@databasin/mcp-client 0.1.0

package/README.md

@@ -0,0 +1,108 @@
+# DataBasin MCP Client
+
+Run DataBasin tools locally in Codex, Claude Code, and other MCP clients. The package uses stdio locally and calls the remote DataBasin API over HTTPS as the signed-in user.
+
+Production is the default. Users do not need to configure an API URL, tenant ID, client ID, scope, bearer token, callback port, or client secret.
+
+## Requirements
+
+- Node.js 22.14 or newer
+- A DataBasin account
+- A supported OS credential store: Windows DPAPI, macOS Keychain, or Linux Secret Service/LibSecret
+
+## Sign in with your assistant
+
+After adding the MCP server, ask your assistant to connect to DataBasin. It can:
+
+1. Call `databasin_auth_status` to check the local session.
+2. Call `databasin_login` when sign-in is needed. It returns Microsoft's short-lived device-login URL and user code immediately.
+3. Give you that URL and code. You can complete sign-in from any browser or device, after which the assistant calls `databasin_auth_status` again.
+
+Enter credentials only on Microsoft's page. The assistant receives the intentionally displayable, short-lived device user code, but never receives the password, OAuth device code, authorization code, access token, refresh token, or signed-in account identity.
+
+The CLI remains available as a fallback:
+
+```bash
+npx -y @databasin/mcp-client login
+```
+
+Assistant-driven login uses Microsoft's OAuth device authorization flow. CLI fallback uses Authorization Code with PKCE and an ephemeral `http://localhost` loopback callback. Both use a public client; no client secret is installed on the user's machine. MSAL stores and refreshes the session in the operating system credential store.
+
+Check or clear the session:
+
+```bash
+npx -y @databasin/mcp-client status
+npx -y @databasin/mcp-client logout
+```
+
+## Codex
+
+```bash
+codex mcp add databasin -- npx -y @databasin/mcp-client
+```
+
+Equivalent `config.toml`:
+
+```toml
+[mcp_servers.databasin]
+command = "npx"
+args = ["-y", "@databasin/mcp-client"]
+```
+
+## Claude Code
+
+```bash
+claude mcp add --transport stdio --scope user databasin -- npx -y @databasin/mcp-client
+```
+
+Equivalent `.mcp.json` entry:
+
+```json
+{
+  "mcpServers": {
+    "databasin": {
+      "command": "npx",
+      "args": ["-y", "@databasin/mcp-client"]
+    }
+  }
+}
+```
+
+## Non-production
+
+Production is selected when no environment is supplied. To use the DataBasin NP environment, add the option to the MCP command. The assistant-driven login tools automatically use that environment:
+
+```toml
+[mcp_servers.databasin_np]
+command = "npx"
+args = ["-y", "@databasin/mcp-client", "--environment", "np"]
+```
+
+For CLI fallback, run `npx -y @databasin/mcp-client login --environment np`.
+
+`test`, `staging`, and `non-production` are accepted aliases for `np`; `production` is accepted as an alias for `prod`.
+
+## Tools
+
+- `databasin_auth_status`: check whether the local DataBasin session is authenticated without exposing account identity
+- `databasin_login`: return Microsoft device-login instructions without blocking the assistant
+- `databasin_get_context`: list caller-visible projects and connection identifiers
+- `databasin_search`: search visible pipelines, connectors, and automations
+- `databasin_browse_schema`: browse catalogs, schemas, tables, and columns
+- `databasin_get_operation`: read bounded query status and results
+- `databasin_cancel_operation`: request cancellation of a visible query operation
+
+Tool output is bounded and inspected for credential-like fields. API URLs are fixed by the selected release profile, authentication tokens remain inside MSAL, and the agent cannot supply arbitrary URLs or headers.
+
+## Publishing
+
+The package publishes only `dist/` and this README. Before publishing:
+
+```bash
+npm ci
+npm run verify
+npm pack --dry-run
+npm publish --access public
+```
+
+Publishing from CI should use npm trusted publishing with provenance. Choose and record DataBasin's approved package license before the first public release; the package is currently marked `UNLICENSED`.

