@cognite/cli 1.3.4-alpha.selfsigned → 1.4.0

package/dist/deploy/index.d.ts

@@ -1,32 +1,4 @@
-import { CogniteClient } from '@cognite/sdk';
-
-type Deployment = {
-    org: string;
-    project: string;
-    baseUrl: string;
-    deployClientId: string;
-    deploySecretName: string;
-    published: boolean;
-    /** Identity provider type. Defaults to "cdf" if not specified */
-    idpType?: "cdf" | "entra_id";
-    /** Tenant ID for Entra ID authentication. Required when idpType is "entra_id" */
-    tenantId?: string;
-    /**
-     * OAuth scope for Entra ID authentication. When set, overrides the scope
-     * that would otherwise be derived from baseUrl
-     * (e.g. "https://<cluster>.cognitedata.com/.default").
-     * Use this for non-standard CDF environments such as private-link deployments.
-     */
-    scope?: string;
-};
-type App = {
-    externalId: string;
-    name: string;
-    description: string;
-    versionTag: string;
-};
-
-declare const deploy: (deployment: Deployment, app: App, folder: string) => Promise<void>;
+import { CogniteClient, ClientOptions } from '@cognite/sdk';
 
 /**
  * App Hosting HTTP API layer.
@@ -52,6 +24,18 @@ interface AppVersion {
     createdBy: string;
     appExternalId: string;
 }
+declare const SIGNATURE_STATUSES: readonly ["VALID", "REVOKED", "EXPIRED", "SIGNED_BEFORE_KEY_ISSUED", "IAT_IN_FUTURE", "BUNDLE_TOO_OLD", "KEY_NOT_IN_REGISTRY"];
+type SignatureStatus = (typeof SIGNATURE_STATUSES)[number];
+declare const SIGNER_ROLES: readonly ["developer", "certifier"];
+type SignerRole = (typeof SIGNER_ROLES)[number];
+type StoredSignature = {
+    signerKid: string;
+    signerRole: SignerRole;
+    signatureIat: number;
+    receivedAt: number;
+    createdTime: number;
+    status: SignatureStatus;
+};
 
 declare class AppHostingClient {
     private api;
@@ -63,10 +47,22 @@ declare class AppHostingClient {
      * success so the call is safe to repeat.
      */
     ensureApp(externalId: string, name: string, description: string): Promise<void>;
+    /**
+     * Submit verified compact-JWS signatures for a version uploaded earlier.
+     * No-op when `items` is empty so callers can wire it unconditionally.
+     * The backend accepts and stores well-formed tokens; tier-policy
+     * verification happens on the subsequent publish step.
+     */
+    submitSignatures(appExternalId: string, version: string, items: string[]): Promise<void>;
+    /** Fetch the stored signatures for a version. Returns [] when none stored. */
+    listSignatures(appExternalId: string, version: string): Promise<StoredSignature[]>;
     /** Transition a version from DRAFT to PUBLISHED. */
     publishVersion(appExternalId: string, version: string): Promise<void>;
     /** Publish the version and immediately set it as the ACTIVE alias. */
     publishAndActivate(appExternalId: string, version: string): Promise<void>;
+    getActiveVersion(appExternalId: string): Promise<AppVersion | null>;
+    /** Remove the ACTIVE alias from a version, taking it out of service without changing its lifecycle state. */
+    deactivateVersion(appExternalId: string, version: string): Promise<void>;
     /**
      * Set the ACTIVE alias on a version. Returns the version that was
      * previously active (if any) so callers can surface "Superseded X"
@@ -89,6 +85,42 @@ declare class AppHostingClient {
     deploy(appExternalId: string, name: string, description: string, versionTag: string, fileContent: Buffer, fileName: string, published?: boolean): Promise<void>;
 }
 
