@datar-platform/cli 0.1.0-alpha.0

package/README.md

@@ -0,0 +1,131 @@
+# @datar-platform/cli
+
+The **`datar` CLI** and **MCP server** — connect any AI harness (Claude Code, Cursor,
+etc.) to a Datar organization with a single API token, the way you connect a CLI to a
+cloud account. The token is bound server-side to one org and a set of scopes, so once you
+authenticate, the harness already knows _which org_ it's in and _what it may do_ — no org
+selection, no endpoint guessing.
+
+Built entirely on [`@datar-platform/sdk`](../sdk). **v1 is read + discovery only,**
+available over two transports that share one tool registry: a **local stdio** server
+(`datar mcp`, this package) and a **remote Streamable HTTP** endpoint
+(`/api/mcp` in the web app — no local install needed, just a token).
+
+## Install & authenticate
+
+```bash
+pnpm add -g @datar-platform/cli    # or run via npx
+
+export DATAR_API_TOKEN=dt_...       # mint at <baseUrl>/settings/api-tokens
+export DATAR_BASE_URL=https://acme.datar.co.za   # or http://localhost:3000 for dev
+```
+
+### How read-only is actually enforced
+
+The read-only guarantee is **client-side**, not scope-based:
+
+- Every discovery/read tool and `datar_query` issue **HTTP GET** only, and tRPC refuses
+  mutations over GET — so they physically cannot write, whatever the token's scopes are.
+- `datar_ask` is the **only** tool that can act (it drives an A2A agent, which may call
+  mutating endpoints). It is **opt-in** — registered only when `DATAR_MCP_ALLOW_AGENT=1`.
+  Default off ⇒ the whole surface is provably read-only.
+
+> ⚠️ **Do not rely on token scopes alone for read-only.** Historically most endpoints were
+> built on `serviceProcedure`, which did **not** run the API-token scope-enforcement
+> middleware (only `orgProtectedProcedure` did) — a "read-scoped" `dt_` token could still
+> write through those endpoints. This has since been fixed: `serviceProcedure`,
+> `serviceAdminProcedure`, `memberRoleProcedure`, and `marketplaceRoleProcedure` all now run
+> `.use(apiScopeMiddleware)` (`packages/api/src/trpc.ts`), with a regression test at
+> `packages/api/tests/services/trpc.service-procedure-scope.test.ts`. Scope-based read-only
+> is now real, but this client-side guarantee (GET-only tools, `datar_ask` off) remains the
+> primary one — treat token scoping as defense-in-depth on top of it, not a replacement.
+
+## Use as a CLI
+
+```bash
+datar whoami                         # the org/user this token resolves to
+datar ls                             # list Datar service agents
+datar ask "how many open tenders do we have?"      # orchestrator routes it
+datar ask procurement "list my draft submissions"  # target one agent
+datar query v2.people.org.getActiveMembers          # any read procedure by path
+datar projects ls                    # quick record listings
+```
+
+## Use as an MCP server (Claude Code)
+
+```bash
+claude mcp add datar \
+  --env DATAR_API_TOKEN=dt_... \
+  --env DATAR_BASE_URL=https://acme.datar.co.za \
+  -- npx -y @datar-platform/cli mcp
+```
+
+Then ask Claude things like _"list Datar services"_, _"show my projects"_, or _"what
+PayFast-backed transactions came in this month?"_ — it will call the tools below.
+
+## Use remotely — no local install (Streamable HTTP)
+
+Any MCP-capable harness can connect straight to a Datar tenant with nothing but a token —
+`apps/web/app/api/mcp/route.ts` exposes the **same tool registry** over the MCP Streamable
+HTTP transport (stateless — a fresh `McpServer` per request, as the SDK recommends for
+serverless):
+
+```bash
+claude mcp add datar-remote --transport http \
+  https://acme.datar.co.za/api/mcp \
+  --header "Authorization: Bearer dt_..."
+```
+
+Auth is the same bearer-token model as everywhere else in the platform (`dt_` API token /
+`sk_` access key), validated with the same check the A2A gateway uses
+(`resolveA2AAuth`) — a missing/invalid token gets a `401` before any MCP handling happens.
+Every tool call then re-enters the app's own tRPC endpoints under the caller's real
+identity, exactly like the local CLI does (the SDK client is just pointed at the request's
+own origin instead of an env var). Same `DATAR_MCP_ALLOW_AGENT=1` gate controls whether
+`datar_ask` is registered on the remote endpoint too.
+
+### Tools exposed (26 read-only by default; +`datar_ask` = 27 with `DATAR_MCP_ALLOW_AGENT=1`)
+
+- **Discovery** — `datar_whoami`, `datar_list_services`, `datar_describe_service`
+  (skills + input/output JSON schemas from each agent card — the catalog that makes
+  downstream calls precise).
+- **Typed reads** (deterministic, no nested-LLM cost) — `drive_list_files`,
+  `drive_get_file`, `drive_list_folders`, `projects_list`, `projects_get`,
+  `projects_metrics`, `tasks_list`, `people_list`, `requests_list`,
+  `requests_pending_approvals`, `transact_list_accounts`, `transact_list_transactions`,
+  `procurement_list_tenders`, `procurement_list_public_tenders`,
+  `procurement_list_suppliers`, `inventory_list_items`, `inventory_low_stock`,
+  `isms_list_risks`, `isms_list_controls`, `invoicing_list_invoices`,
+  `invoicing_list_clients`, `messages_list`.
+- **Natural-language fallback** — `datar_ask` (forwards to any agent / the orchestrator;
+  reuses tool-calling, KB grounding, cross-service routing). **Opt-in / can act:** only
+  registered when `DATAR_MCP_ALLOW_AGENT=1`; omitted by default so the surface stays read-only.
+- **Read escape hatch** — `datar_query` (any `v2.*` tRPC query by path; mutation-looking
+  paths are refused, and `client.query()` only issues GETs, which tRPC never serves for
+  mutations).
+
+## Verify locally
+
+```bash
+pnpm -F @datar-platform/cli build && pnpm -F @datar-platform/cli test
+# Drive it interactively with the MCP inspector:
+npx @modelcontextprotocol/inspector node packages/cli/dist/index.js mcp
+```
+
+## Architecture notes
+
+- The tool registry (`src/mcp/tools/`, exported as `@datar-platform/cli/mcp/tools`) is
+  **transport-agnostic** — a `ToolDef[]` with no MCP/stdio/HTTP types. `src/mcp/server.ts`'s
+  `createDatarMcpServer(client, tools)` (exported as `@datar-platform/cli/mcp`) builds an
+  `McpServer` from it and is reused verbatim by both transports:
+  - `startStdioServer()` (this package's `datar mcp` command) — `StdioServerTransport`.
+  - `apps/web/app/api/mcp/route.ts` — `WebStandardStreamableHTTPServerTransport`, stateless
+    (fresh server + transport per request; the SDK's own guidance for serverless/Fluid
+    Compute — reusing one across requests causes message-ID collisions between clients).
+- Everything routes through one `Datar` SDK client. No direct DynamoDB / tRPC-server
+  access; the CLI (and the remote endpoint) are pure API consumers — the remote endpoint's
+  client just points at the incoming request's own origin instead of an env var.
+
+**Roadmap (not in v1):** curated writes behind `api.*.write` scopes (once scope enforcement
+lands platform-wide, see the warning above) · per-tenant MCP-token onboarding UI + usage
+metering · external connectors (multi-store Shopify, cloud-drive sources, CRM).

