@speedkit/cli 4.11.0 → 4.12.0

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+# [4.12.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.11.0...v4.12.0) (2026-06-19)
+
+
+### Features
+
+* adapt queryBuilderParam ([7cca445](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/7cca445b200a96ee2fb4d1241dd803fefab0a1e4))
+* prefer direct AWS over baqend Athena api ([b388456](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/b388456e4a0a073bac1c54e5e33b3178f375b7d7))
+* prefere baqendAthenaApi ofer native awsLogin ([4ce13eb](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/4ce13eb5fc9332fa140d474d256418ed8866910c))
+
 # [4.11.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.10.0...v4.11.0) (2026-06-19)
 
 

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g @speedkit/cli
 $ sk COMMAND
 running command...
 $ sk (--version)
-@speedkit/cli/4.11.0 linux-x64 node-v22.23.0
+@speedkit/cli/4.12.0 linux-x64 node-v22.23.0
 $ sk --help [COMMAND]
 USAGE
   $ sk COMMAND

package/dist/commands/generate-pop-config.js

@@ -152,7 +152,7 @@ export default class GeneratePopConfig extends Command {
     async run() {
         const { args: { app }, flags: { coverage, deploy, "pop-limit": popLimit, "traffic-share": minimalShare, "use-rum": useRum, "force-shield": forceShield, }, } = await this.parse(GeneratePopConfig);
         // @todo refactor businessCode from this command to src/pop-config/pop-config-service
-        const popConfigService = await new PopConfigFactory().getService();
+        const popConfigService = await new PopConfigFactory().getService(app);
         const result = await popConfigService.getUsedPopsPerOrigin(app, useRum);
         const originStats = this.generateOriginStats(result)
             .filter((stats) => {

package/dist/services/athena/athena-query-service.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Analytics buckets that exist in every app and map 1:1 to the Athena
+ * databases. Passed to {@link AthenaService.getResult} so the Baqend native
+ * query path knows which `/db/:bucket/query` endpoint to hit. The database is
+ * derived server-side from the part before the dot (e.g. `fastly.Logs` -> the
+ * `fastly` database).
+ */
+export declare enum AthenaBucket {
+    FastlyLogs = "fastly.Logs",
+    RumPi = "rum.Pi",
+    RumPiAgg = "rum.PiAgg"
+}
+export type AthenaParameter = boolean | number | string;
+/**
+ * Contract shared by every Athena query implementation (AWS SDK, Baqend native
+ * query, and the fallback that combines them). Consumers depend on this
+ * interface, never on a concrete class.
+ */
+export interface AthenaService {
+    /**
+     * Run a query and return the rows as objects keyed by column name.
+     *
+     * @param query - the SQL to execute
+     * @param parameters - values substituted for the `?` placeholders, in order
+     * @param maxAgeInMinutes - result-reuse cache window
+     * @param bucket - the analytics bucket the query targets. Required for the
+     * Baqend native query path; when omitted the AWS path is used.
+     */
+    getResult<T>(query: string, parameters?: AthenaParameter[], maxAgeInMinutes?: number, bucket?: AthenaBucket): Promise<T[]>;
+}

package/dist/services/athena/athena-query-service.js

@@ -0,0 +1,13 @@
+/**
+ * Analytics buckets that exist in every app and map 1:1 to the Athena
+ * databases. Passed to {@link AthenaService.getResult} so the Baqend native
+ * query path knows which `/db/:bucket/query` endpoint to hit. The database is
+ * derived server-side from the part before the dot (e.g. `fastly.Logs` -> the
+ * `fastly` database).
+ */
+export var AthenaBucket;
+(function (AthenaBucket) {
+    AthenaBucket["FastlyLogs"] = "fastly.Logs";
+    AthenaBucket["RumPi"] = "rum.Pi";
+    AthenaBucket["RumPiAgg"] = "rum.PiAgg";
+})(AthenaBucket || (AthenaBucket = {}));

