@querypanel/node-sdk 1.0.56 → 1.0.58

package/dist/index.js

@@ -1,3 +1,183 @@
+// src/adapters/bigquery.ts
+var BigQueryAdapter = class {
+  constructor(clientFn, options) {
+    this.clientFn = clientFn;
+    this.projectId = options.projectId;
+    this.datasetProjectId = options.datasetProjectId ?? options.projectId;
+    this.defaultDataset = options.dataset;
+    this.databaseName = options.database ?? options.dataset;
+    this.kind = options.kind ?? "bigquery";
+    if (options.allowedTables) {
+      this.allowedTables = normalizeTableFilter(
+        options.allowedTables,
+        this.defaultDataset
+      );
+    }
+  }
+  projectId;
+  datasetProjectId;
+  defaultDataset;
+  databaseName;
+  kind;
+  allowedTables;
+  async execute(sql, params) {
+    if (this.allowedTables) {
+      this.validateQueryTables(sql);
+    }
+    const result = await this.clientFn({
+      query: sql,
+      params,
+      dryRun: false
+    });
+    return { fields: result.fields, rows: result.rows };
+  }
+  async validate(sql, params) {
+    await this.clientFn({
+      query: sql,
+      params,
+      dryRun: true
+    });
+  }
+  getDialect() {
+    return "bigquery";
+  }
+  /**
+   * Introspect using BigQuery INFORMATION_SCHEMA (TABLES and COLUMNS).
+   * Restricts to the default dataset (or allowedTables) and returns tables/columns only.
+   */
+  async introspect(options) {
+    const tablesToIntrospect = options?.tables ? normalizeTableFilter(options.tables, this.defaultDataset) : this.allowedTables;
+    const normalizedTables = tablesToIntrospect ?? [];
+    const tablesSql = buildTablesQuery(
+      this.datasetProjectId,
+      this.defaultDataset,
+      normalizedTables
+    );
+    const tablesResult = await this.clientFn({
+      query: tablesSql,
+      dryRun: false
+    });
+    const tableRows = tablesResult.rows;
+    const columnsSql = buildColumnsQuery(
+      this.datasetProjectId,
+      this.defaultDataset,
+      normalizedTables
+    );
+    const columnsResult = await this.clientFn({
+      query: columnsSql,
+      dryRun: false
+    });
+    const columnRows = columnsResult.rows;
+    const tablesByKey = /* @__PURE__ */ new Map();
+    for (const row of tableRows) {
+      const key = tableKey(row.table_schema, row.table_name);
+      const table = {
+        name: row.table_name,
+        schema: row.table_schema,
+        type: asTableType(row.table_type),
+        columns: []
+      };
+      tablesByKey.set(key, table);
+    }
+    for (const row of columnRows) {
+      const key = tableKey(row.table_schema, row.table_name);
+      const table = tablesByKey.get(key);
+      if (!table) continue;
+      const column = {
+        name: row.column_name,
+        type: row.data_type,
+        isPrimaryKey: false
+      };
+      table.columns.push(column);
+    }
+    const tables = Array.from(tablesByKey.values()).sort((a, b) => {
+      if (a.schema === b.schema) {
+        return a.name.localeCompare(b.name);
+      }
+      return a.schema.localeCompare(b.schema);
+    });
+    return {
+      db: {
+        kind: this.kind,
+        name: this.databaseName
+      },
+      tables,
+      introspectedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  validateQueryTables(sql) {
+    if (!this.allowedTables || this.allowedTables.length === 0) {
+      return;
+    }
+    const allowedSet = new Set(
+      this.allowedTables.map((t) => tableKey(t.dataset, t.table))
+    );
+    const tablePattern = /(?:FROM|JOIN)\s+`?(?:[\w-]+\.)?([\w-]+)\.([\w-]+)`?|(?:FROM|JOIN)\s+`?([\w-]+)`?/gi;
+    const matches = sql.matchAll(tablePattern);
+    for (const match of matches) {
+      const dataset = match[1] ?? match[3] ?? this.defaultDataset;
+      const table = match[2] ?? match[3];
+      if (table) {
+        const key = tableKey(dataset, table);
+        if (!allowedSet.has(key)) {
+          throw new Error(
+            `Query references table "${dataset}.${table}" which is not in the allowed tables list`
+          );
+        }
+      }
+    }
+  }
+};
+function normalizeTableFilter(tables, defaultDataset) {
+  if (!tables?.length) return [];
+  const normalized = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of tables) {
+    if (!raw?.trim()) continue;
+    const trimmed = raw.trim();
+    const parts = trimmed.split(".");
+    const table = parts.pop() ?? "";
+    const dataset = parts.pop() ?? defaultDataset;
+    const key = tableKey(dataset, table);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    normalized.push({ dataset, table });
+  }
+  return normalized;
+}
+function tableKey(dataset, table) {
+  return `${dataset}.${table}`;
+}
+function buildTablesQuery(datasetProjectId, dataset, tables) {
+  const qualifier = `\`${datasetProjectId}.${dataset}.INFORMATION_SCHEMA.TABLES\``;
+  const filter = tables.length > 0 ? ` AND table_name IN (${tables.map((t) => `'${escapeSql(t.table)}'`).join(", ")})` : "";