package/dist/config.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Resolves the Datar API token + tenant base URL from the environment (and,
+ * optionally, a `~/.datar/config.json` written by `datar login`).
+ *
+ * Auth model: the `dt_` API token is bound server-side to an organization and
+ * a set of scopes, so once resolved here the caller's tenant and permissions
+ * are already fixed — no org selection needed on the client. Mint tokens in the
+ * Datar web UI at /settings/api-tokens. For the read-only MCP server, scope the
+ * token to `api.*.read` + `a2a.*` only; that is the real read-only guarantee.
+ */
+import type { DatarOptions } from "@datar-platform/sdk";
+export interface ResolvedConfig extends DatarOptions {
+    /** Where the token/baseUrl were resolved from — for `datar whoami` output. */
+    source: "env" | "config-file";
+}
+declare const CONFIG_PATH: string;
+/**
+ * Resolve credentials with precedence: env vars first (so CI / MCP-host env
+ * always wins), then the on-disk config file. Throws a clear, actionable error
+ * when neither yields a usable token + baseUrl.
+ */
+export declare function resolveConfig(): ResolvedConfig;
+export { CONFIG_PATH };
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,8EAA8E;IAC9E,MAAM,EAAE,KAAK,GAAG,aAAa,CAAC;CAC/B;AAED,QAAA,MAAM,WAAW,QAA2C,CAAC;AAe7D;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,cAAc,CA6B9C;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/config.js

