@sqlanvil/cli 1.34.0 → 1.36.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +12 -6
  2. package/bundle.js +66504 -60117
  3. package/package.json +37 -30
  4. package/worker_bundle.js +52548 -49682
package/README.md CHANGED
@@ -12,7 +12,7 @@ authority for the version you have installed: `sqlanvil help` lists the commands
12
12
 
13
13
  ```bash
14
14
  npm install -g @sqlanvil/cli
15
- sqlanvil --version # sqlanvil 1.34.0 (Dataform core 3.1.0)
15
+ sqlanvil --version # sqlanvil 1.36.0 (Dataform core 3.1.0)
16
16
  ```
17
17
 
18
18
  Requires Node.js 20.19+ or 22.12+. `--version` reports the sqlanvil release and the Dataform core
@@ -108,10 +108,12 @@ Installs the NPM dependencies declared in the project's `package.json` (for exam
108
108
  sqlanvil init-creds [project-dir]
109
109
  ```
110
110
 
111
- **BigQuery only.** Asks for the dataset location and whether to use Application Default
112
- Credentials or a service-account JSON key, then writes `.df-credentials.json`. For Postgres,
113
- Supabase and MySQL, edit the template `init` wrote instead (see
114
- [Credentials file](#credentials-file)).
111
+ **BigQuery only.** Asks for the dataset location, whether to use Application Default
112
+ Credentials or a service-account JSON key, and (optional, press Enter to skip) a service account
113
+ to impersonate — saved as `impersonateServiceAccount`, see [Credentials file](#credentials-file) —
114
+ then writes `.df-credentials.json`. The connection test runs as the impersonated account, so a
115
+ missing `roles/iam.serviceAccountTokenCreator` grant surfaces before the file is written. For
116
+ Postgres, Supabase and MySQL, edit the template `init` wrote instead.
115
117
 
116
118
  | Flag | Default | Description |
117
119
  |---|---|---|
@@ -418,7 +420,11 @@ It is gitignored by `init` and must never be committed. Non-secret settings stay
418
420
 
419
421
  `credentials` is the service-account key JSON as a string. Omit it to use Application Default
420
422
  Credentials (`gcloud auth application-default login`). `accessToken` takes a short-lived OAuth2
421
- token instead, and wins over `credentials`.
423
+ token instead, and wins over `credentials`. `impersonateServiceAccount` (a service-account email)
424
+ makes the CLI run BigQuery queries as that account without holding its key: your ADC identity, or
425
+ the `credentials` key, is the source and needs `roles/iam.serviceAccountTokenCreator` on it.
426
+ Precedence: `accessToken` → `impersonateServiceAccount` → `credentials` → ADC. The same fields work
427
+ in a `connections.<name>` BigQuery entry.
422
428
 
423
429
  Two optional sections can sit alongside the warehouse fields:
424
430