@superblocksteam/shared 0.9618.2 → 0.9619.0

package/dist-esm/types/credentials/index.d.ts

@@ -1,253 +0,0 @@
-/**
- * Per-organization credential payloads, shared between server and UI.
- *
- * A credential row is canonically identified by the
- * `(role, backend, auth_method)` tuple; the schema stores the tuple,
- * not a dotted-string discriminator. The dotted form
- * `<role>.<backend>.<auth-method>` clients see in `type` is a derived
- * label projected from the tuple at DTO-build time. Always 3 segments
- * — even when a backend has a single canonical auth method, it's
- * recorded explicitly so the wire format and the schema stay in
- * lockstep without a per-backend special case.
- *
- * Each row carries `{ secrets, metadata }`. The database enforces the
- * split at the column level: `secrets` is encrypted, `metadata` is
- * plaintext jsonb. The union below forces every new field to pick a
- * side at authoring time — a future column cannot accidentally stuff
- * a secret into `metadata` without the TS compiler flagging it,
- * because the keys in each variant's `metadata` are fixed.
- *
- * The registry (`packages/server/src/db/repository/credential/registry.ts`)
- * owns the matching zod validators, the runtime-plaintext-location
- * pin, and the cardinality (`'singleton' | 'multi' | 'per-user'`).
- * This file only expresses the shape both sides of the wire agree on.
- *
- *  - `provisioning.*` — admin credentials a worker uses to create
- *    per-app logical databases in a customer's cloud.
- *  - `inference.*` — credentials used to call a managed inference API
- *    (Snowflake Cortex REST API, Databricks AI Gateway). Non-singleton
- *    so an org can keep separate dev/prod rows.
- *  - reserved: `authoring.*`, `runtime.*`, `connection.*`, `pat.*`,
- *    `trust.*`, `generator.*`.
- *
- * Trust and generator payload variants don't appear in the union yet —
- * those land in the followup PR alongside their registry entries. The
- * schema (and the CHECK constraint allowing `class IN ('stored', 'trust',
- * 'generator')`) already supports them so the followup is registry-only.
- */
-/**
- * Secrets shape for `provisioning.snowflake.pat` and
- * `inference.snowflake-cortex.pat`. Snowflake accepts either a
- * programmatic access token (used as the `password` for `snowflake-sdk`,
- * or as a bearer token against the REST API) or an RSA private key used
- * to sign a short-lived JWT. Consumers branch on which shape is present.
- *
- * Note that the dotted label says `pat` even when the keypair branch is
- * used; `pat` here is the identifier of the auth-method *family*,
- * because Snowflake exposes both as a single endpoint that consumes a
- * bearer token (the keypair JWT and the literal PAT are interchangeable
- * at the request level). When a true second auth method lands (e.g.
- * OAuth M2M) it gets its own tuple with a distinct auth_method segment.
- */
-export type SnowflakeSecrets = {
-    pat: string;
-} | {
-    privateKey: string;
-    privateKeyPassphrase?: string;
-};
-export type ProvisioningLakebasePayload = {
-    type: 'provisioning.lakebase.pat';
-    secrets: {
-        pat: string;
-    };
-    metadata: {
-        workspaceUrl?: string;
-        adminHost?: string;
-        adminPort?: number;
-        adminUsername?: string;
-        sslMode?: string;
-    };
-};
-export type ProvisioningSnowflakePayload = {
-    type: 'provisioning.snowflake.pat';
-    secrets: SnowflakeSecrets;
-    metadata: {
-        account: string;
-        username: string;
-        warehouse?: string;
-        role?: string;
-        schema?: string;
-        databasePrefix?: string;
-    };
-};
-/**
- * Credentials used to call the Snowflake Cortex REST API. Same secret
- * shapes as `provisioning.snowflake.pat` — the REST API accepts either
- * a long-lived PAT as a bearer token or a short-lived JWT signed with
- * an RSA private key. `cardinality: 'multi'` in the registry because
- * orgs will plausibly want separate dev / prod Cortex identities.
