@databricks/appkit 0.83.0 → 0.84.0

package/dist/plugins/genie/manifest.js

@@ -4,6 +4,7 @@ var manifest_default = {
 	name: "genie",
 	displayName: "Genie Plugin",
 	description: "AI/BI Genie space integration for natural language data queries",
+	scopes: ["genie"],
 	resources: {
 		"required": [{
 			"type": "genie_space",

package/dist/plugins/jobs/plugin.js

@@ -2,7 +2,7 @@ import { ExecutionError } from "../../errors/execution.js";
 import { ValidationError } from "../../errors/validation.js";
 import "../../errors/index.js";
 import { createLogger } from "../../logging/logger.js";
-import { getCurrentUserId, getWorkspaceClient } from "../../context/execution-context.js";
+import { getCurrentPrincipalId, getWorkspaceClient } from "../../context/execution-context.js";
 import "../../context/index.js";
 import { Plugin } from "../../plugin/plugin.js";
 import { toPlugin } from "../../plugin/to-plugin.js";
@@ -172,7 +172,7 @@ var JobsPlugin = class JobsPlugin extends Plugin {
 		const jobConfig = this.jobConfigs[jobKey];
 		const self = this;
 		const client = this.client;
-		const userKey = getCurrentUserId();
+		const userKey = getCurrentPrincipalId();
 		/**
 		* Verify that `runId` belongs to this job's configured `jobId`. Returns
 		* null if the run is in scope; otherwise returns a 404 `ExecutionResult`.

