@cognite/cli 1.5.1 → 1.6.0-alpha.sdk-gen

package/dist/deploy/index.d.ts

@@ -1,4 +1,5 @@
 import { CogniteClient, ClientOptions } from '@cognite/sdk';
+import { inspect } from 'node:util';
 
 /**
  * App Hosting HTTP API layer.
@@ -24,6 +25,12 @@ interface AppVersion {
     createdBy: string;
     appExternalId: string;
 }
+/** Stored app metadata as returned by `GET /apps/:id`. */
+interface AppMetadata {
+    externalId: string;
+    name: string;
+    description?: string;
+}
 declare const SIGNATURE_STATUSES: readonly ["VALID", "REVOKED", "EXPIRED", "SIGNED_BEFORE_KEY_ISSUED", "IAT_IN_FUTURE", "BUNDLE_TOO_OLD", "KEY_NOT_IN_REGISTRY"];
 type SignatureStatus = (typeof SIGNATURE_STATUSES)[number];
 declare const SIGNER_ROLES: readonly ["developer", "certifier"];
@@ -43,10 +50,26 @@ declare class AppHostingClient {
     getVersion(appExternalId: string, version: string): Promise<AppVersion>;
     uploadVersion(appExternalId: string, version: string, fileContent: Buffer, fileName: string, entryPath?: string): Promise<void>;
     /**
-     * Ensure the app exists — creates it if missing, treats 409 Conflict as
+     * Ensure the app exists. Creates it when missing; treats 409 Conflict as
      * success so the call is safe to repeat.
+     *
+     * Deploy does not change an existing app's name or description — instead, when
+     * the app already exists, it checks for metadata drift. Any drift blocks the
+     * deploy; the user must run `apps metadata update` to sync first.
      */
     ensureApp(externalId: string, name: string, description: string): Promise<void>;
+    /**
+     * Drift check on deploy: any metadata drift blocks the deploy. A failed
+     * lookup must never block a deploy, so API errors here are swallowed.
+     */
+    private checkMetadataDrift;
+    /** Fetch the deployed app's stored metadata. Throws AppNotFoundError when absent. */
+    getApp(externalId: string): Promise<AppMetadata>;
+    /**
+     * Explicitly push the app's name and description to the backend. An empty
+     * description is sent as setNull, since the backend rejects blank strings.
+     */
+    updateAppMetadata(externalId: string, name: string, description: string): Promise<void>;
     /**
      * Submit verified compact-JWS signatures for a version uploaded earlier.
      * No-op when `items` is empty so callers can wire it unconditionally.
@@ -93,13 +116,15 @@ type Deployment = {
     deploySecretName: string;
     published: boolean;
     /** Identity provider type. Defaults to "cdf" if not specified */
-    idpType?: 'cdf' | 'entra_id';
+    idpType?: 'cdf' | 'entra_id' | 'oauth';
     /** Tenant ID for Entra ID authentication. Required when idpType is "entra_id" */
     tenantId?: string;
     /** OAuth scopes to request. When omitted, token retrieval derives
      *  `https://<cluster>.cognitedata.com/.default` from `baseUrl`. When set to `[]`,
      *  an empty scope string is sent. */
     scopes?: string[];
+    /** OAuth token endpoint. Required when idpType is "oauth". */
+    tokenUrl?: string;
 };
 type App = {
     externalId: string;
@@ -144,6 +169,26 @@ type Authenticatable = Pick<CogniteClient, 'authenticate'>;
 declare function getSdk(deployment: Deployment, folder: string, env?: NodeJS.ProcessEnv): Promise<CogniteClient>;
 declare function getSdk<C extends Authenticatable>(deployment: Deployment, folder: string, env: NodeJS.ProcessEnv, createClient: (opts: ClientOptions) => C): Promise<C>;
 
+/**
+ * Wraps a secret string so it cannot accidentally leak through string
+ * coercion, `JSON.stringify`, or `util.inspect` / `console.log`. The raw
+ * value is only accessible via {@link expose}, which should be called at
+ * trusted boundaries (crypto operations, HTTP headers, SDK init) and nowhere
+ * else.
+ */
+declare class SensitiveString {
+    #private;
+    constructor(value: string);
+    toString(): string;
+    toJSON(): string;
+    /** Covers `util.inspect` and `console.log`. */
+    [inspect.custom](): string;
+    /** Returns the raw value. Only call this at a trusted boundary. */
+    expose(): string;
+    /** Creates a {@link SensitiveString} wrapping `value`. */
+    static from(value: string): SensitiveString;
+}
+
 /**
  * Get access token for deployment using the appropriate identity provider.
  * Supports both CDF OAuth and Entra ID (Azure AD) authentication.
@@ -151,7 +196,7 @@ declare function getSdk<C extends Authenticatable>(deployment: Deployment, folde
  * Set COGNITE_TOKEN to skip OAuth entirely (useful when running the CLI
  * against a local mock server — see cli/testing/msw/standalone.ts).
  */
-declare const getToken: (deployment: Deployment, env?: NodeJS.ProcessEnv) => Promise<string>;
+declare const getToken: (deployment: Deployment, env?: NodeJS.ProcessEnv) => Promise<SensitiveString>;
 
