@keboola/api-client 52.0.0 → 53.0.0

package/dist/sdk/dataAppServer/index.cjs

@@ -0,0 +1,266 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_createFetchClient = require("../../createFetchClient-CDKSkd7i.cjs");
+const require_storage = require("../../storage-BMrYlyLB.cjs");
+const require_RowLevelSecurityError = require("../../RowLevelSecurityError-RK_NhhAx.cjs");
+const require_transientRetries = require("../../transientRetries-CBorl4Ue.cjs");
+const require_isPlainObject = require("../../isPlainObject-CcvQt0qB.cjs");
+const require_serviceIds = require("../../serviceIds-Bg1pWiPE.cjs");
+const require_queryService = require("../../queryService-C3BQ6GKW.cjs");
+const require_sdk_queryService_index = require("../queryService/index.cjs");
+const require_readJwtClaims = require("../../readJwtClaims-SVJgo04x.cjs");
+let node_async_hooks = require("node:async_hooks");
+let node_fs_promises = require("node:fs/promises");
+// src/sdks/dataAppServer/express.ts
+/** Answers a row-level security refusal with 403 and passes any other error on. */
+const createExpressErrorHandler = () => (err, _req, res, next) => {
+	if (res.headersSent || !require_RowLevelSecurityError.isRowLevelSecurityError(err)) {
+		next(err);
+		return;
+	}
+	res.status(require_createFetchClient.HttpStatus.FORBIDDEN).json({
+		error: err.message,
+		code: "ROW_LEVEL_SECURITY"
+	});
+};
+// src/sdks/dataAppServer/requestContext.ts
+const isHeadersLike = (headers) => "get" in headers && typeof headers.get === "function";
+const appUserTokenOf = (request) => {
+	const headers = "headers" in request ? request.headers : request;
+	if (isHeadersLike(headers)) return headers.get("X-Kbc-App-User-Token") || void 0;
+	const value = headers[require_createFetchClient.APP_USER_TOKEN_HEADER.toLowerCase()];
+	return (Array.isArray(value) ? value[0] : value) || void 0;
+};
+const userOf = (token) => {
+	const { idp, sub, email } = require_readJwtClaims.readJwtClaims(token) ?? {};
+	if (typeof idp !== "string" || typeof sub !== "string" || !idp || !sub) return void 0;
+	return typeof email === "string" && email ? {
+		idp,
+		sub,
+		email
+	} : {
+		idp,
+		sub
+	};
+};
+/**
+* The signed-in user of the request being handled, kept across every `await` the request makes.
+*
+* - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.
+* - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.
+* - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.
+*/
+const createRequestContext = () => {
+	const storage = new node_async_hooks.AsyncLocalStorage();
+	const current = () => storage.getStore();
+	return {
+		runWithRequest: (request, fn) => {
+			const appUserToken = appUserTokenOf(request);
+			return storage.run({
+				appUserToken,
+				user: appUserToken ? userOf(appUserToken) : void 0
+			}, fn);
+		},
+		current,
+		currentUser: () => current()?.user,
+		currentUserKey: () => {
+			const user = current()?.user;
+			return user && JSON.stringify([user.idp, user.sub]);
+		}
+	};
+};
+// src/sdks/dataAppServer/parseCell.ts
+const FLOAT_TYPE = /^(real|float|float64)$/i;
+const DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;
+const DECIMAL = /^-?\d+(\.\d+)?$/;
+const EPOCH = /^-?\d+(\.\d+)?( \d+)?$/;
+const BIGQUERY_TIMESTAMP = /^(\S+) (\S+) \+0000 UTC$/;
+const DAY_MS = 864e5;
+/** Every decimal of at most this many significant digits survives a round trip through a double. */
+const EXACT_DIGITS = 15;
+const significantDigits = (decimal) => decimal.replace(/[-.]/g, "").replace(/^0+/, "").replace(/0+$/, "").length;
+const decimalOf = (cell) => {
+	const n = Number(cell);
+	return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS) ? n : cell;
+};
+const floatOf = (cell) => {
+	const n = Number(cell);
+	return Number.isFinite(n) ? n : cell;
+};
+const epochIso = (cell) => (/* @__PURE__ */ new Date(parseFloat(cell) * 1e3)).toISOString();
+const timestampOf = (cell) => EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, "$1T$2Z");
+/**
+* The parser for a Query Service cell (always a string) of one column type.
+*
+* 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).
+* 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.
+* 3. Timestamps become ISO (`timestamp_ntz` without `Z`); other types keep the string.