package/dist/plugins/jobs/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","names":["manifest"],"sources":["../../../src/plugins/jobs/plugin.ts"],"sourcesContent":["import { STATUS_CODES } from \"node:http\";\n\nimport type express from \"express\";\nimport type {\n  IAppRouter,\n  PluginExecutionSettings,\n  StreamExecutionSettings,\n} from \"shared\";\nimport { toJSONSchema } from \"zod\";\n\nimport { JobsConnector } from \"../../connectors/jobs\";\nimport { getCurrentUserId, getWorkspaceClient } from \"../../context\";\nimport { ExecutionError, ValidationError } from \"../../errors\";\nimport { createLogger } from \"../../logging/logger\";\nimport type { ExecutionResult } from \"../../plugin\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { ResourceRequirement } from \"../../registry\";\nimport { defineManifest, ResourceType } from \"../../registry\";\nimport type { jobs as jobsTypes } from \"../../workspace-client\";\nimport {\n  JOBS_READ_DEFAULTS,\n  JOBS_STREAM_DEFAULTS,\n  JOBS_WRITE_DEFAULTS,\n} from \"./defaults\";\nimport manifest from \"./manifest.json\";\nimport { mapParams } from \"./params\";\nimport type {\n  IJobsConfig,\n  JobAPI,\n  JobConfig,\n  JobRunStatus,\n  JobsExport,\n} from \"./types\";\n\nconst logger = createLogger(\"jobs\");\n\nconst DEFAULT_WAIT_TIMEOUT = 600_000;\nconst DEFAULT_POLL_INTERVAL = 5_000;\n/** Cap on param-key count when a job has no Zod schema. Jobs that need more keys must define a schema. */\nconst MAX_UNVALIDATED_PARAM_KEYS = 50;\n\n/** Replace upstream error messages with generic descriptions keyed by HTTP status. */\nfunction errorResult(status: number): ExecutionResult<never> {\n  return {\n    ok: false,\n    status,\n    message: STATUS_CODES[status] ?? \"Request failed\",\n  };\n}\n\nfunction isTerminalRunState(state: string | undefined): boolean {\n  return (\n    state === \"TERMINATED\" || state === \"SKIPPED\" || state === \"INTERNAL_ERROR\"\n  );\n}\n\n/** Exponential backoff (1.5x) with +/- 20% jitter, capped at `max`. */\nfunction nextPollDelay(\n  current: number,\n  max: number,\n): { delay: number; next: number } {\n  const jitter = 1 + (Math.random() * 0.4 - 0.2);\n  return {\n    delay: Math.min(current * jitter, max),\n    next: Math.min(current * 1.5, max),\n  };\n}\n\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve) => {\n    if (signal?.aborted) {\n      resolve();\n      return;\n    }\n    const timer = setTimeout(resolve, ms);\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timer);\n        resolve();\n      },\n      { once: true },\n    );\n  });\n}\n\nclass JobsPlugin extends Plugin {\n  static manifest = defineManifest<\"jobs\">(manifest);\n\n  declare protected config: IJobsConfig;\n  private connector: JobsConnector;\n  private jobIds: Record<string, number> = {};\n  private jobConfigs: Record<string, JobConfig> = {};\n  private jobKeys: string[] = [];\n\n  /**\n   * Scans process.env for DATABRICKS_JOB_* keys and merges with explicit config.\n   * Explicit config wins for per-job overrides; auto-discovered jobs get default `{}` config.\n   */\n  static discoverJobs(config: IJobsConfig): Record<string, JobConfig> {\n    const explicit = config.jobs ?? {};\n    const discovered: Record<string, JobConfig> = {};\n\n    const prefix = \"DATABRICKS_JOB_\";\n    for (const key of Object.keys(process.env)) {\n      if (!key.startsWith(prefix)) continue;\n      if (key === \"DATABRICKS_JOB_ID\") continue;\n      const suffix = key.slice(prefix.length);\n      if (!suffix || !process.env[key]) continue;\n      const jobKey = suffix.toLowerCase();\n      if (!(jobKey in explicit)) {\n        discovered[jobKey] = {};\n      }\n    }\n\n    // Single-job shorthand: DATABRICKS_JOB_ID maps to \"default\" key\n    if (\n      process.env.DATABRICKS_JOB_ID &&\n      Object.keys(explicit).length === 0 &&\n      Object.keys(discovered).length === 0\n    ) {\n      discovered.default = {};\n    }\n\n    return { ...discovered, ...explicit };\n  }\n\n  /**\n   * Generates resource requirements dynamically from discovered + configured jobs.\n   * Each job key maps to a `DATABRICKS_JOB_{KEY_UPPERCASE}` env var (or `DATABRICKS_JOB_ID` for \"default\").\n   */\n  static getResourceRequirements(config: IJobsConfig): ResourceRequirement[] {\n    const jobs = JobsPlugin.discoverJobs(config);\n    return Object.keys(jobs).map((key) => ({\n      type: ResourceType.JOB,\n      alias: `job-${key}`,\n      resourceKey: `job-${key}`,\n      description: `Databricks Job \"${key}\"`,\n      permission: \"CAN_MANAGE_RUN\" as const,\n      fields: {\n        id: {\n          env:\n            key === \"default\"\n              ? \"DATABRICKS_JOB_ID\"\n              : `DATABRICKS_JOB_${key.toUpperCase()}`,\n          description: `Job ID for \"${key}\"`,\n        },\n      },\n      required: true,\n    }));\n  }\n\n  constructor(config: IJobsConfig) {\n    super(config);\n    this.config = config;\n    this.connector = new JobsConnector({\n      telemetry: config.telemetry,\n    });\n\n    const jobs = JobsPlugin.discoverJobs(config);\n    this.jobKeys = Object.keys(jobs);\n    this.jobConfigs = jobs;\n\n    for (const key of this.jobKeys) {\n      const envVar =\n        key === \"default\"\n          ? \"DATABRICKS_JOB_ID\"\n          : `DATABRICKS_JOB_${key.toUpperCase()}`;\n      const jobIdStr = process.env[envVar];\n      if (jobIdStr) {\n        const parsed = Number.parseInt(jobIdStr, 10);\n        if (!Number.isNaN(parsed)) {\n          this.jobIds[key] = parsed;\n        }\n      }\n    }\n  }\n\n  async setup() {\n    logger.info(\n      `Jobs plugin initialized with ${this.jobKeys.length} job(s): ${this.jobKeys.join(\", \")}`,\n    );\n  }\n\n  private get client() {\n    return getWorkspaceClient();\n  }\n\n  private getJobId(jobKey: string): number {\n    const id = this.jobIds[jobKey];\n    if (!id) {\n      const envVar =\n        jobKey === \"default\"\n          ? \"DATABRICKS_JOB_ID\"\n          : `DATABRICKS_JOB_${jobKey.toUpperCase()}`;\n      throw new Error(\n        `Job \"${jobKey}\" has no configured job ID. Set ${envVar} env var.`,\n      );\n    }\n    return id;\n  }\n\n  private _readSettings(\n    cacheKey: (string | number | object)[],\n  ): PluginExecutionSettings {\n    return {\n      default: {\n        ...JOBS_READ_DEFAULTS,\n        ...(this.config.timeout != null && { timeout: this.config.timeout }),\n        cache: { ...JOBS_READ_DEFAULTS.cache, cacheKey },\n      },\n    };\n  }\n\n  private _writeSettings(): PluginExecutionSettings {\n    return {\n      default: {\n        ...JOBS_WRITE_DEFAULTS,\n        ...(this.config.timeout != null && { timeout: this.config.timeout }),\n      },\n    };\n  }\n\n  /**\n   * Validates params against the job's Zod schema (if any) and maps them\n   * to SDK request fields based on the task type. Shared by runNow and runAndWait.\n   */\n  private _validateAndMap(\n    jobKey: string,\n    params?: Record<string, unknown>,\n  ): Record<string, unknown> {\n    const jobConfig = this.jobConfigs[jobKey];\n    let validated = params;\n\n    if (jobConfig?.params) {\n      const result = jobConfig.params.safeParse(params ?? {});\n      if (!result.success) {\n        throw new ValidationError(\n          `Parameter validation failed for job \"${jobKey}\": ${result.error.message}`,\n        );\n      }\n      validated = result.data as Record<string, unknown>;\n    }\n\n    return jobConfig?.taskType && validated\n      ? mapParams(jobConfig.taskType, validated)\n      : (validated ?? {});\n  }\n\n  /**\n   * Creates a JobAPI for a specific configured job key.\n   * Each method is scoped to the job's configured ID.\n   */\n  protected createJobAPI(jobKey: string): JobAPI {\n    const jobId = this.getJobId(jobKey);\n    const jobConfig = this.jobConfigs[jobKey];\n    // Capture `this` for use in the async generator\n    const self = this;\n    // Capture client and userId eagerly: the closures below run later, after the ALS context may have exited.\n    const client = this.client;\n    const userKey = getCurrentUserId();\n\n    /**\n     * Verify that `runId` belongs to this job's configured `jobId`. Returns\n     * null if the run is in scope; otherwise returns a 404 `ExecutionResult`.\n     * Prevents cross-job access via the `/:jobKey/runs/:runId` HTTP surface.\n     */\n    const verifyRunScope = async (\n      runId: number,\n    ): Promise<ExecutionResult<never> | null> => {\n      const result = await self.execute(\n        async (signal) =>\n          self.connector.getRun(client, { run_id: runId }, signal),\n        self._readSettings([\"jobs:getRun\", jobKey, runId]),\n        userKey,\n      );\n      if (!result.ok) return errorResult(result.status);\n      if (result.data.job_id !== jobId) return errorResult(404);\n      return null;\n    };\n\n    return {\n      runNow: async (\n        params?: Record<string, unknown>,\n      ): Promise<ExecutionResult<jobsTypes.RunNowResponse>> => {\n        const sdkFields = self._validateAndMap(jobKey, params);\n\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.runNow(\n              client,\n              { ...sdkFields, job_id: jobId },\n              signal,\n            ),\n          self._writeSettings(),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      async *runAndWait(\n        params?: Record<string, unknown>,\n        signal?: AbortSignal,\n      ): AsyncGenerator<JobRunStatus, void, unknown> {\n        const sdkFields = self._validateAndMap(jobKey, params);\n\n        const runResult = await self.execute(\n          async (signal) =>\n            self.connector.runNow(\n              client,\n              { ...sdkFields, job_id: jobId },\n              signal,\n            ),\n          self._writeSettings(),\n          userKey,\n        );\n\n        if (!runResult.ok) {\n          throw new ExecutionError(\"Failed to trigger job run\");\n        }\n        const runId = runResult.data.run_id;\n        if (!runId) {\n          throw new Error(\"runNow did not return a run_id\");\n        }\n\n        const basePollInterval =\n          self.config.pollIntervalMs ?? DEFAULT_POLL_INTERVAL;\n        const maxPollInterval = basePollInterval * 6;\n        const timeout = jobConfig?.waitTimeout ?? DEFAULT_WAIT_TIMEOUT;\n        const startTime = Date.now();\n        let currentInterval = basePollInterval;\n\n        while (!signal?.aborted) {\n          if (Date.now() - startTime > timeout) {\n            throw new Error(\n              `Job run ${runId} polling timeout after ${timeout}ms`,\n            );\n          }\n\n          const runStatusResult = await self.execute(\n            async (signal) =>\n              self.connector.getRun(client, { run_id: runId }, signal),\n            {\n              default: {\n                ...JOBS_READ_DEFAULTS,\n                cache: { enabled: false },\n              },\n            },\n            userKey,\n          );\n          if (!runStatusResult.ok) {\n            throw new ExecutionError(\n              `Failed to poll run status for run ${runId}`,\n            );\n          }\n          const run = runStatusResult.data;\n          const state = run.state?.life_cycle_state;\n\n          yield { status: state, timestamp: Date.now(), run };\n\n          if (isTerminalRunState(state)) return;\n\n          const { delay, next } = nextPollDelay(\n            currentInterval,\n            maxPollInterval,\n          );\n          currentInterval = next;\n          await abortableSleep(delay, signal);\n        }\n      },\n\n      lastRun: async (): Promise<\n        ExecutionResult<jobsTypes.BaseRun | undefined>\n      > => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.listRuns(\n              client,\n              { job_id: jobId, limit: 1 },\n              signal,\n            ),\n          self._readSettings([\"jobs:lastRun\", jobKey]),\n          userKey,\n        );\n        if (!result.ok) return errorResult(result.status);\n        return { ok: true, data: result.data[0] };\n      },\n\n      listRuns: async (options?: {\n        limit?: number;\n      }): Promise<ExecutionResult<jobsTypes.BaseRun[]>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.listRuns(\n              client,\n              { job_id: jobId, limit: options?.limit },\n              signal,\n            ),\n          self._readSettings([\n            \"jobs:listRuns\",\n            jobKey,\n            options?.limit ?? \"default\",\n          ]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      getRun: async (\n        runId: number,\n      ): Promise<ExecutionResult<jobsTypes.Run>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getRun(client, { run_id: runId }, signal),\n          self._readSettings([\"jobs:getRun\", jobKey, runId]),\n          userKey,\n        );\n        if (!result.ok) return errorResult(result.status);\n        if (result.data.job_id !== jobId) return errorResult(404);\n        return result;\n      },\n\n      getRunOutput: async (\n        runId: number,\n      ): Promise<ExecutionResult<jobsTypes.RunOutput>> => {\n        const scopeError = await verifyRunScope(runId);\n        if (scopeError) return scopeError;\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getRunOutput(client, { run_id: runId }, signal),\n          self._readSettings([\"jobs:getRunOutput\", jobKey, runId]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      cancelRun: async (runId: number): Promise<ExecutionResult<void>> => {\n        const scopeError = await verifyRunScope(runId);\n        if (scopeError) return scopeError;\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.cancelRun(client, { run_id: runId }, signal),\n          self._writeSettings(),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      getJob: async (): Promise<ExecutionResult<jobsTypes.Job>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getJob(client, { job_id: jobId }, signal),\n          self._readSettings([\"jobs:getJob\", jobKey]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n    };\n  }\n\n  /**\n   * Resolve `:jobKey` from the request. Returns the key and ID,\n   * or sends a 404 and returns `{ jobKey: undefined, jobId: undefined }`.\n   */\n  private _resolveJob(\n    req: express.Request,\n    res: express.Response,\n  ):\n    | { jobKey: string; jobId: number }\n    | { jobKey: undefined; jobId: undefined } {\n    const jobKey = req.params.jobKey;\n    if (!this.jobKeys.includes(jobKey)) {\n      const safeKey = jobKey.replace(/[^a-zA-Z0-9_-]/g, \"\");\n      res.status(404).json({\n        error: `Unknown job \"${safeKey}\"`,\n        plugin: this.name,\n      });\n      return { jobKey: undefined, jobId: undefined };\n    }\n    const jobId = this.jobIds[jobKey];\n    if (!jobId) {\n      res.status(404).json({\n        error: `Job \"${jobKey}\" has no configured job ID`,\n        plugin: this.name,\n      });\n      return { jobKey: undefined, jobId: undefined };\n    }\n    return { jobKey, jobId };\n  }\n\n  private _sendStatusError(res: express.Response, status: number): void {\n    res.status(status).json({\n      error: STATUS_CODES[status] ?? \"Unknown Error\",\n      plugin: this.name,\n    });\n  }\n\n  /**\n   * Validate params from an HTTP request body. Eager validation lets streaming\n   * requests get a clean 400 instead of a generic SSE error event. Throws\n   * ValidationError so handlers can map to a 400 response via their catch block.\n   */\n  private _parseRunParams(\n    jobKey: string,\n    rawParams: unknown,\n  ): Record<string, unknown> | undefined {\n    if (\n      rawParams !== undefined &&\n      (typeof rawParams !== \"object\" ||\n        rawParams === null ||\n        Array.isArray(rawParams))\n    ) {\n      throw new ValidationError(\"params must be a plain object\");\n    }\n\n    const jobConfig = this.jobConfigs[jobKey];\n    if (jobConfig?.params) {\n      const result = jobConfig.params.safeParse(rawParams ?? {});\n      if (!result.success) {\n        throw new ValidationError(\"Invalid job parameters\");\n      }\n      // Pass rawParams — not result.data — to avoid double-transforming\n      // when _validateAndMap calls safeParse again downstream.\n      return rawParams as Record<string, unknown>;\n    }\n    // No schema. Either reject (no taskType) or enforce a key cap so that\n    // untrusted clients can't spread arbitrarily many fields into the SDK.\n    if (rawParams !== undefined) {\n      if (!jobConfig?.taskType) {\n        throw new ValidationError(\"This job does not accept parameters\");\n      }\n      const keyCount = Object.keys(rawParams as Record<string, unknown>).length;\n      if (keyCount > MAX_UNVALIDATED_PARAM_KEYS) {\n        throw new ValidationError(\n          `Too many parameters (${keyCount}). Define a Zod schema to accept more than ${MAX_UNVALIDATED_PARAM_KEYS}.`,\n        );\n      }\n    }\n    return rawParams as Record<string, unknown> | undefined;\n  }\n\n  private async _handleRun(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { jobKey } = this._resolveJob(req, res);\n    if (!jobKey) return;\n\n    const stream = req.query.stream === \"true\";\n\n    try {\n      const params = this._parseRunParams(jobKey, req.body?.params);\n      const api = this.createJobAPI(jobKey);\n\n      if (stream) {\n        const streamSettings: StreamExecutionSettings = {\n          default: JOBS_STREAM_DEFAULTS,\n        };\n        await this.executeStream<JobRunStatus>(\n          res,\n          (signal) => api.runAndWait(params, signal),\n          streamSettings,\n        );\n      } else {\n        const result = await api.runNow(params);\n        if (!result.ok) {\n          this._sendStatusError(res, result.status);\n          return;\n        }\n        res.json({ runId: result.data.run_id });\n      }\n    } catch (error) {\n      if (error instanceof ValidationError) {\n        if (!res.headersSent) {\n          res.status(400).json({ error: error.message, plugin: this.name });\n        }\n        return;\n      }\n      logger.error(\"Run failed for job %s: %O\", jobKey, error);\n      if (!res.headersSent) {\n        res.status(500).json({ error: \"Run failed\", plugin: this.name });\n      }\n    }\n  }\n\n  injectRoutes(router: IAppRouter) {\n    this.route(router, {\n      name: \"run\",\n      method: \"post\",\n      path: \"/:jobKey/run\",\n      handler: (req, res) => this._handleRun(req, res),\n    });\n\n    // GET /:jobKey/runs\n    this.route(router, {\n      name: \"runs\",\n      method: \"get\",\n      path: \"/:jobKey/runs\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const limit = Math.max(\n          1,\n          Math.min(Number.parseInt(req.query.limit as string, 10) || 20, 100),\n        );\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.listRuns({ limit });\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json({ runs: result.data });\n        } catch (error) {\n          logger.error(\"List runs failed for job %s: %O\", jobKey, error);\n          res\n            .status(500)\n            .json({ error: \"List runs failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // GET /:jobKey/runs/:runId\n    this.route(router, {\n      name: \"run-detail\",\n      method: \"get\",\n      path: \"/:jobKey/runs/:runId\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const runId = Number.parseInt(req.params.runId, 10);\n        if (Number.isNaN(runId) || runId <= 0) {\n          res.status(400).json({ error: \"Invalid runId\", plugin: this.name });\n          return;\n        }\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.getRun(runId);\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json(result.data);\n        } catch (error) {\n          logger.error(\n            \"Get run failed for job %s run %d: %O\",\n            jobKey,\n            runId,\n            error,\n          );\n          res.status(500).json({ error: \"Get run failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // GET /:jobKey/status\n    this.route(router, {\n      name: \"status\",\n      method: \"get\",\n      path: \"/:jobKey/status\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.lastRun();\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json({\n            status: result.data?.state?.life_cycle_state ?? null,\n            run: result.data ?? null,\n          });\n        } catch (error) {\n          logger.error(\"Status check failed for job %s: %O\", jobKey, error);\n          res\n            .status(500)\n            .json({ error: \"Status check failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // DELETE /:jobKey/runs/:runId\n    this.route(router, {\n      name: \"cancel-run\",\n      method: \"delete\",\n      path: \"/:jobKey/runs/:runId\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const runId = Number.parseInt(req.params.runId, 10);\n        if (Number.isNaN(runId) || runId <= 0) {\n          res.status(400).json({ error: \"Invalid runId\", plugin: this.name });\n          return;\n        }\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.cancelRun(runId);\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.status(204).end();\n        } catch (error) {\n          logger.error(\n            \"Cancel run failed for job %s run %d: %O\",\n            jobKey,\n            runId,\n            error,\n          );\n          res\n            .status(500)\n            .json({ error: \"Cancel run failed\", plugin: this.name });\n        }\n      },\n    });\n  }\n\n  exports(): JobsExport {\n    const resolveJob = (jobKey: string): JobAPI => {\n      if (!this.jobKeys.includes(jobKey)) {\n        throw new Error(\n          `Unknown job \"${jobKey}\". Available jobs: ${this.jobKeys.join(\", \")}`,\n        );\n      }\n\n      return this.createJobAPI(jobKey);\n    };\n\n    return resolveJob as JobsExport;\n  }\n\n  clientConfig(): Record<string, unknown> {\n    const jobs: Record<string, { params: unknown; taskType: string | null }> =\n      {};\n    for (const key of this.jobKeys) {\n      const config = this.jobConfigs[key];\n      jobs[key] = {\n        params: config?.params ? toJSONSchema(config.params) : null,\n        taskType: config?.taskType ?? null,\n      };\n    }\n    return { jobs };\n  }\n}\n\n/**\n * @internal\n */\nexport const jobs = toPlugin(JobsPlugin);\n\n/**\n * @internal\n */\nexport { JobsPlugin };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;;AAE9B,MAAM,6BAA6B;;AAGnC,SAAS,YAAY,QAAwC;AAC3D,QAAO;EACL,IAAI;EACJ;EACA,SAAS,aAAa,WAAW;EAClC;;AAGH,SAAS,mBAAmB,OAAoC;AAC9D,QACE,UAAU,gBAAgB,UAAU,aAAa,UAAU;;;AAK/D,SAAS,cACP,SACA,KACiC;CACjC,MAAM,SAAS,KAAK,KAAK,QAAQ,GAAG,KAAM;AAC1C,QAAO;EACL,OAAO,KAAK,IAAI,UAAU,QAAQ,IAAI;EACtC,MAAM,KAAK,IAAI,UAAU,KAAK,IAAI;EACnC;;AAGH,SAAS,eAAe,IAAY,QAAqC;AACvE,QAAO,IAAI,SAAe,YAAY;AACpC,MAAI,QAAQ,SAAS;AACnB,YAAS;AACT;;EAEF,MAAM,QAAQ,WAAW,SAAS,GAAG;AACrC,UAAQ,iBACN,eACM;AACJ,gBAAa,MAAM;AACnB,YAAS;KAEX,EAAE,MAAM,MAAM,CACf;GACD;;AAGJ,IAAM,aAAN,MAAM,mBAAmB,OAAO;CAC9B,OAAO,WAAW,eAAuBA,iBAAS;CAGlD,AAAQ;CACR,AAAQ,SAAiC,EAAE;CAC3C,AAAQ,aAAwC,EAAE;CAClD,AAAQ,UAAoB,EAAE;;;;;CAM9B,OAAO,aAAa,QAAgD;EAClE,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,aAAwC,EAAE;EAEhD,MAAM,SAAS;AACf,OAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI,EAAE;AAC1C,OAAI,CAAC,IAAI,WAAW,OAAO,CAAE;AAC7B,OAAI,QAAQ,oBAAqB;GACjC,MAAM,SAAS,IAAI,MAAM,GAAc;AACvC,OAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAM;GAClC,MAAM,SAAS,OAAO,aAAa;AACnC,OAAI,EAAE,UAAU,UACd,YAAW,UAAU,EAAE;;AAK3B,MACE,QAAQ,IAAI,qBACZ,OAAO,KAAK,SAAS,CAAC,WAAW,KACjC,OAAO,KAAK,WAAW,CAAC,WAAW,EAEnC,YAAW,UAAU,EAAE;AAGzB,SAAO;GAAE,GAAG;GAAY,GAAG;GAAU;;;;;;CAOvC,OAAO,wBAAwB,QAA4C;EACzE,MAAM,OAAO,WAAW,aAAa,OAAO;AAC5C,SAAO,OAAO,KAAK,KAAK,CAAC,KAAK,SAAS;GACrC,MAAM,aAAa;GACnB,OAAO,OAAO;GACd,aAAa,OAAO;GACpB,aAAa,mBAAmB,IAAI;GACpC,YAAY;GACZ,QAAQ,EACN,IAAI;IACF,KACE,QAAQ,YACJ,sBACA,kBAAkB,IAAI,aAAa;IACzC,aAAa,eAAe,IAAI;IACjC,EACF;GACD,UAAU;GACX,EAAE;;CAGL,YAAY,QAAqB;AAC/B,QAAM,OAAO;AACb,OAAK,SAAS;AACd,OAAK,YAAY,IAAI,cAAc,EACjC,WAAW,OAAO,WACnB,CAAC;EAEF,MAAM,OAAO,WAAW,aAAa,OAAO;AAC5C,OAAK,UAAU,OAAO,KAAK,KAAK;AAChC,OAAK,aAAa;AAElB,OAAK,MAAM,OAAO,KAAK,SAAS;GAC9B,MAAM,SACJ,QAAQ,YACJ,sBACA,kBAAkB,IAAI,aAAa;GACzC,MAAM,WAAW,QAAQ,IAAI;AAC7B,OAAI,UAAU;IACZ,MAAM,SAAS,OAAO,SAAS,UAAU,GAAG;AAC5C,QAAI,CAAC,OAAO,MAAM,OAAO,CACvB,MAAK,OAAO,OAAO;;;;CAM3B,MAAM,QAAQ;AACZ,SAAO,KACL,gCAAgC,KAAK,QAAQ,OAAO,WAAW,KAAK,QAAQ,KAAK,KAAK,GACvF;;CAGH,IAAY,SAAS;AACnB,SAAO,oBAAoB;;CAG7B,AAAQ,SAAS,QAAwB;EACvC,MAAM,KAAK,KAAK,OAAO;AACvB,MAAI,CAAC,IAAI;GACP,MAAM,SACJ,WAAW,YACP,sBACA,kBAAkB,OAAO,aAAa;AAC5C,SAAM,IAAI,MACR,QAAQ,OAAO,kCAAkC,OAAO,WACzD;;AAEH,SAAO;;CAGT,AAAQ,cACN,UACyB;AACzB,SAAO,EACL,SAAS;GACP,GAAG;GACH,GAAI,KAAK,OAAO,WAAW,QAAQ,EAAE,SAAS,KAAK,OAAO,SAAS;GACnE,OAAO;IAAE,GAAG,mBAAmB;IAAO;IAAU;GACjD,EACF;;CAGH,AAAQ,iBAA0C;AAChD,SAAO,EACL,SAAS;GACP,GAAG;GACH,GAAI,KAAK,OAAO,WAAW,QAAQ,EAAE,SAAS,KAAK,OAAO,SAAS;GACpE,EACF;;;;;;CAOH,AAAQ,gBACN,QACA,QACyB;EACzB,MAAM,YAAY,KAAK,WAAW;EAClC,IAAI,YAAY;AAEhB,MAAI,WAAW,QAAQ;GACrB,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,EAAE,CAAC;AACvD,OAAI,CAAC,OAAO,QACV,OAAM,IAAI,gBACR,wCAAwC,OAAO,KAAK,OAAO,MAAM,UAClE;AAEH,eAAY,OAAO;;AAGrB,SAAO,WAAW,YAAY,YAC1B,UAAU,UAAU,UAAU,UAAU,GACvC,aAAa,EAAE;;;;;;CAOtB,AAAU,aAAa,QAAwB;EAC7C,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,YAAY,KAAK,WAAW;EAElC,MAAM,OAAO;EAEb,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU,kBAAkB;;;;;;EAOlC,MAAM,iBAAiB,OACrB,UAC2C;GAC3C,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc;IAAC;IAAe;IAAQ;IAAM,CAAC,EAClD,QACD;AACD,OAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,OAAI,OAAO,KAAK,WAAW,MAAO,QAAO,YAAY,IAAI;AACzD,UAAO;;AAGT,SAAO;GACL,QAAQ,OACN,WACuD;IACvD,MAAM,YAAY,KAAK,gBAAgB,QAAQ,OAAO;IAEtD,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OACb,QACA;KAAE,GAAG;KAAW,QAAQ;KAAO,EAC/B,OACD,EACH,KAAK,gBAAgB,EACrB,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,OAAO,WACL,QACA,QAC6C;IAC7C,MAAM,YAAY,KAAK,gBAAgB,QAAQ,OAAO;IAEtD,MAAM,YAAY,MAAM,KAAK,QAC3B,OAAO,WACL,KAAK,UAAU,OACb,QACA;KAAE,GAAG;KAAW,QAAQ;KAAO,EAC/B,OACD,EACH,KAAK,gBAAgB,EACrB,QACD;AAED,QAAI,CAAC,UAAU,GACb,OAAM,IAAI,eAAe,4BAA4B;IAEvD,MAAM,QAAQ,UAAU,KAAK;AAC7B,QAAI,CAAC,MACH,OAAM,IAAI,MAAM,iCAAiC;IAGnD,MAAM,mBACJ,KAAK,OAAO,kBAAkB;IAChC,MAAM,kBAAkB,mBAAmB;IAC3C,MAAM,UAAU,WAAW,eAAe;IAC1C,MAAM,YAAY,KAAK,KAAK;IAC5B,IAAI,kBAAkB;AAEtB,WAAO,CAAC,QAAQ,SAAS;AACvB,SAAI,KAAK,KAAK,GAAG,YAAY,QAC3B,OAAM,IAAI,MACR,WAAW,MAAM,yBAAyB,QAAQ,IACnD;KAGH,MAAM,kBAAkB,MAAM,KAAK,QACjC,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,EACE,SAAS;MACP,GAAG;MACH,OAAO,EAAE,SAAS,OAAO;MAC1B,EACF,EACD,QACD;AACD,SAAI,CAAC,gBAAgB,GACnB,OAAM,IAAI,eACR,qCAAqC,QACtC;KAEH,MAAM,MAAM,gBAAgB;KAC5B,MAAM,QAAQ,IAAI,OAAO;AAEzB,WAAM;MAAE,QAAQ;MAAO,WAAW,KAAK,KAAK;MAAE;MAAK;AAEnD,SAAI,mBAAmB,MAAM,CAAE;KAE/B,MAAM,EAAE,OAAO,SAAS,cACtB,iBACA,gBACD;AACD,uBAAkB;AAClB,WAAM,eAAe,OAAO,OAAO;;;GAIvC,SAAS,YAEJ;IACH,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,SACb,QACA;KAAE,QAAQ;KAAO,OAAO;KAAG,EAC3B,OACD,EACH,KAAK,cAAc,CAAC,gBAAgB,OAAO,CAAC,EAC5C,QACD;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,WAAO;KAAE,IAAI;KAAM,MAAM,OAAO,KAAK;KAAI;;GAG3C,UAAU,OAAO,YAEoC;IACnD,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,SACb,QACA;KAAE,QAAQ;KAAO,OAAO,SAAS;KAAO,EACxC,OACD,EACH,KAAK,cAAc;KACjB;KACA;KACA,SAAS,SAAS;KACnB,CAAC,EACF,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,QAAQ,OACN,UAC4C;IAC5C,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc;KAAC;KAAe;KAAQ;KAAM,CAAC,EAClD,QACD;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,QAAI,OAAO,KAAK,WAAW,MAAO,QAAO,YAAY,IAAI;AACzD,WAAO;;GAGT,cAAc,OACZ,UACkD;IAClD,MAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,QAAI,WAAY,QAAO;IACvB,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,aAAa,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAChE,KAAK,cAAc;KAAC;KAAqB;KAAQ;KAAM,CAAC,EACxD,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,WAAW,OAAO,UAAkD;IAClE,MAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,QAAI,WAAY,QAAO;IACvB,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,UAAU,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC7D,KAAK,gBAAgB,EACrB,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,QAAQ,YAAqD;IAC3D,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc,CAAC,eAAe,OAAO,CAAC,EAC3C,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAEzD;;;;;;CAOH,AAAQ,YACN,KACA,KAG0C;EAC1C,MAAM,SAAS,IAAI,OAAO;AAC1B,MAAI,CAAC,KAAK,QAAQ,SAAS,OAAO,EAAE;GAClC,MAAM,UAAU,OAAO,QAAQ,mBAAmB,GAAG;AACrD,OAAI,OAAO,IAAI,CAAC,KAAK;IACnB,OAAO,gBAAgB,QAAQ;IAC/B,QAAQ,KAAK;IACd,CAAC;AACF,UAAO;IAAE,QAAQ;IAAW,OAAO;IAAW;;EAEhD,MAAM,QAAQ,KAAK,OAAO;AAC1B,MAAI,CAAC,OAAO;AACV,OAAI,OAAO,IAAI,CAAC,KAAK;IACnB,OAAO,QAAQ,OAAO;IACtB,QAAQ,KAAK;IACd,CAAC;AACF,UAAO;IAAE,QAAQ;IAAW,OAAO;IAAW;;AAEhD,SAAO;GAAE;GAAQ;GAAO;;CAG1B,AAAQ,iBAAiB,KAAuB,QAAsB;AACpE,MAAI,OAAO,OAAO,CAAC,KAAK;GACtB,OAAO,aAAa,WAAW;GAC/B,QAAQ,KAAK;GACd,CAAC;;;;;;;CAQJ,AAAQ,gBACN,QACA,WACqC;AACrC,MACE,cAAc,WACb,OAAO,cAAc,YACpB,cAAc,QACd,MAAM,QAAQ,UAAU,EAE1B,OAAM,IAAI,gBAAgB,gCAAgC;EAG5D,MAAM,YAAY,KAAK,WAAW;AAClC,MAAI,WAAW,QAAQ;AAErB,OAAI,CADW,UAAU,OAAO,UAAU,aAAa,EAAE,CAAC,CAC9C,QACV,OAAM,IAAI,gBAAgB,yBAAyB;AAIrD,UAAO;;AAIT,MAAI,cAAc,QAAW;AAC3B,OAAI,CAAC,WAAW,SACd,OAAM,IAAI,gBAAgB,sCAAsC;GAElE,MAAM,WAAW,OAAO,KAAK,UAAqC,CAAC;AACnE,OAAI,WAAW,2BACb,OAAM,IAAI,gBACR,wBAAwB,SAAS,6CAA6C,2BAA2B,GAC1G;;AAGL,SAAO;;CAGT,MAAc,WACZ,KACA,KACe;EACf,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,MAAI,CAAC,OAAQ;EAEb,MAAM,SAAS,IAAI,MAAM,WAAW;AAEpC,MAAI;GACF,MAAM,SAAS,KAAK,gBAAgB,QAAQ,IAAI,MAAM,OAAO;GAC7D,MAAM,MAAM,KAAK,aAAa,OAAO;AAErC,OAAI,QAAQ;IACV,MAAM,iBAA0C,EAC9C,SAAS,sBACV;AACD,UAAM,KAAK,cACT,MACC,WAAW,IAAI,WAAW,QAAQ,OAAO,EAC1C,eACD;UACI;IACL,MAAM,SAAS,MAAM,IAAI,OAAO,OAAO;AACvC,QAAI,CAAC,OAAO,IAAI;AACd,UAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,QAAI,KAAK,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC;;WAElC,OAAO;AACd,OAAI,iBAAiB,iBAAiB;AACpC,QAAI,CAAC,IAAI,YACP,KAAI,OAAO,IAAI,CAAC,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,KAAK;KAAM,CAAC;AAEnE;;AAEF,UAAO,MAAM,6BAA6B,QAAQ,MAAM;AACxD,OAAI,CAAC,IAAI,YACP,KAAI,OAAO,IAAI,CAAC,KAAK;IAAE,OAAO;IAAc,QAAQ,KAAK;IAAM,CAAC;;;CAKtE,aAAa,QAAoB;AAC/B,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,UAAU,KAAK,QAAQ,KAAK,WAAW,KAAK,IAAI;GACjD,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,KAAK,IACjB,GACA,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,OAAiB,GAAG,IAAI,IAAI,IAAI,CACpE;AAED,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,SAAS,EAAE,OAAO,CAAC;AAC5C,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC;aACxB,OAAO;AACd,YAAO,MAAM,mCAAmC,QAAQ,MAAM;AAC9D,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAoB,QAAQ,KAAK;MAAM,CAAC;;;GAG9D,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,OAAO,GAAG;AACnD,QAAI,OAAO,MAAM,MAAM,IAAI,SAAS,GAAG;AACrC,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAiB,QAAQ,KAAK;MAAM,CAAC;AACnE;;AAGF,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,OAAO,MAAM;AACtC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK,OAAO,KAAK;aACd,OAAO;AACd,YAAO,MACL,wCACA,QACA,OACA,MACD;AACD,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAkB,QAAQ,KAAK;MAAM,CAAC;;;GAGzE,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;AAEb,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,SAAS;AAClC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK;MACP,QAAQ,OAAO,MAAM,OAAO,oBAAoB;MAChD,KAAK,OAAO,QAAQ;MACrB,CAAC;aACK,OAAO;AACd,YAAO,MAAM,sCAAsC,QAAQ,MAAM;AACjE,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAuB,QAAQ,KAAK;MAAM,CAAC;;;GAGjE,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,OAAO,GAAG;AACnD,QAAI,OAAO,MAAM,MAAM,IAAI,SAAS,GAAG;AACrC,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAiB,QAAQ,KAAK;MAAM,CAAC;AACnE;;AAGF,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,UAAU,MAAM;AACzC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,OAAO,IAAI,CAAC,KAAK;aACd,OAAO;AACd,YAAO,MACL,2CACA,QACA,OACA,MACD;AACD,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAqB,QAAQ,KAAK;MAAM,CAAC;;;GAG/D,CAAC;;CAGJ,UAAsB;EACpB,MAAM,cAAc,WAA2B;AAC7C,OAAI,CAAC,KAAK,QAAQ,SAAS,OAAO,CAChC,OAAM,IAAI,MACR,gBAAgB,OAAO,qBAAqB,KAAK,QAAQ,KAAK,KAAK,GACpE;AAGH,UAAO,KAAK,aAAa,OAAO;;AAGlC,SAAO;;CAGT,eAAwC;EACtC,MAAM,OACJ,EAAE;AACJ,OAAK,MAAM,OAAO,KAAK,SAAS;GAC9B,MAAM,SAAS,KAAK,WAAW;AAC/B,QAAK,OAAO;IACV,QAAQ,QAAQ,SAAS,aAAa,OAAO,OAAO,GAAG;IACvD,UAAU,QAAQ,YAAY;IAC/B;;AAEH,SAAO,EAAE,MAAM;;;;;;AAOnB,MAAa,OAAO,SAAS,WAAW"}
+{"version":3,"file":"plugin.js","names":["manifest"],"sources":["../../../src/plugins/jobs/plugin.ts"],"sourcesContent":["import { STATUS_CODES } from \"node:http\";\n\nimport type express from \"express\";\nimport type {\n  IAppRouter,\n  PluginExecutionSettings,\n  StreamExecutionSettings,\n} from \"shared\";\nimport { toJSONSchema } from \"zod\";\n\nimport { JobsConnector } from \"../../connectors/jobs\";\nimport { getCurrentPrincipalId, getWorkspaceClient } from \"../../context\";\nimport { ExecutionError, ValidationError } from \"../../errors\";\nimport { createLogger } from \"../../logging/logger\";\nimport type { ExecutionResult } from \"../../plugin\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { ResourceRequirement } from \"../../registry\";\nimport { defineManifest, ResourceType } from \"../../registry\";\nimport type { jobs as jobsTypes } from \"../../workspace-client\";\nimport {\n  JOBS_READ_DEFAULTS,\n  JOBS_STREAM_DEFAULTS,\n  JOBS_WRITE_DEFAULTS,\n} from \"./defaults\";\nimport manifest from \"./manifest.json\";\nimport { mapParams } from \"./params\";\nimport type {\n  IJobsConfig,\n  JobAPI,\n  JobConfig,\n  JobRunStatus,\n  JobsExport,\n} from \"./types\";\n\nconst logger = createLogger(\"jobs\");\n\nconst DEFAULT_WAIT_TIMEOUT = 600_000;\nconst DEFAULT_POLL_INTERVAL = 5_000;\n/** Cap on param-key count when a job has no Zod schema. Jobs that need more keys must define a schema. */\nconst MAX_UNVALIDATED_PARAM_KEYS = 50;\n\n/** Replace upstream error messages with generic descriptions keyed by HTTP status. */\nfunction errorResult(status: number): ExecutionResult<never> {\n  return {\n    ok: false,\n    status,\n    message: STATUS_CODES[status] ?? \"Request failed\",\n  };\n}\n\nfunction isTerminalRunState(state: string | undefined): boolean {\n  return (\n    state === \"TERMINATED\" || state === \"SKIPPED\" || state === \"INTERNAL_ERROR\"\n  );\n}\n\n/** Exponential backoff (1.5x) with +/- 20% jitter, capped at `max`. */\nfunction nextPollDelay(\n  current: number,\n  max: number,\n): { delay: number; next: number } {\n  const jitter = 1 + (Math.random() * 0.4 - 0.2);\n  return {\n    delay: Math.min(current * jitter, max),\n    next: Math.min(current * 1.5, max),\n  };\n}\n\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve) => {\n    if (signal?.aborted) {\n      resolve();\n      return;\n    }\n    const timer = setTimeout(resolve, ms);\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timer);\n        resolve();\n      },\n      { once: true },\n    );\n  });\n}\n\nclass JobsPlugin extends Plugin {\n  static manifest = defineManifest<\"jobs\">(manifest);\n\n  declare protected config: IJobsConfig;\n  private connector: JobsConnector;\n  private jobIds: Record<string, number> = {};\n  private jobConfigs: Record<string, JobConfig> = {};\n  private jobKeys: string[] = [];\n\n  /**\n   * Scans process.env for DATABRICKS_JOB_* keys and merges with explicit config.\n   * Explicit config wins for per-job overrides; auto-discovered jobs get default `{}` config.\n   */\n  static discoverJobs(config: IJobsConfig): Record<string, JobConfig> {\n    const explicit = config.jobs ?? {};\n    const discovered: Record<string, JobConfig> = {};\n\n    const prefix = \"DATABRICKS_JOB_\";\n    for (const key of Object.keys(process.env)) {\n      if (!key.startsWith(prefix)) continue;\n      if (key === \"DATABRICKS_JOB_ID\") continue;\n      const suffix = key.slice(prefix.length);\n      if (!suffix || !process.env[key]) continue;\n      const jobKey = suffix.toLowerCase();\n      if (!(jobKey in explicit)) {\n        discovered[jobKey] = {};\n      }\n    }\n\n    // Single-job shorthand: DATABRICKS_JOB_ID maps to \"default\" key\n    if (\n      process.env.DATABRICKS_JOB_ID &&\n      Object.keys(explicit).length === 0 &&\n      Object.keys(discovered).length === 0\n    ) {\n      discovered.default = {};\n    }\n\n    return { ...discovered, ...explicit };\n  }\n\n  /**\n   * Generates resource requirements dynamically from discovered + configured jobs.\n   * Each job key maps to a `DATABRICKS_JOB_{KEY_UPPERCASE}` env var (or `DATABRICKS_JOB_ID` for \"default\").\n   */\n  static getResourceRequirements(config: IJobsConfig): ResourceRequirement[] {\n    const jobs = JobsPlugin.discoverJobs(config);\n    return Object.keys(jobs).map((key) => ({\n      type: ResourceType.JOB,\n      alias: `job-${key}`,\n      resourceKey: `job-${key}`,\n      description: `Databricks Job \"${key}\"`,\n      permission: \"CAN_MANAGE_RUN\" as const,\n      fields: {\n        id: {\n          env:\n            key === \"default\"\n              ? \"DATABRICKS_JOB_ID\"\n              : `DATABRICKS_JOB_${key.toUpperCase()}`,\n          description: `Job ID for \"${key}\"`,\n        },\n      },\n      required: true,\n    }));\n  }\n\n  constructor(config: IJobsConfig) {\n    super(config);\n    this.config = config;\n    this.connector = new JobsConnector({\n      telemetry: config.telemetry,\n    });\n\n    const jobs = JobsPlugin.discoverJobs(config);\n    this.jobKeys = Object.keys(jobs);\n    this.jobConfigs = jobs;\n\n    for (const key of this.jobKeys) {\n      const envVar =\n        key === \"default\"\n          ? \"DATABRICKS_JOB_ID\"\n          : `DATABRICKS_JOB_${key.toUpperCase()}`;\n      const jobIdStr = process.env[envVar];\n      if (jobIdStr) {\n        const parsed = Number.parseInt(jobIdStr, 10);\n        if (!Number.isNaN(parsed)) {\n          this.jobIds[key] = parsed;\n        }\n      }\n    }\n  }\n\n  async setup() {\n    logger.info(\n      `Jobs plugin initialized with ${this.jobKeys.length} job(s): ${this.jobKeys.join(\", \")}`,\n    );\n  }\n\n  private get client() {\n    return getWorkspaceClient();\n  }\n\n  private getJobId(jobKey: string): number {\n    const id = this.jobIds[jobKey];\n    if (!id) {\n      const envVar =\n        jobKey === \"default\"\n          ? \"DATABRICKS_JOB_ID\"\n          : `DATABRICKS_JOB_${jobKey.toUpperCase()}`;\n      throw new Error(\n        `Job \"${jobKey}\" has no configured job ID. Set ${envVar} env var.`,\n      );\n    }\n    return id;\n  }\n\n  private _readSettings(\n    cacheKey: (string | number | object)[],\n  ): PluginExecutionSettings {\n    return {\n      default: {\n        ...JOBS_READ_DEFAULTS,\n        ...(this.config.timeout != null && { timeout: this.config.timeout }),\n        cache: { ...JOBS_READ_DEFAULTS.cache, cacheKey },\n      },\n    };\n  }\n\n  private _writeSettings(): PluginExecutionSettings {\n    return {\n      default: {\n        ...JOBS_WRITE_DEFAULTS,\n        ...(this.config.timeout != null && { timeout: this.config.timeout }),\n      },\n    };\n  }\n\n  /**\n   * Validates params against the job's Zod schema (if any) and maps them\n   * to SDK request fields based on the task type. Shared by runNow and runAndWait.\n   */\n  private _validateAndMap(\n    jobKey: string,\n    params?: Record<string, unknown>,\n  ): Record<string, unknown> {\n    const jobConfig = this.jobConfigs[jobKey];\n    let validated = params;\n\n    if (jobConfig?.params) {\n      const result = jobConfig.params.safeParse(params ?? {});\n      if (!result.success) {\n        throw new ValidationError(\n          `Parameter validation failed for job \"${jobKey}\": ${result.error.message}`,\n        );\n      }\n      validated = result.data as Record<string, unknown>;\n    }\n\n    return jobConfig?.taskType && validated\n      ? mapParams(jobConfig.taskType, validated)\n      : (validated ?? {});\n  }\n\n  /**\n   * Creates a JobAPI for a specific configured job key.\n   * Each method is scoped to the job's configured ID.\n   */\n  protected createJobAPI(jobKey: string): JobAPI {\n    const jobId = this.getJobId(jobKey);\n    const jobConfig = this.jobConfigs[jobKey];\n    // Capture `this` for use in the async generator\n    const self = this;\n    // Capture client and userId eagerly: the closures below run later, after the ALS context may have exited.\n    const client = this.client;\n    const userKey = getCurrentPrincipalId();\n\n    /**\n     * Verify that `runId` belongs to this job's configured `jobId`. Returns\n     * null if the run is in scope; otherwise returns a 404 `ExecutionResult`.\n     * Prevents cross-job access via the `/:jobKey/runs/:runId` HTTP surface.\n     */\n    const verifyRunScope = async (\n      runId: number,\n    ): Promise<ExecutionResult<never> | null> => {\n      const result = await self.execute(\n        async (signal) =>\n          self.connector.getRun(client, { run_id: runId }, signal),\n        self._readSettings([\"jobs:getRun\", jobKey, runId]),\n        userKey,\n      );\n      if (!result.ok) return errorResult(result.status);\n      if (result.data.job_id !== jobId) return errorResult(404);\n      return null;\n    };\n\n    return {\n      runNow: async (\n        params?: Record<string, unknown>,\n      ): Promise<ExecutionResult<jobsTypes.RunNowResponse>> => {\n        const sdkFields = self._validateAndMap(jobKey, params);\n\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.runNow(\n              client,\n              { ...sdkFields, job_id: jobId },\n              signal,\n            ),\n          self._writeSettings(),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      async *runAndWait(\n        params?: Record<string, unknown>,\n        signal?: AbortSignal,\n      ): AsyncGenerator<JobRunStatus, void, unknown> {\n        const sdkFields = self._validateAndMap(jobKey, params);\n\n        const runResult = await self.execute(\n          async (signal) =>\n            self.connector.runNow(\n              client,\n              { ...sdkFields, job_id: jobId },\n              signal,\n            ),\n          self._writeSettings(),\n          userKey,\n        );\n\n        if (!runResult.ok) {\n          throw new ExecutionError(\"Failed to trigger job run\");\n        }\n        const runId = runResult.data.run_id;\n        if (!runId) {\n          throw new Error(\"runNow did not return a run_id\");\n        }\n\n        const basePollInterval =\n          self.config.pollIntervalMs ?? DEFAULT_POLL_INTERVAL;\n        const maxPollInterval = basePollInterval * 6;\n        const timeout = jobConfig?.waitTimeout ?? DEFAULT_WAIT_TIMEOUT;\n        const startTime = Date.now();\n        let currentInterval = basePollInterval;\n\n        while (!signal?.aborted) {\n          if (Date.now() - startTime > timeout) {\n            throw new Error(\n              `Job run ${runId} polling timeout after ${timeout}ms`,\n            );\n          }\n\n          const runStatusResult = await self.execute(\n            async (signal) =>\n              self.connector.getRun(client, { run_id: runId }, signal),\n            {\n              default: {\n                ...JOBS_READ_DEFAULTS,\n                cache: { enabled: false },\n              },\n            },\n            userKey,\n          );\n          if (!runStatusResult.ok) {\n            throw new ExecutionError(\n              `Failed to poll run status for run ${runId}`,\n            );\n          }\n          const run = runStatusResult.data;\n          const state = run.state?.life_cycle_state;\n\n          yield { status: state, timestamp: Date.now(), run };\n\n          if (isTerminalRunState(state)) return;\n\n          const { delay, next } = nextPollDelay(\n            currentInterval,\n            maxPollInterval,\n          );\n          currentInterval = next;\n          await abortableSleep(delay, signal);\n        }\n      },\n\n      lastRun: async (): Promise<\n        ExecutionResult<jobsTypes.BaseRun | undefined>\n      > => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.listRuns(\n              client,\n              { job_id: jobId, limit: 1 },\n              signal,\n            ),\n          self._readSettings([\"jobs:lastRun\", jobKey]),\n          userKey,\n        );\n        if (!result.ok) return errorResult(result.status);\n        return { ok: true, data: result.data[0] };\n      },\n\n      listRuns: async (options?: {\n        limit?: number;\n      }): Promise<ExecutionResult<jobsTypes.BaseRun[]>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.listRuns(\n              client,\n              { job_id: jobId, limit: options?.limit },\n              signal,\n            ),\n          self._readSettings([\n            \"jobs:listRuns\",\n            jobKey,\n            options?.limit ?? \"default\",\n          ]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      getRun: async (\n        runId: number,\n      ): Promise<ExecutionResult<jobsTypes.Run>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getRun(client, { run_id: runId }, signal),\n          self._readSettings([\"jobs:getRun\", jobKey, runId]),\n          userKey,\n        );\n        if (!result.ok) return errorResult(result.status);\n        if (result.data.job_id !