+  return `SELECT table_name, table_schema, table_type
+  FROM ${qualifier}
+  WHERE table_schema = '${escapeSql(dataset)}'${filter}
+  ORDER BY table_schema, table_name`;
+}
+function buildColumnsQuery(datasetProjectId, dataset, tables) {
+  const qualifier = `\`${datasetProjectId}.${dataset}.INFORMATION_SCHEMA.COLUMNS\``;
+  const filter = tables.length > 0 ? ` AND table_name IN (${tables.map((t) => `'${escapeSql(t.table)}'`).join(", ")})` : "";
+  return `SELECT table_name, table_schema, column_name, data_type, ordinal_position, is_nullable
+  FROM ${qualifier}
+  WHERE table_schema = '${escapeSql(dataset)}'${filter}
+  ORDER BY table_schema, table_name, ordinal_position`;
+}
+function escapeSql(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "''");
+}
+function asTableType(tableType) {
+  const normalized = tableType?.toLowerCase() ?? "";
+  if (normalized.includes("view")) {
+    return normalized.includes("materialized") ? "materialized_view" : "view";
+  }
+  if (normalized.includes("external") || normalized.includes("snapshot") || normalized.includes("clone")) {
+    return "table";
+  }
+  return "table";
+}
+
 // src/utils/clickhouse.ts
 var WRAPPER_REGEX = /^(Nullable|LowCardinality|SimpleAggregateFunction)\((.+)\)$/i;
 function unwrapTypeModifiers(type) {
@@ -67,7 +247,7 @@ var ClickHouseAdapter = class {
     this.defaultFormat = options.defaultFormat ?? "JSONEachRow";
     this.kind = options.kind ?? "clickhouse";
     if (options.allowedTables) {
-      this.allowedTables = normalizeTableFilter(options.allowedTables);
+      this.allowedTables = normalizeTableFilter2(options.allowedTables);
     }
   }
   databaseName;
@@ -105,7 +285,7 @@ var ClickHouseAdapter = class {
    * No indexes, constraints, or statistics
    */
   async introspect(options) {
-    const tablesToIntrospect = options?.tables ? normalizeTableFilter(options.tables) : this.allowedTables;
+    const tablesToIntrospect = options?.tables ? normalizeTableFilter2(options.tables) : this.allowedTables;
     const allowTables = tablesToIntrospect ?? [];
     const hasFilter = allowTables.length > 0;
     const queryParams = {
@@ -145,7 +325,7 @@ var ClickHouseAdapter = class {
       const base = {
         name: table.name,
         schema: this.databaseName,
-        type: asTableType(table.engine),
+        type: asTableType2(table.engine),
         columns: tableColumns
       };
       const comment = sanitize(table.comment);
@@ -223,7 +403,7 @@ function normalizePayload(payload) {
   }
   return [];
 }
-function normalizeTableFilter(tables) {
+function normalizeTableFilter2(tables) {
   if (!tables?.length) return [];
   const seen = /* @__PURE__ */ new Set();
   const normalized = [];
@@ -251,7 +431,7 @@ function transformColumnRow(row) {
   if (comment !== void 0) column.comment = comment;
   return column;
 }
-function asTableType(engine) {
+function asTableType2(engine) {
   if (typeof engine === "string") {
     const normalized = engine.toLowerCase();
     if (normalized.includes("view")) {
@@ -280,7 +460,7 @@ var PostgresAdapter = class {
     this.defaultSchema = options.defaultSchema ?? "public";
     this.kind = options.kind ?? "postgres";
     if (options.allowedTables) {
-      this.allowedTables = normalizeTableFilter2(
+      this.allowedTables = normalizeTableFilter3(
         options.allowedTables,
         this.defaultSchema
       );
@@ -307,7 +487,7 @@ var PostgresAdapter = class {
       return;
     }
     const allowedSet = new Set(
-      this.allowedTables.map((t) => tableKey(t.schema, t.table))
+      this.allowedTables.map((t) => tableKey2(t.schema, t.table))
     );
     const neutralizedSql = sql.replace(/EXTRACT\s*\([^)]*FROM\s+[^)]+\)/gi, "EXTRACT(/*neutralized*/)").replace(/SUBSTRING\s*\([^)]*FROM\s+[^)]+\)/gi, "SUBSTRING(/*neutralized*/)").replace(/TRIM\s*\([^)]*FROM\s+[^)]+\)/gi, "TRIM(/*neutralized*/)").replace(/POSITION\s*\([^)]*FROM\s+[^)]+\)/gi, "POSITION(/*neutralized*/)");
     const tablePattern = /(?:FROM|JOIN)\s+(?:ONLY\s+)?(?:([a-zA-Z_][a-zA-Z0-9_]*)\.)?(["']?[a-zA-Z_][a-zA-Z0-9_]*["']?)/gi;
@@ -316,7 +496,7 @@ var PostgresAdapter = class {
       const schema = match[1] ?? this.defaultSchema;
       const table = match[2]?.replace(/['"]/g, "");
       if (table) {
-        const key = tableKey(schema, table);
+        const key = tableKey2(schema, table);
         if (!allowedSet.has(key)) {
           throw new Error(
             `Query references table "${schema}.${table}" which is not in the allowed tables list`
@@ -326,29 +506,31 @@ var PostgresAdapter = class {
     }
   }
   /**
-   * Convert named params to positional array for PostgreSQL
-   * PostgreSQL expects $1, $2, $3 in SQL and an array of values [val1, val2, val3]
+   * Convert params to positional array for PostgreSQL.
+   * PostgreSQL expects $1, $2, $3 in SQL and an array of values [val1, val2, val3].
