bool(ean)?$/i.test(type)) return (cell) => cell === 'true';\n  if (/^date$/i.test(type)) {\n    return (cell) =>\n      EPOCH.test(cell) ? new Date(Number(cell) * DAY_MS).toISOString().slice(0, 10) : cell;\n  }\n  if (/^(timestamp_ntz|datetime)$/i.test(type)) {\n    return (cell) => (EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell);\n  }\n  if (/^timestamp/i.test(type)) return timestampOf;\n  return (cell) => cell;\n};\n"],"mappings":";;;AAUA,MAAM,kCAAkC;AACxC,MAAM,wBAAwB;AAC9B,MAAM,kBAAkB;AAExB,MAAM,yBAAyB,MAAc,UAAkB;CAC7D,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GACvC,MAAM,IAAIA,wBAAAA,gBAAgB,GAAG,KAAK,mCAAmC,OAAO;AAEhF;;;;;AAwBA,MAAa,yBAAyB,EAAE,yBAAiD;;;;;;;;;CASvF,MAAM,sBAAsB,OAC1B,YACA,aACA,UACA,YACyB;EACzB,IAAI;EAEJ,MAAM,OAAO,MAAMC,wBAAAA,gBAAgB;GACjC;GACA,OAAO;GACP,WAAW,OAAO,QAAQ,aAAa;IACrC,MAAM,OAAO,MAAM,mBAAmB,gBAAgB,YAAY,aAAa;KAC7E;KACA;IACF,CAAC;IACD,cAAc;IAEd,OAAO,KAAK,QAAQ,CAAC;GACvB;EACF,CAAC;EAED,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,0CAA0C,aAAa;EAEvF,OAAO;GAAE,GAAG;GAAW;EAAK;CAC9B;;;;;;;;;CAUA,MAAM,eAAe,OACnB,UACA,aACA,MACA,UAA+B,CAAC,MACL;EAC3B,MAAM,EACJ,WAAW,iCACX,SACA,WAAW,uBACX,UAAU,iBACV,GAAG,gBACD;EACJ,sBAAsB,YAAY,QAAQ;EAC1C,IAAI,YAAY,KAAA,GAAW,sBAAsB,WAAW,OAAO;EAEnE,MAAM,EAAE,eAAe,MAAM,mBAAmB,eAAe,UAAU,aAAa,IAAI;EAC1F,MAAM,SAAS,MAAM,mBAClB,OAAO;GAAE,MAAM,EAAE,IAAI,WAAW;GAAG;GAAU;GAAS,GAAG;EAAY,CAAC,CAAC,CACvE,KAAK;EACR,MAAM,UAAyB,CAAC;EAChC,KAAK,MAAM,aAAa,OAAO,YAC7B,QAAQ,KAAK,MAAM,oBAAoB,YAAY,UAAU,IAAI,UAAU,OAAO,CAAC;EAGrF,OAAO;CACT;CAEA,OAAO,EACL,aACF;AACF;;ACrHA,MAAM,aAAa;AACnB,MAAM,eAAe;AACrB,MAAM,UAAU;AAChB,MAAM,QAAQ;AACd,MAAM,qBAAqB;AAC3B,MAAM,SAAS;;AAEf,MAAM,eAAe;AAErB,MAAM,qBAAqB,YACzB,QAAQ,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;AAErE,MAAM,aAAa,SAAiB;CAClC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,QAAQ,KAAK,IAAI,MAAM,OAAO,cAAc,CAAC,KAAK,kBAAkB,IAAI,KAAK,gBAChF,IACA;AACN;AAEA,MAAM,WAAW,SAAiB;CAChC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAClC;AAEA,MAAM,YAAY,0BAAiB,IAAI,KAAK,WAAW,IAAI,IAAI,GAAI,EAAA,CAAE,YAAY;AAEjF,MAAM,eAAe,SACnB,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,KAAK,QAAQ,oBAAoB,QAAQ;;;;;;;;AAS/E,MAAa,cAAc,SAA8C;CACvE,IAAI,aAAa,KAAK,IAAI,GAAG,OAAO;CACpC,IAAI,WAAW,KAAK,IAAI,GAAG,OAAO;CAClC,IAAI,gBAAgB,KAAK,IAAI,GAAG,QAAQ,SAAS,SAAS;CAC1D,IAAI,UAAU,KAAK,IAAI,GACrB,QAAQ,SACN,MAAM,KAAK,IAAI,qBAAI,IAAI,KAAK,OAAO,IAAI,IAAI,MAAM,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAEpF,IAAI,8BAA8B,KAAK,IAAI,GACzC,QAAQ,SAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAErE,IAAI,cAAc,KAAK,IAAI,GAAG,OAAO;CACrC,QAAQ,SAAS;AACnB"}

