@databrainhq/mcp-server 0.3.0-rc.13 → 0.3.0-rc.15

package/dist/{main-VEKNKWL5.js → main-2FKQQLWX.js}

@@ -1,7 +1,15 @@
 #!/usr/bin/env node
+import {
+  catalogueTurnEntry,
+  isExecutableBrynTool,
+  parseBrynCatalogue,
+  registerBrynTools,
+  registerBrynTurns,
+  registerCatalogueTurns
+} from "./chunk-V5JINLOA.js";
 import {
   registerChartApps
-} from "./chunk-233VGFHY.js";
+} from "./chunk-QQ6KNULX.js";
 import {
   PREVIEW_PATH,
   WRITE_CREATE,
@@ -9,26 +17,33 @@ import {
   registerAllPrompts,
   registerAllResources,
   registerAllTools
-} from "./chunk-PSJVYD4W.js";
+} from "./chunk-6MD7KOAU.js";
 import {
+  BrynCatalogueCache,
   DatabrainApiError,
   DatabrainClient,
   MCP_SERVER_VERSION,
+  RateLimitedError,
+  parseBrynStream,
   parseErrorBody,
+  parseRetryAfter,
   parseStudioStream,
+  readBrynStream,
   stringify,
   toolContext,
   toolError,
   toolSuccess
-} from "./chunk-AEQTEE5C.js";
-import "./chunk-Q5EYDKSA.js";
+} from "./chunk-4E57ZRZO.js";
+import "./chunk-2F7V6RZR.js";
 import {
   FilePatStore,
-  HOSTED_SCOPES,
-  HostedAuthError,
   createBearerVerifier,
   principalSchema
-} from "./chunk-X44C5GW2.js";
+} from "./chunk-MUZ3KEJX.js";
+import {
+  HOSTED_SCOPES,
+  HostedAuthError
+} from "./chunk-3AH56XX7.js";
 
 // src/hosted/main.ts
 import { isAbsolute } from "path";
@@ -37,16 +52,21 @@ import { pathToFileURL } from "url";
 // src/hosted/config.ts
 function loadHostedConfig(env = process.env) {
   const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === "1";
-  if (testOnly && env.NODE_ENV === "production") throw new Error("Hosted test mode is forbidden in production.");
-  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly) throw new Error("Invalid DATABRAIN_HOSTED_TEST_ONLY.");
+  if (testOnly && env.NODE_ENV === "production")
+    throw new Error("Hosted test mode is forbidden in production.");
+  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly)
+    throw new Error("Invalid DATABRAIN_HOSTED_TEST_ONLY.");
   const validUrl = (value, field) => {
     try {
       if (!value) throw new Error();
       const url = new URL(value);
-      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:") throw new Error();
+      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:")
+        throw new Error();
       return url;
     } catch {
-      throw new Error(`Configure ${field} as an HTTPS URL without credentials, query or fragment.`);
+      throw new Error(
+        `Configure ${field} as an HTTPS URL without credentials, query or fragment.`
+      );
     }
   };
   let publicValue = env.DATABRAIN_HOSTED_PUBLIC_URL;
@@ -58,10 +78,12 @@ function loadHostedConfig(env = process.env) {
   }
   const publicUrl = validUrl(publicValue, "DATABRAIN_HOSTED_PUBLIC_URL");
   validUrl(issuerValue, "DATABRAIN_HOSTED_ISSUER");
-  if (publicUrl.pathname !== "/mcp") throw new Error("DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.");
+  if (publicUrl.pathname !== "/mcp")
+    throw new Error("DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.");
   const port = Number(env.DATABRAIN_HOSTED_PORT || "3144");
   const bind = env.DATABRAIN_HOSTED_BIND || "127.0.0.1";
-  if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("Invalid DATABRAIN_HOSTED_PORT.");
+  if (!Number.isInteger(port) || port < 1024 || port > 65535)
+    throw new Error("Invalid DATABRAIN_HOSTED_PORT.");
   let apiUrl;
   if (env.DATABRAIN_HOSTED_API_URL) {
     let url;
@@ -71,7 +93,9 @@ function loadHostedConfig(env = process.env) {
       url = void 0;
     }
     if (!url || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
-      throw new Error("Configure DATABRAIN_HOSTED_API_URL as an origin without credentials, path, query or fragment.");
+      throw new Error(
+        "Configure DATABRAIN_HOSTED_API_URL as an origin without credentials, path, query or fragment."
+      );
     }
     apiUrl = url.origin;
   }
@@ -86,65 +110,17 @@ function loadHostedConfig(env = process.env) {
 }
 
 // src/hosted/http.ts
-import { createServer } from "http";
+import {
+  createServer
+} from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
-// src/hosted/server.ts
-import { AsyncLocalStorage } from "async_hooks";
-import { z as z2 } from "zod";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { instrument } from "@posthog/mcp";
-import { PostHog } from "posthog-node";
-
-// src/tools/infrastructure/create-workspace.ts
-import { z } from "zod";
-function registerCreateWorkspace(server, client) {
-  server.tool(
-    "create_workspace",
-    'Create a new workspace to connect a datasource or datamart for dashboard building. Works only when this sign-in granted "All workspaces I can access" and your role may create workspaces; the new workspace is usable on the next call.',
-    {
-      name: z.string().describe("Unique workspace name"),
-      connectionType: z.enum(["DATASOURCE", "DATAMART", "MULTI_DATASOURCE"]).optional().describe("Connection type \u2014 DATASOURCE, DATAMART, or MULTI_DATASOURCE"),
-      datasourceName: z.string().optional().describe("Datasource name (required when connectionType is DATASOURCE)"),
-      datamartName: z.string().optional().describe("Datamart name (required when connectionType is DATAMART)"),
-      body: z.record(z.unknown()).optional().describe("Raw API body passthrough for POST /api/v2/workspace")
-    },
-    WRITE_CREATE,
-    async (params) => {
-      try {
-        const body = params.body ? { ...params.body } : {
-          name: params.name,
-          connectionType: params.connectionType,
-          datasourceName: params.datasourceName,
-          datamartName: params.datamartName
-        };
-        const result = await client.request({
-          method: "POST",
-          path: "/api/v2/workspace",
-          body,
-          auth: "service",
-          invalidateCache: ["list_workspaces"]
-        });
-        if (result.error) {
-          return toolError(`Workspace creation failed: ${stringify(result.error)}`);
-        }
-        return toolSuccess(
-          `Workspace "${result.name || params.name}" created successfully.
