@cognite/cli 1.3.4-alpha.selfsigned → 1.4.0-alpha.sdk-gen

package/dist/deploy/index.d.ts

@@ -1,32 +1,4 @@
-import { CogniteClient } from '@cognite/sdk';
-
-type Deployment = {
-    org: string;
-    project: string;
-    baseUrl: string;
-    deployClientId: string;
-    deploySecretName: string;
-    published: boolean;
-    /** Identity provider type. Defaults to "cdf" if not specified */
-    idpType?: "cdf" | "entra_id";
-    /** Tenant ID for Entra ID authentication. Required when idpType is "entra_id" */
-    tenantId?: string;
-    /**
-     * OAuth scope for Entra ID authentication. When set, overrides the scope
-     * that would otherwise be derived from baseUrl
-     * (e.g. "https://<cluster>.cognitedata.com/.default").
-     * Use this for non-standard CDF environments such as private-link deployments.
-     */
-    scope?: string;
-};
-type App = {
-    externalId: string;
-    name: string;
-    description: string;
-    versionTag: string;
-};
-
-declare const deploy: (deployment: Deployment, app: App, folder: string) => Promise<void>;
+import { CogniteClient, ClientOptions } from '@cognite/sdk';
 
 /**
  * App Hosting HTTP API layer.
@@ -52,6 +24,18 @@ interface AppVersion {
     createdBy: string;
     appExternalId: string;
 }
+declare const SIGNATURE_STATUSES: readonly ["VALID", "REVOKED", "EXPIRED", "SIGNED_BEFORE_KEY_ISSUED", "IAT_IN_FUTURE", "BUNDLE_TOO_OLD", "KEY_NOT_IN_REGISTRY"];
+type SignatureStatus = (typeof SIGNATURE_STATUSES)[number];
+declare const SIGNER_ROLES: readonly ["developer", "certifier"];
+type SignerRole = (typeof SIGNER_ROLES)[number];
+type StoredSignature = {
+    signerKid: string;
+    signerRole: SignerRole;
+    signatureIat: number;
+    receivedAt: number;
+    createdTime: number;
+    status: SignatureStatus;
+};
 
 declare class AppHostingClient {
     private api;
@@ -63,10 +47,22 @@ declare class AppHostingClient {
      * success so the call is safe to repeat.
      */
     ensureApp(externalId: string, name: string, description: string): Promise<void>;
+    /**
+     * Submit verified compact-JWS signatures for a version uploaded earlier.
+     * No-op when `items` is empty so callers can wire it unconditionally.
+     * The backend accepts and stores well-formed tokens; tier-policy
+     * verification happens on the subsequent publish step.
+     */
+    submitSignatures(appExternalId: string, version: string, items: string[]): Promise<void>;
+    /** Fetch the stored signatures for a version. Returns [] when none stored. */
+    listSignatures(appExternalId: string, version: string): Promise<StoredSignature[]>;
     /** Transition a version from DRAFT to PUBLISHED. */
     publishVersion(appExternalId: string, version: string): Promise<void>;
     /** Publish the version and immediately set it as the ACTIVE alias. */
     publishAndActivate(appExternalId: string, version: string): Promise<void>;
+    getActiveVersion(appExternalId: string): Promise<AppVersion | null>;
+    /** Remove the ACTIVE alias from a version, taking it out of service without changing its lifecycle state. */
+    deactivateVersion(appExternalId: string, version: string): Promise<void>;
     /**
      * Set the ACTIVE alias on a version. Returns the version that was
      * previously active (if any) so callers can surface "Superseded X"
@@ -89,6 +85,42 @@ declare class AppHostingClient {
     deploy(appExternalId: string, name: string, description: string, versionTag: string, fileContent: Buffer, fileName: string, published?: boolean): Promise<void>;
 }
 
