@lightdash/cli 2.562.0 → 2.563.0

package/dist/handlers/agentConnectionConnect.js

@@ -0,0 +1,371 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentConnectionConnectHandler = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const crypto_1 = require("crypto");
+const uuid_1 = require("uuid");
+const apiUrl_1 = require("../agentConnections/apiUrl");
+const connectInputs_1 = require("../agentConnections/connectInputs");
+const initialToken_1 = require("../agentConnections/initialToken");
+const lifecycle_1 = require("../agentConnections/lifecycle");
+const personalRecovery_1 = require("../agentConnections/personalRecovery");
+const schema_1 = require("../agentConnections/schema");
+const statusResponse_1 = require("../agentConnections/statusResponse");
+const store_1 = require("../agentConnections/store");
+const warehouseStatus_1 = require("../agentConnections/warehouseStatus");
+const config_1 = require("../config");
+const credentials_1 = require("../credentials");
+const globalState_1 = tslib_1.__importDefault(require("../globalState"));
+const connectionBrowser_1 = require("./login/connectionBrowser");
+const loopback_1 = require("./login/loopback");
+const couldNotStart = 'Could not start agent connection approval. No credential was saved. Try again when the server is available.';
+const existingConnection = 'The server returned the existing agent connection instead of a new one. No credential was saved.';
+const unchanged = 'No agent connection credential was saved. Your personal CLI login is unchanged.';
+class ApprovalStartError extends Error {
+}
+const requestResults = async (response) => {
+    if ([404, 405].includes(response.status))
+        throw new ApprovalStartError('Agent connections are not available on this server yet.');
+    if (response.status === 401)
+        throw new ApprovalStartError('Your personal CLI login was rejected. Run lightdash login for this instance, then try again.');
+    let envelope;
+    try {
+        const value = await response.json();
+        envelope = (0, statusResponse_1.responseRecord)(value);
+    }
+    catch {
+        throw new ApprovalStartError(couldNotStart);
+    }
+    if (!response.ok) {
+        const error = typeof envelope.error === 'object' && envelope.error !== null
+            ? (0, statusResponse_1.responseRecord)(envelope.error)
+            : {};
+        if (error.code === 'agent_connections_unavailable')
+            throw new ApprovalStartError('Agent connections are not available on this server yet.');
+        if (error.code === 'agent_identity_disabled')
+            throw new ApprovalStartError('Agent connections are disabled on this server. Ask an administrator to enable agent identity.');
+        if (response.status === 403)
+            throw new ApprovalStartError('The server refused agent connection approval. Check your permissions with an administrator.');
+        throw new ApprovalStartError(couldNotStart);
+    }
+    if (envelope.status !== 'ok')
+        throw new ApprovalStartError(couldNotStart);
+    return (0, statusResponse_1.responseRecord)(envelope.results);
+};
+const personIdentity = (person) => {
+    if (typeof person.userUuid !== 'string' ||
+        !(0, uuid_1.validate)(person.userUuid) ||
+        typeof person.organizationUuid !== 'string' ||
+        !(0, uuid_1.validate)(person.organizationUuid) ||
+        person.isServiceAccount === true)
+        throw new initialToken_1.ConnectionProofError();
+    return {
+        personUuid: person.userUuid,
+        organizationUuid: person.organizationUuid,
+    };
+};
+const proofResults = async (response) => {
+    if (!response.ok)
+        throw new initialToken_1.ConnectionProofError();
+    const value = await response.json();
+    const envelope = (0, statusResponse_1.responseRecord)(value);
+    if (envelope.status !== 'ok')
+        throw new initialToken_1.ConnectionProofError();
+    return (0, statusResponse_1.responseRecord)(envelope.results);
+};
+const agentConnectionConnectHandler = async (options, dependencies = {
+    launchBrowser: connectionBrowser_1.openConnectionBrowser,
+}) => {
+    (0, credentials_1.refuseAgentConnection)(true);
+    const input = (0, connectInputs_1.connectionConnectInputs)(options);
+    const deadline = Date.now() + input.timeout * 1000;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), input.timeout * 1000);
+    const cancel = () => controller.abort();
+    process.once('SIGINT', cancel);
+    process.once('SIGTERM', cancel);
+    let listener = null;
+    let spinner = null;
+    let countdown = null;