- */
-export type InferenceSnowflakeCortexPayload = {
-    type: 'inference.snowflake-cortex.pat';
-    secrets: SnowflakeSecrets;
-    metadata: {
-        /** Snowflake account identifier, e.g. `xy12345.us-east-1`. */
-        account: string;
-        /** Service user whose PAT or public key is installed on the Snowflake side. */
-        username: string;
-        /** Role the PAT is scoped to / the JWT should assume at call time. */
-        role?: string;
-    };
-};
-/**
- * Databricks AI Gateway credential. AI Gateway only accepts Programmatic
- * Access Tokens (PATs) as bearer credentials — there is no keypair or
- * OAuth path comparable to Snowflake Cortex. `gatewayHost` is either the
- * Anthropic-compatible AI Gateway origin or a workspace AI Gateway
- * Anthropic messages URL, both validated at the registry.
- */
-export type InferenceDatabricksAiGatewayPayload = {
-    type: 'inference.databricks-ai-gateway.pat';
-    secrets: {
-        pat: string;
-    };
-    metadata: {
-        /**
-         * AI Gateway origin, e.g. `https://<gateway-name>.ai-gateway.cloud.databricks.com`,
-         * or workspace Anthropic messages URL, e.g.
-         * `https://<your-databricks-workspace-url>/ai-gateway/anthropic/v1/messages`.
-         */
-        gatewayHost: string;
-    };
-};
-export type CredentialPayload = ProvisioningLakebasePayload | ProvisioningSnowflakePayload | InferenceSnowflakeCortexPayload | InferenceDatabricksAiGatewayPayload;
-export type CredentialType = CredentialPayload['type'];
-/**
- * All known `<role>` prefixes. Used by callers to filter credentials by
- * role (e.g. "list all provisioning credentials for this org"). Includes
- * reserved-but-unused roles so adding a new one later is a registry +
- * union change rather than a cross-cutting rename.
- *
- * `trust` and `generator` are reserved for the credential-class taxonomy
- * (see `CredentialClass` below): trust-config rows like
- * `trust.aws.iam-role-assume` will claim `role: 'trust'`, generator rows
- * like `generator.snowflake.keypair-jwt` will claim `role: 'generator'`.
- * They are not yet populated in the registry — these reserved values
- * just keep the `(class, role, backend, auth_method)` tuple consistent
- * so the followup PR's registrations are a code-only change.
- */
-export declare const CREDENTIAL_ROLES: readonly ["provisioning", "authoring", "runtime", "connection", "inference", "pat", "trust", "generator"];
-export type CredentialRole = (typeof CREDENTIAL_ROLES)[number];
-/**
- * Three credential classes, recorded on every row of the `credential`
- * table:
- *   - `stored`     — encrypted secret bytes are the credential
- *                    (PATs, RSA private keys held for JWT signing).
- *   - `trust`      — the credential is a trust assertion held in
- *                    `metadata`; `encrypted_secrets` is NULL. The DB's
- *                    `chk_credential_secrets_class` CHECK constraint
- *                    enforces this.
- *   - `generator`  — encrypted bytes are *generator material* (OAuth
- *                    client_id+secret, RSA keypair) used to mint a
- *                    short-lived runtime token. The minted token is
- *                    never persisted; only the cache key tuple
- *                    (orgId, credentialId, fingerprint, derivationKey)
- *                    is.
- *
- * The class is denormalized onto the row so query paths can branch on
- * it without joining the registry, and so the schema CHECK constraint
- * can enforce the secrets-vs-no-secrets invariant. Only `'stored'`
- * entries are registered today; `'trust'` and `'generator'` are
- * reserved by the schema and the type system, awaiting their registry
- * additions in the followup PR.
- */
-export declare const CREDENTIAL_CLASSES: readonly ["stored", "trust", "generator"];
-export type CredentialClass = (typeof CREDENTIAL_CLASSES)[number];
-/**
- * The process where a credential's plaintext (or its derived runtime
- * token, for generator credentials) may legitimately exist.
- *
- *   - `server`        — the Superblocks control plane.
- *   - `orchestrator`  — the customer's On-Premise Agent.
