@keystrokehq/snowflake 0.0.1

package/dist/file-formats.d.mts

@@ -0,0 +1,39 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow } from "./statements-DJL0qVNA.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+import { CatalogResult, ShowScopedOptions, showFileFormats } from "./catalog.mjs";
+
+//#region src/file-formats.d.ts
+interface FileFormatRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+}
+interface FileFormatContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface CreateFileFormatOptions extends FileFormatRef, FileFormatContext {
+  readonly orReplace?: boolean;
+  readonly ifNotExists?: boolean;
+  readonly temporary?: boolean;
+  /** `TYPE = 'CSV'`, `FIELD_DELIMITER = '|'`, `SKIP_HEADER = 1`, etc. */
+  readonly options: OptionMap;
+  readonly comment?: string;
+}
+declare function createFileFormat(client: SnowflakeClient, options: CreateFileFormatOptions): Promise<void>;
+interface AlterFileFormatOptions extends FileFormatRef, FileFormatContext {
+  readonly rename?: FileFormatRef;
+  readonly set?: OptionMap;
+  readonly unset?: readonly string[];
+  readonly comment?: string;
+}
+declare function alterFileFormat(client: SnowflakeClient, options: AlterFileFormatOptions): Promise<void>;
+interface DropFileFormatOptions extends FileFormatRef, FileFormatContext {
+  readonly ifExists?: boolean;
+}
+declare function dropFileFormat(client: SnowflakeClient, options: DropFileFormatOptions): Promise<void>;
+interface DescribeFileFormatOptions extends FileFormatRef, FileFormatContext {}
+declare function describeFileFormat(client: SnowflakeClient, options: DescribeFileFormatOptions): Promise<readonly HydratedRow[]>;
+//#endregion
+export { AlterFileFormatOptions, type CatalogResult, CreateFileFormatOptions, DescribeFileFormatOptions, DropFileFormatOptions, FileFormatContext, FileFormatRef, type ShowScopedOptions, alterFileFormat, createFileFormat, describeFileFormat, dropFileFormat, showFileFormats };

package/dist/file-formats.mjs

@@ -0,0 +1,48 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+import { showFileFormats } from "./catalog.mjs";
+
+//#region src/file-formats.ts
+function fileFormatFqn(ref) {
+	return buildFqn(ref.database, ref.schema, ref.name);
+}
+async function createFileFormat(client, options) {
+	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""}${options.temporary ? " TEMPORARY" : ""} FILE FORMAT${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
+	const body = formatOptions(options.options);
+	await executeSql(client, {
+		statement: `${prefix} ${fileFormatFqn(options)} ${body}` + (options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : ""),
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function alterFileFormat(client, options) {
+	let tail;
+	if (options.rename) tail = `RENAME TO ${fileFormatFqn(options.rename)}`;
+	else if (options.set && Object.keys(options.set).length > 0) tail = `SET ${formatOptions(options.set)}`;
+	else if (options.unset && options.unset.length > 0) tail = `UNSET ${options.unset.map((k) => k.toUpperCase()).join(", ")}`;
+	else if (options.comment !== void 0) tail = `SET COMMENT = ${quoteLiteral(options.comment)}`;
+	else throw new Error("alterFileFormat requires one of: rename / set / unset / comment");
+	await executeSql(client, {
+		statement: `ALTER FILE FORMAT ${fileFormatFqn(options)} ${tail}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function dropFileFormat(client, options) {
+	await executeSql(client, {
+		statement: `DROP FILE FORMAT${options.ifExists ? " IF EXISTS" : ""} ${fileFormatFqn(options)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function describeFileFormat(client, options) {
+	return (await executeSql(client, {
+		statement: `DESCRIBE FILE FORMAT ${fileFormatFqn(options)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows;
+}
+
+//#endregion
+export { alterFileFormat, createFileFormat, describeFileFormat, dropFileFormat, showFileFormats };