+*/
+const cellParser = (type) => {
+	if (DECIMAL_TYPE.test(type)) return decimalOf;
+	if (FLOAT_TYPE.test(type)) return floatOf;
+	if (/^bool(ean)?$/i.test(type)) return (cell) => cell === "true";
+	if (/^date$/i.test(type)) return (cell) => EPOCH.test(cell) ? (/* @__PURE__ */ new Date(Number(cell) * DAY_MS)).toISOString().slice(0, 10) : cell;
+	if (/^timestamp_ntz$/i.test(type)) return (cell) => EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell;
+	if (/^timestamp/i.test(type)) return timestampOf;
+	return (cell) => cell;
+};
+// src/sdks/dataAppServer/runQuery.ts
+const PAGE_SIZE = 1e4;
+const TIMEOUT = 6e4;
+const refusalWarning = (scope) => {
+	const prefix = "[dataAppServer] row-level security refused";
+	if (scope?.appUserToken) return `${prefix} the query for this user`;
+	return `${prefix} a query sent without ${require_createFetchClient.APP_USER_TOKEN_HEADER}: ${scope ? "the request has none" : "it ran outside a user request (startup, timer, background job)"}`;
+};
+const toRecords = ({ columns = [], data = [], numberOfRows }, capped) => {
+	const parsers = columns.map(({ name, type }) => ({
+		key: name.toLowerCase(),
+		parse: cellParser(type)
+	}));
+	const keys = /* @__PURE__ */ new Set();
+	for (const { key } of parsers) {
+		if (keys.has(key)) throw new Error(`runQuery: two columns are named "${key}"; alias one with AS`);
+		keys.add(key);
+	}
+	const rows = data.map((row) => {
+		const record = {};
+		parsers.forEach(({ key, parse }, i) => {
+			const cell = row[i];
+			record[key] = cell == null ? null : parse(cell);
+		});
+		return record;
+	});
+	if (!capped && numberOfRows !== void 0 && rows.length < numberOfRows) throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);
+	return rows;
+};
+/**
+* Runs one SQL statement in the app's workspace and resolves every row as a record.
+*
+* - Sends the request's user token with the app's Storage token; without a user, the Storage token.
+* - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.
+*/
+const createRunQuery = (settings, requestContext) => {
+	const queryService = require_sdk_queryService_index.createQueryServiceSdk({ queryServiceClient: require_queryService.createQueryServiceClient({
+		baseUrl: settings.queryServiceUrl,
+		auth: async () => {
+			const storageToken = await settings.storageToken();
+			const appUserToken = requestContext.current()?.appUserToken;
+			return appUserToken ? {
+				type: "app-user-token",
+				token: appUserToken,
+				storageToken
+			} : {
+				type: "sapi-token",
+				token: storageToken
+			};
+		}
+	}) });
+	return async (sql, options = {}) => {
+		const scope = requestContext.current();
+		const [result] = await queryService.executeQuery(settings.branchId(), await settings.workspaceId(), {
+			statements: [sql],
+			transactional: false
+		}, {
+			...options,
+			pageSize: PAGE_SIZE,
+			timeout: options.timeout ?? TIMEOUT
+		}).catch((error) => {
+			if (require_RowLevelSecurityError.isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));
+			throw error;
+		});
+		return result ? toRecords(result, options.maxRows !== void 0) : [];
+	};
+};
+// src/sdks/dataAppServer/settings.ts
+/** A setting the app needs is missing or unreadable; the message names the variable or file. */
+var AppConfigError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "AppConfigError";
+	}
+};
+const STACK_INDEX_TIMEOUT = 1e4;
+const required = (env, name) => {
+	const value = env[name];
+	if (!value) throw new AppConfigError(`Missing environment variable ${name}`);
+	return value;
+};
+const storageTokenFrom = async (env) => {
+	const file = env.STORAGE_API_TOKEN_PATH;
+	if (!file) {
+		if (env.KBC_TOKEN) return env.KBC_TOKEN;
+		throw new AppConfigError("Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN");
+	}
+	const token = (await (0, node_fs_promises.readFile)(file, "utf8").catch((error) => {
+		throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, { cause: error });
+	})).trim();
+	if (!token) throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);
+	return token;
+};
+const manifestWorkspaceId = async (file) => {
+	let manifest;
+	try {
+		manifest = JSON.parse(await (0, node_fs_promises.readFile)(file, "utf8"));
+	} catch (error) {
+		throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, { cause: error });
+	}
+	const id = require_isPlainObject.isPlainObject(manifest) ? manifest.workspaceId : void 0;
+	if (typeof id === "string" && id || typeof id === "number") return String(id);
+	throw new AppConfigError(`The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`);
+};
+const queryServiceUrlFromIndex = async (kbcUrl, token) => {
+	const { services } = await require_storage.createStorageClient({
+		baseUrl: kbcUrl,
+		auth: {
+			type: "sapi-token",
+			token
+		}
+	}).getStackInfo({ exclude: "components" }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));
+	const url = services.find(({ id }) => id === require_serviceIds.ServiceId.Query)?.url;
+	if (!url) throw new AppConfigError("The stack index of KBC_URL lists no query service");
+	return url;
+};
+/**
+* What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.
+*
+* - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.
+* - The workspace ID and the Query Service URL are read once per process.
+* - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).
+*/
+const createSettings = (env) => {
+	const storageToken = () => storageTokenFrom(env);
+	const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;
+	return {
+		branchId: () => required(env, "BRANCH_ID"),
+		storageToken,
+		workspaceId: require_transientRetries.lazy(() => manifest ? manifestWorkspaceId(manifest) : required(env, "WORKSPACE_ID")),
+		queryServiceUrl: require_transientRetries.lazy(async () => env.QUERY_SERVICE_URL || queryServiceUrlFromIndex(required(env, "KBC_URL"), await storageToken())),
+		hasWorkspace: Boolean(manifest || env.WORKSPACE_ID)
+	};
+};
+// src/sdks/dataAppServer/initializeApp.ts
+/**
+* Sets up Keboola access for this data app process; call it once.
+*
+* - Synchronous, no network call, never throws: each setting is read on first use.
+* - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).
+* - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.