 /**
  * Sibling-file discovery for bundle signatures written by `cognite sign`.

package/dist/deploy/index.js

@@ -1 +1 @@
-import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-MZWFUPT4.js";export{a as AppHostingClient,b as ApplicationPackager,c as BUNDLE_DIR,j as SIGNATURE_SUFFIXES,d as bundleFileName,e as bundlePath,i as deploy,k as discoverSignatures,g as getSdk,f as getToken,h as packageAndUpload};
+import{a,b,c,d,e,f,g,h,i,j,k}from"../chunk-IX7GU6LI.js";import"../chunk-ATR2SGLU.js";export{a as AppHostingClient,b as ApplicationPackager,c as BUNDLE_DIR,j as SIGNATURE_SUFFIXES,d as bundleFileName,e as bundlePath,i as deploy,k as discoverSignatures,g as getSdk,f as getToken,h as packageAndUpload};

package/dist/index.d.ts

@@ -1,2 +1,5 @@
 export { App, AppHostingClient, ApplicationPackager, BUNDLE_DIR, Deployment, SIGNATURE_SUFFIXES, bundleFileName, bundlePath, deploy, discoverSignatures, getSdk, getToken, packageAndUpload } from './deploy/index.js';
+export { DuneRequester, DuneRuntime, ViewDefinition, ViewDefinitionProperty, createDuneRuntime, createDuneRuntimeFromViews } from './sdk-runtime/index.js';
 import '@cognite/sdk';
+import 'node:util';
+import 'graphql';

package/dist/index.js

@@ -1 +1 @@
-import{a as o,b as r,c as e,d as f,e as m,f as p,g as t,h as x,i as a,j as b,k as c}from"./chunk-MZWFUPT4.js";export{o as AppHostingClient,r as ApplicationPackager,e as BUNDLE_DIR,b as SIGNATURE_SUFFIXES,f as bundleFileName,m as bundlePath,a as deploy,c as discoverSignatures,t as getSdk,p as getToken,x as packageAndUpload};
+import{a as o,b as r,c as e,d as f,e as m,f as p,g as t,h as x,i as a,j as b,k as c}from"./chunk-IX7GU6LI.js";import{a as d,b as g}from"./chunk-OIOJTLJU.js";import"./chunk-ATR2SGLU.js";export{o as AppHostingClient,r as ApplicationPackager,e as BUNDLE_DIR,b as SIGNATURE_SUFFIXES,f as bundleFileName,m as bundlePath,d as createDuneRuntime,g as createDuneRuntimeFromViews,a as deploy,c as discoverSignatures,t as getSdk,p as getToken,x as packageAndUpload};

