@databasin/mcp-client 0.1.0 → 0.2.0

package/dist/login-url.js

@@ -0,0 +1,82 @@
+/**
+ * Microsoft-owned device sign-in locations. Entra has changed the
+ * verification URI it returns over time — the original pin of exactly
+ * microsoft.com/devicelogin rejected Microsoft's own current response
+ * (login.microsoft.com/device, observed 2026-08-26), making sign-in
+ * impossible. Every entry is a first-party Microsoft host with its exact
+ * expected path; anything else is still rejected, and the returned value is
+ * the canonical form, never the raw input.
+ */
+const DEVICE_LOGIN_LOCATIONS = new Map([
+    ['microsoft.com', new Set(['/devicelogin', '/devicelogin/'])],
+    ['www.microsoft.com', new Set(['/devicelogin', '/devicelogin/'])],
+    ['login.microsoft.com', new Set(['/device', '/device/'])]
+]);
+const INTERACTIVE_SUFFIX = '/oauth2/v2.0/authorize';
+export function projectDevicePrompt(response) {
+    const verificationUri = validateDeviceLoginUrl(response.verificationUri);
+    const userCode = validateUserCode(response.userCode);
+    const expiresIn = validateExpiresIn(response.expiresIn);
+    return Object.freeze({ userCode, verificationUri, expiresIn });
+}
+export function validateDeviceLoginUrl(value) {
+    const url = parseUrl(value);
+    assertSafeHttpsUrl(url);
+    const paths = DEVICE_LOGIN_LOCATIONS.get(url.hostname);
+    if (!paths || !paths.has(url.pathname)) {
+        throw new Error('Microsoft returned an unexpected device sign-in URL.');
+    }
+    if (url.search || url.hash)
+        throw new Error('Microsoft returned an unexpected device sign-in URL.');
+    return `https://${url.hostname}${url.pathname.replace(/\/$/u, '')}`;
+}
+export function validateInteractiveLoginUrl(rawUrl, profile) {
+    const url = parseUrl(rawUrl);
+    assertSafeHttpsUrl(url);
+    if (url.hash)
+        throw new Error('Refusing to open an unexpected OAuth URL.');
+    const segments = url.pathname.split('/').filter(Boolean);
+    const expectedTenant = profile?.tenantId.toLowerCase();
+    const tenant = segments[0]?.toLowerCase();
+    const expectedPath = tenant === undefined ? '' : `/${tenant}${INTERACTIVE_SUFFIX}`;
+    const validTenant = expectedTenant === undefined ? isUuid(tenant) : tenant === expectedTenant;
+    if (url.hostname !== 'login.microsoftonline.com' || !validTenant || url.pathname.toLowerCase() !== expectedPath) {
+        throw new Error('Refusing to open an unexpected OAuth URL.');
+    }
+    if (profile && url.searchParams.get('client_id') !== profile.clientId) {
+        throw new Error('Refusing to open an OAuth URL for an unexpected client.');
+    }
+    return url.toString();
+}
+function parseUrl(value) {
+    if (typeof value !== 'string' || value.length > 4_096)
+        throw new Error('Microsoft returned an invalid sign-in URL.');
+    try {
+        return new URL(value);
+    }
+    catch {
+        throw new Error('Microsoft returned an invalid sign-in URL.');
+    }
+}
+function assertSafeHttpsUrl(url) {
+    if (url.protocol !== 'https:' || url.username || url.password || url.port) {
+        throw new Error('Microsoft returned an unsafe sign-in URL.');
+    }
+}
+function validateUserCode(value) {
+    if (typeof value !== 'string' || !/^[A-Z0-9-]{4,32}$/iu.test(value)) {
+        throw new Error('Microsoft returned an invalid device sign-in code.');
+    }
+    return value;
+}
+function validateExpiresIn(value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > 1_800) {
+        throw new Error('Microsoft returned an invalid device sign-in expiry.');
+    }
+    return value;
+}
+function isUuid(value) {
+    return value !== undefined
+        && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value);
+}
+//# sourceMappingURL=login-url.js.map

