yamchart 0.10.2 → 0.10.3

package/dist/{dev-KOWFGDOP.js → dev-PHFYLJPJ.js}

@@ -2,7 +2,7 @@ import { createRequire as __yamchartCreateRequire } from 'module'; if (!globalTh
 import {
   loadEnvFile,
   validateProject
-} from "./chunk-25ES7MGF.js";
+} from "./chunk-ODSPBOJW.js";
 import {
   box,
   detail,
@@ -18,10 +18,16 @@ import {
   filterCatalogEntries
 } from "./chunk-ZMJPRNOA.js";
 import {
+  buildModelPath,
   buildProvider,
   createEmbedder,
-  createProviderForTask
-} from "./chunk-UOSOZT47.js";
+  createProviderForTask,
+  detectConventions,
+  formatModelSql,
+  scaffoldModelSql,
+  updateSchemaYml,
+  writeDbtModel
+} from "./chunk-KDDO4UII.js";
 import {
   BigQueryConnector,
   DuckDBConnector,
@@ -40,7 +46,7 @@ import {
   resolveMySQLAuth,
   resolvePostgresAuth,
   resolveSnowflakeAuth
-} from "./chunk-5CRXV5PQ.js";
+} from "./chunk-2XJZJ6IA.js";
 import {
   SemanticModelBuilder,
   SemanticQueryCompiler,
@@ -57,7 +63,7 @@ import {
   isRelativeDateRange,
   loadSemanticDefinitions,
   validateSemanticQuery
-} from "./chunk-X3UG6T3Q.js";
+} from "./chunk-6ELSQNIH.js";
 import {
   AiConfigSchema,
   ChartSchema,
@@ -74,7 +80,7 @@ import {
   SemanticQuerySchema,
   deepMerge,
   resolveProjectConfig
-} from "./chunk-7HWFVUGP.js";
+} from "./chunk-OYBI433Z.js";
 import {
   AuthDatabase,
   generateOpaqueToken,
@@ -3040,7 +3046,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root, ref);
+      let _sch = resolve4.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3067,7 +3073,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve3(root, ref) {
+    function resolve4(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3642,7 +3648,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3869,7 +3875,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve4,
       resolveComponent,
       equal,
       serialize,
@@ -6850,7 +6856,7 @@ var require_dist = __commonJS({
 });
 
 // src/commands/dev.ts
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 import { homedir } from "os";
 
 // ../server/dist/server.js
@@ -6858,9 +6864,476 @@ import Fastify from "fastify";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 
-// ../server/dist/services/config-loader.js
+// ../../packages/engine/dist/cache.js
+import { LRUCache } from "lru-cache";
+var MemoryCache = class {
+  cache;
+  defaultTtlMs;
+  hits = 0;
+  misses = 0;
+  constructor(options) {
+    this.defaultTtlMs = options.defaultTtlMs;
+    this.cache = new LRUCache({
+      max: options.maxSize,
+      ttl: options.defaultTtlMs,
+      ttlAutopurge: true
+    });
+  }
+  async get(key) {
+    const value = this.cache.get(key);
+    if (value) {
+      this.hits++;
+      return value;
+    }
+    this.misses++;
+    return null;
+  }
+  async set(key, value, ttlMs) {
+    this.cache.set(key, value, { ttl: ttlMs ?? this.defaultTtlMs });
+  }
+  async invalidate(key) {
+    this.cache.delete(key);
+  }
+  async invalidatePattern(pattern) {
+    const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    const regex = new RegExp(`^${regexPattern}$`);
+    for (const key of this.cache.keys()) {
+      if (regex.test(key)) {
+        this.cache.delete(key);
+      }
+    }
+  }
+  async clear() {
+    this.cache.clear();
+  }
+  getStats() {
+    return {
+      size: this.cache.size,
+      hits: this.hits,
+      misses: this.misses
+    };
+  }
+};
+function parseTtl2(ttl) {
+  const match = ttl.match(/^(\d+)(ms|s|m|h|d)$/);
+  if (!match) {
+    throw new Error(`Invalid TTL format: ${ttl}`);
+  }
+  const value = parseInt(match[1] ?? "0", 10);
+  const unit = match[2];
+  switch (unit) {
+    case "ms":
+      return value;
+    case "s":
+      return value * 1e3;
+    case "m":
+      return value * 60 * 1e3;
+    case "h":
+      return value * 60 * 60 * 1e3;
+    case "d":
+      return value * 24 * 60 * 60 * 1e3;
+    default:
+      throw new Error(`Unknown TTL unit: ${unit}`);
+  }
+}
+
+// ../../packages/engine/dist/connector-factory.js
+import { join } from "path";
+function createConnectorFromConfig(connection, options) {
+  const { projectDir } = options;
+  switch (connection.type) {
+    case "duckdb": {
+      const duckdbConfig = connection;
+      const dbPath = duckdbConfig.config.path.startsWith("/") ? duckdbConfig.config.path : join(projectDir, duckdbConfig.config.path);
+      return new DuckDBConnector({ path: dbPath });
+    }
+    case "postgres": {
+      const pgConnection = connection;
+      const credentials = resolvePostgresAuth(pgConnection, options.secrets);
+      return new PostgresConnector({
+        host: pgConnection.config.host,
+        port: pgConnection.config.port,
+        database: pgConnection.config.database,
+        schema: pgConnection.config.schema,
+        ssl: pgConnection.config.ssl,
+        user: credentials.user,
+        password: credentials.password,
+        min: pgConnection.pool?.min_connections,
+        max: pgConnection.pool?.max_connections,
+        idleTimeoutMillis: pgConnection.pool?.idle_timeout,
+        statementTimeout: pgConnection.query?.timeout
+      });
+    }
+    case "mysql": {
+      const mysqlConnection = connection;
+      const credentials = resolveMySQLAuth(mysqlConnection, options.secrets);
+      return new MySQLConnector({
+        host: mysqlConnection.config.host,
+        port: mysqlConnection.config.port,
+        database: mysqlConnection.config.database,
+        ssl: mysqlConnection.config.ssl,
+        user: credentials.user,
+        password: credentials.password,
+        min: mysqlConnection.pool?.min_connections,
+        max: mysqlConnection.pool?.max_connections,
+        idleTimeoutMillis: mysqlConnection.pool?.idle_timeout,
+        statementTimeout: mysqlConnection.query?.timeout
+      });
+    }
+    case "sqlite": {
+      const sqliteConnection = connection;
+      const dbPath = sqliteConnection.config.path.startsWith("/") ? sqliteConnection.config.path : sqliteConnection.config.path === ":memory:" ? ":memory:" : join(projectDir, sqliteConnection.config.path);
+      return new SQLiteConnector({ path: dbPath });
+    }
+    case "snowflake": {
+      const sfConnection = connection;
+      const credentials = resolveSnowflakeAuth(sfConnection, options.secrets);
+      return new SnowflakeConnector({
+        account: sfConnection.config.account,
+        username: credentials.username,
+        password: credentials.password,
+        privateKey: credentials.privateKey,
+        authenticator: credentials.authenticator,
+        clientStoreTemporaryCredential: credentials.clientStoreTemporaryCredential,
+        warehouse: sfConnection.config.warehouse,
+        database: sfConnection.config.database,
+        schema: sfConnection.config.schema,
+        role: sfConnection.config.role,
+        statementTimeout: sfConnection.query?.timeout
+      });
+    }
+    case "bigquery": {
+      const bqConnection = connection;
+      const creds = resolveBigQueryAuth(bqConnection, options.secrets);
+      const keyFilename = creds.keyFilename ? creds.keyFilename.startsWith("/") ? creds.keyFilename : join(projectDir, creds.keyFilename) : void 0;
+      return new BigQueryConnector({
+        projectId: bqConnection.config.project_id,
+        dataset: bqConnection.config.dataset,
+        location: bqConnection.config.location,
+        maxBytesBilled: bqConnection.config.max_bytes_billed,
+        credentials: creds.credentials,
+        keyFilename
+      });
+    }
+    default:
+      throw new Error(`Unsupported connection type: ${connection.type}`);
+  }
+}
+function buildConnectionInfo(connection) {
+  const info2 = {
+    name: connection.name,
+    type: connection.type
+  };
+  switch (connection.type) {
+    case "duckdb": {
+      const c = connection;
+      info2.path = c.config.path;
+      break;
+    }
+    case "postgres": {
+      const c = connection;
+      info2.host = c.config.host;
+      info2.port = c.config.port;
+      info2.database = c.config.database;
+      info2.schema = c.config.schema;
+      break;
+    }
+    case "mysql": {
+      const c = connection;
+      info2.host = c.config.host;
+      info2.port = c.config.port;
+      info2.database = c.config.database;
+      break;
+    }
+    case "sqlite": {
+      const c = connection;
+      info2.path = c.config.path;
+      break;
+    }
+    case "snowflake": {
+      const c = connection;
+      info2.account = c.config.account;
+      info2.warehouse = c.config.warehouse;
+      info2.database = c.config.database;
+      info2.schema = c.config.schema;
+      info2.role = c.config.role;
+      break;
+    }
+    case "bigquery": {
+      const c = connection;
+      info2.database = c.config.project_id;
+      info2.schema = c.config.dataset;
+      break;
+    }
+  }
+  return info2;
+}
+async function testConnection(connection, options) {
+  const start = performance.now();
+  let connector = null;
+  try {
+    connector = createConnectorFromConfig(connection, options);
+    await connector.connect();
+    const healthQuery = connection.type === "duckdb" ? "SELECT 1 AS health" : "SELECT 1";
+    await connector.execute(healthQuery);
+    const latencyMs = performance.now() - start;
+    return {
+      name: connection.name,
+      type: connection.type,
+      status: "healthy",
+      latencyMs: Math.round(latencyMs)
+    };
+  } catch (err) {
+    const latencyMs = performance.now() - start;
+    let errorMessage = "Unknown error";
+    if (err instanceof Error) {
+      const pgError = err;
+      errorMessage = err.message || pgError.code || "Connection failed";
+    } else {
+      errorMessage = String(err);
+    }
+    return {
+      name: connection.name,
+      type: connection.type,
+      status: "unhealthy",
+      latencyMs: Math.round(latencyMs),
+      error: errorMessage
+    };
+  } finally {
+    if (connector) {
+      try {
+        await connector.disconnect();
+      } catch {
+      }
+    }
+  }
+}
+
+// ../../packages/engine/dist/query-service.js
+function quoteIdentifier(name, dialect) {
+  if (dialect === "mysql" || dialect === "bigquery")
+    return `\`${name.replace(/`/g, "``")}\``;
+  return `"${name.replace(/"/g, '""')}"`;
+}
+var QueryService = class {
+  compiler;
+  connector;
+  cache;
+  models;
+  refs;
+  dialect;
+  constructor(config) {
+    this.compiler = new QueryCompiler({
+      models: config.models,
+      refs: config.refs
+    });
+    this.connector = config.connector;
+    this.cache = config.cache;
+    this.models = new Map(Object.entries(config.models));
+    this.refs = config.refs;
+    this.dialect = config.dialect ?? "duckdb";
+  }
+  async executeChart(chart, params, userContext) {
+    const compiled = this.compiler.compile(chart, params, userContext);
+    const cached = await this.cache.get(compiled.cacheKey);
+    if (cached) {
+      return {
+        columns: cached.columns,
+        rows: cached.rows,
+        rowCount: cached.rowCount,
+        durationMs: cached.durationMs,
+        cached: true,
+        cacheKey: compiled.cacheKey,
+        compiledSql: compiled.sql
+      };
+    }
+    const result = await this.connector.execute(compiled.sql);
+    const cacheEntry = {
+      columns: result.columns,
+      rows: result.rows,
+      rowCount: result.rowCount,
+      durationMs: result.durationMs,
+      cachedAt: Date.now()
+    };
+    await this.cache.set(compiled.cacheKey, cacheEntry);
+    return {
+      ...result,
+      cached: false,
+      cacheKey: compiled.cacheKey,
+      compiledSql: compiled.sql
+    };
+  }
+  /**
+   * Execute a table chart with server-side pagination.
+   * Wraps the compiled SQL with LIMIT/OFFSET and runs a parallel COUNT(*) query.
+   * Optionally computes summary aggregations for specified columns.