package/dist/api-client.d.ts

@@ -0,0 +1,43 @@
+import type { DataBasinProfile } from './config.js';
+import type { BrowseSchemaInput, SearchInput } from './schemas.js';
+export interface DataBasinApi {
+    getProjects(signal?: AbortSignal): Promise<unknown>;
+    getAccessibleConnections(signal?: AbortSignal): Promise<unknown>;
+    search(input: SearchInput, signal?: AbortSignal): Promise<unknown>;
+    browseSchema(input: BrowseSchemaInput, signal?: AbortSignal): Promise<unknown>;
+    getOperation(operationId: string, options: {
+        offset: number;
+        limit: number;
+    }, signal?: AbortSignal): Promise<unknown>;
+    cancelOperation(operationId: string, signal?: AbortSignal): Promise<unknown>;
+}
+export interface DataBasinApiClientOptions {
+    baseUrl: string;
+    auth: {
+        profile: DataBasinProfile;
+        getAccessToken(): Promise<string>;
+    };
+    fetchImpl?: typeof fetch;
+    maxResponseBytes?: number;
+    timeoutMs?: number;
+}
+export declare class DataBasinApiClient implements DataBasinApi {
+    private readonly baseUrl;
+    private readonly auth;
+    private readonly fetchImpl;
+    private readonly maxResponseBytes;
+    private readonly timeoutMs;
+    constructor(options: DataBasinApiClientOptions);
+    getProjects(signal?: AbortSignal): Promise<unknown>;
+    getAccessibleConnections(signal?: AbortSignal): Promise<unknown>;
+    search(input: SearchInput, signal?: AbortSignal): Promise<unknown>;
+    browseSchema(input: BrowseSchemaInput, signal?: AbortSignal): Promise<unknown>;
+    getOperation(operationId: string, options: {
+        offset: number;
+        limit: number;
+    }, signal?: AbortSignal): Promise<unknown>;
+    cancelOperation(operationId: string, signal?: AbortSignal): Promise<unknown>;
+    private request;
+}
+export declare function normalizeApiBase(raw: string): string;
+//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKnE,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,wBAAwB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,OAAO,EAAE,gBAAgB,CAAC;QAC1B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KACnC,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,EAAE,yBAAyB;IAQ9C,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAInD,wBAAwB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAQlE,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAaxE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAU3H,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;YAI9D,OAAO;CAoCtB;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYpD"}

package/dist/api-client.js

@@ -0,0 +1,154 @@
+import { DataBasinError, LoginRequiredError } from './errors.js';
+export class DataBasinApiClient {
+    baseUrl;
+    auth;
+    fetchImpl;
+    maxResponseBytes;
+    timeoutMs;
+    constructor(options) {
+        this.baseUrl = normalizeApiBase(options.baseUrl);
+        this.auth = options.auth;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.maxResponseBytes = options.maxResponseBytes ?? 5_000_000;
+        this.timeoutMs = options.timeoutMs ?? 30_000;
+    }
+    getProjects(signal) {
+        return this.request('GET', '/my/projects', undefined, signal);
+    }
+    getAccessibleConnections(signal) {
+        return this.request('GET', '/connections/accessible', undefined, signal);
+    }
+    search(input, signal) {
+        const params = new URLSearchParams({ q: input.q, limit: String(input.limit) });
+        if (input.projectId)
+            params.set('projectId', input.projectId);
+        if (input.organizationId !== undefined)
+            params.set('orgId', String(input.organizationId));
+        if (input.types?.length)
+            params.set('types', input.types.join(','));
+        return this.request('GET', `/search?${params.toString()}`, undefined, signal);
+    }
+    browseSchema(input, signal) {
+        const params = new URLSearchParams({ connectorId: String(input.connectorId) });
+        let path = '/databasin/catalogs';
+        if (input.level !== 'catalogs')
+            params.set('catalog', input.catalog);
+        if (input.level === 'schemas')
+            path = '/databasin/schemas';
+        if (input.level === 'tables' || input.level === 'columns') {
+            path = input.level === 'tables' ? '/databasin/tables' : '/databasin/columns';
+            params.set('schema', input.schema);
+        }
+        if (input.level === 'columns')
+            params.set('table', input.table);
+        return this.request('GET', `${path}?${params.toString()}`, undefined, signal);
+    }
+    async getOperation(operationId, options, signal) {
+        const encoded = encodeURIComponent(operationId);
+        const status = await this.request('GET', `/databasin/query/${encoded}/status`, undefined, signal, true);
+        const statusObject = asRecord(status);
+        if (String(statusObject.status ?? '').toLowerCase() !== 'completed')
+            return status;