+*/
+const initializeApp = ({ env = process.env } = {}) => {
+	const settings = createSettings(env);
+	const requestContext = createRequestContext();
+	return {
+		server: {
+			runWithRequest: requestContext.runWithRequest,
+			currentUser: requestContext.currentUser,
+			currentUserKey: requestContext.currentUserKey,
+			expressMiddleware: () => (req, _res, next) => requestContext.runWithRequest(req, next),
+			expressErrorHandler: createExpressErrorHandler
+		},
+		workspace: settings.hasWorkspace ? { runQuery: createRunQuery(settings, requestContext) } : void 0
+	};
+};
+exports.AppConfigError = AppConfigError;
+exports.initializeApp = initializeApp;
+
+//# sourceMappingURL=index.cjs.map

package/dist/sdk/dataAppServer/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["isRowLevelSecurityError","HttpStatus","APP_USER_TOKEN_HEADER","readJwtClaims","AsyncLocalStorage","APP_USER_TOKEN_HEADER","createQueryServiceSdk","createQueryServiceClient","isRowLevelSecurityError","readFile","isPlainObject","createStorageClient","ServiceId","lazy"],"sources":["../../../src/sdks/dataAppServer/express.ts","../../../src/sdks/dataAppServer/requestContext.ts","../../../src/sdks/dataAppServer/parseCell.ts","../../../src/sdks/dataAppServer/runQuery.ts","../../../src/sdks/dataAppServer/settings.ts","../../../src/sdks/dataAppServer/initializeApp.ts"],"sourcesContent":["import { isRowLevelSecurityError } from '../../errors';\nimport { HttpStatus } from '../../internal';\n\ntype ErrorResponse = {\n  headersSent: boolean;\n  status(code: number): { json(body: unknown): unknown };\n};\n\n/** Answers a row-level security refusal with 403 and passes any other error on. */\nexport const createExpressErrorHandler =\n  () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => {\n    if (res.headersSent || !isRowLevelSecurityError(err)) {\n      next(err);\n      return;\n    }\n    res.status(HttpStatus.FORBIDDEN).json({ error: err.message, code: 'ROW_LEVEL_SECURITY' });\n  };\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { readJwtClaims } from '../../utils/readJwtClaims';\n\ntype NodeHeaders = Record<string, string | string[] | undefined>;\n\ntype HeadersLike = { get(name: string): string | null };\n\n/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */\nexport type AppRequest = HeadersLike | { headers: HeadersLike | NodeHeaders };\n\n/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */\nexport type AppUser = { idp: string; sub: string; email?: string };\n\ntype Scope = { appUserToken: string | undefined; user: AppUser | undefined };\n\nexport type RequestContext = ReturnType<typeof createRequestContext>;\n\nconst isHeadersLike = (headers: object): headers is HeadersLike =>\n  'get' in headers && typeof headers.get === 'function';\n\nconst appUserTokenOf = (request: AppRequest): string | undefined => {\n  const headers = 'headers' in request ? request.headers : request;\n  if (isHeadersLike(headers)) return headers.get(APP_USER_TOKEN_HEADER) || undefined;\n  const value = headers[APP_USER_TOKEN_HEADER.toLowerCase()];\n  return (Array.isArray(value) ? value[0] : value) || undefined;\n};\n\nconst userOf = (token: string): AppUser | undefined => {\n  const { idp, sub, email } = readJwtClaims(token) ?? {};\n  if (typeof idp !== 'string' || typeof sub !== 'string' || !idp || !sub) return undefined;\n  return typeof email === 'string' && email ? { idp, sub, email } : { idp, sub };\n};\n\n/**\n * The signed-in user of the request being handled, kept across every `await` the request makes.\n *\n * - Work the request starts keeps its user: a timer, a promise cached at module level, a listener.\n * - `currentUser()` reads the token payload unverified: safe only behind Keboola's apps proxy.\n * - `currentUserKey()` is the same for every token of one user (`idp` + `sub`): a per-user cache key.\n */\nexport const createRequestContext = () => {\n  const storage = new AsyncLocalStorage<Scope>();\n  const current = () => storage.getStore();\n\n  return {\n    runWithRequest: <T>(request: AppRequest, fn: () => T): T => {\n      const appUserToken = appUserTokenOf(request);\n      return storage.run(\n        { appUserToken, user: appUserToken ? userOf(appUserToken) : undefined },\n        fn,\n      );\n    },\n    current,\n    currentUser: () => current()?.user,\n    currentUserKey: () => {\n      const user = current()?.user;\n      return user && JSON.stringify([user.idp, user.sub]);\n    },\n  };\n};\n","const FLOAT_TYPE = /^(real|float|float64)$/i;\nconst DECIMAL_TYPE = /^(fixed|integer|int64|numeric|bignumeric)$/i;\nconst DECIMAL = /^-?