- *   - `worker`        — the orchestrator's per-language sandboxed
- *                       worker process (Go/JS/Python).
- *   - `customer-sm`   — held in the customer's own secret manager
- *                       (AWS Secrets Manager, GCP Secret Manager,
- *                       Vault); the Superblocks control plane never
- *                       touches it. Reserved.
- *
- * The repository's `assertProcessCanHandle` guard reads a process-level
- * `PROCESS_LOCATION` constant and rejects with
- * `WrongProcessForCredentialError` if a row's
- * `runtimePlaintextLocation` excludes the current process. Replaces
- * the implicit "this code path lives server-side, so the secret must
- * be decryptable here" convention with a typed check.
- */
-export declare const RUNTIME_PLAINTEXT_LOCATIONS: readonly ["server", "orchestrator", "worker", "customer-sm"];
-export type RuntimePlaintextLocation = (typeof RUNTIME_PLAINTEXT_LOCATIONS)[number];
-/**
- * Format a `(role, backend, authMethod)` tuple into the dotted
- * `CredentialType` label that clients see on the wire. The schema
- * stores the tuple; this is the canonical projection for DTOs and
- * registry-by-label lookups. Always 3 segments.
- */
-export declare function formatCredentialType(role: string, backend: string, authMethod: string): CredentialType;
-/**
- * Inverse of `formatCredentialType`. Returns `null` when the input
- * doesn't have exactly three dotted segments — the caller decides
- * whether that's a hard error or a soft signal. Backend and auth-method
- * identifiers may contain hyphens but never dots, so a length-3 split
- * is unambiguous.
- */
-export declare function parseCredentialType(type: string): {
-    role: string;
-    backend: string;
-    authMethod: string;
-} | null;
-/**
- * Convenience: extract the role segment of a `CredentialType`. The
- * full tuple round-trip is `parseCredentialType`.
- */
-export declare function credentialRole(type: CredentialType): CredentialRole;
-/**
- * Non-secret projection returned from list / GET endpoints. Never contains
- * `secrets`. `metadata` is the same shape the client POSTed under that key.
- *
- * `class`, `role`, `backend`, `authMethod`, and `runtimePlaintextLocation`
- * come from columns on the row (the canonical tuple plus the registry-
- * pinned class and process-location). `type` is the dotted label
- * projected from `(role, backend, authMethod)` — kept on the DTO as
- * an API-stable identifier so existing clients don't have to assemble
- * it themselves.
- */
-export interface CredentialDto {
-    id: string;
-    organizationId: string;
-    /** Derived label `${role}.${backend}.${authMethod}`; not stored. */
-    type: CredentialType;
-    /** `null` when the registry marks the tuple as a singleton. */
-    name: string | null;
-    metadata: CredentialPayload['metadata'];
-    /** First 8 hex of SHA-256 over the decrypted secrets object at write time. */
-    fingerprint: string;
-    /** See `CredentialClass`. Pinned by the registry on write. */
-    class: CredentialClass;
-    /** See `CREDENTIAL_ROLES`. First segment of the canonical tuple. */
-    role: CredentialRole;
-    /** Short backend identifier, e.g. `lakebase`, `snowflake`, `aws`. */
-    backend: string;
-    /** Short auth-method identifier, e.g. `pat`, `keypair`, `oauth-m2m`. */
-    authMethod: string;
-    /** See `RuntimePlaintextLocation`. Pinned by the registry on write. */
-    runtimePlaintextLocation: RuntimePlaintextLocation;
-    createdAt: string;
-    updatedAt: string;
-    createdBy: string | null;
-}
-export interface UpsertCredentialRequest {
-    type: CredentialType;
-    name?: string | null;
-    secrets: CredentialPayload['secrets'];
-    metadata: CredentialPayload['metadata'];
-}
-//# sourceMappingURL=index.d.ts.map

package/dist-esm/types/credentials/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvG,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,QAAQ,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,IAAI,EAAE,4BAA4B,CAAC;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,gCAAgC,CAAC;IACvC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE;QACR,8DAA8D;QAC9D,OAAO,EAAE,MAAM,CAAC;QAChB,+EAA+E;QAC/E,QAAQ,EAAE,MAAM,CAAC;QACjB,sEAAsE;QACtE,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mCAAmC,GAAG;IAChD,IAAI,EAAE,qCAAqC,CAAC;IAC5C,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,QAAQ,EAAE;QACR;;;;WAIG;QACH,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB,2BAA2B,GAC3B,4BAA4B,GAC5B,+BAA+B,GAC/B,mCAAmC,CAAC;AAExC,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,2GAA4G,CAAC;AAC1I,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,2CAA4C,CAAC;AAC5E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,8DAA+D,CAAC;AACxG,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,CAEtG;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM9G;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAEnE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,IAAI,EAAE,cAAc,CAAC;IACrB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAC;IACvB,oEAAoE;IACpE,IAAI,EAAE,cAAc,CAAC;IACrB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,wBAAwB,EAAE,wBAAwB,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACtC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CACzC"}

package/dist-esm/types/credentials/index.js

@@ -1,128 +0,0 @@
-/**
- * Per-organization credential payloads, shared between server and UI.
