@hydradb/mcp 1.2.1 → 1.3.0

package/dist/http.js

@@ -0,0 +1,427 @@
+#!/usr/bin/env node
+/**
+ * The remotely hostable HTTP transport.
+ *
+ * This is the server behind a URL like `https://mcp.hydradb.com/mcp`: instead of
+ * every user installing and spawning the stdio binary ({@link file://./index.ts}),
+ * one process answers MCP over HTTP and each user points their client at the URL.
+ *
+ * It reuses the whole tool surface unchanged — {@link createHydraDBServer} builds
+ * exactly the same server the stdio path does. The only things this file adds are
+ * the ones a network endpoint needs and a pipe does not: a Host/Origin
+ * allowlist, CORS, and PER-REQUEST tenant credentials (see
+ * {@link file://./http-config.ts}), because one hosted process has no single
+ * ambient account to run as.
+ *
+ * Sessions are stateless: MCP's Protocol object binds to one transport, so a
+ * shared process serving many independent callers builds a fresh server +
+ * transport per request and tears it down when the response closes. That is the
+ * transport's documented stateless mode (`sessionIdGenerator: undefined`).
+ */
+import cors from "cors";
+import express from "express";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { HydraDB } from "./hydra/index.js";
+import { buildAllowedHosts, jsonRpcError, parseList, parsePort, resolveHttpServerConfig, resolveRequestCredentials, } from "./http-config.js";
+import { logger } from "./logger.js";
+import { introspect, isAccessToken, metadataUrl, protectedResourceMetadata, wwwAuthenticate, } from "./oauth.js";
+import { awaitInFlight, beginShutdown, createHydraDBServer, inFlightCount, } from "./server.js";
+/**
+ * The largest request body accepted before parsing.
+ *
+ * Sized above the tool layer's own ceilings — memory ingest caps `text` at 1M
+ * characters (~4 MB as UTF-8 with a JSON envelope), which is the biggest
+ * legitimate body — so a valid large ingest is not rejected at the door while an
+ * unbounded body cannot exhaust memory. Anything genuinely oversized is still
+ * refused by the per-tool checks with a message naming the real limit.
+ */
+const MAX_REQUEST_BODY = "8mb";
+/**
+ * Startup banners and security warnings go straight to stderr, not through
+ * `logger`.
+ *
+ * `logger` is gated by `HYDRADB_LOG_LEVEL`, which defaults to ERROR, so a
+ * `logger.warn` about a public bind would be invisible in the exact default
+ * configuration where it matters most. These lines must surface regardless of
+ * level — the same reason the deprecated-alias warnings bypass the logger — so
+ * they use `console.error` (stderr) directly. Per-request and lifecycle logging
+ * still goes through `logger`.
+ */
+function banner(message) {
+    console.error(`[hydradb-mcp] ${message}`);
+}
+/** The bearer value from an `Authorization` header, scheme-insensitive. */
+function bearerFromHeader(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    if (!raw)
+        return undefined;
+    const match = /^\s*Bearer\s+(.+)$/i.exec(raw);
+    return (match ? match[1] : raw).trim() || undefined;
+}
+/** JSON-RPC error codes used for transport-level failures (spec: -32000 range). */
+const JSONRPC_UNAUTHORIZED = -32001;
+const JSONRPC_BAD_REQUEST = -32602;
+const JSONRPC_INTERNAL_ERROR = -32603;
+const JSONRPC_MISDIRECTED = -32000;
+/**
+ * Build the Express app for the HTTP transport.
+ *
+ * Exported (and taking its config as an argument rather than reading the
+ * environment) so tests exercise the exact wiring production runs, against an
+ * arbitrary allowlist, with no process-global state.
+ */
+export function createHttpApp(config) {
+    const { bindAddress, allowedOrigins, allowedHosts } = config;
+    const allowsAllOrigins = allowedOrigins.includes("*");
+    // OAuth is a per-deployment capability, not a per-request one, so it is
+    // resolved once. `null` means every OAuth surface below is absent and this
+    // server is byte-for-byte the pre-OAuth one.
