@keystrokehq/snowflake 0.0.16 → 0.0.18

package/dist/users/index.d.mts

@@ -1,61 +0,0 @@
-import { SnowflakeClient } from "../client/index.mjs";
-import { d as HydratedRow } from "../statements-DJL0qVNA.mjs";
-import { t as OptionMap } from "../sql-options-2k5xQ-oS.mjs";
-import { CatalogResult, ShowOptions, showUsers } from "../catalog/index.mjs";
-
-//#region src/users/index.d.ts
-interface UserContext {
-  readonly warehouse?: string;
-  readonly role?: string;
-}
-interface CreateUserOptions extends UserContext {
-  readonly name: string;
-  readonly orReplace?: boolean;
-  readonly ifNotExists?: boolean;
-  /** `PASSWORD = '...'`, `LOGIN_NAME = '...'`, `DEFAULT_ROLE = 'ANALYST'`, etc. */
-  readonly options?: OptionMap;
-  readonly comment?: string;
-}
-declare function createUser(client: SnowflakeClient, options: CreateUserOptions): Promise<void>;
-interface AlterUserOptions extends UserContext {
-  readonly name: string;
-  readonly rename?: string;
-  readonly set?: OptionMap;
-  readonly unset?: readonly string[];
-  readonly comment?: string;
-  readonly ifExists?: boolean;
-}
-declare function alterUser(client: SnowflakeClient, options: AlterUserOptions): Promise<void>;
-interface DropUserOptions extends UserContext {
-  readonly name: string;
-  readonly ifExists?: boolean;
-}
-declare function dropUser(client: SnowflakeClient, options: DropUserOptions): Promise<void>;
-interface DescribeUserOptions extends UserContext {
-  readonly name: string;
-}
-declare function describeUser(client: SnowflakeClient, options: DescribeUserOptions): Promise<readonly HydratedRow[]>;
-interface ResetUserPasswordOptions extends UserContext {
-  readonly name: string;
-  readonly ifExists?: boolean;
-  /**
-   * When provided, the new password is set explicitly via
-   * `ALTER USER name SET PASSWORD = '...'`. When omitted, the command is
-   * `ALTER USER name RESET PASSWORD`, which tells Snowflake to email the
-   * user a one-time password link (per docs/sql-reference/sql/alter-user).
-   */
-  readonly password?: string;
-}
-declare function resetUserPassword(client: SnowflakeClient, options: ResetUserPasswordOptions): Promise<void>;
-interface UnlockUserOptions extends UserContext {
-  readonly name: string;
-  readonly ifExists?: boolean;
-}
-/**
- * `ALTER USER name SET MINS_TO_UNLOCK = 0` — immediately releases a lockout
- * caused by `MINS_TO_BYPASS_NETWORK_POLICY`, `LOCK_UNTIL`, or repeated
- * failed-password attempts. No-op if the user is not locked.
- */
-declare function unlockUser(client: SnowflakeClient, options: UnlockUserOptions): Promise<void>;
-//#endregion
-export { AlterUserOptions, type CatalogResult, CreateUserOptions, DescribeUserOptions, DropUserOptions, ResetUserPasswordOptions, type ShowOptions, UnlockUserOptions, UserContext, alterUser, createUser, describeUser, dropUser, resetUserPassword, showUsers, unlockUser };

package/dist/users/index.mjs

@@ -1,67 +0,0 @@
-import { executeSql } from "../sql/index.mjs";
-import { a as quoteLiteral, i as quoteIdentifier } from "../sql-safety-BZpAPsq6.mjs";
-import { t as formatOptions } from "../sql-options-D6GEa21F.mjs";
-import { showUsers } from "../catalog/index.mjs";
-
-//#region src/users/index.ts
-async function createUser(client, options) {
-	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""} USER${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
-	const body = options.options && Object.keys(options.options).length > 0 ? ` ${formatOptions(options.options)}` : "";
-	const comment = options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : "";
-	await executeSql(client, {
-		statement: `${prefix} ${quoteIdentifier(options.name)}${body}${comment}`,
-		warehouse: options.warehouse,
-		role: options.role
-	});
-}
-async function alterUser(client, options) {
-	let tail;
-	if (options.rename) tail = `RENAME TO ${quoteIdentifier(options.rename)}`;