-
-Next steps:
-1. Use \`create_data_app\` to create a data app linked to this workspace
-2. Build dashboards in the Databrain UI using this workspace
-3. Use \`create_embed\` to embed dashboards`
-        );
-      } catch (err) {
-        if (err instanceof DatabrainApiError) return err.toToolResponse();
-        return toolError(`Unexpected error: ${err.message}`);
-      }
-    }
+// src/hosted/authorization.ts
+function brynEntry(name, catalogue) {
+  return catalogue?.tools.find(
+    (entry) => entry.name === name && isExecutableBrynTool(entry)
   );
 }
-
-// src/hosted/authorization.ts
 var TOOL_SCOPES = {
   whoami: [],
   list_datasources: ["mcp:datamarts:read"],
@@ -172,7 +148,11 @@ var TOOL_SCOPES = {
   create_dashboard: ["mcp:dashboards:write"],
   get_dashboard: ["mcp:dashboards:read"],
   dashboard_snapshot: ["mcp:dashboards:read"],
-  generate_dashboard_tiles: ["mcp:dashboards:write", "mcp:query", "mcp:embeds:write"],
+  generate_dashboard_tiles: [
+    "mcp:dashboards:write",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
   ask_question: ["mcp:query"],
   get_semantic_layer: ["mcp:datamarts:read"],
   update_semantic_layer: ["mcp:datamarts:write"],
@@ -184,8 +164,16 @@ var TOOL_SCOPES = {
   apply_semantic_change: ["mcp:datamarts:write"],
   eval_semantic_model: ["mcp:datamarts:read", "mcp:query"],
   list_widgets: ["mcp:dashboards:read"],
-  validate_metric_spec: ["mcp:dashboards:read", "mcp:query", "mcp:embeds:write"],
-  create_or_update_metric_from_query: ["mcp:dashboards:write", "mcp:query", "mcp:embeds:write"],
+  validate_metric_spec: [
+    "mcp:dashboards:read",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
+  create_or_update_metric_from_query: [
+    "mcp:dashboards:write",
+    "mcp:query",
+    "mcp:embeds:write"
+  ],
   create_workspace_metric: ["mcp:dashboards:write", "mcp:query"],
   add_widget: ["mcp:dashboards:write", "mcp:embeds:write"],
   update_widget: ["mcp:dashboards:write", "mcp:embeds:write"],
@@ -212,25 +200,51 @@ var TOOL_SCOPES = {
   drill_down: ["mcp:dashboards:read", "mcp:query"],
   change_date_range: ["mcp:dashboards:read", "mcp:query"]
 };
-function requiredScopes(name) {
-  if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, "tool_not_authorized");
+var BRYN_TURN_SCOPES = {
+  ask_bryn_metric: ["mcp:query"],
+  ask_bryn_semantic_model: ["mcp:datamarts:read", "mcp:datamarts:write"],
+  ask_bryn_theme: ["mcp:embeds:write"],
+  ask_bryn_custom_chart: ["mcp:custom-charts:write"]
+};
+function requiredScopes(name, catalogue) {
+  if ((catalogue?.tools.length || catalogue?.turns.length) && Object.hasOwn(BRYN_TURN_SCOPES, name))
+    return BRYN_TURN_SCOPES[name];
+  const turn = Object.hasOwn(TOOL_SCOPES, name) ? void 0 : catalogueTurnEntry(name, catalogue);
+  if (turn) return turn.requiredScopes;
+  const bryn = brynEntry(name, catalogue);
+  if (bryn) {
+    if (bryn.requiredScopes) return bryn.requiredScopes;
+    if (bryn.surface === "custom-chart-studio")
+      return ["mcp:custom-charts:write"];
+    return bryn.effect === "read" ? ["mcp:dashboards:read"] : ["mcp:embeds:write"];
+  }
+  if (!Object.hasOwn(TOOL_SCOPES, name))
+    throw new HostedAuthError(403, "tool_not_authorized");
   return TOOL_SCOPES[name];
 }
-function authorizeTool(name, principal) {
-  if (principal.expiresAt !== void 0 && principal.expiresAt <= Date.now() / 1e3) throw new HostedAuthError(401, "invalid_token");
-  if (requiredScopes(name).some((scope) => !principal.scopes.includes(scope))) throw new HostedAuthError(403, "insufficient_scope");
+function authorizeTool(name, principal, catalogue) {
+  if (principal.expiresAt !== void 0 && principal.expiresAt <= Date.now() / 1e3)
+    throw new HostedAuthError(401, "invalid_token");
+  if (requiredScopes(name, catalogue).some(
+    (scope) => !principal.scopes.includes(scope)
+  ))
+    throw new HostedAuthError(403, "insufficient_scope");
 }
 var TOOL_ARGUMENT_VALUES = {
   list_dashboards: { scope: ["auto", "data_app", "global"] }
 };
 var TOOL_OPAQUE_ARGUMENTS = {
+  ask_bryn_theme: ["theme", "dark", "schema", "contrast"],
+  ask_bryn_custom_chart: ["draft"],
   preview_chart: ["rows"],
   custom_chart_preview: ["rows", "manifest"],
   custom_chart_edit: ["draft"]
 };
-function assertToolArguments(name, value, principal, delegated = false) {
+function assertToolArguments(name, value, principal, delegated = false, catalogue) {
   const allowed = Object.hasOwn(TOOL_ARGUMENT_VALUES, name) ? TOOL_ARGUMENT_VALUES[name] : {};
-  const opaque = Object.hasOwn(TOOL_OPAQUE_ARGUMENTS, name) ? TOOL_OPAQUE_ARGUMENTS[name] : void 0;
+  const bryn = brynEntry(name, catalogue);
+  const turn = Object.hasOwn(TOOL_SCOPES, name) ? void 0 : catalogueTurnEntry(name, catalogue);