package/dist/login-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-url.js","sourceRoot":"","sources":["../src/login-url.ts"],"names":[],"mappings":"AAiBA;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAA6C,IAAI,GAAG,CAAC;IAC/E,CAAC,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD,MAAM,UAAU,mBAAmB,CAAC,QAA+B;IACjE,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACpG,OAAO,WAAW,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,OAA0B;IACpF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACnF,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC;IAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,2BAA2B,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QAChH,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrH,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAyB;IACvC,OAAO,KAAK,KAAK,SAAS;WACrB,6EAA6E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjG,CAAC"}

package/dist/mcp-endpoint.d.ts

@@ -0,0 +1,5 @@
+import { type DataBasinProfile } from './config.js';
+export declare const MCP_ENDPOINT_PATH: "/mcp";
+export declare function mcpEndpointForProfile(profile: DataBasinProfile): URL;
+export declare function assertBuiltInProfile(profile: DataBasinProfile): void;
+//# sourceMappingURL=mcp-endpoint.d.ts.map

package/dist/mcp-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint.d.ts","sourceRoot":"","sources":["../src/mcp-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,eAAO,MAAM,iBAAiB,EAAG,MAAe,CAAC;AAEjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,GAAG,CAOpE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CASpE"}

package/dist/mcp-endpoint.js

@@ -0,0 +1,22 @@
+import { getProfile } from './config.js';
+export const MCP_ENDPOINT_PATH = '/mcp';
+export function mcpEndpointForProfile(profile) {
+    assertBuiltInProfile(profile);
+    const endpoint = new URL(profile.apiBaseUrl);
+    endpoint.pathname = MCP_ENDPOINT_PATH;
+    endpoint.search = '';
+    endpoint.hash = '';
+    return endpoint;
+}
+export function assertBuiltInProfile(profile) {
+    const expected = getProfile(profile.environment);
+    const matches = profile.label === expected.label
+        && profile.apiBaseUrl === expected.apiBaseUrl
+        && profile.tenantId === expected.tenantId
+        && profile.clientId === expected.clientId
+        && profile.scopes.length === expected.scopes.length
+        && profile.scopes.every((scope, index) => scope === expected.scopes[index]);
+    if (!matches)
+        throw new Error('Only the built-in DataBasin production and NP profiles are permitted.');
+}
+//# sourceMappingURL=mcp-endpoint.js.map

package/dist/mcp-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint.js","sourceRoot":"","sources":["../src/mcp-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAyB,MAAM,aAAa,CAAC;AAEhE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAe,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,OAAyB;IAC7D,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,QAAQ,CAAC,QAAQ,GAAG,iBAAiB,CAAC;IACtC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;IACrB,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;IACnB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;WAC3C,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC1C,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;WACtC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;WACtC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;WAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;AACzG,CAAC"}

package/dist/proxy-tools.d.ts

@@ -0,0 +1,5 @@
+import { type Tool } from '@modelcontextprotocol/client';
+import { McpServer } from '@modelcontextprotocol/server';
+import type { RemoteMcp } from './remote-mcp.js';
+export declare function registerRemoteTools(server: McpServer, remote: RemoteMcp, tools: readonly Tool[]): readonly string[];
+//# sourceMappingURL=proxy-tools.d.ts.map

package/dist/proxy-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-tools.d.ts","sourceRoot":"","sources":["../src/proxy-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAIzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,SAAS,IAAI,EAAE,GACrB,SAAS,MAAM,EAAE,CAQnB"}

