@keboola/api-client 56.0.0 → 57.0.0

package/dist/{types-DPFG6AAA.d.ts → types-CnSBLcZB.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-DcKc3_Y1.js";
+import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-9p4O-clX.js";
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -40,6 +40,9 @@ type paths = {
     /**
      * Create variable
      * @description Creates a new variable.
+     *
+     *     * An `encrypted` variable takes plaintext here and is encrypted by the service; a value that is
+     *       already ciphertext (`KBC::…`) is stored as it is.
      */
     post: operations['createVariable'];
     delete?: never;
@@ -48,6 +51,32 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/variables/group': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Move variables to a group
+     * @description Moves a set of variables to a group, or out of every group, in a single request.
+     *
+     *     * The group is outside the identity hash, so every variable keeps its row and its hash.
+     *     * An absent or `null` `group` means "out of every group".
+     *     * The move is one transaction and it is all-or-nothing: an unknown hash, a hash from another
+     *       project or a branch the token may not write to moves nothing.
+     *     * The response lists the variables in the order of `hashes`.
+     */
+    patch: operations['updateVariablesGroup'];
+    trace?: never;
+  };
   '/variables/{hash}': {
     parameters: {
       query?: never;
@@ -65,7 +94,22 @@ type paths = {
     delete: operations['deleteVariable'];
     options?: never;
     head?: never;
-    patch?: never;
+    /**
+     * Update variable
+     * @description Updates a variable in place.
+     *
+     *     * Only `value`, `flags` and `group` can be patched. The key, the attributes and the branch are the
+     *       variable's identity — they are hashed into `hash`, so an update keeps both the row and the hash.
+     *     * A field absent from the body is left alone; `group: null` moves the variable out of every group.
+     *     * An `encrypted` variable takes plaintext here and is encrypted by the service; a value that is
+     *       already ciphertext (`KBC::…`) is stored as it is.
+     *     * `flags` replaces the whole flag set. Adding `encrypted` encrypts the value being stored — the
+     *       one sent, or the stored plaintext when the body carries no `value`. Removing `encrypted` needs a
+     *       `value` in the same request, because the stored one is ciphertext the service cannot decrypt.
+     *     * The write happens only after validation, authorization and encryption have all succeeded, so a
+     *       rejected update leaves the variable with its old value.
+     */
+    patch: operations['updateVariable'];
     trace?: never;
   };
   '/variables/merged/branch': {
@@ -170,6 +214,35 @@ type components = {
       /** @description SHA-256 hash of the variable key + attributes */
       hash?: string;
     };
+    /**
+     * @description The changeable part of a variable. At least one property has to be present.
+     *
+     *     Key and attributes are the variable's identity and are not changeable here.
+     */
+    UpdateVariable: {
+      /** @description Plaintext for an `encrypted` variable — the service encrypts it. Must not be `null`. */
+      value?: string;
+      /**
+       * @description Replaces the whole flag set.
+       *
+       *     Adding `encrypted` encrypts the stored value. Removing it needs a `value` in the same
+       *     request: the stored one is ciphertext the service cannot decrypt.
+       */
+      flags?: ('encrypted' | 'oauthCredentialsId')[];
+      /**
+       * @description `null` moves the variable out of every group.
+       * @example MySQL Credentials
+       */
+      group?: string | null;
+    };
+    UpdateVariablesGroup: {
+      hashes: string[];
+      /**
+       * @description Absent or `null` moves the variables out of every group.
+       * @example MySQL Credentials
+       */
+      group?: string | null;
+    };
     Error: {
       error: string;
       code: number;
@@ -312,6 +385,46 @@ interface operations {
       };
     };
   };
+  updateVariablesGroup: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['UpdateVariablesGroup'];
+      };
+    };
+    responses: {
+      /** @description Variables moved */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['VariableWithHash'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      /** @description At least one hash does not belong to a variable in the project. Nothing was moved. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid request payload */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   deleteVariable: {
     parameters: {
       query?: never;
@@ -342,6 +455,53 @@ interface operations {
       };
     };
   };
+  updateVariable: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Variable hash */
+        hash: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['UpdateVariable'];
+      };
+    };
+    responses: {
+      /** @description Variable updated */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['VariableWithHash'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      /** @description Variable not found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /**
+       * @description Invalid request payload — an empty body, a `null` value, an unknown flag, a group that fails
+       *     validation, or `encrypted` removed without a new `value`. The variable keeps its old value,
+       *     flags and group.
