@embrasure/ember 0.2.0

package/README.md

@@ -0,0 +1,58 @@
+# Ember CLI and MCP
+
+The v0.2.0 tool contract replaces the original setup/status/audit tool names. Refresh your MCP client's tool list after upgrading.
+
+`@embrasure/ember` gives engineers and agents one safe interface for operating an Ember managed data warehouse.
+
+```sh
+npx @embrasure/ember auth login
+npx @embrasure/ember setup
+npx @embrasure/ember status
+```
+
+OAuth-capable MCP clients can connect directly to:
+
+```text
+https://embrasure.ai/api/mcp/ember
+```
+
+Clients without remote OAuth can run `ember mcp serve`. Both transports expose exactly five tools: `warehouse`, `sources`, `ingestion`, `catalog`, and `query`.
+
+Source secrets are never MCP arguments. OAuth and browser-configured sources return a secure handoff URL. The CLI can read database credentials from an environment variable or stdin:
+
+```sh
+ember source connect postgres --credential-env DATABASE_URL
+printf '%s' "$DATABASE_URL" | ember source connect postgres --credential-stdin
+```
+
+Ingestion planning selects every eligible discovered table automatically and reports blocked tables. Batch ingestion also adds newly discovered eligible tables. Use `--tables` only to explicitly restrict tables, columns, keys, or cursors; an explicit table list disables automatic additions. CDC engines require another plan for new tables. A successful start means ingestion was scheduled; inspect status, then verify an answer with a read-only query.
+
+All warehouse SQL is server-enforced as read-only. Query and ingestion operations return handles for polling, pagination, and cancellation.
+
+Start business questions with `catalog` so the agent can find the agreed metric definition before writing SQL:
+
+```sh
+ember catalog search "latest onboarding rates"
+ember catalog describe <object-id>
+ember catalog tables ember
+ember catalog table ember <table>
+ember warehouse usage
+```
+
+Search returns up to 10 matches by default, with semantic meaning, verification, conflicts, and freshness.
+Use `--refs` to anchor the search to known source or relation references. Search is bounded; refine the
+question if results are incomplete. Table listings support `--next-token`, and table descriptions support
+`--column-offset` for wide schemas. Internal audit logging continues without an exposed `audit` tool.
+
+Remote OAuth starts with read access and requests additional scopes for changes. MCP calls validate the
+session on every request. Oversized pages return an error; retry the same cursor with a smaller limit
+(up to 100 rows for query results). After a timeout or cancellation, check operation status before
+retrying a change. Cancelling the client request does not undo accepted warehouse work.
+
+## Embrasure plugin
+
+The public Embrasure plugin at `https://embrasure.ai/api/mcp` reuses this operator with
+`createEmberMcpHttpHandler(resolveOperator, { surface: "embrasure" })`. It retains the Embrasure
+name and enables additional catalog save/correct and ingestion inspect_table/edit_table actions.
+These edits preview by default and use the existing workspace-authorized APIs. The standalone
+Ember CLI and MCP schemas remain unchanged. Both surfaces keep SQL read-only.