package/dist/proxy-tools.js

@@ -0,0 +1,39 @@
+import { fromJsonSchema } from '@modelcontextprotocol/client';
+import { safeCorrelationId } from './correlation.js';
+import { publicError } from './errors.js';
+import { LOCAL_AUTH_TOOL_NAMES } from './auth-tools.js';
+export function registerRemoteTools(server, remote, tools) {
+    const names = new Set(LOCAL_AUTH_TOOL_NAMES);
+    for (const tool of tools) {
+        if (names.has(tool.name))
+            throw new Error(`The remote MCP server advertised duplicate tool "${tool.name}".`);
+        names.add(tool.name);
+        registerRemoteTool(server, remote, tool);
+    }
+    return tools.map((tool) => tool.name);
+}
+function registerRemoteTool(server, remote, tool) {
+    const outputSchema = tool.outputSchema
+        ? fromJsonSchema(tool.outputSchema)
+        : undefined;
+    server.registerTool(tool.name, {
+        ...(tool.title ? { title: tool.title } : {}),
+        ...(tool.description ? { description: tool.description } : {}),
+        inputSchema: fromJsonSchema(tool.inputSchema),
+        ...(outputSchema ? { outputSchema } : {}),
+        ...(tool.annotations ? { annotations: tool.annotations } : {}),
+        ...(tool.icons ? { icons: [...tool.icons] } : {}),
+        ...(tool._meta ? { _meta: tool._meta } : {})
+    }, async (args, context) => {
+        try {
+            return await remote.callTool(tool, args, context.mcpReq.signal);
+        }
+        catch (error) {
+            const visible = publicError(error);
+            const { correlationId, ...publicFields } = visible;
+            const safe = { ...publicFields, correlationId: safeCorrelationId(correlationId) };
+            return { content: [{ type: 'text', text: JSON.stringify(safe) }], isError: true };
+        }
+    });
+}
+//# sourceMappingURL=proxy-tools.js.map

package/dist/proxy-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-tools.js","sourceRoot":"","sources":["../src/proxy-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAkC,MAAM,8BAA8B,CAAC;AAE9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,MAAiB,EACjB,KAAsB;IAEtB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAC7G,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiB,EAAE,MAAiB,EAAE,IAAU;IAC1E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY;QACpC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,YAA8B,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,WAA6B,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;YACnD,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YAClF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/remote-mcp.d.ts

@@ -0,0 +1,27 @@
+import { type CallToolResult, type FetchLike, type Tool } from '@modelcontextprotocol/client';
+import type { DataBasinProfile } from './config.js';
+export declare const REMOTE_PROTOCOL_VERSION: "2026-07-28";
+export interface RemoteMcp {
+    connect(): Promise<readonly Tool[]>;
+    callTool(tool: Tool, args: unknown, signal?: AbortSignal): Promise<CallToolResult>;
+    close(): Promise<void>;
+}
+export type RemoteAuth = Readonly<{
+    profile: DataBasinProfile;
+    getAccessToken(): Promise<string>;
+}>;
+export type OfficialRemoteMcpOptions = Readonly<{
+    auth: RemoteAuth;
+    fetchImpl?: FetchLike;
+}>;
+export declare class OfficialRemoteMcp implements RemoteMcp {
+    private readonly client;
+    private readonly transport;
+    private connected;
+    constructor(options: OfficialRemoteMcpOptions);
+    connect(): Promise<readonly Tool[]>;
+    callTool(tool: Tool, args: unknown, signal?: AbortSignal): Promise<CallToolResult>;
+    close(): Promise<void>;
+}
+export declare function authenticatedFetch(auth: RemoteAuth, fetchImpl: FetchLike): FetchLike;
+//# sourceMappingURL=remote-mcp.d.ts.map

package/dist/remote-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,IAAI,EACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,eAAO,MAAM,uBAAuB,EAAG,YAAqB,CAAC;AAE7D,MAAM,WAAW,SAAS;IACxB,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC,CAAC;AAEH,qBAAa,iBAAkB,YAAW,SAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,wBAAwB;IAevC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAazC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAW5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,SAAS,CAWpF"}