\\d+(\\.\\d+)?$/;\nconst EPOCH = /^-?\\d+(\\.\\d+)?( \\d+)?$/;\nconst BIGQUERY_TIMESTAMP = /^(\\S+) (\\S+) \\+0000 UTC$/;\nconst DAY_MS = 86_400_000;\n/** Every decimal of at most this many significant digits survives a round trip through a double. */\nconst EXACT_DIGITS = 15;\n\nconst significantDigits = (decimal: string) =>\n  decimal.replace(/[-.]/g, '').replace(/^0+/, '').replace(/0+$/, '').length;\n\nconst decimalOf = (cell: string) => {\n  const n = Number(cell);\n  return DECIMAL.test(cell) && (Number.isSafeInteger(n) || significantDigits(cell) <= EXACT_DIGITS)\n    ? n\n    : cell;\n};\n\nconst floatOf = (cell: string) => {\n  const n = Number(cell);\n  return Number.isFinite(n) ? n : cell;\n};\n\nconst epochIso = (cell: string) => new Date(parseFloat(cell) * 1000).toISOString();\n\nconst timestampOf = (cell: string) =>\n  EPOCH.test(cell) ? epochIso(cell) : cell.replace(BIGQUERY_TIMESTAMP, '$1T$2Z');\n\n/**\n * The parser for a Query Service cell (always a string) of one column type.\n *\n * 1. A decimal is a number only when it keeps every digit, else the string (`NUMBER(38,6)`, IDs).\n * 2. Floats and booleans are typed; a Snowflake `date` (epoch days) becomes `YYYY-MM-DD`.\n * 3. Timestamps become ISO (`timestamp_ntz` without `Z`); other types keep the string.\n */\nexport const cellParser = (type: string): ((cell: string) => unknown) => {\n  if (DECIMAL_TYPE.test(type)) return decimalOf;\n  if (FLOAT_TYPE.test(type)) return floatOf;\n  if (/^bool(ean)?$/i.test(type)) return (cell) => cell === 'true';\n  if (/^date$/i.test(type)) {\n    return (cell) =>\n      EPOCH.test(cell) ? new Date(Number(cell) * DAY_MS).toISOString().slice(0, 10) : cell;\n  }\n  if (/^timestamp_ntz$/i.test(type)) {\n    return (cell) => (EPOCH.test(cell) ? epochIso(cell).slice(0, -1) : cell);\n  }\n  if (/^timestamp/i.test(type)) return timestampOf;\n  return (cell) => cell;\n};\n","import { createQueryServiceClient, type QueryServiceCredential } from '../../clients/queryService';\nimport type { QueryResult } from '../../clients/queryService/types';\nimport { isRowLevelSecurityError } from '../../errors';\nimport { APP_USER_TOKEN_HEADER } from '../../internal';\nimport { createQueryServiceSdk, type ExecuteQueryOptions } from '../queryService';\n\nimport { cellParser } from './parseCell';\nimport type { RequestContext } from './requestContext';\nimport type { Settings } from './settings';\n\nexport type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;\n\nconst PAGE_SIZE = 10_000;\nconst TIMEOUT = 60_000;\n\nconst refusalWarning = (scope: ReturnType<RequestContext['current']>) => {\n  const prefix = '[dataAppServer] row-level security refused';\n  if (scope?.appUserToken) return `${prefix} the query for this user`;\n  const reason = scope\n    ? 'the request has none'\n    : 'it ran outside a user request (startup, timer, background job)';\n  return `${prefix} a query sent without ${APP_USER_TOKEN_HEADER}: ${reason}`;\n};\n\nconst toRecords = ({ columns = [], data = [], numberOfRows }: QueryResult, capped: boolean) => {\n  const parsers = columns.map(({ name, type }) => ({\n    key: name.toLowerCase(),\n    parse: cellParser(type),\n  }));\n  const keys = new Set<string>();\n  for (const { key } of parsers) {\n    if (keys.has(key))\n      throw new Error(`runQuery: two columns are named \"${key}\"; alias one with AS`);\n    keys.add(key);\n  }\n  const rows = data.map((row) => {\n    const record: Record<string, unknown> = {};\n    parsers.forEach(({ key, parse }, i) => {\n      const cell = row[i];\n      record[key] = cell == null ? null : parse(cell);\n    });\n    return record;\n  });\n  if (!capped && numberOfRows !== undefined && rows.length < numberOfRows) {\n    throw new Error(`runQuery: got ${rows.length} of ${numberOfRows} rows`);\n  }\n  return rows;\n};\n\n/**\n * Runs one SQL statement in the app's workspace and resolves every row as a record.