@databrainhq/mcp-server 0.3.0-rc.12 → 0.3.0-rc.14

package/dist/{main-IUV24DMP.js → main-QCBVJSSR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   registerChartApps
-} from "./chunk-ZTHGF27R.js";
+} from "./chunk-NIC5MAGC.js";
 import {
   PREVIEW_PATH,
   WRITE_CREATE,
@@ -9,7 +9,7 @@ import {
   registerAllPrompts,
   registerAllResources,
   registerAllTools
-} from "./chunk-OLOC2MTA.js";
+} from "./chunk-UYFFFAYV.js";
 import {
   DatabrainApiError,
   DatabrainClient,
@@ -20,15 +20,15 @@ import {
   toolContext,
   toolError,
   toolSuccess
-} from "./chunk-347U6GXR.js";
-import "./chunk-Q5EYDKSA.js";
+} from "./chunk-AWICHHDU.js";
+import "./chunk-2F7V6RZR.js";
 import {
   FilePatStore,
   HOSTED_SCOPES,
   HostedAuthError,
   createBearerVerifier,
   principalSchema
-} from "./chunk-Z3ZHN4UW.js";
+} from "./chunk-CEGHG5U3.js";
 
 // src/hosted/main.ts
 import { isAbsolute } from "path";
@@ -37,16 +37,21 @@ import { pathToFileURL } from "url";
 // src/hosted/config.ts
 function loadHostedConfig(env = process.env) {
   const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === "1";
-  if (testOnly && env.NODE_ENV === "production") throw new Error("Hosted test mode is forbidden in production.");
-  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly) throw new Error("Invalid DATABRAIN_HOSTED_TEST_ONLY.");
+  if (testOnly && env.NODE_ENV === "production")
+    throw new Error("Hosted test mode is forbidden in production.");
+  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly)
+    throw new Error("Invalid DATABRAIN_HOSTED_TEST_ONLY.");
   const validUrl = (value, field) => {
     try {
       if (!value) throw new Error();
       const url = new URL(value);
-      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:") throw new Error();
+      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:")
+        throw new Error();
       return url;
     } catch {
-      throw new Error(`Configure ${field} as an HTTPS URL without credentials, query or fragment.`);
+      throw new Error(
+        `Configure ${field} as an HTTPS URL without credentials, query or fragment.`
+      );
     }
   };
   let publicValue = env.DATABRAIN_HOSTED_PUBLIC_URL;
@@ -58,13 +63,31 @@ function loadHostedConfig(env = process.env) {
   }
   const publicUrl = validUrl(publicValue, "DATABRAIN_HOSTED_PUBLIC_URL");
   validUrl(issuerValue, "DATABRAIN_HOSTED_ISSUER");
-  if (publicUrl.pathname !== "/mcp") throw new Error("DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.");
+  if (publicUrl.pathname !== "/mcp")
+    throw new Error("DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.");
   const port = Number(env.DATABRAIN_HOSTED_PORT || "3144");
   const bind = env.DATABRAIN_HOSTED_BIND || "127.0.0.1";
-  if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("Invalid DATABRAIN_HOSTED_PORT.");
+  if (!Number.isInteger(port) || port < 1024 || port > 65535)
+    throw new Error("Invalid DATABRAIN_HOSTED_PORT.");
+  let apiUrl;
+  if (env.DATABRAIN_HOSTED_API_URL) {
+    let url;
+    try {
+      url = new URL(env.DATABRAIN_HOSTED_API_URL);
+    } catch {
+      url = void 0;
+    }
+    if (!url || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+      throw new Error(
+        "Configure DATABRAIN_HOSTED_API_URL as an origin without credentials, path, query or fragment."
+      );
+    }
+    apiUrl = url.origin;
+  }
   return {
     publicUrl: publicValue,
     issuer: issuerValue,
+    ...apiUrl ? { apiUrl } : {},
     port,
     bind,
     testOnly
@@ -72,64 +95,11 @@ function loadHostedConfig(env = process.env) {
 }
 
 // src/hosted/http.ts
-import { createServer } from "http";
+import {
+  createServer
+} from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
-// src/hosted/server.ts
-import { AsyncLocalStorage } from "async_hooks";
-import { z as z2 } from "zod";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { instrument } from "@posthog/mcp";
-import { PostHog } from "posthog-node";
-
-// src/tools/infrastructure/create-workspace.ts
-import { z } from "zod";
-function registerCreateWorkspace(server, client) {
-  server.tool(
-    "create_workspace",
-    'Create a new workspace to connect a datasource or datamart for dashboard building. Works only when this sign-in granted "All workspaces I can access" and your role may create workspaces; the new workspace is usable on the next call.',
-    {
-      name: z.string().describe("Unique workspace name"),
-      connectionType: z.enum(["DATASOURCE", "DATAMART", "MULTI_DATASOURCE"]).optional().describe("Connection type \u2014 DATASOURCE, DATAMART, or MULTI_DATASOURCE"),
-      datasourceName: z.string().optional().describe("Datasource name (required when connectionType is DATASOURCE)"),
-      datamartName: z.string().optional().describe("Datamart name (required when connectionType is DATAMART)"),
-      body: z.record(z.unknown()).optional().describe("Raw API body passthrough for POST /api/v2/workspace")
-    },
-    WRITE_CREATE,
-    async (params) => {
-      try {
-        const body = params.body ? { ...params.body } : {
-          name: params.name,
-          connectionType: params.connectionType,
-          datasourceName: params.datasourceName,
-          datamartName: params.datamartName
-        };
-        const result = await client.request({
-          method: "POST",
-          path: "/api/v2/workspace",
-          body,
-          auth: "service",
-          invalidateCache: ["list_workspaces"]
-        });
-        if (result.error) {
-          return toolError(`Workspace creation failed: ${stringify(result.error)}`);
-        }
-        return toolSuccess(
-          `Workspace "${result.name || params.name}" created successfully.
