postgresdk 0.16.7 → 0.16.8

package/dist/cli.js

@@ -1805,6 +1805,15 @@ function extractConfigFields(configContent) {
       isCommented: pullBlock.isCommented
     });
   }
+  const pullTokenMatch = configContent.match(/^\s*(\/\/)?\s*pullToken:\s*(.+),?$/m);
+  if (pullTokenMatch) {
+    fields.push({
+      key: "pullToken",
+      value: pullTokenMatch[2]?.trim().replace(/,$/, ""),
+      description: "Token for protecting /_psdk/* endpoints",
+      isCommented: !!pullTokenMatch[1]
+    });
+  }
   return fields;
 }
 function extractComplexBlock(configContent, blockName) {
@@ -1947,21 +1956,36 @@ export default {
   ${getComplexBlockLine("tests", existingFields, mergeStrategy, userChoices)}
   
   // ========== AUTHENTICATION ==========
-  
+
   /**
    * Authentication configuration for your API
-   * 
+   *
    * Simple syntax examples:
    *   auth: { apiKey: process.env.API_KEY }
    *   auth: { jwt: process.env.JWT_SECRET }
-   * 
+   *
    * Multiple API keys:
    *   auth: { apiKeys: [process.env.KEY1, process.env.KEY2] }
-   * 
+   *
    * Full syntax for advanced options:
    */
   ${getComplexBlockLine("auth", existingFields, mergeStrategy, userChoices)}
-  
+
+  // ========== SDK ENDPOINT PROTECTION ==========
+
+  /**
+   * Token for protecting /_psdk/* endpoints (SDK distribution and contract endpoints)
+   *
+   * When set, clients must provide this token via Authorization header when pulling SDK.
+   * If not set, /_psdk/* endpoints are publicly accessible.
+   *
+   * This is separate from the main auth strategy (JWT/API key) used for CRUD operations.
+   *
+   * Use "env:" prefix to read from environment variables:
+   *   pullToken: "env:POSTGRESDK_PULL_TOKEN"
+   */
+  ${getFieldLine("pullToken", existingFields, mergeStrategy, '"env:POSTGRESDK_PULL_TOKEN"', userChoices)}
+
   // ========== SDK DISTRIBUTION (Pull Configuration) ==========
   
   /**
@@ -2050,9 +2074,9 @@ function getDefaultComplexBlock(key) {
   // },`;
     case "pull":
       return `// pull: {
-  //   from: "https://api.myapp.com",     // API URL to pull SDK from
-  //   output: "./src/sdk",                // Local directory for pulled SDK
-  //   token: process.env.API_TOKEN,       // Optional authentication token
+  //   from: "https://api.myapp.com",        // API URL to pull SDK from
+  //   output: "./src/sdk",                   // Local directory for pulled SDK
+  //   pullToken: "env:POSTGRESDK_PULL_TOKEN",  // Optional: if server has pullToken set
   // },`;
     default:
       return `// ${key}: {},`;
@@ -2154,6 +2178,7 @@ async function initCommand(args) {
       const newOptions = [
         { key: "tests", description: "Enable test generation" },
         { key: "auth", description: "Add authentication" },
+        { key: "pullToken", description: "Add SDK endpoint protection" },
         { key: "pull", description: "Configure SDK distribution" }
       ];
       const existingKeys = new Set(existingFields.map((f) => f.key));
@@ -2518,7 +2543,14 @@ Options:`);
     const headers = resolvedToken ? { Authorization: `Bearer ${resolvedToken}` } : {};
     const manifestRes = await fetch(`${config.from}/_psdk/sdk/manifest`, { headers });
     if (!manifestRes.ok) {
-      throw new Error(`Failed to fetch SDK manifest: ${manifestRes.status} ${manifestRes.statusText}`);
+      let errorMsg = `${manifestRes.status} ${manifestRes.statusText}`;
+      try {
+        const errorBody = await manifestRes.json();
+        if (errorBody.error) {
+          errorMsg = errorBody.error;
+        }
+      } catch {}
+      throw new Error(`Failed to fetch SDK manifest: ${errorMsg}`);
     }
     const manifest = await manifestRes.json();
     console.log(`\uD83D\uDCE6 SDK version: ${manifest.version}`);
@@ -2526,7 +2558,14 @@ Options:`);
     console.log(`\uD83D\uDCC4 Files: ${manifest.files.length}`);
     const sdkRes = await fetch(`${config.from}/_psdk/sdk/download`, { headers });
     if (!sdkRes.ok) {
-      throw new Error(`Failed to download SDK: ${sdkRes.status} ${sdkRes.statusText}`);
+      let errorMsg = `${sdkRes.status} ${sdkRes.statusText}`;
+      try {
+        const errorBody = await sdkRes.json();
+        if (errorBody.error) {
+          errorMsg = errorBody.error;
+        }
+      } catch {}
+      throw new Error(`Failed to download SDK: ${errorMsg}`);
     }
     const sdk = await sdkRes.json();
     for (const [path, content] of Object.entries(sdk.files)) {
@@ -4481,10 +4520,12 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions, pullToken) {
   const tableNames = tables.map((t) => t.name).sort();
   const ext = useJsExtensions ? ".js" : "";
   let resolvedPullToken;
+  let pullTokenEnvVar;
   if (pullToken) {
     if (pullToken.startsWith("env:")) {
       const envVarName = pullToken.slice(4);
       resolvedPullToken = `process.env.${envVarName}`;
+      pullTokenEnvVar = envVarName;
     } else {
       resolvedPullToken = JSON.stringify(pullToken);
     }
@@ -4586,7 +4627,9 @@ ${pullToken ? `
 
     if (!expectedToken) {
       // Token not configured in environment - reject request
-      return c.json({ error: "SDK endpoints are protected but token not configured" }, 500);
+      return c.json({
+        error: "SDK endpoints are protected but pullToken environment variable not set. ${pullTokenEnvVar ? `Set ${pullTokenEnvVar} in your environment or remove pullToken from config.` : "Set the pullToken environment variable or remove pullToken from config."}"
+      }, 500);
     }
 
     if (!authHeader || !authHeader.startsWith("Bearer ")) {

package/dist/index.js

@@ -3619,10 +3619,12 @@ function emitHonoRouter(tables, hasAuth, useJsExtensions, pullToken) {
   const tableNames = tables.map((t) => t.name).sort();
   const ext = useJsExtensions ? ".js" : "";
   let resolvedPullToken;
+  let pullTokenEnvVar;
   if (pullToken) {
     if (pullToken.startsWith("env:")) {
       const envVarName = pullToken.slice(4);
       resolvedPullToken = `process.env.${envVarName}`;
+      pullTokenEnvVar = envVarName;
     } else {
       resolvedPullToken = JSON.stringify(pullToken);
     }
@@ -3724,7 +3726,9 @@ ${pullToken ? `
 
     if (!expectedToken) {
       // Token not configured in environment - reject request
-      return c.json({ error: "SDK endpoints are protected but token not configured" }, 500);
+      return c.json({
+        error: "SDK endpoints are protected but pullToken environment variable not set. ${pullTokenEnvVar ? `Set ${pullTokenEnvVar} in your environment or remove pullToken from config.` : "Set the pullToken environment variable or remove pullToken from config."}"
+      }, 500);
     }
 
     if (!authHeader || !authHeader.startsWith("Bearer ")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresdk",
-  "version": "0.16.7",
+  "version": "0.16.8",
   "description": "Generate a typed server/client SDK from a Postgres schema (includes, Zod, Hono).",
   "type": "module",
   "bin": {