@databrainhq/mcp-server 0.3.0-rc.11 → 0.3.0-rc.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/README.md +8 -5
  2. package/dist/apps/server.d.ts +35 -7
  3. package/dist/apps/server.js +4 -4
  4. package/dist/apps/stdio.js +5 -5
  5. package/dist/{chunk-RHK62ZJ6.js → chunk-347U6GXR.js} +3 -3
  6. package/dist/chunk-347U6GXR.js.map +1 -0
  7. package/dist/{chunk-IBYBK5ZE.js → chunk-LACJHQYH.js} +4 -4
  8. package/dist/{chunk-ES2LUP4U.js → chunk-OLOC2MTA.js} +245 -89
  9. package/dist/chunk-OLOC2MTA.js.map +1 -0
  10. package/dist/{chunk-DM7S4R57.js → chunk-V3UW3B6U.js} +2 -2
  11. package/dist/{chunk-NBFUKVWP.js → chunk-ZTHGF27R.js} +99 -15
  12. package/dist/chunk-ZTHGF27R.js.map +1 -0
  13. package/dist/cli.js +1 -1
  14. package/dist/index.js +4 -4
  15. package/dist/{main-JEYYFGJM.js → main-IUV24DMP.js} +28 -20
  16. package/dist/main-IUV24DMP.js.map +1 -0
  17. package/package.json +1 -1
  18. package/dist/chunk-ES2LUP4U.js.map +0 -1
  19. package/dist/chunk-NBFUKVWP.js.map +0 -1
  20. package/dist/chunk-RHK62ZJ6.js.map +0 -1
  21. package/dist/main-JEYYFGJM.js.map +0 -1
  22. /package/dist/{chunk-IBYBK5ZE.js.map → chunk-LACJHQYH.js.map} +0 -0
  23. /package/dist/{chunk-DM7S4R57.js.map → chunk-V3UW3B6U.js.map} +0 -0
package/dist/chunk-NBFUKVWP.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/apps/custom-chart-assets.ts","../src/apps/registry.ts","../src/apps/backend.ts","../src/apps/tile.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { CustomChartsApi } from '../api/custom-charts-api.js';\nimport { contentHash, validateBundle } from '../custom-chart/bundle.js';\nimport { READ_ONLY } from '../tools/annotations.js';\nimport { appMeta } from './feature.js';\nimport { bounded, MAX_CUSTOM_BUNDLE_CHARS, CUSTOM_BUNDLE_CHUNK_CHARS } from './contract.js';\nimport { readCustomChartBrowserRuntime } from '../custom-chart/assets.js';\n\n// Content-addressed immutable artifacts only. Authorization and the published pointer/hash\n// are fetched live before every cache lookup; no principal or API response is cached.\nconst assets = new Map<string, { text: string; expires: number }>();\n\n/** Chunk large code assets; every chunk rechecks the live published pointer and caller. */\nexport function registerCustomChartAssets(server: McpServer, client: DatabrainClient): void {\n const runtime = server.tool('load_custom_chart_runtime',\n 'Load the trusted app/embed sandbox adapter for a custom chart tile. App-only; no company data or chart code.',\n {}, READ_ONLY, async () => bounded({ content: [{ type: 'text' as const, text: 'Custom chart sandbox runtime.' }],\n _meta: { 'databrain/custom-chart-runtime': readCustomChartBrowserRuntime() } }));\n runtime.update({ _meta: appMeta(['app']) });\n const api = new CustomChartsApi(client);\n const tool = server.tool('load_custom_chart_bundle',\n 'Load one bounded chunk of the company published custom chart bundle for the tile. No draft version, credentials, or query rows.',\n { key: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), offset: z.number().int().min(0).max(MAX_CUSTOM_BUNDLE_CHARS).default(0),\n contentHash: z.string().regex(/^[a-f0-9]{64}$/).optional() }, READ_ONLY,\n async ({ key, offset, contentHash: expected }) => {\n try {\n const detail = await api.get(key);\n if (detail.status !== 'published' || !detail.publishedVersionId) throw new Error('not published');\n const publishedHash = detail.versions?.find(version => version.id === detail.publishedVersionId)?.contentHash;\n const cached = publishedHash && /^[a-f0-9]{64}$/.test(publishedHash) ? assets.get(publishedHash) : undefined;\n let hash = publishedHash, asset = cached && cached.expires > Date.now() ? cached.text : undefined;\n if (asset === undefined) {\n const raw = await api.bundle(key, detail.publishedVersionId);\n const bundle = { ...raw, bundleCss: raw.bundleCss ?? undefined };\n if (validateBundle(bundle).length || bundle.manifest.id !== key) throw new Error('invalid bundle');\n hash = contentHash(bundle);\n if (publishedHash && publishedHash !== hash) throw new Error('published hash mismatch');\n // Only runtime artifacts cross the bridge; never any API envelope or extra fields.\n asset = JSON.stringify({ manifest: bundle.manifest, bundleJs: bundle.bundleJs, bundleCss: bundle.bundleCss ?? '', iconSvg: bundle.iconSvg });\n if (assets.size >= 4) assets.delete(assets.keys().next().value!);\n assets.set(hash, { text: asset, expires: Date.now() + 60_000 });\n }\n if (expected && hash !== expected) throw new Error('published version changed');\n if (offset > asset.length) throw new Error('offset');\n const chunk = asset.slice(offset, offset + CUSTOM_BUNDLE_CHUNK_CHARS);\n return bounded({ content: [{ type: 'text' as const, text: 'Published custom chart asset chunk.' }],\n structuredContent: { key, contentHash: hash, offset, chunk,\n nextOffset: offset + chunk.length < asset.length ? offset + chunk.length : null } });\n } catch {\n return { isError: true, content: [{ type: 'text' as const,\n text: `Could not load published custom:${key}. It may be unpublished, changed, or unavailable to this sign-in.` }] };\n }\n });\n tool.update({ _meta: appMeta(['app']) });\n}\n","import { registerCustomChartAssets } from './custom-chart-assets.js';\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { DatabrainApiError } from '../utils/errors.js';\nimport { READ_ONLY } from '../tools/annotations.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { createChartBackend, type ChartBackend, type ChartAction } from './backend.js';\nimport { APP_MIME, CHART_URI, KPI_URI, pageSchema, referenceSchema, viewSchema } from './contract.js';\nimport { appMeta, chartResult } from './feature.js';\nimport { tileHtml } from './tile.js';\nimport { draftSchema, draftPage, RENDER_TYPES, saveDraftAsDashboard, workspacesForDatamart } from './preview.js';\nimport { rowsSchema } from './contract.js';\nimport { WRITE_CREATE } from '../tools/annotations.js';\nimport { APPLY_TO_PRODUCTION_CONFIRMATION } from '../tools/widgets/production-guards.js';\n\nconst actions: Record<ChartAction, string> = {\n render_chart: 'Render one authorized chart page as SVG with point metadata. Cursor pagination stays within the same guest scope.',\n refresh_widget: 'Refresh a chart in the current guest scope. Revalidates access before returning data.',\n drill_down: 'Explore a server-issued drill identifier within the current chart and guest scope.',\n change_date_range: 'Render a chart for an ordered date range within the current guest scope.',\n};\n\n/** Call after registerAllTools so existing registration policy/instrumentation remains active. */\nexport function registerChartApps(server: McpServer, client: DatabrainClient, backend: ChartBackend = createChartBackend(client)): void {\n for (const [name, description] of Object.entries(actions)) {\n const action = name as ChartAction;\n const tool = server.tool(name, description, {\n reference: referenceSchema, view: viewSchema.default({}),\n context: z.string().max(200).optional().describe('Chart interaction context'),\n }, READ_ONLY, async ({ reference, view }) => {\n try {\n if ((action === 'drill_down' && !view.drillId) || (action === 'change_date_range' && !view.dateRange)) throw new Error('Missing view selector');\n const page = pageSchema.parse(await toolContext.run({ tool: name, category: 'embedding', workflowIntent: 'chart_app', inputMode: 'app' },\n () => backend.execute(action, reference, view)));\n // SVG is rendered as an isolated image, never inserted into the HTML DOM.\n // Reject active/external/animated constructs as a further contract check.\n if (page.svg && (!/^\\s*<svg\\b/i.test(page.svg) ||\n /<\\s*(?:script|foreignObject|iframe|image|animate\\w*|set)\\b|<!DOCTYPE|<!ENTITY|\\bon\\w+\\s*=|@(?:import|keyframes)|\\banimation\\s*:|(?:href\\s*=\\s*[\"'](?!#)|url\\s*\\(\\s*[\"']?(?!#))/i.test(page.svg))) {\n throw new Error('Unsafe SVG');\n }\n return chartResult(`${page.kind === 'kpi' ? 'KPI' : 'Chart'} ready. ${page.rows.length} rows in this page.${page.fallback ? ' ' + page.fallback : ''}`, {\n ...page, reference, view,\n });\n } catch {\n return { isError: true, content: [{ type: 'text' as const,\n text: 'Chart unavailable. Check dashboard access and the chart renderer integration, then retry.' }] };\n }\n });\n tool.update({ _meta: appMeta(['app']) });\n }\n registerDraftTools(server, client);\n registerCustomChartAssets(server, client);\n for (const [uri, kind] of [[CHART_URI, 'chart'], [KPI_URI, 'kpi']] as const) {\n server.resource(`Databrain ${kind} tile`, uri, { mimeType: APP_MIME, description: `Interactive ${kind} using host theme and scoped server tools` }, async () => ({\n contents: [{ uri, mimeType: APP_MIME, text: tileHtml(kind), _meta: { ui: { prefersBorder: true, csp: { resourceDomains: [\"data:\", \"blob:\"], frameDomains: [\"blob:\"], connectDomains: [] } } } }],\n }));\n }\n}\n\n/** The tile's controls over an unsaved answer. `preview_chart` is the \"show as\" row and\n * is app-only: the model already has ask_question. `save_chart_as_dashboard` is the commit,\n * visible to both, and gated the way every production write here is gated. */\nfunction registerDraftTools(server: McpServer, client: DatabrainClient): void {\n const preview = server.tool('preview_chart',\n 'Redraw an unsaved ask_question answer as another chart type, from the rows already on screen. No query runs.',\n { draft: draftSchema, rows: rowsSchema, chartType: z.enum(RENDER_TYPES),\n context: z.string().max(200).optional().describe('Chart interaction context') },\n READ_ONLY, async ({ draft, rows, chartType }) => {\n try {\n const page = await draftPage(client, draft, rows, chartType);\n return chartResult(`${page.kind === 'table' ? 'Table' : 'Chart'} ready as ${chartType}.`, page);\n } catch {\n return { isError: true, content: [{ type: 'text' as const, text: 'Chart preview unavailable. Ask the question again to retry.' }] };\n }\n });\n preview.update({ _meta: appMeta(['app']) });\n\n const save = server.tool('save_chart_as_dashboard',\n 'Save an ask_question answer: creates a workspace metric from its SQL and a new dashboard holding it. ' +\n `Production write; requires confirm: \"${APPLY_TO_PRODUCTION_CONFIRMATION}\". ` +\n 'A workspaceName is needed when the datamart backs more than one workspace.',\n { draft: draftSchema, chartType: z.enum(RENDER_TYPES),\n dashboardTitle: z.string().trim().min(1).max(200),\n workspaceName: z.string().trim().min(1).max(256).optional(),\n attemptId: z.string().trim().min(1).max(64).optional()\n .describe('Identifies one save attempt. Reuse it to retry safely; omit or change it to save again on purpose.'),\n confirm: z.string().optional(),\n context: z.string().max(200).optional().describe('Chart interaction context') },\n WRITE_CREATE, async ({ draft, chartType, dashboardTitle, workspaceName, attemptId, confirm }) => {\n if (confirm !== APPLY_TO_PRODUCTION_CONFIRMATION) {\n return { isError: true, content: [{ type: 'text' as const,\n text: `Saving writes to production. Retry with confirm: \"${APPLY_TO_PRODUCTION_CONFIRMATION}\".` }] };\n }\n // The draft's workspace list is a hint for the tile. The caller wrote it, so the\n // set a save may target is recomputed here from the datamart, on the server's own credential.\n const choices = await workspacesForDatamart(client, draft.datamartName, 'authorize');\n const refuse = (text: string) => ({ isError: true, content: [{ type: 'text' as const, text }],\n structuredContent: { kind: 'save', ok: false, choices } });\n // A named workspace must be one the draft's datamart can serve, spelled the draft's way.\n const target = workspaceName\n ? choices.find(w => w.trim().toLowerCase() === workspaceName.toLowerCase())\n : choices.length === 1 ? choices[0] : undefined;\n if (workspaceName && !target) {\n return refuse(`Workspace \"${workspaceName}\" cannot run this datamart's SQL. Choose one of: ${choices.join(', ')}.`);\n }\n if (!target) {\n return refuse(choices.length\n ? `Choose a workspace: ${choices.join(', ')}.`\n : `No workspace is built on datamart \"${draft.datamartName}\". Create one in Databrain, then save again.`);\n }\n try {\n const saved = await saveDraftAsDashboard(client, draft, { chartType, dashboardTitle, workspaceName: target, attemptId });\n return chartResult(`Saved \"${saved.title}\" to workspace ${saved.workspaceName} (dashboard ${saved.dashboardId}, metric ${saved.metricId}).`,\n { kind: 'save', ok: true, ...saved, draft: { ...draft, chartType } });\n } catch (error) {\n const code = error instanceof DatabrainApiError ? error.code : 'SAVE_FAILED';\n return { isError: true, content: [{ type: 'text' as const,\n text: `Could not save (${code}). Check the workspace name and your access, then try again.` }],\n structuredContent: { kind: 'save', ok: false, code } };\n }\n });\n save.update({ _meta: appMeta(['model', 'app']) });\n}\n","import { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { createServiceBundle } from '../services/factory.js';\nimport { pageSchema, referenceSchema, viewSchema, type ChartPage, type ChartReference, type ChartView } from './contract.js';\n\nexport const RENDER_PATH = '/api/v2/dashboard/mcp-chart';\nexport type ChartAction = 'render_chart' | 'refresh_widget' | 'drill_down' | 'change_date_range';\nexport interface ChartBackend {\n execute(action: ChartAction, reference: ChartReference, view: ChartView): Promise<ChartPage>;\n}\n\nclass UncachedChartClient extends DatabrainClient {\n constructor(private readonly delegate: DatabrainClient) {\n super({ apiUrl: delegate.getApiUrl(), demoDomain: delegate.getDemoDomain() });\n }\n override request<T>(options: RequestOptions): Promise<T> {\n return this.delegate.request<T>({ ...options, cacheKey: undefined, cacheTtlMs: undefined });\n }\n}\n\n/** Proposed backend route; no local renderer, ambient service fallback, or UI credentials. */\nexport function createChartBackend(client: DatabrainClient): ChartBackend {\n // The general embed lookup caches for five minutes. Authorization must not.\n const services = createServiceBundle(new UncachedChartClient(client));\n return {\n async execute(action, rawReference, rawView) {\n const reference = referenceSchema.parse(rawReference);\n const view = viewSchema.parse(rawView);\n // Every page/refresh/drill re-reads the embed live, so a revoked tenant stops working at once.\n const app = await services.widgetService.resolveDataAppName(undefined, reference.embedId);\n if (!app.ok) throw new Error('Chart scope unavailable');\n const scope = await services.widgetService.ensureReadableDashboardScope({\n embedId: reference.embedId, clientId: reference.clientId, dataAppName: app.value });\n if (!scope.ok) throw new Error('Chart scope denied');\n const { token } = await services.guestTokenService.generateToken({\n clientId: reference.clientId, dataAppName: app.value, allowedEmbeds: [reference.embedId],\n permissions: { isDisableMetricCreation: true, isEnableManageMetrics: false,\n isEnableMetricUpdation: false, isEnableArchiveMetrics: false },\n });\n if (!token) throw new Error('Guest scope unavailable');\n const page = await client.request<unknown>({\n method: 'POST', path: RENDER_PATH, auth: 'none', token,\n body: { action, embedId: reference.embedId, widgetId: reference.widgetId, ...view,\n pageSize: 50, width: 600, height: 320, animation: false },\n skipDataUnwrap: true,\n });\n return pageSchema.parse(page);\n },\n };\n}\n","import { transformSync } from 'esbuild';\nimport { MAX_CUSTOM_BUNDLE_CHARS, CUSTOM_BUNDLE_CHUNK_CHARS } from './contract.js';\n\n/** No iframe imports. All requests use the host bridge. */\nexport const TILE_SCRIPT = String.raw`(()=>{\nconst $=id=>document.getElementById(id),root=document.documentElement,pending=new Map();\nlet seq=0,origin='*',ready=false,closed=false,ref=null,view={},next=null,context={},busy=false,revision=0,rawSvg=null,dialect=null,shown=false,draft=null,rows=[],saved=null,attempt='',workspace=null,custom=null,customMode=false;\n/* One lifecycle, two sets of names. Hosts ship either or both, so notifications go out\n under both and arrive under either. Same order in both rows: result, input, context. */\nconst DASH=['ui/notifications/tool-result','ui/notifications/tool-input','ui/notifications/host-context-changed'],\nSNAKE=['notifications/tools/call/result','notifications/tools/call/input','notifications/host_context/changed'],\nINIT=['ui/notifications/initialized','notifications/initialized'],\nSIZE=['ui/notifications/size-changed','notifications/size_changed'],\nDISPLAY=['ui/request-display-mode','requestDisplayMode'];\nfunction send(message){if(!closed)parent.postMessage({jsonrpc:'2.0',...message},origin)}\nfunction notify(names,params){for(const method of names)send({method,params})}\nfunction rpc(method,params){return new Promise((resolve,reject)=>{const id=++seq;\nconst timer=setTimeout(()=>{pending.delete(id);reject(Error('timeout'))},65000);\npending.set(id,{resolve,reject,timer});send({id,method,params})})}\n/* Try each alias while the host says it never heard of it; any other error stands. */\nasync function ask(names,params){let last;\nfor(const method of names){try{return await rpc(method,params)}catch(error){last=error;if(error.code!==-32601)throw error}}\nthrow last}\n/* Fixed codes only; never log customer rows. */\nfunction trouble(code){send({method:'notifications/error',params:{code}})}\n/* One formatter for rail, table, KPI and answer line. Compact past 10K, grouped past 100,\n two decimals below; null is an absence, so it prints as a dash and never as 0. */\nfunction fmt(v){if(typeof v!=='number')return v==null||v===''?'\\u2014':String(v);const a=Math.abs(v);\nreturn new Intl.NumberFormat(navigator.language||'en',a>=1e4?{notation:'compact',maximumFractionDigits:1}:a>=100?{maximumFractionDigits:0}:{maximumFractionDigits:2}).format(v)}\nfunction exact(el,v){el.title=typeof v==='number'?String(v):''}\n/* The answer line: what this shows, and the headline value. Gated on carrying a number or\n a count, so it never renders as a second title or an empty reserved slot. */\nfunction answer(p){if(p.description)return p.description;const bits=[];\nif(p.kind==='dashboard'){const n=p.widgets?.length||0;return n?n+(n===1?' chart':' charts')+' on this dashboard':''}\nconst [dim,measure]=p.columns||[];const pts=(p.points||[]).filter(q=>typeof q.value==='number');\nif(pts.length<2)return '';if(dim&&measure&&!p.draft)bits.push(measure+' by '+dim);\nconst top=pts.reduce((a,b)=>b.value>a.value?b:a);bits.push(top.label.split(' \\u2014 ')[0]+' highest at '+fmt(top.value));return bits.join(' \\u00b7 ')}\nfunction status(text,bad,ok){const s=$('status');s.textContent=text;s.toggleAttribute('data-error',!!bad);s.toggleAttribute('data-ok',!!ok);if(bad)$('plot').dataset.state='off'}\nfunction paint(){const img=$('chart-image');if(!img||!rawSvg)return;\nconst c=getComputedStyle(document.body).color,mix=pc=>'color-mix(in srgb,'+c+' '+pc+'%,transparent)';\nimg.src='data:image/svg+xml,'+encodeURIComponent(rawSvg.replace(/<\\/svg>\\s*$/i,'<style>text{fill:'+mix(72)+'!important}'\n+'[stroke=\"#dbdee4\"],[stroke=\"#f1f1f2\" i]{stroke:'+mix(13)+'!important}[stroke=\"#54555a\"],[stroke=\"#d4d4d8\" i]{stroke:'+mix(30)+'!important}'\n+'</style></svg>'))}\nfunction controls(){document.querySelectorAll('button,input,select').forEach(e=>{e.disabled=busy});\n$('refresh').hidden=!ref;$('next').hidden=!next;$('range').hidden=!ref||customMode;$('plot').toggleAttribute('data-busy',busy);\n$('save').hidden=!draft||!!saved||!$('form').hidden;\n$('expand').hidden=!shown||root.dataset.kind==='dashboard'||!context.availableDisplayModes?.includes('fullscreen');\nroot.toggleAttribute('data-deep',context.displayMode==='fullscreen'||$('expand').hidden)}\nfunction host(change){context={...context,...change};if(change.theme==='dark'||change.theme==='light')root.style.colorScheme=change.theme;\nconst vars=change.styles?.variables||{};for(const [key,value] of Object.entries(vars)){\nif(/^--(?:color-|font-|border-|shadow-)/.test(key)&&typeof value==='string'&&!/url\\s*\\(|@import/i.test(value))root.style.setProperty(key,value)}\nconst face=change.styles?.css?.fonts;if(typeof face==='string'&&face.length<4000&&!/@import|javascript:/i.test(face))$('hostfont').textContent=face;\nconst insets=change.safeAreaInsets;if(insets)for(const edge of ['top','right','bottom','left']){\nconst n=insets[edge];if(Number.isFinite(n))root.style.setProperty('--safe-'+edge,Math.max(0,Math.min(n,200))+'px')}\nroot.dataset.mode=context.displayMode==='fullscreen'?'full':'inline';\n$('expand').textContent=context.displayMode==='fullscreen'?'Back to conversation':'Expand';paint();custom?.update();controls()}\nfunction scope(p,n){const bits=[];\nif(p.kind==='chart'||p.kind==='table')bits.push(p.rowsTotal>n?'first '+n+' of '+p.rowsTotal+' rows':n?(n===1?'1 row':n+' rows'):'No rows in this view');\nif(view.dateRange)bits.push(view.dateRange.from+' to '+view.dateRange.to);\nif(next)bits.push('more pages available');\nif(p.customChart&&n)bits.push('calculations use this page');\n$('scope').textContent=bits.join(' · ')}\nfunction resize(){if(ready)notify(SIZE,{width:document.body.scrollWidth,height:document.body.scrollHeight})}\nfunction table(rows,columns){$('rows').replaceChildren();$('data').hidden=!rows?.length;if(!rows?.length)return;\n$('count').textContent=rows.length===1?'1 row behind this':rows.length+' rows behind this';\nconst t=document.createElement('table');\nconst num=name=>rows.some(r=>typeof r[name]==='number');\nconst header=document.createElement('tr');for(const name of columns){const th=document.createElement('th');th.scope='col';th.textContent=name;if(num(name))th.className='n';header.append(th)}\nconst head=document.createElement('thead');head.append(header);t.append(head);const body=document.createElement('tbody');\nfor(const row of rows.slice(0,50)){const tr=document.createElement('tr');for(const key of columns){const td=document.createElement('td');td.textContent=fmt(row[key]);exact(td,row[key]);if(num(key))td.className='n';tr.append(td)}body.append(tr)}t.append(body);$('rows').append(t)}\nasync function display(mode){try{const answer=await ask(DISPLAY,{mode});\nhost({displayMode:answer.mode||context.displayMode});if(root.dataset.mode==='full'&&!$('data').hidden)$('data').open=true;resize()}\ncatch{status('Expand is unavailable in this host.',1)}}\nfunction wait(){busy=true;if(!$('plot').firstChild)$('plot').dataset.state='wait';status('Loading chart…');controls()}\nasync function call(name,extra={}){if(!ready||!ref||busy)return;run(name,{reference:ref,view:{...view,...extra}})}\n/* The draft tools take the draft and the rows on screen instead of a reference. */\nasync function run(name,args){if(!ready||busy)return;wait();const rev=++revision;\nconst selection=workspace?(name==='save_chart_as_dashboard'?{workspaceName:args.workspaceName||workspace.name}:{workspace:workspace.id}):{};\ntry{const result=await rpc('tools/call',{name,arguments:{...args,...selection,context:'tile'}});\nif(rev===revision)render(result)}catch{if(rev===revision){trouble('tool-call-failed');if(name==='save_chart_as_dashboard'){$('plot').dataset.state='ready';status('Could not save. Try again.',1)}else if(name==='preview_chart'){status('Could not draw that. Pick another type.',1);$('plot').dataset.state='ready'}else stale()}}finally{busy=false;controls()}}\nfunction stale(){if(shown&&$('plot').firstChild){status('Could not refresh. Showing the last chart that loaded. Select Refresh to try again.',1);$('plot').dataset.state='stale'}else status('Could not load the chart. Select Refresh to try again.',1)}\nfunction render(result){busy=false;controls();\nif(result?._meta?.['databrain/workspace'])workspace=result._meta['databrain/workspace'];\nconst sp=result?.structuredContent;if(sp&&sp.kind==='save'){$('plot').dataset.state='ready';if(sp.ok){saved=sp;$('form').hidden=true;status('Saved \"'+sp.title+'\" to workspace '+sp.workspaceName+'.',0,1)}\nelse if(sp.choices?.length){choose(sp.choices);status('Choose a workspace, then save again.',1)}\nelse status((result.content?.