@contextflo/postgres-mcp 0.1.0

package/dist/db/introspection.js

@@ -0,0 +1,178 @@
+/**
+ * Schema introspection straight off the live catalog.
+ *
+ * Everything here filters on `has_table_privilege`, so the picture the model gets is
+ * scoped to what the connecting role can actually read. On the read-only role the README
+ * recommends, that is a useful property rather than an accident.
+ *
+ * These are deliberately thin. The catalog is queryable SQL through the `query` tool, so
+ * anything more specific than "list" and "describe" belongs there rather than in a tool
+ * signature the model has to learn.
+ */
+/** Ordinary tables, views, materialized views, partitioned and foreign tables. */
+const RELATION_KINDS = "('r', 'v', 'm', 'p', 'f')";
+const VISIBLE_SCHEMAS = `
+  n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_toast%'
+  AND n.nspname NOT LIKE 'pg_temp%'
+`;
+/**
+ * Lists tables, optionally narrowed by a case-insensitive substring.
+ *
+ * The pattern matches anywhere in the table name, the qualified name, or the table's
+ * comment — the comment included because a table named `fct_orders` may be the one
+ * someone means by "revenue", and a name-only match would report nothing and send the
+ * model away empty-handed.
+ */
+export async function listTables(database, options) {
+    const pattern = options.pattern ?? null;
+    const schema = options.schema ?? null;
+    const rows = await database.internalQuery(`
+    SELECT n.nspname AS schema,
+           c.relname AS name,
+           CASE c.relkind
+             WHEN 'r' THEN 'table'
+             WHEN 'p' THEN 'partitioned table'
+             WHEN 'v' THEN 'view'
+             WHEN 'm' THEN 'materialized view'
+             WHEN 'f' THEN 'foreign table'
+           END AS kind,
+           obj_description(c.oid, 'pg_class') AS description,
+           count(*) OVER () AS total_matches
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relkind IN ${RELATION_KINDS}
+       AND ${VISIBLE_SCHEMAS}
+       AND has_table_privilege(c.oid, 'SELECT')
+       -- A table partitioned by day has hundreds of children; the parent is the one to query.
+       AND NOT c.relispartition
+       AND ($2::text IS NULL OR n.nspname = $2)
+       AND (
+         $1::text IS NULL
+         OR c.relname ILIKE '%' || $4::text || '%'
+         OR (n.nspname || '.' || c.relname) ILIKE '%' || $4::text || '%'
+         OR obj_description(c.oid, 'pg_class') ILIKE '%' || $4::text || '%'
+       )
+     ORDER BY
+       CASE
+         WHEN $1::text IS NULL THEN 0
+         WHEN lower(n.nspname || '.' || c.relname) = lower($1) THEN 0
+         WHEN lower(c.relname) = lower($1) THEN 1
+         WHEN c.relname ILIKE $4::text || '%' THEN 2
+         WHEN c.relname ILIKE '%' || $4::text || '%' THEN 3
+         ELSE 4
+       END,
+       n.nspname,
+       c.relname
+     LIMIT $3
+    `, [pattern, schema, options.limit, pattern === null ? null : escapeLike(pattern)]);
+    return {
+        tables: rows.map((row) => ({
+            schema: row.schema,
+            name: row.name,
+            fullyQualifiedName: `${row.schema}.${row.name}`,
+            kind: row.kind,
+            description: row.description,
+        })),
+        totalMatches: rows.length > 0 ? Number(rows[0].total_matches) : 0,
+    };
+}
+/** `order_items` should match that name, not every table with "order" + any char + "items". */
+function escapeLike(pattern) {
+    return pattern.replace(/[\\%_]/g, (character) => `\\${character}`);
+}
+/**
+ * Describes several tables in one round trip — the model usually has two or three
+ * candidates after a search and should not need a call each to choose between them.
+ *
+ * Names are matched case-insensitively, and an unqualified name resolves against any
+ * visible schema, because a model that read `orders` in a list will ask for `orders`.