package/dist/remote-mcp.js

@@ -0,0 +1,70 @@
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { randomUUID } from 'node:crypto';
+import { mcpEndpointForProfile } from './mcp-endpoint.js';
+import { VERSION } from './version.js';
+export const REMOTE_PROTOCOL_VERSION = '2026-07-28';
+export class OfficialRemoteMcp {
+    client;
+    transport;
+    connected = false;
+    constructor(options) {
+        const fetchImpl = authenticatedFetch(options.auth, options.fetchImpl ?? globalThis.fetch);
+        this.client = new Client({ name: 'databasin-mcp-client-proxy', version: VERSION }, {
+            enforceStrictCapabilities: true,
+            versionNegotiation: { mode: { pin: REMOTE_PROTOCOL_VERSION } }
+        });
+        this.transport = new StreamableHTTPClientTransport(mcpEndpointForProfile(options.auth.profile), {
+            fetch: fetchImpl,
+            onInsufficientScope: 'throw'
+        });
+    }
+    async connect() {
+        if (!this.connected) {
+            try {
+                await this.client.connect(this.transport);
+                this.connected = true;
+            }
+            catch (error) {
+                await this.close();
+                throw error;
+            }
+        }
+        return (await this.client.listTools(undefined, { cacheMode: 'refresh' })).tools;
+    }
+    callTool(tool, args, signal) {
+        return this.client.callTool({ name: tool.name, arguments: asArguments(args) }, {
+            toolDefinition: tool,
+            timeout: requestTimeout(tool),
+            ...(signal ? { signal } : {})
+        });
+    }
+    async close() {
+        this.connected = false;
+        await this.client.close();
+    }
+}
+export function authenticatedFetch(auth, fetchImpl) {
+    return async (url, init = {}) => {
+        const headers = new Headers(init.headers);
+        if (headers.get('Mcp-Method') === 'tools/call') {
+            headers.set('Authorization', `Bearer ${await auth.getAccessToken()}`);
+            headers.set('X-Correlation-Id', randomUUID());
+        }
+        else {
+            headers.delete('Authorization');
+        }
+        return fetchImpl(url, { ...init, redirect: 'error', headers });
+    };
+}
+function asArguments(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function requestTimeout(tool) {
+    const value = tool._meta?.['com.databasin/requestTimeoutMs'];
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 1_000 && value <= 2_000_000
+        ? value
+        : 60_000;
+}
+//# sourceMappingURL=remote-mcp.js.map

package/dist/remote-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,6BAA6B,EAI9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAqB,CAAC;AAkB7D,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAS;IACf,SAAS,CAAgC;IAClD,SAAS,GAAG,KAAK,CAAC;IAE1B,YAAY,OAAiC;QAC3C,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CACtB,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,OAAO,EAAE,EACxD;YACE,yBAAyB,EAAE,IAAI;YAC/B,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE;SAC/D,CACF,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC9F,KAAK,EAAE,SAAS;YAChB,mBAAmB,EAAE,OAAO;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IAED,QAAQ,CAAC,IAAU,EAAE,IAAa,EAAE,MAAoB;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CACzB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EACjD;YACE,cAAc,EAAE,IAAI;YACpB,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAgB,EAAE,SAAoB;IACvE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,gCAAgC,CAAC,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,SAAS;QACrG,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC;AACb,CAAC"}

package/dist/safety.d.ts

@@ -1,3 +1,7 @@
+export declare function isSensitiveKey(key: string): boolean;
+export declare function containsSensitiveMaterial(value: string): boolean;
+export declare function redactSensitiveText(value: string): string;
+export declare function sanitizeOutput(value: unknown): unknown;
 export declare function assertSafeOutput(value: unknown, maxBytes?: number): void;
 export declare function correlationId(): string;
 //# sourceMappingURL=safety.d.ts.map

package/dist/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../src/safety.ts"],"names":[],"mappings":"AAMA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAY,GAAG,IAAI,CAK3E;AAgBD,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../src/safety.ts"],"names":[],"mappings":"AA0BA,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAShE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASzD;AAMD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAY,GAAG,IAAI,CAM3E;AA8CD,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/safety.js

