@cognite/cli 1.3.4-alpha.selfsigned → 1.4.0

package/LICENSE.md

@@ -0,0 +1,6 @@
+Commercial Software Licence Agreement
+
+Copyright (c) Cognite AS 2026
+
+See Master Subscription and Professional Services Agreement for details:
+https://www.cognite.com/en/company/legal/master-subscription-services-agreement-2025

package/README.md

@@ -47,6 +47,18 @@ Browse available skills at [cognitedata/builder-skills](https://github.com/cogni
 - Node.js ≥ 20
 - React ≥ 18 (optional peer dependency — only needed for auth components)
 
+## Telemetry
+
+`@cognite/cli` collects anonymous usage data (commands run, success/failure, CLI and Node.js versions) to help improve the tool.
+
+To opt out:
+
+```bash
+export COGNITE_TELEMETRY_DISABLED=1
+```
+
+`DO_NOT_TRACK=1` is also honoured.
+
 ## Development
 
 ### Running tests

package/_templates/app/new/claude/mcp.json.ejs.t

@@ -0,0 +1,11 @@
+---
+to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>.mcp.json'
+---
+{
+  "mcpServers": {
+    "cognite-docs": {
+      "type": "http",
+      "url": "https://docs.cognite.com/mcp"
+    }
+  }
+}

package/_templates/app/new/config/vite.config.ts.ejs.t

@@ -3,17 +3,20 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>vite.config.ts'
 ---
 import path from 'node:path';
 
-import { fusionOpenPlugin, manifestCspPlugin } from '@cognite/app-sdk/vite';
+import {
+  fusionOpenPlugin,
+  manifestCspPlugin,
+  mkcertPlugin,
+} from '@cognite/app-sdk/vite';
 import tailwindcss from '@tailwindcss/vite';
 import react from '@vitejs/plugin-react';
 import { defineConfig } from 'vite';
-import mkcert from 'vite-plugin-mkcert';
 
 export default defineConfig({
   base: './',
   // manifestCspPlugin() must stay first — its middleware sets the
   // Content-Security-Policy header before any HTML response is sent.
-  plugins: [manifestCspPlugin(), react(), mkcert(), fusionOpenPlugin(), tailwindcss()],
+  plugins: [manifestCspPlugin(), react(), mkcertPlugin(), fusionOpenPlugin(), tailwindcss()],
   resolve: {
     alias: {
       '@': path.resolve(__dirname, './src'),

package/_templates/app/new/config/vitest.config.ts.ejs.t

@@ -10,5 +10,10 @@ export default defineConfig({
     globals: true,
     environment: 'happy-dom',
     setupFiles: ['vitest.setup.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html', 'lcov'],
+      exclude: ['node_modules/', 'dist/', 'vitest.setup.ts', '**/*.config.ts', '**/*.d.ts'],
+    },
   },
 });

package/_templates/app/new/cursor/mcp.json.ejs.t

@@ -0,0 +1,10 @@
+---
+to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>.cursor/mcp.json'
+---
+{
+  "mcpServers": {
+    "cognite-docs": {
+      "url": "https://docs.cognite.com/mcp"
+    }
+  }
+}

package/_templates/app/new/root/.npmrc.ejs.t

@@ -2,4 +2,4 @@
 to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>.npmrc'
 ---
 engine-strict=true
-min-release-age=2
+min-release-age=1

package/_templates/app/new/root/AGENTS.md.ejs.t

@@ -22,11 +22,69 @@ This app uses [github/spec-kit](https://github.com/github/spec-kit) for spec-dri
 
 ---
 
-## 1. Dependency Injection
+## 1. UI Components
 
-Inject dependencies via React context (hooks/components) or factory-override pattern (plain functions). Never hard-code dependencies.
+Always check `@cognite/aura/components` before reaching for a raw HTML element or custom CSS/Tailwind solution. If Aura has a component that covers the need, use it. Only fall back to custom solutions when Aura genuinely doesn't cover the use case.
 
