@databrainhq/mcp-server 0.2.17 → 0.3.0-rc.10

package/dist/chunk-OCBTNAAO.js

@@ -0,0 +1,1946 @@
+#!/usr/bin/env node
+
+// src/utils/errors.ts
+var DatabrainApiError = class extends Error {
+  constructor(status, code, message, details, serverHint, retryable) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.serverHint = serverHint;
+    this.retryable = retryable;
+    this.name = "DatabrainApiError";
+  }
+  toToolResponse() {
+    const parts = [`Error: ${this.message}`];
+    const detailDump = this.formatDetails();
+    if (detailDump) parts.push(detailDump);
+    const hint = this.serverHint ? `Hint: ${this.serverHint}` : this.hint();
+    if (hint) parts.push(hint);
+    return {
+      content: [{ type: "text", text: parts.join("\n\n") }],
+      isError: true
+    };
+  }
+  /**
+   * Surface API-returned details for 4xx errors so the LLM can recover or
+   * report the real reason (validation messages, field names, etc.). Skips
+   * fields already collapsed into `message`/`code`, and skips 5xx where the
+   * payload usually isn't actionable.
+   */
+  formatDetails() {
+    if (this.status < 400 || this.status >= 500) return "";
+    if (!this.details || typeof this.details !== "object") return "";
+    const skipKeys = /* @__PURE__ */ new Set(["message", "detail", "error", "code", "data", "hint", "retryable"]);
+    const extra = {};
+    for (const [k, v] of Object.entries(this.details)) {
+      if (skipKeys.has(k)) continue;
+      if (v === null || v === void 0) continue;
+      extra[k] = v;
+    }
+    if (Object.keys(extra).length === 0) return "";
+    try {
+      return `API details: ${JSON.stringify(extra)}`;
+    } catch {
+      return "";
+    }
+  }
+  hint() {
+    if (this.code === "OAUTH_SIGN_IN_REQUIRED") {
+      return "Hint: Snapshots draw as a signed-in Databrain user. Connect this AI app with a Databrain sign-in (the hosted connector, or /mcp in Claude Code); a service token cannot take them.";
+    }
+    if (this.code === "RENDER_IN_PROGRESS") {
+      return "Hint: Your other snapshot is still rendering. Wait a few seconds, then call the tool again.";
+    }
+    if (this.code === "SNAPSHOT_TIMEOUT" || this.code === "SNAPSHOT_TOO_LARGE") {
+      return "Hint: Ask for one chart with metricId, or a smaller width.";
+    }
+    if (this.code === "UNAUTHORIZED_ORIGIN") {
+      return "Hint: The embed origin is not on the allowed domains list. Add the domain to the allowed domains in the Databrain settings; the token itself is fine.";
+    }
+    if (this.status === 401 || this.status === 403) {
+      if (this.code === "OAUTH_API_ERROR") {
+        return "Hint: Check that the backend accepts the configured OAuth issuer and resource, and that the service principal has permission for this operation. Static fallback applies only to token acquisition failures.";
+      }
+      if (this.code === "INVALID_SERVICE_TOKEN" || this.code === "MISSING_SERVICE_TOKEN" || this.message.toLowerCase().includes("service token")) {
+        return "Hint: The service token (DATABRAIN_SERVICE_TOKEN) is invalid, expired, or missing. It must be set in the MCP server config (not at runtime). Check Settings > Service Tokens in the Databrain UI.";
+      }
+      return "Hint: The per-data-app API token is invalid or expired. Use `create_api_token` to generate a new one. Do not ask the user \u2014 manage tokens via MCP tools.";
+    }
+    if (this.status === 400) {
+      return "Hint: The request was invalid. Check parameter values match expected types and formats. Use the corresponding list tool to verify IDs and names.";
+    }
+    if (this.status === 404) {
+      return "Hint: The requested resource was not found. Verify the ID or name is correct using the corresponding list tool.";
+    }
+    if (this.status === 409) {
+      return "Hint: A resource with this name already exists. Use a different name or list existing resources first.";
+    }
+    if (this.status === 422) {
+      return "Hint: The request parameters are invalid. Check the required fields and their formats.";
+    }
+    if (this.status === 429) {
+      return "Hint: API rate limit reached. Wait a moment and try again.";
+    }
+    if (this.status >= 500) {
+      return "Hint: The Databrain API is experiencing issues. Try again in a few moments.";
+    }
+    return "";
+  }
+};
+function toolError(message) {
+  return {
+    content: [{ type: "text", text: message }],
+    isError: true
+  };
+}
+function stringify(value) {
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+function toolSuccess(text) {
+  return {
+    content: [{ type: "text", text }]
+  };
+}
+
+// src/utils/logger.ts
+var LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
+var currentLevel = process.env.DATABRAIN_LOG_LEVEL || "warn";
+var secrets = /* @__PURE__ */ new Set();
+function registerSecret(value) {
+  if (typeof value === "string" && value.length >= 8) secrets.add(value);
+}
+function redactSecrets(text) {
+  let out = text;
+  for (const secret of secrets) out = out.split(secret).join("[redacted]");
+  return out;
+}
+function log(level, message, data) {
+  if (LOG_LEVELS[level] < LOG_LEVELS[currentLevel]) return;
+  const line = `[databrain-mcp] [${level.toUpperCase()}] ${message}`;
+  const text = data !== void 0 ? `${line} ${JSON.stringify(data)}` : line;
+  process.stderr.write(`${redactSecrets(text)}
+`);
+}
+var logger = {
+  debug: (msg, data) => log("debug", msg, data),
+  info: (msg, data) => log("info", msg, data),
+  warn: (msg, data) => log("warn", msg, data),
+  error: (msg, data) => log("error", msg, data)
+};
+
+// package.json
+var package_default = {
+  name: "@databrainhq/mcp-server",
+  mcpName: "com.usedatabrain/mcp-server",
+  version: "0.3.0-rc.10",
+  description: "MCP server for Databrain embedded analytics - connect databases, create datamarts, configure embeds, and generate frontend code",
+  type: "module",
+  bin: {
+    "mcp-server": "dist/index.js",
+    "databrain-mcp-server": "dist/index.js",
+    "databrain-mcp-chart-apps": "dist/apps/stdio.js",
+    databrain: "dist/cli.js"
+  },
+  main: "dist/index.js",
+  types: "dist/index.d.ts",
+  files: [
+    "dist",
+    "skills",
+    ".claude-plugin",
+    ".mcp.json"
+  ],
+  scripts: {
+    build: "tsup && node scripts/copy-custom-chart-assets.mjs",
+    dev: "tsx src/index.ts",
+    test: "vitest run",
+    "test:watch": "vitest",
+    "test:live": "vitest run tests/integration/prompt-flows.test.ts",
+    lint: "tsc --noEmit",
+    prepublishOnly: "npm run build"
+  },
+  keywords: [
+    "mcp",
+    "databrain",
+    "embedded-analytics",
+    "ai",
+    "model-context-protocol"
+  ],
+  license: "MIT",
+  dependencies: {
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@posthog/mcp": "^0.10.7",
+    esbuild: "0.27.3",
+    fflate: "0.8.3",
+    "posthog-node": "^5.21.2",
+    yaml: "^2.9.1",
+    zod: "^3.24.0"
+  },
+  devDependencies: {
+    "@types/node": "^25.3.5",
+    tsup: "^8.4.0",
+    tsx: "^4.19.0",
+    typescript: "^5.7.0",
+    vitest: "^3.0.0"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/databrainhq/mcp-server.git"
+  },
+  engines: {
+    node: ">=18.0.0"
+  }
+};
+
+// src/version.ts
+var MCP_SERVER_VERSION = package_default.version;
+
+// src/utils/cache.ts
+var TtlCache = class {
+  store = /* @__PURE__ */ new Map();
+  get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return entry.value;
+  }
+  set(key, value, ttlMs) {
+    this.store.set(key, { value, expiresAt: Date.now() + ttlMs });
+  }
+  invalidateByPrefix(prefix) {
+    for (const key of this.store.keys()) {
+      if (key.startsWith(prefix)) {
+        this.store.delete(key);
+      }
+    }
+  }
+  clear() {
+    this.store.clear();
+  }
+};
+
+// src/client/error-body.ts
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var str = (v) => typeof v === "string" && v.trim() ? v : void 0;
+var fromEnvelope = (v) => {
+  if (!isRecord(v)) return void 0;
+  const out = {
+    code: str(v.code),
+    message: str(v.message) ?? str(v.detail),
+    hint: str(v.hint),
+    retryable: typeof v.retryable === "boolean" ? v.retryable : void 0,
+    details: v.details
+  };
+  return out.code || out.message || out.hint ? out : void 0;
+};
+function parseErrorBody(body) {
+  if (!isRecord(body)) return {};
+  const nested = fromEnvelope(isRecord(body.data) ? body.data.error : void 0) ?? fromEnvelope(body.error) ?? fromEnvelope(body);
+  if (nested) {
+    return { ...nested, message: nested.message ?? str(body.error) };
+  }
+  return { message: str(body.error) };
+}
+
+// src/utils/tool-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var toolContext = new AsyncLocalStorage();
+
+// src/client/oauth-client-credentials.ts
+import { z } from "zod";
+var oauthHttpsUrl = z.string().refine((value) => {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
+}, "OAuth URLs must use HTTPS without userinfo or fragments");
+var oauthConfigSchema = z.object({
+  issuer: oauthHttpsUrl.refine((value) => {
+    try {
+      return !new URL(value).search;
+    } catch {
+      return false;
+    }
