@databrainhq/mcp-server 0.2.17 → 0.3.0-rc.10

package/dist/main-KZRHWE3K.js

@@ -0,0 +1,857 @@
+#!/usr/bin/env node
+import {
+  registerChartApps
+} from "./chunk-5IGP6A6T.js";
+import {
+  PREVIEW_PATH,
+  WRITE_CREATE,
+  enableChartApps,
+  registerAllPrompts,
+  registerAllResources,
+  registerAllTools
+} from "./chunk-ERTAKB2H.js";
+import {
+  DatabrainApiError,
+  DatabrainClient,
+  MCP_SERVER_VERSION,
+  parseErrorBody,
+  stringify,
+  toolContext,
+  toolError,
+  toolSuccess
+} from "./chunk-OCBTNAAO.js";
+import {
+  FilePatStore,
+  HOSTED_SCOPES,
+  HostedAuthError,
+  createBearerVerifier,
+  principalSchema
+} from "./chunk-Z3ZHN4UW.js";
+
+// src/hosted/main.ts
+import { isAbsolute } from "path";
+import { pathToFileURL } from "url";
+
+// src/hosted/config.ts
+function loadHostedConfig(env = process.env) {
+  const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === "1";
+  if (testOnly && env.NODE_ENV === "production") throw new Error("Hosted test mode is forbidden in production.");
+  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly) throw new Error("Invalid DATABRAIN_HOSTED_TEST_ONLY.");
+  const validUrl = (value, field) => {
+    try {
+      if (!value) throw new Error();
+      const url = new URL(value);
+      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:") throw new Error();
+      return url;
+    } catch {
+      throw new Error(`Configure ${field} as an HTTPS URL without credentials, query or fragment.`);
+    }
+  };
+  let publicValue = env.DATABRAIN_HOSTED_PUBLIC_URL;
+  let issuerValue = env.DATABRAIN_HOSTED_ISSUER;
+  if (!publicValue && !issuerValue && env.HOSTED_APP_URL) {
+    const origin = validUrl(env.HOSTED_APP_URL, "HOSTED_APP_URL").origin;
+    publicValue = `${origin}/mcp`;
+    issuerValue = origin;
+  }
+  const publicUrl = validUrl(publicValue, "DATABRAIN_HOSTED_PUBLIC_URL");
+  validUrl(issuerValue, "DATABRAIN_HOSTED_ISSUER");
+  if (publicUrl.pathname !== "/mcp") throw new Error("DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.");
+  const port = Number(env.DATABRAIN_HOSTED_PORT || "3144");
+  const bind = env.DATABRAIN_HOSTED_BIND || "127.0.0.1";
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("Invalid DATABRAIN_HOSTED_PORT.");
+  return {
+    publicUrl: publicValue,
+    issuer: issuerValue,
+    port,
+    bind,
+    testOnly
+  };
+}
+
+// src/hosted/http.ts
+import { createServer } from "http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
+// src/hosted/server.ts
+import { AsyncLocalStorage } from "async_hooks";
+import { z as z2 } from "zod";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { instrument } from "@posthog/mcp";
+import { PostHog } from "posthog-node";
+
+// src/tools/infrastructure/create-workspace.ts
+import { z } from "zod";
+function registerCreateWorkspace(server, client) {
+  server.tool(
+    "create_workspace",
+    'Create a new workspace to connect a datasource or datamart for dashboard building. Works only when this sign-in granted "All workspaces I can access" and your role may create workspaces; the new workspace is usable on the next call.',
+    {
+      name: z.string().describe("Unique workspace name"),
+      connectionType: z.enum(["DATASOURCE", "DATAMART", "MULTI_DATASOURCE"]).optional().describe("Connection type \u2014 DATASOURCE, DATAMART, or MULTI_DATASOURCE"),
+      datasourceName: z.string().optional().describe("Datasource name (required when connectionType is DATASOURCE)"),
+      datamartName: z.string().optional().describe("Datamart name (required when connectionType is DATAMART)"),
+      body: z.record(z.unknown()).optional().describe("Raw API body passthrough for POST /api/v2/workspace")
+    },
+    WRITE_CREATE,
+    async (params) => {
+      try {
+        const body = params.body ? { ...params.body } : {
+          name: params.name,
+          connectionType: params.connectionType,
+          datasourceName: params.datasourceName,
+          datamartName: params.datamartName
+        };
+        const result = await client.request({
+          method: "POST",
+          path: "/api/v2/workspace",
+          body,
+          auth: "service",
+          invalidateCache: ["list_workspaces"]
+        });
+        if (result.error) {
+          return toolError(`Workspace creation failed: ${stringify(result.error)}`);
+        }
+        return toolSuccess(
+          `Workspace "${result.name || params.name}" created successfully.