-### React context
+---
+
+## 2. Host integration (`@cognite/app-sdk`)
+
+The Fusion host exposes a `HostAppAPI` (imported as `HostAppAPI` from `@cognite/app-sdk`) via `connectToHostApp(...)`. Reach for it whenever the situation calls for it — don't hand-roll an equivalent or read browser globals directly.
+
+### Decision rule for any new piece of state
+
+Before adding `useState`, `useReducer`, or a store entry, ask: **"would a user expect this to survive a page reload, or to be restored when someone opens a shared link?"** If yes, it belongs in `syncInternalState` + `initialState`, **not** in plain React state.
+
+- **Yes, host-synced:** current page / active view / route, selected tab, active filters, selected resource id, search query, sort order, expanded rows, focused row, side-panel open/closed — anything that drives what the user sees.
+- **No, local-only:** in-flight form input before submit, hover/focus, transient toasts, animation state, optimistic UI mid-flight.
+
+When in doubt, host-synced is the safer default — over-syncing is cheap, under-syncing breaks reload and share.
+
+### API surface
+
+- **Host-synced UI state** → on startup, seed your state from the `initialState` string returned by `connectToHostApp`. On every change, call `api.syncInternalState(JSON.stringify(state))`. The host serializes this into the URL so reloads and shared links restore the same state. **Do not** hold state from the "host-synced" category above in plain `useState` / `useRef` / a local store.
+- **Navigating elsewhere in Fusion** (another app, a Fusion route) → `api.navigateInternal({ path, queryParams, hash })`. Never set `window.location` directly.
+- **Navigating to an external URL** → `api.navigateExternal({ url, openInNewTab })`. Only `https:` is allowed.
+- **Needing a CDF base URL or access token** for API requests → `api.getBaseUrl()` / `api.getAccessToken()`. Never hardcode the cluster URL.
+- **Needing the current CDF project name** → `api.getProject()`. Don't read it from config or URL params.
+- **Exposing the app's capabilities to a Fusion agent** → register a custom agent server with `api.registerAgentServer(handle)` and clean up on unmount with `api.unregisterAgentServer(uri)`.
+
+Get `api` once at app startup and surface it to the rest of the app via React context so view models can depend on it through the patterns below.
+
+### Round-trip example: host-synced state
+
+```typescript
+import { connectToHostApp, type HostAppAPI } from '@cognite/app-sdk';
+
+type AppState = { page: 'a' | 'b'; filters: string[] };
+const DEFAULT_STATE: AppState = { page: 'a', filters: [] };
+
+// On startup — seed from initialState, not from a hardcoded default.
+const { api, initialState } = await connectToHostApp({ applicationName: '<%= name %>' });
+const seeded: AppState = initialState ? (JSON.parse(initialState) as AppState) : DEFAULT_STATE;
+
+// On every change — push the new state to the host so the URL stays in sync.
+async function updateState(next: AppState, api: HostAppAPI) {
+  setState(next); // your local React/store setter
+  await api.syncInternalState(JSON.stringify(next));
+}
+```
+
+`initialState` is the JSON string the host extracted from the URL on this load — the host owns the URL plumbing, the app just reads/writes the string.
+
+---
+
+## 3. Dependency Injection
+
+**All non-stateless dependencies must be injected.** Never import and call a service, SDK client, or stateful module directly inside a component or hook — it makes the code untestable and tightly coupled.
+
+What to inject: SDK clients, API services, analytics, timers (`Date.now`, `setTimeout`), random generators, external stores.
+What not to inject: pure functions, constants, type utilities.
+
+Use **narrow interfaces** — depend only on the subset of a service you actually need.
+
+### React context (hooks and components)
 
 ```typescript
 const defaultDeps = { useDataSource, useAnalytics };
@@ -38,7 +96,7 @@ export function useMyHook() {
 }
 ```
 
-### Factory overrides
+### Factory overrides (plain functions)
 
 ```typescript
 type Deps = { serviceFactory: () => SomeService };
@@ -51,7 +109,7 @@ export const doWork = async (props: Props, overrides?: Partial<Deps>) => {
 
 ---
 
-## 2. Interface-Based Services
+## 4. Interface-Based Services
 
 Define an interface; implement with a class. Never reference the concrete class outside its own file.
 
@@ -68,7 +126,7 @@ export class ApiDataService implements DataService {
 
 ---
 
-## 3. ViewModel Pattern
+## 5. ViewModel Pattern
 
 Business logic lives in `use<Name>ViewModel`. Components only render.
 
@@ -89,9 +147,26 @@ export const TodoView = () => {
 };
 ```
 