+type Deployment = {
+    org: string;
+    project: string;
+    baseUrl: string;
+    deployClientId: string;
+    deploySecretName: string;
+    published: boolean;
+    /** Identity provider type. Defaults to "cdf" if not specified */
+    idpType?: 'cdf' | 'entra_id';
+    /** Tenant ID for Entra ID authentication. Required when idpType is "entra_id" */
+    tenantId?: string;
+};
+type App = {
+    externalId: string;
+    name: string;
+    description: string;
+    versionTag: string;
+};
+
+/**
+ * Package `dist/` into `<folder>/.cognite-bundles/<externalId>-<versionTag>.zip`
+ * and upload it via an already-authenticated `AppHostingClient`. Both deploy
+ * entry points (programmatic `deploy()` and the CLI's interactive path) reuse
+ * this so packaging/upload behaviour stays in one place.
+ *
+ * The bundle file is intentionally left on disk so the follow-on
+ * `cognite apps sign` + `cognite apps publish` flow can operate on the
+ * exact bytes the backend received.
+ */
+declare function packageAndUpload(client: AppHostingApiClient, app: App, folder: string, published: boolean): Promise<void>;
+/**
+ * Programmatic deploy used by CI scripts: resolves an SDK from the
+ * deployment's env-var credentials, then runs `packageAndUpload`.
+ */
+declare const deploy: (deployment: Deployment, app: App, folder: string) => Promise<void>;
+
 /**
  * Application Packaging
  *
@@ -100,9 +132,13 @@ declare class ApplicationPackager {
     constructor(distDirectory?: string);
     validateBuildDirectory(): void;
     createZip(outputFilename?: string, verbose?: boolean): Promise<string>;
+    createSourceArchive(outputPath: string): Promise<string>;
+    private validateNoSensitiveFiles;
 }
 
-declare const getSdk: (deployment: Deployment, folder: string, env?: NodeJS.ProcessEnv) => Promise<CogniteClient>;
+type Authenticatable = Pick<CogniteClient, 'authenticate'>;
+declare function getSdk(deployment: Deployment, folder: string, env?: NodeJS.ProcessEnv): Promise<CogniteClient>;
+declare function getSdk<C extends Authenticatable>(deployment: Deployment, folder: string, env: NodeJS.ProcessEnv, createClient: (opts: ClientOptions) => C): Promise<C>;
 
 /**
  * Get access token for deployment using the appropriate identity provider.
@@ -113,4 +149,37 @@ declare const getSdk: (deployment: Deployment, folder: string, env?: NodeJS.Proc
  */
 declare const getToken: (deployment: Deployment, env?: NodeJS.ProcessEnv) => Promise<string>;
 
-export { type App, AppHostingClient, ApplicationPackager, type Deployment, deploy, getSdk, getToken };
+/**
+ * Sibling-file discovery for bundle signatures written by `cognite sign`.
+ *
+ *   <bundle>.dev.sig     — developer signature
+ *   <bundle>.cert.sig    — certifier counter-signature (`--as-certifier`)
+ *
+ * Tokens are passed verbatim to the App Hosting `/signatures` endpoint; the
+ * backend verifies them against its key registry and tier policy.
+ *
+ * Collaborators are injected via `deps` so tests can stub fs without `vi.mock`.
+ */
+declare const SIGNATURE_SUFFIXES: readonly [".dev.sig", ".cert.sig"];
+type DiscoverSignaturesDeps = {
+    existsSync?: (path: string) => boolean;
+    readFileSync?: (path: string, encoding: 'utf8') => string;
+};
+declare function discoverSignatures(bundlePath: string, deps?: DiscoverSignaturesDeps): string[];
+
+/**
+ * Stable on-disk location for a packaged app bundle, keyed on app + version.
+ *
+ * `cognite apps deploy` writes the zip here and leaves it in place, so the
+ * subsequent `cognite apps sign` + `cognite apps publish` steps operate on
+ * the *exact bytes* that were uploaded — the bundle SHA in the signed
+ * payload matches what the backend has on hand.
+ *
+ * Lives under a single gitignored folder (`.cognite-bundles/`) so signed
+ * artefacts don't accidentally land in version control.
+ */
+declare const BUNDLE_DIR = ".cognite-bundles";
+declare function bundleFileName(externalId: string, versionTag: string): string;
+declare function bundlePath(cwd: string, externalId: string, versionTag: string): string;
+
+export { type App, AppHostingClient, ApplicationPackager, BUNDLE_DIR, type Deployment, SIGNATURE_SUFFIXES, bundleFileName, bundlePath, deploy, discoverSignatures, getSdk, getToken, packageAndUpload };