package/dist/queryService-DE_yE_S4.js

@@ -0,0 +1,106 @@
+import { t as ValidationError } from "./ValidationError-BsdFDGY2.js";
+import { t as collectByOffset } from "./collectByOffset-i8Tdoze7.js";
+// src/sdks/queryService/queryServiceSdk.ts
+const DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5e3;
+const DEFAULT_POLL_INTERVAL = 500;
+const DEFAULT_TIMEOUT = 3e5;
+const assertPositiveInteger = (name, value) => {
+	if (!Number.isInteger(value) || value <= 0) throw new ValidationError(`${name} must be a positive integer, got ${value}`);
+};
+/**
+* Higher-level SDK composing queryService client calls with job polling and result-page
+* auto-pagination for orchestrated workflows.
+*/
+const createQueryServiceSdk = ({ queryServiceClient }) => {
+	/**
+	* Fetches every page of a statement's results, merging them into a single {@link QueryResult}.
+	*
+	* - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off
+	*   the first page; `collectByOffset` hands back only the rows.
+	* - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`
+	*   sibling resolving `{ first, items }`, not for widening this closure.
+	*/
+	const fetchAllResultPages = async (queryJobId, statementId, pageSize, maxRows) => {
+		let firstPage;
+		const data = await collectByOffset({
+			pageSize,
+			limit: maxRows,
+			fetchFrom: async (offset, pageSize) => {
+				const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {
+					offset,
+					pageSize
+				});
+				firstPage ??= page;
+				return page.data ?? [];
+			}
+		});
+		if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);
+		return {
+			...firstPage,
+			data
+		};
+	};
+	/**
+	* Submits a query job, waits for completion, and fetches results for every statement —
+	* auto-paginating each statement's results so sets larger than `pageSize` come back in full
+	* instead of being truncated at the API's default page size.
+	*
+	* - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.
+	* - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.
+	*/
+	const executeQuery = async (branchId, workspaceId, body, options = {}) => {
+		const { pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE, maxRows, interval = DEFAULT_POLL_INTERVAL, timeout = DEFAULT_TIMEOUT, ...pollOptions } = options;
+		assertPositiveInteger("pageSize", pageSize);
+		if (maxRows !== void 0) assertPositiveInteger("maxRows", maxRows);
+		const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);
+		const status = await queryServiceClient.poller({
+			init: { id: queryJobId },
+			interval,
+			timeout,
+			...pollOptions
+		}).wait();
+		const results = [];
+		for (const statement of status.statements) results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));
+		return results;
+	};
+	return { executeQuery };
+};
+// src/sdks/queryService/parseCell.ts
+const FLOAT_TYPE = /^(real|float|float64)$/i;
+const DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;
+const DECIMAL = /^-?\d+(\.\d+)?$/;
+const EPOCH = /^-?\d+(\.\d+)?( \d+)?$/;
+const BIGQUERY_TIMESTAMP = /^(\S+) (\S+) \+0000 UTC$/;
+const DAY_MS = 864e5;
+/** Every decimal of at most this many significant digits survives a round trip through a double. */
+const EXACT_DIGITS = 15;
+const significantDigits = (decimal) => decimal.replace(/[-.]/g, "").replace(/^0+/, "").replace(/0+$/, "").length;
+const decimalOf = (cell) => {
+	const n = Number(cell);
+	return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS) ? n : cell;
+};
+const floatOf = (cell) => {
+	const n = Number(cell);
+	return Number.isFinite(n) ? n : cell;
+};
+const epochIso = (cell) => (/* @__PURE__ */ new Date(parseFloat(cell) * 1e3)).toISOString();
+const timestampOf = (cell) => EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, "$1T$2Z");
+/**
+* The parser for a Query Service cell (always a string) of one column type.
+*
+* 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).
+* 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.
+* 3. Timestamps become ISO (`timestamp_ntz`, `datetime` without `Z`); other types keep the string.
+*/
+const cellParser = (type) => {
+	if (DECIMAL_TYPE.test(type)) return decimalOf;
+	if (FLOAT_TYPE.test(type)) return floatOf;
+	if (/^bool(ean)?$/i.test(type)) return (cell) => cell === "true";
+	if (/^date$/i.test(type)) return (cell) => EPOCH.test(cell) ? (/* @__PURE__ */ new Date(Number(cell) * DAY_MS)).toISOString().slice(0, 10) : cell;
+	if (/^(timestamp_ntz|datetime)$/i.test(type)) return (cell) => EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell;
+	if (/^timestamp/i.test(type)) return timestampOf;
+	return (cell) => cell;
+};
+export { createQueryServiceSdk as n, cellParser as t };
+
+//# sourceMappingURL=queryService-DE_yE_S4.js.map