package/dist/sdk-runtime/index.d.ts

@@ -0,0 +1,255 @@
+import { ViewDefinition as ViewDefinition$1, ViewPropertyDefinition, EnumProperty, ConnectionDefinitionRead, ViewReference, FilterDefinition, SearchSort, AggregationDefinition, AggregatedResultItem, InstancesAPI, CogniteClient } from '@cognite/sdk';
+import { DocumentNode, GraphQLSchema } from 'graphql';
+
+interface GenerateSdkConfig {
+    name: string;
+    space: string;
+    dataModelExternalId: string;
+    dataModelVersion: string;
+}
+
+interface SharedViewId {
+    space: string;
+    externalId: string;
+    version: string;
+}
+type PropertyDescriptor = {
+    kind: 'scalar';
+    isList?: boolean;
+    graphqlType?: string;
+} | {
+    kind: 'enum';
+    values: string[];
+    valueNames: Record<string, string>;
+} | {
+    kind: 'directRelation';
+    targetView: SharedViewId;
+} | {
+    kind: 'directRelationList';
+    targetView: SharedViewId;
+} | {
+    kind: 'reverseDirect';
+    sourceView: SharedViewId;
+    throughProperty: string;
+} | {
+    kind: 'reverseList';
+    sourceView: SharedViewId;
+    throughProperty: string;
+} | {
+    kind: 'edge';
+    targetView: SharedViewId;
+    direction: 'outwards' | 'inwards';
+};
+interface SchemaView {
+    view: SharedViewId;
+    properties: Map<string, PropertyDescriptor>;
+}
+interface SchemaKnowledge {
+    view(ref: SharedViewId): SchemaView;
+    property(ref: SharedViewId, prop: string): PropertyDescriptor | undefined;
+}
+
+type DmsEnumPropertyType = EnumProperty & {
+    list?: boolean;
+    maxListSize?: number;
+};
+type CodegenPropertyType = Exclude<ViewPropertyDefinition['type'], EnumProperty> | DmsEnumPropertyType;
+type ViewDefinitionProperty = ((Omit<ViewPropertyDefinition, 'type'> & {
+    type: CodegenPropertyType;
+}) | ConnectionDefinitionRead) & {
+    constraintState?: Record<string, unknown>;
+    description?: string;
+};
+type ViewDefinition = Omit<ViewDefinition$1, 'properties'> & {
+    properties: Record<string, ViewDefinitionProperty>;
+};
+
+/**
+ * Executes an operation document in-process and resolves to its result.
+ * The generated SDK supplies the result/variable types at each call site
+ * (requester<TData, TVariables>(doc, vars)), so no cast is needed on the
+ * document constants themselves.
+ */
+type DuneRequester = <TData, TVariables>(doc: DocumentNode, variables?: TVariables) => Promise<TData>;
+
+interface PropertyRef {
+    view: ViewReference;
+    property: string;
+}
+interface ConnectionSelection {
+    limit?: number;
+    select: SelectionTree;
+}
+interface SelectionTree {
+    scalars: string[];
+    connections: Map<string, ConnectionSelection>;
+}
+interface SortClause {
+    property: PropertyRef;
+    direction: 'ascending' | 'descending';
+    /** When true, nulls sort before non-nulls. Defaults to false. */
+    nullsFirst?: boolean;
+}
+/** Pre-translated DMS logical filter (output of translateFilter in resolver layer). */
+type LogicalFilter = FilterDefinition;
+interface QueryInput {
+    view: ViewReference;
+    filter?: LogicalFilter;
+    sort?: SortClause[];
+    select: SelectionTree;
+    /** Page size. Defaults to INITIAL_BATCH_LIMIT if omitted. */
+    limit?: number;
+    /** Opaque cursor from a previous ListResult.pageInfo.endCursor. */
+    cursor?: string;
+}
+interface ListResult<T = Record<string, unknown>> {
+    items: T[];
+    pageInfo: {
+        endCursor: string | null;
+        hasNextPage: boolean;
+    };
+}
+
+interface SearchInput {
+    view: ViewReference;
+    /** Full-text search term. */
+    query?: string;
+    filter?: LogicalFilter;
+    sort?: SearchSort[];
+    select: SelectionTree;
+    /** Max items to return. Defaults to searchLimit config. */
+    limit?: number;
+    /** Restrict search to specific property names within the view. */
+    properties?: string[];
+}
+
+interface AggregateInput {
+    view: ViewReference;
+    filter?: LogicalFilter;
+    aggregates: AggregationDefinition[];
+    groupBy?: string[];
+    /** Optional full-text query to scope which instances are aggregated. */
+    query?: string;
+}
+interface AggregateOutput {
+    items: AggregatedResultItem[];
+}
+
+type DmsClient = Pick<InstancesAPI, 'query' | 'search' | 'aggregate' | 'retrieve' | 'upsert' | 'delete' | 'sync' | 'inspect'>;
+interface PlannerConfig {
+    initialBatchLimit: number;
+    maxBatchLimit: number;
+    searchLimit: number;
+    inFilterChunkSize: number;
+    reverseListChunkSize: number;
+    previewLimit: number;
+    nestedDetailLimit: number;
+    enableRemoveNotConnected: boolean;
+    max408Retries: number;
+    max429Retries: number;