-	else if (options.set && Object.keys(options.set).length > 0) tail = `SET ${formatOptions(options.set)}`;
-	else if (options.unset && options.unset.length > 0) tail = `UNSET ${options.unset.map((k) => k.toUpperCase()).join(", ")}`;
-	else if (options.comment !== void 0) tail = `SET COMMENT = ${quoteLiteral(options.comment)}`;
-	else throw new Error("alterUser requires one of: rename / set / unset / comment");
-	await executeSql(client, {
-		statement: `ALTER USER${options.ifExists ? " IF EXISTS" : ""} ${quoteIdentifier(options.name)} ${tail}`,
-		warehouse: options.warehouse,
-		role: options.role
-	});
-}
-async function dropUser(client, options) {
-	await executeSql(client, {
-		statement: `DROP USER${options.ifExists ? " IF EXISTS" : ""} ${quoteIdentifier(options.name)}`,
-		warehouse: options.warehouse,
-		role: options.role
-	});
-}
-async function describeUser(client, options) {
-	return (await executeSql(client, {
-		statement: `DESCRIBE USER ${quoteIdentifier(options.name)}`,
-		warehouse: options.warehouse,
-		role: options.role
-	})).rows;
-}
-async function resetUserPassword(client, options) {
-	const ifExists = options.ifExists ? " IF EXISTS" : "";
-	const tail = options.password === void 0 ? "RESET PASSWORD" : `SET PASSWORD = ${quoteLiteral(options.password)}`;
-	await executeSql(client, {
-		statement: `ALTER USER${ifExists} ${quoteIdentifier(options.name)} ${tail}`,
-		warehouse: options.warehouse,
-		role: options.role
-	});
-}
-/**
-* `ALTER USER name SET MINS_TO_UNLOCK = 0` — immediately releases a lockout
-* caused by `MINS_TO_BYPASS_NETWORK_POLICY`, `LOCK_UNTIL`, or repeated
-* failed-password attempts. No-op if the user is not locked.
-*/
-async function unlockUser(client, options) {
-	await executeSql(client, {
-		statement: `ALTER USER${options.ifExists ? " IF EXISTS" : ""} ${quoteIdentifier(options.name)} SET MINS_TO_UNLOCK = 0`,
-		warehouse: options.warehouse,
-		role: options.role
-	});
-}
-
-//#endregion
-export { alterUser, createUser, describeUser, dropUser, resetUserPassword, showUsers, unlockUser };

package/dist/verification/index.d.mts

@@ -1,201 +0,0 @@
-import { AzureEventGridEvent, GcsPubSubPush, SnsNotification } from "../events/index.mjs";
-import { z } from "zod";
-
-//#region src/verification/index.d.ts
-/**
- * Thrown whenever a webhook verifier rejects a request. Includes a
- * compact `reason` code so callers can distinguish transport problems
- * (signature mismatch) from policy problems (wrong audience).
- */
-declare class SnowflakeWebhookVerificationError extends Error {
-  readonly name = "SnowflakeWebhookVerificationError";
-  readonly reason: string;
-  readonly provider: 'aws-s3' | 'gcp-gcs' | 'azure-blob' | 'unknown';
-  constructor(input: {
-    message: string;
-    reason: string;
-    provider?: 'aws-s3' | 'gcp-gcs' | 'azure-blob';
-    cause?: unknown;
-  });
-}
-type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
-interface VerifySnsMessageOptions {
-  /** Expected SNS topic ARN. Mismatch ⇒ verification error. */
-  readonly expectedTopicArn?: string;
-  /** Regex string (compiled with `u` flag). Defaults to AWS SNS hosts. */
-  readonly allowedSigningCertHostPattern?: string;
-  /** Test seam — override the default global fetch. */
-  readonly fetchImpl?: FetchLike;
-  /**
-   * Test seam — bypass network + return the cert PEM directly.
-   * Takes precedence over `fetchImpl`.
-   */
-  readonly resolveCert?: (signingCertUrl: string) => Promise<string> | string;
-}
-/**
- * Parse an SNS HTTP(S) notification body into a typed envelope. Throws
- * if the body is not valid JSON or doesn't match the SNS schema.
- */
-declare function parseSnsNotification(rawBody: string): SnsNotification;
-/**
- * Build the canonical string that SNS signs. The SNS spec fixes the
- * field order per message type — do not re-order keys.
