drizzle-cube 0.6.4 → 0.6.5

package/dist/adapters/utils.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./utils-_whV4fXL.cjs");exports.buildTransformedQuery=e.t,exports.calculateQueryComplexity=e.n,exports.formatCubeResponse=e.r,exports.formatErrorResponse=e.i,exports.formatMetaResponse=e.a,exports.formatSqlResponse=e.o,exports.formatSqlString=e.S,exports.generateRequestId=e.s,exports.getDatabaseType=e.c,exports.handleBatchRequest=e.l,exports.handleDiscover=e.p,exports.handleDryRun=e.u,exports.handleLoad=e.m,exports.handleSuggest=e.d,exports.handleValidate=e.f,exports.normalizeQueryFields=e.h;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./utils-CBR-9AMD.cjs");exports.buildTransformedQuery=e.t,exports.calculateQueryComplexity=e.n,exports.formatCubeResponse=e.r,exports.formatErrorResponse=e.i,exports.formatMetaResponse=e.a,exports.formatSqlResponse=e.o,exports.formatSqlString=e.S,exports.generateRequestId=e.s,exports.getDatabaseType=e.c,exports.handleBatchRequest=e.l,exports.handleDiscover=e.p,exports.handleDryRun=e.u,exports.handleLoad=e.m,exports.handleSuggest=e.d,exports.handleValidate=e.f,exports.normalizeQueryFields=e.h;

package/dist/adapters/utils.d.ts

@@ -275,10 +275,17 @@ export interface MCPOptions {
     /** Base path for MCP endpoints (default: '/mcp') */
     basePath?: string;
     /**
-     * Allowed origins for MCP requests (for Origin header validation per MCP 2025-11-25).
-     * If not provided, all origins are allowed (permissive mode).
-     * Set this to restrict access to specific origins for production security.
-     * Example: ['http://localhost:3000', 'https://myapp.com']
+     * Allowed origins for MCP requests (Origin header validation per MCP 2025-11-25,
+     * mitigating DNS rebinding).
+     *
+     * Default (when omitted): admit loopback origins (localhost / 127.x / [::1]) plus
+     * non-browser / server-to-server clients that send no Origin header (e.g. the Claude
+     * MCP connector, curl); every other browser Origin is rejected with 403.
+     *
+     * If a **browser front-end** calls `/mcp`, you MUST list its origin here to allow it,
+     * e.g. ['https://app.example.com']. Include the wildcard '*' to allow ALL origins
+     * (permissive mode — discouraged; prefer exact origins and/or {@link resourceMetadataUrl}
+     * auth as the primary control for public deployments).
      */
     allowedOrigins?: string[];
     /**
@@ -315,6 +322,11 @@ export interface MCPOptions {
      * When set, MCP endpoints require a Bearer token in the Authorization header.
      * Unauthenticated requests receive 401 with WWW-Authenticate pointing to this URL.
      * Token validation is the responsibility of extractSecurityContext.
+     *
+     * Strongly recommended for any public deployment: auth is the primary access control
+     * for `/mcp`, while {@link allowedOrigins} validation is defense-in-depth against
+     * browser-driven (DNS-rebinding) requests. The Claude MCP connector supports the
+     * OAuth 2.1 / PRM flow this enables.
      */
     resourceMetadataUrl?: string;
     /**

package/dist/adapters/utils.js

@@ -1,2 +1,2 @@
-import { S as e, a as t, c as n, d as r, f as i, h as a, i as o, l as s, m as c, n as l, o as u, p as d, r as f, s as p, t as m, u as h } from "./utils-BPWZsX7k.js";
+import { S as e, a as t, c as n, d as r, f as i, h as a, i as o, l as s, m as c, n as l, o as u, p as d, r as f, s as p, t as m, u as h } from "./utils-U7gV5wQL.js";
 export { m as buildTransformedQuery, l as calculateQueryComplexity, f as formatCubeResponse, o as formatErrorResponse, t as formatMetaResponse, u as formatSqlResponse, e as formatSqlString, p as generateRequestId, n as getDatabaseType, s as handleBatchRequest, d as handleDiscover, h as handleDryRun, c as handleLoad, r as handleSuggest, i as handleValidate, a as normalizeQueryFields };

