@lightdash/cli 2.562.0 → 2.564.0

package/dist/agentConnectionConnectOption.d.ts

@@ -0,0 +1,8 @@
+import { type Command } from 'commander';
+export declare const registerAgentConnectionConnect: (command: Command, legacyHandler: (options: {
+    verbose: boolean;
+    project?: string;
+    oauthPort?: number;
+    timeout?: number;
+}, command: Command) => Promise<void>) => void;
+//# sourceMappingURL=agentConnectionConnectOption.d.ts.map

package/dist/agentConnectionConnectOption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentConnectionConnectOption.d.ts","sourceRoot":"","sources":["../src/agentConnectionConnectOption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAEjD,eAAO,MAAM,8BAA8B,YAC9B,OAAO,iBACD,CACX,OAAO,EAAE;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,EACD,OAAO,EAAE,OAAO,KACf,OAAO,CAAC,IAAI,CAAC,KACnB,IA8EF,CAAC"}

package/dist/agentConnectionConnectOption.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAgentConnectionConnect = void 0;
+const tslib_1 = require("tslib");
+const commander_1 = require("commander");
+const registerAgentConnectionConnect = (command, legacyHandler) => {
+    command
+        .addOption(new commander_1.Option('--name <slot>', 'Name the agent connection slot').hideHelp())
+        .addOption(new commander_1.Option('--capabilities <keys>', 'Request these agent actions').hideHelp())
+        .addOption(new commander_1.Option('--expires-in <duration>', 'Request this connection lifetime').hideHelp())
+        .addOption(new commander_1.Option('--connection', 'Request an agent connection credential').hideHelp());
+    command.on('option:project', (value) => {
+        const previous = command.getOptionValue('connectionProjects');
+        const projects = Array.isArray(previous)
+            ? previous.filter((item) => typeof item === 'string')
+            : [];
+        command.setOptionValue('connectionProjects', [...projects, value]);
+    });
+    command.on('option:oauth-port', (value) => command.setOptionValue('connectionOauthPort', value));
+    command.action(function dispatch(...args) {
+        const [options] = args;
+        if (options.name !== undefined ||
+            options.capabilities !== undefined ||
+            options.expiresIn !== undefined ||
+            options.connection) {
+            return Promise.resolve().then(() => tslib_1.__importStar(require('./handlers/agentConnectionConnect'))).then(({ agentConnectionConnectHandler }) => agentConnectionConnectHandler({
+                verbose: options.verbose,
+                name: options.name,
+                capabilities: options.capabilities,
+                expiresIn: options.expiresIn,
+                projects: options.connectionProjects,
+                oauthPort: options.connectionOauthPort,
+                timeout: options.timeout,
+            }));
+        }
+        return legacyHandler.apply(this, args);
+    });
+};
+exports.registerAgentConnectionConnect = registerAgentConnectionConnect;

package/dist/agentConnectionOption.d.ts

@@ -0,0 +1,3 @@
+import { type Command } from 'commander';
+export declare const registerAgentConnectionOption: (program: Command, resetInvocation?: () => void) => void;
+//# sourceMappingURL=agentConnectionOption.d.ts.map

package/dist/agentConnectionOption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentConnectionOption.d.ts","sourceRoot":"","sources":["../src/agentConnectionOption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAUjD,eAAO,MAAM,6BAA6B,YAC7B,OAAO,oBACC,MAAM,IAAI,KAC5B,IAuDF,CAAC"}