+### Where state lives
+
+A ViewModel hook must **not** hold state with `useState` / `useReducer` directly. State lives in a shared storage layer — a context-backed hook (like `useTodoStorage` above), a store, or a `*StateProvider` rendered once near the root of the view tree. The ViewModel composes that storage with commands and derivations; it is itself stateless.
+
+This matters because each call to a `useState`-backed hook creates an **independent** piece of React state. Two components calling the same ViewModel hook would each get their own copy and never sync.
+
+> ⚠️ Anti-pattern: `useState` inside `useFooViewModel`, then two sibling components each call `useFooViewModel()`. Clicks update one copy; the other renders stale data.
+
+### How many times to call a ViewModel hook
+
+- **Backed by shared context / store** → multiple components may call the hook; they all observe the same value. This is the default for non-trivial views.
+- **Not backed by shared state** → call the hook **once** at the top of the view tree and pass values down as props. Never call it twice and expect them to stay in sync.
+
+### Host-synced state inside a ViewModel
+
+When a ViewModel exposes state that falls under §2's "host-synced" category, the **ViewModel** — not the view component — is responsible for seeding from `initialState` and pushing changes via `syncInternalState`. The state itself still lives in the shared storage layer described above; the ViewModel just owns the read/write contract with the host.
+
 ---
 
-## 4. Test-First Development
+## 6. Test-First Development
 
 Write tests before implementation for all non-trivial behavior changes.
 
@@ -187,21 +262,41 @@ Place reusable factories in `src/__mocks__/`. Use `.test` TLD for fake URLs (RFC
 
 ---
 
-## 5. TypeScript Rules
+## 7. TypeScript Rules
 
 - Never use `any`; prefer `unknown` or explicit strong types
-- Never use `as unknown as T`; for partial test doubles use `{ ...defaults, ...overrides } as T`
+- Never use `as` casts — they silence the compiler without providing safety. Use type guards instead.
+- Exception: `Partial<T> as T` is acceptable for test mocks only.
+- All function parameters must have type annotations.
 - Use direct React type imports: `import type { ComponentType, ReactNode } from 'react'`
 
 ```typescript
-function createMockWindow(overrides: Partial<Window> = {}): Window {
-  return { postMessage: vi.fn(), ...overrides } as Window;
+// ❌ Never
+const x: any = data;
+const y = data as SomeType;
+const z = {} as unknown as Window;
+function process(data) { ... }         // missing parameter type
+
+// ✅ Type guard
+function isSomeType(value: unknown): value is SomeType {
+  return typeof value === 'object' && value !== null && 'id' in value;
 }
+if (isSomeType(data)) { /* TypeScript now knows */ }
+
+// ✅ Test mock only
+const mock = { postMessage: vi.fn() } as Partial<Window> as Window;
 ```
 
 ---
 
-## 6. Commits and pull requests
+## 8. CogniteClient / authentication
+
+Auth is handled by `CogniteSdkProvider` from `@cognite/app-sdk/react` (see `App.tsx`). Nested components get the client via `useCogniteSdk()`. To wire up or migrate auth, run the `/setup-flows-auth` skill.
+
+---
+
+
+## 9. Commits and pull requests
 
 Use [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/).
 

package/_templates/app/new/root/gitignore.ejs.t

@@ -6,6 +6,13 @@ node_modules
 
 # Build output
 dist
+coverage
+
+# Retained app bundles from `cognite apps deploy` (signed before publish)
+.cognite-bundles
+
+# Local HTTPS certificates from `cognite apps setup-https`
+certificates
 
 # Environment variables
 .env

package/_templates/app/new/root/package.json.ejs.t

@@ -18,15 +18,17 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>package.json'
     "test": "vitest run",
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
+    "test:coverage": "vitest run --coverage",
     "lint": "eslint . --ext .js,.mjs,.cjs,.ts,.tsx",
     "lint:fix": "eslint . --fix --ext .js,.mjs,.cjs,.ts,.tsx",
     "deploy": "npx @cognite/cli@latest apps deploy --interactive",
-    "activate": "npx @cognite/cli@latest apps activate --interactive"
+    "activate": "npx @cognite/cli@latest apps activate --interactive",
+    "setup-https": "npx @cognite/cli@latest apps setup-https"
   },
   "dependencies": {
     "@cognite/aura": "^0.1.7",
     "@cognite/sdk": "^10.3.0",
-    "@cognite/app-sdk": "^0.4.0",
+    "@cognite/app-sdk": "^0.5.1",
     "@tabler/icons-react": "^3.35.0",
     "@tanstack/react-query": "^5.90.10",
     "clsx": "^2.1.1",
@@ -44,6 +46,7 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>package.json'
     "@types/react": "^18.3.1",
     "@types/react-dom": "^18.3.1",
     "@vitejs/plugin-react": "^5.1.1",
+    "@vitest/coverage-v8": "^2.1.8",
     "@vitest/ui": "^2.1.8",
     "autoprefixer": "^10.4.22",
     "eslint": "9.39.4",
@@ -58,7 +61,6 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>package.json'
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.46.4",
     "vite": "7.3.2",
-    "vite-plugin-mkcert": "^1.17.9",
     "vitest": "^2.1.8"
   }
 }