== jobId) return errorResult(404);\n        return result;\n      },\n\n      getRunOutput: async (\n        runId: number,\n      ): Promise<ExecutionResult<jobsTypes.RunOutput>> => {\n        const scopeError = await verifyRunScope(runId);\n        if (scopeError) return scopeError;\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getRunOutput(client, { run_id: runId }, signal),\n          self._readSettings([\"jobs:getRunOutput\", jobKey, runId]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      cancelRun: async (runId: number): Promise<ExecutionResult<void>> => {\n        const scopeError = await verifyRunScope(runId);\n        if (scopeError) return scopeError;\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.cancelRun(client, { run_id: runId }, signal),\n          self._writeSettings(),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n\n      getJob: async (): Promise<ExecutionResult<jobsTypes.Job>> => {\n        const result = await self.execute(\n          async (signal) =>\n            self.connector.getJob(client, { job_id: jobId }, signal),\n          self._readSettings([\"jobs:getJob\", jobKey]),\n          userKey,\n        );\n        return result.ok ? result : errorResult(result.status);\n      },\n    };\n  }\n\n  /**\n   * Resolve `:jobKey` from the request. Returns the key and ID,\n   * or sends a 404 and returns `{ jobKey: undefined, jobId: undefined }`.\n   */\n  private _resolveJob(\n    req: express.Request,\n    res: express.Response,\n  ):\n    | { jobKey: string; jobId: number }\n    | { jobKey: undefined; jobId: undefined } {\n    const jobKey = req.params.jobKey;\n    if (!this.jobKeys.includes(jobKey)) {\n      const safeKey = jobKey.replace(/[^a-zA-Z0-9_-]/g, \"\");\n      res.status(404).json({\n        error: `Unknown job \"${safeKey}\"`,\n        plugin: this.name,\n      });\n      return { jobKey: undefined, jobId: undefined };\n    }\n    const jobId = this.jobIds[jobKey];\n    if (!jobId) {\n      res.status(404).json({\n        error: `Job \"${jobKey}\" has no configured job ID`,\n        plugin: this.name,\n      });\n      return { jobKey: undefined, jobId: undefined };\n    }\n    return { jobKey, jobId };\n  }\n\n  private _sendStatusError(res: express.Response, status: number): void {\n    res.status(status).json({\n      error: STATUS_CODES[status] ?? \"Unknown Error\",\n      plugin: this.name,\n    });\n  }\n\n  /**\n   * Validate params from an HTTP request body. Eager validation lets streaming\n   * requests get a clean 400 instead of a generic SSE error event. Throws\n   * ValidationError so handlers can map to a 400 response via their catch block.\n   */\n  private _parseRunParams(\n    jobKey: string,\n    rawParams: unknown,\n  ): Record<string, unknown> | undefined {\n    if (\n      rawParams !== undefined &&\n      (typeof rawParams !== \"object\" ||\n        rawParams === null ||\n        Array.isArray(rawParams))\n    ) {\n      throw new ValidationError(\"params must be a plain object\");\n    }\n\n    const jobConfig = this.jobConfigs[jobKey];\n    if (jobConfig?.params) {\n      const result = jobConfig.params.safeParse(rawParams ?? {});\n      if (!result.success) {\n        throw new ValidationError(\"Invalid job parameters\");\n      }\n      // Pass rawParams — not result.data — to avoid double-transforming\n      // when _validateAndMap calls safeParse again downstream.\n      return rawParams as Record<string, unknown>;\n    }\n    // No schema. Either reject (no taskType) or enforce a key cap so that\n    // untrusted clients can't spread arbitrarily many fields into the SDK.\n    if (rawParams !== undefined) {\n      if (!jobConfig?.taskType) {\n        throw new ValidationError(\"This job does not accept parameters\");\n      }\n      const keyCount = Object.keys(rawParams as Record<string, unknown>).length;\n      if (keyCount > MAX_UNVALIDATED_PARAM_KEYS) {\n        throw new ValidationError(\n          `Too many parameters (${keyCount}). Define a Zod schema to accept more than ${MAX_UNVALIDATED_PARAM_KEYS}.`,\n        );\n      }\n    }\n    return rawParams as Record<string, unknown> | undefined;\n  }\n\n  private async _handleRun(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { jobKey } = this._resolveJob(req, res);\n    if (!jobKey) return;\n\n    const stream = req.query.stream === \"true\";\n\n    try {\n      const params = this._parseRunParams(jobKey, req.body?.params);\n      const api = this.createJobAPI(jobKey);\n\n      if (stream) {\n        const streamSettings: StreamExecutionSettings = {\n          default: JOBS_STREAM_DEFAULTS,\n        };\n        await this.executeStream<JobRunStatus>(\n          res,\n          (signal) => api.runAndWait(params, signal),\n          streamSettings,\n        );\n      } else {\n        const result = await api.runNow(params);\n        if (!result.ok) {\n          this._sendStatusError(res, result.status);\n          return;\n        }\n        res.json({ runId: result.data.run_id });\n      }\n    } catch (error) {\n      if (error instanceof ValidationError) {\n        if (!res.headersSent) {\n          res.status(400).json({ error: error.message, plugin: this.name });\n        }\n        return;\n      }\n      logger.error(\"Run failed for job %s: %O\", jobKey, error);\n      if (!res.headersSent) {\n        res.status(500).json({ error: \"Run failed\", plugin: this.name });\n      }\n    }\n  }\n\n  injectRoutes(router: IAppRouter) {\n    this.route(router, {\n      name: \"run\",\n      method: \"post\",\n      path: \"/:jobKey/run\",\n      handler: (req, res) => this._handleRun(req, res),\n    });\n\n    // GET /:jobKey/runs\n    this.route(router, {\n      name: \"runs\",\n      method: \"get\",\n      path: \"/:jobKey/runs\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const limit = Math.max(\n          1,\n          Math.min(Number.parseInt(req.query.limit as string, 10) || 20, 100),\n        );\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.listRuns({ limit });\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json({ runs: result.data });\n        } catch (error) {\n          logger.error(\"List runs failed for job %s: %O\", jobKey, error);\n          res\n            .status(500)\n            .json({ error: \"List runs failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // GET /:jobKey/runs/:runId\n    this.route(router, {\n      name: \"run-detail\",\n      method: \"get\",\n      path: \"/:jobKey/runs/:runId\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const runId = Number.parseInt(req.params.runId, 10);\n        if (Number.isNaN(runId) || runId <= 0) {\n          res.status(400).json({ error: \"Invalid runId\", plugin: this.name });\n          return;\n        }\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.getRun(runId);\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json(result.data);\n        } catch (error) {\n          logger.error(\n            \"Get run failed for job %s run %d: %O\",\n            jobKey,\n            runId,\n            error,\n          );\n          res.status(500).json({ error: \"Get run failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // GET /:jobKey/status\n    this.route(router, {\n      name: \"status\",\n      method: \"get\",\n      path: \"/:jobKey/status\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.lastRun();\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.json({\n            status: result.data?.state?.life_cycle_state ?? null,\n            run: result.data ?? null,\n          });\n        } catch (error) {\n          logger.error(\"Status check failed for job %s: %O\", jobKey, error);\n          res\n            .status(500)\n            .json({ error: \"Status check failed\", plugin: this.name });\n        }\n      },\n    });\n\n    // DELETE /:jobKey/runs/:runId\n    this.route(router, {\n      name: \"cancel-run\",\n      method: \"delete\",\n      path: \"/:jobKey/runs/:runId\",\n      handler: async (req: express.Request, res: express.Response) => {\n        const { jobKey } = this._resolveJob(req, res);\n        if (!jobKey) return;\n\n        const runId = Number.parseInt(req.params.runId, 10);\n        if (Number.isNaN(runId) || runId <= 0) {\n          res.status(400).json({ error: \"Invalid runId\", plugin: this.name });\n          return;\n        }\n\n        try {\n          const api = this.createJobAPI(jobKey);\n          const result = await api.cancelRun(runId);\n          if (!result.ok) {\n            this._sendStatusError(res, result.status);\n            return;\n          }\n          res.status(204).end();\n        } catch (error) {\n          logger.error(\n            \"Cancel run failed for job %s run %d: %O\",\n            jobKey,\n            runId,\n            error,\n          );\n          res\n            .status(500)\n            .json({ error: \"Cancel run failed\", plugin: this.name });\n        }\n      },\n    });\n  }\n\n  exports(): JobsExport {\n    const resolveJob = (jobKey: string): JobAPI => {\n      if (!this.jobKeys.includes(jobKey)) {\n        throw new Error(\n          `Unknown job \"${jobKey}\". Available jobs: ${this.jobKeys.join(\", \")}`,\n        );\n      }\n\n      return this.createJobAPI(jobKey);\n    };\n\n    return resolveJob as JobsExport;\n  }\n\n  clientConfig(): Record<string, unknown> {\n    const jobs: Record<string, { params: unknown; taskType: string | null }> =\n      {};\n    for (const key of this.jobKeys) {\n      const config = this.jobConfigs[key];\n      jobs[key] = {\n        params: config?.params ? toJSONSchema(config.params) : null,\n        taskType: config?.taskType ?? null,\n      };\n    }\n    return { jobs };\n  }\n}\n\n/**\n * @internal\n */\nexport const jobs = toPlugin(JobsPlugin);\n\n/**\n * @internal\n */\nexport { JobsPlugin };\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkCA,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;;AAE9B,MAAM,6BAA6B;;AAGnC,SAAS,YAAY,QAAwC;AAC3D,QAAO;EACL,IAAI;EACJ;EACA,SAAS,aAAa,WAAW;EAClC;;AAGH,SAAS,mBAAmB,OAAoC;AAC9D,QACE,UAAU,gBAAgB,UAAU,aAAa,UAAU;;;AAK/D,SAAS,cACP,SACA,KACiC;CACjC,MAAM,SAAS,KAAK,KAAK,QAAQ,GAAG,KAAM;AAC1C,QAAO;EACL,OAAO,KAAK,IAAI,UAAU,QAAQ,IAAI;EACtC,MAAM,KAAK,IAAI,UAAU,KAAK,IAAI;EACnC;;AAGH,SAAS,eAAe,IAAY,QAAqC;AACvE,QAAO,IAAI,SAAe,YAAY;AACpC,MAAI,QAAQ,SAAS;AACnB,YAAS;AACT;;EAEF,MAAM,QAAQ,WAAW,SAAS,GAAG;AACrC,UAAQ,iBACN,eACM;AACJ,gBAAa,MAAM;AACnB,YAAS;KAEX,EAAE,MAAM,MAAM,CACf;GACD;;AAGJ,IAAM,aAAN,MAAM,mBAAmB,OAAO;CAC9B,OAAO,WAAW,eAAuBA,iBAAS;CAGlD,AAAQ;CACR,AAAQ,SAAiC,EAAE;CAC3C,AAAQ,aAAwC,EAAE;CAClD,AAAQ,UAAoB,EAAE;;;;;CAM9B,OAAO,aAAa,QAAgD;EAClE,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,aAAwC,EAAE;EAEhD,MAAM,SAAS;AACf,OAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI,EAAE;AAC1C,OAAI,CAAC,IAAI,WAAW,OAAO,CAAE;AAC7B,OAAI,QAAQ,oBAAqB;GACjC,MAAM,SAAS,IAAI,MAAM,GAAc;AACvC,OAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAM;GAClC,MAAM,SAAS,OAAO,aAAa;AACnC,OAAI,EAAE,UAAU,UACd,YAAW,UAAU,EAAE;;AAK3B,MACE,QAAQ,IAAI,qBACZ,OAAO,KAAK,SAAS,CAAC,WAAW,KACjC,OAAO,KAAK,WAAW,CAAC,WAAW,EAEnC,YAAW,UAAU,EAAE;AAGzB,SAAO;GAAE,GAAG;GAAY,GAAG;GAAU;;;;;;CAOvC,OAAO,wBAAwB,QAA4C;EACzE,MAAM,OAAO,WAAW,aAAa,OAAO;AAC5C,SAAO,OAAO,KAAK,KAAK,CAAC,KAAK,SAAS;GACrC,MAAM,aAAa;GACnB,OAAO,OAAO;GACd,aAAa,OAAO;GACpB,aAAa,mBAAmB,IAAI;GACpC,YAAY;GACZ,QAAQ,EACN,IAAI;IACF,KACE,QAAQ,YACJ,sBACA,kBAAkB,IAAI,aAAa;IACzC,aAAa,eAAe,IAAI;IACjC,EACF;GACD,UAAU;GACX,EAAE;;CAGL,YAAY,QAAqB;AAC/B,QAAM,OAAO;AACb,OAAK,SAAS;AACd,OAAK,YAAY,IAAI,cAAc,EACjC,WAAW,OAAO,WACnB,CAAC;EAEF,MAAM,OAAO,WAAW,aAAa,OAAO;AAC5C,OAAK,UAAU,OAAO,KAAK,KAAK;AAChC,OAAK,aAAa;AAElB,OAAK,MAAM,OAAO,KAAK,SAAS;GAC9B,MAAM,SACJ,QAAQ,YACJ,sBACA,kBAAkB,IAAI,aAAa;GACzC,MAAM,WAAW,QAAQ,IAAI;AAC7B,OAAI,UAAU;IACZ,MAAM,SAAS,OAAO,SAAS,UAAU,GAAG;AAC5C,QAAI,CAAC,OAAO,MAAM,OAAO,CACvB,MAAK,OAAO,OAAO;;;;CAM3B,MAAM,QAAQ;AACZ,SAAO,KACL,gCAAgC,KAAK,QAAQ,OAAO,WAAW,KAAK,QAAQ,KAAK,KAAK,GACvF;;CAGH,IAAY,SAAS;AACnB,SAAO,oBAAoB;;CAG7B,AAAQ,SAAS,QAAwB;EACvC,MAAM,KAAK,KAAK,OAAO;AACvB,MAAI,CAAC,IAAI;GACP,MAAM,SACJ,WAAW,YACP,sBACA,kBAAkB,OAAO,aAAa;AAC5C,SAAM,IAAI,MACR,QAAQ,OAAO,kCAAkC,OAAO,WACzD;;AAEH,SAAO;;CAGT,AAAQ,cACN,UACyB;AACzB,SAAO,EACL,SAAS;GACP,GAAG;GACH,GAAI,KAAK,OAAO,WAAW,QAAQ,EAAE,SAAS,KAAK,OAAO,SAAS;GACnE,OAAO;IAAE,GAAG,mBAAmB;IAAO;IAAU;GACjD,EACF;;CAGH,AAAQ,iBAA0C;AAChD,SAAO,EACL,SAAS;GACP,GAAG;GACH,GAAI,KAAK,OAAO,WAAW,QAAQ,EAAE,SAAS,KAAK,OAAO,SAAS;GACpE,EACF;;;;;;CAOH,AAAQ,gBACN,QACA,QACyB;EACzB,MAAM,YAAY,KAAK,WAAW;EAClC,IAAI,YAAY;AAEhB,MAAI,WAAW,QAAQ;GACrB,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,EAAE,CAAC;AACvD,OAAI,CAAC,OAAO,QACV,OAAM,IAAI,gBACR,wCAAwC,OAAO,KAAK,OAAO,MAAM,UAClE;AAEH,eAAY,OAAO;;AAGrB,SAAO,WAAW,YAAY,YAC1B,UAAU,UAAU,UAAU,UAAU,GACvC,aAAa,EAAE;;;;;;CAOtB,AAAU,aAAa,QAAwB;EAC7C,MAAM,QAAQ,KAAK,SAAS,OAAO;EACnC,MAAM,YAAY,KAAK,WAAW;EAElC,MAAM,OAAO;EAEb,MAAM,SAAS,KAAK;EACpB,MAAM,UAAU,uBAAuB;;;;;;EAOvC,MAAM,iBAAiB,OACrB,UAC2C;GAC3C,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc;IAAC;IAAe;IAAQ;IAAM,CAAC,EAClD,QACD;AACD,OAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,OAAI,OAAO,KAAK,WAAW,MAAO,QAAO,YAAY,IAAI;AACzD,UAAO;;AAGT,SAAO;GACL,QAAQ,OACN,WACuD;IACvD,MAAM,YAAY,KAAK,gBAAgB,QAAQ,OAAO;IAEtD,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OACb,QACA;KAAE,GAAG;KAAW,QAAQ;KAAO,EAC/B,OACD,EACH,KAAK,gBAAgB,EACrB,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,OAAO,WACL,QACA,QAC6C;IAC7C,MAAM,YAAY,KAAK,gBAAgB,QAAQ,OAAO;IAEtD,MAAM,YAAY,MAAM,KAAK,QAC3B,OAAO,WACL,KAAK,UAAU,OACb,QACA;KAAE,GAAG;KAAW,QAAQ;KAAO,EAC/B,OACD,EACH,KAAK,gBAAgB,EACrB,QACD;AAED,QAAI,CAAC,UAAU,GACb,OAAM,IAAI,eAAe,4BAA4B;IAEvD,MAAM,QAAQ,UAAU,KAAK;AAC7B,QAAI,CAAC,MACH,OAAM,IAAI,MAAM,iCAAiC;IAGnD,MAAM,mBACJ,KAAK,OAAO,kBAAkB;IAChC,MAAM,kBAAkB,mBAAmB;IAC3C,MAAM,UAAU,WAAW,eAAe;IAC1C,MAAM,YAAY,KAAK,KAAK;IAC5B,IAAI,kBAAkB;AAEtB,WAAO,CAAC,QAAQ,SAAS;AACvB,SAAI,KAAK,KAAK,GAAG,YAAY,QAC3B,OAAM,IAAI,MACR,WAAW,MAAM,yBAAyB,QAAQ,IACnD;KAGH,MAAM,kBAAkB,MAAM,KAAK,QACjC,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,EACE,SAAS;MACP,GAAG;MACH,OAAO,EAAE,SAAS,OAAO;MAC1B,EACF,EACD,QACD;AACD,SAAI,CAAC,gBAAgB,GACnB,OAAM,IAAI,eACR,qCAAqC,QACtC;KAEH,MAAM,MAAM,gBAAgB;KAC5B,MAAM,QAAQ,IAAI,OAAO;AAEzB,WAAM;MAAE,QAAQ;MAAO,WAAW,KAAK,KAAK;MAAE;MAAK;AAEnD,SAAI,mBAAmB,MAAM,CAAE;KAE/B,MAAM,EAAE,OAAO,SAAS,cACtB,iBACA,gBACD;AACD,uBAAkB;AAClB,WAAM,eAAe,OAAO,OAAO;;;GAIvC,SAAS,YAEJ;IACH,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,SACb,QACA;KAAE,QAAQ;KAAO,OAAO;KAAG,EAC3B,OACD,EACH,KAAK,cAAc,CAAC,gBAAgB,OAAO,CAAC,EAC5C,QACD;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,WAAO;KAAE,IAAI;KAAM,MAAM,OAAO,KAAK;KAAI;;GAG3C,UAAU,OAAO,YAEoC;IACnD,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,SACb,QACA;KAAE,QAAQ;KAAO,OAAO,SAAS;KAAO,EACxC,OACD,EACH,KAAK,cAAc;KACjB;KACA;KACA,SAAS,SAAS;KACnB,CAAC,EACF,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,QAAQ,OACN,UAC4C;IAC5C,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc;KAAC;KAAe;KAAQ;KAAM,CAAC,EAClD,QACD;AACD,QAAI,CAAC,OAAO,GAAI,QAAO,YAAY,OAAO,OAAO;AACjD,QAAI,OAAO,KAAK,WAAW,MAAO,QAAO,YAAY,IAAI;AACzD,WAAO;;GAGT,cAAc,OACZ,UACkD;IAClD,MAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,QAAI,WAAY,QAAO;IACvB,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,aAAa,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAChE,KAAK,cAAc;KAAC;KAAqB;KAAQ;KAAM,CAAC,EACxD,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,WAAW,OAAO,UAAkD;IAClE,MAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,QAAI,WAAY,QAAO;IACvB,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,UAAU,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC7D,KAAK,gBAAgB,EACrB,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAGxD,QAAQ,YAAqD;IAC3D,MAAM,SAAS,MAAM,KAAK,QACxB,OAAO,WACL,KAAK,UAAU,OAAO,QAAQ,EAAE,QAAQ,OAAO,EAAE,OAAO,EAC1D,KAAK,cAAc,CAAC,eAAe,OAAO,CAAC,EAC3C,QACD;AACD,WAAO,OAAO,KAAK,SAAS,YAAY,OAAO,OAAO;;GAEzD;;;;;;CAOH,AAAQ,YACN,KACA,KAG0C;EAC1C,MAAM,SAAS,IAAI,OAAO;AAC1B,MAAI,CAAC,KAAK,QAAQ,SAAS,OAAO,EAAE;GAClC,MAAM,UAAU,OAAO,QAAQ,mBAAmB,GAAG;AACrD,OAAI,OAAO,IAAI,CAAC,KAAK;IACnB,OAAO,gBAAgB,QAAQ;IAC/B,QAAQ,KAAK;IACd,CAAC;AACF,UAAO;IAAE,QAAQ;IAAW,OAAO;IAAW;;EAEhD,MAAM,QAAQ,KAAK,OAAO;AAC1B,MAAI,CAAC,OAAO;AACV,OAAI,OAAO,IAAI,CAAC,KAAK;IACnB,OAAO,QAAQ,OAAO;IACtB,QAAQ,KAAK;IACd,CAAC;AACF,UAAO;IAAE,QAAQ;IAAW,OAAO;IAAW;;AAEhD,SAAO;GAAE;GAAQ;GAAO;;CAG1B,AAAQ,iBAAiB,KAAuB,QAAsB;AACpE,MAAI,OAAO,OAAO,CAAC,KAAK;GACtB,OAAO,aAAa,WAAW;GAC/B,QAAQ,KAAK;GACd,CAAC;;;;;;;CAQJ,AAAQ,gBACN,QACA,WACqC;AACrC,MACE,cAAc,WACb,OAAO,cAAc,YACpB,cAAc,QACd,MAAM,QAAQ,UAAU,EAE1B,OAAM,IAAI,gBAAgB,gCAAgC;EAG5D,MAAM,YAAY,KAAK,WAAW;AAClC,MAAI,WAAW,QAAQ;AAErB,OAAI,CADW,UAAU,OAAO,UAAU,aAAa,EAAE,CAAC,CAC9C,QACV,OAAM,IAAI,gBAAgB,yBAAyB;AAIrD,UAAO;;AAIT,MAAI,cAAc,QAAW;AAC3B,OAAI,CAAC,WAAW,SACd,OAAM,IAAI,gBAAgB,sCAAsC;GAElE,MAAM,WAAW,OAAO,KAAK,UAAqC,CAAC;AACnE,OAAI,WAAW,2BACb,OAAM,IAAI,gBACR,wBAAwB,SAAS,6CAA6C,2BAA2B,GAC1G;;AAGL,SAAO;;CAGT,MAAc,WACZ,KACA,KACe;EACf,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,MAAI,CAAC,OAAQ;EAEb,MAAM,SAAS,IAAI,MAAM,WAAW;AAEpC,MAAI;GACF,MAAM,SAAS,KAAK,gBAAgB,QAAQ,IAAI,MAAM,OAAO;GAC7D,MAAM,MAAM,KAAK,aAAa,OAAO;AAErC,OAAI,QAAQ;IACV,MAAM,iBAA0C,EAC9C,SAAS,sBACV;AACD,UAAM,KAAK,cACT,MACC,WAAW,IAAI,WAAW,QAAQ,OAAO,EAC1C,eACD;UACI;IACL,MAAM,SAAS,MAAM,IAAI,OAAO,OAAO;AACvC,QAAI,CAAC,OAAO,IAAI;AACd,UAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,QAAI,KAAK,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC;;WAElC,OAAO;AACd,OAAI,iBAAiB,iBAAiB;AACpC,QAAI,CAAC,IAAI,YACP,KAAI,OAAO,IAAI,CAAC,KAAK;KAAE,OAAO,MAAM;KAAS,QAAQ,KAAK;KAAM,CAAC;AAEnE;;AAEF,UAAO,MAAM,6BAA6B,QAAQ,MAAM;AACxD,OAAI,CAAC,IAAI,YACP,KAAI,OAAO,IAAI,CAAC,KAAK;IAAE,OAAO;IAAc,QAAQ,KAAK;IAAM,CAAC;;;CAKtE,aAAa,QAAoB;AAC/B,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,UAAU,KAAK,QAAQ,KAAK,WAAW,KAAK,IAAI;GACjD,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,KAAK,IACjB,GACA,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,OAAiB,GAAG,IAAI,IAAI,IAAI,CACpE;AAED,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,SAAS,EAAE,OAAO,CAAC;AAC5C,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC;aACxB,OAAO;AACd,YAAO,MAAM,mCAAmC,QAAQ,MAAM;AAC9D,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAoB,QAAQ,KAAK;MAAM,CAAC;;;GAG9D,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,OAAO,GAAG;AACnD,QAAI,OAAO,MAAM,MAAM,IAAI,SAAS,GAAG;AACrC,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAiB,QAAQ,KAAK;MAAM,CAAC;AACnE;;AAGF,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,OAAO,MAAM;AACtC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK,OAAO,KAAK;aACd,OAAO;AACd,YAAO,MACL,wCACA,QACA,OACA,MACD;AACD,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAkB,QAAQ,KAAK;MAAM,CAAC;;;GAGzE,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;AAEb,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,SAAS;AAClC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,KAAK;MACP,QAAQ,OAAO,MAAM,OAAO,oBAAoB;MAChD,KAAK,OAAO,QAAQ;MACrB,CAAC;aACK,OAAO;AACd,YAAO,MAAM,sCAAsC,QAAQ,MAAM;AACjE,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAuB,QAAQ,KAAK;MAAM,CAAC;;;GAGjE,CAAC;AAGF,OAAK,MAAM,QAAQ;GACjB,MAAM;GACN,QAAQ;GACR,MAAM;GACN,SAAS,OAAO,KAAsB,QAA0B;IAC9D,MAAM,EAAE,WAAW,KAAK,YAAY,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAQ;IAEb,MAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,OAAO,GAAG;AACnD,QAAI,OAAO,MAAM,MAAM,IAAI,SAAS,GAAG;AACrC,SAAI,OAAO,IAAI,CAAC,KAAK;MAAE,OAAO;MAAiB,QAAQ,KAAK;MAAM,CAAC;AACnE;;AAGF,QAAI;KAEF,MAAM,SAAS,MADH,KAAK,aAAa,OAAO,CACZ,UAAU,MAAM;AACzC,SAAI,CAAC,OAAO,IAAI;AACd,WAAK,iBAAiB,KAAK,OAAO,OAAO;AACzC;;AAEF,SAAI,OAAO,IAAI,CAAC,KAAK;aACd,OAAO;AACd,YAAO,MACL,2CACA,QACA,OACA,MACD;AACD,SACG,OAAO,IAAI,CACX,KAAK;MAAE,OAAO;MAAqB,QAAQ,KAAK;MAAM,CAAC;;;GAG/D,CAAC;;CAGJ,UAAsB;EACpB,MAAM,cAAc,WAA2B;AAC7C,OAAI,CAAC,KAAK,QAAQ,SAAS,OAAO,CAChC,OAAM,IAAI,MACR,gBAAgB,OAAO,qBAAqB,KAAK,QAAQ,KAAK,KAAK,GACpE;AAGH,UAAO,KAAK,aAAa,OAAO;;AAGlC,SAAO;;CAGT,eAAwC;EACtC,MAAM,OACJ,EAAE;AACJ,OAAK,MAAM,OAAO,KAAK,SAAS;GAC9B,MAAM,SAAS,KAAK,WAAW;AAC/B,QAAK,OAAO;IACV,QAAQ,QAAQ,SAAS,aAAa,OAAO,OAAO,GAAG;IACvD,UAAU,QAAQ,YAAY;IAC/B;;AAEH,SAAO,EAAE,MAAM;;;;;;AAOnB,MAAa,OAAO,SAAS,WAAW"}