-
-Next steps:
-1. Use \`create_data_app\` to create a data app linked to this workspace
-2. Build dashboards in the Databrain UI using this workspace
-3. Use \`create_embed\` to embed dashboards`
-        );
-      } catch (err) {
-        if (err instanceof DatabrainApiError) return err.toToolResponse();
-        return toolError(`Unexpected error: ${err.message}`);
-      }
-    }
-  );
-}
-
 // src/hosted/authorization.ts
 var TOOL_SCOPES = {
   whoami: [],
@@ -158,7 +128,11 @@ var TOOL_SCOPES = {
   create_dashboard: ["mcp:dashboards:write"],
   get_dashboard: ["mcp:dashboards:read"],
   dashboard_snapshot: ["mcp:dashboards:read"],
-  generate_dashboard_tiles: ["mcp:dashboards:write", "mcp:query", "mcp:embeds:write"],
+  generate_dashboard_tiles: [
+    "mcp:dashboards:write",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
   ask_question: ["mcp:query"],
   get_semantic_layer: ["mcp:datamarts:read"],
   update_semantic_layer: ["mcp:datamarts:write"],
@@ -170,8 +144,16 @@ var TOOL_SCOPES = {
   apply_semantic_change: ["mcp:datamarts:write"],
   eval_semantic_model: ["mcp:datamarts:read", "mcp:query"],
   list_widgets: ["mcp:dashboards:read"],
-  validate_metric_spec: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"],
-  create_or_update_metric_from_query: ["mcp:dashboards:write", "mcp:query", "mcp:embeds:write"],
+  validate_metric_spec: [
+    "mcp:dashboards:read",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
+  create_or_update_metric_from_query: [
+    "mcp:dashboards:write",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
   create_workspace_metric: ["mcp:dashboards:write", "mcp:query"],
   add_widget: ["mcp:dashboards:write", "mcp:embeds:write"],
   update_widget: ["mcp:dashboards:write", "mcp:embeds:write"],
@@ -199,12 +181,15 @@ var TOOL_SCOPES = {
   change_date_range: ["mcp:dashboards:read", "mcp:query"]
 };
 function requiredScopes(name) {
-  if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, "tool_not_authorized");
+  if (!Object.hasOwn(TOOL_SCOPES, name))
+    throw new HostedAuthError(403, "tool_not_authorized");
   return TOOL_SCOPES[name];
 }
 function authorizeTool(name, principal) {
-  if (principal.expiresAt !== void 0 && principal.expiresAt <= Date.now() / 1e3) throw new HostedAuthError(401, "invalid_token");
-  if (requiredScopes(name).some((scope) => !principal.scopes.includes(scope))) throw new HostedAuthError(403, "insufficient_scope");
+  if (principal.expiresAt !== void 0 && principal.expiresAt <= Date.now() / 1e3)
+    throw new HostedAuthError(401, "invalid_token");
+  if (requiredScopes(name).some((scope) => !principal.scopes.includes(scope)))
+    throw new HostedAuthError(403, "insufficient_scope");
 }
 var TOOL_ARGUMENT_VALUES = {
   list_dashboards: { scope: ["auto", "data_app", "global"] }
@@ -228,7 +213,8 @@ function assertToolArguments(name, value, principal, delegated = false) {
       rest[key] = child;
       continue;
     }
-    if (typeof child !== "string" || !allowed[key].includes(child)) throw new HostedAuthError(403, "identity_argument_forbidden");
+    if (typeof child !== "string" || !allowed[key].includes(child))
+      throw new HostedAuthError(403, "identity_argument_forbidden");
   }
   assertBoundArguments(rest, principal, { target, delegated, opaque });
   return target;
@@ -247,7 +233,9 @@ var WORKSPACE_FREE_TOOLS = /* @__PURE__ */ new Set([
   "list_custom_charts",
   "publish_custom_chart"
 ]);
-var WORKSPACE_SPANNING_TOOLS = /* @__PURE__ */ new Set(["list_dashboards"]);
+var WORKSPACE_SPANNING_TOOLS = /* @__PURE__ */ new Set([