package/_templates/app/new/src/App.test.tsx.ejs.t

@@ -1,13 +1,45 @@
 ---
 to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>src/App.test.tsx'
 ---
-import * as appSdk from '@cognite/app-sdk';
 import { render, screen, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { HostAppAPI, ConnectToHostAppResult } from '@cognite/app-sdk';
+import { CogniteClient } from '@cognite/sdk';
+import type { ComponentProps } from 'react';
 
 import App from './App';
 
-vi.mock(import('@cognite/app-sdk'));
+type AppDeps = NonNullable<ComponentProps<typeof App>['deps']>;
+
+function makeApi(): HostAppAPI {
+  return {
+    getProject: vi.fn<HostAppAPI['getProject']>(() => Promise.resolve('<%= project %>')),
+    getBaseUrl: vi.fn<HostAppAPI['getBaseUrl']>(() => Promise.resolve('https://cognite.test')),
+    getAccessToken: vi.fn<HostAppAPI['getAccessToken']>(() => Promise.resolve('test-token')),
+    getAppId: vi.fn<HostAppAPI['getAppId']>(() => Promise.resolve('test-app-id')),
+    syncInternalState: vi.fn<HostAppAPI['syncInternalState']>(() => Promise.resolve(true)),
+    navigateInternal: vi.fn<HostAppAPI['navigateInternal']>(() => Promise.resolve(true)),
+    navigateExternal: vi.fn<HostAppAPI['navigateExternal']>(() => Promise.resolve(true)),
+    registerAgentServer: vi.fn<HostAppAPI['registerAgentServer']>(() => Promise.resolve()),
+    unregisterAgentServer: vi.fn<HostAppAPI['unregisterAgentServer']>(() => Promise.resolve()),
+    sendAgentLayoutMode: vi.fn<HostAppAPI['sendAgentLayoutMode']>(() => Promise.resolve()),
+    sendAgentMessage: vi.fn<HostAppAPI['sendAgentMessage']>(() => Promise.resolve()),
+  };
+}
+
+function makeLoadingDeps(): AppDeps {
+  return {
+    connectToHostApp: vi.fn<AppDeps['connectToHostApp']>(() => new Promise<ConnectToHostAppResult>(() => undefined)),
+    createClient: vi.fn<AppDeps['createClient']>((config) => new CogniteClient(config)),
+  };
+}
+
+function makeConnectedDeps(): AppDeps {
+  return {
+    connectToHostApp: vi.fn<AppDeps['connectToHostApp']>(() => Promise.resolve({ api: makeApi() })),
+    createClient: vi.fn<AppDeps['createClient']>((config) => new CogniteClient(config)),
+  };
+}
 
 describe('App', () => {
   beforeEach(() => {
@@ -15,19 +47,13 @@ describe('App', () => {
   });
 
   it('renders loading state', () => {
-    vi.mocked(appSdk.connectToHostApp).mockReturnValue(new Promise(() => {}));
-
-    render(<App />);
+    render(<App deps={makeLoadingDeps()} />);
     expect(screen.getByText('Loading project...')).toBeInTheDocument();
   });
 
   it('renders splash with deployment targets and checklist copy', async () => {
-    vi.mocked(appSdk.connectToHostApp).mockResolvedValue({
-      api: { getProject: vi.fn().mockResolvedValue('my-test-project') } as Partial<appSdk.HostAppAPI> as appSdk.HostAppAPI,
-    });
-
-    render(<App />);
-    await waitFor(() => expect(screen.getByText('Welcome to Flows')).toBeInTheDocument());
+    render(<App deps={makeConnectedDeps()} />);
+    await waitFor(() => expect(screen.getByText('Welcome to Flows custom apps')).toBeInTheDocument());
     expect(screen.getByText('App deployment checklist')).toBeInTheDocument();
     expect(screen.getByText('Plan')).toBeInTheDocument();
     expect(screen.getByText('Explore')).toBeInTheDocument();

