@databricks/sdk-keyconfigurations 0.0.0-dev → 0.1.0-dev.2

package/src/v1/client.ts

@@ -0,0 +1,209 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import {VERSION as AUTH_VERSION} from '@databricks/sdk-auth';
+import {createDefault} from '@databricks/sdk-core/clientinfo';
+import type {Logger} from '@databricks/sdk-core/logger';
+import {NoOpLogger} from '@databricks/sdk-core/logger';
+import type {CallOptions} from '@databricks/sdk-options/call';
+import type {ClientOptions} from '@databricks/sdk-options/client';
+import type {HttpClient} from '@databricks/sdk-core/http';
+import {newHttpClient} from './transport';
+import {
+  buildHttpRequest,
+  executeCall,
+  executeHttpCall,
+  marshalRequest,
+  parseResponse,
+} from './utils';
+import pkgJson from '../../package.json' with {type: 'json'};
+import {z} from 'zod';
+import type {
+  CreateCustomerManagedKeyRequest,
+  CustomerManagedKey,
+  DeleteCustomerManagedKeyRequest,
+  GetCustomerManagedKeyRequest,
+  ListCustomerManagedKeyRequest,
+  ListCustomerManagedKeyResponse,
+} from './model';
+import {
+  marshalCreateCustomerManagedKeyRequestSchema,
+  unmarshalCustomerManagedKeySchema,
+} from './model';
+
+// Package identity segment for this client to be used in the User-Agent header.
+const PACKAGE_SEGMENT = {
+  key: 'sdk-js-' + pkgJson.name.replace(/^@[^/]+\/sdk-/, ''),
+  value: pkgJson.version,
+};
+
+export class KeyConfigurationsClient {
+  private readonly host: string;
+  // Fallback for endpoints whose path contains {account_id}. If the request
+  // already carries an accountId, that value wins.
+  private readonly accountId: string | undefined;
+  private readonly httpClient: HttpClient;
+  private readonly logger: Logger;
+  // User-Agent header value. Composed once at construction from
+  // createDefault() merged with this package's identity and the active
+  // credential's name.
+  private readonly userAgent: string;
+
+  constructor(options: ClientOptions) {
+    if (options.host === undefined) {
+      throw new Error('Host is required.');
+    }
+    this.host = options.host.replace(/\/$/, '');
+    this.accountId = options.accountId;
+    this.logger = options.logger ?? new NoOpLogger();
+    const info = createDefault()
+      .with(PACKAGE_SEGMENT)
+      .with({key: 'sdk-js-auth', value: AUTH_VERSION})
+      .with({key: 'auth', value: options.credentials?.name() ?? 'default'});
+    this.userAgent = info.toString();
+    this.httpClient = newHttpClient(options);
+  }
+
+  /**
+   * Creates a customer-managed key configuration object for an account, specified by ID.
+   * This operation uploads a reference to a customer-managed key to <Databricks>.
+   * If the key is assigned as a workspace's customer-managed key for managed services,
+   * <Databricks> uses the key to encrypt the workspaces notebooks and secrets in the control plane,
+   * in addition to Databricks SQL queries and query history. If it is specified as a
+   * workspace's customer-managed key for workspace storage, the key encrypts the
+   * workspace's root S3 bucket (which contains the workspace's root DBFS and system data)
+   * and, optionally, cluster EBS volume data.
+   *
+   * **Important**: Customer-managed keys are supported only for some deployment types,
+   * subscription types, and AWS regions that currently support creation of <Databricks> workspaces.
+   *
+   * This operation is available only if your account is on the E2 version of the
+   * platform or on a select custom plan that allows multiple workspaces per account.
+   *
+   * **GCP only**: To create a customer-managed key on GCP, you must include the
+   * `X-Databricks-GCP-SA-Access-Token` HTTP header in your request. This header must contain
+   * a Google Cloud OAuth access token with the `cloud-platform` scope. The Google identity
+   * associated with the token must also have the `setIamPermissions` and `getIamPermissions`
+   * IAM permissions on the key resource. For details on obtaining this token, see
+   * [Authenticate with Google ID tokens](https://docs.databricks.com/gcp/en/dev-tools/auth/authentication-google-id.html).
