@keystrokehq/snowflake 0.0.1

package/dist/integration-Dptv8L0L.mjs

@@ -0,0 +1,207 @@
+import { defineOfficialIntegration } from "@keystrokehq/integration-authoring/official";
+import { z } from "zod";
+import { CredentialSet } from "@keystrokehq/core";
+
+//#region src/webhook-credentials.ts
+/**
+* Webhook credential sets for the Snowflake auto-ingest triggers.
+*
+* Snowflake has no native webhook product — auto-ingest relies on
+* cloud-provider event buses (AWS SNS, GCP Pub/Sub, Azure Event Grid)
+* that forward object-storage notifications to a public endpoint.
+* Each cloud has a different trust model, so we ship one credential
+* set per cloud rather than a single generic "auto-ingest" set.
+*
+* These credentials hold only the verification material the webhook
+* receiver needs — the cloud provider itself controls who can publish
+* to the topic/queue/event-grid. All auth fields are strings to keep
+* them CredentialSet-compatible (auth shapes are Zod objects without
+* unions/optionals-at-root).
+*/
+/**
+* AWS SNS webhook credentials.
+*
+* SNS verifies message authenticity via an X.509 signature whose public
+* cert is published at an SNS-hosted URL. The only real secret is the
+* optional {@link expectedTopicArn}: tight-scoping to a single topic
+* prevents an attacker that fooled SNS signing (not possible absent a
+* certificate compromise) from posting events from an unrelated topic.
+*/
+const snowflakeS3SnsWebhookCredentialSet = new CredentialSet({
+	id: "snowflake-s3-sns-webhook",
+	exposure: "platform-only",
+	name: "Snowflake Auto-Ingest — AWS SNS",
+	auth: z.object({
+		expectedTopicArn: z.string().optional(),
+		allowedSigningCertHostPattern: z.string().default("^sns\\.[a-z0-9-]+\\.amazonaws\\.com(\\.cn)?$").optional(),
+		autoConfirmSubscriptions: z.enum(["true", "false"]).default("false").optional()
+	})
+});
+/**
+* GCP Pub/Sub push subscriptions sign each request with a Google-minted
+* OIDC JWT (RS256) in the `Authorization` header. Verification requires
+* knowing:
+*
+*  - `expectedAudience`: the OIDC audience configured on the push
+*    subscription (commonly the webhook URL itself).
+*  - `expectedServiceAccount`: the push subscription's service-account
+*    email, which appears as the JWT `email` claim.
+*
+* Both are public identifiers, but pinning them prevents an attacker
+* with any valid Google OIDC token from impersonating the subscription.
+*/
+const snowflakeGcsPubSubWebhookCredentialSet = new CredentialSet({
+	id: "snowflake-gcs-pubsub-webhook",
+	exposure: "platform-only",
+	name: "Snowflake Auto-Ingest — GCS Pub/Sub",
+	auth: z.object({
+		expectedAudience: z.string().min(1),
+		expectedServiceAccount: z.string().min(1),
+		jwksUri: z.string().default("https://www.googleapis.com/oauth2/v3/certs").optional(),
+		issuer: z.string().default("https://accounts.google.com").optional()
+	})
+});
+/**
+* Azure Event Grid authenticates webhook endpoints via one-time
+* handshake validation (validation code or URL) rather than per-request
+* signatures. If the operator wires a **shared secret** into the
+* Event Grid subscription as a custom header, that secret can be
+* checked here as a defence-in-depth measure.
+*
+* Event Grid's synchronous handshake (`SubscriptionValidationEvent`) is
+* not fulfillable through the Keystroke static-response webhook
+* primitive; Snowflake operators should use **manual handshake** or
+* Cloud-Events schema. See `IMPLEMENTATION_NOTES.md` § trigger webhooks.