+
+Next steps:
+1. Use \`create_data_app\` to create a data app linked to this workspace
+2. Build dashboards in the Databrain UI using this workspace
+3. Use \`create_embed\` to embed dashboards`
+        );
+      } catch (err) {
+        if (err instanceof DatabrainApiError) return err.toToolResponse();
+        return toolError(`Unexpected error: ${err.message}`);
+      }
+    }
+  );
+}
+
+// src/hosted/authorization.ts
+var TOOL_SCOPES = {
+  whoami: [],
+  list_datasources: ["mcp:datamarts:read"],
+  discover_datasource_schema: ["mcp:datamarts:read"],
+  list_datamarts: ["mcp:datamarts:read"],
+  list_workspaces: ["mcp:datamarts:read"],
+  sync_datasource: ["mcp:datamarts:write"],
+  create_datamart: ["mcp:datamarts:write"],
+  list_data_apps: ["mcp:dashboards:read"],
+  list_tenants: ["mcp:dashboards:read"],
+  create_data_app: ["mcp:embeds:write"],
+  list_api_tokens: ["mcp:embeds:write"],
+  create_api_token: ["mcp:embeds:write"],
+  rotate_api_token: ["mcp:embeds:write"],
+  create_embed: ["mcp:embeds:write"],
+  list_embeds: ["mcp:dashboards:read"],
+  get_embed_details: ["mcp:dashboards:read"],
+  update_embed: ["mcp:embeds:write"],
+  customize_embed_theme: ["mcp:embeds:write"],
+  get_demo_link: ["mcp:embeds:write"],
+  generate_guest_token: ["mcp:embeds:write"],
+  generate_embed_code: ["mcp:dashboards:read"],
+  create_workspace: ["mcp:datamarts:write"],
+  list_dashboards: ["mcp:dashboards:read"],
+  create_dashboard: ["mcp:dashboards:write"],
+  get_dashboard: ["mcp:dashboards:read"],
+  dashboard_snapshot: ["mcp:dashboards:read"],
+  generate_dashboard_tiles: ["mcp:dashboards:write", "mcp:query"],
+  ask_question: ["mcp:query"],
+  get_semantic_layer: ["mcp:datamarts:read"],
+  update_semantic_layer: ["mcp:datamarts:write"],
+  start_semantic_layer_generation: ["mcp:datamarts:write"],
+  get_semantic_layer_generation_status: ["mcp:datamarts:read"],
+  search_semantic_model: ["mcp:datamarts:read"],
+  get_semantic_entity: ["mcp:datamarts:read"],
+  propose_semantic_change: ["mcp:datamarts:read"],
+  apply_semantic_change: ["mcp:datamarts:write"],
+  eval_semantic_model: ["mcp:datamarts:read", "mcp:query"],
+  list_widgets: ["mcp:dashboards:read"],
+  validate_metric_spec: ["mcp:dashboards:read", "mcp:query"],
+  create_or_update_metric_from_query: ["mcp:dashboards:write", "mcp:query"],
+  create_workspace_metric: ["mcp:dashboards:write", "mcp:query"],
+  add_widget: ["mcp:dashboards:write"],
+  update_widget: ["mcp:dashboards:write"],
+  remove_widget: ["mcp:dashboards:write"],
+  generate_widget: ["mcp:dashboards:write", "mcp:query"],
+  list_scheduled_reports: ["mcp:dashboards:read"],
+  custom_chart_scaffold: [],
+  custom_chart_validate: ["mcp:custom-charts:read"],
+  custom_chart_upload: ["mcp:custom-charts:write"],
+  list_custom_charts: ["mcp:custom-charts:read"],
+  publish_custom_chart: ["mcp:custom-charts:write"],
+  // Chart tile controls (the chart-apps composition). The same routes as ask_question and a
+  // dashboard save; listed so a hosted composition is not refused for want of a policy.
+  preview_chart: ["mcp:query"],
+  save_chart_as_dashboard: ["mcp:dashboards:write", "mcp:query"],
+  // Saved-widget rendering mints a guest token; retain the issuer's embed-write boundary.
