@openbkn/bkn-sdk 0.1.1-alpha.16 → 0.1.1-alpha.19

package/dist/cli.js

@@ -6,8 +6,8 @@ import {
   HttpError,
   InputError,
   activePlatform,
-  attachNoAuth,
   attachToken,
+  changePasswordSafe,
   createClient,
   credentialDeviceLogin,
   currentToken,
@@ -16,7 +16,6 @@ import {
   deletePlatform,
   deviceLogin,
   exportCreds,
-  fetchAuthStatus,
   formatError,
   getUserSafe,
   isHeadless,
@@ -28,7 +27,6 @@ import {
   rawCall,
   readPlatformConfig,
   renderReportMarkdown,
-  request,
   resolveContext,
   setActivePlatform,
   status,
@@ -37,7 +35,7 @@ import {
   use,
   whoami,
   writePlatformConfig
-} from "./chunk-SH2KLES5.js";
+} from "./chunk-ISJHU26W.js";
 
 // src/cli.ts
 import { Command as Command17 } from "commander";
@@ -45,10 +43,10 @@ import { Command as Command17 } from "commander";
 // package.json
 var package_default = {
   name: "@openbkn/bkn-sdk",
-  version: "0.1.1-alpha.16",
+  version: "0.1.1-alpha.19",
   description: "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   type: "module",
-  license: "SEE LICENSE IN LICENSE",
+  license: "Apache-2.0",
   engines: {
     node: ">=18"
   },
@@ -63,7 +61,7 @@ var package_default = {
       import: "./dist/index.js"
     }
   },
-  files: ["dist", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
+  files: ["dist", "!dist/**/*.map", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
   publishConfig: {
     access: "public"
   },
@@ -76,7 +74,8 @@ var package_default = {
     build: "tsup",
     dev: "tsup --watch",
     typecheck: "tsc --noEmit",
-    lint: "biome check . && tsc --noEmit",
+    "check:deps": "node scripts/check-no-self-dep.mjs",
+    lint: "npm run check:deps && biome check . && tsc --noEmit",
     format: "biome format --write .",
     test: "vitest run",
     "test:cover": "vitest run --coverage",
@@ -85,12 +84,12 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.9.1",
-    "@openbkn/bkn-sdk": "^0.1.1-alpha.3",
     chalk: "^5.4.1",
     commander: "^13.1.0",
     "csv-parse": "^6.2.1",
     "js-yaml": "^4.2.0",
     jszip: "^3.10.1",
+    undici: "^8.7.0",
     zod: "^3.24.1"
   },
   devDependencies: {
@@ -104,6 +103,7 @@ var package_default = {
 };
 
 // src/commands/admin.ts
+import { readFileSync as readFileSync2 } from "fs";
 import { Command as Command2 } from "commander";
 
 // src/help/grouped-help.ts
@@ -352,25 +352,6 @@ function readBody(opts) {
 
 // src/commands/auth.ts
 import { Command } from "commander";
-
-// src/api/eacp-crypto.ts
-import {
-  constants,
-  createPrivateKey,
-  createPublicKey,
-  publicEncrypt
-} from "crypto";
-
-// src/api/admin.ts
-async function changePasswordSafe(ctx, account, oldPassword, newPassword) {
-  await request(ctx, "/api/safe/v1/auth/change-password", {
-    method: "POST",
-    body: { account, old_password: oldPassword, new_password: newPassword }
-  });
-  return { ok: true };
-}
-
-// src/commands/auth.ts
 async function resolveAccount(baseUrl, accessToken, insecure, idToken) {
   const sub = decodeJwt(idToken ?? accessToken)?.sub;
   if (!sub) return void 0;
@@ -399,25 +380,17 @@ function renderSessions(items) {
   return lines.join("\n") || "(no saved sessions)";
 }
 function registerAuthLeaves(cmd) {
-  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "use a fixed OAuth2 client id (skip dynamic registration)").option("--client-secret <secret>", "OAuth2 client secret (omit for public/PKCE)").option(
-    "--port <n>",
-    "loopback redirect port for the auth_code flow",
-    (v) => Number.parseInt(v, 10)
-  ).option("--device", "headless device-code login (RFC 8628) \u2014 no callback server, no password").option("--audience <aud>", "device-code token audience", "bkn-safe").option(
+  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "OAuth2 client id to authenticate as").option("--device", "headless device-code login (RFC 8628) \u2014 no callback server, no password").option("--audience <aud>", "device-code token audience", "bkn-safe").option(
     "--timeout <s>",
     "device-login wait before timing out",
     (v) => Number.parseInt(v, 10),
     120
-  ).option("--no-browser", "(legacy) print the URL instead of opening a browser").option("--product <name>", "(legacy) ISF OAuth product query").option("--signin-public-key-file <path>", "(legacy) RSA public key for ISF /oauth2/signin").option("--no-auth", "register the platform with no authentication (no bkn-safe)").action(async (url, opts, cmd2) => {