+  "list_dashboards"
+]);
 var WORKSPACE_INPUT = "workspace";
 var WorkspaceSelectionError = class extends HostedAuthError {
   constructor(status, code, reason) {
@@ -260,7 +248,9 @@ function grantedWorkspaces(principal) {
   return principal.workspaceId ? [{ id: principal.workspaceId, name: principal.workspaceName }] : [];
 }
 function grantedNames(principal) {
-  const names = grantedWorkspaces(principal).map((item) => item.name ?? item.id);
+  const names = grantedWorkspaces(principal).map(
+    (item) => item.name ?? item.id
+  );
   return names.length > 20 ? `${names.slice(0, 20).join(", ")} and ${names.length - 20} more` : names.join(", ");
 }
 function findGranted(principal, key, value) {
@@ -297,7 +287,9 @@ function selectWorkspace(args, principal, keys = [WORKSPACE_INPUT, "workspaceNam
 }
 function namesWorkspace(value) {
   if (!value || typeof value !== "object") return false;
-  return Object.entries(value).some(([key, child]) => [WORKSPACE_INPUT, "workspaceName", "workspaceId"].includes(key) && child !== void 0 || namesWorkspace(child));
+  return Object.entries(value).some(
+    ([key, child]) => [WORKSPACE_INPUT, "workspaceName", "workspaceId"].includes(key) && child !== void 0 || namesWorkspace(child)
+  );
 }
 function tenantAllowed(child, principal, delegated) {
   if (typeof child !== "string") return false;
@@ -343,18 +335,85 @@ function assertBoundArguments(value, principal, binding = {}) {
 }
 
 // src/hosted/server.ts
-var schemaInstrumentation = new PostHog("hosted-contract-only", { disabled: true });
+import { AsyncLocalStorage } from "async_hooks";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { instrument } from "@posthog/mcp";
+import { PostHog } from "posthog-node";
+import { z as z2 } from "zod";
+
+// src/tools/infrastructure/create-workspace.ts
+import { z } from "zod";
+function registerCreateWorkspace(server, client) {
+  server.tool(
+    "create_workspace",
+    'Create a new workspace to connect a datasource or datamart for dashboard building. Works only when this sign-in granted "All workspaces I can access" and your role may create workspaces; the new workspace is usable on the next call.',
+    {
+      name: z.string().describe("Unique workspace name"),
+      connectionType: z.enum(["DATASOURCE", "DATAMART", "MULTI_DATASOURCE"]).optional().describe(
+        "Connection type \u2014 DATASOURCE, DATAMART, or MULTI_DATASOURCE"
+      ),
+      datasourceName: z.string().optional().describe(
+        "Datasource name (required when connectionType is DATASOURCE)"
+      ),
+      datamartName: z.string().optional().describe("Datamart name (required when connectionType is DATAMART)"),
+      body: z.record(z.string(), z.unknown()).optional().describe("Raw API body passthrough for POST /api/v2/workspace")
+    },
+    WRITE_CREATE,
+    async (params) => {
+      try {
+        const body = params.body ? { ...params.body } : {
+          name: params.name,
+          connectionType: params.connectionType,
+          datasourceName: params.datasourceName,
+          datamartName: params.datamartName
+        };
+        const result = await client.request({
+          method: "POST",
+          path: "/api/v2/workspace",
+          body,
+          auth: "service",
+          invalidateCache: ["list_workspaces"]
+        });
+        if (result.error) {
+          return toolError(
+            `Workspace creation failed: ${stringify(result.error)}`
+          );
+        }
+        return toolSuccess(
+          `Workspace "${result.name || params.name}" created successfully.