package/dist/plugins/lakebase/lakebase.d.ts

@@ -21,11 +21,8 @@ import * as stream from "stream";
  * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic
  * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.
  *
- * Supports On-Behalf-Of (OBO) via `asUser(req)` — each user gets a separate
- * `pg.Pool` authenticated with their Databricks identity, enabling features
- * like Row-Level Security (RLS). Routing is handled transparently by
- * {@link RoutingPool}, which reads the execution context set by the base
- * class `asUser()`.
+ * App-only in v1. Caller-scoped operations reject before opening a connection.
+ * The platform's postgres user scope is deferred for this connector.
  *
  * @example
  * ```ts
@@ -38,8 +35,6 @@ import * as stream from "stream";
  * // Service principal query
  * const result = await AppKit.lakebase.query("SELECT * FROM users WHERE id = $1", [userId]);
  *
- * // User-scoped query (per-user pool, RLS enforced)
- * const mine = await AppKit.lakebase.asUser(req).query("SELECT * FROM my_data");
  * ```
  */
 declare class LakebasePlugin extends Plugin implements ToolProvider {
@@ -60,8 +55,8 @@ declare class LakebasePlugin extends Plugin implements ToolProvider {
   /**
    * Executes a parameterized SQL query against the Lakebase pool.
    *
-   * When called inside `asUser(req)`, the query automatically routes to
-   * the per-user pool via {@link RoutingPool}.
+   * New caller scopes enforce the app-only resource contract. Deprecated
+   * user entry points retain their established per-user pool routing.
    *
    * @param text - SQL query string, using `$1`, `$2`, ... placeholders
    * @param values - Parameter values corresponding to placeholders
@@ -117,20 +112,18 @@ declare class LakebasePlugin extends Plugin implements ToolProvider {
   toolkit(opts?: ToolkitOptions): Record<string, ToolkitEntry>;
   /**
    * Returns the pool config for the current execution context.
-   * Inside `asUser(req)`, returns user-scoped config; otherwise SP config.
+   * Caller scopes reject; plain execution returns SP configuration.
    */
   private activePoolConfig;
   /**
    * Returns the plugin's public API, accessible via `AppKit.lakebase`.
    *
-   * - `pool` — The connection pool (routes to per-user pool when inside `asUser(req)`)
-   * - `query` — Convenience method for executing parameterized SQL queries
-   * - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.
-   *   Inside `asUser(req)`, returns user-scoped config.
-   * - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction.
-   *   Inside `asUser(req)`, returns user-scoped config.
+   * - `pool`: The service-principal connection pool.
+   * - `query`: Convenience method for executing parameterized SQL queries.
+   * - `getOrmConfig()`: SP configuration for Drizzle, TypeORM, Sequelize, etc.
+   * - `getPgConfig()`: A service-principal `pg.PoolConfig` for manual pools.
    *
-   * Use `AppKit.lakebase.asUser(req)` to get the same API backed by a per-user pool.
+   * Caller-scoped access is rejected in v1, including cached pool handles.
    */
   exports(): {
     pool: LakebasePool;

package/dist/plugins/lakebase/lakebase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lakebase.d.ts","names":[],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA;;;;;;;;;;;;;;;cAAa,cAAA,SAAuB,MAAA,YAAkB,YAAA;EAkOU;EAAA,OAhOvD,QAAA,EAFmB,cAAA;EAAA,UAIR,MAAA,EAAQ,eAAA;EAAA,QAClB,IAAA;EAAA,QACA,cAAA;EAwEG;;;;;;;;EA9DL,KAAA,CAAA,GAAK,OAAA;EAhByC;;;;;;;;;;;;;;;;;;EA2E9C,KAAA,WAAgB,cAAA,OAAA,CACpB,IAAA,UACA,MAAA,eACC,OAAA,CAAQ,WAAA,CAAY,CAAA;EAAZ;;;;;;;;;;;;;;EAAA,QAmBG,oBAAA;EA4HH;;;;;;;;;;;;EA7FL,QAAA,CAAA,GAAY,OAAA;EArDN;;;;;EAAA,QAkFJ,KAAA;cAEI,MAAA,EAAQ,eAAA;EAAA,QAYZ,cAAA;EA2CR,aAAA,CAAA,GAAiB,mBAAA;EAIX,gBAAA,CACJ,IAAA,UACA,IAAA,WACA,MAAA,GAAS,WAAA,GACR,OAAA;EAIH,OAAA,CAAQ,IAAA,GAJE,cAAA,GAIoD,MAAA,SAAA,YAAA;;;;;UAQtD,gBAAA;;;;;;;;;;;;;EAyBR,OAAA,CAAA;UAGwB,YAAA;sBA3LF,cAAA,QAAc,IAAA,UACtB,MAAA,iBAEX,OAAA,CAAQ,WAAA,CAAY,CAAA;;;;;;;;;;iBA/Fb,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkSC,QAAA,EAAQ,QAAA,QAAA,cAAA,EAAA,eAAA"}
+{"version":3,"file":"lakebase.d.ts","names":[],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA;;;;;;;;;;cAAa,cAAA,SAAuB,MAAA,YAAkB,YAAA;EA+JhC;EAAA,OA7Jb,QAAA,EAFmB,cAAA;EAAA,UAIR,MAAA,EAAQ,eAAA;EAAA,QAClB,IAAA;EAAA,QACA,cAAA;EA4NsD;;;;;;;;EAlNxD,KAAA,CAAA,GAAK,OAAA;;;;;;;;;;;;;;;;;;;EA2DL,KAAA,WAAgB,cAAA,OAAA,CACpB,IAAA,UACA,MAAA,eACC,OAAA,CAAQ,WAAA,CAAY,CAAA;EAHX;;;;;;;;;;;;;;EAAA,QAsBE,oBAAA;EAqHd;;;;;;;;;;;;EAtFM,QAAA,CAAA,GAAY,OAAA;EA0GV;;;;;EAAA,QA7EA,KAAA;cAEI,MAAA,EAAQ,eAAA;EAAA,QAYZ,cAAA;EA2CR,aAAA,CAAA,GAAiB,mBAAA;EAIX,gBAAA,CACJ,IAAA,UACA,IAAA,WACA,MAAA,GAAS,WAAA,GACR,OAAA;EAIH,OAAA,CAAQ,IAAA,GAJE,cAAA,GAIoD,MAAA,SAAA,YAAA;EApJvC;;;;EAAA,QA4Jf,gBAAA;;;;;;;;;;;EAwBR,OAAA,CAAA;UAGwB,YAAA;sBA1LF,cAAA,QAAc,IAAA,UACtB,MAAA,iBAEX,OAAA,CAAQ,WAAA,CAAY,CAAA;;;;;;;;;;iBAzFgC,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2R5C,QAAA,EAAQ,QAAA,QAAA,cAAA,EAAA,eAAA"}

package/dist/plugins/lakebase/lakebase.js

@@ -3,6 +3,7 @@ import { getClientOptions } from "../../context/client-options.js";
 import { createLogger } from "../../logging/logger.js";
 import { createLakebasePoolManager } from "../../connectors/lakebase/pool-manager.js";
 import { getCallerContext } from "../../context/execution-context.js";
+import { assertResourceExecution } from "../../context/resource-capabilities.js";
 import { RoutingPool } from "../../connectors/lakebase/routing-pool.js";
 import { createLakebasePool, getLakebaseOrmConfig, getLakebasePgConfig, getUsernameWithApiLookup } from "../../connectors/lakebase/index.js";
 import { Plugin } from "../../plugin/plugin.js";
@@ -30,11 +31,8 @@ const OBO_POOL_DEFAULTS = {
 * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic
 * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.
 *
-* Supports On-Behalf-Of (OBO) via `asUser(req)` — each user gets a separate
-* `pg.Pool` authenticated with their Databricks identity, enabling features
-* like Row-Level Security (RLS). Routing is handled transparently by
-* {@link RoutingPool}, which reads the execution context set by the base
-* class `asUser()`.
+* App-only in v1. Caller-scoped operations reject before opening a connection.
+* The platform's postgres user scope is deferred for this connector.
 *
 * @example
 * ```ts
@@ -47,8 +45,6 @@ const OBO_POOL_DEFAULTS = {
 * // Service principal query
 * const result = await AppKit.lakebase.query("SELECT * FROM users WHERE id = $1", [userId]);
 *
-* // User-scoped query (per-user pool, RLS enforced)
-* const mine = await AppKit.lakebase.asUser(req).query("SELECT * FROM my_data");
 * ```
 */
 var LakebasePlugin = class extends Plugin {
@@ -96,8 +92,8 @@ var LakebasePlugin = class extends Plugin {
 	/**
 	* Executes a parameterized SQL query against the Lakebase pool.
 	*
-	* When called inside `asUser(req)`, the query automatically routes to
-	* the per-user pool via {@link RoutingPool}.
+	* New caller scopes enforce the app-only resource contract. Deprecated
+	* user entry points retain their established per-user pool routing.
 	*
 	* @param text - SQL query string, using `$1`, `$2`, ... placeholders
 	* @param values - Parameter values corresponding to placeholders
@@ -221,9 +217,10 @@ var LakebasePlugin = class extends Plugin {
 	}
 	/**
 	* Returns the pool config for the current execution context.
-	* Inside `asUser(req)`, returns user-scoped config; otherwise SP config.
+	* Caller scopes reject; plain execution returns SP configuration.
 	*/
 	activePoolConfig() {
+		assertResourceExecution("postgres");
 		const ctx = getCallerContext();
 		if (ctx) {
 			const user = ctx.principal.userEmail ?? ctx.principal.userId;
@@ -238,14 +235,12 @@ var LakebasePlugin = class extends Plugin {
 	/**
 	* Returns the plugin's public API, accessible via `AppKit.lakebase`.
 	*
-	* - `pool` — The connection pool (routes to per-user pool when inside `asUser(req)`)
-	* - `query` — Convenience method for executing parameterized SQL queries
-	* - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.
-	*   Inside `asUser(req)`, returns user-scoped config.
-	* - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction.
-	*   Inside `asUser(req)`, returns user-scoped config.
+	* - `pool`: The service-principal connection pool.
+	* - `query`: Convenience method for executing parameterized SQL queries.
+	* - `getOrmConfig()`: SP configuration for Drizzle, TypeORM, Sequelize, etc.
+	* - `getPgConfig()`: A service-principal `pg.PoolConfig` for manual pools.
 	*
-	* Use `AppKit.lakebase.asUser(req)` to get the same API backed by a per-user pool.
+	* Caller-scoped access is rejected in v1, including cached pool handles.
 	*/
 	exports() {
 		return {