package/dist/auth.d.ts

@@ -0,0 +1,24 @@
+export declare const DEFAULT_API_URL = "https://api.embrasure.ai";
+export declare const DEFAULT_WEB_URL = "https://app.embrasure.ai";
+export type EmberConfig = {
+    apiBaseUrl?: string;
+    webBaseUrl?: string;
+    workspaceId?: string;
+    expiresAt?: string;
+    refreshExpiresAt?: string;
+    sessionId?: string;
+    deviceId?: string;
+};
+export type Runtime = {
+    apiBaseUrl: string;
+    webBaseUrl: string;
+    workspaceId: string | null;
+    accessToken: string | null;
+};
+export declare function emberConfigPath(): string;
+export declare function readEmberConfig(): Promise<EmberConfig>;
+export declare function resolveRuntime(overrides?: Partial<Runtime>, env?: NodeJS.ProcessEnv): Promise<Runtime>;
+export declare function browserLogin(runtime: Runtime, open?: boolean): Promise<Runtime>;
+export declare function logout(): Promise<{
+    sessionRevoked: boolean;
+}>;

package/dist/auth.js

@@ -0,0 +1,305 @@
+import { EMBER_VERSION } from "./version.js";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { mkdir, open as openFile, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { homedir, hostname, platform } from "node:os";
+import { dirname, join } from "node:path";
+const SERVICE = "ai.embrasure.ember";
+const ACCOUNT = "refresh_token";
+const AUTH_REQUEST_TIMEOUT_MS = 20_000;
+let memorySession = null;
+let refreshInFlight = null;
+export const DEFAULT_API_URL = "https://api.embrasure.ai";
+export const DEFAULT_WEB_URL = "https://app.embrasure.ai";
+export function emberConfigPath() { return join(homedir(), ".ember", "config.json"); }
+export async function readEmberConfig() {
+    try {
+        return JSON.parse(await readFile(emberConfigPath(), "utf8"));
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+async function writeEmberConfig(config) {
+    const path = emberConfigPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+}
+export async function resolveRuntime(overrides = {}, env = process.env) {
+    const config = await readEmberConfig();
+    const apiBaseUrl = trim(overrides.apiBaseUrl ?? env.EMBER_API_BASE_URL ?? config.apiBaseUrl ?? DEFAULT_API_URL);
+    const webBaseUrl = trim(overrides.webBaseUrl ?? env.EMBER_WEB_BASE_URL ?? config.webBaseUrl ?? DEFAULT_WEB_URL);
+    const workspaceId = overrides.workspaceId ?? env.EMBER_WORKSPACE_ID ?? config.workspaceId ?? null;
+    let accessToken = overrides.accessToken ?? env.EMBER_API_TOKEN ?? null;
+    if (!overrides.accessToken && !env.EMBER_API_TOKEN) {
+        if (memorySession?.accessToken && memorySession.sessionId === config.sessionId && !expiresSoon(memorySession.expiresAt)) {
+            return { apiBaseUrl, webBaseUrl, workspaceId, accessToken: memorySession.accessToken };
+        }
+        const payload = await withRefreshLock(async () => {
+            const refreshToken = await readKeychain();
+            if (!refreshToken)
+                return null;
+            const refreshed = await refreshSession(apiBaseUrl, refreshToken);
+            if (typeof refreshed.access_token !== "string")
+                throw new Error("Ember login expired. Run `ember auth login`.");
+            await storeSession(await readEmberConfig(), refreshed, apiBaseUrl, webBaseUrl, workspaceId);
+            return refreshed;
+        });
+        if (payload) {
+            accessToken = typeof payload.access_token === "string" ? payload.access_token : null;
+        }
+    }
+    return { apiBaseUrl, webBaseUrl, workspaceId, accessToken };
+}
+async function withRefreshLock(action) {
+    const directory = dirname(emberConfigPath());
+    const lockPath = join(directory, "refresh.lock");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + 75_000;
+    while (true) {
+        try {
+            const handle = await openFile(lockPath, "wx", 0o600);
+            const owner = `${process.pid}:${randomUUID()}\n`;
+            try {
+                await handle.writeFile(owner);
+                return await action();
+            }
+            finally {
+                await handle.close();
+                const currentOwner = await readFile(lockPath, "utf8").catch(() => null);
+                if (currentOwner === owner)
+                    await rm(lockPath, { force: true });
+            }
+        }
+        catch (error) {
+            if (!error || typeof error !== "object" || !("code" in error) || error.code !== "EEXIST")