+  ).option("--no-browser", "print the URL instead of opening a browser").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const out = outputOptions(cmd2);
     const report = (r) => {
       if (out.json || out.compact) {
         printJson({ loggedIn: true, ...r }, out);
-      } else if (r.noAuth) {
-        process.stdout.write(`Registered ${r.baseUrl ?? url} (no authentication)
-`);
       } else {
         process.stdout.write(`Logged in to ${r.baseUrl ?? url} as ${r.username ?? r.userId}
 `);
@@ -425,20 +398,7 @@ function registerAuthLeaves(cmd) {
     };
     const token = opts.token ?? g.token;
     if (token) {
-      report(attachToken(url, token, { insecure: g.insecure }));
-      return;
-    }
-    if (opts.auth === false) {
-      report(attachNoAuth(url, { insecure: g.insecure }));
-      return;
-    }
-    const authStatus = await fetchAuthStatus(url);
-    if (authStatus && !authStatus.enabled) {
-      process.stderr.write(
-        `Platform auth is disabled (stack: ${authStatus.stack ?? "none"}) \u2014 registering without auth.
-`
-      );
-      report(attachNoAuth(url, { insecure: g.insecure }));
+      report(attachToken(url, token));
       return;
     }
     let tokens;
@@ -451,7 +411,8 @@ function registerAuthLeaves(cmd) {
         tokens = await credentialDeviceLogin(url, username, password, {
           clientId: opts.clientId,
           audience: opts.audience,
-          timeoutMs: opts.timeout * 1e3
+          timeoutMs: opts.timeout * 1e3,
+          insecure: g.insecure
         });
       } else {
         const headless = isHeadless();
@@ -460,6 +421,7 @@ function registerAuthLeaves(cmd) {
           clientId: opts.clientId,
           audience: opts.audience,
           timeoutMs: opts.timeout * 1e3,
+          insecure: g.insecure,
           onPrompt: ({ userCode, verificationUri, verificationUriComplete }) => {
             const target = verificationUriComplete ?? verificationUri;
             process.stderr.write(
@@ -478,9 +440,9 @@ User code: ${userCode}
       }
     } catch (e) {
       if (e instanceof Error && /Device auth failed \(404\)/.test(e.message)) {
-        process.stderr.write("No auth endpoint found \u2014 registering platform without auth.\n");
-        report(attachNoAuth(url, { insecure: g.insecure }));
-        return;
+        throw new InputError(
+          `No auth endpoint on ${url} \u2014 the platform has no bkn-safe auth stack. Deploy bkn-safe, or log in elsewhere and pass the token with \`--token\`.`
+        );
       }
       throw e;
     }
@@ -496,29 +458,28 @@ User code: ${userCode}
       attachToken(url, tokens.accessToken, {
         refreshToken: tokens.refreshToken,
         idToken: tokens.idToken,
-        insecure: g.insecure,
         username: account
       })
     );
   });
-  cmd.command("status").description("Show base URL and whether a token is configured").action((_opts, cmd2) => printJson(status(), outputOptions(cmd2)));
+  cmd.command("status").description("Show base URL and whether a token is configured").action(
+    (_opts, cmd2) => printJson(status({ user: cmd2.optsWithGlobals().user }), outputOptions(cmd2))
+  );
   cmd.command("token").description("Print the current access token, refreshing it if expired (keep secret)").option("--no-refresh", "print the stored token as-is, without refreshing").action(async (opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-    const token = opts.refresh === false ? currentToken() : await currentTokenFresh();
+    const token = opts.refresh === false ? currentToken({ user: g.user }) : await currentTokenFresh({ insecure: g.insecure, user: g.user });
     process.stdout.write(`${token}
 `);
   });
   cmd.command("whoami [url]").description("Show current user identity (from the token)").option("--no-lookup", "skip the backend identity fallback (eacp/user/get)").action(async (_url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-    const me = whoami();
+    const me = whoami({ user: g.user });
     if (opts.lookup !== false && me.baseUrl && me.sub) {
       try {
         const u = await getUserSafe(
           {
             baseUrl: me.baseUrl,
-            token: currentToken(),