+   */
+  async createCustomerManagedKeyPublic(
+    req: CreateCustomerManagedKeyRequest,
+    options?: CallOptions
+  ): Promise<CustomerManagedKey> {
+    const url = `${this.host}/api/2.0/accounts/${req.accountId ?? this.accountId ?? ''}/customer-managed-keys`;
+    const body = marshalRequest(
+      req,
+      marshalCreateCustomerManagedKeyRequestSchema
+    );
+    let resp: CustomerManagedKey | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers({'Content-Type': 'application/json'});
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('POST', url, headers, callSignal, body);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(respBody, unmarshalCustomerManagedKeySchema);
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+
+  /** Deletes a customer-managed key configuration object for an account. You cannot delete a configuration that is associated with a running workspace. */
+  async deleteCustomerManagedKeyPublic(
+    req: DeleteCustomerManagedKeyRequest,
+    options?: CallOptions
+  ): Promise<CustomerManagedKey> {
+    const url = `${this.host}/api/2.0/accounts/${req.accountId ?? this.accountId ?? ''}/customer-managed-keys/${req.customerManagedKeyId ?? ''}`;
+    let resp: CustomerManagedKey | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers();
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('DELETE', url, headers, callSignal);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(respBody, unmarshalCustomerManagedKeySchema);
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+
+  /**
+   * Gets a customer-managed key configuration object for an account, specified by ID.
+   * This operation uploads a reference to a customer-managed key to <Databricks>.
+   * If assigned as a workspace's customer-managed key for managed services, <Databricks> uses the
+   * key to encrypt the workspaces notebooks and secrets in the control plane, in addition to
+   * Databricks SQL queries and query history. If it is specified as a workspace's
+   * customer-managed key for storage, the key encrypts the workspace's root S3 bucket
+   * (which contains the workspace's root DBFS and system data) and, optionally, cluster EBS volume data.
+   *
+   * **Important**: Customer-managed keys are supported only for some deployment types,
+   * subscription types, and AWS regions.
+   *
+   * This operation is available only if your account is on the E2 version of the platform.",
+   */
+  async getCustomerManagedKeyPublic(
+    req: GetCustomerManagedKeyRequest,
+    options?: CallOptions
+  ): Promise<CustomerManagedKey> {
+    const url = `${this.host}/api/2.0/accounts/${req.accountId ?? this.accountId ?? ''}/customer-managed-keys/${req.customerManagedKeyId ?? ''}`;
+    let resp: CustomerManagedKey | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers();
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('GET', url, headers, callSignal);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = parseResponse(respBody, unmarshalCustomerManagedKeySchema);
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+
+  /** Lists <Databricks> customer-managed key configurations for an account. */
+  async listCustomerManagedKeyPublic(
+    req: ListCustomerManagedKeyRequest,
+    options?: CallOptions
+  ): Promise<ListCustomerManagedKeyResponse> {
+    const url = `${this.host}/api/2.0/accounts/${req.accountId ?? this.accountId ?? ''}/customer-managed-keys`;
+    let resp: ListCustomerManagedKeyResponse | undefined;
+    const call = async (callSignal?: AbortSignal): Promise<void> => {
+      const headers = new Headers();
+      headers.set('User-Agent', this.userAgent);
+      const httpReq = buildHttpRequest('GET', url, headers, callSignal);
+      const respBody = await executeHttpCall({
+        request: httpReq,
+        httpClient: this.httpClient,
+        logger: this.logger,
+      });
+      resp = {
+        customerManagedKeys: parseResponse(
+          respBody,
+          z.array(z.lazy(() => unmarshalCustomerManagedKeySchema))
+        ),
+      };
+    };
+    await executeCall(call, options);
+    if (resp === undefined) {
+      throw new Error('operation completed without a result.');
+    }
+    return resp;
+  }
+}

package/src/v1/index.ts

@@ -0,0 +1,22 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+export {KeyConfigurationsClient} from './client';
+
+export {CmkUseCase} from './model';
+
+export type {
+  AwsKeyInfo,
+  AzureKeyInfo,
+  CreateAwsKeyInfo,
+  CreateAzureKeyInfo,
+  CreateCustomerManagedKeyRequest,
+  CreateGcpKeyInfo,
+  CustomerManagedKey,
+  DeleteCustomerManagedKeyRequest,
+  GcpKeyInfo,
+  GcpServiceAccount,
+  GetCustomerManagedKeyRequest,
+  KeyAccessConfiguration,
+  ListCustomerManagedKeyRequest,
+  ListCustomerManagedKeyResponse,
+} from './model';

package/src/v1/model.ts

@@ -0,0 +1,373 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import {z} from 'zod';
+
+export enum CmkUseCase {
+  /** Encryption for the control plane resources. */
+  MANAGED_SERVICES = 'MANAGED_SERVICES',
+  /** Encryption for the customer cloud resources. */
+  STORAGE = 'STORAGE',
+}
+
+export interface AwsKeyInfo {
+  /** The AWS KMS key's Amazon Resource Name (ARN). */
+  keyArn?: string | undefined;
+  /** The AWS KMS key alias. */
+  keyAlias?: string | undefined;
+  /** The AWS KMS key region. */
+  keyRegion?: string | undefined;
+  /**
+   * This field applies only if the `use_cases` property includes `STORAGE`. If this is set to true or omitted, the key is also used to encrypt
+   * cluster EBS volumes. If you do not want to use this key for encrypting EBS volumes, set to false.