package/dist/deploy/index.js

@@ -1 +1 @@
-import{a,b,c,d,e}from"../chunk-BXCPVUBR.js";export{a as AppHostingClient,b as ApplicationPackager,e as deploy,d as getSdk,c as getToken};
+import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-Z24V7VPI.js";import"../chunk-EI7MMDWY.js";export{a as AppHostingClient,b as ApplicationPackager,c as BUNDLE_DIR,j as SIGNATURE_SUFFIXES,d as bundleFileName,e as bundlePath,i as deploy,k as discoverSignatures,g as getSdk,f as getToken,h as packageAndUpload};

package/dist/index.d.ts

@@ -1,2 +1,4 @@
-export { App, AppHostingClient, ApplicationPackager, Deployment, deploy, getSdk, getToken } from './deploy/index.js';
+export { App, AppHostingClient, ApplicationPackager, BUNDLE_DIR, Deployment, SIGNATURE_SUFFIXES, bundleFileName, bundlePath, deploy, discoverSignatures, getSdk, getToken, packageAndUpload } from './deploy/index.js';
+export { DuneRuntime, ViewDefinition, ViewDefinitionProperty, createDuneRuntime, createDuneRuntimeFromViews } from './sdk-runtime/index.js';
 import '@cognite/sdk';
+import 'graphql';

package/dist/index.js

@@ -1 +1 @@
-import{a as o,b as r,c as e,d as f,e as m}from"./chunk-BXCPVUBR.js";export{o as AppHostingClient,r as ApplicationPackager,m as deploy,f as getSdk,e as getToken};
+import{a as o,b as r,c as e,d as f,e as m,f as p,g as t,h as x,i as a,j as b,k as c}from"./chunk-Z24V7VPI.js";import{a as d,b as g}from"./chunk-FEYVYSNN.js";import"./chunk-EI7MMDWY.js";export{o as AppHostingClient,r as ApplicationPackager,e as BUNDLE_DIR,b as SIGNATURE_SUFFIXES,f as bundleFileName,m as bundlePath,d as createDuneRuntime,g as createDuneRuntimeFromViews,a as deploy,c as discoverSignatures,t as getSdk,p as getToken,x as packageAndUpload};