@@ -1,27 +1,111 @@
-import { randomUUID } from 'node:crypto';
+import { freshCorrelationId } from './correlation.js';
 import { DataBasinError } from './errors.js';
-const SENSITIVE_KEY = /(?:pass(word)?|secret|token|api[-_]?key|credential|authorization|cookie|webhook|signed[-_]?url|connection[-_]?string|private[-_]?key|client[-_]?secret|keyvault)/iu;
+const SENSITIVE_KEY = /(?:pass(?:word|wd)?|pwd|secret|token|api[-_]?key|credential|authorization|cookie|webhook|signed[-_]?url|connection[-_]?string|private[-_]?key|client[-_]?secret|keyvault)/iu;
+const JWT_SOURCE = String.raw `\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b`;
+const BEARER_SOURCE = String.raw `\bbearer\s+[a-z0-9._~+/=-]{12,}`;
+const JDBC_SOURCE = String.raw `\bjdbc:[^\s"'<>]+`;
+const DATABASE_URI_SOURCE = String.raw `\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|sqlserver|redis):\/\/[^\s"'<>]+`;
+const PEM_SOURCE = String.raw `-----BEGIN [A-Z0-9 ]*(?:PRIVATE KEY|CERTIFICATE)-----[\s\S]*?-----END [A-Z0-9 ]*(?:PRIVATE KEY|CERTIFICATE)-----`;
+const KEY_VALUE_SOURCE = String.raw `\b(?:password|passwd|pwd|secret|token|access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|client[_-]?secret)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)`;
+const JWT = new RegExp(JWT_SOURCE, 'u');
+const BEARER = new RegExp(BEARER_SOURCE, 'iu');
+const JDBC = new RegExp(JDBC_SOURCE, 'iu');
+const DATABASE_URI = new RegExp(DATABASE_URI_SOURCE, 'iu');
+const PEM = new RegExp(PEM_SOURCE, 'u');
+const KEY_VALUE = new RegExp(KEY_VALUE_SOURCE, 'iu');
+const REDACTED_KEY_VALUE = /\b(?:password|passwd|pwd|secret|token|access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|client[_-]?secret)\b\s*[:=]\s*(?:"\[REDACTED\]"|'\[REDACTED\]'|\[REDACTED\])/giu;
+const DB_LOCATION_FIELD = /\b(?:server|host|data source|database)\s*=/iu;
+const DB_CREDENTIAL_FIELD = /\b(?:password|pwd|user id|uid)\s*=/iu;
+const REDACT_PEM = new RegExp(PEM_SOURCE, 'gu');
+const REDACT_JWT = new RegExp(JWT_SOURCE, 'gu');
+const REDACT_BEARER = new RegExp(BEARER_SOURCE, 'giu');
+const REDACT_JDBC = new RegExp(JDBC_SOURCE, 'giu');
+const REDACT_DATABASE_URI = new RegExp(DATABASE_URI_SOURCE, 'giu');
+const REDACT_KEY_VALUE = new RegExp(KEY_VALUE_SOURCE.replace('(?:password', '(password'), 'giu');
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEY.test(key);
+}
+export function containsSensitiveMaterial(value) {
+    const candidate = value.replace(REDACTED_KEY_VALUE, '');
+    return JWT.test(candidate)
+        || BEARER.test(candidate)
+        || JDBC.test(candidate)
+        || DATABASE_URI.test(candidate)
+        || PEM.test(candidate)
+        || KEY_VALUE.test(candidate)
+        || isDatabaseConnectionString(candidate);
+}
+export function redactSensitiveText(value) {
+    if (isDatabaseConnectionString(value))
+        return '[REDACTED]';
+    return value
+        .replace(REDACT_PEM, '[REDACTED]')
+        .replace(REDACT_JWT, '[REDACTED]')
+        .replace(REDACT_BEARER, 'Bearer [REDACTED]')
+        .replace(REDACT_JDBC, '[REDACTED]')
+        .replace(REDACT_DATABASE_URI, '[REDACTED]')
+        .replace(REDACT_KEY_VALUE, '$1=[REDACTED]');
+}
+function isDatabaseConnectionString(value) {
+    return DB_LOCATION_FIELD.test(value) && DB_CREDENTIAL_FIELD.test(value);
+}
+export function sanitizeOutput(value) {
+    return sanitize(value);
+}
 export function assertSafeOutput(value, maxBytes = 1_048_576) {
-    inspectKeys(value, '$');
-    if (Buffer.byteLength(JSON.stringify(value), 'utf8') > maxBytes) {
+    inspect(value);
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined || Buffer.byteLength(serialized, 'utf8') > maxBytes) {
         throw new DataBasinError('POLICY_DENIED', 'The tool output exceeded the response-size limit.');
     }
 }
-function inspectKeys(value, path) {
+function sanitize(value) {
+    if (Array.isArray(value))
+        return value.map(sanitize);
+    if (typeof value === 'string')
+        return redactSensitiveText(value);
+    if (!value || typeof value !== 'object')
+        return value;
+    return sanitizeRecord(value);
+}
+function sanitizeRecord(object) {
+    const output = {};
+    const fieldName = namedField(object);
+    for (const [key, child] of Object.entries(object)) {
+        output[key] = shouldRedact(key, fieldName) ? '[REDACTED]' : sanitize(child);
+    }
+    return output;
+}
+function namedField(object) {
+    if (typeof object.name === 'string')
+        return object.name;
+    return typeof object.key === 'string' ? object.key : undefined;
+}
+function shouldRedact(key, fieldName) {
+    if (isSensitiveKey(key))
+        return true;
+    return key === 'value' && fieldName !== undefined && isSensitiveKey(fieldName);
+}
+function inspect(value) {
     if (Array.isArray(value)) {
-        value.forEach((child, index) => inspectKeys(child, `${path}[${index}]`));
+        value.forEach(inspect);
+        return;
+    }
+    if (typeof value === 'string') {
+        if (containsSensitiveMaterial(value))
+            throw new DataBasinError('POLICY_DENIED', 'Sensitive material was blocked from tool output.');
         return;
     }
     if (!value || typeof value !== 'object')
         return;
     for (const [key, child] of Object.entries(value)) {
-        if (SENSITIVE_KEY.test(key)) {
-            throw new DataBasinError('INTERNAL_ERROR', `A sensitive field was blocked at ${path}.`);
+        if (isSensitiveKey(key) && child !== '[REDACTED]') {
+            throw new DataBasinError('POLICY_DENIED', 'Sensitive material was blocked from tool output.');
         }
-        inspectKeys(child, `${path}.${key}`);
+        inspect(child);
     }
 }
 export function correlationId() {
-    return randomUUID();
+    return freshCorrelationId();
 }
 //# sourceMappingURL=safety.js.map