package/dist/agentConnectionOption.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAgentConnectionOption = void 0;
+const commander_1 = require("commander");
+const commandPolicy_1 = require("./agentConnections/commandPolicy");
+const credentials_1 = require("./credentials");
+const registerAgentConnectionOption = (program, resetInvocation = () => { }) => {
+    program.addOption(new commander_1.Option('--agent-connection <slot>', 'Use an agent connection slot').hideHelp());
+    const { parseAsync } = program;
+    const parseWithContext = function parseWithSelection(...args) {
+        this.setOptionValueWithSource('agentConnection', undefined, 'default');
+        const agent = this.commands.find((command) => command.name() === 'agent');
+        for (const command of agent?.commands ?? []) {
+            let options = [];
+            if (command.name() === 'connect')
+                options = [
+                    'name',
+                    'capabilities',
+                    'expiresIn',
+                    'connection',
+                    'connectionProjects',
+                    'connectionOauthPort',
+                ];
+            else if (command.name() === 'status')
+                options = ['name', 'json'];
+            else if (command.name() === 'revoke')
+                options = ['name', 'json', 'human'];
+            for (const option of options)
+                command.setOptionValueWithSource(option, undefined, 'default');
+        }
+        resetInvocation();
+        const environmentSelection = process.env.LIGHTDASH_AGENT_CONNECTION ?? null;
+        return (0, credentials_1.runWithParsedAgentConnectionSelection)(() => {
+            const selection = this.opts().agentConnection;
+            if (selection !== undefined && typeof selection !== 'string')
+                throw new Error('Invalid agent connection selection.');
+            return selection ?? environmentSelection;
+        }, environmentSelection !== null ||
+            (args[0] ?? process.argv).some((argument) => argument.startsWith('--agent-connection')), () => parseAsync.apply(this, args));
+    };
+    Object.assign(program, { parseAsync: parseWithContext });
+    program.hook('preAction', (_root, command) => {
+        if ((0, credentials_1.getAgentConnectionSelection)() === null)
+            return;
+        (0, commandPolicy_1.assertAgentCommandAllowed)((0, commandPolicy_1.agentCommandPath)(command), command.opts());
+    });
+};
+exports.registerAgentConnectionOption = registerAgentConnectionOption;

package/dist/agentConnections/agentTokenProvider.d.ts

@@ -0,0 +1,13 @@
+import { type AgentConnectionSlot, type SlotKey } from './schema';
+import { AgentConnectionStore } from './store';
+export declare const assertUsableSlot: (slot: AgentConnectionSlot, now: number) => void;
+export declare class AgentTokenProvider {
+    private readonly store;
+    private readonly verified;
+    constructor(store?: AgentConnectionStore);
+    private verify;
+    private reconnect;
+    getToken(key: SlotKey, rejectedGeneration?: number | null, proxyAuthorization?: string | null): Promise<AgentConnectionSlot>;
+    getLifecycleToken(key: SlotKey, operation: import('./lifecycle').LifecycleOperation, rejectedGeneration: number | null, proxyAuthorization: string | null): Promise<AgentConnectionSlot>;
+}
+//# sourceMappingURL=agentTokenProvider.d.ts.map

package/dist/agentConnections/agentTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentTokenProvider.d.ts","sourceRoot":"","sources":["../../src/agentConnections/agentTokenProvider.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,mBAAmB,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAoB,MAAM,SAAS,CAAC;AAwDjE,eAAO,MAAM,gBAAgB,SACnB,mBAAmB,OACpB,MAAM,KACZ,IAsCF,CAAC;AAEF,qBAAa,kBAAkB;IAIvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAH1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YACqB,KAAK,GAAE,oBAAiD,EACzE;YAEU,MAAM;YA+DN,SAAS;IAkBjB,QAAQ,CACV,GAAG,EAAE,OAAO,EACZ,kBAAkB,GAAE,MAAM,GAAG,IAAW,EACxC,kBAAkB,GAAE,MAAM,GAAG,IAAW,GACzC,OAAO,CAAC,mBAAmB,CAAC,CAgK9B;IACK,iBAAiB,CACnB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,OAAO,aAAa,EAAE,kBAAkB,EACnD,kBAAkB,EAAE,MAAM,GAAG,IAAI,EACjC,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,mBAAmB,CAAC,CA0B9B;CACJ"}