@@ -0,0 +1,50 @@
+/**
+ * Resolves the Datar API token + tenant base URL from the environment (and,
+ * optionally, a `~/.datar/config.json` written by `datar login`).
+ *
+ * Auth model: the `dt_` API token is bound server-side to an organization and
+ * a set of scopes, so once resolved here the caller's tenant and permissions
+ * are already fixed — no org selection needed on the client. Mint tokens in the
+ * Datar web UI at /settings/api-tokens. For the read-only MCP server, scope the
+ * token to `api.*.read` + `a2a.*` only; that is the real read-only guarantee.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const CONFIG_PATH = join(homedir(), ".datar", "config.json");
+function readFileConfig() {
+    try {
+        return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Resolve credentials with precedence: env vars first (so CI / MCP-host env
+ * always wins), then the on-disk config file. Throws a clear, actionable error
+ * when neither yields a usable token + baseUrl.
+ */
+export function resolveConfig() {
+    const file = readFileConfig();
+    const apiToken = process.env.DATAR_API_TOKEN ?? file.apiToken;
+    const baseUrl = process.env.DATAR_BASE_URL ?? file.baseUrl;
+    const source = process.env.DATAR_API_TOKEN
+        ? "env"
+        : "config-file";
+    if (!apiToken) {
+        throw new Error("No Datar API token found. Set DATAR_API_TOKEN (recommended for MCP) " +
+            `or run \`datar login\`. Mint a token at <baseUrl>/settings/api-tokens.`);
+    }
+    if (!baseUrl) {
+        throw new Error("No Datar base URL found. Set DATAR_BASE_URL (e.g. https://acme.datar.co.za " +
+            "or http://localhost:3000) or run `datar login`.");
+    }
+    if (!apiToken.startsWith("dt_")) {
+        // Non-fatal shape check — access keys (sk_) also work, but dt_ is the norm.
+        process.stderr.write(`[datar] warning: API token does not start with "dt_"; continuing anyway.\n`);
+    }
+    return { apiToken, baseUrl: baseUrl.replace(/\/$/, ""), source };
+}
+export { CONFIG_PATH };
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAO7D,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAe,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC;IAC3D,MAAM,MAAM,GAA6B,OAAO,CAAC,GAAG,CAAC,eAAe;QAClE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,aAAa,CAAC;IAElB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC3E,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,4EAA4E;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Minimal authenticated GET helper for Datar endpoints that are NOT tRPC —
+ * specifically the A2A agent-card surface (`/api/a2a/agents` and each agent's
+ * `/.well-known/agent.json`). tRPC calls go through the SDK's transport; this
+ * covers the discovery routes the SDK doesn't wrap.
+ */
+import type { ResolvedConfig } from "./config.js";
+export declare function datarGet<T = unknown>(config: ResolvedConfig, path: string): Promise<T>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/http.js