+   * When the record has numeric keys ("1", "2", "3") — e.g. from mapGeneratedParams —
+   * use only those in order so placeholder order matches SQL. Otherwise fall back to
+   * named keys in alphabetical order for backward compatibility.
    */
   convertNamedToPositionalParams(params) {
     const numericKeys = Object.keys(params).filter((k) => /^\d+$/.test(k)).map((k) => Number.parseInt(k, 10)).sort((a, b) => a - b);
-    const namedKeys = Object.keys(params).filter((k) => !/^\d+$/.test(k)).sort();
-    const positionalParams = [];
-    for (const key of numericKeys) {
-      let val = params[String(key)];
-      if (typeof val === "string") {
-        const match = val.match(/^<([a-zA-Z0-9_]+)>$/);
-        const namedKey = match?.[1];
-        if (namedKey && namedKey in params) {
-          val = params[namedKey];
+    if (numericKeys.length > 0) {
+      const positionalParams = [];
+      for (const key of numericKeys) {
+        let val = params[String(key)];
+        if (typeof val === "string") {
+          const match = val.match(/^<([a-zA-Z0-9_]+)>$/);
+          const namedKey = match?.[1];
+          if (namedKey && namedKey in params) {
+            val = params[namedKey];
+          }
         }
+        positionalParams.push(val);
       }
-      positionalParams.push(val);
-    }
-    for (const key of namedKeys) {
-      const val = params[key];
-      positionalParams.push(val);
+      return positionalParams;
     }
-    return positionalParams;
+    const namedKeys = Object.keys(params).filter((k) => !/^\d+$/.test(k)).sort();
+    return namedKeys.map((key) => params[key]);
   }
   async validate(sql, params) {
     let paramArray;
@@ -365,23 +547,23 @@ var PostgresAdapter = class {
    * No indexes, constraints, or statistics
    */
   async introspect(options) {
-    const tablesToIntrospect = options?.tables ? normalizeTableFilter2(options.tables, this.defaultSchema) : this.allowedTables;
+    const tablesToIntrospect = options?.tables ? normalizeTableFilter3(options.tables, this.defaultSchema) : this.allowedTables;
     const normalizedTables = tablesToIntrospect ?? [];
     const tablesResult = await this.clientFn(
-      buildTablesQuery(normalizedTables)
+      buildTablesQuery2(normalizedTables)
     );
     const tableRows = tablesResult.rows;
     const columnsResult = await this.clientFn(
-      buildColumnsQuery(normalizedTables)
+      buildColumnsQuery2(normalizedTables)
     );
     const columnRows = columnsResult.rows;
     const tablesByKey = /* @__PURE__ */ new Map();
     for (const row of tableRows) {
-      const key = tableKey(row.schema_name, row.table_name);
+      const key = tableKey2(row.schema_name, row.table_name);
       const table = {
         name: row.table_name,
         schema: row.schema_name,
-        type: asTableType2(row.table_type),
+        type: asTableType3(row.table_type),
         columns: []
       };
       const comment = sanitize2(row.comment);
@@ -391,7 +573,7 @@ var PostgresAdapter = class {
       tablesByKey.set(key, table);
     }
     for (const row of columnRows) {
-      const key = tableKey(row.table_schema, row.table_name);
+      const key = tableKey2(row.table_schema, row.table_name);
       const table = tablesByKey.get(key);
       if (!table) continue;
       const column = {
@@ -421,7 +603,7 @@ var PostgresAdapter = class {
     };
   }
 };
-function normalizeTableFilter2(tables, defaultSchema) {
+function normalizeTableFilter3(tables, defaultSchema) {
   if (!tables?.length) return [];
   const normalized = [];
   const seen = /* @__PURE__ */ new Set();
@@ -435,14 +617,14 @@ function normalizeTableFilter2(tables, defaultSchema) {
     if (!isSafeIdentifier(schema) || !isSafeIdentifier(table)) {
       continue;
     }
-    const key = tableKey(schema, table);
+    const key = tableKey2(schema, table);
     if (seen.has(key)) continue;
     seen.add(key);
     normalized.push({ schema, table });
   }
   return normalized;
 }
-function buildTablesQuery(tables) {
+function buildTablesQuery2(tables) {
   const filter = buildFilterClause(tables, "n.nspname", "c.relname");
   return `SELECT
     c.relname AS table_name,
@@ -461,7 +643,7 @@ function buildTablesQuery(tables) {
     ${filter}
   ORDER BY n.nspname, c.relname;`;
 }
-function buildColumnsQuery(tables) {
+function buildColumnsQuery2(tables) {
   const filter = buildFilterClause(
     tables,
     "cols.table_schema",
@@ -506,13 +688,13 @@ function buildFilterClause(tables, schemaExpr, tableExpr) {
   });
   return `AND (${clauses.join(" OR ")})`;
 }
-function tableKey(schema, table) {
+function tableKey2(schema, table) {
   return `${schema}.${table}`;
 }
 function isSafeIdentifier(value) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
 }
-function asTableType2(value) {
+function asTableType3(value) {
   const normalized = value.toLowerCase();
   if (normalized.includes("view")) {
     return normalized.includes("materialized") ? "materialized_view" : "view";
@@ -560,6 +742,13 @@ var ApiClient = class {
   getDefaultTenantId() {
     return this.defaultTenantId;
   }
+  /**
+   * Create a JWT for the given tenant (and optional userId, scopes).
