@databasin/mcp-client 0.1.0 → 0.2.0-beta.1

package/dist/token-validation.js

@@ -0,0 +1,183 @@
+import { DataBasinError } from './errors.js';
+const MAX_ACCESS_TOKEN_BYTES = 64 * 1024;
+const MAX_JWT_PAYLOAD_BYTES = 32 * 1024;
+const TOKEN_REJECTED_MESSAGE = 'Microsoft Entra returned an access token that did not match the configured DataBasin API.';
+/**
+ * MSAL records the account's environment as whichever canonical alias Entra's
+ * instance-discovery metadata prefers — observed as login.windows.net in
+ * practice (2026-08-26), which the previous exact pin of
+ * login.microsoftonline.com rejected, invalidating every successful sign-in.
+ * These are the four first-party aliases from Entra's published instance
+ * metadata for the worldwide cloud; anything else is still rejected, and the
+ * token's issuer/audience/scope/tenant checks are unchanged.
+ */
+const ENTRA_ACCOUNT_ENVIRONMENTS = new Set([
+    'login.microsoftonline.com',
+    'login.windows.net',
+    'login.microsoft.com',
+    'sts.windows.net'
+]);
+export function accountMatchesProfile(account, profile) {
+    return sameTenant(account.tenantId, profile.tenantId)
+        && ENTRA_ACCOUNT_ENVIRONMENTS.has(account.environment.toLowerCase());
+}
+export function validateAccessTokenResult(result, profile, nowMs) {
+    assertAuthenticationResult(result);
+    assertMsalMetadata(result, profile, nowMs);
+    const requirements = tokenRequirements(profile);
+    if (!hasRequiredMsalScope(result.scopes, requirements))
+        rejectToken();
+    const claims = decodeJwtPayload(result.accessToken);
+    assertTokenClaims(claims, profile, requirements, nowMs);
+    // This local payload check is defense-in-depth only. The DataBasin API remains
+    // responsible for cryptographic signature and authorization validation.
+    return result.accessToken;
+}
+function assertAuthenticationResult(result) {
+    if (!result)
+        rejectToken();
+    if (!result.accessToken)
+        rejectToken();
+    if (!result.account)
+        rejectToken();
+}
+function assertMsalMetadata(result, profile, nowMs) {
+    if (!Number.isFinite(nowMs))
+        rejectToken();
+    if (!accountMatchesProfile(result.account, profile))
+        rejectToken();
+    if (!sameTenant(result.tenantId, profile.tenantId))
+        rejectToken();
+    if (!matchesConfiguredAuthority(result.authority, profile.tenantId))
+        rejectToken();
+    if (result.tokenType.toLowerCase() !== 'bearer')
+        rejectToken();
+    if (!(result.expiresOn instanceof Date))
+        rejectToken();
+    const expiresOn = result.expiresOn.getTime();
+    if (!Number.isFinite(expiresOn) || expiresOn <= nowMs)
+        rejectToken();
+}
+function assertTokenClaims(claims, profile, requirements, nowMs) {
+    if (!sameTenant(stringClaim(claims, 'tid'), profile.tenantId))
+        rejectToken();
+    const issuer = stringClaim(claims, 'iss').toLowerCase();
+    if (!allowedIssuers(profile.tenantId).has(issuer))
+        rejectToken();
+    if (!matchesAudience(stringClaim(claims, 'aud'), requirements))
+        rejectToken();
+    if (!hasDelegatedScope(stringClaim(claims, 'scp'), requirements.delegatedScope))
+        rejectToken();
+    const nowSeconds = Math.floor(nowMs / 1_000);
+    if (numericDateClaim(claims, 'exp') <= nowSeconds)
+        rejectToken();
+    if (numericDateClaim(claims, 'nbf') > nowSeconds)
+        rejectToken();
+}
+function matchesAudience(audience, requirements) {
+    return audience === requirements.resourceUri || audience === requirements.resourceClientId;
+}
+function hasDelegatedScope(rawScopes, requiredScope) {
+    const expected = requiredScope.toLowerCase();
+    return rawScopes.split(/\s+/u).filter(Boolean).some((scope) => scope.toLowerCase() === expected);
+}
+function tokenRequirements(profile) {
+    if (profile.scopes.length !== 1)
+        rejectToken();
+    const configuredScope = profile.scopes[0];
+    const match = /^api:\/\/([0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\/([A-Za-z0-9._-]{1,128})$/iu.exec(configuredScope);
+    if (!match)
+        rejectToken();
+    return {
+        resourceUri: `api://${match[1]}`,
+        resourceClientId: match[1],
