@keystrokehq/snowflake 0.0.9 → 0.0.16-integration-id-canonicalization.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/snowflake",
-  "version": "0.0.9",
+  "version": "0.0.16-integration-id-canonicalization.0",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -9,9 +9,13 @@
       "types": "./dist/index.d.mts",
       "default": "./dist/index.mjs"
     },
-    "./connection": {
-      "types": "./dist/connection.d.mts",
-      "default": "./dist/connection.mjs"
+    "./credential-sets": {
+      "types": "./dist/credential-sets/index.d.mts",
+      "default": "./dist/credential-sets/index.mjs"
+    },
+    "./operations": {
+      "types": "./dist/operations/index.d.mts",
+      "default": "./dist/operations/index.mjs"
     },
     "./client": {
       "types": "./dist/client.d.mts",
@@ -21,17 +25,13 @@
       "types": "./dist/schemas/index.d.mts",
       "default": "./dist/schemas/index.mjs"
     },
-    "./_official": {
-      "types": "./dist/_official/index.d.mts",
-      "default": "./dist/_official/index.mjs"
-    },
     "./events": {
-      "types": "./dist/events.d.mts",
-      "default": "./dist/events.mjs"
+      "types": "./dist/events/index.d.mts",
+      "default": "./dist/events/index.mjs"
     },
     "./triggers": {
-      "types": "./dist/triggers.d.mts",
-      "default": "./dist/triggers.mjs"
+      "types": "./dist/triggers/index.d.mts",
+      "default": "./dist/triggers/index.mjs"
     },
     "./verification": {
       "types": "./dist/verification.d.mts",
@@ -136,10 +136,6 @@
     "./status-page": {
       "types": "./dist/status-page.d.mts",
       "default": "./dist/status-page.mjs"
-    },
-    "./_runtime": {
-      "types": "./dist/_runtime/index.d.mts",
-      "default": "./dist/_runtime/index.mjs"
     }
   },
   "files": [
@@ -160,8 +156,8 @@
     "vitest": "^4.0.18",
     "@keystrokehq/core": "^0.0.12",
     "@keystrokehq/test-utils": "0.0.0",
-    "@keystrokehq/typescript-config": "0.0.0",
-    "@keystrokehq/integration-authoring": "0.0.9"
+    "@keystrokehq/integration-authoring": "0.0.9",
+    "@keystrokehq/typescript-config": "0.0.0"
   },
   "keywords": [
     "snowflake",

package/dist/_official/index.d.mts

@@ -1,2 +0,0 @@
-import { c as snowflakeOfficialIntegration, i as snowflake, s as snowflakeBundle } from "../integration-86b6WaJF.mjs";
-export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/_official/index.mjs

@@ -1,3 +0,0 @@
-import { a as snowflakeBundle, n as snowflake, o as snowflakeOfficialIntegration } from "../integration-DNMbfXEy.mjs";
-
-export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/connection.d.mts

@@ -1,2 +0,0 @@
-import { a as snowflakeAuthModeSchema, c as snowflakeOfficialIntegration, i as snowflake, n as SnowflakeCredentials, o as snowflakeAuthSchema, r as parseSnowflakeCredentials, s as snowflakeBundle, t as SnowflakeAuthMode } from "./integration-86b6WaJF.mjs";
-export { type SnowflakeAuthMode, type SnowflakeCredentials, parseSnowflakeCredentials, snowflake, snowflakeAuthModeSchema, snowflakeAuthSchema, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/connection.mjs

@@ -1,3 +0,0 @@
-import { a as snowflakeBundle, i as snowflakeAuthSchema, n as snowflake, o as snowflakeOfficialIntegration, r as snowflakeAuthModeSchema, t as parseSnowflakeCredentials } from "./integration-DNMbfXEy.mjs";
-
-export { parseSnowflakeCredentials, snowflake, snowflakeAuthModeSchema, snowflakeAuthSchema, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/databases.mjs

