@databrainhq/mcp-server 0.3.0-rc.3 → 0.3.0-rc.5

package/dist/custom-chart/template/icon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="12" width="4" height="8" rx="1"/><rect x="10" y="6" width="4" height="14" rx="1"/><rect x="17" y="9" width="4" height="11" rx="1"/></svg>

package/dist/custom-chart/template/manifest.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 2,
+  "id": "my-chart",
+  "name": "My chart",
+  "version": "1.0.0",
+  "description": "Bars with an optional target line.",
+  "slots": [
+    { "id": "category", "label": "Category", "role": "dimension", "types": ["string"], "required": true, "description": "One bar per value." },
+    { "id": "value", "label": "Value", "role": "measure", "types": ["number"], "required": true },
+    { "id": "target", "label": "Target", "role": "measure", "types": ["number"], "required": false }
+  ],
+  "options": [
+    { "id": "show_labels", "label": "Show labels", "type": "boolean", "default": true, "group": "Labels" },
+    { "id": "subtitle", "label": "Subtitle", "type": "string", "default": "", "maxLength": 120, "group": "Labels" },
+    { "id": "bar_radius", "label": "Corner radius", "type": "number", "default": 4, "min": 0, "max": 20, "step": 1, "group": "Bars" },
+    { "id": "bar_color", "label": "Bar colour", "type": "color", "default": "#3366cc", "group": "Bars" },
+    { "id": "sort", "label": "Sort", "type": "select", "default": "none", "choices": [
+      { "value": "none", "label": "Data order" },
+      { "value": "asc", "label": "Smallest first" },
+      { "value": "desc", "label": "Largest first" }
+    ], "group": "Bars" }
+  ]
+}

package/dist/custom-chart/template/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "my-chart",
+  "private": true,
+  "version": "1.0.0",
+  "scripts": {
+    "validate": "databrain custom-chart validate",
+    "build": "databrain custom-chart build",
+    "dev": "databrain custom-chart dev",
+    "upload": "databrain custom-chart upload"
+  },
+  "devDependencies": {
+    "@databrainhq/mcp-server": "latest"
+  }
+}

package/dist/custom-chart/template/sample-data.json

@@ -0,0 +1,18 @@
+{
+  "columns": [
+    { "id": "country", "label": "Country", "type": "string", "filterable": true, "slotId": "category" },
+    { "id": "revenue", "label": "Revenue", "type": "number", "filterable": false, "slotId": "value" },
+    { "id": "target", "label": "Target", "type": "number", "filterable": false, "slotId": "target" }
+  ],
+  "rows": [
+    ["India", 1240, 1100],
+    ["United States", 980, 1200],
+    ["Germany", 610, 600],
+    ["Brazil", 430, 500],
+    ["Japan", 390, 350],
+    ["France", 280, 300],
+    ["Canada", 210, 250],
+    ["Australia", 150, 200]
+  ],
+  "options": {}
+}

package/dist/custom-chart/template/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true
+  },
+  "include": ["chart.ts", "custom-chart.d.ts"]
+}

package/dist/index.js

@@ -3,15 +3,17 @@ import {
   DEFAULT_POSTHOG_API_KEY,
   DEFAULT_POSTHOG_HOST,
   loadConfig
-} from "./chunk-OHTV24NG.js";
+} from "./chunk-V64ZQINV.js";
 import {
-  DatabrainClient,
-  MCP_SERVER_VERSION,
-  logger,
   registerAllPrompts,
   registerAllResources,
   registerAllTools
-} from "./chunk-DZOYK5BB.js";
+} from "./chunk-5IQ7MVUH.js";
+import {
+  DatabrainClient,
+  MCP_SERVER_VERSION,
+  logger
+} from "./chunk-PRE4CGOV.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -41,7 +43,7 @@ function createServer(config) {
     },
     {
       instructions: operatorBlurb + `Databrain uses two token types \u2014 never confuse them:
-\u2022 SERVICE TOKEN (DATABRAIN_SERVICE_TOKEN): org-level, pre-configured in MCP server config. Used for: list_datasources, discover_datasource_schema, sync_datasource, list_datamarts, create_datamart, list_workspaces, list_data_apps, list_tenants, create_data_app, list_api_tokens, create_api_token, rotate_api_token, list_dashboards (workspace scope), ask_question, get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status. ${serviceTokenStatus}
+\u2022 SERVICE TOKEN (DATABRAIN_SERVICE_TOKEN): org-level, pre-configured in MCP server config. Used for: list_datasources, discover_datasource_schema, sync_datasource, list_datamarts, create_datamart, list_workspaces, list_data_apps, list_tenants, create_data_app, list_api_tokens, create_api_token, rotate_api_token, list_dashboards (workspace scope), ask_question, get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status, custom_chart_validate (server check), custom_chart_upload, list_custom_charts, publish_custom_chart. ${serviceTokenStatus}
 \u2022 API TOKEN (per data app): scoped to one data app, used for embedding operations (list_embeds, get_embed_details, create_embed, update_embed, generate_guest_token), data-app scoped dashboard listing, widget CRUD/metric creation through guest-token APIs, and list_scheduled_reports. ${apiTokenStatus}
 
 FIRST classify the request before calling tools \u2014 this avoids wasted turns:
@@ -57,6 +59,8 @@ FIRST classify the request before calling tools \u2014 this avoids wasted turns:
 
 Production safety: OAuth may not be available yet. In service-token mode, writes are actor=system. For create_datamart and create_or_update_metric_from_query, dry_run is the default. Apply requires confirm="APPLY_TO_PRODUCTION" after the user reviews the plan. Widget validation and mutation tools must verify the resolved embed is tenant-scoped for the requested clientId; if not, they must refuse to touch it as a likely production/data-app dashboard. Do not apply from a vague request.
 
+Custom chart types (chart type custom:<key>): custom_chart_scaffold returns a chart project the agent writes to disk, custom_chart_validate checks a manifest and bundle without persisting, custom_chart_upload creates the chart or a preview version only with mode="apply" and confirm="APPLY_TO_PRODUCTION" (dry_run shows the plan first), and publish_custom_chart makes a version live for every builder only with the same confirmation because every dashboard using that key re-renders. Build the bundle with \`databrain custom-chart build\` (the CLI in this package), never by hand.
+
 Infrastructure creation is intentionally narrow in MCP: datasource and workspace creation still happen outside this workflow; sync_datasource and dry-run/apply create_datamart are available. The semantic layer is populated and maintained via MCP tools (get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status). When the semantic layer is empty, use these tools \u2014 do NOT send the user to the UI for semantic metadata.
 