+    retryBaseDelayMs: number;
+    maxConcurrentRequests: number;
+    /** Maximum SelectionTree nesting depth. Throws PlannerValidationError if exceeded. */
+    maxNestingDepth: number;
+    /** Hard ceiling for listAll without an explicit maxTotal. Throws rather than silently truncating. */
+    maxTotalItems: number;
+    /** Maximum filter-tree recursion depth (_and/_or/_not/nested). Throws PlannerValidationError if exceeded. */
+    maxFilterDepth: number;
+}
+
+type UnpackedNode = {
+    space: string;
+    externalId: string;
+} & Record<string, unknown>;
+
+/** Properties registered once at client init and merged into every subsequent event. */
+interface SdkTelemetryBaseProperties {
+    project?: string;
+}
+/** Typed map of every event name to its specific properties. */
+interface SdkTelemetryEventMap {
+    'Flows.SDK.ClientCreated': {
+        viewCount: number;
+    };
+    'Flows.SDK.OperationExecuted': {
+        operationType: 'query' | 'search' | 'count' | 'aggregate' | 'retrieve';
+        viewExternalId: string;
+        success: boolean;
+        durationMs: number;
+    };
+}
+type SdkTelemetryEventName = keyof SdkTelemetryEventMap;
+interface SdkTelemetry {
+    track<E extends SdkTelemetryEventName>(eventName: E, properties: SdkTelemetryEventMap[E]): void;
+    flush(timeoutMs?: number): Promise<void>;
+    /** Merge properties into every subsequent event (Mixpanel-style super properties). */
+    register(baseProperties: SdkTelemetryBaseProperties): void;
+}
+
+declare class QueryRunner {
+    private readonly dms;
+    private readonly schema;
+    private readonly config;
+    private readonly executor;
+    private readonly telemetry;
+    get schemaKnowledge(): SchemaKnowledge | undefined;
+    get maxFilterDepth(): number;
+    constructor(dms: DmsClient, schema?: SchemaKnowledge, config?: Partial<PlannerConfig>, telemetry?: SdkTelemetry);
+    private trackOperation;
+    private _queryPage;
+    query(input: QueryInput): Promise<ListResult<UnpackedNode>>;
+    /**
+     * Collects all pages until exhaustion. `input.limit` is the page size.
+     * `maxTotal` sets an explicit ceiling — without it, throws at `config.maxTotalItems`
+     * to prevent unbounded fetches.
+     */
+    queryAll(input: Omit<QueryInput, 'cursor'>, maxTotal?: number): Promise<UnpackedNode[]>;
+    /**
+     * Full-text or filter-based search returning a single (non-paginated) result set.
+     * Use for top-level discovery; DMS search has eventual consistency — do not use
+     * for writes-then-reads or where strong consistency is required.
+     */
+    search(input: SearchInput): Promise<ListResult<UnpackedNode>>;
+    /**
+     * Fetches specific nodes by space+externalId. Returns an empty array when ids is empty.
+     * Extracts view-scoped properties before returning, matching the shape of list results.
+     */
+    retrieve(ids: Array<{
+        space: string;
+        externalId: string;
+    }>, view: ViewReference): Promise<UnpackedNode[]>;
+    /**
+     * Returns the total count of instances matching the filter.
+     * Wraps the filter with hasData so only instances with data in the view are counted.
+     */
+    count(input: {
+        view: ViewReference;
+        filter?: LogicalFilter;
+    }): Promise<number>;
+    aggregate(input: AggregateInput): Promise<AggregateOutput>;
+    /**
+     * Async generator — yields one ListResult per page.
+     * Lets callers stream results or stop early without fetching remaining pages.
+     */
+    queryPages(input: Omit<QueryInput, 'cursor'>): AsyncGenerator<ListResult<UnpackedNode>>;
+}
+
+interface DuneRuntime {
+    schema: GraphQLSchema;
+    rootValue: Record<string, unknown>;
+    runner: QueryRunner;
+    /** Backs the generated SDK methods — executes each operation document in-process. */
+    requester: DuneRequester;
+}
+/**
+ * Builds the full runtime from a data model config. Fetches views from CDF,
+ * builds the GraphQL schema, wires resolvers, and returns a ready requester.
+ */
+declare function createDuneRuntime(config: GenerateSdkConfig, client: CogniteClient, telemetry?: SdkTelemetry): Promise<DuneRuntime>;
+/**
+ * Builds the runtime directly from an array of ViewDefinition objects — skips the
+ * data model lookup. Useful when you already have views from sdk.views.list().
+ */
+declare function createDuneRuntimeFromViews(views: ViewDefinition[], client: CogniteClient, telemetry?: SdkTelemetry): DuneRuntime;
+
+export { type DuneRequester, type DuneRuntime, type ViewDefinition, type ViewDefinitionProperty, createDuneRuntime, createDuneRuntimeFromViews };