package/dist/sdk-runtime/index.d.ts

@@ -0,0 +1,209 @@
+import { ViewDefinition as ViewDefinition$1, ViewDefinitionProperty as ViewDefinitionProperty$1, ViewReference, FilterDefinition, SearchSort, AggregationDefinition, AggregatedResultItem, InstancesAPI, CogniteClient } from '@cognite/sdk';
+import { DocumentNode, GraphQLSchema } from 'graphql';
+
+interface GenerateSdkConfig {
+    name: string;
+    space: string;
+    dataModelExternalId: string;
+    dataModelVersion: string;
+}
+
+interface SharedViewId {
+    space: string;
+    externalId: string;
+    version: string;
+}
+type PropertyDescriptor = {
+    kind: 'scalar';
+    isList?: boolean;
+    graphqlType?: string;
+} | {
+    kind: 'enum';
+    values: string[];
+    valueNames: Record<string, string>;
+} | {
+    kind: 'directRelation';
+    targetView: SharedViewId;
+} | {
+    kind: 'directRelationList';
+    targetView: SharedViewId;
+} | {
+    kind: 'reverseDirect';
+    sourceView: SharedViewId;
+    throughProperty: string;
+} | {
+    kind: 'reverseList';
+    sourceView: SharedViewId;
+    throughProperty: string;
+} | {
+    kind: 'edge';
+    targetView: SharedViewId;
+    direction: 'outwards' | 'inwards';
+};
+interface SchemaView {
+    view: SharedViewId;
+    properties: Map<string, PropertyDescriptor>;
+}
+interface SchemaKnowledge {
+    view(ref: SharedViewId): SchemaView;
+    property(ref: SharedViewId, prop: string): PropertyDescriptor | undefined;
+}
+
+type ViewDefinitionProperty = ViewDefinitionProperty$1 & {
+    constraintState?: Record<string, unknown>;
+};
+type ViewDefinition = Omit<ViewDefinition$1, 'properties'> & {
+    properties: Record<string, ViewDefinitionProperty>;
+};
+
+/**
+ * Matches the Requester type emitted by @graphql-codegen/typescript-generic-sdk,
+ * so the return of createDuneRequester can be passed directly to getSdk().
+ */
+type DuneRequester = <TData, TVariables>(doc: DocumentNode, variables?: TVariables) => Promise<TData>;
+
+interface PropertyRef {
+    view: ViewReference;
+    property: string;
+}
+interface ConnectionSelection {
+    limit?: number;
+    select: SelectionTree;
+}
+interface SelectionTree {
+    scalars: string[];
+    connections: Map<string, ConnectionSelection>;
+}
+interface SortClause {
+    property: PropertyRef;
+    direction: 'ascending' | 'descending';
+    /** When true, nulls sort before non-nulls. Defaults to false. */
+    nullsFirst?: boolean;
+}
+/** Pre-translated DMS logical filter (output of translateFilter in resolver layer). */
+type LogicalFilter = FilterDefinition;
+interface QueryInput {
+    view: ViewReference;
+    filter?: LogicalFilter;
+    sort?: SortClause[];
+    select: SelectionTree;
+    /** Page size. Defaults to INITIAL_BATCH_LIMIT if omitted. */
+    limit?: number;
+    /** Opaque cursor from a previous ListResult.pageInfo.endCursor. */
+    cursor?: string;
+}
+interface ListResult<T = Record<string, unknown>> {
+    items: T[];
+    pageInfo: {
+        endCursor: string | null;
+        hasNextPage: boolean;
+    };
+}
+
+interface SearchInput {
+    view: ViewReference;
+    /** Full-text search term. */
+    query?: string;
+    filter?: LogicalFilter;
+    sort?: SearchSort[];
+    select: SelectionTree;
+    /** Max items to return. Defaults to searchLimit config. */
+    limit?: number;
+    /** Restrict search to specific property names within the view. */
+    properties?: string[];
+}
+
+interface AggregateInput {
+    view: ViewReference;
+    filter?: LogicalFilter;
+    aggregates: AggregationDefinition[];
+    groupBy?: string[];
+    /** Optional full-text query to scope which instances are aggregated. */
+    query?: string;
+}
+interface AggregateOutput {
+    items: AggregatedResultItem[];