@@ -1,3 +0,0 @@
-import { findDatabases, showDatabases } from "./catalog.mjs";
-
-export { findDatabases, showDatabases };

package/dist/integration-DNMbfXEy.mjs

@@ -1,251 +0,0 @@
-import { CredentialSet } from "@keystrokehq/core";
-import { z } from "zod";
-
-//#region ../../packages/integration-authoring/dist/official/index.mjs
-const OFFICIAL_CREDENTIAL_SET_ID_PREFIX = "keystroke:";
-function officialCredentialSetId(id) {
-	return `${OFFICIAL_CREDENTIAL_SET_ID_PREFIX}${id}`;
-}
-/**
-* Creates an official integration bundle from a single config object.
-*
-* - Creates the public `CredentialSet` internally.
-* - Accepts optional `internal` fields for Keystroke-owned platform credentials.
-*/
-function defineOfficialIntegration(config) {
-	const internalCredentialSets = config.internal ?? {};
-	const allInternalCredentialSets = [
-		...internalCredentialSets.providerApp ? [internalCredentialSets.providerApp] : [],
-		...internalCredentialSets.providerAppVariants ?? [],
-		...internalCredentialSets.webhookVerification ? [internalCredentialSets.webhookVerification] : [],
-		...internalCredentialSets.other ?? []
-	];
-	const credentialSet = new CredentialSet({
-		id: config.id,
-		name: config.name,
-		description: config.description,
-		auth: config.auth,
-		...config.connections ? { connections: config.connections } : {},
-		...config.proxy ? { proxy: config.proxy } : {},
-		...config.needsRawSecret === true ? { needsRawSecret: true } : {}
-	});
-	return Object.freeze({
-		integration: {
-			id: config.id,
-			name: config.name,
-			...config.description !== void 0 ? { description: config.description } : {},
-			auth: config.auth,
-			...config.proxy ? { proxy: config.proxy } : {},
-			...config.needsRawSecret === true ? { needsRawSecret: true } : {},
-			...config.connections ? { connections: config.connections } : {}
-		},
-		credentialSet,
-		internalCredentialSets,
-		allInternalCredentialSets
-	});
-}
-
-//#endregion
-//#region src/webhook-credentials.ts
-/**
-* Webhook credential sets for the Snowflake auto-ingest triggers.
-*
-* Snowflake has no native webhook product — auto-ingest relies on
-* cloud-provider event buses (AWS SNS, GCP Pub/Sub, Azure Event Grid)
-* that forward object-storage notifications to a public endpoint.
-* Each cloud has a different trust model, so we ship one credential
-* set per cloud rather than a single generic "auto-ingest" set.
-*
-* These credentials hold only the verification material the webhook
-* receiver needs — the cloud provider itself controls who can publish
-* to the topic/queue/event-grid. All auth fields are strings to keep
-* them CredentialSet-compatible (auth shapes are Zod objects without
-* unions/optionals-at-root).
-*/
-/**
-* AWS SNS webhook credentials.
-*
-* SNS verifies message authenticity via an X.509 signature whose public
-* cert is published at an SNS-hosted URL. The only real secret is the
-* optional {@link expectedTopicArn}: tight-scoping to a single topic
-* prevents an attacker that fooled SNS signing (not possible absent a
-* certificate compromise) from posting events from an unrelated topic.
-*/
-const snowflakeS3SnsWebhookCredentialSet = new CredentialSet({
-	id: officialCredentialSetId("snowflake-s3-sns-webhook"),
-	exposure: "platform-only",
-	name: "Snowflake Auto-Ingest — AWS SNS",
-	auth: z.object({
-		expectedTopicArn: z.string().optional(),
-		allowedSigningCertHostPattern: z.string().default("^sns\\.[a-z0-9-]+\\.amazonaws\\.com(\\.cn)?$").optional(),
-		autoConfirmSubscriptions: z.enum(["true", "false"]).default("false").optional()
-	})
-});
-/**
-* GCP Pub/Sub push subscriptions sign each request with a Google-minted