 After embed setup, customize with: brand-my-embed prompt for theming. Use update_embed (body passthrough) for filters, localization, and permissions.
@@ -111,7 +115,7 @@ function banner(msg) {
 async function main() {
   try {
     if (process.argv.includes("--http")) {
-      const { startHosted } = await import("./main-VPCN2764.js");
+      const { startHosted } = await import("./main-Q6XT4O46.js");
       await startHosted();
       return;
     }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/server.ts","../src/utils/analytics.ts"],"sourcesContent":["import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { loadConfig } from './utils/config.js';\nimport { createServer } from './server.js';\nimport { setupAnalytics } from './utils/analytics.js';\nimport { logger } from './utils/logger.js';\nimport { MCP_SERVER_VERSION } from './version.js';\n\nfunction banner(msg: string): void {\n  process.stderr.write(`[databrain] ${msg}\\n`);\n}\n\nasync function main(): Promise<void> {\n  try {\n    if (process.argv.includes('--http')) {\n      const { startHosted } = await import('./hosted/main.js');\n      await startHosted();\n      return;\n    }\n    const config = loadConfig();\n    const server = createServer(config);\n    const posthog = setupAnalytics(server, config);\n    const transport = new StdioServerTransport();\n\n    let shuttingDown = false;\n    const flushAnalytics = async (): Promise<void> => {\n      if (shuttingDown || !posthog) return;\n      shuttingDown = true;\n      await posthog.shutdown();\n    };\n    // StdioServerTransport never observes stdin ending, so the MCP client\n    // disconnecting drains the event loop and exits the process without ever\n    // calling transport/server onclose. `beforeExit` is what actually fires\n    // in that path; posthog-node's flush timers are unref'd so they don't\n    // keep the process alive on their own.\n    process.on('beforeExit', () => void flushAnalytics());\n    process.on('SIGINT', () => void flushAnalytics().then(() => process.exit(0)));\n    process.on('SIGTERM', () => void flushAnalytics().then(() => process.exit(0)));\n\n    await server.connect(transport);\n    banner(`v${MCP_SERVER_VERSION} ready`);\n  } catch (error) {\n    logger.error('Failed to start server', error);\n    process.exit(1);\n  }\n}\n\nmain();\n","import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { DatabrainClient } from './client/databrain-client.js';\nimport type { Config } from './utils/config.js';\nimport { registerAllTools } from './tools/registry.js';\nimport { registerAllResources } from './resources/registry.js';\nimport { registerAllPrompts } from './prompts/registry.js';\nimport { MCP_SERVER_VERSION } from './version.js';\n\nexport function createServer(config: Config): McpServer {\n  const client = new DatabrainClient(config);\n  const auth = client.getActiveAuth();\n  let operatorBlurb: string;\n  if (auth.source === 'oauth-client-credentials') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: OAuth client-credentials mode is configured for org-level calls. Tokens identify a service application, not a human operator. The backend must validate the token and map its issuer/subject to an authorized principal. Configuration alone does not prove backend acceptance. Do NOT ask the user for credentials or tokens.\\n\\n';\n  } else if (auth.source === 'service-token') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: service-token mode. Calls are authenticated at org level — actions in the audit log are tagged actor=system, not a specific user. Per-user identity binding will be added when the OAuth-based login flow ships. Do NOT ask the user for credentials or tokens.\\n\\n';\n  } else if (auth.source === 'api-token') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: API-token-only mode. A per-data-app API token is configured, but DATABRAIN_SERVICE_TOKEN is not. Embedding operations can use the configured API token, but org-level setup tools require DATABRAIN_SERVICE_TOKEN in the MCP config.\\n\\n';\n  } else {\n    operatorBlurb =\n      'OPERATOR IDENTITY: no usable token is configured. The MCP server normally refuses this config at startup. Ask the user to add DATABRAIN_SERVICE_TOKEN or DATABRAIN_API_TOKEN to the MCP config before proceeding.\\n\\n';\n  }\n\n  const serviceTokenStatus = config.oauth\n    ? 'OAuth client credentials are configured for service-level operations. A configured DATABRAIN_SERVICE_TOKEN is used only if token acquisition fails.'\n    : config.serviceToken\n    ? 'This MCP server has DATABRAIN_SERVICE_TOKEN configured; never ask the user for it.'\n    : 'DATABRAIN_SERVICE_TOKEN is not configured. Ask the user to add it to the MCP config only if org-level setup is needed.';\n  const apiTokenStatus = client.hasApiToken()\n    ? 'This MCP server has a per-data-app API token configured.'\n    : config.oauth\n      ? 'Created/rotated via create_api_token or rotate_api_token using configured OAuth service credentials, once the backend supports them.'\n    : 'Created/rotated via create_api_token or rotate_api_token during setup when DATABRAIN_SERVICE_TOKEN is available.';\n\n  const server = new McpServer(\n    {\n      name: 'databrain',\n      version: MCP_SERVER_VERSION,\n      description:\n        'Databrain MCP Server — build customer-facing embedded analytics AND run internal analytics on your own data. Supports embed setup, semantic-layer maintenance, natural-language querying, SQL→metric creation (embedded production metrics and unpublished internal workspace metrics), theming, filters, permissions, and guest token generation.',\n    },\n    {\n      instructions:\n        operatorBlurb +\n        'Databrain uses two token types — never confuse them:\\n' +\n        `• SERVICE TOKEN (DATABRAIN_SERVICE_TOKEN): org-level, pre-configured in MCP server config. Used for: list_datasources, discover_datasource_schema, sync_datasource, list_datamarts, create_datamart, list_workspaces, list_data_apps, list_tenants, create_data_app, list_api_tokens, create_api_token, rotate_api_token, list_dashboards (workspace scope), ask_question, get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status. ${serviceTokenStatus}\\n` +\n        `• API TOKEN (per data app): scoped to one data app, used for embedding operations (list_embeds, get_embed_details, create_embed, update_embed, generate_guest_token), data-app scoped dashboard listing, widget CRUD/metric creation through guest-token APIs, and list_scheduled_reports. ${apiTokenStatus}\\n\\n` +\n        'FIRST classify the request before calling tools — this avoids wasted turns:\\n' +\n        '• (A) EMBEDDING: putting Databrain dashboards/charts in front of YOUR customers (data apps, embeds, guest tokens, per-customer dashboard widgets). Needs an API token and usually a clientId.\\n' +\n        '• (B) INTERNAL ANALYTICS: exploring your own data or migrating SQL into your own Databrain metrics for internal use. Workspace-scoped, uses the service token, NO clientId. Creating an unpublished workspace metric (create_workspace_metric) lives here — it is NOT embedding.\\n\\n' +\n        '5 core use cases — match the user\\'s scenario to the right prompt:\\n' +\n        '1. Embed existing dashboard → prompt: embed-existing-dashboard (list_data_apps → create_api_token → list_dashboards → create_embed → generate_guest_token → generate_embed_code)\\n' +\n        '2. Blank dashboard per client → prompt: embed-blank-dashboard (list_data_apps → list_datamarts → create_embed with clientId per client → generate_guest_token → generate_embed_code)\\n' +\n        '3. Explore & query data → prompt: query-data (list_datamarts → get_semantic_layer → if empty, auto-generate descriptions with update_semantic_layer or use populate-semantic-layer prompt → ask_question)\\n' +\n        '4. SQL → embedded production metric on a customer dashboard (EMBEDDING, requires clientId) → prompt: sql-to-metric-migration (validate_metric_spec → create_or_update_metric_from_query dry_run → apply only with explicit production confirmation)\\n' +\n        '5. SQL → unpublished workspace metric (INTERNAL ANALYTICS, no clientId, not attached to any dashboard) → prompt: sql-to-workspace-metric (discover_datasource_schema → create_workspace_metric dry_run → apply with explicit confirmation)\\n\\n' +\n        'Production safety: OAuth may not be available yet. In service-token mode, writes are actor=system. For create_datamart and create_or_update_metric_from_query, dry_run is the default. Apply requires confirm=\"APPLY_TO_PRODUCTION\" after the user reviews the plan. Widget validation and mutation tools must verify the resolved embed is tenant-scoped for the requested clientId; if not, they must refuse to touch it as a likely production/data-app dashboard. Do not apply from a vague request.\\n\\n' +\n        'Infrastructure creation is intentionally narrow in MCP: datasource and workspace creation still happen outside this workflow; sync_datasource and dry-run/apply create_datamart are available. The semantic layer is populated and maintained via MCP tools (get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status). When the semantic layer is empty, use these tools — do NOT send the user to the UI for semantic metadata.\\n\\n' +\n        'After embed setup, customize with: brand-my-embed prompt for theming. Use update_embed (body passthrough) for filters, localization, and permissions.\\n' +\n        'Use generate_guest_token for frontend auth and generate_embed_code for framework snippets.\\n' +\n        'For advanced embed configuration (UI toggles, filters, i18n), use update_embed with a body passthrough.\\n' +\n        'To diagnose embed issues, use get_embed_details and reason about the response.\\n' +\n        'Do NOT ask the user for any tokens — manage them via MCP tools.\\n\\n' +\n        'IMPORTANT — accessSettings defaults:\\n' +\n        'When calling create_embed, only pass accessSettings: { datamartName: \"...\" } plus any flags the user explicitly wants enabled. For multi-tenant dashboard embeds, also pass clientId. The tool auto-fills all required isAllow* fields with secure defaults (all false). Do NOT guess or enumerate accessSettings fields.\\n\\n' +\n        'IMPORTANT — create_data_app does NOT accept workspaceName. Only pass { name: \"...\" }.\\n\\n' +\n        'IMPORTANT — Be interactive. Present results from each tool call and ask the user before proceeding to the next step. Never batch multiple mutating operations without user confirmation.\\n' +\n        'Trigger keywords: embed, dashboard, analytics, Databrain, guest token, theme, filters, permissions, datasource, datamart, workspace, metric creation.',\n    },\n  );\n\n  registerAllTools(server, client);\n  registerAllResources(server);\n  registerAllPrompts(server);\n\n  return server;\n}\n","import { createHash } from 'node:crypto';\nimport { PostHog } from 'posthog-node';\nimport { instrument } from '@posthog/mcp';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { Config } from './config.js';\nimport { DEFAULT_POSTHOG_API_KEY, DEFAULT_POSTHOG_HOST } from './config.js';\nimport { logger } from './logger.js';\n\n// Derives a stable per-install distinct_id from the active auth token without\n// ever sending the token itself to PostHog.\nfunction distinctIdFromToken(token: string | undefined): string | null {\n  if (!token) return null;\n  return createHash('sha256').update(token).digest('hex').slice(0, 32);\n}\n\n/**\n * Wires PostHog MCP analytics (tool calls, initialize, exceptions) into the\n * server. Always on — not user-configurable. Returns the PostHog client so\n * the caller can flush/shutdown it on exit, or null when no auth token is\n * configured yet (nothing to derive a distinct_id from).\n */\nexport function setupAnalytics(server: McpServer, config: Config): PostHog | null {\n  const distinctId = distinctIdFromToken(config.serviceToken || config.apiToken);\n  if (!distinctId) {\n    return null;\n  }\n\n  const posthog = new PostHog(config.posthogApiKey || DEFAULT_POSTHOG_API_KEY, {\n    host: config.posthogHost || DEFAULT_POSTHOG_HOST,\n  });\n\n  instrument(server, posthog, {\n    logger: (msg) => logger.debug(`[posthog] ${msg}`),\n    identify: { distinctId },\n  });\n\n  return posthog;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,4BAA4B;;;ACArC,SAAS,iBAAiB;AAQnB,SAAS,aAAa,QAA2B;AACtD,QAAM,SAAS,IAAI,gBAAgB,MAAM;AACzC,QAAM,OAAO,OAAO,cAAc;AAClC,MAAI;AACJ,MAAI,KAAK,WAAW,4BAA4B;AAC9C,oBACE;AAAA,EACJ,WAAW,KAAK,WAAW,iBAAiB;AAC1C,oBACE;AAAA,EACJ,WAAW,KAAK,WAAW,aAAa;AACtC,oBACE;AAAA,EACJ,OAAO;AACL,oBACE;AAAA,EACJ;AAEA,QAAM,qBAAqB,OAAO,QAC9B,wJACA,OAAO,eACP,uFACA;AACJ,QAAM,iBAAiB,OAAO,YAAY,IACtC,6DACA,OAAO,QACL,yIACF;AAEJ,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,IACJ;AAAA,IACA;AAAA,MACE,cACE,gBACA;AAAA,oeACge,kBAAkB;AAAA,kSACpN,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAsBhT;AAAA,EACF;AAEA,mBAAiB,QAAQ,MAAM;AAC/B,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AAEzB,SAAO;AACT;;;AC/EA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAQ3B,SAAS,oBAAoB,OAA0C;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrE;AAQO,SAAS,eAAe,QAAmB,QAAgC;AAChF,QAAM,aAAa,oBAAoB,OAAO,gBAAgB,OAAO,QAAQ;AAC7E,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ,OAAO,iBAAiB,yBAAyB;AAAA,IAC3E,MAAM,OAAO,eAAe;AAAA,EAC9B,CAAC;AAED,aAAW,QAAQ,SAAS;AAAA,IAC1B,QAAQ,CAAC,QAAQ,OAAO,MAAM,aAAa,GAAG,EAAE;AAAA,IAChD,UAAU,EAAE,WAAW;AAAA,EACzB,CAAC;AAED,SAAO;AACT;;;AF9BA,SAAS,OAAO,KAAmB;AACjC,UAAQ,OAAO,MAAM,eAAe,GAAG;AAAA,CAAI;AAC7C;AAEA,eAAe,OAAsB;AACnC,MAAI;AACF,QAAI,QAAQ,KAAK,SAAS,QAAQ,GAAG;AACnC,YAAM,EAAE,YAAY,IAAI,MAAM,OAAO,oBAAkB;AACvD,YAAM,YAAY;AAClB;AAAA,IACF;AACA,UAAM,SAAS,WAAW;AAC1B,UAAM,SAAS,aAAa,MAAM;AAClC,UAAM,UAAU,eAAe,QAAQ,MAAM;AAC7C,UAAM,YAAY,IAAI,qBAAqB;AAE3C,QAAI,eAAe;AACnB,UAAM,iBAAiB,YAA2B;AAChD,UAAI,gBAAgB,CAAC,QAAS;AAC9B,qBAAe;AACf,YAAM,QAAQ,SAAS;AAAA,IACzB;AAMA,YAAQ,GAAG,cAAc,MAAM,KAAK,eAAe,CAAC;AACpD,YAAQ,GAAG,UAAU,MAAM,KAAK,eAAe,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AAC5E,YAAQ,GAAG,WAAW,MAAM,KAAK,eAAe,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AAE7E,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,IAAI,kBAAkB,QAAQ;AAAA,EACvC,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,KAAK;AAC5C,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAEA,KAAK;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/server.ts","../src/utils/analytics.ts"],"sourcesContent":["import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { loadConfig } from './utils/config.js';\nimport { createServer } from './server.js';\nimport { setupAnalytics } from './utils/analytics.js';\nimport { logger } from './utils/logger.js';\nimport { MCP_SERVER_VERSION } from './version.js';\n\nfunction banner(msg: string): void {\n  process.stderr.write(`[databrain] ${msg}\\n`);\n}\n\nasync function main(): Promise<void> {\n  try {\n    if (process.argv.includes('--http')) {\n      const { startHosted } = await import('./hosted/main.js');\n      await startHosted();\n      return;\n    }\n    const config = loadConfig();\n    const server = createServer(config);\n    const posthog = setupAnalytics(server, config);\n    const transport = new StdioServerTransport();\n\n    let shuttingDown = false;\n    const flushAnalytics = async (): Promise<void> => {\n      if (shuttingDown || !posthog) return;\n      shuttingDown = true;\n      await posthog.shutdown();\n    };\n    // StdioServerTransport never observes stdin ending, so the MCP client\n    // disconnecting drains the event loop and exits the process without ever\n    // calling transport/server onclose. `beforeExit` is what actually fires\n    // in that path; posthog-node's flush timers are unref'd so they don't\n    // keep the process alive on their own.\n    process.on('beforeExit', () => void flushAnalytics());\n    process.on('SIGINT', () => void flushAnalytics().then(() => process.exit(0)));\n    process.on('SIGTERM', () => void flushAnalytics().then(() => process.exit(0)));\n\n    await server.connect(transport);\n    banner(`v${MCP_SERVER_VERSION} ready`);\n  } catch (error) {\n    logger.error('Failed to start server', error);\n    process.exit(1);\n  }\n}\n\nmain();\n","import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { DatabrainClient } from './client/databrain-client.js';\nimport type { Config } from './utils/config.js';\nimport { registerAllTools } from './tools/registry.js';\nimport { registerAllResources } from './resources/registry.js';\nimport { registerAllPrompts } from './prompts/registry.js';\nimport { MCP_SERVER_VERSION } from './version.js';\n\nexport function createServer(config: Config): McpServer {\n  const client = new DatabrainClient(config);\n  const auth = client.getActiveAuth();\n  let operatorBlurb: string;\n  if (auth.source === 'oauth-client-credentials') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: OAuth client-credentials mode is configured for org-level calls. Tokens identify a service application, not a human operator. The backend must validate the token and map its issuer/subject to an authorized principal. Configuration alone does not prove backend acceptance. Do NOT ask the user for credentials or tokens.\\n\\n';\n  } else if (auth.source === 'service-token') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: service-token mode. Calls are authenticated at org level — actions in the audit log are tagged actor=system, not a specific user. Per-user identity binding will be added when the OAuth-based login flow ships. Do NOT ask the user for credentials or tokens.\\n\\n';\n  } else if (auth.source === 'api-token') {\n    operatorBlurb =\n      'OPERATOR IDENTITY: API-token-only mode. A per-data-app API token is configured, but DATABRAIN_SERVICE_TOKEN is not. Embedding operations can use the configured API token, but org-level setup tools require DATABRAIN_SERVICE_TOKEN in the MCP config.\\n\\n';\n  } else {\n    operatorBlurb =\n      'OPERATOR IDENTITY: no usable token is configured. The MCP server normally refuses this config at startup. Ask the user to add DATABRAIN_SERVICE_TOKEN or DATABRAIN_API_TOKEN to the MCP config before proceeding.\\n\\n';\n  }\n\n  const serviceTokenStatus = config.oauth\n    ? 'OAuth client credentials are configured for service-level operations. A configured DATABRAIN_SERVICE_TOKEN is used only if token acquisition fails.'\n    : config.serviceToken\n    ? 'This MCP server has DATABRAIN_SERVICE_TOKEN configured; never ask the user for it.'\n    : 'DATABRAIN_SERVICE_TOKEN is not configured. Ask the user to add it to the MCP config only if org-level setup is needed.';\n  const apiTokenStatus = client.hasApiToken()\n    ? 'This MCP server has a per-data-app API token configured.'\n    : config.oauth\n      ? 'Created/rotated via create_api_token or rotate_api_token using configured OAuth service credentials, once the backend supports them.'\n    : 'Created/rotated via create_api_token or rotate_api_token during setup when DATABRAIN_SERVICE_TOKEN is available.';\n\n  const server = new McpServer(\n    {\n      name: 'databrain',\n      version: MCP_SERVER_VERSION,\n      description:\n        'Databrain MCP Server — build customer-facing embedded analytics AND run internal analytics on your own data. Supports embed setup, semantic-layer maintenance, natural-language querying, SQL→metric creation (embedded production metrics and unpublished internal workspace metrics), theming, filters, permissions, and guest token generation.',\n    },\n    {\n      instructions:\n        operatorBlurb +\n        'Databrain uses two token types — never confuse them:\\n' +\n        `• SERVICE TOKEN (DATABRAIN_SERVICE_TOKEN): org-level, pre-configured in MCP server config. Used for: list_datasources, discover_datasource_schema, sync_datasource, list_datamarts, create_datamart, list_workspaces, list_data_apps, list_tenants, create_data_app, list_api_tokens, create_api_token, rotate_api_token, list_dashboards (workspace scope), ask_question, get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status, custom_chart_validate (server check), custom_chart_upload, list_custom_charts, publish_custom_chart. ${serviceTokenStatus}\\n` +\n        `• API TOKEN (per data app): scoped to one data app, used for embedding operations (list_embeds, get_embed_details, create_embed, update_embed, generate_guest_token), data-app scoped dashboard listing, widget CRUD/metric creation through guest-token APIs, and list_scheduled_reports. ${apiTokenStatus}\\n\\n` +\n        'FIRST classify the request before calling tools — this avoids wasted turns:\\n' +\n        '• (A) EMBEDDING: putting Databrain dashboards/charts in front of YOUR customers (data apps, embeds, guest tokens, per-customer dashboard widgets). Needs an API token and usually a clientId.\\n' +\n        '• (B) INTERNAL ANALYTICS: exploring your own data or migrating SQL into your own Databrain metrics for internal use. Workspace-scoped, uses the service token, NO clientId. Creating an unpublished workspace metric (create_workspace_metric) lives here — it is NOT embedding.\\n\\n' +\n        '5 core use cases — match the user\\'s scenario to the right prompt:\\n' +\n        '1. Embed existing dashboard → prompt: embed-existing-dashboard (list_data_apps → create_api_token → list_dashboards → create_embed → generate_guest_token → generate_embed_code)\\n' +\n        '2. Blank dashboard per client → prompt: embed-blank-dashboard (list_data_apps → list_datamarts → create_embed with clientId per client → generate_guest_token → generate_embed_code)\\n' +\n        '3. Explore & query data → prompt: query-data (list_datamarts → get_semantic_layer → if empty, auto-generate descriptions with update_semantic_layer or use populate-semantic-layer prompt → ask_question)\\n' +\n        '4. SQL → embedded production metric on a customer dashboard (EMBEDDING, requires clientId) → prompt: sql-to-metric-migration (validate_metric_spec → create_or_update_metric_from_query dry_run → apply only with explicit production confirmation)\\n' +\n        '5. SQL → unpublished workspace metric (INTERNAL ANALYTICS, no clientId, not attached to any dashboard) → prompt: sql-to-workspace-metric (discover_datasource_schema → create_workspace_metric dry_run → apply with explicit confirmation)\\n\\n' +\n        'Production safety: OAuth may not be available yet. In service-token mode, writes are actor=system. For create_datamart and create_or_update_metric_from_query, dry_run is the default. Apply requires confirm=\"APPLY_TO_PRODUCTION\" after the user reviews the plan. Widget validation and mutation tools must verify the resolved embed is tenant-scoped for the requested clientId; if not, they must refuse to touch it as a likely production/data-app dashboard. Do not apply from a vague request.\\n\\n' +\n        'Custom chart types (chart type custom:<key>): custom_chart_scaffold returns a chart project the agent writes to disk, custom_chart_validate checks a manifest and bundle without persisting, custom_chart_upload creates the chart or a preview version only with mode=\"apply\" and confirm=\"APPLY_TO_PRODUCTION\" (dry_run shows the plan first), and publish_custom_chart makes a version live for every builder only with the same confirmation because every dashboard using that key re-renders. Build the bundle with `databrain custom-chart build` (the CLI in this package), never by hand.\\n\\n' +\n        'Infrastructure creation is intentionally narrow in MCP: datasource and workspace creation still happen outside this workflow; sync_datasource and dry-run/apply create_datamart are available. The semantic layer is populated and maintained via MCP tools (get_semantic_layer, update_semantic_layer, start_semantic_layer_generation, get_semantic_layer_generation_status). When the semantic layer is empty, use these tools — do NOT send the user to the UI for semantic metadata.\\n\\n' +\n        'After embed setup, customize with: brand-my-embed prompt for theming. Use update_embed (body passthrough) for filters, localization, and permissions.\\n' +\n        'Use generate_guest_token for frontend auth and generate_embed_code for framework snippets.\\n' +\n        'For advanced embed configuration (UI toggles, filters, i18n), use update_embed with a body passthrough.\\n' +\n        'To diagnose embed issues, use get_embed_details and reason about the response.\\n' +\n        'Do NOT ask the user for any tokens — manage them via MCP tools.\\n\\n' +\n        'IMPORTANT — accessSettings defaults:\\n' +\n        'When calling create_embed, only pass accessSettings: { datamartName: \"...\" } plus any flags the user explicitly wants enabled. For multi-tenant dashboard embeds, also pass clientId. The tool auto-fills all required isAllow* fields with secure defaults (all false). Do NOT guess or enumerate accessSettings fields.\\n\\n' +\n        'IMPORTANT — create_data_app does NOT accept workspaceName. Only pass { name: \"...\" }.\\n\\n' +\n        'IMPORTANT — Be interactive. Present results from each tool call and ask the user before proceeding to the next step. Never batch multiple mutating operations without user confirmation.\\n' +\n        'Trigger keywords: embed, dashboard, analytics, Databrain, guest token, theme, filters, permissions, datasource, datamart, workspace, metric creation.',\n    },\n  );\n\n  registerAllTools(server, client);\n  registerAllResources(server);\n  registerAllPrompts(server);\n\n  return server;\n}\n","import { createHash } from 'node:crypto';\nimport { PostHog } from 'posthog-node';\nimport { instrument } from '@posthog/mcp';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { Config } from './config.js';\nimport { DEFAULT_POSTHOG_API_KEY, DEFAULT_POSTHOG_HOST } from './config.js';\nimport { logger } from './logger.js';\n\n// Derives a stable per-install distinct_id from the active auth token without\n// ever sending the token itself to PostHog.\nfunction distinctIdFromToken(token: string | undefined): string | null {\n  if (!token) return null;\n  return createHash('sha256').update(token).digest('hex').slice(0, 32);\n}\n\n/**\n * Wires PostHog MCP analytics (tool calls, initialize, exceptions) into the\n * server. Always on — not user-configurable. Returns the PostHog client so\n * the caller can flush/shutdown it on exit, or null when no auth token is\n * configured yet (nothing to derive a distinct_id from).\n */\nexport function setupAnalytics(server: McpServer, config: Config): PostHog | null {\n  const distinctId = distinctIdFromToken(config.serviceToken || config.apiToken);\n  if (!distinctId) {\n    return null;\n  }\n\n  const posthog = new PostHog(config.posthogApiKey || DEFAULT_POSTHOG_API_KEY, {\n    host: config.posthogHost || DEFAULT_POSTHOG_HOST,\n  });\n\n  instrument(server, posthog, {\n    logger: (msg) => logger.debug(`[posthog] ${msg}`),\n    identify: { distinctId },\n  });\n\n  return posthog;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,4BAA4B;;;ACArC,SAAS,iBAAiB;AAQnB,SAAS,aAAa,QAA2B;AACtD,QAAM,SAAS,IAAI,gBAAgB,MAAM;AACzC,QAAM,OAAO,OAAO,cAAc;AAClC,MAAI;AACJ,MAAI,KAAK,WAAW,4BAA4B;AAC9C,oBACE;AAAA,EACJ,WAAW,KAAK,WAAW,iBAAiB;AAC1C,oBACE;AAAA,EACJ,WAAW,KAAK,WAAW,aAAa;AACtC,oBACE;AAAA,EACJ,OAAO;AACL,oBACE;AAAA,EACJ;AAEA,QAAM,qBAAqB,OAAO,QAC9B,wJACA,OAAO,eACP,uFACA;AACJ,QAAM,iBAAiB,OAAO,YAAY,IACtC,6DACA,OAAO,QACL,yIACF;AAEJ,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,IACJ;AAAA,IACA;AAAA,MACE,cACE,gBACA;AAAA,ykBACqkB,kBAAkB;AAAA,kSACzT,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAuBhT;AAAA,EACF;AAEA,mBAAiB,QAAQ,MAAM;AAC/B,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AAEzB,SAAO;AACT;;;AChFA,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAQ3B,SAAS,oBAAoB,OAA0C;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACrE;AAQO,SAAS,eAAe,QAAmB,QAAgC;AAChF,QAAM,aAAa,oBAAoB,OAAO,gBAAgB,OAAO,QAAQ;AAC7E,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ,OAAO,iBAAiB,yBAAyB;AAAA,IAC3E,MAAM,OAAO,eAAe;AAAA,EAC9B,CAAC;AAED,aAAW,QAAQ,SAAS;AAAA,IAC1B,QAAQ,CAAC,QAAQ,OAAO,MAAM,aAAa,GAAG,EAAE;AAAA,IAChD,UAAU,EAAE,WAAW;AAAA,EACzB,CAAC;AAED,SAAO;AACT;;;AF9BA,SAAS,OAAO,KAAmB;AACjC,UAAQ,OAAO,MAAM,eAAe,GAAG;AAAA,CAAI;AAC7C;AAEA,eAAe,OAAsB;AACnC,MAAI;AACF,QAAI,QAAQ,KAAK,SAAS,QAAQ,GAAG;AACnC,YAAM,EAAE,YAAY,IAAI,MAAM,OAAO,oBAAkB;AACvD,YAAM,YAAY;AAClB;AAAA,IACF;AACA,UAAM,SAAS,WAAW;AAC1B,UAAM,SAAS,aAAa,MAAM;AAClC,UAAM,UAAU,eAAe,QAAQ,MAAM;AAC7C,UAAM,YAAY,IAAI,qBAAqB;AAE3C,QAAI,eAAe;AACnB,UAAM,iBAAiB,YAA2B;AAChD,UAAI,gBAAgB,CAAC,QAAS;AAC9B,qBAAe;AACf,YAAM,QAAQ,SAAS;AAAA,IACzB;AAMA,YAAQ,GAAG,cAAc,MAAM,KAAK,eAAe,CAAC;AACpD,YAAQ,GAAG,UAAU,MAAM,KAAK,eAAe,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AAC5E,YAAQ,GAAG,WAAW,MAAM,KAAK,eAAe,EAAE,KAAK,MAAM,QAAQ,KAAK,CAAC,CAAC,CAAC;AAE7E,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,IAAI,kBAAkB,QAAQ;AAAA,EACvC,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,KAAK;AAC5C,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;AAEA,KAAK;","names":[]}