+   * Use this when you need to pass a token to the embed (e.g. frontend or demo).
+   */
+  async createJwt(tenantId, userId, scopes) {
+    return await this.generateJWT(tenantId, userId, scopes);
+  }
   async get(path, tenantId, userId, scopes, signal, sessionId) {
     return await this.request(path, {
       method: "GET",
@@ -772,6 +961,111 @@ var ApiClient = class {
   }
 };
 
+// src/core/callback-client.ts
+var CallbackApiClient = class {
+  requestHandler;
+  defaultTenantId;
+  constructor(requestHandler, options) {
+    this.requestHandler = requestHandler;
+    this.defaultTenantId = options?.defaultTenantId;
+  }
+  getDefaultTenantId() {
+    return this.defaultTenantId;
+  }
+  async request(opts) {
+    const { data, headers } = await this.requestHandler({
+      method: opts.method,
+      path: opts.path,
+      body: opts.body,
+      tenantId: opts.tenantId,
+      userId: opts.userId,
+      scopes: opts.scopes,
+      signal: opts.signal,
+      sessionId: opts.sessionId
+    });
+    return { data, headers };
+  }
+  async get(path, tenantId, userId, scopes, signal, sessionId) {
+    const { data } = await this.request({
+      method: "GET",
+      path,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return data;
+  }
+  async post(path, body, tenantId, userId, scopes, signal, sessionId) {
+    const { data } = await this.request({
+      method: "POST",
+      path,
+      body,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return data;
+  }
+  async postWithHeaders(path, body, tenantId, userId, scopes, signal, sessionId) {
+    const { data, headers } = await this.request({
+      method: "POST",
+      path,
+      body,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return {
+      data,
+      headers: headers ?? new Headers()
+    };
+  }
+  async put(path, body, tenantId, userId, scopes, signal, sessionId) {
+    const { data } = await this.request({
+      method: "PUT",
+      path,
+      body,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return data;
+  }
+  async patch(path, body, tenantId, userId, scopes, signal, sessionId) {
+    const { data } = await this.request({
+      method: "PATCH",
+      path,
+      body,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return data;
+  }
+  async delete(path, tenantId, userId, scopes, signal, sessionId) {
+    const { data } = await this.request({
+      method: "DELETE",
+      path,
+      tenantId,
+      userId,
+      scopes,
+      signal,
+      sessionId
+    });
+    return data;
+  }
+};
+
 // src/core/query-engine.ts
 var QueryEngine = class {
   databases = /* @__PURE__ */ new Map();
@@ -834,6 +1128,12 @@ var QueryEngine = class {
       return [];
     }
   }
+  /**
+   * Maps API params (array in SQL placeholder order $1, $2, $3) to ParamRecord.
+   * Sets both numeric keys ("1", "2", "3") and named keys so that:
+   * - Postgres adapter uses numeric order for positional params (matches SQL).
+   * - Named keys remain for tenant isolation / other lookups.
+   */
   mapGeneratedParams(params) {
     const record = {};
     params.forEach((param, index) => {
@@ -841,6 +1141,7 @@ var QueryEngine = class {
       if (value === void 0) {
         return;
       }
+      record[String(index + 1)] = value;
       const nameCandidate = typeof param.name === "string" && param.name.trim() || typeof param.placeholder === "string" && param.placeholder.trim() || typeof param.position === "number" && String(param.position) || String(index + 1);
       const key = nameCandidate.replace(/[{}:$]/g, "").trim();
       record[key] = value;
@@ -861,6 +1162,9 @@ var QueryEngine = class {
       const paramKey = tenantField;
       params[paramKey] = tenantId;
       tenantPredicate = `${tenantField} = {${tenantField}:${metadata.tenantFieldType ?? "String"}}`;
+    } else if (metadata.dialect === "bigquery") {
+      params[tenantField] = tenantId;
+      tenantPredicate = `${tenantField} = @${tenantField}`;
     } else {
       const escapedId = tenantId.replace(/'/g, "''");
       tenantPredicate = `${tenantField} = '${escapedId}'`;
@@ -1159,20 +1463,171 @@ async function deleteActiveChart(client, id, options, signal) {
     signal
   );
 }
-function resolveTenantId2(client, tenantId) {
-  const resolved = tenantId ?? client.getDefaultTenantId();
-  if (!resolved) {
-    throw new Error(
-      "tenantId is required. Provide it per request or via defaultTenantId option."
-    );
-  }
-  return resolved;
-}
+function resolveTenantId2(client, tenantId) {
+  const resolved = tenantId ?? client.getDefaultTenantId();
+  if (!resolved) {
+    throw new Error(
+      "tenantId is required. Provide it per request or via defaultTenantId option."