+            token: currentToken({ user: g.user }),
             businessDomain: DEFAULT_BUSINESS_DOMAIN,
             insecure: Boolean(g.insecure)
           },
@@ -583,9 +544,8 @@ User code: ${userCode}
   cmd.command("export").description("Export the active session's tokens (for a headless host)").action((_opts, cmd2) => {
     printJson(exportCreds(), outputOptions(cmd2));
   });
-  cmd.command("change-password [url]").description("Change your account password (bkn-safe self-service; no browser)").option("-a, --account <name>", "account / login name (the login column, e.g. admin)").option("--old-password <pwd>", "current password").option("--new-password <pwd>", "new password").option("--public-key-file <path>", "(legacy) RSA public key for ISF password encryption").action(async (url, opts, cmd2) => {
+  cmd.command("change-password [url]").description("Change your account password (bkn-safe self-service; no browser)").option("-a, --account <name>", "account / login name (the login column, e.g. admin)").option("--old-password <pwd>", "current password").option("--new-password <pwd>", "new password").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const ctx = resolveContext({
       baseUrl: url ?? g.baseUrl,
       token: g.token,
@@ -626,6 +586,12 @@ function authCommand() {
 // src/commands/admin.ts
 var int = (v) => Number.parseInt(v, 10);
 var DEFAULT_RESET_PASSWORD = "openbkn";
+async function importLicenseFile(cmd, file, receipt) {
+  const text = readFileSync2(file, "utf8");
+  const res = await clientFrom(cmd).admin.licenseImport(text, { receipt });
+  printJson(res, outputOptions(cmd));
+  if ("stored" in res && res.stored) process.exitCode = 1;
+}
 function adminCommand() {
   const admin = new Command2("admin").description("Operator CLI: org, user, role, models, audit");
   registerAuthLeaves(admin.command("auth").description("Operator authentication"));
@@ -911,6 +877,27 @@ function adminCommand() {
       );
     });
   }
+  const license = admin.command("license").description("Cluster license management");
+  license.command("show").description("Current license detail (state/edition/expiry/features)").action(async (_opts, cmd) => {
+    printJson(await clientFrom(cmd).admin.licenseGet(), outputOptions(cmd));
+  });
+  license.command("import <file>").description("Import a .lic license file (online deployments auto-activate)").action(async (file, _opts, cmd) => {
+    await importLicenseFile(cmd, file, false);
+  });
+  license.command("receipt <file>").description("Import an offline activation receipt (.lic from the license portal)").action(async (file, _opts, cmd) => {
+    await importLicenseFile(cmd, file, true);
+  });
+  license.command("activate").description("Report the installed license to the issuer (online deployments)").action(async (_opts, cmd) => {
+    printJson(await clientFrom(cmd).admin.licenseActivate(), outputOptions(cmd));
+  });
+  license.command("remove").description("Remove the installed license (back to unactivated)").action(async (_opts, cmd) => {
+    printJson(await clientFrom(cmd).admin.licenseRemove(), outputOptions(cmd));
+  });
+  license.command("fingerprint").description(
+    "This cluster's machine code (paste into the license portal for offline activation)"
+  ).action(async (_opts, cmd) => {
+    printJson(await clientFrom(cmd).admin.licenseFingerprint(), outputOptions(cmd));
+  });
   admin.command("audit").description("Audit log queries").command("list").description("List login audit events").option("--user <name>", "filter by user").option("--start <time>", "start time").option("--end <time>", "end time").option("--page <n>", "page", int, 1).option("--size <n>", "page size", int, 30).action(async (opts, cmd) => {
     printJson(
       await clientFrom(cmd).admin.auditList({
@@ -1151,7 +1138,7 @@ function appkeyCommand() {
 import { Command as Command5 } from "commander";
 
 // src/utils/bkn-validate.ts
-import { existsSync, readFileSync as readFileSync2, readdirSync, statSync } from "fs";
+import { existsSync, readFileSync as readFileSync3, readdirSync, statSync } from "fs";
 import { join, resolve } from "path";
 var BKN_OBJECT_NAME_MAX_LENGTH = 40;
 function parseFrontmatter(text) {
@@ -1204,7 +1191,7 @@ function validateBknDirectory(dirPath) {
   if (!existsSync(networkPath)) {