+
+Next steps:
+1. Use \`create_data_app\` to create a data app linked to this workspace
+2. Build dashboards in the Databrain UI using this workspace
+3. Use \`create_embed\` to embed dashboards`
+        );
+      } catch (err) {
+        if (err instanceof DatabrainApiError) return err.toToolResponse();
+        return toolError(`Unexpected error: ${err.message}`);
+      }
+    }
+  );
+}
+
+// src/hosted/server.ts
+var schemaInstrumentation = new PostHog("hosted-contract-only", {
+  disabled: true
+});
 var callWorkspace = new AsyncLocalStorage();
 var WORKSPACE_HINT = "Call whoami to see the workspaces this sign-in granted, then name one.";
 function workspaceError(error) {
-  return toolError(`Error: ${error.reason} (${error.code})
+  return toolError(
+    `Error: ${error.reason} (${error.code})
 
-Hint: ${WORKSPACE_HINT}`);
+Hint: ${WORKSPACE_HINT}`
+  );
 }
 function scopeError(missing) {
-  return toolError(`Error: This connection cannot do this. It needs ${missing.join(", ")}, which your role did not allow when you connected. (INSUFFICIENT_SCOPE)
+  return toolError(
+    `Error: This connection cannot do this. It needs ${missing.join(", ")}, which your role did not allow when you connected. (INSUFFICIENT_SCOPE)
 
-Hint: Ask a Databrain admin for a role that allows it, then connect again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.`);
+Hint: Ask a Databrain admin for a role that allows it, then connect again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.`
+  );
 }
 function onlyWorkspace(raw, target) {
   const keep = (items) => Array.isArray(items) ? items.filter((item) => {
@@ -362,12 +421,16 @@ function onlyWorkspace(raw, target) {
     return record.id === target.id || record._id === target.id || record.id === void 0 && record._id === void 0 && target.name !== void 0 && record.name === target.name;
   }) : items;
   if (Array.isArray(raw)) return keep(raw);
-  if (raw && typeof raw === "object" && "data" in raw) return { ...raw, data: keep(raw.data) };
+  if (raw && typeof raw === "object" && "data" in raw)
+    return { ...raw, data: keep(raw.data) };
   return raw;
 }
 var HostedClient = class extends DatabrainClient {
   constructor(adapter, principal, delegation) {
-    super({ apiUrl: "https://api.usedatabrain.com", demoDomain: "https://demo.usedatabrain.com" });
+    super({
+      apiUrl: "https://api.usedatabrain.com",
+      demoDomain: "https://demo.usedatabrain.com"
+    });
     this.adapter = adapter;
     this.principal = principal;
     this.delegation = delegation;
@@ -384,23 +447,46 @@ var HostedClient = class extends DatabrainClient {
       if (!name) throw new HostedAuthError(403, "tool_not_authorized");
       authorizeTool(name, this.principal);
       const named = callWorkspace.getStore()?.target;
-      const target = named ?? (selectWorkspace(options.body, this.principal, ["workspaceName", "workspaceId"]) ?? selectWorkspace(options.query, this.principal, ["workspaceName", "workspaceId"]));
+      const target = named ?? selectWorkspace(options.body, this.principal, [
+        "workspaceName",
+        "workspaceId"
+      ]) ?? selectWorkspace(options.query, this.principal, [
+        "workspaceName",
+        "workspaceId"
+      ]);
       const delegated = this.delegation !== void 0;
-      const opaque = options.method === "POST" && options.path === PREVIEW_PATH ? ["rows"] : options.method === "POST" && /^\/api\/v2\/custom-charts\/[a-z][a-z0-9_-]*\/bryn\/turn$/.test(options.path) ? ["draft"] : void 0;
-      assertBoundArguments(options.body, this.principal, { target, delegated, opaque });
-      assertBoundArguments(options.query, this.principal, { target, delegated });
+      const opaque = options.method === "POST" && options.path === PREVIEW_PATH ? ["rows"] : options.method === "POST" && /^\/api\/v2\/custom-charts\/[a-z][a-z0-9_-]*\/bryn\/turn$/.test(
+        options.path
+      ) ? ["draft"] : void 0;
+      assertBoundArguments(options.body, this.principal, {
+        target,
+        delegated,
+        opaque
+      });
+      assertBoundArguments(options.query, this.principal, {
+        target,
+        delegated
+      });
       let raw = await this.adapter.executeRequest(
         structuredClone(options),
         structuredClone(this.principal),
         this.delegation,
         target && structuredClone(target)
       );
-      if (named && options.method === "GET" && options.path === "/api/v2/workspace") raw = onlyWorkspace(raw, named);
-      if (!options.skipDataUnwrap && raw && typeof raw === "object" && !Array.isArray(raw) && "data" in raw && raw.data !== null && raw.data !== void 0) return raw.data;
+      if (named && options.method === "GET" && options.path === "/api/v2/workspace")
+        raw = onlyWorkspace(raw, named);
+      if (!options.skipDataUnwrap && raw && typeof raw === "object" && !Array.isArray(raw) && "data" in raw && raw.data !== null && raw.data !== void 0)
+        return raw.data;
       return raw;
     } catch (error) {
       if (error instanceof WorkspaceSelectionError) {
-        throw new DatabrainApiError(error.status, error.code, `${error.reason} (${error.code})`, void 0, WORKSPACE_HINT);
+        throw new DatabrainApiError(
+          error.status,
+          error.code,
+          `${error.reason} (${error.code})`,
+          void 0,
+          WORKSPACE_HINT
+        );
       }
       const status = error instanceof HostedAuthError ? error.status : 503;
       const detail = error instanceof HostedAuthError ? error.detail : void 0;