@@ -0,0 +1,22 @@
+/**
+ * Minimal authenticated GET helper for Datar endpoints that are NOT tRPC —
+ * specifically the A2A agent-card surface (`/api/a2a/agents` and each agent's
+ * `/.well-known/agent.json`). tRPC calls go through the SDK's transport; this
+ * covers the discovery routes the SDK doesn't wrap.
+ */
+export async function datarGet(config, path) {
+    const url = `${config.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+    const res = await fetch(url, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${config.apiToken}`,
+            Accept: "application/json",
+        },
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`GET ${path} failed (${res.status}): ${body.slice(0, 300)}`);
+    }
+    return (await res.json());
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAsB,EACtB,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+/**
+ * `datar` CLI entry point.
+ *
+ * Subcommands (v1, read + discovery only):
+ *   datar mcp                     Start the stdio MCP server (for Claude Code etc.)
+ *   datar whoami                  Show the org/user this token resolves to
+ *   datar ls                      List available service agents
+ *   datar ask [service] <text>    Ask an agent (defaults to the orchestrator)
+ *   datar query <path> [json]     Call a tRPC query by path (read-only)
+ *   datar <service> ls            List a service's primary records (drive, projects, …)
+ *
+ * All commands authenticate with DATAR_API_TOKEN + DATAR_BASE_URL (or `datar login`).
+ */
+import { Datar } from "@datar-platform/sdk";
+import { resolveConfig } from "./config.js";
+import { startStdioServer } from "./mcp/server.js";
+import { rejectIfMutation } from "./mcp/tools/query.js";
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    switch (cmd) {
+        case undefined:
+        case "help":
+        case "-h":
+        case "--help":
+            return printHelp();
+        case "mcp":
+            return startStdioServer();
+        case "whoami": {
+            const { client, config } = connect();
+            const [profile, tenants] = await Promise.allSettled([
+                client.query("v2.auth.getProfile"),
+                client.query("v2.auth.resolveTenantsForSession"),
+            ]);
+            print({
+                baseUrl: config.baseUrl,
+                credentialSource: config.source,
+                user: profile.status === "fulfilled" ? profile.value : null,
+                tenants: tenants.status === "fulfilled" ? tenants.value : null,
+            });
+            return;
+        }
+        case "ls":
+        case "services": {
+            const { client } = connect();
+            print(await client.query("v2.ai.agents.listServices"));
+            return;
+        }
+        case "ask": {
+            const { client } = connect();
+            // `datar ask projects "how many open tasks"` OR `datar ask "…"` (orchestrator)
+            const known = new Set([
+                "orchestrator",
+                "drive",
+                "projects",
+                "people",
+                "requests",
+                "inventory",
+                "messages",
+                "social",
+                "procurement",
+                "transact",
+                "isms",
+                "advice",
+            ]);
+            let service = "orchestrator";
+            let words = rest;
+            if (rest.length > 1 && known.has(rest[0])) {
+                service = rest[0];
+                words = rest.slice(1);
+            }
+            const message = words.join(" ").trim();
+            if (!message)
+                throw new Error("Usage: datar ask [service] <question>");
+            const res = await client.ai.ask({ service: service, message });
+            process.stdout.write(`${res.text}\n`);
+            if (res.data)
+                print(res.data);
+            return;
+        }
+        case "query": {
+            const { client } = connect();
+            const path = rest[0];
+            if (!path)
+                throw new Error("Usage: datar query <v2.path> [json-input]");
+            const reason = rejectIfMutation(path);
+            if (reason)
+                throw new Error(reason);
+            const input = rest[1] ? JSON.parse(rest[1]) : undefined;
+            print(await client.query(path, input));
+            return;
+        }
+        // `datar <service> ls` — thin listing shortcuts over the SDK.
+        case "drive":
+        case "projects":
+        case "requests":
+        case "transact":
+        case "procurement":
+        case "inventory":
+        case "isms":
+        case "invoicing":
+        case "messages":
+            return serviceList(cmd, rest);
+        default:
+            process.stderr.write(`Unknown command: ${cmd}\n\n`);
+            printHelp();
+            process.exitCode = 1;
+    }
+}
+/** `datar <service> ls` dispatch. */
+async function serviceList(service, rest) {
+    const sub = rest[0] ?? "ls";
+    if (sub !== "ls") {
+        throw new Error(`Unknown subcommand: datar ${service} ${sub} (only 'ls' in v1)`);
+    }
+    const { client } = connect();
+    const listers = {
+        drive: () => client.drive.listFiles(),
+        projects: () => client.projects.list(),
+        requests: () => client.requests.getAll(),