     errors.push("Missing network.bkn at the BKN root.");
   } else {
-    const fm = parseFrontmatter(readFileSync2(networkPath, "utf8"));
+    const fm = parseFrontmatter(readFileSync3(networkPath, "utf8"));
     if (!fm) errors.push("network.bkn has no frontmatter block.");
     else {
       if (fm.type !== "knowledge_network")
@@ -1216,7 +1203,7 @@ function validateBknDirectory(dirPath) {
   const otIds = /* @__PURE__ */ new Set();
   const otFiles = bknFiles(join(dir, "object_types"));
   for (const file of otFiles) {
-    const fm = parseFrontmatter(readFileSync2(file, "utf8"));
+    const fm = parseFrontmatter(readFileSync3(file, "utf8"));
     const rel = file.slice(dir.length + 1);
     if (!fm || fm.type !== "object_type") {
       errors.push(`${rel}: not a valid object_type (missing/wrong frontmatter type).`);
@@ -1236,7 +1223,7 @@ function validateBknDirectory(dirPath) {
   }
   const rtFiles = bknFiles(join(dir, "relation_types"));
   for (const file of rtFiles) {
-    const text = readFileSync2(file, "utf8");
+    const text = readFileSync3(file, "utf8");
     const fm = parseFrontmatter(text);
     const rel = file.slice(dir.length + 1);
     if (!fm || fm.type !== "relation_type") {
@@ -2106,13 +2093,29 @@ Examples:
 // src/commands/resource.ts
 import { Command as Command12 } from "commander";
 var int9 = (v) => Number.parseInt(v, 10);
+var parsePairs = (raw) => {
+  if (!raw) return void 0;
+  return raw.split(",").map((part) => {
+    const idx = part.indexOf("=");
+    if (idx < 1) throw new Error("--extension must be key=value[,key=value]");
+    return { key: part.slice(0, idx).trim(), value: part.slice(idx + 1).trim() };
+  }).filter((p) => p.key.length > 0);
+};
 function resourceCommand() {
   const cmd = new Command12("resource").alias("res").description("Resources \u2014 list, find, get, query, delete");
-  cmd.command("list").description("List resources under a catalog").option("--catalog-id <id>", "filter by catalog id").option("--datasource-id <id>", "alias of --catalog-id").option("--category <c>", "resource category (table | logicview | dataset)").option("--type <c>", "alias of --category").option("--limit <n>", "page size", int9, DEFAULT_LIST_LIMIT).action(async (opts, cmd2) => {
+  cmd.command("list").description("List resources under a catalog").option("--catalog-id <id>", "filter by catalog id").option("--datasource-id <id>", "alias of --catalog-id").option("--category <c>", "resource category (table | logicview | dataset)").option("--type <c>", "alias of --category").option("--status <status>", "filter by status").option("--database <name>", "filter by database").option("--limit <n>", "page size", int9, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int9, 0).option("--include-extensions", "include all extension key/value pairs").option("--include-extension-keys <keys>", "include selected extension keys").option("--extension <k=v,...>", "filter by extension key/value pairs").option("--sort <field>", "sort field: name | create_time | update_time").option("--direction <dir>", "sort direction: asc | desc").action(async (opts, cmd2) => {
     const data = await clientFrom(cmd2).resource.list({
       datasourceId: opts.catalogId ?? opts.datasourceId,
       category: opts.category ?? opts.type,
-      limit: opts.limit
+      status: opts.status,
+      database: opts.database,
+      limit: opts.limit,
+      offset: opts.offset,
+      includeExtensions: opts.includeExtensions,
+      includeExtensionKeys: opts.includeExtensionKeys,
+      extensionPairs: parsePairs(opts.extension),
+      sort: opts.sort,
+      direction: opts.direction
     });
     printJson(data, outputOptions(cmd2));
   });
@@ -2334,11 +2337,11 @@ function toolCommand() {
 }
 
 // src/commands/trace.ts
-import { readFileSync as readFileSync4, writeFileSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync } from "fs";
 import { Command as Command15 } from "commander";
 
-// src/trace-ai/schema-validate.ts
-import { readFileSync as readFileSync3 } from "fs";
+// src/bkn-trace/schema-validate.ts
+import { readFileSync as readFileSync4 } from "fs";
 import { extname } from "path";
 import yaml from "js-yaml";
 import { z } from "zod";
@@ -2375,7 +2378,7 @@ var DiagnosisRule = z.object({
   params: z.record(z.string(), z.unknown()).optional()