@@ -442,37 +528,56 @@ function workspaceLine(name, input) {
 }
 function whoami(principal) {
   const granted = grantedWorkspaces(principal);
-  return toolSuccess(JSON.stringify({
-    status: "authenticated",
-    activeBearer: principal.credentialType,
-    actorKind: principal.actorKind,
-    userId: principal.userId,
-    companyId: principal.companyId,
-    workspaceGrant: principal.workspaces?.mode === "all" ? "All workspaces I can access (new ones are included)" : "Only the workspaces chosen at sign-in",
-    grantedWorkspaces: granted.map((item) => ({ id: item.id, name: item.name })),
-    ...granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {},
-    note: granted.length === 1 ? "Every call works in this workspace." : `Name the workspace on each call that works in one (the \`${WORKSPACE_INPUT}\` or \`workspaceName\` input): ${grantedNames(principal)}.`,
-    oauthClientId: principal.clientId,
-    scopes: principal.scopes
-  }, null, 2));
+  return toolSuccess(
+    JSON.stringify(
+      {
+        status: "authenticated",
+        activeBearer: principal.credentialType,
+        actorKind: principal.actorKind,
+        userId: principal.userId,
+        companyId: principal.companyId,
+        workspaceGrant: principal.workspaces?.mode === "all" ? "All workspaces I can access (new ones are included)" : "Only the workspaces chosen at sign-in",
+        grantedWorkspaces: granted.map((item) => ({
+          id: item.id,
+          name: item.name
+        })),
+        ...granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {},
+        note: granted.length === 1 ? "Every call works in this workspace." : `Name the workspace on each call that works in one (the \`${WORKSPACE_INPUT}\` or \`workspaceName\` input): ${grantedNames(principal)}.`,
+        oauthClientId: principal.clientId,
+        scopes: principal.scopes
+      },
+      null,
+      2
+    )
+  );
 }
 function createHostedToolServer(principal, adapter, delegation) {
   const bound = structuredClone(principal);
   const delegated = delegation !== void 0;
-  const server = new McpServer({ name: "databrain", version: MCP_SERVER_VERSION }, {
-    instructions: "Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). Never ask for a service token or put credentials in tool arguments. Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. For existing saved charts, call list_widgets with dashboardId or dashboardName and no clientId; no embed, data app or datamart is needed. Use render_metric_tile to draw a metricRef directly. Use ask_question for new data questions. Chart controls and save_chart_as_dashboard use the same workspace and role; saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer."
-  });
+  const server = new McpServer(
+    { name: "databrain", version: MCP_SERVER_VERSION },
+    {
+      instructions: "Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). Never ask for a service token or put credentials in tool arguments. Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. For existing saved charts, call list_widgets with dashboardId or dashboardName and no clientId; no embed, data app or datamart is needed. Use render_metric_tile to draw a metricRef directly. Use ask_question for new data questions. Chart controls and save_chart_as_dashboard use the same workspace and role; saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer."
+    }
+  );
   const register = server.tool.bind(server);
   server.tool = ((...args) => {
     const name = args[0];
     const index = args.length - 1;
     const handler = args[index];
     const shape = typeof args[1] === "string" && args[2] && typeof args[2] === "object" && !("readOnlyHint" in args[2]) ? args[2] : void 0;
-    const ownSelector = shape && ["workspaceName", "workspaceId"].find((key) => Object.hasOwn(shape, key));
+    const ownSelector = shape && ["workspaceName", "workspaceId"].find(
+      (key) => Object.hasOwn(shape, key)
+    );
     const addsInput = shape !== void 0 && !ownSelector && !WORKSPACE_FREE_TOOLS.has(name) && !Object.hasOwn(shape, WORKSPACE_INPUT);
     if (shape && !WORKSPACE_FREE_TOOLS.has(name)) {
       if (addsInput) {
-        args[2] = { ...shape, [WORKSPACE_INPUT]: z2.string().min(1).max(512).optional().describe(WORKSPACE_SPANNING_TOOLS.has(name) ? "Workspace id or name. Leave it out to cover every granted workspace." : "Workspace id or name. Needed when you granted more than one workspace.") };
+        args[2] = {
+          ...shape,
+          [WORKSPACE_INPUT]: z2.string().min(1).max(512).optional().describe(
+            WORKSPACE_SPANNING_TOOLS.has(name) ? "Workspace id or name. Leave it out to cover every granted workspace." : "Workspace id or name. Needed when you granted more than one workspace."
+          )
+        };
       }
       args[1] = `${args[1]}${workspaceLine(name, addsInput ? WORKSPACE_INPUT : ownSelector)}`;
     }
@@ -482,7 +587,10 @@ function createHostedToolServer(principal, adapter, delegation) {
         const target = assertToolArguments(name, values[0], bound, delegated);
         if (name === "whoami") return whoami(bound);
         const input = values[0] && typeof values[0] === "object" ? values[0] : void 0;
-        if (input?.projectDir !== void 0) return toolError("projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory.");
+        if (input?.projectDir !== void 0)
+          return toolError(
+            "projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory."