+       */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   listBranchVariables: {
     parameters: {
       query?: {
@@ -388,4 +548,4 @@ type VariableWithHash = Omit<VariableWithHashRaw, 'hash'> & {
 };
 type AnyVariable = VariableWithHash | CreateVariableBody;
 export { GetVariablesQuery as a, GetVariablesByBranchId as i, CreateVariableBody as n, VariableWithHash as o, DeleteVariablePath as r, AnyVariable as t };
-//# sourceMappingURL=types-DPFG6AAA.d.ts.map
+//# sourceMappingURL=types-CnSBLcZB.d.ts.map

package/dist/{types-D4knWlwr.d.ts → types-CsXLdnfV.d.ts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-DcKc3_Y1.js";
+import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-9p4O-clX.js";
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -1781,4 +1781,4 @@ type MetaStoreListResponse<TData extends Record<string, unknown>> = {
 type GetSchemaPath = OpenapiPathType<paths['/api/v1/schema/{objectType}']['get']>;
 type GetVersionedSchemaPath = OpenapiPathType<paths['/api/v1/schema/{objectType}/{version}']['get']>;
 export { ReplaceMetaObjectPath as A, MetaObjectMeta as C, RawMetaObject as D, MetaStoreObjectResponse as E, UpdateMetaObjectBody as F, UpdateMetaObjectInput as I, UpdateMetaObjectPath as L, ReplaceTargetProjectsInput as M, ReplaceTargetProjectsPath as N, ReplaceMetaObjectBody as O, ScopeElevationRequestPath as P, components as R, MetaObject as S, MetaStoreListResponse as T, GetMetaObjectsQuery as _, CreateMetaObjectPath as a, GetOrganizationMetaObjectsQuery as b, DeleteMetaObjectRevisionPath as c, GetMetaObjectRevisionsInput as d, GetMetaObjectRevisionsPath as f, GetMetaObjectsPath as g, GetMetaObjectsInput as h, CreateMetaObjectInput as i, ReplaceTargetProjectsBody as j, ReplaceMetaObjectInput as k, GetMetaObjectPath as l, GetMetaObjectRevisionsSchemaQuery as m, GetVersionedSchemaPath as n, CreateMetaObjectReturn as o, GetMetaObjectRevisionsQuery as p, CreateMetaObjectBody as r, DeleteMetaObjectPath as s, GetSchemaPath as t, GetMetaObjectRevisionPath as u, GetMetaObjectsSchemaQuery as v, MetaObjectScope as w, GetOrganizationMetaObjectsSchemaQuery as x, GetOrganizationMetaObjectsPath as y, paths as z };
-//# sourceMappingURL=types-D4knWlwr.d.ts.map
+//# sourceMappingURL=types-CsXLdnfV.d.ts.map

package/dist/{types-C3Kf_ggm.d.cts → types-CzAh5-0z.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-DcKc3_Y1.cjs";
+import { c as OpenapiQueryType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-9p4O-clX.cjs";
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -2104,4 +2104,4 @@ type GetConnectorsQuery = NonNullable<OpenapiQueryType<paths['/connectors']['get
 type SetConnectorCredentialsPath = OpenapiPathType<paths['/connectors/{connector_id}/credentials']['put']>;
 type SetConnectorCredentialsBody = OpenapiBodyType<paths['/connectors/{connector_id}/credentials']['put']>;
 export { SetConnectorCredentialsBody as n, SetConnectorCredentialsPath as r, GetConnectorsQuery as t };
-//# sourceMappingURL=types-C3Kf_ggm.d.cts.map
+//# sourceMappingURL=types-CzAh5-0z.d.cts.map

package/dist/{types-D6Fbf_y3.d.ts → types-D0F_c5KI.d.ts}

@@ -1,6 +1,6 @@
-import { i as CreateMetaObjectInput } from "./types-D4knWlwr.js";
-import { n as createMetastoreClient } from "./index-B2YNTI4p.js";
-import { n as MetastoreObjectMeta, t as MetastoreObject } from "./metaObject-qWyZAD-5.js";
+import { i as CreateMetaObjectInput } from "./types-CsXLdnfV.js";
+import { n as createMetastoreClient } from "./index-CeWVf3d1.js";
+import { n as MetastoreObjectMeta, t as MetastoreObject } from "./metaObject-AQ7wKDOu.js";
 /**
  * The closed value sets the metastore accepts on a semantic object.