+    const oauth = config.oauth ?? null;
+    const app = express();
+    // Off by default so a direct client cannot spoof `X-Forwarded-*`; a
+    // deployment behind a known proxy sets TRUST_PROXY to recover the real client
+    // IP without trusting every hop. Only logging and `req.protocol` read it — the
+    // Host allowlist, not a proxy header, is the DNS-rebinding defence.
+    app.set("trust proxy", config.trustProxy);
+    // The Host allowlist is the actual defence; the fingerprinting header is noise.
+    app.disable("x-powered-by");
+    // --- Host header allowlist (runs first, before CORS) ---
+    //
+    // A DNS-rebinding defence: without it, a page the user visits can point a
+    // hostname it controls at 127.0.0.1 and drive a locally bound server. The
+    // check is the operator's ALLOWED_HOSTS plus loopback; a hosted deployment
+    // adds its public hostname. 421 Misdirected Request is the status for "this
+    // server does not answer to that authority".
+    app.use((req, res, next) => {
+        const host = req.headers.host;
+        if (!host || !allowedHosts.has(host.toLowerCase())) {
+            logger.warn("rejected request with disallowed Host header", {
+                host,
+                path: req.path,
+            });
+            res
+                .status(421)
+                .json(jsonRpcError(JSONRPC_MISDIRECTED, "Misdirected request"));
+            return;
+        }
+        next();
+    });
+    // --- CORS ---
+    //
+    // A distinct error type so the error handler below can tell an origin
+    // rejection apart from any other downstream failure and answer it with 403.
+    class CorsOriginNotAllowedError extends Error {
+        constructor(origin) {
+            super(`Origin ${origin} not allowed by CORS`);
+            this.origin = origin;
+            this.name = "CorsOriginNotAllowedError";
+        }
+    }
+    app.use(cors({
+        origin: (origin, callback) => {
+            // No Origin header: a non-browser client or a same-origin request.
+            // These are not subject to CORS and are allowed through.
+            if (!origin)
+                return callback(null, true);
+            // The opaque `null` origin (sandboxed iframe, file://) is only
+            // honoured when the operator lists it explicitly.
+            if (origin === "null") {
+                return allowedOrigins.includes("null")
+                    ? callback(null, true)
+                    : callback(new CorsOriginNotAllowedError("null"));
+            }
+            if (allowsAllOrigins || allowedOrigins.includes(origin)) {
+                return callback(null, true);
+            }
+            return callback(new CorsOriginNotAllowedError(origin));
+        },
+        // The client reads the session id and negotiated protocol version off
+        // the response; without exposing them a browser cannot complete a session.
+        // WWW-Authenticate is the OAuth discovery entry point: a browser-based
+        // client (claude.ai) that cannot read it off the 401 never learns where
+        // to log in, so the whole flow silently fails for exactly the clients
+        // OAuth exists for.
+        exposedHeaders: ["Mcp-Session-Id", "Mcp-Protocol-Version", "WWW-Authenticate"],
+        allowedHeaders: [
+            "Content-Type",
+            "Authorization",
+            "Mcp-Session-Id",
+            "Mcp-Protocol-Version",
+            "X-HydraDB-Api-Key",
+            "X-HydraDB-Database",
+            "X-HydraDB-Collection",
+            "X-HydraDB-Graph-Database",
+            "X-HydraDB-Graph-Collection",
+        ],
+    }));
+    // Turn a CORS origin rejection into an explicit 403 with a JSON-RPC body,
+    // mirroring the 421 the Host check emits. Placed right after cors so any
+    // other error still reaches Express's default handler unchanged.
+    app.use((err, req, res, next) => {
+        if (err instanceof CorsOriginNotAllowedError) {
+            logger.warn("rejected request with disallowed Origin", {
+                origin: err.origin,
+                path: req.path,
+            });
+            res
+                .status(403)
+                .json(jsonRpcError(JSONRPC_MISDIRECTED, "Origin not allowed"));
+            return;
+        }
+        next(err);
+    });
+    app.use(express.json({ limit: MAX_REQUEST_BODY }));
+    // --- The MCP endpoint ---
+    // Serves MCP at both the root `/` (e.g. https://mcp.hydradb.com) and `/mcp`
+    // so clients pointing at either URL connect seamlessly.