+    );
+  }
+  return resolved;
+}
+
+// src/routes/dashboards.ts
+function resolveTenantId3(client, tenantId) {
+  const resolved = tenantId ?? client.getDefaultTenantId();
+  if (resolved === void 0) {
+    throw new Error("tenantId is required (option or client default)");
+  }
+  return resolved;
+}
+async function createDashboard(client, body, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.post(
+    "/dashboards",
+    body,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function listDashboards(client, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  const params = new URLSearchParams();
+  if (options?.pagination?.page) {
+    params.set("page", options.pagination.page.toString());
+  }
+  if (options?.pagination?.limit) {
+    params.set("limit", options.pagination.limit.toString());
+  }
+  if (options?.status) {
+    params.set("status", options.status);
+  }
+  if (options?.sortBy) {
+    params.set("sort_by", options.sortBy);
+  }
+  if (options?.sortDir) {
+    params.set("sort_dir", options.sortDir);
+  }
+  return await client.get(
+    `/dashboards?${params.toString()}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function getDashboard(client, id, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.get(
+    `/dashboards/${id}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function getDashboardForTenant(client, id, tenantId, options, signal) {
+  const params = new URLSearchParams();
+  params.set("tenant_id", tenantId);
+  return await client.get(
+    `/dashboards/${id}/for-tenant?${params.toString()}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function updateDashboard(client, id, body, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.put(
+    `/dashboards/${id}`,
+    body,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function updateDashboardStatus(client, id, status, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.patch(
+    `/dashboards/${id}/status`,
+    { status },
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function deleteDashboard(client, id, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  await client.delete(
+    `/dashboards/${id}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function forkDashboard(client, id, input, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.post(
+    `/dashboards/${id}/fork`,
+    input,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function updateFork(client, forkId, input, options, signal) {
+  const tenantId = resolveTenantId3(client, options?.tenantId);
+  return await client.put(
+    `/dashboards/forks/${forkId}`,
+    input,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function rollbackFork(client, forkId, tenantId, options, signal) {
+  return await client.post(
+    `/dashboards/forks/${forkId}/rollback`,
+    { tenant_id: tenantId },
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function deleteFork(client, forkId, tenantId, options, signal) {
+  const params = new URLSearchParams();
+  params.set("tenant_id", tenantId);
+  await client.delete(
+    `/dashboards/forks/${forkId}?${params.toString()}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
+async function listForksForTenant(client, tenantId, options, signal) {
+  return await client.get(
+    `/dashboards/customer/${tenantId}`,
+    tenantId,
+    options?.userId,
+    options?.scopes,
+    signal
+  );
+}
 
 // src/routes/ingest.ts
 import crypto2 from "crypto";
 async function syncSchema(client, queryEngine, databaseName, options, signal) {
-  const tenantId = resolveTenantId3(client, options.tenantId);
+  const tenantId = resolveTenantId4(client, options.tenantId);
   const adapter = queryEngine.getDatabase(databaseName);
   const metadata = queryEngine.getDatabaseMetadata(databaseName);
   const introspection = await adapter.introspect(
@@ -1194,7 +1649,7 @@ async function syncSchema(client, queryEngine, databaseName, options, signal) {
   );
   return response;
 }
-function resolveTenantId3(client, tenantId) {
+function resolveTenantId4(client, tenantId) {
   const resolved = tenantId ?? client.getDefaultTenantId();
   if (!resolved) {
     throw new Error(
@@ -1236,7 +1691,7 @@ import crypto4 from "crypto";
 // src/routes/query.ts
 import crypto3 from "crypto";
 async function ask(client, queryEngine, question, options, signal) {
-  const tenantId = resolveTenantId4(client, options.tenantId);
+  const tenantId = resolveTenantId5(client, options.tenantId);
   const sessionId = crypto3.randomUUID();
   const querypanelSessionId = options.querypanelSessionId ?? sessionId;
   const maxRetry = options.maxRetry ?? 0;
@@ -1266,7 +1721,8 @@ async function ask(client, queryEngine, question, options, signal) {
         ...options.maxRetry ? { max_retry: options.maxRetry } : {},
         ...tenantSettings ? { tenant_settings: tenantSettings } : {},
         ...databaseName ? { database: databaseName } : {},
-        ...metadata?.dialect ? { dialect: metadata.dialect } : {}
+        ...metadata?.dialect ? { dialect: metadata.dialect } : {},
+        ...options.model?.trim() ? { model: options.model.trim() } : {}
       },
       tenantId,
       options.userId,
@@ -1290,7 +1746,7 @@ async function ask(client, queryEngine, question, options, signal) {
     const dbName = queryResponse.data.database ?? options.database ?? queryEngine.getDefaultDatabase();
     if (!dbName) {
       throw new Error(
-        "No database attached. Call attachPostgres/attachClickhouse first."
+        "No database attached. Call attachPostgres, attachClickhouse, or attachBigQuery first."