package/dist/functions.d.mts

@@ -0,0 +1,53 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow } from "./statements-DJL0qVNA.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+import { CatalogResult, ShowScopedOptions, showFunctions } from "./catalog.mjs";
+
+//#region src/functions.d.ts
+interface FunctionRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+}
+interface FunctionContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface FunctionArgument {
+  readonly name: string;
+  /** Snowflake type keyword (NUMBER, VARCHAR, DATE, VARIANT, ...). */
+  readonly type: string;
+  readonly defaultExpression?: string;
+}
+type FunctionLanguage = 'SQL' | 'JAVASCRIPT' | 'PYTHON' | 'JAVA' | 'SCALA';
+interface CreateFunctionOptions extends FunctionRef, FunctionContext {
+  readonly orReplace?: boolean;
+  readonly ifNotExists?: boolean;
+  readonly secure?: boolean;
+  readonly temporary?: boolean;
+  readonly arguments?: readonly FunctionArgument[];
+  /** Return type keyword, e.g. `NUMBER`, `VARCHAR`, `TABLE (col1 NUMBER, col2 VARCHAR)`. */
+  readonly returns: string;
+  readonly language?: FunctionLanguage;
+  /** `STRICT`, `IMMUTABLE`, `VOLATILE`, `MEMOIZABLE`, `RETURNS NULL ON NULL INPUT`. Raw keywords joined with spaces. */
+  readonly modifiers?: readonly string[];
+  /** Language-specific options: `RUNTIME_VERSION = '3.10'`, `PACKAGES = ('snowflake-snowpark-python')`, `HANDLER = 'main'`, `IMPORTS = (@STG/pkg.zip)`. */
+  readonly options?: OptionMap;
+  readonly comment?: string;
+  /** Function body (SQL expression, JS, Python, Java). `$$...$$` wrapping is applied automatically for non-SQL languages. */
+  readonly as: string;
+  /** Force `$$...$$` (dollar-quoted) body delimiter even for SQL. */
+  readonly dollarQuotedBody?: boolean;
+}
+declare function createFunction(client: SnowflakeClient, options: CreateFunctionOptions): Promise<void>;
+interface DropFunctionOptions extends FunctionRef, FunctionContext {
+  readonly ifExists?: boolean;
+  readonly arguments?: readonly FunctionArgument[];
+}
+declare function dropFunction(client: SnowflakeClient, options: DropFunctionOptions): Promise<void>;
+interface DescribeFunctionOptions extends FunctionRef, FunctionContext {
+  readonly arguments?: readonly FunctionArgument[];
+}
+declare function describeFunction(client: SnowflakeClient, options: DescribeFunctionOptions): Promise<readonly HydratedRow[]>;
+//#endregion
+export { type CatalogResult, CreateFunctionOptions, DescribeFunctionOptions, DropFunctionOptions, FunctionArgument, FunctionContext, FunctionLanguage, FunctionRef, type ShowScopedOptions, createFunction, describeFunction, dropFunction, showFunctions };

