[Pijukatel]

Syncs the client to OpenAPI spec v2-2026-10-01T153946Z (up from v2-2026-09-28T115051Z, #14) and to all 33 referenced apify-client-js PRs. All 33 are merged into its master. An earlier revision of this PR wrongly left out 27 of them as targeting an unmerged v3 branch; this revision checks each of the 33 against a fresh clone and finds every one on apify-client-js origin/master.

Spec delta (apify/apify-docs#3037, apify/apify-docs#3024):

• Build::getImageDigest() returns the new imageDigest field.
• The task-publish docs no longer carry a stale "contact support" sentence (text-only change).

Reference-client delta: ported

• New InvalidRequestException, UnauthorizedException, ForbiddenException, NotFoundException, ConflictException, RateLimitException and ServerException, thrown by HTTP status. They all extend ApifyApiException.

• A 404 is swallowed regardless of its type. Before, only a short allowlist of types was swallowed.

• Behavior change: a 404 now throws instead of resolving to null or doing nothing in two cases:

  • get()/delete() on a resource client obtained without an ID: RunClient::dataset(), keyValueStore(), requestQueue(), log(), and BuildClient::log().
  • The fixed sub-paths getStatistics(), getInput(), getLog() and getOpenApiDefinition().

  In both cases the response can't tell a missing parent from a missing sub-resource.

• Behavior change: ActorClient::version()/build() and ActorVersionClient::envVar() reject an empty-string identifier.

• Behavior change: IDs and path segments built from caller input are rejected when empty or ./... Before, they were percent-encoded and sent as literal dot-segments.

• ResourceContext::toSafeId() replaces every / in an ID, not just the first one.

• Timeout tiers: timeoutShortSecs, timeoutMediumSecs, timeoutLongSecs and timeoutMaxSecs on ApifyClient. Every method that sends a request also takes a per-call $timeoutSecs override: seconds, a tier name, or 'noTimeout'.

• compression option on ApifyClient: 'brotli', 'gzip' or a custom HttpCompressorInterface. Without it, behavior doesn't change.

• Request-body compression is skipped for content types that are already compressed.

• baseUrl/publicBaseUrl accept a URL that already ends with /v2 without doubling it.

• RequestQueueClient::batchAddRequests() serializes each request once, and its per-item size check uses the reference client's byte accounting.

• DatasetClient::createItemsPublicUrl() takes a format parameter.

• DatasetClient::iterateItems() paginates by the scanned-row count.

• ActorClient::start()/validateInput() and RunClient::metamorph() send a string input as raw bytes.

Reference-client delta: not ported. Every PR has a reason recorded in the archived notes:

• No PHP equivalent:
  • URL-field normalization
  • TypeScript-only type changes
  • an AbortSignal cancellation API, which doesn't fit a synchronous client
  • ESM, zod and dependency tooling changes
• Not removed: options that were already deprecated, because removing them would be a public-interface break.
• Already covered by the existing design: a custom HTTP client and the error body of a failed streaming request.

CLIENT_VERSION goes from 0.6.2 to 0.8.0.

Review: two /review-client rounds on the corrected scope. Their findings on timeout tiers, path safety and docs are fixed in 57a2475, and the final round was Approved with no open items.

Verification: lint 0/146, unit tests 189/189, examples 46/46, integration tests 59/59 against the live API, PHPStan 0 errors. CI is green on 5313016.