  *
@@ -172,4 +172,4 @@ type SemanticUnreadableObjectRef = {
   modelUUID: string | null;
 };
 export { CONSTRAINT_TYPES as A, SemanticRuleExpression as C, UpdateSemanticObjectMeta as D, SemanticValidationQuery as E, SQL_DIALECTS as F, RELATIONSHIP_JOIN_TYPES as M, RULE_OPERATORS as N, CONSTRAINT_SCOPES as O, SEMANTIC_OBJECT_SCOPES as P, SemanticRelationshipJoinType as S, SemanticUnreadableObjectRef as T, SemanticObject as _, SemanticChildObjectType as a, SemanticObjectType as b, SemanticConstraintSeverity as c, SemanticFieldData as d, SemanticFieldRole as f, SemanticModelData as g, SemanticModelChildRef as h, SemanticChildObjectDataMap as i, FIELD_ROLES as j, CONSTRAINT_SEVERITIES as k, SemanticConstraintType as l, SemanticMetricData as m, MetastoreClient as n, SemanticConstraintData as o, SemanticGlossaryData as p, SemanticAiMetadata as r, SemanticConstraintScope as s, CreateSemanticObjectMeta as t, SemanticDatasetData as u, SemanticObjectMeta as v, SemanticRuleOperator as w, SemanticRelationshipData as x, SemanticObjectScope as y };
-//# sourceMappingURL=types-D6Fbf_y3.d.ts.map
+//# sourceMappingURL=types-D0F_c5KI.d.ts.map

package/dist/{types-DykEfF2N.d.cts → types-D3L3CqKl.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-DcKc3_Y1.cjs";
+import { c as OpenapiQueryType, l as OpenapiReturnType, r as OpenapiBodyType, s as OpenapiPathType } from "./index-9p4O-clX.cjs";
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -24,6 +24,26 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/session/browser': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Adopt the browser session into an application session
+     * @description Mints a programmatic session for the admin signed in through the browser session cookie and pairs it with that browser session. Call it same-origin with the `X-KBC-CSRF: 1` header and no Authorization header; there is no request body. The refresh token is not returned: it stays in the cookie channel, so refresh in browser mode with the returned sessionId.
+     */
+    post: operations['post_Keboola\\Controller\\Auth\\BrowserSessionAdoptAction'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/v1/auth/device/approve': {
     parameters: {
       query?: never;
@@ -169,7 +189,11 @@ type paths = {
     delete?: never;
     options?: never;
     head?: never;
-    patch?: never;
+    /**
+     * Update the caller's own profile
+     * @description Sets the display name of the admin that owns the session. The endpoint always edits the caller; it accepts no other fields, and the e-mail address cannot be changed here.