+*/
+const snowflakeAzureEventGridWebhookCredentialSet = new CredentialSet({
+	id: "snowflake-azure-eventgrid-webhook",
+	exposure: "platform-only",
+	name: "Snowflake Auto-Ingest — Azure Event Grid",
+	auth: z.object({
+		sharedSecret: z.string().optional(),
+		sharedSecretHeader: z.string().default("aeg-subscription-secret").optional(),
+		expectedTopicArn: z.string().optional()
+	})
+});
+
+//#endregion
+//#region src/integration.ts
+/**
+* Public auth schema for Snowflake connections.
+*
+* Modeled as a discriminated union on `mode`. `connection.kind` is `manual`
+* because Keystroke does not run an interactive Snowflake OAuth dance — OAuth
+* mode accepts a bearer token provided by the caller (external IdP /
+* Snowflake-hosted OAuth). See `IMPLEMENTATION_NOTES.md` § 2 for rationale.
+*/
+const snowflakeAuthModeSchema = z.enum([
+	"keypair",
+	"oauth",
+	"pat",
+	"basic"
+]);
+/**
+* Flat Zod object — the official integration contract constrains `auth` to a
+* `ZodObject<ZodRawShape>`, so mode-specific fields are declared as optional
+* and validated via `superRefine` below. Runtime invariants still cover:
+*  - keypair → requires SNOWFLAKE_USER + SNOWFLAKE_PRIVATE_KEY
+*  - oauth   → requires SNOWFLAKE_OAUTH_ACCESS_TOKEN
+*  - pat     → requires SNOWFLAKE_USER + SNOWFLAKE_PAT
+*  - basic   → requires SNOWFLAKE_USER + SNOWFLAKE_PASSWORD
+*/
+const baseSnowflakeAuthShape = {
+	mode: snowflakeAuthModeSchema,
+	SNOWFLAKE_ACCOUNT: z.string().min(1),
+	SNOWFLAKE_USER: z.string().min(1).optional(),
+	SNOWFLAKE_PRIVATE_KEY: z.string().min(1).optional(),
+	SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.string().optional(),
+	SNOWFLAKE_PAT: z.string().min(1).optional(),
+	SNOWFLAKE_PASSWORD: z.string().min(1).optional(),
+	SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.string().min(1).optional(),
+	SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.string().optional(),
+	SNOWFLAKE_OAUTH_CLIENT_ID: z.string().optional(),
+	SNOWFLAKE_OAUTH_CLIENT_SECRET: z.string().optional(),
+	SNOWFLAKE_OAUTH_TOKEN_URL: z.string().url().optional(),
+	SNOWFLAKE_OAUTH_SCOPES: z.string().optional(),
+	SNOWFLAKE_ROLE: z.string().optional(),
+	SNOWFLAKE_WAREHOUSE: z.string().optional(),
+	SNOWFLAKE_DATABASE: z.string().optional(),
+	SNOWFLAKE_SCHEMA: z.string().optional(),
+	SNOWFLAKE_HOST: z.string().optional(),
+	SNOWFLAKE_REGION: z.string().optional(),
+	SNOWFLAKE_PUBLIC_KEY_FP: z.string().optional()
+};
+const snowflakeAuthSchema = z.object(baseSnowflakeAuthShape).superRefine((value, ctx) => {
+	if (value.mode === "keypair") {
+		if (!value.SNOWFLAKE_USER) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_USER"],
+			message: "SNOWFLAKE_USER is required when mode = \"keypair\""
+		});
+		if (!value.SNOWFLAKE_PRIVATE_KEY) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_PRIVATE_KEY"],
+			message: "SNOWFLAKE_PRIVATE_KEY is required when mode = \"keypair\""
+		});
+	} else if (value.mode === "oauth") {
+		if (!value.SNOWFLAKE_OAUTH_ACCESS_TOKEN) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_OAUTH_ACCESS_TOKEN"],
+			message: "SNOWFLAKE_OAUTH_ACCESS_TOKEN is required when mode = \"oauth\""
+		});
+	} else if (value.mode === "pat") {
+		if (!value.SNOWFLAKE_USER) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_USER"],
+			message: "SNOWFLAKE_USER is required when mode = \"pat\""
+		});
+		if (!value.SNOWFLAKE_PAT) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_PAT"],
+			message: "SNOWFLAKE_PAT is required when mode = \"pat\""
+		});
+	} else if (value.mode === "basic") {
+		if (!value.SNOWFLAKE_USER) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_USER"],
+			message: "SNOWFLAKE_USER is required when mode = \"basic\""
+		});
+		if (!value.SNOWFLAKE_PASSWORD) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: ["SNOWFLAKE_PASSWORD"],
+			message: "SNOWFLAKE_PASSWORD is required when mode = \"basic\""
+		});
+	}
+});
+/**
+* `auth` shape used when defining the official integration. Must be a
+* `ZodObject<ZodRawShape>` — refinements are attached for callers via
+* {@link parseSnowflakeCredentials}.