-* OIDC JWT (RS256) in the `Authorization` header. Verification requires
-* knowing:
-*
-*  - `expectedAudience`: the OIDC audience configured on the push
-*    subscription (commonly the webhook URL itself).
-*  - `expectedServiceAccount`: the push subscription's service-account
-*    email, which appears as the JWT `email` claim.
-*
-* Both are public identifiers, but pinning them prevents an attacker
-* with any valid Google OIDC token from impersonating the subscription.
-*/
-const snowflakeGcsPubSubWebhookCredentialSet = new CredentialSet({
-	id: officialCredentialSetId("snowflake-gcs-pubsub-webhook"),
-	exposure: "platform-only",
-	name: "Snowflake Auto-Ingest — GCS Pub/Sub",
-	auth: z.object({
-		expectedAudience: z.string().min(1),
-		expectedServiceAccount: z.string().min(1),
-		jwksUri: z.string().default("https://www.googleapis.com/oauth2/v3/certs").optional(),
-		issuer: z.string().default("https://accounts.google.com").optional()
-	})
-});
-/**
-* Azure Event Grid authenticates webhook endpoints via one-time
-* handshake validation (validation code or URL) rather than per-request
-* signatures. If the operator wires a **shared secret** into the
-* Event Grid subscription as a custom header, that secret can be
-* checked here as a defence-in-depth measure.
-*
-* Event Grid's synchronous handshake (`SubscriptionValidationEvent`) is
-* not fulfillable through the Keystroke static-response webhook
-* primitive; Snowflake operators should use **manual handshake** or
-* Cloud-Events schema. See `IMPLEMENTATION_NOTES.md` § trigger webhooks.
-*/
-const snowflakeAzureEventGridWebhookCredentialSet = new CredentialSet({
-	id: officialCredentialSetId("snowflake-azure-eventgrid-webhook"),
-	exposure: "platform-only",
-	name: "Snowflake Auto-Ingest — Azure Event Grid",
-	auth: z.object({
-		sharedSecret: z.string().optional(),
-		sharedSecretHeader: z.string().default("aeg-subscription-secret").optional(),
-		expectedTopicArn: z.string().optional()
-	})
-});
-
-//#endregion
-//#region src/integration.ts
-/**
-* Public auth schema for Snowflake connections.
-*
-* Modeled as a discriminated union on `mode`. `connection.kind` is `manual`
-* because Keystroke does not run an interactive Snowflake OAuth dance — OAuth
-* mode accepts a bearer token provided by the caller (external IdP /
-* Snowflake-hosted OAuth). See `IMPLEMENTATION_NOTES.md` § 2 for rationale.
-*/
-const snowflakeAuthModeSchema = z.enum([
-	"keypair",
-	"oauth",
-	"pat",
-	"basic"
-]);
-/**
-* Flat Zod object — the official integration contract constrains `auth` to a
-* `ZodObject<ZodRawShape>`, so mode-specific fields are declared as optional
-* and validated via `superRefine` below. Runtime invariants still cover:
-*  - keypair → requires SNOWFLAKE_USER + SNOWFLAKE_PRIVATE_KEY
-*  - oauth   → requires SNOWFLAKE_OAUTH_ACCESS_TOKEN
-*  - pat     → requires SNOWFLAKE_USER + SNOWFLAKE_PAT
-*  - basic   → requires SNOWFLAKE_USER + SNOWFLAKE_PASSWORD
-*/
-const baseSnowflakeAuthShape = {
-	mode: snowflakeAuthModeSchema,
-	SNOWFLAKE_ACCOUNT: z.string().min(1),
-	SNOWFLAKE_USER: z.string().min(1).optional(),
-	SNOWFLAKE_PRIVATE_KEY: z.string().min(1).optional(),
-	SNOWFLAKE_PRIVATE_KEY_PASSPHRASE: z.string().optional(),
-	SNOWFLAKE_PAT: z.string().min(1).optional(),
-	SNOWFLAKE_PASSWORD: z.string().min(1).optional(),
-	SNOWFLAKE_OAUTH_ACCESS_TOKEN: z.string().min(1).optional(),
-	SNOWFLAKE_OAUTH_REFRESH_TOKEN: z.string().optional(),
-	SNOWFLAKE_OAUTH_CLIENT_ID: z.string().optional(),
-	SNOWFLAKE_OAUTH_CLIENT_SECRET: z.string().optional(),
-	SNOWFLAKE_OAUTH_TOKEN_URL: z.string().url().optional(),
-	SNOWFLAKE_OAUTH_SCOPES: z.string().optional(),
-	SNOWFLAKE_ROLE: z.string().optional(),