 });
 function parseFile(file) {
-  const text = readFileSync3(file, "utf8");
+  const text = readFileSync4(file, "utf8");
   const ext = extname(file).toLowerCase();
   if (ext === ".yaml" || ext === ".yml") return yaml.load(text);
   return JSON.parse(text);
@@ -2414,7 +2417,7 @@ function validateSchemaFile(file, kind) {
 // src/commands/trace.ts
 function traceCommand() {
   const cmd = new Command15("trace").description(
-    "Trace AI \u2014 fetch spans, diagnose (symbolic + LLM rubric), scan, eval-set, schema validate"
+    "BKN Trace \u2014 fetch spans, diagnose (symbolic + LLM rubric), scan, eval-set, schema validate"
   );
   cmd.command("get <conversation-id>").description("Fetch all trace spans for a conversation").option("--max-spans <n>", "max spans", (v) => Number.parseInt(v, 10)).action(async (conversationId, opts, cmd2) => {
     printJson(
@@ -2442,7 +2445,7 @@ function traceCommand() {
   });
   const evalSet = cmd.command("eval-set").description("Build + run trace eval sets");
   evalSet.command("build <queries-file>").description("Build eval cases from a queries JSON file").option("--out <file>", "write the cases JSON here (default: stdout)").action(async (queriesFile, opts, cmd2) => {
-    const raw = JSON.parse(readFileSync4(queriesFile, "utf8"));
+    const raw = JSON.parse(readFileSync5(queriesFile, "utf8"));
     const cases = clientFrom(cmd2).trace.evalSetBuild(raw);
     if (opts.out) {
       writeFileSync(opts.out, JSON.stringify({ cases }, null, 2));
@@ -2452,7 +2455,7 @@ function traceCommand() {
     }
   });
   evalSet.command("test <cases-file>").description("Run an eval set against an agent (--llm enables semantic_match)").requiredOption("--agent <id>", "agent id to run the queries against").option("--version <v>", "agent version", "v0").option("--llm", "enable semantic_match assertions via the local `claude` CLI").action(async (casesFile, opts, cmd2) => {
-    const raw = JSON.parse(readFileSync4(casesFile, "utf8"));
+    const raw = JSON.parse(readFileSync5(casesFile, "utf8"));
     const cases = clientFrom(cmd2).trace.evalSetBuild(raw);
     const result = await clientFrom(cmd2).trace.evalSetTest(opts.agent, cases, {
       version: opts.version,
@@ -2473,14 +2476,35 @@ function traceCommand() {
 // src/commands/vega.ts
 import { Command as Command16 } from "commander";
 var int12 = (v) => Number.parseInt(v, 10);
+var parsePairs2 = (raw) => {
+  if (!raw) return void 0;
+  return raw.split(",").map((part) => {
+    const idx = part.indexOf("=");
+    if (idx < 1) throw new InputError("--extension must be key=value[,key=value]");
+    return { key: part.slice(0, idx).trim(), value: part.slice(idx + 1).trim() };
+  }).filter((p) => p.key.length > 0);
+};
 function vegaCommand() {
   const vega = new Command16("vega").description(
     "Vega observability \u2014 catalog, resources, index build tasks"
   );
   const catalog = vega.command("catalog").description("Catalog entries");
-  catalog.command("list").description("List catalog entries").option("--limit <n>", "page size", (v) => Number.parseInt(v, 10), DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", (v) => Number.parseInt(v, 10), 0).action(async (_opts, cmd) => {
+  catalog.command("list").description("List catalog entries").option("--limit <n>", "page size", (v) => Number.parseInt(v, 10), DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", (v) => Number.parseInt(v, 10), 0).option("--name <s>", "filter by name").option("--tag <s>", "filter by tag").option("--type <type>", "filter by catalog type: physical | logical").option("--enabled <bool>", "filter by enabled state").option("--health-check-status <s>", "filter by health status").option("--include-extensions", "include all extension key/value pairs").option("--include-extension-keys <keys>", "include selected extension keys").option("--extension <k=v,...>", "filter by extension key/value pairs").option("--sort <field>", "sort field: name | create_time | update_time").option("--direction <dir>", "sort direction: asc | desc").action(async (_opts, cmd) => {
     const o = cmd.optsWithGlobals();
-    const data = await clientFrom(cmd).vega.catalogs({ limit: o.limit, offset: o.offset });
+    const data = await clientFrom(cmd).vega.catalogs({
+      limit: o.limit,
+      offset: o.offset,