+  render_chart: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"],
+  refresh_widget: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"],
+  drill_down: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"],
+  change_date_range: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"]
+};
+function requiredScopes(name) {
+  if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, "tool_not_authorized");
+  return TOOL_SCOPES[name];
+}
+function authorizeTool(name, principal) {
+  if (principal.expiresAt !== void 0 && principal.expiresAt <= Date.now() / 1e3) throw new HostedAuthError(401, "invalid_token");
+  if (requiredScopes(name).some((scope) => !principal.scopes.includes(scope))) throw new HostedAuthError(403, "insufficient_scope");
+}
+var TOOL_ARGUMENT_VALUES = {
+  list_dashboards: { scope: ["auto", "data_app", "global"] }
+};
+var TOOL_OPAQUE_ARGUMENTS = {
+  preview_chart: ["rows"]
+};
+function assertToolArguments(name, value, principal, delegated = false) {
+  const allowed = Object.hasOwn(TOOL_ARGUMENT_VALUES, name) ? TOOL_ARGUMENT_VALUES[name] : {};
+  const opaque = Object.hasOwn(TOOL_OPAQUE_ARGUMENTS, name) ? TOOL_OPAQUE_ARGUMENTS[name] : void 0;
+  const target = selectWorkspace(value, principal);
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    assertBoundArguments(value, principal, { target, delegated });
+    return target;
+  }
+  const rest = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (!Object.hasOwn(allowed, key)) {
+      rest[key] = child;
+      continue;
+    }
+    if (typeof child !== "string" || !allowed[key].includes(child)) throw new HostedAuthError(403, "identity_argument_forbidden");
+  }
+  assertBoundArguments(rest, principal, { target, delegated, opaque });
+  return target;
+}
+var WORKSPACE_FREE_TOOLS = /* @__PURE__ */ new Set([
+  "whoami",
+  "list_workspaces",
+  "create_workspace",
+  "generate_embed_code",
+  "custom_chart_scaffold",
+  "custom_chart_validate",
+  "custom_chart_upload",
+  "list_custom_charts",
+  "publish_custom_chart"
+]);
+var WORKSPACE_SPANNING_TOOLS = /* @__PURE__ */ new Set(["list_dashboards"]);
+var WORKSPACE_INPUT = "workspace";
+var WorkspaceSelectionError = class extends HostedAuthError {
+  constructor(status, code, reason) {
+    super(status, code);
+    this.reason = reason;
+  }
+};
+function grantedWorkspaces(principal) {
+  if (principal.grantedWorkspaces) return principal.grantedWorkspaces;
+  return principal.workspaceId ? [{ id: principal.workspaceId, name: principal.workspaceName }] : [];
+}
+function grantedNames(principal) {
+  const names = grantedWorkspaces(principal).map((item) => item.name ?? item.id);
+  return names.length > 20 ? `${names.slice(0, 20).join(", ")} and ${names.length - 20} more` : names.join(", ");
+}
+function findGranted(principal, key, value) {
+  const granted = grantedWorkspaces(principal);
+  const matches = typeof value !== "string" ? [] : key === "workspaceId" ? granted.filter((item) => item.id === value) : key === "workspaceName" ? granted.filter((item) => item.name === value) : granted.some((item) => item.id === value) ? granted.filter((item) => item.id === value) : granted.filter((item) => item.name === value);
+  if (matches.length !== 1) {
+    throw new WorkspaceSelectionError(
+      404,
+      "NOT_FOUND_IN_GRANT",
+      `Workspace ${JSON.stringify(String(value).slice(0, 100))} is not one this sign-in granted. Granted: ${grantedNames(principal)}.`
+    );
+  }
+  return matches[0];
+}
+function selectWorkspace(args, principal, keys = [WORKSPACE_INPUT, "workspaceName", "workspaceId"]) {
+  let target;
+  if (args && typeof args === "object" && !Array.isArray(args)) {
+    for (const key of keys) {
+      const value = args[key];
+      if (value === void 0) continue;
+      const found = findGranted(principal, key, value);
+      if (target && target.id !== found.id) {
+        throw new WorkspaceSelectionError(
+          400,
+          "WORKSPACE_CONFLICT",
+          "These inputs name different workspaces. Name one workspace for this call."