- *
- * A credential row is canonically identified by the
- * `(role, backend, auth_method)` tuple; the schema stores the tuple,
- * not a dotted-string discriminator. The dotted form
- * `<role>.<backend>.<auth-method>` clients see in `type` is a derived
- * label projected from the tuple at DTO-build time. Always 3 segments
- * — even when a backend has a single canonical auth method, it's
- * recorded explicitly so the wire format and the schema stay in
- * lockstep without a per-backend special case.
- *
- * Each row carries `{ secrets, metadata }`. The database enforces the
- * split at the column level: `secrets` is encrypted, `metadata` is
- * plaintext jsonb. The union below forces every new field to pick a
- * side at authoring time — a future column cannot accidentally stuff
- * a secret into `metadata` without the TS compiler flagging it,
- * because the keys in each variant's `metadata` are fixed.
- *
- * The registry (`packages/server/src/db/repository/credential/registry.ts`)
- * owns the matching zod validators, the runtime-plaintext-location
- * pin, and the cardinality (`'singleton' | 'multi' | 'per-user'`).
- * This file only expresses the shape both sides of the wire agree on.
- *
- *  - `provisioning.*` — admin credentials a worker uses to create
- *    per-app logical databases in a customer's cloud.
- *  - `inference.*` — credentials used to call a managed inference API
- *    (Snowflake Cortex REST API, Databricks AI Gateway). Non-singleton
- *    so an org can keep separate dev/prod rows.
- *  - reserved: `authoring.*`, `runtime.*`, `connection.*`, `pat.*`,
- *    `trust.*`, `generator.*`.
- *
- * Trust and generator payload variants don't appear in the union yet —
- * those land in the followup PR alongside their registry entries. The
- * schema (and the CHECK constraint allowing `class IN ('stored', 'trust',
- * 'generator')`) already supports them so the followup is registry-only.
- */
-/**
- * All known `<role>` prefixes. Used by callers to filter credentials by
- * role (e.g. "list all provisioning credentials for this org"). Includes
- * reserved-but-unused roles so adding a new one later is a registry +
- * union change rather than a cross-cutting rename.
- *
- * `trust` and `generator` are reserved for the credential-class taxonomy
- * (see `CredentialClass` below): trust-config rows like
- * `trust.aws.iam-role-assume` will claim `role: 'trust'`, generator rows
- * like `generator.snowflake.keypair-jwt` will claim `role: 'generator'`.
- * They are not yet populated in the registry — these reserved values
- * just keep the `(class, role, backend, auth_method)` tuple consistent
- * so the followup PR's registrations are a code-only change.
- */
-export const CREDENTIAL_ROLES = ['provisioning', 'authoring', 'runtime', 'connection', 'inference', 'pat', 'trust', 'generator'];
-/**
- * Three credential classes, recorded on every row of the `credential`
- * table:
- *   - `stored`     — encrypted secret bytes are the credential
- *                    (PATs, RSA private keys held for JWT signing).