package/_templates/app/new/src/App.tsx.ejs.t

@@ -1,7 +1,8 @@
 ---
 to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>src/App.tsx'
 ---
-import { connectToHostApp } from '@cognite/app-sdk';
+import type { ComponentProps } from 'react';
+import { CogniteSdkProvider, useCogniteSdk } from '@cognite/app-sdk/react';
 import {
   Alert,
   AlertDescription,
@@ -18,7 +19,6 @@ import {
   Separator,
 } from '@cognite/aura/components';
 import { IconCaretUpDown, IconRocket } from '@tabler/icons-react';
-import { useEffect, useState } from 'react';
 
 import appConfig from '../app.json';
 
@@ -62,71 +62,41 @@ const CHECKLIST_STEPS = [
   },
 ] as const;
 
-function App() {
-  // Connect to the Fusion host via @cognite/app-sdk. The handshake is
-  // asynchronous — `project` is only populated after Comlink finishes
-  // exposing the host API, so we render a loader until then.
-  const [project, setProject] = useState<string | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState<string | undefined>();
-
-  useEffect(() => {
-    let cancelled = false;
-    connectToHostApp({ applicationName: '<%= name %>' })
-      .then(async ({ api }) => {
-        if (cancelled) return;
-        const proj = await api.getProject();
-        if (cancelled) return;
-        setProject(proj);
-      })
-      .catch((err: unknown) => {
-        if (cancelled) return;
-        setError(err instanceof Error ? err.message : String(err));
-      })
-      .finally(() => {
-        if (!cancelled) setIsLoading(false);
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, []);
-
-  if (isLoading) {
-    return (
-      <main className="min-h-screen bg-muted/50 text-foreground">
-        <section className="mx-auto flex min-h-screen w-full max-w-lg flex-col justify-center p-4 sm:p-8">
-          <div className="mx-auto w-full max-w-sm">
-            <Card aria-label="Loading project" aria-live="polite">
-              <CardContent>
-                <div className="inline-flex items-center gap-3 text-muted-foreground">
-                  <Loader size={20} />
-                  <span>Loading project...</span>
-                </div>
-              </CardContent>
-            </Card>
-          </div>
-        </section>
-      </main>
-    );
-  }
-
-  if (error) {
-    return (
-      <main className="min-h-screen bg-muted/50 text-foreground">
-        <section className="mx-auto flex min-h-screen w-full max-w-lg flex-col justify-center p-4 sm:p-8">
-          <div className="mx-auto w-full max-w-sm">
-            <Alert>
-              <AlertDescription>Failed to connect to Fusion host: {error}</AlertDescription>
-            </Alert>
-          </div>
-        </section>
-      </main>
-    );
-  }
+const loadingFallback = (
+  <main className="min-h-screen bg-muted/50 text-foreground">
+    <section className="mx-auto flex min-h-screen w-full max-w-lg flex-col justify-center p-4 sm:p-8">
+      <div className="mx-auto w-full max-w-sm">
+        <Card aria-label="Loading project" aria-live="polite">
+          <CardContent>
+            <div className="inline-flex items-center gap-3 text-muted-foreground">
+              <Loader size={20} />
+              <span>Loading project...</span>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </section>
+  </main>
+);
+
+const errorFallback = (
+  <main className="min-h-screen bg-muted/50 text-foreground">
+    <section className="mx-auto flex min-h-screen w-full max-w-lg flex-col justify-center p-4 sm:p-8">
+      <div className="mx-auto w-full max-w-sm">
+        <Alert>
+          <AlertDescription>Failed to connect to Fusion host</AlertDescription>
+        </Alert>
+      </div>
+    </section>
+  </main>
+);
+
+function AppContent() {
+  const client = useCogniteSdk();
 
   const deployment = appConfig.deployments?.[0];
   const orgLabel = deployment?.org ?? '';
-  const projectLabel = deployment?.project ?? project ?? '';
+  const projectLabel = deployment?.project ?? client.project ?? '';
 
   return (
     <main className="min-h-screen bg-muted/50 text-foreground">
@@ -230,4 +200,16 @@ function App() {
   );
 }
 