+   */
+  reuseKeyForClusterVolumes?: boolean | undefined;
+}
+
+export interface AzureKeyInfo {
+  /** The base URI of the KeyVault. */
+  keyVaultUri?: string | undefined;
+  /** The name of the key in KeyVault. */
+  keyName?: string | undefined;
+  /** The current key version. */
+  version?: string | undefined;
+  /** The tenant id where the KeyVault lives. */
+  tenantId?: string | undefined;
+  /**
+   * The Disk Encryption Set id that is used to represent the key info used for
+   * Managed Disk BYOK use case
+   */
+  diskEncryptionSetId?: string | undefined;
+  /**
+   * The structure to store key access credential
+   * This is set if the Managed Identity is being used to access the Azure Key Vault key.
+   */
+  keyAccessConfiguration?: KeyAccessConfiguration | undefined;
+}
+
+export interface CreateAwsKeyInfo {
+  /** The AWS KMS key's Amazon Resource Name (ARN). */
+  keyArn?: string | undefined;
+  /** The AWS KMS key alias. */
+  keyAlias?: string | undefined;
+  /** The AWS KMS key region. */
+  keyRegion?: string | undefined;
+  /**
+   * This field applies only if the `use_cases` property includes `STORAGE`. If this is set to true or omitted, the key is also used to encrypt
+   * cluster EBS volumes. If you do not want to use this key for encrypting EBS volumes, set to false.
+   */
+  reuseKeyForClusterVolumes?: boolean | undefined;
+}
+
+export interface CreateAzureKeyInfo {
+  /** The base URI of the KeyVault. */
+  keyVaultUri?: string | undefined;
+  /** The name of the key in KeyVault. */
+  keyName?: string | undefined;
+  /** The current key version. */
+  version?: string | undefined;
+  /** The tenant id where the KeyVault lives. */
+  tenantId?: string | undefined;
+  /**
+   * The Disk Encryption Set id that is used to represent the key info used for
+   * Managed Disk BYOK use case
+   */
+  diskEncryptionSetId?: string | undefined;
+  /**
+   * The structure to store key access credential
+   * This is set if the Managed Identity is being used to access the Azure Key Vault key.
+   */
+  keyAccessConfiguration?: KeyAccessConfiguration | undefined;
+}
+
+export interface CreateCustomerManagedKeyRequest {
+  accountId?: string | undefined;
+  /**
+   * (-- The key information. Exactly one of aws_key_info, gcp_key_info, or
+   * azure_key_info must be set, matching the cloud of the account. --)
+   */
+  keyInfo?:
+    | {$case: 'awsKeyInfo'; awsKeyInfo: CreateAwsKeyInfo}
+    | {$case: 'gcpKeyInfo'; gcpKeyInfo: CreateGcpKeyInfo}
+    | {$case: 'azureKeyInfo'; azureKeyInfo: CreateAzureKeyInfo}
+    | undefined;
+  /** The cases that the key can be used for. */
+  useCases?: CmkUseCase[] | undefined;
+}
+
+export interface CreateGcpKeyInfo {
+  /**
+   * Globally unique kms key resource id of the form
+   * projects/testProjectId/locations/us-east4/keyRings/gcpCmkKeyRing/cryptoKeys/cmk-eastus4
+   */
+  kmsKeyId?: string | undefined;
+  /**
+   * Globally unique service account email that has access to the KMS key.
+   * The service account exists within the Databricks CP project.