+ */
+export async function getTableContext(database, fullyQualifiedNames) {
+    if (fullyQualifiedNames.length === 0)
+        return [];
+    const wanted = fullyQualifiedNames.map((name) => name.toLowerCase());
+    const rows = await database.internalQuery(`
+    SELECT n.nspname AS schema,
+           c.relname AS table,
+           CASE c.relkind
+             WHEN 'r' THEN 'table'
+             WHEN 'p' THEN 'partitioned table'
+             WHEN 'v' THEN 'view'
+             WHEN 'm' THEN 'materialized view'
+             WHEN 'f' THEN 'foreign table'
+           END AS kind,
+           obj_description(c.oid, 'pg_class') AS table_description,
+           NULLIF(c.reltuples, -1) AS approximate_rows,
+           a.attname AS column_name,
+           format_type(a.atttypid, a.atttypmod) AS data_type,
+           NOT a.attnotnull AS is_nullable,
+           pg_get_expr(d.adbin, d.adrelid) AS default_value,
+           col_description(c.oid, a.attnum) AS column_description,
+           EXISTS (
+             SELECT 1 FROM pg_index i
+              WHERE i.indrelid = c.oid AND i.indisprimary AND a.attnum = ANY (i.indkey)
+           ) AS is_primary_key,
+           (
+             SELECT tn.nspname || '.' || tc.relname || '.' || ta.attname
+               FROM pg_constraint con
+               JOIN pg_class tc ON tc.oid = con.confrelid
+               JOIN pg_namespace tn ON tn.oid = tc.relnamespace
+               JOIN pg_attribute ta
+                 ON ta.attrelid = con.confrelid
+                AND ta.attnum = con.confkey[array_position(con.conkey, a.attnum)]
+              WHERE con.conrelid = c.oid
+                AND con.contype = 'f'
+                AND a.attnum = ANY (con.conkey)
+              LIMIT 1
+           ) AS references,
+           (
+             SELECT array_agg(e.enumlabel::text ORDER BY e.enumsortorder)
+               FROM pg_enum e
+              WHERE e.enumtypid = a.atttypid
+           ) AS enum_values,
+           a.attnum AS ordinal
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      LEFT JOIN pg_attribute a
+        ON a.attrelid = c.oid AND a.attnum > 0 AND NOT a.attisdropped
+      LEFT JOIN pg_attrdef d ON d.adrelid = c.oid AND d.adnum = a.attnum
+     WHERE c.relkind IN ${RELATION_KINDS}
+       AND ${VISIBLE_SCHEMAS}
+       AND has_table_privilege(c.oid, 'SELECT')
+       AND (
+         lower(n.nspname || '.' || c.relname) = ANY ($1::text[])
+         OR lower(c.relname) = ANY ($1::text[])
+       )
+     ORDER BY n.nspname, c.relname, a.attnum
+    `, [wanted]);
+    const byTable = new Map();
+    for (const row of rows) {
+        const fullyQualifiedName = `${row.schema}.${row.table}`;
+        let table = byTable.get(fullyQualifiedName);
+        if (!table) {
+            table = {
+                fullyQualifiedName,
+                kind: row.kind,
+                description: row.table_description,
+                approximateRows: row.approximate_rows === null ? null : Math.max(0, Math.round(Number(row.approximate_rows))),
+                columns: [],
+            };
+            byTable.set(fullyQualifiedName, table);
+        }
+        if (row.column_name !== null) {
+            table.columns.push({
+                name: row.column_name,
+                dataType: row.data_type ?? 'unknown',
+                isNullable: row.is_nullable ?? true,
+                defaultValue: row.default_value,
+                description: row.column_description,
+                isPrimaryKey: row.is_primary_key ?? false,
+                references: row.references,
+                enumValues: row.enum_values,
+            });
+        }
+    }
+    return [...byTable.values()];
+}
+//# sourceMappingURL=introspection.js.map