package/dist/services/athena/athena-service-factory.d.ts

@@ -1,13 +1,27 @@
-import { AthenaService } from "./athena-service.js";
+import { AthenaService } from "./athena-query-service.js";
 export declare class AthenaServiceFactory {
+    private app?;
     service?: AthenaService;
+    /**
+     * @param app - the app to query. Enables the Baqend native query path (app
+     * token only) as a fallback when no AWS login is present. Without it, only
+     * the AWS path is available.
+     */
+    constructor(app?: string);
     getService(): Promise<AthenaService>;
+    /**
+     * Prefer direct AWS Athena whenever AWS credentials are present — they
+     * usually carry higher access rights than the Baqend app-token path. Only
+     * when no AWS login is available do we fall back to the Baqend native query
+     * path (which needs an `app`).
+     */
     private createService;
     /**
-     * create awsAthenaClient
+     * Resolve the AWS credential chain (env, SSO cache, ...) without prompting.
+     * Returns a ready client when credentials exist, otherwise `undefined` so the
+     * caller can fall back to the Baqend path.
      *
-     * @param cli
      * @private
      */
-    private getAthenaClient;
+    private tryGetAthenaClient;
 }

package/dist/services/athena/athena-service-factory.js

@@ -1,36 +1,56 @@
 import { AthenaClient } from "@aws-sdk/client-athena";
 import { safe } from "../../helpers/safe.js";
 import { CliServiceFactory } from "../cli/index.js";
-import { ATHENA_CONFIG, FetchCredentialsError } from "./index.js";
-import { AthenaService } from "./athena-service.js";
+import { ATHENA_CONFIG } from "./athena-service-model.js";
+import { FetchCredentialsError } from "./error/fetch-credentials-error.js";
+import { AwsAthenaService } from "./athena-service.js";
+import { BaqendAthenaService } from "./baqend-athena-service.js";
+import { EntityManagerFactory } from "../config-api/entity-manager-factory.js";
 export class AthenaServiceFactory {
+    app;
     service;
+    /**
+     * @param app - the app to query. Enables the Baqend native query path (app
+     * token only) as a fallback when no AWS login is present. Without it, only
+     * the AWS path is available.
+     */
+    constructor(app) {
+        this.app = app;
+    }
     async getService() {
-        if (!(this.service instanceof AthenaService)) {
+        if (!this.service) {
             this.service = await this.createService();
         }
         return this.service;
     }
+    /**
+     * Prefer direct AWS Athena whenever AWS credentials are present — they
+     * usually carry higher access rights than the Baqend app-token path. Only
+     * when no AWS login is available do we fall back to the Baqend native query
+     * path (which needs an `app`).
+     */
     async createService() {
         const cli = new CliServiceFactory().getService();
-        const client = await this.getAthenaClient(cli);
-        return new AthenaService(client, cli);
+        const client = await this.tryGetAthenaClient();
+        if (client) {
+            cli.comment("Using AWS credentials for Athena queries.");
+            return new AwsAthenaService(client, cli);
+        }
+        if (this.app) {
+            return new BaqendAthenaService(this.app, new EntityManagerFactory(), cli);
+        }
+        throw new FetchCredentialsError("Cannot send Athena queries: no AWS credentials found and no app given for the Baqend API.");
     }
     /**
-     * create awsAthenaClient
+     * Resolve the AWS credential chain (env, SSO cache, ...) without prompting.
+     * Returns a ready client when credentials exist, otherwise `undefined` so the
+     * caller can fall back to the Baqend path.
      *
-     * @param cli
      * @private
      */
-    async getAthenaClient(cli) {
+    async tryGetAthenaClient() {
         const client = new AthenaClient(ATHENA_CONFIG);
-        cli.startAction("ATHENA", "check for aws credentials");
         const credentialsResult = await safe(client.config.credentials());
-        if (credentialsResult.success === true) {
-            cli.successAction("ATHENA");
-            return client;
-        }
-        cli.failAction("ATHENA");
-        throw new FetchCredentialsError(credentialsResult.error);
+        return credentialsResult.success === true ? client : undefined;
     }
 }

