@sqlanvil/cli 1.35.0 → 1.36.0

package/README.md

@@ -12,7 +12,7 @@ authority for the version you have installed: `sqlanvil help` lists the commands
 
 ```bash
 npm install -g @sqlanvil/cli
-sqlanvil --version    # sqlanvil 1.35.0 (Dataform core 3.1.0)
+sqlanvil --version    # sqlanvil 1.36.0 (Dataform core 3.1.0)
 ```
 
 Requires Node.js 20.19+ or 22.12+. `--version` reports the sqlanvil release and the Dataform core
@@ -108,10 +108,12 @@ Installs the NPM dependencies declared in the project's `package.json` (for exam
 sqlanvil init-creds [project-dir]
 ```
 
-**BigQuery only.** Asks for the dataset location and whether to use Application Default
-Credentials or a service-account JSON key, then writes `.df-credentials.json`. For Postgres,
-Supabase and MySQL, edit the template `init` wrote instead (see
-[Credentials file](#credentials-file)).
+**BigQuery only.** Asks for the dataset location, whether to use Application Default
+Credentials or a service-account JSON key, and (optional, press Enter to skip) a service account
+to impersonate — saved as `impersonateServiceAccount`, see [Credentials file](#credentials-file) —
+then writes `.df-credentials.json`. The connection test runs as the impersonated account, so a
+missing `roles/iam.serviceAccountTokenCreator` grant surfaces before the file is written. For
+Postgres, Supabase and MySQL, edit the template `init` wrote instead.
 
 | Flag | Default | Description |
 |---|---|---|
@@ -418,7 +420,11 @@ It is gitignored by `init` and must never be committed. Non-secret settings stay
 
 `credentials` is the service-account key JSON as a string. Omit it to use Application Default
 Credentials (`gcloud auth application-default login`). `accessToken` takes a short-lived OAuth2
-token instead, and wins over `credentials`.
+token instead, and wins over `credentials`. `impersonateServiceAccount` (a service-account email)
+makes the CLI run BigQuery queries as that account without holding its key: your ADC identity, or
+the `credentials` key, is the source and needs `roles/iam.serviceAccountTokenCreator` on it.
+Precedence: `accessToken` → `impersonateServiceAccount` → `credentials` → ADC. The same fields work
+in a `connections.<name>` BigQuery entry.
 
 Two optional sections can sit alongside the warehouse fields:
 

package/bundle.js

@@ -49829,6 +49829,7 @@ function requireTs () {
 		             * @property {string|null} [credentials] BigQuery credentials
 		             * @property {string|null} [location] BigQuery location
 		             * @property {string|null} [accessToken] BigQuery accessToken
+		             * @property {string|null} [impersonateServiceAccount] BigQuery impersonateServiceAccount
 		             */
 		    
 		            /**
@@ -49878,6 +49879,14 @@ function requireTs () {
 		             */
 		            BigQuery.prototype.accessToken = "";
 		    
+		            /**
+		             * BigQuery impersonateServiceAccount.
+		             * @member {string} impersonateServiceAccount
+		             * @memberof sqlanvil.BigQuery
+		             * @instance
+		             */
+		            BigQuery.prototype.impersonateServiceAccount = "";
+		    
 		            /**
 		             * Creates a new BigQuery instance using the specified properties.
