@lightdash/cli 0.3482.1 → 0.3483.0

package/dist/handlers/contentAsCode/projectResources.d.ts

@@ -1,7 +1,8 @@
-import { type AgentAsCode, type AlertAsCode, type GoogleSheetsSyncAsCode, type ScheduledDeliveryAsCode, type VirtualViewAsCode } from '@lightdash/common';
+import { type AgentAsCode, type AlertAsCode, type ExternalConnectionAsCode, type GoogleSheetsSyncAsCode, type ScheduledDeliveryAsCode, type VirtualViewAsCode } from '@lightdash/common';
 import type { CodeResourceDefinition } from './resource';
 export declare const VIRTUAL_VIEW_CODE_RESOURCE: CodeResourceDefinition<VirtualViewAsCode>;
 export declare const AI_AGENT_CODE_RESOURCE: CodeResourceDefinition<AgentAsCode>;
+export declare const EXTERNAL_CONNECTION_CODE_RESOURCE: CodeResourceDefinition<ExternalConnectionAsCode>;
 export declare const SCHEDULED_DELIVERY_CODE_RESOURCE: CodeResourceDefinition<ScheduledDeliveryAsCode>;
 export declare const ALERT_CODE_RESOURCE: CodeResourceDefinition<AlertAsCode>;
 export declare const GOOGLE_SHEETS_CODE_RESOURCE: CodeResourceDefinition<GoogleSheetsSyncAsCode>;

package/dist/handlers/contentAsCode/projectResources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projectResources.d.ts","sourceRoot":"","sources":["../../../src/handlers/contentAsCode/projectResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,eAAO,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,iBAAiB,CAwB5E,CAAC;AAEN,eAAO,MAAM,sBAAsB,EAAE,sBAAsB,CAAC,WAAW,CAyBtE,CAAC;AA4CF,eAAO,MAAM,gCAAgC,iDAKvC,CAAC;AAEP,eAAO,MAAM,mBAAmB,qCAI9B,CAAC;AAEH,eAAO,MAAM,2BAA2B,gDAKlC,CAAC"}
+{"version":3,"file":"projectResources.d.ts","sourceRoot":"","sources":["../../../src/handlers/contentAsCode/projectResources.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,eAAO,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,iBAAiB,CAwB5E,CAAC;AAEN,eAAO,MAAM,sBAAsB,EAAE,sBAAsB,CAAC,WAAW,CAyBtE,CAAC;AAEF,eAAO,MAAM,iCAAiC,EAAE,sBAAsB,CAAC,wBAAwB,CAwB1F,CAAC;AA4CN,eAAO,MAAM,gCAAgC,iDAKvC,CAAC;AAEP,eAAO,MAAM,mBAAmB,qCAI9B,CAAC;AAEH,eAAO,MAAM,2BAA2B,gDAKlC,CAAC"}

package/dist/handlers/contentAsCode/projectResources.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GOOGLE_SHEETS_CODE_RESOURCE = exports.ALERT_CODE_RESOURCE = exports.SCHEDULED_DELIVERY_CODE_RESOURCE = exports.AI_AGENT_CODE_RESOURCE = exports.VIRTUAL_VIEW_CODE_RESOURCE = void 0;
+exports.GOOGLE_SHEETS_CODE_RESOURCE = exports.ALERT_CODE_RESOURCE = exports.SCHEDULED_DELIVERY_CODE_RESOURCE = exports.EXTERNAL_CONNECTION_CODE_RESOURCE = exports.AI_AGENT_CODE_RESOURCE = exports.VIRTUAL_VIEW_CODE_RESOURCE = void 0;
 const common_1 = require("@lightdash/common");
 exports.VIRTUAL_VIEW_CODE_RESOURCE = {
     kind: common_1.ContentAsCodeType.VIRTUAL_VIEW,
@@ -50,6 +50,29 @@ exports.AI_AGENT_CODE_RESOURCE = {
     serialize: ({ updatedAt, downloadedAt, ...agent }) => agent,
     sort: (left, right) => left.slug.localeCompare(right.slug),
 };
+exports.EXTERNAL_CONNECTION_CODE_RESOURCE = {
+    kind: common_1.ContentAsCodeType.EXTERNAL_CONNECTION,
+    displayLabel: 'external connection',
+    identityLabel: 'slug',
+    scope: 'project',
+    folderName: 'external-connections',
+    acceptedExtensions: ['.yml', '.yaml'],
+    fileName: {
+        strategy: 'identity',
+        fallbackPrefix: 'external-connection',
+        extension: '.yml',
+    },
+    dependencies: [],
+    identity: ({ slug }) => slug,
+    displayName: ({ name }) => name,
+    parse: (input, source) => (0, common_1.parseVersionedContentAsCodeDocument)({
+        input,
+        source,
+        resourceLabel: 'external connection',
+        contentType: common_1.ContentAsCodeType.EXTERNAL_CONNECTION,
+    }),
+    sort: (left, right) => left.slug.localeCompare(right.slug),
+};
 const scheduledResource = ({ contentType, folderName, label, }) => ({
     kind: contentType,
     displayLabel: label,

package/dist/handlers/contentAsCode/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/handlers/contentAsCode/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,yBAAyB,EACjC,MAAM,mBAAmB,CAAC;AAY3B,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,yBAAyB,CAAC;IAChC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACtD,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,SAAS,wBAAwB,EACH,CAAC;AAEzE,eAAO,MAAM,sBAAsB,EAAE,SAAS,wBAAwB,EAuBrE,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC1C,WAAW,SAAS,wBAAwB,EAAE,KAC/C,IAeF,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/handlers/contentAsCode/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,yBAAyB,EACjC,MAAM,mBAAmB,CAAC;AAa3B,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,yBAAyB,CAAC;IAChC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACtD,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,SAAS,wBAAwB,EACH,CAAC;AAEzE,eAAO,MAAM,sBAAsB,EAAE,SAAS,wBAAwB,EAwBrE,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC1C,WAAW,SAAS,wBAAwB,EAAE,KAC/C,IAeF,CAAC"}