+  }, "OAuth issuer must not contain a query"),
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1),
+  resource: oauthHttpsUrl,
+  scope: z.string().min(1).optional(),
+  authMethod: z.enum(["client_secret_basic", "client_secret_post"]).default("client_secret_basic")
+});
+var metadataSchema = z.object({
+  issuer: z.string(),
+  token_endpoint: oauthHttpsUrl,
+  token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+  grant_types_supported: z.array(z.string()).optional()
+});
+var tokenSchema = z.object({
+  access_token: z.string().regex(/^[A-Za-z0-9\-._~+/]+=*$/),
+  token_type: z.string().refine((value) => value.toLowerCase() === "bearer"),
+  expires_in: z.number().finite().positive().optional()
+});
+var TOKEN_TIMEOUT_MS = 1e4;
+var FAILURE_COOLDOWN_MS = 3e4;
+var MAX_REFRESH_SKEW_MS = 6e4;
+function authError() {
+  return new Error("OAuth token acquisition failed. Check the configured issuer, client credentials, resource and scopes.");
+}
+var OAuthClientCredentials = class {
+  config;
+  tokenEndpoint;
+  cached;
+  pending;
+  retryAt = 0;
+  constructor(config) {
+    const parsed = oauthConfigSchema.safeParse(config);
+    if (!parsed.success) throw authError();
+    this.config = Object.freeze(parsed.data);
+  }
+  getStatus() {
+    if (this.cached && Date.now() < this.cached.renewAt) return "ready";
+    if (this.retryAt > 0) return "unavailable";
+    return "configured";
+  }
+  async getToken() {
+    if (this.cached && Date.now() < this.cached.renewAt) return this.cached.value;
+    if (this.pending) return this.pending;
+    if (Date.now() < this.retryAt) throw authError();
+    this.cached = void 0;
+    this.pending = this.acquire().catch(() => {
+      this.retryAt = Date.now() + FAILURE_COOLDOWN_MS;
+      throw authError();
+    }).finally(() => {
+      this.pending = void 0;
+    });
+    return this.pending;
+  }
+  async discoverTokenEndpoint(signal) {
+    if (this.tokenEndpoint) return this.tokenEndpoint;
+    const issuer = new URL(this.config.issuer);
+    const path = issuer.pathname.replace(/\/$/, "");
+    const candidates = [.../* @__PURE__ */ new Set([
+      `${issuer.origin}/.well-known/oauth-authorization-server${path}`,
+      `${issuer.origin}/.well-known/openid-configuration${path}`,
+      `${issuer.origin}${path}/.well-known/openid-configuration`
+    ])];
+    for (const url of candidates) {
+      const response = await fetch(url, {
+        headers: { Accept: "application/json" },
+        redirect: "error",
+        signal
+      });
+      if (response.status === 404 || response.status === 405) continue;
+      if (!response.ok) throw authError();
+      const metadata = metadataSchema.parse(await response.json());
+      if (metadata.issuer !== this.config.issuer) throw authError();
+      const methods = metadata.token_endpoint_auth_methods_supported ?? ["client_secret_basic"];
+      if (!methods.includes(this.config.authMethod)) throw authError();
+      if (metadata.grant_types_supported && !metadata.grant_types_supported.includes("client_credentials")) {
+        throw authError();
+      }
+      this.tokenEndpoint = metadata.token_endpoint;
+      return this.tokenEndpoint;
+    }
+    throw authError();
+  }
+  async acquire() {
+    const signal = AbortSignal.timeout(TOKEN_TIMEOUT_MS);
+    const endpoint = await this.discoverTokenEndpoint(signal);
+    const body = new URLSearchParams({
+      grant_type: "client_credentials",
+      resource: this.config.resource
+    });
+    if (this.config.scope) body.set("scope", this.config.scope);
+    const headers = {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    };
+    if (this.config.authMethod === "client_secret_post") {
+      body.set("client_id", this.config.clientId);
+      body.set("client_secret", this.config.clientSecret);
+    } else {
+      const encode = (value) => new URLSearchParams({ value }).toString().slice(6);
+      headers.Authorization = `Basic ${Buffer.from(`${encode(this.config.clientId)}:${encode(this.config.clientSecret)}`).toString("base64")}`;
+    }
+    const startedAt = Date.now();
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers,
+      body: body.toString(),
+      redirect: "error",
+      signal
+    });
+    if (!response.ok) throw authError();
+    const token = tokenSchema.parse(await response.json());
+    if (token.expires_in !== void 0) {
+      const lifetimeMs = token.expires_in * 1e3;
+      const expiresAt = startedAt + lifetimeMs;
+      if (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) throw authError();
+      this.cached = {
+        value: token.access_token,
+        renewAt: expiresAt - Math.min(MAX_REFRESH_SKEW_MS, lifetimeMs * 0.1)
+      };
+    }
+    this.retryAt = 0;
+    return token.access_token;
+  }
+};
+
+// src/client/databrain-client.ts
+var MCP_USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION}`;
+var MAX_RETRIES = 3;
+var REQUEST_TIMEOUT_MS = 3e4;
+var NON_TRANSIENT_PATTERNS = [
+  "out of context",
+  "Definition not found",
+  "not a data question",
+  "Query generation failed",
+  "not found",
+  "not authenticated",
+  "Invalid Service Token",
+  "service token"
+];
+var DatabrainClient = class {
+  constructor(config) {
+    this.config = config;
+    registerSecret(config.serviceToken);
+    registerSecret(config.apiToken);
+    if (config.oauth) {
+      if (!oauthHttpsUrl.safeParse(config.apiUrl).success) {
+        throw new Error("OAuth requires an HTTPS Databrain API URL without userinfo or fragments.");
+      }
+      this.oauth = new OAuthClientCredentials(config.oauth);
+      this.config = Object.freeze({ ...config });
+    }
+  }
+  cache = new TtlCache();
+  runtimeApiToken;
+  oauth;
+  oauthFallback = false;
+  hasApiToken() {
+    return !!(this.runtimeApiToken || this.config.apiToken);
+  }
+  setRuntimeApiToken(token) {
+    registerSecret(token);
+    this.runtimeApiToken = token;
+    logger.info("Runtime API token set for this session");
+  }
+  getServiceToken() {
+    return this.config.serviceToken;
+  }
+  getApiUrl() {
+    return this.config.apiUrl;
+  }
+  getDemoDomain() {
+    return this.config.demoDomain;
+  }
+  /**
+   * Describes which credential is currently used as the bearer for outgoing
+   * API calls. Used by `whoami` so the LLM can give the user a truthful answer.
+   */
+  getActiveAuth() {
+    if (this.oauth) {
+      if (this.oauthFallback) return { source: "service-token", oauthFallback: true };
+      return { source: "oauth-client-credentials", status: this.oauth.getStatus() };
+    }
+    if (this.config.serviceToken) return { source: "service-token" };
+    if (this.runtimeApiToken || this.config.apiToken) return { source: "api-token" };
+    return { source: "none" };
+  }
+  async getToken(auth) {
+    if (auth === "none") return void 0;
+    if (auth === "service") {
+      if (this.oauth) {
+        try {
+          const token = await this.oauth.getToken();
+          this.oauthFallback = false;
+          return token;
+        } catch {
+          if (!this.config.serviceToken) {
+            throw new DatabrainApiError(
+              0,
+              "OAUTH_TOKEN_ERROR",
+              "OAuth token acquisition failed. Check the configured issuer, client credentials, resource and scopes."
+            );
+          }
+          if (!this.oauthFallback) logger.warn("OAuth unavailable; using the configured static service token.");
+          this.oauthFallback = true;
+        }
+      }
+      return this.config.serviceToken;
+    }
+    return this.runtimeApiToken || this.config.apiToken;
+  }
+  async request(options) {
+    return this.requestInternal(options);
+  }
+  async requestInternal(options) {
+    const usesOAuth = !!this.oauth && options.auth === "service" && !options.token;
+    const cacheAllowed = !usesOAuth;
+    if (options.invalidateCache) {
+      for (const prefix of options.invalidateCache) {
+        this.cache.invalidateByPrefix(prefix);
+      }
+    }
+    if (cacheAllowed && options.cacheKey && options.cacheTtlMs) {
+      const cached = this.cache.get(options.cacheKey);
+      if (cached !== void 0) {
+        logger.debug(`Cache hit: ${options.cacheKey}`);
+        return cached;
+      }
+    }
+    let token = options.token ?? await this.getToken(options.auth);
+    if (options.auth !== "none" && !options.token && !token) {
+      if (options.auth === "service") {
+        throw new DatabrainApiError(
+          401,
+          "MISSING_SERVICE_TOKEN",
+          "DATABRAIN_SERVICE_TOKEN is required for this operation (org-level token for discovery and data app management). It must be set in the MCP server configuration \u2014 do not ask the user for it at runtime."
+        );
+      }
+      throw new DatabrainApiError(
+        401,
+        "MISSING_API_TOKEN",
+        "A per-data-app API token is required for this embedding operation but none is configured. Call `create_api_token` to generate one, or `set_api_token` if you already have the value. Do not ask the user for this token \u2014 create it via the MCP tools."