+        );
+      }
+      target = found;
+    }
+  }
+  const granted = grantedWorkspaces(principal);
+  return target ?? (granted.length === 1 ? granted[0] : void 0);
+}
+function namesWorkspace(value) {
+  if (!value || typeof value !== "object") return false;
+  return Object.entries(value).some(([key, child]) => [WORKSPACE_INPUT, "workspaceName", "workspaceId"].includes(key) && child !== void 0 || namesWorkspace(child));
+}
+function tenantAllowed(child, principal, delegated) {
+  if (typeof child !== "string") return false;
+  if (principal.tenantIds) return principal.tenantIds.includes(child);
+  return delegated && principal.credentialType === "oauth";
+}
+function assertBoundArguments(value, principal, binding = {}) {
+  if (!value || typeof value !== "object") return;
+  const { opaque, ...nested } = binding;
+  for (const [key, child] of Object.entries(value)) {
+    if (opaque?.includes(key) && !Array.isArray(value)) continue;
+    if (key === "workspaceId" || key === "workspaceName") {
+      const target = binding.target;
+      if (target ? child !== (key === "workspaceId" ? target.id : target.name) : !findGranted(principal, key, child)) {
+        throw new HostedAuthError(403, "principal_mismatch");
+      }
+    }
+    if (["companyId", "userId"].includes(key) && child !== principal[key]) {
+      throw new HostedAuthError(403, "principal_mismatch");
+    }
+    if ([
+      "scope",
+      "scopes",
+      "authUser",
+      "actorKind",
+      "credentialType",
+      "oauthClientId",
+      "operatorEmail",
+      "session_variables",
+      "isAllClient",
+      "isAdmin",
+      "serviceToken",
+      "apiToken",
+      "authorization"
+    ].includes(key)) {
+      throw new HostedAuthError(403, "identity_argument_forbidden");
+    }
+    if (["clientId", "tenantId"].includes(key) && !tenantAllowed(child, principal, binding.delegated === true)) {
+      throw new HostedAuthError(403, "tenant_not_authorized");
+    }
+    assertBoundArguments(child, principal, nested);
+  }
+}
+
+// src/hosted/server.ts
+var schemaInstrumentation = new PostHog("hosted-contract-only", { disabled: true });
+var callWorkspace = new AsyncLocalStorage();
+var WORKSPACE_HINT = "Call whoami to see the workspaces this sign-in granted, then name one.";
+function workspaceError(error) {
+  return toolError(`Error: ${error.reason} (${error.code})
+
+Hint: ${WORKSPACE_HINT}`);
+}
+function scopeError(missing) {
+  return toolError(`Error: This connection cannot do this. It needs ${missing.join(", ")}, which your role did not allow when you connected. (INSUFFICIENT_SCOPE)
+
+Hint: Ask a Databrain admin for a role that allows it, then connect again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.`);
+}
+function onlyWorkspace(raw, target) {
+  const keep = (items) => Array.isArray(items) ? items.filter((item) => {
+    const record = item && typeof item === "object" ? item : {};
+    return record.id === target.id || record._id === target.id || record.id === void 0 && record._id === void 0 && target.name !== void 0 && record.name === target.name;
+  }) : items;
+  if (Array.isArray(raw)) return keep(raw);
+  if (raw && typeof raw === "object" && "data" in raw) return { ...raw, data: keep(raw.data) };
+  return raw;
+}
+var HostedClient = class extends DatabrainClient {
+  constructor(adapter, principal, delegation) {
+    super({ apiUrl: "https://api.usedatabrain.com", demoDomain: "https://demo.usedatabrain.com" });
+    this.adapter = adapter;
+    this.principal = principal;
+    this.delegation = delegation;
+  }
+  // A generated API credential must never replace the authorizing hosted principal.
+  setRuntimeApiToken(_token) {
+  }
+  async request(options) {
+    try {
+      const name = toolContext.getStore()?.tool;
+      if (!name) throw new HostedAuthError(403, "tool_not_authorized");
+      authorizeTool(name, this.principal);
+      const named = callWorkspace.getStore()?.target;
+      const target = named ?? (selectWorkspace(options.body, this.principal, ["workspaceName", "workspaceId"]) ?? selectWorkspace(options.query, this.principal, ["workspaceName", "workspaceId"]));
+      const delegated = this.delegation !== void 0;
+      const opaque = options.method === "POST" && options.path === PREVIEW_PATH ? ["rows"] : void 0;
+      assertBoundArguments(options.body, this.principal, { target, delegated, opaque });
+      assertBoundArguments(options.query, this.principal, { target, delegated });
+      let raw = await this.adapter.executeRequest(
+        structuredClone(options),
+        structuredClone(this.principal),
+        this.delegation,
+        target && structuredClone(target)
+      );
+      if (named && options.method === "GET" && options.path === "/api/v2/workspace") raw = onlyWorkspace(raw, named);
+      if (!options.skipDataUnwrap && raw && typeof raw === "object" && !Array.isArray(raw) && "data" in raw && raw.data !== null && raw.data !== void 0) return raw.data;
+      return raw;
+    } catch (error) {
+      if (error instanceof WorkspaceSelectionError) {
+        throw new DatabrainApiError(error.status, error.code, `${error.reason} (${error.code})`, void 0, WORKSPACE_HINT);
+      }
+      const status = error instanceof HostedAuthError ? error.status : 503;
+      const detail = error instanceof HostedAuthError ? error.detail : void 0;
+      if (status === 403 && detail?.code) {
+        throw new DatabrainApiError(
+          0,
+          detail.code,
+          `${detail.message ?? "Your role does not allow this here."} (${detail.code})`,
+          void 0,
+          "Ask a Databrain admin for access, or pick a workspace where your role allows it."
+        );
+      }
+      if (status === 401 || status === 403) {
+        throw new DatabrainApiError(
+          0,
+          "HOSTED_REQUEST_DENIED",
+          "The signed-in Databrain user cannot do this: the sign-in expired or was revoked, or the granted scopes, role or workspace do not allow it. Sign in again or ask an admin."