package/dist/handlers/contentAsCode/registry.js

@@ -30,6 +30,7 @@ exports.PROJECT_CODE_RESOURCES = [
     projectResources_1.SCHEDULED_DELIVERY_CODE_RESOURCE,
     projectResources_1.ALERT_CODE_RESOURCE,
     projectResources_1.GOOGLE_SHEETS_CODE_RESOURCE,
+    projectResources_1.EXTERNAL_CONNECTION_CODE_RESOURCE,
 ];
 const assertCodeResourceDependencyOrder = (resources) => {
     const completed = new Set();

package/dist/handlers/dbt/apiClient.d.ts

@@ -16,6 +16,7 @@ export type ContentAsCodeUploadPermissions = {
     scheduledDeliveries: boolean;
     googleSheets: boolean;
     dataApps: boolean;
+    externalConnections: boolean;
 };
 export declare const getContentAsCodeUploadPermissions: (projectUuid: string) => Promise<ContentAsCodeUploadPermissions>;
 export declare const checkProjectCreationPermission: (upstreamProjectUuid: string | undefined, projectType: ProjectType) => Promise<void>;

package/dist/handlers/dbt/apiClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../src/handlers/dbt/apiClient.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,WAAW,EAIX,WAAW,EAEX,KAAK,6BAA6B,EAGrC,MAAM,mBAAmB,CAAC;AAC3B,OAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS7C,KAAK,iBAAiB,GAAG;IACrB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,SAE9C,CAAC;AAEF,eAAO,MAAM,YAAY,GAAU,CAAC,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,wBAIlE,iBAAiB,KAAG,OAAO,CAAC,CAAC,CAqE/B,CAAC;AAEF,eAAO,MAAM,cAAc,QACb,OAAO,CAAC,6BAA6B,CAKzC,CAAC;AAEX,MAAM,MAAM,8BAA8B,GAAG;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC1C,aAAa,MAAM,KACpB,OAAO,CAAC,8BAA8B,CAsFxC,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,qBAAqB,MAAM,GAAG,SAAS,EACvC,aAAa,WAAW,KACzB,OAAO,CAAC,IAAI,CA0Gd,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,IAAI,CA2B1D,CAAC"}
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../../../src/handlers/dbt/apiClient.ts"],"names":[],"mappings":"AACA,OAAO,EAGH,WAAW,EAIX,WAAW,EAEX,KAAK,6BAA6B,EAGrC,MAAM,mBAAmB,CAAC;AAC3B,OAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAS7C,KAAK,iBAAiB,GAAG;IACrB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC9B,CAAC;AAKF,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,SAE9C,CAAC;AAEF,eAAO,MAAM,YAAY,GAAU,CAAC,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,wBAIlE,iBAAiB,KAAG,OAAO,CAAC,CAAC,CAqE/B,CAAC;AAEF,eAAO,MAAM,cAAc,QACb,OAAO,CAAC,6BAA6B,CAKzC,CAAC;AAEX,MAAM,MAAM,8BAA8B,GAAG;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC1C,aAAa,MAAM,KACpB,OAAO,CAAC,8BAA8B,CA0FxC,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACvC,qBAAqB,MAAM,GAAG,SAAS,EACvC,aAAa,WAAW,KACzB,OAAO,CAAC,IAAI,CA0Gd,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,IAAI,CA2B1D,CAAC"}

package/dist/handlers/dbt/apiClient.js

@@ -135,6 +135,7 @@ const getContentAsCodeUploadPermissions = async (projectUuid) => {
             ability.can('manage', (0, ability_1.subject)('GoogleSheets', { ...baseSubject })),
         dataApps: ability.can('create', (0, ability_1.subject)('DataApp', { ...accessibleResourceSubject })) ||
             ability.can('manage', (0, ability_1.subject)('DataApp', { ...accessibleResourceSubject })),
+        externalConnections: ability.can('manage', (0, ability_1.subject)('ExternalConnection', { ...baseSubject })),
     };
 };
 exports.getContentAsCodeUploadPermissions = getContentAsCodeUploadPermissions;