package/dist/sdk-runtime/index.js

@@ -0,0 +1 @@
+import{a,b}from"../chunk-OIOJTLJU.js";import"../chunk-ATR2SGLU.js";export{a as createDuneRuntime,b as createDuneRuntimeFromViews};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cognite/cli",
-  "version": "1.5.1",
+  "version": "1.6.0-alpha.sdk-gen",
   "description": "CLI for Cognite Data Fusion",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "Cognite",
@@ -22,6 +22,11 @@
       "types": "./dist/deploy/index.d.ts",
       "import": "./dist/deploy/index.js",
       "default": "./dist/deploy/index.js"
+    },
+    "./sdk-runtime": {
+      "types": "./dist/sdk-runtime/index.d.ts",
+      "import": "./dist/sdk-runtime/index.js",
+      "default": "./dist/sdk-runtime/index.js"
     }
   },
   "bin": {
@@ -46,8 +51,14 @@
     "refresh-spec-kit": "bash scripts/refresh-spec-kit.sh"
   },
   "dependencies": {
-    "@cognite/app-sdk": "^0.6.0",
-    "@cognite/sdk": "^10.10.0",
+    "@cognite/app-sdk": "^0.7.0",
+    "@cognite/sdk": "^10.11.0",
+    "@graphql-codegen/add": "^7.0.1",
+    "@graphql-codegen/cli": "^7.0.0",
+    "@graphql-codegen/typescript": "^6.0.1",
+    "@graphql-codegen/typescript-document-nodes": "^6.0.1",
+    "@graphql-codegen/typescript-operations": "^6.0.2",
+    "@napi-rs/keyring": "^1.3.0",
     "@sentry/node": "^10.51.0",
     "@zip.js/zip.js": "^2.7.0",
     "chalk": "^5.6.2",
@@ -56,6 +67,7 @@
     "dotenv": "^17.4.2",
     "enquirer": "^2.4.1",
     "execa": "^5.1.1",
+    "graphql": "^16.14.0",
     "hygen": "^6.2.11",
     "jose": "^6.2.2",
     "mixpanel": "^0.21.0",
@@ -92,7 +104,7 @@
     "react-dom": "^19.2.6",
     "tsup": "^8.4.0",
     "typescript": "^5.0.0",
-    "vitest": "4.1.7"
+    "vitest": "4.1.8"
   },
   "engines": {
     "node": ">=20"