+  const opaque = turn ? turn.opaqueContextFields : bryn ? bryn.opaqueContextFields ? ["input", ...bryn.opaqueContextFields] : ["input", "draft", "theme", "dark", "schema", "contrast", "followUp"] : Object.hasOwn(TOOL_OPAQUE_ARGUMENTS, name) ? TOOL_OPAQUE_ARGUMENTS[name] : void 0;
   const target = selectWorkspace(value, principal);
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     assertBoundArguments(value, principal, { target, delegated });
@@ -242,7 +256,8 @@ function assertToolArguments(name, value, principal, delegated = false) {
       rest[key] = child;
       continue;
     }
-    if (typeof child !== "string" || !allowed[key].includes(child)) throw new HostedAuthError(403, "identity_argument_forbidden");
+    if (typeof child !== "string" || !allowed[key].includes(child))
+      throw new HostedAuthError(403, "identity_argument_forbidden");
   }
   assertBoundArguments(rest, principal, { target, delegated, opaque });
   return target;
@@ -261,7 +276,9 @@ var WORKSPACE_FREE_TOOLS = /* @__PURE__ */ new Set([
   "list_custom_charts",
   "publish_custom_chart"
 ]);
-var WORKSPACE_SPANNING_TOOLS = /* @__PURE__ */ new Set(["list_dashboards"]);
+var WORKSPACE_SPANNING_TOOLS = /* @__PURE__ */ new Set([
+  "list_dashboards"
+]);
 var WORKSPACE_INPUT = "workspace";
 var WorkspaceSelectionError = class extends HostedAuthError {
   constructor(status, code, reason) {
@@ -274,7 +291,9 @@ function grantedWorkspaces(principal) {
   return principal.workspaceId ? [{ id: principal.workspaceId, name: principal.workspaceName }] : [];
 }
 function grantedNames(principal) {
-  const names = grantedWorkspaces(principal).map((item) => item.name ?? item.id);
+  const names = grantedWorkspaces(principal).map(
+    (item) => item.name ?? item.id
+  );
   return names.length > 20 ? `${names.slice(0, 20).join(", ")} and ${names.length - 20} more` : names.join(", ");
 }
 function findGranted(principal, key, value) {
@@ -311,7 +330,9 @@ function selectWorkspace(args, principal, keys = [WORKSPACE_INPUT, "workspaceNam
 }
 function namesWorkspace(value) {
   if (!value || typeof value !== "object") return false;
-  return Object.entries(value).some(([key, child]) => [WORKSPACE_INPUT, "workspaceName", "workspaceId"].includes(key) && child !== void 0 || namesWorkspace(child));
+  return Object.entries(value).some(
+    ([key, child]) => [WORKSPACE_INPUT, "workspaceName", "workspaceId"].includes(key) && child !== void 0 || namesWorkspace(child)
+  );
 }
 function tenantAllowed(child, principal, delegated) {
   if (typeof child !== "string") return false;
@@ -357,18 +378,85 @@ function assertBoundArguments(value, principal, binding = {}) {
 }
 
 // src/hosted/server.ts
-var schemaInstrumentation = new PostHog("hosted-contract-only", { disabled: true });
+import { AsyncLocalStorage } from "async_hooks";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { instrument } from "@posthog/mcp";
+import { PostHog } from "posthog-node";
+import { z as z2 } from "zod";
+
+// src/tools/infrastructure/create-workspace.ts
+import { z } from "zod";
+function registerCreateWorkspace(server, client) {
+  server.tool(
+    "create_workspace",
+    'Create a new workspace to connect a datasource or datamart for dashboard building. Works only when this sign-in granted "All workspaces I can access" and your role may create workspaces; the new workspace is usable on the next call.',
+    {
+      name: z.string().describe("Unique workspace name"),
+      connectionType: z.enum(["DATASOURCE", "DATAMART", "MULTI_DATASOURCE"]).optional().describe(
+        "Connection type \u2014 DATASOURCE, DATAMART, or MULTI_DATASOURCE"
+      ),
+      datasourceName: z.string().optional().describe(
+        "Datasource name (required when connectionType is DATASOURCE)"
+      ),
+      datamartName: z.string().optional().describe("Datamart name (required when connectionType is DATAMART)"),
+      body: z.record(z.string(), z.unknown()).optional().describe("Raw API body passthrough for POST /api/v2/workspace")
+    },
+    WRITE_CREATE,
+    async (params) => {
+      try {
+        const body = params.body ? { ...params.body } : {
+          name: params.name,
+          connectionType: params.connectionType,
+          datasourceName: params.datasourceName,
+          datamartName: params.datamartName
+        };
+        const result = await client.request({
+          method: "POST",
+          path: "/api/v2/workspace",
+          body,
+          auth: "service",
+          invalidateCache: ["list_workspaces"]
+        });
+        if (result.error) {
+          return toolError(
+            `Workspace creation failed: ${stringify(result.error)}`
+          );
+        }
+        return toolSuccess(
+          `Workspace "${result.name || params.name}" created successfully.