[0]?.text)||'Could not save. Try again.',1);controls();resize();return}\nif(result?.isError&&draft&&$('form').hidden===false){$('plot').dataset.state='ready';status((result.content?.[0]?.text)||'Could not save. Try again.',1);controls();return}\nif(result?.isError){trouble('tool-returned-error');\nif(shown&&$('plot').firstChild){stale();controls();return}shown=false;controls();\nstatus(ref?'Chart unavailable. Check your access to this dashboard, then Refresh.'\n:'Chart unavailable. Ask again to retry.',1);return}\nconst p=result?.structuredContent;if(!p||typeof p!=='object'){shown=false;controls();status('No chart data came back for this result.',1);return}\nrevision++;custom?.dispose();custom=null;customMode=!!p.customChart;shown=true;rawSvg=null;$('plot').replaceChildren();$('plot').dataset.state='ready';$('choices').replaceChildren();delete $('rail').dataset.value;\nref=p.reference||null;view=p.view||{};next=p.nextCursor||null;draft=p.draft||null;rows=p.rows||[];saved=null;$('form').hidden=true;\n$('title').textContent=p.title||'Analytics';$('description').textContent=answer(p);root.dataset.kind=p.kind;$('choices').toggleAttribute('data-grid',p.kind==='dashboard');\nif(p.kind==='dashboard'){$('plot').dataset.state='off';\nfor(const item of p.widgets||[]){const b=document.createElement('button');b.textContent=item.name||'Untitled widget';b.onclick=()=>{ref=item.reference;view={};call('render_chart')};$('choices').append(b)}\nstatus(p.widgets?.length?'':'No charts on this dashboard yet. Add one in Databrain.');\n}else if(p.kind==='kpi'){\nconst number=document.createElement('p');number.className='kpi';number.textContent=fmt(p.value);exact(number,p.value);$('plot').append(number);status('');\n}else if(p.customChart){\nif(!rows.length){$('plot').dataset.state='off';status('No rows in this view.');}\nelse{status('Loading custom chart…');const rev=revision;\nconst box=document.createElement('div');box.style.width='100%';$('plot').append(box);\nloadCustom(result,p,box,rev);}\n}else if(p.svg){\nconst box=document.createElement('div');box.className='chart';box.style.aspectRatio=p.width+'/'+p.height;\nconst img=document.createElement('img');img.id='chart-image';rawSvg=p.svg;img.alt=p.title||'Chart';img.onerror=()=>{status('The chart could not be drawn. The rows are below.',1);$('data').open=$('data').toggleAttribute('data-only',true)};box.append(img);\nfor(const point of p.points||[]){const b=document.createElement('button');b.className='point';b.setAttribute('aria-label',point.label+': '+fmt(point.value));b.setAttribute('aria-pressed','false');\nb.style.left=100*point.x/p.width+'%';b.style.top=100*point.y/p.height+'%';b.style.width=100*point.width/p.width+'%';b.style.height=100*point.height/p.height+'%';\nconst hover=()=>{$('vlabel').textContent=point.label;$('vnum').textContent=fmt(point.value);exact($('vnum'),point.value);$('rail').dataset.value='1'};b.onmouseenter=hover;b.onfocus=hover;\nb.onclick=()=>{box.querySelectorAll('.point').forEach(e=>e.setAttribute('aria-pressed','false'));b.setAttribute('aria-pressed','true');hover();\n$('choices').replaceChildren();if(point.drillId){const drill=document.createElement('button');drill.className='primary';drill.textContent='Explore selected data';drill.onclick=()=>call('drill_down',{drillId:point.drillId,cursor:undefined});$('choices').append(drill)}};box.append(b)}$('plot').append(box);\nstatus('');\n}else if(p.kind==='table'){\n// ask_question returns a table by design; calling that a missing chart called success a failure.\n$('plot').dataset.state='off';status('');\n}else{$('plot').dataset.state='off';\nstatus('Nothing to show. Try a wider date range, then Refresh.',1)}\nif(draft&&p.previewTypes?.length){for(const t of p.previewTypes){const b=document.createElement('button');b.textContent=t[0].toUpperCase()+t.slice(1);b.className='chip';b.setAttribute('aria-pressed',String(t===draft.chartType));\nb.onclick=()=>run('preview_chart',{draft,rows,chartType:t});$('choices').append(b)}$('choices').dataset.chips='1'}else delete $('choices').dataset.chips;\nif(p.previewError)status('Cannot draw this as '+(p.draft?.chartType||'a chart')+' ('+p.previewError+'). Showing the rows.',1);\npaint();table(p.rows||[],p.columns||Object.keys(p.rows?.[0]||{}));scope(p,p.rows?.length||0);\nconst only=!p.svg&&!p.customChart&&p.value===undefined&&p.kind!=='dashboard';$('data').open=only;$('data').toggleAttribute('data-only',only);controls();resize()}\nasync function loadCustom(result,p,box,rev){try{\nif(!globalThis.DbnCustomChartRuntime){\nconst runtime=await rpc('tools/call',{name:'load_custom_chart_runtime',arguments:{context:'tile'}});\nif(rev!==revision)return;\nconst code=runtime._meta?.['databrain/custom-chart-runtime'];\nif(runtime.isError||typeof code!=='string'||code.length>64000)throw Error('runtime unavailable');\nconst script=document.createElement('script');script.textContent=code;document.head.append(script);script.remove();\nif(!globalThis.DbnCustomChartRuntime)throw Error('runtime unavailable');\n}\nlet bundle=result._meta?.['databrain/custom-chart-bundle'];\nif(!bundle){let text='',offset=0,hash;\nfor(let chunks=0;chunks<${Math.ceil(MAX_CUSTOM_BUNDLE_CHARS / CUSTOM_BUNDLE_CHUNK_CHARS)};chunks++){\nconst r=await rpc('tools/call',{name:'load_custom_chart_bundle',arguments:{context:'tile',key:p.customChart.key,offset,...(hash?{contentHash:hash}:{})}});\nif(rev!==revision)return;\nif(r.isError)throw Error('unavailable');const part=r.structuredContent;\nif(!part||part.key!==p.customChart.key||part.offset!==offset||typeof part.chunk!=='string'||part.chunk.length>${CUSTOM_BUNDLE_CHUNK_CHARS}||!part.chunk.length)throw Error('invalid chunk');\nif(hash&&hash!==part.contentHash)throw Error('changed');hash=part.contentHash;text+=part.chunk;\nif(text.length>${MAX_CUSTOM_BUNDLE_CHARS})throw Error('too large');if(part.nextOffset===null){bundle=JSON.parse(text);break}\nif(part.nextOffset!==offset+part.chunk.length)throw Error('invalid offset');offset=part.nextOffset;\n}\n}\nif(rev!==revision)return;if(!bundle||bundle.manifest.id!==p.customChart.key)throw Error('invalid bundle');\ncustom=DbnCustomChartRuntime.mount(box,bundle,p.customChart,p.rows||[],message=>{if(rev!==revision)return;status(message,!!message);if(message){$('data').open=true;$('data').setAttribute('data-only','')}resize()});\n}catch{if(rev===revision){status(result._meta?.['databrain/custom-chart-bundle']?'Draft preview could not open. Check the bindings and sandbox support. The rows are below.':'Published custom chart unavailable, or this host cannot open its sandbox. The rows are below.',1);$('data').open=true;$('data').setAttribute('data-only','');resize()}}}\n$('refresh').onclick=()=>call('refresh_widget',{cursor:undefined});$('next').onclick=()=>call('render_chart',{cursor:next});\nfunction choose(names){const w=$('ws');w.replaceChildren();for(const n of names){const o=document.createElement('option');o.value=n;o.textContent=n;w.append(o)}$('wsrow').hidden=names.length<2;$('wsone').textContent=names.length===1?'in workspace '+names[0]:'';$('form').hidden=false;$('dtitle').focus();controls();resize()}\n$('save').onclick=()=>{attempt=crypto.randomUUID();$('dtitle').value=draft?.title||'';choose(draft?.workspaces||[])};\n$('cancel').onclick=()=>{$('form').hidden=true;status('');controls();resize()};\n$('commit').onclick=()=>{const t=$('dtitle').value.trim();if(!t){status('Name the dashboard.',1);return}\nrun('save_chart_as_dashboard',{draft,chartType:draft.chartType,dashboardTitle:t,workspaceName:$('wsrow').hidden?undefined:$('ws').value,attemptId:attempt,confirm:'APPLY_TO_PRODUCTION'})};\n$('expand').onclick=()=>display(context.displayMode==='fullscreen'?'inline':'fullscreen');\n$('dates').onclick=()=>{const from=$('from').value,to=$('to').value;if(!from||!to||from>to){status('Start date must not be after the end date.',1);return}call('change_date_range',{dateRange:{from,to},cursor:undefined,drillId:undefined})};\nfunction receive(event){if(event.source!==parent||closed)return;const m=event.data;\nif(!m||Array.isArray(m)||m.jsonrpc!=='2.0'||(origin!=='*'&&event.origin!==origin))return;\nif(!m.method&&pending.has(m.id)&&('result'in m||'error'in m)){if(origin==='*'&&event.origin!=='null')origin=event.origin;\nconst p=pending.get(m.id);pending.delete(m.id);clearTimeout(p.timer);\nif(m.error){const error=Error('host error');error.code=m.error.code;p.reject(error)}else p.resolve(m.result);return}\nif(m.method==='ping'&&m.id!==undefined){send({id:m.id,result:{}});return}\nif(m.method==='ui/resource-teardown'){send({id:m.id,result:{}});closed=true;revision++;custom?.dispose();custom=null;for(const p of pending.values()){clearTimeout(p.timer);p.reject(Error('closed'))}pending.clear();observer.disconnect();removeEventListener('message',receive);return}\nif(!ready||m.id!==undefined)return;\nlet slot=DASH.indexOf(m.method),kind='dashed';\nif(slot<0){slot=SNAKE.indexOf(m.method);kind='snake'}\nif(slot>=0){\n/* A dual host posts each notification twice. Lock to the first name and drop its twin:\n same payload, and a second render is a visible flicker. */\nif(!dialect)dialect=kind;if(dialect!==kind)return;\n// The snake result nests one level deeper.\nif(slot===0)render(kind==='snake'?m.params&&m.params.result:m.params);\nelse if(slot===1)wait();\nelse{host(m.params||{});resize()}\nreturn}\nif(m.method==='ui/notifications/tool-cancelled'){revision++;custom?.dispose();custom=null;busy=false;$('plot').dataset.state='off';status('Request cancelled.');controls()}}\naddEventListener('message',receive);const observer=new ResizeObserver(resize);observer.observe(document.body);controls();\nrpc('ui/initialize',{protocolVersion:'2026-01-26',appInfo:{name:'Databrain tile',version:'1.0.0'},appCapabilities:{availableDisplayModes:['inline','fullscreen']}})\n.then(r=>{if(r.protocolVersion!=='2026-01-26')throw Error('version');host(r.hostContext||{});ready=true;notify(INIT,{});resize()})\n.catch(()=>{trouble('initialize-failed');status('This chart needs an MCP Apps host.',1)});\n})();`;\n\n/** Compact the trusted bridge once, preserving the existing built-in result budget. */\nconst SERVED_SCRIPT = transformSync(TILE_SCRIPT, { minify: true, target: 'es2020' }).code;\nexport function tileHtml(kind: 'chart' | 'kpi' = 'chart'): string {\n return strip(`<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; font-src data:; connect-src 'none'; frame-src blob:; base-uri 'none'; form-action 'none'\">\n<title>Databrain ${kind} tile</title><style id=\"hostfont\"></style><style>\n/* Host tokens are the Claude MCP Apps style-variable names. Every one carries a fallback:\n hosts may ship any subset, so nothing here may depend on a token existing. */\n:root{color-scheme:light dark;\n--dbn-bg:var(--color-background-primary,Canvas);--dbn-text:var(--color-text-primary,CanvasText);\n--dbn-mute:var(--color-text-secondary,GrayText);--dbn-faint:var(--color-text-tertiary,GrayText);\n--dbn-edge:var(--color-border-secondary,color-mix(in srgb,currentColor 20%,transparent));\n--dbn-line:var(--color-border-tertiary,color-mix(in srgb,currentColor 9%,transparent));\n--dbn-accent:var(--color-text-info,LinkText);--dbn-ring:var(--color-ring-primary,var(--dbn-accent));\n--dbn-bad:var(--color-text-danger,var(--dbn-text));\n--dbn-quiet:color-mix(in srgb,currentColor 6%,transparent);\n--bw:var(--border-width-regular,1px);--r-s:var(--border-radius-sm,6px);--r-m:var(--border-radius-md,8px);\n--med:var(--font-weight-medium,500);--semi:var(--font-weight-semibold,600);--xs:var(--font-text-xs-size,12px);\n/* One curve. Quick / standard / display-mode. Corporate: no overshoot. */\n--e:cubic-bezier(.2,0,0,1);--q:120ms;--s:300ms;--l:400ms}\n*{box-sizing:border-box}\nbody{margin:0;padding:var(--safe-top,0px) var(--safe-right,0px) var(--safe-bottom,0px) var(--safe-left,0px);background:var(--dbn-bg);color:var(--dbn-text);\nfont:var(--font-text-sm-size,14px)/var(--font-text-sm-line-height,1.4) var(--font-sans,system-ui)}\nmain{padding:20px;max-width:1200px;margin:auto;transition:padding var(--l) var(--e)}\nheader{display:flex;align-items:start;justify-content:space-between;gap:12px}header>div{min-width:0}\n.acts{display:flex;gap:6px;flex:none;align-items:center}\nh1{font-size:var(--font-heading-md-size,18px);line-height:var(--font-heading-md-line-height,1.4);margin:0 0 6px;font-weight:var(--semi);letter-spacing:-.01em;overflow-wrap:anywhere;transition:font-size var(--l) var(--e)}\np{margin:6px 0;color:var(--dbn-mute);overflow-wrap:anywhere}\n#description{font-size:var(--xs);display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden;margin-top:2px}#description:empty{display:none}\nbutton,input,select{font:inherit;color:inherit;background:var(--dbn-bg);border:var(--bw) solid var(--dbn-edge);border-radius:var(--r-s);padding:7px 10px}\nbutton{cursor:pointer;transition:background-color var(--q) var(--e),border-color var(--q) var(--e)}\ninput{max-width:160px;min-width:0}button:hover:not(:disabled){background:var(--dbn-quiet)}button:disabled{color:var(--dbn-faint);cursor:default}\nbutton:focus-visible,input:focus-visible,summary:focus-visible{outline:2px solid var(--dbn-ring);outline-offset:2px}\n/* The picker is a scannable grid of quiet chips: 26 charts fit in nine rows, not a wall. */\n#choices[data-grid]{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:6px;margin-top:12px}\n#choices[data-grid] button{text-align:left;border-color:var(--dbn-line);padding:8px 10px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;min-width:0}\n#choices[data-grid] button:hover:not(:disabled){background:var(--dbn-quiet);border-color:var(--dbn-edge)}\n/* One primary per state: the drill pill, and Next page when there is a next page. */\n#choices button.primary,#next{flex:none;text-align:center;border:var(--bw) solid var(--dbn-accent);\nborder-radius:var(--r-s);padding:7px 10px;font-weight:var(--med);color:var(--dbn-accent)}\n#choices button.primary{align-self:flex-start;margin-top:10px}\n/* Refresh is a re-fetch, not a choice. Quiet it so it stops reading as a fifth chart. */\n#refresh{border-color:transparent;color:var(--dbn-mute);padding:7px 8px}\n#refresh:hover:not(:disabled){color:var(--dbn-text);background:none;text-decoration:underline}\n#status:empty{margin:0}\n#status[data-ok],#status[data-error]{font-weight:var(--med);border-left:2px solid;border-radius:0 var(--r-m) var(--r-m) 0;padding:10px 12px;margin:10px 0;background:color-mix(in srgb,currentColor 5%,transparent)}\n#status[data-ok]{color:var(--color-text-success,var(--dbn-text));border-color:var(--color-border-success,color-mix(in srgb,currentColor 40%,transparent))}\n/* \"Show as\": one row of quiet chips, the current type pressed. Never a second title. */\n#choices[data-chips]{flex-direction:row;flex-wrap:wrap;gap:6px;margin-top:10px}\n.chip{border-color:var(--dbn-line);border-radius:999px;padding:5px 11px;font-size:var(--xs);color:var(--dbn-mute)}\n.chip:hover:not(:disabled){color:var(--dbn-text);border-color:var(--dbn-edge)}\n.chip[aria-pressed=true]{color:var(--dbn-text);border-color:var(--dbn-text);background:var(--dbn-quiet)}\n/* Save is the one commit on a draft, so it is the one filled button in the tile. */\n#save,#commit{border-color:var(--dbn-accent);background:var(--dbn-accent);color:var(--dbn-bg);font-weight:var(--med)}\n#save:hover:not(:disabled),#commit:hover:not(:disabled){background:color-mix(in srgb,var(--dbn-accent) 85%,var(--dbn-text))}\n#form{margin-top:12px;padding:12px;border:var(--bw) solid var(--dbn-line);border-radius:var(--r-m);display:flex;flex-direction:column;gap:8px}\n[hidden]{display:none!important}#form label{flex-direction:column;align-items:stretch;gap:4px;font-size:var(--xs)}\n#form input,#form select{max-width:none;width:100%;background:color-mix(in srgb,currentColor 4%,var(--dbn-bg))}\n#wsone{color:var(--dbn-mute);font-size:var(--xs)}#wsone:empty{display:none}\n#status[data-error]{color:var(--dbn-bad);border-color:var(--color-border-danger,color-mix(in srgb,currentColor 40%,transparent));background:var(--color-background-danger,color-mix(in srgb,currentColor 5%,transparent))}\n/* Reserved plot. The skeleton is a static bar silhouette matching the 15:8 backend render:\n Claude's guidance asks for a skeleton that matches the final layout, and bans nothing here,\n but shimmer is banned by our own motion budget - so this paints once and never repaints. */\n#plot{position:relative;transition:opacity var(--q) var(--e)}#plot[data-busy],#plot[data-state=stale]{opacity:.55}\n#plot[data-state=wait]{aspect-ratio:15/8}\n#plot[data-state=wait]::before,#plot[data-state=ready]::before{content:'';position:absolute;pointer-events:none;inset:16% 6% 13%;\nborder-bottom:var(--bw) solid var(--dbn-line);transition:opacity var(--s) var(--e);\n--g:linear-gradient(var(--dbn-quiet),var(--dbn-quiet));background:var(--g) 0 100%/11% 44% no-repeat,var(--g) 22% 100%/11% 71% no-repeat,var(--g) 44% 100%/11% 57% no-repeat,var(--g) 66% 100%/11% 86% no-repeat,var(--g) 88% 100%/11% 33% no-repeat}\n#plot[data-state=ready]::before{opacity:0}\n.chart{position:relative;width:100%;margin:12px 0}.chart img{width:100%;height:100%;display:block}\n/* A point's geometry comes from the renderer and can be 8px; the hit area must not.\n ::after pads it to at least 24px; ::before is the marker that says \"you can pick this\". */\n.point{position:absolute;padding:0;border:0;background:transparent;border-radius:50%}\n.point::after{content:'';position:absolute;inset:-8px}\n.point::before{content:'';position:absolute;left:50%;top:50%;width:8px;height:8px;margin:-4px;border-radius:50%;\nbackground:var(--dbn-accent);box-shadow:0 0 0 2px var(--dbn-bg);opacity:0;transform:scale(.6);transition:opacity var(--q) var(--e),transform var(--q) var(--e)}\n.point:hover::before,.point:focus-visible::before{opacity:.7;transform:none}\n.point[aria-pressed=true]::before{opacity:1;transform:none;box-shadow:0 0 0 2px var(--dbn-bg),0 0 0 4px color-mix(in srgb,var(--dbn-accent) 35%,transparent)}\n.kpi{font-size:clamp(34px,10vw,44px);line-height:1.1;font-weight:var(--semi);letter-spacing:-.025em;font-variant-numeric:tabular-nums;color:var(--dbn-text);margin:14px 0 6px;transition:font-size var(--l) var(--e)}\n/* The readout rail. At rest it states the scope of what is on screen; on selection it\n becomes the value. One slot, two jobs, so selecting a bar never reflows the tile. */\n#rail{display:flex;align-items:center;min-height:2.5em;margin:2px 0 0}\n#scope,#value{margin:0;display:none;overflow-wrap:anywhere}\n#rail:not([data-value]) #scope{display:block;color:var(--dbn-mute);font-size:var(--xs)}\n#rail:not([data-value]):has(#scope:empty){display:none}\n#rail[data-value] #value{display:flex;flex-direction:column;gap:1px;line-height:1.15}\n#vlabel{color:var(--dbn-mute);font-size:var(--xs)}\n#vnum{font-size:var(--font-heading-md-size,18px);font-weight:var(--semi);letter-spacing:-.015em;font-variant-numeric:tabular-nums}\n[data-mode=full] #vnum{font-size:var(--font-heading-xl-size,24px)}\nfooter,.dates{display:flex;gap:8px;flex-wrap:wrap;align-items:center}\n#choices{display:flex;flex-direction:column;align-items:stretch;margin:10px 0 0}footer{margin-top:12px}footer:not(:has(button:not([hidden]))){display:none}.dates{margin:8px 0 2px}\nlabel{display:flex;align-items:center;gap:6px;color:var(--dbn-mute)}\n#range{margin-top:10px}#data{margin-top:2px}\nhtml:not([data-deep]) #range,html:not([data-deep]) #data:not([data-only]){display:none}\nsummary{cursor:pointer;color:var(--dbn-mute);font-size:var(--xs);padding:5px 0;width:fit-content;transition:color var(--q) var(--e)}summary:hover{color:var(--dbn-text)}\n#rows{overflow:auto;max-height:260px;border-radius:var(--r-s)}\ntable{border-collapse:collapse;width:100%;font-size:var(--xs)}\nth,td{text-align:left;padding:8px;border-bottom:var(--bw) solid var(--dbn-line);overflow-wrap:anywhere}\ntd.n,th.n{text-align:right;font-variant-numeric:tabular-nums}\nth{font-weight:var(--semi);position:sticky;top:0;background:var(--dbn-bg);color:var(--dbn-mute);\nfont-size:var(--xs);letter-spacing:.02em;text-transform:uppercase}\n/* Inline to fullscreen is a layout morph, not a new screen: main widens over 400ms on the\n one curve and every dependent box follows it. Fullscreen is the detailed view, so the\n table loses its inline height cap. */\n/* The SVG is rendered at 600x320 and scaled by width, so an unbounded fullscreen column\n makes the chart's own axis type larger than the tile's heading. Hold a measure. */\n[data-mode=full] main{padding:28px 32px;max-width:900px}\n[data-mode=full] h1{font-size:var(--font-heading-xl-size,24px);line-height:var(--font-heading-xl-line-height,1.25)}\n[data-mode=full] .kpi{font-size:clamp(44px,7vw,72px)}\n[data-mode=full] #rows{max-height:none}\n/* Touch: the host gives vertical pan to the conversation, so a nested scroller is a trap. */\n@media(pointer:coarse){button,input{min-height:44px}summary{padding:12px 0}#rows{max-height:none;overflow:visible}}\n@media(max-width:480px){main{padding:14px}}\n/* Entrance. Content first, chrome 60ms later: 300+60 = 360ms, inside the 400ms budget.\n No stagger past two groups - a chat tile that cascades reads as lag, not luxury. */\n@keyframes rise{from{opacity:0;transform:translateY(6px)}}\n@keyframes land{from{opacity:0;transform:translateY(4px) scale(.995)}}\nheader,#status,#plot{animation:rise var(--s) var(--e) both}\n#rail,#choices,footer,#range,#data{animation:rise var(--s) var(--e) 60ms both}\n.chart,.kpi{animation:land var(--s) var(--e) both}\n@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important;transition:none!important}}\n</style></head><body><main id=\"tile\"><header><div><h1 id=\"title\">Analytics</h1><p id=\"description\"></p></div><div class=\"acts\"><button id=\"refresh\" hidden>Refresh</button><button id=\"expand\" hidden>Expand</button></div></header>\n<p id=\"status\" role=\"status\">Loading chart…</p><div id=\"plot\" data-state=\"wait\"></div>\n<div id=\"rail\"><p id=\"scope\"></p><p id=\"value\"><span id=\"vlabel\"></span><b id=\"vnum\"></b></p></div><div id=\"choices\"></div>\n<footer><button id=\"save\" hidden>Save as dashboard</button><button id=\"next\" hidden>Next page</button></footer>\n<form id=\"form\" hidden onsubmit=\"return false\"><label>Dashboard name<input id=\"dtitle\" type=\"text\" maxlength=\"200\" autocomplete=\"off\"></label>\n<label id=\"wsrow\" hidden>Workspace<select id=\"ws\"></select></label><p id=\"wsone\"></p>\n<div class=\"dates\"><button id=\"commit\" type=\"button\">Save to Databrain</button><button id=\"cancel\" type=\"button\">Cancel</button></div></form>\n<details id=\"range\" hidden><summary>Change the date range</summary><div class=\"dates\"><label>From <input id=\"from\" type=\"date\"></label><label>To <input id=\"to\" type=\"date\"></label><button id=\"dates\" type=\"button\">Apply dates</button></div></details>\n<details id=\"data\" hidden><summary id=\"count\">Show the data behind this</summary><div id=\"rows\" tabindex=\"0\" role=\"region\" aria-label=\"Chart data\"></div></details></main><script>${SERVED_SCRIPT}</script></body></html>`);\n}\nfunction strip(html: string): string {\n return html.replace(/\\/\\*[\\s\\S]*?\\*\\//g, '').replace(/\\n{2,}/g, '\\n')\n .replace(/<style>([\\s\\S]*?)