package/dist/services/athena/athena-service.d.ts

@@ -1,6 +1,13 @@
 import { AthenaClient } from "@aws-sdk/client-athena";
+import { AthenaService } from "./athena-query-service.js";
 import { CliServiceInterface } from "../cli/index.js";
-export declare class AthenaService {
+/**
+ * Athena query implementation backed by the AWS SDK. Requires a valid AWS
+ * login (SSO). Preferred whenever AWS credentials are present, as they usually
+ * grant higher access than the Baqend app-token path; see
+ * {@link AthenaServiceFactory}.
+ */
+export declare class AwsAthenaService implements AthenaService {
     private client;
     private cli;
     constructor(client: AthenaClient, cli: CliServiceInterface);

package/dist/services/athena/athena-service.js

@@ -2,7 +2,13 @@ import { GetQueryExecutionCommand, GetQueryResultsCommand, QueryExecutionState,
 import { DEFAULT_MAX_AGE_IN_MINUTES } from "./athena-service-model.js";
 import { AthenaQueryError } from "./error/athena-query-error.js";
 import { safe } from "../../helpers/safe.js";
-export class AthenaService {
+/**
+ * Athena query implementation backed by the AWS SDK. Requires a valid AWS
+ * login (SSO). Preferred whenever AWS credentials are present, as they usually
+ * grant higher access than the Baqend app-token path; see
+ * {@link AthenaServiceFactory}.
+ */
+export class AwsAthenaService {
     client;
     cli;
     constructor(client, cli) {

package/dist/services/athena/baqend-athena-service.d.ts

@@ -0,0 +1,30 @@
+import { AthenaBucket, AthenaParameter, AthenaService } from "./athena-query-service.js";
+import { EntityManagerFactory } from "../config-api/entity-manager-factory.js";
+import { CliServiceInterface } from "../cli/index.js";
+/**
+ * Runs Athena SQL through the Baqend API, authenticated by the app token only
+ * (no AWS login). Hits the native query path via
+ * `db["<bucket>"].executeQuery(sql, triggeredBy, ttl)`.
+ *
+ * Two normalizations vs the AWS path:
+ *  - `?` placeholders are inlined (the native path has no parameter binding).
+ *  - the `live.` catalog prefix is stripped — the server derives catalog and
+ *    database itself, and a 3-part `live.<db>.<table>` reference fails there
+ *    (verified against a live app), whereas 2-part `<db>.<table>` works.
+ */
+export declare class BaqendAthenaService implements AthenaService {
+    private app;
+    private entityManagerFactory;
+    private cli;
+    private static readonly TRIGGERED_BY;
+    private static readonly CATALOG_PREFIX;
+    constructor(app: string, entityManagerFactory: EntityManagerFactory, cli: CliServiceInterface);
+    getResult<T>(query: string, parameters?: AthenaParameter[], maxAgeInMinutes?: number, bucket?: AthenaBucket): Promise<T[]>;
+    /**
+     * Inline the `?` placeholders with the given parameters (same quoting as the
+     * AWS path) and strip any `live.` catalog prefix. Done in a single
+     * string-literal-aware pass so `?` and `live.` occurring inside single-quoted
+     * literals (e.g. `split(url, '?')`, `'https://live.foo.com'`) are left intact.
+     */
+    private prepareQuery;
+}