+
+Next steps:
+1. Use \`create_data_app\` to create a data app linked to this workspace
+2. Build dashboards in the Databrain UI using this workspace
+3. Use \`create_embed\` to embed dashboards`
+        );
+      } catch (err) {
+        if (err instanceof DatabrainApiError) return err.toToolResponse();
+        return toolError(`Unexpected error: ${err.message}`);
+      }
+    }
+  );
+}
+
+// src/hosted/server.ts
+var schemaInstrumentation = new PostHog("hosted-contract-only", {
+  disabled: true
+});
 var callWorkspace = new AsyncLocalStorage();
 var WORKSPACE_HINT = "Call whoami to see the workspaces this sign-in granted, then name one.";
 function workspaceError(error) {
-  return toolError(`Error: ${error.reason} (${error.code})
+  return toolError(
+    `Error: ${error.reason} (${error.code})
 
-Hint: ${WORKSPACE_HINT}`);
+Hint: ${WORKSPACE_HINT}`
+  );
 }
 function scopeError(missing) {
-  return toolError(`Error: This connection cannot do this. It needs ${missing.join(", ")}, which your role did not allow when you connected. (INSUFFICIENT_SCOPE)
+  return toolError(
+    `Error: This connection cannot do this. It needs ${missing.join(", ")}, which your role did not allow when you connected. (INSUFFICIENT_SCOPE)
 
-Hint: Ask a Databrain admin for a role that allows it, then connect again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.`);
+Hint: Ask a Databrain admin for a role that allows it, then connect again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.`
+  );
 }
 function onlyWorkspace(raw, target) {
   const keep = (items) => Array.isArray(items) ? items.filter((item) => {
@@ -376,15 +464,20 @@ function onlyWorkspace(raw, target) {
     return record.id === target.id || record._id === target.id || record.id === void 0 && record._id === void 0 && target.name !== void 0 && record.name === target.name;
   }) : items;
   if (Array.isArray(raw)) return keep(raw);
-  if (raw && typeof raw === "object" && "data" in raw) return { ...raw, data: keep(raw.data) };
+  if (raw && typeof raw === "object" && "data" in raw)
+    return { ...raw, data: keep(raw.data) };
   return raw;
 }
 var HostedClient = class extends DatabrainClient {
-  constructor(adapter, principal, delegation) {
-    super({ apiUrl: "https://api.usedatabrain.com", demoDomain: "https://demo.usedatabrain.com" });
+  constructor(adapter, principal, delegation, brynCatalogue) {
+    super({
+      apiUrl: "https://api.usedatabrain.com",
+      demoDomain: "https://demo.usedatabrain.com"
+    });
     this.adapter = adapter;
     this.principal = principal;
     this.delegation = delegation;
+    this.brynCatalogue = brynCatalogue;
   }
   // A generated API credential must never replace the authorizing hosted principal.
   setRuntimeApiToken(_token) {
@@ -396,25 +489,58 @@ var HostedClient = class extends DatabrainClient {
     try {
       const name = toolContext.getStore()?.tool;
       if (!name) throw new HostedAuthError(403, "tool_not_authorized");
-      authorizeTool(name, this.principal);
+      authorizeTool(name, this.principal, this.brynCatalogue);
       const named = callWorkspace.getStore()?.target;
-      const target = named ?? (selectWorkspace(options.body, this.principal, ["workspaceName", "workspaceId"]) ?? selectWorkspace(options.query, this.principal, ["workspaceName", "workspaceId"]));
+      const target = named ?? selectWorkspace(options.body, this.principal, [
+        "workspaceName",
+        "workspaceId"
+      ]) ?? selectWorkspace(options.query, this.principal, [
+        "workspaceName",
+        "workspaceId"
+      ]);
       const delegated = this.delegation !== void 0;
-      const opaque = options.method === "POST" && options.path === PREVIEW_PATH ? ["rows"] : options.method === "POST" && /^\/api\/v2\/custom-charts\/[a-z][a-z0-9_-]*\/bryn\/turn$/.test(options.path) ? ["draft"] : void 0;
-      assertBoundArguments(options.body, this.principal, { target, delegated, opaque });
-      assertBoundArguments(options.query, this.principal, { target, delegated });
+      const opaque = options.method === "POST" && options.path === PREVIEW_PATH ? ["rows"] : options.method === "POST" && /^\/api\/v2\/custom-charts\/[a-z][a-z0-9_-]*\/bryn\/turn$/.test(
+        options.path
+      ) ? ["draft"] : options.method === "POST" && options.path === "/api/v2/theme-bryn/turn" ? ["theme", "dark", "schema", "contrast"] : options.method === "POST" && /^\/api\/mcp\/bryn\/tools\/[a-z][a-z0-9_]*$/.test(
+        options.path
+      ) ? [
+        "input",
+        "draft",
+        "theme",
+        "dark",
+        "schema",
+        "contrast",
+        "followUp"
+      ] : void 0;
+      assertBoundArguments(options.body, this.principal, {
+        target,
+        delegated,
+        opaque
+      });
+      assertBoundArguments(options.query, this.principal, {
+        target,
+        delegated
+      });
       let raw = await this.adapter.executeRequest(
         structuredClone(options),
         structuredClone(this.principal),
         this.delegation,
         target && structuredClone(target)
       );
-      if (named && options.method === "GET" && options.path === "/api/v2/workspace") raw = onlyWorkspace(raw, named);
-      if (!options.skipDataUnwrap && raw && typeof raw === "object" && !Array.isArray(raw) && "data" in raw && raw.data !== null && raw.data !== void 0) return raw.data;
+      if (named && options.method === "GET" && options.path === "/api/v2/workspace")
+        raw = onlyWorkspace(raw, named);
+      if (!options.skipDataUnwrap && raw && typeof raw === "object" && !Array.isArray(raw) && "data" in raw && raw.data !== null && raw.data !== void 0)
+        return raw.data;
       return raw;
     } catch (error) {
       if (error instanceof WorkspaceSelectionError) {
-        throw new DatabrainApiError(error.status, error.code, `${error.reason} (${error.code})`, void 0, WORKSPACE_HINT);
+        throw new DatabrainApiError(
+          error.status,
+          error.code,
+          `${error.reason} (${error.code})`,
+          void 0,
+          WORKSPACE_HINT
+        );
       }
       const status = error instanceof HostedAuthError ? error.status : 503;
       const detail = error instanceof HostedAuthError ? error.detail : void 0;
@@ -456,47 +582,75 @@ function workspaceLine(name, input) {
 }
 function whoami(principal) {
   const granted = grantedWorkspaces(principal);
-  return toolSuccess(JSON.stringify({
-    status: "authenticated",
-    activeBearer: principal.credentialType,
-    actorKind: principal.actorKind,
-    userId: principal.userId,
-    companyId: principal.companyId,
-    workspaceGrant: principal.workspaces?.mode === "all" ? "All workspaces I can access (new ones are included)" : "Only the workspaces chosen at sign-in",
-    grantedWorkspaces: granted.map((item) => ({ id: item.id, name: item.name })),
-    ...granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {},
-    note: granted.length === 1 ? "Every call works in this workspace." : `Name the workspace on each call that works in one (the \`${WORKSPACE_INPUT}\` or \`workspaceName\` input): ${grantedNames(principal)}.`,
-    oauthClientId: principal.clientId,
-    scopes: principal.scopes
-  }, null, 2));
+  return toolSuccess(
+    JSON.stringify(
+      {
+        status: "authenticated",
+        activeBearer: principal.credentialType,
+        actorKind: principal.actorKind,
+        userId: principal.userId,
+        companyId: principal.companyId,
+        workspaceGrant: principal.workspaces?.mode === "all" ? "All workspaces I can access (new ones are included)" : "Only the workspaces chosen at sign-in",
+        grantedWorkspaces: granted.map((item) => ({
+          id: item.id,
+          name: item.name
+        })),
+        ...granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {},
+        note: granted.length === 1 ? "Every call works in this workspace." : `Name the workspace on each call that works in one (the \`${WORKSPACE_INPUT}\` or \`workspaceName\` input): ${grantedNames(principal)}.`,
+        oauthClientId: principal.clientId,
+        scopes: principal.scopes
+      },
+      null,
+      2
+    )
+  );
 }
-function createHostedToolServer(principal, adapter, delegation) {
+function createHostedToolServer(principal, adapter, delegation, brynCatalogue) {
   const bound = structuredClone(principal);
   const delegated = delegation !== void 0;
-  const server = new McpServer({ name: "databrain", version: MCP_SERVER_VERSION }, {
-    instructions: "Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). Never ask for a service token or put credentials in tool arguments. Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. For existing saved charts, call list_widgets with dashboardId or dashboardName and no clientId; no embed, data app or datamart is needed. Use render_metric_tile to draw a metricRef directly. Use ask_question for new data questions. Chart controls and save_chart_as_dashboard use the same workspace and role; saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer."