+   */
+  async executeChartPaginated(chart, params, options, userContext) {
+    const compiled = this.compiler.compile(chart, params, userContext);
+    const baseSql = compiled.sql;
+    const q = quoteIdentifier;
+    const d = this.dialect;
+    let orderBy = "";
+    if (options.sortField) {
+      const cleanField = options.sortField.replace(/[^\w\s]/g, "");
+      if (cleanField.length > 0) {
+        orderBy = `ORDER BY ${q(cleanField, d)} ${options.sortDirection === "desc" ? "DESC" : "ASC"}`;
+      }
+    }
+    const offset = options.page * options.pageSize;
+    const dataSql = `SELECT * FROM (${baseSql}) _t ${orderBy} LIMIT ${options.pageSize} OFFSET ${offset}`;
+    const countCacheKey = `${compiled.cacheKey}:count`;
+    let totalCount;
+    const cachedCount = await this.cache.get(countCacheKey);
+    if (cachedCount) {
+      totalCount = cachedCount.rowCount;
+    } else {
+      const countSql = `SELECT COUNT(*) AS _count FROM (${baseSql}) _t`;
+      const countResult = await this.connector.execute(countSql);
+      totalCount = Number(countResult.rows[0]?._count ?? 0);
+      await this.cache.set(countCacheKey, {
+        columns: [],
+        rows: [],
+        rowCount: totalCount,
+        durationMs: countResult.durationMs,
+        cachedAt: Date.now()
+      });
+    }
+    let summaryValues;
+    if (options.summaryColumns && options.summaryColumns.length > 0) {
+      const summaryCacheKey = `${compiled.cacheKey}:summary`;
+      const cachedSummary = await this.cache.get(summaryCacheKey);
+      if (cachedSummary && cachedSummary.rows[0]) {
+        summaryValues = cachedSummary.rows[0];
+      } else {
+        const aggExprs = options.summaryColumns.map(({ field, summary }) => {
+          const col = q(field, d);
+          switch (summary) {
+            case "sum":
+              return `SUM(${col}) AS ${q(`_sum_${field}`, d)}`;
+            case "avg":
+              return `AVG(${col}) AS ${q(`_avg_${field}`, d)}`;
+            case "min":
+              return `MIN(${col}) AS ${q(`_min_${field}`, d)}`;
+            case "max":
+              return `MAX(${col}) AS ${q(`_max_${field}`, d)}`;
+            case "count":
+              return `COUNT(${col}) AS ${q(`_count_${field}`, d)}`;
+            default:
+              return null;
+          }
+        }).filter(Boolean);
+        if (aggExprs.length > 0) {
+          const summarySql = `SELECT ${aggExprs.join(", ")} FROM (${baseSql}) _t`;
+          const summaryResult = await this.connector.execute(summarySql);
+          if (summaryResult.rows[0]) {
+            summaryValues = {};
+            for (const { field, summary } of options.summaryColumns) {
+              const key = `_${summary}_${field}`;
+              summaryValues[`${summary}:${field}`] = Number(summaryResult.rows[0][key] ?? 0);
+            }
+            await this.cache.set(summaryCacheKey, {
+              columns: [],
+              rows: [summaryValues],
+              rowCount: 0,
+              durationMs: summaryResult.durationMs,
+              cachedAt: Date.now()
+            });
+          }
+        }
+      }
+    }
+    const result = await this.connector.execute(dataSql);
+    return {
+      ...result,
+      cached: false,
+      cacheKey: compiled.cacheKey,
+      compiledSql: dataSql,
+      totalCount,
+      page: options.page,
+      pageSize: options.pageSize,
+      summaryValues
+    };
+  }
+  /**
+   * Execute a chart query for CSV export with a bounded row limit.
+   * Returns full QueryResult — caller streams to HTTP response.
+   */
+  async executeChartForExport(chart, params, maxRows, userContext) {
+    const compiled = this.compiler.compile(chart, params, userContext);
+    const sql = `SELECT * FROM (${compiled.sql}) _t LIMIT ${maxRows}`;
+    const result = await this.connector.execute(sql);
+    return {
+      ...result,
+      cached: false,
+      cacheKey: compiled.cacheKey,
+      compiledSql: sql
+    };
+  }
+  /**
+   * Compile a chart query without executing it.
+   * Returns the compiled SQL and cache key.
+   */
+  compileChart(chart, params, userContext) {
+    return this.compiler.compile(chart, params, userContext);
+  }
+  invalidateChart(chartName) {
+    this.cache.invalidatePattern(`${chartName}:*`);
+  }
+  invalidateAll() {
+    this.cache.clear();
+  }
+  /**
+   * Update the compiler with new models and refs.
+   * Called when config is reloaded.
+   */
+  updateCompiler(config) {
+    this.compiler = new QueryCompiler({
+      models: config.models,
+      refs: config.refs
+    });
+    this.models = new Map(Object.entries(config.models));
+    this.refs = config.refs;
+  }
+  getCacheStats() {
+    return this.cache.getStats();
+  }
+  async executeRawSql(sql) {
+    return this.connector.execute(sql);
+  }
+  async executeModel(modelName, params, userContext, limit2 = 1e3, filters) {
+    const model = this.models.get(modelName);
+    if (!model) {
+      throw new Error(`Unknown model: ${modelName}`);
+    }
+    const context = createTemplateContext(params, this.refs, userContext);
+    let sql = renderTemplate(model.sql, context);
+    if (filters && Object.keys(filters).length > 0) {
+      const clauses = Object.entries(filters).map(([field, value]) => `${field} = '${value.replace(/'/g, "''")}'`);
+      sql = `SELECT * FROM (${sql}) _detail WHERE ${clauses.join(" AND ")} LIMIT ${limit2}`;
+    } else {
+      sql = `SELECT * FROM (${sql}) _detail LIMIT ${limit2}`;
+    }
+    return this.connector.execute(sql);
+  }
+  async executeParameterOptions(modelName, valueField, labelField) {
+    const model = this.models.get(modelName);
+    if (!model) {
+      throw new Error(`Unknown model: ${modelName}`);
+    }
+    const context = createTemplateContext({}, this.refs);
+    const sql = renderTemplate(model.sql, context);
+    const result = await this.connector.execute(sql);
+    return result.rows.map((row) => ({
+      value: String(row[valueField] ?? ""),
+      label: String(row[labelField] ?? row[valueField] ?? "")
+    }));
+  }
+};
+
+// ../../packages/engine/dist/config-loader.js
 import { readFile, readdir, access } from "fs/promises";
-import { join, extname, relative, dirname } from "path";
+import { join as join2, extname, relative, dirname } from "path";
 import { parse as parseYaml } from "yaml";
 import { watch } from "chokidar";
 
@@ -7113,7 +7586,7 @@ data: ${JSON.stringify(event.data)}
 `;
 }
 
-// ../server/dist/services/config-loader.js
+// ../../packages/engine/dist/config-loader.js
 var ConfigLoader = class {
   projectDir;
   project = null;
@@ -7164,7 +7637,7 @@ var ConfigLoader = class {
     await this.loadAgents();
   }
   async loadProject() {
-    const projectPath = join(this.projectDir, "yamchart.yaml");
+    const projectPath = join2(this.projectDir, "yamchart.yaml");
     try {
       await access(projectPath);
     } catch {
@@ -7173,7 +7646,7 @@ var ConfigLoader = class {
     const content = await readFile(projectPath, "utf-8");
     const raw = parseYaml(content);
     let merged = resolveProjectConfig(raw, this.env);
-    const localPath = join(this.projectDir, "yamchart.local.yaml");
+    const localPath = join2(this.projectDir, "yamchart.local.yaml");
     try {
       await access(localPath);
       const localContent = await readFile(localPath, "utf-8");
@@ -7190,7 +7663,7 @@ var ConfigLoader = class {
     this.project = result.data;
   }
   async loadConnections() {
-    const connectionsDir = join(this.projectDir, "connections");
+    const connectionsDir = join2(this.projectDir, "connections");
     try {
       await access(connectionsDir);
     } catch {
@@ -7200,7 +7673,7 @@ var ConfigLoader = class {
     for (const file of files) {
       if (extname(file) !== ".yaml" && extname(file) !== ".yml")
         continue;
-      const filePath = join(connectionsDir, file);
+      const filePath = join2(connectionsDir, file);
       const content = await readFile(filePath, "utf-8");
       const parsed = parseYaml(content);
       const result = ConnectionSchema.safeParse(parsed);
@@ -7212,7 +7685,7 @@ var ConfigLoader = class {
     }
   }
   async loadCharts() {
-    const chartsDir = join(this.projectDir, "charts");
+    const chartsDir = join2(this.projectDir, "charts");
     try {
       await access(chartsDir);
     } catch {
@@ -7223,7 +7696,7 @@ var ConfigLoader = class {
   async loadChartsFromDir(dir, baseDir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
+      const fullPath = join2(dir, entry.name);
       if (entry.isDirectory() && dir === baseDir) {
         await this.loadChartsFromDir(fullPath, baseDir);
       } else if (entry.isFile() && (extname(entry.name) === ".yaml" || extname(entry.name) === ".yml")) {
@@ -7256,7 +7729,7 @@ var ConfigLoader = class {
     }
   }
   async loadModels() {
-    const modelsDir = join(this.projectDir, "models");
+    const modelsDir = join2(this.projectDir, "models");
     try {
       await access(modelsDir);
     } catch {
@@ -7267,7 +7740,7 @@ var ConfigLoader = class {
   async loadModelsFromDir(dir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
+      const fullPath = join2(dir, entry.name);
       if (entry.isDirectory()) {
         await this.loadModelsFromDir(fullPath);
       } else if (extname(entry.name) === ".sql") {
@@ -7286,7 +7759,7 @@ var ConfigLoader = class {
     }
   }
   async loadDashboards() {
-    const dashboardsDir = join(this.projectDir, "dashboards");
+    const dashboardsDir = join2(this.projectDir, "dashboards");
     try {
       await access(dashboardsDir);
     } catch {
@@ -7297,7 +7770,7 @@ var ConfigLoader = class {
   async loadDashboardsFromDir(dir, baseDir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
+      const fullPath = join2(dir, entry.name);
       if (entry.isDirectory() && dir === baseDir) {
         await this.loadDashboardsFromDir(fullPath, baseDir);
       } else if (entry.isFile() && (extname(entry.name) === ".yaml" || extname(entry.name) === ".yml")) {
@@ -7330,7 +7803,7 @@ var ConfigLoader = class {
     }
   }
   async loadSchedules() {
-    const schedulesDir = join(this.projectDir, "schedules");
+    const schedulesDir = join2(this.projectDir, "schedules");
     try {
       await access(schedulesDir);
     } catch {
@@ -7340,7 +7813,7 @@ var ConfigLoader = class {
     for (const file of files) {
       if (extname(file) !== ".yaml" && extname(file) !== ".yml")
         continue;
-      const filePath = join(schedulesDir, file);
+      const filePath = join2(schedulesDir, file);
       const content = await readFile(filePath, "utf-8");
       const parsed = parseYaml(content);
       const result = ScheduleSchema.safeParse(parsed);
@@ -7352,7 +7825,7 @@ var ConfigLoader = class {
     }
   }
   async loadEvents() {
-    const eventsPath = join(this.projectDir, "events.yaml");
+    const eventsPath = join2(this.projectDir, "events.yaml");
     try {
       await access(eventsPath);
     } catch {
@@ -7368,12 +7841,12 @@ var ConfigLoader = class {
     }
   }
   async loadAgents() {
-    const agentsDir = join(this.projectDir, "agents");
+    const agentsDir = join2(this.projectDir, "agents");
     this.agentRegistry.clearProjectAgents();
     try {
       const files = await readdir(agentsDir);
       for (const file of files.filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"))) {
-        const content = await readFile(join(agentsDir, file), "utf-8");
+        const content = await readFile(join2(agentsDir, file), "utf-8");
         this.agentRegistry.loadFromYaml(content, `agents/${file}`, (msg) => {
           console.warn(msg);
         });
@@ -7385,15 +7858,15 @@ var ConfigLoader = class {
     if (this.watcher)
       return;
     const watchPaths = [
-      join(this.projectDir, "yamchart.yaml"),
-      join(this.projectDir, "yamchart.local.yaml"),
-      join(this.projectDir, "connections"),
-      join(this.projectDir, "charts"),
-      join(this.projectDir, "models"),
-      join(this.projectDir, "dashboards"),
-      join(this.projectDir, "schedules"),
-      join(this.projectDir, "events.yaml"),
-      join(this.projectDir, "agents")
+      join2(this.projectDir, "yamchart.yaml"),
+      join2(this.projectDir, "yamchart.local.yaml"),
+      join2(this.projectDir, "connections"),
+      join2(this.projectDir, "charts"),
+      join2(this.projectDir, "models"),
+      join2(this.projectDir, "dashboards"),
+      join2(this.projectDir, "schedules"),
+      join2(this.projectDir, "events.yaml"),
+      join2(this.projectDir, "agents")
     ];
     this.watcher = watch(watchPaths, {
       ignored: /(^|[\/\\])\../,
@@ -7469,692 +7942,231 @@ Fix: run "ulimit -n 10240" before starting yamchart dev, or add it to your shell
     this.runtimeKnowledgeUrl = rc.knowledge?.database_url;
     this.runtimeAi = rc.ai;
   }
-  getConnectionSecrets(name) {
-    return this.connectionSecrets.get(name);
-  }
-  /** Knowledge DB URL: runtime override wins, else the named env var. */
-  getKnowledgeDbUrl(envVarName, env) {
-    return this.runtimeKnowledgeUrl ?? env[envVarName];
-  }
-  /** Effective AI config: Git project.ai with the runtime ai deep-merged over it. */
-  getAiConfig() {
-    const base2 = this.project?.ai;
-    if (!this.runtimeAi)
-      return base2;
-    return deepMerge(base2 ?? {}, this.runtimeAi);
-  }
-  getCharts() {
-    return Array.from(this.charts.values());
-  }
-  getChartByName(name) {
-    return this.charts.get(name);
-  }
-  getChartFolder(name) {
-    return this.chartFolders.get(name) ?? "";
-  }
-  getChartFilePath(name) {
-    return this.chartFilePaths.get(name);
-  }
-  getModels() {
-    return Array.from(this.models.values());
-  }
-  getModelByName(name) {
-    return this.models.get(name);
-  }
-  getDefaultConnection() {
-    const envConnection = process.env.YAMCHART_CONNECTION;
-    if (envConnection) {
-      return this.connections.get(envConnection);
-    }
-    const defaultName = this.project?.defaults?.connection;
-    if (defaultName) {
-      return this.connections.get(defaultName);
-    }
-    return this.connections.values().next().value;
-  }
-  getDashboards() {
-    return Array.from(this.dashboards.values());