+     */
+    patch: operations['patch_auth_me_update'];
     trace?: never;
   };
   '/v1/auth/me/maintainers': {
@@ -1147,6 +1171,16 @@ type components = {
        */
       webauthn: Record<string, never> | null;
     };
+    BrowserSessionAdoptResponse: {
+      /** @description Bearer access token (kbc_at_...). */
+      accessToken: string;
+      /** @example Bearer */
+      tokenType: string;
+      /** @description Access token lifetime in seconds. */
+      expiresIn: number;
+      /** @description Programmatic session id, for browser-mode refresh. */
+      sessionId: string;
+    };
     DeviceAuthorizationApprovalRequest: {
       /** @description User code to approve or deny. Required in bearer mode; browser mode uses the code stored in the session. */
       userCode: string;
@@ -1371,6 +1405,10 @@ type components = {
         hasMore: boolean;
       };
     };
+    MeProfileUpdateRequest: {
+      /** @description The display name. Leading and trailing whitespace is trimmed; it must not be empty. */
+      name: string;
+    };
     PaginationMeta: {
       /** @description Number of items matching the filters, ignoring pagination. */
       total: number;
@@ -1596,6 +1634,8 @@ type components = {
       lastUsedIp: string | null;
       /** @description User agent of the client. */
       userAgent: string | null;
+      /** @description Name the application reported for itself; not verified by Keboola. Set only for local (loopback) MCP clients. Display it next to `client`, never instead of it. */
+      reportedClientName: string | null;
       /**
        * Format: date-time
        * @description Access token expiration timestamp.
@@ -1843,6 +1883,57 @@ interface operations {
       };
     };
   };
+  'post_Keboola\\Controller\\Auth\\BrowserSessionAdoptAction': {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description Required; must be "1". */
+        'X-KBC-CSRF': '1';
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The programmatic session paired with the browser session. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['BrowserSessionAdoptResponse'];
+        };
+      };
+      /** @description No valid browser session cookie, a wrong X-KBC-CSRF value or an Origin outside the allowlist (`{"error": "invalid_session"}` from the cookie authenticator); or no X-KBC-CSRF header or an Authorization header on the request (auth.session.browserSessionRequired). */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description The admin may not hold an application session (auth.session.browserSessionAdoptionRefused). */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Too many adoptions for this browser session, or too many failed attempts from this IP. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   post_auth_device_authorization_approve: {
     parameters: {
       query?: never;
@@ -2252,6 +2343,60 @@ interface operations {
       };
     };
   };
+  patch_auth_me_update: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['MeProfileUpdateRequest'];
+      };
+    };
+    responses: {
+      /** @description The updated user. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            user: components['schemas']['MeUser'];
+          };
+        };
+      };
+      /** @description Empty or too long name, or a field other than `name` (validation.failed); or a body that is not a JSON object. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Access token is missing, malformed, expired, or its session has been revoked. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description PAT bearer presented to a session-only endpoint. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   'get_/v1/auth/me/maintainers': {
     parameters: {
       query?: {
@@ -3759,6 +3904,8 @@ type GetDeviceAuthorizationTokenResult = OpenapiReturnType<paths['/v1/auth/devic
 type LoginBody = OpenapiBodyType<paths['/v1/auth/login']['post']>;
 type MeResult = OpenapiReturnType<paths['/v1/auth/me']['get']>;
 type MeUser = OpenapiReturnType<paths['/v1/auth/me']['get']>['user'];
+type UpdateMeInput = OpenapiBodyType<paths['/v1/auth/me']['patch']>;
+type UpdateMeResult = OpenapiReturnType<paths['/v1/auth/me']['patch']>;
 type MeOrganization = OpenapiReturnType<paths['/v1/auth/me']['get']>['organizations']['preview'][number];
 type MeMaintainer = OpenapiReturnType<paths['/v1/auth/me']['get']>['maintainers']['preview'][number];
 type MeProject = OpenapiReturnType<paths['/v1/auth/me']['get']>['projects']['preview'][number];