package/dist/handlers/download.d.ts

@@ -1,4 +1,4 @@
-import { AgentAsCode, ChartAsCode, DashboardAsCode, type SpaceAsCode } from '@lightdash/common';
+import { AgentAsCode, ChartAsCode, DashboardAsCode, ExternalConnectionAsCode, type SpaceAsCode } from '@lightdash/common';
 import { type ContentAsCodeOutputVariant } from '../terminal/contentAsCodeOutput';
 import { type SpaceCodeFile } from './spacesAsCode';
 export type DownloadHandlerOptions = {
@@ -10,6 +10,7 @@ export type DownloadHandlerOptions = {
     googleSheets: string[];
     scheduledDeliveries: string[];
     virtualViews: string[];
+    externalConnections: string[];
     apps?: string[];
     includeAgents?: boolean;
     includeApps?: boolean;
@@ -34,10 +35,12 @@ export type DownloadHandlerOptions = {
     skipGoogleSheets: boolean;
     skipScheduledDeliveries: boolean;
     skipVirtualViews: boolean;
+    skipExternalConnections: boolean;
     includeAlerts: boolean;
     includeGoogleSheets: boolean;
     includeScheduledDeliveries: boolean;
     includeVirtualViews: boolean;
+    includeExternalConnections: boolean;
     includeAll: boolean;
     appsOnly?: boolean;
     stripPivotSeries: boolean;
@@ -54,6 +57,7 @@ type MetadataEntry = {
 };
 type DownloadContentType = 'charts' | 'dashboards' | 'sqlCharts';
 export declare const downloadContent: (ids: string[], type: DownloadContentType, projectId: string, projectName: string, customPath?: string, languageMap?: boolean, nested?: boolean, skipSpaces?: boolean, stripPivotSeries?: boolean, rootSpaces?: boolean, onProgress?: (detail: string) => void) => Promise<[number, string[], MetadataEntry[], SpaceAsCode[]]>;
+export declare const getExternalConnectionSecretEnvVar: (slug: string) => string;
 export declare const downloadHandler: (options: DownloadHandlerOptions) => Promise<void>;
 export declare const uploadHandler: (options: DownloadHandlerOptions) => Promise<void>;
 export declare const testHelpers: {
@@ -63,8 +67,10 @@ export declare const testHelpers: {
     getDashboardChartSlugs: (dashboardSlugs: string[], customPath?: string, looseDashboards?: (DashboardAsCode & {
         needsUpdating: boolean;
     })[]) => Promise<string[]>;
-    hasContentFilters: ({ spacesOnly, charts, dashboards, agents, alerts, googleSheets, scheduledDeliveries, virtualViews, apps, }: Pick<DownloadHandlerOptions, "spacesOnly" | "charts" | "dashboards" | "agents" | "alerts" | "googleSheets" | "scheduledDeliveries" | "virtualViews" | "apps">) => boolean;
+    hasContentFilters: ({ spacesOnly, charts, dashboards, agents, alerts, googleSheets, scheduledDeliveries, virtualViews, externalConnections, apps, }: Pick<DownloadHandlerOptions, "spacesOnly" | "charts" | "dashboards" | "agents" | "alerts" | "googleSheets" | "scheduledDeliveries" | "virtualViews" | "externalConnections" | "apps">) => boolean;
+    isExternalConnectionsUnavailableError: (error: unknown) => boolean;
     readAiAgentFiles: (customPath?: string) => Promise<AgentAsCode[]>;
+    readExternalConnectionFiles: (customPath?: string) => Promise<ExternalConnectionAsCode[]>;
     readSpaceFiles: (customPath?: string) => Promise<SpaceCodeFile[]>;
     readSpaceNames: (customPath?: string) => Promise<Record<string, string>>;
     sanitizeChartForDownload: (chart: ChartAsCode, stripPivotSeries: boolean) => ChartAsCode;
@@ -75,6 +81,7 @@ export declare const testHelpers: {
         detail: string;
         variant?: ContentAsCodeOutputVariant;
     };
+    upsertExternalConnections: (projectId: string, slugs: string[], changes: Record<string, number>, force: boolean, canUpload: boolean, customPath?: string) => Promise<Record<string, number>>;
     upsertSpaces: (projectId: string, files: SpaceCodeFile[], changes: Record<string, number>, skipSpaceCreate: boolean, publicSpaceCreate: boolean, skipSpaceAccess?: boolean) => Promise<Record<string, number>>;
     upsertVirtualViews: (projectId: string, slugs: string[], changes: Record<string, number>, force: boolean, canUpload: boolean, customPath?: string) => Promise<Record<string, number>>;
     validateSpaceIdentity: (parsed: unknown, filePath: string) => SpaceAsCode;