-  }
-  getDashboardByName(name) {
-    return this.dashboards.get(name);
-  }
-  getDashboardFolder(name) {
-    return this.dashboardFolders.get(name) ?? "";
-  }
-  getDashboardFilePath(name) {
-    return this.dashboardFilePaths.get(name);
-  }
-  getSchedules() {
-    return Array.from(this.schedules.values());
-  }
-  getEvents() {
-    return this.events;
-  }
-  getProjectDir() {
-    return this.projectDir;
-  }
-  getValidationError(name) {
-    return this.validationErrors.get(name);
-  }
-  getValidationErrors() {
-    return this.validationErrors;
-  }
-  getAgentRegistry() {
-    return this.agentRegistry;
-  }
-};
-
-// ../server/dist/services/runtime-config-store.js
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname3, join as join3, isAbsolute } from "path";
-
-// ../server/dist/services/secret-crypto.js
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-var ALGO = "aes-256-gcm";
-function deriveKeyFromEnv(env) {
-  const b64 = env.YAMCHART_CONFIG_SECRET;
-  if (!b64)
-    return null;
-  const key = Buffer.from(b64, "base64");
-  if (key.length !== 32) {
-    throw new Error("YAMCHART_CONFIG_SECRET must be a base64-encoded 32-byte key");
-  }
-  return key;
-}
-function getConfigKey(dataDir, env, log) {
-  const fromEnv = deriveKeyFromEnv(env);
-  if (fromEnv)
-    return fromEnv;
-  const keyPath = join2(dataDir, ".config-secret");
-  if (existsSync(keyPath)) {
-    const key2 = Buffer.from(readFileSync(keyPath, "utf8").trim(), "base64");
-    if (key2.length !== 32) {
-      throw new Error(`Key file at ${keyPath} does not contain a 32-byte key (got ${key2.length} bytes). Delete it to regenerate.`);
-    }
-    return key2;
-  }
-  mkdirSync(dirname2(keyPath), { recursive: true });
-  const key = randomBytes(32);
-  writeFileSync(keyPath, key.toString("base64"), { mode: 384 });
-  log?.(`No YAMCHART_CONFIG_SECRET set \u2014 generated a machine-local key at ${keyPath}. Set YAMCHART_CONFIG_SECRET to keep secrets readable across deploys/volumes.`);
-  return key;
-}
-function encryptSecret(plain, key) {
-  const iv = randomBytes(12);
-  const cipher = createCipheriv(ALGO, key, iv);
-  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
-}
-function decryptSecret(enc, key) {
-  const [ivB64, tagB64, ctB64] = enc.split(":");
-  if (!ivB64 || !tagB64 || !ctB64)
-    throw new Error("Malformed encrypted secret");
-  const decipher = createDecipheriv(ALGO, key, Buffer.from(ivB64, "base64"));
-  decipher.setAuthTag(Buffer.from(tagB64, "base64"));
-  return Buffer.concat([decipher.update(Buffer.from(ctB64, "base64")), decipher.final()]).toString("utf8");
-}
-function maskSecret(plain) {
-  if (plain.length <= 4)
-    return "\u2022\u2022\u2022\u2022";
-  return "\u2022\u2022\u2022\u2022" + plain.slice(-4);
-}
-
-// ../server/dist/services/runtime-config-store.js
-var RuntimeConfigError = class extends Error {
-};
-var SECRET_LEAF_KEYS = /* @__PURE__ */ new Set(["password", "private_key", "credentials_json", "database_url", "api_key"]);
-function transformSecretLeaves(obj, fn) {
-  if (Array.isArray(obj))
-    return obj.map((v) => transformSecretLeaves(v, fn));
-  if (obj && typeof obj === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(obj)) {
-      out[k] = SECRET_LEAF_KEYS.has(k) && typeof v === "string" ? fn(v) : transformSecretLeaves(v, fn);
-    }
-    return out;
-  }
-  return obj;
-}
-var RuntimeConfigStore = class {
-  filePath;
-  key;
-  constructor(filePath, key) {
-    this.filePath = filePath;
-    this.key = key;
-  }
-  /** Directory the store (and key file) live in — useful for getConfigKey(). */
-  get dataDir() {
-    return dirname3(this.filePath);
-  }
-  static resolvePath(opts) {
-    if (opts.env.YAMCHART_RUNTIME_CONFIG)
-      return opts.env.YAMCHART_RUNTIME_CONFIG;
-    if (opts.authDbPath && isAbsolute(opts.authDbPath))
-      return join3(dirname3(opts.authDbPath), "runtime-config.json");
-    return join3(opts.projectDir, ".yamchart", "runtime-config.json");
-  }
-  read() {
-    if (!existsSync2(this.filePath))
-      return { version: 1 };
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
-    } catch (err) {
-      throw new RuntimeConfigError(`runtime-config.json is not valid JSON: ${err.message}`);
-    }
-    let decrypted;
-    try {
-      decrypted = transformSecretLeaves(parsed, (s) => decryptSecret(s, this.key));
-    } catch (err) {
-      throw new RuntimeConfigError(`Could not decrypt runtime-config.json (wrong YAMCHART_CONFIG_SECRET?): ${err.message}`);
-    }
-    const result = RuntimeConfigSchema.safeParse(decrypted);
-    if (!result.success)
-      throw new RuntimeConfigError(`Invalid runtime-config.json: ${result.error.message}`);
-    return result.data;
-  }
-  write(config) {
-    const validated = RuntimeConfigSchema.parse(config);
-    const encrypted = transformSecretLeaves(validated, (s) => encryptSecret(s, this.key));
-    mkdirSync2(dirname3(this.filePath), { recursive: true, mode: 448 });
-    writeFileSync2(this.filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
-  }
-};
-
-// ../server/dist/services/restart.js
-function requestRestart(env, exit = (c) => process.exit(c), schedule = (fn, ms) => {
-  setTimeout(fn, ms).unref?.();
-}) {
-  if (env.YAMCHART_DEV_CHILD === "1") {
-    schedule(() => exit(75), 150);
-    return { applying: true, restartRequired: false };
-  }
-  return { applying: false, restartRequired: true };
-}
-
-// ../server/dist/services/connection-refs.js
-function findConnectionRefs(connectionName, input) {
-  const refs = [];
-  const resolves = (explicit) => (explicit ?? input.defaultConnection) === connectionName;
-  for (const c of input.charts) {
-    if (resolves(c.source?.connection))
-      refs.push({ kind: "chart", name: c.name });
-  }
-  for (const m of input.models) {
-    if (resolves(m.metadata.connection))
-      refs.push({ kind: "model", name: m.metadata.name });
-  }
-  return refs;
-}
-
-// ../server/dist/services/cache.js
-import { LRUCache } from "lru-cache";
-var MemoryCache = class {
-  cache;
-  defaultTtlMs;
-  hits = 0;
-  misses = 0;
-  constructor(options) {
-    this.defaultTtlMs = options.defaultTtlMs;
-    this.cache = new LRUCache({
-      max: options.maxSize,
-      ttl: options.defaultTtlMs,
-      ttlAutopurge: true
-    });
-  }
-  async get(key) {
-    const value = this.cache.get(key);
-    if (value) {
-      this.hits++;
-      return value;
-    }
-    this.misses++;
-    return null;
-  }
-  async set(key, value, ttlMs) {
-    this.cache.set(key, value, { ttl: ttlMs ?? this.defaultTtlMs });
-  }
-  async invalidate(key) {
-    this.cache.delete(key);
-  }
-  async invalidatePattern(pattern) {
-    const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    const regex = new RegExp(`^${regexPattern}$`);
-    for (const key of this.cache.keys()) {
-      if (regex.test(key)) {
-        this.cache.delete(key);
-      }
-    }
+  getConnectionSecrets(name) {
+    return this.connectionSecrets.get(name);
   }
-  async clear() {
-    this.cache.clear();
+  /** Knowledge DB URL: runtime override wins, else the named env var. */
+  getKnowledgeDbUrl(envVarName, env) {
+    return this.runtimeKnowledgeUrl ?? env[envVarName];
   }
-  getStats() {
-    return {
-      size: this.cache.size,
-      hits: this.hits,
-      misses: this.misses
-    };
+  /** Effective AI config: Git project.ai with the runtime ai deep-merged over it. */
+  getAiConfig() {
+    const base2 = this.project?.ai;
+    if (!this.runtimeAi)
+      return base2;
+    return deepMerge(base2 ?? {}, this.runtimeAi);
   }
-};
-function parseTtl2(ttl) {
-  const match = ttl.match(/^(\d+)(ms|s|m|h|d)$/);
-  if (!match) {
-    throw new Error(`Invalid TTL format: ${ttl}`);
+  getCharts() {
+    return Array.from(this.charts.values());
   }
-  const value = parseInt(match[1] ?? "0", 10);
-  const unit = match[2];
-  switch (unit) {
-    case "ms":
-      return value;
-    case "s":
-      return value * 1e3;
-    case "m":
-      return value * 60 * 1e3;
-    case "h":
-      return value * 60 * 60 * 1e3;
-    case "d":
-      return value * 24 * 60 * 60 * 1e3;
-    default:
-      throw new Error(`Unknown TTL unit: ${unit}`);
+  getChartByName(name) {
+    return this.charts.get(name);
   }
-}
-
-// ../server/dist/services/query-service.js
-function quoteIdentifier(name, dialect) {
-  if (dialect === "mysql" || dialect === "bigquery")
-    return `\`${name.replace(/`/g, "``")}\``;
-  return `"${name.replace(/"/g, '""')}"`;
-}
-var QueryService = class {
-  compiler;
-  connector;
-  cache;
-  models;
-  refs;
-  dialect;
-  constructor(config) {
-    this.compiler = new QueryCompiler({
-      models: config.models,
-      refs: config.refs
-    });
-    this.connector = config.connector;
-    this.cache = config.cache;
-    this.models = new Map(Object.entries(config.models));
-    this.refs = config.refs;
-    this.dialect = config.dialect ?? "duckdb";
+  getChartFolder(name) {
+    return this.chartFolders.get(name) ?? "";
   }
-  async executeChart(chart, params, userContext) {
-    const compiled = this.compiler.compile(chart, params, userContext);
-    const cached = await this.cache.get(compiled.cacheKey);
-    if (cached) {
-      return {
-        columns: cached.columns,
-        rows: cached.rows,
-        rowCount: cached.rowCount,
-        durationMs: cached.durationMs,
-        cached: true,
-        cacheKey: compiled.cacheKey,
-        compiledSql: compiled.sql
-      };
-    }
-    const result = await this.connector.execute(compiled.sql);
-    const cacheEntry = {
-      columns: result.columns,
-      rows: result.rows,
-      rowCount: result.rowCount,
-      durationMs: result.durationMs,
-      cachedAt: Date.now()
-    };
-    await this.cache.set(compiled.cacheKey, cacheEntry);
-    return {
-      ...result,
-      cached: false,
-      cacheKey: compiled.cacheKey,
-      compiledSql: compiled.sql
-    };
+  getChartFilePath(name) {
+    return this.chartFilePaths.get(name);
   }
-  /**
-   * Execute a table chart with server-side pagination.
-   * Wraps the compiled SQL with LIMIT/OFFSET and runs a parallel COUNT(*) query.
-   * Optionally computes summary aggregations for specified columns.
-   */
-  async executeChartPaginated(chart, params, options, userContext) {
-    const compiled = this.compiler.compile(chart, params, userContext);
-    const baseSql = compiled.sql;
-    const q = quoteIdentifier;
-    const d = this.dialect;
-    let orderBy = "";
-    if (options.sortField) {
-      const cleanField = options.sortField.replace(/[^\w\s]/g, "");
-      if (cleanField.length > 0) {
-        orderBy = `ORDER BY ${q(cleanField, d)} ${options.sortDirection === "desc" ? "DESC" : "ASC"}`;
-      }
-    }
-    const offset = options.page * options.pageSize;
-    const dataSql = `SELECT * FROM (${baseSql}) _t ${orderBy} LIMIT ${options.pageSize} OFFSET ${offset}`;
-    const countCacheKey = `${compiled.cacheKey}:count`;
-    let totalCount;
-    const cachedCount = await this.cache.get(countCacheKey);
-    if (cachedCount) {
-      totalCount = cachedCount.rowCount;
-    } else {
-      const countSql = `SELECT COUNT(*) AS _count FROM (${baseSql}) _t`;
-      const countResult = await this.connector.execute(countSql);
-      totalCount = Number(countResult.rows[0]?._count ?? 0);
-      await this.cache.set(countCacheKey, {
-        columns: [],
-        rows: [],
-        rowCount: totalCount,
-        durationMs: countResult.durationMs,
-        cachedAt: Date.now()
-      });
+  getModels() {
+    return Array.from(this.models.values());
+  }
+  getModelByName(name) {
+    return this.models.get(name);
+  }
+  getDefaultConnection() {
+    const envConnection = process.env.YAMCHART_CONNECTION;
+    if (envConnection) {
+      return this.connections.get(envConnection);
     }
-    let summaryValues;
-    if (options.summaryColumns && options.summaryColumns.length > 0) {
-      const summaryCacheKey = `${compiled.cacheKey}:summary`;
-      const cachedSummary = await this.cache.get(summaryCacheKey);
-      if (cachedSummary && cachedSummary.rows[0]) {
-        summaryValues = cachedSummary.rows[0];
-      } else {
-        const aggExprs = options.summaryColumns.map(({ field, summary }) => {
-          const col = q(field, d);
-          switch (summary) {
-            case "sum":
-              return `SUM(${col}) AS ${q(`_sum_${field}`, d)}`;
-            case "avg":
-              return `AVG(${col}) AS ${q(`_avg_${field}`, d)}`;
-            case "min":
-              return `MIN(${col}) AS ${q(`_min_${field}`, d)}`;
-            case "max":
-              return `MAX(${col}) AS ${q(`_max_${field}`, d)}`;
-            case "count":
-              return `COUNT(${col}) AS ${q(`_count_${field}`, d)}`;
-            default:
-              return null;
-          }
-        }).filter(Boolean);
-        if (aggExprs.length > 0) {
-          const summarySql = `SELECT ${aggExprs.join(", ")} FROM (${baseSql}) _t`;
-          const summaryResult = await this.connector.execute(summarySql);
-          if (summaryResult.rows[0]) {
-            summaryValues = {};
-            for (const { field, summary } of options.summaryColumns) {
-              const key = `_${summary}_${field}`;
-              summaryValues[`${summary}:${field}`] = Number(summaryResult.rows[0][key] ?? 0);
-            }
-            await this.cache.set(summaryCacheKey, {
-              columns: [],
-              rows: [summaryValues],
-              rowCount: 0,
-              durationMs: summaryResult.durationMs,
-              cachedAt: Date.now()
-            });
-          }
-        }
-      }
+    const defaultName = this.project?.defaults?.connection;
+    if (defaultName) {
+      return this.connections.get(defaultName);
     }
-    const result = await this.connector.execute(dataSql);
-    return {
-      ...result,
-      cached: false,
-      cacheKey: compiled.cacheKey,
-      compiledSql: dataSql,
-      totalCount,
-      page: options.page,
-      pageSize: options.pageSize,
-      summaryValues
-    };
+    return this.connections.values().next().value;
   }
-  /**
-   * Execute a chart query for CSV export with a bounded row limit.