+        configuredScope,
+        delegatedScope: match[2]
+    };
+}
+function hasRequiredMsalScope(scopes, requirements) {
+    const accepted = new Set([
+        requirements.configuredScope.toLowerCase(),
+        requirements.delegatedScope.toLowerCase()
+    ]);
+    return scopes.some((scope) => accepted.has(scope.trim().toLowerCase()));
+}
+function matchesConfiguredAuthority(raw, tenantId) {
+    try {
+        const authority = new URL(raw);
+        const expectedPath = `/${tenantId.toLowerCase()}`;
+        const path = authority.pathname.toLowerCase();
+        const safeOrigin = [
+            authority.protocol === 'https:',
+            ENTRA_ACCOUNT_ENVIRONMENTS.has(authority.hostname.toLowerCase()),
+            authority.port === '',
+            authority.username === '',
+            authority.password === '',
+            authority.search === '',
+            authority.hash === ''
+        ].every(Boolean);
+        return safeOrigin && (path === expectedPath || path === `${expectedPath}/`);
+    }
+    catch {
+        return false;
+    }
+}
+function allowedIssuers(tenantId) {
+    const tenant = tenantId.toLowerCase();
+    return new Set([
+        `https://sts.windows.net/${tenant}/`,
+        `https://login.microsoftonline.com/${tenant}/v2.0`
+    ]);
+}
+function decodeJwtPayload(accessToken) {
+    if (Buffer.byteLength(accessToken, 'utf8') > MAX_ACCESS_TOKEN_BYTES)
+        rejectToken();
+    const segments = accessToken.split('.');
+    if (segments.length !== 3)
+        rejectToken();
+    if (segments.some((segment) => !/^[A-Za-z0-9_-]+$/u.test(segment)))
+        rejectToken();
+    const payloadSegment = segments[1];
+    if (payloadSegment.length % 4 === 1)
+        rejectToken();
+    return parseJwtPayload(payloadSegment);
+}
+function parseJwtPayload(payloadSegment) {
+    try {
+        const bytes = Buffer.from(payloadSegment, 'base64url');
+        if (bytes.length > MAX_JWT_PAYLOAD_BYTES)
+            rejectToken();
+        if (bytes.toString('base64url') !== payloadSegment)
+            rejectToken();
+        const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!parsed || typeof parsed !== 'object')
+            rejectToken();
+        if (Array.isArray(parsed))
+            rejectToken();
+        return parsed;
+    }
+    catch (error) {
+        if (error instanceof DataBasinError)
+            throw error;
+        rejectToken();
+    }
+}
+function stringClaim(claims, name) {
+    const value = claims[name];
+    if (typeof value !== 'string' || value.length === 0 || value.length > 2_048)
+        rejectToken();
+    return value;
+}
+function numericDateClaim(claims, name) {
+    const value = claims[name];
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        rejectToken();
+    return value;
+}
+function sameTenant(actual, expected) {
+    return actual.toLowerCase() === expected.toLowerCase();
+}
+function rejectToken() {
+    throw new DataBasinError('UNAUTHENTICATED', TOKEN_REJECTED_MESSAGE);
+}
+//# sourceMappingURL=token-validation.js.map

package/dist/token-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-validation.js","sourceRoot":"","sources":["../src/token-validation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,2FAA2F,CAAC;AAS3H;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,OAAoB,EAAE,OAAyB;IACnF,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;WAChD,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAmC,EACnC,OAAyB,EACzB,KAAa;IAEb,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;QAAE,WAAW,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpD,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACxD,+EAA+E;IAC/E,wEAAwE;IACxE,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAmC;IAEnC,IAAI,CAAC,MAAM;QAAE,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAuD,EACvD,OAAyB,EACzB,KAAa;IAEb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,WAAW,EAAE,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;QAAE,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;QAAE,WAAW,EAAE,CAAC;IACnF,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,WAAW,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