package/dist/safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety.js","sourceRoot":"","sources":["../src/safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,aAAa,GAAG,oKAAoK,CAAC;AAE3L,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAQ,GAAG,SAAS;IACnE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,oCAAoC,IAAI,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,WAAW,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../src/safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,aAAa,GAAG,6KAA6K,CAAC;AACpM,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAAC;AAC9F,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAA,iCAAiC,CAAC;AAClE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,mBAAmB,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA,sFAAsF,CAAC;AAC7H,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,kHAAkH,CAAC;AAChJ,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAA,8JAA8J,CAAC;AAClM,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAC/C,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC3C,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;AAC3D,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACxC,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACrD,MAAM,kBAAkB,GAAG,mLAAmL,CAAC;AAC/M,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACvD,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AACnD,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AAEjG,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;WACrB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;WACtB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;WACpB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;WAC5B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;WACnB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;WACzB,0BAA0B,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,OAAO,KAAK;SACT,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;SACjC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;SACjC,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAC3C,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC;SAClC,OAAO,CAAC,mBAAmB,EAAE,YAAY,CAAC;SAC1C,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAQ,GAAG,SAAS;IACnE,OAAO,CAAC,KAAK,CAAC,CAAC;IACf,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,cAAc,CAAC,KAAgC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B;IACjD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACxD,OAAO,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,SAA6B;IAC9D,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,GAAG,KAAK,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,yBAAyB,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;QACpI,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAClD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC"}