@@ -3855,5 +4002,5 @@ type RegisterWebauthnResult = OpenapiReturnType<paths['/v1/auth/webauthn/registe
 type RemoveWebauthnPath = OpenapiPathType<paths['/v1/auth/webauthn/{id}']['delete']>;
 type RemoveWebauthnQuery = NonNullable<OpenapiQueryType<paths['/v1/auth/webauthn/{id}']['delete']>>;
 type RemoveWebauthnInput = RemoveWebauthnPath & RemoveWebauthnQuery;
-export { CreateDeviceAuthorizationBody as $, PatScopeInput as A, GetMeMaintainersResult as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, MeMaintainer as G, GetMeOrganizationsResult as H, VerifyMfaBody as I, MeResult as J, MeOrganization as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, ApproveDeviceAuthorizationResult as Q, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, GetMeProjectsQuery as U, GetMeOrganizationsQuery as V, GetMeProjectsResult as W, LoginBody as X, MeUser as Y, ApproveDeviceAuthorizationBody as Z, RevokeSessionPath as _, RemoveWebauthnInput as a, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, CreateDeviceAuthorizationResult as et, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, paths as it, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, GetDeviceAuthorizationTokenResult as nt, RemoveWebauthnPath as o, SudoBody as p, MeProject as q, RegisterWebauthnOptionsResult as r, components as rt, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, GetDeviceAuthorizationTokenBody as tt, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, GetMeMaintainersQuery as z };
-//# sourceMappingURL=types-DykEfF2N.d.cts.map
+export { ApproveDeviceAuthorizationBody as $, PatScopeInput as A, GetMeMaintainersResult as B, GetPkceTokenResult as C, ExchangePatBodyRaw as D, CreatePatResult as E, TotpVerifyResult as F, MeMaintainer as G, GetMeOrganizationsResult as H, VerifyMfaBody as I, MeResult as J, MeOrganization as K, VerifyMfaResult as L, DisableTotpPath as M, RegenerateRecoveryCodesResult as N, ExchangePatInput as O, TotpSetupResult as P, LoginBody as Q, VerifyMfaType as R, GetPkceTokenBody as S, CreatePatInput as T, GetMeProjectsQuery as U, GetMeOrganizationsQuery as V, GetMeProjectsResult as W, UpdateMeInput as X, MeUser as Y, UpdateMeResult as Z, RevokeSessionPath as _, RemoveWebauthnInput as a, components as at, InitiateSamlBody as b, IntrospectTokenResult as c, RefreshTokenResult as d, ApproveDeviceAuthorizationResult as et, RevokeTokenBody as f, SudoResult as g, SudoChallengeResult as h, RegisterWebauthnResult as i, GetDeviceAuthorizationTokenResult as it, RevokePatPath as j, ListPatsResult as k, RefreshTokenBody as l, SudoBodyRaw as m, RegisterWebauthnInput as n, CreateDeviceAuthorizationResult as nt, RemoveWebauthnPath as o, paths as ot, SudoBody as p, MeProject as q, RegisterWebauthnOptionsResult as r, GetDeviceAuthorizationTokenBody as rt, RemoveWebauthnQuery as s, ListWebauthnCredentialsResult as t, CreateDeviceAuthorizationBody as tt, RefreshTokenPartialBody as u, AssertSamlBody as v, CreatePatBodyRaw as w, InitiateSamlResult as x, AssertSamlResult as y, GetMeMaintainersQuery as z };
+//# sourceMappingURL=types-D3L3CqKl.d.cts.map

package/dist/{types--mz2z0Zm.d.cts → types-D4oIei5M.d.cts}

@@ -1,4 +1,4 @@
-import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-DcKc3_Y1.cjs";
+import { c as OpenapiQueryType, l as OpenapiReturnType, n as ArrayElement, r as OpenapiBodyType, s as OpenapiPathType } from "./index-9p4O-clX.cjs";
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -40,6 +40,9 @@ type paths = {
     /**
      * Create variable
      * @description Creates a new variable.
+     *
+     *     * An `encrypted` variable takes plaintext here and is encrypted by the service; a value that is
+     *       already ciphertext (`KBC::…`) is stored as it is.
      */
     post: operations['createVariable'];
     delete?: never;
@@ -48,6 +51,32 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/variables/group': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    /**
+     * Move variables to a group
+     * @description Moves a set of variables to a group, or out of every group, in a single request.
+     *
+     *     * The group is outside the identity hash, so every variable keeps its row and its hash.
+     *     * An absent or `null` `group` means "out of every group".
+     *     * The move is one transaction and it is all-or-nothing: an unknown hash, a hash from another
+     *       project or a branch the token may not write to moves nothing.
+     *     * The response lists the variables in the order of `hashes`.