+        const params = new URLSearchParams({ offset: String(options.offset), limit: String(options.limit) });
+        const results = await this.request('GET', `/databasin/query/${encoded}/results?${params.toString()}`, undefined, signal);
+        return { ...statusObject, ...asRecord(results) };
+    }
+    cancelOperation(operationId, signal) {
+        return this.request('POST', `/databasin/query/${encodeURIComponent(operationId)}/cancel`, undefined, signal);
+    }
+    async request(method, path, body, callerSignal, allowFailedOperation = false) {
+        const accessToken = await this.auth.getAccessToken();
+        const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
+        const signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+        let response;
+        try {
+            response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method,
+                signal,
+                redirect: 'error',
+                headers: {
+                    accept: 'application/json',
+                    authorization: `Bearer ${accessToken}`,
+                    ...(body === undefined ? {} : { 'content-type': 'application/json' })
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) })
+            });
+        }
+        catch {
+            throw new DataBasinError('DEPENDENCY_UNAVAILABLE', 'The DataBasin API could not be reached.');
+        }
+        const payload = await readJson(response, this.maxResponseBytes);
+        if (response.ok)
+            return payload;
+        if (allowFailedOperation && response.status === 500 && isFailedOperation(payload))
+            return payload;
+        if (response.status === 401)
+            throw new LoginRequiredError(this.auth.profile.environment);
+        if (response.status === 403)
+            throw new DataBasinError('POLICY_DENIED', 'DataBasin denied access to this resource.');
+        if (response.status === 404)
+            throw new DataBasinError('NOT_FOUND', 'The requested DataBasin resource was not found.');
+        if (response.status >= 500)
+            throw new DataBasinError('DEPENDENCY_UNAVAILABLE', 'The DataBasin API is temporarily unavailable.');
+        throw new DataBasinError('OPERATION_FAILED', `The DataBasin API rejected the request with HTTP ${response.status}.`);
+    }
+}
+export function normalizeApiBase(raw) {
+    const url = new URL(raw);
+    if (url.protocol !== 'https:') {
+        throw new Error('The DataBasin API URL must use HTTPS.');
+    }
+    url.search = '';
+    url.hash = '';
+    url.username = '';
+    url.password = '';
+    const path = url.pathname.replace(/\/+$/u, '');
+    url.pathname = path.endsWith('/api') ? path : `${path}/api`;
+    return url.toString().replace(/\/$/u, '');
+}
+async function readJson(response, maxBytes) {
+    const contentLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new DataBasinError('POLICY_DENIED', 'The DataBasin API response exceeded the size limit.');
+    }
+    if (!response.body)
+        return null;
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new DataBasinError('POLICY_DENIED', 'The DataBasin API response exceeded the size limit.');
+        }
+        chunks.push(value);
+    }
+    if (total === 0)
+        return null;
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        if (response.ok)
+            throw new DataBasinError('OPERATION_FAILED', 'The DataBasin API returned an invalid response.');
+        return null;
+    }
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function isFailedOperation(value) {
+    const record = asRecord(value);
+    return record.status === 'failed' && typeof record.queryId === 'string' && record.queryId.length > 0;
+}
+//# sourceMappingURL=api-client.js.map

package/dist/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAwBjE,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAS;IAChB,IAAI,CAAoC;IACxC,SAAS,CAAe;IACxB,gBAAgB,CAAS;IACzB,SAAS,CAAS;IAEnC,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC/C,CAAC;IAED,WAAW,CAAC,MAAoB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,wBAAwB,CAAC,MAAoB;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,CAAC,KAAkB,EAAE,MAAoB;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,YAAY,CAAC,KAAwB,EAAE,MAAoB;QACzD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,IAAI,GAAG,qBAAqB,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAQ,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,GAAG,oBAAoB,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAC7E,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAM,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,OAA0C,EAAE,MAAoB;QACtG,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,OAAO,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxG,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,oBAAoB,OAAO,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACzH,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/G,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAkB,EAClB,IAAY,EACZ,IAAc,EACd,YAA0B,EAC1B,oBAAoB,GAAG,KAAK;QAE5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7F,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACxD,MAAM;gBACN,MAAM;gBACN,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC;QAChC,IAAI,oBAAoB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QACpH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,iDAAiD,CAAC,CAAC;QACtH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,+CAA+C,CAAC,CAAC;QAChI,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,oDAAoD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvH,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;IAC5D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,QAAgB;IAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AACvG,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,73 @@
+import { type AccountInfo, type AuthenticationResult, type IPublicClientApplication } from '@azure/msal-node';
+import { type DataBasinEnvironment, type DataBasinProfile } from './config.js';
+export interface AuthStatus {
+    authenticated: boolean;
+    environment: DataBasinEnvironment;
+    username?: string;
+}
+export type AssistantAuthState = 'authenticated' | 'pending' | 'not_authenticated' | 'failed';
+export interface AssistantAuthResult {
+    status: AssistantAuthState;
+    environment: DataBasinEnvironment;
+    loginUrl: string | null;
+    userCode?: string;
+    expiresAt?: string;
+    message: string;
+}
+interface DeviceCodePrompt {
+    userCode: string;
+    verificationUri: string;
+    expiresIn: number;
+}
+export interface PublicClientLike {
+    getAllAccounts(): Promise<AccountInfo[]>;
+    acquireTokenSilent(request: {
+        account: AccountInfo;
+        scopes: string[];
+    }): Promise<AuthenticationResult>;
+    acquireTokenInteractive(request: {
+        scopes: string[];
+        openBrowser: (url: string) => Promise<void>;
+        prompt?: string;
+        successTemplate?: string;
+        errorTemplate?: string;
+    }): Promise<AuthenticationResult>;
+    acquireTokenByDeviceCode(request: {
+        scopes: string[];
+        timeout?: number;
+        deviceCodeCallback: (response: DeviceCodePrompt) => void;
+    }): Promise<AuthenticationResult | null>;
+    signOut(request: {
+        account: AccountInfo;
+    }): Promise<void>;
+}
+export interface AuthManagerOptions {
+    createClient?: () => Promise<PublicClientLike>;
+    openBrowser?: (url: string) => Promise<void>;
+}
+export declare class AuthManager {
+    readonly profile: DataBasinProfile;
+    private clientPromise;
+    private tokenPromise;
+    private activeLogin;
+    private lastLoginFailed;
+    private readonly createClient;
+    private readonly openBrowser;
+    constructor(profile: DataBasinProfile, options?: AuthManagerOptions);
+    getAccessToken(): Promise<string>;
+    login(): Promise<AuthStatus>;
+    startLogin(): Promise<AssistantAuthResult>;
+    getLoginStatus(): Promise<AssistantAuthResult>;
+    private beginDeviceLogin;
+    private performDeviceLogin;
+    private performInteractiveLogin;
+    private completeLogin;
+    private assistantResult;
+    logout(): Promise<number>;
+    status(): Promise<AuthStatus>;
+    private acquireSilent;
+    private client;
+}
+export declare function createSecurePublicClient(profile: DataBasinProfile): Promise<IPublicClientApplication>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAEzB,KAAK,wBAAwB,EAC9B,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAgB,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG7F,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;AAE9F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,oBAAoB,CAAC;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzC,kBAAkB,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE,WAAW,CAAC;QACrB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClC,uBAAuB,CAAC,OAAO,EAAE;QAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClC,wBAAwB,CAAC,OAAO,EAAE;QAChC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,kBAAkB,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;KAC1D,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AASD,qBAAa,WAAW;IASpB,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IARpC,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;gBAGlD,OAAO,EAAE,gBAAgB,EAClC,OAAO,GAAE,kBAAuB;IAM5B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAOjC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC;IAI5B,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAoC1C,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAyCpD,OAAO,CAAC,gBAAgB;YA6BV,kBAAkB;YAelB,uBAAuB;YAiBvB,aAAa;IAqB3B,OAAO,CAAC,eAAe;IAiBjB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAOzB,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;YAQrB,aAAa;IAgB3B,OAAO,CAAC,MAAM;CAUf;AAED,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA2B3G"}

package/dist/auth.js

@@ -0,0 +1,234 @@
+import { mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { InteractionRequiredAuthError, PublicClientApplication } from '@azure/msal-node';