- *   - `trust`      — the credential is a trust assertion held in
- *                    `metadata`; `encrypted_secrets` is NULL. The DB's
- *                    `chk_credential_secrets_class` CHECK constraint
- *                    enforces this.
- *   - `generator`  — encrypted bytes are *generator material* (OAuth
- *                    client_id+secret, RSA keypair) used to mint a
- *                    short-lived runtime token. The minted token is
- *                    never persisted; only the cache key tuple
- *                    (orgId, credentialId, fingerprint, derivationKey)
- *                    is.
- *
- * The class is denormalized onto the row so query paths can branch on
- * it without joining the registry, and so the schema CHECK constraint
- * can enforce the secrets-vs-no-secrets invariant. Only `'stored'`
- * entries are registered today; `'trust'` and `'generator'` are
- * reserved by the schema and the type system, awaiting their registry
- * additions in the followup PR.
- */
-export const CREDENTIAL_CLASSES = ['stored', 'trust', 'generator'];
-/**
- * The process where a credential's plaintext (or its derived runtime
- * token, for generator credentials) may legitimately exist.
- *
- *   - `server`        — the Superblocks control plane.
- *   - `orchestrator`  — the customer's On-Premise Agent.
- *   - `worker`        — the orchestrator's per-language sandboxed
- *                       worker process (Go/JS/Python).
- *   - `customer-sm`   — held in the customer's own secret manager
- *                       (AWS Secrets Manager, GCP Secret Manager,
- *                       Vault); the Superblocks control plane never
- *                       touches it. Reserved.
- *
- * The repository's `assertProcessCanHandle` guard reads a process-level
- * `PROCESS_LOCATION` constant and rejects with
- * `WrongProcessForCredentialError` if a row's
- * `runtimePlaintextLocation` excludes the current process. Replaces
- * the implicit "this code path lives server-side, so the secret must
- * be decryptable here" convention with a typed check.
- */
-export const RUNTIME_PLAINTEXT_LOCATIONS = ['server', 'orchestrator', 'worker', 'customer-sm'];
-/**
- * Format a `(role, backend, authMethod)` tuple into the dotted
- * `CredentialType` label that clients see on the wire. The schema
- * stores the tuple; this is the canonical projection for DTOs and
- * registry-by-label lookups. Always 3 segments.
- */
-export function formatCredentialType(role, backend, authMethod) {
-    return `${role}.${backend}.${authMethod}`;
-}
-/**
- * Inverse of `formatCredentialType`. Returns `null` when the input
- * doesn't have exactly three dotted segments — the caller decides
- * whether that's a hard error or a soft signal. Backend and auth-method
- * identifiers may contain hyphens but never dots, so a length-3 split
- * is unambiguous.
- */
-export function parseCredentialType(type) {
-    const parts = type.split('.');
-    if (parts.length !== 3) {
-        return null;
-    }
-    return { role: parts[0], backend: parts[1], authMethod: parts[2] };
-}
-/**
- * Convenience: extract the role segment of a `CredentialType`. The
- * full tuple round-trip is `parseCredentialType`.
- */
-export function credentialRole(type) {
-    return type.split('.')[0];
-}
-//# sourceMappingURL=index.js.map

package/dist-esm/types/credentials/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/credentials/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA2FH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAG1I;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAGxG;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAe,EAAE,UAAkB;IACpF,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,UAAU,EAAoB,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAmB,CAAC;AAC9C,CAAC"}

package/dist-esm/types/datasource/auth.d.ts

@@ -1,293 +0,0 @@
-import { ClientAuthMethod } from '../../plugins/index.js';
-import { OAuthErrorResponse, OAuthTokenResponse } from '../auth/index.js';
-import { Property } from '../common/property.js';
-export declare const OAUTH_CALLBACK_PATH = "oauth/callback";
-export declare const LS_OAUTH_DATASOURCE_KEY = "oauth-datasource";
-export declare const LS_OAUTH_ENV_KEY = "oauth-env";
-export declare const LS_OAUTH_ERROR_KEY = "oauth-error";
-export declare const LS_OAUTH_ONE_TIME_CODE = "oauth-one-time-code";
-export declare const LS_OAUTH_REDIRECT_FINISHED = "oauth-redirect-finished";
-export declare const LS_FULL_STATE = "oauth-full-state";
-export declare function getOAuthCodeVerifierStorageKey(oneTimeCode: string): string;
-/**
- * Persisted integration configuration stores some booleans as strings or
- * numbers, because form controls and older writers coerced them on the way in
- * (hence the `FakeBoolean` fields below). Returns the boolean such a value
- * stands for, or `undefined` when it stands for neither and the caller has to
- * decide what an unrecognized value means.