+type Deployment = {
+    org: string;
+    project: string;
+    baseUrl: string;
+    deployClientId: string;
+    deploySecretName: string;
+    published: boolean;
+    /** Identity provider type. Defaults to "cdf" if not specified */
+    idpType?: 'cdf' | 'entra_id';
+    /** Tenant ID for Entra ID authentication. Required when idpType is "entra_id" */
+    tenantId?: string;
+};
+type App = {
+    externalId: string;
+    name: string;
+    description: string;
+    versionTag: string;
+};
+
+/**
+ * Package `dist/` into `<folder>/.cognite-bundles/<externalId>-<versionTag>.zip`
+ * and upload it via an already-authenticated `AppHostingClient`. Both deploy
+ * entry points (programmatic `deploy()` and the CLI's interactive path) reuse
+ * this so packaging/upload behaviour stays in one place.
+ *
+ * The bundle file is intentionally left on disk so the follow-on
+ * `cognite apps sign` + `cognite apps publish` flow can operate on the
+ * exact bytes the backend received.
+ */
+declare function packageAndUpload(client: AppHostingApiClient, app: App, folder: string, published: boolean): Promise<void>;
+/**
+ * Programmatic deploy used by CI scripts: resolves an SDK from the
+ * deployment's env-var credentials, then runs `packageAndUpload`.
+ */
+declare const deploy: (deployment: Deployment, app: App, folder: string) => Promise<void>;
+
 /**
  * Application Packaging
  *
@@ -100,9 +132,13 @@ declare class ApplicationPackager {
     constructor(distDirectory?: string);
     validateBuildDirectory(): void;
     createZip(outputFilename?: string, verbose?: boolean): Promise<string>;
+    createSourceArchive(outputPath: string): Promise<string>;
+    private validateNoSensitiveFiles;
 }
 
-declare const getSdk: (deployment: Deployment, folder: string, env?: NodeJS.ProcessEnv) => Promise<CogniteClient>;
+type Authenticatable = Pick<CogniteClient, 'authenticate'>;
+declare function getSdk(deployment: Deployment, folder: string, env?: NodeJS.ProcessEnv): Promise<CogniteClient>;
+declare function getSdk<C extends Authenticatable>(deployment: Deployment, folder: string, env: NodeJS.ProcessEnv, createClient: (opts: ClientOptions) => C): Promise<C>;
 
 /**
  * Get access token for deployment using the appropriate identity provider.
@@ -113,4 +149,37 @@ declare const getSdk: (deployment: Deployment, folder: string, env?: NodeJS.Proc
  */
 declare const getToken: (deployment: Deployment, env?: NodeJS.ProcessEnv) => Promise<string>;
 
-export { type App, AppHostingClient, ApplicationPackager, type Deployment, deploy, getSdk, getToken };
+/**
+ * Sibling-file discovery for bundle signatures written by `cognite sign`.
+ *
+ *   <bundle>.dev.sig     — developer signature
+ *   <bundle>.cert.sig    — certifier counter-signature (`--as-certifier`)
+ *
+ * Tokens are passed verbatim to the App Hosting `/signatures` endpoint; the
+ * backend verifies them against its key registry and tier policy.
+ *
+ * Collaborators are injected via `deps` so tests can stub fs without `vi.mock`.
+ */
+declare const SIGNATURE_SUFFIXES: readonly [".dev.sig", ".cert.sig"];
+type DiscoverSignaturesDeps = {
+    existsSync?: (path: string) => boolean;
+    readFileSync?: (path: string, encoding: 'utf8') => string;
+};
+declare function discoverSignatures(bundlePath: string, deps?: DiscoverSignaturesDeps): string[];
+
+/**
+ * Stable on-disk location for a packaged app bundle, keyed on app + version.
+ *
+ * `cognite apps deploy` writes the zip here and leaves it in place, so the
+ * subsequent `cognite apps sign` + `cognite apps publish` steps operate on
+ * the *exact bytes* that were uploaded — the bundle SHA in the signed
+ * payload matches what the backend has on hand.
+ *
+ * Lives under a single gitignored folder (`.cognite-bundles/`) so signed
+ * artefacts don't accidentally land in version control.
+ */
+declare const BUNDLE_DIR = ".cognite-bundles";
+declare function bundleFileName(externalId: string, versionTag: string): string;
+declare function bundlePath(cwd: string, externalId: string, versionTag: string): string;
+
+export { type App, AppHostingClient, ApplicationPackager, BUNDLE_DIR, type Deployment, SIGNATURE_SUFFIXES, bundleFileName, bundlePath, deploy, discoverSignatures, getSdk, getToken, packageAndUpload };