-  });
+  const server = new McpServer(
+    { name: "databrain", version: MCP_SERVER_VERSION },
+    {
+      instructions: "Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). Never ask for a service token or put credentials in tool arguments. Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. For existing saved charts, call list_widgets with dashboardId or dashboardName and no clientId; no embed, data app or datamart is needed. Use render_metric_tile to draw a metricRef directly. Use ask_question for new data questions. Chart controls and save_chart_as_dashboard use the same workspace and role; saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer."
+    }
+  );
   const register = server.tool.bind(server);
   server.tool = ((...args) => {
     const name = args[0];
     const index = args.length - 1;
     const handler = args[index];
     const shape = typeof args[1] === "string" && args[2] && typeof args[2] === "object" && !("readOnlyHint" in args[2]) ? args[2] : void 0;
-    const ownSelector = shape && ["workspaceName", "workspaceId"].find((key) => Object.hasOwn(shape, key));
+    const ownSelector = shape && ["workspaceName", "workspaceId"].find(
+      (key) => Object.hasOwn(shape, key)
+    );
     const addsInput = shape !== void 0 && !ownSelector && !WORKSPACE_FREE_TOOLS.has(name) && !Object.hasOwn(shape, WORKSPACE_INPUT);
     if (shape && !WORKSPACE_FREE_TOOLS.has(name)) {
       if (addsInput) {
-        args[2] = { ...shape, [WORKSPACE_INPUT]: z2.string().min(1).max(512).optional().describe(WORKSPACE_SPANNING_TOOLS.has(name) ? "Workspace id or name. Leave it out to cover every granted workspace." : "Workspace id or name. Needed when you granted more than one workspace.") };
+        args[2] = {
+          ...shape,
+          [WORKSPACE_INPUT]: z2.string().min(1).max(512).optional().describe(
+            WORKSPACE_SPANNING_TOOLS.has(name) ? "Workspace id or name. Leave it out to cover every granted workspace." : "Workspace id or name. Needed when you granted more than one workspace."
+          )
+        };
       }
       args[1] = `${args[1]}${workspaceLine(name, addsInput ? WORKSPACE_INPUT : ownSelector)}`;
     }
     args[index] = async (...values) => {
       try {
-        authorizeTool(name, bound);
-        const target = assertToolArguments(name, values[0], bound, delegated);
+        authorizeTool(name, bound, brynCatalogue);
+        const target = assertToolArguments(
+          name,
+          values[0],
+          bound,
+          delegated,
+          brynCatalogue
+        );
         if (name === "whoami") return whoami(bound);
         const input = values[0] && typeof values[0] === "object" ? values[0] : void 0;
-        if (input?.projectDir !== void 0) return toolError("projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory.");
+        if (input?.projectDir !== void 0)
+          return toolError(
+            "projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory."
+          );
         if (!target && !WORKSPACE_FREE_TOOLS.has(name) && !WORKSPACE_SPANNING_TOOLS.has(name) && !namesWorkspace(input)) {
           throw new WorkspaceSelectionError(
             400,
@@ -507,25 +661,41 @@ function createHostedToolServer(principal, adapter, delegation) {
         if (input) {
           if (addsInput) delete input[WORKSPACE_INPUT];
           if (shape && target) {
-            if (Object.hasOwn(shape, "workspaceId")) input.workspaceId = target.id;
-            if (Object.hasOwn(shape, "workspaceName") && target.name !== void 0) input.workspaceName = target.name;
+            if (Object.hasOwn(shape, "workspaceId"))
+              input.workspaceId = target.id;
+            if (Object.hasOwn(shape, "workspaceName") && target.name !== void 0)
+              input.workspaceName = target.name;
           }
         }
-        const result = await callWorkspace.run({ target }, () => handler(...values));
+        const result = await callWorkspace.run(
+          { target },
+          () => handler(...values)
+        );
         if (target && result?._meta?.["ui/resourceUri"]) {
-          return { ...result, _meta: { ...result._meta, "databrain/workspace": target } };
+          return {
+            ...result,
+            _meta: { ...result._meta, "databrain/workspace": target }
+          };
         }
         return result;
       } catch (error) {
-        if (error instanceof WorkspaceSelectionError) return workspaceError(error);
-        return toolError("Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.");
+        if (error instanceof WorkspaceSelectionError)
+          return workspaceError(error);
+        return toolError(
+          "Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access."