<\\/style><\\/head>/, (_m, css: string) => `<style>${css.replace(/;}/g, '}').replace(/\\n/g, '')}</style></head>`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAYlB,IAAM,SAAS,oBAAI,IAA+C;AAG3D,SAAS,0BAA0B,QAAmB,QAA+B;AAC1F,QAAM,UAAU,OAAO;AAAA,IAAK;AAAA,IAC1B;AAAA,IACA,CAAC;AAAA,IAAG;AAAA,IAAW,YAAY,QAAQ;AAAA,MAAE,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,gCAAgC,CAAC;AAAA,MAC7G,OAAO,EAAE,kCAAkC,8BAA8B,EAAE;AAAA,IAAE,CAAC;AAAA,EAAC;AACnF,UAAQ,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,QAAM,MAAM,IAAI,gBAAgB,MAAM;AACtC,QAAM,OAAO,OAAO;AAAA,IAAK;AAAA,IACvB;AAAA,IACA;AAAA,MAAE,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB;AAAA,MAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,uBAAuB,EAAE,QAAQ,CAAC;AAAA,MACxH,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,IAAE;AAAA,IAAG;AAAA,IAChE,OAAO,EAAE,KAAK,QAAQ,aAAa,SAAS,MAAM;AAChD,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,IAAI,GAAG;AAChC,YAAI,OAAO,WAAW,eAAe,CAAC,OAAO,mBAAoB,OAAM,IAAI,MAAM,eAAe;AAChG,cAAM,gBAAgB,OAAO,UAAU,KAAK,aAAW,QAAQ,OAAO,OAAO,kBAAkB,GAAG;AAClG,cAAM,SAAS,iBAAiB,iBAAiB,KAAK,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI;AACnG,YAAI,OAAO,eAAe,QAAQ,UAAU,OAAO,UAAU,KAAK,IAAI,IAAI,OAAO,OAAO;AACxF,YAAI,UAAU,QAAW;AACvB,gBAAM,MAAM,MAAM,IAAI,OAAO,KAAK,OAAO,kBAAkB;AAC3D,gBAAM,SAAS,EAAE,GAAG,KAAK,WAAW,IAAI,aAAa,OAAU;AAC/D,cAAI,eAAe,MAAM,EAAE,UAAU,OAAO,SAAS,OAAO,IAAK,OAAM,IAAI,MAAM,gBAAgB;AACjG,iBAAO,YAAY,MAAM;AACzB,cAAI,iBAAiB,kBAAkB,KAAM,OAAM,IAAI,MAAM,yBAAyB;AAEtF,kBAAQ,KAAK,UAAU,EAAE,UAAU,OAAO,UAAU,UAAU,OAAO,UAAU,WAAW,OAAO,aAAa,IAAI,SAAS,OAAO,QAAQ,CAAC;AAC3I,cAAI,OAAO,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,EAAE,KAAK,EAAE,KAAM;AAC/D,iBAAO,IAAI,MAAM,EAAE,MAAM,OAAO,SAAS,KAAK,IAAI,IAAI,IAAO,CAAC;AAAA,QAChE;AACA,YAAI,YAAY,SAAS,SAAU,OAAM,IAAI,MAAM,2BAA2B;AAC9E,YAAI,SAAS,MAAM,OAAQ,OAAM,IAAI,MAAM,QAAQ;AACnD,cAAM,QAAQ,MAAM,MAAM,QAAQ,SAAS,yBAAyB;AACpE,eAAO,QAAQ;AAAA,UAAE,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,sCAAsC,CAAC;AAAA,UAC/F,mBAAmB;AAAA,YAAE;AAAA,YAAK,aAAa;AAAA,YAAM;AAAA,YAAQ;AAAA,YACnD,YAAY,SAAS,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS;AAAA,UAAK;AAAA,QAAE,CAAC;AAAA,MACzF,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM,mCAAmC,GAAG;AAAA,QAAoE,CAAC,EAAE;AAAA,MACvH;AAAA,IACF;AAAA,EAAC;AACH,OAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC;;;ACvDA,SAAS,KAAAA,UAAS;;;ACIX,IAAM,cAAc;AAM3B,IAAM,sBAAN,cAAkC,gBAAgB;AAAA,EAChD,YAA6B,UAA2B;AACtD,UAAM,EAAE,QAAQ,SAAS,UAAU,GAAG,YAAY,SAAS,cAAc,EAAE,CAAC;AADjD;AAAA,EAE7B;AAAA,EACS,QAAW,SAAqC;AACvD,WAAO,KAAK,SAAS,QAAW,EAAE,GAAG,SAAS,UAAU,QAAW,YAAY,OAAU,CAAC;AAAA,EAC5F;AACF;AAGO,SAAS,mBAAmB,QAAuC;AAExE,QAAM,WAAW,oBAAoB,IAAI,oBAAoB,MAAM,CAAC;AACpE,SAAO;AAAA,IACL,MAAM,QAAQ,QAAQ,cAAc,SAAS;AAC3C,YAAM,YAAY,gBAAgB,MAAM,YAAY;AACpD,YAAM,OAAO,WAAW,MAAM,OAAO;AAErC,YAAM,MAAM,MAAM,SAAS,cAAc,mBAAmB,QAAW,UAAU,OAAO;AACxF,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB;AACtD,YAAM,QAAQ,MAAM,SAAS,cAAc,6BAA6B;AAAA,QACtE,SAAS,UAAU;AAAA,QAAS,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,MAAM,CAAC;AACpF,UAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,oBAAoB;AACnD,YAAM,EAAE,MAAM,IAAI,MAAM,SAAS,kBAAkB,cAAc;AAAA,QAC/D,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,QAAO,eAAe,CAAC,UAAU,OAAO;AAAA,QACvF,aAAa;AAAA,UAAE,yBAAyB;AAAA,UAAM,uBAAuB;AAAA,UACnE,wBAAwB;AAAA,UAAO,wBAAwB;AAAA,QAAM;AAAA,MACjE,CAAC;AACD,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yBAAyB;AACrD,YAAM,OAAO,MAAM,OAAO,QAAiB;AAAA,QACzC,QAAQ;AAAA,QAAQ,MAAM;AAAA,QAAa,MAAM;AAAA,QAAQ;AAAA,QACjD,MAAM;AAAA,UAAE;AAAA,UAAQ,SAAS,UAAU;AAAA,UAAS,UAAU,UAAU;AAAA,UAAU,GAAG;AAAA,UAC3E,UAAU;AAAA,UAAI,OAAO;AAAA,UAAK,QAAQ;AAAA,UAAK,WAAW;AAAA,QAAM;AAAA,QAC1D,gBAAgB;AAAA,MAClB,CAAC;AACD,aAAO,WAAW,MAAM,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;;;ACjDA,SAAS,qBAAqB;AAIvB,IAAM,cAAc,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAmIR,KAAK,KAAK,0BAA0B,yBAAyB,CAAC;AAAA;AAAA;AAAA;AAAA,gHAIwB,yBAAyB;AAAA;AAAA,iBAExH,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0CxC,IAAM,gBAAgB,cAAc,aAAa,EAAE,QAAQ,MAAM,QAAQ,SAAS,CAAC,EAAE;AAC9E,SAAS,SAAS,OAAwB,SAAiB;AAChE,SAAO,MAAM;AAAA;AAAA,mBAEI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oLA4H6J,aAAa,yBAAyB;AAC1N;AACA,SAAS,MAAM,MAAsB;AACnC,SAAO,KAAK,QAAQ,qBAAqB,EAAE,EAAE,QAAQ,WAAW,IAAI,EACjE,QAAQ,sCAAsC,CAAC,IAAI,QAAgB,UAAU,IAAI,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE,CAAC,iBAAiB;AAC7I;;;AF5SA,IAAM,UAAuC;AAAA,EAC3C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AACrB;AAGO,SAAS,kBAAkB,QAAmB,QAAyB,UAAwB,mBAAmB,MAAM,GAAS;AACtI,aAAW,CAAC,MAAM,WAAW,KAAK,OAAO,QAAQ,OAAO,GAAG;AACzD,UAAM,SAAS;AACf,UAAM,OAAO,OAAO,KAAK,MAAM,aAAa;AAAA,MAC1C,WAAW;AAAA,MAAiB,MAAM,WAAW,QAAQ,CAAC,CAAC;AAAA,MACvD,SAASC,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAC9E,GAAG,WAAW,OAAO,EAAE,WAAW,KAAK,MAAM;AAC3C,UAAI;AACF,YAAK,WAAW,gBAAgB,CAAC,KAAK,WAAa,WAAW,uBAAuB,CAAC,KAAK,UAAY,OAAM,IAAI,MAAM,uBAAuB;AAC9I,cAAM,OAAO,WAAW,MAAM,MAAM,YAAY;AAAA,UAAI,EAAE,MAAM,MAAM,UAAU,aAAa,gBAAgB,aAAa,WAAW,MAAM;AAAA,UACrI,MAAM,QAAQ,QAAQ,QAAQ,WAAW,IAAI;AAAA,QAAC,CAAC;AAGjD,YAAI,KAAK,QAAQ,CAAC,cAAc,KAAK,KAAK,GAAG,KAC3C,kLAAkL,KAAK,KAAK,GAAG,IAAI;AACnM,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AACA,eAAO,YAAY,GAAG,KAAK,SAAS,QAAQ,QAAQ,OAAO,WAAW,KAAK,KAAK,MAAM,sBAAsB,KAAK,WAAW,MAAM,KAAK,WAAW,EAAE,IAAK;AAAA,UACvJ,GAAG;AAAA,UAAM;AAAA,UAAW;AAAA,QACtB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM;AAAA,QAA4F,CAAC,EAAE;AAAA,MACzG;AAAA,IACF,CAAC;AACD,SAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,EACzC;AACA,qBAAmB,QAAQ,MAAM;AACjC,4BAA0B,QAAQ,MAAM;AACxC,aAAW,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,WAAW,OAAO,GAAG,CAAC,SAAS,KAAK,CAAC,GAAY;AAC3E,WAAO,SAAS,aAAa,IAAI,SAAS,KAAK,EAAE,UAAU,UAAU,aAAa,eAAe,IAAI,4CAA4C,GAAG,aAAa;AAAA,MAC/J,UAAU,CAAC,EAAE,KAAK,UAAU,UAAU,MAAM,SAAS,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,eAAe,MAAM,KAAK,EAAE,iBAAiB,CAAC,SAAS,OAAO,GAAG,cAAc,CAAC,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;AAAA,IACjM,EAAE;AAAA,EACJ;AACF;AAKA,SAAS,mBAAmB,QAAmB,QAA+B;AAC5E,QAAM,UAAU,OAAO;AAAA,IAAK;AAAA,IAC1B;AAAA,IACA;AAAA,MAAE,OAAO;AAAA,MAAa,MAAM;AAAA,MAAY,WAAWA,GAAE,KAAK,YAAY;AAAA,MACpE,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAAE;AAAA,IAChF;AAAA,IAAW,OAAO,EAAE,OAAO,MAAM,UAAU,MAAM;AAC/C,UAAI;AACF,cAAM,OAAO,MAAM,UAAU,QAAQ,OAAO,MAAM,SAAS;AAC3D,eAAO,YAAY,GAAG,KAAK,SAAS,UAAU,UAAU,OAAO,aAAa,SAAS,KAAK,IAAI;AAAA,MAChG,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,8DAA8D,CAAC,EAAE;AAAA,MACpI;AAAA,IACF;AAAA,EAAC;AACH,UAAQ,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAE1C,QAAM,OAAO,OAAO;AAAA,IAAK;AAAA,IACvB,6IACwC,gCAAgC;AAAA,IAExE;AAAA,MAAE,OAAO;AAAA,MAAa,WAAWA,GAAE,KAAK,YAAY;AAAA,MAClD,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAChD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC1D,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAClD,SAAS,oGAAoG;AAAA,MAChH,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC7B,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAAE;AAAA,IAChF;AAAA,IAAc,OAAO,EAAE,OAAO,WAAW,gBAAgB,eAAe,WAAW,QAAQ,MAAM;AAC/F,UAAI,YAAY,kCAAkC;AAChD,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM,qDAAqD,gCAAgC;AAAA,QAAK,CAAC,EAAE;AAAA,MACvG;AAGA,YAAM,UAAU,MAAM,sBAAsB,QAAQ,MAAM,cAAc,WAAW;AACnF,YAAM,SAAS,CAAC,UAAkB;AAAA,QAAE,SAAS;AAAA,QAAM,SAAS,CAAC,EAAE,MAAM,QAAiB,KAAK,CAAC;AAAA,QAC1F,mBAAmB,EAAE,MAAM,QAAQ,IAAI,OAAO,QAAQ;AAAA,MAAE;AAE1D,YAAM,SAAS,gBACX,QAAQ,KAAK,OAAK,EAAE,KAAK,EAAE,YAAY,MAAM,cAAc,YAAY,CAAC,IACxE,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AACxC,UAAI,iBAAiB,CAAC,QAAQ;AAC5B,eAAO,OAAO,cAAc,aAAa,oDAAoD,QAAQ,KAAK,IAAI,CAAC,GAAG;AAAA,MACpH;AACA,UAAI,CAAC,QAAQ;AACX,eAAO,OAAO,QAAQ,SAClB,uBAAuB,QAAQ,KAAK,IAAI,CAAC,MACzC,sCAAsC,MAAM,YAAY,8CAA8C;AAAA,MAC5G;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,qBAAqB,QAAQ,OAAO,EAAE,WAAW,gBAAgB,eAAe,QAAQ,UAAU,CAAC;AACvH,eAAO;AAAA,UAAY,UAAU,MAAM,KAAK,kBAAkB,MAAM,aAAa,eAAe,MAAM,WAAW,YAAY,MAAM,QAAQ;AAAA,UACrI,EAAE,MAAM,QAAQ,IAAI,MAAM,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,QAAC;AAAA,MACxE,SAAS,OAAO;AACd,cAAM,OAAO,iBAAiB,oBAAoB,MAAM,OAAO;AAC/D,eAAO;AAAA,UAAE,SAAS;AAAA,UAAM,SAAS,CAAC;AAAA,YAAE,MAAM;AAAA,YACxC,MAAM,mBAAmB,IAAI;AAAA,UAA+D,CAAC;AAAA,UAC7F,mBAAmB,EAAE,MAAM,QAAQ,IAAI,OAAO,KAAK;AAAA,QAAE;AAAA,MACzD;AAAA,IACF;AAAA,EAAC;AACH,OAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;AAClD;","names":["z","z"]}
package/dist/chunk-RHK62ZJ6.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/utils/errors.ts","../src/utils/logger.ts","../package.json","../src/version.ts","../src/custom-chart/studio.ts","../src/utils/cache.ts","../src/client/error-body.ts","../src/utils/tool-context.ts","../src/client/oauth-client-credentials.ts","../src/client/databrain-client.ts","../src/api/custom-charts-api.ts","../src/custom-chart/api.ts","../src/custom-chart/scaffold.ts"],"sourcesContent":["export class DatabrainApiError extends Error {\n constructor(\n public readonly status: number,\n public readonly code: string,\n message: string,\n public readonly details?: unknown,\n /** The server's own next step for this error class, when it sent one. */\n public readonly serverHint?: string,\n public readonly retryable?: boolean,\n ) {\n super(message);\n this.name = 'DatabrainApiError';\n }\n\n toToolResponse(): { content: Array<{ type: 'text'; text: string }>; isError: true } {\n const parts = [`Error: ${this.message}`];\n const detailDump = this.formatDetails();\n if (detailDump) parts.push(detailDump);\n const hint = this.serverHint ? `Hint: ${this.serverHint}` : this.hint();\n if (hint) parts.push(hint);\n return {\n content: [{ type: 'text', text: parts.join('\\n\\n') }],\n isError: true,\n };\n }\n\n /**\n * Surface API-returned details for 4xx errors so the LLM can recover or\n * report the real reason (validation messages, field names, etc.). Skips\n * fields already collapsed into `message`/`code`, and skips 5xx where the\n * payload usually isn't actionable.\n */\n private formatDetails(): string {\n if (this.status < 400 || this.status >= 500) return '';\n if (!this.details || typeof this.details !== 'object') return '';\n\n const skipKeys = new Set(['message', 'detail', 'error', 'code', 'data', 'hint', 'retryable']);\n const extra: Record<string, unknown> = {};\n for (const [k, v] of Object.entries(this.details as Record<string, unknown>)) {\n if (skipKeys.has(k)) continue;\n if (v === null || v === undefined) continue;\n extra[k] = v;\n }\n if (Object.keys(extra).length === 0) return '';\n try {\n return `API details: ${JSON.stringify(extra)}`;\n } catch {\n return '';\n }\n }\n\n private hint(): string {\n // dashboard_snapshot: the API's own reasons, so the generic status hints below do not mislead.\n if (this.code === 'OAUTH_SIGN_IN_REQUIRED') {\n return 'Hint: Snapshots draw as a signed-in Databrain user. Connect this AI app with a Databrain sign-in (the hosted connector, or /mcp in Claude Code); a service token cannot take them.';\n }\n if (this.code === 'RENDER_IN_PROGRESS') {\n return 'Hint: Your other snapshot is still rendering. Wait a few seconds, then call the tool again.';\n }\n if (this.code === 'SNAPSHOT_TIMEOUT' || this.code === 'SNAPSHOT_TOO_LARGE') {\n return 'Hint: Ask for one chart with metricId, or a smaller width.';\n }\n if (this.code === 'UNAUTHORIZED_ORIGIN') {\n return 'Hint: The embed origin is not on the allowed domains list. Add the domain to the allowed domains in the Databrain settings; the token itself is fine.';\n }\n if (this.status === 401 || this.status === 403) {\n if (this.code === 'OAUTH_API_ERROR') {\n return 'Hint: Check that the backend accepts the configured OAuth issuer and resource, and that the service principal has permission for this operation. Static fallback applies only to token acquisition failures.';\n }\n if (\n this.code === 'INVALID_SERVICE_TOKEN' ||\n this.code === 'MISSING_SERVICE_TOKEN' ||\n this.message.toLowerCase().includes('service token')\n ) {\n return 'Hint: The service token (DATABRAIN_SERVICE_TOKEN) is invalid, expired, or missing. It must be set in the MCP server config (not at runtime). Check Settings > Service Tokens in the Databrain UI.';\n }\n return 'Hint: The per-data-app API token is invalid or expired. Use `create_api_token` to generate a new one. Do not ask the user — manage tokens via MCP tools.';\n }\n if (this.status === 400) {\n return 'Hint: The request was invalid. Check parameter values match expected types and formats. Use the corresponding list tool to verify IDs and names.';\n }\n if (this.status === 404) {\n return 'Hint: The requested resource was not found. Verify the ID or name is correct using the corresponding list tool.';\n }\n if (this.status === 409) {\n return 'Hint: A resource with this name already exists. Use a different name or list existing resources first.';\n }\n if (this.status === 422) {\n return 'Hint: The request parameters are invalid. Check the required fields and their formats.';\n }\n if (this.status === 429) {\n return 'Hint: API rate limit reached. Wait a moment and try again.';\n }\n if (this.status >= 500) {\n return 'Hint: The Databrain API is experiencing issues. Try again in a few moments.';\n }\n return '';\n }\n}\n\nexport function toolError(message: string): { content: Array<{ type: 'text'; text: string }>; isError: true } {\n return {\n content: [{ type: 'text', text: message }],\n isError: true,\n };\n}\n\nexport function stringify(value: unknown): string {\n if (typeof value === 'string') return value;\n try {\n return JSON.stringify(value, null, 2);\n } catch {\n return String(value);\n }\n}\n\nexport function toolSuccess(text: string): { content: Array<{ type: 'text'; text: string }> } {\n return {\n content: [{ type: 'text', text }],\n };\n}\n","const LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 } as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\nconst currentLevel: LogLevel =\n (process.env.DATABRAIN_LOG_LEVEL as LogLevel) || 'warn';\n\n/**\n * Credentials the process holds. Every log line is scrubbed of them before it\n * reaches stderr, because an API error body can quote the Authorization\n * header back and stderr is a terminal, a CI log or the MCP host's log.\n */\nconst secrets = new Set<string>();\n\nexport function registerSecret(value: string | undefined | null): void {\n if (typeof value === 'string' && value.length >= 8) secrets.add(value);\n}\n\nexport function redactSecrets(text: string): string {\n let out = text;\n for (const secret of secrets) out = out.split(secret).join('[redacted]');\n return out;\n}\n\nfunction log(level: LogLevel, message: string, data?: unknown): void {\n if (LOG_LEVELS[level] < LOG_LEVELS[currentLevel]) return;\n const line = `[databrain-mcp] [${level.toUpperCase()}] ${message}`;\n const text = data !== undefined ? `${line} ${JSON.stringify(data)}` : line;\n process.stderr.write(`${redactSecrets(text)}\\n`);\n}\n\nexport const logger = {\n debug: (msg: string, data?: unknown) => log('debug', msg, data),\n info: (msg: string, data?: unknown) => log('info', msg, data),\n warn: (msg: string, data?: unknown) => log('warn', msg, data),\n error: (msg: string, data?: unknown) => log('error', msg, data),\n};\n","{\n \"name\": \"@databrainhq/mcp-server\",\n \"mcpName\": \"com.usedatabrain/mcp-server\",\n \"version\": \"0.3.0-rc.11\",\n \"description\": \"MCP server for Databrain embedded analytics - connect databases, create datamarts, configure embeds, and generate frontend code\",\n \"type\": \"module\",\n \"bin\": {\n \"mcp-server\": \"dist/index.js\",\n \"databrain-mcp-server\": \"dist/index.js\",\n \"databrain-mcp-chart-apps\": \"dist/apps/stdio.js\",\n \"databrain\": \"dist/cli.js\"\n },\n \"main\": \"dist/index.js\",\n \"types\": \"dist/index.d.ts\",\n \"files\": [\n \"dist\",\n \"skills\",\n \".claude-plugin\",\n \".mcp.json\"\n ],\n \"scripts\": {\n \"build\": \"tsup && node scripts/copy-custom-chart-assets.mjs\",\n \"dev\": \"tsx src/index.ts\",\n \"test\": \"vitest run\",\n \"test:watch\": \"vitest\",\n \"test:live\": \"vitest run tests/integration/prompt-flows.test.ts\",\n \"lint\": \"tsc --noEmit\",\n \"prepublishOnly\": \"npm run build\"\n },\n \"keywords\": [\n \"mcp\",\n \"databrain\",\n \"embedded-analytics\",\n \"ai\",\n \"model-context-protocol\"\n ],\n \"license\": \"MIT\",\n \"dependencies\": {\n \"@modelcontextprotocol/sdk\": \"^1.32.1\",\n \"@posthog/mcp\": \"^0.10.7\",\n \"esbuild\": \"0.27.3\",\n \"fflate\": \"0.8.3\",\n \"posthog-node\": \"^5.21.2\",\n \"yaml\": \"^2.9.1\",\n \"zod\": \"^3.24.0\"\n },\n \"devDependencies\": {\n \"@types/node\": \"^25.3.5\",\n \"tsup\": \"^8.4.0\",\n \"tsx\": \"^4.19.0\",\n \"typescript\": \"^5.7.0\",\n \"vitest\": \"^3.0.0\"\n },\n \"publishConfig\": {\n \"access\": \"public\"\n },\n \"repository\": {\n \"type\": \"git\",\n \"url\": \"git+https://github.com/databrainhq/mcp-server.git\"\n },\n \"engines\": {\n \"node\": \">=18.0.0\"\n }\n}\n","import packageJson from '../package.json';\n\n// tsup embeds this package.json value in dist while tsx resolves the same file\n// during development. The handshake and request headers therefore share the\n// package version without maintaining a second release string.\nexport const MCP_SERVER_VERSION = packageJson.version;\n","import { z } from 'zod';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { DatabrainApiError } from '../utils/errors.js';\n\nconst studioCell = z.union([z.string().max(4096), z.number().finite(), z.boolean(), z.null()]);\nexport const studioDraftSchema = z.object({\n code: z.string().max(64_000), css: z.string().max(32_000), manifest: z.record(z.unknown()),\n sampleData: z.object({ columns: z.array(z.object({ id: z.string(), label: z.string(),\n type: z.enum(['string', 'number', 'boolean']), slotId: z.string().optional() }).strict()).max(64),\n rows: z.array(z.array(studioCell)).max(200) }).strict(),\n name: z.string().max(256), description: z.string().max(500), iconSvg: z.string().max(16_384),\n}).strict();\nexport type StudioDraft = z.infer<typeof studioDraftSchema>;\n\n/** Accept only the studio's domain result, never general SSE data or credentials. */\nexport function parseStudioStream(text: string): { draft?: StudioDraft; sessionId?: string; applied: boolean } {\n if (text.length > 4 * 1024 * 1024) throw new Error('Studio stream too large');\n let draft: StudioDraft | undefined;\n let sessionId: string | undefined;\n let failure = false;\n for (const frame of text.split(/\\r?\\n\\r?\\n/)) {\n const line = frame.split(/\\r?\\n/).filter(l => l.startsWith('data:')).map(l => l.slice(5).trimStart()).join('\\n');\n if (!line || line === '[DONE]') continue;\n const event = JSON.parse(line);\n if (event.type === 'session' && typeof event.sessionId === 'string') sessionId = event.sessionId;\n if (event.type === 'error') failure = true;\n if (event.type === 'tool_execution_end' && event.name === 'update_custom_chart' &&\n event.status === 'completed' && event.result?.kind === 'applied') {\n draft = studioDraftSchema.parse(event.result.draft);\n }\n }\n if (failure && !draft) throw new Error('Bryn did not complete an edit');\n return { draft, sessionId, applied: !!draft };\n}\n\n/** Only absence permits the old authoring path. An auth denial or outage is not absence. */\nexport async function editWithBryn(client: DatabrainClient, input: {\n key: string; workspaceId: string; message: string; draft: StudioDraft; sessionId?: string;\n}): Promise<{ available: boolean; draft: StudioDraft; sessionId?: string; applied: boolean }> {\n // Bryn requires a signed-in session. A stdio service token is still valid for\n // the existing authoring API; do not send it to a session-only route.\n if (!client.isHosted()) return { available: false, draft: input.draft, applied: false };\n try {\n const result = await client.request<ReturnType<typeof parseStudioStream>>({\n method: 'POST', path: `/api/v2/custom-charts/${encodeURIComponent(input.key)}/bryn/turn`, auth: 'service',\n body: { workspaceId: input.workspaceId, message: input.message, draft: input.draft,\n sessionId: input.sessionId, mode: 'build', viewingOldVersion: false },\n responseFormat: 'studio-sse', timeoutMs: 180_000, noRetryOnTimeout: true,\n });\n return { available: true, draft: result.draft ?? input.draft, applied: result.applied, sessionId: result.sessionId };\n } catch (error) {\n if (error instanceof DatabrainApiError && error.status === 404) {\n return { available: false, draft: input.draft, applied: false };\n }\n throw error;\n }\n}\n","interface CacheEntry<T> {\n value: T;\n expiresAt: number;\n}\n\nexport class TtlCache {\n private store = new Map<string, CacheEntry<unknown>>();\n\n get<T>(key: string): T | undefined {\n const entry = this.store.get(key);\n if (!entry) return undefined;\n if (Date.now() > entry.expiresAt) {\n this.store.delete(key);\n return undefined;\n }\n return entry.value as T;\n }\n\n set<T>(key: string, value: T, ttlMs: number): void {\n this.store.set(key, { value, expiresAt: Date.now() + ttlMs });\n }\n\n invalidateByPrefix(prefix: string): void {\n for (const key of this.store.keys()) {\n if (key.startsWith(prefix)) {\n this.store.delete(key);\n }\n }\n }\n\n clear(): void {\n this.store.clear();\n }\n}\n","/**\n * Reads a Databrain error body into one shape. The backend sends the same\n * envelope `{ code, message, hint, retryable, details }` in three places:\n * flat (`{ code, message }`), under `error` (public REST, datasource API) and\n * under `data.error` (the externalApis routes, which also send `error` as a\n * plain string). Reading only the flat form dropped the code and hint.\n */\nexport interface ParsedErrorBody {\n code?: string;\n message?: string;\n hint?: string;\n retryable?: boolean;\n details?: unknown;\n}\n\nconst isRecord = (v: unknown): v is Record<string, unknown> =>\n typeof v === 'object' && v !== null && !Array.isArray(v);\n\nconst str = (v: unknown): string | undefined =>\n typeof v === 'string' && v.trim() ? v : undefined;\n\nconst fromEnvelope = (v: unknown): ParsedErrorBody | undefined => {\n if (!isRecord(v)) return undefined;\n const out: ParsedErrorBody = {\n code: str(v.code),\n message: str(v.message) ?? str(v.detail),\n hint: str(v.hint),\n retryable: typeof v.retryable === 'boolean' ? v.retryable : undefined,\n details: v.details,\n };\n return out.code || out.message || out.hint ? out : undefined;\n};\n\nexport function parseErrorBody(body: unknown): ParsedErrorBody {\n if (!isRecord(body)) return {};\n const nested =\n fromEnvelope(isRecord(body.data) ? body.data.error : undefined) ??\n fromEnvelope(body.error) ??\n fromEnvelope(body);\n if (nested) {\n return { ...nested, message: nested.message ?? str(body.error) };\n }\n return { message: str(body.error) };\n}\n","import { AsyncLocalStorage } from 'node:async_hooks';\n\n/**\n * Per-tool-call intent metadata. Set when an MCP tool handler runs (see\n * registerAllTools, which wraps every handler), and read by DatabrainClient to\n * tag outbound API requests with X-Databrain-MCP-* headers. The backend\n * (mcpTracking) records these so usage can be attributed to a specific tool and\n * workflow intent — letting us see, e.g., embedding vs internal-analytics flows.\n */\nexport interface ToolCallContext {\n /** The MCP tool name being executed, e.g. 'create_workspace_metric'. */\n tool: string;\n /** Coarse domain bucket, e.g. 'embedding' | 'internal_analytics'. */\n category: string;\n /** Use-case bucket, e.g. 'sql_to_workspace_metric'. */\n workflowIntent: string;\n /** How the request was initiated; 'tool_call' for MCP tool invocations. */\n inputMode: string;\n}\n\nexport const toolContext = new AsyncLocalStorage<ToolCallContext>();\n","import { z } from 'zod';\n\n// Validate without transforming: issuer identity uses exact string comparison.\nexport const oauthHttpsUrl = z.string().refine(value => {\n try {\n const url = new URL(value);\n return url.protocol === 'https:' && !url.username && !url.password && !url.hash;\n } catch { return false; }\n}, 'OAuth URLs must use HTTPS without userinfo or fragments');\n\nexport const oauthConfigSchema = z.object({\n issuer: oauthHttpsUrl.refine(value => {\n try { return !new URL(value).search; } catch { return false; }\n }, 'OAuth issuer must not contain a query'),\n clientId: z.string().min(1),\n clientSecret: z.string().min(1),\n resource: oauthHttpsUrl,\n scope: z.string().min(1).optional(),\n authMethod: z.enum(['client_secret_basic', 'client_secret_post']).default('client_secret_basic'),\n});\n\nexport type OAuthConfig = z.infer<typeof oauthConfigSchema>;\n\nconst metadataSchema = z.object({\n issuer: z.string(),\n token_endpoint: oauthHttpsUrl,\n token_endpoint_auth_methods_supported: z.array(z.string()).optional(),\n grant_types_supported: z.array(z.string()).optional(),\n});\nconst tokenSchema = z.object({\n access_token: z.string().regex(/^[A-Za-z0-9\\-._~+/]+=*$/),\n token_type: z.string().refine(value => value.toLowerCase() === 'bearer'),\n expires_in: z.number().finite().positive().optional(),\n});\n\nconst TOKEN_TIMEOUT_MS = 10_000;\nconst FAILURE_COOLDOWN_MS = 30_000;\nconst MAX_REFRESH_SKEW_MS = 60_000;\n\nfunction authError(): Error {\n // Never retain an IdP body, a fetch error, or a schema error as a cause:\n // those can contain credentials and are serialized by callers/telemetry.