package/dist/deploy/index.js

@@ -1 +1 @@
-import{a,b,c,d,e}from"../chunk-BXCPVUBR.js";export{a as AppHostingClient,b as ApplicationPackager,e as deploy,d as getSdk,c as getToken};
+import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-Z7JAPCBW.js";export{a as AppHostingClient,b as ApplicationPackager,c as BUNDLE_DIR,j as SIGNATURE_SUFFIXES,d as bundleFileName,e as bundlePath,i as deploy,k as discoverSignatures,g as getSdk,f as getToken,h as packageAndUpload};

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export { App, AppHostingClient, ApplicationPackager, Deployment, deploy, getSdk, getToken } from './deploy/index.js';
+export { App, AppHostingClient, ApplicationPackager, BUNDLE_DIR, Deployment, SIGNATURE_SUFFIXES, bundleFileName, bundlePath, deploy, discoverSignatures, getSdk, getToken, packageAndUpload } from './deploy/index.js';
 import '@cognite/sdk';

package/dist/index.js

@@ -1 +1 @@
-import{a as o,b as r,c as e,d as f,e as m}from"./chunk-BXCPVUBR.js";export{o as AppHostingClient,r as ApplicationPackager,m as deploy,f as getSdk,e as getToken};
+import{a as o,b as r,c as e,d as f,e as m,f as p,g as t,h as x,i as a,j as b,k as c}from"./chunk-Z7JAPCBW.js";export{o as AppHostingClient,r as ApplicationPackager,e as BUNDLE_DIR,b as SIGNATURE_SUFFIXES,f as bundleFileName,m as bundlePath,a as deploy,c as discoverSignatures,t as getSdk,p as getToken,x as packageAndUpload};

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cognite/cli",
-  "version": "1.3.4-alpha.selfsigned",
+  "version": "1.4.0",
   "description": "CLI for Cognite Data Fusion",
-  "license": "Apache-2.0",
+  "license": "SEE LICENSE IN LICENSE.md",
   "author": "Cognite",
   "repository": {
     "type": "git",
@@ -34,6 +34,7 @@
   ],
   "scripts": {
     "build": "tsup",
+    "typecheck": "tsc --noEmit",
     "prepare": "tsup",
     "prepack": "pnpm run build",
     "prepublishOnly": "pnpm run build",
@@ -44,11 +45,12 @@
     "refresh-spec-kit": "bash scripts/refresh-spec-kit.sh"
   },
   "dependencies": {
-    "@cognite/app-sdk": "^0.4.0",
+    "@cognite/app-sdk": "^0.5.1",
     "@cognite/sdk": "^10.10.0",
     "@sentry/node": "^10.51.0",
     "@zip.js/zip.js": "^2.7.0",
     "chalk": "^5.6.2",
+    "clipboardy": "5.3.1",
     "commander": "^14.0.3",
     "dotenv": "^17.4.2",
     "enquirer": "^2.4.1",
@@ -58,7 +60,6 @@
     "mixpanel": "^0.21.0",
     "open": "^10.1.0",
     "openid-client": "^6.8.3",
-    "selfsigned": "^5.5.0",
     "semver": "^7.7.0",
     "skills": "^1.4.3",
     "valibot": "^1.3.1"

