@databrainhq/mcp-server 0.3.0-rc.13 → 0.3.0-rc.15

package/dist/main-2FKQQLWX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hosted/main.ts","../src/hosted/config.ts","../src/hosted/http.ts","../src/hosted/authorization.ts","../src/hosted/server.ts","../src/tools/infrastructure/create-workspace.ts","../src/hosted/provider.ts"],"sourcesContent":["import { isAbsolute } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { FilePatStore } from './auth.js';\nimport { loadHostedConfig } from './config.js';\nimport { createHostedHttpServer } from './http.js';\nimport { createProviderAdapter } from './provider.js';\nimport type { HostedAdapter } from './types.js';\n\nexport async function startHosted(): Promise<void> {\n  const config = loadHostedConfig();\n  let adapter: HostedAdapter;\n  if (config.testOnly) {\n    const file = process.env.DATABRAIN_HOSTED_TEST_FIXTURES;\n    if (!file || !isAbsolute(file))\n      throw new Error(\n        'Hosted test mode requires an absolute fixture store path.'\n      );\n    const { createTestOnlyAdapter } = await import('./test-only.js');\n    adapter = createTestOnlyAdapter(file);\n  } else {\n    const file = process.env.DATABRAIN_HOSTED_ADAPTER_MODULE;\n    if (!file) {\n      adapter = createProviderAdapter(config);\n      process.stderr.write(\n        '[databrain] OAuth configured: data tools run as the signed-in user through the issuer; PAT membership requires a trusted adapter.\\n'\n      );\n    } else {\n      if (!isAbsolute(file))\n        throw new Error(\n          'DATABRAIN_HOSTED_ADAPTER_MODULE must be an absolute path.'\n        );\n      try {\n        adapter = (await import(pathToFileURL(file).href)).adapter;\n      } catch {\n        throw new Error('Could not load the trusted hosted adapter.');\n      }\n    }\n    if (\n      !adapter ||\n      ['verifyOAuth', 'resolvePatGrant', 'executeRequest'].some(\n        (key) => typeof adapter[key as keyof HostedAdapter] !== 'function'\n      )\n    )\n      throw new Error('Invalid trusted hosted adapter.');\n  }\n  const patPath = process.env.DATABRAIN_HOSTED_PAT_STORE;\n  if (patPath && !isAbsolute(patPath))\n    throw new Error('Hosted PAT store must be an absolute path.');\n  const server = createHostedHttpServer(\n    config,\n    adapter,\n    patPath ? new FilePatStore(patPath) : undefined\n  );\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(config.port, config.bind, resolve);\n  });\n  process.stderr.write(\n    `[databrain] hosted HTTP ready on ${config.bind}:${config.port}/mcp${config.testOnly ? ' — TEST ONLY: synthetic identity and data; no OAuth consent' : ''}\\n`\n  );\n  const shutdown = () => {\n    server.close(() => process.exit(0));\n    setTimeout(() => {\n      server.closeAllConnections();\n      process.exit(0);\n    }, 5000).unref();\n  };\n  process.once('SIGINT', shutdown);\n  process.once('SIGTERM', shutdown);\n}\n","import type { HostedConfig } from './types.js';\n\nexport function loadHostedConfig(\n  env: NodeJS.ProcessEnv = process.env\n): HostedConfig {\n  const testOnly = env.DATABRAIN_HOSTED_TEST_ONLY === '1';\n  if (testOnly && env.NODE_ENV === 'production')\n    throw new Error('Hosted test mode is forbidden in production.');\n  if (env.DATABRAIN_HOSTED_TEST_ONLY && !testOnly)\n    throw new Error('Invalid DATABRAIN_HOSTED_TEST_ONLY.');\n  const validUrl = (value: string | undefined, field: string) => {\n    try {\n      if (!value) throw new Error();\n      const url = new URL(value);\n      if (\n        url.username ||\n        url.password ||\n        url.search ||\n        url.hash ||\n        url.protocol !== 'https:'\n      )\n        throw new Error();\n      return url;\n    } catch {\n      throw new Error(\n        `Configure ${field} as an HTTPS URL without credentials, query or fragment.`\n      );\n    }\n  };\n  // Self-hosted installs set no new variable: with neither URL given, both come from the\n  // HOSTED_APP_URL origin the image already has (app, API and /mcp on one origin). HTTPS only.\n  let publicValue = env.DATABRAIN_HOSTED_PUBLIC_URL;\n  let issuerValue = env.DATABRAIN_HOSTED_ISSUER;\n  if (!publicValue && !issuerValue && env.HOSTED_APP_URL) {\n    const origin = validUrl(env.HOSTED_APP_URL, 'HOSTED_APP_URL').origin;\n    publicValue = `${origin}/mcp`;\n    issuerValue = origin;\n  }\n  const publicUrl = validUrl(publicValue, 'DATABRAIN_HOSTED_PUBLIC_URL');\n  validUrl(issuerValue, 'DATABRAIN_HOSTED_ISSUER');\n  if (publicUrl.pathname !== '/mcp')\n    throw new Error('DATABRAIN_HOSTED_PUBLIC_URL must end in /mcp.');\n  const port = Number(env.DATABRAIN_HOSTED_PORT || '3144');\n  // Loopback by default so a laptop run is not silently on the network. A\n  // container has to be told, because binding loopback inside a task means the\n  // load balancer health check can never reach it and the service never\n  // stabilises. Set DATABRAIN_HOSTED_BIND=0.0.0.0 in ECS.\n  const bind = env.DATABRAIN_HOSTED_BIND || '127.0.0.1';\n  if (!Number.isInteger(port) || port < 1024 || port > 65535)\n    throw new Error('Invalid DATABRAIN_HOSTED_PORT.');\n  // Optional private address of the same API (for example ECS service discovery), so\n  // the token check and data calls stay inside the network. The issuer is still the\n  // identity the principal must name; this only changes where the requests go.\n  let apiUrl: string | undefined;\n  if (env.DATABRAIN_HOSTED_API_URL) {\n    let url: URL | undefined;\n    try {\n      url = new URL(env.DATABRAIN_HOSTED_API_URL);\n    } catch {\n      url = undefined;\n    }\n    if (\n      !url ||\n      !['http:', 'https:'].includes(url.protocol) ||\n      url.username ||\n      url.password ||\n      url.search ||\n      url.hash ||\n      url.pathname !== '/'\n    ) {\n      throw new Error(\n        'Configure DATABRAIN_HOSTED_API_URL as an origin without credentials, path, query or fragment.'\n      );\n    }\n    apiUrl = url.origin;\n  }\n  return {\n    publicUrl: publicValue!,\n    issuer: issuerValue!,\n    ...(apiUrl ? { apiUrl } : {}),\n    port,\n    bind,\n    testOnly,\n  };\n}\n","import {\n  createServer,\n  type IncomingMessage,\n  type ServerResponse,\n} from 'node:http';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport { type BrynCatalogue, parseBrynCatalogue } from '../bryn/catalogue.js';\nimport {\n  BrynCatalogueCache,\n  RateLimitedError,\n} from '../bryn/catalogueCache.js';\nimport { toolError } from '../utils/errors.js';\nimport { createBearerVerifier } from './auth.js';\nimport {\n  assertToolArguments,\n  authorizeTool,\n  requiredScopes,\n  WorkspaceSelectionError,\n} from './authorization.js';\nimport {\n  createHostedToolServer,\n  scopeError,\n  workspaceError,\n} from './server.js';\nimport type { HostedAdapter, HostedConfig, PatStore } from './types.js';\nimport { HOSTED_SCOPES, HostedAuthError } from './types.js';\n\nconst HEALTH_BODY = JSON.stringify({ status: 'ok' });\n// A legal Chart studio draft is 4 MiB; leave room for the JSON-RPC envelope.\nconst MAX_MCP_BODY_BYTES = 4 * 1024 * 1024 + 64 * 1024;\n\n/** Exactly `/health`, with or without a query string; `/health/x` is not health. */\nfunction healthPath(url: string | undefined): boolean {\n  const path = (url || '/').split('?')[0];\n  return path === '/health';\n}\n\nfunction reply(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, {\n    'Content-Type': 'application/json',\n    'Cache-Control': 'no-store',\n  });\n  res.end(JSON.stringify(body));\n}\n\nasync function readBody(req: IncomingMessage): Promise<unknown> {\n  let size = 0;\n  const chunks: Buffer[] = [];\n  for await (const chunk of req) {\n    size += chunk.length;\n    if (size > MAX_MCP_BODY_BYTES) throw new Error('body_too_large');\n    chunks.push(Buffer.from(chunk));\n  }\n  return JSON.parse(Buffer.concat(chunks).toString('utf8'));\n}\n\nexport function createHostedHttpServer(\n  config: HostedConfig,\n  adapter: HostedAdapter,\n  pats?: PatStore\n) {\n  const publicUrl = new URL(config.publicUrl);\n  const metadataPath = `/.well-known/oauth-protected-resource${publicUrl.pathname === '/' ? '' : publicUrl.pathname}`;\n  const metadataUrl = `${publicUrl.origin}${metadataPath}`;\n  const verify = createBearerVerifier(adapter, config.publicUrl, pats);\n  let active = 0;\n  const catalogueCache = new BrynCatalogueCache();\n\n  const server = createServer(async (req, res) => {\n    // Liveness for the load balancer. It arrives with the target IP:port as Host,\n    // so it runs before the Host/Origin checks and sets no CORS headers. It is\n    // unauthenticated, reads no body and never echoes configuration.\n    if (healthPath(req.url)) {\n      if (req.method !== 'GET' && req.method !== 'HEAD') {\n        res.writeHead(405, { Allow: 'GET, HEAD', 'Cache-Control': 'no-store' });\n        res.end();\n        return;\n      }\n      res.writeHead(200, {\n        'Content-Type': 'application/json',\n        'Cache-Control': 'no-store',\n        'Content-Length': Buffer.byteLength(HEALTH_BODY),\n      });\n      res.end(req.method === 'HEAD' ? undefined : HEALTH_BODY);\n      return;\n    }\n    res.setHeader('X-Content-Type-Options', 'nosniff');\n    if (config.testOnly) res.setHeader('X-Databrain-Test-Only', 'true');\n    try {\n      // Tailscale Serve may preserve the public Host or use the loopback destination.\n      // Never use Host/Forwarded headers to construct discovery URLs or trust an identity.\n      const localPort = (server.address() as { port: number } | null)?.port;\n      if (\n        ![\n          publicUrl.host,\n          `127.0.0.1:${localPort}`,\n          `localhost:${localPort}`,\n        ].includes(req.headers.host || '')\n      ) {\n        reply(res, 403, { error: 'invalid_host' });\n        return;\n      }\n      if (req.headers.origin && req.headers.origin !