package/dist/agentConnections/agentTokenProvider.js

@@ -0,0 +1,294 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentTokenProvider = exports.assertUsableSlot = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const ajv_1 = tslib_1.__importDefault(require("ajv"));
+const crypto_1 = require("crypto");
+const apiUrl_1 = require("./apiUrl");
+const schema_1 = require("./schema");
+const store_1 = require("./store");
+const createResponseValidator = () => new ajv_1.default().compile({
+    type: 'object',
+    required: [
+        'access_token',
+        'refresh_token',
+        'token_type',
+        'expires_in',
+        'scope',
+    ],
+    properties: {
+        access_token: { type: 'string', minLength: 1 },
+        refresh_token: { type: 'string', minLength: 1 },
+        token_type: {
+            type: 'string',
+            pattern: '^[Bb][Ee][Aa][Rr][Ee][Rr]$',
+        },
+        expires_in: { type: 'integer', minimum: 1, maximum: 2_147_483_647 },
+        scope: { type: 'string', minLength: 1 },
+    },
+});
+let responseValidator = null;
+const validateResponse = (value) => {
+    responseValidator ??= createResponseValidator();
+    return responseValidator(value);
+};
+const record = (value) => {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error('The server returned invalid connection data.');
+    return Object.fromEntries(Object.entries(value));
+};
+const results = async (response) => {
+    if (!response.ok)
+        throw new Error('The server rejected this connection credential.');
+    const value = await response.json();
+    const payload = record(value);
+    if (payload.status !== 'ok')
+        throw new Error('The server returned invalid connection data.');
+    return record(payload.results);
+};
+const reconnectError = () => new Error('Reconnect before using this agent connection. Its refresh outcome is uncertain.');
+const assertUsableSlot = (slot, now) => {
+    if (Date.parse(slot.grantExpiresAt) <= now ||
+        slot.lastReported.status === 'expired')
+        throw new Error('This agent connection expired. Reconnect before using this slot.');
+    if (slot.lastReported.status === 'revoked' ||
+        slot.lastReported.revokedAt !== null)
+        throw new Error('This agent connection was revoked. Reconnect before using this slot.');
+    if (slot.lastReported.limitsStatus !== 'ok')
+        throw new Error('This agent connection has invalid limits. Reconnect before using this slot.');
+    switch (slot.revokeState.kind) {
+        case 'none':
+            break;
+        case 'unconfirmed':
+            throw new Error('Revocation of this agent connection is unconfirmed. Reconnect before using this slot.');
+        default:
+            (0, common_1.assertUnreachable)(slot.revokeState, 'Unknown revoke state');
+    }
+    switch (slot.refreshState.kind) {
+        case 'idle':
+            break;
+        case 'in_progress':
+        case 'reconnect_required':
+            throw reconnectError();
+        default:
+            (0, common_1.assertUnreachable)(slot.refreshState, 'Unknown refresh state');
+    }
+};
+exports.assertUsableSlot = assertUsableSlot;
+class AgentTokenProvider {
+    store;
+    verified = new Set();
+    constructor(store = new store_1.AgentConnectionStore()) {
+        this.store = store;
+    }
+    async verify(slot, proxyAuthorization) {
+        const fetch = (0, apiUrl_1.createAgentConnectionFetch)(slot.instanceUrl);
+        const headers = {
+            Authorization: `Bearer ${slot.tokens.accessToken}`,
+            ...(proxyAuthorization === null
+                ? {}
+                : { 'Proxy-Authorization': proxyAuthorization }),
+        };
+        const user = await results(await fetch(`${slot.instanceUrl}/api/v1/user`, {
+            headers,
+            redirect: 'error',
+            signal: AbortSignal.timeout(15_000),
+        }));
+        if (user.userUuid !== slot.personUuid ||
+            user.organizationUuid !== slot.organizationUuid)
+            throw new Error('Agent connection identity does not match the configured person and organisation.');
+        const status = await results(await fetch(`${slot.instanceUrl}/api/v2/user/agent-connections/${slot.grantUuid}/status`, {
+            headers,
+            redirect: 'error',
+            signal: AbortSignal.timeout(15_000),
+        }));
+        if (status.grantUuid !== slot.grantUuid ||
+            status.clientId !== slot.clientId ||
+            status.approvedAt !== slot.approvedAt ||