package/dist/chunk-MZWFUPT4.js

@@ -1,13 +0,0 @@
-var ae=Object.defineProperty;var i=(n,e)=>ae(n,"name",{value:e,configurable:!0});import{mkdir as Oe,readFile as Le}from"fs/promises";import{basename as He,dirname as Be}from"path";var D=class D extends Error{constructor(e,t={}){super(e),this.name="HintedError",t.cause!==void 0&&(this.cause=t.cause);let r=this.deriveDefaults(t);this.hint=t.hint??r.hint,this.helpUrl=t.helpUrl??r.helpUrl,this.shouldReport=t.shouldReport??!0}deriveDefaults(e){return{hint:le(e.cause)}}};i(D,"HintedError");var l=D;var Y="https://docs.cognite.com/cdf/access/",ce="https://status.cognite.com";function pe(n){switch(n){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:Y};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:Y};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:ce};default:return{}}}i(pe,"defaultHintForStatus");var U=class U extends l{constructor(e,t){super(e,t),this.name="HintedHttpError",this.httpStatusCode=t.httpStatusCode,this.requestUrl=t.requestUrl,this.responseBody=t.responseBody}deriveDefaults(e){let{httpStatusCode:t}=e,r=pe(t),o=super.deriveDefaults(e);return{hint:r.hint??o.hint,helpUrl:r.helpUrl}}};i(U,"HintedHttpError");var A=U;function ue(n,e){if(n)switch(n){case"ENOTFOUND":return e.hostname?`DNS lookup failed for ${e.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return e.hostname&&e.port?`Connection refused by ${e.hostname}:${e.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return e.path?`Permission denied: ${e.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return e.path?`File or directory not found: ${e.path}.`:"File or directory not found.";case"EISDIR":return e.path?`Expected a file but found a directory: ${e.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return e.port?`Port ${e.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}i(ue,"hintForErrno");function le(n){let e=n,t=new Set;for(;e!=null&&!t.has(e)&&(t.add(e),typeof e=="object");){let r=e,o=ue(r.code,r);if(o!==void 0)return o;e=r.cause}}i(le,"hintForCause");var z="https://docs.cognite.com/cdf/access/";function g(n){return n!==null&&typeof n=="object"}i(g,"isRecord");function v(n){return n instanceof Error&&"status"in n&&typeof n.status=="number"}i(v,"isHttpError");function de(n){switch(n){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${z}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${z}`;default:return}}i(de,"httpStatusHint");function E(n){let e=n instanceof Error?n:new Error(String(n));if(!v(e))return null;let t=de(e.status);return t?Object.assign(new Error(`${e.message}
-  ${t}`),{cause:e}):null}i(E,"enrichedHttpError");function ge(n){if(!g(n))return null;let e=n.missing;if(Array.isArray(e))return e;let t=n.data;if(g(t)){let r=t.error;if(g(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(t.missing))return t.missing}return null}i(ge,"findMissingArray");function he(n,e){if(!v(n)||n.status!==400)return!1;let t=ge(n);return t?t.some(r=>g(r)&&typeof r.externalId=="string"&&e.includes(r.externalId)):!1}i(he,"isMissingExternalIdError");function N(n,e){return v(n)&&n.status===404||he(n,e)}i(N,"isNotFoundError");var W=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],X=["ACTIVE","PREVIEW"],V=class V extends Error{constructor(e,t){super(`Version ${t} of app ${e} not found`),this.name="AppVersionNotFoundError",this.appExternalId=e,this.version=t}};i(V,"AppVersionNotFoundError");var b=V;function T(n,e){return n.includes(e)}i(T,"includesValue");function fe(n){return T(W,n)}i(fe,"isAppVersionLifecycleState");function me(n){return T(X,n)}i(me,"isAppVersionAlias");function ye(n){return typeof n.version=="string"&&fe(n.lifecycleState)&&typeof n.entrypoint=="string"&&typeof n.createdTime=="number"&&typeof n.createdBy=="string"&&typeof n.appExternalId=="string"&&(n.alias===void 0||me(n.alias))&&(n.comment===void 0||typeof n.comment=="string")}i(ye,"isAppVersion");function K(n){if(!g(n)){let e=JSON.stringify(n)?.slice(0,200)??String(n);throw new Error(`Invalid version response: expected object, got ${e}`)}if(!ye(n)){let e=JSON.stringify(n).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${e}`)}return n}i(K,"parseAppVersion");var _=class _{constructor(e){this.client=e}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(e,t,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:e,name:t,description:r}]}})}catch(o){throw E(o)??o}}async uploadVersion(e,t,r,o,s="index.html"){console.log(`\u{1F4E4} Uploading version ${t}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(r)]),o),a.append("version",t),a.append("entryPath",s);let p=encodeURIComponent(e),c=`${this.appsBasePath}/${p}/versions`,u=await this.client.authenticate(),h=`${this.client.getBaseUrl()}${c}`,y=new AbortController,se=setTimeout(()=>y.abort(),300*1e3),S;try{S=await fetch(h,{method:"POST",headers:{Authorization:`Bearer ${u}`},body:a,signal:y.signal})}catch(f){throw f instanceof Error&&f.name==="AbortError"?new l("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new l(`Failed to upload version to ${h}`,{cause:f,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(se)}if(!S.ok){let f=await S.text(),w;try{w=JSON.parse(f)}catch{}let x=f;if(g(w)){let k=w.error;if(typeof k=="string")x=k;else if(g(k)){let C=k.message,J=k.code;x=typeof C=="string"?C:J!=null?`Unknown error (code: ${J})`:f}else{let C=w.message;x=typeof C=="string"?C:f}}let G=S.headers.get("x-request-id"),ie=G?