- *
- * @see https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html
- */
-declare function canonicalSnsString(message: SnsNotification): string;
-/**
- * Verify an SNS notification. Performs:
- *  1. Topic-ARN pinning (if provided).
- *  2. SigningCertURL host allowlist (default: AWS SNS hosts only —
- *     prevents SSRF against arbitrary URLs).
- *  3. Cert fetch + signature verification (SHA1 or SHA256 per
- *     `SignatureVersion`).
- *
- * Returns the parsed notification on success.
- */
-declare function verifySnsMessage(rawBody: string, options?: VerifySnsMessageOptions): Promise<SnsNotification>;
-declare const googleJwksKeySchema: z.ZodObject<{
-  kid: z.ZodString;
-  kty: z.ZodString;
-  alg: z.ZodOptional<z.ZodString>;
-  use: z.ZodOptional<z.ZodString>;
-  n: z.ZodString;
-  e: z.ZodString;
-}, z.core.$catchall<z.ZodUnknown>>;
-declare const googleOidcClaimsSchema: z.ZodObject<{
-  iss: z.ZodString;
-  aud: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-  sub: z.ZodOptional<z.ZodString>;
-  email: z.ZodOptional<z.ZodString>;
-  email_verified: z.ZodOptional<z.ZodBoolean>;
-  exp: z.ZodNumber;
-  iat: z.ZodOptional<z.ZodNumber>;
-  nbf: z.ZodOptional<z.ZodNumber>;
-}, z.core.$catchall<z.ZodUnknown>>;
-type GoogleOidcClaims = z.infer<typeof googleOidcClaimsSchema>;
-interface VerifyPubSubPushOptions {
-  readonly expectedAudience: string;
-  readonly expectedServiceAccount: string;
-  readonly issuer?: string;
-  readonly jwksUri?: string;
-  readonly fetchImpl?: FetchLike;
-  /** Override "now" for deterministic tests. */
-  readonly now?: () => number;
-  /** Test seam: supply JWKS directly, bypassing the HTTP fetch + cache. */
-  readonly resolveJwks?: (jwksUri: string) => Promise<z.infer<typeof googleJwksKeySchema>[]> | z.infer<typeof googleJwksKeySchema>[];
-  /** Disable the in-process cache. Useful for tests. */
-  readonly disableCache?: boolean;
-}
-/**
- * Verify the OIDC JWT that GCP Pub/Sub push sends in `Authorization:
- * Bearer <token>`. Returns the decoded claims on success.
- */
-declare function verifyPubSubPushAuthorization(authorizationHeader: string | undefined, options: VerifyPubSubPushOptions): Promise<GoogleOidcClaims>;
-/** Parse a Pub/Sub push envelope. Does not verify anything. */
-declare function parsePubSubPush(rawBody: string): GcsPubSubPush;
-/**
- * Event Grid sends its validation request as a single-event array with
- * `eventType: 'Microsoft.EventGrid.SubscriptionValidationEvent'`. The
- * Keystroke webhook primitive does not support dynamic responses, so
- * operators must use **manual validation** (VSCode extension, portal
- * click-through, or a curl to `validationUrl`) rather than relying on
- * synchronous `validationResponse`.
- */
-declare const EVENT_GRID_VALIDATION_EVENT_TYPE = "Microsoft.EventGrid.SubscriptionValidationEvent";
-interface EventGridValidationEventData {
-  readonly validationCode: string;
-  readonly validationUrl?: string;
-}
-interface ParsedEventGridBatch {
-  readonly events: readonly AzureEventGridEvent[];
-  readonly validationEvents: readonly {
-    readonly event: AzureEventGridEvent;
-    readonly data: EventGridValidationEventData;
-  }[];
-}
-interface VerifyEventGridRequestOptions {
-  readonly sharedSecret?: string;
-  readonly sharedSecretHeader?: string;
-  readonly expectedTopic?: string;
-}
-/** Parse an Event Grid batch. Validates each envelope with Zod. */
-declare function parseEventGridBatch(rawBody: string): ParsedEventGridBatch;
-/**
- * Verify an Event Grid request. Event Grid's trust model is
- * primarily the delivery handshake + network ACLs, but operators can
- * wire a shared secret into a custom header. This verifier:
- *
- *  - Checks the shared secret (if configured on both ends).
- *  - Parses + schema-validates the event batch.
- *  - Optionally enforces a topic-ARN pin.