+    // --- OAuth Protected Resource Metadata (RFC 9728) ---
+    //
+    // The one document a client needs to get from "401" to "open the browser at
+    // the right place". Served at the root form and the `/mcp` path form, since
+    // a client tries the path-inserted URL first when the endpoint has a path.
+    // Registered only when OAuth is configured, so an unconfigured server has
+    // no new routes at all.
+    if (oauth) {
+        app.get(["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"], (_req, res) => {
+            res.setHeader("Cache-Control", "public, max-age=300");
+            res.setHeader("Access-Control-Allow-Origin", "*");
+            res.json(protectedResourceMetadata(oauth));
+        });
+    }
+    app.all(["/", "/mcp"], async (req, res) => {
+        // An OAuth access token arrives in the same `Authorization: Bearer` slot
+        // an API key does. It is told apart by prefix and exchanged, via the
+        // issuer, for the API key and scope the user approved on the consent
+        // screen. From there it is indistinguishable from a caller who sent that
+        // key directly: the same resolver runs, and the tool layer never learns
+        // OAuth exists.
+        let identity;
+        const bearer = bearerFromHeader(req.headers.authorization);
+        if (oauth && isAccessToken(bearer)) {
+            const result = await introspect(oauth, bearer);
+            if (!result.ok) {
+                if (result.reason === "unavailable") {
+                    logger.error("token introspection unavailable", { detail: result.detail });
+                    res
+                        .status(503)
+                        .json(jsonRpcError(JSONRPC_INTERNAL_ERROR, "Authorization service unavailable"));
+                    return;
+                }
+                res.setHeader("WWW-Authenticate", wwwAuthenticate(oauth, "invalid_token", result.reason === "wrong_audience"
+                    ? "token was not issued for this server"
+                    : "token is invalid, expired or revoked"));
+                res
+                    .status(401)
+                    .json(jsonRpcError(JSONRPC_UNAUTHORIZED, "Invalid or expired access token"));
+                return;
+            }
+            const t = result.token;
+            identity = {
+                apiKey: t.apiKey,
+                ...(t.database != null ? { database: t.database } : {}),
+                ...(t.collection != null ? { collection: t.collection } : {}),
+                ...(t.allowedDatabases ? { allowedDatabases: t.allowedDatabases } : {}),
+                ...(t.allowedCollections ? { allowedCollections: t.allowedCollections } : {}),
+            };
+            // A token is a credential; nothing carrying one may be cached.
+            res.setHeader("Cache-Control", "no-store");
+        }
+        // Who is this request for? On a hosted process the answer lives entirely
+        // in the request, so it is resolved here and a missing/incomplete answer
+        // is refused before any server is built.
+        const resolution = resolveRequestCredentials(req.headers, process.env, identity);
+        if (!resolution.ok) {
+            // 401 gets a WWW-Authenticate header so a spec-compliant client knows
+            // how to authenticate rather than just seeing a bare refusal. With
+            // OAuth configured that header is the whole discovery entry point.