+*/
+const snowflakeAuthObjectSchema = z.object(baseSnowflakeAuthShape);
+const snowflakeOfficialIntegration = {
+	id: "snowflake",
+	name: "Snowflake",
+	description: "Snowflake data cloud: SQL API v2, Snowpipe (file + streaming), warehouses, roles, users, grants, shares, streams, tasks, and administration for Keystroke workflows.",
+	auth: snowflakeAuthObjectSchema
+};
+const snowflakeBundle = defineOfficialIntegration({
+	...snowflakeOfficialIntegration,
+	internal: { other: [
+		snowflakeS3SnsWebhookCredentialSet,
+		snowflakeGcsPubSubWebhookCredentialSet,
+		snowflakeAzureEventGridWebhookCredentialSet
+	] }
+});
+const snowflake = snowflakeBundle.credentialSet;
+/**
+* Parse raw credential values through the full refinement pipeline. Callers
+* (client, operations) should use this instead of the raw object schema so
+* mode-specific invariants are enforced.
+*/
+function parseSnowflakeCredentials(input) {
+	return snowflakeAuthSchema.parse(input);
+}
+
+//#endregion
+export { snowflakeBundle as a, snowflakeGcsPubSubWebhookCredentialSet as c, snowflakeAuthSchema as i, snowflakeS3SnsWebhookCredentialSet as l, snowflake as n, snowflakeOfficialIntegration as o, snowflakeAuthModeSchema as r, snowflakeAzureEventGridWebhookCredentialSet as s, parseSnowflakeCredentials as t };

package/dist/org-admin.d.mts

@@ -0,0 +1,80 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow, m as ColumnMeta } from "./statements-DJL0qVNA.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+
+//#region src/org-admin.d.ts
+interface OrgAdminContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface ListOrganizationAccountsOptions extends OrgAdminContext {
+  readonly like?: string;
+}
+interface ListOrganizationAccountsResult {
+  readonly columns: readonly ColumnMeta[];
+  readonly rows: readonly HydratedRow[];
+}
+/**
+ * `SHOW ORGANIZATION ACCOUNTS`. Lists every account in the org (ORGADMIN
+ * only).
+ */
+declare function listOrganizationAccounts(client: SnowflakeClient, options?: ListOrganizationAccountsOptions): Promise<ListOrganizationAccountsResult>;
+interface CreateOrganizationAccountOptions extends OrgAdminContext {
+  readonly name: string;
+  readonly adminName: string;
+  readonly adminPassword: string;
+  readonly email: string;
+  /** `STANDARD`, `ENTERPRISE`, `BUSINESS_CRITICAL`, `VPS`. */
+  readonly edition: 'STANDARD' | 'ENTERPRISE' | 'BUSINESS_CRITICAL' | 'VPS';
+  /** Snowflake region identifier, e.g. `AWS_US_WEST_2`. */
+  readonly region?: string;
+  readonly regionGroup?: string;
+  readonly firstName?: string;
+  readonly lastName?: string;
+  readonly mustChangePassword?: boolean;
+  readonly comment?: string;
+  /** Any other `KEY = value` options the org admin wants to forward. */
+  readonly options?: OptionMap;
+}
+/**
+ * `CREATE ORGANIZATION ACCOUNT <name>
+ *    ADMIN_NAME = '...' ADMIN_PASSWORD = '...' EMAIL = '...'