+                throw error;
+            try {
+                const lock = await stat(lockPath);
+                if (Date.now() - lock.mtimeMs > 30_000) {
+                    await rm(lockPath, { force: true });
+                    continue;
+                }
+            }
+            catch (lockError) {
+                if (!lockError || typeof lockError !== "object" || !("code" in lockError) || lockError.code !== "ENOENT")
+                    throw lockError;
+            }
+            if (Date.now() >= deadline)
+                throw new Error("Timed out waiting for another Ember process to refresh authentication.");
+            await new Promise((resolve) => setTimeout(resolve, 75 + Math.floor(Math.random() * 75)));
+        }
+    }
+}
+export async function browserLogin(runtime, open = true) {
+    const state = randomBytes(24).toString("base64url");
+    const verifier = randomBytes(48).toString("base64url");
+    const challenge = createHash("sha256").update(verifier, "ascii").digest("base64url");
+    const config = await readEmberConfig();
+    const deviceId = config.deviceId ?? randomUUID();
+    const callback = await callbackServer(state);
+    const url = new URL("/cli-auth/complete", runtime.webBaseUrl);
+    for (const [key, value] of Object.entries({
+        state, api_base_url: runtime.apiBaseUrl, return_url: callback.returnUrl, code_challenge: challenge,
+        code_challenge_method: "S256", device_id: deviceId, device_name: hostname().slice(0, 200) || "This computer",
+        platform: platform(), client: "ember", client_version: EMBER_VERSION, workspace_id: runtime.workspaceId ?? undefined,
+        scope: "read write admin",
+    }))
+        if (value)
+            url.searchParams.set(key, value);
+    process.stderr.write(`Open to sign in:\n${url.toString()}\n`);
+    if (open)
+        await openBrowser(url.toString());
+    try {
+        const code = await callback.wait();
+        const response = await fetch(`${runtime.apiBaseUrl}/v1/auth/session/token`, {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: verifier, redirect_uri: callback.returnUrl }),
+            signal: AbortSignal.timeout(AUTH_REQUEST_TIMEOUT_MS),
+        });
+        const payload = await response.json().catch(() => ({}));
+        if (!response.ok || typeof payload.access_token !== "string" || typeof payload.refresh_token !== "string" || typeof payload.workspace_id !== "string") {
+            throw new Error(typeof payload.detail === "string" ? payload.detail : "Browser sign-in failed.");
+        }
+        await withRefreshLock(() => storeSession({ ...config, deviceId }, payload, runtime.apiBaseUrl, runtime.webBaseUrl, payload.workspace_id));
+        return { ...runtime, accessToken: payload.access_token, workspaceId: payload.workspace_id };
+    }
+    finally {
+        await callback.close();
+    }
+}
+export async function logout() {
+    return withRefreshLock(async () => {
+        const config = await readEmberConfig();
+        const refreshToken = await readKeychain();
+        let sessionRevoked = false;
+        if (refreshToken) {
+            const response = await fetch(`${trim(config.apiBaseUrl ?? DEFAULT_API_URL)}/v1/auth/session/revoke`, {
+                method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ refresh_token: refreshToken }),
+                signal: AbortSignal.timeout(AUTH_REQUEST_TIMEOUT_MS),
+            }).catch(() => null);
+            sessionRevoked = response?.ok ?? false;
+        }
+        await deleteKeychain();
+        await rm(emberConfigPath(), { force: true });
+        return { sessionRevoked };
+    });
+}
+async function storeSession(config, payload, apiBaseUrl, webBaseUrl, workspaceId) {
+    if (typeof payload.refresh_token === "string")
+        await writeKeychain(payload.refresh_token);
+    const sessionId = stringValue(payload.session_id) ?? config.sessionId;
+    const expiresAt = stringValue(payload.expires_at);
+    if (typeof payload.access_token === "string")
+        memorySession = { sessionId, accessToken: payload.access_token, expiresAt };
+    await writeEmberConfig({ ...config, apiBaseUrl, webBaseUrl, workspaceId: typeof payload.workspace_id === "string" ? payload.workspace_id : workspaceId ?? undefined, expiresAt, refreshExpiresAt: stringValue(payload.refresh_expires_at), sessionId });
+}