+            if (resolution.status === 401) {
+                res.setHeader("WWW-Authenticate", oauth ? wwwAuthenticate(oauth) : 'Bearer realm="Hydra DB MCP"');
+            }
+            res
+                .status(resolution.status)
+                .json(jsonRpcError(resolution.status === 401
+                ? JSONRPC_UNAUTHORIZED
+                : JSONRPC_BAD_REQUEST, resolution.message));
+            return;
+        }
+        const creds = resolution.credentials;
+        try {
+            const hydra = new HydraDB({
+                token: creds.apiKey,
+                database: creds.database,
+                collection: creds.collection,
+                ...(creds.allowedDatabases ? { allowedDatabases: creds.allowedDatabases } : {}),
+                ...(creds.allowedCollections
+                    ? { allowedCollections: creds.allowedCollections }
+                    : {}),
+                ...(creds.baseUrl != null ? { baseUrl: creds.baseUrl } : {}),
+                ...(creds.timeoutSeconds != null
+                    ? { timeoutSeconds: creds.timeoutSeconds }
+                    : {}),
+                ...(creds.maxRetries != null ? { maxRetries: creds.maxRetries } : {}),
+            });
+            const server = createHydraDBServer(hydra, creds.graph, { oauthTools: identity != null });
+            // Stateless: this pair serves exactly this request and is discarded when
+            // the response closes. Tearing them down on `close` — which fires for a
+            // clean end AND for the error path below (it sends a response, which then
+            // closes) — is what frees the per-request state; without it a long-lived
+            // process leaks a server per call. It is the single teardown point, so
+            // nothing here double-closes. `close()` returns a promise, and a stray
+            // rejection would take the whole process down via `unhandledRejection`, so
+            // it is explicitly swallowed.
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                enableJsonResponse: true,
+            });
+            res.on("close", () => {
+                transport.close().catch(() => { });
+                server.close().catch(() => { });
+            });
+            await server.connect(transport);
+            await transport.handleRequest(req, res, req.body);
+        }
+        catch (error) {
+            logger.error("error handling MCP request", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            // Do not close here: the `res.on("close")` handler above owns teardown,
+            // and the transport may still be mid-write. Only the transport writes the
+            // JSON-RPC body, so this responds solely when nothing has been sent yet
+            // AND the socket is still open — a client that aborted mid-request lands
+            // here too, and writing to its closed socket is pointless. Ending the
+            // response then triggers that one teardown.
+            if (!res.headersSent && !res.writableEnded) {
+                res
+                    .status(500)
+                    .json(jsonRpcError(JSONRPC_INTERNAL_ERROR, "Internal server error"));
+            }
+        }
+    });
+    // A liveness probe for load balancers and container orchestrators. It says
+    // nothing about Hydra DB reachability on purpose — credentials are per
+    // request, so there is no single upstream this endpoint could check.
+    app.get("/health", (_req, res) => {
+        res.json({ status: "ok", service: "hydradb-mcp" });
+    });
+    // `express.json` throws on a malformed body (`entity.parse.failed`) or one
+    // over the limit (`entity.too.large`). Registered after the routes so it
+    // catches those, it keeps every refusal on this server speaking JSON-RPC
+    // rather than letting Express answer with its default HTML error page. Any
+    // other error falls through to Express's default handler unchanged.
+    app.use((err, _req, res, next) => {
+        if (err.type === "entity.parse.failed") {
+            res
+                .status(400)
+                .json(jsonRpcError(JSONRPC_BAD_REQUEST, "Request body is not valid JSON"));
+            return;
+        }
+        if (err.type === "entity.too.large") {
+            res
+                .status(413)
+                .json(jsonRpcError(JSONRPC_BAD_REQUEST, `Request body exceeds the ${MAX_REQUEST_BODY} limit`));
+            return;
+        }
+        next(err);
+    });
+    if (bindAddress === "0.0.0.0" || bindAddress === "::") {
+        banner(`WARNING: BIND_ADDRESS=${bindAddress} exposes the server on all network interfaces — ` +
+            "set ALLOWED_HOSTS/ALLOWED_ORIGINS and put it behind TLS. See SECURITY.md.");
+    }
+    if (allowsAllOrigins) {
+        banner('WARNING: ALLOWED_ORIGINS contains "*" — any website may call this server. See SECURITY.md.');
+    }
+    return app;
+}
+/**
+ * Wire graceful shutdown for the HTTP server.
+ *
+ * The in-flight bookkeeping is shared with the stdio path (it is module state in
+ * {@link file://./server.js}), so this drains accepted tool calls the same way:
+ * stop accepting, close the listener, wait for running handlers, then exit. An
+ * ingest cut off mid-write leaves the caller unable to tell whether it
+ * committed, which under upsert is not answerable by retrying.