package/dist/functions.mjs

@@ -0,0 +1,56 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+import { showFunctions } from "./catalog.mjs";
+
+//#region src/functions.ts
+function renderArguments(args) {
+	if (!args || args.length === 0) return "()";
+	return `(${args.map((a) => {
+		const suffix = a.defaultExpression ? ` DEFAULT ${a.defaultExpression}` : "";
+		return `${a.name} ${a.type.toUpperCase()}${suffix}`;
+	}).join(", ")})`;
+}
+function renderArgumentTypes(args) {
+	if (!args || args.length === 0) return "()";
+	return `(${args.map((a) => a.type.toUpperCase()).join(", ")})`;
+}
+function renderBody(body, forceDollarQuoted, language) {
+	if (forceDollarQuoted ?? (language !== void 0 && language !== "SQL")) {
+		if (body.includes("$$")) throw new Error("Function body contains \"$$\"; cannot safely dollar-quote. Use quoteLiteral-style body or a custom delimiter.");
+		return `$$${body}$$`;
+	}
+	return body;
+}
+async function createFunction(client, options) {
+	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""}${options.secure ? " SECURE" : ""}${options.temporary ? " TEMPORARY" : ""} FUNCTION${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
+	const args = renderArguments(options.arguments);
+	const language = options.language ? ` LANGUAGE ${options.language}` : "";
+	const modifiers = options.modifiers && options.modifiers.length > 0 ? ` ${options.modifiers.map((m) => m.toUpperCase()).join(" ")}` : "";
+	const body = options.options && Object.keys(options.options).length > 0 ? ` ${formatOptions(options.options)}` : "";
+	const comment = options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : "";
+	const rendered = renderBody(options.as, options.dollarQuotedBody, options.language);
+	await executeSql(client, {
+		statement: `${prefix} ${buildFqn(options.database, options.schema, options.name)}${args} RETURNS ${options.returns}${language}${modifiers}${body}${comment} AS ${rendered}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function dropFunction(client, options) {
+	const fqn = buildFqn(options.database, options.schema, options.name);
+	await executeSql(client, {
+		statement: `DROP FUNCTION${options.ifExists ? " IF EXISTS" : ""} ${fqn}${renderArgumentTypes(options.arguments)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function describeFunction(client, options) {
+	return (await executeSql(client, {
+		statement: `DESCRIBE FUNCTION ${buildFqn(options.database, options.schema, options.name)}${renderArgumentTypes(options.arguments)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows;
+}
+
+//#endregion
+export { createFunction, describeFunction, dropFunction, showFunctions };

package/dist/grants.d.mts

@@ -0,0 +1,93 @@
+import { SnowflakeClient } from "./client.mjs";
+import { CatalogResult, ShowOptions, showGrants } from "./catalog.mjs";
+
+//#region src/grants.d.ts
+interface GrantContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+/**
+ * What a privilege is being granted on. `kind: 'object'` covers the
+ * vast majority of cases (TABLE / VIEW / STAGE / FILE FORMAT / FUNCTION /
+ * PROCEDURE / STREAM / TASK / PIPE / ...). Scope-level variants
+ * (`database` / `schema` / `warehouse` / `role` / `integration` / `account`)
+ * cover grants that apply to whole containers. `allIn` / `futureIn`