+type AppProps = {
+  deps?: ComponentProps<typeof CogniteSdkProvider>['deps'];
+};
+
+function App({ deps }: AppProps) {
+  return (
+    <CogniteSdkProvider loadingFallback={loadingFallback} errorFallback={errorFallback} deps={deps}>
+      <AppContent />
+    </CogniteSdkProvider>
+  );
+}
+
 export default App;

package/_templates/app/new/vscode/mcp.json.ejs.t

@@ -0,0 +1,11 @@
+---
+to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>.vscode/mcp.json'
+---
+{
+  "servers": {
+    "cognite-docs": {
+      "type": "http",
+      "url": "https://docs.cognite.com/mcp"
+    }
+  }
+}

package/dist/chunk-Z7JAPCBW.js

@@ -0,0 +1,13 @@
+var et=Object.defineProperty;var a=(n,t)=>et(n,"name",{value:t,configurable:!0});import{mkdir as xt,readFile as It}from"fs/promises";import{basename as kt,dirname as Ct}from"path";var z="https://docs.cognite.com/cdf/access/";function d(n){return n!==null&&typeof n=="object"}a(d,"isRecord");function w(n){return n instanceof Error&&"status"in n&&typeof n.status=="number"}a(w,"isHttpError");function nt(n){switch(n){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
+  See: ${z}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
+  See: ${z}`;default:return}}a(nt,"httpStatusHint");function h(n){let t=n instanceof Error?n:new Error(String(n));if(!w(t))return null;let e=nt(t.status);return e?Object.assign(new Error(`${t.message}
+  ${e}`),{cause:t}):null}a(h,"enrichedHttpError");function rt(n){if(!d(n))return null;let t=n.missing;if(Array.isArray(t))return t;let e=n.data;if(d(e)){let r=e.error;if(d(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(e.missing))return e.missing}return null}a(rt,"findMissingArray");function it(n,t){if(!w(n)||n.status!==400)return!1;let e=rt(n);return e?e.some(r=>d(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}a(it,"isMissingExternalIdError");function b(n,t){return w(n)&&n.status===404||it(n,t)}a(b,"isNotFoundError");var J=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Y=["ACTIVE","PREVIEW"],T=class T extends Error{constructor(t,e){super(`Version ${e} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=e}};a(T,"AppVersionNotFoundError");var I=T;function k(n,t){return n.includes(t)}a(k,"includesValue");function ot(n){return k(J,n)}a(ot,"isAppVersionLifecycleState");function st(n){return k(Y,n)}a(st,"isAppVersionAlias");function at(n){return typeof n.version=="string"&&ot(n.lifecycleState)&&typeof n.entrypoint=="string"&&typeof n.createdTime=="number"&&typeof n.createdBy=="string"&&typeof n.appExternalId=="string"&&(n.alias===void 0||st(n.alias))&&(n.comment===void 0||typeof n.comment=="string")}a(at,"isAppVersion");function G(n){if(!d(n))throw new Error("Invalid version response: not an object");if(!at(n))throw new Error("Invalid version response: missing or malformed fields");return n}a(G,"parseAppVersion");var V=class V{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,e,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:e,description:r}]}})}catch(i){throw h(i)??i}}async uploadVersion(t,e,r,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${e}...`);let o=new FormData;o.append("file",new Blob([new Uint8Array(r)]),i),o.append("version",e),o.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate(),y=`${this.client.getBaseUrl()}${c}`,f=new AbortController,Q=setTimeout(()=>f.abort(),300*1e3),S;try{S=await fetch(y,{method:"POST",headers:{Authorization:`Bearer ${l}`},body:o,signal:f.signal})}catch(m){throw m instanceof Error&&m.name==="AbortError"?new Error("Upload timed out after 5 minutes"):m}finally{clearTimeout(Q)}if(!S.ok){let m=await S.text(),x=m;try{let R=JSON.parse(m);if(d(R)){let E=R.error;if(typeof E=="string")x=E;else if(d(E)){let A=E.message,M=E.code;x=typeof A=="string"?A:M!=null?`Unknown error (code: ${M})`:m}else{let A=R.message;x=typeof A=="string"?A:m}}}catch{}let j=S.headers.get("x-request-id"),tt=j?