package/dist/handlers/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/handlers/download.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,WAAW,EAuBX,WAAW,EAGX,eAAe,EAef,KAAK,WAAW,EACnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,EAIH,KAAK,0BAA0B,EAClC,MAAM,iCAAiC,CAAC;AA+DzC,OAAO,EAmBH,KAAK,aAAa,EACrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uBAAuB,EAAE,OAAO,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0BAA0B,EAAE,OAAO,CAAC;IACpC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAgIF,KAAK,aAAa,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AA6XF,KAAK,mBAAmB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAkDjE,eAAO,MAAM,eAAe,GACxB,KAAK,MAAM,EAAE,EACb,MAAM,mBAAmB,EACzB,WAAW,MAAM,EACjB,aAAa,MAAM,EACnB,aAAa,MAAM,EACnB,cAAa,OAAe,EAC5B,SAAQ,OAAe,EACvB,aAAY,OAAe,EAC3B,mBAAkB,OAAe,EACjC,aAAY,OAAe,EAC3B,aAAa,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KACtC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,CAAC,CAsI5D,CAAC;AA2cF,eAAO,MAAM,eAAe,GACxB,SAAS,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAunBd,CAAC;AAudF,eAAO,MAAM,aAAa,GACtB,SAAS,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAytBd,CAAC;AAEF,eAAO,MAAM,WAAW;;;;6CA9vBJ,MAAM,EAAE,eACX,MAAM,oBACF,CAAC,eAAe,GAAG;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,EAAE;oIAvqElE,IAAI,CACH,sBAAsB,EACpB,YAAY,GACZ,QAAQ,GACR,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,MAAM,CACX,KAAG,OAAO;oCA+3BM,MAAM,KACpB,OAAO,CAAC,WAAW,EAAE,CAAC;;;sCA9xBd,WAAW,oBACA,OAAO,KAC1B,WAAW;;+EAhIX,IAAI,CACH,sBAAsB,EACtB,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,CACzD,KAAG,OAAO;;qCA+yDC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,0BAA0B,CAAA;KAAE;;oCAzjC5C,MAAM,SACV,MAAM,EAAE,WACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACxB,OAAO,aACH,OAAO,eACL,MAAM,KACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;;CAqsEjC,CAAC"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/handlers/download.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,WAAW,EAyBX,WAAW,EAGX,eAAe,EACf,wBAAwB,EAexB,KAAK,WAAW,EACnB,MAAM,mBAAmB,CAAC;AAY3B,OAAO,EAIH,KAAK,0BAA0B,EAClC,MAAM,iCAAiC,CAAC;AAgEzC,OAAO,EAmBH,KAAK,aAAa,EACrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,sBAAsB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uBAAuB,EAAE,OAAO,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uBAAuB,EAAE,OAAO,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0BAA0B,EAAE,OAAO,CAAC;IACpC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0BAA0B,EAAE,OAAO,CAAC;IACpC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAmIF,KAAK,aAAa,GAAG;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AA6XF,KAAK,mBAAmB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAkDjE,eAAO,MAAM,eAAe,GACxB,KAAK,MAAM,EAAE,EACb,MAAM,mBAAmB,EACzB,WAAW,MAAM,EACjB,aAAa,MAAM,EACnB,aAAa,MAAM,EACnB,cAAa,OAAe,EAC5B,SAAQ,OAAe,EACvB,aAAY,OAAe,EAC3B,mBAAkB,OAAe,EACjC,aAAY,OAAe,EAC3B,aAAa,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KACtC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,CAAC,CAsI5D,CAAC;AAoIF,eAAO,MAAM,iCAAiC,GAAI,MAAM,MAAM,KAAG,MAGzC,CAAC;AAwgBzB,eAAO,MAAM,eAAe,GACxB,SAAS,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAkpBd,CAAC;AAudF,eAAO,MAAM,aAAa,GACtB,SAAS,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAkvBd,CAAC;AAEF,eAAO,MAAM,WAAW;;;;6CAvxBJ,MAAM,EAAE,eACX,MAAM,oBACF,CAAC,eAAe,GAAG;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,EAAE;yJAx4ElE,IAAI,CACH,sBAAsB,EACpB,YAAY,GACZ,QAAQ,GACR,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,qBAAqB,GACrB,MAAM,CACX,KAAG,OAAO;mDAuzB2C,OAAO,KAAG,OAAO;oCA6QtD,MAAM,KACpB,OAAO,CAAC,WAAW,EAAE,CAAC;+CA7LR,MAAM,KACpB,OAAO,CAAC,wBAAwB,EAAE,CAAC;;;sCAtyB3B,WAAW,oBACA,OAAO,KAC1B,WAAW;;+EAnIX,IAAI,CACH,sBAAsB,EACtB,YAAY,GAAG,eAAe,GAAG,QAAQ,GAAG,UAAU,CACzD,KAAG,OAAO;;qCAihEC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,0BAA0B,CAAA;KAAE;2CArmC5C,MAAM,SACV,MAAM,EAAE,WACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACxB,OAAO,aACH,OAAO,eACL,MAAM,KACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;oCAzLnB,MAAM,SACV,MAAM,EAAE,WACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SACxB,OAAO,aACH,OAAO,eACL,MAAM,KACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;;;CAg8EjC,CAAC"}