+ * produce `GRANT ... ON ALL|FUTURE <PLURAL> IN ...` statements.
+ */
+type GrantOn = {
+  readonly kind: 'object'; /** Snowflake object keyword, e.g., `TABLE`, `VIEW`, `STAGE`. */
+  readonly objectType: string;
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+} | {
+  readonly kind: 'database' | 'warehouse' | 'role' | 'integration';
+  readonly name: string;
+} | {
+  readonly kind: 'schema';
+  readonly database?: string;
+  readonly name: string;
+} | {
+  readonly kind: 'account';
+} | {
+  readonly kind: 'allIn' | 'futureIn'; /** Plural keyword, e.g., `TABLES`, `VIEWS`, `SCHEMAS`. */
+  readonly pluralType: string;
+  readonly inDatabase?: string;
+  readonly inSchema?: {
+    readonly database?: string;
+    readonly name: string;
+  };
+};
+type GrantTarget = {
+  readonly role: string;
+} | {
+  readonly user: string;
+} | {
+  readonly share: string;
+};
+interface GrantPrivilegesOptions extends GrantContext {
+  readonly privileges: 'ALL' | 'ALL PRIVILEGES' | readonly string[];
+  readonly on: GrantOn;
+  readonly to: GrantTarget;
+  readonly withGrantOption?: boolean;
+}
+declare function grantPrivileges(client: SnowflakeClient, options: GrantPrivilegesOptions): Promise<void>;
+interface RevokePrivilegesOptions extends GrantContext {
+  readonly privileges: 'ALL' | 'ALL PRIVILEGES' | readonly string[];
+  readonly on: GrantOn;
+  readonly from: GrantTarget;
+  /** Only revoke the grant option, not the underlying privilege. */
+  readonly grantOptionFor?: boolean;
+  readonly cascade?: boolean;
+  readonly restrict?: boolean;
+}
+declare function revokePrivileges(client: SnowflakeClient, options: RevokePrivilegesOptions): Promise<void>;
+interface ShowGrantsToRoleOptions extends ShowOptions {
+  readonly role: string;
+}
+declare function showGrantsToRole(client: SnowflakeClient, options: ShowGrantsToRoleOptions): Promise<CatalogResult>;
+interface ShowGrantsToUserOptions extends ShowOptions {
+  readonly user: string;
+}
+declare function showGrantsToUser(client: SnowflakeClient, options: ShowGrantsToUserOptions): Promise<CatalogResult>;
+interface ShowGrantsOnObjectOptions extends ShowOptions {
+  readonly objectType: string;
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+}
+declare function showGrantsOnObject(client: SnowflakeClient, options: ShowGrantsOnObjectOptions): Promise<CatalogResult>;
+interface ShowGrantsOfRoleOptions extends ShowOptions {
+  readonly role: string;
+}
+declare function showGrantsOfRole(client: SnowflakeClient, options: ShowGrantsOfRoleOptions): Promise<CatalogResult>;
+interface ShowFutureGrantsOptions extends ShowOptions {
+  readonly inDatabase?: string;
+  readonly inSchema?: {
+    readonly database?: string;
+    readonly name: string;
+  };
+}
+declare function showFutureGrants(client: SnowflakeClient, options: ShowFutureGrantsOptions): Promise<CatalogResult>;
+//#endregion
+export { type CatalogResult, GrantContext, GrantOn, GrantPrivilegesOptions, GrantTarget, RevokePrivilegesOptions, ShowFutureGrantsOptions, ShowGrantsOfRoleOptions, ShowGrantsOnObjectOptions, ShowGrantsToRoleOptions, ShowGrantsToUserOptions, grantPrivileges, revokePrivileges, showFutureGrants, showGrants, showGrantsOfRole, showGrantsOnObject, showGrantsToRole, showGrantsToUser };