 		             * @function create
@@ -49914,6 +49923,8 @@ function requireTs () {
 		                    writer.uint32(/* id 4, wireType 2 =*/34).string(message.location);
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    writer.uint32(/* id 5, wireType 2 =*/42).string(message.accessToken);
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    writer.uint32(/* id 6, wireType 2 =*/50).string(message.impersonateServiceAccount);
 		                return writer;
 		            };
 		    
@@ -49980,6 +49991,10 @@ function requireTs () {
 		                            message.accessToken = reader.string();
 		                            break;
 		                        }
+		                    case 6: {
+		                            message.impersonateServiceAccount = reader.string();
+		                            break;
+		                        }
 		                    default:
 		                        reader.skipType(tag & 7, long);
 		                        break;
@@ -50036,6 +50051,9 @@ function requireTs () {
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    if (!$util.isString(message.accessToken))
 		                        return "accessToken: string expected";
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    if (!$util.isString(message.impersonateServiceAccount))
+		                        return "impersonateServiceAccount: string expected";
 		                return null;
 		            };
 		    
@@ -50065,6 +50083,8 @@ function requireTs () {
 		                    message.location = String(object.location);
 		                if (object.accessToken != null)
 		                    message.accessToken = String(object.accessToken);
+		                if (object.impersonateServiceAccount != null)
+		                    message.impersonateServiceAccount = String(object.impersonateServiceAccount);
 		                return message;
 		            };
 		    
@@ -50090,6 +50110,7 @@ function requireTs () {
 		                    object.credentials = "";
 		                    object.location = "";
 		                    object.accessToken = "";
+		                    object.impersonateServiceAccount = "";
 		                }
 		                if (message.projectId != null && Object.hasOwnProperty.call(message, "projectId"))
 		                    object.projectId = message.projectId;
@@ -50099,6 +50120,8 @@ function requireTs () {
 		                    object.location = message.location;
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    object.accessToken = message.accessToken;
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    object.impersonateServiceAccount = message.impersonateServiceAccount;
 		                return object;
 		            };
 		    
@@ -55101,7 +55124,7 @@ function requireVersion () {
 	hasRequiredVersion = 1;
 	Object.defineProperty(version, "__esModule", { value: true });
 	version.dataformVersion = version.version = void 0;
-	version.version = "1.35.0";
+	version.version = "1.36.0";
 	version.dataformVersion = "3.1.0";
 	
 	return version;
@@ -56973,7 +56996,9 @@ function requireBigquery () {
 	    return (mod && mod.__esModule) ? mod : { "default": mod };
 	};
 	Object.defineProperty(bigquery, "__esModule", { value: true });
-	bigquery.BigQueryDbAdapter = void 0;
+	bigquery.BigQueryDbAdapter = bigquery.DeferredAuthClient = void 0;
+	bigquery.createImpersonatedClient = createImpersonatedClient;
+	bigquery.createAuthClient = createAuthClient;
 	bigquery.bigQueryClientOptions = bigQueryClientOptions;
 	bigquery.createBigQueryClientProvider = createBigQueryClientProvider;
 	const bigquery_1 = require$$0$6;
@@ -56986,17 +57011,54 @@ function requireBigquery () {
 	const errors_1 = requireErrors();
 	const promises_1 = requirePromises();
 	const ts_1 = requireTs();
+	const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
 	const EXTRA_GOOGLE_SCOPES = ["https://www.googleapis.com/auth/drive"];
-	function bigQueryClientOptions(credentials, projectId) {
+	class DeferredAuthClient extends google_auth_library_1.AuthClient {
+	    constructor(resolveClient) {
+	        super();
+	        this.resolveClient = resolveClient;
+	    }
+	    async getAccessToken() {
+	        return (await this.resolveClient()).getAccessToken();
+	    }
+	    async getRequestHeaders(url) {
+	        return (await this.resolveClient()).getRequestHeaders(url);
+	    }
+	    async request(options) {
+	        return (await this.resolveClient()).request(options);
+	    }
+	}
+	bigquery.DeferredAuthClient = DeferredAuthClient;
+	function createImpersonatedClient(targetPrincipal, sourceClient) {
+	    return new google_auth_library_1.Impersonated({
+	        sourceClient,
+	        targetPrincipal,
+	        targetScopes: [CLOUD_PLATFORM_SCOPE, ...EXTRA_GOOGLE_SCOPES],
+	    });
+	}
+	function createAuthClient(credentials) {
+	    if (!credentials.impersonateServiceAccount || credentials.accessToken) {
+	        return undefined;
+	    }