package/dist/cjs/adapters/mcp-transport.d.ts

@@ -82,12 +82,16 @@ export declare const MCP_PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
 export declare function validateAcceptHeader(accept: string | null | undefined): boolean;
 export interface OriginValidationOptions {
     /**
-     * List of allowed origins (e.g., ['http://localhost:3000', 'https://myapp.com'])
-     * If not provided, defaults to localhost origins only
+     * List of allowed origins (e.g., ['http://localhost:3000', 'https://myapp.com']).
+     * If not provided, the default policy admits loopback origins (localhost / 127.x /
+     * [::1]) plus non-browser clients that send no Origin header; any other browser
+     * Origin is rejected. Include the wildcard `'*'` to allow ALL origins (permissive
+     * mode — discouraged; prefer listing exact origins or enabling auth).
      */
     allowedOrigins?: string[];
     /**
-     * If true, allows requests without an Origin header (non-browser clients)
+     * If true, allows requests without an Origin header (non-browser / server-to-server
+     * clients such as the Claude MCP connector, curl, Postman).
      * @default true
      */
     allowMissingOrigin?: boolean;
@@ -97,6 +101,11 @@ export interface OriginValidationOptions {
  * Servers MUST validate Origin to prevent DNS rebinding attacks.
  * If Origin is present and invalid, MUST respond with 403 Forbidden.
  *
+ * Default policy (no `allowedOrigins`): admit loopback origins and requests with no
+ * Origin header (non-browser / server-to-server clients); reject every other browser
+ * Origin. Configure `allowedOrigins` to expose a browser front-end, or include `'*'`
+ * to restore fully-permissive behavior.
+ *
  * @returns { valid: true } if allowed, or { valid: false, reason: string } if blocked
  */
 export declare function validateOriginHeader(origin: string | null | undefined, options?: OriginValidationOptions): {
@@ -105,6 +114,15 @@ export declare function validateOriginHeader(origin: string | null | undefined,
     valid: false;
     reason: string;
 };
+/**
+ * Build {@link OriginValidationOptions} from an MCP config, forwarding the
+ * configured allowlist (if any) so `validateOriginHeader` applies the same policy
+ * for POST, GET, and DELETE `/mcp` across every adapter. When `allowedOrigins` is
+ * absent, the loopback-only default policy applies.
+ */
+export declare function originOptionsFromMcp(mcp: {
+    allowedOrigins?: string[];
+}): OriginValidationOptions;
 /**
  * Extract a Bearer token from an Authorization header.
  * Returns the token string if present and well-formed, or null otherwise.

package/dist/cjs/adapters/utils.d.ts

@@ -275,10 +275,17 @@ export interface MCPOptions {
     /** Base path for MCP endpoints (default: '/mcp') */
     basePath?: string;
     /**
-     * Allowed origins for MCP requests (for Origin header validation per MCP 2025-11-25).
-     * If not provided, all origins are allowed (permissive mode).
-     * Set this to restrict access to specific origins for production security.
-     * Example: ['http://localhost:3000', 'https://myapp.com']
+     * Allowed origins for MCP requests (Origin header validation per MCP 2025-11-25,
+     * mitigating DNS rebinding).
+     *
+     * Default (when omitted): admit loopback origins (localhost / 127.x / [::1]) plus
+     * non-browser / server-to-server clients that send no Origin header (e.g. the Claude
+     * MCP connector, curl); every other browser Origin is rejected with 403.
+     *
+     * If a **browser front-end** calls `/mcp`, you MUST list its origin here to allow it,
+     * e.g. ['https://app.example.com']. Include the wildcard '*' to allow ALL origins
+     * (permissive mode — discouraged; prefer exact origins and/or {@link resourceMetadataUrl}
+     * auth as the primary control for public deployments).
      */
     allowedOrigins?: string[];
     /**
@@ -315,6 +322,11 @@ export interface MCPOptions {
      * When set, MCP endpoints require a Bearer token in the Authorization header.
      * Unauthenticated requests receive 401 with WWW-Authenticate pointing to this URL.
      * Token validation is the responsibility of extractSecurityContext.
+     *
+     * Strongly recommended for any public deployment: auth is the primary access control
+     * for `/mcp`, while {@link allowedOrigins} validation is defense-in-depth against
+     * browser-driven (DNS-rebinding) requests. The Claude MCP connector supports the
+     * OAuth 2.1 / PRM flow this enables.
      */
     resourceMetadataUrl?: string;
     /**