+}
+
+type DmsClient = Pick<InstancesAPI, 'query' | 'search' | 'aggregate' | 'retrieve' | 'upsert' | 'delete' | 'sync' | 'inspect'>;
+interface PlannerConfig {
+    initialBatchLimit: number;
+    maxBatchLimit: number;
+    searchLimit: number;
+    inFilterChunkSize: number;
+    previewLimit: number;
+    nestedDetailLimit: number;
+    enableRemoveNotConnected: boolean;
+    max408Retries: number;
+    max429Retries: number;
+    retryBaseDelayMs: number;
+    maxConcurrentRequests: number;
+    /** Maximum SelectionTree nesting depth. Throws PlannerValidationError if exceeded. */
+    maxNestingDepth: number;
+    /** Hard ceiling for listAll without an explicit maxTotal. Throws rather than silently truncating. */
+    maxTotalItems: number;
+}
+
+declare class QueryRunner {
+    private readonly dms;
+    private readonly schema;
+    private readonly config;
+    private readonly executor;
+    get schemaKnowledge(): SchemaKnowledge | undefined;
+    constructor(dms: DmsClient, schema?: SchemaKnowledge, config?: Partial<PlannerConfig>);
+    query<T = Record<string, unknown>>(input: QueryInput): Promise<ListResult<T>>;
+    /**
+     * Collects all pages until exhaustion. `input.limit` is the page size.
+     * `maxTotal` sets an explicit ceiling — without it, throws at `config.maxTotalItems`
+     * to prevent unbounded fetches.
+     */
+    queryAll<T = Record<string, unknown>>(input: Omit<QueryInput, 'cursor'>, maxTotal?: number): Promise<T[]>;
+    /**
+     * Full-text or filter-based search returning a single (non-paginated) result set.
+     * Use for top-level discovery; DMS search has eventual consistency — do not use
+     * for writes-then-reads or where strong consistency is required.
+     */
+    search<T = Record<string, unknown>>(input: SearchInput): Promise<ListResult<T>>;
+    /**
+     * Fetches specific nodes by space+externalId. Returns an empty array when ids is empty.
+     * Extracts view-scoped properties before returning, matching the shape of list results.
+     */
+    getByIds<T = Record<string, unknown>>(ids: Array<{
+        space: string;
+        externalId: string;
+    }>, view: ViewReference): Promise<T[]>;
+    /**
+     * Returns the total count of instances matching the filter.
+     * Wraps the filter with hasData so only instances with data in the view are counted.
+     */
+    count(input: {
+        view: ViewReference;
+        filter?: LogicalFilter;
+    }): Promise<number>;
+    aggregate(input: AggregateInput): Promise<AggregateOutput>;
+    /**
+     * Async generator — yields one ListResult<T> per page.
+     * Lets callers stream results or stop early without fetching remaining pages.
+     */
+    queryPages<T = Record<string, unknown>>(input: Omit<QueryInput, 'cursor'>): AsyncGenerator<ListResult<T>>;
+}
+
+interface DuneRuntime {
+    schema: GraphQLSchema;
+    rootValue: Record<string, unknown>;
+    runner: QueryRunner;
+    /** Pass directly to the generated getSdk() function. */
+    requester: DuneRequester;
+}
+/**
+ * Builds the full runtime from a data model config. Fetches views from CDF,
+ * builds the GraphQL schema, wires resolvers, and returns a ready requester.
+ */
+declare function createDuneRuntime(config: GenerateSdkConfig, client: CogniteClient): Promise<DuneRuntime>;
+/**
+ * Builds the runtime directly from an array of ViewDefinition objects — skips the
+ * data model lookup. Useful when you already have views from sdk.views.list().
+ */
+declare function createDuneRuntimeFromViews(views: ViewDefinition[], client: CogniteClient): DuneRuntime;
+
+export { type DuneRuntime, type ViewDefinition, type ViewDefinitionProperty, createDuneRuntime, createDuneRuntimeFromViews };