+	    const sourceAuth = new google_auth_library_1.GoogleAuth({
+	        credentials: credentials.credentials && JSON.parse(credentials.credentials),
+	        scopes: [CLOUD_PLATFORM_SCOPE],
+	    });
+	    return createImpersonatedClient(credentials.impersonateServiceAccount, new DeferredAuthClient(() => sourceAuth.getClient()));
+	}
+	function bigQueryClientOptions(credentials, projectId, authClient) {
 	    const base = {
 	        projectId,
 	        scopes: EXTRA_GOOGLE_SCOPES,
 	        location: credentials.location || undefined,
 	    };
 	    if (credentials.accessToken) {
-	        const authClient = new google_auth_library_1.OAuth2Client();
-	        authClient.setCredentials({ access_token: credentials.accessToken });
-	        return Object.assign(Object.assign({}, base), { authClient: authClient });
+	        const tokenClient = new google_auth_library_1.OAuth2Client();
+	        tokenClient.setCredentials({ access_token: credentials.accessToken });
+	        return Object.assign(Object.assign({}, base), { authClient: tokenClient });
+	    }
+	    if (authClient) {
+	        return Object.assign(Object.assign({}, base), { authClient });
 	    }
 	    return Object.assign(Object.assign({}, base), { credentials: credentials.credentials ? JSON.parse(credentials.credentials) : undefined });
 	}
@@ -57009,10 +57071,11 @@ function requireBigquery () {
 	const BIGQUERY_INTERNAL_ERROR_JOB_MAX_ATTEMPTS = 3;
 	function createBigQueryClientProvider(credentials) {
 	    const clients = new Map();
+	    const authClient = createAuthClient(credentials);
 	    return (projectId) => {
 	        projectId = projectId || credentials.projectId;
 	        if (!clients.has(projectId)) {
-	            clients.set(projectId, new bigquery_1.BigQuery(bigQueryClientOptions(credentials, projectId)));
+	            clients.set(projectId, new bigquery_1.BigQuery(bigQueryClientOptions(credentials, projectId, authClient)));
 	        }
 	        return clients.get(projectId);
 	    };
@@ -58033,6 +58096,7 @@ function requireBigquery_extract () {
 	        projectId: spec.billingProject || spec.project,
 	        location: conn.location,
 	        accessToken: conn.accessToken,
+	        impersonateServiceAccount: conn.impersonateServiceAccount,
 	        credentials: conn.credentials,
 	    }));
 	    const rowCap = (_d = args.rowCap) !== null && _d !== void 0 ? _d : DEFAULT_ROW_CAP;
@@ -64948,25 +65012,22 @@ function requireCredentials () {
 	const fs = __importStar(require$$0$5);
 	const console_1 = requireConsole();
 	const util_1 = requireUtil();
-	function getBigQueryCredentials() {
-	    const locationIndex = (0, console_1.selectionQuestion)("Enter the location of your datasets:", [
+	function getBigQueryCredentials(prompts = { question: console_1.question, selectionQuestion: console_1.selectionQuestion }) {
+	    const locationIndex = prompts.selectionQuestion("Enter the location of your datasets:", [
 	        "US (default)",
 	        "EU",
 	        "other",
 	    ]);
 	    let location = locationIndex === 0 ? "US" : "EU";
 	    if (locationIndex === 2) {
-	        location = (0, console_1.question)("Enter the location's region name (e.g. 'asia-south1'):");
+	        location = prompts.question("Enter the location's region name (e.g. 'asia-south1'):");
 	    }
-	    const isApplicationDefaultOrJSONKeyIndex = (0, console_1.selectionQuestion)("Do you wish to use Application Default Credentials or JSON Key:", ["ADC (default)", "JSON Key"]);
+	    const isApplicationDefaultOrJSONKeyIndex = prompts.selectionQuestion("Do you wish to use Application Default Credentials or JSON Key:", ["ADC (default)", "JSON Key"]);
 	    if (isApplicationDefaultOrJSONKeyIndex === 0) {
-	        const projectId = (0, console_1.question)("Enter your billing project ID:");
-	        return {
-	            projectId,
-	            location,
-	        };
+	        const projectId = prompts.question("Enter your billing project ID:");
+	        return withServiceAccountToImpersonate({ projectId, location }, prompts);
 	    }
-	    const cloudCredentialsPath = (0, util_1.actuallyResolve)((0, console_1.question)("Follow instructions for creating a service account key for BigQuery access\n" +
+	    const cloudCredentialsPath = (0, util_1.actuallyResolve)(prompts.question("Follow instructions for creating a service account key for BigQuery access\n" +
 	        "(see https://cloud.google.com/iam/docs/keys-create-delete) and download as JSON.\n" +
 	        "(You can delete this file after credential initialization is complete.)\n\n" +
 	        "Enter the path to your Google Cloud private key file:"));
@@ -64974,11 +65035,17 @@ function requireCredentials () {
 	        throw new Error(`Google Cloud private key file "${cloudCredentialsPath}" does not exist!`);
 	    }
 	    const cloudCredentials = JSON.parse(fs.readFileSync(cloudCredentialsPath, "utf8"));
-	    return {
+	    return withServiceAccountToImpersonate({
 	        projectId: cloudCredentials.project_id,