-   * Returns full QueryResult — caller streams to HTTP response.
-   */
-  async executeChartForExport(chart, params, maxRows, userContext) {
-    const compiled = this.compiler.compile(chart, params, userContext);
-    const sql = `SELECT * FROM (${compiled.sql}) _t LIMIT ${maxRows}`;
-    const result = await this.connector.execute(sql);
-    return {
-      ...result,
-      cached: false,
-      cacheKey: compiled.cacheKey,
-      compiledSql: sql
-    };
+  getDashboards() {
+    return Array.from(this.dashboards.values());
   }
-  /**
-   * Compile a chart query without executing it.
-   * Returns the compiled SQL and cache key.
-   */
-  compileChart(chart, params, userContext) {
-    return this.compiler.compile(chart, params, userContext);
+  getDashboardByName(name) {
+    return this.dashboards.get(name);
   }
-  invalidateChart(chartName) {
-    this.cache.invalidatePattern(`${chartName}:*`);
+  getDashboardFolder(name) {
+    return this.dashboardFolders.get(name) ?? "";
   }
-  invalidateAll() {
-    this.cache.clear();
+  getDashboardFilePath(name) {
+    return this.dashboardFilePaths.get(name);
   }
-  /**
-   * Update the compiler with new models and refs.
-   * Called when config is reloaded.
-   */
-  updateCompiler(config) {
-    this.compiler = new QueryCompiler({
-      models: config.models,
-      refs: config.refs
-    });
-    this.models = new Map(Object.entries(config.models));
-    this.refs = config.refs;
+  getSchedules() {
+    return Array.from(this.schedules.values());
   }
-  getCacheStats() {
-    return this.cache.getStats();
+  getEvents() {
+    return this.events;
   }
-  async executeRawSql(sql) {
-    return this.connector.execute(sql);
+  getProjectDir() {
+    return this.projectDir;
   }
-  async executeModel(modelName, params, userContext, limit2 = 1e3, filters) {
-    const model = this.models.get(modelName);
-    if (!model) {
-      throw new Error(`Unknown model: ${modelName}`);
-    }
-    const context = createTemplateContext(params, this.refs, userContext);
-    let sql = renderTemplate(model.sql, context);
-    if (filters && Object.keys(filters).length > 0) {
-      const clauses = Object.entries(filters).map(([field, value]) => `${field} = '${value.replace(/'/g, "''")}'`);
-      sql = `SELECT * FROM (${sql}) _detail WHERE ${clauses.join(" AND ")} LIMIT ${limit2}`;
-    } else {
-      sql = `SELECT * FROM (${sql}) _detail LIMIT ${limit2}`;
-    }
-    return this.connector.execute(sql);
+  getValidationError(name) {
+    return this.validationErrors.get(name);
   }
-  async executeParameterOptions(modelName, valueField, labelField) {
-    const model = this.models.get(modelName);
-    if (!model) {
-      throw new Error(`Unknown model: ${modelName}`);
-    }
-    const context = createTemplateContext({}, this.refs);
-    const sql = renderTemplate(model.sql, context);
-    const result = await this.connector.execute(sql);
-    return result.rows.map((row) => ({
-      value: String(row[valueField] ?? ""),
-      label: String(row[labelField] ?? row[valueField] ?? "")
-    }));
+  getValidationErrors() {
+    return this.validationErrors;
+  }
+  getAgentRegistry() {
+    return this.agentRegistry;
   }
 };
 
-// ../server/dist/services/connector-factory.js
-import { join as join4 } from "path";
-function createConnectorFromConfig(connection, options) {
-  const { projectDir } = options;
-  switch (connection.type) {
-    case "duckdb": {
-      const duckdbConfig = connection;
-      const dbPath = duckdbConfig.config.path.startsWith("/") ? duckdbConfig.config.path : join4(projectDir, duckdbConfig.config.path);
-      return new DuckDBConnector({ path: dbPath });
-    }
-    case "postgres": {
-      const pgConnection = connection;
-      const credentials = resolvePostgresAuth(pgConnection, options.secrets);
-      return new PostgresConnector({
-        host: pgConnection.config.host,
-        port: pgConnection.config.port,
-        database: pgConnection.config.database,
-        schema: pgConnection.config.schema,
-        ssl: pgConnection.config.ssl,
-        user: credentials.user,
-        password: credentials.password,
-        min: pgConnection.pool?.min_connections,
-        max: pgConnection.pool?.max_connections,
-        idleTimeoutMillis: pgConnection.pool?.idle_timeout,
-        statementTimeout: pgConnection.query?.timeout
-      });
-    }
-    case "mysql": {
-      const mysqlConnection = connection;
-      const credentials = resolveMySQLAuth(mysqlConnection, options.secrets);
-      return new MySQLConnector({
-        host: mysqlConnection.config.host,
-        port: mysqlConnection.config.port,
-        database: mysqlConnection.config.database,
-        ssl: mysqlConnection.config.ssl,
-        user: credentials.user,
-        password: credentials.password,
-        min: mysqlConnection.pool?.min_connections,
-        max: mysqlConnection.pool?.max_connections,
-        idleTimeoutMillis: mysqlConnection.pool?.idle_timeout,
-        statementTimeout: mysqlConnection.query?.timeout
-      });
-    }
-    case "sqlite": {
-      const sqliteConnection = connection;
-      const dbPath = sqliteConnection.config.path.startsWith("/") ? sqliteConnection.config.path : sqliteConnection.config.path === ":memory:" ? ":memory:" : join4(projectDir, sqliteConnection.config.path);
-      return new SQLiteConnector({ path: dbPath });
-    }
-    case "snowflake": {
-      const sfConnection = connection;
-      const credentials = resolveSnowflakeAuth(sfConnection, options.secrets);
-      return new SnowflakeConnector({
-        account: sfConnection.config.account,
-        username: credentials.username,
-        password: credentials.password,
-        privateKey: credentials.privateKey,
-        authenticator: credentials.authenticator,
-        clientStoreTemporaryCredential: credentials.clientStoreTemporaryCredential,
-        warehouse: sfConnection.config.warehouse,
-        database: sfConnection.config.database,
-        schema: sfConnection.config.schema,
-        role: sfConnection.config.role,
-        statementTimeout: sfConnection.query?.timeout
-      });
-    }
-    case "bigquery": {
-      const bqConnection = connection;
-      const creds = resolveBigQueryAuth(bqConnection, options.secrets);
-      const keyFilename = creds.keyFilename ? creds.keyFilename.startsWith("/") ? creds.keyFilename : join4(projectDir, creds.keyFilename) : void 0;
-      return new BigQueryConnector({
-        projectId: bqConnection.config.project_id,
-        dataset: bqConnection.config.dataset,
-        location: bqConnection.config.location,
-        maxBytesBilled: bqConnection.config.max_bytes_billed,
-        credentials: creds.credentials,
-        keyFilename
-      });
-    }
-    default:
-      throw new Error(`Unsupported connection type: ${connection.type}`);
+// ../server/dist/services/runtime-config-store.js
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname3, join as join4, isAbsolute } from "path";
+
+// ../../packages/crypto/dist/index.js
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+var ALGO = "aes-256-gcm";
+function deriveKeyFromEnv(env) {
+  const b64 = env.YAMCHART_CONFIG_SECRET;
+  if (!b64)
+    return null;
+  const key = Buffer.from(b64, "base64");
+  if (key.length !== 32) {
+    throw new Error("YAMCHART_CONFIG_SECRET must be a base64-encoded 32-byte key");
   }
+  return key;
 }
-function buildConnectionInfo(connection) {
-  const info2 = {
-    name: connection.name,
-    type: connection.type
-  };
-  switch (connection.type) {
-    case "duckdb": {
-      const c = connection;
-      info2.path = c.config.path;
-      break;
-    }
-    case "postgres": {
-      const c = connection;
-      info2.host = c.config.host;
-      info2.port = c.config.port;
-      info2.database = c.config.database;
-      info2.schema = c.config.schema;
-      break;
-    }
-    case "mysql": {
-      const c = connection;
-      info2.host = c.config.host;
-      info2.port = c.config.port;
-      info2.database = c.config.database;
-      break;
-    }
-    case "sqlite": {
-      const c = connection;
-      info2.path = c.config.path;
-      break;
-    }
-    case "snowflake": {
-      const c = connection;
-      info2.account = c.config.account;
-      info2.warehouse = c.config.warehouse;
-      info2.database = c.config.database;
-      info2.schema = c.config.schema;
-      info2.role = c.config.role;
-      break;
+function encryptSecret(plain, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(ALGO, key, iv);
+  const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+}
+function decryptSecret(enc, key) {
+  const parts = enc.split(":");
+  if (parts.length !== 3)
+    throw new Error("malformed ciphertext");
+  const ivB64 = parts[0];
+  const tagB64 = parts[1];
+  const ctB64 = parts[2];
+  const decipher = createDecipheriv(ALGO, key, Buffer.from(ivB64, "base64"));
+  decipher.setAuthTag(Buffer.from(tagB64, "base64"));
+  return Buffer.concat([decipher.update(Buffer.from(ctB64, "base64")), decipher.final()]).toString("utf8");
+}
+function maskSecret(plain) {
+  if (plain.length <= 4)
+    return "\u2022\u2022\u2022\u2022";
+  return "\u2022\u2022\u2022\u2022" + plain.slice(-4);
+}
+
+// ../server/dist/services/secret-crypto.js
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+function getConfigKey(dataDir, env, log) {
+  const fromEnv = deriveKeyFromEnv(env);
+  if (fromEnv)
+    return fromEnv;
+  const keyPath = join3(dataDir, ".config-secret");
+  if (existsSync(keyPath)) {
+    const key2 = Buffer.from(readFileSync(keyPath, "utf8").trim(), "base64");
+    if (key2.length !== 32) {
+      throw new Error(`Key file at ${keyPath} does not contain a 32-byte key (got ${key2.length} bytes). Delete it to regenerate.`);
     }
-    case "bigquery": {
-      const c = connection;
-      info2.database = c.config.project_id;
-      info2.schema = c.config.dataset;
-      break;
+    return key2;
+  }
+  mkdirSync(dirname2(keyPath), { recursive: true });
+  const key = randomBytes2(32);
+  writeFileSync(keyPath, key.toString("base64"), { mode: 384 });
+  log?.(`No YAMCHART_CONFIG_SECRET set \u2014 generated a machine-local key at ${keyPath}. Set YAMCHART_CONFIG_SECRET to keep secrets readable across deploys/volumes.`);
+  return key;
+}
+
+// ../server/dist/services/runtime-config-store.js
+var RuntimeConfigError = class extends Error {
+};
+var SECRET_LEAF_KEYS = /* @__PURE__ */ new Set(["password", "private_key", "credentials_json", "database_url", "api_key"]);
+function transformSecretLeaves(obj, fn) {
+  if (Array.isArray(obj))
+    return obj.map((v) => transformSecretLeaves(v, fn));
+  if (obj && typeof obj === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      out[k] = SECRET_LEAF_KEYS.has(k) && typeof v === "string" ? fn(v) : transformSecretLeaves(v, fn);
     }
+    return out;
   }
-  return info2;
+  return obj;
 }
-async function testConnection(connection, options) {
-  const start = performance.now();
-  let connector = null;
-  try {
-    connector = createConnectorFromConfig(connection, options);
-    await connector.connect();
-    const healthQuery = connection.type === "duckdb" ? "SELECT 1 AS health" : "SELECT 1";
-    await connector.execute(healthQuery);
-    const latencyMs = performance.now() - start;
-    return {
-      name: connection.name,
-      type: connection.type,
-      status: "healthy",
-      latencyMs: Math.round(latencyMs)
-    };
-  } catch (err) {
-    const latencyMs = performance.now() - start;
-    let errorMessage = "Unknown error";
-    if (err instanceof Error) {
-      const pgError = err;
-      errorMessage = err.message || pgError.code || "Connection failed";
-    } else {
-      errorMessage = String(err);
+var RuntimeConfigStore = class {
+  filePath;
+  key;
+  constructor(filePath, key) {
+    this.filePath = filePath;
+    this.key = key;
+  }
+  /** Directory the store (and key file) live in — useful for getConfigKey(). */
+  get dataDir() {
+    return dirname3(this.filePath);
+  }
+  static resolvePath(opts) {
+    if (opts.env.YAMCHART_RUNTIME_CONFIG)
+      return opts.env.YAMCHART_RUNTIME_CONFIG;
+    if (opts.authDbPath && isAbsolute(opts.authDbPath))
+      return join4(dirname3(opts.authDbPath), "runtime-config.json");
+    return join4(opts.projectDir, ".yamchart", "runtime-config.json");
+  }
+  read() {
+    if (!existsSync2(this.filePath))
+      return { version: 1 };
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
+    } catch (err) {
+      throw new RuntimeConfigError(`runtime-config.json is not valid JSON: ${err.message}`);
     }
-    return {
-      name: connection.name,
-      type: connection.type,
-      status: "unhealthy",
-      latencyMs: Math.round(latencyMs),
-      error: errorMessage
-    };
-  } finally {
-    if (connector) {
-      try {
-        await connector.disconnect();
-      } catch {
-      }
+    let decrypted;
+    try {
+      decrypted = transformSecretLeaves(parsed, (s) => decryptSecret(s, this.key));
+    } catch (err) {
+      throw new RuntimeConfigError(`Could not decrypt runtime-config.json (wrong YAMCHART_CONFIG_SECRET?): ${err.message}`);
     }
+    const result = RuntimeConfigSchema.safeParse(decrypted);
+    if (!result.success)
+      throw new RuntimeConfigError(`Invalid runtime-config.json: ${result.error.message}`);
+    return result.data;
+  }
+  write(config) {
+    const validated = RuntimeConfigSchema.parse(config);
+    const encrypted = transformSecretLeaves(validated, (s) => encryptSecret(s, this.key));
+    mkdirSync2(dirname3(this.filePath), { recursive: true, mode: 448 });
+    writeFileSync2(this.filePath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  }
+};
+
+// ../server/dist/services/restart.js
+function requestRestart(env, exit = (c) => process.exit(c), schedule = (fn, ms) => {
+  setTimeout(fn, ms).unref?.();
+}) {
+  if (env.YAMCHART_DEV_CHILD === "1") {
+    schedule(() => exit(75), 150);
+    return { applying: true, restartRequired: false };
+  }
+  return { applying: false, restartRequired: true };
+}
+
+// ../server/dist/services/connection-refs.js
+function findConnectionRefs(connectionName, input) {
+  const refs = [];
+  const resolves = (explicit) => (explicit ?? input.defaultConnection) === connectionName;
+  for (const c of input.charts) {
+    if (resolves(c.source?.connection))
+      refs.push({ kind: "chart", name: c.name });
+  }
+  for (const m of input.models) {
+    if (resolves(m.metadata.connection))
+      refs.push({ kind: "model", name: m.metadata.name });
   }
+  return refs;
 }
 
 // ../server/dist/routes/config.js