\n *\n * - Sends the request's user token with the app's Storage token; without a user, the Storage token.\n * - A repeated column name, or fewer rows than counted (no `maxRows`), throws instead of losing data.\n */\nexport const createRunQuery = (settings: Settings, requestContext: RequestContext) => {\n  const queryService = createQueryServiceSdk({\n    queryServiceClient: createQueryServiceClient({\n      baseUrl: settings.queryServiceUrl,\n      auth: async (): Promise<QueryServiceCredential> => {\n        const storageToken = await settings.storageToken();\n        const appUserToken = requestContext.current()?.appUserToken;\n        return appUserToken\n          ? { type: 'app-user-token', token: appUserToken, storageToken }\n          : { type: 'sapi-token', token: storageToken };\n      },\n    }),\n  });\n\n  return async (sql: string, options: RunQueryOptions = {}): Promise<Record<string, unknown>[]> => {\n    const scope = requestContext.current();\n    const [result] = await queryService\n      .executeQuery(\n        settings.branchId(),\n        await settings.workspaceId(),\n        { statements: [sql], transactional: false },\n        { ...options, pageSize: PAGE_SIZE, timeout: options.timeout ?? TIMEOUT },\n      )\n      .catch((error: unknown) => {\n        if (isRowLevelSecurityError(error)) console.warn(refusalWarning(scope));\n        throw error;\n      });\n    return result ? toRecords(result, options.maxRows !== undefined) : [];\n  };\n};\n","import { readFile } from 'node:fs/promises';\n\nimport { createStorageClient } from '../../clients/storage';\nimport { ServiceId } from '../../constants/serviceIds';\nimport { lazy } from '../../utils/async';\nimport { isPlainObject } from '../../utils/isPlainObject';\n\nexport type Env = Record<string, string | undefined>;\n\n/** A setting the app needs is missing or unreadable; the message names the variable or file. */\nexport class AppConfigError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = 'AppConfigError';\n  }\n}\n\nexport type Settings = ReturnType<typeof createSettings>;\n\nconst STACK_INDEX_TIMEOUT = 10_000;\n\nconst required = (env: Env, name: string) => {\n  const value = env[name];\n  if (!value) throw new AppConfigError(`Missing environment variable ${name}`);\n  return value;\n};\n\nconst storageTokenFrom = async (env: Env) => {\n  const file = env.STORAGE_API_TOKEN_PATH;\n  if (!file) {\n    if (env.KBC_TOKEN) return env.KBC_TOKEN;\n    throw new AppConfigError('Missing Storage token: set STORAGE_API_TOKEN_PATH or KBC_TOKEN');\n  }\n  const content = await readFile(file, 'utf8').catch((error: unknown) => {\n    throw new AppConfigError(`Cannot read the file in STORAGE_API_TOKEN_PATH: ${file}`, {\n      cause: error,\n    });\n  });\n  const token = content.trim();\n  if (!token)\n    throw new AppConfigError(`The token file in STORAGE_API_TOKEN_PATH is empty: ${file}`);\n  return token;\n};\n\nconst manifestWorkspaceId = async (file: string) => {\n  let manifest: unknown;\n  try {\n    manifest = JSON.parse(await readFile(file, 'utf8'));\n  } catch (error) {\n    throw new AppConfigError(`Cannot read the JSON in KBC_WORKSPACE_MANIFEST_PATH: ${file}`, {\n      cause: error,\n    });\n  }\n  const id = isPlainObject(manifest) ? manifest.workspaceId : undefined;\n  if ((typeof id === 'string' && id) || typeof id === 'number') return String(id);\n  throw new AppConfigError(\n    `The manifest in KBC_WORKSPACE_MANIFEST_PATH has no workspaceId: ${file}`,\n  );\n};\n\nconst queryServiceUrlFromIndex = async (kbcUrl: string, token: string) => {\n  const { services } = await createStorageClient({\n    baseUrl: kbcUrl,\n    auth: { type: 'sapi-token', token },\n  }).getStackInfo({ exclude: 'components' }, AbortSignal.timeout(STACK_INDEX_TIMEOUT));\n  const url = services.find(({ id }) => id === ServiceId.Query)?.url;\n  if (!url) throw new AppConfigError('The stack index of KBC_URL lists no query service');\n  return url;\n};\n\n/**\n * What the platform provides a data app, read on first use; a missing value throws `AppConfigError`.\n *\n * - The Storage token is read on every call: the platform rotates the file in `STORAGE_API_TOKEN_PATH`.