+            status.expiresAt !== slot.grantExpiresAt)
+            throw new Error('Agent connection grant does not match the saved approval.');
+        const checked = (0, schema_1.validateSlot)({
+            ...slot,
+            lastReported: {
+                checkedAt: new Date().toISOString(),
+                limitsStatus: status.limitsStatus,
+                approvedProjects: status.approvedProjects,
+                effectiveProjects: status.effectiveProjects,
+                status: status.status,
+                lastUsedAt: status.lastUsedAt,
+                revokedAt: status.revokedAt,
+            },
+        }, slot);
+        (0, exports.assertUsableSlot)(checked, Date.now());
+        return checked;
+    }
+    async reconnect(locked, slot) {
+        try {
+            await locked.saveSlot({
+                ...slot,
+                refreshState: {
+                    kind: 'reconnect_required',
+                    since: new Date().toISOString(),
+                },
+            });
+        }
+        catch {
+            throw reconnectError();
+        }
+        throw reconnectError();
+    }
+    async getToken(key, rejectedGeneration = null, proxyAuthorization = null) {
+        return this.store.withLock(async (locked) => {
+            let slot = await locked.readSlot(key);
+            if (slot === null)
+                throw new Error('Agent connection not found for this instance, person and organisation. Reconnect before using this slot.');
+            let journal;
+            try {
+                await locked.discardStaleJournal(slot);
+                journal = await locked.readJournal(key);
+            }
+            catch {
+                return this.reconnect(locked, slot);
+            }
+            if (journal !== null) {
+                if (journal.grantUuid === slot.grantUuid &&
+                    slot.tokens.generation === journal.generation + 1 &&
+                    slot.tokens.lastRefreshAttemptUuid ===
+                        journal.attemptUuid &&
+                    slot.refreshState.kind === 'idle')
+                    await locked.clearJournal(key);
+                else
+                    return this.reconnect(locked, slot);
+            }
+            if (slot.refreshState.kind === 'in_progress')
+                return this.reconnect(locked, slot);
+            (0, exports.assertUsableSlot)(slot, Date.now());
+            const remaining = Date.parse(slot.tokens.accessTokenExpiresAt) - Date.now();
+            const lifetime = Date.parse(slot.tokens.accessTokenExpiresAt) -
+                Date.parse(slot.lastReported.checkedAt);
+            const earlyWindow = Math.min(60_000, Math.max(0, lifetime / 10));
+            const mustRefresh = remaining <= earlyWindow ||
+                rejectedGeneration === slot.tokens.generation;
+            if (mustRefresh) {
+                if (slot.tokens.refreshTokenExpiresAt !== null &&
+                    Date.parse(slot.tokens.refreshTokenExpiresAt) <= Date.now())
+                    throw new Error('This agent connection refresh token expired. Reconnect before using this slot.');
+                const attemptUuid = (0, crypto_1.randomUUID)();
+                const startedAt = Date.now();
+                const pending = {
+                    ...slot,
+                    refreshState: {
+                        kind: 'in_progress',
+                        attemptUuid,
+                        startedAt: new Date(startedAt).toISOString(),
+                    },
+                };
+                try {
+                    await locked.saveSlot(pending);
+                    await locked.writeJournal(key, {
+                        grantUuid: slot.grantUuid,
+                        attemptUuid,
+                        generation: slot.tokens.generation,
+                    });
+                    const body = new URLSearchParams({
+                        grant_type: 'refresh_token',
+                        client_id: 'lightdash-cli',
+                        refresh_token: slot.tokens.refreshToken,
+                        resource: slot.resource,
+                        scope: slot.tokens.scopes.join(' '),
+                    });
+                    const fetch = (0, apiUrl_1.createAgentConnectionFetch)(slot.instanceUrl);
+                    const response = await fetch(`${slot.instanceUrl}/api/v1/oauth/token`, {
+                        method: 'POST',