+    const stopWaiting = () => {
+        spinner?.stop();
+        if (countdown !== null)
+            clearInterval(countdown);
+        spinner = null;
+        countdown = null;
+    };
+    let phase = 'start';
+    let instance = null;
+    let saved = false;
+    const secrets = [];
+    const safeText = (value) => (0, statusResponse_1.publicTextIsSafe)(value, secrets) ? value : 'Name unavailable';
+    try {
+        const config = await (0, config_1.getConfig)({ readOnly: true });
+        const bootstrap = (0, personalRecovery_1.capturePersonalBootstrap)(config);
+        instance = bootstrap.instanceUrl;
+        secrets.push(...bootstrap.publicSecrets);
+        const { signal } = controller;
+        const person = personIdentity(await requestResults(await bootstrap.fetch({
+            method: 'GET',
+            url: '/api/v1/user',
+            body: undefined,
+            signal,
+        })));
+        const key = { ...person, instanceUrl: instance, name: input.name };
+        const store = new store_1.AgentConnectionStore();
+        const previous = await store.readSlot(key);
+        if (previous)
+            console.error(`Replacing agent connection slot ${safeText(input.name)}. The old credential stays until the new approval is verified. The old connection will not be revoked.`);
+        const state = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const verifier = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const codeChallenge = (0, crypto_1.createHash)('sha256')
+            .update(verifier)
+            .digest('base64url');
+        listener = await (0, loopback_1.createConnectionLoopback)({
+            port: input.port,
+            state,
+            issuer: instance,
+            signal,
+        });
+        const approval = await requestResults(await bootstrap.fetch({
+            method: 'POST',
+            url: '/api/v2/user/agent-connections/requests',
+            signal,
+            body: JSON.stringify({
+                clientId: 'lightdash-cli',
+                name: input.name,
+                projects: input.projects,
+                capabilities: input.capabilities,
+                expiresInSeconds: input.expiresInSeconds,
+                redirectUri: listener.redirectUri,
+                state,
+                codeChallenge,
+                codeChallengeMethod: 'S256',
+                resource: instance,
+            }),
+        }));
+        if (typeof approval.authorizationUrl !== 'string' ||
+            !bootstrap.publicTextIsSafe(approval.authorizationUrl) ||
+            !/^https?:\/\//.test(approval.authorizationUrl) ||
+            approval.issuer !== instance ||
+            approval.resource !== instance ||
+            typeof approval.expiresAt !== 'string' ||
+            !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(approval.expiresAt) ||
+            !Number.isFinite(Date.parse(approval.expiresAt)) ||
+            Date.parse(approval.expiresAt) <= Date.now())
+            throw new ApprovalStartError(couldNotStart);
+        const approvalDeadline = Date.parse(approval.expiresAt);
+        const authorizationUrl = (0, apiUrl_1.agentConnectionApiUrl)(instance, approval.authorizationUrl);
+        const destination = new URL(authorizationUrl);
+        if (!bootstrap.publicTextIsSafe(authorizationUrl) ||
+            destination.pathname !==
+                new URL(`${instance}/api/v1/oauth/authorize`).pathname ||
+            destination.hash)
+            throw new ApprovalStartError(couldNotStart);
+        console.error(`Open this page to approve the agent connection:\n${authorizationUrl}`);
+        console.error('Waiting for browser approval and warehouse setup...');
+        phase = 'callback';
+        if (process.stderr.isTTY && !globalState_1.default.isNonInteractive()) {
+            const waitingText = () => {
+                const seconds = Math.max(0, Math.ceil((Math.min(deadline, approvalDeadline) - Date.now()) /
+                    1000));
+                return `Waiting for browser approval… (${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, '0')} remaining)`;
+            };
+            spinner = globalState_1.default.startSpinner({
+                text: waitingText(),
+                stream: process.stderr,
+                isEnabled: true,
+            });
+            countdown = setInterval(() => {
+                if (spinner !== null)
+                    spinner.text = waitingText();
+            }, 1000);
+        }
+        if (!globalState_1.default.isNonInteractive())