-	SNOWFLAKE_WAREHOUSE: z.string().optional(),
-	SNOWFLAKE_DATABASE: z.string().optional(),
-	SNOWFLAKE_SCHEMA: z.string().optional(),
-	SNOWFLAKE_HOST: z.string().optional(),
-	SNOWFLAKE_REGION: z.string().optional(),
-	SNOWFLAKE_PUBLIC_KEY_FP: z.string().optional()
-};
-const snowflakeAuthSchema = z.object(baseSnowflakeAuthShape).superRefine((value, ctx) => {
-	if (value.mode === "keypair") {
-		if (!value.SNOWFLAKE_USER) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_USER"],
-			message: "SNOWFLAKE_USER is required when mode = \"keypair\""
-		});
-		if (!value.SNOWFLAKE_PRIVATE_KEY) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_PRIVATE_KEY"],
-			message: "SNOWFLAKE_PRIVATE_KEY is required when mode = \"keypair\""
-		});
-	} else if (value.mode === "oauth") {
-		if (!value.SNOWFLAKE_OAUTH_ACCESS_TOKEN) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_OAUTH_ACCESS_TOKEN"],
-			message: "SNOWFLAKE_OAUTH_ACCESS_TOKEN is required when mode = \"oauth\""
-		});
-	} else if (value.mode === "pat") {
-		if (!value.SNOWFLAKE_USER) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_USER"],
-			message: "SNOWFLAKE_USER is required when mode = \"pat\""
-		});
-		if (!value.SNOWFLAKE_PAT) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_PAT"],
-			message: "SNOWFLAKE_PAT is required when mode = \"pat\""
-		});
-	} else if (value.mode === "basic") {
-		if (!value.SNOWFLAKE_USER) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_USER"],
-			message: "SNOWFLAKE_USER is required when mode = \"basic\""
-		});
-		if (!value.SNOWFLAKE_PASSWORD) ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["SNOWFLAKE_PASSWORD"],
-			message: "SNOWFLAKE_PASSWORD is required when mode = \"basic\""
-		});
-	}
-});
-/**
-* `auth` shape used when defining the official integration. Must be a
-* `ZodObject<ZodRawShape>` — refinements are attached for callers via
-* {@link parseSnowflakeCredentials}.
-*/
-const snowflakeAuthObjectSchema = z.object(baseSnowflakeAuthShape);
-const snowflakeOfficialIntegration = {
-	id: "snowflake",
-	name: "Snowflake",
-	description: "Snowflake data cloud: SQL API v2, Snowpipe (file + streaming), warehouses, roles, users, grants, shares, streams, tasks, and administration for Keystroke workflows.",
-	auth: snowflakeAuthObjectSchema
-};
-const snowflakeBundle = defineOfficialIntegration({
-	...snowflakeOfficialIntegration,
-	internal: { other: [
-		snowflakeS3SnsWebhookCredentialSet,
-		snowflakeGcsPubSubWebhookCredentialSet,
-		snowflakeAzureEventGridWebhookCredentialSet
-	] }
-});
-const snowflake = snowflakeBundle.credentialSet;
-/**
-* Parse raw credential values through the full refinement pipeline. Callers
-* (client, operations) should use this instead of the raw object schema so
-* mode-specific invariants are enforced.
-*/
-function parseSnowflakeCredentials(input) {
-	return snowflakeAuthSchema.parse(input);
-}
-
-//#endregion
-export { snowflakeBundle as a, snowflakeAuthSchema as i, snowflake as n, snowflakeOfficialIntegration as o, snowflakeAuthModeSchema as r, parseSnowflakeCredentials as t };

package/dist/schemas-catalog.mjs

@@ -1,3 +0,0 @@
-import { findSchemas, showSchemas } from "./catalog.mjs";
-
-export { findSchemas, showSchemas };

package/dist/views.d.mts

@@ -1,2 +0,0 @@
-import { CatalogResult, ShowMaterializedViewsOptions, ShowViewsOptions, showMaterializedViews, showViews } from "./catalog.mjs";
-export { type CatalogResult, type ShowMaterializedViewsOptions, type ShowViewsOptions, showMaterializedViews, showViews };

package/dist/views.mjs

@@ -1,3 +0,0 @@
-import { showMaterializedViews, showViews } from "./catalog.mjs";
-
-export { showMaterializedViews, showViews };