package/dist/queryService-DE_yE_S4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryService-DE_yE_S4.js","names":[],"sources":["../src/sdks/queryService/queryServiceSdk.ts","../src/sdks/queryService/parseCell.ts"],"sourcesContent":["import type { createQueryServiceClient } from '../../clients/queryService';\nimport type {\n  PostQueryBody,\n  PostQueryPath,\n  QueryJobPollOptions,\n  QueryResult,\n} from '../../clients/queryService/types';\nimport { ValidationError } from '../../errors';\nimport { collectByOffset } from '../../utils/async';\n\nconst DEFAULT_EXECUTE_QUERY_PAGE_SIZE = 5000;\nconst DEFAULT_POLL_INTERVAL = 500;\nconst DEFAULT_TIMEOUT = 300_000;\n\nconst assertPositiveInteger = (name: string, value: number) => {\n  if (!Number.isInteger(value) || value <= 0) {\n    throw new ValidationError(`${name} must be a positive integer, got ${value}`);\n  }\n};\n\nexport type ExecuteQueryOptions = Omit<QueryJobPollOptions, 'interval' | 'timeout'> & {\n  /** Poll interval in ms. Default: 500. */\n  interval?: number;\n  /** Give up after this many ms. Default: 300_000 (5 min). */\n  timeout?: number;\n  /** Page size used internally while auto-paginating each statement's results. Default: 5000. */\n  pageSize?: number;\n  /**\n   * Caps the number of rows fetched per statement. Pagination stops once this many rows have been\n   * collected. Default: unlimited (fetch every row).\n   */\n  maxRows?: number;\n};\n\ntype QueryServiceSdkOptions = {\n  queryServiceClient: ReturnType<typeof createQueryServiceClient>;\n};\n\n/**\n * Higher-level SDK composing queryService client calls with job polling and result-page\n * auto-pagination for orchestrated workflows.\n */\nexport const createQueryServiceSdk = ({ queryServiceClient }: QueryServiceSdkOptions) => {\n  /**\n   * Fetches every page of a statement's results, merging them into a single {@link QueryResult}.\n   *\n   * - `columns`, `status`, `rowsAffected` and `message` describe the statement, so they are read off\n   *   the first page; `collectByOffset` hands back only the rows.\n   * - A second consumer that needs the envelope back is the cue for a `collectPagesByOffset`\n   *   sibling resolving `{ first, items }`, not for widening this closure.\n   */\n  const fetchAllResultPages = async (\n    queryJobId: string,\n    statementId: string,\n    pageSize: number,\n    maxRows: number | undefined,\n  ): Promise<QueryResult> => {\n    let firstPage: QueryResult | undefined;\n\n    const data = await collectByOffset({\n      pageSize,\n      limit: maxRows,\n      fetchFrom: async (offset, pageSize) => {\n        const page = await queryServiceClient.getQueryResults(queryJobId, statementId, {\n          offset,\n          pageSize,\n        });\n        firstPage ??