@@ -9019,8 +9031,8 @@ async function semanticRoutes(fastify, options) {
       });
     }
     const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync3 } = await import("fs");
-    const { join: join14, dirname: dirname5 } = await import("path");
-    const fullPath = join14(projectDir, filePath);
+    const { join: join15, dirname: dirname5 } = await import("path");
+    const fullPath = join15(projectDir, filePath);
     mkdirSync3(dirname5(fullPath), { recursive: true });
     writeFileSync3(fullPath, sql, "utf-8");
     return { saved: true, path: filePath };
@@ -9133,7 +9145,7 @@ var SlackNotifier = class {
     let response = await fetch(webhookUrl, options);
     if (!response.ok) {
       if (this.retryDelayMs > 0) {
-        await new Promise((resolve3) => setTimeout(resolve3, this.retryDelayMs));
+        await new Promise((resolve4) => setTimeout(resolve4, this.retryDelayMs));
       }
       response = await fetch(webhookUrl, options);
       if (!response.ok) {
@@ -9449,6 +9461,8 @@ function rowToBlindspot(r) {
     confidence: r.confidence ?? void 0,
     status: r.status,
     answer: r.answer ?? void 0,
+    prUrl: r.pr_url ?? void 0,
+    resolvedByKnowledge: r.resolved_by_knowledge ?? false,
     createdAt: new Date(r.created_at).toISOString(),
     updatedAt: new Date(r.updated_at).toISOString()
   };
@@ -9476,6 +9490,7 @@ function rowToHunch(r) {
     rationale: r.rationale ?? void 0,
     confidence: r.confidence ?? void 0,
     lastRunSample: r.last_run_sample ?? void 0,
+    autoConfirmed: r.auto_confirmed ?? false,
     createdAt: new Date(r.created_at).toISOString(),
     updatedAt: new Date(r.updated_at).toISOString()
   };
@@ -9595,6 +9610,14 @@ var PostgresKnowledgeStore = class {
       params.push(patch.answer);
       sets.push(`answer = $${params.length}`);
     }
+    if (patch.resolvedByKnowledge !== void 0) {
+      params.push(patch.resolvedByKnowledge);
+      sets.push(`resolved_by_knowledge = $${params.length}`);
+    }
+    if (patch.prUrl !== void 0) {
+      params.push(patch.prUrl);
+      sets.push(`pr_url = $${params.length}`);
+    }
     params.push((/* @__PURE__ */ new Date()).toISOString());
     sets.push(`updated_at = $${params.length}`);
     params.push(id);
@@ -9701,8 +9724,8 @@ var PostgresKnowledgeStore = class {
       ]);
     }
     for (const b of snapshot.blindspots) {
-      await this.pool.query(`INSERT INTO blindspots (id, connection, kind, title, detail, subject, suggested_model, confidence, status, answer, created_at, updated_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) ON CONFLICT (id) DO NOTHING`, [
+      await this.pool.query(`INSERT INTO blindspots (id, connection, kind, title, detail, subject, suggested_model, confidence, status, answer, resolved_by_knowledge, pr_url, created_at, updated_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT (id) DO NOTHING`, [
         b.id,
         b.connection,
         b.kind,
@@ -9713,6 +9736,8 @@ var PostgresKnowledgeStore = class {
         b.confidence ?? null,
         b.status,
         b.answer ?? null,
+        b.resolvedByKnowledge ?? false,
+        b.prUrl ?? null,
         b.createdAt,
         b.updatedAt
       ]);
@@ -9743,11 +9768,11 @@ function __rest(s, e) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve3) {
-      resolve3(value);
+    return value instanceof P ? value : new P(function(resolve4) {
+      resolve4(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve3, reject) {
+  return new (P || (P = Promise))(function(resolve4, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -9763,7 +9788,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve3(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve4(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -12294,15 +12319,15 @@ var RealtimeChannel = class _RealtimeChannel {
         }
       }
     } else {
-      return new Promise((resolve3) => {
+      return new Promise((resolve4) => {
         var _a2, _b2, _c;
         const push = this._push(args.type, args, opts.timeout || this.timeout);
         if (args.type === "broadcast" && !((_c = (_b2 = (_a2 = this.params) === null || _a2 === void 0 ? void 0 : _a2.config) === null || _b2 === void 0 ? void 0 : _b2.broadcast) === null || _c === void 0 ? void 0 : _c.ack)) {
-          resolve3("ok");
+          resolve4("ok");
         }
-        push.receive("ok", () => resolve3("ok"));
-        push.receive("error", () => resolve3("error"));
-        push.receive("timeout", () => resolve3("timed out"));
+        push.receive("ok", () => resolve4("ok"));
+        push.receive("error", () => resolve4("error"));
+        push.receive("timeout", () => resolve4("timed out"));
       });
     }
   }
@@ -12330,16 +12355,16 @@ var RealtimeChannel = class _RealtimeChannel {
     };
     this.joinPush.destroy();
     let leavePush = null;
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       leavePush = new Push(this, CHANNEL_EVENTS.leave, {}, timeout);
       leavePush.receive("ok", () => {
         onClose();
-        resolve3("ok");
+        resolve4("ok");
       }).receive("timeout", () => {
         onClose();
-        resolve3("timed out");
+        resolve4("timed out");
       }).receive("error", () => {
-        resolve3("error");
+        resolve4("error");
       });
       leavePush.send();
       if (!this._canPush()) {
@@ -12418,8 +12443,8 @@ var RealtimeChannel = class _RealtimeChannel {
   _trigger(type, payload, ref) {
     var _a, _b;
     const typeLower = type.toLocaleLowerCase();
-    const { close, error: error2, leave, join: join14 } = CHANNEL_EVENTS;
-    const events = [close, error2, leave, join14];
+    const { close, error: error2, leave, join: join15 } = CHANNEL_EVENTS;
+    const events = [close, error2, leave, join15];
     if (ref && events.indexOf(typeLower) >= 0 && ref !== this._joinRef()) {
       return;
     }
@@ -14035,7 +14060,7 @@ var _getRequestParams = (method, options, parameters, body) => {
   return _objectSpread2(_objectSpread2({}, params), parameters);
 };
 async function _handleRequest(fetcher, method, url, options, parameters, body, namespace) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     fetcher(url, _getRequestParams(method, options, parameters, body)).then((result) => {
       if (!result.ok) throw result;
       if (options === null || options === void 0 ? void 0 : options.noResolveJson) return result;
@@ -14045,7 +14070,7 @@ async function _handleRequest(fetcher, method, url, options, parameters, body, n
         if (!contentType || !contentType.includes("application/json")) return {};
       }
       return result.json();
-    }).then((data) => resolve3(data)).catch((error2) => handleError(error2, reject, options, namespace));
+    }).then((data) => resolve4(data)).catch((error2) => handleError(error2, reject, options, namespace));
   });
 }
 function createFetchApi(namespace = "storage") {
@@ -22642,7 +22667,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve3) => setTimeout(resolve3));
+            await new Promise((resolve4) => setTimeout(resolve4));
             maxReadCount = 3;
             continue;
           }
@@ -24676,9 +24701,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve3) => {
+        return new Promise((resolve4) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve3,
+            resolveJson: resolve4,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -26995,7 +27020,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+        await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -27012,7 +27037,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -27090,7 +27115,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve3(parseResult.data);
+            resolve4(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -27351,12 +27376,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve3, interval);
+      const timeoutId = setTimeout(resolve4, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -28457,7 +28482,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
+      await new Promise((resolve4) => setTimeout(resolve4, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -29032,13 +29057,20 @@ import { z as z2 } from "zod";
 async function listCharts(deps) {
   const charts = deps.configLoader.getCharts().map((c) => {
     const chart = c;
+    const model = chart.source?.model ? deps.configLoader.getModelByName(chart.source.model) : void 0;
+    const modelParameters = model?.metadata?.params ?? [];
+    const parameterDetails = [
+      ...modelParameters.map((p) => ({ ...p, source: "model" })),
+      ...(chart.parameters ?? []).map((p) => ({ ...p, source: "chart" }))
+    ];
     return {
       name: chart.name,
       title: chart.title,
       ...chart.description ? { description: chart.description } : {},
       type: chart.chart?.type,
       model: chart.source?.model,
-      parameters: (chart.parameters ?? []).map((p) => p.name)
+      parameters: (chart.parameters ?? []).map((p) => p.name),
+      parameter_details: parameterDetails
     };
   });
   return JSON.stringify(charts);
@@ -29083,10 +29115,91 @@ async function runSql(deps, args) {
 async function runModel(deps, args) {
   const chart = deps.configLoader.getChartByName(args.name);
   if (!chart) {
+    const model = deps.configLoader.getModelByName(args.name);
+    if (model) {
+      const chartsForModel = deps.configLoader.getCharts().filter((c) => c.source?.model === args.name).map((c) => c.name);
+      return [
+        `Error: "${args.name}" is a model, but run_model currently executes saved charts by chart name.`,
+        chartsForModel.length ? `Use one of these chart names for that model: ${chartsForModel.join(", ")}.` : "Create a chart for this model or use run_sql to query the model SQL directly."
+      ].join(" ");
+    }
     return `Error: Chart "${args.name}" not found. Use list_charts to see available charts.`;
   }
-  const result = await deps.queryService.executeChart(chart, args.params ?? {}, buildUserContext(deps.user));
-  return JSON.stringify({ columns: result.columns, rows: result.rows });
+  const normalized = normalizeChartParams(deps, chart, args.params ?? {});
+  if (normalized.error)
+    return `Error: ${JSON.stringify(normalized.error)}`;
+  try {
+    const result = await deps.queryService.executeChart(chart, normalized.params, buildUserContext(deps.user));
+    return JSON.stringify({ columns: result.columns, rows: result.rows });
+  } catch (err) {
+    return `Error: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+function normalizeChartParams(deps, chart, input) {
+  const definitions = /* @__PURE__ */ new Map();
+  const modelName = chart.source?.model;
+  const model = modelName ? deps.configLoader.getModelByName(modelName) : void 0;
+  for (const param of model?.metadata?.params ?? []) {
+    definitions.set(param.name, param);
+  }
+  for (const param of chart.parameters ?? []) {
+    definitions.set(param.name, param);
+  }
+  const params = { ...input };
+  for (const [name, value] of Object.entries(input)) {
+    const definition = definitions.get(name);
+    if (!definition)
+      continue;
+    const type = definition.type;
+    if (type === "multi_select" || type === "string[]") {
+      if (isAllValue(value)) {
+        params[name] = [];
+      } else if (!Array.isArray(value)) {
+        params[name] = [String(value)];
+      } else {
+        params[name] = value.map((v) => String(v));
+      }
+      continue;
+    }
+    if (type === "number[]") {
+      const values = Array.isArray(value) ? value : [value];
+      const nums = values.map((v) => Number(v));
+      if (nums.some((v) => !Number.isFinite(v))) {
+        return {
+          params,
+          error: {
+            error_type: "invalid_parameter",
+            parameter: name,
+            expected: "array<number>",
+            received: Array.isArray(value) ? "array" : typeof value
+          }
+        };
+      }
+      params[name] = nums;
+      continue;
+    }
+    if (type === "number" && typeof value === "string") {
+      const num2 = Number(value);
+      if (!Number.isFinite(num2)) {
+        return {
+          params,
+          error: {
+            error_type: "invalid_parameter",
+            parameter: name,
+            expected: "number",
+            received: "string"
+          }
+        };
+      }
+      params[name] = num2;
+    }
+  }
+  return { params };
+}
+function isAllValue(value) {
+  if (typeof value === "string")
+    return value.trim().toLowerCase() === "all";
+  return Array.isArray(value) && value.length === 1 && isAllValue(value[0]);
 }
 
 // ../../packages/mcp-core/dist/catalog.js
@@ -29124,22 +29237,38 @@ function includeFilter(deps) {
 }
 async function listTables(deps) {
   const tables = await readCatalogTables(deps.projectDir, includeFilter(deps));
-  return JSON.stringify(tables.map((t) => ({
-    name: t.name,
-    ...t.schema ? { schema: t.schema } : {},
-    connection: t.connection,
-    columnCount: t.columns.length
-  })));
+  if (tables.length === 0) {
+    const live = await discoverLiveTables(deps);
+    return JSON.stringify({
+      tables: live.tables.map(tableSummary),
+      ...live.warning ? { warning: live.warning } : {}
+    });
+  }
+  return JSON.stringify({ tables: tables.map(tableSummary) });
 }
 async function describeTable(deps, args) {
-  const normalizedTable = args.schema != null && !args.table.includes(".") ? `${args.schema}.${args.table}` : args.table;
-  const parts = normalizedTable.split(".");
+  const identifier = parseTableIdentifier(args.table, args.schema);
+  if (!identifier.valid)
+    return `Error: ${identifier.error}`;
+  const normalizedTable = identifier.normalized;
+  const parts = identifier.parts;
   const tableName = parts[parts.length - 1] ?? normalizedTable;
   const schema = parts.length > 1 ? parts.slice(0, -1).join(".") : void 0;
   const tables = await readCatalogTables(deps.projectDir, includeFilter(deps));
-  const match = tables.find((t) => t.name === tableName && (schema === void 0 || t.schema === schema));
+  const match = tables.find((t) => t.name === tableName && (schema === void 0 || schemaMatches(t.schema, schema)));
   if (!match) {
-    return `Error: Table "${args.table}" not found in catalog. Use list_tables to see available tables.`;
+    try {
+      const result = await deps.queryService.executeRawSql(`SELECT * FROM ${identifier.sql} LIMIT 0`);
+      return JSON.stringify({
+        name: tableName,
+        ...schema ? { schema } : {},
+        columns: result.columns,
+        warning: "Table was not found in the cached catalog; columns were discovered with a live LIMIT 0 query."