+async function refreshSession(apiBaseUrl, refreshToken) {
+    if (refreshInFlight)
+        return refreshInFlight;
+    refreshInFlight = (async () => {
+        let token = refreshToken;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const response = await fetch(`${apiBaseUrl}/v1/auth/session/refresh`, {
+                method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ refresh_token: token }),
+                signal: AbortSignal.timeout(AUTH_REQUEST_TIMEOUT_MS),
+            });
+            const payload = await response.json().catch(() => ({}));
+            if (response.ok && typeof payload.access_token === "string")
+                return payload;
+            if (attempt === 0) {
+                await new Promise((resolve) => setTimeout(resolve, 150));
+                const rotated = await readKeychain();
+                if (rotated && rotated !== token) {
+                    token = rotated;
+                    continue;
+                }
+            }
+            throw new Error("Ember login expired. Run `ember auth login`.");
+        }
+        throw new Error("Ember login expired. Run `ember auth login`.");
+    })();
+    try {
+        return await refreshInFlight;
+    }
+    finally {
+        refreshInFlight = null;
+    }
+}
+function expiresSoon(value) {
+    if (!value)
+        return true;
+    const expiresAt = Date.parse(value);
+    return !Number.isFinite(expiresAt) || expiresAt <= Date.now() + 60_000;
+}
+function stringValue(value) { return typeof value === "string" ? value : undefined; }
+function trim(value) { return value.replace(/\/+$/, ""); }
+async function callbackServer(state) {
+    let resolveCode;
+    let rejectCode;
+    const promise = new Promise((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        const code = url.searchParams.get("code");
+        if (url.pathname !== "/callback") {
+            response.writeHead(404).end("Not found.");
+            return;
+        }
+        if (request.method !== "GET" || url.searchParams.get("state") !== state || !code) {
+            response.writeHead(400).end("Ember sign-in failed. Return to your terminal.");
+            rejectCode(new Error("Browser sign-in returned an invalid callback."));
+            return;
+        }
+        response.writeHead(200, { "Content-Type": "text/plain" }).end("Ember is signed in. You can close this tab.");
+        resolveCode(code);
+    });
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(0, "127.0.0.1", resolve); });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Could not start login callback.");
+    const timeout = setTimeout(() => rejectCode(new Error("Timed out waiting for browser sign-in.")), 180_000);
+    timeout.unref();
+    return { returnUrl: `http://127.0.0.1:${address.port}/callback`, wait: () => promise, close: async () => { clearTimeout(timeout); await new Promise((resolve) => server.close(() => resolve())); } };
+}
+function openBrowser(url) {
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    return run(command, args).catch(() => undefined);
+}
+async function readKeychain() {
+    if (process.platform === "darwin")
+        return run("ruby", ["-e", MAC_KEYCHAIN_SCRIPT, "read", SERVICE, ACCOUNT]).then((v) => v.trim() || null).catch(() => null);
+    if (process.platform === "linux")
+        return run("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT]).then((v) => v.trim() || null).catch(() => null);
+    return null;
+}
+async function writeKeychain(value) {
+    memorySession = null;
+    if (process.platform === "darwin") {
+        await run("ruby", ["-e", MAC_KEYCHAIN_SCRIPT, "write", SERVICE, ACCOUNT], value);
+        return;
+    }
+    if (process.platform === "linux") {
+        await run("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT]).catch(() => undefined);
+        await run("secret-tool", ["store", "--label=Ember CLI auth", "service", SERVICE, "account", ACCOUNT], value);
+        return;
+    }
+    throw new Error("Ember browser login requires macOS Keychain or Linux Secret Service. Use EMBER_API_TOKEN on this platform.");
+}
+async function deleteKeychain() {
+    memorySession = null;
+    if (process.platform === "darwin")
+        await run("security", ["delete-generic-password", "-s", SERVICE, "-a", ACCOUNT]).catch(() => undefined);
+    if (process.platform === "linux")