== publicUrl.origin) {\n        reply(res, 403, { error: 'invalid_origin' });\n        return;\n      }\n      if (req.headers.origin) {\n        res.setHeader('Access-Control-Allow-Origin', publicUrl.origin);\n        res.setHeader('Vary', 'Origin');\n        res.setHeader(\n          'Access-Control-Expose-Headers',\n          'WWW-Authenticate, MCP-Protocol-Version'\n        );\n      }\n      const url = new URL(req.url || '/', publicUrl.origin);\n      if (\n        req.method === 'GET' &&\n        [metadataPath, '/.well-known/oauth-protected-resource'].includes(\n          url.pathname\n        )\n      ) {\n        reply(res, 200, {\n          resource: config.publicUrl,\n          authorization_servers: [config.issuer],\n          scopes_supported: HOSTED_SCOPES,\n          bearer_methods_supported: ['header'],\n          resource_name: config.testOnly\n            ? 'Databrain (TEST ONLY; fixture identity)'\n            : 'Databrain',\n        });\n        return;\n      }\n      if (url.pathname !== publicUrl.pathname) {\n        reply(res, 404, { error: 'not_found' });\n        return;\n      }\n      if (url.search) {\n        reply(res, 400, { error: 'query_parameters_not_supported' });\n        return;\n      }\n      if (req.method === 'OPTIONS') {\n        res.setHeader(\n          'Access-Control-Allow-Methods',\n          'POST, GET, DELETE, OPTIONS'\n        );\n        res.setHeader(\n          'Access-Control-Allow-Headers',\n          'Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id'\n        );\n        res.writeHead(204);\n        res.end();\n        return;\n      }\n      // Duplicate Authorization fields and cookies never select a principal.\n      const authFields = req.rawHeaders.filter(\n        (_, i) =>\n          i % 2 === 0 && req.rawHeaders[i].toLowerCase() === 'authorization'\n      );\n      const match = /^Bearer ([^\\s]+)$/i.exec(req.headers.authorization || '');\n      if (authFields.length !== 1 || !match)\n        throw new HostedAuthError(401, 'invalid_token');\n      const principal = await verify(match[1]);\n      if (req.method !== 'POST') {\n        res.setHeader('Allow', 'POST, OPTIONS');\n        reply(res, 405, { error: 'method_not_allowed' });\n        return;\n      }\n      if (\n        !req.headers['content-type']\n          ?.toLowerCase()\n          .startsWith('application/json')\n      ) {\n        reply(res, 415, { error: 'unsupported_media_type' });\n        return;\n      }\n      if (active >= 32) {\n        reply(res, 503, { error: 'server_busy' });\n        return;\n      }\n      active++;\n      let body: any;\n      try {\n        body = await readBody(req);\n      } catch {\n        active--;\n        reply(res, 400, { error: 'invalid_request' });\n        return;\n      }\n      try {\n        // The installed SDK accepts batches; this endpoint does not. A batch must\n        // never skip the per-call HTTP authorization/challenge path below.\n        if (Array.isArray(body)) {\n          reply(res, 400, { error: 'batch_not_supported' });\n          return;\n        }\n        // Only an OAuth bearer delegates; a PAT never leaves this process.\n        const delegation = match[1].startsWith('dbp_')\n          ? undefined\n          : adapter.delegate?.(match[1], principal);\n        // One read per user per minute, shared by concurrent requests. A failed or\n        // rate-limited read keeps the last good catalogue and never fails the call.\n        let brynCatalogue: BrynCatalogue = { tools: [], turns: [] };\n        let catalogueRetryAfter: number | undefined;\n        if (adapter.getBrynCatalogue) {\n          const read = await catalogueCache.get(\n            `${principal.companyId}:${principal.userId}:${principal.credentialType}`,\n            async () => {\n              let raw: unknown;\n              try {\n                raw = await adapter.getBrynCatalogue!(principal, delegation);\n              } catch (error) {\n                if (error instanceof HostedAuthError) {\n                  if (error.detail?.status === 429)\n                    throw new RateLimitedError(error.retryAfterMs);\n                  // An issuer from before Bryn discovery has no such route.\n                  if (error.status === 404) return { tools: [], turns: [] };\n                }\n                throw error;\n              }\n              try {\n                return parseBrynCatalogue(raw);\n              } catch {\n                // A malformed new catalogue cannot disable the established tools.\n                return { tools: [], turns: [] };\n              }\n            }\n          );\n          brynCatalogue = read.catalogue;\n          if (read.degraded) catalogueRetryAfter = read.retryAfterSeconds;\n        }\n        if (\n          body?.method === 'tools/call' &&\n          typeof body.params?.name === 'string'\n        ) {\n          try {\n            authorizeTool(body.params.name, principal, brynCatalogue);\n            assertToolArguments(\n              body.params.name,\n              body.params.arguments,\n              principal,\n              delegation !== undefined,\n              brynCatalogue\n            );\n          } catch (error) {\n            // A workspace the grant does not hold, or two that disagree: answer the call as a\n            // tool error with the granted names, which an AI can act on. No tool runs.\n            if (error instanceof WorkspaceSelectionError) {\n              reply(res, 200, {\n                jsonrpc: '2.0',\n                id: body.id ?? null,\n                result: workspaceError(error),\n              });\n              return;\n            }\n            // A scope the grant lacks: consent already trimmed the scopes to the role, so a\n            // step-up challenge (403 insufficient_scope) cannot get more. It made Claude Code\n            // drop the whole connection to \"needs authentication\". Answer the call instead.\n            if (\n              error instanceof HostedAuthError &&\n              error.code === 'insufficient_scope'\n            ) {\n              const missing = requiredScopes(\n                body.params.name,\n                brynCatalogue\n              ).filter((scope) => !principal.scopes.includes(scope));\n              reply(res, 200, {\n                jsonrpc: '2.0',\n                id: body.id ?? null,\n                result: scopeError(missing),\n              });\n              return;\n            }\n            // The catalogue could not be read and this is no established tool: it may be\n            // a Bryn tool. Say when to retry instead of calling it unauthorized.\n            if (\n              catalogueRetryAfter !== undefined &&\n              error instanceof HostedAuthError &&\n              error.code === 'tool_not_authorized'\n            ) {\n              reply(res, 200, {\n                jsonrpc: '2.0',\n                id: body.id ?? null,\n                result: toolError(\n                  `Error: Bryn tools are temporarily unavailable because the tool list could not be read (rate limited or busy). Retry in ${catalogueRetryAfter} seconds. (TEMPORARILY_UNAVAILABLE)`\n                ),\n              });\n              return;\n            }\n            throw error;\n          }\n        }\n        const mcp = createHostedToolServer(\n          principal,\n          adapter,\n          delegation,\n          brynCatalogue\n        );\n        const transport = new StreamableHTTPServerTransport({\n          sessionIdGenerator: undefined,\n          enableJsonResponse: true,\n        });\n        let closed = false;\n        const close = () => {\n          if (!closed) {\n            closed = true;\n            void mcp.close();\n          }\n        };\n        res.once('close', close);\n        try {\n          await mcp.connect(transport);\n          await transport.handleRequest(req, res, body);\n        } finally {\n          if (res.writableEnded) close();\n        }\n      } finally {\n        active--;\n      }\n    } catch (error) {\n      if (res.headersSent) {\n        res.end();\n        return;\n      }\n      const status = error instanceof HostedAuthError ? error.status : 503;\n      if (status === 401)\n        res.setHeader(\n          'WWW-Authenticate',\n          `Bearer error=\"invalid_token\", resource_metadata=\"${metadataUrl}\"`\n        );\n      reply(res, status, {\n        error:\n          error instanceof HostedAuthError\n            ? error.code\n            : 'temporarily_unavailable',\n      });\n    }\n  });\n  server.requestTimeout = 30_000;\n  server.headersTimeout = 10_000;\n  server.keepAliveTimeout = 5_000;\n  return server;\n}\n","import {\n  type BrynCatalogue,\n  type BrynTool,\n  isExecutableBrynTool,\n} from '../bryn/catalogue.js';\nimport { catalogueTurnEntry } from '../bryn/catalogueTurns.js';\nimport type {\n  GrantedWorkspace,\n  HostedPrincipal,\n  HostedScope,\n} from './types.js';\nimport { HostedAuthError } from './types.js';\n\nfunction brynEntry(\n  name: string,\n  catalogue?: BrynCatalogue\n): BrynTool | undefined {\n  return catalogue?.tools.find(\n    (entry) => entry.name === name && isExecutableBrynTool(entry)\n  );\n}\n\n/** Explicit exhaustive policy: a newly registered tool is denied until it gets a policy. */\nexport const TOOL_SCOPES: Readonly<Record<string, readonly HostedScope[]>> = {\n  whoami: [],\n  list_datasources: ['mcp:datamarts:read'],\n  discover_datasource_schema: ['mcp:datamarts:read'],\n  list_datamarts: ['mcp:datamarts:read'],\n  