package/dist/sdk-runtime/index.js

@@ -0,0 +1 @@
+import{a,b}from"../chunk-FEYVYSNN.js";import"../chunk-EI7MMDWY.js";export{a as createDuneRuntime,b as createDuneRuntimeFromViews};

package/dist/{skills-GQ5TZKCM.js → skills-SV7BPHAZ.js}

@@ -1 +1 @@
-import{b as a,c as b,d as c,e as d}from"./chunk-A5ASLC6T.js";export{c as buildPullArgs,a as execSkillsCli,b as pullAllArgs,d as registerSkillsCommand};
+import{b as a,c as b,d as c,e as d}from"./chunk-VTE66IK5.js";export{c as buildPullArgs,a as execSkillsCli,b as pullAllArgs,d as registerSkillsCommand};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cognite/cli",
-  "version": "1.3.4-alpha.selfsigned",
+  "version": "1.4.0-alpha.sdk-gen",
   "description": "CLI for Cognite Data Fusion",
-  "license": "Apache-2.0",
+  "license": "SEE LICENSE IN LICENSE.md",
   "author": "Cognite",
   "repository": {
     "type": "git",
@@ -22,6 +22,11 @@
       "types": "./dist/deploy/index.d.ts",
       "import": "./dist/deploy/index.js",
       "default": "./dist/deploy/index.js"
+    },
+    "./sdk-runtime": {
+      "types": "./dist/sdk-runtime/index.d.ts",
+      "import": "./dist/sdk-runtime/index.js",
+      "default": "./dist/sdk-runtime/index.js"
     }
   },
   "bin": {
@@ -34,6 +39,7 @@
   ],
   "scripts": {
     "build": "tsup",
+    "typecheck": "tsc --noEmit",
     "prepare": "tsup",
     "prepack": "pnpm run build",
     "prepublishOnly": "pnpm run build",
@@ -44,21 +50,26 @@
     "refresh-spec-kit": "bash scripts/refresh-spec-kit.sh"
   },
   "dependencies": {
-    "@cognite/app-sdk": "^0.4.0",
+    "@cognite/app-sdk": "^0.5.1",
     "@cognite/sdk": "^10.10.0",
+    "@graphql-codegen/cli": "^7.0.0",
+    "@graphql-codegen/typescript": "^6.0.1",
+    "@graphql-codegen/typescript-generic-sdk": "^5.0.1",
+    "@graphql-codegen/typescript-operations": "^6.0.2",
     "@sentry/node": "^10.51.0",
     "@zip.js/zip.js": "^2.7.0",
     "chalk": "^5.6.2",
+    "clipboardy": "5.3.1",
     "commander": "^14.0.3",
     "dotenv": "^17.4.2",
     "enquirer": "^2.4.1",
     "execa": "^5.1.1",
+    "graphql": "^16.13.2",
     "hygen": "^6.2.11",
     "jose": "^6.2.2",
     "mixpanel": "^0.21.0",
     "open": "^10.1.0",
     "openid-client": "^6.8.3",
-    "selfsigned": "^5.5.0",
     "semver": "^7.7.0",
     "skills": "^1.4.3",
     "valibot": "^1.3.1"

package/dist/chunk-A5ASLC6T.js

@@ -1,7 +0,0 @@
-var r=Object.defineProperty;var s=(l,i)=>r(l,"name",{value:i,configurable:!0});import{execFileSync as c}from"child_process";import{createRequire as a}from"module";import{InvalidArgumentError as p}from"commander";var e="cognitedata/builder-skills",o=["claude-code","cursor"],t=o.flatMap(l=>["-a",l]),u=a(import.meta.url).resolve("skills/bin/cli.mjs");function n(l,i={}){c(process.execPath,[u,...l],{stdio:"inherit",cwd:process.cwd(),...i})}s(n,"execSkillsCli");function S(){return["add",e,...t,"--skill","*","-y"]}s(S,"pullAllArgs");function d(l){if(!/^[\w.-]+\/[\w.-]+$/.test(l))throw new p("Expected owner/repo format (e.g., cognitedata/builder-skills)");return l}s(d,"validateSource");function m(l){let i=["add",l.source,...t];return l.skill?i.push("--skill",l.skill):l.interactive||i.push("--skill","*","-y"),l.global&&i.push("--global"),i}s(m,"buildPullArgs");function k(l){console.log(`\u{1F504} Pulling skills from ${l.source}...`),n(m(l)),console.log(`
-\u2705 Skills pulled successfully`)}s(k,"handlePull");function P(l){let i=l.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
-Supports: ${o.join(", ")}`).addHelpText("after",`
-Examples:
-  npx @cognite/cli apps skills pull                               Pull all skills
-  npx @cognite/cli apps skills pull --skill create-client-tool    Pull a specific skill
-  npx @cognite/cli apps skills list                               List installed skills`);return i.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",d,e).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(k),i.command("list").description("List installed skills").action(()=>{n(["list"])}),i}s(P,"registerSkillsCommand");export{s as a,n as b,S as c,m as d,P as e};