+          );
         if (!target && !WORKSPACE_FREE_TOOLS.has(name) && !WORKSPACE_SPANNING_TOOLS.has(name) && !namesWorkspace(input)) {
           throw new WorkspaceSelectionError(
             400,
@@ -493,18 +601,29 @@ function createHostedToolServer(principal, adapter, delegation) {
         if (input) {
           if (addsInput) delete input[WORKSPACE_INPUT];
           if (shape && target) {
-            if (Object.hasOwn(shape, "workspaceId")) input.workspaceId = target.id;
-            if (Object.hasOwn(shape, "workspaceName") && target.name !== void 0) input.workspaceName = target.name;
+            if (Object.hasOwn(shape, "workspaceId"))
+              input.workspaceId = target.id;
+            if (Object.hasOwn(shape, "workspaceName") && target.name !== void 0)
+              input.workspaceName = target.name;
           }
         }
-        const result = await callWorkspace.run({ target }, () => handler(...values));
+        const result = await callWorkspace.run(
+          { target },
+          () => handler(...values)
+        );
         if (target && result?._meta?.["ui/resourceUri"]) {
-          return { ...result, _meta: { ...result._meta, "databrain/workspace": target } };
+          return {
+            ...result,
+            _meta: { ...result._meta, "databrain/workspace": target }
+          };
         }
         return result;
       } catch (error) {
-        if (error instanceof WorkspaceSelectionError) return workspaceError(error);
-        return toolError("Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.");
+        if (error instanceof WorkspaceSelectionError)
+          return workspaceError(error);
+        return toolError(
+          "Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access."
+        );
       }
     };
     return register(...args);
@@ -527,7 +646,10 @@ function healthPath(url) {
   return path === "/health";
 }
 function reply(res, status, body) {
-  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
   res.end(JSON.stringify(body));
 }
 async function readBody(req) {
@@ -565,7 +687,11 @@ function createHostedHttpServer(config, adapter, pats) {
     if (config.testOnly) res.setHeader("X-Databrain-Test-Only", "true");
     try {
       const localPort = server.address()?.port;
-      if (![publicUrl.host, `127.0.0.1:${localPort}`, `localhost:${localPort}`].includes(req.headers.host || "")) {
+      if (![
+        publicUrl.host,
+        `127.0.0.1:${localPort}`,
+        `localhost:${localPort}`
+      ].includes(req.headers.host || "")) {
         reply(res, 403, { error: "invalid_host" });
         return;
       }
@@ -576,10 +702,15 @@ function createHostedHttpServer(config, adapter, pats) {
       if (req.headers.origin) {
         res.setHeader("Access-Control-Allow-Origin", publicUrl.origin);
         res.setHeader("Vary", "Origin");
-        res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, MCP-Protocol-Version");
+        res.setHeader(
+          "Access-Control-Expose-Headers",
+          "WWW-Authenticate, MCP-Protocol-Version"
+        );
       }
       const url = new URL(req.url || "/", publicUrl.origin);
-      if (req.method === "GET" && [metadataPath, "/.well-known/oauth-protected-resource"].includes(url.pathname)) {
+      if (req.method === "GET" && [metadataPath, "/.well-known/oauth-protected-resource"].includes(
+        url.pathname
+      )) {
         reply(res, 200, {
           resource: config.publicUrl,
           authorization_servers: [config.issuer],
@@ -598,15 +729,24 @@ function createHostedHttpServer(config, adapter, pats) {
         return;
       }
       if (req.method === "OPTIONS") {
-        res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id");
+        res.setHeader(
+          "Access-Control-Allow-Methods",
+          "POST, GET, DELETE, OPTIONS"
+        );
+        res.setHeader(
+          "Access-Control-Allow-Headers",
+          "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id"
+        );
         res.writeHead(204);
         res.end();
         return;
       }
-      const authFields = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "authorization");
+      const authFields = req.rawHeaders.filter(
+        (_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "authorization"
+      );
       const match = /^Bearer ([^\s]+)$/i.exec(req.headers.authorization || "");
-      if (authFields.length !== 1 || !match) throw new HostedAuthError(401, "invalid_token");
+      if (authFields.length !== 1 || !match)
+        throw new HostedAuthError(401, "invalid_token");
       const principal = await verify(match[1]);
       if (req.method !== "POST") {
         res.setHeader("Allow", "POST, OPTIONS");
@@ -639,22 +779,40 @@ function createHostedHttpServer(config, adapter, pats) {
         if (body?.method === "tools/call" && typeof body.params?.name === "string") {
           try {
             authorizeTool(body.params.name, principal);
-            assertToolArguments(body.params.name, body.params.arguments, principal, delegation !== void 0);
+            assertToolArguments(
+              body.params.name,
+              body.params.arguments,
+              principal,
+              delegation !== void 0
+            );
           } catch (error) {
             if (error instanceof WorkspaceSelectionError) {
-              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: workspaceError(error) });
+              reply(res, 200, {