package/dist/db/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../../src/db/introspection.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,MAAM,cAAc,GAAG,2BAA2B,CAAA;AAElD,MAAM,eAAe,GAAG;;;;CAIvB,CAAA;AAuCD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAkB,EAClB,OAAqF;IAErF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;IAErC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,aAAa,CAOvC;;;;;;;;;;;;;;0BAcsB,cAAc;aAC3B,eAAe;;;;;;;;;;;;;;;;;;;;;;;KAuBvB,EACD,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAChF,CAAA;IAED,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,kBAAkB,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE;YAC/C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC;QACH,YAAY,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;KACnE,CAAA;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,mBAA6B;IAE7B,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAEpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,aAAa,CAgBvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA6CsB,cAAc;aAC3B,eAAe;;;;;;;KAOvB,EACD,CAAC,MAAM,CAAC,CACT,CAAA;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAE/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAA;QAEvD,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,kBAAkB;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,iBAAiB;gBAClC,eAAe,EAAE,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC7G,OAAO,EAAE,EAAE;aACZ,CAAA;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;QACxC,CAAC;QAED,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC7B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,GAAG,CAAC,WAAW;gBACrB,QAAQ,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;gBACpC,UAAU,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACnC,YAAY,EAAE,GAAG,CAAC,aAAa;gBAC/B,WAAW,EAAE,GAAG,CAAC,kBAAkB;gBACnC,YAAY,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;gBACzC,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,WAAW;aAC5B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;AAC9B,CAAC"}

package/dist/db/pool.d.ts

@@ -0,0 +1,37 @@
+import pg from 'pg';
+export interface DatabaseOptions {
+    connectionString: string;
+    statementTimeoutMs: number;
+}
+export interface ReadOnlyResult {
+    rows: Record<string, unknown>[];
+    /** True when the query produced more rows than the cap and the extras were dropped. */
+    truncated: boolean;
+}
+export declare class Database {
+    private readonly pool;
+    private readonly statementTimeoutMs;
+    /** True when startup options were refused and we connected without them. */
+    readonly behindPooler: boolean;
+    private constructor();
+    static connect(options: DatabaseOptions): Promise<Database>;
+    private static open;
+    /**
+     * Runs a single already-validated read-only statement, reading at most `maxRows`.
+     *
+     * Reads `maxRows + 1` so truncation is detectable rather than silent.
+     */
+    runReadOnly(sql: string, maxRows: number): Promise<ReadOnlyResult>;
+    /**
+     * For this server's own introspection queries — never for user input. `queryMode` is
+     * mandatory here for the reason described at the top of this file.
+     */
+    internalQuery<T extends pg.QueryResultRow>(text: string, values?: unknown[]): Promise<T[]>;
+    /**
+     * Layer 4 is a database role, not code — but connecting as a superuser silently
+     * defeats it, so say so. Also confirms the startup options actually landed, which a
+     * connection pooler in front of Postgres may prevent.
+     */
+    warnOnWeakSetup(): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/db/pool.js

@@ -0,0 +1,213 @@
+import pg from 'pg';
+import Cursor from 'pg-cursor';
+import { parse as parseConnectionString } from 'pg-connection-string';
+import { describeConnectionError } from './errors.js';
+/**
+ * The single place user-supplied SQL reaches the database, and the home of safety layers
+ * 1 and 2.
+ *
+ * ## Layer 1 — extended query protocol
+ *
+ * The archived `@modelcontextprotocol/server-postgres` ran `client.query(sql)` with a
+ * bare string. node-postgres only prepares a statement when
+ * `Query.requiresPreparation()` is true, and with no values that is false — so the driver
+ * sends a *simple* Query message, which permits multiple statements. That is what let
+ * `COMMIT; DROP TABLE x; BEGIN;` escape their read-only transaction.
+ *
+ * So: user SQL goes through `pg-cursor`, which always issues Parse/Bind/Describe/Execute,
+ * and Postgres itself rejects multi-statement input at Parse time. Internal queries pass
+ * `queryMode: 'extended'` explicitly.
+ *
+ * Note that `values: []` does NOT force the extended protocol — `requiresPreparation()`
+ * checks `values.length > 0`. Anything added here must use a cursor or `queryMode`.