- */
-export declare function asFakeBoolean(value: unknown): boolean | undefined;
-/**
- * `usePkce` is typed as a boolean but reaches us from persisted integration
- * configuration, where a form checkbox can store it as the string `'true'`.
- * Every read of the flag goes through this predicate so that no two call
- * sites disagree about whether PKCE is on.
- */
-export declare function isPkceEnabled(usePkce: unknown): boolean;
-export type AuthId = string;
-export declare function getAuthId(authType: AuthType | undefined, authConfig: AuthConfig | undefined, integrationId?: string, integrationConfigurationId?: string): AuthId;
-export declare function getAuthIdCandidates(authType: AuthType | undefined, authConfig: AuthConfig | undefined, integrationId?: string, integrationConfigurationId?: string): AuthId[];
-export declare enum IntegrationAuthType {
-    NONE = "None",
-    BASIC = "basic",
-    OAUTH2_CODE = "oauth-code",
-    OAUTH2_CLIENT_CREDS = "oauth-client-cred",
-    OAUTH2_IMPLICIT = "oauth-implicit",
-    OAUTH2_PASSWORD = "oauth-pword",
-    OAUTH2_TOKEN_EXCHANGE = "oauth-token-exchange",
-    OAUTH2_TOKEN_EXCHANGE_PROTO = "oauthTokenExchange",
-    /** Passes the user's SSO IdP access token through as {{ oauth.token }} — no OAuth client config needed. */
-    OAUTH2_IDP_TOKEN_PASSTHROUGH = "oauth-idp-token-passthrough",
-    FIREBASE = "Firebase",
-    BEARER = "bearer",
-    API_KEY = "api-key",
-    TOKEN_PREFIXED = "token-prefixed",
-    API_KEY_FORM = "api-key-form"
-}
-export declare enum NewAuthType {
-    OAUTH2_PASSWORD_GRANT_FLOW = "passwordGrantFlow",
-    OAUTH2_AUTH_CODE_FLOW = "authorizationCodeFlow",
-    OAUTH2_CLIENT_CREDS_FLOW = "clientCredentialsFlow",
-    OAUTH2_TOKEN_EXCHANGE_FLOW = "tokenExchangeFlow"
-}
-export declare function isRedirectRequired(authType: AuthType | undefined): boolean;
-export declare const IntegrationAuthHeaderPrefixMap: {
-    basic: string;
-    bearer: string;
-    "oauth-code": string;
-    "token-prefixed": string;
-};
-export declare enum ApiKeyMethod {
-    HEADER = "header",
-    QUERY_PARAM = "query-param"
-}
-export declare enum GoogleSheetsAuthType {
-    OAUTH2_CODE = "oauth-code",
-    SERVICE_ACCOUNT = "service-account"
-}
-export declare enum AWSAuthType {
-    ACCESS_KEY = "access-key",
-    TOKEN_FILE = "token-file",
-    EC2_INSTANCE_METADATA = "ec2-instance-metadata"
-}
-export declare enum PostgresAuthType {
-    AWS_IAM_ROLE = "aws_iam_role",
-    PASSWORD = "password"
-}
-export declare function getAWSAuthTypeDisplayName(authType: AWSAuthType): string;
-declare enum DatabaseAuthType {
-    URL = "url",
-    FIELDS = "fields",
-    OKTA = "okta",
-    KEY_PAIR = "key-pair"
-}
-export type AuthType = IntegrationAuthType | GoogleSheetsAuthType | NewAuthType | DatabaseAuthType;
-export declare function getDisplayName(authType: AuthType): string;
-type PublicFirebaseAuthConfig = {
-    apiKey?: string;
-    google?: boolean;
-    email?: boolean;
-};
-type FirebaseAuthConfig = PublicFirebaseAuthConfig;
-type PublicOAuthConfig = PublicOAuthPasswordConfig & PublicOAuthClientCredsConfig & PublicOAuthImplicitConfig & PublicOAuthCodeConfig & PublicOAuthTokenExchangeConfig;