\n * - The workspace ID and the Query Service URL are read once per process.\n * - The Query Service URL is `QUERY_SERVICE_URL`, or the stack index of `KBC_URL` (local runs).\n */\nexport const createSettings = (env: Env) => {\n  const storageToken = () => storageTokenFrom(env);\n  const manifest = env.KBC_WORKSPACE_MANIFEST_PATH;\n\n  return {\n    branchId: () => required(env, 'BRANCH_ID'),\n    storageToken,\n    workspaceId: lazy(() =>\n      manifest ? manifestWorkspaceId(manifest) : required(env, 'WORKSPACE_ID'),\n    ),\n    queryServiceUrl: lazy(\n      async () =>\n        env.QUERY_SERVICE_URL ||\n        queryServiceUrlFromIndex(required(env, 'KBC_URL'), await storageToken()),\n    ),\n    hasWorkspace: Boolean(manifest || env.WORKSPACE_ID),\n  };\n};\n","import { createExpressErrorHandler } from './express';\nimport { type AppRequest, createRequestContext } from './requestContext';\nimport { createRunQuery } from './runQuery';\nimport { createSettings, type Env } from './settings';\n\n/** `env` replaces `process.env` (tests, local runs). */\nexport type DataAppServerOptions = { env?: Env };\n\n/**\n * Sets up Keboola access for this data app process; call it once.\n *\n * - Synchronous, no network call, never throws: each setting is read on first use.\n * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).\n * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.\n */\nexport const initializeApp = ({ env = process.env }: DataAppServerOptions = {}) => {\n  const settings = createSettings(env);\n  const requestContext = createRequestContext();\n\n  return {\n    server: {\n      runWithRequest: requestContext.runWithRequest,\n      currentUser: requestContext.currentUser,\n      currentUserKey: requestContext.currentUserKey,\n      expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) =>\n        requestContext.runWithRequest(req, next),\n      expressErrorHandler: createExpressErrorHandler,\n    },\n    workspace: settings.hasWorkspace\n      ? { runQuery: createRunQuery(settings, requestContext) }\n      : undefined,\n  };\n};\n\nexport type DataAppServer = ReturnType<typeof initializeApp>;\n"],"mappings":";;;;;;;;;;;;;;AASA,MAAa,mCACJ,KAAc,MAAe,KAAoB,SAAkC;CACxF,IAAI,IAAI,eAAe,CAACA,8BAAAA,wBAAwB,GAAG,GAAG;EACpD,KAAK,GAAG;EACR;CACF;CACA,IAAI,OAAOC,0BAAAA,WAAW,SAAS,CAAC,CAAC,KAAK;EAAE,OAAO,IAAI;EAAS,MAAM;CAAqB,CAAC;AAC1F;;ACGF,MAAM,iBAAiB,YACrB,SAAS,WAAW,OAAO,QAAQ,QAAQ;AAE7C,MAAM,kBAAkB,YAA4C;CAClE,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU;CACzD,IAAI,cAAc,OAAO,GAAG,OAAO,QAAQ,IAAA,sBAAyB,KAAK,KAAA;CACzE,MAAM,QAAQ,QAAQC,0BAAAA,sBAAsB,YAAY;CACxD,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,UAAU,KAAA;AACtD;AAEA,MAAM,UAAU,UAAuC;CACrD,MAAM,EAAE,KAAK,KAAK,UAAUC,sBAAAA,cAAc,KAAK,KAAK,CAAC;CACrD,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,CAAC,OAAO,CAAC,KAAK,OAAO,KAAA;CAC/E,OAAO,OAAO,UAAU,YAAY,QAAQ;EAAE;EAAK;EAAK;CAAM,IAAI;EAAE;EAAK;CAAI;AAC/E;;;;;;;;AASA,MAAa,6BAA6B;CACxC,MAAM,UAAU,IAAIC,iBAAAA,kBAAyB;CAC7C,MAAM,gBAAgB,QAAQ,SAAS;CAEvC,OAAO;EACL,iBAAoB,SAAqB,OAAmB;GAC1D,MAAM,eAAe,eAAe,OAAO;GAC3C,OAAO,QAAQ,IACb;IAAE;IAAc,MAAM,eAAe,OAAO,YAAY,IAAI,KAAA;GAAU,GACtE,EACF;EACF;EACA;EACA,mBAAmB,QAAQ,CAAC,EAAE;EAC9B,sBAAsB;GACpB,MAAM,OAAO,QAAQ,CAAC,EAAE;GACxB,OAAO,QAAQ,KAAK,UAAU,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;EACpD;CACF;AACF;;AC7DA,MAAM,aAAa;AACnB,MAAM,eAAe;AACrB,MAAM,UAAU;AAChB,MAAM,QAAQ;AACd,MAAM,qBAAqB;AAC3B,MAAM,SAAS;;AAEf,MAAM,eAAe;AAErB,MAAM,qBAAqB,YACzB,QAAQ,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC;AAErE,MAAM,aAAa,SAAiB;CAClC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,QAAQ,KAAK,IAAI,MAAM,OAAO,cAAc,CAAC,KAAK,kBAAkB,IAAI,KAAK,gBAChF,IACA;AACN;AAEA,MAAM,WAAW,SAAiB;CAChC,MAAM,IAAI,OAAO,IAAI;CACrB,OAAO,OAAO,SAAS,CAAC,IAAI,IAAI;AAClC;AAEA,MAAM,YAAY,0BAAiB,IAAI,KAAK,WAAW,IAAI,IAAI,GAAI,EAAA,CAAE,YAAY;AAEjF,MAAM,eAAe,SACnB,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,KAAK,QAAQ,oBAAoB,QAAQ;;;;;;;;AAS/E,MAAa,cAAc,SAA8C;CACvE,IAAI,aAAa,KAAK,IAAI,GAAG,OAAO;CACpC,IAAI,WAAW,KAAK,IAAI,GAAG,OAAO;CAClC,IAAI,gBAAgB,KAAK,IAAI,GAAG,QAAQ,SAAS,SAAS;CAC1D,IAAI,UAAU,KAAK,IAAI,GACrB,QAAQ,SACN,MAAM,KAAK,IAAI,qBAAI,IAAI,KAAK,OAAO,IAAI,