package/dist/grants.mjs

@@ -0,0 +1,102 @@
+import { executeSql } from "./sql.mjs";
+import { i as quoteIdentifier, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { showGrants } from "./catalog.mjs";
+
+//#region src/grants.ts
+/**
+* Grants / privileges: GRANT, REVOKE, and five SHOW GRANTS convenience
+* wrappers plus SHOW FUTURE GRANTS.
+*
+* Covers PLAN §6.15 (7 actions).
+*/
+function renderScope(on) {
+	switch (on.kind) {
+		case "object": return `${on.objectType.toUpperCase()} ${buildFqn(on.database, on.schema, on.name)}`;
+		case "schema": return `SCHEMA ${buildFqn(on.database, on.name)}`;
+		case "database": return `DATABASE ${quoteIdentifier(on.name)}`;
+		case "warehouse": return `WAREHOUSE ${quoteIdentifier(on.name)}`;
+		case "role": return `ROLE ${quoteIdentifier(on.name)}`;
+		case "integration": return `INTEGRATION ${quoteIdentifier(on.name)}`;
+		case "account": return "ACCOUNT";
+		case "allIn":
+		case "futureIn": {
+			const modifier = on.kind === "allIn" ? "ALL" : "FUTURE";
+			const plural = on.pluralType.toUpperCase();
+			if (on.inDatabase) return `${modifier} ${plural} IN DATABASE ${quoteIdentifier(on.inDatabase)}`;
+			if (on.inSchema) return `${modifier} ${plural} IN SCHEMA ${buildFqn(on.inSchema.database, on.inSchema.name)}`;
+			throw new Error(`${on.kind} requires inDatabase or inSchema`);
+		}
+	}
+}
+function renderTarget(target) {
+	if ("role" in target) return `ROLE ${quoteIdentifier(target.role)}`;
+	if ("user" in target) return `USER ${quoteIdentifier(target.user)}`;
+	return `SHARE ${quoteIdentifier(target.share)}`;
+}
+function renderPrivileges(privileges) {
+	if (privileges === "ALL" || privileges === "ALL PRIVILEGES") return "ALL PRIVILEGES";
+	if (privileges.length === 0) throw new Error("privileges must be non-empty (or \"ALL\" / \"ALL PRIVILEGES\")");
+	return privileges.map((p) => p.toUpperCase()).join(", ");
+}
+async function grantPrivileges(client, options) {
+	await executeSql(client, {
+		statement: `GRANT ${renderPrivileges(options.privileges)} ON ${renderScope(options.on)} TO ${renderTarget(options.to)}${options.withGrantOption ? " WITH GRANT OPTION" : ""}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function revokePrivileges(client, options) {
+	if (options.cascade && options.restrict) throw new Error("revokePrivileges: cascade and restrict are mutually exclusive");
+	await executeSql(client, {
+		statement: `${options.grantOptionFor ? "REVOKE GRANT OPTION FOR" : "REVOKE"} ${renderPrivileges(options.privileges)} ON ${renderScope(options.on)} FROM ${renderTarget(options.from)}${options.cascade ? " CASCADE" : options.restrict ? " RESTRICT" : ""}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function showGrantsToRole(client, options) {
+	return showGrants(client, {
+		...options,
+		toRole: options.role
+	});
+}
+async function showGrantsToUser(client, options) {
+	return showGrants(client, {
+		...options,
+		toUser: options.user
+	});
+}
+async function showGrantsOnObject(client, options) {
+	return showGrants(client, {
+		...options,
+		on: {
+			objectType: options.objectType,
+			database: options.database,
+			schema: options.schema,
+			name: options.name
+		}
+	});
+}
+async function showGrantsOfRole(client, options) {
+	return showGrants(client, {
+		...options,
+		ofRole: options.role
+	});
+}
+async function showFutureGrants(client, options) {
+	let scope;
+	if (options.inDatabase) scope = `DATABASE ${quoteIdentifier(options.inDatabase)}`;
+	else if (options.inSchema) scope = `SCHEMA ${buildFqn(options.inSchema.database, options.inSchema.name)}`;
+	else throw new Error("showFutureGrants requires inDatabase or inSchema");
+	const result = await executeSql(client, {
+		statement: `SHOW FUTURE GRANTS IN ${scope}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+	return {
+		rows: result.rows,
+		columns: result.columns
+	};
+}
+
+//#endregion
+export { grantPrivileges, revokePrivileges, showFutureGrants, showGrants, showGrantsOfRole, showGrantsOnObject, showGrantsToRole, showGrantsToUser };

package/dist/index.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/index.mjs

@@ -0,0 +1 @@
+export {  };