+ *    EDITION = '...' [REGION = '...'] [REGION_GROUP = '...']
+ *    [FIRST_NAME = '...'] [LAST_NAME = '...']
+ *    [MUST_CHANGE_PASSWORD = TRUE|FALSE]
+ *    [COMMENT = '...']`
+ */
+declare function createOrganizationAccount(client: SnowflakeClient, options: CreateOrganizationAccountOptions): Promise<void>;
+interface AlterAccountOptions extends OrgAdminContext {
+  /**
+   * Target account name — if omitted, the statement targets the current
+   * account (`ALTER ACCOUNT SET ...`). When provided, Snowflake runs it as
+   * `ALTER ACCOUNT <name> SET ...` (ORGADMIN scope).
+   */
+  readonly name?: string;
+  readonly ifExists?: boolean;
+  readonly set?: OptionMap;
+  readonly unset?: readonly string[];
+  readonly setResourceMonitor?: string;
+  readonly unsetResourceMonitor?: boolean;
+  readonly comment?: string;
+}
+declare function alterAccount(client: SnowflakeClient, options: AlterAccountOptions): Promise<void>;
+interface EnableAccountFeatureOptions extends OrgAdminContext {
+  /** Feature parameter name, e.g. `ENABLE_UNREDACTED_QUERY_SYNTAX_ERROR`. */
+  readonly feature: string;
+  /** When `false`, emits `SET <FEATURE> = FALSE` (i.e., disables it). */
+  readonly enabled?: boolean;
+  readonly ifExists?: boolean;
+  /** Scope the change to a specific account (requires ORGADMIN). */
+  readonly name?: string;
+}
+/**
+ * Generic `ALTER ACCOUNT SET <FEATURE> = TRUE|FALSE` wrapper. Snowflake
+ * exposes a growing set of account-level boolean parameters; this helper
+ * keeps the pattern uniform for workflow authors without embedding the
+ * full (ever-changing) feature catalogue in the package.
+ */
+declare function enableAccountFeature(client: SnowflakeClient, options: EnableAccountFeatureOptions): Promise<void>;
+//#endregion
+export { AlterAccountOptions, CreateOrganizationAccountOptions, EnableAccountFeatureOptions, ListOrganizationAccountsOptions, ListOrganizationAccountsResult, OrgAdminContext, alterAccount, createOrganizationAccount, enableAccountFeature, listOrganizationAccounts };

package/dist/org-admin.mjs

@@ -0,0 +1,79 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, i as quoteIdentifier, r as likeClause } from "./sql-safety-CywdR3EP.mjs";
+import { t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+
+//#region src/org-admin.ts
+/**
+* `SHOW ORGANIZATION ACCOUNTS`. Lists every account in the org (ORGADMIN
+* only).
+*/
+async function listOrganizationAccounts(client, options = {}) {
+	const result = await executeSql(client, {
+		statement: `SHOW ORGANIZATION ACCOUNTS${likeClause(options.like)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+	return {
+		columns: result.columns,
+		rows: result.rows
+	};
+}
+/**
+* `CREATE ORGANIZATION ACCOUNT <name>
+*    ADMIN_NAME = '...' ADMIN_PASSWORD = '...' EMAIL = '...'
+*    EDITION = '...' [REGION = '...'] [REGION_GROUP = '...']
+*    [FIRST_NAME = '...'] [LAST_NAME = '...']