\n return new Error('OAuth token acquisition failed. Check the configured issuer, client credentials, resource and scopes.');\n}\n\n/** One immutable credential/issuer/resource binding per MCP process client. */\nexport class OAuthClientCredentials {\n private readonly config: OAuthConfig;\n private tokenEndpoint?: string;\n private cached?: { value: string; renewAt: number };\n private pending?: Promise<string>;\n private retryAt = 0;\n\n constructor(config: OAuthConfig) {\n // Also validate programmatic callers; do not expose invalid values in errors.\n const parsed = oauthConfigSchema.safeParse(config);\n if (!parsed.success) throw authError();\n this.config = Object.freeze(parsed.data);\n }\n\n getStatus(): 'configured' | 'ready' | 'unavailable' {\n if (this.cached && Date.now() < this.cached.renewAt) return 'ready';\n if (this.retryAt > 0) return 'unavailable';\n return 'configured';\n }\n\n async getToken(): Promise<string> {\n if (this.cached && Date.now() < this.cached.renewAt) return this.cached.value;\n if (this.pending) return this.pending;\n if (Date.now() < this.retryAt) throw authError();\n\n this.cached = undefined;\n this.pending = this.acquire().catch(() => {\n this.retryAt = Date.now() + FAILURE_COOLDOWN_MS;\n throw authError();\n }).finally(() => { this.pending = undefined; });\n return this.pending;\n }\n\n private async discoverTokenEndpoint(signal: AbortSignal): Promise<string> {\n if (this.tokenEndpoint) return this.tokenEndpoint;\n const issuer = new URL(this.config.issuer);\n const path = issuer.pathname.replace(/\\/$/, '');\n const candidates = [...new Set([\n `${issuer.origin}/.well-known/oauth-authorization-server${path}`,\n `${issuer.origin}/.well-known/openid-configuration${path}`,\n `${issuer.origin}${path}/.well-known/openid-configuration`,\n ])];\n\n for (const url of candidates) {\n // No credentials, cookies, API headers, or redirects during discovery.\n const response = await fetch(url, {\n headers: { Accept: 'application/json' }, redirect: 'error', signal,\n });\n if (response.status === 404 || response.status === 405) continue;\n if (!response.ok) throw authError();\n const metadata = metadataSchema.parse(await response.json());\n if (metadata.issuer !== this.config.issuer) throw authError();\n const methods = metadata.token_endpoint_auth_methods_supported ?? ['client_secret_basic'];\n if (!methods.includes(this.config.authMethod)) throw authError();\n if (metadata.grant_types_supported && !metadata.grant_types_supported.includes('client_credentials')) {\n throw authError();\n }\n this.tokenEndpoint = metadata.token_endpoint;\n return this.tokenEndpoint;\n }\n throw authError();\n }\n\n private async acquire(): Promise<string> {\n // One time budget covers all discovery attempts and token acquisition.\n const signal = AbortSignal.timeout(TOKEN_TIMEOUT_MS);\n const endpoint = await this.discoverTokenEndpoint(signal);\n const body = new URLSearchParams({\n grant_type: 'client_credentials', resource: this.config.resource,\n });\n if (this.config.scope) body.set('scope', this.config.scope);\n const headers: Record<string, string> = {\n Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded',\n };\n if (this.config.authMethod === 'client_secret_post') {\n body.set('client_id', this.config.clientId);\n body.set('client_secret', this.config.clientSecret);\n } else {\n // RFC 6749 2.3.1: form-encode EACH value before constructing Basic auth.\n const encode = (value: string) => new URLSearchParams({ value }).toString().slice(6);\n headers.Authorization = `Basic ${Buffer.from(`${encode(this.config.clientId)}:${encode(this.config.clientSecret)}`).toString('base64')}`;\n }\n\n const startedAt = Date.now();\n const response = await fetch(endpoint, {\n method: 'POST', headers, body: body.toString(), redirect: 'error', signal,\n });\n if (!response.ok) throw authError();\n const token = tokenSchema.parse(await response.json());\n if (token.expires_in !== undefined) {\n const lifetimeMs = token.expires_in * 1000;\n const expiresAt = startedAt + lifetimeMs;\n if (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) throw authError();\n this.cached = {\n value: token.access_token,\n renewAt: expiresAt - Math.min(MAX_REFRESH_SKEW_MS, lifetimeMs * 0.1),\n };\n }\n // With no expires_in, use the token for this call only. No JWT decoding,\n // assumed lifetime, refresh_token grant, disk storage, or background timer.\n this.retryAt = 0;\n return token.access_token;\n }\n}\n","import { parseStudioStream } from '../custom-chart/studio.js';\nimport { TtlCache } from '../utils/cache.js';\nimport type { Config } from '../utils/config.js';\nimport { DatabrainApiError } from '../utils/errors.js';\nimport { logger, registerSecret } from '../utils/logger.js';\nimport type { RequestOptions } from './types.js';\nimport { parseErrorBody } from './error-body.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { OAuthClientCredentials, oauthHttpsUrl } from './oauth-client-credentials.js';\n\nconst MCP_USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION}`;\n\nconst MAX_RETRIES = 3;\nconst REQUEST_TIMEOUT_MS = 30_000;\n\nconst NON_TRANSIENT_PATTERNS = [\n 'out of context',\n 'Definition not found',\n 'not a data question',\n 'Query generation failed',\n 'not found',\n 'not authenticated',\n 'Invalid Service Token',\n 'service token',\n];\n\nexport class DatabrainClient {\n private cache = new TtlCache();\n private runtimeApiToken: string | undefined;\n private readonly oauth?: OAuthClientCredentials;\n private oauthFallback = false;\n\n constructor(private config: Config) {\n registerSecret(config.serviceToken);\n registerSecret(config.apiToken);\n if (config.oauth) {\n if (!oauthHttpsUrl.safeParse(config.apiUrl).success) {\n throw new Error('OAuth requires an HTTPS Databrain API URL without userinfo or fragments.');\n }\n this.oauth = new OAuthClientCredentials(config.oauth);\n // Prevent later mutation of a caller-owned config from moving credentials\n // or the resource bearer to another API/issuer within this client session.\n this.config = Object.freeze({ ...config });\n }\n }\n\n hasApiToken(): boolean {\n return !!(this.runtimeApiToken || this.config.apiToken);\n }\n\n /** The hosted composition supplies a signed-in identity, unlike local API credentials. */\n isHosted(): boolean { return false; }\n\n setRuntimeApiToken(token: string): void {\n registerSecret(token);\n this.runtimeApiToken = token;\n logger.info('Runtime API token set for this session');\n }\n\n getServiceToken(): string | undefined {\n return this.config.serviceToken;\n }\n\n getApiUrl(): string {\n return this.config.apiUrl;\n }\n\n getDemoDomain(): string {\n return this.config.demoDomain;\n }\n\n /**\n * Describes which credential is currently used as the bearer for outgoing\n * API calls. Used by `whoami` so the LLM can give the user a truthful answer.\n */\n getActiveAuth():\n | { source: 'service-token'; oauthFallback?: boolean }\n | { source: 'oauth-client-credentials'; status: 'configured' | 'ready' | 'unavailable' }\n | { source: 'api-token' }\n | { source: 'none' } {\n if (this.oauth) {\n if (this.oauthFallback) return { source: 'service-token', oauthFallback: true };\n return { source: 'oauth-client-credentials', status: this.oauth.getStatus() };\n }\n if (this.config.serviceToken) return { source: 'service-token' };\n if (this.runtimeApiToken || this.config.apiToken) return { source: 'api-token' };\n return { source: 'none' };\n }\n\n private async getToken(auth: 'service' | 'api' | 'none'): Promise<string | undefined> {\n if (auth === 'none') return undefined;\n if (auth === 'service') {\n if (this.oauth) {\n try {\n const token = await this.oauth.getToken();\n this.oauthFallback = false;\n return token;\n } catch {\n if (!this.config.serviceToken) {\n throw new DatabrainApiError(0, 'OAUTH_TOKEN_ERROR',\n 'OAuth token acquisition failed. Check the configured issuer, client credentials, resource and scopes.');\n }\n if (!this.oauthFallback) logger.warn('OAuth unavailable; using the configured static service token.');\n this.oauthFallback = true;\n }\n }\n return this.config.serviceToken;\n }\n return this.runtimeApiToken || this.config.apiToken;\n }\n\n async request<T>(options: RequestOptions): Promise<T> {\n return this.requestInternal<T>(options);\n }\n\n private async requestInternal<T>(options: RequestOptions): Promise<T> {\n const usesOAuth = !!this.oauth && options.auth === 'service' && !options.token;\n // An OAuth renewal can switch to a differently scoped static principal.\n // Do not serve/store service response caches across that auth boundary.\n const cacheAllowed = !usesOAuth;\n // Invalidate caches first\n if (options.invalidateCache) {\n for (const prefix of options.invalidateCache) {\n this.cache.invalidateByPrefix(prefix);\n }\n }\n\n // Check cache\n if (cacheAllowed && options.cacheKey && options.cacheTtlMs) {\n const cached = this.cache.get<T>(options.cacheKey);\n if (cached !== undefined) {\n logger.debug(`Cache hit: ${options.cacheKey}`);\n return cached;\n }\n }\n\n let token = options.token ?? await this.getToken(options.auth);\n if (options.auth !== 'none' && !options.token && !token) {\n if (options.auth === 'service') {\n throw new DatabrainApiError(\n 401,\n 'MISSING_SERVICE_TOKEN',\n 'DATABRAIN_SERVICE_TOKEN is required for this operation (org-level token for discovery and data app management). It must be set in the MCP server configuration — do not ask the user for it at runtime.',\n );\n }\n throw new DatabrainApiError(\n 401,\n 'MISSING_API_TOKEN',\n 'A per-data-app API token is required for this embedding operation but none is configured. ' +\n 'Call `create_api_token` to generate one, or `set_api_token` if you already have the value. Do not ask the user for this token — create it via the MCP tools.',\n );\n }\n\n // Build URL\n let url = `${this.config.apiUrl}${options.path}`;\n if (options.query) {\n const params = new URLSearchParams(options.query);\n url += `?${params.toString()}`;\n }\n\n let lastError: Error | undefined;\n\n for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {\n try {\n if (usesOAuth && attempt > 1) token = await this.getToken(options.auth);\n const headers: Record<string, string> = {\n 'Content-Type': 'application/json',\n Accept: 'application/json',\n 'User-Agent': MCP_USER_AGENT,\n 'X-Databrain-Client': MCP_USER_AGENT,\n ...options.headers,\n };\n // Tag the call with the active tool's intent so backend telemetry can\n // attribute usage (embedding vs internal analytics, per-tool). Present\n // only when invoked from within a tool handler (see registry wrapper).\n const ctx = toolContext.getStore();\n if (ctx) {\n headers['X-Databrain-MCP-Tool'] = ctx.tool;\n headers['X-Databrain-MCP-Tool-Category'] = ctx.category;\n headers['X-Databrain-MCP-Workflow-Intent'] = ctx.workflowIntent;\n headers['X-Databrain-MCP-Input-Mode'] = ctx.inputMode;\n }\n if (token) {\n // Guest-token endpoints (auth: 'none' with a minted token) read the\n // token from `x-plugin-token` and require a whitelisted Origin.\n // DATABRAIN_DOMAINS includes `usedatabrain.com`, so `mcp.usedatabrain.com`\n // passes the whitelist without needing a per-company config.\n if (options.auth === 'none') {\n headers['x-plugin-token'] = token;\n headers['Origin'] = 'https://mcp.usedatabrain.com';\n } else {\n headers['Authorization'] = `Bearer ${token}`;\n }\n }\n\n const response = await fetch(url, {\n method: options.method,\n headers,\n body: options.body ? JSON.stringify(options.body) : undefined,\n signal: AbortSignal.timeout(options.timeoutMs || REQUEST_TIMEOUT_MS),\n ...(usesOAuth ? { redirect: 'error' as const } : {}),\n });\n\n if (!response.ok) {\n // An untrusted API can echo credentials in its error body. Keep\n // OAuth errors body-free in both tool output and telemetry. Never\n // retry/downgrade a backend denial with the static service token.\n if (usesOAuth) {\n throw new DatabrainApiError(response.status, 'OAUTH_API_ERROR',\n `Databrain API request failed with status ${response.status} using configured service credentials.`);\n }\n const errorBody = await response.text();\n logger.warn(`[API Error] ${options.method} ${options.path} status=${response.status} body=${errorBody.slice(0, 500)}`);\n let parsed: unknown = {};\n try {\n parsed = JSON.parse(errorBody);\n } catch {\n // not JSON\n }\n\n const envelope = parseErrorBody(parsed);\n const errorMsg = envelope.message || `API request failed with status ${response.status}`;\n const error = new DatabrainApiError(\n response.status,\n envelope.code || `HTTP_${response.status}`,\n errorMsg,\n parsed,\n envelope.hint,\n envelope.retryable,\n );\n\n // Retry on 429 or 5xx (but not when the error is clearly non-transient)\n // The server's own retryable flag wins over the status heuristic.\n const isTransient =\n envelope.retryable !== undefined\n ? envelope.retryable && (response.status === 429 || response.status >= 500)\n : response.status === 429 ||\n (response.status >= 500 &&\n !NON_TRANSIENT_PATTERNS.some((p) => errorMsg.includes(p)));\n if (isTransient && attempt < MAX_RETRIES) {\n const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);\n logger.warn(`Retrying in ${delay}ms (attempt ${attempt}/${MAX_RETRIES})`, {\n status: response.status,\n path: options.path,\n });\n await new Promise((r) => setTimeout(r, delay));\n lastError = error;\n continue;\n }\n\n throw error;\n }\n\n const text = await response.text();\n let data = (options.responseFormat === 'studio-sse' ? parseStudioStream(text) : text ? JSON.parse(text) : {}) as T;\n\n // Databrain API wraps most responses in { data: ... } — unwrap automatically\n if (\n !options.skipDataUnwrap &&\n data &&\n typeof data === 'object' &&\n !Array.isArray(data) &&\n 'data' in data\n ) {\n const inner = (data as Record<string, unknown>).data;\n if (inner !== null && inner !== undefined) {\n data = inner as unknown as T;\n }\n }\n\n // Store in cache\n if (cacheAllowed && options.cacheKey && options.cacheTtlMs) {\n this.cache.set(options.cacheKey, data, options.cacheTtlMs);\n }\n\n return data;\n } catch (err) {\n if (err instanceof DatabrainApiError) throw err;\n\n if (attempt < MAX_RETRIES && (err as Error)?.name === 'TimeoutError' && !options.noRetryOnTimeout) {\n const delay = Math.min(1000 * Math.pow(2, attempt - 1), 8000);\n logger.warn(`Request timed out, retrying in ${delay}ms`, { path: options.path });\n await new Promise((r) => setTimeout(r, delay));\n lastError = err as Error;\n continue;\n }\n\n throw new DatabrainApiError(\n 0,\n 'NETWORK_ERROR',\n usesOAuth ? 'Failed to connect to Databrain API using configured service credentials.'\n : `Failed to connect to Databrain API: ${(err as Error).message}`,\n );\n }\n }\n\n throw lastError || new DatabrainApiError(0, 'UNKNOWN', 'Request failed after retries');\n }\n}\n","import type { DatabrainClient } from '../client/databrain-client.js';\nimport type { CustomChartBundle, Problem } from '../custom-chart/types.js';\n\n/**\n * Service-token custom chart API (brief section 5), mounted by the backend\n * under /api/mcp/custom-charts. Company scope comes from the token; nothing\n * here sends a company or tenant selector.\n */\nexport const CUSTOM_CHARTS_PATH = '/api/mcp/custom-charts';\nconst LIST_CACHE_KEY = 'list_custom_charts';\n\nexport interface CustomChartVersionSummary {\n id: string;\n versionNumber: number;\n contentHash: string;\n sizeBytes?: number;\n createdAt?: string;\n createdBy?: string | null;\n [key: string]: unknown;\n}\n\nexport interface CustomChartSummary {\n id: string;\n key: string;\n name: string;\n description?: string | null;\n status: 'private' | 'published' | string;\n chartType?: string;\n publishedVersionId?: string | null;\n previewVersionId?: string | null;\n publishedVersionNumber?: number | null;\n previewVersionNumber?: number | null;\n versionsCount?: number;\n iconSvg?: string;\n createdBy?: string | null;\n createdAt?: string;\n updatedAt?: string;\n [key: string]: unknown;\n}\n\nexport interface CustomChartDetail extends CustomChartSummary {\n versions?: CustomChartVersionSummary[];\n}\n\nexport interface ValidateResponse {\n ok: boolean;\n problems: Problem[];\n contentHash?: string;\n sizeBytes?: number;\n}\n\nexport interface UploadResponse {\n chart: CustomChartSummary;\n version: CustomChartVersionSummary;\n created: 'chart' | 'version' | 'none';\n}\n\nexport interface UploadBody extends CustomChartBundle {\n name?: string;\n description?: string;\n}\n\nconst encodeKey = (key: string): string => encodeURIComponent(key);\n\nexport class CustomChartsApi {\n constructor(private readonly client: DatabrainClient) {}\n\n async list(): Promise<CustomChartSummary[]> {\n const response = await this.client.request<{ charts?: CustomChartSummary[] } | CustomChartSummary[]>({\n method: 'GET',\n path: CUSTOM_CHARTS_PATH,\n auth: 'service',\n cacheKey: LIST_CACHE_KEY,\n cacheTtlMs: 30_000,\n });\n if (Array.isArray(response)) return response;\n return Array.isArray(response?.charts) ? response.charts : [];\n }\n\n async get(key: string): Promise<CustomChartDetail> {\n const response = await this.client.request<{ chart?: CustomChartDetail } | CustomChartDetail>({\n method: 'GET',\n path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}`,\n auth: 'service',\n });\n const wrapped = response as { chart?: CustomChartDetail };\n return wrapped.chart ? wrapped.chart : (response as CustomChartDetail);\n }\n\n /** Never persists. The server repeats every client side check. */\n async validate(body: UploadBody): Promise<ValidateResponse> {\n const response = await this.client.request<ValidateResponse>({\n method: 'POST',\n path: `${CUSTOM_CHARTS_PATH}/validate`,\n auth: 'service',\n body,\n timeoutMs: 60_000,\n });\n return {\n ok: response.ok === true,\n problems: Array.isArray(response.problems) ? response.problems : [],\n contentHash: response.contentHash,\n sizeBytes: response.sizeBytes,\n };\n }\n\n /** Creates the chart (first upload) or a preview version; idempotent on contentHash. */\n async upload(body: UploadBody): Promise<UploadResponse> {\n return this.client.request<UploadResponse>({\n method: 'POST',\n path: CUSTOM_CHARTS_PATH,\n auth: 'service',\n body,\n timeoutMs: 60_000,\n invalidateCache: [LIST_CACHE_KEY],\n });\n }\n\n async bundle(key: string, versionId: string): Promise<CustomChartBundle> {\n return this.client.request<CustomChartBundle>({ method: 'GET',\n path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}/versions/${encodeURIComponent(versionId)}/bundle`,\n auth: 'service' });\n }\n\n async publish(key: string, versionId?: string): Promise<{ chart: CustomChartSummary }> {\n return this.client.request<{ chart: CustomChartSummary }>({\n method: 'POST',\n path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}/publish`,\n auth: 'service',\n body: versionId ? { versionId } : {},\n invalidateCache: [LIST_CACHE_KEY],\n });\n }\n\n async discardPreview(key: string): Promise<{ chart: CustomChartSummary }> {\n return this.client.request<{ chart: CustomChartSummary }>({\n method: 'POST',\n path: `${CUSTOM_CHARTS_PATH}/${encodeKey(key)}/discard-preview`,\n auth: 'service',\n body: {},\n invalidateCache: [LIST_CACHE_KEY],\n });\n }\n}\n","import type { DatabrainClient } from '../client/databrain-client.js';\nimport { CustomChartsApi } from '../api/custom-charts-api.js';\nimport type { CustomChartSummary } from '../api/custom-charts-api.js';\nimport { DatabrainApiError } from '../utils/errors.js';\nimport type { Problem } from './types.js';\n\nexport {\n CustomChartsApi,\n CUSTOM_CHARTS_PATH,\n type CustomChartDetail,\n type CustomChartSummary,\n type CustomChartVersionSummary,\n type UploadBody,\n type UploadResponse,\n type ValidateResponse,\n} from '../api/custom-charts-api.js';\n\nexport function createCustomChartsApi(client: DatabrainClient): CustomChartsApi {\n return new CustomChartsApi(client);\n}\n\n/** The backend error body is { error: { code, message, problems? } }. Pull the problems out. */\nexport function apiProblems(err: unknown): Problem[] {\n if (!(err instanceof DatabrainApiError)) return [];\n const details = err.details as { error?: { problems?: unknown }; problems?: unknown } | undefined;\n const list = details?.error?.problems ?? details?.problems;\n if (!Array.isArray(list)) return [];\n return list.filter(\n (item): item is Problem =>\n !!item && typeof item === 'object' && typeof (item as Problem).code === 'string' && typeof (item as Problem).message === 'string',\n );\n}\n\nexport interface UploadPlan {\n action: 'create chart' | 'create version' | 'no change';\n key: string;\n existing?: CustomChartSummary;\n nextVersionNumber: number;\n summary: string;\n}\n\n/**\n * What an apply will do, computed from the chart list (brief section 8):\n * \"will create chart\" when the key is new, \"will create version n\" when the\n * chart exists. The content-hash replay (\"none\") is only known to the server.\n */\nexport function planUpload(key: string, existing: CustomChartSummary | undefined, versionsKnown?: number): UploadPlan {\n if (!existing) {\n return { action: 'create chart', key, nextVersionNumber: 1, summary: `will create chart custom:${key} (version 1, status private)` };\n }\n const count = typeof versionsKnown === 'number' ? versionsKnown : typeof existing.versionsCount === 'number' ? existing.versionsCount : undefined;\n const next = count !== undefined ? count + 1 : NaN;\n const label = Number.isFinite(next) ? `version ${next}` : 'the next version';\n return {\n action: 'create version',\n key,\n existing,\n nextVersionNumber: Number.isFinite(next) ? next : 0,\n summary: `will create ${label} of custom:${key} in preview (status stays ${existing.status}; the published version keeps serving until you publish)`,\n };\n}\n","import { readTemplateFiles } from './assets.js';\nimport { isId, validateManifest } from './manifest.js';\nimport type { CustomChartOption, CustomChartSlot, Problem } from './types.js';\n\n/**\n * A chart project is the template folder with manifest.json and package.json\n * rewritten for the requested key, name, slots and options. Every other file\n * is copied verbatim so that the guide, the types and the sample chart stay\n * byte identical to what the tests exercise.\n */\nexport interface ScaffoldInput {\n key: string;\n name: string;\n description?: string;\n slots?: CustomChartSlot[];\n options?: CustomChartOption[];\n}\n\nexport interface ScaffoldResult {\n ok: boolean;\n problems: Problem[];\n files: Record<string, string>;\n nextStep: string;\n}\n\nconst DEFAULT_SLOTS: CustomChartSlot[] = [\n { id: 'category', label: 'Category', role: 'dimension', types: ['string'], required: true, description: 'One bar per value.' },\n { id: 'value', label: 'Value', role: 'measure', types: ['number'], required: true },\n { id: 'target', label: 'Target', role: 'measure', types: ['number'], required: false },\n];\n\nexport function scaffoldProject(input: ScaffoldInput): ScaffoldResult {\n const template = readTemplateFiles();\n const templateManifest = JSON.parse(template['manifest.json']) as {\n slots: CustomChartSlot[];\n options: CustomChartOption[];\n };\n const problems: Problem[] = [];\n if (!isId(input.key)) {\n problems.push({\n code: 'manifest.id.invalid',\n path: '/id',\n message: 'key must match ^[a-z][a-z0-9_-]{0,63}$ (lowercase letters, digits, _ and -).',\n });\n }\n const name = typeof input.name === 'string' ? input.name.trim() : '';\n if (name.length === 0 || name.length > 256) {\n problems.push({ code: 'manifest.name.invalid', path: '/name', message: 'name must be 1 to 256 characters.' });\n }\n\n const manifest: Record<string, unknown> = {\n schemaVersion: 2,\n id: input.key,\n name,\n version: '1.0.0',\n ...