- */
-declare function verifyEventGridRequest(input: {
-  readonly rawBody: string;
-  readonly headers: Readonly<Record<string, string | undefined>>;
-}, options?: VerifyEventGridRequestOptions): ParsedEventGridBatch;
-declare const s3EventRecordSchema: z.ZodObject<{
-  eventTime: z.ZodOptional<z.ZodString>;
-  eventName: z.ZodOptional<z.ZodString>;
-  awsRegion: z.ZodOptional<z.ZodString>;
-  requestParameters: z.ZodOptional<z.ZodObject<{
-    sourceIPAddress: z.ZodOptional<z.ZodString>;
-  }, z.core.$catchall<z.ZodUnknown>>>;
-  s3: z.ZodOptional<z.ZodObject<{
-    bucket: z.ZodOptional<z.ZodObject<{
-      name: z.ZodString;
-    }, z.core.$catchall<z.ZodUnknown>>>;
-    object: z.ZodOptional<z.ZodObject<{
-      key: z.ZodOptional<z.ZodString>;
-      size: z.ZodOptional<z.ZodNumber>;
-      eTag: z.ZodOptional<z.ZodString>;
-      sequencer: z.ZodOptional<z.ZodString>;
-    }, z.core.$catchall<z.ZodUnknown>>>;
-  }, z.core.$catchall<z.ZodUnknown>>>;
-}, z.core.$catchall<z.ZodUnknown>>;
-type S3EventRecord = z.infer<typeof s3EventRecordSchema>;
-/**
- * Extract S3 object events out of the inner {@link SnsNotification}
- * message body. SNS forwards the verbatim S3 notification JSON in
- * `Message`.
- */
-declare function extractS3Records(snsMessage: SnsNotification): readonly S3EventRecord[];
-declare const gcsObjectPayloadSchema: z.ZodObject<{
-  bucket: z.ZodOptional<z.ZodString>;
-  name: z.ZodOptional<z.ZodString>;
-  size: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
-  etag: z.ZodOptional<z.ZodString>;
-  generation: z.ZodOptional<z.ZodString>;
-  timeCreated: z.ZodOptional<z.ZodString>;
-  updated: z.ZodOptional<z.ZodString>;
-}, z.core.$catchall<z.ZodUnknown>>;
-type GcsObjectPayload = z.infer<typeof gcsObjectPayloadSchema>;
-/**
- * Decode + validate the inner GCS object payload from a Pub/Sub push.
- * Returns `undefined` if the `message.data` field is missing or the
- * decoded body does not shape-match a GCS Object Change notification.
- */
-declare function extractGcsObjectPayload(push: GcsPubSubPush): GcsObjectPayload | undefined;
-declare const azureBlobDataSchema: z.ZodObject<{
-  api: z.ZodOptional<z.ZodString>;
-  blobType: z.ZodOptional<z.ZodString>;
-  contentLength: z.ZodOptional<z.ZodNumber>;
-  contentType: z.ZodOptional<z.ZodString>;
-  eTag: z.ZodOptional<z.ZodString>;
-  url: z.ZodOptional<z.ZodString>;
-  sequencer: z.ZodOptional<z.ZodString>;
-  storageDiagnostics: z.ZodOptional<z.ZodUnknown>;
-}, z.core.$catchall<z.ZodUnknown>>;
-type AzureBlobEventData = z.infer<typeof azureBlobDataSchema>;
-/**
- * Extract `bucket` + `key` from the `url` or `subject` fields of an
- * Event Grid blob event. Event Grid populates `subject` as
- * `/blobServices/default/containers/<container>/blobs/<key>` so we can
- * parse either.
- */
-declare function parseAzureBlobLocation(event: AzureEventGridEvent): {
-  readonly bucket: string;
-  readonly key: string;
-};
-//#endregion
-export { AzureBlobEventData, EVENT_GRID_VALIDATION_EVENT_TYPE, EventGridValidationEventData, GcsObjectPayload, GoogleOidcClaims, ParsedEventGridBatch, S3EventRecord, SnowflakeWebhookVerificationError, VerifyEventGridRequestOptions, VerifyPubSubPushOptions, VerifySnsMessageOptions, canonicalSnsString, extractGcsObjectPayload, extractS3Records, parseAzureBlobLocation, parseEventGridBatch, parsePubSubPush, parseSnsNotification, verifyEventGridRequest, verifyPubSubPushAuthorization, verifySnsMessage };