@openbkn/bkn-sdk 0.1.1-alpha.10 → 0.1.1-alpha.12

package/dist/index.d.ts

@@ -245,6 +245,63 @@ declare function agents(ctx: RequestContext): {
     }) => Promise<ChatResult>;
 };
 
+/**
+ * AppKey API (`/api/safe/v1/{me,admin}/api-keys`, OAuth-token-gated). AppKeys
+ * are user-issued long-lived credentials (prefix `bak_`) that authenticate AS
+ * their owner — downstream authorization is identical to that owner's OAuth
+ * token. Issuing/managing them needs a real OAuth session (an AppKey itself
+ * cannot mint AppKeys). The plaintext `key` is returned ONCE, on create.
+ * Usage of an AppKey is drop-in: pass it as the bearer `--token` against the
+ * Context Loader (agent-retrieval) MCP/REST surface. See issue #75.
+ */
+
+/** A key's public metadata — never carries the secret. */
+interface ApiKey {
+    id: string;
+    key_id: string;
+    name: string;
+    /** Masked preview for display, e.g. `bak_b3ff****b234` — safe to show in lists. */
+    masked: string;
+    enabled: boolean;
+    /** `null` = never expires. */
+    expires_at: string | null;
+    /** `null` = never used (zombie-key signal). */
+    last_used_at: string | null;
+    created_at: string;
+    /** Present only on the admin list. */
+    owner_user_id?: string;
+}
+/** Create response — `key` is the full plaintext, shown only this once. */
+interface CreatedApiKey extends ApiKey {
+    key: string;
+}
+interface CreateApiKeyInput {
+    name: string;
+    /** RFC3339; omit = backend default (1 year). Must be in the future. */
+    expiresAt?: string;
+    /** `true` = never expire (wins over `expiresAt`). */
+    neverExpire?: boolean;
+}
+
+declare function appKeys(ctx: RequestContext): {
+    /** List the caller's own keys (no secrets). */
+    list: () => Promise<{
+        keys: ApiKey[];
+    }>;
+    /** Issue a key — the result's `key` is the plaintext, shown only once. */
+    create: (input: CreateApiKeyInput) => Promise<CreatedApiKey>;
+    /** Revoke one of the caller's keys (immediate). */
+    revoke: (id: string) => Promise<void>;
+    /** Rotate a key in place — new plaintext (shown once); old secret dies now. */
+    regenerate: (id: string) => Promise<CreatedApiKey>;
+    /** Admin: list all keys, or one owner's (adds `owner_user_id`). */
+    adminList: (ownerId?: string) => Promise<{
+        keys: ApiKey[];
+    }>;
+    /** Admin: revoke any key. */
+    adminRevoke: (id: string) => Promise<void>;
+};
+
 /**
  * Context-loader client over the agent-retrieval MCP endpoint (JSON-RPC).
  * Reimplemented slim from kweaver-sdk: initialize → session id →
@@ -828,6 +885,22 @@ declare const BuildTask: z.ZodObject<{
     model_dimensions: z.ZodOptional<z.ZodNumber>;
 }, z.ZodTypeAny, "passthrough">>;
 type BuildTask = z.infer<typeof BuildTask>;
+interface SqlQueryRequest {
+    /** SQL string (MySQL/MariaDB/PostgreSQL) or an OpenSearch DSL object. */
+    query: string | Record<string, unknown>;
+    /**
+     * Source type (mysql | mariadb | postgresql | opensearch …). Optional — when
+     * the query carries a `{{<resource-id>}}` placeholder the backend infers the
+     * type from that resource's Catalog connector. Pass it only to override.
+     */
+    resource_type?: string;
+    /** Streaming batch size (100–10000, default server-side). */
+    stream_size?: number;
+    /** Query timeout in seconds (1–3600). */
+    query_timeout?: number;
+    /** Cursor session id for paged streaming. */
+    query_id?: string;
+}
 interface ListCatalogsOptions {
     limit?: number;
     offset?: number;
@@ -852,6 +925,8 @@ declare function vega(ctx: RequestContext): {
     catalogHealth: (ids: string[]) => Promise<unknown>;
     connectorTypes: () => Promise<unknown>;
     connectorType: (type: string) => Promise<unknown>;
+    /** Run SQL / OpenSearch DSL directly against a data source. */
+    sql: (body: SqlQueryRequest) => Promise<unknown>;
     /** Build a resource's index. With `wait`, polls until terminal. */
     build: (req: CreateBuildTaskRequest, opts?: {
         wait?: boolean;
@@ -886,6 +961,7 @@ interface BknClient {
     readonly toolboxes: ReturnType<typeof toolboxes>;
     readonly trace: ReturnType<typeof trace>;
     readonly admin: ReturnType<typeof admin>;
+    readonly appKeys: ReturnType<typeof appKeys>;
     readonly vega: ReturnType<typeof vega>;
     /** Raw API passthrough (the `call` escape hatch). */
     call(path: string, opts?: RawCallOptions): Promise<RawCallResult>;
@@ -898,7 +974,9 @@ declare class HttpError extends Error {
     readonly status: number;
     readonly statusText: string;
     readonly body: string;
-    constructor(status: number, statusText: string, body: string);
+    /** Optional next-step guidance, overriding the status default (e.g. AppKey re-issue). */
+    readonly hint?: string;
+    constructor(status: number, statusText: string, body: string, hint?: string);
 }
 /** Raised for bad CLI/SDK input before any request is made. */
 declare class InputError extends Error {

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   toolboxes,
   trace,
   vega
-} from "./chunk-GNL6Z5VF.js";
+} from "./chunk-3FVB6VFQ.js";
 export {
   DEFAULT_BUSINESS_DOMAIN,
   DEFAULT_LIST_LIMIT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openbkn/bkn-sdk",
-  "version": "0.1.1-alpha.10",
+  "version": "0.1.1-alpha.12",
   "description": "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   "type": "module",
   "license": "Apache-2.0",