package/dist/{main-VPCN2764.js → main-Q6XT4O46.js}

@@ -1,22 +1,24 @@
 #!/usr/bin/env node
+import {
+  registerAllPrompts,
+  registerAllResources,
+  registerAllTools
+} from "./chunk-5IQ7MVUH.js";
 import {
   DatabrainApiError,
   DatabrainClient,
   MCP_SERVER_VERSION,
-  registerAllPrompts,
-  registerAllResources,
-  registerAllTools,
   toolContext,
   toolError,
   toolSuccess
-} from "./chunk-DZOYK5BB.js";
+} from "./chunk-PRE4CGOV.js";
 import {
   FilePatStore,
   HOSTED_SCOPES,
   HostedAuthError,
   createBearerVerifier,
   principalSchema
-} from "./chunk-CX3CS62P.js";
+} from "./chunk-3GF7WSKK.js";
 
 // src/hosted/main.ts
 import { isAbsolute } from "path";
@@ -101,7 +103,12 @@ var TOOL_SCOPES = {
   update_widget: ["mcp:dashboards:write"],
   remove_widget: ["mcp:dashboards:write"],
   generate_widget: ["mcp:dashboards:write", "mcp:query"],
-  list_scheduled_reports: ["mcp:dashboards:read"]
+  list_scheduled_reports: ["mcp:dashboards:read"],
+  custom_chart_scaffold: [],
+  custom_chart_validate: ["mcp:custom-charts:read"],
+  custom_chart_upload: ["mcp:custom-charts:write"],
+  list_custom_charts: ["mcp:custom-charts:read"],
+  publish_custom_chart: ["mcp:custom-charts:write"]
 };
 function requiredScopes(name) {
   if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, "tool_not_authorized");
@@ -220,6 +227,11 @@ function createHostedToolServer(principal, adapter) {
 }
 
 // src/hosted/http.ts
+var HEALTH_BODY = JSON.stringify({ status: "ok" });
+function healthPath(url) {
+  const path = (url || "/").split("?")[0];
+  return path === "/health";
+}
 function reply(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
   res.end(JSON.stringify(body));
@@ -241,6 +253,20 @@ function createHostedHttpServer(config, adapter, pats) {
   const verify = createBearerVerifier(adapter, config.publicUrl, pats);
   let active = 0;
   const server = createServer(async (req, res) => {
+    if (healthPath(req.url)) {
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { Allow: "GET, HEAD", "Cache-Control": "no-store" });
+        res.end();
+        return;
+      }
+      res.writeHead(200, {
+        "Content-Type": "application/json",
+        "Cache-Control": "no-store",
+        "Content-Length": Buffer.byteLength(HEALTH_BODY)
+      });
+      res.end(req.method === "HEAD" ? void 0 : HEALTH_BODY);
+      return;
+    }
     res.setHeader("X-Content-Type-Options", "nosniff");
     if (config.testOnly) res.setHeader("X-Databrain-Test-Only", "true");
     try {
@@ -403,7 +429,7 @@ async function startHosted() {
   if (config.testOnly) {
     const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;
     if (!file || !isAbsolute(file)) throw new Error("Hosted test mode requires an absolute fixture store path.");
-    const { createTestOnlyAdapter } = await import("./test-only-B4EVUNFU.js");
+    const { createTestOnlyAdapter } = await import("./test-only-TJ3DQUYW.js");
     adapter = createTestOnlyAdapter(file);
   } else {
     const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;
@@ -442,4 +468,4 @@ async function startHosted() {
 export {
   startHosted
 };
-//# sourceMappingURL=main-VPCN2764.js.map
+//# sourceMappingURL=main-Q6XT4O46.js.map