+                jsonrpc: "2.0",
+                id: body.id ?? null,
+                result: workspaceError(error)
+              });
               return;
             }
             if (error instanceof HostedAuthError && error.code === "insufficient_scope") {
-              const missing = requiredScopes(body.params.name).filter((scope) => !principal.scopes.includes(scope));
-              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: scopeError(missing) });
+              const missing = requiredScopes(body.params.name).filter(
+                (scope) => !principal.scopes.includes(scope)
+              );
+              reply(res, 200, {
+                jsonrpc: "2.0",
+                id: body.id ?? null,
+                result: scopeError(missing)
+              });
               return;
             }
             throw error;
           }
         }
         const mcp = createHostedToolServer(principal, adapter, delegation);
-        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0, enableJsonResponse: true });
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: void 0,
+          enableJsonResponse: true
+        });
         let closed = false;
         const close = () => {
           if (!closed) {
@@ -678,8 +836,14 @@ function createHostedHttpServer(config, adapter, pats) {
         return;
       }
       const status = error instanceof HostedAuthError ? error.status : 503;
-      if (status === 401) res.setHeader("WWW-Authenticate", `Bearer error="invalid_token", resource_metadata="${metadataUrl}"`);
-      reply(res, status, { error: error instanceof HostedAuthError ? error.code : "temporarily_unavailable" });
+      if (status === 401)
+        res.setHeader(
+          "WWW-Authenticate",
+          `Bearer error="invalid_token", resource_metadata="${metadataUrl}"`
+        );
+      reply(res, status, {
+        error: error instanceof HostedAuthError ? error.code : "temporarily_unavailable"
+      });
     }
   });
   server.requestTimeout = 3e4;
@@ -694,7 +858,12 @@ var USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION} (hosted)`;
 var REQUEST_TIMEOUT_MS = 3e4;
 var FORWARDED_HEADERS = /* @__PURE__ */ new Set(["idempotency-key"]);
 var WORKSPACE_HEADER = "X-Databrain-Workspace";
-var GRANT_DENIALS = /* @__PURE__ */ new Set(["ROLE_NOT_ALLOWED", "WORKSPACE_CREATE_NOT_ALLOWED", "forbidden_permission", "insufficient_scope"]);
+var GRANT_DENIALS = /* @__PURE__ */ new Set([
+  "ROLE_NOT_ALLOWED",
+  "WORKSPACE_CREATE_NOT_ALLOWED",
+  "forbidden_permission",
+  "insufficient_scope"
+]);
 function errorDetail(status, text, bearer) {
   let parsed;
   try {
@@ -734,7 +903,8 @@ function createProviderAdapter(config) {
   if (issuer.protocol !== "https:" || issuer.username || issuer.password || issuer.search || issuer.hash) {
     throw new Error("Invalid hosted authorization server configuration.");
   }
-  const apiBase = config.issuer.replace(/\/$/, "");
+  const apiBase = (config.apiUrl ?? config.issuer).replace(/\/$/, "");
+  const apiOrigin = new URL(apiBase).origin;
   const endpoint = `${apiBase}/oauth/principal`;
   const publicOrigin = new URL(config.publicUrl).origin;
   const bearers = /* @__PURE__ */ new WeakMap();
@@ -743,16 +913,23 @@ function createProviderAdapter(config) {
     async verifyOAuth(token, resource) {
       try {
         const response = await fetch(endpoint, {
-          headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+          headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/json"
+          },
           redirect: "error",
           signal: AbortSignal.timeout(1e4)
         });
         if (!response.ok) {
-          if (response.status === 429 || response.status >= 500) throw new HostedAuthError(503, "temporarily_unavailable");
+          if (response.status === 429 || response.status >= 500)
+            throw new HostedAuthError(503, "temporarily_unavailable");
           throw new HostedAuthError(401, "invalid_token");
         }
-        const { issuer: _issuer, ...principal } = responseSchema.parse(await response.json());
-        if (principal.resource !== resource || principal.credentialType !== "oauth") throw new HostedAuthError(401, "invalid_token");
+        const { issuer: _issuer, ...principal } = responseSchema.parse(
+          await response.json()
+        );
+        if (principal.resource !== resource || principal.credentialType !== "oauth")
+          throw new HostedAuthError(401, "invalid_token");
         return principal;
       } catch (error) {
         if (error instanceof HostedAuthError) throw error;
@@ -763,18 +940,25 @@ function createProviderAdapter(config) {
       throw new HostedAuthError(401, "pat_membership_adapter_required");
     },
     delegate(token) {
-      const handle = Object.freeze({ kind: "hosted-delegation" });
+      const handle = Object.freeze({
+        kind: "hosted-delegation"
+      });
       bearers.set(handle, token);
       return handle;
     },
     async executeRequest(options, principal, delegation, workspace) {
       const bearer = delegation ? bearers.get(delegation) : void 0;
-      if (options.auth !== "none" && !bearer) throw new HostedAuthError(503, "delegated_backend_adapter_required");
-      if (options.auth === "none" && !options.token) throw new HostedAuthError(403, "tool_not_authorized");
-      if (!options.path.startsWith("/") || options.path.startsWith("//")) throw new HostedAuthError(403, "tool_not_authorized");