+     */
+    patch: operations['updateVariablesGroup'];
+    trace?: never;
+  };
   '/variables/{hash}': {
     parameters: {
       query?: never;
@@ -65,7 +94,22 @@ type paths = {
     delete: operations['deleteVariable'];
     options?: never;
     head?: never;
-    patch?: never;
+    /**
+     * Update variable
+     * @description Updates a variable in place.
+     *
+     *     * Only `value`, `flags` and `group` can be patched. The key, the attributes and the branch are the
+     *       variable's identity — they are hashed into `hash`, so an update keeps both the row and the hash.
+     *     * A field absent from the body is left alone; `group: null` moves the variable out of every group.
+     *     * An `encrypted` variable takes plaintext here and is encrypted by the service; a value that is
+     *       already ciphertext (`KBC::…`) is stored as it is.
+     *     * `flags` replaces the whole flag set. Adding `encrypted` encrypts the value being stored — the
+     *       one sent, or the stored plaintext when the body carries no `value`. Removing `encrypted` needs a
+     *       `value` in the same request, because the stored one is ciphertext the service cannot decrypt.
+     *     * The write happens only after validation, authorization and encryption have all succeeded, so a
+     *       rejected update leaves the variable with its old value.
+     */
+    patch: operations['updateVariable'];
     trace?: never;
   };
   '/variables/merged/branch': {
@@ -170,6 +214,35 @@ type components = {
       /** @description SHA-256 hash of the variable key + attributes */
       hash?: string;
     };
+    /**
+     * @description The changeable part of a variable. At least one property has to be present.
+     *
+     *     Key and attributes are the variable's identity and are not changeable here.
+     */
+    UpdateVariable: {
+      /** @description Plaintext for an `encrypted` variable — the service encrypts it. Must not be `null`. */
+      value?: string;
+      /**
+       * @description Replaces the whole flag set.
+       *
+       *     Adding `encrypted` encrypts the stored value. Removing it needs a `value` in the same
+       *     request: the stored one is ciphertext the service cannot decrypt.
+       */
+      flags?: ('encrypted' | 'oauthCredentialsId')[];
+      /**
+       * @description `null` moves the variable out of every group.
+       * @example MySQL Credentials
+       */
+      group?: string | null;
+    };
+    UpdateVariablesGroup: {
+      hashes: string[];
+      /**
+       * @description Absent or `null` moves the variables out of every group.
+       * @example MySQL Credentials
+       */
+      group?: string | null;
+    };
     Error: {
       error: string;
       code: number;
@@ -312,6 +385,46 @@ interface operations {
       };
     };
   };
+  updateVariablesGroup: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['UpdateVariablesGroup'];
+      };
+    };
+    responses: {
+      /** @description Variables moved */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['VariableWithHash'][];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      /** @description At least one hash does not belong to a variable in the project. Nothing was moved. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid request payload */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   deleteVariable: {
     parameters: {
       query?: never;
@@ -342,6 +455,53 @@ interface operations {
       };
     };
   };
+  updateVariable: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Variable hash */
+        hash: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['UpdateVariable'];
+      };
+    };
+    responses: {
+      /** @description Variable updated */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['VariableWithHash'];
+        };
+      };
+      401: components['responses']['401_Unauthorized'];
+      403: components['responses']['403_Forbidden'];
+      /** @description Variable not found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /**
+       * @description Invalid request payload — an empty body, a `null` value, an unknown flag, a group that fails
+       *     validation, or `encrypted` removed without a new `value`. The variable keeps its old value,
+       *     flags and group.
+       */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   listBranchVariables: {
     parameters: {
       query?: {
@@ -388,4 +548,4 @@ type VariableWithHash = Omit<VariableWithHashRaw, 'hash'> & {
 };
 type AnyVariable = VariableWithHash | CreateVariableBody;
 export { GetVariablesQuery as a, GetVariablesByBranchId as i, CreateVariableBody as n, VariableWithHash as o, DeleteVariablePath as r, AnyVariable as t };
-//# sourceMappingURL=types--mz2z0Zm.d.cts.map
+//# sourceMappingURL=types-D4oIei5M.d.cts.map