package/dist/services/athena/baqend-athena-service.js

@@ -0,0 +1,92 @@
+import { DEFAULT_MAX_AGE_IN_MINUTES } from "./athena-service-model.js";
+import { safe } from "../../helpers/safe.js";
+/**
+ * Runs Athena SQL through the Baqend API, authenticated by the app token only
+ * (no AWS login). Hits the native query path via
+ * `db["<bucket>"].executeQuery(sql, triggeredBy, ttl)`.
+ *
+ * Two normalizations vs the AWS path:
+ *  - `?` placeholders are inlined (the native path has no parameter binding).
+ *  - the `live.` catalog prefix is stripped — the server derives catalog and
+ *    database itself, and a 3-part `live.<db>.<table>` reference fails there
+ *    (verified against a live app), whereas 2-part `<db>.<table>` works.
+ */
+export class BaqendAthenaService {
+    app;
+    entityManagerFactory;
+    cli;
+    static TRIGGERED_BY = "speed-kit-cli";
+    // a `live.` catalog qualifier in front of a `<db>.<table>` reference
+    static CATALOG_PREFIX = /^live\.[a-z_]\w*\.[a-z_]/i;
+    constructor(app, entityManagerFactory, cli) {
+        this.app = app;
+        this.entityManagerFactory = entityManagerFactory;
+        this.cli = cli;
+    }
+    async getResult(query, parameters = [], maxAgeInMinutes = DEFAULT_MAX_AGE_IN_MINUTES, bucket) {
+        if (!bucket) {
+            throw new Error("BaqendAthenaService.getResult requires a bucket to target");
+        }
+        this.cli.startAction("ATHENA:QUERY", "execute athena query via baqend");
+        const db = await this.entityManagerFactory.getEntityManager(this.app);
+        const sql = this.prepareQuery(query, parameters);
+        const ttl = `${maxAgeInMinutes}m`;
+        const result = await safe(db[bucket].executeQuery(sql, BaqendAthenaService.TRIGGERED_BY, ttl));
+        if (result.success === true) {
+            this.cli.successAction("ATHENA:QUERY");
+            return result.data;
+        }
+        this.cli.failAction("ATHENA:QUERY");
+        this.cli.writeError("Cannot send Athena queries via the Baqend API for this app.");
+        throw result.errorObj ?? new Error(result.error);
+    }
+    /**
+     * Inline the `?` placeholders with the given parameters (same quoting as the
+     * AWS path) and strip any `live.` catalog prefix. Done in a single
+     * string-literal-aware pass so `?` and `live.` occurring inside single-quoted
+     * literals (e.g. `split(url, '?')`, `'https://live.foo.com'`) are left intact.
+     */
+    prepareQuery(query, parameters) {
+        let out = "";
+        let inString = false;
+        let paramIndex = 0;
+        for (let index = 0; index < query.length; index++) {
+            const char = query[index];
+            if (inString) {
+                out += char;
+                // a doubled '' is an escaped quote that stays inside the string
+                if (char === "'") {
+                    if (query[index + 1] === "'") {
+                        out += query[++index];
+                    }
+                    else {
+                        inString = false;
+                    }
+                }
+                continue;
+            }
+            if (char === "'") {
+                inString = true;
+                out += char;
+                continue;
+            }
+            if (char === "?") {
+                if (paramIndex >= parameters.length) {
+                    throw new Error("Not enough parameters provided for the query");
+                }
+                const value = parameters[paramIndex++];
+                out += typeof value === "string" ? `'${value}'` : String(value);
+                continue;
+            }
+            // strip a `live.` catalog qualifier at a word boundary
+            if ((char === "l" || char === "L") &&
+                (index === 0 || !/\w/.test(query[index - 1])) &&
+                BaqendAthenaService.CATALOG_PREFIX.test(query.slice(index))) {
+                index += 4; // skip "live." (the loop's index++ skips the dot)
+                continue;
+            }
+            out += char;
+        }
+        return out;
+    }
+}

package/dist/services/athena/index.d.ts

@@ -1,4 +1,6 @@
+export * from "./athena-query-service.js";
 export * from "./athena-service.js";
+export * from "./baqend-athena-service.js";
 export * from "./athena-service-factory.js";
 export * from "./athena-service-model.js";
 export * from "./error/fetch-credentials-error.js";

package/dist/services/athena/index.js

@@ -1,4 +1,6 @@
+export * from "./athena-query-service.js";
 export * from "./athena-service.js";
+export * from "./baqend-athena-service.js";
 export * from "./athena-service-factory.js";
 export * from "./athena-service-model.js";
 export * from "./error/fetch-credentials-error.js";

package/dist/services/onboarding/dashboard/index.js

@@ -1,6 +1,7 @@
 import { BaqendResponse } from "../browser/baqend-response.js";
 import { safe } from "../../../helpers/safe.js";
 import json2Csv from "json2csv";
+import { AthenaBucket } from "../../athena/index.js";
 export class Dashboard {
     customerConfig;
     parameterQueryBuilder;
@@ -32,7 +33,7 @@ export class Dashboard {
         if (url.pathname.startsWith("/query/execute")) {
             const postData = request.postData;
             const data = JSON.parse(postData);
-            const response = await safe(this.athenaClient.getResult(data.query, []));
+            const response = await safe(this.athenaClient.getResult(data.query, [], undefined, AthenaBucket.RumPi));
             if (response.success === true) {
                 return this.createBaqendResponse(requestOrigin, JSON.stringify(response.data), "application/json; charset=UTF-8");
             }