       );
     }
     const paramMetadata = Array.isArray(queryResponse.data.params) ? queryResponse.data.params : [];
@@ -1391,7 +1847,7 @@ async function ask(client, queryEngine, question, options, signal) {
   }
   throw new Error("Unexpected error in ask retry loop");
 }
-function resolveTenantId4(client, tenantId) {
+function resolveTenantId5(client, tenantId) {
   const resolved = tenantId ?? client.getDefaultTenantId();
   if (!resolved) {
     throw new Error(
@@ -1547,7 +2003,7 @@ function stripVizSpecOnlyHints(hints) {
   const { kind: _kind, ...rest } = hints;
   return rest;
 }
-function resolveTenantId5(client, tenantId) {
+function resolveTenantId6(client, tenantId) {
   const resolved = tenantId ?? client.getDefaultTenantId();
   if (!resolved) {
     throw new Error(
@@ -1557,7 +2013,7 @@ function resolveTenantId5(client, tenantId) {
   return resolved;
 }
 async function modifyChart(client, queryEngine, input, options, signal) {
-  const tenantId = resolveTenantId5(client, options?.tenantId);
+  const tenantId = resolveTenantId6(client, options?.tenantId);
   const sessionId = crypto4.randomUUID();
   const querypanelSessionId = options?.querypanelSessionId ?? sessionId;
   const hasQuerypanelSessionContext = !!options?.querypanelSessionId;
@@ -1725,7 +2181,7 @@ async function modifyChart(client, queryEngine, input, options, signal) {
 
 // src/routes/sessions.ts
 async function listSessions(client, options, signal) {
-  const tenantId = resolveTenantId6(client, options?.tenantId);
+  const tenantId = resolveTenantId7(client, options?.tenantId);
   const params = new URLSearchParams();
   if (options?.pagination?.page)
     params.set("page", `${options.pagination.page}`);
@@ -1748,7 +2204,7 @@ async function listSessions(client, options, signal) {
   );
 }
 async function getSession(client, sessionId, options, signal) {
-  const tenantId = resolveTenantId6(client, options?.tenantId);
+  const tenantId = resolveTenantId7(client, options?.tenantId);
   const params = new URLSearchParams();
   if (options?.includeTurns !== void 0) {
     params.set("include_turns", `${options.includeTurns}`);
@@ -1762,7 +2218,7 @@ async function getSession(client, sessionId, options, signal) {
   );
 }
 async function updateSession(client, sessionId, body, options, signal) {
-  const tenantId = resolveTenantId6(client, options?.tenantId);
+  const tenantId = resolveTenantId7(client, options?.tenantId);
   return await client.patch(
     `/sessions/${encodeURIComponent(sessionId)}`,
     body,
@@ -1773,7 +2229,7 @@ async function updateSession(client, sessionId, body, options, signal) {
   );
 }
 async function deleteSession(client, sessionId, options, signal) {
-  const tenantId = resolveTenantId6(client, options?.tenantId);
+  const tenantId = resolveTenantId7(client, options?.tenantId);
   await client.delete(
     `/sessions/${encodeURIComponent(sessionId)}`,
     tenantId,
@@ -1782,7 +2238,7 @@ async function deleteSession(client, sessionId, options, signal) {
     signal
   );
 }
-function resolveTenantId6(client, tenantId) {
+function resolveTenantId7(client, tenantId) {
   const resolved = tenantId ?? client.getDefaultTenantId();
   if (!resolved) {
     throw new Error(
@@ -1795,7 +2251,7 @@ function resolveTenantId6(client, tenantId) {
 // src/routes/vizspec.ts
 import crypto5 from "crypto";
 async function generateVizSpec(client, input, options, signal) {
-  const tenantId = resolveTenantId7(client, options?.tenantId);
+  const tenantId = resolveTenantId8(client, options?.tenantId);
   const sessionId = crypto5.randomUUID();
   const response = await client.post(
     "/vizspec",
@@ -1817,7 +2273,7 @@ async function generateVizSpec(client, input, options, signal) {
   );
   return response;
 }
-function resolveTenantId7(client, tenantId) {
+function resolveTenantId8(client, tenantId) {
   const resolved = tenantId ?? client.getDefaultTenantId();
   if (!resolved) {
     throw new Error(
@@ -1828,13 +2284,64 @@ function resolveTenantId7(client, tenantId) {
 }
 
 // src/index.ts
-var QueryPanelSdkAPI = class {
+var QueryPanelSdkAPI = class _QueryPanelSdkAPI {
   client;
   queryEngine;
-  constructor(baseUrl, privateKey, organizationId, options) {
-    this.client = new ApiClient(baseUrl, privateKey, organizationId, options);
+  /**
+   * @param workspaceId - Workspace UUID (same value as your org in the dashboard). Passed to the API as JWT claim `organizationId`.
+   */
+  constructor(baseUrl, privateKey, workspaceId, options) {
+    if (options?.api) {
+      this.client = options.api;
+    } else {
+      if (!baseUrl) throw new Error("Base URL is required");
+      if (!privateKey) throw new Error("Private key is required");
+      if (!workspaceId) throw new Error("Workspace ID is required");
+      this.client = new ApiClient(baseUrl, privateKey, workspaceId, {
+        defaultTenantId: options?.defaultTenantId,
+        additionalHeaders: options?.additionalHeaders,
+        fetch: options?.fetch
+      });
+    }
     this.queryEngine = new QueryEngine();
   }
+  /**
+   * Create an SDK instance that uses a request callback instead of HTTP.
+   * Use this when calling the SDK from within your own API so that "API" calls
+   * are handled in-process (e.g. by invoking querypanel-sdk services directly)
+   * and do not cause recursion.
+   *
+   * @param workspaceId - Workspace identifier (sent as `organizationId` in JWTs and API auth)
+   * @param requestHandler - Callback invoked for each logical API request (method, path, body, tenantId, etc.)