= page;\n\n        return page.data ?? [];\n      },\n    });\n\n    if (!firstPage) throw new Error(`No result pages returned for statement ${statementId}`);\n\n    return { ...firstPage, data };\n  };\n\n  /**\n   * Submits a query job, waits for completion, and fetches results for every statement —\n   * auto-paginating each statement's results so sets larger than `pageSize` come back in full\n   * instead of being truncated at the API's default page size.\n   *\n   * - Throws {@link QueryJobError} when the job ended `failed`, carrying the failed statements.\n   * - Throws the poll's failure when the wait timed out, was aborted or ran out of attempts.\n   */\n  const executeQuery = async (\n    branchId: PostQueryPath['branchId'],\n    workspaceId: PostQueryPath['workspaceId'],\n    body: PostQueryBody,\n    options: ExecuteQueryOptions = {},\n  ): Promise<QueryResult[]> => {\n    const {\n      pageSize = DEFAULT_EXECUTE_QUERY_PAGE_SIZE,\n      maxRows,\n      interval = DEFAULT_POLL_INTERVAL,\n      timeout = DEFAULT_TIMEOUT,\n      ...pollOptions\n    } = options;\n    assertPositiveInteger('pageSize', pageSize);\n    if (maxRows !== undefined) assertPositiveInteger('maxRows', maxRows);\n\n    const { queryJobId } = await queryServiceClient.createQueryJob(branchId, workspaceId, body);\n    const status = await queryServiceClient\n      .poller({ init: { id: queryJobId }, interval, timeout, ...pollOptions })\n      .wait();\n    const results: QueryResult[] = [];\n    for (const statement of status.statements) {\n      results.push(await fetchAllResultPages(queryJobId, statement.id, pageSize, maxRows));\n    }\n\n    return results;\n  };\n\n  return {\n    executeQuery,\n  };\n};\n","const FLOAT_TYPE = /^(real|float|float64)$/i;\nconst DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;\nconst DECIMAL = /^-?\\d+(\\.\\d+)?$/;\nconst EPOCH = /^-?\\d+(\\.\\d+)?( \\d+)?$/;\nconst BIGQUERY_TIMESTAMP = /^(\\S+) (\\S+) \\+0000 UTC$/;\nconst DAY_MS = 86_400_000;\n/** Every decimal of at most this many significant digits survives a round trip through a double. */\nconst EXACT_DIGITS = 15;\n\nconst significantDigits = (decimal: string) =>\n  decimal.replace(/[-.]/g, '').replace(/^0+/, '').replace(/0+$/, '').length;\n\nconst decimalOf = (cell: string) => {\n  const n = Number(cell);\n  return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS)\n    ? n\n    : cell;\n};\n\nconst floatOf = (cell: string) => {\n  const n = Number(cell);\n  return Number.isFinite(n) ? n : cell;\n};\n\nconst epochIso = (cell: string) => new Date(parseFloat(cell) * 1000).toISOString();\n\nconst timestampOf = (cell: string) =>\n  EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, '$1T$2Z');\n\n/**\n * The parser for a Query Service cell (always a string) of one column type.\n *\n * 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).\n * 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.