+import { DataProtectionScope, PersistenceCachePlugin, PersistenceCreator } from '@azure/msal-node-extensions';
+import { openSystemBrowser } from './browser.js';
+import { authorityFor } from './config.js';
+import { DataBasinError, LoginRequiredError } from './errors.js';
+export class AuthManager {
+    profile;
+    clientPromise;
+    tokenPromise;
+    activeLogin;
+    lastLoginFailed = false;
+    createClient;
+    openBrowser;
+    constructor(profile, options = {}) {
+        this.profile = profile;
+        this.createClient = options.createClient ?? (() => createSecurePublicClient(profile));
+        this.openBrowser = options.openBrowser ?? openSystemBrowser;
+    }
+    async getAccessToken() {
+        this.tokenPromise ??= this.acquireSilent().finally(() => {
+            this.tokenPromise = undefined;
+        });
+        return this.tokenPromise;
+    }
+    async login() {
+        return this.performInteractiveLogin(this.openBrowser);
+    }
+    async startLogin() {
+        const status = await this.getLoginStatus();
+        if (status.status === 'authenticated' || status.status === 'pending')
+            return status;
+        const login = this.beginDeviceLogin();
+        const outcome = await Promise.race([
+            login.prompted.then((prompt) => ({ state: 'prompted', prompt })),
+            login.completion.then(() => ({ state: 'completed' }), () => ({ state: 'failed' }))
+        ]);
+        if (outcome.state === 'completed') {
+            return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} sign-in is complete.`);
+        }
+        if (outcome.state === 'failed') {
+            return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
+        }
+        return this.assistantResult('pending', outcome.prompt.verificationUri, `Open the Microsoft sign-in URL on any device and enter code ${outcome.prompt.userCode}. Then call databasin_auth_status.`, outcome.prompt.userCode, login.expiresAt);
+    }
+    async getLoginStatus() {
+        const login = this.activeLogin;
+        if (login) {
+            return this.assistantResult('pending', login.prompt?.verificationUri ?? null, login.prompt
+                ? `Open the Microsoft sign-in URL on any device and enter code ${login.prompt.userCode}.`
+                : 'Microsoft is preparing the device sign-in instructions.', login.prompt?.userCode, login.expiresAt);
+        }
+        const cachedStatus = await this.status();
+        if (cachedStatus.authenticated) {
+            try {
+                await this.getAccessToken();
+                return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} is signed in.`);
+            }
+            catch (error) {
+                if (!(error instanceof DataBasinError) || error.code !== 'UNAUTHENTICATED')
+                    throw error;
+            }
+        }
+        if (this.lastLoginFailed) {
+            return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
+        }
+        return this.assistantResult('not_authenticated', null, `DataBasin ${this.profile.label} is not signed in. Call databasin_login to begin.`);
+    }
+    beginDeviceLogin() {
+        if (this.activeLogin)
+            return this.activeLogin;
+        this.lastLoginFailed = false;
+        let resolvePrompted = () => undefined;
+        const login = {
+            prompted: new Promise((resolve) => {
+                resolvePrompted = resolve;
+            }),
+            completion: Promise.resolve({ authenticated: false, environment: this.profile.environment }),
+            prompt: undefined,
+            expiresAt: undefined
+        };
+        login.completion = this.performDeviceLogin((prompt) => {
+            login.prompt = prompt;
+            login.expiresAt = new Date(Date.now() + prompt.expiresIn * 1_000).toISOString();
+            resolvePrompted(prompt);
+        }).catch((error) => {
+            this.lastLoginFailed = true;
+            throw error;
+        }).finally(() => {
+            if (this.activeLogin === login)
+                this.activeLogin = undefined;
+        });
+        this.activeLogin = login;
+        void login.completion.catch(() => undefined);
+        return login;
+    }
+    async performDeviceLogin(onPrompt) {
+        const client = await this.client();
+        let result;
+        try {
+            result = await client.acquireTokenByDeviceCode({
+                scopes: [...this.profile.scopes],
+                timeout: 900,
+                deviceCodeCallback: onPrompt
+            });
+        }
+        catch {
+            throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
+        }
+        return this.completeLogin(client, result);
+    }
+    async performInteractiveLogin(openBrowser) {
+        const client = await this.client();
+        let result;
+        try {
+            result = await client.acquireTokenInteractive({
+                scopes: [...this.profile.scopes],