list_workspaces: ['mcp:datamarts:read'],\n  sync_datasource: ['mcp:datamarts:write'],\n  create_datamart: ['mcp:datamarts:write'],\n  list_data_apps: ['mcp:dashboards:read'],\n  list_tenants: ['mcp:dashboards:read'],\n  create_data_app: ['mcp:embeds:write'],\n  list_api_tokens: ['mcp:embeds:write'],\n  create_api_token: ['mcp:embeds:write'],\n  rotate_api_token: ['mcp:embeds:write'],\n  create_embed: ['mcp:embeds:write'],\n  list_embeds: ['mcp:dashboards:read'],\n  get_embed_details: ['mcp:dashboards:read'],\n  update_embed: ['mcp:embeds:write'],\n  customize_embed_theme: ['mcp:embeds:write'],\n  get_demo_link: ['mcp:embeds:write'],\n  generate_guest_token: ['mcp:embeds:write'],\n  generate_embed_code: ['mcp:dashboards:read'],\n  create_workspace: ['mcp:datamarts:write'],\n  list_dashboards: ['mcp:dashboards:read'],\n  create_dashboard: ['mcp:dashboards:write'],\n  get_dashboard: ['mcp:dashboards:read'],\n  dashboard_snapshot: ['mcp:dashboards:read'],\n  generate_dashboard_tiles: [\n    'mcp:dashboards:write',\n    'mcp:query',\n    'mcp:embeds:write',\n  ],\n  ask_question: ['mcp:query'],\n  get_semantic_layer: ['mcp:datamarts:read'],\n  update_semantic_layer: ['mcp:datamarts:write'],\n  start_semantic_layer_generation: ['mcp:datamarts:write'],\n  get_semantic_layer_generation_status: ['mcp:datamarts:read'],\n  search_semantic_model: ['mcp:datamarts:read'],\n  get_semantic_entity: ['mcp:datamarts:read'],\n  propose_semantic_change: ['mcp:datamarts:read'],\n  apply_semantic_change: ['mcp:datamarts:write'],\n  eval_semantic_model: ['mcp:datamarts:read', 'mcp:query'],\n  list_widgets: ['mcp:dashboards:read'],\n  validate_metric_spec: [\n    'mcp:dashboards:read',\n    'mcp:query',\n    'mcp:embeds:write',\n  ],\n  create_or_update_metric_from_query: [\n    'mcp:dashboards:write',\n    'mcp:query',\n    'mcp:embeds:write',\n  ],\n  create_workspace_metric: ['mcp:dashboards:write', 'mcp:query'],\n  add_widget: ['mcp:dashboards:write', 'mcp:embeds:write'],\n  update_widget: ['mcp:dashboards:write', 'mcp:embeds:write'],\n  remove_widget: ['mcp:dashboards:write', 'mcp:embeds:write'],\n  generate_widget: ['mcp:dashboards:write', 'mcp:query', 'mcp:embeds:write'],\n  list_scheduled_reports: ['mcp:dashboards:read'],\n  custom_chart_edit: ['mcp:custom-charts:write'],\n  custom_chart_preview: ['mcp:custom-charts:read'],\n  load_custom_chart_bundle: ['mcp:custom-charts:read'],\n  load_custom_chart_runtime: ['mcp:custom-charts:read'],\n  custom_chart_scaffold: [],\n  custom_chart_validate: ['mcp:custom-charts:read'],\n  custom_chart_upload: ['mcp:custom-charts:write'],\n  list_custom_charts: ['mcp:custom-charts:read'],\n  publish_custom_chart: ['mcp:custom-charts:write'],\n  // Chart tile controls (the chart-apps composition). The same routes as ask_question and a\n  // dashboard save; listed so a hosted composition is not refused for want of a policy.\n  preview_chart: ['mcp:query'],\n  save_chart_as_dashboard: ['mcp:dashboards:write', 'mcp:query'],\n  // Hosted platform reads do not mint embed credentials. Guest rendering retains its backend boundary.\n  render_metric_tile: ['mcp:dashboards:read', 'mcp:query'],\n  render_chart: ['mcp:dashboards:read', 'mcp:query'],\n  refresh_widget: ['mcp:dashboards:read', 'mcp:query'],\n  drill_down: ['mcp:dashboards:read', 'mcp:query'],\n  change_date_range: ['mcp:dashboards:read', 'mcp:query'],\n};\n\nconst BRYN_TURN_SCOPES: Readonly<Record<string, readonly HostedScope[]>> = {\n  ask_bryn_metric: ['mcp:query'],\n  ask_bryn_semantic_model: ['mcp:datamarts:read', 'mcp:datamarts:write'],\n  ask_bryn_theme: ['mcp:embeds:write'],\n  ask_bryn_custom_chart: ['mcp:custom-charts:write'],\n};\n\nexport function requiredScopes(\n  name: string,\n  catalogue?: BrynCatalogue\n): readonly HostedScope[] {\n  if (\n    (catalogue?.tools.length || catalogue?.turns.length) &&\n    Object.hasOwn(BRYN_TURN_SCOPES, name)\n  )\n    return BRYN_TURN_SCOPES[name];\n  // An established tool keeps its own policy, whatever the catalogue claims.\n  const turn = Object.hasOwn(TOOL_SCOPES, name)\n    ? undefined\n    : catalogueTurnEntry(name, catalogue);\n  if (turn) return turn.requiredScopes;\n  const bryn = brynEntry(name, catalogue);\n  if (bryn) {\n    if (bryn.requiredScopes) return bryn.requiredScopes;\n    if (bryn.surface === 'custom-chart-studio')\n      return ['mcp:custom-charts:write'];\n    return bryn.effect === 'read'\n      ? ['mcp:dashboards:read']\n      : ['mcp:embeds:write'];\n  }\n  if (!Object.hasOwn(TOOL_SCOPES, name))\n    throw new HostedAuthError(403, 'tool_not_authorized');\n  return TOOL_SCOPES[name];\n}\n\nexport function authorizeTool(\n  name: string,\n  principal: HostedPrincipal,\n  catalogue?: BrynCatalogue\n): void {\n  if (\n    principal.expiresAt !== undefined &&\n    principal.expiresAt <= Date.now() / 1000\n  )\n    throw new HostedAuthError(401, 'invalid_token');\n  if (\n    requiredScopes(name, catalogue).some(\n      (scope) => !principal.scopes.includes(scope)\n    )\n  )\n    throw new HostedAuthError(403, 'insufficient_scope');\n}\n\n/**\n * A tool's own top-level argument whose name is also a forbidden identity key, with the\n * only values it may take. `list_dashboards.scope` picks the listing, not an OAuth scope.\n */\nconst TOOL_ARGUMENT_VALUES: Readonly<\n  Record<string, Readonly<Record<string, readonly string[]>>>\n> = {\n  list_dashboards: { scope: ['auto', 'data_app', 'global'] },\n};\n\n/**\n * Top-level tool arguments that carry query rows, not selectors. A row may have a\n * `userId` or `workspaceId` column; the issuer treats the rows as data.\n */\nconst TOOL_OPAQUE_ARGUMENTS: Readonly<Record<string, readonly string[]>> = {\n  ask_bryn_theme: ['theme', 'dark', 'schema', 'contrast'],\n  ask_bryn_custom_chart: ['draft'],\n  preview_chart: ['rows'],\n  custom_chart_preview: ['rows', 'manifest'],\n  custom_chart_edit: ['draft'],\n};\n\n/**\n * Tool-call arguments: the allowed own arguments by exact value, then the shared binding rules\n * against the call's workspace. Returns that workspace (see selectWorkspace).\n */\nexport function assertToolArguments(\n  name: string,\n  value: unknown,\n  principal: HostedPrincipal,\n  delegated = false,\n  catalogue?: BrynCatalogue\n): GrantedWorkspace | undefined {\n  const allowed = Object.hasOwn(TOOL_ARGUMENT_VALUES, name)\n    ? TOOL_ARGUMENT_VALUES[name]\n    : {};\n  const bryn = brynEntry(name, catalogue);\n  const turn = Object.hasOwn(TOOL_SCOPES, name)\n    ? undefined\n    : catalogueTurnEntry(name, catalogue);\n  const opaque = turn\n    ? turn.opaqueContextFields\n    : bryn\n      ? bryn.opaqueContextFields\n        ? ['input', ...bryn.opaqueContextFields]\n        : ['input', 'draft', 'theme', 'dark', 'schema', 'contrast', 'followUp']\n      : Object.hasOwn(TOOL_OPAQUE_ARGUMENTS, name)\n        ? TOOL_OPAQUE_ARGUMENTS[name]\n        : undefined;\n  const target = selectWorkspace(value, principal);\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    assertBoundArguments(value, principal, { target, delegated });\n    return target;\n  }\n  const rest: Record<string, unknown> = {};\n  for (const [key, child] of Object.entries(value)) {\n    if (!Object.hasOwn(allowed, key)) {\n      rest[key] = child;\n      continue;\n    }\n    if (typeof child !== 'string' || !allowed[key].includes(child))\n      throw new HostedAuthError(403, 'identity_argument_forbidden');\n  }\n  assertBoundArguments(rest, principal, { target, delegated, opaque });\n  return target;\n}\n\n/**\n * Tools that act on no single workspace: identity, the granted list, company-level\n * custom charts, local code generation, and workspace creation. Every other tool\n * reaches a workspace-scoped route, so it can name its workspace.\n */\nexport const WORKSPACE_FREE_TOOLS: ReadonlySet<string> = new Set([\n  'whoami',\n  'list_workspaces',\n  'create_workspace',\n  'generate_embed_code',\n  'custom_chart_preview',\n  'load_custom_chart_bundle',\n  'load_custom_chart_runtime',\n  'custom_chart_scaffold',\n  'custom_chart_validate',\n  'custom_chart_upload',\n  'list_custom_charts',\n  'publish_custom_chart',\n]);\n\n/**\n * Tools that walk every granted workspace when the call names none (each request then names\n * its own workspace), and only the named one when it does. They never ask for a workspace.\n */\nexport const WORKSPACE_SPANNING_TOOLS: ReadonlySet<string> = new Set([\n  'list_dashboards',\n]);\n\n/** The workspace selector a hosted tool gains when its own schema has none. Sent only as a header. */\nexport const WORKSPACE_INPUT = 'workspace';\n\n/** Raised before any request when a call names its workspace wrongly; the tool shows the message. */\nexport class WorkspaceSelectionError extends HostedAuthError {\n  constructor(\n    status: 400 | 404,\n    code: string,\n    public readonly reason: string\n  ) {\n    super(status, code);\n  }\n}\n\nexport function grantedWorkspaces(\n  principal: HostedPrincipal\n): GrantedWorkspace[] {\n  if (principal.grantedWorkspaces) return principal.grantedWorkspaces;\n  return principal.workspaceId\n    ? [{ id: principal.workspaceId, name: principal.workspaceName }]\n    : [];\n}\n\n/** \"A, B, C\", at most 20 names, then \"and N more\". Only the user's own granted names. */\nexport function grantedNames(principal: HostedPrincipal): string {\n  const names = grantedWorkspaces(principal).map(\n    (item) => item.name ?? item.id\n  );\n  return names.length > 20\n    ? `${names.slice(0, 20).join(', ')} and ${names.length - 20} more`\n    : names.join(', ');\n}\n\n/** A selector is a granted workspace's id, else its exact name. Nothing else, and never two. */\nfunction findGranted(\n  principal: HostedPrincipal,\n  key: string,\n  value: unknown\n): GrantedWorkspace {\n  const granted = grantedWorkspaces(principal);\n  const matches =\n    typeof value !