+*    [MUST_CHANGE_PASSWORD = TRUE|FALSE]
+*    [COMMENT = '...']`
+*/
+async function createOrganizationAccount(client, options) {
+	const parts = [
+		`ADMIN_NAME = ${quoteLiteral(options.adminName)}`,
+		`ADMIN_PASSWORD = ${quoteLiteral(options.adminPassword)}`,
+		`EMAIL = ${quoteLiteral(options.email)}`,
+		`EDITION = ${quoteLiteral(options.edition)}`
+	];
+	if (options.region) parts.push(`REGION = ${quoteLiteral(options.region)}`);
+	if (options.regionGroup) parts.push(`REGION_GROUP = ${quoteLiteral(options.regionGroup)}`);
+	if (options.firstName) parts.push(`FIRST_NAME = ${quoteLiteral(options.firstName)}`);
+	if (options.lastName) parts.push(`LAST_NAME = ${quoteLiteral(options.lastName)}`);
+	if (options.mustChangePassword !== void 0) parts.push(`MUST_CHANGE_PASSWORD = ${options.mustChangePassword ? "TRUE" : "FALSE"}`);
+	if (options.comment) parts.push(`COMMENT = ${quoteLiteral(options.comment)}`);
+	if (options.options && Object.keys(options.options).length > 0) parts.push(formatOptions(options.options));
+	await executeSql(client, {
+		statement: `CREATE ORGANIZATION ACCOUNT ${quoteIdentifier(options.name)} ${parts.join(" ")}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function alterAccount(client, options) {
+	let tail;
+	if (options.setResourceMonitor !== void 0) tail = `SET RESOURCE_MONITOR = ${quoteIdentifier(options.setResourceMonitor)}`;
+	else if (options.unsetResourceMonitor) tail = "UNSET RESOURCE_MONITOR";
+	else if (options.set && Object.keys(options.set).length > 0) tail = `SET ${formatOptions(options.set)}`;
+	else if (options.unset && options.unset.length > 0) tail = `UNSET ${options.unset.map((k) => k.toUpperCase()).join(", ")}`;
+	else if (options.comment !== void 0) tail = `SET COMMENT = ${quoteLiteral(options.comment)}`;
+	else throw new Error("alterAccount requires one of: set / unset / setResourceMonitor / unsetResourceMonitor / comment");
+	await executeSql(client, {
+		statement: `ALTER ACCOUNT${options.ifExists ? " IF EXISTS" : ""}${options.name ? ` ${quoteIdentifier(options.name)}` : ""} ${tail}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+/**
+* Generic `ALTER ACCOUNT SET <FEATURE> = TRUE|FALSE` wrapper. Snowflake
+* exposes a growing set of account-level boolean parameters; this helper
+* keeps the pattern uniform for workflow authors without embedding the
+* full (ever-changing) feature catalogue in the package.
+*/
+async function enableAccountFeature(client, options) {
+	const enabled = options.enabled !== false;
+	await executeSql(client, {
+		statement: `ALTER ACCOUNT${options.ifExists ? " IF EXISTS" : ""}${options.name ? ` ${quoteIdentifier(options.name)}` : ""} SET ${options.feature.toUpperCase()} = ${enabled ? "TRUE" : "FALSE"}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+
+//#endregion
+export { alterAccount, createOrganizationAccount, enableAccountFeature, listOrganizationAccounts };

package/dist/pipes.d.mts

@@ -0,0 +1,119 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow } from "./statements-DJL0qVNA.mjs";
+import { CatalogResult, ShowScopedOptions, showPipes } from "./catalog.mjs";
+
+//#region src/pipes.d.ts
+interface PipeRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+}
+interface PipeContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface CreatePipeOptions extends PipeRef, PipeContext {
+  readonly orReplace?: boolean;
+  readonly ifNotExists?: boolean;
+  readonly autoIngest?: boolean;
+  /** S3 SNS topic ARN (AUTO_INGEST buckets sending SNS notifications). */
+  readonly awsSnsTopic?: string;
+  /** Notification integration for GCS / Azure Event Grid ingest. */
+  readonly integration?: string;
+  /** Notification integration that receives ERRORS (Snowflake error-integration object). */
+  readonly errorIntegration?: string;
+  readonly comment?: string;