+ *
+ * ## Layer 2 — connection-level read-only
+ *
+ * `default_transaction_read_only=on` is set in the startup packet, and every statement
+ * additionally runs inside an explicit `BEGIN READ ONLY`. The explicit transaction is
+ * what makes this layer hold behind a pooler: PgBouncer refuses unknown startup
+ * parameters outright, so on that error we reconnect without them rather than fail. The
+ * statement timeout is set with `SET LOCAL` inside each transaction for the same reason.
+ * `SET`/`RESET` are rejected by the parser layer, so a session cannot turn either back off.
+ */
+const DEFAULT_IDLE_TRANSACTION_TIMEOUT_MS = 60_000;
+/** Client-side backstop in case the server never answers; the server-side timeout fires first. */
+const CLIENT_TIMEOUT_GRACE_MS = 5_000;
+// node-postgres turns date and timestamp values into JS Dates in the *MCP process's*
+// timezone, and JSON renders those in UTC — so `2024-01-15` came out as
+// `2024-01-14T18:30:00.000Z` for anyone east of Greenwich. Hand the model exactly what
+// Postgres sent instead. Intervals too, which otherwise become `{ "days": 1 }` objects.
+const DATE_LIKE_TYPES = [1082 /* date */, 1114 /* timestamp */, 1184 /* timestamptz */, 1186 /* interval */];
+const DATE_LIKE_ARRAY_TYPES = [1182, 1115, 1185, 1187];
+const TEXT_ARRAY_TYPE = 1009;
+for (const oid of DATE_LIKE_TYPES)
+    pg.types.setTypeParser(oid, (value) => value);
+for (const oid of DATE_LIKE_ARRAY_TYPES)
+    pg.types.setTypeParser(oid, pg.types.getTypeParser(TEXT_ARRAY_TYPE));
+export class Database {
+    pool;
+    statementTimeoutMs;
+    /** True when startup options were refused and we connected without them. */
+    behindPooler;
+    constructor(pool, statementTimeoutMs, behindPooler) {
+        this.pool = pool;
+        this.statementTimeoutMs = statementTimeoutMs;
+        this.behindPooler = behindPooler;
+    }
+    static async connect(options) {
+        try {
+            return await Database.open(options, true);
+        }
+        catch (error) {
+            if (!isUnsupportedStartupParameter(error))
+                throw new Error(describeConnectionError(error));
+        }
+        console.error('[postgres-mcp] the server refused startup parameters, which usually means PgBouncer or another ' +
+            'pooler. Reconnecting without them: every statement still runs in BEGIN READ ONLY with its ' +
+            'own statement timeout.');
+        try {
+            return await Database.open(options, false);
+        }
+        catch (error) {
+            throw new Error(describeConnectionError(error));
+        }
+    }
+    static async open(options, withStartupOptions) {
+        const pool = new pg.Pool(buildPoolConfig(options, withStartupOptions));
+        // pg emits 'error' asynchronously when an idle connection is reaped server-side.
+        // Without a listener node re-throws it as an uncaught exception and kills the server.
+        pool.on('error', (error) => {
+            console.error(`[postgres-mcp] pool error: ${describeConnectionError(error)}`);
+        });
+        try {
+            const client = await pool.connect();
+            client.release();
+        }
+        catch (error) {
+            await pool.end().catch(() => { });
+            throw error;
+        }
+        return new Database(pool, options.statementTimeoutMs, !withStartupOptions);
+    }
+    /**
+     * Runs a single already-validated read-only statement, reading at most `maxRows`.
+     *
+     * Reads `maxRows + 1` so truncation is detectable rather than silent.
+     */
+    async runReadOnly(sql, maxRows) {
+        const client = await this.pool.connect();
+        try {
+            await client.query({ text: 'BEGIN READ ONLY', queryMode: 'extended' });
+            // SET LOCAL rather than a startup option, so the timeout holds behind a pooler too.