+   */
+  gcpServiceAccount?: GcpServiceAccount | undefined;
+  /**
+   * When true, <Databricks> will not use OAuth to grant the service account
+   * access to the KMS key. The customer is responsible for granting access
+   * manually.
+   */
+  manual?: boolean | undefined;
+}
+
+export interface CustomerManagedKey {
+  /** ID of the encryption key configuration object. */
+  customerManagedKeyId?: string | undefined;
+  /** Time in epoch milliseconds when the customer key was created. */
+  creationTime?: bigint | undefined;
+  /** The <Databricks> account ID that holds the customer-managed key. */
+  accountId?: string | undefined;
+  /**
+   * (-- The key information, if aws_key_info is defined, it's a AWS Databricks object.
+   * If azure_key_info is defined, it's an Azure Databricks customer key object. --)
+   */
+  keyInfo?:
+    | {$case: 'awsKeyInfo'; awsKeyInfo: AwsKeyInfo}
+    | {$case: 'azureKeyInfo'; azureKeyInfo: AzureKeyInfo}
+    | {$case: 'gcpKeyInfo'; gcpKeyInfo: GcpKeyInfo}
+    | undefined;
+  /** The cases that the key can be used for. */
+  useCases?: CmkUseCase[] | undefined;
+}
+
+export interface DeleteCustomerManagedKeyRequest {
+  /** <Databricks> encryption key configuration ID. */
+  customerManagedKeyId?: string | undefined;
+  accountId?: string | undefined;
+}
+
+export interface GcpKeyInfo {
+  /**
+   * Globally unique kms key resource id of the form
+   * projects/testProjectId/locations/us-east4/keyRings/gcpCmkKeyRing/cryptoKeys/cmk-eastus4
+   */
+  kmsKeyId?: string | undefined;
+  /**
+   * Globally unique service account email that has access to the KMS key.
+   * The service account exists within the Databricks CP project.
+   */
+  gcpServiceAccount?: GcpServiceAccount | undefined;
+  /**
+   * When true, <Databricks> will not use OAuth to grant the service account
+   * access to the KMS key. The customer is responsible for granting access
+   * manually.
+   */
+  manual?: boolean | undefined;
+}
+
+export interface GcpServiceAccount {
+  serviceAccountEmail?: string | undefined;
+}
+
+export interface GetCustomerManagedKeyRequest {
+  /** <Databricks> encryption key configuration ID. */
+  customerManagedKeyId?: string | undefined;
+  accountId?: string | undefined;
+}
+
+/** The credential ID that is used to access the key vault. */
+export interface KeyAccessConfiguration {
+  credentialId?: string | undefined;
+}
+
+export interface ListCustomerManagedKeyRequest {
+  accountId?: string | undefined;
+}
+
+export interface ListCustomerManagedKeyResponse {
+  customerManagedKeys?: CustomerManagedKey[] | undefined;
+}
+
+export const unmarshalAwsKeyInfoSchema: z.ZodType<AwsKeyInfo> = z
+  .object({
+    key_arn: z.string().optional(),
+    key_alias: z.string().optional(),
+    key_region: z.string().optional(),
+    reuse_key_for_cluster_volumes: z.boolean().optional(),
+  })
+  .transform(d => ({
+    keyArn: d.key_arn,
+    keyAlias: d.key_alias,
+    keyRegion: d.key_region,
+    reuseKeyForClusterVolumes: d.reuse_key_for_cluster_volumes,
+  }));
+
+export const unmarshalAzureKeyInfoSchema: z.ZodType<AzureKeyInfo> = z
+  .object({
+    key_vault_uri: z.string().optional(),
+    key_name: z.string().optional(),
+    version: z.string().optional(),
+    tenant_id: z.string().optional(),
+    disk_encryption_set_id: z.string().optional(),
+    key_access_configuration: z
+      .lazy(() => unmarshalKeyAccessConfigurationSchema)
+      .optional(),
+  })
+  .transform(d => ({
+    keyVaultUri: d.key_vault_uri,
+    keyName: d.key_name,
+    version: d.version,
+    tenantId: d.tenant_id,
+    diskEncryptionSetId: d.disk_encryption_set_id,
+    keyAccessConfiguration: d.key_access_configuration,
+  }));
+