== 'string'\n      ? []\n      : key === 'workspaceId'\n        ? granted.filter((item) => item.id === value)\n        : key === 'workspaceName'\n          ? granted.filter((item) => item.name === value)\n          : granted.some((item) => item.id === value)\n            ? granted.filter((item) => item.id === value)\n            : granted.filter((item) => item.name === value);\n  if (matches.length !== 1) {\n    throw new WorkspaceSelectionError(\n      404,\n      'NOT_FOUND_IN_GRANT',\n      `Workspace ${JSON.stringify(String(value).slice(0, 100))} is not one this sign-in granted. Granted: ${grantedNames(principal)}.`\n    );\n  }\n  return matches[0];\n}\n\n/**\n * The one workspace a tool call acts in: the top-level `workspace`, `workspaceName` or\n * `workspaceId` inputs (all must name the same granted workspace), else the only granted\n * workspace, else none (the issuer then asks for one, or the route is company-level).\n */\nexport function selectWorkspace(\n  args: unknown,\n  principal: HostedPrincipal,\n  keys: readonly string[] = [WORKSPACE_INPUT, 'workspaceName', 'workspaceId']\n): GrantedWorkspace | undefined {\n  let target: GrantedWorkspace | undefined;\n  if (args && typeof args === 'object' && !Array.isArray(args)) {\n    for (const key of keys) {\n      const value = (args as Record<string, unknown>)[key];\n      if (value === undefined) continue;\n      const found = findGranted(principal, key, value);\n      if (target && target.id !== found.id) {\n        throw new WorkspaceSelectionError(\n          400,\n          'WORKSPACE_CONFLICT',\n          'These inputs name different workspaces. Name one workspace for this call.'\n        );\n      }\n      target = found;\n    }\n  }\n  const granted = grantedWorkspaces(principal);\n  return target ?? (granted.length === 1 ? granted[0] : undefined);\n}\n\n/** True when a workspace selector appears anywhere in the arguments, raw passthroughs included. */\nexport function namesWorkspace(value: unknown): boolean {\n  if (!value || typeof value !== 'object') return false;\n  return Object.entries(value).some(\n    ([key, child]) =>\n      ([WORKSPACE_INPUT, 'workspaceName', 'workspaceId'].includes(key) &&\n        child !== undefined) ||\n      namesWorkspace(child)\n  );\n}\n\n/** What one tool call is bound to, beyond the principal. */\nexport interface ArgumentBinding {\n  /** The call's workspace (selectWorkspace). Every workspace selector must name it. */\n  target?: GrantedWorkspace;\n  /**\n   * The call runs as a delegated OAuth request: the issuer checks any tenant id against its\n   * route policy on that very call, as it does for the app user, and refuses a route that\n   * claims none. Without it (a PAT, a non-delegating adapter) a tenant needs `tenantIds`.\n   */\n  delegated?: boolean;\n  /** Top-level keys holding data rather than selectors (query rows), never scanned. */\n  opaque?: readonly string[];\n}\n\nfunction tenantAllowed(\n  child: unknown,\n  principal: HostedPrincipal,\n  delegated: boolean\n): boolean {\n  if (typeof child !== 'string') return false;\n  if (principal.tenantIds) return principal.tenantIds.includes(child);\n  return delegated && principal.credentialType === 'oauth';\n}\n\n/**\n * Reject conflicting selectors even in raw body passthroughs before a handler can use them.\n * A workspace selector must name the call's target when it has one, else a granted workspace.\n */\nexport function assertBoundArguments(\n  value: unknown,\n  principal: HostedPrincipal,\n  binding: ArgumentBinding = {}\n): void {\n  if (!value || typeof value !== 'object') return;\n  const { opaque, ...nested } = binding;\n  for (const [key, child] of Object.entries(value)) {\n    if (opaque?.includes(key) && !Array.isArray(value)) continue;\n    if (key === 'workspaceId' || key === 'workspaceName') {\n      const target = binding.target;\n      if (\n        target\n          ? child !== (key === 'workspaceId' ? target.id : target.name)\n          : !findGranted(principal, key, child)\n      ) {\n        throw new HostedAuthError(403, 'principal_mismatch');\n      }\n    }\n    if (\n      ['companyId', 'userId'].includes(key) &&\n      child !== principal[key as 'companyId' | 'userId']\n    ) {\n      throw new HostedAuthError(403, 'principal_mismatch');\n    }\n    if (\n      [\n        'scope',\n        'scopes',\n        'authUser',\n        'actorKind',\n        'credentialType',\n        'oauthClientId',\n        'operatorEmail',\n        'session_variables',\n        'isAllClient',\n        'isAdmin',\n        'serviceToken',\n        'apiToken',\n        'authorization',\n      ].includes(key)\n    ) {\n      throw new HostedAuthError(403, 'identity_argument_forbidden');\n    }\n    if (\n      ['clientId', 'tenantId'].includes(key) &&\n      !tenantAllowed(child, principal, binding.delegated === true)\n    ) {\n      throw new HostedAuthError(403, 'tenant_not_authorized');\n    }\n    assertBoundArguments(child, principal, nested);\n  }\n}\n","import { AsyncLocalStorage } from 'node:async_hooks';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';\nimport { instrument } from '@posthog/mcp';\nimport { PostHog } from 'posthog-node';\nimport { z } from 'zod';\nimport { enableChartApps } from '../apps/feature.js';\nimport { PREVIEW_PATH } from '../apps/preview.js';\nimport { registerChartApps } from '../apps/registry.js';\nimport type { BrynCatalogue } from '../bryn/catalogue.js';\nimport { registerCatalogueTurns } from '../bryn/catalogueTurns.js';\nimport { registerBrynTools } from '../bryn/register.js';\nimport { registerBrynTurns } from '../bryn/turns.js';\nimport { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { registerAllPrompts } from '../prompts/registry.js';\nimport { registerAllResources } from '../resources/registry.js';\nimport { registerCreateWorkspace } from '../tools/infrastructure/create-workspace.js';\nimport { registerAllTools } from '../tools/registry.js';\nimport { DatabrainApiError, toolError, toolSuccess } from '../utils/errors.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport {\n  assertBoundArguments,\n  assertToolArguments,\n  authorizeTool,\n  grantedNames,\n  grantedWorkspaces,\n  namesWorkspace,\n  selectWorkspace,\n  WORKSPACE_FREE_TOOLS,\n  WORKSPACE_INPUT,\n  WORKSPACE_SPANNING_TOOLS,\n  WorkspaceSelectionError,\n} from './authorization.js';\nimport type {\n  GrantedWorkspace,\n  HostedAdapter,\n  HostedDelegation,\n  HostedPrincipal,\n} from './types.js';\nimport { HostedAuthError } from './types.js';\n\n// Stdio's instrumentation changes the wire schema (required `context`). Use that\n// same implementation, with capture disabled until hosted telemetry has an owner.\n// No bearer, request headers, tool arguments or results are sent to analytics.\nconst schemaInstrumentation = new PostHog('hosted-contract-only', {\n  disabled: true,\n});\n\n/** The granted workspace the running tool call acts in. Set by the tool wrapper only. */\nconst callWorkspace = new AsyncLocalStorage<{ target?: GrantedWorkspace }>();\n\nconst WORKSPACE_HINT =\n  'Call whoami to see the workspaces this sign-in granted, then name one.';\n\n/** A workspace selection problem, as the tool result the AI reads: reason, code, next step. */\nexport function workspaceError(error: WorkspaceSelectionError) {\n  return toolError(\n    `Error: ${error.reason} (${error.code})\\n\\nHint: ${WORKSPACE_HINT}`\n  );\n}\n\n/** A tool this sign-in's scopes do not cover, as a tool result: the connection stays up. */\nexport function scopeError(missing: readonly string[]) {\n  return toolError(\n    `Error: This connection cannot do this. It needs ${missing.join(', ')}, which your role did not allow ` +\n      'when you connected. (INSUFFICIENT_SCOPE)\\n\\nHint: Ask a Databrain admin for a role that allows it, then connect ' +\n      'again. If your role allows it in a workspace you did not choose, connect again and choose that workspace.'\n  );\n}\n\n/** The workspace list answer (bare or under `data`) cut to one workspace. */\nfunction onlyWorkspace(raw: unknown, target: GrantedWorkspace): unknown {\n  const keep = (items: unknown) =>\n    Array.isArray(items)\n      ? items.filter((item) => {\n          const record =\n            item && typeof item === 'object'\n              ? (item as Record<string, unknown>)\n              : {};\n          return (\n            record.id === target.id ||\n            record._id === target.id ||\n            (record.id === undefined &&\n              record._id === undefined &&\n              target.name !== undefined &&\n              record.name === target.name)\n          );\n        })\n      : items;\n  if (Array.isArray(raw)) return keep(raw);\n  if (raw && typeof raw === 'object' && 'data' in raw)\n    return { ...raw, data: keep((raw as { data: unknown }).data) };\n  return raw;\n}\n\n/** A request-local client: shared APIs/tools run unchanged, through a delegated executor. */\nclass HostedClient extends DatabrainClient {\n  constructor(\n    private readonly adapter: HostedAdapter,\n    private readonly principal: HostedPrincipal,\n    private readonly delegation?: HostedDelegation,\n    private readonly brynCatalogue?: BrynCatalogue\n  ) {\n    super({\n      apiUrl: 'https://api.usedatabrain.com',\n      demoDomain: 'https://demo.usedatabrain.com',\n    });\n  }\n  // A generated API credential must never replace the authorizing hosted principal.