-type OAuthConfig = OAuthPasswordConfig & OAuthClientCredsConfig & OAuthImplicitConfig & OAuthCodeConfig & OAuthBringYourOwnClientConfig & OAuthTokenExchangeConfig;
-type PublicOAuthPasswordConfig = {
-    clientId?: string;
-    tokenUrl?: string;
-    useFixedPasswordCreds?: boolean;
-};
-type OAuthPasswordConfig = PublicOAuthPasswordConfig & {
-    clientSecret?: string;
-    username?: string;
-    password?: string;
-};
-type PublicOAuthClientCredsConfig = {
-    clientId?: string;
-    tokenUrl?: string;
-    scope?: string;
-};
-type OAuthClientCredsConfig = PublicOAuthClientCredsConfig & {
-    clientSecret?: string;
-    audience?: string;
-    clientAuthMethod?: ClientAuthMethod;
-};
-type PublicOAuthImplicitConfig = {
-    clientId?: string;
-    authorizationUrl?: string;
-    scope?: string;
-};
-type OAuthImplicitConfig = PublicOAuthImplicitConfig & {
-    clientSecret?: string;
-};
-type PublicOAuthTokenExchangeConfig = {
-    tokenUrl?: string;
-    audience?: string;
-    scope?: string;
-    subjectTokenSource?: string;
-    subjectTokenSourceStaticToken?: string;
-    subjectTokenType?: string;
-    clientId?: string;
-};
-export type OAuthTokenExchangeConfig = PublicOAuthTokenExchangeConfig & {
-    clientSecret?: string;
-};
-type PublicOAuthCodeConfig = {
-    clientId?: string;
-    authorizationUrl?: string;
-    authUrl?: string;
-    userInfoUrl?: string;
-    tokenUrl?: string;
-    scope?: string;
-    audience?: string;
-    promptType?: string;
-    refreshTokenFromServer?: boolean;
-    tokenScope?: TokenScope;
-    revokeTokenUrl?: string;
-    authToken?: string;
-    hasToken?: boolean;
-    userEmail?: string;
-    sendOAuthState?: boolean;
-    usePkce?: boolean;
-    usePkceClientSecret?: boolean;
-};
-type OAuthCodeConfig = Omit<PublicOAuthCodeConfig, 'usePkce' | 'usePkceClientSecret'> & {
-    clientSecret?: string;
-    usePkce?: FakeBoolean;
-    usePkceClientSecret?: FakeBoolean;
-};
-export declare enum TokenScope {
-    DATASOURCE = "datasource",
-    USER = "user"
-}
-type OAuthBringYourOwnClientConfig = {
-    tokenUrl?: string;
-    authorizationUrl?: string;
-    revokeTokenUrl?: string;
-    clientSecret?: string;
-    clientAuthMethod?: ClientAuthMethod;
-};
-export declare enum TokenType {
-    REFRESH = "refresh",
-    USER = "userId",
-    ACCESS = "token",
-    ID = "id-token"
-}
-export type TokenMetadata = {
-    email?: string;
-    issuerHost?: string;
-};
-type FakeBoolean = boolean | string;
-type BasicAuthConfig = PublicBasicAuthConfig & {
-    username?: string;
-    password?: string;
-};
-type PublicBasicAuthConfig = {
-    shareBasicAuthCreds?: FakeBoolean;
-};
-type BearerTokenAuthConfig = {
-    bearerToken?: string;
-};
-type TokenPrefixedAuthConfig = {
-    prefix?: string;
-    token?: string;
-};
-type ApiKeyFormAuthConfig = {
-    apiKeys?: Record<string, {
-        header?: string;
-        prefix?: string;
-        token?: string;
-    }>;
-};
-type ApiKeyAuthConfig = {
-    key?: string;
-    value?: string;
-    method?: ApiKeyMethod;
-};
-export declare const PUBLIC_SECRET_PLACEHOLDER = "<redacted>";