+                        body,
+                        redirect: 'error',
+                        signal: AbortSignal.timeout(15_000),
+                        headers: proxyAuthorization === null
+                            ? {}
+                            : {
+                                'Proxy-Authorization': proxyAuthorization,
+                            },
+                    });
+                    if (!response.ok)
+                        throw reconnectError();
+                    const value = await response.json();
+                    if (!validateResponse(value) ||
+                        value.refresh_token === slot.tokens.refreshToken)
+                        throw reconnectError();
+                    const scopes = value.scope.split(' ');
+                    const savedScopes = slot.tokens.scopes;
+                    if (scopes.length !== slot.tokens.scopes.length ||
+                        new Set(scopes).size !== scopes.length ||
+                        scopes.some((scope) => !savedScopes.includes(scope)))
+                        throw reconnectError();
+                    const dateHeader = response.headers.get('date');
+                    const serverTime = dateHeader === null
+                        ? startedAt
+                        : Date.parse(dateHeader);
+                    if (!Number.isFinite(serverTime) ||
+                        Math.max(Date.now(), serverTime) >=
+                            Date.parse(slot.grantExpiresAt))
+                        throw reconnectError();
+                    const expiresAt = Math.min(startedAt + value.expires_in * 1000, serverTime + value.expires_in * 1000, Date.parse(slot.grantExpiresAt));
+                    if (expiresAt <= Date.now())
+                        throw reconnectError();
+                    slot = await this.verify({
+                        ...slot,
+                        tokens: {
+                            ...slot.tokens,
+                            accessToken: value.access_token,
+                            refreshToken: value.refresh_token,
+                            accessTokenExpiresAt: new Date(expiresAt).toISOString(),
+                            generation: slot.tokens.generation + 1,
+                            lastRefreshAttemptUuid: attemptUuid,
+                        },
+                        refreshState: { kind: 'idle' },
+                    }, proxyAuthorization);
+                    await locked.saveSlot(slot);
+                }
+                catch {
+                    return this.reconnect(locked, pending);
+                }
+                await locked.clearJournal(key);
+            }
+            const verificationKey = JSON.stringify([
+                slot.instanceUrl,
+                slot.organizationUuid,
+                slot.personUuid,
+                slot.grantUuid,
+                slot.tokens.generation,
+            ]);
+            if (!mustRefresh && !this.verified.has(verificationKey)) {
+                try {
+                    slot = await this.verify(slot, proxyAuthorization);
+                }
+                catch {
+                    throw new Error('The server could not verify this agent connection. Reconnect or check its status in the app.');
+                }
+            }
+            this.verified.add(verificationKey);
+            return slot;
+        });
+    }
+    async getLifecycleToken(key, operation, rejectedGeneration, proxyAuthorization) {
+        const { revocationRecovery } = await Promise.resolve().then(() => tslib_1.__importStar(require('./lifecycle')));
+        const slot = await this.store.readLifecycleSlot(key);
+        if (!slot ||
+            slot.grantUuid !== operation.grantUuid ||
+            slot.tokens.generation !== operation.generation)
+            throw new Error('The local connection changed. Run the command again.');
+        if (operation.kind === 'revoke') {
+            if (Date.parse(slot.tokens.accessTokenExpiresAt) <= Date.now() ||
+                Date.parse(slot.grantExpiresAt) <= Date.now())
+                throw new Error(revocationRecovery);
+            return slot;
+        }
+        (0, exports.assertUsableSlot)(slot, Date.now());
+        if (Date.parse(slot.tokens.accessTokenExpiresAt) > Date.now() &&
+            rejectedGeneration === null)
+            return slot;
+        return this.getToken(key, rejectedGeneration, proxyAuthorization);
+    }
+}
+exports.AgentTokenProvider = AgentTokenProvider;