+        await run("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT]).catch(() => undefined);
+}
+function run(command, args, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const timeout = setTimeout(() => { child.kill(); reject(new Error(`${command} timed out.`)); }, 5_000);
+        timeout.unref();
+        child.stdout.on("data", (chunk) => { stdout += chunk; });
+        child.stderr.on("data", (chunk) => { stderr += chunk; });
+        child.once("error", (error) => { clearTimeout(timeout); reject(error); });
+        child.once("close", (code) => { clearTimeout(timeout); code === 0 ? resolve(stdout) : reject(new Error(stderr.trim() || `${command} failed.`)); });
+        child.stdin.end(input);
+    });
+}
+const MAC_KEYCHAIN_SCRIPT = String.raw `
+require 'fiddle'
+require 'fiddle/import'
+module Security
+  extend Fiddle::Importer
+  dlload '/System/Library/Frameworks/Security.framework/Security'
+  extern 'int SecKeychainAddGenericPassword(void*, unsigned int, void*, unsigned int, void*, unsigned int, void*, void*)'
+  extern 'int SecKeychainFindGenericPassword(void*, unsigned int, void*, unsigned int, void*, void*, void*, void*)'
+  extern 'int SecKeychainItemModifyAttributesAndData(void*, void*, unsigned int, void*)'
+  extern 'int SecKeychainItemFreeContent(void*, void*)'
+end
+op, service, account = ARGV
+if op == 'write'
+  secret = STDIN.read
+  item_ref = [0].pack('J')
+  found = Security.SecKeychainFindGenericPassword(0, service.bytesize, service, account.bytesize, account, 0, 0, item_ref)
+  status = if found == 0
+    Security.SecKeychainItemModifyAttributesAndData(item_ref.unpack1('J'), 0, secret.bytesize, secret)
+  else
+    Security.SecKeychainAddGenericPassword(0, service.bytesize, service, account.bytesize, account, secret.bytesize, secret, 0)
+  end
+  abort("Keychain write failed: #{status}") unless status == 0
+elsif op == 'read'
+  length = [0].pack('L!')
+  data = [0].pack('J')
+  status = Security.SecKeychainFindGenericPassword(0, service.bytesize, service, account.bytesize, account, length, data, 0)
+  exit 0 unless status == 0
+  byte_count = length.unpack1('L!')
+  pointer = data.unpack1('J')
+  print Fiddle::Pointer.new(pointer)[0, byte_count]
+  Security.SecKeychainItemFreeContent(0, pointer)
+end
+`;

package/dist/catalog.d.ts

@@ -0,0 +1,180 @@
+import type { EmbrasureApiClient, UnifiedContextObject } from "@embrasure/api-client";
+import type { CatalogInput } from "./types.js";
+export declare function readCatalog(client: EmbrasureApiClient, workspaceId: string, input: CatalogInput): Promise<{
+    ok: boolean;
+    action: string;
+    data: {
+        database: string;
+        next_token: string | null;
+        tables: {
+            column_count: number;
+            database: string;
+            name: string;
+            catalog_name: string;
+            schema_name: string;
+            table_name: string;
+            logical_schema?: string | null;
+            logical_table?: string | null;
+            source_schema?: string | null;
+            source_table?: string | null;
+            query_name: string;
+            relation_type?: "table" | "view";
+            created_at?: string | null;
+            updated_at?: string | null;
+        }[];
+        object_id?: undefined;
+        object?: undefined;
+        related?: undefined;
+        edges?: undefined;
+        join_plans?: undefined;
+        evidence?: undefined;
+        evidence_links?: undefined;
+        observations?: undefined;
+        conflicts?: undefined;
+        freshness?: undefined;
+        coverage?: undefined;
+        warnings?: undefined;
+        query_id?: undefined;
+        matches?: undefined;
+        meaning_candidates?: undefined;
+        memories?: undefined;
+        truncated?: undefined;
+        exhaustive?: undefined;
+    };
+    next_action: string;
+} | {
+    ok: boolean;
+    action: string;
+    data: {
+        columns: import("@embrasure/api-client").WarehouseTableColumnResponse[];
+        column_count: number;
+        column_offset: number;
+        next_column_offset: number | null;
+        database: string;
+        name: string;
+        catalog_name: string;
+        schema_name: string;
+        table_name: string;
+        logical_schema?: string | null;
+        logical_table?: string | null;
+        source_schema?: string | null;
+        source_table?: string | null;