\n  override setRuntimeApiToken(_token: string): void {}\n  override isHosted(): boolean {\n    return true;\n  }\n\n  override async request<T>(options: RequestOptions): Promise<T> {\n    try {\n      const name = toolContext.getStore()?.tool;\n      if (!name) throw new HostedAuthError(403, 'tool_not_authorized');\n      authorizeTool(name, this.principal, this.brynCatalogue);\n      const named = callWorkspace.getStore()?.target;\n      // With no workspace for the call (a tool that walks every granted workspace), a request\n      // that names one top-level workspace acts in it, and says so in the header too.\n      const target =\n        named ??\n        selectWorkspace(options.body, this.principal, [\n          'workspaceName',\n          'workspaceId',\n        ]) ??\n        selectWorkspace(options.query, this.principal, [\n          'workspaceName',\n          'workspaceId',\n        ]);\n      const delegated = this.delegation !== undefined;\n      // Chart preview rows are query output (a row may have a userId column); the issuer\n      // treats them as data too. Every other body field is still checked.\n      const opaque =\n        options.method === 'POST' && options.path === PREVIEW_PATH\n          ? ['rows']\n          : options.method === 'POST' &&\n              /^\\/api\\/v2\\/custom-charts\\/[a-z][a-z0-9_-]*\\/bryn\\/turn$/.test(\n                options.path\n              )\n            ? ['draft']\n            : options.method === 'POST' &&\n                options.path === '/api/v2/theme-bryn/turn'\n              ? ['theme', 'dark', 'schema', 'contrast']\n              : options.method === 'POST' &&\n                  /^\\/api\\/mcp\\/bryn\\/tools\\/[a-z][a-z0-9_]*$/.test(\n                    options.path\n                  )\n                ? [\n                    'input',\n                    'draft',\n                    'theme',\n                    'dark',\n                    'schema',\n                    'contrast',\n                    'followUp',\n                  ]\n                : undefined;\n      assertBoundArguments(options.body, this.principal, {\n        target,\n        delegated,\n        opaque,\n      });\n      assertBoundArguments(options.query, this.principal, {\n        target,\n        delegated,\n      });\n      let raw = await this.adapter.executeRequest(\n        structuredClone(options),\n        structuredClone(this.principal),\n        this.delegation,\n        target && structuredClone(target)\n      );\n      // A call that named its workspace reads the workspace list as that workspace only, so a\n      // tool that walks the list (list_dashboards) stays in it.\n      if (\n        named &&\n        options.method === 'GET' &&\n        options.path === '/api/v2/workspace'\n      )\n        raw = onlyWorkspace(raw, named);\n      if (\n        !options.skipDataUnwrap &&\n        raw &&\n        typeof raw === 'object' &&\n        !Array.isArray(raw) &&\n        'data' in raw &&\n        raw.data !== null &&\n        raw.data !== undefined\n      )\n        return raw.data as T;\n      return raw as T;\n    } catch (error) {\n      if (error instanceof WorkspaceSelectionError) {\n        throw new DatabrainApiError(\n          error.status,\n          error.code,\n          `${error.reason} (${error.code})`,\n          undefined,\n          WORKSPACE_HINT\n        );\n      }\n      // The adapter may encounter secret-bearing remote bodies. Do not pass them to tools/logs.\n      const status = error instanceof HostedAuthError ? error.status : 503;\n      const detail =\n        error instanceof HostedAuthError ? error.detail : undefined;\n      // A 403 reaches the tool only with a reason about this user's own grant (the adapter\n      // keeps no other 403 body): the role in that workspace, or workspace creation.\n      if (status === 403 && detail?.code) {\n        throw new DatabrainApiError(\n          0,\n          detail.code,\n          `${detail.message ?? 'Your role does not allow this here.'} (${detail.code})`,\n          undefined,\n          'Ask a Databrain admin for access, or pick a workspace where your role allows it.'\n        );\n      }\n      if (status === 401 || status === 403) {\n        // Status 0 carries no API-key hint: a hosted user has no key to rotate, only a sign-in.\n        throw new DatabrainApiError(\n          0,\n          'HOSTED_REQUEST_DENIED',\n          'The signed-in Databrain user cannot do this: the sign-in expired or was revoked, or the granted scopes, role or workspace do not allow it. Sign in again or ask an admin.'\n        );\n      }\n      if (detail && (detail.code || detail.message)) {\n        // The code rides with the message: a short message (\"The workspace does not allow\n        // this.\") only makes sense next to its reason (DATA_APP_REQUIRED).\n        const message =\n          detail.message ??\n          (status === 404\n            ? 'Not found in the workspace this sign-in approved.'\n            : 'The backend refused this request.');\n        throw new DatabrainApiError(\n          detail.status,\n          detail.code ?? 'HOSTED_REQUEST_FAILED',\n          detail.code && !message.includes(detail.code)\n            ? `${message} (${detail.code})`\n            : message,\n          { error: { code: detail.code, message: detail.message } }\n        );\n      }\n      throw new DatabrainApiError(\n        status,\n        'HOSTED_REQUEST_DENIED',\n        status === 404\n          ? 'Not found in the workspace this sign-in approved.'\n          : 'The authorized backend could not complete this request. Check workspace access and hosted integration.'\n      );\n    }\n  }\n}\n\n/** The hosted description line for a tool that works in one workspace. */\nfunction workspaceLine(name: string, input: string): string {\n  return WORKSPACE_SPANNING_TOOLS.has(name)\n    ? ` With more than one granted workspace, name one in \\`${input}\\` to list only that one; leave it out to list them all.`\n    : ` Needed when you granted more than one workspace: name it in \\`${input}\\`.`;\n}\n\nfunction whoami(principal: HostedPrincipal) {\n  const granted = grantedWorkspaces(principal);\n  return toolSuccess(\n    JSON.stringify(\n      {\n        status: 'authenticated',\n        activeBearer: principal.credentialType,\n        actorKind: principal.actorKind,\n        userId: principal.userId,\n        companyId: principal.companyId,\n        workspaceGrant:\n          principal.workspaces?.mode === 'all'\n            ? 'All workspaces I can access (new ones are included)'\n            : 'Only the workspaces chosen at sign-in',\n        grantedWorkspaces: granted.map((item) => ({\n          id: item.id,\n          name: item.name,\n        })),\n        ...(granted.length === 1\n          ? { workspaceId: granted[0].id, workspaceName: granted[0].name }\n          : {}),\n        note:\n          granted.length === 1\n            ? 'Every call works in this workspace.'\n            : `Name the workspace on each call that works in one (the \\`${WORKSPACE_INPUT}\\` or \\`workspaceName\\` input): ${grantedNames(principal)}.`,\n        oauthClientId: principal.clientId,\n        scopes: principal.scopes,\n      },\n      null,\n      2\n    )\n  );\n}\n\nexport function createHostedToolServer(\n  principal: HostedPrincipal,\n  adapter: HostedAdapter,\n  delegation?: HostedDelegation,\n  brynCatalogue?: BrynCatalogue\n): McpServer {\n  const bound = structuredClone(principal);\n  const delegated = delegation !== undefined;\n  const server = new McpServer(\n    { name: 'databrain', version: MCP_SERVER_VERSION },\n    {\n      instructions:\n        \"Hosted Databrain: each request is authenticated as the signed-in user, with that user's own role in each workspace. \" +\n        'Use whoami to see the verified identity, scopes and the workspaces this sign-in granted. ' +\n        'When more than one workspace is granted, name the workspace on each call (the workspace or workspaceName input). ' +\n        'Never ask for a service token or put credentials in tool arguments. ' +\n        'Workspace and tenant access come from the bearer principal. Existing dry-run and production-confirmation rules still apply. ' +\n        'For existing saved charts, call list_widgets with dashboardId or dashboardName and no clientId; no embed, data app or datamart is needed. Use render_metric_tile to draw a metricRef directly. Use ask_question for new data questions. Chart controls and save_chart_as_dashboard use the same workspace and role; ' +\n        'saving requires the existing production confirmation. Hosts without MCP Apps can read the text answer.',\n    }\n  );\n\n  // The existing shared registry already wraps server.tool for intent telemetry. Layer\n  // hosted policy underneath it; keep every handler and annotation. A tool that works in one\n  // workspace says so, and gains a `workspace` input when its own schema names none.\n  const register = server.tool.bind(server) as (...args: any[]) => unknown;\n  server.tool = ((...args: any[]) => {\n    const name = args[0] as string;\n    const index = args.length - 1;\n    const handler = args[index] as (\n      ...values: any[]\n    ) => CallToolResult | Promise<CallToolResult>;\n    const shape =\n      typeof args[1] === 'string' &&\n      args[2] &&\n      typeof args[2] === 'object' &&\n      !('readOnlyHint' in args[2])\n        ? (args[2] as Record<string, unknown>)\n        : undefined;\n    const ownSelector =\n      shape &&\n      (['workspaceName', 'workspaceId'] as const).find((key) =>\n        Object.hasOwn(shape, key)\n      );\n    const addsInput =\n      shape !