+            await client.query({
+                text: "SELECT set_config('statement_timeout', $1, true)",
+                values: [String(this.statementTimeoutMs)],
+                queryMode: 'extended',
+            });
+            const cursor = client.query(new Cursor(sql));
+            try {
+                const rows = (await cursor.read(maxRows + 1));
+                const truncated = rows.length > maxRows;
+                return { rows: truncated ? rows.slice(0, maxRows) : rows, truncated };
+            }
+            finally {
+                await cursor.close().catch(() => { });
+            }
+        }
+        finally {
+            // Always ROLLBACK, never COMMIT. Beyond discarding the transaction, this undoes any
+            // GUC change made inside it (SET is transactional), so a statement cannot leave a
+            // pooled connection in a weakened state for whoever gets it next.
+            await client.query({ text: 'ROLLBACK', queryMode: 'extended' }).catch((error) => {
+                console.error(`[postgres-mcp] could not roll back: ${describeConnectionError(error)}`);
+            });
+            client.release();
+        }
+    }
+    /**
+     * For this server's own introspection queries — never for user input. `queryMode` is
+     * mandatory here for the reason described at the top of this file.
+     */
+    async internalQuery(text, values = []) {
+        const result = await this.pool.query({ text, values, queryMode: 'extended' });
+        return result.rows;
+    }
+    /**
+     * Layer 4 is a database role, not code — but connecting as a superuser silently
+     * defeats it, so say so. Also confirms the startup options actually landed, which a
+     * connection pooler in front of Postgres may prevent.
+     */
+    async warnOnWeakSetup() {
+        try {
+            const rows = await this.internalQuery(`SELECT rolname AS role,
+                rolsuper AS is_superuser,
+                rolbypassrls AS bypasses_rls,
+                current_setting('default_transaction_read_only') AS default_read_only
+           FROM pg_roles
+          WHERE rolname = current_user`);
+            const info = rows[0];
+            if (!info)
+                return;
+            if (info.is_superuser || info.bypasses_rls) {
+                console.error(`[postgres-mcp] connected as "${info.role}", which is a superuser or bypasses RLS. ` +
+                    'Queries are still read-only, but the recommended setup is a dedicated read-only role ' +
+                    'so the database enforces it independently of this server. See the README.');
+            }
+            if (info.default_read_only !== 'on' && !this.behindPooler) {
+                console.error('[postgres-mcp] default_transaction_read_only did not take effect on this connection ' +
+                    '(a connection pooler may be dropping startup options). Statements still run inside an ' +
+                    'explicit READ ONLY transaction, so writes remain blocked.');
+            }
+        }
+        catch (error) {
+            // A restricted role may not be able to read pg_roles. That is fine — it is a
+            // diagnostic, not a safety layer.
+            console.error(`[postgres-mcp] skipped setup check: ${describeConnectionError(error)}`);
+        }
+    }
+    async close() {
+        await this.pool.end();
+    }
+}
+/** PgBouncer: `unsupported startup parameter: options` (or `...in options: ...`). */
+function isUnsupportedStartupParameter(error) {
+    return /unsupported startup parameter/i.test(error?.message ?? '');
+}
+function buildPoolConfig(options, withStartupOptions) {
+    // Parse here rather than handing `connectionString` to pg: pg re-parses it and
+    // Object.assigns the result over the rest of the config, which would drop our options.
+    const parsed = parseConnectionString(options.connectionString);
+    const hardening = [
+        '-c default_transaction_read_only=on',
+        `-c statement_timeout=${options.statementTimeoutMs}`,
+        `-c idle_in_transaction_session_timeout=${DEFAULT_IDLE_TRANSACTION_TIMEOUT_MS}`,
+    ].join(' ');
+    const config = {
+        max: 5,
+        idleTimeoutMillis: 30_000,
+        // Client-side only — never sent as a startup parameter, so safe behind a pooler.
+        query_timeout: options.statementTimeoutMs + CLIENT_TIMEOUT_GRACE_MS,
+    };
+    if (withStartupOptions) {
+        // Keep anything the user set (including their own `options`) and append ours last so
+        // the read-only settings win.