package/dist/integration-CCWMSTlO.d.mts

@@ -0,0 +1,170 @@
+import * as _keystrokehq_integration_authoring_official0 from "@keystrokehq/integration-authoring/official";
+import { z } from "zod";
+import * as _keystrokehq_core0 from "@keystrokehq/core";
+import * as _keystrokehq_core_credential_set0 from "@keystrokehq/core/credential-set";
+import { InferCredentialSetAuth } from "@keystrokehq/core/credential-set";
+
+//#region src/integration.d.ts
+/**
+ * Public auth schema for Snowflake connections.
+ *
+ * Modeled as a discriminated union on `mode`. `connection.kind` is `manual`
+ * because Keystroke does not run an interactive Snowflake OAuth dance — OAuth
+ * mode accepts a bearer token provided by the caller (external IdP /
+ * Snowflake-hosted OAuth). See `IMPLEMENTATION_NOTES.md` § 2 for rationale.
+ */
+declare const snowflakeAuthModeSchema: z.ZodEnum<{
+  keypair: "keypair";
+  oauth: "oauth";
+  pat: "pat";
+  basic: "basic";
+}>;
+type SnowflakeAuthMode = z.infer<typeof snowflakeAuthModeSchema>;
+declare const snowflakeAuthSchema: z.ZodObject<{
+  mode: z.ZodEnum<{
+    keypair: "keypair";
+    oauth: "oauth";
+    pat: "pat";
+    basic: "basic";
+  }>;
+  SNOWFLAKE_ACCOUNT: z.ZodString;
+  SNOWFLAKE_USER: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PAT: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PASSWORD: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_ID: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_TOKEN_URL: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_SCOPES: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_ROLE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_WAREHOUSE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_DATABASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_SCHEMA: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_HOST: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const snowflakeOfficialIntegration: {
+  id: "snowflake";
+  name: string;
+  description: string;
+  auth: z.ZodObject<{
+    mode: z.ZodEnum<{
+      keypair: "keypair";
+      oauth: "oauth";
+      pat: "pat";
+      basic: "basic";
+    }>;
+    SNOWFLAKE_ACCOUNT: z.ZodString;
+    SNOWFLAKE_USER: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_PAT: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_PASSWORD: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_TOKEN_URL: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_OAUTH_SCOPES: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_ROLE: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_WAREHOUSE: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_DATABASE: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_SCHEMA: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_HOST: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
+    SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+};
+declare const snowflakeBundle: _keystrokehq_integration_authoring_official0.OfficialIntegrationBundle<"snowflake", z.ZodObject<{
+  mode: z.ZodEnum<{
+    keypair: "keypair";
+    oauth: "oauth";
+    pat: "pat";
+    basic: "basic";
+  }>;
+  SNOWFLAKE_ACCOUNT: z.ZodString;
+  SNOWFLAKE_USER: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PAT: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PASSWORD: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_ID: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_TOKEN_URL: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_SCOPES: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_ROLE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_WAREHOUSE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_DATABASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_SCHEMA: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_HOST: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>;
+declare const snowflake: _keystrokehq_core0.CredentialSet<"snowflake", z.ZodObject<{
+  mode: z.ZodEnum<{
+    keypair: "keypair";
+    oauth: "oauth";
+    pat: "pat";
+    basic: "basic";
+  }>;
+  SNOWFLAKE_ACCOUNT: z.ZodString;
+  SNOWFLAKE_USER: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PAT: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PASSWORD: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_ID: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_TOKEN_URL: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_SCOPES: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_ROLE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_WAREHOUSE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_DATABASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_SCHEMA: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_HOST: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
+  mode: z.ZodEnum<{
+    keypair: "keypair";
+    oauth: "oauth";
+    pat: "pat";
+    basic: "basic";
+  }>;
+  SNOWFLAKE_ACCOUNT: z.ZodString;
+  SNOWFLAKE_USER: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PAT: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PASSWORD: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_ID: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_TOKEN_URL: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_OAUTH_SCOPES: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_ROLE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_WAREHOUSE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_DATABASE: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_SCHEMA: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_HOST: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_REGION: z.ZodOptional<z.ZodString>;
+  SNOWFLAKE_PUBLIC_KEY_FP: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>[] | undefined>;
+type SnowflakeCredentials = InferCredentialSetAuth<typeof snowflake>;
+/**
+ * Parse raw credential values through the full refinement pipeline. Callers
+ * (client, operations) should use this instead of the raw object schema so
+ * mode-specific invariants are enforced.
+ */
+declare function parseSnowflakeCredentials(input: unknown): SnowflakeCredentials;
+//#endregion
+export { snowflakeAuthModeSchema as a, snowflakeOfficialIntegration as c, snowflake as i, SnowflakeCredentials as n, snowflakeAuthSchema as o, parseSnowflakeCredentials as r, snowflakeBundle as s, SnowflakeAuthMode as t };