package/dist/server.d.ts

@@ -1,22 +1,20 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { type StdioServerHandle } from '@modelcontextprotocol/server/stdio';
-import { type DataBasinApi } from './api-client.js';
-import type { AssistantAuthResult } from './auth.js';
+import { type AssistantAuthResult } from './auth.js';
 import { type DataBasinEnvironment, type DataBasinProfile } from './config.js';
+import { type RemoteMcp } from './remote-mcp.js';
 export declare const SERVER_NAME = "databasin-mcp";
-export declare const SERVER_VERSION = "0.1.0";
+export declare const SERVER_VERSION = "0.2.0";
 export declare const SERVER_INSTRUCTIONS: string;
 export interface CreateServerOptions {
     environment?: DataBasinEnvironment;
-    profile?: DataBasinProfile;
     auth?: {
         profile: DataBasinProfile;
         getAccessToken(): Promise<string>;
         startLogin(): Promise<AssistantAuthResult>;
         getLoginStatus(): Promise<AssistantAuthResult>;
     };
-    api?: DataBasinApi;
-    fetchImpl?: typeof fetch;
+    remote?: RemoteMcp;
 }
 export declare function createDataBasinServer(options?: CreateServerOptions): Promise<McpServer>;
 export declare function serveDataBasinStdio(options?: CreateServerOptions): StdioServerHandle;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAExF,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAc,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI3F,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,eAAO,MAAM,mBAAmB,QAMrB,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;KAChD,CAAC;IACF,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,wBAAsB,qBAAqB,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,CAcjG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,GAAG,iBAAiB,CASxF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAExF,OAAO,EAAe,KAAK,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAc,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG3F,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGpE,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,eAAO,MAAM,mBAAmB,QAOrB,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,gBAAgB,CAAC;QAC1B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;KAChD,CAAC;IACF,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,CAkBjG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,mBAAwB,GAAG,iBAAiB,CAiBxF"}