+        );
+      }
+      if (detail && (detail.code || detail.message)) {
+        const message = detail.message ?? (status === 404 ? "Not found in the workspace this sign-in approved." : "The backend refused this request.");
+        throw new DatabrainApiError(
+          detail.status,
+          detail.code ?? "HOSTED_REQUEST_FAILED",
+          detail.code && !message.includes(detail.code) ? `${message} (${detail.code})` : message,
+          { error: { code: detail.code, message: detail.message } }
+        );
+      }
+      throw new DatabrainApiError(
+        status,
+        "HOSTED_REQUEST_DENIED",
+        status === 404 ? "Not found in the workspace this sign-in approved." : "The authorized backend could not complete this request. Check workspace access and hosted integration."
+      );
+    }
+  }
+};
+function workspaceLine(name, input) {
+  return WORKSPACE_SPANNING_TOOLS.has(name) ? ` With more than one granted workspace, name one in \`${input}\` to list only that one; leave it out to list them all.` : ` Needed when you granted more than one workspace: name it in \`${input}\`.`;
+}
+function whoami(principal) {
+  const granted = grantedWorkspaces(principal);
+  return toolSuccess(JSON.stringify({
+    status: "authenticated",
+    activeBearer: principal.credentialType,
+    actorKind: principal.actorKind,
+    userId: principal.userId,
+    companyId: principal.companyId,
+    workspaceGrant: principal.workspaces?.mode === "all" ? "All workspaces I can access (new ones are included)" : "Only the workspaces chosen at sign-in",
+    grantedWorkspaces: granted.map((item) => ({ id: item.id, name: item.name })),
+    ...granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {},
+    note: granted.length === 1 ? "Every call works in this workspace." : `Name the workspace on each call that works in one (the \`${WORKSPACE_INPUT}\` or \`workspaceName\` input): ${grantedNames(principal)}.`,
+    oauthClientId: principal.clientId,
+    scopes: principal.scopes
+  }, null, 2));
+}
+function createHostedToolServer(principal, adapter, delegation) {
+  const bound = structuredClone(principal);
+  const delegated = delegation !== void 0;
+  const server = new McpServer({ name: "databrain", version: MCP_SERVER_VERSION }, {
+    instructions: "Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). Never ask for a service token or put credentials in tool arguments. Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. Use ask_question for inline chart or KPI answers. Chart controls and save_chart_as_dashboard use the same workspace and role; saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer."
+  });
+  const register = server.tool.bind(server);
+  server.tool = ((...args) => {
+    const name = args[0];
+    const index = args.length - 1;
+    const handler = args[index];
+    const shape = typeof args[1] === "string" && args[2] && typeof args[2] === "object" && !("readOnlyHint" in args[2]) ? args[2] : void 0;
+    const ownSelector = shape && ["workspaceName", "workspaceId"].find((key) => Object.hasOwn(shape, key));
+    const addsInput = shape !== void 0 && !ownSelector && !WORKSPACE_FREE_TOOLS.has(name) && !Object.hasOwn(shape, WORKSPACE_INPUT);
+    if (shape && !WORKSPACE_FREE_TOOLS.has(name)) {
+      if (addsInput) {
+        args[2] = { ...shape, [WORKSPACE_INPUT]: z2.string().min(1).max(512).optional().describe(WORKSPACE_SPANNING_TOOLS.has(name) ? "Workspace id or name. Leave it out to cover every granted workspace." : "Workspace id or name. Needed when you granted more than one workspace.") };
+      }
+      args[1] = `${args[1]}${workspaceLine(name, addsInput ? WORKSPACE_INPUT : ownSelector)}`;
+    }
+    args[index] = async (...values) => {
+      try {
+        authorizeTool(name, bound);
+        const target = assertToolArguments(name, values[0], bound, delegated);
+        if (name === "whoami") return whoami(bound);
+        const input = values[0] && typeof values[0] === "object" ? values[0] : void 0;
+        if (!target && !WORKSPACE_FREE_TOOLS.has(name) && !WORKSPACE_SPANNING_TOOLS.has(name) && !namesWorkspace(input)) {
+          throw new WorkspaceSelectionError(
+            400,
+            "WORKSPACE_REQUIRED",
+            `Name the workspace for this call. Granted: ${grantedNames(bound)}.`
+          );
+        }
+        if (input) {
+          if (addsInput) delete input[WORKSPACE_INPUT];
+          if (shape && target) {
+            if (Object.hasOwn(shape, "workspaceId")) input.workspaceId = target.id;
+            if (Object.hasOwn(shape, "workspaceName") && target.name !== void 0) input.workspaceName = target.name;
+          }
+        }
+        const result = await callWorkspace.run({ target }, () => handler(...values));
+        if (target && result?._meta?.["ui/resourceUri"]) {
+          return { ...result, _meta: { ...result._meta, "databrain/workspace": target } };
+        }
+        return result;
+      } catch (error) {
+        if (error instanceof WorkspaceSelectionError) return workspaceError(error);