+            await dependencies
+                .launchBrowser(authorizationUrl)
+                .catch(() => false);
+        const callback = await listener.result;
+        stopWaiting();
+        if (approvalDeadline <= Date.now()) {
+            controller.abort();
+            throw new Error('The approval transaction expired.');
+        }
+        phase = 'proof';
+        const exchanged = await (0, initialToken_1.exchangeInitialConnectionToken)({
+            instanceUrl: instance,
+            ...callback,
+            verifier,
+            redirectUri: listener.redirectUri,
+            signal,
+            proxyAuthorization: bootstrap.proxyAuthorization,
+        });
+        secrets.push(exchanged.tokens.accessToken, exchanged.tokens.refreshToken);
+        if (previous?.grantUuid === exchanged.grantUuid)
+            throw new initialToken_1.ConnectionProofError(existingConnection);
+        const fetch = (0, apiUrl_1.createAgentConnectionFetch)(instance);
+        const headers = {
+            Authorization: `Bearer ${exchanged.tokens.accessToken}`,
+            ...(bootstrap.proxyAuthorization === null
+                ? {}
+                : { 'Proxy-Authorization': bootstrap.proxyAuthorization }),
+        };
+        const statusResponse = await fetch(`/api/v2/user/agent-connections/${exchanged.grantUuid}/status`, { headers, signal, redirect: 'error' });
+        if (!statusResponse.ok)
+            throw new initialToken_1.ConnectionProofError();
+        const statusValue = await statusResponse.json();
+        const statusEnvelope = (0, statusResponse_1.responseRecord)(statusValue);
+        const status = (0, statusResponse_1.responseRecord)(statusEnvelope.results);
+        const grantDeadline = typeof status.expiresAt === 'string'
+            ? Date.parse(status.expiresAt)
+            : NaN;
+        if (!Number.isFinite(grantDeadline))
+            throw new initialToken_1.ConnectionProofError();
+        const clipDeadline = (value) => new Date(Math.min(Date.parse(value), grantDeadline)).toISOString();
+        const slot = (0, schema_1.validateSlot)({
+            ...key,
+            ...exchanged,
+            tokens: {
+                ...exchanged.tokens,
+                accessTokenExpiresAt: clipDeadline(exchanged.tokens.accessTokenExpiresAt),
+                refreshTokenExpiresAt: exchanged.tokens.refreshTokenExpiresAt === null
+                    ? null
+                    : clipDeadline(exchanged.tokens.refreshTokenExpiresAt),
+            },
+            clientId: 'lightdash-cli',
+            resource: instance,
+            approvedAt: status.approvedAt,
+            grantExpiresAt: status.expiresAt,
+            lastReported: {
+                checkedAt: new Date().toISOString(),
+                limitsStatus: status.limitsStatus,
+                approvedProjects: status.approvedProjects,
+                effectiveProjects: status.effectiveProjects,
+                status: status.status,
+                lastUsedAt: status.lastUsedAt,
+                revokedAt: status.revokedAt,
+            },
+            refreshState: { kind: 'idle' },
+            revokeState: { kind: 'none' },
+        }, key);
+        const verified = (0, statusResponse_1.connectionResponse)(statusValue, slot, true, secrets);
+        if (verified.lastReported.status !== 'active' ||
+            verified.lastReported.limitsStatus !== 'ok' ||
+            verified.lastReported.revokedAt !== null ||
+            Date.parse(verified.grantExpiresAt) <= Date.now() ||
+            Date.parse(verified.grantExpiresAt) >
+                Date.parse(verified.approvedAt) +
+                    input.expiresInSeconds * 1000 ||
+            Date.parse(verified.approvedAt) > Date.now() ||
+            verified.lastReported.approvedProjects.some((project) => project.approvedCapabilities.some((capability) => !input.capabilities.includes(capability))))
+            throw new initialToken_1.ConnectionProofError();
+        if (input.projects !== null) {
+            const requestedProjects = input.projects;
+            const projectMatches = await Promise.all(verified.lastReported.approvedProjects.map(async (project) => {
+                if (requestedProjects.includes(project.projectUuid))
+                    return project.projectUuid;
+                const details = await proofResults(await fetch(`/api/v1/projects/${project.projectUuid}`, {
+                    headers,
+                    signal,
+                    redirect: 'error',
+                }));
+                if (details.projectUuid !== project.projectUuid ||