+                openBrowser,
+                prompt: 'select_account',
+                successTemplate: successPage(this.profile.label),
+                errorTemplate: errorPage()
+            });
+        }
+        catch {
+            throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
+        }
+        return this.completeLogin(client, result);
+    }
+    async completeLogin(client, result) {
+        if (!result?.account || !result.accessToken) {
+            throw new DataBasinError('UNAUTHENTICATED', 'Microsoft Entra did not return a usable DataBasin session.');
+        }
+        const accounts = await client.getAllAccounts();
+        await Promise.all(accounts
+            .filter((account) => account.homeAccountId !== result.account?.homeAccountId)
+            .map((account) => client.signOut({ account })));
+        return {
+            authenticated: true,
+            environment: this.profile.environment,
+            username: result.account.username
+        };
+    }
+    assistantResult(status, loginUrl, message, userCode, expiresAt) {
+        return {
+            status,
+            environment: this.profile.environment,
+            loginUrl,
+            ...(userCode ? { userCode } : {}),
+            ...(expiresAt ? { expiresAt } : {}),
+            message
+        };
+    }
+    async logout() {
+        const client = await this.client();
+        const accounts = await client.getAllAccounts();
+        await Promise.all(accounts.map((account) => client.signOut({ account })));
+        return accounts.length;
+    }
+    async status() {
+        const accounts = await (await this.client()).getAllAccounts();
+        const account = selectAccount(accounts, this.profile.tenantId);
+        return account
+            ? { authenticated: true, environment: this.profile.environment, username: account.username }
+            : { authenticated: false, environment: this.profile.environment };
+    }
+    async acquireSilent() {
+        const client = await this.client();
+        const account = selectAccount(await client.getAllAccounts(), this.profile.tenantId);
+        if (!account)
+            throw new LoginRequiredError(this.profile.environment);
+        try {
+            const result = await client.acquireTokenSilent({ account, scopes: [...this.profile.scopes] });
+            if (!result.accessToken)
+                throw new LoginRequiredError(this.profile.environment);
+            return result.accessToken;
+        }
+        catch (error) {
+            if (error instanceof InteractionRequiredAuthError) {
+                throw new LoginRequiredError(this.profile.environment);
+            }
+            throw new DataBasinError('UNAUTHENTICATED', `The DataBasin ${this.profile.label} session could not be refreshed. Sign in again.`);
+        }
+    }
+    client() {
+        this.clientPromise ??= this.createClient().catch((error) => {
+            this.clientPromise = undefined;
+            const detail = error instanceof Error && error.message.includes('libsecret')
+                ? ' Install or unlock the system keyring and try again.'
+                : '';
+            throw new DataBasinError('UNAUTHENTICATED', `Secure DataBasin credential storage is unavailable.${detail}`);
+        });
+        return this.clientPromise;
+    }
+}
+export async function createSecurePublicClient(profile) {
+    const cacheDirectory = join(homedir(), '.databasin', 'mcp', 'auth', profile.environment);
+    await mkdir(cacheDirectory, { recursive: true, mode: 0o700 });
+    const persistence = await PersistenceCreator.createPersistence({
+        cachePath: join(cacheDirectory, 'msal-cache.lock'),
+        dataProtectionScope: DataProtectionScope.CurrentUser,
+        serviceName: 'com.databasin.mcp',
+        accountName: profile.environment,
+        usePlaintextFileOnLinux: false
+    });
+    const configuration = {
+        auth: {
+            clientId: profile.clientId,
+            authority: authorityFor(profile)
+        },
+        cache: {
+            cachePlugin: new PersistenceCachePlugin(persistence)
+        },
+        system: {
+            loggerOptions: {
+                piiLoggingEnabled: false,
+                logLevel: 0,
+                loggerCallback: () => undefined
+            }
+        }
+    };
+    return new PublicClientApplication(configuration);
+}
+function selectAccount(accounts, tenantId) {
+    return accounts.find((account) => account.tenantId.toLowerCase() === tenantId.toLowerCase()) ?? accounts[0];
+}
+function successPage(label) {
+    return `<!doctype html><html><body><h1>DataBasin sign-in complete</h1><p>You are signed in to ${label}. You can close this window.</p></body></html>`;
+}
+function errorPage() {
+    return '<!doctype html><html><body><h1>DataBasin sign-in failed</h1><p>Return to your assistant or terminal and try again.</p></body></html>';