+      name: o.name,
+      tag: o.tag,
+      type: o.type,
+      enabled: o.enabled === void 0 ? void 0 : o.enabled === "true",
+      healthCheckStatus: o.healthCheckStatus,
+      includeExtensions: o.includeExtensions,
+      includeExtensionKeys: o.includeExtensionKeys,
+      extensionPairs: parsePairs2(o.extension),
+      sort: o.sort,
+      direction: o.direction
+    });
     printJson(data, outputOptions(cmd));
   });
   catalog.command("get <id>").description("Get a catalog by id").action(async (id, _opts, cmd) => {
@@ -2492,21 +2516,41 @@ function vegaCommand() {
   catalog.command("health <ids...>").description("Health-status for one or more catalogs").action(async (ids, _opts, cmd) => {
     printJson(await clientFrom(cmd).vega.catalogHealth(ids), outputOptions(cmd));
   });
-  catalog.command("create").description("Create a catalog (data source)").requiredOption("--name <s>", "catalog name").requiredOption("--connector-type <s>", "connector type (e.g. mysql)").requiredOption("--connector-config <json>", "connector config JSON").option("--tags <t1,t2>", "comma-separated tags").option("--description <s>", "description").option("--enabled", "create enabled (default: disabled)").action(async (opts, cmd) => {
+  catalog.command("create").description("Create a catalog (data source)").requiredOption("--name <s>", "catalog name").requiredOption("--connector-type <s>", "connector type (e.g. mysql)").requiredOption("--connector-config <json>", "connector config JSON").option("--id <id>", "explicit catalog id").option("--tags <t1,t2>", "comma-separated tags").option("--description <s>", "description").option("--enabled", "create enabled (default: disabled)").option("--internal", "create an internal catalog").option("--extensions <json>", "extension key/value JSON object").action(async (opts, cmd) => {
     let connectorConfig;
     try {
       connectorConfig = JSON.parse(opts.connectorConfig);
     } catch {
       throw new Error("--connector-config must be valid JSON");
     }
+    const extensions = opts.extensions ? JSON.parse(opts.extensions) : void 0;
     printJson(
       await clientFrom(cmd).vega.createCatalog({
+        id: opts.id,
         name: opts.name,
         connectorType: opts.connectorType,
         connectorConfig,
         tags: opts.tags ? String(opts.tags).split(",").map((t) => t.trim()).filter(Boolean) : void 0,
         description: opts.description,
-        enabled: opts.enabled ? true : void 0
+        enabled: opts.enabled ? true : void 0,
+        internal: opts.internal ? true : void 0,
+        extensions
+      }),
+      outputOptions(cmd)
+    );
+  });
+  catalog.command("update <id>").description("Update a catalog").option("--name <s>", "catalog name").option("--connector-type <s>", "connector type").option("--connector-config <json>", "connector config JSON").option("--tags <t1,t2>", "comma-separated tags").option("--description <s>", "description").option("--enabled <bool>", "enabled state").option("--extensions <json>", "extension key/value JSON object").action(async (id, opts, cmd) => {
+    const connectorConfig = opts.connectorConfig ? JSON.parse(opts.connectorConfig) : void 0;
+    const extensions = opts.extensions ? JSON.parse(opts.extensions) : void 0;
+    printJson(
+      await clientFrom(cmd).vega.updateCatalog(id, {
+        name: opts.name,
+        connectorType: opts.connectorType,
+        connectorConfig,
+        tags: opts.tags ? String(opts.tags).split(",").map((t) => t.trim()).filter(Boolean) : void 0,
+        description: opts.description,
+        enabled: opts.enabled === void 0 ? void 0 : opts.enabled === "true",
+        extensions
       }),
       outputOptions(cmd)
     );
@@ -2514,6 +2558,15 @@ function vegaCommand() {
   catalog.command("enable <id>").description("Enable a catalog (required before discovery)").action(async (id, _opts, cmd) => {
     printJson(await clientFrom(cmd).vega.enableCatalog(id), outputOptions(cmd));
   });
+  catalog.command("disable <id>").description("Disable a catalog").action(async (id, _opts, cmd) => {
+    printJson(await clientFrom(cmd).vega.disableCatalog(id), outputOptions(cmd));
+  });
+  catalog.command("delete <id>").description("Delete a catalog").action(async (id, _opts, cmd) => {