== undefined &&\n      !ownSelector &&\n      !WORKSPACE_FREE_TOOLS.has(name) &&\n      !Object.hasOwn(shape, WORKSPACE_INPUT);\n    if (shape && !WORKSPACE_FREE_TOOLS.has(name)) {\n      if (addsInput) {\n        args[2] = {\n          ...shape,\n          [WORKSPACE_INPUT]: z\n            .string()\n            .min(1)\n            .max(512)\n            .optional()\n            .describe(\n              WORKSPACE_SPANNING_TOOLS.has(name)\n                ? 'Workspace id or name. Leave it out to cover every granted workspace.'\n                : 'Workspace id or name. Needed when you granted more than one workspace.'\n            ),\n        };\n      }\n      args[1] = `${args[1]}${workspaceLine(name, addsInput ? WORKSPACE_INPUT : ownSelector!)}`;\n    }\n    args[index] = async (...values: any[]) => {\n      try {\n        authorizeTool(name, bound, brynCatalogue);\n        const target = assertToolArguments(\n          name,\n          values[0],\n          bound,\n          delegated,\n          brynCatalogue\n        );\n        if (name === 'whoami') return whoami(bound);\n        const input =\n          values[0] && typeof values[0] === 'object'\n            ? (values[0] as Record<string, unknown>)\n            : undefined;\n        if (input?.projectDir !== undefined)\n          return toolError(\n            'projectDir is not available on the hosted server. Pass chartTs, manifest, bundleCss and iconSvg to compile in memory.'\n          );\n        if (\n          !target &&\n          !WORKSPACE_FREE_TOOLS.has(name) &&\n          !WORKSPACE_SPANNING_TOOLS.has(name) &&\n          !namesWorkspace(input)\n        ) {\n          throw new WorkspaceSelectionError(\n            400,\n            'WORKSPACE_REQUIRED',\n            `Name the workspace for this call. Granted: ${grantedNames(bound)}.`\n          );\n        }\n        if (input) {\n          // The new input is a header, never a body field. A selector the tool declares\n          // gets the call's workspace when it was left out, as for one granted workspace before.\n          if (addsInput) delete input[WORKSPACE_INPUT];\n          if (shape && target) {\n            if (Object.hasOwn(shape, 'workspaceId'))\n              input.workspaceId = target.id;\n            if (\n              Object.hasOwn(shape, 'workspaceName') &&\n              target.name !== undefined\n            )\n              input.workspaceName = target.name;\n          }\n        }\n        const result = await callWorkspace.run({ target }, () =>\n          handler(...values)\n        );\n        // The iframe's follow-up calls have no model to repeat the workspace selector.\n        // Carry only this verified call's workspace, never a draft's claimed choices.\n        if (target && result?._meta?.['ui/resourceUri']) {\n          return {\n            ...result,\n            _meta: { ...result._meta, 'databrain/workspace': target },\n          };\n        }\n        return result;\n      } catch (error) {\n        if (error instanceof WorkspaceSelectionError)\n          return workspaceError(error);\n        return toolError(\n          'Hosted authorization denied this tool call. Check the granted scopes, workspace and tenant access.'\n        );\n      }\n    };\n    return register(...args);\n  }) as McpServer['tool'];\n\n  const client = new HostedClient(adapter, bound, delegation, brynCatalogue);\n  enableChartApps(server);\n  registerAllTools(server, client);\n  if (brynCatalogue?.tools.length || brynCatalogue?.turns.length) {\n    registerBrynTools(server, client, brynCatalogue);\n    registerBrynTurns(server, client);\n    registerCatalogueTurns(server, client, brynCatalogue);\n  }\n  // Hosted only: a grant of \"All workspaces I can access\" may create one (the issuer decides).\n  registerCreateWorkspace(server, client);\n  registerAllResources(server);\n  registerAllPrompts(server);\n  // Keep Apps on the principal-bound client and under the same registration policy.\n  registerChartApps(server, client);\n  instrument(server, schemaInstrumentation, { beforeSend: () => null });\n  return server;\n}\n","import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { z } from 'zod';\nimport type { DatabrainClient } from '../../client/databrain-client.js';\nimport {\n  DatabrainApiError,\n  stringify,\n  toolError,\n  toolSuccess,\n} from '../../utils/errors.js';\nimport { WRITE_CREATE } from '../annotations.js';\n\n/**\n * Registered by the hosted server only (stdio dropped it in v0.2.0). The issuer allows it\n * only for a sign-in granted \"All workspaces I can access\" and a role that may create one.\n */\nexport function registerCreateWorkspace(\n  server: McpServer,\n  client: DatabrainClient\n): void {\n  server.tool(\n    'create_workspace',\n    'Create a new workspace to connect a datasource or datamart for dashboard building. ' +\n      'Works only when this sign-in granted \"All workspaces I can access\" and your role may create workspaces; ' +\n      'the new workspace is usable on the next call.',\n    {\n      name: z.string().describe('Unique workspace name'),\n      connectionType: z\n        .enum(['DATASOURCE', 'DATAMART', 'MULTI_DATASOURCE'])\n        .optional()\n        .describe(\n          'Connection type — DATASOURCE, DATAMART, or MULTI_DATASOURCE'\n        ),\n      datasourceName: z\n        .string()\n        .optional()\n        .describe(\n          'Datasource name (required when connectionType is DATASOURCE)'\n        ),\n      datamartName: z\n        .string()\n        .optional()\n        .describe('Datamart name (required when connectionType is DATAMART)'),\n      body: z\n        .record(z.string(), z.unknown())\n        .optional()\n        .describe('Raw API body passthrough for POST /api/v2/workspace'),\n    },\n    WRITE_CREATE,\n    async (params) => {\n      try {\n        const body: Record<string, unknown> = params.body\n          ? { ...params.body }\n          : {\n              name: params.name,\n              connectionType: params.connectionType,\n              datasourceName: params.datasourceName,\n              datamartName: params.datamartName,\n            };\n\n        const result = await client.request<{\n          name?: string;\n          id?: string;\n          _id?: string;\n          error?: unknown;\n        }>({\n          method: 'POST',\n          path: '/api/v2/workspace',\n          body,\n          auth: 'service',\n          invalidateCache: ['list_workspaces'],\n        });\n\n        if (result.error) {\n          return toolError(\n            `Workspace creation failed: ${stringify(result.error)}`\n          );\n        }\n\n        return toolSuccess(\n          `Workspace \"${result.name || params.name}\" created successfully.\\n\\n` +\n            'Next steps:\\n' +\n            '1. Use `create_data_app` to create a data app linked to this workspace\\n' +\n            '2. Build dashboards in the Databrain UI using this workspace\\n' +\n            '3. Use `create_embed` to embed dashboards'\n        );\n      } catch (err) {\n        if (err instanceof DatabrainApiError) return err.toToolResponse();\n        return toolError(`Unexpected error: ${(err as Error).message}`);\n      }\n    }\n  );\n}\n","import { z } from 'zod';\nimport { parseRetryAfter } from '../bryn/catalogueCache.js';\nimport { parseBrynStream, readBrynStream } from '../bryn/stream.js';\nimport { parseErrorBody } from '../client/error-body.js';\nimport { parseStudioStream } from '../custom-chart/studio.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { MCP_SERVER_VERSION } from '../version.js';\nimport { principalSchema } from './auth.js';\nimport type {\n  HostedAdapter,\n  HostedConfig,\n  HostedDelegation,\n  HostedErrorDetail,\n} from './types.js';\nimport { HostedAuthError } from './types.js';\n\nconst USER_AGENT = `databrain-mcp-server/${MCP_SERVER_VERSION} (hosted)`;\nconst REQUEST_TIMEOUT_MS = 30_000;\n/** Request headers a tool may set; nothing that can carry or replace a credential. */\nconst FORWARDED_HEADERS = new Set(['idempotency-key']);\n/** The call's workspace, for the issuer's delegated path. Only this adapter sets it. */\nexport const WORKSPACE_HEADER = 'X-Databrain-Workspace';\n/**\n * 403 codes whose reason is about the caller's own grant in a workspace it named and holds,\n * so they reveal nothing about other workspaces or companies. Every other 403 stays opaque.\n */\nconst GRANT_DENIALS = new Set([\n  'ROLE_NOT_ALLOWED',\n  'WORKSPACE_CREATE_NOT_ALLOWED',\n  'forbidden_permission',\n  'insufficient_scope',\n]);\n\n/** Code and message only, as short plain text; never other body fields or the bearer. */\nfunction errorDetail(\n  status: number,\n  text: string,\n  bearer: string | undefined\n): HostedErrorDetail {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    return { status };\n  }\n  const envelope = parseErrorBody(parsed);\n  // A dashboard write the API refuses tile by tile (422 `{tileVerdicts}`) carries no\n  // envelope; its problems are the only reason a tool can act on.\n  const tiles = tileProblems(parsed);\n  const code = envelope.code ?? (tiles ? 'TILE_VALIDATION_FAILED' : undefined);\n  const message = envelope.message ?? tiles;\n  const clean = (value: string | undefined, max: number) => {\n    if (!value) return undefined;\n    // biome-ignore lint/suspicious/noControlCharactersInRegex: Redaction intentionally removes control characters.\n    let out = value.replace(/[\\u0000-\\u001f\\u007f]+/g, ' ').trim();\n    if (bearer) out = out.split(bearer).join('[redacted]');\n    return out.slice(0, max) || undefined;\n  };\n  // Long enough for the issuer's list of up to 20 granted workspace names.\n  return {\n    status,\n    code: code && /^[A-Za-z0-9_.:-]{1,64}$/.test(code) ? code : undefined,\n    message: clean(message, 1200),\n  };\n}\n\n/** \"Tile t1: problem; problem. Tile t2: ...