+      );
+    }
+    let url = `${this.config.apiUrl}${options.path}`;
+    if (options.query) {
+      const params = new URLSearchParams(options.query);
+      url += `?${params.toString()}`;
+    }
+    let lastError;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        if (usesOAuth && attempt > 1) token = await this.getToken(options.auth);
+        const headers = {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "User-Agent": MCP_USER_AGENT,
+          "X-Databrain-Client": MCP_USER_AGENT,
+          ...options.headers
+        };
+        const ctx = toolContext.getStore();
+        if (ctx) {
+          headers["X-Databrain-MCP-Tool"] = ctx.tool;
+          headers["X-Databrain-MCP-Tool-Category"] = ctx.category;
+          headers["X-Databrain-MCP-Workflow-Intent"] = ctx.workflowIntent;
+          headers["X-Databrain-MCP-Input-Mode"] = ctx.inputMode;
+        }
+        if (token) {
+          if (options.auth === "none") {
+            headers["x-plugin-token"] = token;
+            headers["Origin"] = "https://mcp.usedatabrain.com";
+          } else {
+            headers["Authorization"] = `Bearer ${token}`;
+          }
+        }
+        const response = await fetch(url, {
+          method: options.method,
+          headers,
+          body: options.body ? JSON.stringify(options.body) : void 0,
+          signal: AbortSignal.timeout(options.timeoutMs || REQUEST_TIMEOUT_MS),
+          ...usesOAuth ? { redirect: "error" } : {}
+        });
+        if (!response.ok) {
+          if (usesOAuth) {
+            throw new DatabrainApiError(
+              response.status,
+              "OAUTH_API_ERROR",
+              `Databrain API request failed with status ${response.status} using configured service credentials.`
+            );
+          }
+          const errorBody = await response.text();
+          logger.warn(`[API Error] ${options.method} ${options.path} status=${response.status} body=${errorBody.slice(0, 500)}`);
+          let parsed = {};
+          try {
+            parsed = JSON.parse(errorBody);
+          } catch {
+          }
+          const envelope = parseErrorBody(parsed);
+          const errorMsg = envelope.message || `API request failed with status ${response.status}`;
+          const error = new DatabrainApiError(
+            response.status,
+            envelope.code || `HTTP_${response.status}`,
+            errorMsg,
+            parsed,
+            envelope.hint,
+            envelope.retryable
+          );
+          const isTransient = envelope.retryable !== void 0 ? envelope.retryable && (response.status === 429 || response.status >= 500) : response.status === 429 || response.status >= 500 && !NON_TRANSIENT_PATTERNS.some((p) => errorMsg.includes(p));
+          if (isTransient && attempt < MAX_RETRIES) {
+            const delay = Math.min(1e3 * Math.pow(2, attempt - 1), 8e3);
+            logger.warn(`Retrying in ${delay}ms (attempt ${attempt}/${MAX_RETRIES})`, {
+              status: response.status,
+              path: options.path
+            });
+            await new Promise((r) => setTimeout(r, delay));
+            lastError = error;
+            continue;
+          }
+          throw error;
+        }
+        const text = await response.text();
+        let data = text ? JSON.parse(text) : {};
+        if (!options.skipDataUnwrap && data && typeof data === "object" && !Array.isArray(data) && "data" in data) {
+          const inner = data.data;
+          if (inner !== null && inner !== void 0) {
+            data = inner;
+          }
+        }
+        if (cacheAllowed && options.cacheKey && options.cacheTtlMs) {
+          this.cache.set(options.cacheKey, data, options.cacheTtlMs);
+        }
+        return data;
+      } catch (err) {
+        if (err instanceof DatabrainApiError) throw err;
+        if (attempt < MAX_RETRIES && err?.name === "TimeoutError" && !options.noRetryOnTimeout) {
+          const delay = Math.min(1e3 * Math.pow(2, attempt - 1), 8e3);
+          logger.warn(`Request timed out, retrying in ${delay}ms`, { path: options.path });
+          await new Promise((r) => setTimeout(r, delay));
+          lastError = err;
+          continue;
+        }
+        throw new DatabrainApiError(
+          0,
+          "NETWORK_ERROR",
+          usesOAuth ? "Failed to connect to Databrain API using configured service credentials." : `Failed to connect to Databrain API: ${err.message}`
+        );
+      }
+    }
+    throw lastError || new DatabrainApiError(0, "UNKNOWN", "Request failed after retries");
+  }
+};
+
+// src/custom-chart/assets.ts
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+var cachedDir;
+function customChartAssetDir() {
+  if (cachedDir) return cachedDir;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    here,
+    join(here, "custom-chart"),
+    join(here, "..", "custom-chart"),
+    join(here, "..", "..", "custom-chart"),
+    join(here, "..", "src", "custom-chart")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(join(candidate, "runtime-shim.js")) && existsSync(join(candidate, "template", "manifest.json"))) {
+      cachedDir = resolve(candidate);
+      return cachedDir;
+    }
+  }
+  throw new Error(
+    `Custom chart assets not found near ${here}. Expected runtime-shim.js and template/ (run npm run build).`
+  );
+}
+function readRuntimeShim() {
+  return readFileSync(join(customChartAssetDir(), "runtime-shim.js"), "utf8");
+}
+function templateDir() {
+  return join(customChartAssetDir(), "template");
+}
+function readTemplateFiles() {
+  const dir = templateDir();
+  const files = {};
+  for (const name of readdirSync(dir).sort()) {
+    const path = join(dir, name);
+    if (statSync(path).isFile()) files[name] = readFileSync(path, "utf8");
+  }
+  return files;
+}
+
+// src/custom-chart/manifest.ts
+import { z as z2 } from "zod";
+
+// src/custom-chart/types.ts
+var MAX_MANIFEST_BYTES = 32 * 1024;
+var MAX_BUNDLE_JS_BYTES = 2 * 1024 * 1024;
+var MAX_BUNDLE_CSS_BYTES = 256 * 1024;
+var MAX_ICON_BYTES = 16 * 1024;
+var MAX_SLOTS = 16;
+var MAX_OPTIONS = 32;
+
+// src/custom-chart/manifest.ts
+var ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+var FORBIDDEN_IDS = ["constructor", "prototype", "__proto__"];
+var LANGUAGE_PATTERN = /^[a-z]{2}(-[A-Z]{2})?$/;
+var SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+var COLOR_PATTERN = /^#[0-9a-fA-F]{6}$/;
+var FIELD_TYPES = ["string", "number", "boolean"];
+var MAX_TEXT = 256;
+var MAX_DESCRIPTION = 500;
+var MAX_GROUP = 64;
+var MAX_CHOICES = 32;
+var MAX_STRING_OPTION_LENGTH = 1024;
+var V1_TOP_KEYS = ["schemaVersion", "id", "name", "slots", "options"];
+var V2_TOP_EXTRA_KEYS = ["version", "description", "translations"];
+var V1_SLOT_KEYS = ["id", "label", "role", "types", "required"];
+var V2_SLOT_EXTRA_KEYS = ["description"];
+var OPTION_BASE_KEYS = ["id", "label", "type", "default"];
+var OPTION_TYPE_KEYS = {
+  boolean: [],
+  number: ["min", "max"],
+  string: ["maxLength"],
+  select: ["choices"],
+  color: []
+};
+var V2_OPTION_EXTRA_KEYS = {
+  boolean: ["group"],
+  number: ["group", "step"],
+  string: ["group"],
+  select: ["group"],
+  color: ["group"]
+};
+var TRANSLATION_KEYS = ["name", "description", "slots", "options"];
+var SLOT_TRANSLATION_KEYS = ["label", "description"];
+var OPTION_TRANSLATION_KEYS = ["label", "group", "choices"];
+var isRecord2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+var isId = (value) => typeof value === "string" && ID_PATTERN.test(value) && !FORBIDDEN_IDS.includes(value);
+var isText = (value, max = MAX_TEXT) => typeof value === "string" && value.length > 0 && value.length <= max;
+var isTranslationText = (value) => typeof value === "string" && value.length <= MAX_TEXT;
+var isFiniteNumber = (value) => typeof value === "number" && Number.isFinite(value);
+var jsonBytes = (value) => Buffer.byteLength(JSON.stringify(value), "utf8");
+var Collector = class {
+  problems = [];
+  add(code, path, message) {
+    this.problems.push({ code, path, message });
+  }
+  /**
+   * Unknown keys report `<scope>.unknownKey`, one per key; a missing required
+   * key reports `missingCode(key)`. Returns false when anything was reported,
+   * so the caller can stop looking at a shape it cannot trust.
+   */
+  checkKeys(value, path, scope, required, optional, missingCode = (key) => `${scope}.${key}`) {
+    const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+    let ok = true;
+    for (const key of Object.keys(value)) {
+      if (!allowed.has(key)) {
+        this.add(`${scope}.unknownKey`, `${path}/${key}`, `Remove "${key}". It is not a known key here.`);
+        ok = false;
+      }
+    }
+    for (const key of required) {
+      if (!Object.hasOwn(value, key)) {
+        this.add(missingCode(key), `${path}/${key}`, `Add the required key "${key}".`);
+        ok = false;
+      }
+    }
+    return ok;
+  }
+};
+function validateSlot(c, value, path, v2) {
+  if (!isRecord2(value)) {
+    c.add("manifest.slot.invalid", path, "A slot must be an object.");
+    return;
+  }
+  if (!c.checkKeys(value, path, "manifest.slot", V1_SLOT_KEYS, v2 ? V2_SLOT_EXTRA_KEYS : [])) return;
+  if (!isId(value.id)) {
+    c.add("manifest.slot.id", `${path}/id`, "A slot id is lowercase, starts with a letter, and uses only a-z, 0-9, _ and -, up to 64 characters.");
+  }
+  if (!isText(value.label)) {
+    c.add("manifest.slot.label", `${path}/label`, `A slot label is 1 to ${MAX_TEXT} characters.`);
+  }
+  const role = value.role;
+  if (role !== "dimension" && role !== "measure") {
+    c.add("manifest.slot.role", `${path}/role`, 'A slot role is "dimension" or "measure".');
+  }
+  if (typeof value.required !== "boolean") {
+    c.add("manifest.slot.required", `${path}/required`, "required is true or false.");
+  }
+  const types = value.types;
+  const typesOk = Array.isArray(types) && types.length > 0 && types.length <= 3 && new Set(types).size === types.length && types.every((type) => FIELD_TYPES.includes(type));
+  if (!typesOk) {
+    c.add("manifest.slot.types", `${path}/types`, 'types is a list of 1 to 3 distinct values from "string", "number" and "boolean".');
+  } else if (role === "measure" && (types.length !== 1 || types[0] !== "number")) {
+    c.add("manifest.slot.types", `${path}/types`, 'A measure slot accepts only ["number"].');
+  }
+  if (Object.hasOwn(value, "description") && !isText(value.description)) {
+    c.add("manifest.slot.description", `${path}/description`, `A slot description is 1 to ${MAX_TEXT} characters.`);
+  }
+}
+function validateOption(c, value, path, v2) {
+  if (!isRecord2(value)) {
+    c.add("manifest.option.invalid", path, "An option must be an object.");
+    return;
+  }
+  const id = value.id;
+  if (typeof id === "string" && (id === "theme" || id.startsWith("theme."))) {
+    c.add("manifest.option.reserved", `${path}/id`, 'The option id "theme" (and any id starting with "theme.") is reserved for the host theme.');
+    return;
+  }
+  const type = typeof value.type === "string" ? value.type : "";
+  const typeKeys = Object.hasOwn(OPTION_TYPE_KEYS, type) ? OPTION_TYPE_KEYS[type] : void 0;
+  if (!typeKeys || type === "color" && !v2) {
+    c.add(
+      "manifest.option.type",
+      `${path}/type`,
+      v2 ? 'An option type is one of "boolean", "number", "string", "select", "color".' : 'An option type is one of "boolean", "number", "string", "select" (color needs schemaVersion 2).'