+        transact: () => client.transact.listAccounts(),
+        procurement: () => client.procurement.listTenders(),
+        inventory: () => client.inventory.listItems(),
+        isms: () => client.isms.listRisks(),
+        invoicing: () => client.invoicing.listInvoices(),
+        messages: () => client.messages.list(),
+    };
+    const fn = listers[service];
+    if (!fn)
+        throw new Error(`No 'ls' for service '${service}'`);
+    print(await fn());
+}
+function connect() {
+    const config = resolveConfig();
+    const client = new Datar({
+        apiToken: config.apiToken,
+        baseUrl: config.baseUrl,
+    });
+    return { client, config };
+}
+function print(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+function printHelp() {
+    process.stdout.write([
+        "datar — CLI + MCP server for the Datar platform (v1: read + discovery)",
+        "",
+        "Usage:",
+        "  datar mcp                     Start the stdio MCP server (for Claude Code)",
+        "  datar whoami                  Show the org/user this token resolves to",
+        "  datar ls                      List available service agents",
+        "  datar ask [service] <text>    Ask an agent (default: orchestrator)",
+        "  datar query <v2.path> [json]  Call a tRPC query by path (read-only)",
+        "  datar <service> ls            List records (drive|projects|requests|transact|",
+        "                                procurement|inventory|isms|invoicing|messages)",
+        "",
+        "Auth: set DATAR_API_TOKEN and DATAR_BASE_URL. Mint a token at",
+        "      <baseUrl>/settings/api-tokens (scope it to reads for v1).",
+        "",
+    ].join("\n"));
+}
+main(process.argv.slice(2)).catch((err) => {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE5B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QAErB,KAAK,KAAK;YACR,OAAO,gBAAgB,EAAE,CAAC;QAE5B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBAClD,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;gBAClC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC;aACjD,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,MAAM,CAAC,MAAM;gBAC/B,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC3D,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,IAAI,CAAC;QACV,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;gBACpB,cAAc;gBACd,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,aAAa;gBACb,UAAU;gBACV,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,cAAc,CAAC;YAC7B,IAAI,KAAK,GAAG,IAAI,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBAC3C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;gBACnB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,8DAA8D;QAC9D,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,WAAW,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEhC;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,MAAM,CAAC,CAAC;YACpD,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,qCAAqC;AACrC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,IAAc;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,6BAA6B,OAAO,IAAI,GAAG,oBAAoB,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IAC7B,MAAM,OAAO,GAA2C;QACtD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;QACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;QACxC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC9C,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE;QAC7C,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;QACnC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE;QAChD,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;KACvC,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO;IAId,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,wEAAwE;QACxE,EAAE;QACF,QAAQ;QACR,8EAA8E;QAC9E,0EAA0E;QAC1E,+DAA+D;QAC/D,sEAAsE;QACtE,uEAAuE;QACvE,iFAAiF;QACjF,gFAAgF;QAChF,EAAE;QACF,+DAA+D;QAC/D,iEAAiE;QACjE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/mcp/registry.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Transport-agnostic tool registry.
+ *
+ * A `ToolDef` is a plain description of one MCP tool: its name, human/agent-
+ * facing description, a Zod raw-shape input schema, and a handler that receives
+ * the shared `Datar` SDK client plus the parsed args. The stdio server
+ * (`server.ts`) adapts these into `registerTool` calls; a future remote HTTP
+ * endpoint can consume the SAME array — hence no MCP or stdio types leak in here.
+ *
+ * v1 invariant: READ ONLY. Every handler here must only ever call SDK read
+ * methods or `client.query(...)` (tRPC GET). None may call a mutation. This is
+ * defense-in-depth on top of the real guard, which is the token's scopes.
+ */
+import type { ZodRawShape } from "zod";
+import type { Datar } from "@datar-platform/sdk";
+export interface ToolDef<Shape extends ZodRawShape = ZodRawShape> {
+    name: string;
+    description: string;
+    /** Zod raw shape (object of zod validators). Empty object = no args. */
+    inputSchema: Shape;
+    /** Read-only handler. Returns any JSON-serialisable value. */
+    handler: (client: Datar, args: Record<string, unknown>) => Promise<unknown>;
+}
+/** Helper to define a tool with inferred shape while keeping the union homogeneous. */
+export declare function tool<Shape extends ZodRawShape>(def: ToolDef<Shape>): ToolDef;
+//# sourceMappingURL=registry.d.ts.map