+export const unmarshalCustomerManagedKeySchema: z.ZodType<CustomerManagedKey> =
+  z
+    .object({
+      customer_managed_key_id: z.string().optional(),
+      creation_time: z
+        .union([z.number(), z.bigint()])
+        .transform(v => BigInt(v))
+        .optional(),
+      account_id: z.string().optional(),
+      aws_key_info: z.lazy(() => unmarshalAwsKeyInfoSchema).optional(),
+      azure_key_info: z.lazy(() => unmarshalAzureKeyInfoSchema).optional(),
+      gcp_key_info: z.lazy(() => unmarshalGcpKeyInfoSchema).optional(),
+      use_cases: z.array(z.enum(CmkUseCase)).optional(),
+    })
+    .transform(d => ({
+      customerManagedKeyId: d.customer_managed_key_id,
+      creationTime: d.creation_time,
+      accountId: d.account_id,
+      keyInfo:
+        d.aws_key_info !== undefined
+          ? {$case: 'awsKeyInfo' as const, awsKeyInfo: d.aws_key_info}
+          : d.azure_key_info !== undefined
+            ? {$case: 'azureKeyInfo' as const, azureKeyInfo: d.azure_key_info}
+            : d.gcp_key_info !== undefined
+              ? {$case: 'gcpKeyInfo' as const, gcpKeyInfo: d.gcp_key_info}
+              : undefined,
+      useCases: d.use_cases,
+    }));
+
+export const unmarshalGcpKeyInfoSchema: z.ZodType<GcpKeyInfo> = z
+  .object({
+    kms_key_id: z.string().optional(),
+    gcp_service_account: z
+      .lazy(() => unmarshalGcpServiceAccountSchema)
+      .optional(),
+    manual: z.boolean().optional(),
+  })
+  .transform(d => ({
+    kmsKeyId: d.kms_key_id,
+    gcpServiceAccount: d.gcp_service_account,
+    manual: d.manual,
+  }));
+
+export const unmarshalGcpServiceAccountSchema: z.ZodType<GcpServiceAccount> = z
+  .object({
+    service_account_email: z.string().optional(),
+  })
+  .transform(d => ({
+    serviceAccountEmail: d.service_account_email,
+  }));
+
+export const unmarshalKeyAccessConfigurationSchema: z.ZodType<KeyAccessConfiguration> =
+  z
+    .object({
+      credential_id: z.string().optional(),
+    })
+    .transform(d => ({
+      credentialId: d.credential_id,
+    }));
+
+export const marshalCreateAwsKeyInfoSchema: z.ZodType = z
+  .object({
+    keyArn: z.string().optional(),
+    keyAlias: z.string().optional(),
+    keyRegion: z.string().optional(),
+    reuseKeyForClusterVolumes: z.boolean().optional(),
+  })
+  .transform(d => ({
+    key_arn: d.keyArn,
+    key_alias: d.keyAlias,
+    key_region: d.keyRegion,
+    reuse_key_for_cluster_volumes: d.reuseKeyForClusterVolumes,
+  }));
+
+export const marshalCreateAzureKeyInfoSchema: z.ZodType = z
+  .object({
+    keyVaultUri: z.string().optional(),
+    keyName: z.string().optional(),
+    version: z.string().optional(),
+    tenantId: z.string().optional(),
+    diskEncryptionSetId: z.string().optional(),
+    keyAccessConfiguration: z
+      .lazy(() => marshalKeyAccessConfigurationSchema)
+      .optional(),
+  })
+  .transform(d => ({
+    key_vault_uri: d.keyVaultUri,
+    key_name: d.keyName,
+    version: d.version,
+    tenant_id: d.tenantId,
+    disk_encryption_set_id: d.diskEncryptionSetId,
+    key_access_configuration: d.keyAccessConfiguration,
+  }));
+
+export const marshalCreateCustomerManagedKeyRequestSchema: z.ZodType = z
+  .object({
+    accountId: z.string().optional(),
+    keyInfo: z
+      .discriminatedUnion('$case', [
+        z.object({
+          $case: z.literal('awsKeyInfo'),
+          awsKeyInfo: z.lazy(() => marshalCreateAwsKeyInfoSchema),
+        }),
+        z.object({
+          $case: z.literal('gcpKeyInfo'),
+          gcpKeyInfo: z.lazy(() => marshalCreateGcpKeyInfoSchema),
+        }),
+        z.object({
+          $case: z.literal('azureKeyInfo'),
+          azureKeyInfo: z.lazy(() => marshalCreateAzureKeyInfoSchema),
+        }),