(input.description ? { description: input.description } : {}),\n slots: input.slots && input.slots.length > 0 ? input.slots : templateManifest.slots ?? DEFAULT_SLOTS,\n options: input.options ?? templateManifest.options,\n };\n problems.push(...validateManifest(manifest));\n\n const packageJson = JSON.parse(template['package.json']) as Record<string, unknown>;\n packageJson.name = input.key;\n\n const files: Record<string, string> = {};\n for (const [file, content] of Object.entries(template)) {\n if (file === 'manifest.json') files[file] = JSON.stringify(manifest, null, 2) + '\\n';\n else if (file === 'package.json') files[file] = JSON.stringify(packageJson, null, 2) + '\\n';\n else files[file] = content;\n }\n\n return {\n ok: problems.length === 0,\n problems,\n files,\n nextStep:\n 'Write these files into a folder, edit chart.ts, then run `databrain custom-chart validate` and ' +\n '`databrain custom-chart build`. Upload with `databrain custom-chart upload` or the custom_chart_upload tool.',\n };\n}\n"],"mappings":";;;;;;;;AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACkB,QACA,MAChB,SACgB,SAEA,YACA,WAChB;AACA,UAAM,OAAO;AARG;AACA;AAEA;AAEA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,iBAAoF;AAClF,UAAM,QAAQ,CAAC,UAAU,KAAK,OAAO,EAAE;AACvC,UAAM,aAAa,KAAK,cAAc;AACtC,QAAI,WAAY,OAAM,KAAK,UAAU;AACrC,UAAM,OAAO,KAAK,aAAa,SAAS,KAAK,UAAU,KAAK,KAAK,KAAK;AACtE,QAAI,KAAM,OAAM,KAAK,IAAI;AACzB,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC;AAAA,MACpD,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,gBAAwB;AAC9B,QAAI,KAAK,SAAS,OAAO,KAAK,UAAU,IAAK,QAAO;AACpD,QAAI,CAAC,KAAK,WAAW,OAAO,KAAK,YAAY,SAAU,QAAO;AAE9D,UAAM,WAAW,oBAAI,IAAI,CAAC,WAAW,UAAU,SAAS,QAAQ,QAAQ,QAAQ,WAAW,CAAC;AAC5F,UAAM,QAAiC,CAAC;AACxC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,OAAkC,GAAG;AAC5E,UAAI,SAAS,IAAI,CAAC,EAAG;AACrB,UAAI,MAAM,QAAQ,MAAM,OAAW;AACnC,YAAM,CAAC,IAAI;AAAA,IACb;AACA,QAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO;AAC5C,QAAI;AACF,aAAO,gBAAgB,KAAK,UAAU,KAAK,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,OAAe;AAErB,QAAI,KAAK,SAAS,0BAA0B;AAC1C,aAAO;AAAA,IACT;AACA,QAAI,KAAK,SAAS,sBAAsB;AACtC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,SAAS,sBAAsB,KAAK,SAAS,sBAAsB;AAC1E,aAAO;AAAA,IACT;AACA,QAAI,KAAK,SAAS,uBAAuB;AACvC,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,OAAO,KAAK,WAAW,KAAK;AAC9C,UAAI,KAAK,SAAS,mBAAmB;AACnC,eAAO;AAAA,MACT;AACA,UACE,KAAK,SAAS,2BACd,KAAK,SAAS,2BACd,KAAK,QAAQ,YAAY,EAAE,SAAS,eAAe,GACnD;AACA,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,KAAK;AACvB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,KAAK;AACvB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,KAAK;AACvB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,KAAK;AACvB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,WAAW,KAAK;AACvB,aAAO;AAAA,IACT;AACA,QAAI,KAAK,UAAU,KAAK;AACtB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,SAAoF;AAC5G,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IACzC,SAAS;AAAA,EACX;AACF;AAEO,SAAS,UAAU,OAAwB;AAChD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI;AACF,WAAO,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,EACtC,QAAQ;AACN,WAAO,OAAO,KAAK;AAAA,EACrB;AACF;AAEO,SAAS,YAAY,MAAkE;AAC5F,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EAClC;AACF;;;ACxHA,IAAM,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE;AAG1D,IAAM,eACH,QAAQ,IAAI,uBAAoC;AAOnD,IAAM,UAAU,oBAAI,IAAY;AAEzB,SAAS,eAAe,OAAwC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,UAAU,EAAG,SAAQ,IAAI,KAAK;AACvE;AAEO,SAAS,cAAc,MAAsB;AAClD,MAAI,MAAM;AACV,aAAW,UAAU,QAAS,OAAM,IAAI,MAAM,MAAM,EAAE,KAAK,YAAY;AACvE,SAAO;AACT;AAEA,SAAS,IAAI,OAAiB,SAAiB,MAAsB;AACnE,MAAI,WAAW,KAAK,IAAI,WAAW,YAAY,EAAG;AAClD,QAAM,OAAO,oBAAoB,MAAM,YAAY,CAAC,KAAK,OAAO;AAChE,QAAM,OAAO,SAAS,SAAY,GAAG,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK;AACtE,UAAQ,OAAO,MAAM,GAAG,cAAc,IAAI,CAAC;AAAA,CAAI;AACjD;AAEO,IAAM,SAAS;AAAA,EACpB,OAAO,CAAC,KAAa,SAAmB,IAAI,SAAS,KAAK,IAAI;AAAA,EAC9D,MAAM,CAAC,KAAa,SAAmB,IAAI,QAAQ,KAAK,IAAI;AAAA,EAC5D,MAAM,CAAC,KAAa,SAAmB,IAAI,QAAQ,KAAK,IAAI;AAAA,EAC5D,OAAO,CAAC,KAAa,SAAmB,IAAI,SAAS,KAAK,IAAI;AAChE;;;ACnCA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,SAAW;AAAA,EACX,aAAe;AAAA,EACf,MAAQ;AAAA,EACR,KAAO;AAAA,IACL,cAAc;AAAA,IACd,wBAAwB;AAAA,IACxB,4BAA4B;AAAA,IAC5B,WAAa;AAAA,EACf;AAAA,EACA,MAAQ;AAAA,EACR,OAAS;AAAA,EACT,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,KAAO;AAAA,IACP,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,aAAa;AAAA,IACb,MAAQ;AAAA,IACR,gBAAkB;AAAA,EACpB;AAAA,EACA,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,EACX,cAAgB;AAAA,IACd,6BAA6B;AAAA,IAC7B,gBAAgB;AAAA,IAChB,SAAW;AAAA,IACX,QAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,iBAAmB;AAAA,IACjB,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,KAAO;AAAA,IACP,YAAc;AAAA,IACd,QAAU;AAAA,EACZ;AAAA,EACA,eAAiB;AAAA,IACf,QAAU;AAAA,EACZ;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AACF;;;AC1DO,IAAM,qBAAqB,gBAAY;;;ACL9C,SAAS,SAAS;AAIlB,IAAM,aAAa,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;AACtF,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAM;AAAA,EAAG,KAAK,EAAE,OAAO,EAAE,IAAI,IAAM;AAAA,EAAG,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,EACzF,YAAY,EAAE,OAAO;AAAA,IAAE,SAAS,EAAE,MAAM,EAAE,OAAO;AAAA,MAAE,IAAI,EAAE,OAAO;AAAA,MAAG,OAAO,EAAE,OAAO;AAAA,MACjF,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAAA,MAAG,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAAE,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE;AAAA,IAChG,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,EAAE,IAAI,GAAG;AAAA,EAAE,CAAC,EAAE,OAAO;AAAA,EACxD,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EAAG,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EAAG,SAAS,EAAE,OAAO,EAAE,IAAI,KAAM;AAC7F,CAAC,EAAE,OAAO;AAIH,SAAS,kBAAkB,MAA6E;AAC7G,MAAI,KAAK,SAAS,IAAI,OAAO,KAAM,OAAM,IAAI,MAAM,yBAAyB;AAC5E,MAAI;AACJ,MAAI;AACJ,MAAI,UAAU;AACd,aAAW,SAAS,KAAK,MAAM,YAAY,GAAG;AAC5C,UAAM,OAAO,MAAM,MAAM,OAAO,EAAE,OAAO,OAAK,EAAE,WAAW,OAAO,CAAC,EAAE,IAAI,OAAK,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,KAAK,IAAI;AAC/G,QAAI,CAAC,QAAQ,SAAS,SAAU;AAChC,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAI,MAAM,SAAS,aAAa,OAAO,MAAM,cAAc,SAAU,aAAY,MAAM;AACvF,QAAI,MAAM,SAAS,QAAS,WAAU;AACtC,QAAI,MAAM,SAAS,wBAAwB,MAAM,SAAS,yBACtD,MAAM,WAAW,eAAe,MAAM,QAAQ,SAAS,WAAW;AACpE,cAAQ,kBAAkB,MAAM,MAAM,OAAO,KAAK;AAAA,IACpD;AAAA,EACF;AACA,MAAI,WAAW,CAAC,MAAO,OAAM,IAAI,MAAM,+BAA+B;AACtE,SAAO,EAAE,OAAO,WAAW,SAAS,CAAC,CAAC,MAAM;AAC9C;AAGA,eAAsB,aAAa,QAAyB,OAEkC;AAG5F,MAAI,CAAC,OAAO,SAAS,EAAG,QAAO,EAAE,WAAW,OAAO,OAAO,MAAM,OAAO,SAAS,MAAM;AACtF,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,QAA8C;AAAA,MACxE,QAAQ;AAAA,MAAQ,MAAM,yBAAyB,mBAAmB,MAAM,GAAG,CAAC;AAAA,MAAc,MAAM;AAAA,MAChG,MAAM;AAAA,QAAE,aAAa,MAAM;AAAA,QAAa,SAAS,MAAM;AAAA,QAAS,OAAO,MAAM;AAAA,QAC3E,WAAW,MAAM;AAAA,QAAW,MAAM;AAAA,QAAS,mBAAmB;AAAA,MAAM;AAAA,MACtE,gBAAgB;AAAA,MAAc,WAAW;AAAA,MAAS,kBAAkB;AAAA,IACtE,CAAC;AACD,WAAO,EAAE,WAAW,MAAM,OAAO,OAAO,SAAS,MAAM,OAAO,SAAS,OAAO,SAAS,WAAW,OAAO,UAAU;AAAA,EACrH,SAAS,OAAO;AACd,QAAI,iBAAiB,qBAAqB,MAAM,WAAW,KAAK;AAC9D,aAAO,EAAE,WAAW,OAAO,OAAO,MAAM,OAAO,SAAS,MAAM;AAAA,IAChE;AACA,UAAM;AAAA,EACR;AACF;;;ACnDO,IAAM,WAAN,MAAe;AAAA,EACZ,QAAQ,oBAAI,IAAiC;AAAA,EAErD,IAAO,KAA4B;AACjC,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW;AAChC,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAO,KAAa,OAAU,OAAqB;AACjD,SAAK,MAAM,IAAI,KAAK,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,EAC9D;AAAA,EAEA,mBAAmB,QAAsB;AACvC,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AACF;;;AClBA,IAAM,WAAW,CAAC,MAChB,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAEzD,IAAM,MAAM,CAAC,MACX,OAAO,MAAM,YAAY,EAAE,KAAK,IAAI,IAAI;AAE1C,IAAM,eAAe,CAAC,MAA4C;AAChE,MAAI,CAAC,SAAS,CAAC,EAAG,QAAO;AACzB,QAAM,MAAuB;AAAA,IAC3B,MAAM,IAAI,EAAE,IAAI;AAAA,IAChB,SAAS,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,MAAM;AAAA,IACvC,MAAM,IAAI,EAAE,IAAI;AAAA,IAChB,WAAW,OAAO,EAAE,cAAc,YAAY,EAAE,YAAY;AAAA,IAC5D,SAAS,EAAE;AAAA,EACb;AACA,SAAO,IAAI,QAAQ,IAAI,WAAW,IAAI,OAAO,MAAM;AACrD;AAEO,SAAS,eAAe,MAAgC;AAC7D,MAAI,CAAC,SAAS,IAAI,EAAG,QAAO,CAAC;AAC7B,QAAM,SACJ,aAAa,SAAS,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,MAAS,KAC9D,aAAa,KAAK,KAAK,KACvB,aAAa,IAAI;AACnB,MAAI,QAAQ;AACV,WAAO,EAAE,GAAG,QAAQ,SAAS,OAAO,WAAW,IAAI,KAAK,KAAK,EAAE;AAAA,EACjE;AACA,SAAO,EAAE,SAAS,IAAI,KAAK,KAAK,EAAE;AACpC;;;AC3CA,SAAS,yBAAyB;AAoB3B,IAAM,cAAc,IAAI,kBAAmC;;;ACpBlE,SAAS,KAAAA,UAAS;AAGX,IAAM,gBAAgBA,GAAE,OAAO,EAAE,OAAO,WAAS;AACtD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,QAAQ;AAAE,WAAO;AAAA,EAAO;AAC1B,GAAG,yDAAyD;AAErD,IAAM,oBAAoBA,GAAE,OAAO;AAAA,EACxC,QAAQ,cAAc,OAAO,WAAS;AACpC,QAAI;AAAE,aAAO,CAAC,IAAI,IAAI,KAAK,EAAE;AAAA,IAAQ,QAAQ;AAAE,aAAO;AAAA,IAAO;AAAA,EAC/D,GAAG,uCAAuC;AAAA,EAC1C,UAAUA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,cAAcA,GAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC9B,UAAU;AAAA,EACV,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAClC,YAAYA,GAAE,KAAK,CAAC,uBAAuB,oBAAoB,CAAC,EAAE,QAAQ,qBAAqB;AACjG,CAAC;AAID,IAAM,iBAAiBA,GAAE,OAAO;AAAA,EAC9B,QAAQA,GAAE,OAAO;AAAA,EACjB,gBAAgB;AAAA,EAChB,uCAAuCA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpE,uBAAuBA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACtD,CAAC;AACD,IAAM,cAAcA,GAAE,OAAO;AAAA,EAC3B,cAAcA,GAAE,OAAO,EAAE,MAAM,yBAAyB;AAAA,EACxD,YAAYA,GAAE,OAAO,EAAE,OAAO,WAAS,MAAM,YAAY,MAAM,QAAQ;AAAA,EACvE,YAAYA,GAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AACtD,CAAC;AAED,IAAM,mBAAmB;AACzB,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAE5B,SAAS,YAAmB;AAG1B,SAAO,IAAI,MAAM,uGAAuG;AAC1H;AAGO,IAAM,yBAAN,MAA6B;AAAA,EACjB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EAElB,YAAY,QAAqB;AAE/B,UAAM,SAAS,kBAAkB,UAAU,MAAM;AACjD,QAAI,CAAC,OAAO,QAAS,OAAM,UAAU;AACrC,SAAK,SAAS,OAAO,OAAO,OAAO,IAAI;AAAA,EACzC;AAAA,EAEA,YAAoD;AAClD,QAAI,KAAK,UAAU,KAAK,IAAI,IAAI,KAAK,OAAO,QAAS,QAAO;AAC5D,QAAI,KAAK,UAAU,EAAG,QAAO;AAC7B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAA4B;AAChC,QAAI,KAAK,UAAU,KAAK,IAAI,IAAI,KAAK,OAAO,QAAS,QAAO,KAAK,OAAO;AACxE,QAAI,KAAK,QAAS,QAAO,KAAK;AAC9B,QAAI,KAAK,IAAI,IAAI,KAAK,QAAS,OAAM,UAAU;AAE/C,SAAK,SAAS;AACd,SAAK,UAAU,KAAK,QAAQ,EAAE,MAAM,MAAM;AACxC,WAAK,UAAU,KAAK,IAAI,IAAI;AAC5B,YAAM,UAAU;AAAA,IAClB,CAAC,EAAE,QAAQ,MAAM;AAAE,WAAK,UAAU;AAAA,IAAW,CAAC;AAC9C,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,sBAAsB,QAAsC;AACxE,QAAI,KAAK,cAAe,QAAO,KAAK;AACpC,UAAM,SAAS,IAAI,IAAI,KAAK,OAAO,MAAM;AACzC,UAAM,OAAO,OAAO,SAAS,QAAQ,OAAO,EAAE;AAC9C,UAAM,aAAa,CAAC,GAAG,oBAAI,IAAI;AAAA,MAC7B,GAAG,OAAO,MAAM,0CAA0C,IAAI;AAAA,MAC9D,GAAG,OAAO,MAAM,oCAAoC,IAAI;AAAA,MACxD,GAAG,OAAO,MAAM,GAAG,IAAI;AAAA,IACzB,CAAC,CAAC;AAEF,eAAW,OAAO,YAAY;AAE5B,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC,SAAS,EAAE,QAAQ,mBAAmB;AAAA,QAAG,UAAU;AAAA,QAAS;AAAA,MAC9D,CAAC;AACD,UAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK;AACxD,UAAI,CAAC,SAAS,GAAI,OAAM,UAAU;AAClC,YAAM,WAAW,eAAe,MAAM,MAAM,SAAS,KAAK,CAAC;AAC3D,UAAI,SAAS,WAAW,KAAK,OAAO,OAAQ,OAAM,UAAU;AAC5D,YAAM,UAAU,SAAS,yCAAyC,CAAC,qBAAqB;AACxF,UAAI,CAAC,QAAQ,SAAS,KAAK,OAAO,UAAU,EAAG,OAAM,UAAU;AAC/D,UAAI,SAAS,yBAAyB,CAAC,SAAS,sBAAsB,SAAS,oBAAoB,GAAG;AACpG,cAAM,UAAU;AAAA,MAClB;AACA,WAAK,gBAAgB,SAAS;AAC9B,aAAO,KAAK;AAAA,IACd;AACA,UAAM,UAAU;AAAA,EAClB;AAAA,EAEA,MAAc,UAA2B;AAEvC,UAAM,SAAS,YAAY,QAAQ,gBAAgB;AACnD,UAAM,WAAW,MAAM,KAAK,sBAAsB,MAAM;AACxD,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MAAsB,UAAU,KAAK,OAAO;AAAA,IAC1D,CAAC;AACD,QAAI,KAAK,OAAO,MAAO,MAAK,IAAI,SAAS,KAAK,OAAO,KAAK;AAC1D,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MAAoB,gBAAgB;AAAA,IAC9C;AACA,QAAI,KAAK,OAAO,eAAe,sBAAsB;AACnD,WAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD,OAAO;AAEL,YAAM,SAAS,CAAC,UAAkB,IAAI,gBAAgB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC;AACnF,cAAQ,gBAAgB,SAAS,OAAO,KAAK,GAAG,OAAO,KAAK,OAAO,QAAQ,CAAC,IAAI,OAAO,KAAK,OAAO,YAAY,CAAC,EAAE,EAAE,SAAS,QAAQ,CAAC;AAAA,IACxI;AAEA,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MAAQ;AAAA,MAAS,MAAM,KAAK,SAAS;AAAA,MAAG,UAAU;AAAA,MAAS;AAAA,IACrE,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,UAAU;AAClC,UAAM,QAAQ,YAAY,MAAM,MAAM,SAAS,KAAK,CAAC;AACrD,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,aAAa,MAAM,aAAa;AACtC,YAAM,YAAY,YAAY;AAC9B,UAAI,CAAC,OAAO,SAAS,SAAS,KAAK,KAAK,IAAI,KAAK,UAAW,OAAM,UAAU;AAC5E,WAAK,SAAS;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,SAAS,YAAY,KAAK,IAAI,qBAAqB,aAAa,GAAG;AAAA,MACrE;AAAA,IACF;AAGA,SAAK,UAAU;AACf,WAAO,MAAM;AAAA,EACf;AACF;;;AC1IA,IAAM,iBAAiB,wBAAwB,kBAAkB;AAEjE,IAAM,cAAc;AACpB,IAAM,qBAAqB;AAE3B,IAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,kBAAN,MAAsB;AAAA,EAM3B,YAAoB,QAAgB;AAAhB;AAClB,mBAAe,OAAO,YAAY;AAClC,mBAAe,OAAO,QAAQ;AAC9B,QAAI,OAAO,OAAO;AAChB,UAAI,CAAC,cAAc,UAAU,OAAO,MAAM,EAAE,SAAS;AACnD,cAAM,IAAI,MAAM,0EAA0E;AAAA,MAC5F;AACA,WAAK,QAAQ,IAAI,uBAAuB,OAAO,KAAK;AAGpD,WAAK,SAAS,OAAO,OAAO,EAAE,GAAG,OAAO,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA,EAjBQ,QAAQ,IAAI,SAAS;AAAA,EACrB;AAAA,EACS;AAAA,EACT,gBAAgB;AAAA,EAgBxB,cAAuB;AACrB,WAAO,CAAC,EAAE,KAAK,mBAAmB,KAAK,OAAO;AAAA,EAChD;AAAA;AAAA,EAGA,WAAoB;AAAE,WAAO;AAAA,EAAO;AAAA,EAEpC,mBAAmB,OAAqB;AACtC,mBAAe,KAAK;AACpB,SAAK,kBAAkB;AACvB,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAAA,EAEA,kBAAsC;AACpC,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,YAAoB;AAClB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,gBAAwB;AACtB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAIuB;AACrB,QAAI,KAAK,OAAO;AACd,UAAI,KAAK,cAAe,QAAO,EAAE,QAAQ,iBAAiB,eAAe,KAAK;AAC9E,aAAO,EAAE,QAAQ,4BAA4B,QAAQ,KAAK,MAAM,UAAU,EAAE;AAAA,IAC9E;AACA,QAAI,KAAK,OAAO,aAAc,QAAO,EAAE,QAAQ,gBAAgB;AAC/D,QAAI,KAAK,mBAAmB,KAAK,OAAO,SAAU,QAAO,EAAE,QAAQ,YAAY;AAC/E,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAAA,EAEA,MAAc,SAAS,MAA+D;AACpF,QAAI,SAAS,OAAQ,QAAO;AAC5B,QAAI,SAAS,WAAW;AACtB,UAAI,KAAK,OAAO;AACd,YAAI;AACF,gBAAM,QAAQ,MAAM,KAAK,MAAM,SAAS;AACxC,eAAK,gBAAgB;AACrB,iBAAO;AAAA,QACT,QAAQ;AACN,cAAI,CAAC,KAAK,OAAO,cAAc;AAC7B,kBAAM,IAAI;AAAA,cAAkB;AAAA,cAAG;AAAA,cAC7B;AAAA,YAAuG;AAAA,UAC3G;AACA,cAAI,CAAC,KAAK,cAAe,QAAO,KAAK,+DAA+D;AACpG,eAAK,gBAAgB;AAAA,QACvB;AAAA,MACF;AACA,aAAO,KAAK,OAAO;AAAA,IACrB;AACA,WAAO,KAAK,mBAAmB,KAAK,OAAO;AAAA,EAC7C;AAAA,EAEA,MAAM,QAAW,SAAqC;AACpD,WAAO,KAAK,gBAAmB,OAAO;AAAA,EACxC;AAAA,EAEA,MAAc,gBAAmB,SAAqC;AACpE,UAAM,YAAY,CAAC,CAAC,KAAK,SAAS,QAAQ,SAAS,aAAa,CAAC,QAAQ;AAGzE,UAAM,eAAe,CAAC;AAEtB,QAAI,QAAQ,iBAAiB;AAC3B,iBAAW,UAAU,QAAQ,iBAAiB;AAC5C,aAAK,MAAM,mBAAmB,MAAM;AAAA,MACtC;AAAA,IACF;AAGA,QAAI,gBAAgB,QAAQ,YAAY,QAAQ,YAAY;AAC1D,YAAM,SAAS,KAAK,MAAM,IAAO,QAAQ,QAAQ;AACjD,UAAI,WAAW,QAAW;AACxB,eAAO,MAAM,cAAc,QAAQ,QAAQ,EAAE;AAC7C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,SAAS,MAAM,KAAK,SAAS,QAAQ,IAAI;AAC7D,QAAI,QAAQ,SAAS,UAAU,CAAC,QAAQ,SAAS,CAAC,OAAO;AACvD,UAAI,QAAQ,SAAS,WAAW;AAC9B,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MAEF;AAAA,IACF;AAGA,QAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,QAAQ,IAAI;AAC9C,QAAI,QAAQ,OAAO;AACjB,YAAM,SAAS,IAAI,gBAAgB,QAAQ,KAAK;AAChD,aAAO,IAAI,OAAO,SAAS,CAAC;AAAA,IAC9B;AAEA,QAAI;AAEJ,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,UAAI;AACF,YAAI,aAAa,UAAU,EAAG,SAAQ,MAAM,KAAK,SAAS,QAAQ,IAAI;AACtE,cAAM,UAAkC;AAAA,UACtC,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,sBAAsB;AAAA,UACtB,GAAG,QAAQ;AAAA,QACb;AAIA,cAAM,MAAM,YAAY,SAAS;AACjC,YAAI,KAAK;AACP,kBAAQ,sBAAsB,IAAI,IAAI;AACtC,kBAAQ,+BAA+B,IAAI,IAAI;AAC/C,kBAAQ,iCAAiC,IAAI,IAAI;AACjD,kBAAQ,4BAA4B,IAAI,IAAI;AAAA,QAC9C;AACA,YAAI,OAAO;AAKT,cAAI,QAAQ,SAAS,QAAQ;AAC3B,oBAAQ,gBAAgB,IAAI;AAC5B,oBAAQ,QAAQ,IAAI;AAAA,UACtB,OAAO;AACL,oBAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,UAC5C;AAAA,QACF;AAEA,cAAM,WAAW,MAAM,MAAM,KAAK;AAAA,UAChC,QAAQ,QAAQ;AAAA,UAChB;AAAA,UACA,MAAM,QAAQ,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,UACpD,QAAQ,YAAY,QAAQ,QAAQ,aAAa,kBAAkB;AAAA,UACnE,GAAI,YAAY,EAAE,UAAU,QAAiB,IAAI,CAAC;AAAA,QACpD,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAIhB,cAAI,WAAW;AACb,kBAAM,IAAI;AAAA,cAAkB,SAAS;AAAA,cAAQ;AAAA,cAC3C,4CAA4C,SAAS,MAAM;AAAA,YAAwC;AAAA,UACvG;AACA,gBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,iBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,QAAQ,IAAI,WAAW,SAAS,MAAM,SAAS,UAAU,MAAM,GAAG,GAAG,CAAC,EAAE;AACrH,cAAI,SAAkB,CAAC;AACvB,cAAI;AACF,qBAAS,KAAK,MAAM,SAAS;AAAA,UAC/B,QAAQ;AAAA,UAER;AAEA,gBAAM,WAAW,eAAe,MAAM;AACtC,gBAAM,WAAW,SAAS,WAAW,kCAAkC,SAAS,MAAM;AACtF,gBAAM,QAAQ,IAAI;AAAA,YAChB,SAAS;AAAA,YACT,SAAS,QAAQ,QAAQ,SAAS,MAAM;AAAA,YACxC;AAAA,YACA;AAAA,YACA,SAAS;AAAA,YACT,SAAS;AAAA,UACX;AAIA,gBAAM,cACJ,SAAS,cAAc,SACnB,SAAS,cAAc,SAAS,WAAW,OAAO,SAAS,UAAU,OACrE,SAAS,WAAW,OACnB,SAAS,UAAU,OAClB,CAAC,uBAAuB,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AAChE,cAAI,eAAe,UAAU,aAAa;AACxC,kBAAM,QAAQ,KAAK,IAAI,MAAO,KAAK,IAAI,GAAG,UAAU,CAAC,GAAG,GAAI;AAC5D,mBAAO,KAAK,eAAe,KAAK,eAAe,OAAO,IAAI,WAAW,KAAK;AAAA,cACxE,QAAQ,SAAS;AAAA,cACjB,MAAM,QAAQ;AAAA,YAChB,CAAC;AACD,kBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAC7C,wBAAY;AACZ;AAAA,UACF;AAEA,gBAAM;AAAA,QACR;AAEA,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAI,OAAQ,QAAQ,mBAAmB,eAAe,kBAAkB,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAG3G,YACE,CAAC,QAAQ,kBACT,QACA,OAAO,SAAS,YAChB,CAAC,MAAM,QAAQ,IAAI,KACnB,UAAU,MACV;AACA,gBAAM,QAAS,KAAiC;AAChD,cAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,mBAAO;AAAA,UACT;AAAA,QACF;AAGA,YAAI,gBAAgB,QAAQ,YAAY,QAAQ,YAAY;AAC1D,eAAK,MAAM,IAAI,QAAQ,UAAU,MAAM,QAAQ,UAAU;AAAA,QAC3D;AAEA,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAmB,OAAM;AAE5C,YAAI,UAAU,eAAgB,KAAe,SAAS,kBAAkB,CAAC,QAAQ,kBAAkB;AACjG,gBAAM,QAAQ,KAAK,IAAI,MAAO,KAAK,IAAI,GAAG,UAAU,CAAC,GAAG,GAAI;AAC5D,iBAAO,KAAK,kCAAkC,KAAK,MAAM,EAAE,MAAM,QAAQ,KAAK,CAAC;AAC/E,gBAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAC7C,sBAAY;AACZ;AAAA,QACF;AAEA,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA,YAAY,6EACR,uCAAwC,IAAc,OAAO;AAAA,QACnE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,kBAAkB,GAAG,WAAW,8BAA8B;AAAA,EACvF;AACF;;;ACnSO,IAAM,qBAAqB;AAClC,IAAM,iBAAiB;AAqDvB,IAAM,YAAY,CAAC,QAAwB,mBAAmB,GAAG;AAE1D,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6B,QAAyB;AAAzB;AAAA,EAA0B;AAAA,EAEvD,MAAM,OAAsC;AAC1C,UAAM,WAAW,MAAM,KAAK,OAAO,QAAkE;AAAA,MACnG,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,MACV,YAAY;AAAA,IACd,CAAC;AACD,QAAI,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACpC,WAAO,MAAM,QAAQ,UAAU,MAAM,IAAI,SAAS,SAAS,CAAC;AAAA,EAC9D;AAAA,EAEA,MAAM,IAAI,KAAyC;AACjD,UAAM,WAAW,MAAM,KAAK,OAAO,QAA2D;AAAA,MAC5F,QAAQ;AAAA,MACR,MAAM,GAAG,kBAAkB,IAAI,UAAU,GAAG,CAAC;AAAA,MAC7C,MAAM;AAAA,IACR,CAAC;AACD,UAAM,UAAU;AAChB,WAAO,QAAQ,QAAQ,QAAQ,QAAS;AAAA,EAC1C;AAAA;AAAA,EAGA,MAAM,SAAS,MAA6C;AAC1D,UAAM,WAAW,MAAM,KAAK,OAAO,QAA0B;AAAA,MAC3D,QAAQ;AAAA,MACR,MAAM,GAAG,kBAAkB;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,WAAO;AAAA,MACL,IAAI,SAAS,OAAO;AAAA,MACpB,UAAU,MAAM,QAAQ,SAAS,QAAQ,IAAI,SAAS,WAAW,CAAC;AAAA,MAClE,aAAa,SAAS;AAAA,MACtB,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,OAAO,MAA2C;AACtD,WAAO,KAAK,OAAO,QAAwB;AAAA,MACzC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN;AAAA,MACA,WAAW;AAAA,MACX,iBAAiB,CAAC,cAAc;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,OAAO,KAAa,WAA+C;AACvE,WAAO,KAAK,OAAO,QAA2B;AAAA,MAAE,QAAQ;AAAA,MACtD,MAAM,GAAG,kBAAkB,IAAI,UAAU,GAAG,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,MACvF,MAAM;AAAA,IAAU,CAAC;AAAA,EACrB;AAAA,EAEA,MAAM,QAAQ,KAAa,WAA4D;AACrF,WAAO,KAAK,OAAO,QAAuC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,GAAG,kBAAkB,IAAI,UAAU,GAAG,CAAC;AAAA,MAC7C,MAAM;AAAA,MACN,MAAM,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC,iBAAiB,CAAC,cAAc;AAAA,IAClC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,eAAe,KAAqD;AACxE,WAAO,KAAK,OAAO,QAAuC;AAAA,MACxD,QAAQ;AAAA,MACR,MAAM,GAAG,kBAAkB,IAAI,UAAU,GAAG,CAAC;AAAA,MAC7C,MAAM;AAAA,MACN,MAAM,CAAC;AAAA,MACP,iBAAiB,CAAC,cAAc;AAAA,IAClC,CAAC;AAAA,EACH;AACF;;;AC9HO,SAAS,sBAAsB,QAA0C;AAC9E,SAAO,IAAI,gBAAgB,MAAM;AACnC;AAGO,SAAS,YAAY,KAAyB;AACnD,MAAI,EAAE,eAAe,mBAAoB,QAAO,CAAC;AACjD,QAAM,UAAU,IAAI;AACpB,QAAM,OAAO,SAAS,OAAO,YAAY,SAAS;AAClD,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO,CAAC;AAClC,SAAO,KAAK;AAAA,IACV,CAAC,SACC,CAAC,CAAC,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiB,SAAS,YAAY,OAAQ,KAAiB,YAAY;AAAA,EAC7H;AACF;AAeO,SAAS,WAAW,KAAa,UAA0C,eAAoC;AACpH,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,QAAQ,gBAAgB,KAAK,mBAAmB,GAAG,SAAS,4BAA4B,GAAG,+BAA+B;AAAA,EACrI;AACA,QAAM,QAAQ,OAAO,kBAAkB,WAAW,gBAAgB,OAAO,SAAS,kBAAkB,WAAW,SAAS,gBAAgB;AACxI,QAAM,OAAO,UAAU,SAAY,QAAQ,IAAI;AAC/C,QAAM,QAAQ,OAAO,SAAS,IAAI,IAAI,WAAW,IAAI,KAAK;AAC1D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,mBAAmB,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA,IAClD,SAAS,eAAe,KAAK,cAAc,GAAG,6BAA6B,SAAS,MAAM;AAAA,EAC5F;AACF;;;ACnCA,IAAM,gBAAmC;AAAA,EACvC,EAAE,IAAI,YAAY,OAAO,YAAY,MAAM,aAAa,OAAO,CAAC,QAAQ,GAAG,UAAU,MAAM,aAAa,qBAAqB;AAAA,EAC7H,EAAE,IAAI,SAAS,OAAO,SAAS,MAAM,WAAW,OAAO,CAAC,QAAQ,GAAG,UAAU,KAAK;AAAA,EAClF,EAAE,IAAI,UAAU,OAAO,UAAU,MAAM,WAAW,OAAO,CAAC,QAAQ,GAAG,UAAU,MAAM;AACvF;AAEO,SAAS,gBAAgB,OAAsC;AACpE,QAAM,WAAW,kBAAkB;AACnC,QAAM,mBAAmB,KAAK,MAAM,SAAS,eAAe,CAAC;AAI7D,QAAM,WAAsB,CAAC;AAC7B,MAAI,CAAC,KAAK,MAAM,GAAG,GAAG;AACpB,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,IAAI;AAClE,MAAI,KAAK,WAAW,KAAK,KAAK,SAAS,KAAK;AAC1C,aAAS,KAAK,EAAE,MAAM,yBAAyB,MAAM,SAAS,SAAS,oCAAoC,CAAC;AAAA,EAC9G;AAEA,QAAM,WAAoC;AAAA,IACxC,eAAe;AAAA,IACf,IAAI,MAAM;AAAA,IACV;AAAA,IACA,SAAS;AAAA,IACT,GAAI,MAAM,cAAc,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,IAC9D,OAAO,MAAM,SAAS,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ,iBAAiB,SAAS;AAAA,IACvF,SAAS,MAAM,WAAW,iBAAiB;AAAA,EAC7C;AACA,WAAS,KAAK,GAAG,iBAAiB,QAAQ,CAAC;AAE3C,QAAM,cAAc,KAAK,MAAM,SAAS,cAAc,CAAC;AACvD,cAAY,OAAO,MAAM;AAEzB,QAAM,QAAgC,CAAC;AACvC,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACtD,QAAI,SAAS,gBAAiB,OAAM,IAAI,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI;AAAA,aACvE,SAAS,eAAgB,OAAM,IAAI,IAAI,KAAK,UAAU,aAAa,MAAM,CAAC,IAAI;AAAA,QAClF,OAAM,IAAI,IAAI;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,IAAI,SAAS,WAAW;AAAA,IACxB;AAAA,IACA;AAAA,IACA,UACE;AAAA,EAEJ;AACF;","names":["z"]}