+                    typeof details.slug !== 'string' ||
+                    !requestedProjects.includes(details.slug))
+                    throw new initialToken_1.ConnectionProofError();
+                return details.slug;
+            }));
+            if (new Set(projectMatches).size !== projectMatches.length)
+                throw new initialToken_1.ConnectionProofError();
+        }
+        const subject = personIdentity(await proofResults(await fetch('/api/v1/user', {
+            headers,
+            signal,
+            redirect: 'error',
+        })));
+        if (subject.personUuid !== person.personUuid ||
+            subject.organizationUuid !== person.organizationUuid ||
+            signal.aborted)
+            throw new initialToken_1.ConnectionProofError();
+        phase = 'save';
+        const outcome = await store.saveSlot(verified, (current) => {
+            if (signal.aborted || deadline <= Date.now())
+                throw new initialToken_1.ConnectionProofError('Agent connection approval timed out or was cancelled. No credential was saved.');
+            if (Date.parse(verified.grantExpiresAt) <= Date.now())
+                throw new initialToken_1.ConnectionProofError('The agent connection expired. No credential was saved.');
+            if (Date.parse(verified.tokens.accessTokenExpiresAt) <=
+                Date.now() ||
+                (verified.tokens.refreshTokenExpiresAt !== null &&
+                    Date.parse(verified.tokens.refreshTokenExpiresAt) <=
+                        Date.now()))
+                throw new initialToken_1.ConnectionProofError('The agent connection token expired before it could be saved. No credential was saved.');
+            if (approvalDeadline <= Date.now())
+                throw new initialToken_1.ConnectionProofError('The approval transaction expired. No credential was saved.');
+            if (current?.grantUuid === verified.grantUuid)
+                throw new initialToken_1.ConnectionProofError(existingConnection);
+        });
+        saved = true;
+        console.error(`Agent connection saved: ${safeText(verified.name)}`);
+        if (outcome.cleanupIncomplete)
+            console.error(`The credential was saved, but local clean-up did not finish. Run lightdash agent status --name ${safeText(verified.name)} to check it.`);
+        console.error(`Projects: ${verified.lastReported.approvedProjects.map((project) => safeText(project.name ?? 'Name unavailable')).join(', ') || 'None'}`);
+        const actions = [
+            ...new Set(verified.lastReported.approvedProjects.flatMap((project) => project.approvedCapabilities)),
+        ];
+        console.error(`Approved actions: ${actions.map((capability) => common_1.AGENT_CAPABILITY_DEFINITIONS[capability].name).join(', ') || 'None'}`);
+        console.error(`Expires: ${safeText(verified.grantExpiresAt)}`);
+        const warehouse = await (0, warehouseStatus_1.readWarehouseStatus)(verified, async ({ url, method, signal: warehouseSignal }) => fetch(url, {
+            method,
+            headers,
+            signal: AbortSignal.any([
+                signal,
+                warehouseSignal ?? signal,
+            ]),
+            redirect: 'error',
+        })).catch(() => null);
+        console.error(warehouse !== null && warehouse.state !== 'unknown'
+            ? `Warehouse sign-ins: ${warehouse.state}`
+            : 'Warehouse sign-ins: unknown; review them in the app.');
+        if (warehouse?.projects.some((project) => project.source === 'server'))
+            console.error('Default warehouse connection checked; review additional connections in the app.');
+        console.error(`Use: lightdash --agent-connection ${safeText(verified.name)} <command>`);
+        console.error(`Settings: ${safeText((0, lifecycle_1.settingsUrl)(instance))}`);
+        process.exitCode = 0;
+    }
+    catch (error) {
+        stopWaiting();
+        if (saved) {
+            process.exitCode = 0;
+            return;
+        }
+        let message = couldNotStart;
+        if (error instanceof ApprovalStartError ||
+            error instanceof personalRecovery_1.PersonalRecoveryError ||
+            error instanceof initialToken_1.ConnectionProofError)
+            message = error.message;
+        else if (phase === 'proof')
+            message = initialToken_1.unboundConnection;
+        else if (phase === 'callback')
+            message = controller.signal.aborted
+                ? 'Agent connection approval timed out or was cancelled. No credential was saved.'