+        );
       }
     };
     return register(...args);
   });
-  const client = new HostedClient(adapter, bound, delegation);
+  const client = new HostedClient(adapter, bound, delegation, brynCatalogue);
   enableChartApps(server);
   registerAllTools(server, client);
+  if (brynCatalogue?.tools.length || brynCatalogue?.turns.length) {
+    registerBrynTools(server, client, brynCatalogue);
+    registerBrynTurns(server, client);
+    registerCatalogueTurns(server, client, brynCatalogue);
+  }
   registerCreateWorkspace(server, client);
   registerAllResources(server);
   registerAllPrompts(server);
@@ -536,12 +706,16 @@ function createHostedToolServer(principal, adapter, delegation) {
 
 // src/hosted/http.ts
 var HEALTH_BODY = JSON.stringify({ status: "ok" });
+var MAX_MCP_BODY_BYTES = 4 * 1024 * 1024 + 64 * 1024;
 function healthPath(url) {
   const path = (url || "/").split("?")[0];
   return path === "/health";
 }
 function reply(res, status, body) {
-  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
   res.end(JSON.stringify(body));
 }
 async function readBody(req) {
@@ -549,7 +723,7 @@ async function readBody(req) {
   const chunks = [];
   for await (const chunk of req) {
     size += chunk.length;
-    if (size > 1048576) throw new Error("body_too_large");
+    if (size > MAX_MCP_BODY_BYTES) throw new Error("body_too_large");
     chunks.push(Buffer.from(chunk));
   }
   return JSON.parse(Buffer.concat(chunks).toString("utf8"));
@@ -560,6 +734,7 @@ function createHostedHttpServer(config, adapter, pats) {
   const metadataUrl = `${publicUrl.origin}${metadataPath}`;
   const verify = createBearerVerifier(adapter, config.publicUrl, pats);
   let active = 0;
+  const catalogueCache = new BrynCatalogueCache();
   const server = createServer(async (req, res) => {
     if (healthPath(req.url)) {
       if (req.method !== "GET" && req.method !== "HEAD") {
@@ -579,7 +754,11 @@ function createHostedHttpServer(config, adapter, pats) {
     if (config.testOnly) res.setHeader("X-Databrain-Test-Only", "true");
     try {
       const localPort = server.address()?.port;
-      if (![publicUrl.host, `127.0.0.1:${localPort}`, `localhost:${localPort}`].includes(req.headers.host || "")) {
+      if (![
+        publicUrl.host,
+        `127.0.0.1:${localPort}`,
+        `localhost:${localPort}`
+      ].includes(req.headers.host || "")) {
         reply(res, 403, { error: "invalid_host" });
         return;
       }
@@ -590,10 +769,15 @@ function createHostedHttpServer(config, adapter, pats) {
       if (req.headers.origin) {
         res.setHeader("Access-Control-Allow-Origin", publicUrl.origin);
         res.setHeader("Vary", "Origin");
-        res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate, MCP-Protocol-Version");
+        res.setHeader(
+          "Access-Control-Expose-Headers",
+          "WWW-Authenticate, MCP-Protocol-Version"
+        );
       }
       const url = new URL(req.url || "/", publicUrl.origin);
-      if (req.method === "GET" && [metadataPath, "/.well-known/oauth-protected-resource"].includes(url.pathname)) {
+      if (req.method === "GET" && [metadataPath, "/.well-known/oauth-protected-resource"].includes(
+        url.pathname
+      )) {
         reply(res, 200, {
           resource: config.publicUrl,
           authorization_servers: [config.issuer],
@@ -612,15 +796,24 @@ function createHostedHttpServer(config, adapter, pats) {
         return;
       }
       if (req.method === "OPTIONS") {
-        res.setHeader("Access-Control-Allow-Methods", "POST, GET, DELETE, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id");
+        res.setHeader(
+          "Access-Control-Allow-Methods",
+          "POST, GET, DELETE, OPTIONS"
+        );
+        res.setHeader(
+          "Access-Control-Allow-Headers",
+          "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id"
+        );
         res.writeHead(204);
         res.end();
         return;
       }
-      const authFields = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "authorization");
+      const authFields = req.rawHeaders.filter(
+        (_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === "authorization"
+      );
       const match = /^Bearer ([^\s]+)$/i.exec(req.headers.authorization || "");
-      if (authFields.length !== 1 || !match) throw new HostedAuthError(401, "invalid_token");
+      if (authFields.length !== 1 || !match)
+        throw new HostedAuthError(401, "invalid_token");
       const principal = await verify(match[1]);
       if (req.method !== "POST") {
         res.setHeader("Allow", "POST, OPTIONS");
@@ -650,25 +843,87 @@ function createHostedHttpServer(config, adapter, pats) {
           return;
         }
         const delegation = match[1].startsWith("dbp_") ? void 0 : adapter.delegate?.(match[1], principal);
+        let brynCatalogue = { tools: [], turns: [] };
+        let catalogueRetryAfter;
+        if (adapter.getBrynCatalogue) {
+          const read = await catalogueCache.get(
+            `${principal.companyId}:${principal.userId}:${principal.credentialType}`,
+            async () => {
+              let raw;
+              try {
+                raw = await adapter.getBrynCatalogue(principal, delegation);
+              } catch (error) {
+                if (error instanceof HostedAuthError) {
+                  if (error.detail?.status === 429)
+                    throw new RateLimitedError(error.retryAfterMs);
+                  if (error.status === 404) return { tools: [], turns: [] };
+                }
+                throw error;
+              }
+              try {
+                return parseBrynCatalogue(raw);
+              } catch {
+                return { tools: [], turns: [] };
+              }
+            }
+          );
+          brynCatalogue = read.catalogue;
+          if (read.degraded) catalogueRetryAfter = read.retryAfterSeconds;
+        }
         if (body?.method === "tools/call" && typeof body.params?.name === "string") {
           try {
-            authorizeTool(body.params.name, principal);
-            assertToolArguments(body.params.name, body.params.arguments, principal, delegation !== void 0);
+            authorizeTool(body.params.name, principal, brynCatalogue);
+            assertToolArguments(
+              body.params.name,
+              body.params.arguments,
+              principal,
+              delegation !== void 0,
+              brynCatalogue
+            );
           } catch (error) {
             if (error instanceof WorkspaceSelectionError) {
-              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: workspaceError(error) });