package/dist/main-JEYYFGJM.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../src/hosted/main.ts","../src/hosted/config.ts","../src/hosted/http.ts","../src/hosted/server.ts","../src/tools/infrastructure/create-workspace.ts","../src/hosted/authorization.ts","../src/hosted/provider.ts"],"sourcesContent":["import { isAbsolute } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { loadHostedConfig } from './config.js';\nimport { FilePatStore } from './auth.js';\nimport { createHostedHttpServer } from './http.js';\nimport type { HostedAdapter } from './types.js';\nimport { createProviderAdapter } from './provider.js';\n\nexport async function startHosted(): Promise<void> {\n const config = loadHostedConfig();\n let adapter: HostedAdapter;\n if (config.testOnly) {\n const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;\n if (!file || !isAbsolute(file)) throw new Error('Hosted test mode requires an absolute fixture store path.');\n const { createTestOnlyAdapter } = await import('./test-only.js');\n adapter = createTestOnlyAdapter(file);\n } else {\n const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;\n if (!file) {\n adapter = createProviderAdapter(config);\n process.stderr.write('[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\\n');\n } else {\n if (!isAbsolute(file)) throw new Error('DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.');\n try { adapter = (await import(pathToFileURL(file).href)).adapter; }\n catch { throw new Error('Could not load the trusted hosted adapter.'); }\n }\n if (!adapter || ['verifyOAuth', 'resolvePatGrant', 'executeRequest'].some(key =>\n typeof adapter[key as keyof HostedAdapter] !== 'function')) throw new Error('Invalid trusted hosted adapter.');\n }\n const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;\n if (patPath && !isAbsolute(patPath)) throw new Error('Hosted PAT store must be an absolute path.');\n const server = createHostedHttpServer(config, adapter, patPath ? new FilePatStore(patPath) : undefined);\n await new Promise<void>((resolve, reject) => {\n server.once('error', reject);\n server.listen(config.port, config.bind, resolve);\n });\n process.stderr.write(`[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? ' — TEST ONLY: synthetic identity and data; no OAuth consent' : ''}\\n`);\n const shutdown = () => {\n server.close(() => process.exit(0));\n setTimeout(() => { server.closeAllConnections(); process.exit(0); }, 5000).unref();\n };\n process.once('SIGINT', shutdown);\n process.once('SIGTERM', shutdown);\n}\n","import type { HostedConfig } from './types.js';\n\nexport function loadHostedConfig(env: NodeJS.ProcessEnv = process.env): HostedConfig {\n const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === '1';\n if (testOnly && env.NODE_ENV === 'production') throw new Error('Hosted test mode is forbidden in production.');\n if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly) throw new Error('Invalid DATABRAIN_HOSTED_TEST_ONLY.');\n const validUrl = (value: string | undefined, field: string) => {\n try {\n if (!value) throw new Error();\n const url = new URL(value);\n if (url.username || url.password || url.search || url.hash || url.protocol !== 'https:') throw new Error();\n return url;\n } catch { throw new Error(`Configure ${field} as an HTTPS URL without credentials, query or fragment.`); }\n };\n // Self-hosted installs set no new variable: with neither URL given, both come from the\n // HOSTED_APP_URL origin the image already has (app, API and /mcp on one origin). HTTPS only.\n let publicValue = env.DATABRAIN_HOSTED_PUBLIC_URL;\n let issuerValue = env.DATABRAIN_HOSTED_ISSUER;\n if (!publicValue && !issuerValue && env.HOSTED_APP_URL) {\n const origin = validUrl(env.HOSTED_APP_URL, 'HOSTED_APP_URL').origin;\n publicValue = `${origin}/mcp`;\n issuerValue = origin;\n }\n const publicUrl = validUrl(publicValue, 'DATABRAIN_HOSTED_PUBLIC_URL');\n validUrl(issuerValue, 'DATABRAIN_HOSTED_ISSUER');\n if (publicUrl.pathname !== '/mcp') throw new Error('DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.');\n const port = Number(env.DATABRAIN_HOSTED_PORT || '3144');\n // Loopback by default so a laptop run is not silently on the network. A\n // container has to be told, because binding loopback inside a task means the\n // load balancer health check can never reach it and the service never\n // stabilises. Set DATABRAIN_HOSTED_BIND=0.0.0.0 in ECS.\n const bind = env.DATABRAIN_HOSTED_BIND || '127.0.0.1';\n if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error('Invalid DATABRAIN_HOSTED_PORT.');\n return { publicUrl: publicValue!, issuer: issuerValue!, port,\n bind, testOnly };\n}\n","import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { createHostedToolServer, scopeError, workspaceError } from './server.js';\nimport { createBearerVerifier } from './auth.js';\nimport { WorkspaceSelectionError, authorizeTool, assertToolArguments, requiredScopes } from './authorization.js';\nimport { HOSTED_SCOPES, HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedConfig, PatStore } from './types.js';\n\nconst HEALTH_BODY = JSON.stringify({ status: 'ok' });\n\n/** Exactly `/health`, with or without a query string; `/health/x` is not health. */\nfunction healthPath(url: string | undefined): boolean {\n const path = (url || '/').split('?')[0];\n return path === '/health';\n}\n\nfunction reply(res: ServerResponse, status: number, body: unknown): void {\n res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });\n res.end(JSON.stringify(body));\n}\n\nasync function readBody(req: IncomingMessage): Promise<unknown> {\n let size = 0;\n const chunks: Buffer[] = [];\n for await (const chunk of req) {\n size += chunk.length;\n if (size > 1_048_576) throw new Error('body_too_large');\n chunks.push(Buffer.from(chunk));\n }\n return JSON.parse(Buffer.concat(chunks).toString('utf8'));\n}\n\nexport function createHostedHttpServer(config: HostedConfig, adapter: HostedAdapter, pats?: PatStore) {\n const publicUrl = new URL(config.publicUrl);\n const metadataPath = `/.well-known/oauth-protected-resource${publicUrl.pathname === '/' ? '' : publicUrl.pathname}`;\n const metadataUrl = `${publicUrl.origin}${metadataPath}`;\n const verify = createBearerVerifier(adapter, config.publicUrl, pats);\n let active = 0;\n\n const server = createServer(async (req, res) => {\n // Liveness for the load balancer. It arrives with the target IP:port as Host,\n // so it runs before the Host/Origin checks and sets no CORS headers. It is\n // unauthenticated, reads no body and never echoes configuration.\n if (healthPath(req.url)) {\n if (req.method !== 'GET' && req.method !== 'HEAD') {\n res.writeHead(405, { Allow: 'GET, HEAD', 'Cache-Control': 'no-store' }); res.end(); return;\n }\n res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store',\n 'Content-Length': Buffer.byteLength(HEALTH_BODY) });\n res.end(req.method === 'HEAD' ? undefined : HEALTH_BODY); return;\n }\n res.setHeader('X-Content-Type-Options', 'nosniff');\n if (config.testOnly) res.setHeader('X-Databrain-Test-Only', 'true');\n try {\n // Tailscale Serve may preserve the public Host or use the loopback destination.\n // Never use Host/Forwarded headers to construct discovery URLs or trust an identity.\n const localPort = (server.address() as { port: number } | null)?.port;\n if (![publicUrl.host, `127.0.0.1:${localPort}`, `localhost:${localPort}`].includes(req.headers.host || '')) {\n reply(res, 403, { error: 'invalid_host' }); return;\n }\n if (req.headers.origin && req.headers.origin !== publicUrl.origin) {\n reply(res, 403, { error: 'invalid_origin' }); return;\n }\n if (req.headers.origin) {\n res.setHeader('Access-Control-Allow-Origin', publicUrl.origin);\n res.setHeader('Vary', 'Origin');\n res.setHeader('Access-Control-Expose-Headers', 'WWW-Authenticate, MCP-Protocol-Version');\n }\n const url = new URL(req.url || '/', publicUrl.origin);\n if (req.method === 'GET' && [metadataPath, '/.well-known/oauth-protected-resource'].includes(url.pathname)) {\n reply(res, 200, {\n resource: config.publicUrl, authorization_servers: [config.issuer],\n scopes_supported: HOSTED_SCOPES, bearer_methods_supported: ['header'],\n resource_name: config.testOnly ? 'Databrain (TEST ONLY; fixture identity)' : 'Databrain',\n }); return;\n }\n if (url.pathname !== publicUrl.pathname) { reply(res, 404, { error: 'not_found' }); return; }\n if (url.search) { reply(res, 400, { error: 'query_parameters_not_supported' }); return; }\n if (req.method === 'OPTIONS') {\n res.setHeader('Access-Control-Allow-Methods', 'POST, GET, DELETE, OPTIONS');\n res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id');\n res.writeHead(204); res.end(); return;\n }\n // Duplicate Authorization fields and cookies never select a principal.\n const authFields = req.rawHeaders.filter((_, i) => i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'authorization');\n const match = /^Bearer ([^\\s]+)$/i.exec(req.headers.authorization || '');\n if (authFields.length !== 1 || !match) throw new HostedAuthError(401, 'invalid_token');\n const principal = await verify(match[1]);\n if (req.method !== 'POST') {\n res.setHeader('Allow', 'POST, OPTIONS');\n reply(res, 405, { error: 'method_not_allowed' }); return;\n }\n if (!req.headers['content-type']?.toLowerCase().startsWith('application/json')) {\n reply(res, 415, { error: 'unsupported_media_type' }); return;\n }\n if (active >= 32) { reply(res, 503, { error: 'server_busy' }); return; }\n active++;\n let body: any;\n try { body = await readBody(req); }\n catch { active--; reply(res, 400, { error: 'invalid_request' }); return; }\n try {\n // The installed SDK accepts batches; this endpoint does not. A batch must\n // never skip the per-call HTTP authorization/challenge path below.\n if (Array.isArray(body)) { reply(res, 400, { error: 'batch_not_supported' }); return; }\n // Only an OAuth bearer delegates; a PAT never leaves this process.\n const delegation = match[1].startsWith('dbp_') ? undefined : adapter.delegate?.(match[1], principal);\n if (body?.method === 'tools/call' && typeof body.params?.name === 'string') {\n try {\n authorizeTool(body.params.name, principal);\n assertToolArguments(body.params.name, body.params.arguments, principal, delegation !== undefined);\n } catch (error) {\n // A workspace the grant does not hold, or two that disagree: answer the call as a\n // tool error with the granted names, which an AI can act on. No tool runs.\n if (error instanceof WorkspaceSelectionError) {\n reply(res, 200, { jsonrpc: '2.0', id: body.id ?? null, result: workspaceError(error) }); return;\n }\n // A scope the grant lacks: consent already trimmed the scopes to the role, so a\n // step-up challenge (403 insufficient_scope) cannot get more. It made Claude Code\n // drop the whole connection to \"needs authentication\". Answer the call instead.\n if (error instanceof HostedAuthError && error.code === 'insufficient_scope') {\n const missing = requiredScopes(body.params.name).filter(scope => !principal.scopes.includes(scope));\n reply(res, 200, { jsonrpc: '2.0', id: body.id ?? null, result: scopeError(missing) }); return;\n }\n throw error;\n }\n }\n const mcp = createHostedToolServer(principal, adapter, delegation);\n const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });\n let closed = false;\n const close = () => { if (!closed) { closed = true; void mcp.close(); } };\n res.once('close', close);\n try {\n await mcp.connect(transport);\n await transport.handleRequest(req, res, body);\n } finally { if (res.writableEnded) close(); }\n } finally { active--; }\n } catch (error) {\n if (res.headersSent) { res.end(); return; }\n const status = error instanceof HostedAuthError ? error.status : 503;\n if (status === 401) res.setHeader('WWW-Authenticate', `Bearer error=\"invalid_token\", resource_metadata=\"${metadataUrl}\"`);\n reply(res, status, { error: error instanceof HostedAuthError ? error.code : 'temporarily_unavailable' });\n }\n });\n server.requestTimeout = 30_000;\n server.headersTimeout = 10_000;\n server.keepAliveTimeout = 5_000;\n return server;\n}\n","import { AsyncLocalStorage } from 'node:async_hooks';\nimport { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { instrument } from '@posthog/mcp';\nimport { PostHog } from 'posthog-node';\nimport { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { registerAllTools } from '../tools/registry.js';\nimport { registerCreateWorkspace } from '../tools/infrastructure/create-workspace.js';\nimport { PREVIEW_PATH } from '../apps/preview.js';\nimport { enableChartApps } from '../apps/feature.js';\nimport { registerChartApps } from '../apps/registry.js';\nimport { registerAllResources } from '../resources/registry.js';\nimport { registerAllPrompts } from '../prompts/registry.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { DatabrainApiError, toolError, toolSuccess } from '../utils/errors.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport {\n WORKSPACE_FREE_TOOLS, WORKSPACE_INPUT, WORKSPACE_SPANNING_TOOLS, WorkspaceSelectionError, assertBoundArguments,\n assertToolArguments, authorizeTool, grantedNames, grantedWorkspaces, namesWorkspace, selectWorkspace,\n} from './authorization.js';\nimport { HostedAuthError } from './types.js';\nimport type { GrantedWorkspace, HostedAdapter, HostedDelegation, HostedPrincipal } from './types.js';\n\n// Stdio's instrumentation changes the wire schema (required `context`). Use that\n// same implementation, with capture disabled until hosted telemetry has an owner.\n// No bearer, request headers, tool arguments or results are sent to analytics.\nconst schemaInstrumentation = new PostHog('hosted-contract-only', { disabled: true });\n\n/** The granted workspace the running tool call acts in. Set by the tool wrapper only. */\nconst callWorkspace = new AsyncLocalStorage<{ target?: GrantedWorkspace }>();\n\nconst WORKSPACE_HINT = 'Call whoami to see the workspaces this sign-in granted, then name one.';\n\n/** A workspace selection problem, as the tool result the AI reads: reason, code, next step. */\nexport function workspaceError(error: WorkspaceSelectionError) {\n return toolError(`Error: ${error.reason} (${error.code})\\n\\nHint: ${WORKSPACE_HINT}`);\n}\n\n/** A tool this sign-in's scopes do not cover, as a tool result: the connection stays up. */\nexport function scopeError(missing: readonly string[]) {\n return toolError(`Error: This connection cannot do this. It needs ${missing.join(', ')}, which your role did not allow ` +\n 'when you connected. (INSUFFICIENT_SCOPE)\\n\\nHint: Ask a Databrain admin for a role that allows it, then connect ' +\n 'again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.');\n}\n\n/** The workspace list answer (bare or under `data`) cut to one workspace. */\nfunction onlyWorkspace(raw: unknown, target: GrantedWorkspace): unknown {\n const keep = (items: unknown) => Array.isArray(items) ? items.filter(item => {\n const record = item && typeof item === 'object' ? item as Record<string, unknown> : {};\n return record.id === target.id || record._id === target.id ||\n (record.id === undefined && record._id === undefined && target.name !== undefined && record.name === target.name);\n }) : items;\n if (Array.isArray(raw)) return keep(raw);\n if (raw && typeof raw === 'object' && 'data' in raw) return { ...raw, data: keep((raw as { data: unknown }).data) };\n return raw;\n}\n\n/** A request-local client: shared APIs/tools run unchanged, through a delegated executor. */\nclass HostedClient extends DatabrainClient {\n constructor(private readonly adapter: HostedAdapter, private readonly principal: HostedPrincipal,\n private readonly delegation?: HostedDelegation) {\n super({ apiUrl: 'https://api.usedatabrain.com', demoDomain: 'https://demo.usedatabrain.com' });\n }\n // A generated API credential must never replace the authorizing hosted principal.\n override setRuntimeApiToken(_token: string): void {}\n override isHosted(): boolean { return true; }\n\n override async request<T>(options: RequestOptions): Promise<T> {\n try {\n const name = toolContext.getStore()?.tool;\n if (!name) throw new HostedAuthError(403, 'tool_not_authorized');\n authorizeTool(name, this.principal);\n const named = callWorkspace.getStore()?.target;\n // With no workspace for the call (a tool that walks every granted workspace), a request\n // that names one top-level workspace acts in it, and says so in the header too.\n const target = named ?? (selectWorkspace(options.body, this.principal, ['workspaceName', 'workspaceId'])\n ?? selectWorkspace(options.query, this.principal, ['workspaceName', 'workspaceId']));\n const delegated = this.delegation !== undefined;\n // Chart preview rows are query output (a row may have a userId column); the issuer\n // treats them as data too. Every other body field is still checked.\n const opaque = options.method === 'POST' && options.path === PREVIEW_PATH ? ['rows']\n : options.method === 'POST' && /^\\/api\\/v2\\/custom-charts\\/[a-z][a-z0-9_-]*\\/bryn\\/turn$/.test(options.path) ? ['draft'] : undefined;\n assertBoundArguments(options.body, this.principal, { target, delegated, opaque });\n assertBoundArguments(options.query, this.principal, { target, delegated });\n let raw = await this.adapter.executeRequest(structuredClone(options), structuredClone(this.principal),\n this.delegation, target && structuredClone(target));\n // A call that named its workspace reads the workspace list as that workspace only, so a\n // tool that walks the list (list_dashboards) stays in it.\n if (named && options.method === 'GET' && options.path === '/api/v2/workspace') raw = onlyWorkspace(raw, named);\n if (!options.skipDataUnwrap && raw && typeof raw === 'object' && !Array.isArray(raw) &&\n 'data' in raw && raw.data !== null && raw.data !== undefined) return raw.data as T;\n return raw as T;\n } catch (error) {\n if (error instanceof WorkspaceSelectionError) {\n throw new DatabrainApiError(error.status, error.code, `${error.reason} (${error.code})`, undefined, WORKSPACE_HINT);\n }\n // The adapter may encounter secret-bearing remote bodies. Do not pass them to tools/logs.\n const status = error instanceof HostedAuthError ? error.status : 503;\n const detail = error instanceof HostedAuthError ? error.detail : undefined;\n // A 403 reaches the tool only with a reason about this user's own grant (the adapter\n // keeps no other 403 body): the role in that workspace, or workspace creation.\n if (status === 403 && detail?.code) {\n throw new DatabrainApiError(0, detail.code, `${detail.message ?? 'Your role does not allow this here.'} (${detail.code})`,\n undefined, 'Ask a Databrain admin for access, or pick a workspace where your role allows it.');\n }\n if (status === 401 || status === 403) {\n // Status 0 carries no API-key hint: a hosted user has no key to rotate, only a sign-in.\n throw new DatabrainApiError(0, 'HOSTED_REQUEST_DENIED',\n 'The signed-in Databrain user cannot do this: the sign-in expired or was revoked, or the granted scopes, role or workspace do not allow it. Sign in again or ask an admin.');\n }\n if (detail && (detail.code || detail.message)) {\n // The code rides with the message: a short message (\"The workspace does not allow\n // this.\") only makes sense next to its reason (DATA_APP_REQUIRED).\n const message = detail.message ?? (status === 404 ? 'Not found in the workspace this sign-in approved.'\n : 'The backend refused this request.');\n throw new DatabrainApiError(detail.status, detail.code ?? 'HOSTED_REQUEST_FAILED',\n detail.code && !message.includes(detail.code) ? `${message} (${detail.code})` : message,\n { error: { code: detail.code, message: detail.message } });\n }\n throw new DatabrainApiError(status, 'HOSTED_REQUEST_DENIED',\n status === 404\n ? 'Not found in the workspace this sign-in approved.'\n : 'The authorized backend could not complete this request. Check workspace access and hosted integration.');\n }\n }\n}\n\n/** The hosted description line for a tool that works in one workspace. */\nfunction workspaceLine(name: string, input: string): string {\n return WORKSPACE_SPANNING_TOOLS.has(name)\n ? ` With more than one granted workspace, name one in \\`${input}\\` to list only that one; leave it out to list them all.`\n : ` Needed when you granted more than one workspace: name it in \\`${input}\\`.`;\n}\n\nfunction whoami(principal: HostedPrincipal) {\n const granted = grantedWorkspaces(principal);\n return toolSuccess(JSON.stringify({\n status: 'authenticated', activeBearer: principal.credentialType,\n actorKind: principal.actorKind, userId: principal.userId, companyId: principal.companyId,\n workspaceGrant: principal.workspaces?.mode === 'all'\n ? 'All workspaces I can access (new ones are included)' : 'Only the workspaces chosen at sign-in',\n grantedWorkspaces: granted.map(item => ({ id: item.id, name: item.name })),\n ...(granted.length === 1 ? { workspaceId: granted[0].id, workspaceName: granted[0].name } : {}),\n note: granted.length === 1\n ? 'Every call works in this workspace.'\n : `Name the workspace on each call that works in one (the \\`${WORKSPACE_INPUT}\\` or \\`workspaceName\\` input): ${grantedNames(principal)}.`,\n oauthClientId: principal.clientId, scopes: principal.scopes,\n }, null, 2));\n}\n\nexport function createHostedToolServer(principal: HostedPrincipal, adapter: HostedAdapter,\n delegation?: HostedDelegation): McpServer {\n const bound = structuredClone(principal);\n const delegated = delegation !== undefined;\n const server = new McpServer({ name: 'databrain', version: MCP_SERVER_VERSION }, {\n instructions: 'Hosted Databrain: each request is authenticated as the signed-in user, with that user\\'s own role in each workspace. ' +\n 'Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. ' +\n 'When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). ' +\n 'Never ask for a service token or put credentials in tool arguments. ' +\n 'Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. ' +\n 'Use ask_question for inline chart or KPI answers. Chart controls and save_chart_as_dashboard use the same workspace and role; ' +\n 'saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer.',\n });\n\n // The existing shared registry already wraps server.tool for intent telemetry. Layer\n // hosted policy underneath it; keep every handler and annotation. A tool that works in one\n // workspace says so, and gains a `workspace` input when its own schema names none.\n const register = server.tool.bind(server) as (...args: any[]) => unknown;\n server.tool = ((...args: any[]) => {\n const name = args[0] as string;\n const index = args.length - 1;\n const handler = args[index] as (...values: any[]) => CallToolResult | Promise<CallToolResult>;\n const shape = typeof args[1] === 'string' && args[2] && typeof args[2] === 'object' &&\n !('readOnlyHint' in args[2]) ? args[2] as Record<string, unknown> : undefined;\n const ownSelector = shape && (['workspaceName', 'workspaceId'] as const).find(key => Object.hasOwn(shape, key));\n const addsInput = shape !== undefined && !ownSelector && !WORKSPACE_FREE_TOOLS.has(name) &&\n !Object.hasOwn(shape, WORKSPACE_INPUT);\n if (shape && !WORKSPACE_FREE_TOOLS.has(name)) {\n if (addsInput) {\n args[2] = { ...shape, [WORKSPACE_INPUT]: z.string().min(1).max(512).optional()\n .describe(WORKSPACE_SPANNING_TOOLS.has(name)\n ? 'Workspace id or name. Leave it out to cover every granted workspace.'\n : 'Workspace id or name. Needed when you granted more than one workspace.') };\n }\n args[1] = `${args[1]}${workspaceLine(name, addsInput ? WORKSPACE_INPUT : ownSelector!)}`;\n }\n args[index] = async (...values: any[]) => {\n try {\n authorizeTool(name, bound);\n const target = assertToolArguments(name, values[0], bound, delegated);\n if (name === 'whoami') return whoami(bound);\n const input = values[0] && typeof values[0] === 'object' ? values[0] as Record<string, unknown> : undefined;\n if (input?.projectDir !== undefined) return toolError('projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory.');\n if (!target && !WORKSPACE_FREE_TOOLS.has(name) && !WORKSPACE_SPANNING_TOOLS.has(name) && !namesWorkspace(input)) {\n throw new WorkspaceSelectionError(400, 'WORKSPACE_REQUIRED',\n `Name the workspace for this call. Granted: ${grantedNames(bound)}.`);\n }\n if (input) {\n // The new input is a header, never a body field. A selector the tool declares\n // gets the call's workspace when it was left out, as for one granted workspace before.\n if (addsInput) delete input[WORKSPACE_INPUT];\n if (shape && target) {\n if (Object.hasOwn(shape, 'workspaceId')) input.workspaceId = target.id;\n if (Object.hasOwn(shape, 'workspaceName') && target.name !== undefined) input.workspaceName = target.name;\n }\n }\n const result = await callWorkspace.run({ target }, () => handler(...values));\n // The iframe's follow-up calls have no model to repeat the workspace selector.\n // Carry only this verified call's workspace, never a draft's claimed choices.\n if (target && result?._meta?.['ui/resourceUri']) {\n return { ...result, _meta: { ...result._meta, 'databrain/workspace': target } };\n }\n return result;\n } catch (error) {\n if (error instanceof WorkspaceSelectionError) return workspaceError(error);\n return toolError('Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.');\n }\n };\n return register(...args);\n }) as McpServer['tool'];\n\n const client = new HostedClient(adapter, bound, delegation);\n enableChartApps(server);\n registerAllTools(server, client);\n // Hosted only: a grant of \"All workspaces I can access\" may create one (the issuer decides).\n registerCreateWorkspace(server, client);\n registerAllResources(server);\n registerAllPrompts(server);\n // Keep Apps on the principal-bound client and under the same registration policy.\n registerChartApps(server, client);\n instrument(server, schemaInstrumentation, { beforeSend: () => null });\n return server;\n}\n","import { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../../client/databrain-client.js';\nimport { DatabrainApiError, toolError, toolSuccess, stringify } from '../../utils/errors.js';\nimport { WRITE_CREATE } from '../annotations.js';\n\n/**\n * Registered by the hosted server only (stdio dropped it in v0.2.0). The issuer allows it\n * only for a sign-in granted \"All workspaces I can access\" and a role that may create one.