package/dist/handlers/download.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.testHelpers = exports.uploadHandler = exports.downloadHandler = exports.downloadContent = void 0;
+exports.testHelpers = exports.uploadHandler = exports.downloadHandler = exports.getExternalConnectionSecretEnvVar = exports.downloadContent = void 0;
 const tslib_1 = require("tslib");
 /* eslint-disable no-await-in-loop */
 /* eslint-disable no-param-reassign */
@@ -30,7 +30,7 @@ const selectProject_1 = require("./selectProject");
 const spacesAsCode_1 = require("./spacesAsCode");
 const shouldDownloadAiAgents = ({ includeAll, includeAgents, agents, appsOnly, }) => appsOnly !== true &&
     (includeAll === true || includeAgents === true || agents.length > 0);
-const hasContentFilters = ({ spacesOnly, charts, dashboards, agents, alerts, googleSheets, scheduledDeliveries, virtualViews, apps, }) => !spacesOnly &&
+const hasContentFilters = ({ spacesOnly, charts, dashboards, agents, alerts, googleSheets, scheduledDeliveries, virtualViews, externalConnections, apps, }) => !spacesOnly &&
     [
         charts,
         dashboards,
@@ -39,6 +39,7 @@ const hasContentFilters = ({ spacesOnly, charts, dashboards, agents, alerts, goo
         googleSheets,
         scheduledDeliveries,
         virtualViews,
+        externalConnections,
         apps ?? [],
     ].some((filters) => filters.length > 0);
 /*
@@ -502,6 +503,129 @@ const upsertVirtualViews = async (projectId, slugs, changes, force, canUpload, c
     }
     return changes;
 };
+const getExternalConnectionSecretEnvVar = (slug) => `LIGHTDASH_EXTERNAL_CONNECTION_SECRET_${slug
+    .replace(/-/g, '_')
+    .toUpperCase()}`;
+exports.getExternalConnectionSecretEnvVar = getExternalConnectionSecretEnvVar;
+const EXTERNAL_CONNECTION_SECRET_TYPES = new Set([
+    'api_key',
+    'bearer_token',
+    'google_service_account',
+]);
+/**
+ * External connections are enterprise-only and admin-gated; when the download
+ * was reached implicitly through --include-all these statuses mean "not
+ * available here" rather than a real failure: 403 = missing
+ * manage:ExternalConnection, 404 = pre-feature server, 422 = OSS server with
+ * no EE coder service provider (MissingConfigError).
+ */
+const isExternalConnectionsUnavailableError = (error) => error instanceof common_1.LightdashError &&
+    [403, 404, 422].includes(error.statusCode);
+const downloadExternalConnections = async (projectId, slugs, implicit, customPath) => {
+    const slugQuery = slugs.map((slug) => ['slugs', slug]);
+    let offset = 0;
+    let total = 0;
+    const connections = [];
+    // Every page repeats the same full list, so warn once after the loop.
+    let missingSlugs = [];
+    try {
+        do {
+            const query = new URLSearchParams([
+                ...slugQuery,
+                ['offset', String(offset)],
+            ]).toString();
+            const results = await (0, apiClient_1.lightdashApi)({
+                method: 'GET',
+                url: `/api/v1/projects/${projectId}/code/externalConnections?${query}`,
+                body: undefined,
+            });
+            connections.push(...results.externalConnections);
+            missingSlugs = results.missingSlugs;
+            offset = results.offset;
+            total = results.total;
+        } while (offset < total);
+    }
+    catch (error) {
+        if (implicit && isExternalConnectionsUnavailableError(error)) {
+            globalState_1.default.log(styles.warning('Skipping external connections: they require Lightdash Enterprise and the manage:ExternalConnection permission.'));
+            globalState_1.default.debug(`Could not download external connections: ${(0, common_1.getErrorMessage)(error)}`);
+            return 0;
+        }
+        throw error;
+    }
+    missingSlugs.forEach((slug) => globalState_1.default.log(styles.warning(`External connection "${slug}" was not found`)));
+    await (0, resource_1.writeCodeResourceDocuments)({
+        definition: projectResources_1.EXTERNAL_CONNECTION_CODE_RESOURCE,
+        basePath: (0, contentAsCodePaths_1.getDownloadFolder)(customPath),
+        documents: connections,
+        pruneOtherDocuments: slugs.length === 0,
+    });
+    const secretEnvVars = connections
+        .filter(({ authType }) => EXTERNAL_CONNECTION_SECRET_TYPES.has(authType))
+        .map(({ slug }) => (0, exports.getExternalConnectionSecretEnvVar)(slug));
+    if (secretEnvVars.length > 0) {
+        globalState_1.default.log(styles.warning(`Secrets are never downloaded. To create these connections on another instance, set:\n\t${secretEnvVars.join('\n\t')}`));
+    }
+    return connections.length;
+};
+const readExternalConnectionFiles = async (customPath) => {
+    const result = await (0, resource_1.readCodeResourceFiles)({
+        definition: projectResources_1.EXTERNAL_CONNECTION_CODE_RESOURCE,
+        basePath: (0, contentAsCodePaths_1.getDownloadFolder)(customPath),
+    });
+    (0, resource_1.assertCodeResourceFilesValid)(result);
+    return result.files.map(({ document }) => document);
+};
+const upsertExternalConnections = async (projectId, slugs, changes, force, canUpload, customPath) => {
+    const connections = await readExternalConnectionFiles(customPath);
+    const selected = slugs.length
+        ? connections.filter(({ slug }) => slugs.includes(slug))
+        : connections;
+    const selectedSlugs = new Set(selected.map(({ slug }) => slug));
+    slugs
+        .filter((slug) => !selectedSlugs.has(slug))
+        .forEach((slug) => globalState_1.default.log(styles.warning(`External connection "${slug}" was not found locally`)));
+    if (selected.length > 0 && !canUpload) {
+        globalState_1.default.log(styles.error(`Error uploading external connections: the manage:ExternalConnection permission is required (enterprise feature)`));
+        return changes;
+    }
+    for (const connection of selected.sort((left, right) => left.slug.localeCompare(right.slug))) {
+        const envVar = (0, exports.getExternalConnectionSecretEnvVar)(connection.slug);