+    printJson(await clientFrom(cmd).vega.deleteCatalog(id), outputOptions(cmd));
+  });
+  catalog.command("test-connection <id>").description("Test a catalog connection").action(async (id, _opts, cmd) => {
+    printJson(await clientFrom(cmd).vega.testCatalogConnection(id), outputOptions(cmd));
+  });
   catalog.command("discover <id>").description("Trigger catalog resource discovery").option("--wait", "wait for discovery to complete").action(async (id, opts, cmd) => {
     printJson(
       await clientFrom(cmd).vega.discoverCatalog(id, Boolean(opts.wait)),
@@ -2527,10 +2580,7 @@ function vegaCommand() {
   connector.command("get <type>").description("Get a connector type").action(async (type, _opts, cmd) => {
     printJson(await clientFrom(cmd).vega.connectorType(type), outputOptions(cmd));
   });
-  vega.command("sql").description("Run SQL / OpenSearch DSL directly against a vega-backend data source").option(
-    "--resource-type <type>",
-    "source type (mysql | postgresql | opensearch | \u2026); optional \u2014 inferred from the {{<id>}} placeholder"
-  ).option(
+  vega.command("sql").description("Run SQL / OpenSearch DSL directly against a vega-backend data source").requiredOption("--resource-type <type>", "source type (mysql | postgresql | opensearch | \u2026)").option("--query-type <type>", "query mode: standard | stream").option(
     "--query <sql>",
     "SQL string; reference a resource with a {{<resource-id>}} placeholder"
   ).option("--stream-size <n>", "streaming batch size (100\u201310000)", int12).option("--query-timeout <s>", "query timeout in seconds (1\u20133600)", int12).option(
@@ -2550,9 +2600,8 @@ function vegaCommand() {
       }
       body = {
         query: opts.query,
-        // Optional — the backend infers the type from the {{<id>}} placeholder's
-        // catalog connector when omitted.
-        ...opts.resourceType ? { resource_type: opts.resourceType } : {},
+        resource_type: opts.resourceType,
+        ...opts.queryType ? { query_type: opts.queryType } : {},
         ...opts.streamSize !== void 0 ? { stream_size: opts.streamSize } : {},
         ...opts.queryTimeout !== void 0 ? { query_timeout: opts.queryTimeout } : {}
       };
@@ -2560,12 +2609,20 @@ function vegaCommand() {
     printJson(await clientFrom(cmd).vega.sql(body), outputOptions(cmd));
   });
   const resource = vega.command("resource").description("Vega-backend resources");
-  resource.command("list").description("List resources").option("--datasource-id <id>", "filter by catalog/datasource id").option("--catalog-id <id>", "alias of --datasource-id").option("--type <category>", "resource category").option("--category <category>", "alias of --type").option("--limit <n>", "page size", (v) => Number.parseInt(v, 10), DEFAULT_LIST_LIMIT).action(async (opts, cmd) => {
+  resource.command("list").description("List resources").option("--datasource-id <id>", "filter by catalog/datasource id").option("--catalog-id <id>", "alias of --datasource-id").option("--type <category>", "resource category").option("--category <category>", "alias of --type").option("--status <status>", "filter by status").option("--database <name>", "filter by database").option("--limit <n>", "page size", (v) => Number.parseInt(v, 10), DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int12, 0).option("--include-extensions", "include all extension key/value pairs").option("--include-extension-keys <keys>", "include selected extension keys").option("--extension <k=v,...>", "filter by extension key/value pairs").option("--sort <field>", "sort field: name | create_time | update_time").option("--direction <dir>", "sort direction: asc | desc").action(async (opts, cmd) => {
     printJson(
       await clientFrom(cmd).resource.list({
         datasourceId: opts.datasourceId ?? opts.catalogId,
         category: opts.type ?? opts.category,
-        limit: opts.limit
+        status: opts.status,
+        database: opts.database,
+        limit: opts.limit,
+        offset: opts.offset,
+        includeExtensions: opts.includeExtensions,
+        includeExtensionKeys: opts.includeExtensionKeys,
+        extensionPairs: parsePairs2(opts.extension),
+        sort: opts.sort,
+        direction: opts.direction
       }),
       outputOptions(cmd)
     );
@@ -2583,16 +2640,25 @@ function vegaCommand() {