package/dist/cjs/server/executors/sqlite-executor.d.ts

@@ -4,9 +4,15 @@ import { BaseDatabaseExecutor } from './base-executor.js';
 export declare class SQLiteExecutor extends BaseDatabaseExecutor {
     execute<T = any[]>(query: SQL | any, numericFields?: string[]): Promise<T>;
     /**
-     * Convert numeric string fields to numbers (only for measure fields)
+     * Convert numeric string fields to numbers (only for measure fields), in place.
+     *
+     * Hot path for large result sets: this runs once per returned row. Rather than
+     * rebuild a fresh object per row (Object.entries + full-key copy), we mutate
+     * the driver-produced row — which we exclusively own — touching only the
+     * measure columns. Dimensions/time dimensions keep their original types.
+     * When there are no numeric fields, the rows are returned untouched.
      */
-    private convertNumericFields;
+    private convertNumericFieldsInPlace;
     /**
      * Coerce a value to a number if it represents a numeric type
      */

package/dist/client/charts.js

@@ -1,14 +1,14 @@
-import { ct as e, dt as t, ft as n, lt as r, mt as i, pt as a, st as o, t as s, ut as c } from "./chunks/chart-data-table-D4g5_jfF.js";
-import { d as l, l as u, s as d, u as f } from "./chunks/chart-activity-grid-DX0SJbxs.js";
-import { t as p } from "./chunks/chart-funnel-CToKSBaL.js";
-import { a as m, i as h, n as g, o as _, r as v, s as y, t as b } from "./chunks/charts-loader-B0DOQMFH.js";
-import { t as x } from "./chunks/chart-area-of01_62R.js";
-import { i as S } from "./chunks/utils-Cq-j5E5I.js";
-import { t as C } from "./chunks/chart-bar-BqelQE_I.js";
-import { t as w } from "./chunks/chart-line-DKgrQA6c.js";
-import { t as T } from "./chunks/chart-pie-ByieAX5H.js";
-import { t as E } from "./chunks/chart-scatter-Dd9WFqnS.js";
-import { t as D } from "./chunks/chart-radar-CiSwHWp4.js";
-import { t as O } from "./chunks/chart-radial-bar-BF6Mhl6f.js";
-import { t as k } from "./chunks/chart-tree-map-Ceq5sLZA.js";
+import { ct as e, dt as t, ft as n, lt as r, mt as i, pt as a, st as o, t as s, ut as c } from "./chunks/chart-data-table-BP6DMdom.js";
+import { d as l, l as u, s as d, u as f } from "./chunks/chart-activity-grid-DDqFVWoa.js";
+import { t as p } from "./chunks/chart-funnel-xeVGBy-p.js";
+import { a as m, i as h, n as g, o as _, r as v, s as y, t as b } from "./chunks/charts-loader-DAJbAD7a.js";
+import { t as x } from "./chunks/chart-area-BHxPNsmc.js";
+import { i as S } from "./chunks/utils-DjLiJKS_.js";
+import { t as C } from "./chunks/chart-bar-DAO3PPcE.js";
+import { t as w } from "./chunks/chart-line-sJK-cJc0.js";
+import { t as T } from "./chunks/chart-pie-BDaaYt7a.js";
+import { t as E } from "./chunks/chart-scatter-CRhGLCcy.js";
+import { t as D } from "./chunks/chart-radar-Bz07PIVe.js";
+import { t as O } from "./chunks/chart-radial-bar-DpyxKQMj.js";
+import { t as k } from "./chunks/chart-tree-map-iI3ewOKY.js";
 export { d as CHART_COLORS, u as CHART_MARGINS, s as DataTable, p as FunnelChart, b as LazyChart, f as NEGATIVE_COLOR, l as POSITIVE_COLOR, x as RechartsAreaChart, C as RechartsBarChart, w as RechartsLineChart, T as RechartsPieChart, D as RechartsRadarChart, O as RechartsRadialBarChart, E as RechartsScatterChart, k as RechartsTreeMapChart, o as clearChartConfigCache, S as formatChartData, g as getAvailableChartTypes, e as getChartConfigAsync, r as getChartConfigSync, v as getUnavailableChartTypes, c as isChartConfigLoaded, h as isChartTypeAvailable, m as isValidChartType, t as loadAllChartConfigs, _ as preloadChart, n as preloadChartConfig, a as preloadChartConfigs, y as preloadCharts, i as useChartConfig };