+    );
+    return;
+  }
+  if (!c.checkKeys(value, path, "manifest.option", [...OPTION_BASE_KEYS, ...typeKeys], v2 ? V2_OPTION_EXTRA_KEYS[type] : [])) return;
+  if (!isId(id)) {
+    c.add("manifest.option.id", `${path}/id`, "An option id is lowercase, starts with a letter, and uses only a-z, 0-9, _ and -, up to 64 characters.");
+  }
+  if (!isText(value.label)) {
+    c.add("manifest.option.label", `${path}/label`, `An option label is 1 to ${MAX_TEXT} characters.`);
+  }
+  if (Object.hasOwn(value, "group") && !isText(value.group, MAX_GROUP)) {
+    c.add("manifest.option.group", `${path}/group`, `An option group is 1 to ${MAX_GROUP} characters.`);
+  }
+  switch (type) {
+    case "boolean":
+      if (typeof value.default !== "boolean") {
+        c.add("manifest.option.default", `${path}/default`, "A boolean default is true or false.");
+      }
+      break;
+    case "number": {
+      const rangeOk = isFiniteNumber(value.min) && isFiniteNumber(value.max) && value.min <= value.max;
+      if (!rangeOk) {
+        c.add("manifest.option.range", `${path}/min`, "Set finite min and max with min <= max.");
+        break;
+      }
+      const min = value.min;
+      const max = value.max;
+      if (!isFiniteNumber(value.default) || value.default < min || value.default > max) {
+        c.add("manifest.option.default", `${path}/default`, "A number default is a finite number between min and max.");
+      }
+      if (Object.hasOwn(value, "step") && (!isFiniteNumber(value.step) || value.step <= 0 || value.step > max - min)) {
+        c.add("manifest.option.step", `${path}/step`, "step is a positive number no larger than max - min.");
+      }
+      break;
+    }
+    case "string": {
+      const maxLength = value.maxLength;
+      if (!isFiniteNumber(maxLength) || !Number.isInteger(maxLength) || maxLength < 1 || maxLength > MAX_STRING_OPTION_LENGTH) {
+        c.add("manifest.option.maxLength", `${path}/maxLength`, `A string option needs an integer "maxLength" from 1 to ${MAX_STRING_OPTION_LENGTH}.`);
+        break;
+      }
+      if (typeof value.default !== "string" || value.default.length > maxLength) {
+        c.add("manifest.option.default", `${path}/default`, "A string default is a string no longer than maxLength.");
+      }
+      break;
+    }
+    case "select": {
+      const choices = value.choices;
+      const choicesOk = Array.isArray(choices) && choices.length > 0 && choices.length <= MAX_CHOICES && choices.every(
+        (choice) => isRecord2(choice) && Object.keys(choice).length === 2 && isId(choice.value) && isText(choice.label)
+      ) && new Set(choices.map((choice) => choice.value)).size === choices.length;
+      if (!choicesOk) {
+        c.add("manifest.option.choices", `${path}/choices`, `choices is a list of 1 to ${MAX_CHOICES} distinct { value, label } pairs; a value follows the id rule.`);
+        break;
+      }
+      if (!choices.some((choice) => choice.value === value.default)) {
+        c.add("manifest.option.default", `${path}/default`, "A select default is the value of one of its choices.");
+      }
+      break;
+    }
+    case "color":
+      if (typeof value.default !== "string" || !COLOR_PATTERN.test(value.default)) {
+        c.add("manifest.option.color", `${path}/default`, 'A color default is a 6 digit hex colour like "#3366cc".');
+      }
+      break;
+    default:
+      break;
+  }
+}
+function validateTranslations(c, value, slots, options) {
+  const path = "/translations";
+  if (!isRecord2(value)) {
+    c.add("manifest.translations.invalid", path, "translations is an object keyed by language code.");
+    return;
+  }
+  for (const [language, entry] of Object.entries(value)) {
+    const langPath = `${path}/${language}`;
+    if (!LANGUAGE_PATTERN.test(language)) {
+      c.add("manifest.translations.language", langPath, `"${language}" is not a language code like "fr" or "pt-BR".`);
+      continue;
+    }
+    if (!isRecord2(entry)) {
+      c.add("manifest.translations.invalid", langPath, "A translation is an object with optional name, description, slots and options.");
+      continue;
+    }
+    if (!c.checkKeys(entry, langPath, "manifest.translations", [], TRANSLATION_KEYS)) continue;
+    for (const key of ["name", "description"]) {
+      if (Object.hasOwn(entry, key) && !isTranslationText(entry[key])) {
+        c.add("manifest.translations.text", `${langPath}/${key}`, `A translated string is at most ${MAX_TEXT} characters.`);
+      }
+    }
+    if (Object.hasOwn(entry, "slots")) {
+      const entrySlots = entry.slots;
+      if (!isRecord2(entrySlots)) {
+        c.add("manifest.translations.invalid", `${langPath}/slots`, "slots is an object keyed by slot id.");
+      } else {
+        for (const [slotId, slotEntry] of Object.entries(entrySlots)) {
+          const slotPath = `${langPath}/slots/${slotId}`;
+          if (!slots.some((slot) => slot.id === slotId)) {
+            c.add("manifest.translations.slot", slotPath, `"${slotId}" is not a slot id in this manifest.`);
+            continue;
+          }
+          if (!isRecord2(slotEntry)) {
+            c.add("manifest.translations.invalid", slotPath, "A slot translation is an object with optional label and description.");
+            continue;
+          }
+          if (!c.checkKeys(slotEntry, slotPath, "manifest.translations", [], SLOT_TRANSLATION_KEYS)) continue;
+          for (const key of ["label", "description"]) {
+            if (Object.hasOwn(slotEntry, key) && !isTranslationText(slotEntry[key])) {
+              c.add("manifest.translations.text", `${slotPath}/${key}`, `A translated string is at most ${MAX_TEXT} characters.`);
+            }
+          }
+        }
+      }
+    }
+    if (Object.hasOwn(entry, "options")) {
+      const entryOptions = entry.options;
+      if (!isRecord2(entryOptions)) {
+        c.add("manifest.translations.invalid", `${langPath}/options`, "options is an object keyed by option id.");
+      } else {
+        for (const [optionId, optionEntry] of Object.entries(entryOptions)) {
+          const optionPath = `${langPath}/options/${optionId}`;
+          const option = options.find((item) => item.id === optionId);
+          if (!option) {
+            c.add("manifest.translations.option", optionPath, `"${optionId}" is not an option id in this manifest.`);
+            continue;
+          }
+          if (!isRecord2(optionEntry)) {
+            c.add("manifest.translations.invalid", optionPath, "An option translation is an object with optional label, group and choices.");
+            continue;
+          }
+          if (!c.checkKeys(optionEntry, optionPath, "manifest.translations", [], OPTION_TRANSLATION_KEYS)) continue;
+          for (const key of ["label", "group"]) {
+            if (Object.hasOwn(optionEntry, key) && !isTranslationText(optionEntry[key])) {
+              c.add("manifest.translations.text", `${optionPath}/${key}`, `A translated string is at most ${MAX_TEXT} characters.`);
+            }
+          }
+          if (!Object.hasOwn(optionEntry, "choices")) continue;
+          const choices = optionEntry.choices;
+          if (!isRecord2(choices)) {
+            c.add("manifest.translations.invalid", `${optionPath}/choices`, "choices is an object keyed by choice value.");
+            continue;
+          }