+        query_name: string;
+        relation_type?: "table" | "view";
+        created_at?: string | null;
+        updated_at?: string | null;
+        next_token?: undefined;
+        tables?: undefined;
+        object_id?: undefined;
+        object?: undefined;
+        related?: undefined;
+        edges?: undefined;
+        join_plans?: undefined;
+        evidence?: undefined;
+        evidence_links?: undefined;
+        observations?: undefined;
+        conflicts?: undefined;
+        freshness?: undefined;
+        coverage?: undefined;
+        warnings?: undefined;
+        query_id?: undefined;
+        matches?: undefined;
+        meaning_candidates?: undefined;
+        memories?: undefined;
+        truncated?: undefined;
+        exhaustive?: undefined;
+    };
+    next_action: string;
+} | {
+    ok: boolean;
+    action: string;
+    data: {
+        object_id: string;
+        object: UnifiedContextObject;
+        related: {
+            object_id: string;
+            kind: string;
+            stable_key: string;
+            title: string;
+            summary: string | undefined;
+            summary_truncated: boolean;
+            connector_id: string | null | undefined;
+            source_id: string | null | undefined;
+            verification_status: string;
+            truth_kind: import("@embrasure/api-client").ContextTruthKind | undefined;
+            authority: Record<string, unknown> | undefined;
+            authority_score: number | null | undefined;
+            confidence: number;
+            updated_at: string | null | undefined;
+            valid_until: string | null | undefined;
+            match: {
+                streams?: string[];
+            } | null | undefined;
+        }[];
+        edges: Record<string, import("@embrasure/api-client").UnifiedContextEdge>;
+        join_plans: import("@embrasure/api-client").ContextJoinPlan[] | undefined;
+        evidence: Record<string, import("@embrasure/api-client").ContextEvidence>;
+        evidence_links: import("@embrasure/api-client").ContextEvidenceLink[];
+        observations: import("@embrasure/api-client").ContextObservation[];
+        conflicts: Record<string, unknown>[] | undefined;
+        freshness: Record<string, unknown> | undefined;
+        coverage: import("@embrasure/api-client").ContextCoverageSummary;
+        warnings: string[] | undefined;
+        database?: undefined;
+        next_token?: undefined;
+        tables?: undefined;
+        query_id?: undefined;
+        matches?: undefined;
+        meaning_candidates?: undefined;
+        memories?: undefined;
+        truncated?: undefined;
+        exhaustive?: undefined;
+    };
+    next_action: string;
+} | {
+    ok: boolean;
+    action: string;
+    data: {
+        query_id: string;
+        matches: {
+            object_id: string;
+            kind: string;
+            stable_key: string;
+            title: string;
+            summary: string | undefined;
+            summary_truncated: boolean;
+            connector_id: string | null | undefined;
+            source_id: string | null | undefined;
+            verification_status: string;
+            truth_kind: import("@embrasure/api-client").ContextTruthKind | undefined;
+            authority: Record<string, unknown> | undefined;
+            authority_score: number | null | undefined;
+            confidence: number;
+            updated_at: string | null | undefined;
+            valid_until: string | null | undefined;
+            match: {
+                streams?: string[];
+            } | null | undefined;
+        }[];
+        meaning_candidates: Record<string, unknown>[];
+        memories: Record<string, unknown>[];
+        conflicts: Record<string, unknown>[] | undefined;
+        freshness: Record<string, unknown> | undefined;
+        coverage: import("@embrasure/api-client").ContextCoverageSummary;
+        warnings: string[] | undefined;
+        truncated: boolean;
+        exhaustive: boolean;
+        database?: undefined;
+        next_token?: undefined;
+        tables?: undefined;
+        object_id?: undefined;
+        object?: undefined;
+        related?: undefined;
+        edges?: undefined;
+        join_plans?: undefined;
+        evidence?: undefined;
+        evidence_links?: undefined;
+        observations?: undefined;
+    };
+    next_action: string;
+}>;