\" for the tiles a dashboard write refused. */\nfunction tileProblems(body: unknown): string | undefined {\n  const verdicts = (body as { tileVerdicts?: unknown } | null)?.tileVerdicts;\n  if (!Array.isArray(verdicts)) return undefined;\n  const lines = verdicts.flatMap((verdict) => {\n    const { id, ok, problems } = (verdict ?? {}) as {\n      id?: unknown;\n      ok?: unknown;\n      problems?: unknown;\n    };\n    if (ok !== false || !Array.isArray(problems)) return [];\n    const words = problems.filter((p): p is string => typeof p === 'string');\n    return words.length\n      ? [`Tile ${typeof id === 'string' ? id : '?'}: ${words.join(' ')}`]\n      : [];\n  });\n  return lines.length\n    ? `The dashboard was not saved. ${lines.join(' ')}`\n    : undefined;\n}\n\n/** BE-3's documented principal endpoint is the trust boundary for opaque OAuth tokens. */\nexport function createProviderAdapter(config: HostedConfig): HostedAdapter {\n  const issuer = new URL(config.issuer);\n  if (\n    issuer.protocol !== 'https:' ||\n    issuer.username ||\n    issuer.password ||\n    issuer.search ||\n    issuer.hash\n  ) {\n    throw new Error('Invalid hosted authorization server configuration.');\n  }\n  const apiBase = (config.apiUrl ?? config.issuer).replace(/\\/$/, '');\n  const apiOrigin = new URL(apiBase).origin;\n  const endpoint = `${apiBase}/oauth/principal`;\n  const publicOrigin = new URL(config.publicUrl).origin;\n  // Handle -> bearer, for this process only. A handle is unreadable and dies with its request.\n  const bearers = new WeakMap<HostedDelegation, string>();\n  const responseSchema = principalSchema\n    .extend({ issuer: z.literal(config.issuer) })\n    .strip();\n  const adapter: HostedAdapter = {\n    async verifyOAuth(token, resource) {\n      try {\n        // Only the explicitly configured issuer ever receives the token: here to verify it,\n        // and in executeRequest for its delegated REST path. No redirects, other origins,\n        // cache or service-token fallback.\n        const response = await fetch(endpoint, {\n          headers: {\n            Authorization: `Bearer ${token}`,\n            Accept: 'application/json',\n          },\n          redirect: 'error',\n          signal: AbortSignal.timeout(10_000),\n        });\n        if (!response.ok) {\n          if (response.status === 429 || response.status >= 500)\n            throw new HostedAuthError(503, 'temporarily_unavailable');\n          throw new HostedAuthError(401, 'invalid_token');\n        }\n        const { issuer: _issuer, ...principal } = responseSchema.parse(\n          await response.json()\n        );\n        if (\n          principal.resource !== resource ||\n          principal.credentialType !== 'oauth'\n        )\n          throw new HostedAuthError(401, 'invalid_token');\n        return principal;\n      } catch (error) {\n        if (error instanceof HostedAuthError) throw error;\n        throw new HostedAuthError(401, 'invalid_token');\n      }\n    },\n    async resolvePatGrant() {\n      throw new HostedAuthError(401, 'pat_membership_adapter_required');\n    },\n    delegate(token) {\n      const handle: HostedDelegation = Object.freeze({\n        kind: 'hosted-delegation' as const,\n      });\n      bearers.set(handle, token);\n      return handle;\n    },\n    async executeRequest(options, principal, delegation, workspace) {\n      // The backend's delegated path re-verifies this bearer for this resource on every\n      // call, then binds workspace, objects, role and audit. Only the configured issuer\n      // receives it, exactly as for /oauth/principal. A guest-token call carries only the\n      // guest token the backend minted for this user's earlier, authorized call.\n      const bearer = delegation ? bearers.get(delegation) : undefined;\n      if (options.auth !== 'none' && !bearer)\n        throw new HostedAuthError(503, 'delegated_backend_adapter_required');\n      if (options.auth === 'none' && !options.token)\n        throw new HostedAuthError(403, 'tool_not_authorized');\n      if (!options.path.startsWith('/') || options.path.startsWith('//'))\n        throw new HostedAuthError(403, 'tool_not_authorized');\n      const url = new URL(`${apiBase}${options.path}`);\n      if (url.origin !== apiOrigin)\n        throw new HostedAuthError(403, 'tool_not_authorized');\n      for (const [key, value] of Object.entries(options.query ?? {}))\n        url.searchParams.set(key, value);\n      const headers: Record<string, string> = {\n        Accept: 'application/json',\n        'Content-Type': 'application/json',\n        'User-Agent': USER_AGENT,\n        'X-Databrain-Client': USER_AGENT,\n      };\n      for (const [key, value] of Object.entries(options.headers ?? {})) {\n        if (FORWARDED_HEADERS.has(key.toLowerCase())) headers[key] = value;\n      }\n      const tool = toolContext.getStore();\n      if (tool) {\n        headers['X-Databrain-MCP-Tool'] = tool.tool;\n        headers['X-Databrain-MCP-Tool-Category'] = tool.category;\n        headers['X-Databrain-MCP-Workflow-Intent'] = tool.workflowIntent;\n        headers['X-Databrain-MCP-Input-Mode'] = tool.inputMode;\n      }\n      if (options.auth === 'none') {\n        headers['x-plugin-token'] = options.token!;\n        headers.Origin = publicOrigin;\n      } else {\n        headers.Authorization = `Bearer ${bearer}`;\n        // Same rule as the bearer: only with it, only to the issuer, and only a workspace\n        // this principal holds. The issuer re-checks it against the live grant.\n        if (workspace) {\n          if (\n            !principal.grantedWorkspaces?.some(\n              (item) => item.id === workspace.id\n            ) &&\n            principal.workspaceId !== workspace.id\n          )\n            throw new HostedAuthError(403, 'principal_mismatch');\n          headers[WORKSPACE_HEADER] = workspace.id;\n        }\n      }\n      const response = await fetch(url, {\n        method: options.method,\n        headers,\n        redirect: 'error',\n        body:\n          options.body === undefined ? undefined : JSON.stringify(options.body),\n        signal: AbortSignal.timeout(options.timeoutMs ?? REQUEST_TIMEOUT_MS),\n      });\n      const text =\n        options.responseFormat === 'bryn-sse' && response.ok\n          ? await readBrynStream(response)\n          : await response.text();\n      if (!response.ok) {\n        // A wrong-workspace object is a 404, like a missing one. 401, 403 and 5xx keep the\n        // status class only. Other 4xx keep the backend's code and message (a validation\n        // reason, `layer_not_found`), so a tool can recover as it does on stdio.\n        const forbidden =\n          response.status === 403 ? errorDetail(403, text, bearer) : undefined;\n        if (forbidden?.code && GRANT_DENIALS.has(forbidden.code)) {\n          throw new HostedAuthError(\n            403,\n            'delegated_request_denied',\n            forbidden.code === 'insufficient_scope' &&\n              options.path === '/api/v2/guest-token/create'\n              ? {\n                  ...forbidden,\n                  message:\n                    'Guest/tenant operations require mcp:embeds:write. Ask an admin for a role that allows it, then connect again.',\n                }\n              : forbidden\n          );\n        }\n        const status =\n          response.status === 403 &&\n          (options.responseFormat === 'studio-sse' ||\n            options.responseFormat === 'bryn-sse')\n            ? 403\n            : response.status === 401\n              ? 401\n              : response.status >= 500\n                ? 503\n                : response.status === 403 || response.status === 404\n                  ? 404\n                  : 400;\n        const detail =\n          status === 401 || status === 503 || response.status === 403\n            ? undefined\n            : errorDetail(response.status, text, bearer);\n        throw new HostedAuthError(\n          status,\n          'delegated_request_denied',\n          detail,\n          response.status === 429\n            ? parseRetryAfter(response.headers.get('retry-after'))\n            : undefined\n        );\n      }\n      try {\n        return options.responseFormat === 'studio-sse'\n          ? parseStudioStream(text)\n          : options.responseFormat === 'bryn-sse'\n            ? parseBrynStream(text)\n            : text\n              ? JSON.parse(text)\n              : null;\n      } catch {\n        throw new HostedAuthError(503, 'delegated_response_invalid');\n      }\n    },\n  };\n  adapter.getBrynCatalogue = (principal, delegation) =>\n    adapter.executeRequest(\n      { method: 'GET', path: '/api/mcp/bryn/catalog', auth: 'service' },\n      principal,\n      delegation\n    );\n  return