package/dist/main-Q6XT4O46.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hosted/main.ts","../src/hosted/config.ts","../src/hosted/http.ts","../src/hosted/server.ts","../src/hosted/authorization.ts","../src/hosted/provider.ts"],"sourcesContent":["import { isAbsolute } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { loadHostedConfig } from './config.js';\nimport { FilePatStore } from './auth.js';\nimport { createHostedHttpServer } from './http.js';\nimport type { HostedAdapter } from './types.js';\nimport { createProviderAdapter } from './provider.js';\n\nexport async function startHosted(): Promise<void> {\n  const config = loadHostedConfig();\n  let adapter: HostedAdapter;\n  if (config.testOnly) {\n    const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;\n    if (!file || !isAbsolute(file)) throw new Error('Hosted test mode requires an absolute fixture store path.');\n    const { createTestOnlyAdapter } = await import('./test-only.js');\n    adapter = createTestOnlyAdapter(file);\n  } else {\n    const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;\n    if (!file) {\n      adapter = createProviderAdapter(config);\n      process.stderr.write('[databrain] OAuth verification configured; backend data operations and PAT membership require a delegated adapter.\\n');\n    } else {\n      if (!isAbsolute(file)) throw new Error('DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.');\n      try { adapter = (await import(pathToFileURL(file).href)).adapter; }\n      catch { throw new Error('Could not load the trusted hosted adapter.'); }\n    }\n    if (!adapter || ['verifyOAuth', 'resolvePatGrant', 'executeRequest'].some(key =>\n      typeof adapter[key as keyof HostedAdapter] !== 'function')) throw new Error('Invalid trusted hosted adapter.');\n  }\n  const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;\n  if (patPath && !isAbsolute(patPath)) throw new Error('Hosted PAT store must be an absolute path.');\n  const server = createHostedHttpServer(config, adapter, patPath ? new FilePatStore(patPath) : undefined);\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(config.port, config.bind, resolve);\n  });\n  process.stderr.write(`[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? ' — TEST ONLY: synthetic identity and data; no OAuth consent' : ''}\\n`);\n  const shutdown = () => {\n    server.close(() => process.exit(0));\n    setTimeout(() => { server.closeAllConnections(); process.exit(0); }, 5000).unref();\n  };\n  process.once('SIGINT', shutdown);\n  process.once('SIGTERM', shutdown);\n}\n","import type { HostedConfig } from './types.js';\n\nexport function loadHostedConfig(env: NodeJS.ProcessEnv = process.env): HostedConfig {\n  const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === '1';\n  if (testOnly && env.NODE_ENV === 'production') throw new Error('Hosted test mode is forbidden in production.');\n  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly) throw new Error('Invalid DATABRAIN_HOSTED_TEST_ONLY.');\n  const validUrl = (value: string | undefined, field: string) => {\n    try {\n      if (!value) throw new Error();\n      const url = new URL(value);\n      if (url.username || url.password || url.search || url.hash || url.protocol !== 'https:') throw new Error();\n      return url;\n    } catch { throw new Error(`Configure ${field} as an HTTPS URL without credentials, query or fragment.`); }\n  };\n  const publicUrl = validUrl(env.DATABRAIN_HOSTED_PUBLIC_URL, 'DATABRAIN_HOSTED_PUBLIC_URL');\n  validUrl(env.DATABRAIN_HOSTED_ISSUER, 'DATABRAIN_HOSTED_ISSUER');\n  if (publicUrl.pathname !== '/mcp') throw new Error('DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.');\n  const port = Number(env.DATABRAIN_HOSTED_PORT || '3144');\n  // Loopback by default so a laptop run is not silently on the network. A\n  // container has to be told, because binding loopback inside a task means the\n  // load balancer health check can never reach it and the service never\n  // stabilises. Set DATABRAIN_HOSTED_BIND=0.0.0.0 in ECS.\n  const bind = env.DATABRAIN_HOSTED_BIND || '127.0.0.1';\n  if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid DATABRAIN_HOSTED_PORT.');\n  return { publicUrl: env.DATABRAIN_HOSTED_PUBLIC_URL!, issuer: env.DATABRAIN_HOSTED_ISSUER!, port,\n    bind, testOnly };\n}\n","import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { createHostedToolServer } from './server.js';\nimport { createBearerVerifier } from './auth.js';\nimport { authorizeTool, assertBoundArguments, requiredScopes } from './authorization.js';\nimport { HOSTED_SCOPES, HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedConfig, PatStore } from './types.js';\n\nconst HEALTH_BODY = JSON.stringify({ status: 'ok' });\n\n/** Exactly `/health`, with or without a query string; `/health/x` is not health. */\nfunction healthPath(url: string | undefined): boolean {\n  const path = (url || '/').split('?')[0];\n  return path === '/health';\n}\n\nfunction reply(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });\n  res.end(JSON.stringify(body));\n}\n\nasync function readBody(req: IncomingMessage): Promise<unknown> {\n  let size = 0;\n  const chunks: Buffer[] = [];\n  for await (const chunk of req) {\n    size += chunk.length;\n    if (size > 1_048_576) throw new Error('body_too_large');\n    chunks.push(Buffer.from(chunk));\n  }\n  return JSON.parse(Buffer.concat(chunks).toString('utf8'));\n}\n\nexport function createHostedHttpServer(config: HostedConfig, adapter: HostedAdapter, pats?: PatStore) {\n  const publicUrl = new URL(config.publicUrl);\n  const metadataPath = `/.well-known/oauth-protected-resource${publicUrl.pathname === '/' ? '' : publicUrl.pathname}`;\n  const metadataUrl = `${publicUrl.origin}${metadataPath}`;\n  const verify = createBearerVerifier(adapter, config.publicUrl, pats);\n  let active = 0;\n\n  const server = createServer(async (req, res) => {\n    // Liveness for the load balancer. It arrives with the target IP:port as Host,\n    // so it runs before the Host/Origin checks and sets no CORS headers. It is\n    // unauthenticated, reads no body and never echoes configuration.\n    if (healthPath(req.url)) {\n      if (req.method !== 'GET' && req.method !== 'HEAD') {\n        res.writeHead(405, { Allow: 'GET, HEAD', 'Cache-Control': 'no-store' }); res.end(); return;\n      }\n      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store',\n        'Content-Length': Buffer.byteLength(HEALTH_BODY) });\n      res.end(req.method === 'HEAD' ? undefined : HEALTH_BODY); return;\n    }\n    res.setHeader('X-Content-Type-Options', 'nosniff');\n    if (config.testOnly) res.setHeader('X-Databrain-Test-Only', 'true');\n    try {\n      // Tailscale Serve may preserve the public Host or use the loopback destination.\n      // Never use Host/Forwarded headers to construct discovery URLs or trust an identity.\n      const localPort = (server.address() as { port: number } | null)?.port;\n      if (![publicUrl.host, `127.0.0.1:${localPort}`, `localhost:${localPort}`].includes(req.headers.host || '')) {\n        reply(res, 403, { error: 'invalid_host' }); return;\n      }\n      if (req.headers.origin && req.headers.origin !== publicUrl.origin) {\n        reply(res, 403, { error: 'invalid_origin' }); return;\n      }\n      if (req.headers.origin) {\n        res.setHeader('Access-Control-Allow-Origin', publicUrl.origin);\n        res.setHeader('Vary', 'Origin');\n        res.setHeader('Access-Control-Expose-Headers', 'WWW-Authenticate, MCP-Protocol-Version');\n      }\n      const url = new URL(req.url || '/', publicUrl.origin);\n      if (req.method === 'GET' && [metadataPath, '/.well-known/oauth-protected-resource'].includes(url.pathname)) {\n        reply(res, 200, {\n          resource: config.publicUrl, authorization_servers: [config.issuer],\n          scopes_supported: HOSTED_SCOPES, bearer_methods_supported: ['header'],\n          resource_name: config.testOnly ? 'Databrain (TEST ONLY; fixture identity)' : 'Databrain',\n        }); return;\n      }\n      if (url.pathname !== publicUrl.pathname) { reply(res, 404, { error: 'not_found' }); return; }\n      if (url.search) { reply(res, 400, { error: 'query_parameters_not_supported' }); return; }\n      if (req.method === 'OPTIONS') {\n        res.setHeader('Access-Control-Allow-Methods', 'POST, GET, DELETE, OPTIONS');\n        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id');\n        res.writeHead(204); res.end(); return;\n      }\n      // Duplicate Authorization fields and cookies never select a principal.\n      const authFields = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'authorization');\n      const match = /^Bearer ([^\\s]+)$/i.exec(req.headers.authorization || '');\n      if (authFields.length !== 1 || !match) throw new HostedAuthError(401, 'invalid_token');\n      const principal = await verify(match[1]);\n      if (req.method !== 'POST') {\n        res.setHeader('Allow', 'POST, OPTIONS');\n        reply(res, 405, { error: 'method_not_allowed' }); return;\n      }\n      if (!req.headers['content-type']?.toLowerCase().startsWith('application/json')) {\n        reply(res, 415, { error: 'unsupported_media_type' }); return;\n      }\n      if (active >= 32) { reply(res, 503, { error: 'server_busy' }); return; }\n      active++;\n      let body: any;\n      try { body = await readBody(req); }\n      catch { active--; reply(res, 400, { error: 'invalid_request' }); return; }\n      try {\n        // The installed SDK accepts batches; this endpoint does not. A batch must\n        // never skip the per-call HTTP authorization/challenge path below.\n        if (Array.isArray(body)) { reply(res, 400, { error: 'batch_not_supported' }); return; }\n        if (body?.method === 'tools/call' && typeof body.params?.name === 'string') {\n          try {\n            authorizeTool(body.params.name, principal);\n            assertBoundArguments(body.params.arguments, principal);\n          } catch (error) {\n            if (error instanceof HostedAuthError && error.code === 'insufficient_scope') {\n              res.setHeader('WWW-Authenticate', `Bearer error=\"insufficient_scope\", resource_metadata=\"${metadataUrl}\", scope=\"${requiredScopes(body.params.name).join(' ')}\"`);\n            }\n            throw error;\n          }\n        }\n        const mcp = createHostedToolServer(principal, adapter);\n        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });\n        let closed = false;\n        const close = () => { if (!closed) { closed = true; void mcp.close(); } };\n        res.once('close', close);\n        try {\n          await mcp.connect(transport);\n          await transport.handleRequest(req, res, body);\n        } finally { if (res.writableEnded) close(); }\n      } finally { active--; }\n    } catch (error) {\n      if (res.headersSent) { res.end(); return; }\n      const status = error instanceof HostedAuthError ? error.status : 503;\n      if (status === 401) res.setHeader('WWW-Authenticate', `Bearer error=\"invalid_token\", resource_metadata=\"${metadataUrl}\"`);\n      reply(res, status, { error: error instanceof HostedAuthError ? error.code : 'temporarily_unavailable' });\n    }\n  });\n  server.requestTimeout = 30_000;\n  server.headersTimeout = 10_000;\n  server.keepAliveTimeout = 5_000;\n  return server;\n}\n","import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { instrument } from '@posthog/mcp';\nimport { PostHog } from 'posthog-node';\nimport { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { registerAllTools } from '../tools/registry.js';\nimport { registerAllResources } from '../resources/registry.js';\nimport { registerAllPrompts } from '../prompts/registry.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { DatabrainApiError, toolError, toolSuccess } from '../utils/errors.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { assertBoundArguments, authorizeTool } from './authorization.js';\nimport { HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedPrincipal } from './types.js';\n\n// Stdio's instrumentation changes the wire schema (required `context`). Use that\n// same implementation, with capture disabled until hosted telemetry has an owner.\n// No bearer, request headers, tool arguments or results are sent to analytics.\nconst schemaInstrumentation = new PostHog('hosted-contract-only', { disabled: true });\n\n/** A request-local client: shared APIs/tools run unchanged, through a delegated executor. */\nclass HostedClient extends DatabrainClient {\n  constructor(private readonly adapter: HostedAdapter, private readonly principal: HostedPrincipal) {\n    super({ apiUrl: 'https://api.usedatabrain.com', demoDomain: 'https://demo.usedatabrain.com' });\n  }\n  // A generated API credential must never replace the authorizing hosted principal.\n  override setRuntimeApiToken(_token: string): void {}\n\n  override async request<T>(options: RequestOptions): Promise<T> {\n    try {\n      const name = toolContext.getStore()?.tool;\n      if (!name) throw new HostedAuthError(403, 'tool_not_authorized');\n      authorizeTool(name, this.principal);\n      assertBoundArguments(options.body, this.principal);\n      assertBoundArguments(options.query, this.principal);\n      const raw = await this.adapter.executeRequest(structuredClone(options), structuredClone(this.principal));\n      if (!options.skipDataUnwrap && raw && typeof raw === 'object' && !Array.isArray(raw) &&\n          'data' in raw && raw.data !== null && raw.data !== undefined) return raw.data as T;\n      return raw as T;\n    } catch (error) {\n      // The adapter may encounter secret-bearing remote bodies. Do not pass them to tools/logs.\n      const status = error instanceof HostedAuthError ? error.status : 503;\n      throw new DatabrainApiError(status, 'HOSTED_REQUEST_DENIED',\n        'The authorized backend could not complete this request. Check workspace access and hosted integration.');\n    }\n  }\n}\n\nexport function createHostedToolServer(principal: HostedPrincipal, adapter: HostedAdapter): McpServer {\n  const bound = structuredClone(principal);\n  const server = new McpServer({ name: 'databrain', version: MCP_SERVER_VERSION }, {\n    instructions: 'Hosted Databrain: each request is authenticated as a user in one authorized workspace. ' +\n      'Use whoami to inspect the verified identity and scopes. Never ask for a service token or put credentials in tool arguments. ' +\n      'Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply.',\n  });\n\n  // The existing shared registry already wraps server.tool for intent telemetry. Layer\n  // hosted policy underneath it; keep every schema, description, annotation and handler.\n  const register = server.tool.bind(server) as (...args: any[]) => unknown;\n  server.tool = ((...args: any[]) => {\n    const name = args[0] as string;\n    const index = args.length - 1;\n    const handler = args[index] as (...values: any[]) => unknown;\n    const shape = args[2] as Record<string, unknown>;\n    args[index] = async (...values: any[]) => {\n      try {\n        authorizeTool(name, bound);\n        assertBoundArguments(values[0], bound);\n        if (name === 'whoami') {\n          return toolSuccess(JSON.stringify({\n            status: 'authenticated', activeBearer: bound.credentialType,\n            actorKind: bound.actorKind, userId: bound.userId, companyId: bound.companyId,\n            workspaceId: bound.workspaceId, workspaceName: bound.workspaceName,\n            oauthClientId: bound.clientId, scopes: bound.scopes,\n          }));\n        }\n        // Required selectors retain their public schema; matching inputs are always replaced\n        // by the trusted value. Optional selectors are supplied when that tool declares them.\n        if (shape && typeof shape === 'object' && values[0] && typeof values[0] === 'object') {\n          for (const key of ['workspaceName', 'workspaceId'] as const) {\n            if (Object.hasOwn(shape, key) && bound[key] !