+        const envValue = process.env[envVar];
+        const secret = envValue !== undefined && envValue !== '' ? envValue : undefined;
+        if (envValue === '') {
+            globalState_1.default.log(styles.warning(`Environment variable ${envVar} is set but empty; treating the secret as not provided.`));
+        }
+        // The parser keeps unknown keys, so a secret authored into the YAML
+        // would otherwise be sent verbatim — strip it and tell the user.
+        if ('secret' in connection) {
+            delete connection.secret;
+            globalState_1.default.log(styles.warning(`Ignoring "secret" in the file for "${connection.slug}" — secrets must never be stored in YAML. Set ${envVar} instead.`));
+        }
+        try {
+            const result = await (0, apiClient_1.lightdashApi)({
+                method: 'POST',
+                url: `/api/v1/projects/${projectId}/code/externalConnections/${encodeURIComponent(connection.slug)}?force=${force}`,
+                body: JSON.stringify({
+                    connection,
+                    ...(secret !== undefined ? { secret } : {}),
+                }),
+            });
+            const action = `external connections ${getPromoteAction(result.action)}`;
+            changes[action] = (changes[action] ?? 0) + 1;
+        }
+        catch (error) {
+            const errorKey = 'external connections with errors';
+            changes[errorKey] = (changes[errorKey] ?? 0) + 1;
+            const secretHint = secret === undefined &&
+                EXTERNAL_CONNECTION_SECRET_TYPES.has(connection.authType)
+                ? `\n\tSet ${envVar} to provide the secret for "${connection.slug}" — secrets are read from the environment at upload time and never stored in YAML.`
+                : '';
+            globalState_1.default.log(styles.error(`Error upserting external connection:\n\t"${connection.name}" (slug: "${connection.slug}")\n\t${(0, common_1.getErrorMessage)(error)}${secretHint}`));
+        }
+    }
+    return changes;
+};
 const getScheduledContentConfig = (contentType, customPath) => {
     switch (contentType) {
         case common_1.ContentAsCodeType.ALERT:
@@ -733,6 +857,7 @@ const downloadHandler = async (options) => {
         options.includeGoogleSheets = false;
         options.includeScheduledDeliveries = false;
         options.includeVirtualViews = false;
+        options.includeExternalConnections = false;
     }
     if (options.spacesOnly) {
         if (options.skipSpaces) {
@@ -746,12 +871,14 @@ const downloadHandler = async (options) => {
         options.googleSheets = [];
         options.scheduledDeliveries = [];
         options.virtualViews = [];
+        options.externalConnections = [];
         options.includeAgents = false;
         options.includeApps = false;
         options.includeAlerts = false;
         options.includeGoogleSheets = false;
         options.includeScheduledDeliveries = false;
         options.includeVirtualViews = false;
+        options.includeExternalConnections = false;
     }
     if (options.rootSpaces && options.nested) {
         throw new common_1.ParameterError('--root-spaces cannot be combined with --nested');
@@ -934,6 +1061,20 @@ const downloadHandler = async (options) => {
                 detail: (total) => `${total} downloaded`,
             });
         }
+        if (includeAllOptionalContent ||
+            options.includeExternalConnections ||
+            options.externalConnections.length > 0) {
+            // Only --include-all is implicit: unavailable (non-EE / no
+            // permission) then warns and skips instead of failing the download
+            const implicit = includeAllOptionalContent &&
+                !options.includeExternalConnections &&
+                options.externalConnections.length === 0;
+            await output.runItem({
+                label: 'External connections',
+                action: () => downloadExternalConnections(projectId, options.externalConnections, implicit, options.path),
+                detail: (total) => `${total} downloaded`,
+            });
+        }
         // Download data apps (enterprise, opt-in via --apps / --include-apps / --include-all)
         const appsSelection = (0, appsDownload_1.selectAppsToDownload)({
             apps: Array.isArray(options.apps) ? options.apps : undefined,
@@ -1596,6 +1737,19 @@ const uploadHandler = async (options) => {
                 });
             }
         }
+        if (!options.skipExternalConnections) {
+            if (hasFilters && options.externalConnections.length === 0) {
+                globalState_1.default.log(styles.warning(`No external connection filters provided, skipping`));
+            }
+            else {
+                changes = await runUploadChangesPhase({
+                    output,
+                    label: 'External connections',
+                    changes,
+                    action: () => upsertExternalConnections(projectId, options.externalConnections, changes, options.force, uploadPermissions.externalConnections, options.path),
+                });
+            }
+        }
         // Upload data apps (enterprise, opt-in via --apps <references...> or
         // --include-apps, fire-and-forget)
         const explicitAppReferences = Array.isArray(options.apps)
@@ -1854,7 +2008,9 @@ exports.testHelpers = {
     getFlatSpaceFileNames: spacesAsCode_1.getFlatSpaceFileNames,
     getDashboardChartSlugs,
     hasContentFilters,
+    isExternalConnectionsUnavailableError,
     readAiAgentFiles,
+    readExternalConnectionFiles,
     readSpaceFiles: spacesAsCode_1.readSpaceFiles,
     readSpaceNames: spacesAsCode_1.readSpaceNames,
     sanitizeChartForDownload,
@@ -1862,6 +2018,7 @@ exports.testHelpers = {
     shouldDownloadAiAgents,
     sortSpaceFilesParentFirst: spacesAsCode_1.sortSpaceFilesParentFirst,
     summarizeUploadChanges,
+    upsertExternalConnections,
     upsertSpaces: spacesAsCode_1.upsertSpaces,
     upsertVirtualViews,
     validateSpaceIdentity: spacesAsCode_1.validateSpaceIdentity,