+        return toolError("Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.");
+      }
+    };
+    return register(...args);
+  });
+  const client = new HostedClient(adapter, bound, delegation);
+  enableChartApps(server);
+  registerAllTools(server, client);
+  registerCreateWorkspace(server, client);
+  registerAllResources(server);
+  registerAllPrompts(server);
+  registerChartApps(server, client);
+  instrument(server, schemaInstrumentation, { beforeSend: () => null });
+  return server;
+}
+
+// src/hosted/http.ts
+var HEALTH_BODY = JSON.stringify({ status: "ok" });
+function healthPath(url) {
+  const path = (url || "/").split("?")[0];
+  return path === "/health";
+}
+function reply(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+async function readBody(req) {
+  let size = 0;
+  const chunks = [];
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > 1048576) throw new Error("body_too_large");
+    chunks.push(Buffer.from(chunk));
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function createHostedHttpServer(config, adapter, pats) {
+  const publicUrl = new URL(config.publicUrl);
+  const metadataPath = `/.well-known/oauth-protected-resource${publicUrl.pathname === "/" ? "" : publicUrl.pathname}`;
+  const metadataUrl = `${publicUrl.origin}${metadataPath}`;
+  const verify = createBearerVerifier(adapter, config.publicUrl, pats);
+  let active = 0;
+  const server = createServer(async (req, res) => {
+    if (healthPath(req.url)) {
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { Allow: "GET, HEAD", "Cache-Control": "no-store" });
+        res.end();
+        return;
+      }
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+        "Content-Length": Buffer.byteLength(HEALTH_BODY)
+      });
+      res.end(req.method === "HEAD" ? void 0 : HEALTH_BODY);
+      return;
+    }
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    if (config.testOnly) res.setHeader("X-Databrain-Test-Only", "true");
+    try {
+      const localPort = server.address()?.port;
+      if (![publicUrl.host, `127.0.0.1:${localPort}`, `localhost:${localPort}`].includes(req.headers.host || "")) {
+        reply(res, 403, { error: "invalid_host" });
+        return;
+      }
+      if (req.headers.origin && req.headers.origin !== publicUrl.origin) {
+        reply(res, 403, { error: "invalid_origin" });
+        return;
+      }
+      if (req.headers.origin) {
+        res.setHeader("Access-Control-Allow-Origin", publicUrl.origin);
+        res.setHeader("Vary", "Origin");
+        res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, MCP-Protocol-Version");
+      }
+      const url = new URL(req.url || "/", publicUrl.origin);
+      if (req.method === "GET" && [metadataPath, "/.well-known/oauth-protected-resource"].includes(url.pathname)) {
+        reply(res, 200, {
+          resource: config.publicUrl,
+          authorization_servers: [config.issuer],
+          scopes_supported: HOSTED_SCOPES,
+          bearer_methods_supported: ["header"],
+          resource_name: config.testOnly ? "Databrain (TEST ONLY; fixture identity)" : "Databrain"
+        });
+        return;
+      }
+      if (url.pathname !== publicUrl.pathname) {
+        reply(res, 404, { error: "not_found" });
+        return;
+      }
+      if (url.search) {
+        reply(res, 400, { error: "query_parameters_not_supported" });
+        return;
+      }
+      if (req.method === "OPTIONS") {
+        res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id");
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      const authFields = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "authorization");
+      const match = /^Bearer ([^\s]+)$/i.exec(req.headers.authorization || "");
+      if (authFields.length !== 1 || !match) throw new HostedAuthError(401, "invalid_token");
+      const principal = await verify(match[1]);
+      if (req.method !== "POST") {
+        res.setHeader("Allow", "POST, OPTIONS");
+        reply(res, 405, { error: "method_not_allowed" });
+        return;
+      }
+      if (!req.headers["content-type"]?.toLowerCase().startsWith("application/json")) {
+        reply(res, 415, { error: "unsupported_media_type" });
+        return;
+      }
+      if (active >= 32) {
+        reply(res, 503, { error: "server_busy" });
+        return;
+      }
+      active++;
+      let body;
+      try {
+        body = await readBody(req);
+      } catch {
+        active--;
+        reply(res, 400, { error: "invalid_request" });
+        return;
+      }
+      try {
+        if (Array.isArray(body)) {
+          reply(res, 400, { error: "batch_not_supported" });
+          return;
+        }
+        const delegation = match[1].startsWith("dbp_") ? void 0 : adapter.delegate?.(match[1], principal);
+        if (body?.method === "tools/call" && typeof body.params?.name === "string") {
+          try {
+            authorizeTool(body.params.name, principal);
+            assertToolArguments(body.params.name, body.params.arguments, principal, delegation !== void 0);