+   * @param options - Optional defaultTenantId
+   * @returns QueryPanelSdkAPI instance; attach databases and call ask(), syncSchema(), etc. as usual
+   *
+   * @example
+   * ```ts
+   * const qp = QueryPanelSdkAPI.withCallbacks(
+   *   process.env.QUERYPANEL_WORKSPACE_ID!,
+   *   async (opts) => {
+   *     // Call your in-process services (e.g. querypanel-sdk logic) instead of HTTP
+   *     if (opts.path === '/query' || opts.path === '/v2/query') {
+   *       const result = await yourSqlGenerator.generate(opts.body, opts.tenantId);
+   *       return { data: result, headers: new Headers({ 'x-querypanel-session-id': result.sessionId }) };
+   *     }
+   *     if (opts.path === '/chart') return { data: await yourChartService.generate(opts.body) };
+   *     // ... other paths
+   *     return { data: await yourProxy(opts) };
+   *   },
+   *   { defaultTenantId: process.env.DEFAULT_TENANT_ID }
+   * );
+   * qp.attachPostgres('db', createClient, { tenantFieldName: 'tenant_id' });
+   * const result = await qp.ask('Top 10 orders', { tenantId: 't1', database: 'db' });
+   * ```
+   */
+  static withCallbacks(workspaceId, requestHandler, options) {
+    const api = new CallbackApiClient(requestHandler, {
+      defaultTenantId: options?.defaultTenantId
+    });
+    return new _QueryPanelSdkAPI("", "", workspaceId, { api });
+  }
   // Database attachment methods
   attachClickhouse(name, clientFn, options) {
     const adapter = new ClickHouseAdapter(clientFn, options);
@@ -1862,6 +2369,19 @@ var QueryPanelSdkAPI = class {
     };
     this.queryEngine.attachDatabase(name, adapter, metadata);
   }
+  attachBigQuery(name, clientFn, options) {
+    const adapter = new BigQueryAdapter(clientFn, options);
+    const metadata = {
+      name,
+      dialect: "bigquery",
+      description: options?.description,
+      tags: options?.tags,
+      tenantFieldName: options?.tenantFieldName,
+      tenantFieldType: options?.tenantFieldType ?? "String",
+      enforceTenantIsolation: options?.tenantFieldName ? options?.enforceTenantIsolation ?? true : void 0
+    };
+    this.queryEngine.attachDatabase(name, adapter, metadata);
+  }
   attachDatabase(name, adapter) {
     const metadata = {
       name,
@@ -1948,6 +2468,48 @@ var QueryPanelSdkAPI = class {
       signal
     );
   }
+  // Embedded dashboard / JWT
+  /**
+   * Creates a JWT for the given tenant (and optional userId, scopes).
+   * Use this when you need to pass a token to the embed (e.g. frontend or demo).
+   * Only available when using the HTTP client (ApiClient); not available when using withCallbacks.
+   */
+  async createJwt(options) {
+    const tenantId = options.tenantId?.trim();
+    if (!tenantId) {
+      throw new Error("tenantId is required");
+    }
+    if (!(this.client instanceof ApiClient)) {
+      throw new Error(
+        "createJwt is not available when using withCallbacks. Use the SDK with baseUrl + privateKey to create JWTs."
+      );
+    }
+    return await this.client.createJwt(
+      tenantId,
+      options.userId,
+      options.scopes
+    );
+  }
+  /**
+   * Runs SQL against an attached database with tenant isolation applied.
+   * Used by embed run-sql (e.g. dashboard chart execution). Requires a database
+   * to be attached (e.g. via attachPostgres) and options.tenantId.
+   */
+  async runSqlForDashboard(input, options) {
+    const tenantId = options.tenantId?.trim();
+    if (!tenantId) {
+      throw new Error("tenantId is required");
+    }
+    const databaseName = input.database ?? "db";
+    const params = input.params ?? {};
+    const result = await this.queryEngine.validateAndExecute(
+      input.sql,
+      params,
+      databaseName,
+      tenantId
+    );
+    return { rows: result.rows, fields: result.fields };
+  }
   // VizSpec generation
   /**
    * Generates a VizSpec visualization specification from query results.
@@ -2391,8 +2953,297 @@ var QueryPanelSdkAPI = class {
   async deleteActiveChart(id, options, signal) {
     await deleteActiveChart(this.client, id, options, signal);
   }
+  // Dashboard CRUD operations
+  /**
+   * Creates a new dashboard with BlockNote content.
+   *
+   * @param body - Dashboard configuration including name and BlockNote content
+   * @param options - Tenant, user, and scope options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Created dashboard
+   *
+   * @example
+   * ```typescript
+   * const dashboard = await qp.createDashboard({
+   *   name: "Sales Dashboard",
+   *   description: "Monthly sales metrics",
+   *   content_json: blockNoteContent,
+   *   editor_type: "blocknote",
+   * }, { tenantId: "tenant_123" });
+   * ```
+   */
+  async createDashboard(body, options, signal) {
+    return await createDashboard(
+      this.client,
+      body,
+      options,
+      signal
+    );
+  }
+  /**
+   * Lists dashboards with pagination and filtering.
+   *
+   * @param options - Filtering and pagination options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Paginated list of dashboards
+   *
+   * @example
+   * ```typescript
+   * const dashboards = await qp.listDashboards({
+   *   tenantId: "tenant_123",
+   *   status: "deployed",
+   *   pagination: { page: 1, limit: 10 },
+   * });
+   * ```
+   */
+  async listDashboards(options, signal) {
+    return await listDashboards(this.client, options, signal);
+  }
+  /**
+   * Gets a dashboard by ID.
+   *
+   * @param id - Dashboard ID
+   * @param options - Tenant, user, and scope options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Dashboard details
+   *
+   * @example
+   * ```typescript
+   * const dashboard = await qp.getDashboard("dash_123", {
+   *   tenantId: "tenant_123",
+   * });
+   * ```
+   */
+  async getDashboard(id, options, signal) {
+    return await getDashboard(
+      this.client,
+      id,
+      options,
+      signal
+    );
+  }
+  /**
+   * Gets a dashboard for a specific tenant.
+   * Returns customer fork if exists, otherwise returns the original dashboard.