package/dist/plugins/lakebase/lakebase.js.map

@@ -1 +1 @@
-{"version":3,"file":"lakebase.js","names":["manifest"],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"sourcesContent":["import type { QueryResult, QueryResultRow } from \"pg\";\nimport type { AgentToolDefinition, ToolProvider } from \"shared\";\nimport { z } from \"zod\";\n\nimport {\n  createLakebasePool,\n  createLakebasePoolManager,\n  getLakebaseOrmConfig,\n  getLakebasePgConfig,\n  getUsernameWithApiLookup,\n  type LakebasePool,\n  type LakebasePoolManager,\n  RoutingPool,\n} from \"../../connectors/lakebase\";\nimport { getClientOptions } from \"../../context/client-options\";\nimport { getCallerContext } from \"../../context/execution-context\";\nimport { buildToolkitEntries } from \"../../core/agent/build-toolkit\";\nimport {\n  defineTool,\n  executeFromRegistry,\n  toolsFromRegistry,\n} from \"../../core/agent/tools/define-tool\";\nimport { assertReadOnlySql } from \"../../core/agent/tools/sql-policy\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport { defineManifest } from \"../../registry\";\nimport { createWorkspaceClient } from \"../../workspace-client\";\nimport manifest from \"./manifest.json\";\nimport type { ILakebaseConfig } from \"./types\";\n\nconst logger = createLogger(\"lakebase\");\n\n/** Default pool settings for per-user OBO pools. */\nconst OBO_POOL_DEFAULTS = {\n  max: 3,\n  allowExitOnIdle: true,\n  idleTimeoutMillis: 30_000,\n};\n\n/**\n * AppKit plugin for Databricks Lakebase Autoscaling.\n *\n * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic\n * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.\n *\n * Supports On-Behalf-Of (OBO) via `asUser(req)` — each user gets a separate\n * `pg.Pool` authenticated with their Databricks identity, enabling features\n * like Row-Level Security (RLS). Routing is handled transparently by\n * {@link RoutingPool}, which reads the execution context set by the base\n * class `asUser()`.\n *\n * @example\n * ```ts\n * import { createApp, lakebase, server } from \"@databricks/appkit\";\n *\n * const AppKit = await createApp({\n *   plugins: [server(), lakebase()],\n * });\n *\n * // Service principal query\n * const result = await AppKit.lakebase.query(\"SELECT * FROM users WHERE id = $1\", [userId]);\n *\n * // User-scoped query (per-user pool, RLS enforced)\n * const mine = await AppKit.lakebase.asUser(req).query(\"SELECT * FROM my_data\");\n * ```\n */\nexport class LakebasePlugin extends Plugin implements ToolProvider {\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = defineManifest<\"lakebase\">(manifest);\n\n  declare protected config: ILakebaseConfig;\n  private pool: RoutingPool | null = null;\n  private oboPoolManager: LakebasePoolManager | null = null;\n\n  /**\n   * Initializes the Lakebase connection pool and OBO pool manager.\n   * Called automatically by AppKit during the plugin setup phase.\n   *\n   * Creates a {@link RoutingPool} that automatically routes queries to either\n   * the service-principal pool or a per-user pool based on the execution\n   * context (set by `Plugin.asUser(req)` via AsyncLocalStorage).\n   */\n  async setup() {\n    const poolConfig = {\n      ...this.config.pool,\n      workspaceClient:\n        this.config.pool?.workspaceClient ??\n        createWorkspaceClient({\n          clientOptions: getClientOptions(),\n        }).toLegacyWorkspaceClient(),\n    };\n    const user = await getUsernameWithApiLookup(poolConfig);\n\n    const spPool = createLakebasePool({ ...poolConfig, user });\n    logger.info(\"Lakebase SP pool initialized\");\n\n    this.oboPoolManager = createLakebasePoolManager({\n      ...poolConfig,\n      ...OBO_POOL_DEFAULTS,\n    });\n    logger.info(\"Lakebase OBO pool manager initialized\");\n\n    const oboManager = this.oboPoolManager;\n    this.pool = new RoutingPool(spPool, (ctx) => {\n      if (!oboManager) throw new Error(\"OBO pool manager not initialized\");\n      // Lakebase OAuth roles use email as the postgres role when available\n      const userKey = ctx.principal.userEmail ?? ctx.principal.userId;\n      const isNew = !oboManager.hasPool(userKey);\n      const pool = oboManager.getPool(\n        userKey,\n        {\n          workspaceClient: ctx.client.toLegacyWorkspaceClient(),\n          user: userKey,\n        },\n        ctx.tokenFingerprint,\n      );\n      if (isNew) {\n        logger.debug(\"Created OBO pool for user (total: %d)\", oboManager.size);\n      }\n      return pool;\n    });\n  }\n\n  /**\n   * Executes a parameterized SQL query against the Lakebase pool.\n   *\n   * When called inside `asUser(req)`, the query automatically routes to\n   * the per-user pool via {@link RoutingPool}.\n   *\n   * @param text - SQL query string, using `$1`, `$2`, ... placeholders\n   * @param values - Parameter values corresponding to placeholders\n   * @returns Query result with typed rows\n   *\n   * @example\n   * ```ts\n   * const result = await AppKit.lakebase.query<{ id: number; name: string }>(\n   *   \"SELECT id, name FROM users WHERE active = $1\",\n   *   [true],\n   * );\n   * ```\n   */\n  async query<T extends QueryResultRow = any>(\n    text: string,\n    values?: unknown[],\n  ): Promise<QueryResult<T>> {\n    // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n    return this.pool!.query<T>(text, values);\n  }\n\n  /**\n   * Execute a single statement inside a `BEGIN READ ONLY … ROLLBACK`\n   * transaction on a dedicated client.\n   *\n   * The three commands MUST share a connection — a naive\n   * `pool.query(\"BEGIN READ ONLY; <stmt>; ROLLBACK\")` batch cannot accept\n   * parameter values (PostgreSQL's Extended Query protocol rejects multi-\n   * statement prepared queries), which would silently break every\n   * parameterized query the agent tool issues.\n   *\n   * Returns the raw `rows` array for the user's statement. Side effects the\n   * statement may attempt (writes, writable-function side effects) are\n   * rejected by PostgreSQL under the read-only transaction posture.\n   */\n  private async runReadOnlyStatement(\n    text: string,\n    values?: unknown[],\n  ): Promise<unknown[]> {\n    // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n    const client = await this.pool!.connect();\n    try {\n      await client.query(\"BEGIN READ ONLY\");\n      const result = await client.query(text, values);\n      return result.rows;\n    } finally {\n      try {\n        await client.query(\"ROLLBACK\");\n      } finally {\n        client.release();\n      }\n    }\n  }\n\n  /**\n   * Gracefully drains and closes all connection pools (SP + OBO).\n   *\n   * Runs as the plugin's `shutdown()` hook (phase 3 of the core lifecycle\n   * manager's graceful shutdown), NOT in `abortActiveOperations()` (phase 2):\n   * other plugins' `shutdown()` hooks may still need database connections to\n   * drain state,\n   * so the pools must outlive the abort phase. `pg.Pool#end()` waits for\n   * checked-out clients to be released, so hooks running concurrently with\n   * this one can still finish their in-flight queries. Errors are caught\n   * and logged; this hook never throws.\n   */\n  async shutdown(): Promise<void> {\n    if (this.pool) {\n      logger.info(\"Closing Lakebase SP pool\");\n      try {\n        await this.pool.end();\n      } catch (err) {\n        logger.error(\"Error closing Lakebase SP pool: %O\", err);\n      }\n      this.pool = null;\n    }\n    if (this.oboPoolManager) {\n      logger.info(\n        \"Closing all Lakebase OBO pools (%d)\",\n        this.oboPoolManager.size,\n      );\n      try {\n        await this.oboPoolManager.closeAll();\n      } catch (err) {\n        logger.error(\"Error closing Lakebase OBO pools: %O\", err);\n      }\n      this.oboPoolManager = null;\n    }\n  }\n\n  /**\n   * Agent tool registry. Empty by default — the Lakebase plugin does NOT\n   * expose its SQL connection to LLM agents unless the developer explicitly\n   * opts in via `config.exposeAsAgentTool`. See {@link buildQueryTool}.\n   */\n  private tools: Record<string, ReturnType<typeof this.buildQueryTool>> = {};\n\n  constructor(config: ILakebaseConfig) {\n    super(config);\n    this.config = config;\n    if (config.exposeAsAgentTool) {\n      this.tools = { query: this.buildQueryTool(config.exposeAsAgentTool) };\n      logger.warn(\n        \"Lakebase agent tool is enabled (readOnly=%s). Every agent with access to this plugin can execute SQL against the Lakebase database as the requesting user's identity.\",\n        config.exposeAsAgentTool.readOnly !== false,\n      );\n    }\n  }\n\n  private buildQueryTool(\n    opt: NonNullable<ILakebaseConfig[\"exposeAsAgentTool\"]>,\n  ) {\n    const readOnly = opt.readOnly !== false;\n    return defineTool({\n      description: readOnly\n        ? \"Execute a read-only SQL query against the Lakebase PostgreSQL database. Only SELECT, WITH, SHOW, EXPLAIN, and DESCRIBE statements are accepted. Use $1, $2, etc. as placeholders and pass values separately.\"\n        : \"Execute a parameterized SQL statement against the Lakebase PostgreSQL database. Use $1, $2, etc. as placeholders and pass values separately. This tool can modify data; every invocation requires explicit human approval.\",\n      schema: z.object({\n        text: z\n          .string()\n          .describe(\n            \"SQL statement with $1, $2, ... placeholders for parameters\",\n          ),\n        values: z\n          .array(z.unknown())\n          .optional()\n          .describe(\"Parameter values corresponding to placeholders\"),\n      }),\n      annotations: {\n        effect: readOnly ? \"read\" : \"destructive\",\n        idempotent: false,\n        requiresUserContext: true,\n      },\n      execute: async (args, signal) => {\n        // Matches the files plugin pattern: the pg connection API\n        // doesn't accept AbortSignal in its current shape, so deeper\n        // mid-call cancellation needs a separate plumbing pass on the\n        // connector. This entry check still catches the common case —\n        // a tool dispatched after the user already cancelled the\n        // stream — and unwinds cleanly instead of running to\n        // completion against the SQL warehouse.\n        signal?.throwIfAborted();\n        if (readOnly) {\n          assertReadOnlySql(args.text);\n          return this.runReadOnlyStatement(args.text, args.values);\n        }\n        const result = await this.query(args.text, args.values);\n        return result.rows;\n      },\n    });\n  }\n\n  getAgentTools(): AgentToolDefinition[] {\n    return toolsFromRegistry(this.tools);\n  }\n\n  async executeAgentTool(\n    name: string,\n    args: unknown,\n    signal?: AbortSignal,\n  ): Promise<unknown> {\n    return executeFromRegistry(this.tools, name, args, signal);\n  }\n\n  toolkit(opts?: import(\"../../core/agent/types\").ToolkitOptions) {\n    return buildToolkitEntries(this.name, this.tools, opts);\n  }\n\n  /**\n   * Returns the pool config for the current execution context.\n   * Inside `asUser(req)`, returns user-scoped config; otherwise SP config.\n   */\n  private activePoolConfig() {\n    const ctx = getCallerContext();\n    if (ctx) {\n      const user = ctx.principal.userEmail ?? ctx.principal.userId;\n      return {\n        ...this.config.pool,\n        workspaceClient: ctx.client.toLegacyWorkspaceClient(),\n        user,\n      };\n    }\n    return this.config.pool;\n  }\n\n  /**\n   * Returns the plugin's public API, accessible via `AppKit.lakebase`.\n   *\n   * - `pool` — The connection pool (routes to per-user pool when inside `asUser(req)`)\n   * - `query` — Convenience method for executing parameterized SQL queries\n   * - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.\n   *   Inside `asUser(req)`, returns user-scoped config.\n   * - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction.\n   *   Inside `asUser(req)`, returns user-scoped config.\n   *\n   * Use `AppKit.lakebase.asUser(req)` to get the same API backed by a per-user pool.\n   */\n  exports() {\n    return {\n      // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n      pool: this.pool! as LakebasePool,\n      query: this.query.bind(this),\n      getOrmConfig: () => getLakebaseOrmConfig(this.activePoolConfig()),\n      getPgConfig: () => getLakebasePgConfig(this.activePoolConfig()),\n    };\n  }\n}\n\n/**\n * @internal\n */\nexport const lakebase = toPlugin(LakebasePlugin);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS,aAAa,WAAW;;AAGvC,MAAM,oBAAoB;CACxB,KAAK;CACL,iBAAiB;CACjB,mBAAmB;CACpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BD,IAAa,iBAAb,cAAoC,OAA+B;;CAEjE,OAAO,WAAW,eAA2BA,iBAAS;CAGtD,AAAQ,OAA2B;CACnC,AAAQ,iBAA6C;;;;;;;;;CAUrD,MAAM,QAAQ;EACZ,MAAM,aAAa;GACjB,GAAG,KAAK,OAAO;GACf,iBACE,KAAK,OAAO,MAAM,mBAClB,sBAAsB,EACpB,eAAe,kBAAkB,EAClC,CAAC,CAAC,yBAAyB;GAC/B;EACD,MAAM,OAAO,MAAM,yBAAyB,WAAW;EAEvD,MAAM,SAAS,mBAAmB;GAAE,GAAG;GAAY;GAAM,CAAC;AAC1D,SAAO,KAAK,+BAA+B;AAE3C,OAAK,iBAAiB,0BAA0B;GAC9C,GAAG;GACH,GAAG;GACJ,CAAC;AACF,SAAO,KAAK,wCAAwC;EAEpD,MAAM,aAAa,KAAK;AACxB,OAAK,OAAO,IAAI,YAAY,SAAS,QAAQ;AAC3C,OAAI,CAAC,WAAY,OAAM,IAAI,MAAM,mCAAmC;GAEpE,MAAM,UAAU,IAAI,UAAU,aAAa,IAAI,UAAU;GACzD,MAAM,QAAQ,CAAC,WAAW,QAAQ,QAAQ;GAC1C,MAAM,OAAO,WAAW,QACtB,SACA;IACE,iBAAiB,IAAI,OAAO,yBAAyB;IACrD,MAAM;IACP,EACD,IAAI,iBACL;AACD,OAAI,MACF,QAAO,MAAM,yCAAyC,WAAW,KAAK;AAExE,UAAO;IACP;;;;;;;;;;;;;;;;;;;;CAqBJ,MAAM,MACJ,MACA,QACyB;AAEzB,SAAO,KAAK,KAAM,MAAS,MAAM,OAAO;;;;;;;;;;;;;;;;CAiB1C,MAAc,qBACZ,MACA,QACoB;EAEpB,MAAM,SAAS,MAAM,KAAK,KAAM,SAAS;AACzC,MAAI;AACF,SAAM,OAAO,MAAM,kBAAkB;AAErC,WADe,MAAM,OAAO,MAAM,MAAM,OAAO,EACjC;YACN;AACR,OAAI;AACF,UAAM,OAAO,MAAM,WAAW;aACtB;AACR,WAAO,SAAS;;;;;;;;;;;;;;;;CAiBtB,MAAM,WAA0B;AAC9B,MAAI,KAAK,MAAM;AACb,UAAO,KAAK,2BAA2B;AACvC,OAAI;AACF,UAAM,KAAK,KAAK,KAAK;YACd,KAAK;AACZ,WAAO,MAAM,sCAAsC,IAAI;;AAEzD,QAAK,OAAO;;AAEd,MAAI,KAAK,gBAAgB;AACvB,UAAO,KACL,uCACA,KAAK,eAAe,KACrB;AACD,OAAI;AACF,UAAM,KAAK,eAAe,UAAU;YAC7B,KAAK;AACZ,WAAO,MAAM,wCAAwC,IAAI;;AAE3D,QAAK,iBAAiB;;;;;;;;CAS1B,AAAQ,QAAgE,EAAE;CAE1E,YAAY,QAAyB;AACnC,QAAM,OAAO;AACb,OAAK,SAAS;AACd,MAAI,OAAO,mBAAmB;AAC5B,QAAK,QAAQ,EAAE,OAAO,KAAK,eAAe,OAAO,kBAAkB,EAAE;AACrE,UAAO,KACL,yKACA,OAAO,kBAAkB,aAAa,MACvC;;;CAIL,AAAQ,eACN,KACA;EACA,MAAM,WAAW,IAAI,aAAa;AAClC,SAAO,WAAW;GAChB,aAAa,WACT,iNACA;GACJ,QAAQ,EAAE,OAAO;IACf,MAAM,EACH,QAAQ,CACR,SACC,6DACD;IACH,QAAQ,EACL,MAAM,EAAE,SAAS,CAAC,CAClB,UAAU,CACV,SAAS,iDAAiD;IAC9D,CAAC;GACF,aAAa;IACX,QAAQ,WAAW,SAAS;IAC5B,YAAY;IACZ,qBAAqB;IACtB;GACD,SAAS,OAAO,MAAM,WAAW;AAQ/B,YAAQ,gBAAgB;AACxB,QAAI,UAAU;AACZ,uBAAkB,KAAK,KAAK;AAC5B,YAAO,KAAK,qBAAqB,KAAK,MAAM,KAAK,OAAO;;AAG1D,YADe,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,EACzC;;GAEjB,CAAC;;CAGJ,gBAAuC;AACrC,SAAO,kBAAkB,KAAK,MAAM;;CAGtC,MAAM,iBACJ,MACA,MACA,QACkB;AAClB,SAAO,oBAAoB,KAAK,OAAO,MAAM,MAAM,OAAO;;CAG5D,QAAQ,MAAwD;AAC9D,SAAO,oBAAoB,KAAK,MAAM,KAAK,OAAO,KAAK;;;;;;CAOzD,AAAQ,mBAAmB;EACzB,MAAM,MAAM,kBAAkB;AAC9B,MAAI,KAAK;GACP,MAAM,OAAO,IAAI,UAAU,aAAa,IAAI,UAAU;AACtD,UAAO;IACL,GAAG,KAAK,OAAO;IACf,iBAAiB,IAAI,OAAO,yBAAyB;IACrD;IACD;;AAEH,SAAO,KAAK,OAAO;;;;;;;;;;;;;;CAerB,UAAU;AACR,SAAO;GAEL,MAAM,KAAK;GACX,OAAO,KAAK,MAAM,KAAK,KAAK;GAC5B,oBAAoB,qBAAqB,KAAK,kBAAkB,CAAC;GACjE,mBAAmB,oBAAoB,KAAK,kBAAkB,CAAC;GAChE;;;;;;AAOL,MAAa,WAAW,SAAS,eAAe"}
+{"version":3,"file":"lakebase.js","names":["manifest"],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"sourcesContent":["import type { QueryResult, QueryResultRow } from \"pg\";\nimport type { AgentToolDefinition, ToolProvider } from \"shared\";\nimport { z } from \"zod\";\n\nimport {\n  createLakebasePool,\n  createLakebasePoolManager,\n  getLakebaseOrmConfig,\n  getLakebasePgConfig,\n  getUsernameWithApiLookup,\n  type LakebasePool,\n  type LakebasePoolManager,\n  RoutingPool,\n} from \"../../connectors/lakebase\";\nimport { getClientOptions } from \"../../context/client-options\";\nimport { getCallerContext } from \"../../context/execution-context\";\nimport { assertResourceExecution } from \"../../context/resource-capabilities\";\nimport { buildToolkitEntries } from \"../../core/agent/build-toolkit\";\nimport {\n  defineTool,\n  executeFromRegistry,\n  toolsFromRegistry,\n} from \"../../core/agent/tools/define-tool\";\nimport { assertReadOnlySql } from \"../../core/agent/tools/sql-policy\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport { defineManifest } from \"../../registry\";\nimport { createWorkspaceClient } from \"../../workspace-client\";\nimport manifest from \"./manifest.json\";\nimport type { ILakebaseConfig } from \"./types\";\n\nconst logger = createLogger(\"lakebase\");\n\n/** Default pool settings for per-user OBO pools. */\nconst OBO_POOL_DEFAULTS = {\n  max: 3,\n  allowExitOnIdle: true,\n  idleTimeoutMillis: 30_000,\n};\n\n/**\n * AppKit plugin for Databricks Lakebase Autoscaling.\n *\n * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic\n * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.\n *\n * App-only in v1. Caller-scoped operations reject before opening a connection.\n * The platform's postgres user scope is deferred for this connector.\n *\n * @example\n * ```ts\n * import { createApp, lakebase, server } from \"@databricks/appkit\";\n *\n * const AppKit = await createApp({\n *   plugins: [server(), lakebase()],\n * });\n *\n * // Service principal query\n * const result = await AppKit.lakebase.query(\"SELECT * FROM users WHERE id = $1\", [userId]);\n *\n * ```\n */\nexport class LakebasePlugin extends Plugin implements ToolProvider {\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = defineManifest<\"lakebase\">(manifest);\n\n  declare protected config: ILakebaseConfig;\n  private pool: RoutingPool | null = null;\n  private oboPoolManager: LakebasePoolManager | null = null;\n\n  /**\n   * Initializes the Lakebase connection pool and OBO pool manager.\n   * Called automatically by AppKit during the plugin setup phase.\n   *\n   * Creates a {@link RoutingPool} that automatically routes queries to either\n   * the service-principal pool or a per-user pool based on the execution\n   * context (set by `Plugin.asUser(req)` via AsyncLocalStorage).\n   */\n  async setup() {\n    const poolConfig = {\n      ...this.config.pool,\n      workspaceClient:\n        this.config.pool?.workspaceClient ??\n        createWorkspaceClient({\n          clientOptions: getClientOptions(),\n        }).toLegacyWorkspaceClient(),\n    };\n    const user = await getUsernameWithApiLookup(poolConfig);\n\n    const spPool = createLakebasePool({ ...poolConfig, user });\n    logger.info(\"Lakebase SP pool initialized\");\n\n    this.oboPoolManager = createLakebasePoolManager({\n      ...poolConfig,\n      ...OBO_POOL_DEFAULTS,\n    });\n    logger.info(\"Lakebase OBO pool manager initialized\");\n\n    const oboManager = this.oboPoolManager;\n    this.pool = new RoutingPool(spPool, (ctx) => {\n      if (!oboManager) throw new Error(\"OBO pool manager not initialized\");\n      // Lakebase OAuth roles use email as the postgres role when available\n      const userKey = ctx.principal.userEmail ?? ctx.principal.userId;\n      const isNew = !oboManager.hasPool(userKey);\n      const pool = oboManager.getPool(\n        userKey,\n        {\n          workspaceClient: ctx.client.toLegacyWorkspaceClient(),\n          user: userKey,\n        },\n        ctx.tokenFingerprint,\n      );\n      if (isNew) {\n        logger.debug(\"Created OBO pool for user (total: %d)\", oboManager.size);\n      }\n      return pool;\n    });\n  }\n\n  /**\n   * Executes a parameterized SQL query against the Lakebase pool.\n   *\n   * New caller scopes enforce the app-only resource contract. Deprecated\n   * user entry points retain their established per-user pool routing.\n   *\n   * @param text - SQL query string, using `$1`, `$2`, ... placeholders\n   * @param values - Parameter values corresponding to placeholders\n   * @returns Query result with typed rows\n   *\n   * @example\n   * ```ts\n   * const result = await AppKit.lakebase.query<{ id: number; name: string }>(\n   *   \"SELECT id, name FROM users WHERE active = $1\",\n   *   [true],\n   * );\n   * ```\n   */\n  async query<T extends QueryResultRow = any>(\n    text: string,\n    values?: unknown[],\n  ): Promise<QueryResult<T>> {\n    // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n    return this.pool!.query<T>(text, values);\n  }\n\n  /**\n   * Execute a single statement inside a `BEGIN READ ONLY … ROLLBACK`\n   * transaction on a dedicated client.\n   *\n   * The three commands MUST share a connection — a naive\n   * `pool.query(\"BEGIN READ ONLY; <stmt>; ROLLBACK\")` batch cannot accept\n   * parameter values (PostgreSQL's Extended Query protocol rejects multi-\n   * statement prepared queries), which would silently break every\n   * parameterized query the agent tool issues.\n   *\n   * Returns the raw `rows` array for the user's statement. Side effects the\n   * statement may attempt (writes, writable-function side effects) are\n   * rejected by PostgreSQL under the read-only transaction posture.\n   */\n  private async runReadOnlyStatement(\n    text: string,\n    values?: unknown[],\n  ): Promise<unknown[]> {\n    // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n    const client = await this.pool!.connect();\n    try {\n      await client.query(\"BEGIN READ ONLY\");\n      const result = await client.query(text, values);\n      return result.rows;\n    } finally {\n      try {\n        await client.query(\"ROLLBACK\");\n      } finally {\n        client.release();\n      }\n    }\n  }\n\n  /**\n   * Gracefully drains and closes all connection pools (SP + OBO).\n   *\n   * Runs as the plugin's `shutdown()` hook (phase 3 of the core lifecycle\n   * manager's graceful shutdown), NOT in `abortActiveOperations()` (phase 2):\n   * other plugins' `shutdown()` hooks may still need database connections to\n   * drain state,\n   * so the pools must outlive the abort phase. `pg.Pool#end()` waits for\n   * checked-out clients to be released, so hooks running concurrently with\n   * this one can still finish their in-flight queries. Errors are caught\n   * and logged; this hook never throws.\n   */\n  async shutdown(): Promise<void> {\n    if (this.pool) {\n      logger.info(\"Closing Lakebase SP pool\");\n      try {\n        await this.pool.end();\n      } catch (err) {\n        logger.error(\"Error closing Lakebase SP pool: %O\", err);\n      }\n      this.pool = null;\n    }\n    if (this.oboPoolManager) {\n      logger.info(\n        \"Closing all Lakebase OBO pools (%d)\",\n        this.oboPoolManager.size,\n      );\n      try {\n        await this.oboPoolManager.closeAll();\n      } catch (err) {\n        logger.error(\"Error closing Lakebase OBO pools: %O\", err);\n      }\n      this.oboPoolManager = null;\n    }\n  }\n\n  /**\n   * Agent tool registry. Empty by default — the Lakebase plugin does NOT\n   * expose its SQL connection to LLM agents unless the developer explicitly\n   * opts in via `config.exposeAsAgentTool`. See {@link buildQueryTool}.\n   */\n  private tools: Record<string, ReturnType<typeof this.buildQueryTool>> = {};\n\n  constructor(config: ILakebaseConfig) {\n    super(config);\n    this.config = config;\n    if (config.exposeAsAgentTool) {\n      this.tools = { query: this.buildQueryTool(config.exposeAsAgentTool) };\n      logger.warn(\n        \"Lakebase agent tool is enabled (readOnly=%s). Every agent with access to this plugin can execute SQL against the Lakebase database as the requesting user's identity.\",\n        config.exposeAsAgentTool.readOnly !== false,\n      );\n    }\n  }\n\n  private buildQueryTool(\n    opt: NonNullable<ILakebaseConfig[\"exposeAsAgentTool\"]>,\n  ) {\n    const readOnly = opt.readOnly !== false;\n    return defineTool({\n      description: readOnly\n        ? \"Execute a read-only SQL query against the Lakebase PostgreSQL database. Only SELECT, WITH, SHOW, EXPLAIN, and DESCRIBE statements are accepted. Use $1, $2, etc. as placeholders and pass values separately.\"\n        : \"Execute a parameterized SQL statement against the Lakebase PostgreSQL database. Use $1, $2, etc. as placeholders and pass values separately. This tool can modify data; every invocation requires explicit human approval.\",\n      schema: z.object({\n        text: z\n          .string()\n          .describe(\n            \"SQL statement with $1, $2, ... placeholders for parameters\",\n          ),\n        values: z\n          .array(z.unknown())\n          .optional()\n          .describe(\"Parameter values corresponding to placeholders\"),\n      }),\n      annotations: {\n        effect: readOnly ? \"read\" : \"destructive\",\n        idempotent: false,\n        requiresUserContext: true,\n      },\n      execute: async (args, signal) => {\n        // Matches the files plugin pattern: the pg connection API\n        // doesn't accept AbortSignal in its current shape, so deeper\n        // mid-call cancellation needs a separate plumbing pass on the\n        // connector. This entry check still catches the common case —\n        // a tool dispatched after the user already cancelled the\n        // stream — and unwinds cleanly instead of running to\n        // completion against the SQL warehouse.\n        signal?.throwIfAborted();\n        if (readOnly) {\n          assertReadOnlySql(args.text);\n          return this.runReadOnlyStatement(args.text, args.values);\n        }\n        const result = await this.query(args.text, args.values);\n        return result.rows;\n      },\n    });\n  }\n\n  getAgentTools(): AgentToolDefinition[] {\n    return toolsFromRegistry(this.tools);\n  }\n\n  async executeAgentTool(\n    name: string,\n    args: unknown,\n    signal?: AbortSignal,\n  ): Promise<unknown> {\n    return executeFromRegistry(this.tools, name, args, signal);\n  }\n\n  toolkit(opts?: import(\"../../core/agent/types\").ToolkitOptions) {\n    return buildToolkitEntries(this.name, this.tools, opts);\n  }\n\n  /**\n   * Returns the pool config for the current execution context.\n   * Caller scopes reject; plain execution returns SP configuration.\n   */\n  private activePoolConfig() {\n    assertResourceExecution(\"postgres\");\n    const ctx = getCallerContext();\n    if (ctx) {\n      const user = ctx.principal.userEmail ?? ctx.principal.userId;\n      return {\n        ...this.config.pool,\n        workspaceClient: ctx.client.toLegacyWorkspaceClient(),\n        user,\n      };\n    }\n    return this.config.pool;\n  }\n\n  /**\n   * Returns the plugin's public API, accessible via `AppKit.lakebase`.\n   *\n   * - `pool`: The service-principal connection pool.\n   * - `query`: Convenience method for executing parameterized SQL queries.\n   * - `getOrmConfig()`: SP configuration for Drizzle, TypeORM, Sequelize, etc.\n   * - `getPgConfig()`: A service-principal `pg.PoolConfig` for manual pools.\n   *\n   * Caller-scoped access is rejected in v1, including cached pool handles.\n   */\n  exports() {\n    return {\n      // oxlint-disable-next-line typescript/no-non-null-assertion -- pool is initialized during setup()\n      pool: this.pool! as LakebasePool,\n      query: this.query.bind(this),\n      getOrmConfig: () => getLakebaseOrmConfig(this.activePoolConfig()),\n      getPgConfig: () => getLakebasePgConfig(this.activePoolConfig()),\n    };\n  }\n}\n\n/**\n * @internal\n */\nexport const lakebase = toPlugin(LakebasePlugin);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,SAAS,aAAa,WAAW;;AAGvC,MAAM,oBAAoB;CACxB,KAAK;CACL,iBAAiB;CACjB,mBAAmB;CACpB;;;;;;;;;;;;;;;;;;;;;;;AAwBD,IAAa,iBAAb,cAAoC,OAA+B;;CAEjE,OAAO,WAAW,eAA2BA,iBAAS;CAGtD,AAAQ,OAA2B;CACnC,AAAQ,iBAA6C;;;;;;;;;CAUrD,MAAM,QAAQ;EACZ,MAAM,aAAa;GACjB,GAAG,KAAK,OAAO;GACf,iBACE,KAAK,OAAO,MAAM,mBAClB,sBAAsB,EACpB,eAAe,kBAAkB,EAClC,CAAC,CAAC,yBAAyB;GAC/B;EACD,MAAM,OAAO,MAAM,yBAAyB,WAAW;EAEvD,MAAM,SAAS,mBAAmB;GAAE,GAAG;GAAY;GAAM,CAAC;AAC1D,SAAO,KAAK,+BAA+B;AAE3C,OAAK,iBAAiB,0BAA0B;GAC9C,GAAG;GACH,GAAG;GACJ,CAAC;AACF,SAAO,KAAK,wCAAwC;EAEpD,MAAM,aAAa,KAAK;AACxB,OAAK,OAAO,IAAI,YAAY,SAAS,QAAQ;AAC3C,OAAI,CAAC,WAAY,OAAM,IAAI,MAAM,mCAAmC;GAEpE,MAAM,UAAU,IAAI,UAAU,aAAa,IAAI,UAAU;GACzD,MAAM,QAAQ,CAAC,WAAW,QAAQ,QAAQ;GAC1C,MAAM,OAAO,WAAW,QACtB,SACA;IACE,iBAAiB,IAAI,OAAO,yBAAyB;IACrD,MAAM;IACP,EACD,IAAI,iBACL;AACD,OAAI,MACF,QAAO,MAAM,yCAAyC,WAAW,KAAK;AAExE,UAAO;IACP;;;;;;;;;;;;;;;;;;;;CAqBJ,MAAM,MACJ,MACA,QACyB;AAEzB,SAAO,KAAK,KAAM,MAAS,MAAM,OAAO;;;;;;;;;;;;;;;;CAiB1C,MAAc,qBACZ,MACA,QACoB;EAEpB,MAAM,SAAS,MAAM,KAAK,KAAM,SAAS;AACzC,MAAI;AACF,SAAM,OAAO,MAAM,kBAAkB;AAErC,WADe,MAAM,OAAO,MAAM,MAAM,OAAO,EACjC;YACN;AACR,OAAI;AACF,UAAM,OAAO,MAAM,WAAW;aACtB;AACR,WAAO,SAAS;;;;;;;;;;;;;;;;CAiBtB,MAAM,WAA0B;AAC9B,MAAI,KAAK,MAAM;AACb,UAAO,KAAK,2BAA2B;AACvC,OAAI;AACF,UAAM,KAAK,KAAK,KAAK;YACd,KAAK;AACZ,WAAO,MAAM,sCAAsC,IAAI;;AAEzD,QAAK,OAAO;;AAEd,MAAI,KAAK,gBAAgB;AACvB,UAAO,KACL,uCACA,KAAK,eAAe,KACrB;AACD,OAAI;AACF,UAAM,KAAK,eAAe,UAAU;YAC7B,KAAK;AACZ,WAAO,MAAM,wCAAwC,IAAI;;AAE3D,QAAK,iBAAiB;;;;;;;;CAS1B,AAAQ,QAAgE,EAAE;CAE1E,YAAY,QAAyB;AACnC,QAAM,OAAO;AACb,OAAK,SAAS;AACd,MAAI,OAAO,mBAAmB;AAC5B,QAAK,QAAQ,EAAE,OAAO,KAAK,eAAe,OAAO,kBAAkB,EAAE;AACrE,UAAO,KACL,yKACA,OAAO,kBAAkB,aAAa,MACvC;;;CAIL,AAAQ,eACN,KACA;EACA,MAAM,WAAW,IAAI,aAAa;AAClC,SAAO,WAAW;GAChB,aAAa,WACT,iNACA;GACJ,QAAQ,EAAE,OAAO;IACf,MAAM,EACH,QAAQ,CACR,SACC,6DACD;IACH,QAAQ,EACL,MAAM,EAAE,SAAS,CAAC,CAClB,UAAU,CACV,SAAS,iDAAiD;IAC9D,CAAC;GACF,aAAa;IACX,QAAQ,WAAW,SAAS;IAC5B,YAAY;IACZ,qBAAqB;IACtB;GACD,SAAS,OAAO,MAAM,WAAW;AAQ/B,YAAQ,gBAAgB;AACxB,QAAI,UAAU;AACZ,uBAAkB,KAAK,KAAK;AAC5B,YAAO,KAAK,qBAAqB,KAAK,MAAM,KAAK,OAAO;;AAG1D,YADe,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,EACzC;;GAEjB,CAAC;;CAGJ,gBAAuC;AACrC,SAAO,kBAAkB,KAAK,MAAM;;CAGtC,MAAM,iBACJ,MACA,MACA,QACkB;AAClB,SAAO,oBAAoB,KAAK,OAAO,MAAM,MAAM,OAAO;;CAG5D,QAAQ,MAAwD;AAC9D,SAAO,oBAAoB,KAAK,MAAM,KAAK,OAAO,KAAK;;;;;;CAOzD,AAAQ,mBAAmB;AACzB,0BAAwB,WAAW;EACnC,MAAM,MAAM,kBAAkB;AAC9B,MAAI,KAAK;GACP,MAAM,OAAO,IAAI,UAAU,aAAa,IAAI,UAAU;AACtD,UAAO;IACL,GAAG,KAAK,OAAO;IACf,iBAAiB,IAAI,OAAO,yBAAyB;IACrD;IACD;;AAEH,SAAO,KAAK,OAAO;;;;;;;;;;;;CAarB,UAAU;AACR,SAAO;GAEL,MAAM,KAAK;GACX,OAAO,KAAK,MAAM,KAAK,KAAK;GAC5B,oBAAoB,qBAAqB,KAAK,kBAAkB,CAAC;GACjE,mBAAmB,oBAAoB,KAAK,kBAAkB,CAAC;GAChE;;;;;;AAOL,MAAa,WAAW,SAAS,eAAe"}