package/dist/chunk-BXCPVUBR.js

@@ -1,9 +0,0 @@
-var W=Object.defineProperty;var s=(e,t)=>W(e,"name",{value:t,configurable:!0});import Y from"fs";import gt from"path";var N="https://docs.cognite.com/cdf/access/";function m(e){return e!==null&&typeof e=="object"}s(m,"isRecord");function S(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}s(S,"isHttpError");function Z(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${N}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${N}`;default:return}}s(Z,"httpStatusHint");function w(e){let t=e instanceof Error?e:new Error(String(e));if(!S(t))return null;let n=Z(t.status);return n?Object.assign(new Error(`${t.message}
-  ${n}`),{cause:t}):null}s(w,"enrichedHttpError");function X(e){if(!m(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(m(n)){let r=n.error;if(m(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(n.missing))return n.missing}return null}s(X,"findMissingArray");function Q(e,t){if(!S(e)||e.status!==400)return!1;let n=X(e);return n?n.some(r=>m(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}s(Q,"isMissingExternalIdError");function v(e,t){return S(e)&&e.status===404||Q(e,t)}s(v,"isNotFoundError");var M=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],J=["ACTIVE","PREVIEW"],I=class I extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};s(I,"AppVersionNotFoundError");var C=I;function q(e,t){return e.includes(t)}s(q,"includesValue");function tt(e){return q(M,e)}s(tt,"isAppVersionLifecycleState");function et(e){return q(J,e)}s(et,"isAppVersionAlias");function nt(e){return typeof e.version=="string"&&tt(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||et(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}s(nt,"isAppVersion");function H(e){if(!m(e))throw new Error("Invalid version response: not an object");if(!nt(e))throw new Error("Invalid version response: missing or malformed fields");return e}s(H,"parseAppVersion");var T=class T{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:r}]}})}catch(o){throw w(o)??o}}async uploadVersion(t,n,r,o,i="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let c=new FormData;c.append("file",new Blob([new Uint8Array(r)]),o),c.append("version",n),c.append("entryPath",i);let l=encodeURIComponent(t),a=`${this.appsBasePath}/${l}/versions`,p=await this.client.authenticate(),g=`${this.client.getBaseUrl()}${a}`,u=new AbortController,G=setTimeout(()=>u.abort(),300*1e3),y;try{y=await fetch(g,{method:"POST",headers:{Authorization:`Bearer ${p}`},body:c,signal:u.signal})}catch(f){throw f instanceof Error&&f.name==="AbortError"?new Error("Upload timed out after 5 minutes"):f}finally{clearTimeout(G)}if(!y.ok){let f=await y.text(),k=f;try{let $=JSON.parse(f);if(m($)){let A=$.error;if(typeof A=="string")k=A;else if(m(A)){let E=A.message,F=A.code;k=typeof E=="string"?E:F!=null?`Unknown error (code: ${F})`:f}else{let E=$.message;k=typeof E=="string"?E:f}}}catch{}let j=y.headers.get("x-request-id"),K=j?` | X-Request-ID: ${j}`:"",B=Object.assign(new Error(`Upload failed: ${y.status} \u2014 ${k}${K}`),{status:y.status});throw w(B)??B}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let r=encodeURIComponent(t),o=encodeURIComponent(n),i=`${this.appsBasePath}/${r}/versions/${o}`;try{let c=await this.client.get(i);return H(c.data)}catch(c){throw v(c,[t,n])?new C(t,n):w(c)??c}}async getActiveVersion(t){let n=encodeURIComponent(t),r=`${this.appsBasePath}/${n}/active`;try{let o=await this.client.get(r);return H(o.data)}catch(o){if(v(o,[t]))return null;throw w(o)??o}}async updateVersions(t,n){let r=encodeURIComponent(t),o=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(o,{data:{items:n}})}catch(i){throw w(i)??i}}};s(T,"AppHostingApi");var x=T;var b=class b{constructor(t){this.api=new x(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,r,o,i){return this.api.uploadVersion(t,n,r,o,i)}async ensureApp(t,n,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,r),console.log(`\u2705 App '${t}' created`)}catch(o){if(S(o)&&o.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw o}}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}async activateVersion(t,n){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let o=r&&r.version!==n?r.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:o}}async deploy(t,n,r,o,i,c,l=!1){console.log(`
-\u{1F680} Deploying application via App Hosting API...