` | X-Request-ID: ${j}`:"",H=Object.assign(new Error(`Upload failed: ${S.status} \u2014 ${x}${tt}`),{status:S.status});throw h(H)??H}console.log(`\u2705 Version ${e} uploaded`)}async getVersion(t,e){let r=encodeURIComponent(t),i=encodeURIComponent(e),s=`${this.appsBasePath}/${r}/versions/${i}`;try{let o=await this.client.get(s);return G(o.data)}catch(o){throw b(o,[t,e])?new I(t,e):h(o)??o}}async getActiveVersion(t){let e=encodeURIComponent(t),r=`${this.appsBasePath}/${e}/active`;try{let i=await this.client.get(r);return G(i.data)}catch(i){if(b(i,[t]))return null;throw h(i)??i}}async updateVersions(t,e){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(i,{data:{items:e}})}catch(s){throw h(s)??s}}async submitSignatures(t,e,r){let i=encodeURIComponent(t),s=encodeURIComponent(e),o=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(o,{data:{items:r}})}catch(p){throw h(p)??p}}async listSignatures(t,e){let r=encodeURIComponent(t),i=encodeURIComponent(e),s=`${this.appsBasePath}/${r}/versions/${i}/signatures/list`;try{let o=await this.client.post(s,{data:{}});return lt(o.data)}catch(o){throw h(o)??o}}};a(V,"AppHostingApi");var C=V,ct=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],pt=["developer","certifier"];function lt(n){if(!d(n))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=n;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(e=>{let r=ut(e);return r?[r]:[]})}a(lt,"parseStoredSignatures");function ut(n){if(!d(n))return null;let{signerKid:t,signerRole:e,signatureIat:r,receivedAt:i,createdTime:s,status:o}=n;return typeof t!="string"||t===""||!k(pt,e)||typeof r!="number"||typeof i!="number"||typeof s!="number"||!k(ct,o)?null:{signerKid:t,signerRole:e,signatureIat:r,receivedAt:i,createdTime:s,status:o}}a(ut,"parseStoredSignature");var D=class D{constructor(t){this.api=new C(t)}getVersion(t,e){return this.api.getVersion(t,e)}uploadVersion(t,e,r,i,s){return this.api.uploadVersion(t,e,r,i,s)}async ensureApp(t,e,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,e,r),console.log(`\u2705 App '${t}' created`)}catch(i){if(w(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw i}}async submitSignatures(t,e,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${e}...`),await this.api.submitSignatures(t,e,r),console.log("\u2705 Signatures stored"))}listSignatures(t,e){return this.api.listSignatures(t,e)}async publishVersion(t,e){await this.api.updateVersions(t,[{version:e,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,e){console.log(`\u{1F680} Publishing and activating version ${e}...`),await this.api.updateVersions(t,[{version:e,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${e} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,e){await this.api.updateVersions(t,[{version:e,update:{alias:{setNull:!0}}}])}async activateVersion(t,e){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let i=r&&r.version!==e?r.version:void 0;return await this.api.updateVersions(t,[{version:e,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,e,r,i,s,o,p=!1){console.log(`
+\u{1F680} Deploying application via App Hosting API...
+`);try{await this.ensureApp(t,e,r),await this.uploadVersion(t,i,s,o),p&&await this.publishAndActivate(t,i),console.log(`
+\u2705 Deployment successful!`)}catch(c){let l=c instanceof Error?c.message:String(c);throw Object.assign(new Error(`Deployment failed: ${l}`),{cause:c})}}};a(D,"AppHostingClient");var v=D;import{execFileSync as $}from"child_process";import g from"fs";import u from"path";import{parseAndValidateManifestConfig as dt}from"@cognite/app-sdk/vite";import{BlobReader as gt,Uint8ArrayWriter as ft,ZipWriter as mt}from"@zip.js/zip.js";var _="package.json",U="package-lock.json",q="manifest.json",N=".cognite",ht=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],F=class F{constructor(t="dist"){this.distPath=u.isAbsolute(t)?t:u.join(process.cwd(),t),this.appRoot=u.dirname(this.distPath)}validateBuildDirectory(){if(!g.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=u.join(this.appRoot,_);if(!g.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let e=u.join(this.appRoot,U);if(!g.existsSync(e))throw new Error(`"${e}" not found. It is required for deployment.`)}async createZip(t="app.zip",e=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new mt(new ft,{level:9}),i=a(async(c,l)=>{await r.add(l,new gt(await g.openAsBlob(c))),e&&console.log(`  \u{1F4C4} ${l}`)},"addFile"),s=a(async c=>{let l=await g.promises.readdir(c,{withFileTypes:!0});for(let y of l){let f=u.join(c,y.name);y.isDirectory()?await s(f):await i(f,u.relative(this.distPath,f).replace(/\\/g,"/"))}},"addDir"),o;try{await s(this.distPath);let c=u.join(this.appRoot,_);await i(c,u.posix.join(N,_));let l=u.join(this.appRoot,q);if(g.existsSync(l)){let f=g.readFileSync(l,"utf-8");dt(f,l),await i(l,u.posix.join(N,q))}let y=u.join(this.appRoot,U);await i(y,u.posix.join(N,U)),o=await r.