+  /** The `COPY INTO ...` body that defines what this pipe loads. */
+  readonly copyStatement: string;
+}
+declare function createPipe(client: SnowflakeClient, options: CreatePipeOptions): Promise<void>;
+interface AlterPipeOptions extends PipeRef, PipeContext {
+  readonly setPipeExecutionPaused?: boolean;
+  readonly comment?: string;
+  readonly refresh?: {
+    readonly prefix?: string;
+    readonly modifiedAfter?: string;
+  };
+  readonly rename?: PipeRef;
+  readonly unset?: readonly string[];
+}
+declare function alterPipe(client: SnowflakeClient, options: AlterPipeOptions): Promise<void>;
+interface DropPipeOptions extends PipeRef, PipeContext {
+  readonly ifExists?: boolean;
+}
+declare function dropPipe(client: SnowflakeClient, options: DropPipeOptions): Promise<void>;
+interface DescribePipeOptions extends PipeRef, PipeContext {}
+declare function describePipe(client: SnowflakeClient, options: DescribePipeOptions): Promise<readonly HydratedRow[]>;
+/** Convenience for `ALTER PIPE name REFRESH ...`. */
+declare function refreshPipe(client: SnowflakeClient, options: PipeRef & PipeContext & {
+  readonly prefix?: string;
+  readonly modifiedAfter?: string;
+}): Promise<void>;
+interface SnowpipeInsertFile {
+  readonly path: string;
+  readonly size?: number | bigint;
+}
+interface InsertFilesOptions extends PipeRef {
+  readonly files: readonly SnowpipeInsertFile[];
+  readonly requestId?: string;
+}
+interface InsertFilesResponse {
+  readonly requestId: string;
+  /** Server-reported ingest batch id (`pipe` field per Snowflake docs). */
+  readonly pipe?: string;
+  readonly responseCode?: string;
+  readonly message?: string;
+  readonly skippedFiles?: readonly {
+    readonly path: string;
+    readonly reason?: string;
+  }[];
+}
+declare function insertFiles(client: SnowflakeClient, options: InsertFilesOptions): Promise<InsertFilesResponse>;
+interface InsertReportOptions extends PipeRef {
+  readonly beginMark?: string;
+  readonly requestId?: string;
+}
+interface InsertReportResponse {
+  readonly pipe?: string;
+  readonly completeResult?: boolean;
+  readonly nextBeginMark?: string;
+  readonly files?: readonly {
+    readonly path: string;
+    readonly stageLocation?: string;
+    readonly fileSize?: number;
+    readonly timeReceived?: string;
+    readonly lastInsertTime?: string;
+    readonly rowsInserted?: number;
+    readonly rowsParsed?: number;
+    readonly errorsSeen?: number;
+    readonly errorLimit?: number;
+    readonly firstError?: string;
+    readonly status?: string;
+  }[];
+}
+declare function insertReport(client: SnowflakeClient, options: InsertReportOptions): Promise<InsertReportResponse>;
+interface LoadHistoryScanOptions extends PipeRef {
+  readonly startTimeInclusive: string;
+  readonly endTimeExclusive: string;
+  readonly requestId?: string;
+}
+interface LoadHistoryScanResponse {
+  readonly pipe?: string;
+  readonly completeResult?: boolean;
+  readonly files?: readonly {
+    readonly path: string;
+    readonly stageLocation?: string;
+    readonly fileSize?: number;
+    readonly timeReceived?: string;
+    readonly lastInsertTime?: string;
+    readonly rowsInserted?: number;
+    readonly rowsParsed?: number;
+    readonly errorsSeen?: number;
+    readonly errorLimit?: number;
+    readonly firstError?: string;
+    readonly status?: string;
+  }[];
+}
+declare function loadHistoryScan(client: SnowflakeClient, options: LoadHistoryScanOptions): Promise<LoadHistoryScanResponse>;
+//#endregion
+export { AlterPipeOptions, type CatalogResult, CreatePipeOptions, DescribePipeOptions, DropPipeOptions, InsertFilesOptions, InsertFilesResponse, InsertReportOptions, InsertReportResponse, LoadHistoryScanOptions, LoadHistoryScanResponse, PipeContext, PipeRef, type ShowScopedOptions, SnowpipeInsertFile, alterPipe, createPipe, describePipe, dropPipe, insertFiles, insertReport, loadHistoryScan, refreshPipe, showPipes };