,YAAY,IAAI,CAAC;QAAE,WAAW,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK;QAAE,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA+B,EAC/B,OAAyB,EACzB,YAA+B,EAC/B,KAAa;IAEb,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;QAAE,WAAW,EAAE,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,WAAW,EAAE,CAAC;IACjE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC;QAAE,WAAW,EAAE,CAAC;IAC9E,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC;QAAE,WAAW,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IAC7C,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU;QAAE,WAAW,EAAE,CAAC;IACjE,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,UAAU;QAAE,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,YAA+B;IACxE,OAAO,QAAQ,KAAK,YAAY,CAAC,WAAW,IAAI,QAAQ,KAAK,YAAY,CAAC,gBAAgB,CAAC;AAC7F,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,aAAqB;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAyB;IAClD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,WAAW,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,gHAAgH,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACrJ,IAAI,CAAC,KAAK;QAAE,WAAW,EAAE,CAAC;IAC1B,OAAO;QACL,WAAW,EAAE,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE;QAChC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAE;QAC3B,eAAe;QACf,cAAc,EAAE,KAAK,CAAC,CAAC,CAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgB,EAAE,YAA+B;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE;QAC1C,YAAY,CAAC,cAAc,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW,EAAE,QAAgB;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG;YACjB,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAC/B,0BAA0B,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAChE,SAAS,CAAC,IAAI,KAAK,EAAE;YACrB,SAAS,CAAC,QAAQ,KAAK,EAAE;YACzB,SAAS,CAAC,QAAQ,KAAK,EAAE;YACzB,SAAS,CAAC,MAAM,KAAK,EAAE;YACvB,SAAS,CAAC,IAAI,KAAK,EAAE;SACtB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,OAAO,UAAU,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,GAAG,YAAY,GAAG,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,IAAI,GAAG,CAAC;QACb,2BAA2B,MAAM,GAAG;QACpC,qCAAqC,MAAM,OAAO;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,sBAAsB;QAAE,WAAW,EAAE,CAAC;IACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,WAAW,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,WAAW,EAAE,CAAC;IAClF,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACpC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,CAAC;IACnD,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,cAAsB;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;YAAE,WAAW,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,cAAc;YAAE,WAAW,EAAE,CAAC;QAClE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,WAAW,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,WAAW,EAAE,CAAC;QACzC,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc;YAAE,MAAM,KAAK,CAAC;QACjD,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,WAAW,EAAE,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA+B,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,WAAW,EAAE,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,QAAgB;IAClD,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;AACtE,CAAC"}

package/dist/tools.d.ts

@@ -2,7 +2,16 @@ import { McpServer } from '@modelcontextprotocol/server';
 import type { DataBasinApi } from './api-client.js';
 import type { AssistantAuthResult } from './auth.js';
 import type { DataBasinProfile } from './config.js';
-export declare const TOOL_NAMES: readonly ["databasin_auth_status", "databasin_login", "databasin_get_context", "databasin_search", "databasin_browse_schema", "databasin_get_operation", "databasin_cancel_operation"];
+export declare const LOCAL_AUTH_TOOL_NAMES: readonly ["databasin_auth_status", "databasin_login"];
+export declare const REMOTE_PRODUCT_TOOL_NAMES: readonly ["databasin_get_capabilities", "databasin_get_context", "databasin_search", "databasin_get_schema", "databasin_run_agent", "databasin_get_agent_run", "databasin_cancel_agent_run", "databasin_run_query", "databasin_get_query_status", "databasin_cancel_query", "databasin_run_assistant"];