+ */
+const SHUTDOWN_GRACE_MS = 10000;
+function installLifecycle(httpServer) {
+    let shuttingDown = false;
+    const shutdown = async (signal) => {
+        if (shuttingDown) {
+            logger.warn(`${signal} received again — exiting immediately`);
+            process.exit(130);
+        }
+        shuttingDown = true;
+        beginShutdown();
+        logger.info(`${signal} received — shutting down`);
+        const timer = setTimeout(() => {
+            logger.warn(`in-flight work did not finish within ${SHUTDOWN_GRACE_MS}ms — exiting anyway`);
+            process.exit(0);
+        }, SHUTDOWN_GRACE_MS);
+        timer.unref();
+        // Stop accepting new connections, then drain the calls already running.
+        httpServer.close();
+        const pending = inFlightCount();
+        if (pending > 0) {
+            logger.info(`waiting for ${pending} in-flight tool call(s)`);
+            await awaitInFlight();
+        }
+        clearTimeout(timer);
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    process.on("unhandledRejection", (reason) => {
+        logger.error("unhandled promise rejection", {
+            error: reason instanceof Error ? (reason.stack ?? reason.message) : String(reason),
+        });
+        process.exit(1);
+    });
+    process.on("uncaughtException", (error) => {
+        logger.error("uncaught exception", { error: error.stack ?? error.message });
+        process.exit(1);
+    });
+}
+function main() {
+    const config = resolveHttpServerConfig();
+    // A public bind WITH tenant credentials in the env is the one genuinely
+    // dangerous combination: every unauthenticated request would run under that
+    // account. It is legitimate for a single-tenant self-host, so this warns
+    // rather than refuses — but a multi-tenant operator must see it.
+    const publicBind = config.bindAddress === "0.0.0.0" || config.bindAddress === "::";
+    if (publicBind && (process.env.HYDRADB_API_KEY || process.env.HYDRA_DB_API_KEY)) {
+        banner("WARNING: HYDRADB_API_KEY is set while binding publicly — every request that " +
+            "sends no `Authorization` header will run under this account. Unset it for a " +
+            "multi-tenant deployment so each caller must authenticate. See SECURITY.md.");
+    }
+    const app = createHttpApp(config);
+    if (config.oauth) {
+        banner(`OAuth enabled: issuer ${config.oauth.issuer}, resource ${config.oauth.resource} ` +
+            `(metadata at ${metadataUrl(config.oauth)})`);
+    }
+    const httpServer = app
+        .listen(config.port, config.bindAddress, () => {
+        // Startup banners: on stderr so an operator sees where it bound
+        // regardless of HYDRADB_LOG_LEVEL.
+        banner(`listening on http://${config.bindAddress}:${config.port}`);
+        banner(`allowed origins: ${config.allowedOrigins.length > 0
+            ? config.allowedOrigins.join(", ")
+            : "(none — cross-origin browser requests will be rejected)"}`);
+    })
+        .on("error", (error) => {
+        logger.error("HTTP server error", { error: error.message });
+        process.exit(1);
+    });
+    installLifecycle(httpServer);
+}
+// Only auto-start when run as a script, so tests can import `createHttpApp`
+// without binding a port. Covers `node dist/http.js`, `tsx src/http.ts`, and
+// the Docker entrypoint.
+const invokedAsScript = import.meta.url === `file://${process.argv[1]}` ||
+    process.argv[1]?.endsWith("/http.js") ||
+    process.argv[1]?.endsWith("/http.ts");
+if (invokedAsScript) {
+    main();
+}
+// Re-exported so callers importing the HTTP entry point get the config helpers
+// from one place.