+          for (const [choiceValue, label] of Object.entries(choices)) {
+            const choicePath = `${optionPath}/choices/${choiceValue}`;
+            if (option.type !== "select" || !(option.choices ?? []).some((choice) => choice.value === choiceValue)) {
+              c.add("manifest.translations.choice", choicePath, `"${choiceValue}" is not a choice of option "${optionId}".`);
+            } else if (!isTranslationText(label)) {
+              c.add("manifest.translations.text", choicePath, `A translated string is at most ${MAX_TEXT} characters.`);
+            }
+          }
+        }
+      }
+    }
+  }
+}
+function validateManifest(value) {
+  const c = new Collector();
+  if (!isRecord2(value)) {
+    c.add("manifest.invalid", "", "manifest.json must be a JSON object.");
+    return c.problems;
+  }
+  const schemaVersion = value.schemaVersion;
+  if (schemaVersion !== 1 && schemaVersion !== 2) {
+    c.add("manifest.schemaVersion.unsupported", "/schemaVersion", "schemaVersion must be 1 or 2.");
+    return c.problems;
+  }
+  const v2 = schemaVersion === 2;
+  if (!c.checkKeys(value, "", "manifest", V1_TOP_KEYS, v2 ? V2_TOP_EXTRA_KEYS : [], (key) => `manifest.${key}.required`)) {
+    return c.problems;
+  }
+  if (!isId(value.id)) {
+    c.add("manifest.id.invalid", "/id", 'id is lowercase, starts with a letter, and uses only a-z, 0-9, _ and -, up to 64 characters. It becomes the chart type "custom:<id>".');
+  }
+  if (!isText(value.name)) {
+    c.add("manifest.name.invalid", "/name", `name is 1 to ${MAX_TEXT} characters.`);
+  }
+  if (Object.hasOwn(value, "version") && (typeof value.version !== "string" || !SEMVER_PATTERN.test(value.version))) {
+    c.add("manifest.version.invalid", "/version", 'version is a semver string like "1.2.0".');
+  }
+  if (Object.hasOwn(value, "description") && !isText(value.description, MAX_DESCRIPTION)) {
+    c.add("manifest.description.invalid", "/description", `description is 1 to ${MAX_DESCRIPTION} characters.`);
+  }
+  const slots = value.slots;
+  if (!Array.isArray(slots)) {
+    c.add("manifest.slots.invalid", "/slots", "slots must be an array.");
+  } else if (slots.length === 0) {
+    c.add("manifest.slots.empty", "/slots", "Declare at least one slot.");
+  } else if (slots.length > MAX_SLOTS) {
+    c.add("manifest.slots.tooMany", "/slots", `Declare at most ${MAX_SLOTS} slots.`);
+  } else {
+    slots.forEach((slot, index) => validateSlot(c, slot, `/slots/${index}`, v2));
+    const seen = /* @__PURE__ */ new Set();
+    slots.forEach((slot, index) => {
+      if (!isRecord2(slot) || typeof slot.id !== "string") return;
+      if (seen.has(slot.id)) {
+        c.add("manifest.slot.duplicate", `/slots/${index}/id`, `Slot id "${slot.id}" is used more than once.`);
+      }
+      seen.add(slot.id);
+    });
+  }
+  const options = value.options;
+  if (!Array.isArray(options)) {
+    c.add("manifest.options.invalid", "/options", "options must be an array (it may be empty).");
+  } else if (options.length > MAX_OPTIONS) {
+    c.add("manifest.options.tooMany", "/options", `Declare at most ${MAX_OPTIONS} options.`);
+  } else {
+    options.forEach((option, index) => validateOption(c, option, `/options/${index}`, v2));
+    const seen = /* @__PURE__ */ new Set();
+    options.forEach((option, index) => {
+      if (!isRecord2(option) || typeof option.id !== "string") return;
+      if (seen.has(option.id)) {
+        c.add("manifest.option.duplicate", `/options/${index}/id`, `Option id "${option.id}" is used more than once.`);
+      }
+      seen.add(option.id);
+    });
+  }
+  if (c.problems.length === 0 && Object.hasOwn(value, "translations")) {
+    validateTranslations(
+      c,
+      value.translations,
+      slots,
+      options
+    );
+  }
+  if (c.problems.length === 0 && jsonBytes(value) > MAX_MANIFEST_BYTES) {
+    c.add("manifest.size", "", `manifest.json must be at most ${MAX_MANIFEST_BYTES} bytes as JSON.`);
+  }
+  return c.problems;
+}
+var slotSchema = z2.object({
+  id: z2.string(),
+  label: z2.string(),
+  role: z2.enum(["dimension", "measure"]),
+  types: z2.array(z2.enum(["string", "number", "boolean"])),
+  required: z2.boolean(),
+  description: z2.string().optional()
+});
+var optionSchema = z2.object({
+  id: z2.string(),
+  label: z2.string(),
+  type: z2.enum(["boolean", "number", "string", "select", "color"]),
+  default: z2.union([z2.string(), z2.number(), z2.boolean()]),
+  min: z2.number().optional(),
+  max: z2.number().optional(),
+  step: z2.number().optional(),
+  maxLength: z2.number().optional(),
+  choices: z2.array(z2.object({ value: z2.string(), label: z2.string() })).optional(),
+  group: z2.string().optional()
+});
+var manifestSchema = z2.object({
+  schemaVersion: z2.union([z2.literal(1), z2.literal(2)]),
+  id: z2.string(),
+  name: z2.string(),
+  version: z2.string().optional(),
+  description: z2.string().optional(),
+  slots: z2.array(slotSchema),
+  options: z2.array(optionSchema),
+  translations: z2.record(z2.unknown()).optional()
+});
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map((item) => sortKeys(item));
+  if (isRecord2(value)) {
+    const out = {};
+    for (const key of Object.keys(value).sort()) out[key] = sortKeys(value[key]);
+    return out;
+  }
+  return value;
+}
+
+// src/custom-chart/scaffold.ts
+var DEFAULT_SLOTS = [
+  { id: "category", label: "Category", role: "dimension", types: ["string"], required: true, description: "One bar per value." },
+  { id: "value", label: "Value", role: "measure", types: ["number"], required: true },
+  { id: "target", label: "Target", role: "measure", types: ["number"], required: false }
+];
+function scaffoldProject(input) {
+  const template = readTemplateFiles();
+  const templateManifest = JSON.parse(template["manifest.json"]);
+  const problems = [];
+  if (!isId(input.key)) {
+    problems.push({
+      code: "manifest.id.invalid",
+      path: "/id",
+      message: "key must match ^[a-z][a-z0-9_-]{0,63}$ (lowercase letters, digits, _ and -)."
+    });
+  }
+  const name = typeof input.name === "string" ? input.name.trim() : "";
+  if (name.length === 0 || name.length > 256) {
+    problems.push({ code: "manifest.name.invalid", path: "/name", message: "name must be 1 to 256 characters." });
+  }
+  const manifest = {
+    schemaVersion: 2,
+    id: input.key,
+    name,
+    version: "1.0.0",
+    ...input.description ? { description: input.description } : {},
+    slots: input.slots && input.slots.length > 0 ? input.slots : templateManifest.slots ?? DEFAULT_SLOTS,
+    options: input.options ?? templateManifest.options
+  };
+  problems.push(...validateManifest(manifest));
+  const packageJson = JSON.parse(template["package.json"]);
+  packageJson.name = input.key;
+  const files = {};
+  for (const [file, content] of Object.entries(template)) {
+    if (file === "manifest.json") files[file] = JSON.stringify(manifest, null, 2) + "\n";
+    else if (file === "package.json") files[file] = JSON.stringify(packageJson, null, 2) + "\n";
+    else files[file] = content;
+  }
+  return {
+    ok: problems.length === 0,
+    problems,
+    files,
+    nextStep: "Write these files into a folder, edit chart.ts, then run `databrain custom-chart validate` and `databrain custom-chart build`. Upload with `databrain custom-chart upload` or the custom_chart_upload tool."