` | X-Request-ID: ${G}`:"";throw new A(`Upload failed: ${S.status} \u2014 ${x}${ie}`,{httpStatusCode:S.status,requestUrl:h,responseBody:g(w)?w:f})}console.log(`\u2705 Version ${t} uploaded`)}async getVersion(e,t){let r=encodeURIComponent(e),o=encodeURIComponent(t),s=`${this.appsBasePath}/${r}/versions/${o}`;try{let a=await this.client.get(s);return K(a.data)}catch(a){throw N(a,[e,t])?new b(e,t):E(a)??a}}async getActiveVersion(e){let t=encodeURIComponent(e),r=`${this.appsBasePath}/${t}/versions/list`;try{let o=await this.client.post(r,{data:{filter:{aliases:["ACTIVE"]}}});if(!g(o.data)||!Array.isArray(o.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=o.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return K(s[0])}catch(o){if(N(o,[e]))return null;throw E(o)??o}}async updateVersions(e,t){let r=encodeURIComponent(e),o=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(o,{data:{items:t}})}catch(s){throw E(s)??s}}async submitSignatures(e,t,r){let o=encodeURIComponent(e),s=encodeURIComponent(t),a=`${this.appsBasePath}/${o}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:r}})}catch(p){throw E(p)??p}}async listSignatures(e,t){let r=encodeURIComponent(e),o=encodeURIComponent(t),s=`${this.appsBasePath}/${r}/versions/${o}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return we(a.data)}catch(a){throw E(a)??a}}};i(_,"AppHostingApi");var R=_,Ee=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],Se=["developer","certifier"];function we(n){if(!g(n))throw new Error("Invalid signatures response: expected an object with an items array");let{items:e}=n;if(!Array.isArray(e))throw new Error("Invalid signatures response: items property is missing or not an array");return e.flatMap(t=>{let r=Ae(t);return r?[r]:[]})}i(we,"parseStoredSignatures");function Ae(n){if(!g(n))return null;let{signerKid:e,signerRole:t,signatureIat:r,receivedAt:o,createdTime:s,status:a}=n;return typeof e!="string"||e===""||!T(Se,t)||typeof r!="number"||typeof o!="number"||typeof s!="number"||!T(Ee,a)?null:{signerKid:e,signerRole:t,signatureIat:r,receivedAt:o,createdTime:s,status:a}}i(Ae,"parseStoredSignature");var F=class F{constructor(e){this.api=new R(e)}getVersion(e,t){return this.api.getVersion(e,t)}uploadVersion(e,t,r,o,s){return this.api.uploadVersion(e,t,r,o,s)}async ensureApp(e,t,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(e,t,r),console.log(`\u2705 App '${e}' created`)}catch(o){if(v(o)&&o.status===409){console.log(`\u2705 App '${e}' already exists`);return}throw o}}async submitSignatures(e,t,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${t}...`),await this.api.submitSignatures(e,t,r),console.log("\u2705 Signatures stored"))}listSignatures(e,t){return this.api.listSignatures(e,t)}async publishVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(e,t){console.log(`\u{1F680} Publishing and activating version ${t}...`),await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${t} is now PUBLISHED and ACTIVE`)}getActiveVersion(e){return this.api.getActiveVersion(e)}async deactivateVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{alias:{setNull:!0}}}])}async activateVersion(e,t){let r=null;try{r=await this.api.getActiveVersion(e)}catch{r=null}let o=r&&r.version!==t?r.version:void 0;return await this.api.updateVersions(e,[{version:t,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:o}}async deploy(e,t,r,o,s,a,p=!1){console.log(`
-\u{1F680} Deploying application via App Hosting API...
-`),await this.ensureApp(e,t,r),await this.uploadVersion(e,o,s,a),p&&await this.publishAndActivate(e,o),console.log(`
-\u2705 Deployment successful!`)}};i(F,"AppHostingClient");var I=F;import{execFileSync as $}from"child_process";import m from"fs";import d from"path";import{parseAndValidateManifestConfig as ke}from"@cognite/app-sdk/vite";import{BlobReader as Ce,Uint8ArrayWriter as ve,ZipWriter as Ie}from"@zip.js/zip.js";var O="package.json",L="package-lock.json",Z="manifest.json",H=".cognite",Pe=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],B=class B{constructor(e="dist"){this.distPath=d.isAbsolute(e)?e:d.join(process.cwd(),e),this.appRoot=d.dirname(this.distPath)}validateBuildDirectory(){if(!m.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let e=d.join(this.appRoot,O);if(!m.existsSync(e))throw new Error(`"${e}" not found. It is required for deployment.`);let t=d.join(this.appRoot,L);if(!m.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`)}async createZip(e="app.zip",t=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new Ie(new ve,{level:9}),o=i(async(c,u)=>{await r.add(u,new Ce(await m.openAsBlob(c))),t&&console.log(`  \u{1F4C4} ${u}`)},"addFile"),s=i(async c=>{let u=await m.promises.readdir(c,{withFileTypes:!0});for(let h of u){let y=d.join(c,h.name);h.isDirectory()?await s(y):await o(y,d.relative(this.distPath,y).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=d.join(this.appRoot,O);await o(c,d.posix.join(H,O));let u=d.join(this.appRoot,Z);if(m.existsSync(u)){let y=m.readFileSync(u,"utf-8");ke(y,u),await o(u,d.posix.join(H,Z))}let h=d.join(this.appRoot,L);await o(h,d.posix.join(H,L)),a=await r.close()}catch(c){let u=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${u}`)}try{await m.promises.writeFile(e,a)}catch(c){throw new l(`Failed to write bundle to ${e}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${e} (${p} MB)`),e}async createSourceArchive(e){console.log("\u{1F4E6} Packaging source for review...");let t;try{t=$("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let r=$("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),o=r?r.replace(/\/$/,""):".",s=o==="."?"HEAD":`HEAD:${o}`;this.validateNoSensitiveFiles(t,s);try{$("git",["-C",t,"archive","--format=zip",`--output=${e}`,s])}catch(c){let u=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${u}`)}let p=(m.statSync(e).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${d.basename(e)} (${p} MB)`),e}validateNoSensitiveFiles(e,t){let r=$("git",["-C",e,"ls-tree","-r","--name-only",t],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