+      });
+    } catch (err) {
+      const detail2 = err instanceof Error ? err.message : String(err);
+      return `Error: Table "${args.table}" not found in catalog, and live discovery failed: ${detail2}`;
+    }
   }
   return JSON.stringify({
     name: match.name,
@@ -29147,24 +29276,111 @@ async function describeTable(deps, args) {
     columns: match.columns
   });
 }
-var TABLE_IDENT = /^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)*$/;
 async function sampleTable(deps, args) {
-  if (!TABLE_IDENT.test(args.table)) {
-    return `Error: Invalid table identifier "${args.table}".`;
-  }
+  const identifier = parseTableIdentifier(args.table, args.schema);
+  if (!identifier.valid)
+    return `Error: ${identifier.error}`;
   const limit2 = Math.min(Math.max(args.limit ?? 5, 1), 100);
-  const parts = args.table.split(".");
+  const parts = identifier.parts;
   const tableName = parts[parts.length - 1] ?? args.table;
   const providedSchema = parts.length > 1 ? parts.slice(0, -1).join(".") : void 0;
   const tables = await readCatalogTables(deps.projectDir, includeFilter(deps));
-  const match = tables.find((t) => t.name === tableName && (providedSchema === void 0 || t.schema === providedSchema));
-  const from = providedSchema === void 0 && match?.schema ? `${match.schema}.${args.table}` : args.table;
+  const match = tables.find((t) => t.name === tableName && (providedSchema === void 0 || schemaMatches(t.schema, providedSchema)));
+  const from = providedSchema === void 0 && match?.schema ? sqlIdentifier(`${match.schema}.${args.table}`) : identifier.sql;
   const result = await deps.queryService.executeRawSql(`SELECT * FROM ${from} LIMIT ${limit2}`);
   return JSON.stringify({ columns: result.columns, rows: result.rows });
 }
+function tableSummary(t) {
+  return {
+    name: t.name,
+    ...t.schema ? { schema: t.schema } : {},
+    connection: t.connection,
+    columnCount: t.columns.length
+  };
+}
+function schemaMatches(catalogSchema, requestedSchema) {
+  if (catalogSchema === requestedSchema)
+    return true;
+  return catalogSchema?.endsWith(`.${requestedSchema}`) ?? false;
+}
+function parseTableIdentifier(table, schema) {
+  const normalizedInput = table.trim().replace(/^`(.+)`$/, "$1");
+  const normalized = schema != null && !normalizedInput.includes(".") ? `${schema}.${normalizedInput}` : normalizedInput;
+  const parts = normalized.split(".");
+  if (parts.length === 0 || parts.length > 3 || parts.some((p) => !/^[A-Za-z_][A-Za-z0-9_-]*$/.test(p))) {
+    return {
+      valid: false,
+      error: `Invalid table identifier "${table}". Use table, schema.table, project.schema.table, or a backticked fully qualified name.`
+    };
+  }
+  return { valid: true, normalized, parts, sql: sqlIdentifier(normalized) };
+}
+function sqlIdentifier(identifier) {
+  const needsQuoting = identifier.split(".").some((p) => p.includes("-"));
+  return needsQuoting ? `\`${identifier}\`` : identifier;
+}
+async function discoverLiveTables(deps) {
+  const include = includeFilter(deps);
+  const connectionType = deps.connectionType?.toLowerCase();
+  try {
+    if (connectionType === "bigquery") {
+      const connection2 = deps.configLoader.getDefaultConnection?.();
+      const config = connection2?.type === "bigquery" ? connection2.config : void 0;
+      const projectId = config?.project_id;
+      if (!projectId) {
+        return {
+          tables: [],
+          warning: "Cached catalog is empty. Live BigQuery discovery needs a default BigQuery connection with config.project_id."
+        };
+      }
+      const region = bigQueryRegion(config.location);
+      const schemas = include?.schemas ?? [];
+      const schemaFilter = schemas.length ? ` AND table_schema IN (${schemas.map(sqlStringLiteral).join(", ")})` : "";
+      const result2 = await deps.queryService.executeRawSql(`SELECT table_schema AS schema, table_name AS name FROM \`${region}\`.INFORMATION_SCHEMA.TABLES WHERE table_catalog = ${sqlStringLiteral(projectId)} AND table_type = 'BASE TABLE'${schemaFilter} ORDER BY table_schema, table_name LIMIT 1000`);
+      return {
+        tables: rowsToTables(result2.rows, connection2?.name ?? "default"),
+        warning: "Cached catalog is empty; returned live BigQuery region-level INFORMATION_SCHEMA results."
+      };
+    }
+    const connection = deps.configLoader.getDefaultConnection?.();
+    if (connection?.type === "postgres" && connection.config.schema) {
+      const result2 = await deps.queryService.executeRawSql(`SELECT table_schema AS schema, table_name AS name FROM information_schema.tables WHERE table_type IN ('BASE TABLE', 'VIEW') AND table_schema = ${sqlStringLiteral(connection.config.schema)} LIMIT 1000`);
+      return {
+        tables: rowsToTables(result2.rows, connection.name),
+        warning: "Cached catalog is empty; returned live INFORMATION_SCHEMA results."
+      };
+    }
+    const result = await deps.queryService.executeRawSql("SELECT table_schema AS schema, table_name AS name FROM information_schema.tables WHERE table_type IN ('BASE TABLE', 'VIEW') LIMIT 1000");
+    return {
+      tables: rowsToTables(result.rows, "default"),
+      warning: "Cached catalog is empty; returned live INFORMATION_SCHEMA results."
+    };
+  } catch (err) {
+    const detail2 = err instanceof Error ? err.message : String(err);
+    return {
+      tables: [],
+      warning: `Cached catalog is empty and live INFORMATION_SCHEMA discovery failed: ${detail2}`
+    };
+  }
+}
+function rowsToTables(rows, connection) {
+  return rows.map((r) => ({
+    name: String(r["name"] ?? r["table_name"] ?? ""),
+    schema: String(r["schema"] ?? r["table_schema"] ?? ""),
+    connection,
+    columns: []
+  })).filter((t) => t.name.length > 0);
+}
+function sqlStringLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function bigQueryRegion(location) {
+  const loc = (location ?? "US").trim().toLowerCase().replace(/_/g, "-");
+  return loc.startsWith("region-") ? loc : `region-${loc}`;
+}
 
 // ../../packages/mcp-core/dist/render/optionBuilder.js
-var SUPPORTED = /* @__PURE__ */ new Set(["line", "bar", "area", "pie", "donut", "scatter"]);
+var SUPPORTED = /* @__PURE__ */ new Set(["line", "bar", "area", "pie", "donut", "scatter", "kpi", "table"]);
 function num(v) {
   if (v === null || v === void 0 || v === "")
     return null;
@@ -29184,6 +29400,64 @@ function buildEChartsOption(chart, rows) {
     left: "center"
   };
   const grid = { left: "3%", right: "4%", bottom: "8%", top: 60, containLabel: true };
+  if (type === "kpi") {
+    const valueField = block.value?.field ?? "";
+    const value = rows[0]?.[valueField];
+    return {
+      title,
+      graphic: [
+        {
+          type: "text",
+          left: "center",
+          top: "42%",
+          style: {
+            text: value === null || value === void 0 ? "No data" : String(value),
+            fontSize: 56,
+            fontWeight: 700,
+            fill: "#111827",
+            textAlign: "center"
+          }
+        },
+        {
+          type: "text",
+          left: "center",
+          top: "58%",
+          style: {
+            text: block.value?.label ?? valueField,
+            fontSize: 18,
+            fill: "#6b7280",
+            textAlign: "center"
+          }
+        }
+      ]
+    };
+  }
+  if (type === "table") {
+    const columns = block.columns?.length ? block.columns : Object.keys(rows[0] ?? {}).map((field) => ({ field, label: field }));
+    return {
+      title,
+      tooltip: { trigger: "item" },
+      grid,
+      xAxis: {
+        type: "category",
+        data: columns.map((c) => c.label ?? c.field),
+        axisLabel: { rotate: 30 }
+      },
+      yAxis: { type: "category", data: rows.slice(0, 10).map((_, i) => `Row ${i + 1}`) },
+      series: [
+        {
+          type: "scatter",
+          symbolSize: 1,
+          label: {
+            show: true,
+            formatter: "{@[2]}",
+            color: "#111827"
+          },
+          data: rows.slice(0, 10).flatMap((row, rowIndex) => columns.map((column, colIndex) => [colIndex, rowIndex, row[column.field] ?? ""]))
+        }
+      ]
+    };
+  }
   if (type === "pie" || type === "donut") {
     return {
       title,
@@ -29208,6 +29482,47 @@ function buildEChartsOption(chart, rows) {
     };
   }
   const echartType = type === "bar" ? "bar" : "line";
+  if (block.series?.columns?.length) {
+    return {
+      title,
+      legend: { bottom: 0 },
+      grid,
+      tooltip: { trigger: "axis" },
+      xAxis: { type: "category", data: rows.map((r) => String(r[xField] ?? "")), name: block.x?.label ?? xField },
+      yAxis: { type: "value", name: block.y?.label ?? block.series.columns.map((c) => c.name ?? c.field).join(", ") },
+      series: block.series.columns.map((column) => {
+        const seriesType = column.type === "bar" ? "bar" : "line";
+        return {
+          name: column.name ?? column.field,
+          type: type === "bar" ? "bar" : seriesType,
+          data: rows.map((r) => num(r[column.field])),
+          ...type === "area" || column.type === "area" ? { areaStyle: {} } : {}
+        };
+      })
+    };
+  }
+  if (block.series?.field) {
+    const seriesField = block.series.field;
+    const groups = [...new Set(rows.map((r) => String(r[seriesField] ?? "")))];
+    const xValues = [...new Set(rows.map((r) => String(r[xField] ?? "")))];
+    return {
+      title,
+      legend: { bottom: 0 },
+      grid,
+      tooltip: { trigger: "axis" },
+      xAxis: { type: "category", data: xValues, name: block.x?.label ?? xField },
+      yAxis: { type: "value", name: block.y?.label ?? yField },
+      series: groups.map((group) => ({
+        name: group,
+        type: echartType,
+        data: xValues.map((x) => {
+          const row = rows.find((r) => String(r[xField] ?? "") === x && String(r[seriesField] ?? "") === group);
+          return row ? num(row[yField]) : null;
+        }),
+        ...type === "area" ? { areaStyle: {} } : {}
+      }))
+    };
+  }
   return {
     title,
     grid,
@@ -29420,6 +29735,18 @@ var EXAMPLES = {
       y: { field: "invoiced_revenue", type: "quantitative", format: "$,.0f" }
     }
   },
+  bar_multi_series_long: {
+    name: "jobs_by_month",
+    title: "Jobs by Month",
+    source: { model: "jobs_by_month" },
+    chart: {
+      type: "bar",
+      x: { field: "month", type: "temporal" },
+      y: { field: "job_count", type: "quantitative", label: "Jobs" },
+      series: { field: "job_type" },
+      legend: { show: true, position: "bottom" }
+    }
+  },
   line: {
     name: "revenue_trend",
     title: "Revenue Trend",
@@ -29430,6 +29757,22 @@ var EXAMPLES = {
       y: { field: "invoiced_revenue", type: "quantitative" }
     }
   },
+  line_multi_series_wide: {
+    name: "jobs_completed_vs_scheduled",
+    title: "Completed vs Scheduled Jobs",
+    source: { model: "jobs_by_month" },
+    chart: {
+      type: "line",
+      x: { field: "month", type: "temporal" },
+      series: {
+        columns: [
+          { field: "completed_jobs", name: "Completed" },
+          { field: "scheduled_jobs", name: "Scheduled", style: "dashed" }
+        ]
+      },
+      legend: { show: true, position: "bottom" }
+    }
+  },
   area: {
     name: "revenue_area",
     title: "Revenue Area",
@@ -29486,7 +29829,7 @@ var EXAMPLES = {
 function getChartSchema(args) {
   const type = args.type != null && EXAMPLES[args.type] != null ? args.type : "bar";
   return JSON.stringify({
-    note: "Axes are objects: { field, type: temporal|quantitative|ordinal|nominal }. source is { model } or { sql }.",
+    note: "Axes are objects: { field, type: temporal|quantitative|ordinal|nominal }. source is { model } or { sql }. For long-format multi-series charts use chart.series.field; for wide-format multi-series charts use chart.series.columns. chart.color is a field-name string or conditional color config, not an axis object.",
     available_examples: Object.keys(EXAMPLES),
     example: EXAMPLES[type]
   }, null, 2);
@@ -29776,16 +30119,52 @@ ${d.content}` });
 // ../../packages/mcp-core/dist/tools/answer.js
 async function answerQuestionTool(deps, args) {
   const connection = args.connection ?? deps.defaultConnectionName ?? "default";
-  const result = await answerQuestion({
-    question: args.question,
-    connection,
-    store: deps.knowledgeStore,
-    embedder: deps.embedder,
-    provider: deps.provider,
-    executeRawSql: (sql) => deps.queryService.executeRawSql(sql),
-    connectionType: deps.connectionType
-  });
-  return JSON.stringify(result, null, 2);
+  try {
+    const result = await answerQuestion({
+      question: args.question,
+      connection,
+      store: deps.knowledgeStore,
+      embedder: deps.embedder,
+      provider: deps.provider,
+      executeRawSql: (sql) => deps.queryService.executeRawSql(sql),
+      connectionType: deps.connectionType
+    });
+    return JSON.stringify(result, null, 2);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const lower = message.toLowerCase();
+    const isEmbeddingProvider = lower.includes("embedding") || lower.includes("embeddings") || lower.includes("generativelanguage.googleapis.com") || lower.includes("premature close");
+    return JSON.stringify({
+      error_type: isEmbeddingProvider ? "embedding_provider_unavailable" : "answer_question_failed",
+      retryable: isEmbeddingProvider,
+      fallback_available: true,
+      fallback_attempted: false,
+      ...suggestFallback(deps, args.question),
+      message: isEmbeddingProvider ? "Natural-language retrieval failed, but governed metric, model, chart, and SQL tools are available." : "Natural-language answering failed, but governed metric, model, chart, and SQL tools are available.",
+      detail: message
+    }, null, 2);
+  }
+}
+function suggestFallback(deps, question) {
+  const charts = deps.configLoader?.getCharts?.() ?? [];
+  const models = deps.configLoader?.getModels?.() ?? [];
+  const terms = question.toLowerCase().split(/[^a-z0-9_]+/).filter((t) => t.length >= 3);
+  const score = (text2) => terms.reduce((total, term) => total + (text2.includes(term) ? 1 : 0), 0);
+  const rankedChart = charts.map((chart) => ({
+    chart,
+    score: score(`${chart.name} ${chart.title ?? ""} ${chart.source?.model ?? ""}`.toLowerCase())
+  })).sort((a, b) => b.score - a.score)[0];
+  if (rankedChart && rankedChart.score > 0) {
+    return { suggested_tool: "run_model", suggested_args: { name: rankedChart.chart.name } };
+  }
+  const rankedModel = models.map((model) => ({
+    model,
+    score: score(`${model.metadata.name} ${model.metadata.description ?? ""}`.toLowerCase())
+  })).sort((a, b) => b.score - a.score)[0];
+  if (rankedModel && rankedModel.score > 0) {
+    return { suggested_tool: "run_sql", suggested_args: { sql: rankedModel.model.sql } };
+  }
+  return {};
 }
 
 // ../../packages/mcp-core/dist/render/embedResource.js
@@ -29878,17 +30257,30 @@ var text = (s) => ({
   content: [{ type: "text", text: s }],
   ...s.startsWith("Error:") ? { isError: true } : {}
 });
+var textOut = (s) => ({
+  content: [{ type: "text", text: s }],
+  structuredContent: { result: s },
+  ...s.startsWith("Error:") ? { isError: true } : {}
+});
+var TABULAR_OUTPUT = {
+  rowCount: z2.number(),
+  columns: z2.array(z2.string()),
+  rows: z2.array(z2.record(z2.unknown())),
+  preview: z2.array(z2.record(z2.unknown()))
+};
+var TEXT_OUTPUT = { result: z2.string() };
 var READ_ONLY = { readOnlyHint: true, destructiveHint: false, openWorldHint: false };
 var WRITE_SAFE = { readOnlyHint: false, destructiveHint: false, openWorldHint: false };
 function buildResourceMeta(baseUrl) {
+  const RESOURCE_DOMAINS = ["https://cdn.jsdelivr.net", "https://persistent.oaistatic.com"];
+  const csp = { connectDomains: [baseUrl], resourceDomains: RESOURCE_DOMAINS };
   return {
-    ui: {
-      domain: baseUrl,
-      csp: {
-        connectDomains: [baseUrl],
-        resourceDomains: ["https://persistent.oaistatic.com"]
-      }
-    }
+    // OpenAI Apps SDK (ChatGPT submission) — clears "Widget CSP / domain not set".