+export declare const TOOL_NAMES: readonly ["databasin_auth_status", "databasin_login", "databasin_get_capabilities", "databasin_get_context", "databasin_search", "databasin_get_schema", "databasin_run_agent", "databasin_get_agent_run", "databasin_cancel_agent_run", "databasin_run_query", "databasin_get_query_status", "databasin_cancel_query", "databasin_run_assistant"];
+type PollingOptions = {
+    maxWaitMs: number;
+    initialDelayMs: number;
+    maxDelayMs: number;
+    sleep: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    now: () => number;
+};
 interface Dependencies {
     api: DataBasinApi;
     auth: {
@@ -11,6 +20,8 @@ interface Dependencies {
     };
     profile: DataBasinProfile;
     maxOutputBytes?: number;
+    polling?: Partial<PollingOptions>;
+    queryPolling?: Partial<PollingOptions>;
 }
 export declare function registerDataBasinTools(server: McpServer, dependencies: Dependencies): void;
 export {};

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAoB,MAAM,8BAA8B,CAAC;AAG3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAiBpD,eAAO,MAAM,UAAU,wLAQZ,CAAC;AAEZ,UAAU,YAAY;IACpB,GAAG,EAAE,YAAY,CAAC;IAClB,IAAI,EAAE;QACJ,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;KAChD,CAAC;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAkG1F"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAC;AAI7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA0BpD,eAAO,MAAM,qBAAqB,uDAGvB,CAAC;AAEZ,eAAO,MAAM,yBAAyB,wSAY3B,CAAC;AAEZ,eAAO,MAAM,UAAU,oVAGZ,CAAC;AAEZ,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB,CAAC;AAEF,UAAU,YAAY;IACpB,GAAG,EAAE,YAAY,CAAC;IAClB,IAAI,EAAE;QACJ,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;KAChD,CAAC;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACxC;AAoBD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAU1F"}

package/dist/tools.js

@@ -1,104 +1,306 @@
-import { ResourceTemplate } from '@modelcontextprotocol/server';
-import { z, ZodError } from 'zod';
+import { randomUUID } from 'node:crypto';
+import { ZodError } from 'zod';
+import { abortableDelay } from './abort.js';
+import { safeCorrelationId } from './correlation.js';
 import { DataBasinError, publicError } from './errors.js';
-import { mapCancel, mapConnections, mapOperation, mapProjects, mapSchema, mapSearch } from './mappers.js';
-import { assertSafeOutput, correlationId } from './safety.js';
-import { AssistantAuthOutputSchema, BrowseSchemaInputSchema, BrowseSchemaOutputSchema, CancelOperationInputSchema, CancelOperationOutputSchema, ContextOutputSchema, OperationInputSchema, OperationOutputSchema, SearchInputSchema, SearchOutputSchema } from './schemas.js';
-export const TOOL_NAMES = Object.freeze([
+import { assertSafeOutput, sanitizeOutput } from './safety.js';
+import { AgentRunEnvelopeSchema, AgentRunLookupInputSchema, AgentRunRequestSchema, AgentRunToolInputSchema, AssistantAuthOutputSchema, AssistantEnvelopeSchema, CapabilitiesEnvelopeSchema, CancelAgentRunInputSchema, ContextEnvelopeSchema, GetSchemaEnvelopeSchema, GetSchemaInputSchema, QueryEnvelopeSchema, QueryLookupInputSchema, RunAssistantInputSchema, RunQueryInputSchema, SearchEnvelopeSchema, SearchInputSchema } from './schemas.js';
+export const LOCAL_AUTH_TOOL_NAMES = Object.freeze([
     'databasin_auth_status',
-    'databasin_login',
+    'databasin_login'
+]);
+export const REMOTE_PRODUCT_TOOL_NAMES = Object.freeze([
+    'databasin_get_capabilities',
     'databasin_get_context',
     'databasin_search',
-    'databasin_browse_schema',
-    'databasin_get_operation',
-    'databasin_cancel_operation'
+    'databasin_get_schema',
+    'databasin_run_agent',
+    'databasin_get_agent_run',
+    'databasin_cancel_agent_run',
+    'databasin_run_query',
+    'databasin_get_query_status',
+    'databasin_cancel_query',
+    'databasin_run_assistant'
+]);
+export const TOOL_NAMES = Object.freeze([
+    ...LOCAL_AUTH_TOOL_NAMES,
+    ...REMOTE_PRODUCT_TOOL_NAMES
 ]);
+const DEFAULT_POLLING = {
+    maxWaitMs: 30 * 60 * 1_000,
+    initialDelayMs: 500,
+    maxDelayMs: 10_000,
+    sleep: abortableDelay,
+    now: Date.now
+};
+// A query is meant to feel like a fast synchronous tool call, not a long-running
+// job like an agent run -- bounded to 2 minutes, not 30.