+        config.options = parsed.options ? `${parsed.options} ${hardening}` : hardening;
+    }
+    else if (parsed.options) {
+        config.options = parsed.options;
+    }
+    if (parsed.host)
+        config.host = parsed.host;
+    if (parsed.port)
+        config.port = Number(parsed.port);
+    if (parsed.database)
+        config.database = parsed.database;
+    if (parsed.user)
+        config.user = parsed.user;
+    if (parsed.password)
+        config.password = parsed.password;
+    if (parsed.ssl !== undefined)
+        config.ssl = parsed.ssl;
+    return config;
+}
+//# sourceMappingURL=pool.js.map

package/dist/db/pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../../src/db/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,MAAM,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,KAAK,IAAI,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,mCAAmC,GAAG,MAAM,CAAA;AAClD,kGAAkG;AAClG,MAAM,uBAAuB,GAAG,KAAK,CAAA;AAErC,qFAAqF;AACrF,wEAAwE;AACxE,uFAAuF;AACvF,wFAAwF;AACxF,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;AAC5G,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACtD,MAAM,eAAe,GAAW,IAAI,CAAA;AAEpC,KAAK,MAAM,GAAG,IAAI,eAAe;IAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;AACxF,KAAK,MAAM,GAAG,IAAI,qBAAqB;IAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAA;AAa7G,MAAM,OAAO,QAAQ;IACF,IAAI,CAAS;IACb,kBAAkB,CAAQ;IAC3C,4EAA4E;IACnE,YAAY,CAAS;IAE9B,YAAoB,IAAa,EAAE,kBAA0B,EAAE,YAAqB;QAClF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAA;QAC5C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;QAC5F,CAAC;QAED,OAAO,CAAC,KAAK,CACX,iGAAiG;YAC/F,4FAA4F;YAC5F,wBAAwB,CAC3B,CAAA;QAED,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAwB,EAAE,kBAA2B;QAC7E,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAA;QAEtE,iFAAiF;QACjF,sFAAsF;QACtF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,8BAA8B,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;YACnC,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAChC,MAAM,KAAK,CAAA;QACb,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,CAAA;IAC5E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAe;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAA;QAExC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;YACtE,oFAAoF;YACpF,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,IAAI,EAAE,kDAAkD;gBACxD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACzC,SAAS,EAAE,UAAU;aACtB,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAA8B,CAAA;gBAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAA;gBAEvC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;YACvE,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,oFAAoF;YACpF,kFAAkF;YAClF,kEAAkE;YAClE,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACvF,OAAO,CAAC,KAAK,CAAC,uCAAuC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxF,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAA8B,IAAY,EAAE,SAAoB,EAAE;QACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;QAChF,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAMnC;;;;;uCAK+B,CAChC,CAAA;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,CAAC,IAAI;gBAAE,OAAM;YAEjB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC3C,OAAO,CAAC,KAAK,CACX,gCAAgC,IAAI,CAAC,IAAI,2CAA2C;oBAClF,uFAAuF;oBACvF,2EAA2E,CAC9E,CAAA;YACH,CAAC;YAED,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1D,OAAO,CAAC,KAAK,CACX,sFAAsF;oBACpF,wFAAwF;oBACxF,2DAA2D,CAC9D,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,kCAAkC;YAClC,OAAO,CAAC,KAAK,CAAC,uCAAuC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;IACvB,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,6BAA6B,CAAC,KAAc;IACnD,OAAO,gCAAgC,CAAC,IAAI,CAAE,KAA8B,EAAE,OAAO,IAAI,EAAE,CAAC,CAAA;AAC9F,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB,EAAE,kBAA2B;IAC5E,+EAA+E;IAC/E,uFAAuF;IACvF,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG;QAChB,qCAAqC;QACrC,wBAAwB,OAAO,CAAC,kBAAkB,EAAE;QACpD,0CAA0C,mCAAmC,EAAE;KAChF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEX,MAAM,MAAM,GAAkB;QAC5B,GAAG,EAAE,CAAC;QACN,iBAAiB,EAAE,MAAM;QACzB,iFAAiF;QACjF,aAAa,EAAE,OAAO,CAAC,kBAAkB,GAAG,uBAAuB;KACpE,CAAA;IAED,IAAI,kBAAkB,EAAE,CAAC;QACvB,qFAAqF;QACrF,8BAA8B;QAC9B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IACjC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1C,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IACtD,IAAI,MAAM,CAAC,IAAI;QAAE,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1C,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IACtD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAA2B,CAAA;IAE7E,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,8 @@
+import { type Server as HttpServer } from 'node:http';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { HttpConfig } from './config.js';
+export interface HttpServerDeps {
+    config: HttpConfig;
+    createMcpServer: () => Server;
+}
+export declare function startHttpServer({ config, createMcpServer }: HttpServerDeps): Promise<HttpServer>;

package/dist/http.js

@@ -0,0 +1,137 @@
+import { createServer as createHttpServer } from 'node:http';
+import { timingSafeEqual } from 'node:crypto';
+import { StreamableHTTPServerTransport, } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+/**
+ * Streamable HTTP transport, for running this on a box and pointing a remote client at it.