+export { buildAllowedHosts, parseList, parsePort, resolveHttpServerConfig };
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EACN,iBAAiB,EAEjB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,yBAAyB,GAEzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACN,UAAU,EACV,aAAa,EACb,WAAW,EAEX,yBAAyB,EACzB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,aAAa,GACb,MAAM,aAAa,CAAC;AAErB;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CAAC,OAAe;IAC9B,OAAO,CAAC,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,KAAoC;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AACpC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AACnC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AACtC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAwB;IACrD,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAC7D,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,wEAAwE;IACxE,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM,KAAK,GAAuB,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;IAEvD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,oEAAoE;IACpE,8EAA8E;IAC9E,+EAA+E;IAC/E,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,gFAAgF;IAChF,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,0DAA0D;IAC1D,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC3D,IAAI;gBACJ,IAAI,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;YACH,GAAG;iBACD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,EAAE;IACF,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,yBAA0B,SAAQ,KAAK;QAC5C,YAAqB,MAAc;YAClC,KAAK,CAAC,UAAU,MAAM,sBAAsB,CAAC,CAAC;YAD1B,WAAM,GAAN,MAAM,CAAQ;YAElC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACzC,CAAC;KACD;IAED,GAAG,CAAC,GAAG,CACN,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAC5B,mEAAmE;YACnE,yDAAyD;YACzD,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,+DAA+D;YAC/D,kDAAkD;YAClD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;oBACtB,CAAC,CAAC,QAAQ,CAAC,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,gBAAgB,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,oBAAoB;QACpB,cAAc,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QAC9E,cAAc,EAAE;YACf,cAAc;YACd,eAAe;YACf,gBAAgB;YAChB,sBAAsB;YACtB,mBAAmB;YACnB,oBAAoB;YACpB,sBAAsB;YACtB,0BAA0B;YAC1B,4BAA4B;SAC5B;KACD,CAAC,CACF,CAAC;IAEF,0EAA0E;IAC1E,yEAAyE;IACzE,iEAAiE;IACjE,GAAG,CAAC,GAAG,CACN,CACC,GAAU,EACV,GAAoB,EACpB,GAAqB,EACrB,IAA0B,EACzB,EAAE;QACH,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBACtD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACd,CAAC,CAAC;YACH,GAAG;iBACD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAChE,OAAO;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACX,CAAC,CACD,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAEnD,2BAA2B;IAC3B,4EAA4E;IAC5E,wDAAwD;IACxD,uDAAuD;IACvD,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,wBAAwB;IACxB,IAAI,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CACN,CAAC,uCAAuC,EAAE,2CAA2C,CAAC,EACtF,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACb,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;YACtD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC,CACD,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,wEAAwE;QACxE,gBAAgB;QAChB,IAAI,QAAsC,CAAC;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3D,IAAI,KAAK,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBACrC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3E,GAAG;yBACD,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,mCAAmC,CAAC,CAAC,CAAC;oBAClF,OAAO;gBACR,CAAC;gBACD,GAAG,CAAC,SAAS,CACZ,kBAAkB,EAClB,eAAe,CACd,KAAK,EACL,eAAe,EACf,MAAM,CAAC,MAAM,KAAK,gBAAgB;oBACjC,CAAC,CAAC,sCAAsC;oBACxC,CAAC,CAAC,sCAAsC,CACzC,CACD,CAAC;gBACF,GAAG;qBACD,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,iCAAiC,CAAC,CAAC,CAAC;gBAC9E,OAAO;YACR,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACvB,QAAQ,GAAG;gBACV,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC;YACF,+DAA+D;YAC/D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,yCAAyC;QACzC,MAAM,UAAU,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC/B,GAAG,CAAC,SAAS,CACZ,kBAAkB,EAClB,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAC9D,CAAC;YACH,CAAC;YACD,GAAG;iBACD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;iBACzB,IAAI,CACJ,YAAY,CACX,UAAU,CAAC,MAAM,KAAK,GAAG;gBACxB,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,EACtB,UAAU,CAAC,OAAO,CAClB,CACD,CAAC;YACH,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC;gBACzB,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,KAAK,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI;oBAC/B,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;oBAC1C,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YAEzF,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,2EAA2E;YAC3E,8BAA8B;YAC9B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBACnD,kBAAkB,EAAE,SAAS;gBAC7B,kBAAkB,EAAE,IAAI;aACxB,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBAC1C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;YACH,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,4CAA4C;YAC5C,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBAC5C,GAAG;qBACD,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