package/dist/pipes.mjs

@@ -0,0 +1,106 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, i as quoteIdentifier, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { showPipes } from "./catalog.mjs";
+
+//#region src/pipes.ts
+function pipeFqn(ref) {
+	return buildFqn(ref.database, ref.schema, ref.name);
+}
+function pipeRestPath(ref, required) {
+	if (required && (!ref.database || !ref.schema)) throw new Error("Snowpipe REST requires fully-qualified database.schema.pipe (provide `database` and `schema`)");
+	return [
+		ref.database,
+		ref.schema,
+		ref.name
+	].filter((segment) => segment !== void 0 && segment.length > 0).join(".");
+}
+async function createPipe(client, options) {
+	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""} PIPE${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
+	const auto = options.autoIngest ? " AUTO_INGEST = TRUE" : "";
+	const sns = options.awsSnsTopic ? ` AWS_SNS_TOPIC = ${quoteLiteral(options.awsSnsTopic)}` : "";
+	const integration = options.integration ? ` INTEGRATION = ${quoteLiteral(options.integration)}` : "";
+	const errorIntegration = options.errorIntegration ? ` ERROR_INTEGRATION = ${quoteIdentifier(options.errorIntegration)}` : "";
+	const comment = options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : "";
+	await executeSql(client, {
+		statement: `${prefix} ${pipeFqn(options)}${auto}${sns}${integration}${errorIntegration}${comment} AS ${options.copyStatement}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function alterPipe(client, options) {
+	let tail;
+	if (options.rename) tail = `RENAME TO ${pipeFqn(options.rename)}`;
+	else if (options.refresh) tail = `REFRESH${options.refresh.prefix ? ` PREFIX = ${quoteLiteral(options.refresh.prefix)}` : ""}${options.refresh.modifiedAfter ? ` MODIFIED_AFTER = ${quoteLiteral(options.refresh.modifiedAfter)}` : ""}`;
+	else if (options.setPipeExecutionPaused !== void 0) tail = `SET PIPE_EXECUTION_PAUSED = ${options.setPipeExecutionPaused ? "TRUE" : "FALSE"}`;
+	else if (options.comment !== void 0) tail = `SET COMMENT = ${quoteLiteral(options.comment)}`;
+	else if (options.unset && options.unset.length > 0) tail = `UNSET ${options.unset.map((k) => k.toUpperCase()).join(", ")}`;
+	else throw new Error("alterPipe requires one of: rename / refresh / setPipeExecutionPaused / comment / unset");
+	await executeSql(client, {
+		statement: `ALTER PIPE ${pipeFqn(options)} ${tail}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function dropPipe(client, options) {
+	await executeSql(client, {
+		statement: `DROP PIPE${options.ifExists ? " IF EXISTS" : ""} ${pipeFqn(options)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function describePipe(client, options) {
+	return (await executeSql(client, {
+		statement: `DESCRIBE PIPE ${pipeFqn(options)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows;
+}
+/** Convenience for `ALTER PIPE name REFRESH ...`. */
+async function refreshPipe(client, options) {
+	await alterPipe(client, {
+		...options,
+		refresh: {
+			prefix: options.prefix,
+			modifiedAfter: options.modifiedAfter
+		}
+	});
+}
+async function insertFiles(client, options) {
+	if (options.files.length === 0) throw new Error("insertFiles requires at least one file");
+	const path = `/v1/data/pipes/${pipeRestPath(options, true)}/insertFiles`;
+	const body = { files: options.files.map((f) => ({
+		path: f.path,
+		...f.size !== void 0 ? { size: typeof f.size === "bigint" ? Number(f.size) : f.size } : {}
+	})) };
+	return client.request(path, {
+		method: "POST",
+		body,
+		requestId: options.requestId,
+		query: options.requestId ? { requestId: options.requestId } : void 0
+	});
+}
+async function insertReport(client, options) {
+	const path = `/v1/data/pipes/${pipeRestPath(options, true)}/insertReport`;