\n * 3. Timestamps become ISO (`timestamp_ntz`, `datetime` without `Z`); other types keep the string.\n */\nexport const cellParser = (type: string): ((cell: string) => unknown) => {\n  if (DECIMAL_TYPE.test(type)) return decimalOf;\n  if (FLOAT_TYPE.test(type)) return floatOf;\n  if (/^bool(ean)?$/i.test(type)) return (cell) => cell === 'true';\n  if (/^date$/i.test(type)) {\n    return (cell) =>\n      EPOCH.test(cell) ? new Date(Number(cell) * DAY_MS).toISOString().slice(0, 10) : cell;\n  }\n  if (/^(timestamp_ntz|datetime)$/i.test(type)) {\n    return (cell) => (EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell);\n  }\n  if (/^timestamp/i.test(type)) return timestampOf;\n  return (cell) => cell;\n};\n"],"mappings":";;;AAUA,MAAM,kCAAkC;AACxC,MAAM,wBAAwB;AAC9B,MAAM,kBAAkB;AAExB,MAAM,yBAAyB,MAAc,UAAkB;CAC7D,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,SAAS,GACvC,MAAM,IAAI,gBAAgB,GAAG,KAAK,mCAAmC,OAAO;AAEhF;;;;;AAwBA,MAAa,yBAAyB,EAAE,yBAAiD;;;;;;;;;CASvF,MAAM,sBAAsB,OAC1B,YACA,aACA,UACA,YACyB;EACzB,IAAI;EAEJ,MAAM,OAAO,MAAM,gBAAgB;GACjC;GACA,OAAO;GACP,WAAW,OAAO,QAAQ,aAAa;IACrC,MAAM,OAAO,MAAM,mBAAmB,gBAAgB,YAAY,aAAa;KAC7E;KACA;IACF,CAAC;IACD,cAAc;IAEd,OAAO,KAAK,QAAQ,CAAC;GACvB;EACF,CAAC;EAED,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,0CAA0C,aAAa;EAEvF,OAAO;GAAE,GAAG;GAAW;EAAK;CAC9B;;;;;;;;;CAUA,MAAM,eAAe,OACnB,UACA,aACA,MACA,UAA+B,CAAC,MACL;EAC3B,MAAM,EACJ,WAAW,iCACX,SACA,WAAW,uBACX,UAAU,iBACV,GAAG,gBACD;EACJ,sBAAsB,YAAY,QAAQ;EAC1C,IAAI,YAAY,KAAA,GAAW,sBAAsB,WAAW,OAAO;EAEnE,MAAM,EAAE,eAAe,MAAM,mBAAmB,eAAe,UAAU,aAAa,IAAI;EAC1F,MAAM,SAAS,MAAM,mBAClB,OAAO;GAAE,MAAM,EAAE,IAAI,WAAW;GAAG;GAAU;GAAS,GAAG;EAAY,CAAC,CAAC,CACvE,KAAK;EACR,MAAM,UAAyB,CAAC;EAChC,KAAK,MAAM,aAAa,OAAO,YAC7B,QAAQ,KAAK,MAAM,oBAAoB,YAAY,UAAU,IAAI,UAAU,OAAO,CAAC;EAGrF,OAAO;CACT;CAEA,OAAO,EACL,aACF;AACF;;ACrHA,MAAM,aAAa;AACnB,MAAM,eAAe;AACrB,MAAM,UAAU;AAChB,MAAM,QAAQ;AACd,MAAM,qBAAqB;AAC3B,MAAM,SAAS;;AAEf,MAAM,eAAe;AAErB,MAAM,qBAAqB,YACzB,QAAQ,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;AAErE,MAAM,aAAa,SAAiB;CAClC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,QAAQ,KAAK,IAAI,MAAM,OAAO,cAAc,CAAC,KAAK,kBAAkB,IAAI,KAAK,gBAChF,IACA;AACN;AAEA,MAAM,WAAW,SAAiB;CAChC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAClC;AAEA,MAAM,YAAY,0BAAiB,IAAI,KAAK,WAAW,IAAI,IAAI,GAAI,EAAA,CAAE,YAAY;AAEjF,MAAM,eAAe,SACnB,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,KAAK,QAAQ,oBAAoB,QAAQ;;;;;;;;AAS/E,MAAa,cAAc,SAA8C;CACvE,IAAI,aAAa,KAAK,IAAI,GAAG,OAAO;CACpC,IAAI,WAAW,KAAK,IAAI,GAAG,OAAO;CAClC,IAAI,gBAAgB,KAAK,IAAI,GAAG,QAAQ,SAAS,SAAS;CAC1D,IAAI,UAAU,KAAK,IAAI,GACrB,QAAQ,SACN,MAAM,KAAK,IAAI,qBAAI,IAAI,KAAK,OAAO,IAAI,IAAI,MAAM,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAEpF,IAAI,8BAA8B,KAAK,IAAI,GACzC,QAAQ,SAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAErE,IAAI,cAAc,KAAK,IAAI,GAAG,OAAO;CACrC,QAAQ,SAAS;AACnB"}