+ *
+ * Stateless: a fresh Server and transport per request, all sharing one connection pool.
+ * There is no session state worth keeping between calls, and no session map to leak.
+ *
+ * On authentication — an MCP endpoint on a reachable port is a live database connection
+ * for anyone who can open a socket to it. The read-only layers hold, so the exposure is
+ * reading everything rather than breaking anything, which is still the whole database.
+ * Hence: loopback unless a flag says otherwise, an optional bearer token, and a warning
+ * loud enough to be uncomfortable when it is exposed without one.
+ */
+const MCP_PATH = '/mcp';
+export async function startHttpServer({ config, createMcpServer }) {
+    warnAboutExposure(config);
+    const server = createHttpServer((request, response) => {
+        void handleRequest(request, response, config, createMcpServer);
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(config.port, config.host, () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    // Report the port actually bound, which differs from the requested one when it was 0.
+    const address = server.address();
+    const port = typeof address === 'object' && address !== null ? address.port : config.port;
+    console.error(`[postgres-mcp] listening on http://${config.host}:${port}${MCP_PATH}`);
+    return server;
+}
+async function handleRequest(request, response, config, createMcpServer) {
+    const path = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`).pathname;
+    if (path === '/health') {
+        respondJson(response, 200, { status: 'ok' });
+        return;
+    }
+    if (path !== MCP_PATH) {
+        respondJson(response, 404, { error: `Not found. The MCP endpoint is ${MCP_PATH}.` });
+        return;
+    }
+    if (!isLoopbackRequestAllowed(request, config.host)) {
+        respondJson(response, 403, {
+            error: 'Host or Origin is not local. This server is bound to loopback and only answers local requests.',
+        });
+        return;
+    }
+    if (!isAuthorized(request, config.authToken)) {
+        response.setHeader('WWW-Authenticate', 'Bearer');
+        respondJson(response, 401, { error: 'Missing or invalid bearer token.' });
+        return;
+    }
+    const mcpServer = createMcpServer();
+    // `sessionIdGenerator: undefined` is the SDK's documented way to ask for stateless mode,
+    // but its own types are not written for exactOptionalPropertyTypes. The two casts here
+    // are types-only; keeping the flag on is worth more in the safety layer than it costs
+    // at this boundary.
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+    });
+    response.on('close', () => {
+        void transport.close();
+        void mcpServer.close();
+    });
+    try {
+        await mcpServer.connect(transport);
+        await transport.handleRequest(request, response);
+    }
+    catch (error) {
+        console.error(`[postgres-mcp] request failed: ${error instanceof Error ? error.message : String(error)}`);
+        if (!response.headersSent) {
+            respondJson(response, 500, { error: 'Internal server error.' });
+        }
+    }
+}
+function isAuthorized(request, authToken) {
+    if (!authToken)
+        return true;
+    const header = request.headers.authorization;
+    if (!header?.startsWith('Bearer '))
+        return false;
+    const presented = Buffer.from(header.slice('Bearer '.length));
+    const expected = Buffer.from(authToken);
+    // timingSafeEqual throws on length mismatch, and the length itself is not a secret.