+const DEFAULT_QUERY_POLLING = {
+    maxWaitMs: 120_000,
+    initialDelayMs: 500,
+    maxDelayMs: 10_000,
+    sleep: abortableDelay,
+    now: Date.now
+};
 export function registerDataBasinTools(server, dependencies) {
-    register(server, dependencies, 'databasin_auth_status', {
+    const polling = { ...DEFAULT_POLLING, ...dependencies.polling };
+    const queryPolling = { ...DEFAULT_QUERY_POLLING, ...dependencies.queryPolling };
+    registerAuthTools(server, dependencies);
+    registerReadTools(server, dependencies);
+    registerAgentRunTool(server, dependencies, polling);
+    registerAgentStatusTools(server, dependencies);
+    registerQueryTool(server, dependencies, queryPolling);
+    registerQueryStatusTools(server, dependencies);
+    registerAssistantTool(server, dependencies);
+}
+function registerAuthTools(server, dependencies) {
+    const authStatus = guardedTool(dependencies, {
         title: 'Check DataBasin sign-in',
-        description: 'Check whether this local MCP client is signed in or waiting for browser sign-in. Returns no account identity or credentials.',
-        inputSchema: z.object({}).strict(),
+        description: 'Check local sign-in state without returning account identity or credentials.',
+        inputSchema: emptyInputSchema(),
         outputSchema: AssistantAuthOutputSchema,
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
-    }, async () => dependencies.auth.getLoginStatus());
-    register(server, dependencies, 'databasin_login', {
+    }, async () => projectAuthOutput(await dependencies.auth.getLoginStatus()));
+    server.registerTool('databasin_auth_status', authStatus.definition, authStatus.callback);
+    const login = guardedTool(dependencies, {
         title: 'Sign in to DataBasin',
-        description: 'Start Microsoft device sign-in and return a short-lived URL and user code usable on any device. Credentials must be entered only on Microsoft\'s page.',
-        inputSchema: z.object({}).strict(),
+        description: 'Start Microsoft device sign-in. Enter credentials only on Microsoft\'s page; never provide credentials in chat.',
+        inputSchema: emptyInputSchema(),
         outputSchema: AssistantAuthOutputSchema,
         annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true }
-    }, async () => dependencies.auth.startLogin());
-    register(server, dependencies, 'databasin_get_context', {
+    }, async () => projectAuthOutput(await dependencies.auth.startLogin()));
+    server.registerTool('databasin_login', login.definition, login.callback);
+}
+function projectAuthOutput(raw) {
+    const output = AssistantAuthOutputSchema.parse(sanitizeOutput(raw));
+    return { ...output, message: authOutputMessage(output) };
+}
+function authOutputMessage(output) {
+    if (output.status === 'pending') {
+        return output.loginUrl === null
+            ? 'Microsoft is preparing the device sign-in instructions.'
+            : 'Microsoft device sign-in is ready. Use the approved login URL and user code, then call databasin_auth_status.';
+    }
+    if (output.status === 'authenticated')
+        return 'DataBasin sign-in is complete.';
+    if (output.status === 'not_authenticated')
+        return 'DataBasin is not signed in. Call databasin_login to begin.';
+    return 'DataBasin sign-in did not complete. Call databasin_login to try again.';
+}
+function registerReadTools(server, dependencies) {
+    const capabilities = guardedTool(dependencies, {
+        title: 'Get DataBasin capabilities',
+        description: 'Fetch the server-owned allowlist before using other DataBasin capabilities.',
+        inputSchema: emptyInputSchema(),
+        outputSchema: CapabilitiesEnvelopeSchema,
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
+    }, async (_input, signal) => dependencies.api.getCapabilities(signal));
+    server.registerTool('databasin_get_capabilities', capabilities.definition, capabilities.callback);
+    const context = guardedTool(dependencies, {
         title: 'Get DataBasin context',
-        description: 'Return projects and connection identifiers visible to the signed-in DataBasin user. Call this first after sign-in.',
-        inputSchema: z.object({}).strict(),
-        outputSchema: ContextOutputSchema,
+        description: 'Enumerate everything the signed-in user has access to: projects, connections (each with name, connector type/subtype, owning institution, and active status), and capabilities.',
+        inputSchema: emptyInputSchema(),
+        outputSchema: ContextEnvelopeSchema,
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
-    }, async (_input, signal) => {
-        const [projects, connections] = await Promise.all([
-            dependencies.api.getProjects(signal),
-            dependencies.api.getAccessibleConnections(signal)
-        ]);
-        return ContextOutputSchema.parse({
-            environment: dependencies.profile.environment,
-            projects: mapProjects(projects).slice(0, 500),
-            connections: mapConnections(connections).slice(0, 500),
-            capabilities: TOOL_NAMES
-        });
-    });
-    register(server, dependencies, 'databasin_search', {