+              reply(res, 200, {
+                jsonrpc: "2.0",
+                id: body.id ?? null,
+                result: workspaceError(error)
+              });
               return;
             }
             if (error instanceof HostedAuthError && error.code === "insufficient_scope") {
-              const missing = requiredScopes(body.params.name).filter((scope) => !principal.scopes.includes(scope));
-              reply(res, 200, { jsonrpc: "2.0", id: body.id ?? null, result: scopeError(missing) });
+              const missing = requiredScopes(
+                body.params.name,
+                brynCatalogue
+              ).filter((scope) => !principal.scopes.includes(scope));
+              reply(res, 200, {
+                jsonrpc: "2.0",
+                id: body.id ?? null,
+                result: scopeError(missing)
+              });
+              return;
+            }
+            if (catalogueRetryAfter !== void 0 && error instanceof HostedAuthError && error.code === "tool_not_authorized") {
+              reply(res, 200, {
+                jsonrpc: "2.0",
+                id: body.id ?? null,
+                result: toolError(
+                  `Error: Bryn tools are temporarily unavailable because the tool list could not be read (rate limited or busy). Retry in ${catalogueRetryAfter} seconds. (TEMPORARILY_UNAVAILABLE)`
+                )
+              });
               return;
             }
             throw error;
           }
         }
-        const mcp = createHostedToolServer(principal, adapter, delegation);
-        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0, enableJsonResponse: true });
+        const mcp = createHostedToolServer(
+          principal,
+          adapter,
+          delegation,
+          brynCatalogue
+        );
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: void 0,
+          enableJsonResponse: true
+        });
         let closed = false;
         const close = () => {
           if (!closed) {
@@ -692,8 +947,14 @@ function createHostedHttpServer(config, adapter, pats) {
         return;
       }
       const status = error instanceof HostedAuthError ? error.status : 503;
-      if (status === 401) res.setHeader("WWW-Authenticate", `Bearer error="invalid_token", resource_metadata="${metadataUrl}"`);
-      reply(res, status, { error: error instanceof HostedAuthError ? error.code : "temporarily_unavailable" });
+      if (status === 401)
+        res.setHeader(
+          "WWW-Authenticate",
+          `Bearer error="invalid_token", resource_metadata="${metadataUrl}"`
+        );
+      reply(res, status, {
+        error: error instanceof HostedAuthError ? error.code : "temporarily_unavailable"
+      });
     }
   });
   server.requestTimeout = 3e4;
@@ -708,7 +969,12 @@ var USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION} (hosted)`;
 var REQUEST_TIMEOUT_MS = 3e4;
 var FORWARDED_HEADERS = /* @__PURE__ */ new Set(["idempotency-key"]);
 var WORKSPACE_HEADER = "X-Databrain-Workspace";
-var GRANT_DENIALS = /* @__PURE__ */ new Set(["ROLE_NOT_ALLOWED", "WORKSPACE_CREATE_NOT_ALLOWED", "forbidden_permission", "insufficient_scope"]);
+var GRANT_DENIALS = /* @__PURE__ */ new Set([
+  "ROLE_NOT_ALLOWED",
+  "WORKSPACE_CREATE_NOT_ALLOWED",
+  "forbidden_permission",
+  "insufficient_scope"
+]);
 function errorDetail(status, text, bearer) {
   let parsed;
   try {
@@ -754,20 +1020,27 @@ function createProviderAdapter(config) {
   const publicOrigin = new URL(config.publicUrl).origin;
   const bearers = /* @__PURE__ */ new WeakMap();
   const responseSchema = principalSchema.extend({ issuer: z3.literal(config.issuer) }).strip();
-  return {
+  const adapter = {
     async verifyOAuth(token, resource) {
       try {
         const response = await fetch(endpoint, {
-          headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+          headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/json"
+          },
           redirect: "error",
           signal: AbortSignal.timeout(1e4)
         });
         if (!response.ok) {
-          if (response.status === 429 || response.status >= 500) throw new HostedAuthError(503, "temporarily_unavailable");
+          if (response.status === 429 || response.status >= 500)
+            throw new HostedAuthError(503, "temporarily_unavailable");
           throw new HostedAuthError(401, "invalid_token");
         }
-        const { issuer: _issuer, ...principal } = responseSchema.parse(await response.json());
-        if (principal.resource !== resource || principal.credentialType !== "oauth") throw new HostedAuthError(401, "invalid_token");
+        const { issuer: _issuer, ...principal } = responseSchema.parse(
+          await response.json()
+        );
+        if (principal.resource !== resource || principal.credentialType !== "oauth")
+          throw new HostedAuthError(401, "invalid_token");
         return principal;
       } catch (error) {
         if (error instanceof HostedAuthError) throw error;
@@ -778,18 +1051,25 @@ function createProviderAdapter(config) {
       throw new HostedAuthError(401, "pat_membership_adapter_required");
     },
     delegate(token) {
-      const handle = Object.freeze({ kind: "hosted-delegation" });
+      const handle = Object.freeze({
+        kind: "hosted-delegation"
+      });
       bearers.set(handle, token);
       return handle;
     },
     async executeRequest(options, principal, delegation, workspace) {
       const bearer = delegation ? bearers.get(delegation) : void 0;
-      if (options.auth !== "none" && !bearer) throw new HostedAuthError(503, "delegated_backend_adapter_required");
-      if (options.auth === "none" && !options.token) throw new HostedAuthError(403, "tool_not_authorized");
-      if (!options.path.startsWith("/") || options.path.startsWith("//")) throw new HostedAuthError(403, "tool_not_authorized");
+      if (options.auth !== "none" && !bearer)
+        throw new HostedAuthError(503, "delegated_backend_adapter_required");
+      if (options.auth === "none" && !options.token)
+        throw new HostedAuthError(403, "tool_not_authorized");
+      if (!options.path.startsWith("/") || options.path.startsWith("//"))
+        throw new HostedAuthError(403, "tool_not_authorized");
       const url = new URL(`${apiBase}${options.path}`);
-      if (url.origin !== apiOrigin) throw new HostedAuthError(403, "tool_not_authorized");
-      for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);
+      if (url.origin !== apiOrigin)
+        throw new HostedAuthError(403, "tool_not_authorized");