package/dist/handlers/download.test.js

@@ -13,7 +13,7 @@ vitest_1.vi.mock('./dbt/apiClient', async (importOriginal) => ({
     ...(await importOriginal()),
     lightdashApi: vitest_1.vi.fn(),
 }));
-const { assertUniqueSpacePaths, downloadSpaces, getDashboardChartSlugs, getFlatSpaceFileNames, hasContentFilters, readAiAgentFiles, readSpaceFiles, readSpaceNames, sanitizeChartForDownload, shouldFallBackToEmbeddedSpaces, shouldDownloadAiAgents, summarizeUploadChanges, upsertSpaces, upsertVirtualViews, validateSpaceIdentity, writeSpaceFiles, } = download_1.testHelpers;
+const { assertUniqueSpacePaths, downloadSpaces, getDashboardChartSlugs, getFlatSpaceFileNames, hasContentFilters, isExternalConnectionsUnavailableError, readAiAgentFiles, readSpaceFiles, readSpaceNames, sanitizeChartForDownload, shouldFallBackToEmbeddedSpaces, shouldDownloadAiAgents, summarizeUploadChanges, upsertExternalConnections, upsertSpaces, upsertVirtualViews, validateSpaceIdentity, writeSpaceFiles, } = download_1.testHelpers;
 const makeContentFilterOptions = (overrides = {}) => ({
     spacesOnly: false,
     charts: [],
@@ -23,6 +23,7 @@ const makeContentFilterOptions = (overrides = {}) => ({
     googleSheets: [],
     scheduledDeliveries: [],
     virtualViews: [],
+    externalConnections: [],
     apps: [],
     ...overrides,
 });
@@ -30,6 +31,9 @@ describe('hasContentFilters', () => {
     it('treats explicit apps as a filtered download and upload', () => {
         expect(hasContentFilters(makeContentFilterOptions({ apps: ['app-reference'] }))).toBe(true);
     });
+    it('treats explicit external connections as a filtered upload', () => {
+        expect(hasContentFilters(makeContentFilterOptions({ externalConnections: ['stripe'] }))).toBe(true);
+    });
     it('keeps an unfiltered content operation unfiltered', () => {
         expect(hasContentFilters(makeContentFilterOptions())).toBe(false);
     });
@@ -290,6 +294,124 @@ version: 1
         expect(logSpy).toHaveBeenCalledExactlyOnceWith(expect.stringContaining('Error uploading virtual views'));
     });
 });
+describe('upsertExternalConnections', () => {
+    let tmpDir;
+    const externalConnectionYaml = (slug, extraLines = []) => [
+        'allowedContentTypes:',
+        '  - application/json',
+        'allowedMethods:',
+        '  - GET',
+        'allowedPathPrefixes: []',
+        'apiKeyLocation: header',
+        'apiKeyName: Authorization',
+        'authType: api_key',
+        'contentType: external_connection',
+        'customHeaders: null',
+        'instructions: null',
+        `name: ${slug}`,
+        'oauthScopes: null',
+        'origin: https://api.example.com',
+        'rateLimitPerMinute: null',
+        'requestMaxBytes: 262144',
+        'responseMaxBytes: 1048576',
+        `slug: ${slug}`,
+        'timeoutMs: 10000',
+        'version: 1',
+        ...extraLines,
+        '',
+    ].join('\n');
+    beforeEach(async () => {
+        vitest_1.vi.mocked(apiClient_1.lightdashApi).mockReset();
+        tmpDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'external-connections-test-'));
+        await fs_1.promises.mkdir(path.join(tmpDir, 'external-connections'));
+    });
+    afterEach(async () => {
+        vitest_1.vi.restoreAllMocks();
+        vitest_1.vi.unstubAllEnvs();
+        await fs_1.promises.rm(tmpDir, { recursive: true, force: true });
+    });
+    it('omits the secret from the request when the env var is unset', async () => {
+        await fs_1.promises.writeFile(path.join(tmpDir, 'external-connections', 'stripe-api.yml'), externalConnectionYaml('stripe-api'));
+        vitest_1.vi.mocked(apiClient_1.lightdashApi).mockResolvedValueOnce({
+            action: 'no changes',
+        });
+        const changes = await upsertExternalConnections('project-uuid', [], {}, false, true, tmpDir);
+        expect(changes).toEqual({ 'external connections skipped': 1 });
+        const request = vitest_1.vi.mocked(apiClient_1.lightdashApi).mock.calls[0][0];
+        expect(request.url).toContain('/code/externalConnections/stripe-api?force=false');
+        const body = JSON.parse(request.body);
+        expect(body).not.toHaveProperty('secret');
+        expect(body.connection.slug).toBe('stripe-api');
+    });
+    it('resolves the secret from LIGHTDASH_EXTERNAL_CONNECTION_SECRET_<SLUG>', async () => {
+        await fs_1.promises.writeFile(path.join(tmpDir, 'external-connections', 'stripe-api.yml'), externalConnectionYaml('stripe-api'));
+        vitest_1.vi.stubEnv('LIGHTDASH_EXTERNAL_CONNECTION_SECRET_STRIPE_API', 'sk-123');
+        vitest_1.vi.mocked(apiClient_1.lightdashApi).mockResolvedValueOnce({
+            action: 'create',
+        });
+        const changes = await upsertExternalConnections('project-uuid', [], {}, false, true, tmpDir);
+        expect(changes).toEqual({ 'external connections created': 1 });
+        const body = JSON.parse(vitest_1.vi.mocked(apiClient_1.lightdashApi).mock.calls[0][0].body);
+        expect(body.secret).toBe('sk-123');
+        // The secret rides next to the document, never inside it
+        expect(body.connection).not.toHaveProperty('secret');
+    });
+    it('strips a secret authored into the YAML and warns', async () => {
+        const logSpy = vitest_1.vi
+            .spyOn(globalState_1.default, 'log')
+            .mockImplementation(() => undefined);
+        await fs_1.promises.writeFile(path.join(tmpDir, 'external-connections', 'stripe-api.yml'), externalConnectionYaml('stripe-api', ['secret: leaked-secret']));
+        vitest_1.vi.mocked(apiClient_1.lightdashApi).mockResolvedValueOnce({
+            action: 'update',
+        });
+        await upsertExternalConnections('project-uuid', [], {}, false, true, tmpDir);
+        const rawBody = vitest_1.vi.mocked(apiClient_1.lightdashApi).mock.calls[0][0].body;
+        expect(rawBody).not.toContain('leaked-secret');
+        expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('secrets must never be stored in YAML'));
+    });
+    it('reports one category error without uploading when the caller lacks permission', async () => {
+        const logSpy = vitest_1.vi
+            .spyOn(globalState_1.default, 'log')
+            .mockImplementation(() => undefined);
+        await fs_1.promises.writeFile(path.join(tmpDir, 'external-connections', 'stripe-api.yml'), externalConnectionYaml('stripe-api'));
+        const changes = await upsertExternalConnections('project-uuid', [], {}, false, false, tmpDir);
+        expect(changes).toEqual({});
+        expect(apiClient_1.lightdashApi).not.toHaveBeenCalled();
+        expect(logSpy).toHaveBeenCalledExactlyOnceWith(expect.stringContaining('Error uploading external connections'));
+    });
+    it('appends the env-var hint when a secret-requiring create fails without the env var', async () => {
+        const logSpy = vitest_1.vi
+            .spyOn(globalState_1.default, 'log')
+            .mockImplementation(() => undefined);
+        await fs_1.promises.writeFile(path.join(tmpDir, 'external-connections', 'stripe-api.yml'), externalConnectionYaml('stripe-api'));
+        vitest_1.vi.mocked(apiClient_1.lightdashApi).mockRejectedValueOnce(new Error('type "api_key" requires a secret'));
+        const changes = await upsertExternalConnections('project-uuid', [], {}, false, true, tmpDir);
+        expect(changes).toEqual({ 'external connections with errors': 1 });
+        expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Set LIGHTDASH_EXTERNAL_CONNECTION_SECRET_STRIPE_API'));
+    });
+});
+describe('getExternalConnectionSecretEnvVar', () => {
+    it('upper-snakes the slug', () => {
+        expect((0, download_1.getExternalConnectionSecretEnvVar)('stripe-api-v2')).toBe('LIGHTDASH_EXTERNAL_CONNECTION_SECRET_STRIPE_API_V2');
+    });
+});
+describe('isExternalConnectionsUnavailableError', () => {
+    const lightdashError = (statusCode) => new common_1.LightdashError({
+        message: 'nope',
+        name: 'TestError',
+        statusCode,
+        data: {},
+    });
+    it('classifies permission, missing-route and non-EE errors as unavailable', () => {
+        [403, 404, 422].forEach((statusCode) => {
+            expect(isExternalConnectionsUnavailableError(lightdashError(statusCode))).toBe(true);
+        });
+    });
+    it('keeps real failures fatal', () => {
+        expect(isExternalConnectionsUnavailableError(lightdashError(500))).toBe(false);
+        expect(isExternalConnectionsUnavailableError(new Error('network down'))).toBe(false);
+    });
+});
 describe('readAiAgentFiles', () => {
     let tmpDir;
     beforeEach(async () => {