+    }, async (_input, signal) => dependencies.api.getContext(signal));
+    server.registerTool('databasin_get_context', context.definition, context.callback);
+    const search = guardedTool(dependencies, {
         title: 'Search DataBasin',
-        description: 'Search visible pipelines, connectors, and automations using the fixed DataBasin API.',
+        description: 'Search: a bounded name/type substring match over the signed-in user\'s authorized scope (max 25 results). Not a listing facility -- use databasin_get_context to enumerate everything the caller has access to.',
         inputSchema: SearchInputSchema,
-        outputSchema: SearchOutputSchema,
+        outputSchema: SearchEnvelopeSchema,
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
-    }, async (input, signal) => mapSearch(await dependencies.api.search(input, signal), input.limit));
-    register(server, dependencies, 'databasin_browse_schema', {
-        title: 'Browse DataBasin schema',
-        description: 'Browse bounded catalogs, schemas, tables, or columns for one visible connector.',
-        inputSchema: BrowseSchemaInputSchema,
-        outputSchema: BrowseSchemaOutputSchema,
+    }, async (input, signal) => dependencies.api.search(input, signal));
+    server.registerTool('databasin_search', search.definition, search.callback);
+    const schema = guardedTool(dependencies, {
+        title: 'Get DataBasin schema metadata',
+        description: 'Read bounded non-secret catalogs, schemas, tables, or columns for one authorized connector. A POLICY_DENIED error may include a "reason" field with a specific, safe remediation hint (for example, which access is missing) when the server provides one.',
+        inputSchema: GetSchemaInputSchema,
+        outputSchema: GetSchemaEnvelopeSchema,
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
-    }, async (input, signal) => mapSchema(await dependencies.api.browseSchema(input, signal), input));
-    register(server, dependencies, 'databasin_get_operation', {
-        title: 'Get DataBasin query operation',
-        description: 'Read bounded status and results for a caller-visible DataBasin query operation.',
-        inputSchema: OperationInputSchema,
-        outputSchema: OperationOutputSchema,
+    }, async (input, signal) => dependencies.api.getSchema(input, signal));
+    server.registerTool('databasin_get_schema', schema.definition, schema.callback);
+}
+function registerAgentRunTool(server, dependencies, polling) {
+    const runAgent = guardedTool(dependencies, {
+        title: 'Run a DataBasin metadata agent',
+        description: 'Start the fixed metadata_readonly agent profile for an explicit institution and optional project/connector scope. No arbitrary SQL, commands, URLs, headers, or credentials are accepted. If the run is still not finished after the 30-minute polling limit, the last observed non-terminal run (for example status "running") is returned with its runId; use databasin_get_agent_run or databasin_cancel_agent_run to follow up.',
+        inputSchema: AgentRunToolInputSchema,
+        outputSchema: AgentRunEnvelopeSchema,
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true }
+    }, async (input, signal) => {
+        const { idempotencyKey, ...rawRequest } = input;
+        const request = AgentRunRequestSchema.parse(rawRequest);
+        const created = await dependencies.api.createAgentRun(request, idempotencyKey ?? randomUUID(), signal);
+        if (isTerminal(created.data.status))
+            return created;
+        try {
+            return await pollAgentRun(dependencies.api, created, signal, polling);
+        }
+        catch (error) {
+            if (isCallerAbort(error, signal))
+                await requestCancellation(dependencies.api, created.data.runId);
+            throw error;
+        }
+    });
+    server.registerTool('databasin_run_agent', runAgent.definition, runAgent.callback);
+}
+function registerAgentStatusTools(server, dependencies) {
+    const getRun = guardedTool(dependencies, {
+        title: 'Get a DataBasin agent run',
+        description: 'Read the current bounded status/result and complete server-authorized scope of an agent run.',
+        inputSchema: AgentRunLookupInputSchema,
+        outputSchema: AgentRunEnvelopeSchema,
         annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
-    }, async (input, signal) => mapOperation(await dependencies.api.getOperation(input.operationId, { offset: input.offset, limit: input.limit }, signal), input.operationId, { offset: input.offset, limit: input.limit }));
-    register(server, dependencies, 'databasin_cancel_operation', {
-        title: 'Cancel DataBasin query operation',
-        description: 'Request cancellation of a caller-visible DataBasin query operation. Cancellation is re-authorized by the API.',
-        inputSchema: CancelOperationInputSchema,
-        outputSchema: CancelOperationOutputSchema,
+    }, async (input, signal) => dependencies.api.getAgentRun(input.runId, signal));
+    server.registerTool('databasin_get_agent_run', getRun.definition, getRun.callback);
+    const cancelRun = guardedTool(dependencies, {