-`).filter(Boolean),o=i(a=>a.split("/").some(p=>Pe.some(c=>c.test(p))),"isSensitive"),s=r.filter(o);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
-`+s.map(a=>`  ${a}`).join(`
-`)+`
-Hint: git rm --cached <file>`)}};i(B,"ApplicationPackager");var P=B;import xe from"path";var Q=".cognite-bundles";function ee(n,e){return`${n}-${e}.zip`}i(ee,"bundleFileName");function j(n,e,t){return xe.join(n,Q,ee(e,t))}i(j,"bundlePath");import{CogniteClient as Fe}from"@cognite/sdk";function be(n){return Math.floor(Math.random()*Math.min(2**n*250,15e3))}i(be,"exponentialBackoffWithJitter");function Te(n){return new Promise(e=>setTimeout(e,n))}i(Te,"sleep");async function te(n,e={}){let t=e.maxAttempts??5,r=e.shouldRetry??(()=>!0),o=e.delayInMsCalculator??be;if(t<1)throw new Error("`maxAttempts` must be 1 or greater");if(t>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await n()}catch(a){if(s>=t||!r(a))throw a;let p=o(s);e.onAttemptFail?.(a,s,p),await Te(p),s++}}i(te,"retryAsync");var Re=i(n=>typeof n=="object"&&n!==null&&"access_token"in n&&typeof n.access_token=="string","hasAccessToken");async function ne({idp:n,tokenUrl:e,init:t,missingTokenHint:r}){let o;try{o=await te(()=>fetch(e,t),{maxAttempts:3})}catch(p){throw new l(`Failed to fetch access token from ${e}`,{cause:p})}if(!o.ok){let p=await o.text();throw new A(`Failed to get token from ${n}: ${o.status} ${o.statusText}`,{httpStatusCode:o.status,requestUrl:e,responseBody:p})}let s=await o.text(),a;try{a=JSON.parse(s)}catch{throw new l(`Unexpected response from ${n} authentication (invalid JSON):
-${s}`,{hint:r})}if(!Re(a))throw new l(`No access token in ${n} authentication response:
-${s}`,{hint:r});return a.access_token}i(ne,"fetchOAuthToken");var $e=i(()=>{let n=process.env.DEPLOYMENT_SECRETS;if(!n)return{};try{let e=JSON.parse(n),t={};for(let[r,o]of Object.entries(e))if(typeof o=="string"){let s=r.toLowerCase().replace(/_/g,"-");t[s]=o}return t}catch(e){return console.error("Error parsing DEPLOYMENT_SECRETS:",e),{}}},"loadSecretsFromEnv"),De=i(n=>{let e;if(process.env.DEPLOYMENT_SECRET&&(e=process.env.DEPLOYMENT_SECRET),e||(e=$e()[n]),e||(e=process.env[n]),!e)throw new Error(`Secret not found in environment: ${n}`);return e},"getSecretFromEnv"),Ue=i(n=>{if(!n)return"";try{return new URL(n).hostname.replace(/\.cognitedata\.com$/,"")}catch{let e=n.replace(/^https?:\/\//,"");return e=e.split("/")[0],e=e.split(":")[0],e=e.replace(/\.cognitedata\.com$/,""),e}},"extractClusterFromUrl"),Ne=i((n,e)=>ne({idp:"CDF",tokenUrl:"https://auth.cognite.com/oauth2/token",init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${n}:${e}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."}),"getTokenCdf"),Ve=i((n,e)=>{if(e!==void 0)return e.join(" ");if(!n)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let t=Ue(n);if(!t)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${n}`);return`https://${t}.cognitedata.com/.default`},"resolveEntraScope"),_e=i((n,e,t,r,o)=>{let s=Ve(r,o);return ne({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${t}/oauth2/v2.0/token`,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:e,grant_type:"client_credentials",...s?{scope:s}:{}})},missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."})},"getTokenEntra"),M=i(async(n,e=process.env)=>{if(e.COGNITE_TOKEN)return e.COGNITE_TOKEN;let{deployClientId:t,deploySecretName:r,idpType:o="cdf",tenantId:s,baseUrl:a,scopes:p}=n,c=De(r);if(o==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return _e(t,c,s,a,p)}return Ne(t,c)},"getToken");async function q(n,e,t=process.env,r){let o=await M(n,t),s=t.COGNITE_BASE_URL??n.baseUrl,a=(r??(p=>new Fe(p)))({appId:e,project:n.project,baseUrl:s,oidcTokenProvider:i(async()=>o,"oidcTokenProvider")});return await a.authenticate(),a}i(q,"getSdk");async function re(n,e,t,r){let{externalId:o,name:s,description:a,versionTag:p}=e,c=j(t,o,p);await Oe(Be(c),{recursive:!0}),await new P(`${t}/dist`).createZip(c,!0);let u;try{u=await Le(c)}catch(h){throw new l(`Failed to read bundle file: ${c}`,{cause:h})}await new I(n).deploy(o,s,a,p,u,He(c),r)}i(re,"packageAndUpload");var je=i(async(n,e,t)=>{let r=await q(n,t);await re(r,e,t,n.published)},"deploy");import{existsSync as Me,readFileSync as qe}from"fs";var oe=[".dev.sig",".cert.sig"];function Ge(n,e={}){let t=e.existsSync??Me,r=e.readFileSync??((s,a)=>qe(s,a)),o=[];for(let s of oe){let a=`${n}${s}`;if(!t(a))continue;let p=r(a,"utf8").trim();p.length>0&&o.push(p)}return o}i(Ge,"discoverSignatures");export{I as a,P as b,Q as c,ee as d,j as e,M as f,q as g,re as h,je as i,oe as j,Ge as k};