\n */\nexport function registerCreateWorkspace(server: McpServer, client: DatabrainClient): void {\n server.tool(\n 'create_workspace',\n 'Create a new workspace to connect a datasource or datamart for dashboard building. ' +\n 'Works only when this sign-in granted \"All workspaces I can access\" and your role may create workspaces; ' +\n 'the new workspace is usable on the next call.',\n {\n name: z.string().describe('Unique workspace name'),\n connectionType: z\n .enum(['DATASOURCE', 'DATAMART', 'MULTI_DATASOURCE'])\n .optional()\n .describe('Connection type — DATASOURCE, DATAMART, or MULTI_DATASOURCE'),\n datasourceName: z\n .string()\n .optional()\n .describe('Datasource name (required when connectionType is DATASOURCE)'),\n datamartName: z\n .string()\n .optional()\n .describe('Datamart name (required when connectionType is DATAMART)'),\n body: z\n .record(z.unknown())\n .optional()\n .describe('Raw API body passthrough for POST /api/v2/workspace'),\n },\n WRITE_CREATE,\n async (params) => {\n try {\n const body: Record<string, unknown> = params.body\n ? { ...params.body }\n : {\n name: params.name,\n connectionType: params.connectionType,\n datasourceName: params.datasourceName,\n datamartName: params.datamartName,\n };\n\n const result = await client.request<{ name?: string; id?: string; _id?: string; error?: unknown }>({\n method: 'POST',\n path: '/api/v2/workspace',\n body,\n auth: 'service',\n invalidateCache: ['list_workspaces'],\n });\n\n if (result.error) {\n return toolError(`Workspace creation failed: ${stringify(result.error)}`);\n }\n\n return toolSuccess(\n `Workspace \"${result.name || params.name}\" created successfully.\\n\\n` +\n 'Next steps:\\n' +\n '1. Use `create_data_app` to create a data app linked to this workspace\\n' +\n '2. Build dashboards in the Databrain UI using this workspace\\n' +\n '3. Use `create_embed` to embed dashboards',\n );\n } catch (err) {\n if (err instanceof DatabrainApiError) return err.toToolResponse();\n return toolError(`Unexpected error: ${(err as Error).message}`);\n }\n },\n );\n}\n","import { HostedAuthError } from './types.js';\nimport type { GrantedWorkspace, HostedPrincipal, HostedScope } from './types.js';\n\n/** Explicit exhaustive policy: a newly registered tool is denied until it gets a policy. */\nexport const TOOL_SCOPES: Readonly<Record<string, readonly HostedScope[]>> = {\n whoami: [],\n list_datasources: ['mcp:datamarts:read'], discover_datasource_schema: ['mcp:datamarts:read'],\n list_datamarts: ['mcp:datamarts:read'], list_workspaces: ['mcp:datamarts:read'],\n sync_datasource: ['mcp:datamarts:write'], create_datamart: ['mcp:datamarts:write'],\n list_data_apps: ['mcp:dashboards:read'], list_tenants: ['mcp:dashboards:read'],\n create_data_app: ['mcp:embeds:write'], list_api_tokens: ['mcp:embeds:write'],\n create_api_token: ['mcp:embeds:write'], rotate_api_token: ['mcp:embeds:write'],\n create_embed: ['mcp:embeds:write'], list_embeds: ['mcp:dashboards:read'],\n get_embed_details: ['mcp:dashboards:read'], update_embed: ['mcp:embeds:write'],\n customize_embed_theme: ['mcp:embeds:write'], get_demo_link: ['mcp:embeds:write'],\n generate_guest_token: ['mcp:embeds:write'], generate_embed_code: ['mcp:dashboards:read'],\n create_workspace: ['mcp:datamarts:write'],\n list_dashboards: ['mcp:dashboards:read'], create_dashboard: ['mcp:dashboards:write'],\n get_dashboard: ['mcp:dashboards:read'], dashboard_snapshot: ['mcp:dashboards:read'], generate_dashboard_tiles: ['mcp:dashboards:write', 'mcp:query'],\n ask_question: ['mcp:query'], get_semantic_layer: ['mcp:datamarts:read'],\n update_semantic_layer: ['mcp:datamarts:write'], start_semantic_layer_generation: ['mcp:datamarts:write'],\n get_semantic_layer_generation_status: ['mcp:datamarts:read'],\n search_semantic_model: ['mcp:datamarts:read'], get_semantic_entity: ['mcp:datamarts:read'],\n propose_semantic_change: ['mcp:datamarts:read'], apply_semantic_change: ['mcp:datamarts:write'],\n eval_semantic_model: ['mcp:datamarts:read', 'mcp:query'],\n list_widgets: ['mcp:dashboards:read'], validate_metric_spec: ['mcp:dashboards:read', 'mcp:query'],\n create_or_update_metric_from_query: ['mcp:dashboards:write', 'mcp:query'],\n create_workspace_metric: ['mcp:dashboards:write', 'mcp:query'],\n add_widget: ['mcp:dashboards:write'], update_widget: ['mcp:dashboards:write'],\n remove_widget: ['mcp:dashboards:write'], generate_widget: ['mcp:dashboards:write', 'mcp:query'],\n list_scheduled_reports: ['mcp:dashboards:read'],\n custom_chart_edit: ['mcp:custom-charts:write'], custom_chart_preview: ['mcp:custom-charts:read'],\n load_custom_chart_bundle: ['mcp:custom-charts:read'],\n load_custom_chart_runtime: ['mcp:custom-charts:read'],\n custom_chart_scaffold: [], custom_chart_validate: ['mcp:custom-charts:read'],\n custom_chart_upload: ['mcp:custom-charts:write'], list_custom_charts: ['mcp:custom-charts:read'],\n publish_custom_chart: ['mcp:custom-charts:write'],\n // Chart tile controls (the chart-apps composition). The same routes as ask_question and a\n // dashboard save; listed so a hosted composition is not refused for want of a policy.\n preview_chart: ['mcp:query'], save_chart_as_dashboard: ['mcp:dashboards:write', 'mcp:query'],\n // Saved-widget rendering mints a guest token; retain the issuer's embed-write boundary.\n render_chart: ['mcp:dashboards:read', 'mcp:query', 'mcp:embeds:write'],\n refresh_widget: ['mcp:dashboards:read', 'mcp:query', 'mcp:embeds:write'],\n drill_down: ['mcp:dashboards:read', 'mcp:query', 'mcp:embeds:write'],\n change_date_range: ['mcp:dashboards:read', 'mcp:query', 'mcp:embeds:write'],\n};\n\nexport function requiredScopes(name: string): readonly HostedScope[] {\n if (!Object.hasOwn(TOOL_SCOPES, name)) throw new HostedAuthError(403, 'tool_not_authorized');\n return TOOL_SCOPES[name];\n}\n\nexport function authorizeTool(name: string, principal: HostedPrincipal): void {\n if (principal.expiresAt !== undefined && principal.expiresAt <= Date.now() / 1000) throw new HostedAuthError(401, 'invalid_token');\n if (requiredScopes(name).some(scope => !principal.scopes.includes(scope))) throw new HostedAuthError(403, 'insufficient_scope');\n}\n\n/**\n * A tool's own top-level argument whose name is also a forbidden identity key, with the\n * only values it may take. `list_dashboards.scope` picks the listing, not an OAuth scope.\n */\nconst TOOL_ARGUMENT_VALUES: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>> = {\n list_dashboards: { scope: ['auto', 'data_app', 'global'] },\n};\n\n/**\n * Top-level tool arguments that carry query rows, not selectors. A row may have a\n * `userId` or `workspaceId` column; the issuer treats the rows as data.\n */\nconst TOOL_OPAQUE_ARGUMENTS: Readonly<Record<string, readonly string[]>> = {\n preview_chart: ['rows'],\n custom_chart_preview: ['rows', 'manifest'],\n custom_chart_edit: ['draft'],\n};\n\n/**\n * Tool-call arguments: the allowed own arguments by exact value, then the shared binding rules\n * against the call's workspace. Returns that workspace (see selectWorkspace).\n */\nexport function assertToolArguments(name: string, value: unknown, principal: HostedPrincipal,\n delegated = false): GrantedWorkspace | undefined {\n const allowed = Object.hasOwn(TOOL_ARGUMENT_VALUES, name) ? TOOL_ARGUMENT_VALUES[name] : {};\n const opaque = Object.hasOwn(TOOL_OPAQUE_ARGUMENTS, name) ? TOOL_OPAQUE_ARGUMENTS[name] : undefined;\n const target = selectWorkspace(value, principal);\n if (!value || typeof value !== 'object' || Array.isArray(value)) {\n assertBoundArguments(value, principal, { target, delegated });\n return target;\n }\n const rest: Record<string, unknown> = {};\n for (const [key, child] of Object.entries(value)) {\n if (!Object.hasOwn(allowed, key)) { rest[key] = child; continue; }\n if (typeof child !== 'string' || !allowed[key].includes(child)) throw new HostedAuthError(403, 'identity_argument_forbidden');\n }\n assertBoundArguments(rest, principal, { target, delegated, opaque });\n return target;\n}\n\n/**\n * Tools that act on no single workspace: identity, the granted list, company-level\n * custom charts, local code generation, and workspace creation. Every other tool\n * reaches a workspace-scoped route, so it can name its workspace.\n */\nexport const WORKSPACE_FREE_TOOLS: ReadonlySet<string> = new Set([\n 'whoami', 'list_workspaces', 'create_workspace', 'generate_embed_code',\n 'custom_chart_preview', 'load_custom_chart_bundle', 'load_custom_chart_runtime',\n 'custom_chart_scaffold', 'custom_chart_validate', 'custom_chart_upload', 'list_custom_charts', 'publish_custom_chart',\n]);\n\n/**\n * Tools that walk every granted workspace when the call names none (each request then names\n * its own workspace), and only the named one when it does. They never ask for a workspace.\n */\nexport const WORKSPACE_SPANNING_TOOLS: ReadonlySet<string> = new Set(['list_dashboards']);\n\n/** The workspace selector a hosted tool gains when its own schema has none. Sent only as a header. */\nexport const WORKSPACE_INPUT = 'workspace';\n\n/** Raised before any request when a call names its workspace wrongly; the tool shows the message. */\nexport class WorkspaceSelectionError extends HostedAuthError {\n constructor(status: 400 | 404, code: string, public readonly reason: string) {\n super(status, code);\n }\n}\n\nexport function grantedWorkspaces(principal: HostedPrincipal): GrantedWorkspace[] {\n if (principal.grantedWorkspaces) return principal.grantedWorkspaces;\n return principal.workspaceId ? [{ id: principal.workspaceId, name: principal.workspaceName }] : [];\n}\n\n/** \"A, B, C\", at most 20 names, then \"and N more\". Only the user's own granted names. */\nexport function grantedNames(principal: HostedPrincipal): string {\n const names = grantedWorkspaces(principal).map(item => item.name ?? item.id);\n return names.length > 20 ? `${names.slice(0, 20).join(', ')} and ${names.length - 20} more` : names.join(', ');\n}\n\n/** A selector is a granted workspace's id, else its exact name. Nothing else, and never two. */\nfunction findGranted(principal: HostedPrincipal, key: string, value: unknown): GrantedWorkspace {\n const granted = grantedWorkspaces(principal);\n const matches = typeof value !== 'string' ? []\n : key === 'workspaceId' ? granted.filter(item => item.id === value)\n : key === 'workspaceName' ? granted.filter(item => item.name === value)\n : granted.some(item => item.id === value) ? granted.filter(item => item.id === value)\n : granted.filter(item => item.name === value);\n if (matches.length !== 1) {\n throw new WorkspaceSelectionError(404, 'NOT_FOUND_IN_GRANT',\n `Workspace ${JSON.stringify(String(value).slice(0, 100))} is not one this sign-in granted. Granted: ${grantedNames(principal)}.`);\n }\n return matches[0];\n}\n\n/**\n * The one workspace a tool call acts in: the top-level `workspace`, `workspaceName` or\n * `workspaceId` inputs (all must name the same granted workspace), else the only granted\n * workspace, else none (the issuer then asks for one, or the route is company-level).\n */\nexport function selectWorkspace(args: unknown, principal: HostedPrincipal,\n keys: readonly string[] = [WORKSPACE_INPUT, 'workspaceName', 'workspaceId']): GrantedWorkspace | undefined {\n let target: GrantedWorkspace | undefined;\n if (args && typeof args === 'object' && !Array.isArray(args)) {\n for (const key of keys) {\n const value = (args as Record<string, unknown>)[key];\n if (value === undefined) continue;\n const found = findGranted(principal, key, value);\n if (target && target.id !== found.id) {\n throw new WorkspaceSelectionError(400, 'WORKSPACE_CONFLICT',\n 'These inputs name different workspaces. Name one workspace for this call.');\n }\n target = found;\n }\n }\n const granted = grantedWorkspaces(principal);\n return target ?? (granted.length === 1 ? granted[0] : undefined);\n}\n\n/** True when a workspace selector appears anywhere in the arguments, raw passthroughs included. */\nexport function namesWorkspace(value: unknown): boolean {\n if (!value || typeof value !== 'object') return false;\n return Object.entries(value).some(([key, child]) =>\n ([WORKSPACE_INPUT, 'workspaceName', 'workspaceId'].includes(key) && child !== undefined) || namesWorkspace(child));\n}\n\n/** What one tool call is bound to, beyond the principal. */\nexport interface ArgumentBinding {\n /** The call's workspace (selectWorkspace). Every workspace selector must name it. */\n target?: GrantedWorkspace;\n /**\n * The call runs as a delegated OAuth request: the issuer checks any tenant id against its\n * route policy on that very call, as it does for the app user, and refuses a route that\n * claims none. Without it (a PAT, a non-delegating adapter) a tenant needs `tenantIds`.\n */\n delegated?: boolean;\n /** Top-level keys holding data rather than selectors (query rows), never scanned. */\n opaque?: readonly string[];\n}\n\nfunction tenantAllowed(child: unknown, principal: HostedPrincipal, delegated: boolean): boolean {\n if (typeof child !== 'string') return false;\n if (principal.tenantIds) return principal.tenantIds.includes(child);\n return delegated && principal.credentialType === 'oauth';\n}\n\n/**\n * Reject conflicting selectors even in raw body passthroughs before a handler can use them.\n * A workspace selector must name the call's target when it has one, else a granted workspace.\n */\nexport function assertBoundArguments(value: unknown, principal: HostedPrincipal, binding: ArgumentBinding = {}): void {\n if (!value || typeof value !== 'object') return;\n const { opaque, ...nested } = binding;\n for (const [key, child] of Object.entries(value)) {\n if (opaque?.includes(key) && !Array.isArray(value)) continue;\n if (key === 'workspaceId' || key === 'workspaceName') {\n const target = binding.target;\n if (target ? child !== (key === 'workspaceId' ? target.id : target.name) : !findGranted(principal, key, child)) {\n throw new HostedAuthError(403, 'principal_mismatch');\n }\n }\n if (['companyId', 'userId'].includes(key) && child !== principal[key as 'companyId' | 'userId']) {\n throw new HostedAuthError(403, 'principal_mismatch');\n }\n if (['scope', 'scopes', 'authUser', 'actorKind', 'credentialType', 'oauthClientId', 'operatorEmail',\n 'session_variables', 'isAllClient', 'isAdmin', 'serviceToken', 'apiToken', 'authorization'].includes(key)) {\n throw new HostedAuthError(403, 'identity_argument_forbidden');\n }\n if (['clientId', 'tenantId'].includes(key) && !tenantAllowed(child, principal, binding.delegated === true)) {\n throw new HostedAuthError(403, 'tenant_not_authorized');\n }\n assertBoundArguments(child, principal, nested);\n }\n}\n","import { parseStudioStream } from '../custom-chart/studio.js';\nimport { z } from 'zod';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { principalSchema } from './auth.js';\nimport { parseErrorBody } from '../client/error-body.js';\nimport { HostedAuthError } from './types.js';\nimport type { HostedAdapter, HostedConfig, HostedDelegation, HostedErrorDetail } from './types.js';\n\nconst USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION} (hosted)`;\nconst REQUEST_TIMEOUT_MS = 30_000;\n/** Request headers a tool may set; nothing that can carry or replace a credential. */\nconst FORWARDED_HEADERS = new Set(['idempotency-key']);\n/** The call's workspace, for the issuer's delegated path. Only this adapter sets it. */\nexport const WORKSPACE_HEADER = 'X-Databrain-Workspace';\n/**\n * 403 codes whose reason is about the caller's own grant in a workspace it named and holds,\n * so they reveal nothing about other workspaces or companies. Every other 403 stays opaque.\n */\nconst GRANT_DENIALS = new Set(['ROLE_NOT_ALLOWED', 'WORKSPACE_CREATE_NOT_ALLOWED']);\n\n/** Code and message only, as short plain text; never other body fields or the bearer. */\nfunction errorDetail(status: number, text: string, bearer: string | undefined): HostedErrorDetail {\n let parsed: unknown;\n try { parsed = JSON.parse(text); } catch { return { status }; }\n const envelope = parseErrorBody(parsed);\n // A dashboard write the API refuses tile by tile (422 `{tileVerdicts}`) carries no\n // envelope; its problems are the only reason a tool can act on.\n const tiles = tileProblems(parsed);\n const code = envelope.code ?? (tiles ? 'TILE_VALIDATION_FAILED' : undefined);\n const message = envelope.message ?? tiles;\n const clean = (value: string | undefined, max: number) => {\n if (!value) return undefined;\n let out = value.replace(/[\\u0000-\\u001f\\u007f]+/g, ' ').trim();\n if (bearer) out = out.split(bearer).join('[redacted]');\n return out.slice(0, max) || undefined;\n };\n // Long enough for the issuer's list of up to 20 granted workspace names.\n return { status, code: code && /^[A-Za-z0-9_.:-]{1,64}$/.test(code) ? code : undefined,\n message: clean(message, 1200) };\n}\n\n/** \"Tile t1: problem; problem. Tile t2: ...\" for the tiles a dashboard write refused. */\nfunction tileProblems(body: unknown): string | undefined {\n const verdicts = (body as { tileVerdicts?: unknown } | null)?.tileVerdicts;\n if (!Array.isArray(verdicts)) return undefined;\n const lines = verdicts.flatMap((verdict) => {\n const { id, ok, problems } = (verdict ?? {}) as { id?: unknown; ok?: unknown; problems?: unknown };\n if (ok !== false || !Array.isArray(problems)) return [];\n const words = problems.filter((p): p is string => typeof p === 'string');\n return words.length ? [`Tile ${typeof id === 'string' ? id : '?'}: ${words.join(' ')}`] : [];\n });\n return lines.length ? `The dashboard was not saved. ${lines.join(' ')}` : undefined;\n}\n\n/** BE-3's documented principal endpoint is the trust boundary for opaque OAuth tokens. */\nexport function createProviderAdapter(config: HostedConfig): HostedAdapter {\n const issuer = new URL(config.issuer);\n if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash) {\n throw new Error('Invalid hosted authorization server configuration.');\n }\n const apiBase = config.issuer.replace(/\\/$/, '');\n const endpoint = `${apiBase}/oauth/principal`;\n const publicOrigin = new URL(config.publicUrl).origin;\n // Handle -> bearer, for this process only. A handle is unreadable and dies with its request.\n const bearers = new WeakMap<HostedDelegation, string>();\n const responseSchema = principalSchema.extend({ issuer: z.literal(config.issuer) }).strip();\n return {\n async verifyOAuth(token, resource) {\n try {\n // Only the explicitly configured issuer ever receives the token: here to verify it,\n // and in executeRequest for its delegated REST path. No redirects, other origins,\n // cache or service-token fallback.\n const response = await fetch(endpoint, {\n headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },\n redirect: 'error', signal: AbortSignal.timeout(10_000),\n });\n if (!response.ok) throw new HostedAuthError(response.status >= 500 ? 503 : 401, 'invalid_token');\n const { issuer: _issuer, ...principal } = responseSchema.parse(await response.json());\n if (principal.resource !== resource || principal.credentialType !== 'oauth') throw new HostedAuthError(401, 'invalid_token');\n return principal;\n } catch (error) {\n if (error instanceof HostedAuthError) throw error;\n throw new HostedAuthError(401, 'invalid_token');\n }\n },\n async resolvePatGrant() { throw new HostedAuthError(401, 'pat_membership_adapter_required'); },\n delegate(token) {\n const handle: HostedDelegation = Object.freeze({ kind: 'hosted-delegation' as const });\n bearers.set(handle, token);\n return handle;\n },\n async executeRequest(options, principal, delegation, workspace) {\n // The backend's delegated path re-verifies this bearer for this resource on every\n // call, then binds workspace, objects, role and audit. Only the configured issuer\n // receives it, exactly as for /oauth/principal. A guest-token call carries only the\n // guest token the backend minted for this user's earlier, authorized call.\n const bearer = delegation ? bearers.get(delegation) : undefined;\n if (options.auth !== 'none' && !bearer) throw new HostedAuthError(503, 'delegated_backend_adapter_required');\n if (options.auth === 'none' && !options.token) throw new HostedAuthError(403, 'tool_not_authorized');\n if (!options.path.startsWith('/') || options.path.startsWith('//')) throw new HostedAuthError(403, 'tool_not_authorized');\n const url = new URL(`${apiBase}${options.path}`);\n if (url.origin !== issuer.origin) throw new HostedAuthError(403, 'tool_not_authorized');\n for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);\n const headers: Record<string, string> = {\n Accept: 'application/json', 'Content-Type': 'application/json', 'User-Agent': USER_AGENT,\n 'X-Databrain-Client': USER_AGENT,\n };\n for (const [key, value] of Object.entries(options.headers ?? {})) {\n if (FORWARDED_HEADERS.has(key.toLowerCase())) headers[key] = value;\n }\n const tool = toolContext.getStore();\n if (tool) {\n headers['X-Databrain-MCP-Tool'] = tool.tool;\n headers['X-Databrain-MCP-Tool-Category'] = tool.category;\n headers['X-Databrain-MCP-Workflow-Intent'] = tool.workflowIntent;\n headers['X-Databrain-MCP-Input-Mode'] = tool.inputMode;\n }\n if (options.auth === 'none') {\n headers['x-plugin-token'] = options.token!;\n headers.Origin = publicOrigin;\n } else {\n headers.Authorization = `Bearer ${bearer}`;\n // Same rule as the bearer: only with it, only to the issuer, and only a workspace\n // this principal holds. The issuer re-checks it against the live grant.\n if (workspace) {\n if (!principal.grantedWorkspaces?.some(item => item.id === workspace.id) &&\n principal.workspaceId !== workspace.id) throw new HostedAuthError(403, 'principal_mismatch');\n headers[WORKSPACE_HEADER] = workspace.id;\n }\n }\n const response = await fetch(url, {\n method: options.method, headers, redirect: 'error',\n body: options.body === undefined ? undefined : JSON.stringify(options.body),\n signal: AbortSignal.timeout(options.timeoutMs ?? REQUEST_TIMEOUT_MS),\n });\n const text = await response.text();\n if (!response.ok) {\n // A wrong-workspace object is a 404, like a missing one. 401, 403 and 5xx keep the\n // status class only. Other 4xx keep the backend's code and message (a validation\n // reason, `layer_not_found`), so a tool can recover as it does on stdio.\n const forbidden = response.status === 403 ? errorDetail(403, text, bearer) : undefined;\n if (forbidden?.code && GRANT_DENIALS.has(forbidden.code)) {\n throw new HostedAuthError(403, 'delegated_request_denied', forbidden);\n }\n const status = response.status === 403 && options.responseFormat === 'studio-sse' ? 403 : response.status === 401 ? 401 : response.status >= 500 ? 503\n : response.status === 403 || response.status === 404 ? 