+                : 'Agent connection approval was denied. No credential was saved.';
+        else if (phase === 'save')
+            message =
+                'Could not save the agent connection credential. Your personal CLI login is unchanged.';
+        console.error(safeText(message));
+        console.error(unchanged);
+        if (instance !== null)
+            console.error(`Manage warehouse agent sign-ins in the app:\n${safeText((0, lifecycle_1.settingsUrl)(instance))}`);
+        process.exitCode = 1;
+    }
+    finally {
+        stopWaiting();
+        controller.abort();
+        clearTimeout(timer);
+        process.removeListener('SIGINT', cancel);
+        process.removeListener('SIGTERM', cancel);
+        await listener?.close();
+    }
+};
+exports.agentConnectionConnectHandler = agentConnectionConnectHandler;

package/dist/handlers/agentConnectionStatus.d.ts

@@ -0,0 +1,7 @@
+import { type AgentOptions } from './agentAccess';
+export type ConnectionStatusOptions = AgentOptions & {
+    name?: string;
+    json?: boolean;
+};
+export declare const agentConnectionStatusHandler: (options: ConnectionStatusOptions) => Promise<void>;
+//# sourceMappingURL=agentConnectionStatus.d.ts.map

package/dist/handlers/agentConnectionStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentConnectionStatus.d.ts","sourceRoot":"","sources":["../../src/handlers/agentConnectionStatus.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAyCF,eAAO,MAAM,4BAA4B,YAC5B,uBAAuB,KACjC,OAAO,CAAC,IAAI,CA6Od,CAAC"}

package/dist/handlers/agentConnectionStatus.js

@@ -0,0 +1,228 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentConnectionStatusHandler = void 0;
+const common_1 = require("@lightdash/common");
+const lifecycle_1 = require("../agentConnections/lifecycle");
+const statusResponse_1 = require("../agentConnections/statusResponse");
+const store_1 = require("../agentConnections/store");
+const warehouseStatus_1 = require("../agentConnections/warehouseStatus");
+const config_1 = require("../config");
+const credentials_1 = require("../credentials");
+const apiClient_1 = require("./dbt/apiClient");
+const localState = (slot) => {
+    if (slot.lastReported.status === 'revoked' ||
+        slot.lastReported.revokedAt !== null)
+        return 'revoked';
+    if (Date.parse(slot.grantExpiresAt) <= Date.now() ||
+        slot.lastReported.status === 'expired')
+        return 'expired';
+    if (slot.lastReported.limitsStatus === 'invalid')
+        return 'invalid';
+    if (slot.refreshState.kind !== 'idle' || slot.revokeState.kind !== 'none')
+        return 'reconnect_required';
+    return null;
+};
+const messages = {
+    missing: 'No agent connection credential. Run lightdash agent connect.',
+    expired: 'This connection expired.',
+    revoked: 'This connection was revoked.',
+    invalid: 'Connection limits are invalid. Reconnect before using this slot.',
+    mismatched: 'This agent connection does not match this instance, organisation and person. No personal credential was used.',
+    reconnect_required: 'The connection refresh or revocation was not confirmed. Reconnect before using this slot.',
+    unreachable: 'Could not reach the server. Connection status is unconfirmed.',
+    rejected: 'The server rejected this connection credential. Reconnect or check its status in the app.',
+};
+const agentConnectionStatusHandler = async (options) => {
+    const selection = (0, lifecycle_1.selectLifecycleSlot)(options.name);
+    return (0, credentials_1.runWithAgentConnectionSelection)(selection, async () => {
+        const config = await (0, config_1.getConfig)({ readOnly: true });
+        const key = (0, lifecycle_1.connectionKey)(config, selection);
+        const store = new store_1.AgentConnectionStore();
+        let slot = null;
+        let state = key === null ? 'mismatched' : 'missing';
+        let source = 'local';
+        let warehouse = { state: 'unknown', projects: [] };
+        let error = null;
+        try {
+            slot = key === null ? null : await store.readSlot(key);
+            if (slot !== null) {
+                const local = localState(slot);
+                state = local ?? 'active';
+                if (local === null) {
+                    const response = await (0, apiClient_1.lightdashRawApi)({
+                        method: 'GET',
+                        url: `/api/v2/user/agent-connections/${slot.grantUuid}/status`,
+                        body: undefined,
+                        safeToRetry: true,
+                        signal: AbortSignal.timeout(15_000),
+                        lifecycle: {
+                            kind: 'status',
+                            grantUuid: slot.grantUuid,
+                            generation: slot.tokens.generation,
+                        },