== undefined) values[0][key] = bound[key];\n          }\n        }\n        return await handler(...values);\n      } catch {\n        return toolError('Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.');\n      }\n    };\n    return register(...args);\n  }) as McpServer['tool'];\n\n  registerAllTools(server, new HostedClient(adapter, bound));\n  registerAllResources(server);\n  registerAllPrompts(server);\n  instrument(server, schemaInstrumentation, { beforeSend: () => null });\n  return server;\n}\n","import { HostedAuthError } from './types.js';\nimport type { HostedPrincipal, HostedScope } from './types.js';\n\n/** Explicit exhaustive policy: a newly registered tool is denied until it gets a policy. */\nexport const TOOL_SCOPES: Readonly<Record<string, readonly HostedScope[]>> = {\n  whoami: [],\n  list_datasources: ['mcp:datamarts:read'], discover_datasource_schema: ['mcp:datamarts:read'],\n  list_datamarts: ['mcp:datamarts:read'], list_workspaces: ['mcp:datamarts:read'],\n  sync_datasource: ['mcp:datamarts:write'], create_datamart: ['mcp:datamarts:write'],\n  list_data_apps: ['mcp:dashboards:read'], list_tenants: ['mcp:dashboards:read'],\n  create_data_app: ['mcp:embeds:write'], list_api_tokens: ['mcp:embeds:write'],\n  create_api_token: ['mcp:embeds:write'], rotate_api_token: ['mcp:embeds:write'],\n  create_embed: ['mcp:embeds:write'], list_embeds: ['mcp:dashboards:read'],\n  get_embed_details: ['mcp:dashboards:read'], update_embed: ['mcp:embeds:write'],\n  customize_embed_theme: ['mcp:embeds:write'], get_demo_link: ['mcp:embeds:write'],\n  generate_guest_token: ['mcp:embeds:write'], generate_embed_code: ['mcp:dashboards:read'],\n  list_dashboards: ['mcp:dashboards:read'], create_dashboard: ['mcp:dashboards:write'],\n  get_dashboard: ['mcp:dashboards:read'], generate_dashboard_tiles: ['mcp:dashboards:write', 'mcp:query'],\n  ask_question: ['mcp:query'], get_semantic_layer: ['mcp:datamarts:read'],\n  update_semantic_layer: ['mcp:datamarts:write'], start_semantic_layer_generation: ['mcp:datamarts:write'],\n  get_semantic_layer_generation_status: ['mcp:datamarts:read'],\n  list_widgets: ['mcp:dashboards:read'], validate_metric_spec: ['mcp:dashboards:read', 'mcp:query'],\n  create_or_update_metric_from_query: ['mcp:dashboards:write', 'mcp:query'],\n  create_workspace_metric: ['mcp:dashboards:write', 'mcp:query'],\n  add_widget: ['mcp:dashboards:write'], update_widget: ['mcp:dashboards:write'],\n  remove_widget: ['mcp:dashboards:write'], generate_widget: ['mcp:dashboards:write', 'mcp:query'],\n  list_scheduled_reports: ['mcp:dashboards:read'],\n  custom_chart_scaffold: [], custom_chart_validate: ['mcp:custom-charts:read'],\n  custom_chart_upload: ['mcp:custom-charts:write'], list_custom_charts: ['mcp:custom-charts:read'],\n  publish_custom_chart: ['mcp:custom-charts:write'],\n};\n\nexport function requiredScopes(name: string): readonly HostedScope[] {\n  if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, 'tool_not_authorized');\n  return TOOL_SCOPES[name];\n}\n\nexport function authorizeTool(name: string, principal: HostedPrincipal): void {\n  if (principal.expiresAt !== undefined && principal.expiresAt <= Date.now() / 1000) throw new HostedAuthError(401, 'invalid_token');\n  if (requiredScopes(name).some(scope => !principal.scopes.includes(scope))) throw new HostedAuthError(403, 'insufficient_scope');\n}\n\n/** Reject conflicting selectors even in raw body passthroughs before a handler can use them. */\nexport function assertBoundArguments(value: unknown, principal: HostedPrincipal): void {\n  if (!value || typeof value !== 'object') return;\n  for (const [key, child] of Object.entries(value)) {\n    if (['workspaceId', 'workspaceName', 'companyId', 'userId'].includes(key) &&\n        child !== principal[key as 'workspaceId' | 'workspaceName' | 'companyId' | 'userId']) {\n      throw new HostedAuthError(403, 'principal_mismatch');\n    }\n    if (['scope', 'scopes', 'authUser', 'actorKind', 'credentialType', 'oauthClientId', 'operatorEmail',\n      'session_variables', 'isAllClient', 'isAdmin', 'serviceToken', 'apiToken', 'authorization'].includes(key)) {\n      throw new HostedAuthError(403, 'identity_argument_forbidden');\n    }\n    if (['clientId', 'tenantId'].includes(key) &&\n        (typeof child !== 'string' || !principal.tenantIds?.includes(child))) {\n      throw new HostedAuthError(403, 'tenant_not_authorized');\n    }\n    assertBoundArguments(child, principal);\n  }\n}\n","import { z } from 'zod';\nimport { principalSchema } from './auth.js';\nimport { HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedConfig } from './types.js';\n\n/** BE-3's documented principal endpoint is the trust boundary for opaque OAuth tokens. */\nexport function createProviderAdapter(config: HostedConfig): HostedAdapter {\n  const issuer = new URL(config.issuer);\n  if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash) {\n    throw new Error('Invalid hosted authorization server configuration.');\n  }\n  const endpoint = `${config.issuer.replace(/\\/$/, '')}/oauth/principal`;\n  const responseSchema = principalSchema.extend({ issuer: z.literal(config.issuer) }).strip();\n  return {\n    async verifyOAuth(token, resource) {\n      try {\n        // Only the explicitly configured issuer ever receives the token, for verification.\n        // No redirects, arbitrary token URLs, cache, service-token fallback or REST replay.\n        const response = await fetch(endpoint, {\n          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },\n          redirect: 'error', signal: AbortSignal.timeout(10_000),\n        });\n        if (!response.ok) throw new HostedAuthError(response.status >= 500 ? 503 : 401, 'invalid_token');\n        const { issuer: _issuer, ...principal } = responseSchema.parse(await response.json());\n        if (principal.resource !== resource || principal.credentialType !== 'oauth') throw new HostedAuthError(401, 'invalid_token');\n        return principal;\n      } catch (error) {\n        if (error instanceof HostedAuthError) throw error;\n        throw new HostedAuthError(401, 'invalid_token');\n      }\n    },\n    async resolvePatGrant() { throw new HostedAuthError(401, 'pat_membership_adapter_required'); },\n    async executeRequest() { throw new HostedAuthError(503, 'delegated_backend_adapter_required'); },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;;;ACCvB,SAAS,iBAAiB,MAAyB,QAAQ,KAAmB;AACnF,QAAM,WAAW,IAAI,+BAA+B;AACpD,MAAI,YAAY,IAAI,aAAa,aAAc,OAAM,IAAI,MAAM,8CAA8C;AAC7G,MAAI,IAAI,8BAA8B,CAAC,SAAU,OAAM,IAAI,MAAM,qCAAqC;AACtG,QAAM,WAAW,CAAC,OAA2B,UAAkB;AAC7D,QAAI;AACF,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,YAAM,MAAM,IAAI,IAAI,KAAK;AACzB,UAAI,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QAAQ,IAAI,aAAa,SAAU,OAAM,IAAI,MAAM;AACzG,aAAO;AAAA,IACT,QAAQ;AAAE,YAAM,IAAI,MAAM,aAAa,KAAK,0DAA0D;AAAA,IAAG;AAAA,EAC3G;AACA,QAAM,YAAY,SAAS,IAAI,6BAA6B,6BAA6B;AACzF,WAAS,IAAI,yBAAyB,yBAAyB;AAC/D,MAAI,UAAU,aAAa,OAAQ,OAAM,IAAI,MAAM,+CAA+C;AAClG,QAAM,OAAO,OAAO,IAAI,yBAAyB,MAAM;AAKvD,QAAM,OAAO,IAAI,yBAAyB;AAC1C,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,QAAQ,OAAO,MAAO,OAAM,IAAI,MAAM,gCAAgC;AAC5G,SAAO;AAAA,IAAE,WAAW,IAAI;AAAA,IAA8B,QAAQ,IAAI;AAAA,IAA0B;AAAA,IAC1F;AAAA,IAAM;AAAA,EAAS;AACnB;;;AC1BA,SAAS,oBAA+D;AACxE,SAAS,qCAAqC;;;ACD9C,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;;;ACEjB,IAAM,cAAgE;AAAA,EAC3E,QAAQ,CAAC;AAAA,EACT,kBAAkB,CAAC,oBAAoB;AAAA,EAAG,4BAA4B,CAAC,oBAAoB;AAAA,EAC3F,gBAAgB,CAAC,oBAAoB;AAAA,EAAG,iBAAiB,CAAC,oBAAoB;AAAA,EAC9E,iBAAiB,CAAC,qBAAqB;AAAA,EAAG,iBAAiB,CAAC,qBAAqB;AAAA,EACjF,gBAAgB,CAAC,qBAAqB;AAAA,EAAG,cAAc,CAAC,qBAAqB;AAAA,EAC7E,iBAAiB,CAAC,kBAAkB;AAAA,EAAG,iBAAiB,CAAC,kBAAkB;AAAA,EAC3E,kBAAkB,CAAC,kBAAkB;AAAA,EAAG,kBAAkB,CAAC,kBAAkB;AAAA,EAC7E,cAAc,CAAC,kBAAkB;AAAA,EAAG,aAAa,CAAC,qBAAqB;AAAA,EACvE,mBAAmB,CAAC,qBAAqB;AAAA,EAAG,cAAc,CAAC,kBAAkB;AAAA,EAC7E,uBAAuB,CAAC,kBAAkB;AAAA,EAAG,eAAe,CAAC,kBAAkB;AAAA,EAC/E,sBAAsB,CAAC,kBAAkB;AAAA,EAAG,qBAAqB,CAAC,qBAAqB;AAAA,EACvF,iBAAiB,CAAC,qBAAqB;AAAA,EAAG,kBAAkB,CAAC,sBAAsB;AAAA,EACnF,eAAe,CAAC,qBAAqB;AAAA,EAAG,0BAA0B,CAAC,wBAAwB,WAAW;AAAA,EACtG,cAAc,CAAC,WAAW;AAAA,EAAG,oBAAoB,CAAC,oBAAoB;AAAA,EACtE,uBAAuB,CAAC,qBAAqB;AAAA,EAAG,iCAAiC,CAAC,qBAAqB;AAAA,EACvG,sCAAsC,CAAC,oBAAoB;AAAA,EAC3D,cAAc,CAAC,qBAAqB;AAAA,EAAG,sBAAsB,CAAC,uBAAuB,WAAW;AAAA,EAChG,oCAAoC,CAAC,wBAAwB,WAAW;AAAA,EACxE,yBAAyB,CAAC,wBAAwB,WAAW;AAAA,EAC7D,YAAY,CAAC,sBAAsB;AAAA,EAAG,eAAe,CAAC,sBAAsB;AAAA,EAC5E,eAAe,CAAC,sBAAsB;AAAA,EAAG,iBAAiB,CAAC,wBAAwB,WAAW;AAAA,EAC9F,wBAAwB,CAAC,qBAAqB;AAAA,EAC9C,uBAAuB,CAAC;AAAA,EAAG,uBAAuB,CAAC,wBAAwB;AAAA,EAC3E,qBAAqB,CAAC,yBAAyB;AAAA,EAAG,oBAAoB,CAAC,wBAAwB;AAAA,EAC/F,sBAAsB,CAAC,yBAAyB;AAClD;AAEO,SAAS,eAAe,MAAsC;AACnE,MAAI,CAAC,OAAO,OAAO,aAAa,IAAI,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AAC3F,SAAO,YAAY,IAAI;AACzB;AAEO,SAAS,cAAc,MAAc,WAAkC;AAC5E,MAAI,UAAU,cAAc,UAAa,UAAU,aAAa,KAAK,IAAI,IAAI,IAAM,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACjI,MAAI,eAAe,IAAI,EAAE,KAAK,WAAS,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC,EAAG,OAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAChI;AAGO,SAAS,qBAAqB,OAAgB,WAAkC;AACrF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,CAAC,eAAe,iBAAiB,aAAa,QAAQ,EAAE,SAAS,GAAG,KACpE,UAAU,UAAU,GAA+D,GAAG;AACxF,YAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,IACrD;AACA,QAAI;AAAA,MAAC;AAAA,MAAS;AAAA,MAAU;AAAA,MAAY;AAAA,MAAa;AAAA,MAAkB;AAAA,MAAiB;AAAA,MAClF;AAAA,MAAqB;AAAA,MAAe;AAAA,MAAW;AAAA,MAAgB;AAAA,MAAY;AAAA,IAAe,EAAE,SAAS,GAAG,GAAG;AAC3G,YAAM,IAAI,gBAAgB,KAAK,6BAA6B;AAAA,IAC9D;AACA,QAAI,CAAC,YAAY,UAAU,EAAE,SAAS,GAAG,MACpC,OAAO,UAAU,YAAY,CAAC,UAAU,WAAW,SAAS,KAAK,IAAI;AACxE,YAAM,IAAI,gBAAgB,KAAK,uBAAuB;AAAA,IACxD;AACA,yBAAqB,OAAO,SAAS;AAAA,EACvC;AACF;;;AD1CA,IAAM,wBAAwB,IAAI,QAAQ,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAGpF,IAAM,eAAN,cAA2B,gBAAgB;AAAA,EACzC,YAA6B,SAAyC,WAA4B;AAChG,UAAM,EAAE,QAAQ,gCAAgC,YAAY,gCAAgC,CAAC;AADlE;AAAyC;AAAA,EAEtE;AAAA;AAAA,EAES,mBAAmB,QAAsB;AAAA,EAAC;AAAA,EAEnD,MAAe,QAAW,SAAqC;AAC7D,QAAI;AACF,YAAM,OAAO,YAAY,SAAS,GAAG;AACrC,UAAI,CAAC,KAAM,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AAC/D,oBAAc,MAAM,KAAK,SAAS;AAClC,2BAAqB,QAAQ,MAAM,KAAK,SAAS;AACjD,2BAAqB,QAAQ,OAAO,KAAK,SAAS;AAClD,YAAM,MAAM,MAAM,KAAK,QAAQ,eAAe,gBAAgB,OAAO,GAAG,gBAAgB,KAAK,SAAS,CAAC;AACvG,UAAI,CAAC,QAAQ,kBAAkB,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAC/E,UAAU,OAAO,IAAI,SAAS,QAAQ,IAAI,SAAS,OAAW,QAAO,IAAI;AAC7E,aAAO;AAAA,IACT,SAAS,OAAO;AAEd,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,YAAM,IAAI;AAAA,QAAkB;AAAA,QAAQ;AAAA,QAClC;AAAA,MAAwG;AAAA,IAC5G;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,WAA4B,SAAmC;AACpG,QAAM,QAAQ,gBAAgB,SAAS;AACvC,QAAM,SAAS,IAAI,UAAU,EAAE,MAAM,aAAa,SAAS,mBAAmB,GAAG;AAAA,IAC/E,cAAc;AAAA,EAGhB,CAAC;AAID,QAAM,WAAW,OAAO,KAAK,KAAK,MAAM;AACxC,SAAO,QAAQ,IAAI,SAAgB;AACjC,UAAM,OAAO,KAAK,CAAC;AACnB,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,QAAQ,KAAK,CAAC;AACpB,SAAK,KAAK,IAAI,UAAU,WAAkB;AACxC,UAAI;AACF,sBAAc,MAAM,KAAK;AACzB,6BAAqB,OAAO,CAAC,GAAG,KAAK;AACrC,YAAI,SAAS,UAAU;AACrB,iBAAO,YAAY,KAAK,UAAU;AAAA,YAChC,QAAQ;AAAA,YAAiB,cAAc,MAAM;AAAA,YAC7C,WAAW,MAAM;AAAA,YAAW,QAAQ,MAAM;AAAA,YAAQ,WAAW,MAAM;AAAA,YACnE,aAAa,MAAM;AAAA,YAAa,eAAe,MAAM;AAAA,YACrD,eAAe,MAAM;AAAA,YAAU,QAAQ,MAAM;AAAA,UAC/C,CAAC,CAAC;AAAA,QACJ;AAGA,YAAI,SAAS,OAAO,UAAU,YAAY,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,MAAM,UAAU;AACpF,qBAAW,OAAO,CAAC,iBAAiB,aAAa,GAAY;AAC3D,gBAAI,OAAO,OAAO,OAAO,GAAG,KAAK,MAAM,GAAG,MAAM,OAAW,QAAO,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG;AAAA,UACvF;AAAA,QACF;AACA,eAAO,MAAM,QAAQ,GAAG,MAAM;AAAA,MAChC,QAAQ;AACN,eAAO,UAAU,oGAAoG;AAAA,MACvH;AAAA,IACF;AACA,WAAO,SAAS,GAAG,IAAI;AAAA,EACzB;AAEA,mBAAiB,QAAQ,IAAI,aAAa,SAAS,KAAK,CAAC;AACzD,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AACzB,aAAW,QAAQ,uBAAuB,EAAE,YAAY,MAAM,KAAK,CAAC;AACpE,SAAO;AACT;;;ADxFA,IAAM,cAAc,KAAK,UAAU,EAAE,QAAQ,KAAK,CAAC;AAGnD,SAAS,WAAW,KAAkC;AACpD,QAAM,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AACtC,SAAO,SAAS;AAClB;AAEA,SAAS,MAAM,KAAqB,QAAgB,MAAqB;AACvE,MAAI,UAAU,QAAQ,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW,CAAC;AACzF,MAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,eAAe,SAAS,KAAwC;AAC9D,MAAI,OAAO;AACX,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,KAAK;AAC7B,YAAQ,MAAM;AACd,QAAI,OAAO,QAAW,OAAM,IAAI,MAAM,gBAAgB;AACtD,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAC1D;AAEO,SAAS,uBAAuB,QAAsB,SAAwB,MAAiB;AACpG,QAAM,YAAY,IAAI,IAAI,OAAO,SAAS;AAC1C,QAAM,eAAe,wCAAwC,UAAU,aAAa,MAAM,KAAK,UAAU,QAAQ;AACjH,QAAM,cAAc,GAAG,UAAU,MAAM,GAAG,YAAY;AACtD,QAAM,SAAS,qBAAqB,SAAS,OAAO,WAAW,IAAI;AACnE,MAAI,SAAS;AAEb,QAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;AAI9C,QAAI,WAAW,IAAI,GAAG,GAAG;AACvB,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,YAAI,UAAU,KAAK,EAAE,OAAO,aAAa,iBAAiB,WAAW,CAAC;AAAG,YAAI,IAAI;AAAG;AAAA,MACtF;AACA,UAAI,UAAU,KAAK;AAAA,QAAE,gBAAgB;AAAA,QAAoB,iBAAiB;AAAA,QACxE,kBAAkB,OAAO,WAAW,WAAW;AAAA,MAAE,CAAC;AACpD,UAAI,IAAI,IAAI,WAAW,SAAS,SAAY,WAAW;AAAG;AAAA,IAC5D;AACA,QAAI,UAAU,0BAA0B,SAAS;AACjD,QAAI,OAAO,SAAU,KAAI,UAAU,yBAAyB,MAAM;AAClE,QAAI;AAGF,YAAM,YAAa,OAAO,QAAQ,GAA+B;AACjE,UAAI,CAAC,CAAC,UAAU,MAAM,aAAa,SAAS,IAAI,aAAa,SAAS,EAAE,EAAE,SAAS,IAAI,QAAQ,QAAQ,EAAE,GAAG;AAC1G,cAAM,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;AAAG;AAAA,MAC9C;AACA,UAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,WAAW,UAAU,QAAQ;AACjE,cAAM,KAAK,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAG;AAAA,MAChD;AACA,UAAI,IAAI,QAAQ,QAAQ;AACtB,YAAI,UAAU,+BAA+B,UAAU,MAAM;AAC7D,YAAI,UAAU,QAAQ,QAAQ;AAC9B,YAAI,UAAU,iCAAiC,wCAAwC;AAAA,MACzF;AACA,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM;AACpD,UAAI,IAAI,WAAW,SAAS,CAAC,cAAc,uCAAuC,EAAE,SAAS,IAAI,QAAQ,GAAG;AAC1G,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,OAAO;AAAA,UAAW,uBAAuB,CAAC,OAAO,MAAM;AAAA,UACjE,kBAAkB;AAAA,UAAe,0BAA0B,CAAC,QAAQ;AAAA,UACpE,eAAe,OAAO,WAAW,4CAA4C;AAAA,QAC/E,CAAC;AAAG;AAAA,MACN;AACA,UAAI,IAAI,aAAa,UAAU,UAAU;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAG;AAAA,MAAQ;AAC5F,UAAI,IAAI,QAAQ;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAG;AAAA,MAAQ;AACxF,UAAI,IAAI,WAAW,WAAW;AAC5B,YAAI,UAAU,gCAAgC,4BAA4B;AAC1E,YAAI,UAAU,gCAAgC,mEAAmE;AACjH,YAAI,UAAU,GAAG;AAAG,YAAI,IAAI;AAAG;AAAA,MACjC;AAEA,YAAM,aAAa,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,WAAW,CAAC,EAAE,YAAY,MAAM,eAAe;AACrH,YAAM,QAAQ,qBAAqB,KAAK,IAAI,QAAQ,iBAAiB,EAAE;AACvE,UAAI,WAAW,WAAW,KAAK,CAAC,MAAO,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACrF,YAAM,YAAY,MAAM,OAAO,MAAM,CAAC,CAAC;AACvC,UAAI,IAAI,WAAW,QAAQ;AACzB,YAAI,UAAU,SAAS,eAAe;AACtC,cAAM,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAG;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,QAAQ,cAAc,GAAG,YAAY,EAAE,WAAW,kBAAkB,GAAG;AAC9E,cAAM,KAAK,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAG;AAAA,MACxD;AACA,UAAI,UAAU,IAAI;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,cAAc,CAAC;AAAG;AAAA,MAAQ;AACvE;AACA,UAAI;AACJ,UAAI;AAAE,eAAO,MAAM,SAAS,GAAG;AAAA,MAAG,QAC5B;AAAE;AAAU,cAAM,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAG;AAAA,MAAQ;AACzE,UAAI;AAGF,YAAI,MAAM,QAAQ,IAAI,GAAG;AAAE,gBAAM,KAAK,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAG;AAAA,QAAQ;AACtF,YAAI,MAAM,WAAW,gBAAgB,OAAO,KAAK,QAAQ,SAAS,UAAU;AAC1E,cAAI;AACF,0BAAc,KAAK,OAAO,MAAM,SAAS;AACzC,iCAAqB,KAAK,OAAO,WAAW,SAAS;AAAA,UACvD,SAAS,OAAO;AACd,gBAAI,iBAAiB,mBAAmB,MAAM,SAAS,sBAAsB;AAC3E,kBAAI,UAAU,oBAAoB,yDAAyD,WAAW,aAAa,eAAe,KAAK,OAAO,IAAI,EAAE,KAAK,GAAG,CAAC,GAAG;AAAA,YAClK;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AACA,cAAM,MAAM,uBAAuB,WAAW,OAAO;AACrD,cAAM,YAAY,IAAI,8BAA8B,EAAE,oBAAoB,QAAW,oBAAoB,KAAK,CAAC;AAC/G,YAAI,SAAS;AACb,cAAM,QAAQ,MAAM;AAAE,cAAI,CAAC,QAAQ;AAAE,qBAAS;AAAM,iBAAK,IAAI,MAAM;AAAA,UAAG;AAAA,QAAE;AACxE,YAAI,KAAK,SAAS,KAAK;AACvB,YAAI;AACF,gBAAM,IAAI,QAAQ,SAAS;AAC3B,gBAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,QAC9C,UAAE;AAAU,cAAI,IAAI,cAAe,OAAM;AAAA,QAAG;AAAA,MAC9C,UAAE;AAAU;AAAA,MAAU;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,IAAI,aAAa;AAAE,YAAI,IAAI;AAAG;AAAA,MAAQ;AAC1C,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,UAAI,WAAW,IAAK,KAAI,UAAU,oBAAoB,oDAAoD,WAAW,GAAG;AACxH,YAAM,KAAK,QAAQ,EAAE,OAAO,iBAAiB,kBAAkB,MAAM,OAAO,0BAA0B,CAAC;AAAA,IACzG;AAAA,EACF,CAAC;AACD,SAAO,iBAAiB;AACxB,SAAO,iBAAiB;AACxB,SAAO,mBAAmB;AAC1B,SAAO;AACT;;;AGxIA,SAAS,SAAS;AAMX,SAAS,sBAAsB,QAAqC;AACzE,QAAM,SAAS,IAAI,IAAI,OAAO,MAAM;AACpC,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtG,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,GAAG,OAAO,OAAO,QAAQ,OAAO,EAAE,CAAC;AACpD,QAAM,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ,EAAE,QAAQ,OAAO,MAAM,EAAE,CAAC,EAAE,MAAM;AAC1F,SAAO;AAAA,IACL,MAAM,YAAY,OAAO,UAAU;AACjC,UAAI;AAGF,cAAM,WAAW,MAAM,MAAM,UAAU;AAAA,UACrC,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,QAAQ,mBAAmB;AAAA,UACxE,UAAU;AAAA,UAAS,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACvD,CAAC;AACD,YAAI,CAAC,SAAS,GAAI,OAAM,IAAI,gBAAgB,SAAS,UAAU,MAAM,MAAM,KAAK,eAAe;AAC/F,cAAM,EAAE,QAAQ,SAAS,GAAG,UAAU,IAAI,eAAe,MAAM,MAAM,SAAS,KAAK,CAAC;AACpF,YAAI,UAAU,aAAa,YAAY,UAAU,mBAAmB,QAAS,OAAM,IAAI,gBAAgB,KAAK,eAAe;AAC3H,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,gBAAiB,OAAM;AAC5C,cAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB;AAAE,YAAM,IAAI,gBAAgB,KAAK,iCAAiC;AAAA,IAAG;AAAA,IAC7F,MAAM,iBAAiB;AAAE,YAAM,IAAI,gBAAgB,KAAK,oCAAoC;AAAA,IAAG;AAAA,EACjG;AACF;;;AL1BA,eAAsB,cAA6B;AACjD,QAAM,SAAS,iBAAiB;AAChC,MAAI;AACJ,MAAI,OAAO,UAAU;AACnB,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,2DAA2D;AAC3G,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,yBAAgB;AAC/D,cAAU,sBAAsB,IAAI;AAAA,EACtC,OAAO;AACL,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,MAAM;AACT,gBAAU,sBAAsB,MAAM;AACtC,cAAQ,OAAO,MAAM,sHAAsH;AAAA,IAC7I,OAAO;AACL,UAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,2DAA2D;AAClG,UAAI;AAAE,mBAAW,MAAM,OAAO,cAAc,IAAI,EAAE,OAAO;AAAA,MAAS,QAC5D;AAAE,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAAG;AAAA,IACzE;AACA,QAAI,CAAC,WAAW,CAAC,eAAe,mBAAmB,gBAAgB,EAAE,KAAK,SACxE,OAAO,QAAQ,GAA0B,MAAM,UAAU,EAAG,OAAM,IAAI,MAAM,iCAAiC;AAAA,EACjH;AACA,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,CAAC,WAAW,OAAO,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACjG,QAAM,SAAS,uBAAuB,QAAQ,SAAS,UAAU,IAAI,aAAa,OAAO,IAAI,MAAS;AACtG,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,OAAO,MAAM,OAAO,MAAM,OAAO;AAAA,EACjD,CAAC;AACD,UAAQ,OAAO,MAAM,oCAAoC,OAAO,IAAI,IAAI,OAAO,IAAI,OAAO,OAAO,WAAW,qEAAgE,EAAE;AAAA,CAAI;AAClL,QAAM,WAAW,MAAM;AACrB,WAAO,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAClC,eAAW,MAAM;AAAE,aAAO,oBAAoB;AAAG,cAAQ,KAAK,CAAC;AAAA,IAAG,GAAG,GAAI,EAAE,MAAM;AAAA,EACnF;AACA,UAAQ,KAAK,UAAU,QAAQ;AAC/B,UAAQ,KAAK,WAAW,QAAQ;AAClC;","names":[]}