+        title: 'Cancel a DataBasin agent run',
+        description: 'Request cancellation of an authorized agent run. A running provider may remain running until it acknowledges cancellation; this tool never claims cancellation before the server reports it.',
+        inputSchema: CancelAgentRunInputSchema,
+        outputSchema: AgentRunEnvelopeSchema,
         annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
-    }, async (input, signal) => mapCancel(await dependencies.api.cancelOperation(input.operationId, signal), input.operationId));
-    server.registerResource('databasin-operation', new ResourceTemplate('databasin://operations/{operationId}', { list: undefined }), {
-        title: 'DataBasin operation result',
-        description: 'Bounded, re-authorized DataBasin operation status and first result page.',
-        mimeType: 'application/json',
-        cacheHint: { cacheScope: 'private', ttlMs: 0 }
-    }, async (uri, variables) => {
+    }, async (input, signal) => dependencies.api.cancelAgentRun(input.runId, input.idempotencyKey ?? randomUUID(), input.reason, signal));
+    server.registerTool('databasin_cancel_agent_run', cancelRun.definition, cancelRun.callback);
+}
+function registerQueryTool(server, dependencies, polling) {
+    const runQuery = guardedTool(dependencies, {
+        title: 'Run a read-only DataBasin SQL query',
+        description: 'Execute a single read-only SELECT or WITH statement against an authorized connector and return up to maxRows rows (default and hard max 1000). No INSERT, UPDATE, DELETE, DDL, or other mutating statements are accepted, and multi-statement text is rejected outright. If the query is still not finished after the 2-minute polling limit, the last observed non-terminal status (for example "running") is returned with its queryId; use databasin_get_query_status or databasin_cancel_query to follow up.',
+        inputSchema: RunQueryInputSchema,
+        outputSchema: QueryEnvelopeSchema,
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true }
+    }, async (input, signal) => {
+        const created = await dependencies.api.runQuery(input, signal);
+        if (isQueryTerminal(created.data.status))
+            return created;
         try {
-            const operationId = String(variables.operationId ?? '');
-            if (!operationId || operationId.length > 256)
-                throw new DataBasinError('INVALID_ARGUMENT', 'A valid operation ID is required.');
-            const output = mapOperation(await dependencies.api.getOperation(operationId, { offset: 0, limit: 100 }), operationId, { offset: 0, limit: 100 });
-            assertSafeOutput(output, dependencies.maxOutputBytes);
-            return { contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(output) }] };
+            return await pollQuery(dependencies.api, created, signal, polling);
         }
         catch (error) {
-            const safe = { ...publicError(error), correlationId: correlationId() };
-            return { contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(safe) }] };
+            if (isCallerAbort(error, signal))
+                await requestQueryCancellation(dependencies.api, created.data.queryId);
+            throw error;
         }
     });
+    server.registerTool('databasin_run_query', runQuery.definition, runQuery.callback);
+}
+function registerQueryStatusTools(server, dependencies) {
+    const getStatus = guardedTool(dependencies, {
+        title: 'Get a DataBasin query status',
+        description: 'Read the current bounded status of a query started by databasin_run_query, including its columns, rows (capped at the run\'s maxRows), and error once the query reaches a terminal status.',
+        inputSchema: QueryLookupInputSchema,
+        outputSchema: QueryEnvelopeSchema,
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false }
+    }, async (input, signal) => dependencies.api.getQueryStatus(input.queryId, signal));
+    server.registerTool('databasin_get_query_status', getStatus.definition, getStatus.callback);
+    const cancelQuery = guardedTool(dependencies, {
+        title: 'Cancel a DataBasin query',
+        description: 'Request cancellation of an authorized, in-progress query. A running engine may remain running until it acknowledges cancellation; this tool never claims cancellation before the server reports it.',
+        inputSchema: QueryLookupInputSchema,
+        outputSchema: QueryEnvelopeSchema,
+        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
+    }, async (input, signal) => dependencies.api.cancelQuery(input.queryId, signal));
+    server.registerTool('databasin_cancel_query', cancelQuery.definition, cancelQuery.callback);
+}
+function registerAssistantTool(server, dependencies) {
+    const runAssistant = guardedTool(dependencies, {
+        title: 'Run the DataBasin assistant',
+        description: 'A read-only DataBasin assistant (a server-side Claude Code agent) that can browse metadata and run DataBasin skills over multiple steps to answer a natural-language request. Requires an LLM connectorId. Read-only: no data writes and no SQL execution -- use databasin_run_query for SQL. Synchronous, and may take up to a few minutes to return.',