+      for (const [key, value] of Object.entries(options.query ?? {}))
+        url.searchParams.set(key, value);
       const headers = {
         Accept: "application/json",
         "Content-Type": "application/json",
@@ -812,7 +1092,10 @@ function createProviderAdapter(config) {
       } else {
         headers.Authorization = `Bearer ${bearer}`;
         if (workspace) {
-          if (!principal.grantedWorkspaces?.some((item) => item.id === workspace.id) && principal.workspaceId !== workspace.id) throw new HostedAuthError(403, "principal_mismatch");
+          if (!principal.grantedWorkspaces?.some(
+            (item) => item.id === workspace.id
+          ) && principal.workspaceId !== workspace.id)
+            throw new HostedAuthError(403, "principal_mismatch");
           headers[WORKSPACE_HEADER] = workspace.id;
         }
       }
@@ -823,27 +1106,41 @@ function createProviderAdapter(config) {
         body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
         signal: AbortSignal.timeout(options.timeoutMs ?? REQUEST_TIMEOUT_MS)
       });
-      const text = await response.text();
+      const text = options.responseFormat === "bryn-sse" && response.ok ? await readBrynStream(response) : await response.text();
       if (!response.ok) {
         const forbidden = response.status === 403 ? errorDetail(403, text, bearer) : void 0;
         if (forbidden?.code && GRANT_DENIALS.has(forbidden.code)) {
           throw new HostedAuthError(
             403,
             "delegated_request_denied",
-            forbidden.code === "insufficient_scope" && options.path === "/api/v2/guest-token/create" ? { ...forbidden, message: "Guest/tenant operations require mcp:embeds:write. Ask an admin for a role that allows it, then connect again." } : forbidden
+            forbidden.code === "insufficient_scope" && options.path === "/api/v2/guest-token/create" ? {
+              ...forbidden,
+              message: "Guest/tenant operations require mcp:embeds:write. Ask an admin for a role that allows it, then connect again."
+            } : forbidden
           );
         }
-        const status = response.status === 403 && options.responseFormat === "studio-sse" ? 403 : response.status === 401 ? 401 : response.status >= 500 ? 503 : response.status === 403 || response.status === 404 ? 404 : 400;
+        const status = response.status === 403 && (options.responseFormat === "studio-sse" || options.responseFormat === "bryn-sse") ? 403 : response.status === 401 ? 401 : response.status >= 500 ? 503 : response.status === 403 || response.status === 404 ? 404 : 400;
         const detail = status === 401 || status === 503 || response.status === 403 ? void 0 : errorDetail(response.status, text, bearer);
-        throw new HostedAuthError(status, "delegated_request_denied", detail);
+        throw new HostedAuthError(
+          status,
+          "delegated_request_denied",
+          detail,
+          response.status === 429 ? parseRetryAfter(response.headers.get("retry-after")) : void 0
+        );
       }
       try {
-        return options.responseFormat === "studio-sse" ? parseStudioStream(text) : text ? JSON.parse(text) : null;
+        return options.responseFormat === "studio-sse" ? parseStudioStream(text) : options.responseFormat === "bryn-sse" ? parseBrynStream(text) : text ? JSON.parse(text) : null;
       } catch {
         throw new HostedAuthError(503, "delegated_response_invalid");
       }
     }
   };
+  adapter.getBrynCatalogue = (principal, delegation) => adapter.executeRequest(
+    { method: "GET", path: "/api/mcp/bryn/catalog", auth: "service" },
+    principal,
+    delegation
+  );
+  return adapter;
 }
 
 // src/hosted/main.ts
@@ -852,33 +1149,51 @@ async function startHosted() {
   let adapter;
   if (config.testOnly) {
     const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;
-    if (!file || !isAbsolute(file)) throw new Error("Hosted test mode requires an absolute fixture store path.");
-    const { createTestOnlyAdapter } = await import("./test-only-LJGOY2QA.js");
+    if (!file || !isAbsolute(file))
+      throw new Error(
+        "Hosted test mode requires an absolute fixture store path."
+      );
+    const { createTestOnlyAdapter } = await import("./test-only-VH3FF5ML.js");
     adapter = createTestOnlyAdapter(file);
   } else {
     const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;
     if (!file) {
       adapter = createProviderAdapter(config);
-      process.stderr.write("[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\n");
+      process.stderr.write(
+        "[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\n"
+      );
     } else {
-      if (!isAbsolute(file)) throw new Error("DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.");
+      if (!isAbsolute(file))
+        throw new Error(
+          "DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path."
+        );
       try {
         adapter = (await import(pathToFileURL(file).href)).adapter;
       } catch {
         throw new Error("Could not load the trusted hosted adapter.");
       }
     }
-    if (!adapter || ["verifyOAuth", "resolvePatGrant", "executeRequest"].some((key) => typeof adapter[key] !== "function")) throw new Error("Invalid trusted hosted adapter.");
+    if (!adapter || ["verifyOAuth", "resolvePatGrant", "executeRequest"].some(
+      (key) => typeof adapter[key] !== "function"
+    ))
+      throw new Error("Invalid trusted hosted adapter.");
   }
   const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;
-  if (patPath && !isAbsolute(patPath)) throw new Error("Hosted PAT store must be an absolute path.");
-  const server = createHostedHttpServer(config, adapter, patPath ? new FilePatStore(patPath) : void 0);
+  if (patPath && !isAbsolute(patPath))
+    throw new Error("Hosted PAT store must be an absolute path.");
+  const server = createHostedHttpServer(
+    config,
+    adapter,
+    patPath ? new FilePatStore(patPath) : void 0
+  );
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(config.port, config.bind, resolve);
   });
-  process.stderr.write(`[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? " \u2014 TEST ONLY: synthetic identity and data; no OAuth consent" : ""}
-`);
+  process.stderr.write(
+    `[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? " \u2014 TEST ONLY: synthetic identity and data; no OAuth consent" : ""}
+`
+  );
   const shutdown = () => {
     server.close(() => process.exit(0));
     setTimeout(() => {
@@ -892,4 +1207,4 @@ async function startHosted() {
 export {
   startHosted
 };
-//# sourceMappingURL=main-VEKNKWL5.js.map
+//# sourceMappingURL=main-2FKQQLWX.js.map