IAAI,MAAM,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAEpF,IAAI,mBAAmB,KAAK,IAAI,GAC9B,QAAQ,SAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI;CAErE,IAAI,cAAc,KAAK,IAAI,GAAG,OAAO;CACrC,QAAQ,SAAS;AACnB;;ACrCA,MAAM,YAAY;AAClB,MAAM,UAAU;AAEhB,MAAM,kBAAkB,UAAiD;CACvE,MAAM,SAAS;CACf,IAAI,OAAO,cAAc,OAAO,GAAG,OAAO;CAI1C,OAAO,GAAG,OAAO,wBAAwBC,0BAAAA,sBAAsB,IAHhD,QACX,yBACA;AAEN;AAEA,MAAM,aAAa,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,gBAA6B,WAAoB;CAC7F,MAAM,UAAU,QAAQ,KAAK,EAAE,MAAM,YAAY;EAC/C,KAAK,KAAK,YAAY;EACtB,OAAO,WAAW,IAAI;CACxB,EAAE;CACF,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,EAAE,SAAS,SAAS;EAC7B,IAAI,KAAK,IAAI,GAAG,GACd,MAAM,IAAI,MAAM,oCAAoC,IAAI,qBAAqB;EAC/E,KAAK,IAAI,GAAG;CACd;CACA,MAAM,OAAO,KAAK,KAAK,QAAQ;EAC7B,MAAM,SAAkC,CAAC;EACzC,QAAQ,SAAS,EAAE,KAAK,SAAS,MAAM;GACrC,MAAM,OAAO,IAAI;GACjB,OAAO,OAAO,QAAQ,OAAO,OAAO,MAAM,IAAI;EAChD,CAAC;EACD,OAAO;CACT,CAAC;CACD,IAAI,CAAC,UAAU,iBAAiB,KAAA,KAAa,KAAK,SAAS,cACzD,MAAM,IAAI,MAAM,iBAAiB,KAAK,OAAO,MAAM,aAAa,MAAM;CAExE,OAAO;AACT;;;;;;;AAQA,MAAa,kBAAkB,UAAoB,mBAAmC;CACpF,MAAM,eAAeC,+BAAAA,sBAAsB,EACzC,oBAAoBC,qBAAAA,yBAAyB;EAC3C,SAAS,SAAS;EAClB,MAAM,YAA6C;GACjD,MAAM,eAAe,MAAM,SAAS,aAAa;GACjD,MAAM,eAAe,eAAe,QAAQ,CAAC,EAAE;GAC/C,OAAO,eACH;IAAE,MAAM;IAAkB,OAAO;IAAc;GAAa,IAC5D;IAAE,MAAM;IAAc,OAAO;GAAa;EAChD;CACF,CAAC,EACH,CAAC;CAED,OAAO,OAAO,KAAa,UAA2B,CAAC,MAA0C;EAC/F,MAAM,QAAQ,eAAe,QAAQ;EACrC,MAAM,CAAC,UAAU,MAAM,aACpB,aACC,SAAS,SAAS,GAClB,MAAM,SAAS,YAAY,GAC3B;GAAE,YAAY,CAAC,GAAG;GAAG,eAAe;EAAM,GAC1C;GAAE,GAAG;GAAS,UAAU;GAAW,SAAS,QAAQ,WAAW;EAAQ,CACzE,CAAC,CACA,OAAO,UAAmB;GACzB,IAAIC,8BAAAA,wBAAwB,KAAK,GAAG,QAAQ,KAAK,eAAe,KAAK,CAAC;GACtE,MAAM;EACR,CAAC;EACH,OAAO,SAAS,UAAU,QAAQ,QAAQ,YAAY,KAAA,CAAS,IAAI,CAAC;CACtE;AACF;;;AC1EA,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;AAIA,MAAM,sBAAsB;AAE5B,MAAM,YAAY,KAAU,SAAiB;CAC3C,MAAM,QAAQ,IAAI;CAClB,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,gCAAgC,MAAM;CAC3E,OAAO;AACT;AAEA,MAAM,mBAAmB,OAAO,QAAa;CAC3C,MAAM,OAAO,IAAI;CACjB,IAAI,CAAC,MAAM;EACT,IAAI,IAAI,WAAW,OAAO,IAAI;EAC9B,MAAM,IAAI,eAAe,gEAAgE;CAC3F;CAMA,MAAM,SAAQ,OAAA,GALQC,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACrE,MAAM,IAAI,eAAe,mDAAmD,QAAQ,EAClF,OAAO,MACT,CAAC;CACH,CAAC,EAAA,CACqB,KAAK;CAC3B,IAAI,CAAC,OACH,MAAM,IAAI,eAAe,sDAAsD,MAAM;CACvF,OAAO;AACT;AAEA,MAAM,sBAAsB,OAAO,SAAiB;CAClD,IAAI;CACJ,IAAI;EACF,WAAW,KAAK,MAAM,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,MAAM,MAAM,CAAC;CACpD,SAAS,OAAO;EACd,MAAM,IAAI,eAAe,wDAAwD,QAAQ,EACvF,OAAO,MACT,CAAC;CACH;CACA,MAAM,KAAKC,sBAAAA,cAAc,QAAQ,IAAI,SAAS,cAAc,KAAA;CAC5D,IAAK,OAAO,OAAO,YAAY,MAAO,OAAO,OAAO,UAAU,OAAO,OAAO,EAAE;CAC9E,MAAM,IAAI,eACR,mEAAmE,MACrE;AACF;AAEA,MAAM,2BAA2B,OAAO,QAAgB,UAAkB;CACxE,MAAM,EAAE,aAAa,MAAMC,gBAAAA,oBAAoB;EAC7C,SAAS;EACT,MAAM;GAAE,MAAM;GAAc;EAAM;CACpC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,aAAa,GAAG,YAAY,QAAQ,mBAAmB,CAAC;CACnF,MAAM,MAAM,SAAS,MAAM,EAAE,SAAS,OAAOC,mBAAAA,UAAU,KAAK,CAAC,EAAE;CAC/D,IAAI,CAAC,KAAK,MAAM,IAAI,eAAe,mDAAmD;CACtF,OAAO;AACT;;;;;;;;AASA,MAAa,kBAAkB,QAAa;CAC1C,MAAM,qBAAqB,iBAAiB,GAAG;CAC/C,MAAM,WAAW,IAAI;CAErB,OAAO;EACL,gBAAgB,SAAS,KAAK,WAAW;EACzC;EACA,aAAaC,yBAAAA,WACX,WAAW,oBAAoB,QAAQ,IAAI,SAAS,KAAK,cAAc,CACzE;EACA,iBAAiBA,yBAAAA,KACf,YACE,IAAI,qBACJ,yBAAyB,SAAS,KAAK,SAAS,GAAG,MAAM,aAAa,CAAC,CAC3E;EACA,cAAc,QAAQ,YAAY,IAAI,YAAY;CACpD;AACF;;;;;;;;;AC/EA,MAAa,iBAAiB,EAAE,MAAM,QAAQ,QAA8B,CAAC,MAAM;CACjF,MAAM,WAAW,eAAe,GAAG;CACnC,MAAM,iBAAiB,qBAAqB;CAE5C,OAAO;EACL,QAAQ;GACN,gBAAgB,eAAe;GAC/B,aAAa,eAAe;GAC5B,gBAAgB,eAAe;GAC/B,0BAA0B,KAAiB,MAAe,SACxD,eAAe,eAAe,KAAK,IAAI;GACzC,qBAAqB;EACvB;EACA,WAAW,SAAS,eAChB,EAAE,UAAU,eAAe,UAAU,cAAc,EAAE,IACrD,KAAA;CACN;AACF"}

package/dist/sdk/dataAppServer/index.d.cts

@@ -0,0 +1,55 @@
+import { b as ExecuteQueryOptions } from "../../index-BUKMdbKh.cjs";
+type NodeHeaders = Record<string, string | string[] | undefined>;
+type HeadersLike = {
+  get(name: string): string | null;
+};
+/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */
+type AppRequest = HeadersLike | {
+  headers: HeadersLike | NodeHeaders;
+};
+/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */
+type AppUser = {
+  idp: string;
+  sub: string;
+  email?: string;
+};
+type Env = Record<string, string | undefined>;