404 : 400;\n const detail = status === 401 || status === 503 || response.status === 403 ? undefined\n : errorDetail(response.status, text, bearer);\n throw new HostedAuthError(status, 'delegated_request_denied', detail);\n }\n try { return options.responseFormat === 'studio-sse' ? parseStudioStream(text) : text ? JSON.parse(text) : null; }\n catch { throw new HostedAuthError(503, 'delegated_response_invalid'); }\n },\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;;;ACCvB,SAAS,iBAAiB,MAAyB,QAAQ,KAAmB;AACnF,QAAM,WAAW,IAAI,+BAA+B;AACpD,MAAI,YAAY,IAAI,aAAa,aAAc,OAAM,IAAI,MAAM,8CAA8C;AAC7G,MAAI,IAAI,8BAA8B,CAAC,SAAU,OAAM,IAAI,MAAM,qCAAqC;AACtG,QAAM,WAAW,CAAC,OAA2B,UAAkB;AAC7D,QAAI;AACF,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,YAAM,MAAM,IAAI,IAAI,KAAK;AACzB,UAAI,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,QAAQ,IAAI,aAAa,SAAU,OAAM,IAAI,MAAM;AACzG,aAAO;AAAA,IACT,QAAQ;AAAE,YAAM,IAAI,MAAM,aAAa,KAAK,0DAA0D;AAAA,IAAG;AAAA,EAC3G;AAGA,MAAI,cAAc,IAAI;AACtB,MAAI,cAAc,IAAI;AACtB,MAAI,CAAC,eAAe,CAAC,eAAe,IAAI,gBAAgB;AACtD,UAAM,SAAS,SAAS,IAAI,gBAAgB,gBAAgB,EAAE;AAC9D,kBAAc,GAAG,MAAM;AACvB,kBAAc;AAAA,EAChB;AACA,QAAM,YAAY,SAAS,aAAa,6BAA6B;AACrE,WAAS,aAAa,yBAAyB;AAC/C,MAAI,UAAU,aAAa,OAAQ,OAAM,IAAI,MAAM,+CAA+C;AAClG,QAAM,OAAO,OAAO,IAAI,yBAAyB,MAAM;AAKvD,QAAM,OAAO,IAAI,yBAAyB;AAC1C,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,QAAQ,OAAO,MAAO,OAAM,IAAI,MAAM,gCAAgC;AAC5G,SAAO;AAAA,IAAE,WAAW;AAAA,IAAc,QAAQ;AAAA,IAAc;AAAA,IACtD;AAAA,IAAM;AAAA,EAAS;AACnB;;;ACnCA,SAAS,oBAA+D;AACxE,SAAS,qCAAqC;;;ACD9C,SAAS,yBAAyB;AAClC,SAAS,KAAAA,UAAS;AAClB,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;;;ACLxB,SAAS,SAAS;AAUX,SAAS,wBAAwB,QAAmB,QAA+B;AACxF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAGA;AAAA,MACE,MAAM,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,MACjD,gBAAgB,EACb,KAAK,CAAC,cAAc,YAAY,kBAAkB,CAAC,EACnD,SAAS,EACT,SAAS,kEAA6D;AAAA,MACzE,gBAAgB,EACb,OAAO,EACP,SAAS,EACT,SAAS,8DAA8D;AAAA,MAC1E,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,0DAA0D;AAAA,MACtE,MAAM,EACH,OAAO,EAAE,QAAQ,CAAC,EAClB,SAAS,EACT,SAAS,qDAAqD;AAAA,IACnE;AAAA,IACA;AAAA,IACA,OAAO,WAAW;AAChB,UAAI;AACF,cAAM,OAAgC,OAAO,OACzC,EAAE,GAAG,OAAO,KAAK,IACjB;AAAA,UACE,MAAM,OAAO;AAAA,UACb,gBAAgB,OAAO;AAAA,UACvB,gBAAgB,OAAO;AAAA,UACvB,cAAc,OAAO;AAAA,QACvB;AAEJ,cAAM,SAAS,MAAM,OAAO,QAAuE;AAAA,UACjG,QAAQ;AAAA,UACR,MAAM;AAAA,UACN;AAAA,UACA,MAAM;AAAA,UACN,iBAAiB,CAAC,iBAAiB;AAAA,QACrC,CAAC;AAED,YAAI,OAAO,OAAO;AAChB,iBAAO,UAAU,8BAA8B,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,QAC1E;AAEA,eAAO;AAAA,UACL,cAAc,OAAO,QAAQ,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAK1C;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAmB,QAAO,IAAI,eAAe;AAChE,eAAO,UAAU,qBAAsB,IAAc,OAAO,EAAE;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACF;;;ACpEO,IAAM,cAAgE;AAAA,EAC3E,QAAQ,CAAC;AAAA,EACT,kBAAkB,CAAC,oBAAoB;AAAA,EAAG,4BAA4B,CAAC,oBAAoB;AAAA,EAC3F,gBAAgB,CAAC,oBAAoB;AAAA,EAAG,iBAAiB,CAAC,oBAAoB;AAAA,EAC9E,iBAAiB,CAAC,qBAAqB;AAAA,EAAG,iBAAiB,CAAC,qBAAqB;AAAA,EACjF,gBAAgB,CAAC,qBAAqB;AAAA,EAAG,cAAc,CAAC,qBAAqB;AAAA,EAC7E,iBAAiB,CAAC,kBAAkB;AAAA,EAAG,iBAAiB,CAAC,kBAAkB;AAAA,EAC3E,kBAAkB,CAAC,kBAAkB;AAAA,EAAG,kBAAkB,CAAC,kBAAkB;AAAA,EAC7E,cAAc,CAAC,kBAAkB;AAAA,EAAG,aAAa,CAAC,qBAAqB;AAAA,EACvE,mBAAmB,CAAC,qBAAqB;AAAA,EAAG,cAAc,CAAC,kBAAkB;AAAA,EAC7E,uBAAuB,CAAC,kBAAkB;AAAA,EAAG,eAAe,CAAC,kBAAkB;AAAA,EAC/E,sBAAsB,CAAC,kBAAkB;AAAA,EAAG,qBAAqB,CAAC,qBAAqB;AAAA,EACvF,kBAAkB,CAAC,qBAAqB;AAAA,EACxC,iBAAiB,CAAC,qBAAqB;AAAA,EAAG,kBAAkB,CAAC,sBAAsB;AAAA,EACnF,eAAe,CAAC,qBAAqB;AAAA,EAAG,oBAAoB,CAAC,qBAAqB;AAAA,EAAG,0BAA0B,CAAC,wBAAwB,WAAW;AAAA,EACnJ,cAAc,CAAC,WAAW;AAAA,EAAG,oBAAoB,CAAC,oBAAoB;AAAA,EACtE,uBAAuB,CAAC,qBAAqB;AAAA,EAAG,iCAAiC,CAAC,qBAAqB;AAAA,EACvG,sCAAsC,CAAC,oBAAoB;AAAA,EAC3D,uBAAuB,CAAC,oBAAoB;AAAA,EAAG,qBAAqB,CAAC,oBAAoB;AAAA,EACzF,yBAAyB,CAAC,oBAAoB;AAAA,EAAG,uBAAuB,CAAC,qBAAqB;AAAA,EAC9F,qBAAqB,CAAC,sBAAsB,WAAW;AAAA,EACvD,cAAc,CAAC,qBAAqB;AAAA,EAAG,sBAAsB,CAAC,uBAAuB,WAAW;AAAA,EAChG,oCAAoC,CAAC,wBAAwB,WAAW;AAAA,EACxE,yBAAyB,CAAC,wBAAwB,WAAW;AAAA,EAC7D,YAAY,CAAC,sBAAsB;AAAA,EAAG,eAAe,CAAC,sBAAsB;AAAA,EAC5E,eAAe,CAAC,sBAAsB;AAAA,EAAG,iBAAiB,CAAC,wBAAwB,WAAW;AAAA,EAC9F,wBAAwB,CAAC,qBAAqB;AAAA,EAC9C,mBAAmB,CAAC,yBAAyB;AAAA,EAAG,sBAAsB,CAAC,wBAAwB;AAAA,EAC/F,0BAA0B,CAAC,wBAAwB;AAAA,EACnD,2BAA2B,CAAC,wBAAwB;AAAA,EACpD,uBAAuB,CAAC;AAAA,EAAG,uBAAuB,CAAC,wBAAwB;AAAA,EAC3E,qBAAqB,CAAC,yBAAyB;AAAA,EAAG,oBAAoB,CAAC,wBAAwB;AAAA,EAC/F,sBAAsB,CAAC,yBAAyB;AAAA;AAAA;AAAA,EAGhD,eAAe,CAAC,WAAW;AAAA,EAAG,yBAAyB,CAAC,wBAAwB,WAAW;AAAA;AAAA,EAE3F,cAAc,CAAC,uBAAuB,aAAa,kBAAkB;AAAA,EACrE,gBAAgB,CAAC,uBAAuB,aAAa,kBAAkB;AAAA,EACvE,YAAY,CAAC,uBAAuB,aAAa,kBAAkB;AAAA,EACnE,mBAAmB,CAAC,uBAAuB,aAAa,kBAAkB;AAC5E;AAEO,SAAS,eAAe,MAAsC;AACnE,MAAI,CAAC,OAAO,OAAO,aAAa,IAAI,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AAC3F,SAAO,YAAY,IAAI;AACzB;AAEO,SAAS,cAAc,MAAc,WAAkC;AAC5E,MAAI,UAAU,cAAc,UAAa,UAAU,aAAa,KAAK,IAAI,IAAI,IAAM,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACjI,MAAI,eAAe,IAAI,EAAE,KAAK,WAAS,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC,EAAG,OAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAChI;AAMA,IAAM,uBAA8F;AAAA,EAClG,iBAAiB,EAAE,OAAO,CAAC,QAAQ,YAAY,QAAQ,EAAE;AAC3D;AAMA,IAAM,wBAAqE;AAAA,EACzE,eAAe,CAAC,MAAM;AAAA,EACtB,sBAAsB,CAAC,QAAQ,UAAU;AAAA,EACzC,mBAAmB,CAAC,OAAO;AAC7B;AAMO,SAAS,oBAAoB,MAAc,OAAgB,WAChE,YAAY,OAAqC;AACjD,QAAM,UAAU,OAAO,OAAO,sBAAsB,IAAI,IAAI,qBAAqB,IAAI,IAAI,CAAC;AAC1F,QAAM,SAAS,OAAO,OAAO,uBAAuB,IAAI,IAAI,sBAAsB,IAAI,IAAI;AAC1F,QAAM,SAAS,gBAAgB,OAAO,SAAS;AAC/C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,yBAAqB,OAAO,WAAW,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,CAAC,OAAO,OAAO,SAAS,GAAG,GAAG;AAAE,WAAK,GAAG,IAAI;AAAO;AAAA,IAAU;AACjE,QAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,GAAG,EAAE,SAAS,KAAK,EAAG,OAAM,IAAI,gBAAgB,KAAK,6BAA6B;AAAA,EAC9H;AACA,uBAAqB,MAAM,WAAW,EAAE,QAAQ,WAAW,OAAO,CAAC;AACnE,SAAO;AACT;AAOO,IAAM,uBAA4C,oBAAI,IAAI;AAAA,EAC/D;AAAA,EAAU;AAAA,EAAmB;AAAA,EAAoB;AAAA,EACjD;AAAA,EAAwB;AAAA,EAA4B;AAAA,EACpD;AAAA,EAAyB;AAAA,EAAyB;AAAA,EAAuB;AAAA,EAAsB;AACjG,CAAC;AAMM,IAAM,2BAAgD,oBAAI,IAAI,CAAC,iBAAiB,CAAC;AAGjF,IAAM,kBAAkB;AAGxB,IAAM,0BAAN,cAAsC,gBAAgB;AAAA,EAC3D,YAAY,QAAmB,MAA8B,QAAgB;AAC3E,UAAM,QAAQ,IAAI;AADyC;AAAA,EAE7D;AACF;AAEO,SAAS,kBAAkB,WAAgD;AAChF,MAAI,UAAU,kBAAmB,QAAO,UAAU;AAClD,SAAO,UAAU,cAAc,CAAC,EAAE,IAAI,UAAU,aAAa,MAAM,UAAU,cAAc,CAAC,IAAI,CAAC;AACnG;AAGO,SAAS,aAAa,WAAoC;AAC/D,QAAM,QAAQ,kBAAkB,SAAS,EAAE,IAAI,UAAQ,KAAK,QAAQ,KAAK,EAAE;AAC3E,SAAO,MAAM,SAAS,KAAK,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,QAAQ,MAAM,SAAS,EAAE,UAAU,MAAM,KAAK,IAAI;AAC/G;AAGA,SAAS,YAAY,WAA4B,KAAa,OAAkC;AAC9F,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,UAAU,OAAO,UAAU,WAAW,CAAC,IACzC,QAAQ,gBAAgB,QAAQ,OAAO,UAAQ,KAAK,OAAO,KAAK,IAC9D,QAAQ,kBAAkB,QAAQ,OAAO,UAAQ,KAAK,SAAS,KAAK,IAClE,QAAQ,KAAK,UAAQ,KAAK,OAAO,KAAK,IAAI,QAAQ,OAAO,UAAQ,KAAK,OAAO,KAAK,IAChF,QAAQ,OAAO,UAAQ,KAAK,SAAS,KAAK;AACpD,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI;AAAA,MAAwB;AAAA,MAAK;AAAA,MACrC,aAAa,KAAK,UAAU,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,8CAA8C,aAAa,SAAS,CAAC;AAAA,IAAG;AAAA,EACpI;AACA,SAAO,QAAQ,CAAC;AAClB;AAOO,SAAS,gBAAgB,MAAe,WAC7C,OAA0B,CAAC,iBAAiB,iBAAiB,aAAa,GAAiC;AAC3G,MAAI;AACJ,MAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,eAAW,OAAO,MAAM;AACtB,YAAM,QAAS,KAAiC,GAAG;AACnD,UAAI,UAAU,OAAW;AACzB,YAAM,QAAQ,YAAY,WAAW,KAAK,KAAK;AAC/C,UAAI,UAAU,OAAO,OAAO,MAAM,IAAI;AACpC,cAAM,IAAI;AAAA,UAAwB;AAAA,UAAK;AAAA,UACrC;AAAA,QAA2E;AAAA,MAC/E;AACA,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,UAAU,kBAAkB,SAAS;AAC3C,SAAO,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AACxD;AAGO,SAAS,eAAe,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAC3C,CAAC,iBAAiB,iBAAiB,aAAa,EAAE,SAAS,GAAG,KAAK,UAAU,UAAc,eAAe,KAAK,CAAC;AACrH;AAgBA,SAAS,cAAc,OAAgB,WAA4B,WAA6B;AAC9F,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,UAAU,UAAW,QAAO,UAAU,UAAU,SAAS,KAAK;AAClE,SAAO,aAAa,UAAU,mBAAmB;AACnD;AAMO,SAAS,qBAAqB,OAAgB,WAA4B,UAA2B,CAAC,GAAS;AACpH,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,QAAM,EAAE,QAAQ,GAAG,OAAO,IAAI;AAC9B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,QAAQ,SAAS,GAAG,KAAK,CAAC,MAAM,QAAQ,KAAK,EAAG;AACpD,QAAI,QAAQ,iBAAiB,QAAQ,iBAAiB;AACpD,YAAM,SAAS,QAAQ;AACvB,UAAI,SAAS,WAAW,QAAQ,gBAAgB,OAAO,KAAK,OAAO,QAAQ,CAAC,YAAY,WAAW,KAAK,KAAK,GAAG;AAC9G,cAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,MACrD;AAAA,IACF;AACA,QAAI,CAAC,aAAa,QAAQ,EAAE,SAAS,GAAG,KAAK,UAAU,UAAU,GAA6B,GAAG;AAC/F,YAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,IACrD;AACA,QAAI;AAAA,MAAC;AAAA,MAAS;AAAA,MAAU;AAAA,MAAY;AAAA,MAAa;AAAA,MAAkB;AAAA,MAAiB;AAAA,MAClF;AAAA,MAAqB;AAAA,MAAe;AAAA,MAAW;AAAA,MAAgB;AAAA,MAAY;AAAA,IAAe,EAAE,SAAS,GAAG,GAAG;AAC3G,YAAM,IAAI,gBAAgB,KAAK,6BAA6B;AAAA,IAC9D;AACA,QAAI,CAAC,YAAY,UAAU,EAAE,SAAS,GAAG,KAAK,CAAC,cAAc,OAAO,WAAW,QAAQ,cAAc,IAAI,GAAG;AAC1G,YAAM,IAAI,gBAAgB,KAAK,uBAAuB;AAAA,IACxD;AACA,yBAAqB,OAAO,WAAW,MAAM;AAAA,EAC/C;AACF;;;AFxMA,IAAM,wBAAwB,IAAI,QAAQ,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAGpF,IAAM,gBAAgB,IAAI,kBAAiD;AAE3E,IAAM,iBAAiB;AAGhB,SAAS,eAAe,OAAgC;AAC7D,SAAO,UAAU,UAAU,MAAM,MAAM,KAAK,MAAM,IAAI;AAAA;AAAA,QAAc,cAAc,EAAE;AACtF;AAGO,SAAS,WAAW,SAA4B;AACrD,SAAO,UAAU,mDAAmD,QAAQ,KAAK,IAAI,CAAC;AAAA;AAAA,8KAEuB;AAC/G;AAGA,SAAS,cAAc,KAAc,QAAmC;AACtE,QAAM,OAAO,CAAC,UAAmB,MAAM,QAAQ,KAAK,IAAI,MAAM,OAAO,UAAQ;AAC3E,UAAM,SAAS,QAAQ,OAAO,SAAS,WAAW,OAAkC,CAAC;AACrF,WAAO,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ,OAAO,MACrD,OAAO,OAAO,UAAa,OAAO,QAAQ,UAAa,OAAO,SAAS,UAAa,OAAO,SAAS,OAAO;AAAA,EAChH,CAAC,IAAI;AACL,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,KAAK,GAAG;AACvC,MAAI,OAAO,OAAO,QAAQ,YAAY,UAAU,IAAK,QAAO,EAAE,GAAG,KAAK,MAAM,KAAM,IAA0B,IAAI,EAAE;AAClH,SAAO;AACT;AAGA,IAAM,eAAN,cAA2B,gBAAgB;AAAA,EACzC,YAA6B,SAAyC,WACnD,YAA+B;AAChD,UAAM,EAAE,QAAQ,gCAAgC,YAAY,gCAAgC,CAAC;AAFlE;AAAyC;AACnD;AAAA,EAEnB;AAAA;AAAA,EAES,mBAAmB,QAAsB;AAAA,EAAC;AAAA,EAC1C,WAAoB;AAAE,WAAO;AAAA,EAAM;AAAA,EAE5C,MAAe,QAAW,SAAqC;AAC7D,QAAI;AACF,YAAM,OAAO,YAAY,SAAS,GAAG;AACrC,UAAI,CAAC,KAAM,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AAC/D,oBAAc,MAAM,KAAK,SAAS;AAClC,YAAM,QAAQ,cAAc,SAAS,GAAG;AAGxC,YAAM,SAAS,UAAU,gBAAgB,QAAQ,MAAM,KAAK,WAAW,CAAC,iBAAiB,aAAa,CAAC,KAClG,gBAAgB,QAAQ,OAAO,KAAK,WAAW,CAAC,iBAAiB,aAAa,CAAC;AACpF,YAAM,YAAY,KAAK,eAAe;AAGtC,YAAM,SAAS,QAAQ,WAAW,UAAU,QAAQ,SAAS,eAAe,CAAC,MAAM,IAC/E,QAAQ,WAAW,UAAU,2DAA2D,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,IAAI;AAC7H,2BAAqB,QAAQ,MAAM,KAAK,WAAW,EAAE,QAAQ,WAAW,OAAO,CAAC;AAChF,2BAAqB,QAAQ,OAAO,KAAK,WAAW,EAAE,QAAQ,UAAU,CAAC;AACzE,UAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,QAAe,gBAAgB,OAAO;AAAA,QAAG,gBAAgB,KAAK,SAAS;AAAA,QAClG,KAAK;AAAA,QAAY,UAAU,gBAAgB,MAAM;AAAA,MAAC;AAGpD,UAAI,SAAS,QAAQ,WAAW,SAAS,QAAQ,SAAS,oBAAqB,OAAM,cAAc,KAAK,KAAK;AAC7G,UAAI,CAAC,QAAQ,kBAAkB,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,KAC/E,UAAU,OAAO,IAAI,SAAS,QAAQ,IAAI,SAAS,OAAW,QAAO,IAAI;AAC7E,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,yBAAyB;AAC5C,cAAM,IAAI,kBAAkB,MAAM,QAAQ,MAAM,MAAM,GAAG,MAAM,MAAM,KAAK,MAAM,IAAI,KAAK,QAAW,cAAc;AAAA,MACpH;AAEA,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AAGjE,UAAI,WAAW,OAAO,QAAQ,MAAM;AAClC,cAAM,IAAI;AAAA,UAAkB;AAAA,UAAG,OAAO;AAAA,UAAM,GAAG,OAAO,WAAW,qCAAqC,KAAK,OAAO,IAAI;AAAA,UACpH;AAAA,UAAW;AAAA,QAAkF;AAAA,MACjG;AACA,UAAI,WAAW,OAAO,WAAW,KAAK;AAEpC,cAAM,IAAI;AAAA,UAAkB;AAAA,UAAG;AAAA,UAC7B;AAAA,QAA2K;AAAA,MAC/K;AACA,UAAI,WAAW,OAAO,QAAQ,OAAO,UAAU;AAG7C,cAAM,UAAU,OAAO,YAAY,WAAW,MAAM,sDAChD;AACJ,cAAM,IAAI;AAAA,UAAkB,OAAO;AAAA,UAAQ,OAAO,QAAQ;AAAA,UACxD,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,IAAI,GAAG,OAAO,KAAK,OAAO,IAAI,MAAM;AAAA,UAChF,EAAE,OAAO,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ,EAAE;AAAA,QAAC;AAAA,MAC7D;AACA,YAAM,IAAI;AAAA,QAAkB;AAAA,QAAQ;AAAA,QAClC,WAAW,MACP,sDACA;AAAA,MAAwG;AAAA,IAChH;AAAA,EACF;AACF;AAGA,SAAS,cAAc,MAAc,OAAuB;AAC1D,SAAO,yBAAyB,IAAI,IAAI,IACpC,wDAAwD,KAAK,6DAC7D,kEAAkE,KAAK;AAC7E;AAEA,SAAS,OAAO,WAA4B;AAC1C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,SAAO,YAAY,KAAK,UAAU;AAAA,IAChC,QAAQ;AAAA,IAAiB,cAAc,UAAU;AAAA,IACjD,WAAW,UAAU;AAAA,IAAW,QAAQ,UAAU;AAAA,IAAQ,WAAW,UAAU;AAAA,IAC/E,gBAAgB,UAAU,YAAY,SAAS,QAC3C,wDAAwD;AAAA,IAC5D,mBAAmB,QAAQ,IAAI,WAAS,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE;AAAA,IACzE,GAAI,QAAQ,WAAW,IAAI,EAAE,aAAa,QAAQ,CAAC,EAAE,IAAI,eAAe,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,IAC7F,MAAM,QAAQ,WAAW,IACrB,wCACA,4DAA4D,eAAe,mCAAmC,aAAa,SAAS,CAAC;AAAA,IACzI,eAAe,UAAU;AAAA,IAAU,QAAQ,UAAU;AAAA,EACvD,GAAG,MAAM,CAAC,CAAC;AACb;AAEO,SAAS,uBAAuB,WAA4B,SACjE,YAA0C;AAC1C,QAAM,QAAQ,gBAAgB,SAAS;AACvC,QAAM,YAAY,eAAe;AACjC,QAAM,SAAS,IAAI,UAAU,EAAE,MAAM,aAAa,SAAS,mBAAmB,GAAG;AAAA,IAC/E,cAAc;AAAA,EAOhB,CAAC;AAKD,QAAM,WAAW,OAAO,KAAK,KAAK,MAAM;AACxC,SAAO,QAAQ,IAAI,SAAgB;AACjC,UAAM,OAAO,KAAK,CAAC;AACnB,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,MAAM,YACzE,EAAE,kBAAkB,KAAK,CAAC,KAAK,KAAK,CAAC,IAA+B;AACtE,UAAM,cAAc,SAAU,CAAC,iBAAiB,aAAa,EAAY,KAAK,SAAO,OAAO,OAAO,OAAO,GAAG,CAAC;AAC9G,UAAM,YAAY,UAAU,UAAa,CAAC,eAAe,CAAC,qBAAqB,IAAI,IAAI,KACrF,CAAC,OAAO,OAAO,OAAO,eAAe;AACvC,QAAI,SAAS,CAAC,qBAAqB,IAAI,IAAI,GAAG;AAC5C,UAAI,WAAW;AACb,aAAK,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,GAAGC,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAC1E,SAAS,yBAAyB,IAAI,IAAI,IACvC,yEACA,wEAAwE,EAAE;AAAA,MAClF;AACA,WAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,cAAc,MAAM,YAAY,kBAAkB,WAAY,CAAC;AAAA,IACxF;AACA,SAAK,KAAK,IAAI,UAAU,WAAkB;AACxC,UAAI;AACF,sBAAc,MAAM,KAAK;AACzB,cAAM,SAAS,oBAAoB,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS;AACpE,YAAI,SAAS,SAAU,QAAO,OAAO,KAAK;AAC1C,cAAM,QAAQ,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,IAA+B;AAClG,YAAI,OAAO,eAAe,OAAW,QAAO,UAAU,uHAAuH;AAC7K,YAAI,CAAC,UAAU,CAAC,qBAAqB,IAAI,IAAI,KAAK,CAAC,yBAAyB,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,GAAG;AAC/G,gBAAM,IAAI;AAAA,YAAwB;AAAA,YAAK;AAAA,YACrC,8CAA8C,aAAa,KAAK,CAAC;AAAA,UAAG;AAAA,QACxE;AACA,YAAI,OAAO;AAGT,cAAI,UAAW,QAAO,MAAM,eAAe;AAC3C,cAAI,SAAS,QAAQ;AACnB,gBAAI,OAAO,OAAO,OAAO,aAAa,EAAG,OAAM,cAAc,OAAO;AACpE,gBAAI,OAAO,OAAO,OAAO,eAAe,KAAK,OAAO,SAAS,OAAW,OAAM,gBAAgB,OAAO;AAAA,UACvG;AAAA,QACF;AACA,cAAM,SAAS,MAAM,cAAc,IAAI,EAAE,OAAO,GAAG,MAAM,QAAQ,GAAG,MAAM,CAAC;AAG3E,YAAI,UAAU,QAAQ,QAAQ,gBAAgB,GAAG;AAC/C,iBAAO,EAAE,GAAG,QAAQ,OAAO,EAAE,GAAG,OAAO,OAAO,uBAAuB,OAAO,EAAE;AAAA,QAChF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,wBAAyB,QAAO,eAAe,KAAK;AACzE,eAAO,UAAU,oGAAoG;AAAA,MACvH;AAAA,IACF;AACA,WAAO,SAAS,GAAG,IAAI;AAAA,EACzB;AAEA,QAAM,SAAS,IAAI,aAAa,SAAS,OAAO,UAAU;AAC1D,kBAAgB,MAAM;AACtB,mBAAiB,QAAQ,MAAM;AAE/B,0BAAwB,QAAQ,MAAM;AACtC,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AAEzB,oBAAkB,QAAQ,MAAM;AAChC,aAAW,QAAQ,uBAAuB,EAAE,YAAY,MAAM,KAAK,CAAC;AACpE,SAAO;AACT;;;ADlOA,IAAM,cAAc,KAAK,UAAU,EAAE,QAAQ,KAAK,CAAC;AAGnD,SAAS,WAAW,KAAkC;AACpD,QAAM,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AACtC,SAAO,SAAS;AAClB;AAEA,SAAS,MAAM,KAAqB,QAAgB,MAAqB;AACvE,MAAI,UAAU,QAAQ,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW,CAAC;AACzF,MAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,eAAe,SAAS,KAAwC;AAC9D,MAAI,OAAO;AACX,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,KAAK;AAC7B,YAAQ,MAAM;AACd,QAAI,OAAO,QAAW,OAAM,IAAI,MAAM,gBAAgB;AACtD,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAC1D;AAEO,SAAS,uBAAuB,QAAsB,SAAwB,MAAiB;AACpG,QAAM,YAAY,IAAI,IAAI,OAAO,SAAS;AAC1C,QAAM,eAAe,wCAAwC,UAAU,aAAa,MAAM,KAAK,UAAU,QAAQ;AACjH,QAAM,cAAc,GAAG,UAAU,MAAM,GAAG,YAAY;AACtD,QAAM,SAAS,qBAAqB,SAAS,OAAO,WAAW,IAAI;AACnE,MAAI,SAAS;AAEb,QAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;AAI9C,QAAI,WAAW,IAAI,GAAG,GAAG;AACvB,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,YAAI,UAAU,KAAK,EAAE,OAAO,aAAa,iBAAiB,WAAW,CAAC;AAAG,YAAI,IAAI;AAAG;AAAA,MACtF;AACA,UAAI,UAAU,KAAK;AAAA,QAAE,gBAAgB;AAAA,QAAoB,iBAAiB;AAAA,QACxE,kBAAkB,OAAO,WAAW,WAAW;AAAA,MAAE,CAAC;AACpD,UAAI,IAAI,IAAI,WAAW,SAAS,SAAY,WAAW;AAAG;AAAA,IAC5D;AACA,QAAI,UAAU,0BAA0B,SAAS;AACjD,QAAI,OAAO,SAAU,KAAI,UAAU,yBAAyB,MAAM;AAClE,QAAI;AAGF,YAAM,YAAa,OAAO,QAAQ,GAA+B;AACjE,UAAI,CAAC,CAAC,UAAU,MAAM,aAAa,SAAS,IAAI,aAAa,SAAS,EAAE,EAAE,SAAS,IAAI,QAAQ,QAAQ,EAAE,GAAG;AAC1G,cAAM,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;AAAG;AAAA,MAC9C;AACA,UAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,WAAW,UAAU,QAAQ;AACjE,cAAM,KAAK,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAG;AAAA,MAChD;AACA,UAAI,IAAI,QAAQ,QAAQ;AACtB,YAAI,UAAU,+BAA+B,UAAU,MAAM;AAC7D,YAAI,UAAU,QAAQ,QAAQ;AAC9B,YAAI,UAAU,iCAAiC,wCAAwC;AAAA,MACzF;AACA,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM;AACpD,UAAI,IAAI,WAAW,SAAS,CAAC,cAAc,uCAAuC,EAAE,SAAS,IAAI,QAAQ,GAAG;AAC1G,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,OAAO;AAAA,UAAW,uBAAuB,CAAC,OAAO,MAAM;AAAA,UACjE,kBAAkB;AAAA,UAAe,0BAA0B,CAAC,QAAQ;AAAA,UACpE,eAAe,OAAO,WAAW,4CAA4C;AAAA,QAC/E,CAAC;AAAG;AAAA,MACN;AACA,UAAI,IAAI,aAAa,UAAU,UAAU;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAG;AAAA,MAAQ;AAC5F,UAAI,IAAI,QAAQ;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAG;AAAA,MAAQ;AACxF,UAAI,IAAI,WAAW,WAAW;AAC5B,YAAI,UAAU,gCAAgC,4BAA4B;AAC1E,YAAI,UAAU,gCAAgC,mEAAmE;AACjH,YAAI,UAAU,GAAG;AAAG,YAAI,IAAI;AAAG;AAAA,MACjC;AAEA,YAAM,aAAa,IAAI,WAAW,OAAO,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,WAAW,CAAC,EAAE,YAAY,MAAM,eAAe;AACrH,YAAM,QAAQ,qBAAqB,KAAK,IAAI,QAAQ,iBAAiB,EAAE;AACvE,UAAI,WAAW,WAAW,KAAK,CAAC,MAAO,OAAM,IAAI,gBAAgB,KAAK,eAAe;AACrF,YAAM,YAAY,MAAM,OAAO,MAAM,CAAC,CAAC;AACvC,UAAI,IAAI,WAAW,QAAQ;AACzB,YAAI,UAAU,SAAS,eAAe;AACtC,cAAM,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAG;AAAA,MACpD;AACA,UAAI,CAAC,IAAI,QAAQ,cAAc,GAAG,YAAY,EAAE,WAAW,kBAAkB,GAAG;AAC9E,cAAM,KAAK,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAG;AAAA,MACxD;AACA,UAAI,UAAU,IAAI;AAAE,cAAM,KAAK,KAAK,EAAE,OAAO,cAAc,CAAC;AAAG;AAAA,MAAQ;AACvE;AACA,UAAI;AACJ,UAAI;AAAE,eAAO,MAAM,SAAS,GAAG;AAAA,MAAG,QAC5B;AAAE;AAAU,cAAM,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAG;AAAA,MAAQ;AACzE,UAAI;AAGF,YAAI,MAAM,QAAQ,IAAI,GAAG;AAAE,gBAAM,KAAK,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAG;AAAA,QAAQ;AAEtF,cAAM,aAAa,MAAM,CAAC,EAAE,WAAW,MAAM,IAAI,SAAY,QAAQ,WAAW,MAAM,CAAC,GAAG,SAAS;AACnG,YAAI,MAAM,WAAW,gBAAgB,OAAO,KAAK,QAAQ,SAAS,UAAU;AAC1E,cAAI;AACF,0BAAc,KAAK,OAAO,MAAM,SAAS;AACzC,gCAAoB,KAAK,OAAO,MAAM,KAAK,OAAO,WAAW,WAAW,eAAe,MAAS;AAAA,UAClG,SAAS,OAAO;AAGd,gBAAI,iBAAiB,yBAAyB;AAC5C,oBAAM,KAAK,KAAK,EAAE,SAAS,OAAO,IAAI,KAAK,MAAM,MAAM,QAAQ,eAAe,KAAK,EAAE,CAAC;AAAG;AAAA,YAC3F;AAIA,gBAAI,iBAAiB,mBAAmB,MAAM,SAAS,sBAAsB;AAC3E,oBAAM,UAAU,eAAe,KAAK,OAAO,IAAI,EAAE,OAAO,WAAS,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC;AAClG,oBAAM,KAAK,KAAK,EAAE,SAAS,OAAO,IAAI,KAAK,MAAM,MAAM,QAAQ,WAAW,OAAO,EAAE,CAAC;AAAG;AAAA,YACzF;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AACA,cAAM,MAAM,uBAAuB,WAAW,SAAS,UAAU;AACjE,cAAM,YAAY,IAAI,8BAA8B,EAAE,oBAAoB,QAAW,oBAAoB,KAAK,CAAC;AAC/G,YAAI,SAAS;AACb,cAAM,QAAQ,MAAM;AAAE,cAAI,CAAC,QAAQ;AAAE,qBAAS;AAAM,iBAAK,IAAI,MAAM;AAAA,UAAG;AAAA,QAAE;AACxE,YAAI,KAAK,SAAS,KAAK;AACvB,YAAI;AACF,gBAAM,IAAI,QAAQ,SAAS;AAC3B,gBAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,QAC9C,UAAE;AAAU,cAAI,IAAI,cAAe,OAAM;AAAA,QAAG;AAAA,MAC9C,UAAE;AAAU;AAAA,MAAU;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,IAAI,aAAa;AAAE,YAAI,IAAI;AAAG;AAAA,MAAQ;AAC1C,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,UAAI,WAAW,IAAK,KAAI,UAAU,oBAAoB,oDAAoD,WAAW,GAAG;AACxH,YAAM,KAAK,QAAQ,EAAE,OAAO,iBAAiB,kBAAkB,MAAM,OAAO,0BAA0B,CAAC;AAAA,IACzG;AAAA,EACF,CAAC;AACD,SAAO,iBAAiB;AACxB,SAAO,iBAAiB;AACxB,SAAO,mBAAmB;AAC1B,SAAO;AACT;;;AIlJA,SAAS,KAAAC,UAAS;AAQlB,IAAM,aAAa,wBAAwB,kBAAkB;AAC7D,IAAM,qBAAqB;AAE3B,IAAM,oBAAoB,oBAAI,IAAI,CAAC,iBAAiB,CAAC;AAE9C,IAAM,mBAAmB;AAKhC,IAAM,gBAAgB,oBAAI,IAAI,CAAC,oBAAoB,8BAA8B,CAAC;AAGlF,SAAS,YAAY,QAAgB,MAAc,QAA+C;AAChG,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI;AAAA,EAAG,QAAQ;AAAE,WAAO,EAAE,OAAO;AAAA,EAAG;AAC9D,QAAM,WAAW,eAAe,MAAM;AAGtC,QAAM,QAAQ,aAAa,MAAM;AACjC,QAAM,OAAO,SAAS,SAAS,QAAQ,2BAA2B;AAClE,QAAM,UAAU,SAAS,WAAW;AACpC,QAAM,QAAQ,CAAC,OAA2B,QAAgB;AACxD,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,MAAM,MAAM,QAAQ,2BAA2B,GAAG,EAAE,KAAK;AAC7D,QAAI,OAAQ,OAAM,IAAI,MAAM,MAAM,EAAE,KAAK,YAAY;AACrD,WAAO,IAAI,MAAM,GAAG,GAAG,KAAK;AAAA,EAC9B;AAEA,SAAO;AAAA,IAAE;AAAA,IAAQ,MAAM,QAAQ,0BAA0B,KAAK,IAAI,IAAI,OAAO;AAAA,IAC3E,SAAS,MAAM,SAAS,IAAI;AAAA,EAAE;AAClC;AAGA,SAAS,aAAa,MAAmC;AACvD,QAAM,WAAY,MAA4C;AAC9D,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,QAAQ,SAAS,QAAQ,CAAC,YAAY;AAC1C,UAAM,EAAE,IAAI,IAAI,SAAS,IAAK,WAAW,CAAC;AAC1C,QAAI,OAAO,SAAS,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtD,UAAM,QAAQ,SAAS,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACvE,WAAO,MAAM,SAAS,CAAC,QAAQ,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC;AAAA,EAC7F,CAAC;AACD,SAAO,MAAM,SAAS,gCAAgC,MAAM,KAAK,GAAG,CAAC,KAAK;AAC5E;AAGO,SAAS,sBAAsB,QAAqC;AACzE,QAAM,SAAS,IAAI,IAAI,OAAO,MAAM;AACpC,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,YAAY,OAAO,UAAU,OAAO,MAAM;AACtG,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,UAAU,OAAO,OAAO,QAAQ,OAAO,EAAE;AAC/C,QAAM,WAAW,GAAG,OAAO;AAC3B,QAAM,eAAe,IAAI,IAAI,OAAO,SAAS,EAAE;AAE/C,QAAM,UAAU,oBAAI,QAAkC;AACtD,QAAM,iBAAiB,gBAAgB,OAAO,EAAE,QAAQC,GAAE,QAAQ,OAAO,MAAM,EAAE,CAAC,EAAE,MAAM;AAC1F,SAAO;AAAA,IACL,MAAM,YAAY,OAAO,UAAU;AACjC,UAAI;AAIF,cAAM,WAAW,MAAM,MAAM,UAAU;AAAA,UACrC,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,QAAQ,mBAAmB;AAAA,UACxE,UAAU;AAAA,UAAS,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACvD,CAAC;AACD,YAAI,CAAC,SAAS,GAAI,OAAM,IAAI,gBAAgB,SAAS,UAAU,MAAM,MAAM,KAAK,eAAe;AAC/F,cAAM,EAAE,QAAQ,SAAS,GAAG,UAAU,IAAI,eAAe,MAAM,MAAM,SAAS,KAAK,CAAC;AACpF,YAAI,UAAU,aAAa,YAAY,UAAU,mBAAmB,QAAS,OAAM,IAAI,gBAAgB,KAAK,eAAe;AAC3H,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,gBAAiB,OAAM;AAC5C,cAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB;AAAE,YAAM,IAAI,gBAAgB,KAAK,iCAAiC;AAAA,IAAG;AAAA,IAC7F,SAAS,OAAO;AACd,YAAM,SAA2B,OAAO,OAAO,EAAE,MAAM,oBAA6B,CAAC;AACrF,cAAQ,IAAI,QAAQ,KAAK;AACzB,aAAO;AAAA,IACT;AAAA,IACA,MAAM,eAAe,SAAS,WAAW,YAAY,WAAW;AAK9D,YAAM,SAAS,aAAa,QAAQ,IAAI,UAAU,IAAI;AACtD,UAAI,QAAQ,SAAS,UAAU,CAAC,OAAQ,OAAM,IAAI,gBAAgB,KAAK,oCAAoC;AAC3G,UAAI,QAAQ,SAAS,UAAU,CAAC,QAAQ,MAAO,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACnG,UAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACxH,YAAM,MAAM,IAAI,IAAI,GAAG,OAAO,GAAG,QAAQ,IAAI,EAAE;AAC/C,UAAI,IAAI,WAAW,OAAO,OAAQ,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACtF,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,EAAG,KAAI,aAAa,IAAI,KAAK,KAAK;AAC/F,YAAM,UAAkC;AAAA,QACtC,QAAQ;AAAA,QAAoB,gBAAgB;AAAA,QAAoB,cAAc;AAAA,QAC9E,sBAAsB;AAAA,MACxB;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AAChE,YAAI,kBAAkB,IAAI,IAAI,YAAY,CAAC,EAAG,SAAQ,GAAG,IAAI;AAAA,MAC/D;AACA,YAAM,OAAO,YAAY,SAAS;AAClC,UAAI,MAAM;AACR,gBAAQ,sBAAsB,IAAI,KAAK;AACvC,gBAAQ,+BAA+B,IAAI,KAAK;AAChD,gBAAQ,iCAAiC,IAAI,KAAK;AAClD,gBAAQ,4BAA4B,IAAI,KAAK;AAAA,MAC/C;AACA,UAAI,QAAQ,SAAS,QAAQ;AAC3B,gBAAQ,gBAAgB,IAAI,QAAQ;AACpC,gBAAQ,SAAS;AAAA,MACnB,OAAO;AACL,gBAAQ,gBAAgB,UAAU,MAAM;AAGxC,YAAI,WAAW;AACb,cAAI,CAAC,UAAU,mBAAmB,KAAK,UAAQ,KAAK,OAAO,UAAU,EAAE,KACnE,UAAU,gBAAgB,UAAU,GAAI,OAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAC/F,kBAAQ,gBAAgB,IAAI,UAAU;AAAA,QACxC;AAAA,MACF;AACA,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC,QAAQ,QAAQ;AAAA,QAAQ;AAAA,QAAS,UAAU;AAAA,QAC3C,MAAM,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,QAC1E,QAAQ,YAAY,QAAQ,QAAQ,aAAa,kBAAkB;AAAA,MACrE,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,CAAC,SAAS,IAAI;AAIhB,cAAM,YAAY,SAAS,WAAW,MAAM,YAAY,KAAK,MAAM,MAAM,IAAI;AAC7E,YAAI,WAAW,QAAQ,cAAc,IAAI,UAAU,IAAI,GAAG;AACxD,gBAAM,IAAI,gBAAgB,KAAK,4BAA4B,SAAS;AAAA,QACtE;AACA,cAAM,SAAS,SAAS,WAAW,OAAO,QAAQ,mBAAmB,eAAe,MAAM,SAAS,WAAW,MAAM,MAAM,SAAS,UAAU,MAAM,MAC/I,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,MAAM;AAC/D,cAAM,SAAS,WAAW,OAAO,WAAW,OAAO,SAAS,WAAW,MAAM,SACzE,YAAY,SAAS,QAAQ,MAAM,MAAM;AAC7C,cAAM,IAAI,gBAAgB,QAAQ,4BAA4B,MAAM;AAAA,MACtE;AACA,UAAI;AAAE,eAAO,QAAQ,mBAAmB,eAAe,kBAAkB,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,MAAM,QAC3G;AAAE,cAAM,IAAI,gBAAgB,KAAK,4BAA4B;AAAA,MAAG;AAAA,IACxE;AAAA,EACF;AACF;;;ANnJA,eAAsB,cAA6B;AACjD,QAAM,SAAS,iBAAiB;AAChC,MAAI;AACJ,MAAI,OAAO,UAAU;AACnB,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,2DAA2D;AAC3G,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,yBAAgB;AAC/D,cAAU,sBAAsB,IAAI;AAAA,EACtC,OAAO;AACL,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,MAAM;AACT,gBAAU,sBAAsB,MAAM;AACtC,cAAQ,OAAO,MAAM,qIAAqI;AAAA,IAC5J,OAAO;AACL,UAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,2DAA2D;AAClG,UAAI;AAAE,mBAAW,MAAM,OAAO,cAAc,IAAI,EAAE,OAAO;AAAA,MAAS,QAC5D;AAAE,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAAG;AAAA,IACzE;AACA,QAAI,CAAC,WAAW,CAAC,eAAe,mBAAmB,gBAAgB,EAAE,KAAK,SACxE,OAAO,QAAQ,GAA0B,MAAM,UAAU,EAAG,OAAM,IAAI,MAAM,iCAAiC;AAAA,EACjH;AACA,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,CAAC,WAAW,OAAO,EAAG,OAAM,IAAI,MAAM,4CAA4C;AACjG,QAAM,SAAS,uBAAuB,QAAQ,SAAS,UAAU,IAAI,aAAa,OAAO,IAAI,MAAS;AACtG,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,OAAO,MAAM,OAAO,MAAM,OAAO;AAAA,EACjD,CAAC;AACD,UAAQ,OAAO,MAAM,oCAAoC,OAAO,IAAI,IAAI,OAAO,IAAI,OAAO,OAAO,WAAW,qEAAgE,EAAE;AAAA,CAAI;AAClL,QAAM,WAAW,MAAM;AACrB,WAAO,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAClC,eAAW,MAAM;AAAE,aAAO,oBAAoB;AAAG,cAAQ,KAAK,CAAC;AAAA,IAAG,GAAG,GAAI,EAAE,MAAM;AAAA,EACnF;AACA,UAAQ,KAAK,UAAU,QAAQ;AAC/B,UAAQ,KAAK,WAAW,QAAQ;AAClC;","names":["z","z","z","z"]}