 	        credentials: fs.readFileSync(cloudCredentialsPath, "utf8"),
 	        location,
-	    };
+	    }, prompts);
+	}
+	function withServiceAccountToImpersonate(credentials, prompts) {
+	    const impersonateServiceAccount = prompts
+	        .question("Enter a service account to impersonate (optional, press Enter to skip):")
+	        .trim();
+	    return impersonateServiceAccount ? Object.assign(Object.assign({}, credentials), { impersonateServiceAccount }) : credentials;
 	}
 	
 	return credentials;

package/package.json

@@ -6,7 +6,7 @@
         "deepmerge": "^4.2.2",
         "fs-extra": "^9.0.0",
         "glob": "13.0.6",
-        "google-auth-library": "^9.15.1",
+        "google-auth-library": "^10.9.1",
         "google-sql-syntax-ts": "^1.0.3",
         "js-beautify": "1.15.4",
         "js-yaml": "^4.3.2",
@@ -90,7 +90,7 @@
     "engines": {
         "node": "^20.19.0 || >=22.12.0"
     },
-    "version": "1.35.0",
+    "version": "1.36.0",
     "name": "@sqlanvil/cli",
     "description": "sqlanvil command line interface.",
     "main": "bundle.js"

package/worker_bundle.js

@@ -49746,6 +49746,7 @@ function requireTs () {
 		             * @property {string|null} [credentials] BigQuery credentials
 		             * @property {string|null} [location] BigQuery location
 		             * @property {string|null} [accessToken] BigQuery accessToken
+		             * @property {string|null} [impersonateServiceAccount] BigQuery impersonateServiceAccount
 		             */
 		    
 		            /**
@@ -49795,6 +49796,14 @@ function requireTs () {
 		             */
 		            BigQuery.prototype.accessToken = "";
 		    
+		            /**
+		             * BigQuery impersonateServiceAccount.
+		             * @member {string} impersonateServiceAccount
+		             * @memberof sqlanvil.BigQuery
+		             * @instance
+		             */
+		            BigQuery.prototype.impersonateServiceAccount = "";
+		    
 		            /**
 		             * Creates a new BigQuery instance using the specified properties.
 		             * @function create
@@ -49831,6 +49840,8 @@ function requireTs () {
 		                    writer.uint32(/* id 4, wireType 2 =*/34).string(message.location);
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    writer.uint32(/* id 5, wireType 2 =*/42).string(message.accessToken);
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    writer.uint32(/* id 6, wireType 2 =*/50).string(message.impersonateServiceAccount);
 		                return writer;
 		            };
 		    
@@ -49897,6 +49908,10 @@ function requireTs () {
 		                            message.accessToken = reader.string();
 		                            break;
 		                        }
+		                    case 6: {
+		                            message.impersonateServiceAccount = reader.string();
+		                            break;
+		                        }
 		                    default:
 		                        reader.skipType(tag & 7, long);
 		                        break;
@@ -49953,6 +49968,9 @@ function requireTs () {
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    if (!$util.isString(message.accessToken))
 		                        return "accessToken: string expected";
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    if (!$util.isString(message.impersonateServiceAccount))
+		                        return "impersonateServiceAccount: string expected";
 		                return null;
 		            };
 		    
@@ -49982,6 +50000,8 @@ function requireTs () {
 		                    message.location = String(object.location);
 		                if (object.accessToken != null)
 		                    message.accessToken = String(object.accessToken);
+		                if (object.impersonateServiceAccount != null)
+		                    message.impersonateServiceAccount = String(object.impersonateServiceAccount);
 		                return message;
 		            };
 		    
@@ -50007,6 +50027,7 @@ function requireTs () {
 		                    object.credentials = "";
 		                    object.location = "";
 		                    object.accessToken = "";
+		                    object.impersonateServiceAccount = "";
 		                }
 		                if (message.projectId != null && Object.hasOwnProperty.call(message, "projectId"))
 		                    object.projectId = message.projectId;
@@ -50016,6 +50037,8 @@ function requireTs () {
 		                    object.location = message.location;
 		                if (message.accessToken != null && Object.hasOwnProperty.call(message, "accessToken"))
 		                    object.accessToken = message.accessToken;
+		                if (message.impersonateServiceAccount != null && Object.hasOwnProperty.call(message, "impersonateServiceAccount"))
+		                    object.impersonateServiceAccount = message.impersonateServiceAccount;
 		                return object;
 		            };