+  };
+}
+
+// src/custom-chart/bundle.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join2, resolve as resolve2, sep } from "path";
+import { build as esbuild } from "esbuild";
+
+// src/custom-chart/sanitize-svg.ts
+var ALLOWED_ELEMENTS = /* @__PURE__ */ new Set([
+  "svg",
+  "g",
+  "defs",
+  "symbol",
+  "use",
+  "title",
+  "desc",
+  "metadata",
+  "path",
+  "rect",
+  "circle",
+  "ellipse",
+  "line",
+  "polyline",
+  "polygon",
+  "text",
+  "tspan",
+  "textpath",
+  "image",
+  "lineargradient",
+  "radialgradient",
+  "stop",
+  "clippath",
+  "mask",
+  "pattern",
+  "marker",
+  "filter",
+  "fegaussianblur",
+  "feoffset",
+  "feblend",
+  "fecolormatrix",
+  "fecomposite",
+  "feflood",
+  "femerge",
+  "femergenode",
+  "fedropshadow",
+  "style",
+  "switch"
+]);
+var ALLOWED_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "id",
+  "class",
+  "style",
+  "href",
+  "xlink:href",
+  "xml:space",
+  "lang",
+  "xml:lang",
+  "version",
+  "baseprofile",
+  "viewbox",
+  "preserveaspectratio",
+  "width",
+  "height",
+  "x",
+  "y",
+  "x1",
+  "y1",
+  "x2",
+  "y2",
+  "cx",
+  "cy",
+  "r",
+  "rx",
+  "ry",
+  "fx",
+  "fy",
+  "fr",
+  "d",
+  "points",
+  "transform",
+  "transform-origin",
+  "fill",
+  "fill-opacity",
+  "fill-rule",
+  "stroke",
+  "stroke-width",
+  "stroke-linecap",
+  "stroke-linejoin",
+  "stroke-miterlimit",
+  "stroke-dasharray",
+  "stroke-dashoffset",
+  "stroke-opacity",
+  "opacity",
+  "color",
+  "display",
+  "visibility",
+  "overflow",
+  "clip-path",
+  "clip-rule",
+  "clippathunits",
+  "mask",
+  "maskunits",
+  "maskcontentunits",
+  "filter",
+  "filterunits",
+  "primitiveunits",
+  "in",
+  "in2",
+  "result",
+  "mode",
+  "operator",
+  "values",
+  "type",
+  "stddeviation",
+  "dx",
+  "dy",
+  "flood-color",
+  "flood-opacity",
+  "offset",
+  "stop-color",
+  "stop-opacity",
+  "gradientunits",
+  "gradienttransform",
+  "spreadmethod",
+  "patternunits",
+  "patterncontentunits",
+  "patterntransform",
+  "markerunits",
+  "markerwidth",
+  "markerheight",
+  "refx",
+  "refy",
+  "orient",
+  "font-family",
+  "font-size",
+  "font-weight",
+  "font-style",
+  "letter-spacing",
+  "text-anchor",
+  "dominant-baseline",
+  "alignment-baseline",
+  "text-decoration",
+  "word-spacing",
+  "paint-order",
+  "vector-effect",
+  "shape-rendering",
+  "text-rendering",
+  "image-rendering",
+  "color-interpolation",
+  "color-interpolation-filters",
+  "enable-background",
+  "startoffset",
+  "method",
+  "spacing",
+  "requiredfeatures",
+  "systemlanguage",
+  "role",
+  "aria-label",
+  "aria-labelledby",
+  "aria-hidden",
+  "focusable",
+  "tabindex"
+]);
+var TAG_RE = /^<\s*(\/?)\s*([A-Za-z_][\w:.-]*)([\s\S]*?)(\/?)\s*>$/;
+var ATTRIBUTE_RE = /([^\s=/"']+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+var decodeEntities = (value) => value.replace(
+  /&#x([0-9a-fA-F]+);?/g,
+  (_m, hex) => String.fromCodePoint(parseInt(hex, 16))
+).replace(
+  /&#(\d+);?/g,
+  (_m, dec) => String.fromCodePoint(parseInt(dec, 10))
+).replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+var normaliseForSchemeCheck = (value) => decodeEntities(value).replace(/[\u0000-\u0020\u007f-\u00a0\u200b-\u200f\u2028\u2029\ufeff]/g, "").toLowerCase();
+var DANGEROUS_SCHEME_RE = /^(javascript|vbscript|livescript|mocha|data:text\/html|data:application)/;
+var isDangerousValue = (value) => {
+  const normalised = normaliseForSchemeCheck(value);
+  return DANGEROUS_SCHEME_RE.test(normalised) || normalised.includes("javascript:") || normalised.includes("vbscript:");
+};
+var SAFE_DATA_IMAGE_RE = /^data:image\/(png|jpeg|jpg|gif|webp);base64,[a-z0-9+/=]+$/;
+var isAcceptableHref = (value, element) => {
+  const normalised = normaliseForSchemeCheck(value);
+  if (normalised.startsWith("#")) return true;
+  return element === "image" && SAFE_DATA_IMAGE_RE.test(normalised);
+};
+var LOCAL_URL_RE = /url\s*\(\s*(['"]?)#[^)'"]*\1\s*\)/gi;
+var STYLE_ESCAPE_RE = /url\s*\(|@import|expression\s*\(|-moz-binding|behavior\s*:/i;
+var isSafeStyle = (value) => !STYLE_ESCAPE_RE.test(decodeEntities(value).replace(LOCAL_URL_RE, ""));
+var tokenize = (input) => {
+  const tokens = [];
+  let index = 0;
+  const length = input.length;
+  const pushSpecial = (end, terminator) => {
+    const close = input.indexOf(terminator, end);
+    const stop = close === -1 ? length : close + terminator.length;
+    tokens.push({ kind: "special", raw: input.slice(index, stop) });
+    index = stop;
+  };
+  while (index < length) {
+    const open = input.indexOf("<", index);
+    if (open === -1) {
+      tokens.push({ kind: "text", raw: input.slice(index) });
+      break;
+    }
+    if (open > index) {
+      tokens.push({ kind: "text", raw: input.slice(index, open) });
+      index = open;
+    }
+    if (input.startsWith("<!--", index)) {
+      pushSpecial(index + 4, "-->");
+      continue;
+    }
+    if (input.startsWith("<![CDATA[", index)) {
+      pushSpecial(index + 9, "]]>");
+      continue;
+    }
+    if (input.startsWith("<?", index)) {
+      pushSpecial(index + 2, "?>");
+      continue;
+    }
+    if (input.startsWith("<!", index)) {
+      const bracket = input.indexOf("[", index);
+      const plainEnd = input.indexOf(">", index);
+      if (bracket !== -1 && (plainEnd === -1 || bracket < plainEnd)) {
+        const subsetEnd = input.indexOf("]", bracket);
+        pushSpecial(subsetEnd === -1 ? index + 2 : subsetEnd, ">");
+      } else {
+        pushSpecial(index + 2, ">");
+      }
+      continue;
+    }
+    let cursor = index + 1;
+    let quote = null;
+    while (cursor < length) {
+      const ch = input[cursor];
+      if (quote) {
+        if (ch === quote) quote = null;
+      } else if (ch === '"' || ch === "'") {
+        quote = ch;
+      } else if (ch === ">") {
+        break;
+      }
+      cursor += 1;
+    }
+    const stop = cursor >= length ? length : cursor + 1;
+    tokens.push({ kind: "tag", raw: input.slice(index, stop) });
+    index = stop;
+  }
+  return tokens;
+};
+var isXmlDeclaration = (raw) => /^<\?xml\b/i.test(raw);
+var cleanAttributes = (element, rawAttributes) => {
+  let removed = 0;
+  let dropElement = false;
+  const kept = [];
+  ATTRIBUTE_RE.lastIndex = 0;
+  let match;
+  while ((match = ATTRIBUTE_RE.exec(rawAttributes)) !== null) {
+    const [whole, name, dq, sq, bare] = match;
+    if (!name || name === "/") continue;
+    const lower = name.toLowerCase();
+    const value = dq ?? sq ?? bare ?? "";
+    if (lower.startsWith("on")) {
+      removed += 1;
+      continue;
+    }
+    const isNamespaceDeclaration = lower === "xmlns" || lower.startsWith("xmlns:");
+    const isData = lower.startsWith("data-");
+    if (!isNamespaceDeclaration && !isData && !ALLOWED_ATTRIBUTES.has(lower)) {
+      removed += 1;
+      continue;
+    }
+    if (isDangerousValue(value)) {
+      removed += 1;
+      continue;
+    }
+    if (lower === "href" || lower === "xlink:href") {
+      if (!isAcceptableHref(value, element)) {
+        removed += 1;
+        if (element === "image" || element === "use") dropElement = true;
+        continue;
+      }
+    }
+    if (lower === "style" && !isSafeStyle(value)) {
+      removed += 1;
+      continue;
+    }
+    kept.push(whole.trim());
+  }
+  return {
+    attributes: kept.length ? ` ${kept.join(" ")}` : "",
+    removed,
+    dropElement
+  };
+};
+var STYLE_OPEN_MARKER = "\0style-open\0";
+var sanitizeSvg = (input) => {
+  const tokens = tokenize(input);
+  const out = [];
+  let removed = 0;
+  let isSvg = false;
+  let dropDepth = 0;
+  const dropStack = [];
+  let styleBuffer = null;
+  for (const token of tokens) {
+    if (token.kind === "special") {
+      if (isXmlDeclaration(token.raw) && dropDepth === 0) {
+        out.push(token.raw);
+      } else {
+        removed += 1;
+      }
+      continue;
+    }
+    if (token.kind === "text") {
+      if (dropDepth > 0) continue;
+      if (styleBuffer) {
+        styleBuffer.push(token.raw);
+      } else {
+        out.push(token.raw);
+      }
+      continue;
+    }
+    const parsed = TAG_RE.exec(token.raw);
+    if (!parsed) {
+      removed += 1;
+      continue;
+    }
+    const [, closing, rawName, rawAttributes, selfClosingSlash] = parsed;
+    const name = rawName.toLowerCase();
+    const isClosing = closing === "/";
+    const isSelfClosing = selfClosingSlash === "/";
+    if (name === "svg") isSvg = true;
+    if (dropDepth > 0) {
+      if (isClosing) {
+        if (dropStack[dropStack.length - 1] === name) {
+          dropStack.pop();
+          dropDepth -= 1;
+        }
+      } else if (!isSelfClosing) {
+        dropStack.push(name);
+        dropDepth += 1;
+      }
+      continue;
+    }
+    if (isClosing) {
+      if (name === "style" && styleBuffer) {
+        const css = styleBuffer.join("");
+        styleBuffer = null;
+        if (isSafeStyle(css)) {
+          out.push(css, token.raw);
+        } else {
+          const openIndex = out.lastIndexOf(STYLE_OPEN_MARKER);
+          if (openIndex !== -1) out.splice(openIndex);
+          removed += 1;
+        }
+        continue;
+      }
+      if (ALLOWED_ELEMENTS.has(name)) out.push(token.raw);
+      continue;
+    }
+    if (!ALLOWED_ELEMENTS.has(name)) {
+      removed += 1;
+      if (!isSelfClosing) {
+        dropStack.push(name);
+        dropDepth += 1;
+      }
+      continue;
+    }
+    const cleaned = cleanAttributes(name, rawAttributes);
+    removed += cleaned.removed;
+    if (cleaned.dropElement) {
+      removed += 1;
+      if (!isSelfClosing) {
+        dropStack.push(name);
+        dropDepth += 1;
+      }
+      continue;
+    }
+    const rebuilt = `<${rawName}${cleaned.attributes}${isSelfClosing ? "/" : ""}>`;
+    if (name === "style" && !isSelfClosing) {
+      out.push(STYLE_OPEN_MARKER, rebuilt);
+      styleBuffer = [];
+      continue;
+    }