package/dist/chunk-BXCPVUBR.js

@@ -1,9 +0,0 @@
-var W=Object.defineProperty;var s=(e,t)=>W(e,"name",{value:t,configurable:!0});import Y from"fs";import gt from"path";var N="https://docs.cognite.com/cdf/access/";function m(e){return e!==null&&typeof e=="object"}s(m,"isRecord");function S(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}s(S,"isHttpError");function Z(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${N}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${N}`;default:return}}s(Z,"httpStatusHint");function w(e){let t=e instanceof Error?e:new Error(String(e));if(!S(t))return null;let n=Z(t.status);return n?Object.assign(new Error(`${t.message}
-  ${n}`),{cause:t}):null}s(w,"enrichedHttpError");function X(e){if(!m(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(m(n)){let r=n.error;if(m(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(n.missing))return n.missing}return null}s(X,"findMissingArray");function Q(e,t){if(!S(e)||e.status!==400)return!1;let n=X(e);return n?n.some(r=>m(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}s(Q,"isMissingExternalIdError");function v(e,t){return S(e)&&e.status===404||Q(e,t)}s(v,"isNotFoundError");var M=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],J=["ACTIVE","PREVIEW"],I=class I extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};s(I,"AppVersionNotFoundError");var C=I;function q(e,t){return e.includes(t)}s(q,"includesValue");function tt(e){return q(M,e)}s(tt,"isAppVersionLifecycleState");function et(e){return q(J,e)}s(et,"isAppVersionAlias");function nt(e){return typeof e.version=="string"&&tt(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||et(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}s(nt,"isAppVersion");function H(e){if(!m(e))throw new Error("Invalid version response: not an object");if(!nt(e))throw new Error("Invalid version response: missing or malformed fields");return e}s(H,"parseAppVersion");var T=class T{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:r}]}})}catch(o){throw w(o)??o}}async uploadVersion(t,n,r,o,i="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let c=new FormData;c.append("file",new Blob([new Uint8Array(r)]),o),c.append("version",n),c.append("entryPath",i);let l=encodeURIComponent(t),a=`${this.appsBasePath}/${l}/versions`,p=await this.client.authenticate(),g=`${this.client.getBaseUrl()}${a}`,u=new AbortController,G=setTimeout(()=>u.abort(),300*1e3),y;try{y=await fetch(g,{method:"POST",headers:{Authorization:`Bearer ${p}`},body:c,signal:u.signal})}catch(f){throw f instanceof Error&&f.name==="AbortError"?new Error("Upload timed out after 5 minutes"):f}finally{clearTimeout(G)}if(!y.ok){let f=await y.text(),k=f;try{let $=JSON.parse(f);if(m($)){let A=$.error;if(typeof A=="string")k=A;else if(m(A)){let E=A.message,F=A.code;k=typeof E=="string"?E:F!=null?`Unknown error (code: ${F})`:f}else{let E=$.message;k=typeof E=="string"?E:f}}}catch{}let j=y.headers.get("x-request-id"),K=j?` | X-Request-ID: ${j}`:"",B=Object.assign(new Error(`Upload failed: ${y.status} \u2014 ${k}${K}`),{status:y.status});throw w(B)??B}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let r=encodeURIComponent(t),o=encodeURIComponent(n),i=`${this.appsBasePath}/${r}/versions/${o}`;try{let c=await this.client.get(i);return H(c.data)}catch(c){throw v(c,[t,n])?new C(t,n):w(c)??c}}async getActiveVersion(t){let n=encodeURIComponent(t),r=`${this.appsBasePath}/${n}/active`;try{let o=await this.client.get(r);return H(o.data)}catch(o){if(v(o,[t]))return null;throw w(o)??o}}async updateVersions(t,n){let r=encodeURIComponent(t),o=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(o,{data:{items:n}})}catch(i){throw w(i)??i}}};s(T,"AppHostingApi");var x=T;var b=class b{constructor(t){this.api=new x(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,r,o,i){return this.api.uploadVersion(t,n,r,o,i)}async ensureApp(t,n,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,r),console.log(`\u2705 App '${t}' created`)}catch(o){if(S(o)&&o.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw o}}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}async activateVersion(t,n){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let o=r&&r.version!==n?r.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:o}}async deploy(t,n,r,o,i,c,l=!1){console.log(`
-\u{1F680} Deploying application via App Hosting API...