package/dist/index.js

@@ -357,6 +357,8 @@ const downloadCommand = commander_1.program
     .option('--virtual-views <slugs...>', 'specify virtual view slugs to download', [])
     .option('--google-sheets <slugs...>', 'specify Google Sheets sync slugs to download', [])
     .option('--scheduled-deliveries <slugs...>', 'specify scheduled delivery slugs to download', [])
+    .option('--external-connections <slugs...>', 'specify external connection slugs to download (enterprise)', [])
+    .option('--include-external-connections', "include all of the project's data-app external connections (enterprise)", false)
     .option('-l, --language-map', 'generate a language maps for the downloaded charts and dashboards', false)
     .option('-p, --path <path>', 'specify a custom path to download content', undefined)
     .option('--nested', 'organize downloads in nested folders by project and space (default: flat structure)', false)
@@ -389,6 +391,7 @@ const uploadCommand = commander_1.program
     .option('--virtual-views <slugs...>', 'specify virtual view slugs to upload', [])
     .option('--google-sheets <slugs...>', 'specify Google Sheets sync slugs to upload', [])
     .option('--scheduled-deliveries <slugs...>', 'specify scheduled delivery slugs to upload', [])
+    .option('--external-connections <slugs...>', 'specify external connection slugs to upload (enterprise)', [])
     .option('--force', 'Force upload unchanged files and allow destructive virtual-view column changes', false)
     .option('-p, --path <path>', 'specify a custom path to upload content from', undefined)
     .option('--project <project uuid>', 'specify a project UUID to upload', parseProjectArgument, undefined)
@@ -402,6 +405,7 @@ const uploadCommand = commander_1.program
     .option('--skip-virtual-views', 'skip uploading virtual views', false)
     .option('--skip-google-sheets', 'skip uploading Google Sheets syncs', false)
     .option('--skip-scheduled-deliveries', 'skip uploading scheduled deliveries', false)
+    .option('--skip-external-connections', 'skip uploading external connections', false)
     .option('--concurrency <number>', 'Number of parallel uploads (default: 1)', '1')
     .option('--include-charts', 'Include charts updates when uploading dashboards', false)
     .option('--validate', 'Validate charts and dashboards after upload', false)

package/dist/vendor/authoring/developing-data-apps-locally/SKILL.md

@@ -12,6 +12,11 @@ You are editing a Lightdash **data app** that was downloaded with the Lightdash
 - All data access goes through `@lightdash/query-sdk` (a postMessage bridge to Lightdash). There is **no** `fetch`, no REST calls, no other network access at runtime — anything else is blocked.
 - For the SDK surface (query builder, `useLightdash`, filters, downloads), read the `lightdash-data-app` skill in this folder.
 
+## External HTTP APIs go through linked connections
+
+- The one sanctioned path to a third-party API is `lightdash.externalFetch('<alias>', ...)` against an **external connection** a project admin configured and linked to this app (see the `lightdash-data-app` skill).
+- If the app needs an API that is not linked, **stop and say so** — do not vendor an HTTP client or try to reach it another way. An admin must create the connection (in project settings, or as code: `lightdash download --include-external-connections`, edit `lightdash/external-connections/<slug>.yml`, `lightdash upload` with the secret in `LIGHTDASH_EXTERNAL_CONNECTION_SECRET_<SLUG>`) and link it to the app in Lightdash. That is project configuration, not part of this folder's source tree.
+
 ## Library boundaries — build with what's preinstalled
 
 - The app builds against a **fixed template dependency set** — see `package.json` (React, Recharts, d3 + d3-cloud/d3-sankey, Radix primitives, Tailwind, lucide-react, date-fns, html-to-image, jspdf, and more). **Design within this set**; it covers almost all data-app needs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "0.3482.1",
+  "version": "0.3483.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -41,8 +41,8 @@
     "unique-names-generator": "4.7.1",
     "uuid": "11.1.1",
     "yaml": "2.8.3",
-    "@lightdash/common": "0.3482.1",
-    "@lightdash/warehouses": "0.3482.1"
+    "@lightdash/warehouses": "0.3483.0",
+    "@lightdash/common": "0.3483.0"
   },
   "devDependencies": {
     "@types/inquirer": "8.2.4",