package/dist/plugins/server/client-config-sanitizer.js

@@ -1,4 +1,5 @@
 import { createLogger } from "../../logging/logger.js";
+import { isPlainObject } from "../../utils/is-plain-object.js";
 import pc from "picocolors";
 
 //#region src/plugins/server/client-config-sanitizer.ts
@@ -47,10 +48,6 @@ function isSecretCoveredByPublicValue(value, envValue, publicValues) {
 	if (publicRanges.length === 0) return false;
 	return getMatchRanges(value, envValue).every(([secretStart, secretEnd]) => publicRanges.some(([publicStart, publicEnd]) => publicStart <= secretStart && publicEnd >= secretEnd));
 }
-function isPlainObject(value) {
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
 function invalidClientConfig(pluginName, path, message) {
 	return /* @__PURE__ */ new Error(`Plugin '${pluginName}' clientConfig() ${message} at ${path}. Only JSON-serializable plain data is supported.`);
 }

package/dist/plugins/server/client-config-sanitizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-config-sanitizer.js","names":[],"sources":["../../../src/plugins/server/client-config-sanitizer.ts"],"sourcesContent":["import pc from \"picocolors\";\n\nimport { createLogger } from \"../../logging/logger\";\n\nconst logger = createLogger(\"server:config\");\n\nconst REDACTED_CLIENT_CONFIG_VALUE = \"[redacted by appkit]\";\nconst MIN_SUBSTRING_LENGTH = 3;\nconst DISALLOWED_CLIENT_CONFIG_KEYS = new Set([\n  \"__proto__\",\n  \"constructor\",\n  \"prototype\",\n]);\n\n/**\n * Builds a Map of non-public env var values (value -> key names)\n * and a Set of public env var values for overlap resolution.\n */\nfunction getEnvValueSets(): {\n  nonPublic: Map<string, string[]>;\n  publicValues: Set<string>;\n} {\n  const nonPublic = new Map<string, string[]>();\n  const publicValues = new Set<string>();\n  for (const [key, value] of Object.entries(process.env)) {\n    if (!value) continue;\n    if (key.startsWith(\"PUBLIC_APPKIT_\")) {\n      publicValues.add(value);\n    } else {\n      const existing = nonPublic.get(value);\n      if (existing) {\n        existing.push(key);\n      } else {\n        nonPublic.set(value, [key]);\n      }\n    }\n  }\n  return { nonPublic, publicValues };\n}\n\nfunction getMatchRanges(\n  haystack: string,\n  needle: string,\n): Array<[number, number]> {\n  const ranges: Array<[number, number]> = [];\n  let startIndex = 0;\n\n  while (startIndex < haystack.length) {\n    const matchIndex = haystack.indexOf(needle, startIndex);\n    if (matchIndex === -1) {\n      break;\n    }\n    ranges.push([matchIndex, matchIndex + needle.length]);\n    startIndex = matchIndex + 1;\n  }\n\n  return ranges;\n}\n\nfunction isSecretCoveredByPublicValue(\n  value: string,\n  envValue: string,\n  publicValues: Set<string>,\n): boolean {\n  const publicRanges = [...publicValues]\n    .filter((publicValue) => publicValue.includes(envValue))\n    .flatMap((publicValue) => getMatchRanges(value, publicValue));\n\n  if (publicRanges.length === 0) {\n    return false;\n  }\n\n  return getMatchRanges(value, envValue).every(([secretStart, secretEnd]) =>\n    publicRanges.some(\n      ([publicStart, publicEnd]) =>\n        publicStart <= secretStart && publicEnd >= secretEnd,\n    ),\n  );\n}\n\nfunction isPlainObject(value: object): boolean {\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n\nfunction invalidClientConfig(\n  pluginName: string,\n  path: string,\n  message: string,\n): Error {\n  return new Error(\n    `Plugin '${pluginName}' clientConfig() ${message} at ${path}. Only JSON-serializable plain data is supported.`,\n  );\n}\n\nfunction assertSafeClientConfigKey(\n  pluginName: string,\n  key: string,\n  path: string,\n): void {\n  if (DISALLOWED_CLIENT_CONFIG_KEYS.has(key)) {\n    throw invalidClientConfig(\n      pluginName,\n      `${path}.${key}`,\n      \"contains a reserved key\",\n    );\n  }\n}\n\nfunction validateClientConfigValue(\n  pluginName: string,\n  value: unknown,\n  path: string,\n  stack: WeakSet<object>,\n): unknown {\n  if (value === null) return null;\n\n  switch (typeof value) {\n    case \"string\":\n    case \"boolean\":\n      return value;\n    case \"number\":\n      if (!Number.isFinite(value)) {\n        throw invalidClientConfig(\n          pluginName,\n          path,\n          \"contains a non-finite number\",\n        );\n      }\n      return value;\n    case \"bigint\":\n      throw invalidClientConfig(pluginName, path, \"contains a BigInt\");\n    case \"undefined\":\n      return undefined;\n    case \"function\":\n      throw invalidClientConfig(pluginName, path, \"contains a function\");\n    case \"symbol\":\n      throw invalidClientConfig(pluginName, path, \"contains a symbol\");\n  }\n\n  if (Array.isArray(value)) {\n    if (stack.has(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a circular reference\",\n      );\n    }\n\n    stack.add(value);\n    const result = value.map(\n      (item, index) =>\n        validateClientConfigValue(\n          pluginName,\n          item,\n          `${path}[${index}]`,\n          stack,\n        ) ?? null,\n    );\n    stack.delete(value);\n    return result;\n  }\n\n  if (typeof value === \"object\") {\n    if (!isPlainObject(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a non-plain object\",\n      );\n    }\n    if (stack.has(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a circular reference\",\n      );\n    }\n\n    stack.add(value);\n    const result: Record<string, unknown> = {};\n    for (const [key, nestedValue] of Object.entries(value)) {\n      assertSafeClientConfigKey(pluginName, key, path);\n      const normalizedValue = validateClientConfigValue(\n        pluginName,\n        nestedValue,\n        `${path}.${key}`,\n        stack,\n      );\n      if (normalizedValue !== undefined) {\n        result[key] = normalizedValue;\n      }\n    }\n    stack.delete(value);\n    return result;\n  }\n\n  throw invalidClientConfig(pluginName, path, \"contains an unsupported value\");\n}\n\nfunction validateClientConfig(\n  pluginName: string,\n  config: unknown,\n): Record<string, unknown> {\n  if (config === null || typeof config !== \"object\" || Array.isArray(config)) {\n    throw new Error(\n      `Plugin '${pluginName}' clientConfig() must return a plain object.`,\n    );\n  }\n\n  return validateClientConfigValue(\n    pluginName,\n    config,\n    \"clientConfig()\",\n    new WeakSet(),\n  ) as Record<string, unknown>;\n}\n\n/**\n * Redacts a string when it contains a non-public env var value. Exact matches\n * are caught regardless of length; substring containment requires the env value\n * to be at least MIN_SUBSTRING_LENGTH chars to avoid false positives from very\n * short values.\n */\nfunction redactLeakedString(\n  value: string,\n  nonPublicValues: Map<string, string[]>,\n  publicValues: Set<string>,\n  leakedVars: Set<string>,\n): string {\n  for (const [envValue, envKeys] of nonPublicValues) {\n    if (value === envValue && !publicValues.has(envValue)) {\n      for (const k of envKeys) leakedVars.add(k);\n      return REDACTED_CLIENT_CONFIG_VALUE;\n    }\n    if (\n      envValue.length >= MIN_SUBSTRING_LENGTH &&\n      value.includes(envValue) &&\n      !isSecretCoveredByPublicValue(value, envValue, publicValues)\n    ) {\n      for (const k of envKeys) leakedVars.add(k);\n      return REDACTED_CLIENT_CONFIG_VALUE;\n    }\n  }\n\n  return value;\n}\n\nfunction redactLeakedValues(\n  obj: unknown,\n  nonPublicValues: Map<string, string[]>,\n  publicValues: Set<string>,\n  leakedVars: Set<string>,\n): unknown {\n  if (typeof obj === \"string\") {\n    return redactLeakedString(obj, nonPublicValues, publicValues, leakedVars);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) =>\n      redactLeakedValues(item, nonPublicValues, publicValues, leakedVars),\n    );\n  }\n\n  if (obj !== null && typeof obj === \"object\") {\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(obj)) {\n      const redactedKey = redactLeakedString(\n        key,\n        nonPublicValues,\n        publicValues,\n        leakedVars,\n      );\n      const uniqueKey = getUniqueObjectKey(redactedKey, result);\n      result[uniqueKey] = redactLeakedValues(\n        value,\n        nonPublicValues,\n        publicValues,\n        leakedVars,\n      );\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction getUniqueObjectKey(\n  key: string,\n  result: Record<string, unknown>,\n): string {\n  if (!Object.hasOwn(result, key)) {\n    return key;\n  }\n\n  let suffix = 2;\n  let candidate = `${key} (${suffix})`;\n  while (Object.hasOwn(result, candidate)) {\n    suffix += 1;\n    candidate = `${key} (${suffix})`;\n  }\n\n  return candidate;\n}\n\n/**\n * Scans a plugin's clientConfig return value for string values that\n * match or contain non-public environment variable values. Matches are\n * replaced with \"[redacted by appkit]\" and a warning is logged.\n *\n * Only env vars prefixed with `PUBLIC_APPKIT_` are allowed through;\n * all other process.env values are treated as sensitive.\n */\nexport function sanitizeClientConfig(\n  pluginName: string,\n  config: unknown,\n): Record<string, unknown> {\n  const validated = validateClientConfig(pluginName, config);\n  const { nonPublic, publicValues } = getEnvValueSets();\n  if (nonPublic.size === 0) return validated;\n\n  const leakedVars = new Set<string>();\n  const sanitized = redactLeakedValues(\n    validated,\n    nonPublic,\n    publicValues,\n    leakedVars,\n  ) as Record<string, unknown>;\n\n  if (leakedVars.size > 0) {\n    const banner = formatLeakedVarsBanner(pluginName, leakedVars);\n    logger.warn(\"\\n\\n%s\\n\", banner);\n  }\n\n  return sanitized;\n}\n\nfunction formatLeakedVarsBanner(\n  pluginName: string,\n  leakedVars: Set<string>,\n): string {\n  const s = leakedVars.size === 1 ? \"\" : \"s\";\n  const contentLines: string[] = [\n    `${pc.bold(pluginName)}.clientConfig() contained ${pc.bold(String(leakedVars.size))} env var value${s}`,\n    `that would have been sent to the browser. AppKit ${pc.green(\"redacted\")} them automatically.`,\n    \"\",\n    ...Array.from(leakedVars, (v) => `  ${pc.red(\"-\")} ${pc.yellow(v)}`),\n    \"\",\n    `To intentionally expose a value, set a matching ${pc.green(\"PUBLIC_APPKIT_\")} variable.`,\n    `Example: ${pc.dim('PUBLIC_APPKIT_MY_VAR=\"safe-value\"')}`,\n  ];\n\n  // oxlint-disable-next-line no-control-regex -- stripping ANSI escape sequences requires matching the ESC control character\n  const stripAnsi = (str: string) => str.replace(/\\x1b\\[[0-9;]*m/g, \"\");\n  const maxLen = Math.max(...contentLines.map((l) => stripAnsi(l).length));\n  const border = pc.yellow(\"=\".repeat(maxLen + 4));\n  const boxed = contentLines.map(\n    (line) =>\n      `${pc.yellow(\"|\")} ${line}${\" \".repeat(maxLen - stripAnsi(line).length)} ${pc.yellow(\"|\")}`,\n  );\n\n  return [border, ...boxed, border].join(\"\\n\");\n}\n"],"mappings":";;;;AAIA,MAAM,SAAS,aAAa,gBAAgB;AAE5C,MAAM,+BAA+B;AACrC,MAAM,uBAAuB;AAC7B,MAAM,gCAAgC,IAAI,IAAI;CAC5C;CACA;CACA;CACD,CAAC;;;;;AAMF,SAAS,kBAGP;CACA,MAAM,4BAAY,IAAI,KAAuB;CAC7C,MAAM,+BAAe,IAAI,KAAa;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,EAAE;AACtD,MAAI,CAAC,MAAO;AACZ,MAAI,IAAI,WAAW,iBAAiB,CAClC,cAAa,IAAI,MAAM;OAClB;GACL,MAAM,WAAW,UAAU,IAAI,MAAM;AACrC,OAAI,SACF,UAAS,KAAK,IAAI;OAElB,WAAU,IAAI,OAAO,CAAC,IAAI,CAAC;;;AAIjC,QAAO;EAAE;EAAW;EAAc;;AAGpC,SAAS,eACP,UACA,QACyB;CACzB,MAAM,SAAkC,EAAE;CAC1C,IAAI,aAAa;AAEjB,QAAO,aAAa,SAAS,QAAQ;EACnC,MAAM,aAAa,SAAS,QAAQ,QAAQ,WAAW;AACvD,MAAI,eAAe,GACjB;AAEF,SAAO,KAAK,CAAC,YAAY,aAAa,OAAO,OAAO,CAAC;AACrD,eAAa,aAAa;;AAG5B,QAAO;;AAGT,SAAS,6BACP,OACA,UACA,cACS;CACT,MAAM,eAAe,CAAC,GAAG,aAAa,CACnC,QAAQ,gBAAgB,YAAY,SAAS,SAAS,CAAC,CACvD,SAAS,gBAAgB,eAAe,OAAO,YAAY,CAAC;AAE/D,KAAI,aAAa,WAAW,EAC1B,QAAO;AAGT,QAAO,eAAe,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,eAC1D,aAAa,MACV,CAAC,aAAa,eACb,eAAe,eAAe,aAAa,UAC9C,CACF;;AAGH,SAAS,cAAc,OAAwB;CAC7C,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,QAAO,UAAU,OAAO,aAAa,UAAU;;AAGjD,SAAS,oBACP,YACA,MACA,SACO;AACP,wBAAO,IAAI,MACT,WAAW,WAAW,mBAAmB,QAAQ,MAAM,KAAK,mDAC7D;;AAGH,SAAS,0BACP,YACA,KACA,MACM;AACN,KAAI,8BAA8B,IAAI,IAAI,CACxC,OAAM,oBACJ,YACA,GAAG,KAAK,GAAG,OACX,0BACD;;AAIL,SAAS,0BACP,YACA,OACA,MACA,OACS;AACT,KAAI,UAAU,KAAM,QAAO;AAE3B,SAAQ,OAAO,OAAf;EACE,KAAK;EACL,KAAK,UACH,QAAO;EACT,KAAK;AACH,OAAI,CAAC,OAAO,SAAS,MAAM,CACzB,OAAM,oBACJ,YACA,MACA,+BACD;AAEH,UAAO;EACT,KAAK,SACH,OAAM,oBAAoB,YAAY,MAAM,oBAAoB;EAClE,KAAK,YACH;EACF,KAAK,WACH,OAAM,oBAAoB,YAAY,MAAM,sBAAsB;EACpE,KAAK,SACH,OAAM,oBAAoB,YAAY,MAAM,oBAAoB;;AAGpE,KAAI,MAAM,QAAQ,MAAM,EAAE;AACxB,MAAI,MAAM,IAAI,MAAM,CAClB,OAAM,oBACJ,YACA,MACA,gCACD;AAGH,QAAM,IAAI,MAAM;EAChB,MAAM,SAAS,MAAM,KAClB,MAAM,UACL,0BACE,YACA,MACA,GAAG,KAAK,GAAG,MAAM,IACjB,MACD,IAAI,KACR;AACD,QAAM,OAAO,MAAM;AACnB,SAAO;;AAGT,KAAI,OAAO,UAAU,UAAU;AAC7B,MAAI,CAAC,cAAc,MAAM,CACvB,OAAM,oBACJ,YACA,MACA,8BACD;AAEH,MAAI,MAAM,IAAI,MAAM,CAClB,OAAM,oBACJ,YACA,MACA,gCACD;AAGH,QAAM,IAAI,MAAM;EAChB,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,MAAM,EAAE;AACtD,6BAA0B,YAAY,KAAK,KAAK;GAChD,MAAM,kBAAkB,0BACtB,YACA,aACA,GAAG,KAAK,GAAG,OACX,MACD;AACD,OAAI,oBAAoB,OACtB,QAAO,OAAO;;AAGlB,QAAM,OAAO,MAAM;AACnB,SAAO;;AAGT,OAAM,oBAAoB,YAAY,MAAM,gCAAgC;;AAG9E,SAAS,qBACP,YACA,QACyB;AACzB,KAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,OAAO,CACxE,OAAM,IAAI,MACR,WAAW,WAAW,8CACvB;AAGH,QAAO,0BACL,YACA,QACA,kCACA,IAAI,SAAS,CACd;;;;;;;;AASH,SAAS,mBACP,OACA,iBACA,cACA,YACQ;AACR,MAAK,MAAM,CAAC,UAAU,YAAY,iBAAiB;AACjD,MAAI,UAAU,YAAY,CAAC,aAAa,IAAI,SAAS,EAAE;AACrD,QAAK,MAAM,KAAK,QAAS,YAAW,IAAI,EAAE;AAC1C,UAAO;;AAET,MACE,SAAS,UAAU,wBACnB,MAAM,SAAS,SAAS,IACxB,CAAC,6BAA6B,OAAO,UAAU,aAAa,EAC5D;AACA,QAAK,MAAM,KAAK,QAAS,YAAW,IAAI,EAAE;AAC1C,UAAO;;;AAIX,QAAO;;AAGT,SAAS,mBACP,KACA,iBACA,cACA,YACS;AACT,KAAI,OAAO,QAAQ,SACjB,QAAO,mBAAmB,KAAK,iBAAiB,cAAc,WAAW;AAG3E,KAAI,MAAM,QAAQ,IAAI,CACpB,QAAO,IAAI,KAAK,SACd,mBAAmB,MAAM,iBAAiB,cAAc,WAAW,CACpE;AAGH,KAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAO9C,MAAM,YAAY,mBANE,mBAClB,KACA,iBACA,cACA,WACD,EACiD,OAAO;AACzD,UAAO,aAAa,mBAClB,OACA,iBACA,cACA,WACD;;AAEH,SAAO;;AAGT,QAAO;;AAGT,SAAS,mBACP,KACA,QACQ;AACR,KAAI,CAAC,OAAO,OAAO,QAAQ,IAAI,CAC7B,QAAO;CAGT,IAAI,SAAS;CACb,IAAI,YAAY,GAAG,IAAI,IAAI,OAAO;AAClC,QAAO,OAAO,OAAO,QAAQ,UAAU,EAAE;AACvC,YAAU;AACV,cAAY,GAAG,IAAI,IAAI,OAAO;;AAGhC,QAAO;;;;;;;;;;AAWT,SAAgB,qBACd,YACA,QACyB;CACzB,MAAM,YAAY,qBAAqB,YAAY,OAAO;CAC1D,MAAM,EAAE,WAAW,iBAAiB,iBAAiB;AACrD,KAAI,UAAU,SAAS,EAAG,QAAO;CAEjC,MAAM,6BAAa,IAAI,KAAa;CACpC,MAAM,YAAY,mBAChB,WACA,WACA,cACA,WACD;AAED,KAAI,WAAW,OAAO,GAAG;EACvB,MAAM,SAAS,uBAAuB,YAAY,WAAW;AAC7D,SAAO,KAAK,YAAY,OAAO;;AAGjC,QAAO;;AAGT,SAAS,uBACP,YACA,YACQ;CACR,MAAM,IAAI,WAAW,SAAS,IAAI,KAAK;CACvC,MAAM,eAAyB;EAC7B,GAAG,GAAG,KAAK,WAAW,CAAC,4BAA4B,GAAG,KAAK,OAAO,WAAW,KAAK,CAAC,CAAC,gBAAgB;EACpG,oDAAoD,GAAG,MAAM,WAAW,CAAC;EACzE;EACA,GAAG,MAAM,KAAK,aAAa,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG;EACpE;EACA,mDAAmD,GAAG,MAAM,iBAAiB,CAAC;EAC9E,YAAY,GAAG,IAAI,sCAAoC;EACxD;CAGD,MAAM,aAAa,QAAgB,IAAI,QAAQ,mBAAmB,GAAG;CACrE,MAAM,SAAS,KAAK,IAAI,GAAG,aAAa,KAAK,MAAM,UAAU,EAAE,CAAC,OAAO,CAAC;CACxE,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,SAAS,EAAE,CAAC;AAMhD,QAAO;EAAC;EAAQ,GALF,aAAa,KACxB,SACC,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,IAAI,GAC5F;EAEyB;EAAO,CAAC,KAAK,KAAK"}
+{"version":3,"file":"client-config-sanitizer.js","names":[],"sources":["../../../src/plugins/server/client-config-sanitizer.ts"],"sourcesContent":["import pc from \"picocolors\";\n\nimport { createLogger } from \"../../logging/logger\";\nimport { isPlainObject } from \"../../utils/is-plain-object\";\n\nconst logger = createLogger(\"server:config\");\n\nconst REDACTED_CLIENT_CONFIG_VALUE = \"[redacted by appkit]\";\nconst MIN_SUBSTRING_LENGTH = 3;\nconst DISALLOWED_CLIENT_CONFIG_KEYS = new Set([\n  \"__proto__\",\n  \"constructor\",\n  \"prototype\",\n]);\n\n/**\n * Builds a Map of non-public env var values (value -> key names)\n * and a Set of public env var values for overlap resolution.\n */\nfunction getEnvValueSets(): {\n  nonPublic: Map<string, string[]>;\n  publicValues: Set<string>;\n} {\n  const nonPublic = new Map<string, string[]>();\n  const publicValues = new Set<string>();\n  for (const [key, value] of Object.entries(process.env)) {\n    if (!value) continue;\n    if (key.startsWith(\"PUBLIC_APPKIT_\")) {\n      publicValues.add(value);\n    } else {\n      const existing = nonPublic.get(value);\n      if (existing) {\n        existing.push(key);\n      } else {\n        nonPublic.set(value, [key]);\n      }\n    }\n  }\n  return { nonPublic, publicValues };\n}\n\nfunction getMatchRanges(\n  haystack: string,\n  needle: string,\n): Array<[number, number]> {\n  const ranges: Array<[number, number]> = [];\n  let startIndex = 0;\n\n  while (startIndex < haystack.length) {\n    const matchIndex = haystack.indexOf(needle, startIndex);\n    if (matchIndex === -1) {\n      break;\n    }\n    ranges.push([matchIndex, matchIndex + needle.length]);\n    startIndex = matchIndex + 1;\n  }\n\n  return ranges;\n}\n\nfunction isSecretCoveredByPublicValue(\n  value: string,\n  envValue: string,\n  publicValues: Set<string>,\n): boolean {\n  const publicRanges = [...publicValues]\n    .filter((publicValue) => publicValue.includes(envValue))\n    .flatMap((publicValue) => getMatchRanges(value, publicValue));\n\n  if (publicRanges.length === 0) {\n    return false;\n  }\n\n  return getMatchRanges(value, envValue).every(([secretStart, secretEnd]) =>\n    publicRanges.some(\n      ([publicStart, publicEnd]) =>\n        publicStart <= secretStart && publicEnd >= secretEnd,\n    ),\n  );\n}\n\nfunction invalidClientConfig(\n  pluginName: string,\n  path: string,\n  message: string,\n): Error {\n  return new Error(\n    `Plugin '${pluginName}' clientConfig() ${message} at ${path}. Only JSON-serializable plain data is supported.`,\n  );\n}\n\nfunction assertSafeClientConfigKey(\n  pluginName: string,\n  key: string,\n  path: string,\n): void {\n  if (DISALLOWED_CLIENT_CONFIG_KEYS.has(key)) {\n    throw invalidClientConfig(\n      pluginName,\n      `${path}.${key}`,\n      \"contains a reserved key\",\n    );\n  }\n}\n\nfunction validateClientConfigValue(\n  pluginName: string,\n  value: unknown,\n  path: string,\n  stack: WeakSet<object>,\n): unknown {\n  if (value === null) return null;\n\n  switch (typeof value) {\n    case \"string\":\n    case \"boolean\":\n      return value;\n    case \"number\":\n      if (!Number.isFinite(value)) {\n        throw invalidClientConfig(\n          pluginName,\n          path,\n          \"contains a non-finite number\",\n        );\n      }\n      return value;\n    case \"bigint\":\n      throw invalidClientConfig(pluginName, path, \"contains a BigInt\");\n    case \"undefined\":\n      return undefined;\n    case \"function\":\n      throw invalidClientConfig(pluginName, path, \"contains a function\");\n    case \"symbol\":\n      throw invalidClientConfig(pluginName, path, \"contains a symbol\");\n  }\n\n  if (Array.isArray(value)) {\n    if (stack.has(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a circular reference\",\n      );\n    }\n\n    stack.add(value);\n    const result = value.map(\n      (item, index) =>\n        validateClientConfigValue(\n          pluginName,\n          item,\n          `${path}[${index}]`,\n          stack,\n        ) ?? null,\n    );\n    stack.delete(value);\n    return result;\n  }\n\n  if (typeof value === \"object\") {\n    if (!isPlainObject(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a non-plain object\",\n      );\n    }\n    if (stack.has(value)) {\n      throw invalidClientConfig(\n        pluginName,\n        path,\n        \"contains a circular reference\",\n      );\n    }\n\n    stack.add(value);\n    const result: Record<string, unknown> = {};\n    for (const [key, nestedValue] of Object.entries(value)) {\n      assertSafeClientConfigKey(pluginName, key, path);\n      const normalizedValue = validateClientConfigValue(\n        pluginName,\n        nestedValue,\n        `${path}.${key}`,\n        stack,\n      );\n      if (normalizedValue !== undefined) {\n        result[key] = normalizedValue;\n      }\n    }\n    stack.delete(value);\n    return result;\n  }\n\n  throw invalidClientConfig(pluginName, path, \"contains an unsupported value\");\n}\n\nfunction validateClientConfig(\n  pluginName: string,\n  config: unknown,\n): Record<string, unknown> {\n  if (config === null || typeof config !== \"object\" || Array.isArray(config)) {\n    throw new Error(\n      `Plugin '${pluginName}' clientConfig() must return a plain object.`,\n    );\n  }\n\n  return validateClientConfigValue(\n    pluginName,\n    config,\n    \"clientConfig()\",\n    new WeakSet(),\n  ) as Record<string, unknown>;\n}\n\n/**\n * Redacts a string when it contains a non-public env var value. Exact matches\n * are caught regardless of length; substring containment requires the env value\n * to be at least MIN_SUBSTRING_LENGTH chars to avoid false positives from very\n * short values.\n */\nfunction redactLeakedString(\n  value: string,\n  nonPublicValues: Map<string, string[]>,\n  publicValues: Set<string>,\n  leakedVars: Set<string>,\n): string {\n  for (const [envValue, envKeys] of nonPublicValues) {\n    if (value === envValue && !publicValues.has(envValue)) {\n      for (const k of envKeys) leakedVars.add(k);\n      return REDACTED_CLIENT_CONFIG_VALUE;\n    }\n    if (\n      envValue.length >= MIN_SUBSTRING_LENGTH &&\n      value.includes(envValue) &&\n      !isSecretCoveredByPublicValue(value, envValue, publicValues)\n    ) {\n      for (const k of envKeys) leakedVars.add(k);\n      return REDACTED_CLIENT_CONFIG_VALUE;\n    }\n  }\n\n  return value;\n}\n\nfunction redactLeakedValues(\n  obj: unknown,\n  nonPublicValues: Map<string, string[]>,\n  publicValues: Set<string>,\n  leakedVars: Set<string>,\n): unknown {\n  if (typeof obj === \"string\") {\n    return redactLeakedString(obj, nonPublicValues, publicValues, leakedVars);\n  }\n\n  if (Array.isArray(obj)) {\n    return obj.map((item) =>\n      redactLeakedValues(item, nonPublicValues, publicValues, leakedVars),\n    );\n  }\n\n  if (obj !== null && typeof obj === \"object\") {\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(obj)) {\n      const redactedKey = redactLeakedString(\n        key,\n        nonPublicValues,\n        publicValues,\n        leakedVars,\n      );\n      const uniqueKey = getUniqueObjectKey(redactedKey, result);\n      result[uniqueKey] = redactLeakedValues(\n        value,\n        nonPublicValues,\n        publicValues,\n        leakedVars,\n      );\n    }\n    return result;\n  }\n\n  return obj;\n}\n\nfunction getUniqueObjectKey(\n  key: string,\n  result: Record<string, unknown>,\n): string {\n  if (!Object.hasOwn(result, key)) {\n    return key;\n  }\n\n  let suffix = 2;\n  let candidate = `${key} (${suffix})`;\n  while (Object.hasOwn(result, candidate)) {\n    suffix += 1;\n    candidate = `${key} (${suffix})`;\n  }\n\n  return candidate;\n}\n\n/**\n * Scans a plugin's clientConfig return value for string values that\n * match or contain non-public environment variable values. Matches are\n * replaced with \"[redacted by appkit]\" and a warning is logged.\n *\n * Only env vars prefixed with `PUBLIC_APPKIT_` are allowed through;\n * all other process.env values are treated as sensitive.\n */\nexport function sanitizeClientConfig(\n  pluginName: string,\n  config: unknown,\n): Record<string, unknown> {\n  const validated = validateClientConfig(pluginName, config);\n  const { nonPublic, publicValues } = getEnvValueSets();\n  if (nonPublic.size === 0) return validated;\n\n  const leakedVars = new Set<string>();\n  const sanitized = redactLeakedValues(\n    validated,\n    nonPublic,\n    publicValues,\n    leakedVars,\n  ) as Record<string, unknown>;\n\n  if (leakedVars.size > 0) {\n    const banner = formatLeakedVarsBanner(pluginName, leakedVars);\n    logger.warn(\"\\n\\n%s\\n\", banner);\n  }\n\n  return sanitized;\n}\n\nfunction formatLeakedVarsBanner(\n  pluginName: string,\n  leakedVars: Set<string>,\n): string {\n  const s = leakedVars.size === 1 ? \"\" : \"s\";\n  const contentLines: string[] = [\n    `${pc.bold(pluginName)}.clientConfig() contained ${pc.bold(String(leakedVars.size))} env var value${s}`,\n    `that would have been sent to the browser. AppKit ${pc.green(\"redacted\")} them automatically.`,\n    \"\",\n    ...Array.from(leakedVars, (v) => `  ${pc.red(\"-\")} ${pc.yellow(v)}`),\n    \"\",\n    `To intentionally expose a value, set a matching ${pc.green(\"PUBLIC_APPKIT_\")} variable.`,\n    `Example: ${pc.dim('PUBLIC_APPKIT_MY_VAR=\"safe-value\"')}`,\n  ];\n\n  // oxlint-disable-next-line no-control-regex -- stripping ANSI escape sequences requires matching the ESC control character\n  const stripAnsi = (str: string) => str.replace(/\\x1b\\[[0-9;]*m/g, \"\");\n  const maxLen = Math.max(...contentLines.map((l) => stripAnsi(l).length));\n  const border = pc.yellow(\"=\".repeat(maxLen + 4));\n  const boxed = contentLines.map(\n    (line) =>\n      `${pc.yellow(\"|\")} ${line}${\" \".repeat(maxLen - stripAnsi(line).length)} ${pc.yellow(\"|\")}`,\n  );\n\n  return [border, ...boxed, border].join(\"\\n\");\n}\n"],"mappings":";;;;;AAKA,MAAM,SAAS,aAAa,gBAAgB;AAE5C,MAAM,+BAA+B;AACrC,MAAM,uBAAuB;AAC7B,MAAM,gCAAgC,IAAI,IAAI;CAC5C;CACA;CACA;CACD,CAAC;;;;;AAMF,SAAS,kBAGP;CACA,MAAM,4BAAY,IAAI,KAAuB;CAC7C,MAAM,+BAAe,IAAI,KAAa;AACtC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,EAAE;AACtD,MAAI,CAAC,MAAO;AACZ,MAAI,IAAI,WAAW,iBAAiB,CAClC,cAAa,IAAI,MAAM;OAClB;GACL,MAAM,WAAW,UAAU,IAAI,MAAM;AACrC,OAAI,SACF,UAAS,KAAK,IAAI;OAElB,WAAU,IAAI,OAAO,CAAC,IAAI,CAAC;;;AAIjC,QAAO;EAAE;EAAW;EAAc;;AAGpC,SAAS,eACP,UACA,QACyB;CACzB,MAAM,SAAkC,EAAE;CAC1C,IAAI,aAAa;AAEjB,QAAO,aAAa,SAAS,QAAQ;EACnC,MAAM,aAAa,SAAS,QAAQ,QAAQ,WAAW;AACvD,MAAI,eAAe,GACjB;AAEF,SAAO,KAAK,CAAC,YAAY,aAAa,OAAO,OAAO,CAAC;AACrD,eAAa,aAAa;;AAG5B,QAAO;;AAGT,SAAS,6BACP,OACA,UACA,cACS;CACT,MAAM,eAAe,CAAC,GAAG,aAAa,CACnC,QAAQ,gBAAgB,YAAY,SAAS,SAAS,CAAC,CACvD,SAAS,gBAAgB,eAAe,OAAO,YAAY,CAAC;AAE/D,KAAI,aAAa,WAAW,EAC1B,QAAO;AAGT,QAAO,eAAe,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,eAC1D,aAAa,MACV,CAAC,aAAa,eACb,eAAe,eAAe,aAAa,UAC9C,CACF;;AAGH,SAAS,oBACP,YACA,MACA,SACO;AACP,wBAAO,IAAI,MACT,WAAW,WAAW,mBAAmB,QAAQ,MAAM,KAAK,mDAC7D;;AAGH,SAAS,0BACP,YACA,KACA,MACM;AACN,KAAI,8BAA8B,IAAI,IAAI,CACxC,OAAM,oBACJ,YACA,GAAG,KAAK,GAAG,OACX,0BACD;;AAIL,SAAS,0BACP,YACA,OACA,MACA,OACS;AACT,KAAI,UAAU,KAAM,QAAO;AAE3B,SAAQ,OAAO,OAAf;EACE,KAAK;EACL,KAAK,UACH,QAAO;EACT,KAAK;AACH,OAAI,CAAC,OAAO,SAAS,MAAM,CACzB,OAAM,oBACJ,YACA,MACA,+BACD;AAEH,UAAO;EACT,KAAK,SACH,OAAM,oBAAoB,YAAY,MAAM,oBAAoB;EAClE,KAAK,YACH;EACF,KAAK,WACH,OAAM,oBAAoB,YAAY,MAAM,sBAAsB;EACpE,KAAK,SACH,OAAM,oBAAoB,YAAY,MAAM,oBAAoB;;AAGpE,KAAI,MAAM,QAAQ,MAAM,EAAE;AACxB,MAAI,MAAM,IAAI,MAAM,CAClB,OAAM,oBACJ,YACA,MACA,gCACD;AAGH,QAAM,IAAI,MAAM;EAChB,MAAM,SAAS,MAAM,KAClB,MAAM,UACL,0BACE,YACA,MACA,GAAG,KAAK,GAAG,MAAM,IACjB,MACD,IAAI,KACR;AACD,QAAM,OAAO,MAAM;AACnB,SAAO;;AAGT,KAAI,OAAO,UAAU,UAAU;AAC7B,MAAI,CAAC,cAAc,MAAM,CACvB,OAAM,oBACJ,YACA,MACA,8BACD;AAEH,MAAI,MAAM,IAAI,MAAM,CAClB,OAAM,oBACJ,YACA,MACA,gCACD;AAGH,QAAM,IAAI,MAAM;EAChB,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,MAAM,EAAE;AACtD,6BAA0B,YAAY,KAAK,KAAK;GAChD,MAAM,kBAAkB,0BACtB,YACA,aACA,GAAG,KAAK,GAAG,OACX,MACD;AACD,OAAI,oBAAoB,OACtB,QAAO,OAAO;;AAGlB,QAAM,OAAO,MAAM;AACnB,SAAO;;AAGT,OAAM,oBAAoB,YAAY,MAAM,gCAAgC;;AAG9E,SAAS,qBACP,YACA,QACyB;AACzB,KAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,OAAO,CACxE,OAAM,IAAI,MACR,WAAW,WAAW,8CACvB;AAGH,QAAO,0BACL,YACA,QACA,kCACA,IAAI,SAAS,CACd;;;;;;;;AASH,SAAS,mBACP,OACA,iBACA,cACA,YACQ;AACR,MAAK,MAAM,CAAC,UAAU,YAAY,iBAAiB;AACjD,MAAI,UAAU,YAAY,CAAC,aAAa,IAAI,SAAS,EAAE;AACrD,QAAK,MAAM,KAAK,QAAS,YAAW,IAAI,EAAE;AAC1C,UAAO;;AAET,MACE,SAAS,UAAU,wBACnB,MAAM,SAAS,SAAS,IACxB,CAAC,6BAA6B,OAAO,UAAU,aAAa,EAC5D;AACA,QAAK,MAAM,KAAK,QAAS,YAAW,IAAI,EAAE;AAC1C,UAAO;;;AAIX,QAAO;;AAGT,SAAS,mBACP,KACA,iBACA,cACA,YACS;AACT,KAAI,OAAO,QAAQ,SACjB,QAAO,mBAAmB,KAAK,iBAAiB,cAAc,WAAW;AAG3E,KAAI,MAAM,QAAQ,IAAI,CACpB,QAAO,IAAI,KAAK,SACd,mBAAmB,MAAM,iBAAiB,cAAc,WAAW,CACpE;AAGH,KAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAO9C,MAAM,YAAY,mBANE,mBAClB,KACA,iBACA,cACA,WACD,EACiD,OAAO;AACzD,UAAO,aAAa,mBAClB,OACA,iBACA,cACA,WACD;;AAEH,SAAO;;AAGT,QAAO;;AAGT,SAAS,mBACP,KACA,QACQ;AACR,KAAI,CAAC,OAAO,OAAO,QAAQ,IAAI,CAC7B,QAAO;CAGT,IAAI,SAAS;CACb,IAAI,YAAY,GAAG,IAAI,IAAI,OAAO;AAClC,QAAO,OAAO,OAAO,QAAQ,UAAU,EAAE;AACvC,YAAU;AACV,cAAY,GAAG,IAAI,IAAI,OAAO;;AAGhC,QAAO;;;;;;;;;;AAWT,SAAgB,qBACd,YACA,QACyB;CACzB,MAAM,YAAY,qBAAqB,YAAY,OAAO;CAC1D,MAAM,EAAE,WAAW,iBAAiB,iBAAiB;AACrD,KAAI,UAAU,SAAS,EAAG,QAAO;CAEjC,MAAM,6BAAa,IAAI,KAAa;CACpC,MAAM,YAAY,mBAChB,WACA,WACA,cACA,WACD;AAED,KAAI,WAAW,OAAO,GAAG;EACvB,MAAM,SAAS,uBAAuB,YAAY,WAAW;AAC7D,SAAO,KAAK,YAAY,OAAO;;AAGjC,QAAO;;AAGT,SAAS,uBACP,YACA,YACQ;CACR,MAAM,IAAI,WAAW,SAAS,IAAI,KAAK;CACvC,MAAM,eAAyB;EAC7B,GAAG,GAAG,KAAK,WAAW,CAAC,4BAA4B,GAAG,KAAK,OAAO,WAAW,KAAK,CAAC,CAAC,gBAAgB;EACpG,oDAAoD,GAAG,MAAM,WAAW,CAAC;EACzE;EACA,GAAG,MAAM,KAAK,aAAa,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG;EACpE;EACA,mDAAmD,GAAG,MAAM,iBAAiB,CAAC;EAC9E,YAAY,GAAG,IAAI,sCAAoC;EACxD;CAGD,MAAM,aAAa,QAAgB,IAAI,QAAQ,mBAAmB,GAAG;CACrE,MAAM,SAAS,KAAK,IAAI,GAAG,aAAa,KAAK,MAAM,UAAU,EAAE,CAAC,OAAO,CAAC;CACxE,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,SAAS,EAAE,CAAC;AAMhD,QAAO;EAAC;EAAQ,GALF,aAAa,KACxB,SACC,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,SAAS,UAAU,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,IAAI,GAC5F;EAEyB;EAAO,CAAC,KAAK,KAAK"}