+                    });
+                    const value = await response.json();
+                    const requestedSlot = slot;
+                    const latest = await store.readSlot(slot);
+                    if (!latest || latest.grantUuid !== slot.grantUuid)
+                        throw new Error('The local connection changed.');
+                    const checked = (0, statusResponse_1.connectionResponse)(value, latest, true);
+                    await store.withLock(async (locked) => {
+                        const current = await locked.readSlot(checked);
+                        if (!(0, lifecycle_1.sameGeneration)(current, checked) ||
+                            current.revokeState.kind !==
+                                requestedSlot.revokeState.kind)
+                            throw new Error('The local connection changed.');
+                        await locked.saveSlot({
+                            ...current,
+                            lastReported: checked.lastReported,
+                        });
+                    });
+                    slot = checked;
+                    source = 'server';
+                    state =
+                        checked.lastReported.limitsStatus === 'invalid'
+                            ? 'invalid'
+                            : checked.lastReported.status;
+                    if (state === 'active')
+                        warehouse = await (0, warehouseStatus_1.readWarehouseStatus)(checked);
+                }
+            }
+        }
+        catch (failure) {
+            state = 'invalid';
+            if (failure instanceof lifecycle_1.AgentConnectionRequestError)
+                state = failure.state;
+            else if (failure instanceof statusResponse_1.ConnectionMismatchError)
+                state = 'mismatched';
+            if (state === 'invalid')
+                error =
+                    slot === null
+                        ? 'Invalid agent connection data. Reconnect before using this slot.'
+                        : 'The server returned invalid connection data. Connection status is unconfirmed.';
+            if (slot !== null) {
+                const latest = await store.readSlot(slot).catch(() => null);
+                if (latest &&
+                    (0, lifecycle_1.sameGeneration)(latest, slot) &&
+                    localState(latest) === 'reconnect_required') {
+                    slot = latest;
+                    state = 'reconnect_required';
+                    error = messages.reconnect_required;
+                }
+            }
+        }
+        if (state !== 'active')
+            error ??= messages[state];
+        const reported = slot === null ? null : (0, statusResponse_1.publicConnectionReport)(slot);
+        let revokeState = null;
+        if (slot !== null)
+            revokeState =
+                slot.revokeState.kind === 'none'
+                    ? { kind: 'none' }
+                    : {
+                        kind: 'unconfirmed',
+                        attemptedAt: slot.revokeState.attemptedAt,
+                    };
+        const result = {
+            version: 1,
+            slot: selection,
+            instanceUrl: slot?.instanceUrl ??
+                key?.instanceUrl ??
+                config.context?.serverUrl ??
+                null,
+            personUuid: slot?.personUuid ?? key?.personUuid ?? null,
+            organizationUuid: slot?.organizationUuid ?? key?.organizationUuid ?? null,
+            grantUuid: slot?.grantUuid ?? null,
+            clientId: slot?.clientId ?? null,
+            connectionState: state,
+            connectionValid: source === 'server' ? state === 'active' : null,
+            serverState: source === 'server'
+                ? (slot?.lastReported.status ?? null)
+                : null,
+            source,
+            checkedAt: source === 'server'
+                ? (slot?.lastReported.checkedAt ?? null)
+                : null,
+            lastReportedAt: slot?.lastReported.checkedAt ?? null,
+            approvedAt: slot?.approvedAt ?? null,
+            grantExpiresAt: slot?.grantExpiresAt ?? null,
+            lastUsedAt: slot?.lastReported.lastUsedAt ?? null,
+            limitsStatus: slot?.lastReported.limitsStatus ?? null,
+            approvedProjects: reported?.approvedProjects ?? [],
+            effectiveProjects: reported?.effectiveProjects ?? [],
+            warehouse,
+            revokeState,
+            settingsUrl: config.context?.serverUrl
+                ? (0, lifecycle_1.settingsUrl)(slot?.instanceUrl ?? config.context.serverUrl)
+                : null,
+            error,
+        };
+        if (options.json)
+            console.log(JSON.stringify(result));
+        else {
+            if (error)
+                console.error(error);