+          } catch (error) {
+            if (error instanceof WorkspaceSelectionError) {
+              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: workspaceError(error) });
+              return;
+            }
+            if (error instanceof HostedAuthError && error.code === "insufficient_scope") {
+              const missing = requiredScopes(body.params.name).filter((scope) => !principal.scopes.includes(scope));
+              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: scopeError(missing) });
+              return;
+            }
+            throw error;
+          }
+        }
+        const mcp = createHostedToolServer(principal, adapter, delegation);
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0, enableJsonResponse: true });
+        let closed = false;
+        const close = () => {
+          if (!closed) {
+            closed = true;
+            void mcp.close();
+          }
+        };
+        res.once("close", close);
+        try {
+          await mcp.connect(transport);
+          await transport.handleRequest(req, res, body);
+        } finally {
+          if (res.writableEnded) close();
+        }
+      } finally {
+        active--;
+      }
+    } catch (error) {
+      if (res.headersSent) {
+        res.end();
+        return;
+      }
+      const status = error instanceof HostedAuthError ? error.status : 503;
+      if (status === 401) res.setHeader("WWW-Authenticate", `Bearer error="invalid_token", resource_metadata="${metadataUrl}"`);
+      reply(res, status, { error: error instanceof HostedAuthError ? error.code : "temporarily_unavailable" });
+    }
+  });
+  server.requestTimeout = 3e4;
+  server.headersTimeout = 1e4;
+  server.keepAliveTimeout = 5e3;
+  return server;
+}
+
+// src/hosted/provider.ts
+import { z as z3 } from "zod";
+var USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION} (hosted)`;
+var REQUEST_TIMEOUT_MS = 3e4;
+var FORWARDED_HEADERS = /* @__PURE__ */ new Set(["idempotency-key"]);
+var WORKSPACE_HEADER = "X-Databrain-Workspace";
+var GRANT_DENIALS = /* @__PURE__ */ new Set(["ROLE_NOT_ALLOWED", "WORKSPACE_CREATE_NOT_ALLOWED"]);
+function errorDetail(status, text, bearer) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { status };
+  }
+  const envelope = parseErrorBody(parsed);
+  const tiles = tileProblems(parsed);
+  const code = envelope.code ?? (tiles ? "TILE_VALIDATION_FAILED" : void 0);
+  const message = envelope.message ?? tiles;
+  const clean = (value, max) => {
+    if (!value) return void 0;
+    let out = value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+    if (bearer) out = out.split(bearer).join("[redacted]");
+    return out.slice(0, max) || void 0;
+  };
+  return {
+    status,
+    code: code && /^[A-Za-z0-9_.:-]{1,64}$/.test(code) ? code : void 0,
+    message: clean(message, 1200)
+  };
+}
+function tileProblems(body) {
+  const verdicts = body?.tileVerdicts;
+  if (!Array.isArray(verdicts)) return void 0;
+  const lines = verdicts.flatMap((verdict) => {
+    const { id, ok, problems } = verdict ?? {};
+    if (ok !== false || !Array.isArray(problems)) return [];
+    const words = problems.filter((p) => typeof p === "string");
+    return words.length ? [`Tile ${typeof id === "string" ? id : "?"}: ${words.join(" ")}`] : [];
+  });
+  return lines.length ? `The dashboard was not saved. ${lines.join(" ")}` : void 0;
+}
+function createProviderAdapter(config) {
+  const issuer = new URL(config.issuer);
+  if (issuer.protocol !== "https:" || issuer.username || issuer.password || issuer.search || issuer.hash) {
+    throw new Error("Invalid hosted authorization server configuration.");
+  }
+  const apiBase = config.issuer.replace(/\/$/, "");
+  const endpoint = `${apiBase}/oauth/principal`;
+  const publicOrigin = new URL(config.publicUrl).origin;
+  const bearers = /* @__PURE__ */ new WeakMap();
+  const responseSchema = principalSchema.extend({ issuer: z3.literal(config.issuer) }).strip();
+  return {
+    async verifyOAuth(token, resource) {
+      try {
+        const response = await fetch(endpoint, {
+          headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+          redirect: "error",
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (!response.ok) throw new HostedAuthError(response.status >= 500 ? 503 : 401, "invalid_token");
+        const { issuer: _issuer, ...principal } = responseSchema.parse(await response.json());
+        if (principal.resource !== resource || principal.credentialType !== "oauth") throw new HostedAuthError(401, "invalid_token");
+        return principal;
+      } catch (error) {
+        if (error instanceof HostedAuthError) throw error;
+        throw new HostedAuthError(401, "invalid_token");
+      }
+    },
+    async resolvePatGrant() {
+      throw new HostedAuthError(401, "pat_membership_adapter_required");
+    },
+    delegate(token) {
+      const handle = Object.freeze({ kind: "hosted-delegation" });
+      bearers.set(handle, token);