package/dist/{test-only-B4EVUNFU.js → test-only-TJ3DQUYW.js}

@@ -3,7 +3,7 @@ import {
   FilePatStore,
   HostedAuthError,
   hashCredential
-} from "./chunk-CX3CS62P.js";
+} from "./chunk-3GF7WSKK.js";
 
 // src/hosted/test-only.ts
 function createTestOnlyAdapter(path) {
@@ -34,4 +34,4 @@ function createTestOnlyAdapter(path) {
 export {
   createTestOnlyAdapter
 };
-//# sourceMappingURL=test-only-B4EVUNFU.js.map
+//# sourceMappingURL=test-only-TJ3DQUYW.js.map

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@databrainhq/mcp-server",
-  "version": "0.3.0-rc.3",
+  "version": "0.3.0-rc.5",
   "description": "MCP server for Databrain embedded analytics - connect databases, create datamarts, configure embeds, and generate frontend code",
   "type": "module",
   "bin": {
     "mcp-server": "dist/index.js",
     "databrain-mcp-server": "dist/index.js",
-    "databrain-mcp-chart-apps": "dist/apps/stdio.js"
+    "databrain-mcp-chart-apps": "dist/apps/stdio.js",
+    "databrain": "dist/cli.js"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -17,7 +18,7 @@
     ".mcp.json"
   ],
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/copy-custom-chart-assets.mjs",
     "dev": "tsx src/index.ts",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -36,6 +37,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@posthog/mcp": "^0.10.7",
+    "esbuild": "0.27.3",
+    "fflate": "0.8.3",
     "posthog-node": "^5.21.2",
     "zod": "^3.24.0"
   },