+    return presented.length === expected.length && timingSafeEqual(presented, expected);
+}
+function respondJson(response, status, body) {
+    response.writeHead(status, { 'content-type': 'application/json' });
+    response.end(JSON.stringify(body));
+}
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+/** As `URL.hostname` spells them, which brackets IPv6. */
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', '[::1]', 'localhost']);
+/**
+ * DNS rebinding: a web page on evil.example re-points its own hostname at 127.0.0.1, and
+ * the browser, seeing the same origin, lets its script POST to this server. Loopback plus
+ * no token is the default setup, so that script could read the database. The Host header
+ * still says evil.example, which is how it is caught. The MCP spec requires this check.
+ *
+ * Only for loopback binds: behind 0.0.0.0 the Host is whatever the proxy in front sends,
+ * and the bearer token is the control.
+ */
+function isLoopbackRequestAllowed(request, boundHost) {
+    if (!LOOPBACK.has(boundHost))
+        return true;
+    const host = request.headers.host;
+    if (!host || !LOOPBACK_HOSTNAMES.has(hostnameOf(`http://${host}`)))
+        return false;
+    // Browsers send Origin; local tools such as the MCP Inspector are served from localhost.
+    const origin = request.headers.origin;
+    return origin === undefined || LOOPBACK_HOSTNAMES.has(hostnameOf(origin));
+}
+function hostnameOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return '';
+    }
+}
+function warnAboutExposure(config) {
+    if (LOOPBACK.has(config.host))
+        return;
+    if (config.authToken) {
+        console.error(`[postgres-mcp] bound to ${config.host} with bearer-token auth. Terminate TLS in front of it — ` +
+            'the token crosses the wire in plaintext otherwise.');
+        return;
+    }
+    console.error(`[postgres-mcp] WARNING: bound to ${config.host} with NO AUTHENTICATION. Anyone who can reach ` +
+        `${config.host}:${config.port} can read every table this connection can see. Queries stay ` +
+        'read-only, so this is data exposure rather than damage — but it is the whole database. ' +
+        'Set AUTH_TOKEN, keep it inside a private network, or bind 127.0.0.1.');
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAwE,MAAM,WAAW,CAAA;AAClI,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EACL,6BAA6B,GAE9B,MAAM,oDAAoD,CAAA;AAI3D;;;;;;;;;;;GAWG;AAEH,MAAM,QAAQ,GAAG,MAAM,CAAA;AAOvB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAE,MAAM,EAAE,eAAe,EAAkB;IAC/E,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACpD,KAAK,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACtC,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,sFAAsF;IACtF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IACzF,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,IAAI,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC,CAAA;IAErF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAwB,EACxB,QAAwB,EACxB,MAAkB,EAClB,eAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAA;IAElG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,QAAQ,GAAG,EAAE,CAAC,CAAA;QACpF,OAAM;IACR,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE;YACzB,KAAK,EAAE,gGAAgG;SACxG,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QAChD,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;IACnC,yFAAyF;IACzF,uFAAuF;IACvF,sFAAsF;IACtF,oBAAoB;IACpB,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;KACqB,CAAC,CAAA;IAErD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;QACtB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,CAAC,SAAsB,CAAC,CAAA;QAC/C,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACzG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB,EAAE,SAA6B;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAA;IAC5C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAEvC,oFAAoF;IACpF,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IAC1E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAClE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;AAC3D,0DAA0D;AAC1D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;AAEvE;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,OAAwB,EAAE,SAAiB;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAEhF,yFAAyF;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAA;IACrC,OAAO,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAkB;IAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAM;IAErC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CACX,2BAA2B,MAAM,CAAC,IAAI,0DAA0D;YAC9F,oDAAoD,CACvD,CAAA;QACD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,KAAK,CACX,oCAAoC,MAAM,CAAC,IAAI,gDAAgD;QAC7F,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,8DAA8D;QAC3F,yFAAyF;QACzF,sEAAsE,CACzE,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};