+        inputSchema: RunAssistantInputSchema,
+        outputSchema: AssistantEnvelopeSchema,
+        annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true }
+    }, async (input, signal) => dependencies.api.runAssistant(input, signal));
+    server.registerTool('databasin_run_assistant', runAssistant.definition, runAssistant.callback);
 }
-function register(server, dependencies, name, definition, handler) {
-    server.registerTool(name, definition, async (rawInput, context) => {
+async function pollAgentRun(api, initial, signal, options) {
+    let current = initial;
+    let delay = options.initialDelayMs;
+    const deadline = options.now() + options.maxWaitMs;
+    while (!isTerminal(current.data.status)) {
+        if (signal?.aborted)
+            throw new DataBasinError('REQUEST_ABORTED', 'The DataBasin request was cancelled by the caller.');
+        const remaining = deadline - options.now();
+        if (remaining <= 0)
+            return current;
+        try {
+            await options.sleep(Math.min(delay, remaining), signal);
+        }
+        catch (error) {
+            if (signal?.aborted) {
+                throw new DataBasinError('REQUEST_ABORTED', 'The DataBasin request was cancelled by the caller.');
+            }
+            throw error;
+        }
+        current = await api.getAgentRun(current.data.runId, signal);
+        delay = Math.min(delay * 2, options.maxDelayMs);
+    }
+    return current;
+}
+async function requestCancellation(api, runId) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    try {
+        await api.cancelAgentRun(runId, randomUUID(), 'user_requested', controller.signal);
+    }
+    catch {
+        // The caller's cancellation remains authoritative; do not claim a server state.
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function isTerminal(status) {
+    return status === 'completed' || status === 'failed' || status === 'cancelled';
+}
+async function pollQuery(api, initial, signal, options) {
+    let current = initial;
+    let delay = options.initialDelayMs;
+    const deadline = options.now() + options.maxWaitMs;
+    while (!isQueryTerminal(current.data.status)) {
+        if (signal?.aborted)
+            throw new DataBasinError('REQUEST_ABORTED', 'The DataBasin request was cancelled by the caller.');
+        const remaining = deadline - options.now();
+        if (remaining <= 0)
+            return current;
+        try {
+            await options.sleep(Math.min(delay, remaining), signal);
+        }
+        catch (error) {
+            if (signal?.aborted) {
+                throw new DataBasinError('REQUEST_ABORTED', 'The DataBasin request was cancelled by the caller.');
+            }
+            throw error;
+        }
+        current = await api.getQueryStatus(current.data.queryId, signal);
+        delay = Math.min(delay * 2, options.maxDelayMs);
+    }
+    return current;
+}
+async function requestQueryCancellation(api, queryId) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5_000);
+    try {
+        await api.cancelQuery(queryId, controller.signal);
+    }
+    catch {
+        // The caller's cancellation remains authoritative; do not claim a server state.
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function isQueryTerminal(status) {
+    return status === 'completed' || status === 'failed' || status === 'cancelled';
+}
+function isCallerAbort(error, signal) {
+    return signal?.aborted === true || error instanceof DataBasinError && error.code === 'REQUEST_ABORTED';
+}
+function guardedTool(dependencies, definition, handler) {
+    const callback = async (rawInput, context) => {
         try {
             const input = definition.inputSchema.parse(rawInput ?? {});
-            const output = definition.outputSchema.parse(await handler(input, context.mcpReq.signal));
+            const output = definition.outputSchema.parse(sanitizeOutput(await handler(input, context.mcpReq.signal)));
             assertSafeOutput(output, dependencies.maxOutputBytes);
             return {
                 content: [{ type: 'text', text: JSON.stringify(output) }],
@@ -109,9 +311,18 @@ function register(server, dependencies, name, definition, handler) {
             const normalized = error instanceof ZodError
                 ? new DataBasinError('INVALID_ARGUMENT', error.issues[0]?.message ?? 'The tool arguments are invalid.')
                 : error;
-            const safe = { ...publicError(normalized), correlationId: correlationId() };
+            const visible = publicError(normalized);
+            const { correlationId: upstreamCorrelation, ...publicFields } = visible;
+            const safe = {
+                ...publicFields,
+                correlationId: safeCorrelationId(upstreamCorrelation)
+            };
             return { content: [{ type: 'text', text: JSON.stringify(safe) }], isError: true };
         }
-    });
+    };
+    return Object.freeze({ definition, callback });
+}
+function emptyInputSchema() {
+    return AgentRunLookupInputSchema.pick({}).strict();
 }
 //# sourceMappingURL=tools.js.map