package/dist/chunk-4LIULTLT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/apps/server.ts","../src/apps/registry.ts","../src/apps/backend.ts","../src/apps/tile.ts"],"sourcesContent":["import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { DatabrainClient } from '../client/databrain-client.js';\nimport type { Config } from '../utils/config.js';\nimport { registerAllTools } from '../tools/registry.js';\nimport { registerAllResources } from '../resources/registry.js';\nimport { registerAllPrompts } from '../prompts/registry.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { enableChartApps } from './feature.js';\nimport { registerChartApps } from './registry.js';\nimport type { ChartBackend } from './backend.js';\n\n/** Reviewable composition seam; hosted owners must retain their principal-bound client/policy. */\nexport function createChartAppServer(config: Config, backend?: ChartBackend): McpServer {\n  const client = new DatabrainClient(config);\n  const server = new McpServer({ name: 'databrain-chart-apps', version: MCP_SERVER_VERSION }, {\n    instructions: 'Use read-only chart previews to inspect analytics. Chart interactions inherit guest scope. ' +\n      'Never request or expose credentials. Mutation tools retain their existing dry-run and confirmation requirements.',\n  });\n  enableChartApps(server);\n  registerAllTools(server, client);\n  registerAllResources(server);\n  registerAllPrompts(server);\n  registerChartApps(server, client, backend);\n  return server;\n}\n","import { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { READ_ONLY } from '../tools/annotations.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { createChartBackend, type ChartBackend, type ChartAction } from './backend.js';\nimport { APP_MIME, CHART_URI, KPI_URI, pageSchema, referenceSchema, viewSchema } from './contract.js';\nimport { appMeta, chartResult } from './feature.js';\nimport { tileHtml } from './tile.js';\n\nconst actions: Record<ChartAction, string> = {\n  render_chart: 'Render one authorized chart page as SVG with point metadata. Cursor pagination stays within the same guest scope.',\n  refresh_widget: 'Refresh a chart in the current guest scope. Revalidates access before returning data.',\n  drill_down: 'Explore a server-issued drill identifier within the current chart and guest scope.',\n  change_date_range: 'Render a chart for an ordered date range within the current guest scope.',\n};\n\n/** Call after registerAllTools so existing registration policy/instrumentation remains active. */\nexport function registerChartApps(server: McpServer, client: DatabrainClient, backend: ChartBackend = createChartBackend(client)): void {\n  for (const [name, description] of Object.entries(actions)) {\n    const action = name as ChartAction;\n    const tool = server.tool(name, description, {\n      reference: referenceSchema, view: viewSchema.default({}),\n      context: z.string().max(200).optional().describe('Chart interaction context'),\n    }, READ_ONLY, async ({ reference, view }) => {\n      try {\n        if ((action === 'drill_down' && !view.drillId) || (action === 'change_date_range' && !view.dateRange)) throw new Error('Missing view selector');\n        const page = pageSchema.parse(await toolContext.run({ tool: name, category: 'embedding', workflowIntent: 'chart_app', inputMode: 'app' },\n          () => backend.execute(action, reference, view)));\n        // SVG is rendered as an isolated image, never inserted into the HTML DOM.\n        // Reject active/external/animated constructs as a further contract check.\n        if (page.svg && (!/^\\s*<svg\\b/i.test(page.svg) ||\n          /<\\s*(?:script|foreignObject|iframe|image|animate\\w*|set)\\b|<!DOCTYPE|<!ENTITY|\\bon\\w+\\s*=|@(?:import|keyframes)|\\banimation\\s*:|(?:href\\s*=\\s*[\"'](?!#)|url\\s*\\(\\s*[\"']?(?!#))/i.test(page.svg))) {\n          throw new Error('Unsafe SVG');\n        }\n        return chartResult(`${page.kind === 'kpi' ? 'KPI' : 'Chart'} ready. ${page.rows.length} rows in this page.`, {\n          ...page, reference, view,\n        });\n      } catch {\n        return { isError: true, content: [{ type: 'text' as const,\n          text: 'Chart unavailable. Check dashboard access and the chart renderer integration, then retry.' }] };\n      }\n    });\n    tool.update({ _meta: appMeta(['app']) });\n  }\n  for (const [uri, kind] of [[CHART_URI, 'chart'], [KPI_URI, 'kpi']] as const) {\n    server.resource(`Databrain ${kind} tile`, uri, { mimeType: APP_MIME, description: `Interactive ${kind} using host theme and scoped server tools` }, async () => ({\n      contents: [{ uri, mimeType: APP_MIME, text: tileHtml(kind), _meta: { ui: { prefersBorder: true } } }],\n    }));\n  }\n}\n","import { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { createServiceBundle } from '../services/factory.js';\nimport { pageSchema, referenceSchema, viewSchema, type ChartPage, type ChartReference, type ChartView } from './contract.js';\n\nexport const RENDER_PATH = '/api/v2/dashboard/mcp-chart';\nexport type ChartAction = 'render_chart' | 'refresh_widget' | 'drill_down' | 'change_date_range';\nexport interface ChartBackend {\n  execute(action: ChartAction, reference: ChartReference, view: ChartView): Promise<ChartPage>;\n}\n\nclass UncachedChartClient extends DatabrainClient {\n  constructor(private readonly delegate: DatabrainClient) {\n    super({ apiUrl: delegate.getApiUrl(), demoDomain: delegate.getDemoDomain() });\n  }\n  override request<T>(options: RequestOptions): Promise<T> {\n    return this.delegate.request<T>({ ...options, cacheKey: undefined, cacheTtlMs: undefined });\n  }\n}\n\n/** Proposed backend route; no local renderer, ambient service fallback, or UI credentials. */\nexport function createChartBackend(client: DatabrainClient): ChartBackend {\n  // The general embed lookup caches for five minutes. Authorization must not.\n  const services = createServiceBundle(new UncachedChartClient(client));\n  return {\n    async execute(action, rawReference, rawView) {\n      const reference = referenceSchema.parse(rawReference);\n      const view = viewSchema.parse(rawView);\n      // Every page/refresh/drill re-reads the embed live, so a revoked tenant stops working at once.\n      const app = await services.widgetService.resolveDataAppName(undefined, reference.embedId);\n      if (!app.ok) throw new Error('Chart scope unavailable');\n      const scope = await services.widgetService.ensureReadableDashboardScope({\n        embedId: reference.embedId, clientId: reference.clientId, dataAppName: app.value });\n      if (!scope.ok) throw new Error('Chart scope denied');\n      const { token } = await services.guestTokenService.generateToken({\n        clientId: reference.clientId, dataAppName: app.value, allowedEmbeds: [reference.embedId],\n        permissions: { isDisableMetricCreation: true, isEnableManageMetrics: false,\n          isEnableMetricUpdation: false, isEnableArchiveMetrics: false },\n      });\n      if (!token) throw new Error('Guest scope unavailable');\n      const page = await client.request<unknown>({\n        method: 'POST', path: RENDER_PATH, auth: 'none', token,\n        body: { action, embedId: reference.embedId, widgetId: reference.widgetId, ...view,\n          pageSize: 50, width: 600, height: 320, animation: false },\n        skipDataUnwrap: true,\n      });\n      return pageSchema.parse(page);\n    },\n  };\n}\n","/** Deliberately no imports in the iframe. All requests go through the host bridge. */\nexport const TILE_SCRIPT = String.raw`(()=>{\nconst $=id=>document.getElementById(id),root=document.documentElement,pending=new Map();\nlet seq=0,origin='*',ready=false,closed=false,ref=null,view={},next=null,context={},busy=false,revision=0,rawSvg=null,dialect=null,shown=false;\n/* One lifecycle, two sets of names. Hosts ship either or both, so notifications go out\n   under both and arrive under either. Same order in both rows: result, input, context. */\nconst DASH=['ui/notifications/tool-result','ui/notifications/tool-input','ui/notifications/host-context-changed'],\nSNAKE=['notifications/tools/call/result','notifications/tools/call/input','notifications/host_context/changed'],\nINIT=['ui/notifications/initialized','notifications/initialized'],\nSIZE=['ui/notifications/size-changed','notifications/size_changed'],\nDISPLAY=['ui/request-display-mode','requestDisplayMode'];\nfunction send(message){if(!closed)parent.postMessage({jsonrpc:'2.0',...message},origin)}\nfunction notify(names,params){for(const method of names)send({method,params})}\nfunction rpc(method,params){return new Promise((resolve,reject)=>{const id=++seq;\nconst timer=setTimeout(()=>{pending.delete(id);reject(Error('timeout'))},30000);\npending.set(id,{resolve,reject,timer});send({id,method,params})})}\n/* Try each alias while the host says it never heard of it; any other error stands. */\nasync function ask(names,params){let last;\nfor(const method of names){try{return await rpc(method,params)}catch(error){last=error;if(error.code!==-32601)throw error}}\nthrow last}\n/* Fixed code only. The tile sits inside customer rows; a log is no place to leak them. */\nfunction trouble(code){send({method:'notifications/error',params:{code}})}\nfunction status(text,bad){const s=$('status');s.textContent=text;s.toggleAttribute('data-error',!!bad);if(bad)$('plot').dataset.state='off'}\nfunction paint(){const img=$('chart-image');if(!img||!rawSvg)return;\nconst c=getComputedStyle(document.body).color,mix=pc=>'color-mix(in srgb,'+c+' '+pc+'%,transparent)';\nimg.src='data:image/svg+xml,'+encodeURIComponent(rawSvg.replace(/<\\/svg>\\s*$/i,'<style>text{fill:'+c+'!important}'\n+'[stroke=\"#dbdee4\"]{stroke:'+mix(13)+'!important}[stroke=\"#54555a\"]{stroke:'+mix(30)+'!important}'\n+'</style></svg>'))}\nfunction controls(){document.querySelectorAll('button,input,select').forEach(e=>{e.disabled=busy});\n$('refresh').hidden=!ref;$('next').hidden=!next;$('range').hidden=!ref;$('plot').toggleAttribute('data-busy',busy);\n$('expand').hidden=!shown||!context.availableDisplayModes?.includes('fullscreen');\nroot.toggleAttribute('data-deep',context.displayMode==='fullscreen'||$('expand').hidden)}\nfunction host(change){context={...context,...change};if(change.theme==='dark'||change.theme==='light')root.style.colorScheme=change.theme;\nconst vars=change.styles?.variables||{};for(const [key,value] of Object.entries(vars)){\nif(/^--(?:color-|font-|border-|shadow-)/.test(key)&&typeof value==='string'&&!/url\\s*\\(|@import/i.test(value))root.style.setProperty(key,value)}\nconst face=change.styles?.css?.fonts;if(typeof face==='string'&&face.length<4000&&!/@import|javascript:/i.test(face))$('hostfont').textContent=face;\nconst insets=change.safeAreaInsets;if(insets)for(const edge of ['top','right','bottom','left']){\nconst n=insets[edge];if(Number.isFinite(n))root.style.setProperty('--safe-'+edge,Math.max(0,Math.min(n,200))+'px')}\nroot.dataset.mode=context.displayMode==='fullscreen'?'full':'inline';\n$('expand').textContent=context.displayMode==='fullscreen'?'Back to conversation':'Expand';paint();controls()}\nfunction scope(p,n){const bits=[];\nif(p.kind==='chart'||p.kind==='table')bits.push(n?(n===1?'1 row':n+' rows'):'No rows in this view');\nif(view.dateRange)bits.push(view.dateRange.from+' to '+view.dateRange.to);\nif(next)bits.push('more pages available');\n$('scope').textContent=bits.join(' · ')}\nfunction resize(){if(ready)notify(SIZE,{width:document.body.scrollWidth,height:document.body.scrollHeight})}\nfunction table(rows,columns){$('rows').replaceChildren();$('data').hidden=!rows?.length;if(!rows?.length)return;\n$('count').textContent=rows.length===1?'1 row behind this':rows.length+' rows behind this';\nconst t=document.createElement('table');\nconst num=name=>rows.some(r=>typeof r[name]==='number');\nconst header=document.createElement('tr');for(const name of columns){const th=document.createElement('th');th.scope='col';th.textContent=name;if(num(name))th.className='n';header.append(th)}\nconst head=document.createElement('thead');head.append(header);t.append(head);const body=document.createElement('tbody');\nfor(const row of rows.slice(0,50)){const tr=document.createElement('tr');for(const key of columns){const td=document.createElement('td');td.textContent=String(row[key]??'');if(num(key))td.className='n';tr.append(td)}body.append(tr)}t.append(body);$('rows').append(t)}\nasync function display(mode){try{const answer=await ask(DISPLAY,{mode});\nhost({displayMode:answer.mode||context.displayMode});if(root.dataset.mode==='full'&&!$('data').hidden)$('data').open=true;resize()}\ncatch{status('Expanded view is unavailable in this host.',1)}}\nfunction wait(){busy=true;if(!$('plot').firstChild)$('plot').dataset.state='wait';status('Loading chart…');controls()}\nasync function call(name,extra={}){if(!ready||!ref||busy)return;wait();const rev=++revision;\ntry{const result=await rpc('tools/call',{name,arguments:{reference:ref,view:{...view,...extra},context:'User is interacting with the chart tile.'}});\nif(rev===revision)render(result)}catch{if(rev===revision){trouble('tool-call-failed');status('Could not load the chart. Select Refresh to try again.',1)}}finally{busy=false;controls()}}\nfunction render(result){busy=false;controls();\nif(result?.isError){trouble('tool-returned-error');shown=false;controls();\nstatus(ref?'Chart unavailable. Check your access to this dashboard, then select Refresh.'\n:'Chart unavailable. Ask for this chart again to retry.',1);return}\nconst p=result?.structuredContent;if(!p||typeof p!=='object'){shown=false;controls();status('No chart data came back for this result.',1);return}\nrevision++;shown=true;rawSvg=null;$('plot').replaceChildren();$('plot').dataset.state='ready';$('choices').replaceChildren();delete $('rail').dataset.value;\nref=p.reference||null;view=p.view||{};next=p.nextCursor||null;\n$('title').textContent=p.title||'Analytics';$('description').textContent=p.description||'';\nif(p.kind==='dashboard'){$('plot').dataset.state='off';\nfor(const item of p.widgets||[]){const b=document.createElement('button');b.textContent=item.name||'Untitled widget';b.onclick=()=>{ref=item.reference;view={};call('render_chart')};$('choices').append(b)}\nstatus(p.widgets?.length?'':'This dashboard has no charts yet. Add one in Databrain, then ask again.');\n}else if(p.kind==='kpi'){\nconst number=document.createElement('p');number.className='kpi';number.textContent=String(p.value??'—');$('plot').append(number);status('');\n}else if(p.svg){\nconst box=document.createElement('div');box.className='chart';box.style.aspectRatio=p.width+'/'+p.height;\nconst img=document.createElement('img');img.id='chart-image';rawSvg=p.svg;img.alt=p.title||'Chart';img.onerror=()=>{status('The chart image could not be drawn. The rows behind it are below.',1);$('data').open=$('data').toggleAttribute('data-only',true)};box.append(img);\nfor(const point of p.points||[]){const b=document.createElement('button');b.className='point';b.setAttribute('aria-label',point.label+': '+point.value);b.setAttribute('aria-pressed','false');\nb.style.left=100*point.x/p.width+'%';b.style.top=100*point.y/p.height+'%';b.style.width=100*point.width/p.width+'%';b.style.height=100*point.height/p.height+'%';\nconst hover=()=>{$('vlabel').textContent=point.label;$('vnum').textContent=point.value;$('rail').dataset.value='1'};b.onmouseenter=hover;b.onfocus=hover;\nb.onclick=()=>{box.querySelectorAll('.point').forEach(e=>e.setAttribute('aria-pressed','false'));b.setAttribute('aria-pressed','true');hover();\n$('choices').replaceChildren();if(point.drillId){const drill=document.createElement('button');drill.className='primary';drill.textContent='Explore selected data';drill.onclick=()=>call('drill_down',{drillId:point.drillId,cursor:undefined});$('choices').append(drill)}};box.append(b)}$('plot').append(box);\nstatus('');\n}else if(p.kind==='table'){\n// ask_question returns a table by design; calling that a missing chart called success a failure.\n$('plot').dataset.state='off';status('');\n}else{$('plot').dataset.state='off';\nstatus('Nothing to show for this view. Try a wider date range, then select Refresh.',1)}\npaint();table(p.rows||[],p.columns||Object.keys(p.rows?.[0]||{}));scope(p,p.rows?.length||0);\nconst only=!p.svg&&p.value===undefined&&p.kind!=='dashboard';$('data').open=only;$('data').toggleAttribute('data-only',only);controls();resize()}\n$('refresh').onclick=()=>call('refresh_widget',{cursor:undefined});$('next').onclick=()=>call('render_chart',{cursor:next});\n$('expand').onclick=()=>display(context.displayMode==='fullscreen'?'inline':'fullscreen');\n$('dates').onclick=()=>{const from=$('from').value,to=$('to').value;if(!from||!to||from>to){status('Choose a start date on or before the end date.',1);return}call('change_date_range',{dateRange:{from,to},cursor:undefined,drillId:undefined})};\nfunction receive(event){if(event.source!==parent||closed)return;const m=event.data;\nif(!m||Array.isArray(m)||m.jsonrpc!=='2.0'||(origin!=='*'&&event.origin!==origin))return;\nif(!m.method&&pending.has(m.id)&&('result'in m||'error'in m)){if(origin==='*'&&event.origin!=='null')origin=event.origin;\nconst p=pending.get(m.id);pending.delete(m.id);clearTimeout(p.timer);\nif(m.error){const error=Error('host error');error.code=m.error.code;p.reject(error)}else p.resolve(m.result);return}\nif(m.method==='ping'&&m.id!==undefined){send({id:m.id,result:{}});return}\nif(m.method==='ui/resource-teardown'){send({id:m.id,result:{}});closed=true;revision++;for(const p of pending.values()){clearTimeout(p.timer);p.reject(Error('closed'))}pending.clear();observer.disconnect();removeEventListener('message',receive);return}\nif(!ready||m.id!==undefined)return;\nlet slot=DASH.indexOf(m.method),kind='dashed';\nif(slot<0){slot=SNAKE.indexOf(m.method);kind='snake'}\nif(slot>=0){\n/* A dual host posts each notification twice. Lock to the first name and drop its twin:\n   same payload, and a second render is a visible flicker. */\nif(!dialect)dialect=kind;if(dialect!==kind)return;\n// The snake result nests one level deeper.\nif(slot===0)render(kind==='snake'?m.params&&m.params.result:m.params);\nelse if(slot===1)wait();\nelse{host(m.params||{});resize()}\nreturn}\nif(m.method==='ui/notifications/tool-cancelled'){revision++;busy=false;$('plot').dataset.state='off';status('Chart request cancelled.');controls()}}\naddEventListener('message',receive);const observer=new ResizeObserver(resize);observer.observe(document.body);controls();\nrpc('ui/initialize',{protocolVersion:'2026-01-26',appInfo:{name:'Databrain chart tile',version:'1.0.0'},appCapabilities:{availableDisplayModes:['inline','fullscreen']}})\n.then(r=>{if(r.protocolVersion!=='2026-01-26')throw Error('version');host(r.hostContext||{});ready=true;notify(INIT,{});resize()})\n.catch(()=>{trouble('initialize-failed');status('This chart needs a host that supports MCP Apps.',1)});\n})();`;\n\nexport function tileHtml(kind: 'chart' | 'kpi' = 'chart'): string {\n  return `<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; font-src data:; connect-src 'none'; base-uri 'none'; form-action 'none'\">\n<title>Databrain ${kind} tile</title><style id=\"hostfont\"></style><style>\n/* Host tokens are the Claude MCP Apps style-variable names. Every one carries a fallback:\n   hosts may ship any subset, so nothing here may depend on a token existing. */\n:root{color-scheme:light dark;\n--dbn-bg:var(--color-background-primary,Canvas);--dbn-text:var(--color-text-primary,CanvasText);\n--dbn-mute:var(--color-text-secondary,GrayText);--dbn-faint:var(--color-text-tertiary,GrayText);\n--dbn-edge:var(--color-border-secondary,color-mix(in srgb,currentColor 20%,transparent));\n--dbn-line:var(--color-border-tertiary,color-mix(in srgb,currentColor 9%,transparent));\n--dbn-accent:var(--color-text-info,LinkText);--dbn-ring:var(--color-ring-primary,var(--dbn-accent));\n--dbn-bad:var(--color-text-danger,var(--dbn-text));--dbn-bad-edge:var(--color-border-danger,currentColor);\n--dbn-quiet:color-mix(in srgb,currentColor 6%,transparent);\n--bw:var(--border-width-regular,1px);--r-s:var(--border-radius-sm,6px);--r-m:var(--border-radius-md,8px);--r-l:var(--border-radius-lg,10px);\n--med:var(--font-weight-medium,500);--semi:var(--font-weight-semibold,600);\n/* One curve. Quick / standard / display-mode. Corporate: no overshoot. */\n--e:cubic-bezier(.2,0,0,1);--q:120ms;--s:300ms;--l:400ms}\n*{box-sizing:border-box}\nbody{margin:0;padding:var(--safe-top,0px) var(--safe-right,0px) var(--safe-bottom,0px) var(--safe-left,0px);background:var(--dbn-bg);color:var(--dbn-text);\nfont:var(--font-text-sm-size,14px)/var(--font-text-sm-line-height,1.4) var(--font-sans,system-ui)}\nmain{padding:20px;max-width:1200px;margin:auto;transition:padding var(--l) var(--e)}\nheader{display:flex;align-items:start;justify-content:space-between;gap:12px}header>div{min-width:0}\nh1{font-size:var(--font-heading-md-size,18px);line-height:var(--font-heading-md-line-height,1.4);margin:0 0 6px;font-weight:var(--semi);letter-spacing:-.01em;overflow-wrap:anywhere;transition:font-size var(--l) var(--e)}\np{margin:6px 0;color:var(--dbn-mute);overflow-wrap:anywhere}#expand{flex:none}\nbutton,input{font:inherit;color:inherit;background:var(--dbn-bg);border:var(--bw) solid var(--dbn-edge);border-radius:var(--r-s);padding:7px 10px}\nbutton{cursor:pointer;transition:background-color var(--q) var(--e),border-color var(--q) var(--e)}\ninput{max-width:160px;min-width:0}button:hover:not(:disabled){background:var(--dbn-quiet)}button:disabled{color:var(--dbn-faint);cursor:default}\nbutton:focus-visible,input:focus-visible,summary:focus-visible{outline:2px solid var(--dbn-ring);outline-offset:2px}\n#choices button{text-align:left;border-color:transparent;border-bottom-color:var(--dbn-line);border-radius:0;padding:10px 2px}\n#choices button:first-child{border-top:var(--bw) solid var(--dbn-line)}\n#choices button:hover:not(:disabled){background:var(--dbn-quiet);border-radius:var(--r-s)}\n/* One primary per state: the drill pill, and Next page when there is a next page. */\n#choices button.primary,#next{flex:none;text-align:center;border:var(--bw) solid var(--dbn-accent);\nborder-radius:var(--r-s);padding:7px 10px;font-weight:var(--med);color:var(--dbn-accent)}\n#choices button.primary{align-self:flex-start;margin-top:10px}\n/* Refresh is a re-fetch, not a choice. Quiet it so it stops reading as a fifth chart. */\n#refresh{border-color:transparent;color:var(--dbn-mute);padding-left:2px;padding-right:8px}\n#refresh:hover:not(:disabled){color:var(--dbn-text);background:none;text-decoration:underline}\n#status:empty{margin:0}\n#status[data-error]{color:var(--dbn-bad);font-weight:var(--med);\nborder-left:2px solid var(--color-border-danger,color-mix(in srgb,currentColor 40%,transparent));\nbackground:var(--color-background-danger,color-mix(in srgb,currentColor 5%,transparent));\nborder-radius:0 var(--r-m) var(--r-m) 0;padding:10px 12px;margin:10px 0}\n/* Reserved plot. The skeleton is a static bar silhouette matching the 15:8 backend render:\n   Claude's guidance asks for a skeleton that matches the final layout, and bans nothing here,\n   but shimmer is banned by our own motion budget - so this paints once and never repaints. */\n#plot{position:relative;transition:opacity var(--q) var(--e)}#plot[data-busy]{opacity:.55}\n#plot[data-state=wait]{aspect-ratio:15/8}\n#plot[data-state=wait]::before,#plot[data-state=ready]::before{content:'';position:absolute;pointer-events:none;inset:16% 6% 13%;\nborder-bottom:var(--bw) solid var(--dbn-line);transition:opacity var(--s) var(--e);\nbackground:linear-gradient(var(--dbn-quiet),var(--dbn-quiet)) 0 100%/11% 44% no-repeat,\nlinear-gradient(var(--dbn-quiet),var(--dbn-quiet)) 22% 100%/11% 71% no-repeat,\nlinear-gradient(var(--dbn-quiet),var(--dbn-quiet)) 44% 100%/11% 57% no-repeat,\nlinear-gradient(var(--dbn-quiet),var(--dbn-quiet)) 66% 100%/11% 86% no-repeat,\nlinear-gradient(var(--dbn-quiet),var(--dbn-quiet)) 88% 100%/11% 33% no-repeat}\n#plot[data-state=ready]::before{opacity:0}\n.chart{position:relative;width:100%;margin:12px 0}.chart img{width:100%;height:100%;display:block}\n.point{position:absolute;padding:0;border:0;background:transparent;border-radius:var(--border-radius-xs,4px);\noutline:2px solid transparent;outline-offset:1px;transition:background-color var(--q) var(--e),outline-color var(--q) var(--e)}\n.point:hover{background:color-mix(in srgb,currentColor 12%,transparent)}\n.point[aria-pressed=true]{outline-color:var(--dbn-accent);background:color-mix(in srgb,var(--dbn-accent) 18%,transparent)}\n.kpi{font-size:clamp(34px,10vw,44px);line-height:1.1;font-weight:var(--semi);letter-spacing:-.025em;font-variant-numeric:tabular-nums;color:var(--dbn-text);margin:14px 0 6px;transition:font-size var(--l) var(--e)}\n/* The readout rail. At rest it states the scope of what is on screen; on selection it\n   becomes the value. One slot, two jobs, so selecting a bar never reflows the tile. */\n#rail{display:flex;align-items:center;min-height:2.5em;margin:2px 0 0}\n#scope,#value{margin:0;display:none;overflow-wrap:anywhere}\n#rail:not([data-value]) #scope{display:block;color:var(--dbn-mute);font-size:var(--font-text-xs-size,12px)}\n#rail:not([data-value]):has(#scope:empty){display:none}\n#rail[data-value] #value{display:flex;flex-direction:column;gap:1px;line-height:1.15}\n#vlabel{color:var(--dbn-mute);font-size:var(--font-text-xs-size,12px)}\n#vnum{font-size:var(--font-heading-md-size,18px);font-weight:var(--semi);letter-spacing:-.015em;font-variant-numeric:tabular-nums}\n[data-mode=full] #vnum{font-size:var(--font-heading-xl-size,24px)}\nfooter,.dates{display:flex;gap:8px;flex-wrap:wrap;align-items:center}\n#choices{display:flex;flex-direction:column;align-items:stretch;margin:10px 0 0}footer{margin-top:12px}.dates{margin:8px 0 2px}\nlabel{display:flex;align-items:center;gap:6px;color:var(--dbn-mute)}\n#range{margin-top:10px}#data{margin-top:2px}#data[hidden],#range[hidden]{display:none}\nhtml:not([data-deep]) #range,html:not([data-deep]) #data:not([data-only]){display:none}\nsummary{cursor:pointer;color:var(--dbn-mute);font-size:var(--font-text-xs-size,12px);padding:5px 0;width:fit-content;transition:color var(--q) var(--e)}summary:hover{color:var(--dbn-text)}\n#rows{overflow:auto;max-height:260px;border-radius:var(--r-s)}\ntable{border-collapse:collapse;width:100%;font-size:var(--font-text-xs-size,12px)}\nth,td{text-align:left;padding:8px;border-bottom:var(--bw) solid var(--dbn-line);overflow-wrap:anywhere}\ntd.n,th.n{text-align:right;font-variant-numeric:tabular-nums}\nth{font-weight:var(--semi);position:sticky;top:0;background:var(--dbn-bg);color:var(--dbn-mute);\nfont-size:var(--font-text-xs-size,12px);letter-spacing:.02em;text-transform:uppercase}\n/* Inline to fullscreen is a layout morph, not a new screen: main widens over 400ms on the\n   one curve and every dependent box follows it. Fullscreen is the detailed view, so the\n   table loses its inline height cap. */\n/* The SVG is rendered at 600x320 and scaled by width, so an unbounded fullscreen column\n   makes the chart's own axis type larger than the tile's heading. Hold a measure. */\n[data-mode=full] main{padding:28px 32px;max-width:900px}\n[data-mode=full] h1{font-size:var(--font-heading-xl-size,24px);line-height:var(--font-heading-xl-line-height,1.25)}\n[data-mode=full] .kpi{font-size:clamp(44px,7vw,72px)}\n[data-mode=full] #rows{max-height:none}\n/* Touch: the host gives vertical pan to the conversation, so a nested scroller is a trap. */\n@media(pointer:coarse){button,input{min-height:44px}summary{padding:12px 0}#rows{max-height:none;overflow:visible}}\n@media(max-width:480px){main{padding:14px}}\n/* Entrance. Content first, chrome 60ms later: 300+60 = 360ms, inside the 400ms budget.\n   No stagger past two groups - a chat tile that cascades reads as lag, not luxury. */\n@keyframes rise{from{opacity:0;transform:translateY(6px)}}\n@keyframes land{from{opacity:0;transform:translateY(4px) scale(.995)}}\nheader,#status,#plot{animation:rise var(--s) var(--e) both}\n#rail,#choices,footer,#range,#data{animation:rise var(--s) var(--e) 60ms both}\n.chart,.kpi{animation:land var(--s) var(--e) both}\n@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important;transition:none!important}}\n</style></head><body><main id=\"tile\"><header><div><h1 id=\"title\">Analytics</h1><p id=\"description\"></p></div><button id=\"expand\" hidden>Expand</button></header>\n<p id=\"status\" role=\"status\">Loading chart…</p><div id=\"plot\" data-state=\"wait\"></div>\n<div id=\"rail\"><p id=\"scope\"></p><p id=\"value\"><span id=\"vlabel\"></span><b id=\"vnum\"></b></p></div><div id=\"choices\"></div>\n<footer><button id=\"refresh\" hidden>Refresh</button><button id=\"next\" hidden>Next page</button></footer>\n<details id=\"range\" hidden><summary>Change the date range</summary><div class=\"dates\"><label>From <input id=\"from\" type=\"date\"></label><label>To <input id=\"to\" type=\"date\"></label><button id=\"dates\" type=\"button\">Apply dates</button></div></details>\n<details id=\"data\" hidden><summary id=\"count\">Show the data behind this</summary><div id=\"rows\" tabindex=\"0\" role=\"region\" aria-label=\"Chart data\"></div></details></main><script>${TILE_SCRIPT}</script></body></html>`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,iBAAiB;;;ACA1B,SAAS,SAAS;;;ACKX,IAAM,cAAc;AAM3B,IAAM,sBAAN,cAAkC,gBAAgB;AAAA,EAChD,YAA6B,UAA2B;AACtD,UAAM,EAAE,QAAQ,SAAS,UAAU,GAAG,YAAY,SAAS,cAAc,EAAE,CAAC;AADjD;AAAA,EAE7B;AAAA,EACS,QAAW,SAAqC;AACvD,WAAO,KAAK,SAAS,QAAW,EAAE,GAAG,SAAS,UAAU,QAAW,YAAY,OAAU,CAAC;AAAA,EAC5F;AACF;AAGO,SAAS,mBAAmB,QAAuC;AAExE,QAAM,WAAW,oBAAoB,IAAI,oBAAoB,MAAM,CAAC;AACpE,SAAO;AAAA,IACL,MAAM,QAAQ,QAAQ,cAAc,SAAS;AAC3C,YAAM,YAAY,gBAAgB,MAAM,YAAY;AACpD,YAAM,OAAO,WAAW,MAAM,OAAO;AAErC,YAAM,MAAM,MAAM,SAAS,cAAc,mBAAmB,QAAW,UAAU,OAAO;AACxF,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB;AACtD,YAAM,QAAQ,MAAM,SAAS,cAAc,6BAA6B;AAAA,QACtE,SAAS,UAAU;AAAA,QAAS,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,MAAM,CAAC;AACpF,UAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,oBAAoB;AACnD,YAAM,EAAE,MAAM,IAAI,MAAM,SAAS,kBAAkB,cAAc;AAAA,QAC/D,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,QAAO,eAAe,CAAC,UAAU,OAAO;AAAA,QACvF,aAAa;AAAA,UAAE,yBAAyB;AAAA,UAAM,uBAAuB;AAAA,UACnE,wBAAwB;AAAA,UAAO,wBAAwB;AAAA,QAAM;AAAA,MACjE,CAAC;AACD,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yBAAyB;AACrD,YAAM,OAAO,MAAM,OAAO,QAAiB;AAAA,QACzC,QAAQ;AAAA,QAAQ,MAAM;AAAA,QAAa,MAAM;AAAA,QAAQ;AAAA,QACjD,MAAM;AAAA,UAAE;AAAA,UAAQ,SAAS,UAAU;AAAA,UAAS,UAAU,UAAU;AAAA,UAAU,GAAG;AAAA,UAC3E,UAAU;AAAA,UAAI,OAAO;AAAA,UAAK,QAAQ;AAAA,UAAK,WAAW;AAAA,QAAM;AAAA,QAC1D,gBAAgB;AAAA,MAClB,CAAC;AACD,aAAO,WAAW,MAAM,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;;;AChDO,IAAM,cAAc,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqH3B,SAAS,SAAS,OAAwB,SAAiB;AAChE,SAAO;AAAA;AAAA,mBAEU,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oLA2G6J,WAAW;AAC/L;;;AF3NA,IAAM,UAAuC;AAAA,EAC3C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AACrB;AAGO,SAAS,kBAAkB,QAAmB,QAAyB,UAAwB,mBAAmB,MAAM,GAAS;AACtI,aAAW,CAAC,MAAM,WAAW,KAAK,OAAO,QAAQ,OAAO,GAAG;AACzD,UAAM,SAAS;AACf,UAAM,OAAO,OAAO,KAAK,MAAM,aAAa;AAAA,MAC1C,WAAW;AAAA,MAAiB,MAAM,WAAW,QAAQ,CAAC,CAAC;AAAA,MACvD,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAC9E,GAAG,WAAW,OAAO,EAAE,WAAW,KAAK,MAAM;AAC3C,UAAI;AACF,YAAK,WAAW,gBAAgB,CAAC,KAAK,WAAa,WAAW,uBAAuB,CAAC,KAAK,UAAY,OAAM,IAAI,MAAM,uBAAuB;AAC9I,cAAM,OAAO,WAAW,MAAM,MAAM,YAAY;AAAA,UAAI,EAAE,MAAM,MAAM,UAAU,aAAa,gBAAgB,aAAa,WAAW,MAAM;AAAA,UACrI,MAAM,QAAQ,QAAQ,QAAQ,WAAW,IAAI;AAAA,QAAC,CAAC;AAGjD,YAAI,KAAK,QAAQ,CAAC,cAAc,KAAK,KAAK,GAAG,KAC3C,kLAAkL,KAAK,KAAK,GAAG,IAAI;AACnM,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AACA,eAAO,YAAY,GAAG,KAAK,SAAS,QAAQ,QAAQ,OAAO,WAAW,KAAK,KAAK,MAAM,uBAAuB;AAAA,UAC3G,GAAG;AAAA,UAAM;AAAA,UAAW;AAAA,QACtB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM;AAAA,QAA4F,CAAC,EAAE;AAAA,MACzG;AAAA,IACF,CAAC;AACD,SAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,EACzC;AACA,aAAW,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,WAAW,OAAO,GAAG,CAAC,SAAS,KAAK,CAAC,GAAY;AAC3E,WAAO,SAAS,aAAa,IAAI,SAAS,KAAK,EAAE,UAAU,UAAU,aAAa,eAAe,IAAI,4CAA4C,GAAG,aAAa;AAAA,MAC/J,UAAU,CAAC,EAAE,KAAK,UAAU,UAAU,MAAM,SAAS,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,eAAe,KAAK,EAAE,EAAE,CAAC;AAAA,IACtG,EAAE;AAAA,EACJ;AACF;;;ADtCO,SAAS,qBAAqB,QAAgB,SAAmC;AACtF,QAAM,SAAS,IAAI,gBAAgB,MAAM;AACzC,QAAM,SAAS,IAAI,UAAU,EAAE,MAAM,wBAAwB,SAAS,mBAAmB,GAAG;AAAA,IAC1F,cAAc;AAAA,EAEhB,CAAC;AACD,kBAAgB,MAAM;AACtB,mBAAiB,QAAQ,MAAM;AAC/B,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AACzB,oBAAkB,QAAQ,QAAQ,OAAO;AACzC,SAAO;AACT;","names":[]}