package/dist/queue/index.d.cts

@@ -1,5 +1,5 @@
 import { Hr as CreateJobBody, Kr as OrchestrationRerunPlanPath, Qr as SearchJobsQuery, Ur as GetQueueJobPath, Wr as KillJobPath, Xr as SearchGroupedJobsQuery, Yr as SearchAllJobsQuery, ei as components } from "../index-FrsEkDvX.cjs";
-import "../index-BUKMdbKh.cjs";
+import "../index-BtvWJBYh.cjs";
 import { n as ClientInitOptions } from "../types-B4ezB18r.cjs";
 import { c as Poller } from "../index-24GpnYhn.cjs";
 declare const createQueueClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/queue/index.d.ts

@@ -1,5 +1,5 @@
 import { Hr as CreateJobBody, Kr as OrchestrationRerunPlanPath, Qr as SearchJobsQuery, Ur as GetQueueJobPath, Wr as KillJobPath, Xr as SearchGroupedJobsQuery, Yr as SearchAllJobsQuery, ei as components } from "../index-FrsEkDvX.js";
-import "../index-BxgHNJ3Q.js";
+import "../index-Df30jjpZ.js";
 import { n as ClientInitOptions } from "../types-Tg3euEN_.js";
 import { c as Poller } from "../index-BUZ-vTRt.js";
 declare const createQueueClient: ({ baseUrl, middlewares, auth }: ClientInitOptions) => {

package/dist/sdk/configurations/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_schemaGuidedMerge = require("../../schemaGuidedMerge-C8CqrNGe.cjs");
-const require_componentId = require("../../componentId-olp0tltf.cjs");
-const require_configurations = require("../../configurations-WI8H4zLk.cjs");
+const require_componentId = require("../../componentId-_tRhEv6W.cjs");
+const require_configurations = require("../../configurations-BM63ep1s.cjs");
 let zod = require("zod");
 // src/sdks/configurations/schemas/appDataGatewaySchema.ts
 /**

package/dist/sdk/configurations/index.d.cts

@@ -1,6 +1,6 @@
-import { Eo as CreateConfigurationInput, O as BranchRefs, Xo as UpdateConfigurationInput, ho as BaseComponentConfig, t as createEncryptionClient, wo as ConfigurationPath, y as createStorageClient } from "../../index-BUKMdbKh.cjs";
+import { Do as CreateConfigurationInput, To as ConfigurationPath, Zo as UpdateConfigurationInput, go as BaseComponentConfig, k as BranchRefs, t as createEncryptionClient, y as createStorageClient } from "../../index-BtvWJBYh.cjs";
 import { t as Project } from "../../project-BGk9CtOq.cjs";
-import "../../index-BL7uXOiY.cjs";
+import "../../index-B04rWq_0.cjs";
 import { z } from "zod";
 type Registry<M extends Record<string, z.ZodObject>> = {
   add: <const Id extends string, Schema extends z.ZodObject>(componentId: Id, schema: Schema) => Registry<M & Record<Id, Schema>>;

package/dist/sdk/configurations/index.d.ts

@@ -1,6 +1,6 @@
-import { Eo as CreateConfigurationInput, O as BranchRefs, Xo as UpdateConfigurationInput, ho as BaseComponentConfig, t as createEncryptionClient, wo as ConfigurationPath, y as createStorageClient } from "../../index-BxgHNJ3Q.js";
+import { Do as CreateConfigurationInput, To as ConfigurationPath, Zo as UpdateConfigurationInput, go as BaseComponentConfig, k as BranchRefs, t as createEncryptionClient, y as createStorageClient } from "../../index-Df30jjpZ.js";
 import { t as Project } from "../../project-DS0HOV3M.js";
-import "../../index-BoKrc8wy.js";
+import "../../index-DCfumWzq.js";
 import { z } from "zod";
 type Registry<M extends Record<string, z.ZodObject>> = {
   add: <const Id extends string, Schema extends z.ZodObject>(componentId: Id, schema: Schema) => Registry<M & Record<Id, Schema>>;