,YAAY,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,qEAAqE;IACrE,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,oEAAoE;IACpE,GAAG,CAAC,GAAG,CACN,CACC,GAA+C,EAC/C,IAAqB,EACrB,GAAqB,EACrB,IAA0B,EACzB,EAAE;QACH,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACxC,GAAG;iBACD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAC5E,OAAO;QACR,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,GAAG;iBACD,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACJ,YAAY,CACX,mBAAmB,EACnB,4BAA4B,gBAAgB,QAAQ,CACpD,CACD,CAAC;YACH,OAAO;QACR,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACX,CAAC,CACD,CAAC;IAEF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CACL,yBAAyB,WAAW,kDAAkD;YACrF,2EAA2E,CAC5E,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,4FAA4F,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,KAAM,CAAC;AAEjC,SAAS,gBAAgB,CAAC,UAAsC;IAC/D,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACzC,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,2BAA2B,CAAC,CAAC;QAElD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,IAAI,CACV,wCAAwC,iBAAiB,qBAAqB,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,wEAAwE;QACxE,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,eAAe,OAAO,yBAAyB,CAAC,CAAC;YAC7D,MAAM,aAAa,EAAE,CAAC;QACvB,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC3C,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;YAC3C,KAAK,EAAE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;SAClF,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACzC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI;IACZ,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;IAEzC,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;IACnF,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjF,MAAM,CACL,8EAA8E;YAC7E,8EAA8E;YAC9E,4EAA4E,CAC7E,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAElC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CACL,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,cAAc,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG;YACjF,gBAAgB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC7C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG;SACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE;QAC7C,gEAAgE;QAChE,mCAAmC;QACnC,MAAM,CAAC,uBAAuB,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,CACL,oBACC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,CAAC,yDACJ,EAAE,CACF,CAAC;IACH,CAAC,CAAC;SACD,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEJ,gBAAgB,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,yBAAyB;AACzB,MAAM,eAAe,GACpB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;AAEvC,IAAI,eAAe,EAAE,CAAC;IACrB,IAAI,EAAE,CAAC;AACR,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/hydra/client.d.ts

@@ -15,6 +15,7 @@
  */
 import { HydraDBClient } from "@hydradb/sdk";
 import type { HydraDB as SDK } from "@hydradb/sdk";
+import { GraphResource } from "./graph.js";
 export type ContextKind = "memory" | "knowledge";
 /**
  * Sized to fit inside a typical MCP host's tool timeout rather than outlast it,
@@ -46,6 +47,14 @@ export interface HydraConfig {
     database: string;
     /** Collection scope (canonical name for the sub-tenant). */
     collection?: string;
+    /**
+     * Databases a per-call `database` override may name. Absent means any.
+     * Set from an OAuth grant the user confined to specific databases; the
+     * default `database` is always allowed.
+     */
+    allowedDatabases?: string[];
+    /** Collections a per-call `collection` override may name. Absent means any. */
+    allowedCollections?: string[];
     /** Optional base URL override; defaults to the SDK's environment. */
     baseUrl?: string;
     /**
@@ -88,6 +97,8 @@ export interface QueryParams {
     numRelatedChunks?: number;
     /** Per-call collection override. */
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface ConversationTurn {
     user: string;
@@ -123,6 +134,8 @@ export interface IngestParams {
     /** Filename to attach when ingesting knowledge text as a document. */
     filename?: string;
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface ListParams {
     kind?: ContextKind;
@@ -130,16 +143,22 @@ export interface ListParams {
     page?: number;
     pageSize?: number;
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface InspectParams {
     id: string;
     mode?: string;
     expirySeconds?: number;
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface IngestionStatusParams {
     ids: string | string[];
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface RelationsParams {
     id?: string;
@@ -147,11 +166,15 @@ export interface RelationsParams {
     limit?: number;
     cursor?: number;
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface DeleteParams {
     ids: string[];
     kind: ContextKind;
     collection?: string;
+    /** Per-call database override. */
+    database?: string;
 }
 export interface CreateDatabaseParams {
     database: string;
@@ -162,16 +185,45 @@ type ScopeFields = {
     database: string;
     collection?: string;
 };
+/**
+ * A per-call `database` named one the connection is not allowed to touch.