package/dist/chunk-CX3CS62P.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/hosted/types.ts","../src/hosted/auth.ts"],"sourcesContent":["import type { RequestOptions } from '../client/types.js';\n\nexport const HOSTED_SCOPES = [\n  'mcp:dashboards:read', 'mcp:dashboards:write',\n  'mcp:datamarts:read', 'mcp:datamarts:write', 'mcp:embeds:write', 'mcp:query',\n] as const;\nexport type HostedScope = typeof HOSTED_SCOPES[number];\n\n/** Only the trusted auth adapter may produce this context. Never populate it from MCP input. */\nexport interface HostedPrincipal {\n  actorKind: 'user';\n  credentialType: 'oauth' | 'pat';\n  userId: string;\n  companyId: string;\n  workspaceId: string;\n  workspaceName?: string;\n  /** OAuth application ID, NOT the tenant identifier called clientId by legacy tools. */\n  clientId: string;\n  resource: string;\n  scopes: HostedScope[];\n  /** Required for stored PATs. OAuth may delegate expiry to fresh provider validation. */\n  expiresAt?: number;\n  /** Explicit tenant allow-list resolved by the backend; absent means no tenant access. */\n  tenantIds?: string[];\n}\n\nexport interface PatRecord {\n  hash: string;\n  revokedAt: number | null;\n  principal: HostedPrincipal;\n}\n\nexport interface PatStore {\n  findByHash(hash: string): Promise<PatRecord | undefined>;\n}\n\n/** Production integration must recheck membership, policy and revocation on every call. */\nexport interface HostedAdapter {\n  verifyOAuth(token: string, resource: string): Promise<HostedPrincipal>;\n  resolvePatGrant(principal: HostedPrincipal): Promise<HostedPrincipal>;\n  /**\n   * Execute as this user/workspace with backend resource and tenant checks and auditing.\n   * Receives NO incoming bearer or server service credential. Credential exchange, if\n   * needed, belongs in the trusted adapter. Do not impersonate a static service token.\n   * Return the raw API result: the shared client performs its usual data unwrapping.\n   */\n  executeRequest(options: RequestOptions, principal: HostedPrincipal): Promise<unknown>;\n}\n\nexport interface HostedConfig {\n  publicUrl: string;\n  issuer: string;\n  port: number;\n  bind: string;\n  testOnly: boolean;\n}\n\nexport class HostedAuthError extends Error {\n  constructor(public readonly status: 401 | 403 | 503, public readonly code: string) {\n    super(code);\n  }\n}\n","import { createHash, timingSafeEqual } from 'node:crypto';\nimport { open } from 'node:fs/promises';\nimport { constants } from 'node:fs';\nimport { z } from 'zod';\nimport { HOSTED_SCOPES, HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedPrincipal, PatRecord, PatStore } from './types.js';\n\nconst identity = z.string().min(1).max(512).regex(/^[^\\x00-\\x1f\\x7f]+$/);\nexport const principalSchema = z.object({\n  actorKind: z.literal('user'), credentialType: z.enum(['oauth', 'pat']),\n  userId: identity, companyId: identity, workspaceId: identity, workspaceName: identity.optional(),\n  clientId: identity, resource: z.string().url(), scopes: z.array(z.enum(HOSTED_SCOPES)),\n  expiresAt: z.number().finite().positive().optional(), tenantIds: z.array(identity).optional(),\n}).strict();\nconst recordSchema = z.object({\n  hash: z.string().regex(/^[a-f0-9]{64}$/), revokedAt: z.number().finite().nullable(),\n  principal: principalSchema,\n}).strict();\n\nexport function hashCredential(token: string): string {\n  return createHash('sha256').update(token).digest('hex');\n}\n\n/** Reread on every request: an atomic file replacement revokes immediately, without restart. */\nexport class FilePatStore implements PatStore {\n  constructor(private readonly path: string) {}\n  async findByHash(hash: string): Promise<PatRecord | undefined> {\n    const handle = await open(this.path, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      const stat = await handle.stat();\n      if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > 1_048_576 ||\n          (process.getuid && stat.uid !== process.getuid())) throw new Error('Invalid credential store');\n      const records = z.array(recordSchema).max(1000).parse(JSON.parse(await handle.readFile('utf8')));\n      const matches = records.filter(record => timingSafeEqual(Buffer.from(record.hash, 'hex'), Buffer.from(hash, 'hex')));\n      // Duplicate records are ambiguous, including an active/revoked pair.\n      if (matches.length > 1) throw new Error('Ambiguous credential store');\n      return matches[0];\n    } finally { await handle.close(); }\n  }\n}\n\nfunction validatePrincipal(value: unknown, resource: string, kind: 'oauth' | 'pat'): HostedPrincipal {\n  const parsed = principalSchema.safeParse(value);\n  if (!parsed.success || parsed.data.resource !== resource || parsed.data.credentialType !== kind ||\n      (parsed.data.expiresAt !== undefined && parsed.data.expiresAt <= Date.now() / 1000) ||\n      (kind === 'pat' && parsed.success && parsed.data.expiresAt === undefined)) throw new HostedAuthError(401, 'invalid_token');\n  return parsed.data;\n}\n\nexport function createBearerVerifier(adapter: HostedAdapter, resource: string, pats?: PatStore) {\n  return async (token: string): Promise<HostedPrincipal> => {\n    try {\n      if (!/^[A-Za-z0-9._~+\\/-]+=*$/.test(token) || token.length > 8192) throw new HostedAuthError(401, 'invalid_token');\n      if (!token.startsWith('dbp_')) {\n        return validatePrincipal(await adapter.verifyOAuth(token, resource), resource, 'oauth');\n      }\n      if (!/^dbp_[A-Za-z0-9_-]{32,}$/.test(token)) throw new HostedAuthError(401, 'invalid_token');\n      const record = await pats?.findByHash(hashCredential(token));\n      if (!record || record.revokedAt !== null || record.hash !== hashCredential(token)) throw new HostedAuthError(401, 'invalid_token');\n      const stored = validatePrincipal(record.principal, resource, 'pat');\n      const resolved = validatePrincipal(await adapter.resolvePatGrant(structuredClone(stored)), resource, 'pat');\n      // Membership resolution may narrow a stored grant, never move or expand it.\n      for (const key of ['userId', 'companyId', 'workspaceId', 'clientId', 'resource'] as const) {\n        if (resolved[key] !== stored[key]) throw new HostedAuthError(401, 'invalid_token');\n      }\n      if (resolved.expiresAt! > stored.expiresAt! || resolved.scopes.some(scope => !stored.scopes.includes(scope)) ||\n          resolved.tenantIds?.some(id => !stored.tenantIds?.includes(id))) throw new HostedAuthError(401, 'invalid_token');\n      return resolved;\n    } catch (error) {\n      if (error instanceof HostedAuthError) throw error;\n      // No raw verifier, filesystem or remote errors can disclose credential values.\n      throw new HostedAuthError(401, 'invalid_token');\n    }\n  };\n}\n"],"mappings":";;;AAEO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EAAuB;AAAA,EACvB;AAAA,EAAsB;AAAA,EAAuB;AAAA,EAAoB;AACnE;AAoDO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YAA4B,QAAyC,MAAc;AACjF,UAAM,IAAI;AADgB;AAAyC;AAAA,EAErE;AACF;;;AC7DA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,YAAY;AACrB,SAAS,iBAAiB;AAC1B,SAAS,SAAS;AAIlB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,qBAAqB;AAChE,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,WAAW,EAAE,QAAQ,MAAM;AAAA,EAAG,gBAAgB,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC;AAAA,EACrE,QAAQ;AAAA,EAAU,WAAW;AAAA,EAAU,aAAa;AAAA,EAAU,eAAe,SAAS,SAAS;AAAA,EAC/F,UAAU;AAAA,EAAU,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,aAAa,CAAC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAAG,WAAW,EAAE,MAAM,QAAQ,EAAE,SAAS;AAC9F,CAAC,EAAE,OAAO;AACV,IAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAAG,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAClF,WAAW;AACb,CAAC,EAAE,OAAO;AAEH,SAAS,eAAe,OAAuB;AACpD,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAGO,IAAM,eAAN,MAAuC;AAAA,EAC5C,YAA6B,MAAc;AAAd;AAAA,EAAe;AAAA,EAC5C,MAAM,WAAW,MAA8C;AAC7D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;AAC9E,QAAI;AACF,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,CAAC,KAAK,OAAO,MAAM,KAAK,OAAO,QAAW,KAAK,KAAK,OAAO,WAC1D,QAAQ,UAAU,KAAK,QAAQ,QAAQ,OAAO,EAAI,OAAM,IAAI,MAAM,0BAA0B;AACjG,YAAM,UAAU,EAAE,MAAM,YAAY,EAAE,IAAI,GAAI,EAAE,MAAM,KAAK,MAAM,MAAM,OAAO,SAAS,MAAM,CAAC,CAAC;AAC/F,YAAM,UAAU,QAAQ,OAAO,YAAU,gBAAgB,OAAO,KAAK,OAAO,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC;AAEnH,UAAI,QAAQ,SAAS,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpE,aAAO,QAAQ,CAAC;AAAA,IAClB,UAAE;AAAU,YAAM,OAAO,MAAM;AAAA,IAAG;AAAA,EACpC;AACF;AAEA,SAAS,kBAAkB,OAAgB,UAAkB,MAAwC;AACnG,QAAM,SAAS,gBAAgB,UAAU,KAAK;AAC9C,MAAI,CAAC,OAAO,WAAW,OAAO,KAAK,aAAa,YAAY,OAAO,KAAK,mBAAmB,QACtF,OAAO,KAAK,cAAc,UAAa,OAAO,KAAK,aAAa,KAAK,IAAI,IAAI,OAC7E,SAAS,SAAS,OAAO,WAAW,OAAO,KAAK,cAAc,OAAY,OAAM,IAAI,gBAAgB,KAAK,eAAe;AAC7H,SAAO,OAAO;AAChB;AAEO,SAAS,qBAAqB,SAAwB,UAAkB,MAAiB;AAC9F,SAAO,OAAO,UAA4C;AACxD,QAAI;AACF,UAAI,CAAC,0BAA0B,KAAK,KAAK,KAAK,MAAM,SAAS,KAAM,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACjH,UAAI,CAAC,MAAM,WAAW,MAAM,GAAG;AAC7B,eAAO,kBAAkB,MAAM,QAAQ,YAAY,OAAO,QAAQ,GAAG,UAAU,OAAO;AAAA,MACxF;AACA,UAAI,CAAC,2BAA2B,KAAK,KAAK,EAAG,OAAM,IAAI,gBAAgB,KAAK,eAAe;AAC3F,YAAM,SAAS,MAAM,MAAM,WAAW,eAAe,KAAK,CAAC;AAC3D,UAAI,CAAC,UAAU,OAAO,cAAc,QAAQ,OAAO,SAAS,eAAe,KAAK,EAAG,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACjI,YAAM,SAAS,kBAAkB,OAAO,WAAW,UAAU,KAAK;AAClE,YAAM,WAAW,kBAAkB,MAAM,QAAQ,gBAAgB,gBAAgB,MAAM,CAAC,GAAG,UAAU,KAAK;AAE1G,iBAAW,OAAO,CAAC,UAAU,aAAa,eAAe,YAAY,UAAU,GAAY;AACzF,YAAI,SAAS,GAAG,MAAM,OAAO,GAAG,EAAG,OAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,MACnF;AACA,UAAI,SAAS,YAAa,OAAO,aAAc,SAAS,OAAO,KAAK,WAAS,CAAC,OAAO,OAAO,SAAS,KAAK,CAAC,KACvG,SAAS,WAAW,KAAK,QAAM,CAAC,OAAO,WAAW,SAAS,EAAE,CAAC,EAAG,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACnH,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,gBAAiB,OAAM;AAE5C,YAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,IAChD;AAAA,EACF;AACF;","names":[]}