package/dist/mcp/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAEvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,WAAW,OAAO,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,KAAK,CAAC;IACnB,8DAA8D;IAC9D,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7E;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,KAAK,SAAS,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAE5E"}

package/dist/mcp/registry.js

@@ -0,0 +1,18 @@
+/**
+ * Transport-agnostic tool registry.
+ *
+ * A `ToolDef` is a plain description of one MCP tool: its name, human/agent-
+ * facing description, a Zod raw-shape input schema, and a handler that receives
+ * the shared `Datar` SDK client plus the parsed args. The stdio server
+ * (`server.ts`) adapts these into `registerTool` calls; a future remote HTTP
+ * endpoint can consume the SAME array — hence no MCP or stdio types leak in here.
+ *
+ * v1 invariant: READ ONLY. Every handler here must only ever call SDK read
+ * methods or `client.query(...)` (tRPC GET). None may call a mutation. This is
+ * defense-in-depth on top of the real guard, which is the token's scopes.
+ */
+/** Helper to define a tool with inferred shape while keeping the union homogeneous. */
+export function tool(def) {
+    return def;
+}
+//# sourceMappingURL=registry.js.map

package/dist/mcp/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/mcp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,uFAAuF;AACvF,MAAM,UAAU,IAAI,CAA4B,GAAmB;IACjE,OAAO,GAAyB,CAAC;AACnC,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Datar MCP server (stdio transport).
+ *
+ * Holds exactly one `Datar` SDK client (authenticated by the resolved `dt_`
+ * token) and registers the v1 read + discovery tool registry against an
+ * `McpServer`. Errors are returned as `isError` tool results so the harness can
+ * see and recover from them rather than the whole server crashing.
+ *
+ * The registry (./tools) is transport-agnostic — a future remote HTTP MCP
+ * endpoint can register the same `ToolDef[]` against a StreamableHTTP transport.
+ */
+import { Datar } from "@datar-platform/sdk";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { ResolvedConfig } from "../config.js";
+import type { ToolDef } from "./registry.js";
+/** Build an `McpServer` with the given client + tools registered. */
+export declare function createDatarMcpServer(client: Datar, tools: ToolDef[]): McpServer;
+/** Entry point for `datar mcp`: resolve config, wire the client, serve on stdio. */
+export declare function startStdioServer(config?: ResolvedConfig): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAO7C,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,KAAK,EACb,KAAK,EAAE,OAAO,EAAE,GACf,SAAS,CAgCX;AAED,oFAAoF;AACpF,wBAAsB,gBAAgB,CACpC,MAAM,GAAE,cAAgC,GACvC,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/mcp/server.js

@@ -0,0 +1,75 @@
+/**
+ * Datar MCP server (stdio transport).
+ *
+ * Holds exactly one `Datar` SDK client (authenticated by the resolved `dt_`
+ * token) and registers the v1 read + discovery tool registry against an
+ * `McpServer`. Errors are returned as `isError` tool results so the harness can
+ * see and recover from them rather than the whole server crashing.
+ *
+ * The registry (./tools) is transport-agnostic — a future remote HTTP MCP
+ * endpoint can register the same `ToolDef[]` against a StreamableHTTP transport.
+ */
+import { Datar } from "@datar-platform/sdk";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { resolveConfig } from "../config.js";
+import { buildRegistry } from "./tools/index.js";
+const SERVER_NAME = "datar";
+const SERVER_VERSION = "0.1.0";
+/** Build an `McpServer` with the given client + tools registered. */
+export function createDatarMcpServer(client, tools) {
+    const server = new McpServer({
+        name: SERVER_NAME,
+        version: SERVER_VERSION,
+    });
+    for (const def of tools) {
+        server.registerTool(def.name, { description: def.description, inputSchema: def.inputSchema }, async (args) => {
+            try {
+                const result = await def.handler(client, args ?? {});
+                return {
+                    content: [{ type: "text", text: safeStringify(result) }],
+                };
+            }
+            catch (err) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error in ${def.name}: ${errMessage(err)}`,
+                        },
+                    ],
+                };
+            }
+        });
+    }
+    return server;
+}
+/** Entry point for `datar mcp`: resolve config, wire the client, serve on stdio. */
+export async function startStdioServer(config = resolveConfig()) {
+    const client = new Datar({
+        apiToken: config.apiToken,
+        baseUrl: config.baseUrl,
+    });
+    const server = createDatarMcpServer(client, buildRegistry(config));
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    // stderr is safe (stdout is the MCP channel); stdout must stay JSON-RPC only.
+    process.stderr.write(`[datar-mcp] connected to ${config.baseUrl} — read + discovery tools ready.\n`);
+}
+function safeStringify(value) {
+    if (typeof value === "string")
+        return value;
+    try {
+        return JSON.stringify(value, null, 2);
+    }
+    catch {
+        return String(value);
+    }
+}
+function errMessage(err) {
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAIjF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,MAAa,EACb,KAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,YAAY,CACjB,GAAG,CAAC,IAAI,EACR,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAC9D,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,YAAY,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE;yBACjD;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAyB,aAAa,EAAE;IAExC,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,MAAM,CAAC,OAAO,oCAAoC,CAC/E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/mcp/tools/ask.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Natural-language fallback — forward a free-form question to a Datar A2A agent
+ * (or the orchestrator, which routes for you). This reuses the whole agent
+ * stack (tool-calling, KB grounding, cross-service delegation) for anything the
+ * typed read tools don't cover.
+ *
+ * THIS TOOL CAN ACT. The agent may call mutating endpoints, and token scopes do
+ * NOT reliably stop it (serviceProcedure endpoints skip the scope middleware).
+ * So it is registered only when DATAR_MCP_ALLOW_AGENT=1 — the default read-only
+ * surface omits it entirely. See ./index.ts and the CLI README.
+ */
+import type { ToolDef } from "../registry.js";
+export declare const askTool: ToolDef;
+//# sourceMappingURL=ask.d.ts.map

package/dist/mcp/tools/ask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/ask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAoB9C,eAAO,MAAM,OAAO,EAAE,OAyCpB,CAAC"}