package/dist/plugins/server/dev-obo-middleware.js

@@ -0,0 +1,60 @@
+import { createDevOboIdentityProvider, loadDevOboIdentityFromEnvironment } from "../../shared/src/dev-obo.js";
+import { createLogger } from "../../logging/logger.js";
+
+//#region src/plugins/server/dev-obo-middleware.ts
+const logger = createLogger("server:dev-obo");
+const loopbackHosts = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+const loopbackPeers = new Set([
+	"127.0.0.1",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
+function isLocalRequest(req) {
+	if (!loopbackPeers.has(req.socket.remoteAddress ?? "")) return false;
+	try {
+		const origin = new URL(`http://${req.headers.host}`);
+		if (!loopbackHosts.has(origin.hostname) || origin.host !== req.headers.host || Number(origin.port || 80) !== req.socket.localPort) return false;
+		if (req.headers.origin && req.headers.origin !== origin.origin) return false;
+		const site = req.headers["sec-fetch-site"];
+		return !site || site === "same-origin" || site === "none";
+	} catch {
+		return false;
+	}
+}
+/** Inject local user headers without changing the default execution principal. */
+function createDevOboMiddleware() {
+	const token = process.env.DATABRICKS_TOKEN?.trim();
+	const profile = process.env.DATABRICKS_CONFIG_PROFILE?.trim();
+	if (process.env.NODE_ENV !== "development" || process.env.APPKIT_DEV_OBO === "false" || !token && !profile) return void 0;
+	const getIdentity = createDevOboIdentityProvider(() => loadDevOboIdentityFromEnvironment());
+	logger.info(`Local OBO headers enabled using ${token ? "DATABRICKS_TOKEN" : "DATABRICKS_CONFIG_PROFILE"}. Open the app on localhost. Set APPKIT_DEV_OBO=false to disable.`);
+	return async (req, res, next) => {
+		if (req.header("x-forwarded-access-token")?.trim()) {
+			next();
+			return;
+		}
+		if (!isLocalRequest(req)) {
+			res.status(403).json({ error: "Local OBO emulation only accepts same-origin loopback requests." });
+			return;
+		}
+		try {
+			const identity = await getIdentity();
+			req.headers["x-forwarded-access-token"] = identity.token;
+			req.headers["x-forwarded-user"] = identity.userId;
+			delete req.headers["x-forwarded-email"];
+			if (identity.email) req.headers["x-forwarded-email"] = identity.email;
+		} catch {
+			res.status(401).json({ error: "Local OBO credentials unavailable. Verify DATABRICKS_TOKEN and DATABRICKS_HOST, or authenticate the user profile in DATABRICKS_CONFIG_PROFILE, then retry." });
+			return;
+		}
+		next();
+	};
+}
+
+//#endregion
+export { createDevOboMiddleware };
+//# sourceMappingURL=dev-obo-middleware.js.map

package/dist/plugins/server/dev-obo-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-obo-middleware.js","names":[],"sources":["../../../src/plugins/server/dev-obo-middleware.ts"],"sourcesContent":["import type { Request, RequestHandler } from \"express\";\nimport {\n  createDevOboIdentityProvider,\n  loadDevOboIdentityFromEnvironment,\n} from \"shared\";\n\nimport { createLogger } from \"../../logging/logger\";\n\nconst logger = createLogger(\"server:dev-obo\");\nconst loopbackHosts = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\nconst loopbackPeers = new Set([\"127.0.0.1\", \"::1\", \"::ffff:127.0.0.1\"]);\n\nfunction isLocalRequest(req: Request): boolean {\n  // Check the socket, not Express's proxy-aware IP or forwarded headers.\n  if (!loopbackPeers.has(req.socket.remoteAddress ?? \"\")) return false;\n  try {\n    const origin = new URL(`http://${req.headers.host}`);\n    if (\n      !loopbackHosts.has(origin.hostname) ||\n      origin.host !== req.headers.host ||\n      Number(origin.port || 80) !== req.socket.localPort\n    )\n      return false;\n    if (req.headers.origin && req.headers.origin !== origin.origin)\n      return false;\n    const site = req.headers[\"sec-fetch-site\"];\n    return !site || site === \"same-origin\" || site === \"none\";\n  } catch {\n    return false;\n  }\n}\n\n/** Inject local user headers without changing the default execution principal. */\nexport function createDevOboMiddleware(): RequestHandler | undefined {\n  const token = process.env.DATABRICKS_TOKEN?.trim();\n  const profile = process.env.DATABRICKS_CONFIG_PROFILE?.trim();\n  if (\n    process.env.NODE_ENV !== \"development\" ||\n    process.env.APPKIT_DEV_OBO === \"false\" ||\n    (!token && !profile)\n  )\n    return undefined;\n\n  const getIdentity = createDevOboIdentityProvider(() =>\n    loadDevOboIdentityFromEnvironment(),\n  );\n  logger.info(\n    `Local OBO headers enabled using ${token ? \"DATABRICKS_TOKEN\" : \"DATABRICKS_CONFIG_PROFILE\"}. Open the app on localhost. Set APPKIT_DEV_OBO=false to disable.`,\n  );\n\n  return async (req, res, next) => {\n    // Preserve explicit forwarded identities.\n    if (req.header(\"x-forwarded-access-token\")?.trim()) {\n      next();\n      return;\n    }\n    if (!isLocalRequest(req)) {\n      res.status(403).json({\n        error:\n          \"Local OBO emulation only accepts same-origin loopback requests.\",\n      });\n      return;\n    }\n    try {\n      const identity = await getIdentity();\n      req.headers[\"x-forwarded-access-token\"] = identity.token;\n      req.headers[\"x-forwarded-user\"] = identity.userId;\n      delete req.headers[\"x-forwarded-email\"];\n      if (identity.email) req.headers[\"x-forwarded-email\"] = identity.email;\n    } catch {\n      // Never fall back to SP or expose credential-bearing CLI errors.\n      res.status(401).json({\n        error:\n          \"Local OBO credentials unavailable. Verify DATABRICKS_TOKEN and DATABRICKS_HOST, or authenticate the user profile in DATABRICKS_CONFIG_PROFILE, then retry.\",\n      });\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;AAQA,MAAM,SAAS,aAAa,iBAAiB;AAC7C,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAQ,CAAC;AAClE,MAAM,gBAAgB,IAAI,IAAI;CAAC;CAAa;CAAO;CAAmB,CAAC;AAEvE,SAAS,eAAe,KAAuB;AAE7C,KAAI,CAAC,cAAc,IAAI,IAAI,OAAO,iBAAiB,GAAG,CAAE,QAAO;AAC/D,KAAI;EACF,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,QAAQ,OAAO;AACpD,MACE,CAAC,cAAc,IAAI,OAAO,SAAS,IACnC,OAAO,SAAS,IAAI,QAAQ,QAC5B,OAAO,OAAO,QAAQ,GAAG,KAAK,IAAI,OAAO,UAEzC,QAAO;AACT,MAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,WAAW,OAAO,OACtD,QAAO;EACT,MAAM,OAAO,IAAI,QAAQ;AACzB,SAAO,CAAC,QAAQ,SAAS,iBAAiB,SAAS;SAC7C;AACN,SAAO;;;;AAKX,SAAgB,yBAAqD;CACnE,MAAM,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;CAClD,MAAM,UAAU,QAAQ,IAAI,2BAA2B,MAAM;AAC7D,KACE,QAAQ,IAAI,aAAa,iBACzB,QAAQ,IAAI,mBAAmB,WAC9B,CAAC,SAAS,CAAC,QAEZ,QAAO;CAET,MAAM,cAAc,mCAClB,mCAAmC,CACpC;AACD,QAAO,KACL,mCAAmC,QAAQ,qBAAqB,4BAA4B,mEAC7F;AAED,QAAO,OAAO,KAAK,KAAK,SAAS;AAE/B,MAAI,IAAI,OAAO,2BAA2B,EAAE,MAAM,EAAE;AAClD,SAAM;AACN;;AAEF,MAAI,CAAC,eAAe,IAAI,EAAE;AACxB,OAAI,OAAO,IAAI,CAAC,KAAK,EACnB,OACE,mEACH,CAAC;AACF;;AAEF,MAAI;GACF,MAAM,WAAW,MAAM,aAAa;AACpC,OAAI,QAAQ,8BAA8B,SAAS;AACnD,OAAI,QAAQ,sBAAsB,SAAS;AAC3C,UAAO,IAAI,QAAQ;AACnB,OAAI,SAAS,MAAO,KAAI,QAAQ,uBAAuB,SAAS;UAC1D;AAEN,OAAI,OAAO,IAAI,CAAC,KAAK,EACnB,OACE,8JACH,CAAC;AACF;;AAEF,QAAM"}

package/dist/plugins/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/plugins/server/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AAqDA;;;;;;;;;;;;;;;cAAa,YAAA,SAAqB,MAAA;EAAA,OAClB,cAAA;;;;EA4JS;;;;;;EAAA,wBAjJC,uBAAA;;SAGjB,QAAA,EAfiB,cAAA;EAAA,QAgBhB,iBAAA;EAAA,QACA,MAAA;EAAA,QACA,aAAA;EAAA,QACA,sBAAA;EAFA;EAAA,QAIA,kBAAA;EAAA,UACU,MAAA,EAAQ,YAAA;EAAA,QAClB,gBAAA;EAAA,QACA,YAAA;EAFkB;;;;;EAAA,QAQlB,YAAA;EAAA,OACD,KAAA,EAAO,WAAA;cAEF,MAAA,EAAQ,YAAA;EAepB,aAAA,CAAc,IAAA,GAAM,UAAA,CAAW,MAAA;EAA/B;EAUM,KAAA,CAAA,GAAK,OAAA;EAVoB;EAa/B,SAAA,CAAA;IAAA;;;;;;gBAHW,gBAAA;;;;;;;;;;;EAiBL,KAAA,CAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,WAAA;EAkFlB;;;;;;;;EAAb,SAAA,CAAA,GAAa,MAAA;EAiCK;;;;;;;;;;;;;;EAXlB,MAAA,CAAO,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;EAsRT;;;;;;EA3QhB,YAAA,CAAa,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;;;;;;;;UAWjB,YAAA;;;;AAmYhB;;;UAhUgB,aAAA;EAAA,eA4CC,cAAA;EAoRE;;;;;EAAA,QAlQH,iBAAA;EAAA,QAqBN,cAAA;EA6OS;;;;;;;;;;;;EAlMjB,qBAAA,CAAA;;;;;;;;EAmBM,QAAA,CAAA,GAAY,OAAA;;;;;;;;;;;;UAoBJ,yBAAA;;;;;EAoBd,OAAA,CAAA;yEAIgB,GAAA,EAAK,OAAA,CAAQ,WAAA;qBA5ShB,MAAA;;;;;;;;kBAAU,gBAAA;;;;;;;;;cA+aZ,MAAA,EAAM,QAAA,QAAA,YAAA,EAAA,YAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/plugins/server/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AAsDA;;;;;;;;;;;;;;;cAAa,YAAA,SAAqB,MAAA;EAAA,OAClB,cAAA;;;;EA8JS;;;;;;EAAA,wBAnJC,uBAAA;;SAGjB,QAAA,EAfiB,cAAA;EAAA,QAgBhB,iBAAA;EAAA,QACA,MAAA;EAAA,QACA,aAAA;EAAA,QACA,sBAAA;EAFA;EAAA,QAIA,kBAAA;EAAA,UACU,MAAA,EAAQ,YAAA;EAAA,QAClB,gBAAA;EAAA,QACA,YAAA;EAFkB;;;;;EAAA,QAQlB,YAAA;EAAA,OACD,KAAA,EAAO,WAAA;cAEF,MAAA,EAAQ,YAAA;EAepB,aAAA,CAAc,IAAA,GAAM,UAAA,CAAW,MAAA;EAA/B;EAUM,KAAA,CAAA,GAAK,OAAA;EAVoB;EAa/B,SAAA,CAAA;IAAA;;;;;;gBAHW,gBAAA;;;;;;;;;;;EAiBL,KAAA,CAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,WAAA;EAoFlB;;;;;;;;EAAb,SAAA,CAAA,GAAa,MAAA;EAiCK;;;;;;;;;;;;;;EAXlB,MAAA,CAAO,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;EAsRT;;;;;;EA3QhB,YAAA,CAAa,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;;;;;;;;UAWjB,YAAA;;;;AAmYhB;;;UAhUgB,aAAA;EAAA,eA4CC,cAAA;EAoRE;;;;;EAAA,QAlQH,iBAAA;EAAA,QAqBN,cAAA;EA6OS;;;;;;;;;;;;EAlMjB,qBAAA,CAAA;;;;;;;;EAmBM,QAAA,CAAA,GAAY,OAAA;;;;;;;;;;;;UAoBJ,yBAAA;;;;;EAoBd,OAAA,CAAA;yEAIgB,GAAA,EAAK,OAAA,CAAQ,WAAA;qBA5ShB,MAAA;;;;;;;;kBAAU,gBAAA;;;;;;;;;cA+aZ,MAAA,EAAM,QAAA,QAAA,YAAA,EAAA,YAAA"}