package/dist/services/onboarding/onboarding-service-factory.js

@@ -81,7 +81,7 @@ export class OnboardingServiceFactory {
             cli.writeWarning("Running in headless mode.");
         }
         const fileWatcher = new FileWatcher(cli, customerConfig, files, documentHandler, browserContext, cache);
-        const athenaClient = (await this.getAthenaClient()) || null;
+        const athenaClient = (await this.getAthenaClient(customerConfig.app)) || null;
         const messageHandler = await this.prepareMessagehandler(athenaClient, files, customerConfig);
         const fetchHandler = await this.getFetchEventHandler(files, customerConfig, documentHandler, cache, cli, browserContext, athenaClient, messageHandler);
         const extensionBridge = new ExtensionBridge(cli);
@@ -134,8 +134,8 @@ export class OnboardingServiceFactory {
         }
         cli.failAction("ONBOARDING:BUILD:INSTALL_RESOURCE", result.error);
     }
-    async getAthenaClient() {
-        const athenaFactory = new AthenaServiceFactory();
+    async getAthenaClient(app) {
+        const athenaFactory = new AthenaServiceFactory(app);
         const result = await safe(athenaFactory.getService());
         if (result.success === true) {
             return result.data;

package/dist/services/pop-config/pop-config-factory.d.ts

@@ -1,4 +1,4 @@
 import { PopConfigService } from "./pop-config-service.js";
 export declare class PopConfigFactory {
-    getService(): Promise<PopConfigService>;
+    getService(app?: string): Promise<PopConfigService>;
 }

package/dist/services/pop-config/pop-config-factory.js

@@ -1,8 +1,8 @@
 import { PopConfigService } from "./pop-config-service.js";
 import { AthenaServiceFactory } from "../athena/index.js";
 export class PopConfigFactory {
-    async getService() {
-        const athenaService = await new AthenaServiceFactory().getService();
+    async getService(app) {
+        const athenaService = await new AthenaServiceFactory(app).getService();
         return new PopConfigService(athenaService);
     }
 }

package/dist/services/pop-config/pop-config-service.js

@@ -1,3 +1,4 @@
+import { AthenaBucket } from "../athena/index.js";
 export class PopConfigService {
     athenaService;
     constructor(athenaService) {
@@ -30,6 +31,6 @@ export class PopConfigService {
         const startDate = new Date(endDate.getFullYear(), endDate.getMonth(), endDate.getDate() - 7);
         const start = startDate.toISOString().slice(0, 10);
         const end = endDate.toISOString().slice(0, 10);
-        return await this.athenaService.getResult(query, [start, end, app], 12 * 60);
+        return await this.athenaService.getResult(query, [start, end, app], 12 * 60, AthenaBucket.FastlyLogs);
     }
 }

package/dist/services/query-builder/query/parameter.js

@@ -37,7 +37,7 @@ from urlWithParams
 group by paramKeys
 )
 
-select paramKeys, cachedUrls - uniqueWithoutParam as potentialGain, cachedUrls, PIs, example1, example2, example3
+select '[' || array_join(paramKeys, ', ') || ']' as paramKeys, cachedUrls - uniqueWithoutParam as potentialGain, cachedUrls, PIs, example1, example2, example3
 from prepared
 where cardinality(paramKeys) > 0
 order by potentialGain desc, cachedUrls desc, PIs desc`;

package/oclif.manifest.json

@@ -759,5 +759,5 @@
       ]
     }
   },
-  "version": "4.11.0"
+  "version": "4.12.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@speedkit/cli",
   "description": "Speed Kit CLI",
-  "version": "4.11.0",
+  "version": "4.12.0",
   "author": {
     "name": "Baqend.com",
     "email": "info@baqend.com"