package/dist/agentConnections/apiUrl.d.ts

@@ -0,0 +1,4 @@
+import fetch, { type RequestInit } from 'node-fetch';
+export declare const agentConnectionApiUrl: (instanceUrl: string, input: string) => string;
+export declare const createAgentConnectionFetch: (instanceUrl: string) => (url: string, init: RequestInit) => Promise<fetch.Response>;
+//# sourceMappingURL=apiUrl.d.ts.map

package/dist/agentConnections/apiUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiUrl.d.ts","sourceRoot":"","sources":["../../src/agentConnections/apiUrl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAGrD,eAAO,MAAM,qBAAqB,gBACjB,MAAM,SACZ,MAAM,KACd,MAkCF,CAAC;AACF,eAAO,MAAM,0BAA0B,gBACrB,MAAM,WAAW,MAAM,QAAQ,WAAW,4BACA,CAAC"}

package/dist/agentConnections/apiUrl.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentConnectionFetch = exports.agentConnectionApiUrl = void 0;
+const tslib_1 = require("tslib");
+const node_fetch_1 = tslib_1.__importDefault(require("node-fetch"));
+const schema_1 = require("./schema");
+const agentConnectionApiUrl = (instanceUrl, input) => {
+    const instance = (0, schema_1.canonicalInstanceUrl)(instanceUrl);
+    const base = new URL(instance);
+    const path = input.split(/[?#]/, 1)[0];
+    const invalid = () => new Error('Agent connection requests must stay within the selected instance API.');
+    if (input !== input.trim() || input.startsWith('//') || path.includes('\\'))
+        throw invalid();
+    let decodedPath = path;
+    while (/%[0-9a-f]{2}/i.test(decodedPath)) {
+        if (/%(?:2f|5c|2e)/i.test(decodedPath))
+            throw invalid();
+        try {
+            decodedPath = decodeURIComponent(decodedPath);
+        }
+        catch {
+            throw invalid();
+        }
+    }
+    const destination = new URL(/^[a-z][a-z0-9+.-]*:/i.test(input)
+        ? input
+        : `${instance}/${input.replace(/^\//, '')}`);
+    if (destination.origin !== base.origin ||
+        destination.username ||
+        destination.password ||
+        !destination.pathname.startsWith(`${base.pathname.replace(/\/$/, '')}/api/`))
+        throw invalid();
+    return destination.href;
+};
+exports.agentConnectionApiUrl = agentConnectionApiUrl;
+const createAgentConnectionFetch = (instanceUrl) => (url, init) => (0, node_fetch_1.default)((0, exports.agentConnectionApiUrl)(instanceUrl, url), init);
+exports.createAgentConnectionFetch = createAgentConnectionFetch;

package/dist/agentConnections/commandPolicy.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from 'commander';
+type CommandPolicy = {
+    disposition: 'admit' | 'local';
+    reason: string;
+} | {
+    disposition: 'refuse';
+    reason: string;
+    message: string;
+};
+export declare const COMMAND_POLICY: Readonly<Record<string, CommandPolicy>>;
+export declare const assertAgentCommandAllowed: (name: string, options?: Readonly<Record<string, unknown>>) => void;
+export declare const agentCommandPath: (command: Command) => string;
+export {};
+//# sourceMappingURL=commandPolicy.d.ts.map

package/dist/agentConnections/commandPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandPolicy.d.ts","sourceRoot":"","sources":["../../src/agentConnections/commandPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,KAAK,aAAa,GACZ;IAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,WAAW,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAcjE,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CA6DlE,CAAC;AAqBF,eAAO,MAAM,yBAAyB,SAC5B,MAAM,YACH,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAC3C,IA6BF,CAAC;AAEF,eAAO,MAAM,gBAAgB,YAAa,OAAO,KAAG,MASnD,CAAC"}