+      if (options.auth !== "none" && !bearer)
+        throw new HostedAuthError(503, "delegated_backend_adapter_required");
+      if (options.auth === "none" && !options.token)
+        throw new HostedAuthError(403, "tool_not_authorized");
+      if (!options.path.startsWith("/") || options.path.startsWith("//"))
+        throw new HostedAuthError(403, "tool_not_authorized");
       const url = new URL(`${apiBase}${options.path}`);
-      if (url.origin !== issuer.origin) throw new HostedAuthError(403, "tool_not_authorized");
-      for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);
+      if (url.origin !== apiOrigin)
+        throw new HostedAuthError(403, "tool_not_authorized");
+      for (const [key, value] of Object.entries(options.query ?? {}))
+        url.searchParams.set(key, value);
       const headers = {
         Accept: "application/json",
         "Content-Type": "application/json",
@@ -797,7 +981,10 @@ function createProviderAdapter(config) {
       } else {
         headers.Authorization = `Bearer ${bearer}`;
         if (workspace) {
-          if (!principal.grantedWorkspaces?.some((item) => item.id === workspace.id) && principal.workspaceId !== workspace.id) throw new HostedAuthError(403, "principal_mismatch");
+          if (!principal.grantedWorkspaces?.some(
+            (item) => item.id === workspace.id
+          ) && principal.workspaceId !== workspace.id)
+            throw new HostedAuthError(403, "principal_mismatch");
           headers[WORKSPACE_HEADER] = workspace.id;
         }
       }
@@ -815,7 +1002,10 @@ function createProviderAdapter(config) {
           throw new HostedAuthError(
             403,
             "delegated_request_denied",
-            forbidden.code === "insufficient_scope" && options.path === "/api/v2/guest-token/create" ? { ...forbidden, message: "Guest/tenant operations require mcp:embeds:write. Ask an admin for a role that allows it, then connect again." } : forbidden
+            forbidden.code === "insufficient_scope" && options.path === "/api/v2/guest-token/create" ? {
+              ...forbidden,
+              message: "Guest/tenant operations require mcp:embeds:write. Ask an admin for a role that allows it, then connect again."
+            } : forbidden
           );
         }
         const status = response.status === 403 && options.responseFormat === "studio-sse" ? 403 : response.status === 401 ? 401 : response.status >= 500 ? 503 : response.status === 403 || response.status === 404 ? 404 : 400;
@@ -837,33 +1027,51 @@ async function startHosted() {
   let adapter;
   if (config.testOnly) {
     const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;
-    if (!file || !isAbsolute(file)) throw new Error("Hosted test mode requires an absolute fixture store path.");
-    const { createTestOnlyAdapter } = await import("./test-only-K7QTSVO4.js");
+    if (!file || !isAbsolute(file))
+      throw new Error(
+        "Hosted test mode requires an absolute fixture store path."
+      );
+    const { createTestOnlyAdapter } = await import("./test-only-6474NMTR.js");
     adapter = createTestOnlyAdapter(file);
   } else {
     const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;
     if (!file) {
       adapter = createProviderAdapter(config);
-      process.stderr.write("[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\n");
+      process.stderr.write(
+        "[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\n"
+      );
     } else {
-      if (!isAbsolute(file)) throw new Error("DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.");
+      if (!isAbsolute(file))
+        throw new Error(
+          "DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path."
+        );
       try {
         adapter = (await import(pathToFileURL(file).href)).adapter;
       } catch {
         throw new Error("Could not load the trusted hosted adapter.");
       }
     }
-    if (!adapter || ["verifyOAuth", "resolvePatGrant", "executeRequest"].some((key) => typeof adapter[key] !== "function")) throw new Error("Invalid trusted hosted adapter.");
+    if (!adapter || ["verifyOAuth", "resolvePatGrant", "executeRequest"].some(
+      (key) => typeof adapter[key] !== "function"
+    ))
+      throw new Error("Invalid trusted hosted adapter.");
   }
   const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;
-  if (patPath && !isAbsolute(patPath)) throw new Error("Hosted PAT store must be an absolute path.");
-  const server = createHostedHttpServer(config, adapter, patPath ? new FilePatStore(patPath) : void 0);
+  if (patPath && !isAbsolute(patPath))
+    throw new Error("Hosted PAT store must be an absolute path.");
+  const server = createHostedHttpServer(
+    config,
+    adapter,
+    patPath ? new FilePatStore(patPath) : void 0
+  );
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(config.port, config.bind, resolve);
   });
-  process.stderr.write(`[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? " \u2014 TEST ONLY: synthetic identity and data; no OAuth consent" : ""}
-`);
+  process.stderr.write(
+    `[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? " \u2014 TEST ONLY: synthetic identity and data; no OAuth consent" : ""}
+`
+  );
   const shutdown = () => {
     server.close(() => process.exit(0));
     setTimeout(() => {
@@ -877,4 +1085,4 @@ async function startHosted() {
 export {
   startHosted
 };
-//# sourceMappingURL=main-IUV24DMP.js.map
+//# sourceMappingURL=main-QCBVJSSR.js.map