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}await g.promises.writeFile(t,o);let p=(o.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let e;try{e=$("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let r=$("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=r?r.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(e,s);try{$("git",["-C",e,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(g.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${u.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,e){let r=$("git",["-C",t,"ls-tree","-r","--name-only",e],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
+`).filter(Boolean),i=a(o=>o.split("/").some(p=>ht.some(c=>c.test(p))),"isSensitive"),s=r.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
+`+s.map(o=>`  ${o}`).join(`
+`)+`
+Hint: git rm --cached <file>`)}};a(F,"ApplicationPackager");var P=F;import yt from"path";var K=".cognite-bundles";function W(n,t){return`${n}-${t}.zip`}a(W,"bundleFileName");function O(n,t,e){return yt.join(n,K,W(t,e))}a(O,"bundlePath");import{CogniteClient as Pt}from"@cognite/sdk";var St=a(()=>{let n=process.env.DEPLOYMENT_SECRETS;if(!n)return{};try{let t=JSON.parse(n),e={};for(let[r,i]of Object.entries(t))if(typeof i=="string"){let s=r.toLowerCase().replace(/_/g,"-");e[s]=i}return e}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),Et=a(n=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=St()[n]),t||(t=process.env[n]),!t)throw new Error(`Secret not found in environment: ${n}`);return t},"getSecretFromEnv"),At=a(n=>{if(!n)return"";try{return new URL(n).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=n.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),wt=a(async(n,t)=>{let e=`Basic ${btoa(`${n}:${t}`)}`,r=await fetch("https://auth.cognite.com/oauth2/token",{method:"POST",headers:{Authorization:e,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})});if(!r.ok){let s=await r.text();throw new Error(`Failed to get token from CDF: ${r.status} ${r.statusText}
+${s}`)}let i=await r.json();if(!i.access_token)throw new Error("No access token returned from CDF authentication");return i.access_token},"getTokenCdf"),vt=a(async(n,t,e,r)=>{if(!r)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let i=At(r);if(!i)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${r}`);let s=`https://login.microsoftonline.com/${e}/oauth2/v2.0/token`,o=`https://${i}.cognitedata.com/.default`,p=await fetch(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:t,scope:o,grant_type:"client_credentials"})});if(!p.ok){let l=await p.text();throw new Error(`Failed to get token from Entra ID: ${p.status} ${p.statusText}
+${l}`)}let c=await p.json();if(!c.access_token)throw new Error("No access token returned from Entra ID authentication");return c.access_token},"getTokenEntra"),L=a(async(n,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:e,deploySecretName:r,idpType:i="cdf",tenantId:s,baseUrl:o}=n,p=Et(r);if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return vt(e,p,s,o)}return wt(e,p)},"getToken");async function B(n,t,e=process.env,r){let i=await L(n,e),s=e.COGNITE_BASE_URL??n.baseUrl,o=(r??(p=>new Pt(p)))({appId:t,project:n.project,baseUrl:s,oidcTokenProvider:a(async()=>i,"oidcTokenProvider")});return await o.authenticate(),o}a(B,"getSdk");async function X(n,t,e,r){let{externalId:i,name:s,description:o,versionTag:p}=t,c=O(e,i,p);await xt(Ct(c),{recursive:!0}),await new P(`${e}/dist`).createZip(c,!0);let l=await It(c);await new v(n).deploy(i,s,o,p,l,kt(c),r)}a(X,"packageAndUpload");var $t=a(async(n,t,e)=>{let r=await B(n,e);await X(r,t,e,n.published)},"deploy");import{existsSync as Rt,readFileSync as bt}from"fs";var Z=[".dev.sig",".cert.sig"];function Tt(n,t={}){let e=t.existsSync??Rt,r=t.readFileSync??((s,o)=>bt(s,o)),i=[];for(let s of Z){let o=`${n}${s}`;if(!e(o))continue;let p=r(o,"utf8").trim();p.length>0&&i.push(p)}return i}a(Tt,"discoverSignatures");export{v as a,P as b,K as c,W as d,O as e,L as f,B as g,X as h,$t as i,Z as j,Tt as k};