+      ])
+      .optional(),
+    useCases: z.array(z.enum(CmkUseCase)).optional(),
+  })
+  .transform(d => ({
+    account_id: d.accountId,
+    ...(d.keyInfo?.$case === 'awsKeyInfo' && {
+      aws_key_info: d.keyInfo.awsKeyInfo,
+    }),
+    ...(d.keyInfo?.$case === 'gcpKeyInfo' && {
+      gcp_key_info: d.keyInfo.gcpKeyInfo,
+    }),
+    ...(d.keyInfo?.$case === 'azureKeyInfo' && {
+      azure_key_info: d.keyInfo.azureKeyInfo,
+    }),
+    use_cases: d.useCases,
+  }));
+
+export const marshalCreateGcpKeyInfoSchema: z.ZodType = z
+  .object({
+    kmsKeyId: z.string().optional(),
+    gcpServiceAccount: z.lazy(() => marshalGcpServiceAccountSchema).optional(),
+    manual: z.boolean().optional(),
+  })
+  .transform(d => ({
+    kms_key_id: d.kmsKeyId,
+    gcp_service_account: d.gcpServiceAccount,
+    manual: d.manual,
+  }));
+
+export const marshalGcpServiceAccountSchema: z.ZodType = z
+  .object({
+    serviceAccountEmail: z.string().optional(),
+  })
+  .transform(d => ({
+    service_account_email: d.serviceAccountEmail,
+  }));
+
+export const marshalKeyAccessConfigurationSchema: z.ZodType = z
+  .object({
+    credentialId: z.string().optional(),
+  })
+  .transform(d => ({
+    credential_id: d.credentialId,
+  }));

package/src/v1/transport.ts

@@ -0,0 +1,73 @@
+// Code generated from API definition by Databricks SDK Generator. DO NOT EDIT.
+
+import type {Credentials} from '@databricks/sdk-auth';
+import {defaultCredentials} from '@databricks/sdk-auth/credentials';
+import type {
+  HttpClient,
+  HttpRequest,
+  HttpResponse,
+} from '@databricks/sdk-core/http';
+import {newFetchHttpClient} from '@databricks/sdk-core/http';
+import type {ClientOptions} from '@databricks/sdk-options/client';
+
+/** Creates a new HTTP client with the given options. */
+export function newHttpClient(options?: ClientOptions): HttpClient {
+  const opts = options ?? {};
+
+  // If an HTTP client is provided, use it as-is. Throw if other options are
+  // also set, since they would be silently ignored.
+  if (opts.httpClient !== undefined) {
+    if (opts.credentials !== undefined || opts.timeout !== undefined) {
+      throw new Error(
+        'httpClient cannot be combined with credentials or timeout'
+      );
+    }
+    return opts.httpClient;
+  }
+
+  const credentials = opts.credentials ?? defaultCredentials();
+
+  const base = newFetchHttpClient();
+  let client: HttpClient = new AuthHttpClient(base, credentials);
+
+  if (opts.timeout !== undefined) {
+    client = new TimeoutHttpClient(client, opts.timeout);
+  }
+
+  return client;
+}
+
+/** Wraps an HttpClient and adds authentication headers to requests. */
+class AuthHttpClient implements HttpClient {
+  constructor(
+    private readonly base: HttpClient,
+    private readonly credentials: Credentials
+  ) {}
+
+  async send(request: HttpRequest): Promise<HttpResponse> {
+    const authHeaders = await this.credentials.authHeaders();
+    // Do not modify the original request.
+    const headers = new Headers(request.headers);
+    for (const h of authHeaders) {
+      headers.set(h.key, h.value);
+    }
+    return this.base.send({...request, headers});
+  }
+}
+
+/** Wraps an HttpClient and applies a default timeout to requests. */
+class TimeoutHttpClient implements HttpClient {
+  constructor(
+    private readonly base: HttpClient,
+    private readonly timeout: number
+  ) {}
+
+  async send(request: HttpRequest): Promise<HttpResponse> {
+    const timeoutSignal = AbortSignal.timeout(this.timeout);
+    const signal =
+      request.signal !== undefined
+        ? AbortSignal.any([request.signal, timeoutSignal])
+        : timeoutSignal;
+    return this.base.send({...request, signal});
+  }
+}