+      return handle;
+    },
+    async executeRequest(options, principal, delegation, workspace) {
+      const bearer = delegation ? bearers.get(delegation) : void 0;
+      if (options.auth !== "none" && !bearer) throw new HostedAuthError(503, "delegated_backend_adapter_required");
+      if (options.auth === "none" && !options.token) throw new HostedAuthError(403, "tool_not_authorized");
+      if (!options.path.startsWith("/") || options.path.startsWith("//")) throw new HostedAuthError(403, "tool_not_authorized");
+      const url = new URL(`${apiBase}${options.path}`);
+      if (url.origin !== issuer.origin) throw new HostedAuthError(403, "tool_not_authorized");
+      for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);
+      const headers = {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "User-Agent": USER_AGENT,
+        "X-Databrain-Client": USER_AGENT
+      };
+      for (const [key, value] of Object.entries(options.headers ?? {})) {
+        if (FORWARDED_HEADERS.has(key.toLowerCase())) headers[key] = value;
+      }
+      const tool = toolContext.getStore();
+      if (tool) {
+        headers["X-Databrain-MCP-Tool"] = tool.tool;
+        headers["X-Databrain-MCP-Tool-Category"] = tool.category;
+        headers["X-Databrain-MCP-Workflow-Intent"] = tool.workflowIntent;
+        headers["X-Databrain-MCP-Input-Mode"] = tool.inputMode;
+      }
+      if (options.auth === "none") {
+        headers["x-plugin-token"] = options.token;
+        headers.Origin = publicOrigin;
+      } else {
+        headers.Authorization = `Bearer ${bearer}`;
+        if (workspace) {
+          if (!principal.grantedWorkspaces?.some((item) => item.id === workspace.id) && principal.workspaceId !== workspace.id) throw new HostedAuthError(403, "principal_mismatch");
+          headers[WORKSPACE_HEADER] = workspace.id;
+        }
+      }
+      const response = await fetch(url, {
+        method: options.method,
+        headers,
+        redirect: "error",
+        body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+        signal: AbortSignal.timeout(options.timeoutMs ?? REQUEST_TIMEOUT_MS)
+      });
+      const text = await response.text();
+      if (!response.ok) {
+        const forbidden = response.status === 403 ? errorDetail(403, text, bearer) : void 0;
+        if (forbidden?.code && GRANT_DENIALS.has(forbidden.code)) {
+          throw new HostedAuthError(403, "delegated_request_denied", forbidden);
+        }
+        const status = response.status === 401 ? 401 : response.status >= 500 ? 503 : response.status === 403 || response.status === 404 ? 404 : 400;
+        const detail = status === 401 || status === 503 || response.status === 403 ? void 0 : errorDetail(response.status, text, bearer);
+        throw new HostedAuthError(status, "delegated_request_denied", detail);
+      }
+      try {
+        return text ? JSON.parse(text) : null;
+      } catch {
+        throw new HostedAuthError(503, "delegated_response_invalid");
+      }
+    }
+  };
+}
+
+// src/hosted/main.ts
+async function startHosted() {
+  const config = loadHostedConfig();
+  let adapter;
+  if (config.testOnly) {
+    const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;
+    if (!file || !isAbsolute(file)) throw new Error("Hosted test mode requires an absolute fixture store path.");
+    const { createTestOnlyAdapter } = await import("./test-only-K7QTSVO4.js");
+    adapter = createTestOnlyAdapter(file);
+  } else {
+    const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;
+    if (!file) {
+      adapter = createProviderAdapter(config);
+      process.stderr.write("[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\n");
+    } else {
+      if (!isAbsolute(file)) throw new Error("DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.");
+      try {
+        adapter = (await import(pathToFileURL(file).href)).adapter;
+      } catch {
+        throw new Error("Could not load the trusted hosted adapter.");
+      }
+    }
+    if (!adapter || ["verifyOAuth", "resolvePatGrant", "executeRequest"].some((key) => typeof adapter[key] !== "function")) throw new Error("Invalid trusted hosted adapter.");
+  }
+  const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;
+  if (patPath && !isAbsolute(patPath)) throw new Error("Hosted PAT store must be an absolute path.");
+  const server = createHostedHttpServer(config, adapter, patPath ? new FilePatStore(patPath) : void 0);
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(config.port, config.bind, resolve);
+  });
+  process.stderr.write(`[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? " \u2014 TEST ONLY: synthetic identity and data; no OAuth consent" : ""}
+`);
+  const shutdown = () => {
+    server.close(() => process.exit(0));
+    setTimeout(() => {
+      server.closeAllConnections();
+      process.exit(0);
+    }, 5e3).unref();
+  };
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+}
+export {
+  startHosted
+};
+//# sourceMappingURL=main-KZRHWE3K.js.map