+   *
+   * @param id - Dashboard ID
+   * @param tenantId - Tenant ID to check for fork
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Dashboard (fork if exists, original otherwise)
+   *
+   * @example
+   * ```typescript
+   * const dashboard = await qp.getDashboardForTenant(
+   *   "dash_123",
+   *   "tenant_456",
+   * );
+   * ```
+   */
+  async getDashboardForTenant(id, tenantId, options, signal) {
+    return await getDashboardForTenant(
+      this.client,
+      id,
+      tenantId,
+      options,
+      signal
+    );
+  }
+  /**
+   * Updates a dashboard.
+   *
+   * @param id - Dashboard ID to update
+   * @param body - Fields to update
+   * @param options - Tenant, user, and scope options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Updated dashboard
+   *
+   * @example
+   * ```typescript
+   * const updated = await qp.updateDashboard("dash_123", {
+   *   name: "Updated Dashboard",
+   *   content_json: newBlockNoteContent,
+   * }, { tenantId: "tenant_123" });
+   * ```
+   */
+  async updateDashboard(id, body, options, signal) {
+    return await updateDashboard(
+      this.client,
+      id,
+      body,
+      options,
+      signal
+    );
+  }
+  /**
+   * Updates dashboard status (deploy/undeploy).
+   *
+   * @param id - Dashboard ID
+   * @param status - New status
+   * @param options - Tenant, user, and scope options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Updated dashboard
+   *
+   * @example
+   * ```typescript
+   * const deployed = await qp.updateDashboardStatus(
+   *   "dash_123",
+   *   "deployed",
+   *   { tenantId: "tenant_123" },
+   * );
+   * ```
+   */
+  async updateDashboardStatus(id, status, options, signal) {
+    return await updateDashboardStatus(
+      this.client,
+      id,
+      status,
+      options,
+      signal
+    );
+  }
+  /**
+   * Deletes a dashboard.
+   *
+   * @param id - Dashboard ID to delete
+   * @param options - Tenant, user, and scope options
+   * @param signal - Optional AbortSignal for cancellation
+   *
+   * @example
+   * ```typescript
+   * await qp.deleteDashboard("dash_123", { tenantId: "tenant_123" });
+   * ```
+   */
+  async deleteDashboard(id, options, signal) {
+    await deleteDashboard(this.client, id, options, signal);
+  }
+  // Dashboard Fork operations (Customer Customization)
+  /**
+   * Forks a dashboard for customer customization (copy-on-write).
+   *
+   * Creates a full copy of the dashboard that the customer can edit independently.
+   * The original dashboard remains unchanged.
+   *
+   * @param id - Dashboard ID to fork
+   * @param input - Fork configuration with tenant_id
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Forked dashboard
+   *
+   * @example
+   * ```typescript
+   * const fork = await qp.forkDashboard("dash_123", {
+   *   tenant_id: "tenant_456",
+   *   name: "Customer's Custom Dashboard",
+   * });
+   * ```
+   */
+  async forkDashboard(id, input, options, signal) {
+    return await forkDashboard(
+      this.client,
+      id,
+      input,
+      options,
+      signal
+    );
+  }
+  /**
+   * Updates a customer fork.
+   *
+   * @param forkId - Fork ID to update
+   * @param input - Update data including tenant_id
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Updated fork
+   *
+   * @example
+   * ```typescript
+   * const updated = await qp.updateFork("fork_123", {
+   *   tenant_id: "tenant_456",
+   *   content_json: newBlockNoteContent,
+   * });
+   * ```
+   */
+  async updateFork(forkId, input, options, signal) {
+    return await updateFork(
+      this.client,
+      forkId,
+      input,
+      options,
+      signal
+    );
+  }
+  /**
+   * Rollbacks a fork to the original dashboard.
+   * This deletes the fork and the customer will see the original again.
+   *
+   * @param forkId - Fork ID to rollback
+   * @param tenantId - Tenant ID
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Original dashboard
+   *
+   * @example
+   * ```typescript
+   * const original = await qp.rollbackFork("fork_123", "tenant_456");
+   * ```
+   */
+  async rollbackFork(forkId, tenantId, options, signal) {
+    return await rollbackFork(
+      this.client,
+      forkId,
+      tenantId,
+      options,
+      signal
+    );
+  }
+  /**
+   * Deletes a customer fork.
+   *
+   * @param forkId - Fork ID to delete
+   * @param tenantId - Tenant ID
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   *
+   * @example
+   * ```typescript
+   * await qp.deleteFork("fork_123", "tenant_456");
+   * ```
+   */
+  async deleteFork(forkId, tenantId, options, signal) {
+    await deleteFork(
+      this.client,
+      forkId,
+      tenantId,
+      options,
+      signal
+    );
+  }
+  /**
+   * Lists all customer forks for a tenant.
+   *
+   * @param tenantId - Tenant ID
+   * @param options - Additional auth options
+   * @param signal - Optional AbortSignal for cancellation
+   * @returns Array of forks
+   *
+   * @example
+   * ```typescript
+   * const forks = await qp.listForksForTenant("tenant_456");
+   * ```
+   */
+  async listForksForTenant(tenantId, options, signal) {
+    return await listForksForTenant(
+      this.client,
+      tenantId,
+      options,
+      signal
+    );
+  }
 };
 export {
+  BigQueryAdapter,
+  CallbackApiClient,
   ClickHouseAdapter,
   PostgresAdapter,
   QueryErrorCode,