package/dist/agentConnections/commandPolicy.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentCommandPath = exports.assertAgentCommandAllowed = exports.COMMAND_POLICY = void 0;
+const credentials_1 = require("../credentials");
+const local = (reason) => ({
+    disposition: 'local',
+    reason,
+});
+const admit = (reason) => ({
+    disposition: 'admit',
+    reason,
+});
+const refuse = (reason, message = credentials_1.agentCommandUnavailable) => ({ disposition: 'refuse', reason, message });
+exports.COMMAND_POLICY = {
+    'upgrade-check': local('Public release index only'),
+    'connect-snowflake': refuse('Separate warehouse credential deposit'),
+    login: refuse('Personal bootstrap', credentials_1.personalLoginRequired),
+    agent: local('Command group'),
+    'agent connect': refuse('Personal bootstrap', credentials_1.personalLoginRequired),
+    'agent status': admit('Own connection status'),
+    'agent revoke': admit('Own connection revocation'),
+    config: local('Command group'),
+    'config set-project': refuse('Saves a personal default; pass --project on the command'),
+    'config set-source': refuse('Saves a personal default; pass --project on the command'),
+    'config list-projects': refuse('Organisation-wide discovery'),
+    'config get-project': admit('Read-only configuration with credential validation'),
+    'config rename-project': refuse('Project lifecycle'),
+    'config unset-project': refuse('Changes personal defaults'),
+    dbt: local('Command group'),
+    'dbt run': local('Local dbt execution'),
+    compile: local('Local compilation with selected optional server reads'),
+    preview: refuse('Project lifecycle'),
+    'start-preview': refuse('Project lifecycle'),
+    'stop-preview': refuse('Project lifecycle'),
+    download: admit('Project content reads; organisation and shared skills modes refused'),
+    upload: refuse('Complete bundle preflight is not yet supported; refuse before any write'),
+    apps: local('Command group'),
+    'apps create': refuse('Unsupported authoring context'),
+    'apps preview': refuse('Unsupported arbitrary API proxy'),
+    'apps validate': local('Local validation with selected optional catalogue reads'),
+    'apps build': local('Local build'),
+    deploy: admit('Existing approved project without source or target overrides'),
+    refresh: refuse('Required global job polling is unavailable'),
+    validate: refuse('Server validation and global job polling are unavailable'),
+    generate: local('Local model generation'),
+    rename: refuse('Queued rename is unavailable'),
+    'slug-update': refuse('Slug rename is unavailable'),
+    'generate-exposures': admit('Approved project exposures'),
+    diagnostics: refuse('Personal credential diagnostics'),
+    lint: local('Local lint'),
+    'warehouse-catalog': admit('Approved project catalogue'),
+    'pre-aggregate-audit': refuse('Server audit is unavailable'),
+    'pre-aggregate-check-external': local('Local warehouse check'),
+    sql: admit('Approved project SQL query'),
+    'run-chart': admit('Approved project metric query'),
+    'set-warehouse': refuse('Warehouse credential configuration'),
+    'export-chart-image': refuse('Public image export is unavailable'),
+    'install-skills': local('Public GitHub assets only'),
+};
+const refusedModes = {
+    deploy: ['create', 'source', 'target', 'organizationCredentials'],
+    download: ['organization', 'skills', 'includeSkills', 'includeAll'],
+    upload: [
+        'validate',
+        'organization',
+        'skills',
+        'deleteSkills',
+        'apps',
+        'includeApps',
+        'appsOnly',
+        'chartTypes',
+        'includeChartTypes',
+        'chartTypesOnly',
+        'spacesOnly',
+        'public',
+    ],
+};
+const assertAgentCommandAllowed = (name, options = {}) => {
+    if ((0, credentials_1.getAgentConnectionSelection)() === null)
+        return;
+    const mode = refusedModes[name]?.find((option) => {
+        const value = options[option];
+        return Array.isArray(value)
+            ? value.length > 0
+            : value !== undefined && value !== null && value !== false;
+    });
+    if (mode) {
+        const flag = mode.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+        throw new Error(`${credentials_1.agentCommandUnavailable}\n--${flag} is not available with an agent connection.`);
+    }
+    const policy = Object.prototype.hasOwnProperty.call(exports.COMMAND_POLICY, name)
+        ? exports.COMMAND_POLICY[name]
+        : undefined;
+    if (!policy || policy.disposition === 'refuse') {
+        const advice = name === 'config set-project' || name === 'config set-source'
+            ? '\nPass --project on the command instead of saving a personal default.'
+            : '';
+        throw new Error(`${policy?.disposition === 'refuse' ? policy.message : credentials_1.agentCommandUnavailable}${advice}`);
+    }
+};
+exports.assertAgentCommandAllowed = assertAgentCommandAllowed;
+const agentCommandPath = (command) => {
+    const parts = [];
+    for (let current = command; current.parent; current = current.parent)
+        parts.unshift(current.name());
+    return parts.join(' ');
+};
+exports.agentCommandPath = agentCommandPath;

package/dist/agentConnections/configLock.d.ts

@@ -0,0 +1,12 @@
+export declare const isFsError: (error: unknown, code: string) => boolean;
+export declare const privateDirectory: (directory: string) => Promise<void>;
+export declare const readPrivateFile: (file: string) => Promise<string | null>;
+export declare const acquireLock: (file: string, options?: {
+    waitMs: number;
+    pollMs: number;
+}) => Promise<() => Promise<void>>;
+export declare const atomicWrite: (file: string, contents: string, commit?: {
+    beforeCommit?: () => void;
+    onCommitted?: () => void;
+}) => Promise<void>;
+//# sourceMappingURL=configLock.d.ts.map

package/dist/agentConnections/configLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configLock.d.ts","sourceRoot":"","sources":["../../src/agentConnections/configLock.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,SAAS,UAAW,OAAO,QAAQ,MAAM,KAAG,OACW,CAAC;AAErE,eAAO,MAAM,gBAAgB,cAAqB,MAAM,KAAG,OAAO,CAAC,IAAI,CAGtE,CAAC;AAEF,eAAO,MAAM,eAAe,SAAgB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAQzE,CAAC;AAoFF,eAAO,MAAM,WAAW,SACd,MAAM,YACH;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,KAI5C,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CA+C7B,CAAC;AAEF,eAAO,MAAM,WAAW,SACd,MAAM,YACF,MAAM,WACR;IAAE,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,KAChE,OAAO,CAAC,IAAI,CA4Bd,CAAC"}