+    "openai/widgetCSP": { connect_domains: [baseUrl], resource_domains: RESOURCE_DOMAINS },
+    "openai/widgetDomain": baseUrl,
+    "openai/widgetDescription": "Interactive yamchart chart renderer",
+    // Standard MCP-UI camelCase form (kept for forward-compat).
+    ui: { domain: baseUrl, csp }
   };
 }
 function createMcpServer(deps) {
@@ -29900,11 +30292,21 @@ function createMcpServer(deps) {
     _meta: buildResourceMeta(baseUrl)
   }, async () => {
     const tpl = await buildTemplateResource();
-    return { contents: [{ uri: TEMPLATE_URI, mimeType: tpl.resource.mimeType, text: tpl.resource.text ?? "" }] };
+    return {
+      contents: [
+        {
+          uri: TEMPLATE_URI,
+          mimeType: tpl.resource.mimeType,
+          text: tpl.resource.text ?? "",
+          _meta: buildResourceMeta(baseUrl)
+        }
+      ]
+    };
   });
   server.registerTool("list_charts", {
     description: "List governed yamchart charts (name, title, type, model, parameters).",
     inputSchema: {},
+    outputSchema: { charts: z2.array(z2.unknown()) },
     annotations: READ_ONLY
   }, async () => {
     const raw = await listCharts(deps);
@@ -29917,6 +30319,7 @@ function createMcpServer(deps) {
   server.registerTool("list_models", {
     description: "List governed SQL models (name, description).",
     inputSchema: {},
+    outputSchema: { models: z2.array(z2.unknown()) },
     annotations: READ_ONLY
   }, async () => {
     const raw = await listModels(deps);
@@ -29927,8 +30330,9 @@ function createMcpServer(deps) {
     };
   });
   server.registerTool("run_model", {
-    description: "Run a governed chart/model by name with parameters and return its data.",
+    description: "Execute a saved governed chart by its chart name (from list_charts) with parameters and return its data. Note: this runs CHARTS, not models \u2014 passing a model name returns an actionable error listing the chart names defined for that model.",
     inputSchema: { name: z2.string(), params: z2.record(z2.unknown()).optional() },
+    outputSchema: TABULAR_OUTPUT,
     annotations: READ_ONLY
   }, async (args) => {
     const raw = await runModel(deps, args);
@@ -29940,6 +30344,7 @@ function createMcpServer(deps) {
       structuredContent: {
         rowCount: parsed.rows.length,
         columns: parsed.columns.map((c) => c.name),
+        rows: parsed.rows,
         preview: parsed.rows.slice(0, 5)
       }
     };
@@ -29947,6 +30352,7 @@ function createMcpServer(deps) {
   server.registerTool("run_sql", {
     description: "Run a read-only ad-hoc SQL query (destructive statements blocked, row-capped).",
     inputSchema: { sql: z2.string(), limit: z2.number().optional() },
+    outputSchema: TABULAR_OUTPUT,
     annotations: READ_ONLY
   }, async (args) => {
     const raw = await runSql(deps, args);
@@ -29958,6 +30364,7 @@ function createMcpServer(deps) {
       structuredContent: {
         rowCount: parsed.rows.length,
         columns: parsed.columns.map((c) => c.name),
+        rows: parsed.rows,
         preview: parsed.rows.slice(0, 5)
       }
     };
@@ -29965,23 +30372,26 @@ function createMcpServer(deps) {
   server.registerTool("list_tables", {
     description: "List warehouse tables from the cached catalog (name, schema, connection, column count).",
     inputSchema: {},
+    outputSchema: { tables: z2.array(z2.unknown()), warning: z2.string().optional() },
     annotations: READ_ONLY
   }, async () => {
     const raw = await listTables(deps);
-    const tables = JSON.parse(raw);
+    const parsed = JSON.parse(raw);
     return {
       content: [{ type: "text", text: raw }],
-      structuredContent: { tables }
+      structuredContent: parsed
     };
   });
   server.registerTool("describe_table", {
     description: 'Show columns and types for a catalog table. Accepts { table } (with optional dot-notation schema: "schema.table") or { table, schema } separately.',
     inputSchema: { table: z2.string(), schema: z2.string().optional() },
+    outputSchema: TEXT_OUTPUT,
     annotations: READ_ONLY
-  }, async (args) => text(await describeTable(deps, args)));
+  }, async (args) => textOut(await describeTable(deps, args)));
   server.registerTool("sample_table", {
     description: "Return a few sample rows from a table.",
-    inputSchema: { table: z2.string(), limit: z2.number().optional() },
+    inputSchema: { table: z2.string(), schema: z2.string().optional(), limit: z2.number().optional() },
+    outputSchema: TABULAR_OUTPUT,
     annotations: READ_ONLY
   }, async (args) => {
     const raw = await sampleTable(deps, args);
@@ -29993,6 +30403,7 @@ function createMcpServer(deps) {
       structuredContent: {
         rowCount: parsed.rows.length,
         columns: parsed.columns.map((c) => c.name),
+        rows: parsed.rows,
         preview: parsed.rows.slice(0, 5)
       }
     };
@@ -30000,6 +30411,7 @@ function createMcpServer(deps) {
   server.registerTool("visualize", {
     description: "Render a yamchart chart spec + data rows to an interactive chart (with a static image fallback). Provide a full chart spec (name, title, source.model, chart) and the data array.",
     inputSchema: { spec: z2.record(z2.unknown()), data: z2.array(z2.record(z2.unknown())) },
+    outputSchema: { spec: z2.record(z2.unknown()), option: z2.record(z2.unknown()) },
     annotations: READ_ONLY,
     _meta: {
       ui: { resourceUri: TEMPLATE_URI },
@@ -30020,16 +30432,47 @@ function createMcpServer(deps) {
       structuredContent: { spec: result.spec, option: result.option }
     };
   });
+  server.registerTool("get_permissions", {
+    description: "Return the current MCP user role and permissions, including whether save_chart is allowed.",
+    inputSchema: {},
+    outputSchema: {
+      role: z2.string(),
+      permissions: z2.record(z2.boolean()),
+      required_role: z2.object({ save_chart: z2.string() })
+    },
+    annotations: READ_ONLY
+  }, async () => {
+    const role = deps.user?.role ?? "anonymous";
+    const permissions = {
+      can_view_charts: true,
+      can_run_sql: true,
+      can_validate_charts: true,
+      can_visualize: true,
+      can_save_charts: canWrite(deps.user)
+    };
+    const result = {
+      role,
+      permissions,
+      required_role: { save_chart: "editor_or_admin" }
+    };
+    const raw = JSON.stringify(result);
+    return {
+      content: [{ type: "text", text: raw }],
+      structuredContent: result
+    };
+  });
   server.registerTool("save_chart", {
     description: "Save a yamchart chart spec to charts/<name>.yaml (requires editor/admin).",
     inputSchema: { spec: z2.record(z2.unknown()) },
+    outputSchema: TEXT_OUTPUT,
     annotations: WRITE_SAFE
-  }, async (args) => text(await saveChart(deps, args)));
+  }, async (args) => textOut(await saveChart(deps, args)));
   if (deps.semanticLayer) {
     const semanticLayer = deps.semanticLayer;
     server.registerTool("list_metrics", {
       description: "List governed business metrics (the semantic glossary): name, synonyms, the entity they belong to, and which dimensions you can slice them by. Prefer querying these by name over writing raw SQL.",
       inputSchema: {},
+      outputSchema: { metrics: z2.array(z2.unknown()) },
       annotations: READ_ONLY
     }, async () => {
       const raw = listMetrics({ semanticLayer });
@@ -30042,8 +30485,9 @@ function createMcpServer(deps) {
     server.registerTool("get_metric", {
       description: "Get the full governed definition of a metric (by name or synonym): how it is computed (aggregation, field/sql, governed filter), its source table, format, and the dimensions/time dimension you can group it by.",
       inputSchema: { name: z2.string() },
+      outputSchema: TEXT_OUTPUT,
       annotations: READ_ONLY
-    }, async (args) => text(getMetric({ semanticLayer }, args)));
+    }, async (args) => textOut(getMetric({ semanticLayer }, args)));
     server.registerTool("query_metric", {
       description: "Query governed metrics by name (or synonym), optionally sliced by dimensions and a time grain, and filtered by a time range. Returns the data rows, the generated SQL (for transparency), and a ready-to-use suggested_chart spec. Prefer this over run_sql for business questions about governed metrics \u2014 it guarantees correct, governed definitions.",
       inputSchema: {
@@ -30058,12 +30502,20 @@ function createMcpServer(deps) {
         order_by: z2.object({ field: z2.string(), direction: z2.enum(["asc", "desc"]).optional() }).optional(),
         limit: z2.number().int().positive().max(1e4).optional()
       },
+      outputSchema: {
+        rowCount: z2.number(),
+        columns: z2.array(z2.string()),
+        rows: z2.array(z2.record(z2.unknown())),
+        preview: z2.array(z2.record(z2.unknown())),
+        sql: z2.string(),
+        suggested_chart: z2.unknown()
+      },
       annotations: READ_ONLY
     }, async (args) => {
       try {
         const raw = await queryMetric({ semanticLayer, queryService: deps.queryService, connectionType: deps.connectionType }, args);
         if (raw.startsWith("Error:") || raw.startsWith("{") && JSON.parse(raw).error) {
-          return text(raw);
+          return { content: [{ type: "text", text: raw }], isError: true };
         }
         const parsed = JSON.parse(raw);
         return {
@@ -30071,6 +30523,7 @@ function createMcpServer(deps) {
           structuredContent: {
             rowCount: parsed.rows.length,
             columns: parsed.columns.map((c) => c.name),
+            rows: parsed.rows,
             preview: parsed.rows.slice(0, 5),
             sql: parsed.sql,
             suggested_chart: parsed.suggested_chart
@@ -30088,12 +30541,21 @@ function createMcpServer(deps) {
     server.registerTool("answer_question", {
       description: 'Answer a business question using governed knowledge: retrieves confirmed Hunches + business context for the source and either reuses a matching SQL or generates SQL grounded in trusted examples. Prefer this for "how many / how much / which" questions.',
       inputSchema: { question: z2.string(), connection: z2.string().optional() },
+      outputSchema: {
+        rowCount: z2.number(),
+        columns: z2.array(z2.string()),
+        rows: z2.array(z2.record(z2.unknown())),
+        preview: z2.array(z2.record(z2.unknown())),
+        sql: z2.unknown().optional(),
+        answer: z2.unknown().optional()
+      },
       annotations: READ_ONLY
     }, async (args) => {
       const raw = await answerQuestionTool({
         knowledgeStore,
         embedder,
         provider: answerProvider,
+        configLoader: deps.configLoader,
         queryService: deps.queryService,
         connectionType: deps.connectionType,
         defaultConnectionName: deps.aiConnectionName
@@ -30101,6 +30563,9 @@ function createMcpServer(deps) {
       if (raw.startsWith("Error:"))
         return { content: [{ type: "text", text: raw }], isError: true };
       const parsed = JSON.parse(raw);
+      if (parsed["error_type"]) {
+        return { content: [{ type: "text", text: raw }], isError: true };
+      }
       const rows = parsed.rows ?? [];
       const columns = parsed.columns ?? [];
       return {
@@ -30108,6 +30573,7 @@ function createMcpServer(deps) {
         structuredContent: {
           rowCount: rows.length,
           columns: columns.map((c) => c.name),
+          rows,
           preview: rows.slice(0, 5),
           sql: parsed.sql,
           answer: parsed.answer
@@ -30118,18 +30584,21 @@ function createMcpServer(deps) {
   server.registerTool("get_chart_schema", {