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EAKxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,YAAY,EAAoD,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AA0DjE,MAAM,OAAO,WAAW;IASX;IARH,aAAa,CAAwC;IACrD,YAAY,CAA8B;IAC1C,WAAW,CAA0B;IACrC,eAAe,GAAG,KAAK,CAAC;IACf,YAAY,CAAkC;IAC9C,WAAW,CAAiC;IAE7D,YACW,OAAyB,EAClC,UAA8B,EAAE;QADvB,YAAO,GAAP,OAAO,CAAkB;QAGlC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACtD,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAEpF,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAoB,EAAE,CAAC,EACvC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAiB,EAAE,CAAC,CACrC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,eAAe,CACzB,eAAe,EACf,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,uBAAuB,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,eAAe,CACzB,QAAQ,EACR,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,+DAA+D,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CACzB,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,eAAe,EAC9B,+DAA+D,OAAO,CAAC,MAAM,CAAC,QAAQ,oCAAoC,EAC1H,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,eAAe,CACzB,SAAS,EACT,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,IAAI,EACrC,KAAK,CAAC,MAAM;gBACV,CAAC,CAAC,+DAA+D,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG;gBACzF,CAAC,CAAC,yDAAyD,EAC7D,KAAK,CAAC,MAAM,EAAE,QAAQ,EACtB,KAAK,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,eAAe,CACzB,eAAe,EACf,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAChD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAAE,MAAM,KAAK,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CACzB,QAAQ,EACR,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,+DAA+D,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CACzB,mBAAmB,EACnB,IAAI,EACJ,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,mDAAmD,CACnF,CAAC;IACJ,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE9C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,eAAe,GAAuC,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1E,MAAM,KAAK,GAAgB;YACzB,QAAQ,EAAE,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;gBAClD,eAAe,GAAG,OAAO,CAAC;YAC5B,CAAC,CAAC;YACF,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5F,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,EAAE;YACpD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAChF,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK;gBAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,KAAK,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,QAA4C;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,MAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;gBAC7C,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChC,OAAO,EAAE,GAAG;gBACZ,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,WAA2C;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC;gBAC5C,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChC,WAAW;gBACX,MAAM,EAAE,gBAAgB;gBACxB,eAAe,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAChD,aAAa,EAAE,SAAS,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,KAAK,4BAA4B,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAwB,EACxB,MAAmC;QAEnC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ;aACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC;aAC5E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CACjD,CAAC;QACF,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;SAClC,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,MAA0B,EAC1B,QAAuB,EACvB,OAAe,EACf,QAAiB,EACjB,SAAkB;QAElB,OAAO;YACL,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,QAAQ;YACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,OAAO;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,OAAO;YACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC5F,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,MAAM,CAAC,WAAW;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAChF,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,iDAAiD,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClE,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC1E,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,sDAAsD,MAAM,EAAE,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAyB;IACtE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CAAC;QAC7D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAClD,mBAAmB,EAAE,mBAAmB,CAAC,WAAW;QACpD,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IACH,MAAM,aAAa,GAAkB;QACnC,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC;SACjC;QACD,KAAK,EAAE;YACL,WAAW,EAAE,IAAI,sBAAsB,CAAC,WAAW,CAAC;SACrD;QACD,MAAM,EAAE;YACN,aAAa,EAAE;gBACb,iBAAiB,EAAE,KAAK;gBACxB,QAAQ,EAAE,CAAC;gBACX,cAAc,EAAE,GAAG,EAAE,CAAC,SAAS;aAChC;SACF;KACF,CAAC;IACF,OAAO,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,QAAuB,EAAE,QAAgB;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,yFAAyF,KAAK,gDAAgD,CAAC;AACxJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,sIAAsI,CAAC;AAChJ,CAAC"}

package/dist/browser.d.ts

@@ -0,0 +1,2 @@
+export declare function openSystemBrowser(rawUrl: string): Promise<void>;
+//# sourceMappingURL=browser.d.ts.map