-`);try{await this.ensureApp(t,n,r),await this.uploadVersion(t,o,i,c),l&&await this.publishAndActivate(t,o),console.log(`
-\u2705 Deployment successful!`)}catch(a){let p=a instanceof Error?a.message:String(a);throw Object.assign(new Error(`Deployment failed: ${p}`),{cause:a})}}};s(b,"AppHostingClient");var P=b;import h from"fs";import d from"path";import{parseAndValidateManifestConfig as rt}from"@cognite/app-sdk/vite";import{BlobReader as ot,Uint8ArrayWriter as st,ZipWriter as it}from"@zip.js/zip.js";var R="package.json",D="package-lock.json",z="manifest.json",_=".cognite",L=class L{constructor(t="dist"){this.distPath=d.isAbsolute(t)?t:d.join(process.cwd(),t),this.appRoot=d.dirname(this.distPath)}validateBuildDirectory(){if(!h.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=d.join(this.appRoot,R);if(!h.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=d.join(this.appRoot,D);if(!h.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new it(new st,{level:9}),o=s(async(a,p)=>{await r.add(p,new ot(await h.openAsBlob(a))),n&&console.log(`  \u{1F4C4} ${p}`)},"addFile"),i=s(async a=>{let p=await h.promises.readdir(a,{withFileTypes:!0});for(let g of p){let u=d.join(a,g.name);g.isDirectory()?await i(u):await o(u,d.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),c;try{await i(this.distPath);let a=d.join(this.appRoot,R);await o(a,d.posix.join(_,R));let p=d.join(this.appRoot,z);if(h.existsSync(p)){let u=h.readFileSync(p,"utf-8");rt(u,p),await o(p,d.posix.join(_,z))}let g=d.join(this.appRoot,D);await o(g,d.posix.join(_,D)),c=await r.close()}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`Failed to create zip: ${p}`)}await h.promises.writeFile(t,c);let l=(c.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${l} MB)`),t}};s(L,"ApplicationPackager");var V=L;import{CogniteClient as ut}from"@cognite/sdk";var at=s(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),n={};for(let[r,o]of Object.entries(t))if(typeof o=="string"){let i=r.toLowerCase().replace(/_/g,"-");n[i]=o}return n}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),ct=s(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=at()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),pt=s(e=>{if(!e)return"";try{return new URL(e).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=e.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),lt=s(async(e,t)=>{let n=`Basic ${btoa(`${e}:${t}`)}`,r=await fetch("https://auth.cognite.com/oauth2/token",{method:"POST",headers:{Authorization:n,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})});if(!r.ok){let i=await r.text();throw new Error(`Failed to get token from CDF: ${r.status} ${r.statusText}
-${i}`)}let o=await r.json();if(!o.access_token)throw new Error("No access token returned from CDF authentication");return o.access_token},"getTokenCdf"),dt=s(async(e,t,n,r,o)=>{let i;if(o)i=o;else{if(!r)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let p=pt(r);if(!p)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${r}`);i=`https://${p}.cognitedata.com/.default`}let c=`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,l=await fetch(c,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e,client_secret:t,scope:i,grant_type:"client_credentials"})});if(!l.ok){let p=await l.text();throw new Error(`Failed to get token from Entra ID: ${l.status} ${l.statusText}
-${p}`)}let a=await l.json();if(!a.access_token)throw new Error("No access token returned from Entra ID authentication");return a.access_token},"getTokenEntra"),U=s(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:n,deploySecretName:r,idpType:o="cdf",tenantId:i,baseUrl:c,scope:l}=e,a=ct(r);if(o==="entra_id"){if(!i)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return dt(n,a,i,c,l)}return lt(n,a)},"getToken");var O=s(async(e,t,n=process.env)=>{let r=await U(e,n),o=n.COGNITE_BASE_URL??e.baseUrl,i=new ut({appId:t,project:e.project,baseUrl:o,oidcTokenProvider:s(async()=>r,"oidcTokenProvider")});return await i.authenticate(),i},"getSdk");var ft=s(async(e,t,n)=>{let r=await new V(`${n}/dist`).createZip("app.zip",!0);try{let{externalId:o,name:i,description:c,versionTag:l}=t,a=await O(e,n),p=new P(a),g=Y.readFileSync(r),u=gt.basename(r);await p.deploy(o,i,c,l,g,u,e.published)}finally{try{Y.unlinkSync(r)}catch{}}},"deploy");export{P as a,V as b,U as c,O as d,ft as e};