     description: "Get the exact yamchart chart spec shape and a working example for a chart type (bar, line, area, kpi, pie, scatter, table). Call this before building a chart. Axes are objects: { field, type: temporal|quantitative|ordinal|nominal }.",
     inputSchema: { type: z2.string().optional() },
+    outputSchema: TEXT_OUTPUT,
     annotations: READ_ONLY
-  }, async (args) => text(getChartSchema(args)));
+  }, async (args) => textOut(getChartSchema(args)));
   server.registerTool("validate_chart", {
     description: "Validate a yamchart chart spec without saving it. Returns { valid: true } or field-level errors with hints so you can self-correct before calling save_chart or visualize.",
     inputSchema: { spec: z2.record(z2.unknown()) },
+    outputSchema: TEXT_OUTPUT,
     annotations: READ_ONLY
-  }, async (args) => text(validateChart(args)));
+  }, async (args) => textOut(validateChart(args)));
   server.registerTool("get_chart_spec", {
     description: "Get the full saved spec of an existing governed chart by name (so you can copy or adapt it). Call list_charts to discover names.",
     inputSchema: { name: z2.string() },
+    outputSchema: TEXT_OUTPUT,
     annotations: READ_ONLY
-  }, async (args) => text(getChartSpec({ configLoader: deps.configLoader }, args)));
+  }, async (args) => textOut(getChartSpec({ configLoader: deps.configLoader }, args)));
   return server;
 }
 
@@ -30227,6 +30696,22 @@ async function catalogRoutes(fastify, options) {
   });
 }
 
+// ../server/dist/services/dbt-path.js
+import { readFile as readFile6 } from "fs/promises";
+import { join as join13, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { parse as parseYaml3 } from "yaml";
+async function resolveDbtProjectPath(projectDir) {
+  try {
+    const raw = await readFile6(join13(projectDir, ".yamchart", "dbt-source.yaml"), "utf-8");
+    const parsed = parseYaml3(raw);
+    if (!parsed?.path)
+      return null;
+    return isAbsolute2(parsed.path) ? parsed.path : resolve2(projectDir, parsed.path);
+  } catch {
+    return null;
+  }
+}
+
 // ../server/dist/routes/learning.js
 var ReadOnlySqlError = class extends Error {
   constructor() {
@@ -30265,6 +30750,51 @@ async function answerBlindspot(deps, id, body) {
 async function dismissBlindspot(deps, id) {
   return deps.store.updateBlindspot(id, { status: "dismissed" });
 }
+async function acceptBlindspot(deps, id) {
+  const bs = await deps.store.getBlindspot(id);
+  if (!bs || bs.kind !== "opportunity" || !bs.suggestedModel) {
+    return { status: 400, body: { error: "Not an opportunity blindspot with a suggested model." } };
+  }
+  if (!/^[a-zA-Z0-9_]+$/.test(bs.suggestedModel.name)) {
+    return {
+      status: 400,
+      body: { error: "Invalid suggested model name \u2014 dbt model names may contain only letters, digits, and underscores." }
+    };
+  }
+  const dbtPath = await resolveDbtProjectPath(deps.projectDir);
+  if (!dbtPath) {
+    return {
+      status: 400,
+      body: { error: 'No connected dbt project. Run "yamchart sync-dbt" to link one.' }
+    };
+  }
+  try {
+    const sm = bs.suggestedModel;
+    const conventions = await detectConventions(dbtPath);
+    const modelPath = buildModelPath(sm.name, void 0, conventions);
+    const layer = modelPath.split("/")[1] ?? "marts";
+    const materialization = conventions.commonMaterializations[layer] ?? "view";
+    const sql = formatModelSql({
+      materialization,
+      sql: scaffoldModelSql(sm),
+      description: sm.description
+    });
+    await writeDbtModel(dbtPath, modelPath, sql);
+    const schemaPath = modelPath.replace(/[^/]+\.sql$/, "schema.yml");
+    await updateSchemaYml(dbtPath, schemaPath, {
+      name: sm.name,
+      description: sm.description,
+      columns: sm.columns
+    });
+    const blindspot = await deps.store.updateBlindspot(id, {
+      status: "answered",
+      answer: `Scaffolded dbt model: ${modelPath}`
+    });
+    return { status: 200, body: { modelPath, schemaPath, blindspot } };
+  } catch (e) {
+    return { status: 500, body: { error: e.message } };
+  }
+}
 async function loadContextBlock(opts, store, connection) {
   const fileDocs = loadKnowledgeDocs(opts.projectDir);
   const dbDocs = (await store.listKnowledgeDocs({ connection })).map((d) => `${d.title}
@@ -30460,6 +30990,16 @@ async function learningRoutes(fastify, opts) {
     }
     return dismissBlindspot({ store }, request.params.id);
   });
+  fastify.post("/api/blindspots/:id/accept", async (request, reply) => {
+    if (!requireStore(reply))
+      return;
+    if (!opts.canWrite(request)) {
+      reply.code(403).send({ error: "Requires editor or admin role." });
+      return;
+    }
+    const result = await acceptBlindspot({ store, projectDir: opts.projectDir }, request.params.id);
+    reply.code(result.status).send(result.body);
+  });
   fastify.get("/api/coverage", async (request, reply) => {
     if (!requireStore(reply))
       return;
@@ -31355,18 +31895,18 @@ data: ${data}
 }
 
 // ../server/dist/server.js
-import { join as join13, dirname as dirname4 } from "path";
+import { join as join14, dirname as dirname4 } from "path";
 import { fileURLToPath } from "url";
-import { access as access2, readFile as readFile6 } from "fs/promises";
+import { access as access2, readFile as readFile7 } from "fs/promises";
 import { watch as fsWatch } from "fs";
 var __dirname = dirname4(fileURLToPath(import.meta.url));
-var packageJsonPath = join13(__dirname, "..", "package.json");
-var packageJson = JSON.parse(await readFile6(packageJsonPath, "utf-8"));
+var packageJsonPath = join14(__dirname, "..", "package.json");
+var packageJson = JSON.parse(await readFile7(packageJsonPath, "utf-8"));
 var VERSION = packageJson.version;
 async function enrichRefsFromCatalog(projectDir, refs) {
   try {
-    const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
-    const catalogData = JSON.parse(await readFile6(catalogPath, "utf-8"));
+    const catalogPath = join14(projectDir, ".yamchart", "catalog.json");
+    const catalogData = JSON.parse(await readFile7(catalogPath, "utf-8"));
     for (const model of catalogData.models ?? []) {
       if (model.name && model.table) {
         refs[model.name] = model.table;
@@ -31376,7 +31916,7 @@ async function enrichRefsFromCatalog(projectDir, refs) {
   }
 }
 async function createServer(options) {
-  const { projectDir, port = 3001, host = "0.0.0.0", watch: watch2 = false, serveStatic = process.env.NODE_ENV === "production", staticDir = join13(__dirname, "public"), auth } = options;
+  const { projectDir, port = 3001, host = "0.0.0.0", watch: watch2 = false, serveStatic = process.env.NODE_ENV === "production", staticDir = join14(__dirname, "public"), auth } = options;
   if (auth) {
     initAuthServer(auth.supabaseUrl, auth.supabaseServiceKey);
   }
@@ -31639,9 +32179,9 @@ async function createServer(options) {
     dialect: defaultConnection?.type ?? "duckdb",
     metricNames: semanticLayer?.listMetrics().map((m) => m.name) ?? [],
     getConnectionTables: async (connection) => {
-      const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
+      const catalogPath = join14(projectDir, ".yamchart", "catalog.json");
       try {
-        const catalogData = JSON.parse(await readFile6(catalogPath, "utf-8"));
+        const catalogData = JSON.parse(await readFile7(catalogPath, "utf-8"));
         return (catalogData.models ?? []).filter((m) => !m.connection || m.connection === connection).map((m) => ({
           table: m.table ?? m.name ?? "",
           columns: (m.columns ?? []).map((c) => ({ name: c.name, type: c.data_type ?? "string" }))
@@ -31756,7 +32296,7 @@ async function createServer(options) {
     await fastify.register(adminConfigRoutes, adminConfigOptions);
     await registerReconnect(fastify);
   }
-  const assetsDir = join13(projectDir, "assets");
+  const assetsDir = join14(projectDir, "assets");
   try {
     await access2(assetsDir);
     await fastify.register(fastifyStatic, {
@@ -31767,10 +32307,10 @@ async function createServer(options) {
   } catch {
   }
   if (project.theme?.customCss) {
-    const cssPath = join13(projectDir, project.theme.customCss);
+    const cssPath = join14(projectDir, project.theme.customCss);
     fastify.get("/api/theme/custom.css", async (_request2, reply) => {
       try {
-        const content = await readFile6(cssPath, "utf-8");
+        const content = await readFile7(cssPath, "utf-8");
         return reply.type("text/css").send(content);
       } catch {
         return reply.status(404).send("");
@@ -31827,7 +32367,7 @@ async function createServer(options) {
       fastify.log.info(`Semantic model rebuilt: ${semanticService.getModel()?.entities.length ?? 0} entities`);
       broadcastConfigChange();
     });
-    const catalogPath = join13(projectDir, ".yamchart", "catalog.json");
+    const catalogPath = join14(projectDir, ".yamchart", "catalog.json");
     try {
       catalogWatcher = fsWatch(catalogPath, () => {
         semanticService.buildFromDisk();
@@ -31893,13 +32433,13 @@ async function runDevServer(projectDir, options) {
   try {
     const { readFileSync: readFileSync5 } = await import("fs");
     const { parse: parse2 } = await import("yaml");
-    const { resolveProjectConfig: resolveProjectConfig2, deepMerge: deepMerge3 } = await import("./dist-WMP7BFKP.js");
-    const raw = readFileSync5(resolve2(projectDir, "yamchart.yaml"), "utf-8");
+    const { resolveProjectConfig: resolveProjectConfig2, deepMerge: deepMerge3 } = await import("./dist-F6TVLP6C.js");
+    const raw = readFileSync5(resolve3(projectDir, "yamchart.yaml"), "utf-8");
     const rawConfig = parse2(raw);
     const resolvedEnv = options.env || process.env.YAMCHART_ENV || void 0;
     let projectConfig = resolveProjectConfig2(rawConfig, resolvedEnv);
     try {
-      const localRaw = readFileSync5(resolve2(projectDir, "yamchart.local.yaml"), "utf-8");
+      const localRaw = readFileSync5(resolve3(projectDir, "yamchart.local.yaml"), "utf-8");
       const localOverrides = parse2(localRaw);
       if (localOverrides && typeof localOverrides === "object") {
         projectConfig = deepMerge3(projectConfig, localOverrides);
@@ -31909,15 +32449,15 @@ async function runDevServer(projectDir, options) {
     if (projectConfig?.auth?.enabled) {
       localAuth = {
         enabled: true,
-        dbPath: projectConfig.auth.db_path ? resolve2(projectConfig.auth.db_path.replace(/^~/, homedir())) : resolve2(homedir(), ".yamchart", "auth.db"),
+        dbPath: projectConfig.auth.db_path ? resolve3(projectConfig.auth.db_path.replace(/^~/, homedir())) : resolve3(homedir(), ".yamchart", "auth.db"),
         sessionTtlMs: projectConfig.auth.session_ttl ? parseTtl(projectConfig.auth.session_ttl) : 30 * 24 * 60 * 60 * 1e3
       };
     }
-    const connectionDir = resolve2(projectDir, "connections");
+    const connectionDir = resolve3(projectDir, "connections");
     const targetConn = process.env.YAMCHART_CONNECTION || projectConfig?.defaults?.connection;
     if (targetConn) {
       try {
-        const connRaw = readFileSync5(resolve2(connectionDir, `${targetConn}.yaml`), "utf-8");
+        const connRaw = readFileSync5(resolve3(connectionDir, `${targetConn}.yaml`), "utf-8");
         const connConfig = parse2(connRaw);
         if (connConfig?.auth?.type === "externalbrowser") {
           usesBrowserAuth = true;
@@ -31997,4 +32537,4 @@ async function runDevServer(projectDir, options) {
 export {
   runDevServer
 };
-//# sourceMappingURL=dev-KOWFGDOP.js.map
+//# sourceMappingURL=dev-PHFYLJPJ.js.map