package/dist/server.js

@@ -1,35 +1,52 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { serveStdio } from '@modelcontextprotocol/server/stdio';
-import { DataBasinApiClient } from './api-client.js';
+import { AuthManager } from './auth.js';
 import { getProfile } from './config.js';
-import { registerDataBasinTools } from './tools.js';
+import { registerAuthTools } from './auth-tools.js';
+import { registerRemoteTools } from './proxy-tools.js';
+import { OfficialRemoteMcp } from './remote-mcp.js';
 import { VERSION } from './version.js';
 export const SERVER_NAME = 'databasin-mcp';
 export const SERVER_VERSION = VERSION;
 export const SERVER_INSTRUCTIONS = [
     'Call databasin_auth_status first. If needed, call databasin_login and give the user its short-lived Microsoft URL and user code; credentials must be entered only on Microsoft\'s page, never in chat.',
-    'After authentication, call databasin_get_context and use only resources visible to the signed-in user.',
+    'After authentication, call databasin_get_capabilities and databasin_get_context before doing work; use only the server-declared capabilities and resources visible to the signed-in user.',
+    'For agent work, require an explicit institutionId and use only the metadata_readonly profile with an optional projectInternalId or connectorId.',
     'Work metadata-first and keep searches and result pages bounded.',
-    'Never request, accept, print, or expose credentials, access tokens, connection strings, arbitrary URLs, or arbitrary headers.',
+    'Never request, accept, print, or expose credentials, access tokens, connection strings, arbitrary URLs, arbitrary headers, mutating or multi-statement SQL, or shell commands; SQL is allowed only through databasin_run_query under its bounded read-only contract.',
     'The local server handles credentials and tokens outside the agent context.'
 ].join(' ');
 export async function createDataBasinServer(options = {}) {
-    const profile = options.profile ?? getProfile(options.environment ?? 'prod');
-    const auth = options.auth ?? new (await import('./auth.js')).AuthManager(profile);
-    const api = options.api ?? new DataBasinApiClient({
-        baseUrl: profile.apiBaseUrl,
-        auth,
-        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {})
-    });
-    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { instructions: SERVER_INSTRUCTIONS });
-    registerDataBasinTools(server, { api, auth, profile });
-    return server;
+    const profile = getProfile(options.environment ?? 'prod');
+    const auth = options.auth ?? new AuthManager(profile);
+    const remote = options.remote ?? new OfficialRemoteMcp({ auth });
+    try {
+        const remoteTools = await remote.connect();
+        const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { instructions: SERVER_INSTRUCTIONS });
+        registerAuthTools(server, auth);
+        registerRemoteTools(server, remote, remoteTools);
+        server.server.onclose = () => void remote.close().catch(() => undefined);
+        return server;
+    }
+    catch (error) {
+        await remote.close().catch(() => undefined);
+        throw error;
+    }
 }
 export function serveDataBasinStdio(options = {}) {
-    return serveStdio(async () => createDataBasinServer(options), {
+    const profile = getProfile(options.environment ?? 'prod');
+    const auth = options.auth ?? new AuthManager(profile);
+    const handle = serveStdio(async () => createDataBasinServer({ ...options, auth }), {
         legacy: 'serve',
         onerror: () => process.stderr.write('DataBasin MCP protocol error.\n'),
         maxSubscriptions: 32
     });
+    return {
+        close: async () => {
+            if (auth instanceof AuthManager)
+                auth.cancelPendingLogin();
+            await handle.close();
+        }
+    };
 }
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,UAAU,EAA0B,MAAM,oCAAoC,CAAC;AAExF,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,UAAU,EAAoD,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,wMAAwM;IACxM,wGAAwG;IACxG,iEAAiE;IACjE,+HAA+H;IAC/H,4EAA4E;CAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAeZ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAA+B,EAAE;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,UAAU;QAC3B,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,mBAAmB,EAAE,CACtC,CAAC;IACF,sBAAsB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAA+B,EAAE;IACnE,OAAO,UAAU,CACf,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAC1C;QACE,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC;QACtE,gBAAgB,EAAE,EAAE;KACrB,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,UAAU,EAA0B,MAAM,oCAAoC,CAAC;AAExF,OAAO,EAAE,WAAW,EAA4B,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,UAAU,EAAoD,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,wMAAwM;IACxM,2LAA2L;IAC3L,iJAAiJ;IACjJ,iEAAiE;IACjE,sQAAsQ;IACtQ,4EAA4E;CAC7E,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAaZ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAA+B,EAAE;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C,EAAE,YAAY,EAAE,mBAAmB,EAAE,CACtC,CAAC;QACF,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAA+B,EAAE;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CACvB,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,EACvD;QACE,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC;QACtE,gBAAgB,EAAE,EAAE;KACrB,CACF,CAAC;IACF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,IAAI,YAAY,WAAW;gBAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/token-validation.d.ts

@@ -0,0 +1,5 @@
+import type { AccountInfo, AuthenticationResult } from '@azure/msal-node';
+import type { DataBasinProfile } from './config.js';
+export declare function accountMatchesProfile(account: AccountInfo, profile: DataBasinProfile): boolean;
+export declare function validateAccessTokenResult(result: AuthenticationResult | null, profile: DataBasinProfile, nowMs: number): string;
+//# sourceMappingURL=token-validation.d.ts.map

package/dist/token-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-validation.d.ts","sourceRoot":"","sources":["../src/token-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA8BpD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAG9F;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,MAAM,GACZ,MAAM,CAUR"}