+/** A setting the app needs is missing or unreadable; the message names the variable or file. */
+declare class AppConfigError extends Error {
+  constructor(message: string, options?: ErrorOptions);
+}
+type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;
+type ErrorResponse = {
+  headersSent: boolean;
+  status(code: number): {
+    json(body: unknown): unknown;
+  };
+};
+/** Answers a row-level security refusal with 403 and passes any other error on. */
+declare const createExpressErrorHandler: () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => void;
+/** `env` replaces `process.env` (tests, local runs). */
+type DataAppServerOptions = {
+  env?: Env;
+};
+/**
+ * Sets up Keboola access for this data app process; call it once.
+ *
+ * - Synchronous, no network call, never throws: each setting is read on first use.
+ * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).
+ * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.
+ */
+declare const initializeApp: ({ env }?: DataAppServerOptions) => {
+  server: {
+    runWithRequest: <T>(request: AppRequest, fn: () => T) => T;
+    currentUser: () => AppUser | undefined;
+    currentUserKey: () => string | undefined;
+    expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) => void;
+    expressErrorHandler: typeof createExpressErrorHandler;
+  };
+  workspace: {
+    runQuery: (sql: string, options?: RunQueryOptions) => Promise<Record<string, unknown>[]>;
+  } | undefined;
+};
+type DataAppServer = ReturnType<typeof initializeApp>;
+export { AppConfigError, type AppRequest, type AppUser, type DataAppServer, type DataAppServerOptions, type RunQueryOptions, initializeApp };
+//# sourceMappingURL=index.d.cts.map

package/dist/sdk/dataAppServer/index.d.ts

@@ -0,0 +1,55 @@
+import { b as ExecuteQueryOptions } from "../../index-BxgHNJ3Q.js";
+type NodeHeaders = Record<string, string | string[] | undefined>;
+type HeadersLike = {
+  get(name: string): string | null;
+};
+/** A Fetch `Request` or `Headers`, or a Node request (Express, Fastify) with its lower-case `headers`. */
+type AppRequest = HeadersLike | {
+  headers: HeadersLike | NodeHeaders;
+};
+/** The signed-in user as the app user token names them; `email` only when the IdP verified it. */
+type AppUser = {
+  idp: string;
+  sub: string;
+  email?: string;
+};
+type Env = Record<string, string | undefined>;
+/** A setting the app needs is missing or unreadable; the message names the variable or file. */
+declare class AppConfigError extends Error {
+  constructor(message: string, options?: ErrorOptions);
+}
+type RunQueryOptions = Pick<ExecuteQueryOptions, 'timeout' | 'maxRows' | 'signal'>;
+type ErrorResponse = {
+  headersSent: boolean;
+  status(code: number): {
+    json(body: unknown): unknown;
+  };
+};
+/** Answers a row-level security refusal with 403 and passes any other error on. */
+declare const createExpressErrorHandler: () => (err: unknown, _req: unknown, res: ErrorResponse, next: (err?: unknown) => void) => void;
+/** `env` replaces `process.env` (tests, local runs). */
+type DataAppServerOptions = {
+  env?: Env;
+};
+/**
+ * Sets up Keboola access for this data app process; call it once.
+ *
+ * - Synchronous, no network call, never throws: each setting is read on first use.
+ * - `workspace` is `undefined` when no workspace is configured (the app has no Storage access).
+ * - `server.expressMiddleware()` goes first and `server.expressErrorHandler()` last.
+ */
+declare const initializeApp: ({ env }?: DataAppServerOptions) => {
+  server: {
+    runWithRequest: <T>(request: AppRequest, fn: () => T) => T;
+    currentUser: () => AppUser | undefined;
+    currentUserKey: () => string | undefined;
+    expressMiddleware: () => (req: AppRequest, _res: unknown, next: () => void) => void;
+    expressErrorHandler: typeof createExpressErrorHandler;
+  };
+  workspace: {
+    runQuery: (sql: string, options?: RunQueryOptions) => Promise<Record<string, unknown>[]>;
+  } | undefined;
+};
+type DataAppServer = ReturnType<typeof initializeApp>;
+export { AppConfigError, type AppRequest, type AppUser, type DataAppServer, type DataAppServerOptions, type RunQueryOptions, initializeApp };
+//# sourceMappingURL=index.d.ts.map