+	const query = {};
+	if (options.beginMark) query.beginMark = options.beginMark;
+	if (options.requestId) query.requestId = options.requestId;
+	return client.request(path, {
+		method: "GET",
+		query
+	});
+}
+async function loadHistoryScan(client, options) {
+	const path = `/v1/data/pipes/${pipeRestPath(options, true)}/loadHistoryScan`;
+	const query = {
+		startTimeInclusive: options.startTimeInclusive,
+		endTimeExclusive: options.endTimeExclusive
+	};
+	if (options.requestId) query.requestId = options.requestId;
+	return client.request(path, {
+		method: "GET",
+		query
+	});
+}
+
+//#endregion
+export { alterPipe, createPipe, describePipe, dropPipe, insertFiles, insertReport, loadHistoryScan, refreshPipe, showPipes };

package/dist/procedures.d.mts

@@ -0,0 +1,61 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow, v as SqlBinding } from "./statements-DJL0qVNA.mjs";
+import { ExecuteSqlResult } from "./sql.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+import { CatalogResult, ShowScopedOptions, showProcedures } from "./catalog.mjs";
+import { RowValue } from "./rows.mjs";
+
+//#region src/procedures.d.ts
+interface ProcedureRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly name: string;
+}
+interface ProcedureContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface ProcedureArgument {
+  readonly name: string;
+  readonly type: string;
+  readonly defaultExpression?: string;
+}
+type ProcedureLanguage = 'SQL' | 'JAVASCRIPT' | 'PYTHON' | 'JAVA' | 'SCALA';
+type ExecuteAs = 'CALLER' | 'OWNER';
+interface CreateProcedureOptions extends ProcedureRef, ProcedureContext {
+  readonly orReplace?: boolean;
+  readonly ifNotExists?: boolean;
+  readonly secure?: boolean;
+  readonly arguments?: readonly ProcedureArgument[];
+  readonly returns: string;
+  readonly language?: ProcedureLanguage;
+  readonly executeAs?: ExecuteAs;
+  /** Additional keywords: `STRICT`, `IMMUTABLE`, `VOLATILE`, etc. */
+  readonly modifiers?: readonly string[];
+  /** Language-specific options: `RUNTIME_VERSION`, `PACKAGES`, `HANDLER`, `IMPORTS`. */
+  readonly options?: OptionMap;
+  readonly comment?: string;
+  readonly as: string;
+  readonly dollarQuotedBody?: boolean;
+}
+declare function createProcedure(client: SnowflakeClient, options: CreateProcedureOptions): Promise<void>;
+interface DropProcedureOptions extends ProcedureRef, ProcedureContext {
+  readonly ifExists?: boolean;
+  readonly arguments?: readonly ProcedureArgument[];
+}
+declare function dropProcedure(client: SnowflakeClient, options: DropProcedureOptions): Promise<void>;
+interface DescribeProcedureOptions extends ProcedureRef, ProcedureContext {
+  readonly arguments?: readonly ProcedureArgument[];
+}
+declare function describeProcedure(client: SnowflakeClient, options: DescribeProcedureOptions): Promise<readonly HydratedRow[]>;
+interface CallProcedureOptions extends ProcedureRef, ProcedureContext {
+  /** Positional arguments — every value flows through SQL API bindings (`?` placeholders). */
+  readonly arguments?: readonly RowValue[];
+  /** Pre-built bindings map (takes precedence over `arguments`). */
+  readonly bindings?: Readonly<Record<string, SqlBinding>>;
+  /** Raw SQL expression list when you need to pass a named function, subquery, or bind-unfriendly value. */
+  readonly rawArguments?: readonly string[];
+}
+declare function callProcedure(client: SnowflakeClient, options: CallProcedureOptions): Promise<ExecuteSqlResult<HydratedRow | readonly unknown[]>>;
+//#endregion
+export { CallProcedureOptions, type CatalogResult, CreateProcedureOptions, DescribeProcedureOptions, DropProcedureOptions, ExecuteAs, ProcedureArgument, ProcedureContext, ProcedureLanguage, ProcedureRef, type ShowScopedOptions, callProcedure, createProcedure, describeProcedure, dropProcedure, showProcedures };