+ *
+ * Written for the agent that reads it as a tool error: it names what IS
+ * allowed and where the choice was made, so the agent can either use an
+ * allowed database or tell the user to reconnect with wider access, rather
+ * than retrying blindly.
+ */
+export declare class ScopeNotAllowedError extends Error {
+    readonly kind: "database" | "collection";
+    readonly requested: string;
+    readonly allowed: readonly string[];
+    constructor(kind: "database" | "collection", requested: string, allowed: readonly string[]);
+}
+/** Kept for the name callers already import; the database case of the above. */
+export declare const DatabaseNotAllowedError: typeof ScopeNotAllowedError;
+/** Throws unless `database` is one the connection may use. */
+export declare function assertDatabaseAllowed(database: string, allowed: readonly string[] | undefined): void;
+/**
+ * Throws unless `collection` is one the connection may use.
+ *
+ * Separate from the database check because confinement has to cover both:
+ * a caller pinned to one database can otherwise step sideways into a
+ * collection the consent screen never showed, and `drop_collection` makes
+ * that destructive.
+ */
+export declare function assertCollectionAllowed(collection: string, allowed: readonly string[] | undefined): void;
 declare abstract class Resource {
     protected readonly sdk: HydraDBClient;
     private readonly database;
     private readonly collection?;
-    protected constructor(sdk: HydraDBClient, database: string, collection?: string | undefined);
-    protected scope(override?: string): ScopeFields;
+    private readonly allowedDatabases?;
+    private readonly allowedCollections?;
+    protected constructor(sdk: HydraDBClient, database: string, collection?: string | undefined, allowedDatabases?: readonly string[] | undefined, allowedCollections?: readonly string[] | undefined);
+    protected scope(override?: string, dbOverride?: string): ScopeFields;
     protected call<T>(path: string, fn: () => Promise<unknown>): Promise<T>;
 }
 export declare class ContextResource extends Resource {
-    constructor(sdk: HydraDBClient, database: string, collection?: string);
+    constructor(sdk: HydraDBClient, database: string, collection?: string, allowedDatabases?: readonly string[], allowedCollections?: readonly string[]);
     /**
      * The single retrieval entry point (SDK `client.query`).
      *
@@ -199,7 +251,7 @@ export declare class ContextResource extends Resource {
     delete(params: DeleteParams, opts?: RequestOptions): Promise<SDK.SourcesMemoryDeleteResponse>;
 }
 export declare class DatabasesResource extends Resource {
-    constructor(sdk: HydraDBClient, database: string, collection?: string);
+    constructor(sdk: HydraDBClient, database: string, collection?: string, allowedDatabases?: readonly string[], allowedCollections?: readonly string[]);
     create(params: CreateDatabaseParams): Promise<SDK.TenantsTenantCreateAcceptedResponse>;
     delete(database: string): Promise<SDK.TenantsTenantDeleteResponse>;
     list(): Promise<SDK.TenantsTenantIdsResponse>;
@@ -216,6 +268,19 @@ export declare class DatabasesResource extends Resource {
 export declare class HydraDB {
     readonly context: ContextResource;
     readonly databases: DatabasesResource;
+    /** The default database every unscoped call uses. */
+    readonly database: string;
+    /** Databases a per-call override may name; undefined means any. */
+    readonly allowedDatabases?: readonly string[];
+    /** Collections a per-call override may name; undefined means any. */
+    readonly allowedCollections?: readonly string[];
+    /** The default collection every unscoped call uses. */
+    readonly collection?: string;
+    /**
+     * BYOG graph operations. Not backed by the SDK — see ./graph.ts for why —
+     * but exposed here so callers reach every HydraDB surface through one object.
+     */
+    readonly graph: GraphResource;
     constructor(config: HydraConfig, sdk?: HydraDBClient);
 }
 export {};