+            if (state === 'missing' && config.context?.apiKey) {
+                const credentialLabel = (0, credentials_1.humanCredential)(config.context.apiKey).kind ===
+                    'service_account'
+                    ? 'Service account credential'
+                    : 'Personal CLI login';
+                console.error(`${credentialLabel}: available (not used). Warehouse status: unknown (not checked).`);
+            }
+            let label = state.charAt(0).toUpperCase() + state.slice(1);
+            if (state === 'expired' && source === 'local')
+                label = 'Expired (local)';
+            else if (state === 'revoked' && source === 'local')
+                label = 'Revoked (last reported)';
+            console.error(`Connection: ${selection} | ${label} | CLI`);
+            console.error(`Instance: ${result.instanceUrl ?? 'unknown'}`);
+            console.error(`Person: ${result.personUuid ?? 'unknown'} | Organisation: ${result.organizationUuid ?? 'unknown'}`);
+            if (source === 'local' && slot) {
+                console.error(`Last reported ${slot.lastReported.status} at ${slot.lastReported.checkedAt}`);
+                console.error('Approved projects and actions below are cached.');
+            }
+            console.error(`Approved: ${result.approvedAt ?? 'unknown'}`);
+            for (const project of result.approvedProjects) {
+                console.error(`Project: ${project.name ?? `${project.projectUuid} (Name unavailable)`}`);
+                console.error(`Approved actions: ${project.approvedCapabilities.map(common_1.getAgentCapabilityName).join(', ') || 'none'}`);
+                for (const capability of result.effectiveProjects.find((p) => p.projectUuid === project.projectUuid)?.capabilities ?? [])
+                    console.error(`${(0, common_1.getAgentCapabilityName)(capability.capability)}: ${(0, statusResponse_1.statusReasonMessage)(capability.reason) ?? 'Allowed'}`);
+            }
+            console.error('Allowed actions can still have resource, destination or recurring-refresh restrictions.');
+            console.error(`Expires: ${result.grantExpiresAt ?? 'unknown'}`);
+            console.error(`Last used: ${result.lastUsedAt ?? 'not reported'}`);
+            if (warehouse.projects.length > 0 &&
+                warehouse.projects.every((project) => project.reason ===
+                    'This connection cannot read warehouse readiness.'))
+                console.error('Warehouse sign-ins: unknown (this connection cannot read warehouse readiness).');
+            else
+                console.error(`Warehouse sign-ins: ${warehouse.state}`);
+            for (const project of warehouse.projects) {
+                console.error(`Warehouse sign-ins: ${project.projectUuid} ${project.state}${project.reason ? ` (${project.reason})` : ''}`);
+                if (project.settingsUrl && project.state !== 'ready')
+                    console.error(project.settingsUrl);
+            }
+            if (warehouse.projects.some((project) => project.source === 'server'))
+                console.error('Default warehouse connection checked; review additional connections in the app.');
+            else
+                console.error('Default warehouse connection readiness could not be checked; review connections in the app.');
+            if (result.settingsUrl)
+                console.error(`Settings: ${result.settingsUrl}`);
+        }
+        const dataCapabilities = [
+            common_1.AgentCapability.ReadDiscover,
+            common_1.AgentCapability.Query,
+            common_1.AgentCapability.RawSql,
+            common_1.AgentCapability.Export,
+        ];
+        const approvedData = result.approvedProjects.some((p) => p.approvedCapabilities.some((c) => dataCapabilities.includes(c)));
+        const effectiveData = result.effectiveProjects.some((p) => p.capabilities.some((c) => c.allowed && dataCapabilities.includes(c.capability)));
+        process.exitCode =
+            state === 'active' &&
+                warehouse.state === 'ready' &&
+                (!approvedData || effectiveData)
+                ? 0
+                : 1;
+    });
+};
+exports.agentConnectionStatusHandler = agentConnectionStatusHandler;

package/dist/handlers/agentRevoke.d.ts

@@ -0,0 +1,7 @@
+export type AgentRevokeOptions = {
+    name: string;
+    json?: boolean;
+    human?: boolean;
+};
+export declare const agentRevokeHandler: (options: AgentRevokeOptions) => Promise<void>;
+//# sourceMappingURL=agentRevoke.d.ts.map

package/dist/handlers/agentRevoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentRevoke.d.ts","sourceRoot":"","sources":["../../src/handlers/agentRevoke.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AACF,eAAO,MAAM,kBAAkB,YAClB,kBAAkB,KAC5B,OAAO,CAAC,IAAI,CAqJd,CAAC"}