+    out.push(rebuilt);
+  }
+  if (styleBuffer) {
+    const openIndex = out.lastIndexOf(STYLE_OPEN_MARKER);
+    if (openIndex !== -1) out.splice(openIndex);
+    removed += 1;
+  }
+  return {
+    svg: out.filter((chunk) => chunk !== STYLE_OPEN_MARKER).join(""),
+    removed,
+    isSvg
+  };
+};
+
+// src/custom-chart/icon.ts
+var UNSAFE = "bundle.icon.unsafe";
+var RULES = [
+  { pattern: /<\s*script\b/i, message: "Remove every <script> element from icon.svg." },
+  { pattern: /<\s*foreignObject\b/i, message: "Remove every <foreignObject> element from icon.svg." },
+  { pattern: /<\s*image\b/i, message: "Remove every <image> element from icon.svg. Draw with paths and shapes." },
+  { pattern: /[\s/]on[a-z]+\s*=/i, message: "Remove every on*= event attribute from icon.svg." },
+  { pattern: /<!--/, message: "Remove every <!-- comment --> from icon.svg." },
+  { pattern: /<!(?:ENTITY|DOCTYPE)\b/i, message: "Remove the DOCTYPE and entity declarations from icon.svg." },
+  { pattern: /<!\[CDATA\[/, message: "Remove every CDATA section from icon.svg." },
+  { pattern: /(?:xlink:)?href\s*=\s*["']\s*(?!#)/i, message: "Every href in icon.svg must start with # (no external or data references)." },
+  { pattern: /javascript\s*:/i, message: "Remove every javascript: reference from icon.svg." },
+  { pattern: /@import|expression\s*\(|-moz-binding/i, message: "Remove @import, expression() and -moz-binding from icon.svg styles." },
+  { pattern: /url\s*\(\s*['"]?\s*(?!#)/i, message: "Every url() in icon.svg must point at a same-document #id." }
+];
+var GENERIC_UNSAFE = "icon.svg must use only plain SVG drawing elements and attributes: no script, event handlers, foreignObject, image, animation, external hrefs, url() styles, comments, DOCTYPE or unknown attributes.";
+var XML_DECLARATION = /^\s*<\?xml[^>]*\?>\s*/i;
+function isSingleSvgRoot(svg) {
+  const body = svg.replace(/^/, "").replace(XML_DECLARATION, "").trim();
+  return /^<svg[\s>][\s\S]*<\/svg>$/i.test(body) || /^<svg\b[^>]*\/>$/i.test(body);
+}
+function validateIcon(svg, path = "/icon.svg") {
+  if (typeof svg !== "string" || svg.trim().length === 0) {
+    return [{ code: "bundle.icon.required", path, message: "icon.svg is required and must not be empty." }];
+  }
+  if (Buffer.byteLength(svg, "utf8") > MAX_ICON_BYTES) {
+    return [{ code: "bundle.icon.size", path, message: `icon.svg must be at most ${MAX_ICON_BYTES} bytes.` }];
+  }
+  const cleaned = sanitizeSvg(svg);
+  if (!cleaned.isSvg || !isSingleSvgRoot(cleaned.svg)) {
+    return [{ code: "bundle.icon.notSvg", path, message: "icon.svg must be one <svg> element with nothing after it." }];
+  }
+  if (cleaned.removed > 0 || /<\s*image\b/i.test(svg)) {
+    const rule = RULES.find((candidate) => candidate.pattern.test(svg));
+    return [{ code: UNSAFE, path, message: rule ? rule.message : GENERIC_UNSAFE }];
+  }
+  return [];
+}
+function sanitizeIcon(svg) {
+  return svg.replace(/^/, "").replace(XML_DECLARATION, "").replace(/<!--[\s\S]*?-->/g, "").trim();
+}
+
+// src/custom-chart/zip.ts
+import { strFromU8, strToU8, unzipSync, zipSync } from "fflate";
+var BUNDLE_ZIP_FILES = ["index.js", "manifest.json", "icon.svg", "index.css"];
+function writeBundleZip(files) {
+  const entries = {};
+  for (const name of BUNDLE_ZIP_FILES) {
+    const content = files[name];
+    if (typeof content === "string") entries[name] = strToU8(content);
+  }
+  return zipSync(entries, { level: 6, mtime: /* @__PURE__ */ new Date("2000-01-01T00:00:00Z") });
+}
+
+// src/custom-chart/bundle.ts
+var utf8Bytes = (text) => Buffer.byteLength(text, "utf8");
+function contentHash(bundle) {
+  const payload = JSON.stringify({
+    manifest: sortKeys(bundle.manifest),
+    bundleJs: bundle.bundleJs,
+    bundleCss: bundle.bundleCss ?? "",
+    iconSvg: bundle.iconSvg
+  });
+  return createHash("sha256").update(payload, "utf8").digest("hex");
+}
+function bundleSizeBytes(bundle) {
+  return utf8Bytes(JSON.stringify(bundle.manifest)) + utf8Bytes(bundle.bundleJs) + (bundle.bundleCss ? utf8Bytes(bundle.bundleCss) : 0) + utf8Bytes(bundle.iconSvg);
+}
+function validateBundle(input) {
+  const problems = validateManifest(input.manifest);
+  if (input.bundleJs !== void 0) {
+    if (typeof input.bundleJs !== "string") {
+      problems.push({ code: "bundle.js.type", path: "/bundleJs", message: "bundleJs must be a string." });
+    } else if (input.bundleJs.trim().length === 0) {
+      problems.push({ code: "bundle.js.empty", path: "/bundleJs", message: "bundleJs must contain JavaScript." });
+    } else if (utf8Bytes(input.bundleJs) > MAX_BUNDLE_JS_BYTES) {
+      problems.push({
+        code: "bundle.js.size",
+        path: "/bundleJs",
+        message: `bundleJs must be at most ${MAX_BUNDLE_JS_BYTES} bytes (2 MiB) as UTF-8. Drop or shrink a dependency.`
+      });
+    }
+  }
+  if (input.bundleCss !== void 0) {
+    if (typeof input.bundleCss !== "string") {
+      problems.push({ code: "bundle.css.type", path: "/bundleCss", message: "bundleCss must be a string when present." });
+    } else if (utf8Bytes(input.bundleCss) > MAX_BUNDLE_CSS_BYTES) {
+      problems.push({
+        code: "bundle.css.size",
+        path: "/bundleCss",
+        message: `bundleCss must be at most ${MAX_BUNDLE_CSS_BYTES} bytes (256 KiB).`
+      });
+    }
+  }
+  if (input.iconSvg !== void 0) problems.push(...validateIcon(input.iconSvg, "/iconSvg"));
+  return problems;
+}
+function readProject(dirInput) {
+  const dir = resolve2(dirInput);
+  const problems = [];
+  const project = { dir, manifest: void 0, problems };
+  const manifestPath = join2(dir, "manifest.json");
+  if (!existsSync2(manifestPath)) {
+    problems.push({ code: "project.manifest.missing", path: "/manifest.json", message: `No manifest.json in ${dir}.` });
+  } else {
+    project.manifestText = readFileSync2(manifestPath, "utf8");
+    try {
+      project.manifest = JSON.parse(project.manifestText);
+    } catch (err) {
+      problems.push({
+        code: "project.manifest.parse",
+        path: "/manifest.json",
+        message: `manifest.json is not valid JSON: ${err.message}`
+      });
+    }
+  }
+  const entry = ["chart.ts", "chart.js"].map((name) => join2(dir, name)).find((path) => existsSync2(path));
+  if (!entry) {
+    problems.push({ code: "project.chart.missing", path: "/chart.ts", message: `No chart.ts in ${dir}. It must export render(ctx).` });
+  } else {
+    project.chartEntry = entry;
+  }
+  const cssPath = join2(dir, "chart.css");
+  if (existsSync2(cssPath)) project.css = readFileSync2(cssPath, "utf8");
+  const iconPath = join2(dir, "icon.svg");
+  if (!existsSync2(iconPath)) {
+    problems.push({ code: "bundle.icon.required", path: "/icon.svg", message: `No icon.svg in ${dir}.` });
+  } else {
+    project.icon = readFileSync2(iconPath, "utf8");
+  }
+  const samplePath = join2(dir, "sample-data.json");
+  if (existsSync2(samplePath)) {
+    try {
+      project.sampleData = JSON.parse(readFileSync2(samplePath, "utf8"));
+    } catch (err) {
+      problems.push({
+        code: "project.sampleData.parse",
+        path: "/sample-data.json",
+        message: `sample-data.json is not valid JSON: ${err.message}`
+      });
+    }
+  }
+  return project;
+}
+function validateProject(dir) {
+  const project = readProject(dir);
+  const problems = [...project.problems];
+  if (project.manifest !== void 0) problems.push(...validateManifest(project.manifest));
+  if (project.icon !== void 0) problems.push(...validateIcon(sanitizeIcon(project.icon)));
+  if (project.css !== void 0 && utf8Bytes(project.css) > MAX_BUNDLE_CSS_BYTES) {
+    problems.push({ code: "bundle.css.size", path: "/chart.css", message: `chart.css must be at most ${MAX_BUNDLE_CSS_BYTES} bytes.` });
+  }
+  return { ok: problems.length === 0, problems, project };
+}
+function insideProjectOnly(dir) {
+  const root = dir.endsWith(sep) ? dir : `${dir}${sep}`;
+  return {
+    name: "databrain-inside-project-only",
+    setup(build) {
+      build.onResolve({ filter: /.*/ }, async (args) => {
+        if (args.kind === "entry-point" || args.pluginData?.databrainChecked) return void 0;
+        const resolved = await build.resolve(args.path, {
+          kind: args.kind,
+          resolveDir: args.resolveDir,
+          importer: args.importer,
+          pluginData: { databrainChecked: true }
+        });
+        if (resolved.errors.length > 0) return { errors: resolved.errors };
+        if (resolved.external || resolved.path.startsWith(root)) return resolved;
+        return {
+          errors: [
+            {
+              text: `"${args.path}" is outside the chart project. Only files inside ${dir} can be imported.`
+            }
+          ]
+        };
+      });
+    }
+  };
+}
+async function buildProject(dir, options = {}) {
+  const validated = validateProject(dir);
+  const { project } = validated;
+  const problems = [...validated.problems];
+  if (!project.chartEntry || project.manifest === void 0 || problems.length > 0) {
+    return { ok: false, problems, written: [] };
+  }
+  const manifest = project.manifest;
+  const common = {
+    plugins: [insideProjectOnly(project.dir)],
+    entryPoints: [project.chartEntry],
+    absWorkingDir: project.dir,
+    bundle: true,
+    target: "es2020",
+    platform: "browser",
+    write: false,
+    legalComments: "none",
+    logLevel: "silent",
+    charset: "utf8"
+  };
+  let moduleJs;
+  try {
+    const shape = await esbuild({ ...common, format: "esm", metafile: true });
+    const exported = Object.values(shape.metafile.outputs)[0]?.exports ?? [];
+    if (!exported.includes("render")) {
+      problems.push({
+        code: "bundle.build.noRender",
+        path: "/chart.ts",
+        message: "chart.ts must be an ES module that exports a function named render: `export function render(ctx) { ... }`. module.exports and default exports are not read."
