@openbkn/bkn-sdk 0.1.1-alpha.10 → 0.1.1-alpha.11

package/dist/{chunk-GNL6Z5VF.js → chunk-SEKM54NB.js}

@@ -9,12 +9,15 @@ var HttpError = class extends Error {
   status;
   statusText;
   body;
-  constructor(status2, statusText, body) {
+  /** Optional next-step guidance, overriding the status default (e.g. AppKey re-issue). */
+  hint;
+  constructor(status2, statusText, body, hint) {
     super(`HTTP ${status2} ${statusText}`);
     this.name = "HttpError";
     this.status = status2;
     this.statusText = statusText;
     this.body = body;
+    this.hint = hint;
   }
 };
 var InputError = class extends Error {
@@ -35,7 +38,8 @@ function formatError(err) {
   if (err instanceof HttpError) {
     const serverMsg = serverError(err.body);
     if (err.status === 401) {
-      return `Not authorized (HTTP 401)${serverMsg ? `: ${serverMsg}` : ""}. Run \`openbkn auth login\` and retry.`;
+      const next = err.hint ?? "Run `openbkn auth login` and retry.";
+      return `Not authorized (HTTP 401)${serverMsg ? `: ${serverMsg}` : ""}. ${next}`;
     }
     if (err.status === 403) {
       return `Forbidden (HTTP 403)${serverMsg ? `: ${serverMsg}` : " \u2014 admin privileges required"}.`;
@@ -313,12 +317,18 @@ async function request(ctx, path, init = {}) {
       res = await send();
     }
     const text = await res.text();
-    if (!res.ok) throw new HttpError(res.status, res.statusText, text);
+    if (!res.ok) throw new HttpError(res.status, res.statusText, text, hintFor(ctx, res.status));
     return text ? JSON.parse(text) : void 0;
   } finally {
     clearTimeout(timer);
   }
 }
+function hintFor(ctx, status2) {
+  if (status2 === 401 && ctx.token.startsWith("bak_")) {
+    return "AppKey invalid / expired / revoked / owner disabled \u2014 re-issue with `openbkn appkey create` (or `appkey regenerate <id>`). Do not auto-retry.";
+  }
+  return void 0;
+}
 async function tryRefresh(ctx) {
   if (!ctx.refresh) return false;
   try {
@@ -2886,6 +2896,9 @@ async function getBuildTask(ctx, taskId) {
   const res = await request(ctx, `${VEGA_BASE}/build-tasks/${encodeURIComponent(taskId)}`);
   return BuildTask.parse(res);
 }
+function runSql(ctx, body) {
+  return request(ctx, `${VEGA_BASE}/resources/query`, { method: "POST", body });
+}
 async function listCatalogs(ctx, opts = {}) {
   return request(ctx, `${VEGA_BASE}/catalogs`, {
     query: { limit: opts.limit, offset: opts.offset }
@@ -4929,6 +4942,8 @@ function vega(ctx) {
     catalogHealth: (ids) => catalogHealthStatus(ctx, ids),
     connectorTypes: () => listConnectorTypes(ctx),
     connectorType: (type) => getConnectorType(ctx, type),
+    /** Run SQL / OpenSearch DSL directly against a data source. */
+    sql: (body) => runSql(ctx, body),
     /** Build a resource's index. With `wait`, polls until terminal. */
     build: async (req, opts = {}) => {
       const task = await createBuildTask(ctx, req);
@@ -5008,6 +5023,53 @@ async function rawCall(ctx, path, opts = {}) {
   }
 }
 
+// src/api/app-keys.ts
+var ME = "/api/safe/v1/me/api-keys";
+var ADMIN2 = "/api/safe/v1/admin/api-keys";
+function listMyApiKeys(ctx) {
+  return request(ctx, ME);
+}
+function createMyApiKey(ctx, input) {
+  return request(ctx, ME, {
+    method: "POST",
+    body: {
+      name: input.name,
+      ...input.expiresAt ? { expires_at: input.expiresAt } : {},
+      ...input.neverExpire ? { never_expire: true } : {}
+    }
+  });
+}
+async function revokeMyApiKey(ctx, id) {
+  await request(ctx, `${ME}/${encodeURIComponent(id)}`, { method: "DELETE" });
+}
+function regenerateMyApiKey(ctx, id) {
+  return request(ctx, `${ME}/${encodeURIComponent(id)}/regenerate`, { method: "POST" });
+}
+function listApiKeysAdmin(ctx, ownerId) {
+  return request(ctx, ADMIN2, { query: { owner_id: ownerId || void 0 } });
+}
+async function revokeApiKeyAdmin(ctx, id) {
+  await request(ctx, `${ADMIN2}/${encodeURIComponent(id)}`, { method: "DELETE" });
+}
+
+// src/resources/app-keys.ts
+function appKeys(ctx) {
+  return {
+    /** List the caller's own keys (no secrets). */
+    list: () => listMyApiKeys(ctx),
+    /** Issue a key — the result's `key` is the plaintext, shown only once. */
+    create: (input) => createMyApiKey(ctx, input),
+    /** Revoke one of the caller's keys (immediate). */
+    revoke: (id) => revokeMyApiKey(ctx, id),
+    /** Rotate a key in place — new plaintext (shown once); old secret dies now. */
+    regenerate: (id) => regenerateMyApiKey(ctx, id),
+    /** Admin: list all keys, or one owner's (adds `owner_user_id`). */
+    adminList: (ownerId) => listApiKeysAdmin(ctx, ownerId),
+    /** Admin: revoke any key. */
+    adminRevoke: (id) => revokeApiKeyAdmin(ctx, id)
+  };
+}
+
 // src/client.ts
 function createClient(opts = {}) {
   const ctx = resolveContext(opts);
@@ -5023,6 +5085,7 @@ function createClient(opts = {}) {
     toolboxes: toolboxes(ctx),
     trace: trace(ctx),
     admin: admin(ctx),
+    appKeys: appKeys(ctx),
     vega: vega(ctx),
     call: (path, callOpts) => rawCall(ctx, path, callOpts)
   };
@@ -5245,4 +5308,4 @@ export {
   exportCreds,
   auth_exports
 };
-//# sourceMappingURL=chunk-GNL6Z5VF.js.map
+//# sourceMappingURL=chunk-SEKM54NB.js.map