-`);try{await this.ensureApp(t,n,r),await this.uploadVersion(t,o,i,c),l&&await this.publishAndActivate(t,o),console.log(`
-\u2705 Deployment successful!`)}catch(a){let p=a instanceof Error?a.message:String(a);throw Object.assign(new Error(`Deployment failed: ${p}`),{cause:a})}}};s(b,"AppHostingClient");var P=b;import h from"fs";import d from"path";import{parseAndValidateManifestConfig as rt}from"@cognite/app-sdk/vite";import{BlobReader as ot,Uint8ArrayWriter as st,ZipWriter as it}from"@zip.js/zip.js";var R="package.json",D="package-lock.json",z="manifest.json",_=".cognite",L=class L{constructor(t="dist"){this.distPath=d.isAbsolute(t)?t:d.join(process.cwd(),t),this.appRoot=d.dirname(this.distPath)}validateBuildDirectory(){if(!h.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=d.join(this.appRoot,R);if(!h.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=d.join(this.appRoot,D);if(!h.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new it(new st,{level:9}),o=s(async(a,p)=>{await r.add(p,new ot(await h.openAsBlob(a))),n&&console.log(`  \u{1F4C4} ${p}`)},"addFile"),i=s(async a=>{let p=await h.promises.readdir(a,{withFileTypes:!0});for(let g of p){let u=d.join(a,g.name);g.isDirectory()?await i(u):await o(u,d.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),c;try{await i(this.distPath);let a=d.join(this.appRoot,R);await o(a,d.posix.join(_,R));let p=d.join(this.appRoot,z);if(h.existsSync(p)){let u=h.readFileSync(p,"utf-8");rt(u,p),await o(p,d.posix.join(_,z))}let g=d.join(this.appRoot,D);await o(g,d.posix.join(_,D)),c=await r.close()}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`Failed to create zip: ${p}`)}await h.promises.writeFile(t,c);let l=(c.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${l} MB)`),t}};s(L,"ApplicationPackager");var V=L;import{CogniteClient as ut}from"@cognite/sdk";var at=s(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),n={};for(let[r,o]of Object.entries(t))if(typeof o=="string"){let i=r.toLowerCase().replace(/_/g,"-");n[i]=o}return n}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),ct=s(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=at()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),pt=s(e=>{if(!e)return"";try{return new URL(e).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=e.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),lt=s(async(e,t)=>{let n=`Basic ${btoa(`${e}:${t}`)}`,r=await fetch("https://auth.cognite.com/oauth2/token",{method:"POST",headers:{Authorization:n,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})});if(!r.ok){let i=await r.text();throw new Error(`Failed to get token from CDF: ${r.status} ${r.statusText}
-${i}`)}let o=await r.json();if(!o.access_token)throw new Error("No access token returned from CDF authentication");return o.access_token},"getTokenCdf"),dt=s(async(e,t,n,r,o)=>{let i;if(o)i=o;else{if(!r)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let p=pt(r);if(!p)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${r}`);i=`https://${p}.cognitedata.com/.default`}let c=`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,l=await fetch(c,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e,client_secret:t,scope:i,grant_type:"client_credentials"})});if(!l.ok){let p=await l.text();throw new Error(`Failed to get token from Entra ID: ${l.status} ${l.statusText}
-${p}`)}let a=await l.json();if(!a.access_token)throw new Error("No access token returned from Entra ID authentication");return a.access_token},"getTokenEntra"),U=s(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:n,deploySecretName:r,idpType:o="cdf",tenantId:i,baseUrl:c,scope:l}=e,a=ct(r);if(o==="entra_id"){if(!i)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return dt(n,a,i,c,l)}return lt(n,a)},"getToken");var O=s(async(e,t,n=process.env)=>{let r=await U(e,n),o=n.COGNITE_BASE_URL??e.baseUrl,i=new ut({appId:t,project:e.project,baseUrl:o,oidcTokenProvider:s(async()=>r,"oidcTokenProvider")});return await i.authenticate(),i},"getSdk");var ft=s(async(e,t,n)=>{let r=await new V(`${n}/dist`).createZip("app.zip",!0);try{let{externalId:o,name:i,description:c,versionTag:l}=t,a=await O(e,n),p=new P(a),g=Y.readFileSync(r),u=gt.basename(r);await p.deploy(o,i,c,l,g,u,e.published)}finally{try{Y.unlinkSync(r)}catch{}}},"deploy");export{P as a,V as b,U as c,O as d,ft as e};