   dataset.command("build <resource-id>").description("Build a resource's index (creates a BuildTask)").requiredOption("--mode <mode>", "build mode: batch | streaming").option("--embedding-fields <list>", "comma-separated fields to vectorize").option(
     "--build-key-fields <list>",
     "comma-separated key fields (batch: time; streaming: row id)"
-  ).option("--embedding-model <id>", "embedding model id (default if omitted)").option("--model-dimensions <n>", "vector dimensions", (v) => Number.parseInt(v, 10)).option("--wait", "poll until the build reaches a terminal state").option("--timeout <s>", "wait timeout in seconds", (v) => Number.parseInt(v, 10), 300).action(async (resourceId, _opts, cmd) => {
+  ).option("--embedding-model <id>", "default embedding model name/id").option("--fulltext-fields <list>", "comma-separated fields for fulltext index").option("--fulltext-analyzer <name>", "fulltext analyzer").option("--execute-type <type>", "batch execution type: incremental | full").option("--wait", "poll until the build reaches a terminal state").option("--timeout <s>", "wait timeout in seconds", (v) => Number.parseInt(v, 10), 300).action(async (resourceId, _opts, cmd) => {
     const o = cmd.optsWithGlobals();
+    const embeddingFields = csv(o.embeddingFields);
+    const buildKeyFields = csv(o.buildKeyFields);
+    const fulltextFields = csv(o.fulltextFields);
+    if (embeddingFields || buildKeyFields || o.embeddingModel || fulltextFields || o.fulltextAnalyzer) {
+      await clientFrom(cmd).resource.configureIndex(resourceId, {
+        embeddingFields,
+        buildKeyFields,
+        embeddingModel: o.embeddingModel,
+        fulltextFields,
+        fulltextAnalyzer: o.fulltextAnalyzer
+      });
+    }
     const task = await clientFrom(cmd).vega.build(
       {
         resource_id: resourceId,
         mode: o.mode,
-        embedding_fields: csv(o.embeddingFields),
-        build_key_fields: csv(o.buildKeyFields),
-        embedding_model: o.embeddingModel,
-        model_dimensions: o.modelDimensions
+        execute_type: o.executeType
       },
       { wait: Boolean(o.wait), timeoutMs: o.timeout * 1e3 }
     );
@@ -2602,6 +2668,40 @@ function vegaCommand() {
     const task = await clientFrom(cmd).vega.buildStatus(taskId);
     printJson(task, outputOptions(cmd));
   });
+  dataset.command("build-list").description("List BuildTasks").option("--limit <n>", "page size", int12, DEFAULT_LIST_LIMIT).option("--offset <n>", "page offset", int12, 0).option("--resource-id <id>", "filter by resource id").option("--catalog-id <id>", "filter by catalog id").option("--status <status>", "comma-separated statuses").option("--active", "only running/init tasks").option("--mode <mode>", "filter by mode: batch | streaming").option("--order-by <field>", "default | created_at | updated_at | status | mode").option("--order <dir>", "asc | desc").action(async (opts, cmd) => {
+    printJson(
+      await clientFrom(cmd).vega.buildTasks({
+        limit: opts.limit,
+        offset: opts.offset,
+        resourceId: opts.resourceId,
+        catalogId: opts.catalogId,
+        status: opts.status,
+        active: opts.active,
+        mode: opts.mode,
+        orderBy: opts.orderBy,
+        order: opts.order
+      }),
+      outputOptions(cmd)
+    );
+  });
+  dataset.command("build-start <task-id>").description("Start a BuildTask").option("--reset", "restart from the beginning").action(async (taskId, opts, cmd) => {
+    printJson(
+      await clientFrom(cmd).vega.startBuildTask(taskId, { reset: opts.reset }),
+      outputOptions(cmd)
+    );
+  });
+  dataset.command("build-stop <task-id>").description("Stop a BuildTask").action(async (taskId, _opts, cmd) => {
+    printJson(await clientFrom(cmd).vega.stopBuildTask(taskId), outputOptions(cmd));
+  });
+  dataset.command("build-delete <ids...>").description("Delete one or more BuildTasks").option("--ignore-missing", "ignore missing task ids").option("--delete-active-index", "delete active indexes too").action(async (ids, opts, cmd) => {
+    printJson(
+      await clientFrom(cmd).vega.deleteBuildTasks(ids, {
+        ignoreMissing: opts.ignoreMissing,
+        deleteActiveIndex: opts.deleteActiveIndex
+      }),
+      outputOptions(cmd)
+    );
+  });
   return group(vega, "AI DATA PLATFORM");
 }