-export declare const extractPublic: (authType: AuthType | undefined, authConfig: AuthConfig | undefined) => PublicAuthConfig;
-type ServiceAccountConfig = {
-    googleServiceAccount?: Property;
-};
-type PublicRestAuthConfig = PublicBasicAuthConfig & PublicOAuthConfig & PublicFirebaseAuthConfig;
-type PublicGoogleSheetsAuthConfig = PublicOAuthCodeConfig;
-type PublicAuthConfig = PublicRestAuthConfig & PublicGoogleSheetsAuthConfig;
-type RestAuthConfig = BasicAuthConfig & OAuthConfig & FirebaseAuthConfig & BearerTokenAuthConfig & TokenPrefixedAuthConfig & ApiKeyFormAuthConfig & ApiKeyAuthConfig;
-type GoogleSheetsAuthConfig = OAuthCodeConfig & ServiceAccountConfig;
-export type AuthConfig = RestAuthConfig & GoogleSheetsAuthConfig;
-export type ExchangeCodeRequest = {
-    authId: AuthId;
-    authType: AuthType;
-    authConfig: AuthConfig;
-    accessCode: string;
-    pluginId: string;
-    origin: string;
-    grantedScope: string | null;
-    integrationId: string | undefined;
-    configurationId: string | undefined;
-};
-export type ExchangeCodeResponse = {
-    successful: boolean;
-    error?: string;
-};
-export declare function isExchangeCodeResponse(obj: ExchangeCodeResponse | {
-    success: boolean;
-    result?: void;
-    error?: string | undefined;
-}): obj is ExchangeCodeResponse;
-export type RequestTokenRequest = {
-    datasourceId: string;
-    username: string;
-    password: string;
-    environment?: string;
-};
-export type RequestTokenResponse = OAuthTokenResponse & OAuthErrorResponse & {
-    expirationTimestamp?: number;
-};
-export type DatasourceAuthState = DatasourceOneTimeState & {
-    integrationId: string;
-    configurationId: string;
-    pluginId: string;
-    authType: AuthType;
-    authId: string;
-    authConfig: {
-        refreshTokenFromServer?: boolean;
-        clientId: string;
-        clientSecret: string;
-        tokenUrl: string;
-        authorizationUrl: string;
-        userInfoUrl?: string;
-        tokenScope: TokenScope;
-        scope: string | undefined;
-        clientAuthMethod?: ClientAuthMethod;
-        usePkce?: boolean;
-        usePkceClientSecret?: boolean;
-    };
-    origin: string;
-};
-export declare function isDatasourceAuthState(aus: DatasourceAuthState | DatasourceOneTimeState): aus is DatasourceAuthState;
-export type DatasourceOneTimeState = {
-    oneTimeCode: string;
-    /**
-     * Explicitly selects the ui-legacy localStorage callback handoff.
-     * ui app and deployed-shell flows must leave this unset so the
-     * dashboard callback uses postMessage only.
-     */
-    useLocalStorage?: boolean;
-    integrationId: string;
-    externalUser: boolean;
-    configurationId?: string;
-    /** Profile key for agent-scoped auth when not supplied via postMessage. */
-    profileKey?: string;
-    /**
-     * Origin of the window that opened the OAuth popup. When the opener
-     * is cross-origin (e.g. a deployed app iframe on a CDN), the callback
-     * page must postMessage with this targetOrigin instead of its own.
-     */
-    openerOrigin?: string;
-};
-export type DeleteDatasourceOnAgentResult = {
-    message?: string;
-    success: boolean;
-};
-export {};
-//# sourceMappingURL=auth.d.ts.map