+      });
+      return { ok: false, problems, written: [] };
+    }
+    const result = await esbuild({
+      ...common,
+      format: "iife",
+      globalName: "__dbnCustomChart",
+      minify: true
+    });
+    moduleJs = result.outputFiles.map((file) => file.text).join("\n");
+  } catch (err) {
+    const errors = err.errors;
+    if (Array.isArray(errors) && errors.length > 0) {
+      for (const error of errors) {
+        const where = error.location ? `${error.location.file ?? "chart.ts"}:${error.location.line ?? 0}` : "chart.ts";
+        problems.push({ code: "bundle.build.failed", path: `/${where}`, message: error.text });
+      }
+    } else {
+      problems.push({ code: "bundle.build.failed", path: "/chart.ts", message: err.message });
+    }
+    return { ok: false, problems, written: [] };
+  }
+  const shim = readRuntimeShim();
+  const slotIds = manifest.slots.map((slot) => slot.id);
+  const globals = `globalThis.__dbnCustomChartSlots=${JSON.stringify(slotIds)};
+`;
+  const bundleJs = `${shim.trimEnd()}
+${globals}${moduleJs.trimEnd()}
+globalThis.__dbnCustomChart=__dbnCustomChart;
+`;
+  const iconSvg = sanitizeIcon(project.icon);
+  const bundleCss = project.css;
+  problems.push(...validateBundle({ manifest, bundleJs, bundleCss, iconSvg }));
+  if (problems.length > 0) return { ok: false, problems, written: [] };
+  const bundle = { manifest, bundleJs, bundleCss, iconSvg };
+  const outputs = {
+    ...bundle,
+    contentHash: contentHash(bundle),
+    sizeBytes: bundleSizeBytes(bundle)
+  };
+  const written = [];
+  if (options.write !== false) {
+    const dist = join2(project.dir, "dist");
+    mkdirSync(dist, { recursive: true });
+    const manifestJson = JSON.stringify(manifest, null, 2) + "\n";
+    const write = (name, content) => {
+      const path = join2(dist, name);
+      writeFileSync(path, content);
+      written.push(path);
+    };
+    write("index.js", bundleJs);
+    write("manifest.json", manifestJson);
+    write("icon.svg", iconSvg);
+    if (bundleCss !== void 0) write("index.css", bundleCss);
+    write(
+      "bundle.zip",
+      writeBundleZip({
+        "index.js": bundleJs,
+        "manifest.json": manifestJson,
+        "icon.svg": iconSvg,
+        ...bundleCss !== void 0 ? { "index.css": bundleCss } : {}
+      })
+    );
+  }
+  return { ok: true, problems: [], outputs, written };
+}
+function readDist(dir) {
+  const dist = join2(resolve2(dir), "dist");
+  const problems = [];
+  const need = ["index.js", "manifest.json", "icon.svg"];
+  for (const name of need) {
+    if (!existsSync2(join2(dist, name))) {
+      problems.push({ code: "project.dist.missing", path: `/dist/${name}`, message: `dist/${name} is missing. Run databrain custom-chart build first.` });
+    }
+  }
+  if (problems.length > 0) return { problems };
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync2(join2(dist, "manifest.json"), "utf8"));
+  } catch (err) {
+    return { problems: [{ code: "project.dist.parse", path: "/dist/manifest.json", message: err.message }] };
+  }
+  const manifestProblems = validateManifest(manifest);
+  if (manifestProblems.length > 0) return { problems: manifestProblems };
+  const cssPath = join2(dist, "index.css");
+  return {
+    problems,
+    bundle: {
+      manifest,
+      bundleJs: readFileSync2(join2(dist, "index.js"), "utf8"),
+      bundleCss: existsSync2(cssPath) ? readFileSync2(cssPath, "utf8") : void 0,
+      iconSvg: readFileSync2(join2(dist, "icon.svg"), "utf8")
+    }
+  };
+}
+
+// src/api/custom-charts-api.ts
+var CUSTOM_CHARTS_PATH = "/api/mcp/custom-charts";
+var LIST_CACHE_KEY = "list_custom_charts";
+var encodeKey = (key) => encodeURIComponent(key);
+var CustomChartsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const response = await this.client.request({
+      method: "GET",
+      path: CUSTOM_CHARTS_PATH,
+      auth: "service",
+      cacheKey: LIST_CACHE_KEY,
+      cacheTtlMs: 3e4
+    });
+    if (Array.isArray(response)) return response;
+    return Array.isArray(response?.charts) ? response.charts : [];
+  }
+  async get(key) {
+    const response = await this.client.request({
+      method: "GET",
+      path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}`,
+      auth: "service"
+    });
+    const wrapped = response;
+    return wrapped.chart ? wrapped.chart : response;
+  }
+  /** Never persists. The server repeats every client side check. */
+  async validate(body) {
+    const response = await this.client.request({
+      method: "POST",
+      path: `${CUSTOM_CHARTS_PATH}/validate`,
+      auth: "service",
+      body,
+      timeoutMs: 6e4
+    });
+    return {
+      ok: response.ok === true,
+      problems: Array.isArray(response.problems) ? response.problems : [],
+      contentHash: response.contentHash,
+      sizeBytes: response.sizeBytes
+    };
+  }
+  /** Creates the chart (first upload) or a preview version; idempotent on contentHash. */
+  async upload(body) {
+    return this.client.request({
+      method: "POST",
+      path: CUSTOM_CHARTS_PATH,
+      auth: "service",
+      body,
+      timeoutMs: 6e4,
+      invalidateCache: [LIST_CACHE_KEY]
+    });
+  }
+  async publish(key, versionId) {
+    return this.client.request({
+      method: "POST",
+      path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}/publish`,
+      auth: "service",
+      body: versionId ? { versionId } : {},
+      invalidateCache: [LIST_CACHE_KEY]
+    });
+  }
+  async discardPreview(key) {
+    return this.client.request({
+      method: "POST",
+      path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}/discard-preview`,
+      auth: "service",
+      body: {},
+      invalidateCache: [LIST_CACHE_KEY]
+    });
+  }
+};
+
+// src/custom-chart/api.ts
+function createCustomChartsApi(client) {
+  return new CustomChartsApi(client);
+}
+function apiProblems(err) {
+  if (!(err instanceof DatabrainApiError)) return [];
+  const details = err.details;
+  const list = details?.error?.problems ?? details?.problems;
+  if (!Array.isArray(list)) return [];
+  return list.filter(
+    (item) => !!item && typeof item === "object" && typeof item.code === "string" && typeof item.message === "string"
+  );
+}
+function planUpload(key, existing, versionsKnown) {
+  if (!existing) {
+    return { action: "create chart", key, nextVersionNumber: 1, summary: `will create chart custom:${key} (version 1, status private)` };
+  }
+  const count = typeof versionsKnown === "number" ? versionsKnown : typeof existing.versionsCount === "number" ? existing.versionsCount : void 0;
+  const next = count !== void 0 ? count + 1 : NaN;
+  const label = Number.isFinite(next) ? `version ${next}` : "the next version";
+  return {
+    action: "create version",
+    key,
+    existing,
+    nextVersionNumber: Number.isFinite(next) ? next : 0,
+    summary: `will create ${label} of custom:${key} in preview (status stays ${existing.status}; the published version keeps serving until you publish)`
+  };
+}
+
+export {
+  oauthHttpsUrl,
+  oauthConfigSchema,
+  DatabrainApiError,
+  toolError,
+  stringify,
+  toolSuccess,
+  registerSecret,
+  redactSecrets,
+  logger,
+  parseErrorBody,
+  MCP_SERVER_VERSION,
+  toolContext,
+  DatabrainClient,
+  CustomChartsApi,
+  slotSchema,
+  optionSchema,
+  scaffoldProject,
+  contentHash,
+  bundleSizeBytes,
+  validateBundle,
+  readProject,
+  validateProject,
+  buildProject,
+  readDist,
+  createCustomChartsApi,
+  apiProblems,
+  planUpload
+};
+//# sourceMappingURL=chunk-OCBTNAAO.js.map