adapter;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;;;ACCvB,SAAS,iBACd,MAAyB,QAAQ,KACnB;AACd,QAAM,WAAW,IAAI,+BAA+B;AACpD,MAAI,YAAY,IAAI,aAAa;AAC/B,UAAM,IAAI,MAAM,8CAA8C;AAChE,MAAI,IAAI,8BAA8B,CAAC;AACrC,UAAM,IAAI,MAAM,qCAAqC;AACvD,QAAM,WAAW,CAAC,OAA2B,UAAkB;AAC7D,QAAI;AACF,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM;AAC5B,YAAM,MAAM,IAAI,IAAI,KAAK;AACzB,UACE,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,IAAI,aAAa;AAEjB,cAAM,IAAI,MAAM;AAClB,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAGA,MAAI,cAAc,IAAI;AACtB,MAAI,cAAc,IAAI;AACtB,MAAI,CAAC,eAAe,CAAC,eAAe,IAAI,gBAAgB;AACtD,UAAM,SAAS,SAAS,IAAI,gBAAgB,gBAAgB,EAAE;AAC9D,kBAAc,GAAG,MAAM;AACvB,kBAAc;AAAA,EAChB;AACA,QAAM,YAAY,SAAS,aAAa,6BAA6B;AACrE,WAAS,aAAa,yBAAyB;AAC/C,MAAI,UAAU,aAAa;AACzB,UAAM,IAAI,MAAM,+CAA+C;AACjE,QAAM,OAAO,OAAO,IAAI,yBAAyB,MAAM;AAKvD,QAAM,OAAO,IAAI,yBAAyB;AAC1C,MAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,QAAQ,OAAO;AACnD,UAAM,IAAI,MAAM,gCAAgC;AAIlD,MAAI;AACJ,MAAI,IAAI,0BAA0B;AAChC,QAAI;AACJ,QAAI;AACF,YAAM,IAAI,IAAI,IAAI,wBAAwB;AAAA,IAC5C,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QACE,CAAC,OACD,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,QACJ,IAAI,aAAa,KACjB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,aAAS,IAAI;AAAA,EACf;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;;;ACpFA;AAAA,EACE;AAAA,OAGK;AACP,SAAS,qCAAqC;;;ACQ9C,SAAS,UACP,MACA,WACsB;AACtB,SAAO,WAAW,MAAM;AAAA,IACtB,CAAC,UAAU,MAAM,SAAS,QAAQ,qBAAqB,KAAK;AAAA,EAC9D;AACF;AAGO,IAAM,cAAgE;AAAA,EAC3E,QAAQ,CAAC;AAAA,EACT,kBAAkB,CAAC,oBAAoB;AAAA,EACvC,4BAA4B,CAAC,oBAAoB;AAAA,EACjD,gBAAgB,CAAC,oBAAoB;AAAA,EACrC,iBAAiB,CAAC,oBAAoB;AAAA,EACtC,iBAAiB,CAAC,qBAAqB;AAAA,EACvC,iBAAiB,CAAC,qBAAqB;AAAA,EACvC,gBAAgB,CAAC,qBAAqB;AAAA,EACtC,cAAc,CAAC,qBAAqB;AAAA,EACpC,iBAAiB,CAAC,kBAAkB;AAAA,EACpC,iBAAiB,CAAC,kBAAkB;AAAA,EACpC,kBAAkB,CAAC,kBAAkB;AAAA,EACrC,kBAAkB,CAAC,kBAAkB;AAAA,EACrC,cAAc,CAAC,kBAAkB;AAAA,EACjC,aAAa,CAAC,qBAAqB;AAAA,EACnC,mBAAmB,CAAC,qBAAqB;AAAA,EACzC,cAAc,CAAC,kBAAkB;AAAA,EACjC,uBAAuB,CAAC,kBAAkB;AAAA,EAC1C,eAAe,CAAC,kBAAkB;AAAA,EAClC,sBAAsB,CAAC,kBAAkB;AAAA,EACzC,qBAAqB,CAAC,qBAAqB;AAAA,EAC3C,kBAAkB,CAAC,qBAAqB;AAAA,EACxC,iBAAiB,CAAC,qBAAqB;AAAA,EACvC,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,eAAe,CAAC,qBAAqB;AAAA,EACrC,oBAAoB,CAAC,qBAAqB;AAAA,EAC1C,0BAA0B;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,cAAc,CAAC,WAAW;AAAA,EAC1B,oBAAoB,CAAC,oBAAoB;AAAA,EACzC,uBAAuB,CAAC,qBAAqB;AAAA,EAC7C,iCAAiC,CAAC,qBAAqB;AAAA,EACvD,sCAAsC,CAAC,oBAAoB;AAAA,EAC3D,uBAAuB,CAAC,oBAAoB;AAAA,EAC5C,qBAAqB,CAAC,oBAAoB;AAAA,EAC1C,yBAAyB,CAAC,oBAAoB;AAAA,EAC9C,uBAAuB,CAAC,qBAAqB;AAAA,EAC7C,qBAAqB,CAAC,sBAAsB,WAAW;AAAA,EACvD,cAAc,CAAC,qBAAqB;AAAA,EACpC,sBAAsB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,oCAAoC;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,yBAAyB,CAAC,wBAAwB,WAAW;AAAA,EAC7D,YAAY,CAAC,wBAAwB,kBAAkB;AAAA,EACvD,eAAe,CAAC,wBAAwB,kBAAkB;AAAA,EAC1D,eAAe,CAAC,wBAAwB,kBAAkB;AAAA,EAC1D,iBAAiB,CAAC,wBAAwB,aAAa,kBAAkB;AAAA,EACzE,wBAAwB,CAAC,qBAAqB;AAAA,EAC9C,mBAAmB,CAAC,yBAAyB;AAAA,EAC7C,sBAAsB,CAAC,wBAAwB;AAAA,EAC/C,0BAA0B,CAAC,wBAAwB;AAAA,EACnD,2BAA2B,CAAC,wBAAwB;AAAA,EACpD,uBAAuB,CAAC;AAAA,EACxB,uBAAuB,CAAC,wBAAwB;AAAA,EAChD,qBAAqB,CAAC,yBAAyB;AAAA,EAC/C,oBAAoB,CAAC,wBAAwB;AAAA,EAC7C,sBAAsB,CAAC,yBAAyB;AAAA;AAAA;AAAA,EAGhD,eAAe,CAAC,WAAW;AAAA,EAC3B,yBAAyB,CAAC,wBAAwB,WAAW;AAAA;AAAA,EAE7D,oBAAoB,CAAC,uBAAuB,WAAW;AAAA,EACvD,cAAc,CAAC,uBAAuB,WAAW;AAAA,EACjD,gBAAgB,CAAC,uBAAuB,WAAW;AAAA,EACnD,YAAY,CAAC,uBAAuB,WAAW;AAAA,EAC/C,mBAAmB,CAAC,uBAAuB,WAAW;AACxD;AAEA,IAAM,mBAAqE;AAAA,EACzE,iBAAiB,CAAC,WAAW;AAAA,EAC7B,yBAAyB,CAAC,sBAAsB,qBAAqB;AAAA,EACrE,gBAAgB,CAAC,kBAAkB;AAAA,EACnC,uBAAuB,CAAC,yBAAyB;AACnD;AAEO,SAAS,eACd,MACA,WACwB;AACxB,OACG,WAAW,MAAM,UAAU,WAAW,MAAM,WAC7C,OAAO,OAAO,kBAAkB,IAAI;AAEpC,WAAO,iBAAiB,IAAI;AAE9B,QAAM,OAAO,OAAO,OAAO,aAAa,IAAI,IACxC,SACA,mBAAmB,MAAM,SAAS;AACtC,MAAI,KAAM,QAAO,KAAK;AACtB,QAAM,OAAO,UAAU,MAAM,SAAS;AACtC,MAAI,MAAM;AACR,QAAI,KAAK,eAAgB,QAAO,KAAK;AACrC,QAAI,KAAK,YAAY;AACnB,aAAO,CAAC,yBAAyB;AACnC,WAAO,KAAK,WAAW,SACnB,CAAC,qBAAqB,IACtB,CAAC,kBAAkB;AAAA,EACzB;AACA,MAAI,CAAC,OAAO,OAAO,aAAa,IAAI;AAClC,UAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACtD,SAAO,YAAY,IAAI;AACzB;AAEO,SAAS,cACd,MACA,WACA,WACM;AACN,MACE,UAAU,cAAc,UACxB,UAAU,aAAa,KAAK,IAAI,IAAI;AAEpC,UAAM,IAAI,gBAAgB,KAAK,eAAe;AAChD,MACE,eAAe,MAAM,SAAS,EAAE;AAAA,IAC9B,CAAC,UAAU,CAAC,UAAU,OAAO,SAAS,KAAK;AAAA,EAC7C;AAEA,UAAM,IAAI,gBAAgB,KAAK,oBAAoB;AACvD;AAMA,IAAM,uBAEF;AAAA,EACF,iBAAiB,EAAE,OAAO,CAAC,QAAQ,YAAY,QAAQ,EAAE;AAC3D;AAMA,IAAM,wBAAqE;AAAA,EACzE,gBAAgB,CAAC,SAAS,QAAQ,UAAU,UAAU;AAAA,EACtD,uBAAuB,CAAC,OAAO;AAAA,EAC/B,eAAe,CAAC,MAAM;AAAA,EACtB,sBAAsB,CAAC,QAAQ,UAAU;AAAA,EACzC,mBAAmB,CAAC,OAAO;AAC7B;AAMO,SAAS,oBACd,MACA,OACA,WACA,YAAY,OACZ,WAC8B;AAC9B,QAAM,UAAU,OAAO,OAAO,sBAAsB,IAAI,IACpD,qBAAqB,IAAI,IACzB,CAAC;AACL,QAAM,OAAO,UAAU,MAAM,SAAS;AACtC,QAAM,OAAO,OAAO,OAAO,aAAa,IAAI,IACxC,SACA,mBAAmB,MAAM,SAAS;AACtC,QAAM,SAAS,OACX,KAAK,sBACL,OACE,KAAK,sBACH,CAAC,SAAS,GAAG,KAAK,mBAAmB,IACrC,CAAC,SAAS,SAAS,SAAS,QAAQ,UAAU,YAAY,UAAU,IACtE,OAAO,OAAO,uBAAuB,IAAI,IACvC,sBAAsB,IAAI,IAC1B;AACR,QAAM,SAAS,gBAAgB,OAAO,SAAS;AAC/C,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,yBAAqB,OAAO,WAAW,EAAE,QAAQ,UAAU,CAAC;AAC5D,WAAO;AAAA,EACT;AACA,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,CAAC,OAAO,OAAO,SAAS,GAAG,GAAG;AAChC,WAAK,GAAG,IAAI;AACZ;AAAA,IACF;AACA,QAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,GAAG,EAAE,SAAS,KAAK;AAC3D,YAAM,IAAI,gBAAgB,KAAK,6BAA6B;AAAA,EAChE;AACA,uBAAqB,MAAM,WAAW,EAAE,QAAQ,WAAW,OAAO,CAAC;AACnE,SAAO;AACT;AAOO,IAAM,uBAA4C,oBAAI,IAAI;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,2BAAgD,oBAAI,IAAI;AAAA,EACnE;AACF,CAAC;AAGM,IAAM,kBAAkB;AAGxB,IAAM,0BAAN,cAAsC,gBAAgB;AAAA,EAC3D,YACE,QACA,MACgB,QAChB;AACA,UAAM,QAAQ,IAAI;AAFF;AAAA,EAGlB;AACF;AAEO,SAAS,kBACd,WACoB;AACpB,MAAI,UAAU,kBAAmB,QAAO,UAAU;AAClD,SAAO,UAAU,cACb,CAAC,EAAE,IAAI,UAAU,aAAa,MAAM,UAAU,cAAc,CAAC,IAC7D,CAAC;AACP;AAGO,SAAS,aAAa,WAAoC;AAC/D,QAAM,QAAQ,kBAAkB,SAAS,EAAE;AAAA,IACzC,CAAC,SAAS,KAAK,QAAQ,KAAK;AAAA,EAC9B;AACA,SAAO,MAAM,SAAS,KAClB,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,QAAQ,MAAM,SAAS,EAAE,UACzD,MAAM,KAAK,IAAI;AACrB;AAGA,SAAS,YACP,WACA,KACA,OACkB;AAClB,QAAM,UAAU,kBAAkB,SAAS;AAC3C,QAAM,UACJ,OAAO,UAAU,WACb,CAAC,IACD,QAAQ,gBACN,QAAQ,OAAO,CAAC,SAAS,KAAK,OAAO,KAAK,IAC1C,QAAQ,kBACN,QAAQ,OAAO,CAAC,SAAS,KAAK,SAAS,KAAK,IAC5C,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,IACtC,QAAQ,OAAO,CAAC,SAAS,KAAK,OAAO,KAAK,IAC1C,QAAQ,OAAO,CAAC,SAAS,KAAK,SAAS,KAAK;AACxD,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa,KAAK,UAAU,OAAO,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,8CAA8C,aAAa,SAAS,CAAC;AAAA,IAC/H;AAAA,EACF;AACA,SAAO,QAAQ,CAAC;AAClB;AAOO,SAAS,gBACd,MACA,WACA,OAA0B,CAAC,iBAAiB,iBAAiB,aAAa,GAC5C;AAC9B,MAAI;AACJ,MAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AAC5D,eAAW,OAAO,MAAM;AACtB,YAAM,QAAS,KAAiC,GAAG;AACnD,UAAI,UAAU,OAAW;AACzB,YAAM,QAAQ,YAAY,WAAW,KAAK,KAAK;AAC/C,UAAI,UAAU,OAAO,OAAO,MAAM,IAAI;AACpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,UAAU,kBAAkB,SAAS;AAC3C,SAAO,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AACxD;AAGO,SAAS,eAAe,OAAyB;AACtD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAC3B,CAAC,CAAC,KAAK,KAAK,MACT,CAAC,iBAAiB,iBAAiB,aAAa,EAAE,SAAS,GAAG,KAC7D,UAAU,UACZ,eAAe,KAAK;AAAA,EACxB;AACF;AAgBA,SAAS,cACP,OACA,WACA,WACS;AACT,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,UAAU,UAAW,QAAO,UAAU,UAAU,SAAS,KAAK;AAClE,SAAO,aAAa,UAAU,mBAAmB;AACnD;AAMO,SAAS,qBACd,OACA,WACA,UAA2B,CAAC,GACtB;AACN,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,QAAM,EAAE,QAAQ,GAAG,OAAO,IAAI;AAC9B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,QAAQ,SAAS,GAAG,KAAK,CAAC,MAAM,QAAQ,KAAK,EAAG;AACpD,QAAI,QAAQ,iBAAiB,QAAQ,iBAAiB;AACpD,YAAM,SAAS,QAAQ;AACvB,UACE,SACI,WAAW,QAAQ,gBAAgB,OAAO,KAAK,OAAO,QACtD,CAAC,YAAY,WAAW,KAAK,KAAK,GACtC;AACA,cAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,MACrD;AAAA,IACF;AACA,QACE,CAAC,aAAa,QAAQ,EAAE,SAAS,GAAG,KACpC,UAAU,UAAU,GAA6B,GACjD;AACA,YAAM,IAAI,gBAAgB,KAAK,oBAAoB;AAAA,IACrD;AACA,QACE;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,SAAS,GAAG,GACd;AACA,YAAM,IAAI,gBAAgB,KAAK,6BAA6B;AAAA,IAC9D;AACA,QACE,CAAC,YAAY,UAAU,EAAE,SAAS,GAAG,KACrC,CAAC,cAAc,OAAO,WAAW,QAAQ,cAAc,IAAI,GAC3D;AACA,YAAM,IAAI,gBAAgB,KAAK,uBAAuB;AAAA,IACxD;AACA,yBAAqB,OAAO,WAAW,MAAM;AAAA,EAC/C;AACF;;;AChbA,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;AAE1B,SAAS,kBAAkB;AAC3B,SAAS,eAAe;AACxB,SAAS,KAAAA,UAAS;;;ACJlB,SAAS,SAAS;AAcX,SAAS,wBACd,QACA,QACM;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IAGA;AAAA,MACE,MAAM,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,MACjD,gBAAgB,EACb,KAAK,CAAC,cAAc,YAAY,kBAAkB,CAAC,EACnD,SAAS,EACT;AAAA,QACC;AAAA,MACF;AAAA,MACF,gBAAgB,EACb,OAAO,EACP,SAAS,EACT;AAAA,QACC;AAAA,MACF;AAAA,MACF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,0DAA0D;AAAA,MACtE,MAAM,EACH,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAC9B,SAAS,EACT,SAAS,qDAAqD;AAAA,IACnE;AAAA,IACA;AAAA,IACA,OAAO,WAAW;AAChB,UAAI;AACF,cAAM,OAAgC,OAAO,OACzC,EAAE,GAAG,OAAO,KAAK,IACjB;AAAA,UACE,MAAM,OAAO;AAAA,UACb,gBAAgB,OAAO;AAAA,UACvB,gBAAgB,OAAO;AAAA,UACvB,cAAc,OAAO;AAAA,QACvB;AAEJ,cAAM,SAAS,MAAM,OAAO,QAKzB;AAAA,UACD,QAAQ;AAAA,UACR,MAAM;AAAA,UACN;AAAA,UACA,MAAM;AAAA,UACN,iBAAiB,CAAC,iBAAiB;AAAA,QACrC,CAAC;AAED,YAAI,OAAO,OAAO;AAChB,iBAAO;AAAA,YACL,8BAA8B,UAAU,OAAO,KAAK,CAAC;AAAA,UACvD;AAAA,QACF;AAEA,eAAO;AAAA,UACL,cAAc,OAAO,QAAQ,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAK1C;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,kBAAmB,QAAO,IAAI,eAAe;AAChE,eAAO,UAAU,qBAAsB,IAAc,OAAO,EAAE;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AACF;;;AD7CA,IAAM,wBAAwB,IAAI,QAAQ,wBAAwB;AAAA,EAChE,UAAU;AACZ,CAAC;AAGD,IAAM,gBAAgB,IAAI,kBAAiD;AAE3E,IAAM,iBACJ;AAGK,SAAS,eAAe,OAAgC;AAC7D,SAAO;AAAA,IACL,UAAU,MAAM,MAAM,KAAK,MAAM,IAAI;AAAA;AAAA,QAAc,cAAc;AAAA,EACnE;AACF;AAGO,SAAS,WAAW,SAA4B;AACrD,SAAO;AAAA,IACL,mDAAmD,QAAQ,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAGvE;AACF;AAGA,SAAS,cAAc,KAAc,QAAmC;AACtE,QAAM,OAAO,CAAC,UACZ,MAAM,QAAQ,KAAK,IACf,MAAM,OAAO,CAAC,SAAS;AACrB,UAAM,SACJ,QAAQ,OAAO,SAAS,WACnB,OACD,CAAC;AACP,WACE,OAAO,OAAO,OAAO,MACrB,OAAO,QAAQ,OAAO,MACrB,OAAO,OAAO,UACb,OAAO,QAAQ,UACf,OAAO,SAAS,UAChB,OAAO,SAAS,OAAO;AAAA,EAE7B,CAAC,IACD;AACN,MAAI,MAAM,QAAQ,GAAG,EAAG,QAAO,KAAK,GAAG;AACvC,MAAI,OAAO,OAAO,QAAQ,YAAY,UAAU;AAC9C,WAAO,EAAE,GAAG,KAAK,MAAM,KAAM,IAA0B,IAAI,EAAE;AAC/D,SAAO;AACT;AAGA,IAAM,eAAN,cAA2B,gBAAgB;AAAA,EACzC,YACmB,SACA,WACA,YACA,eACjB;AACA,UAAM;AAAA,MACJ,QAAQ;AAAA,MACR,YAAY;AAAA,IACd,CAAC;AARgB;AACA;AACA;AACA;AAAA,EAMnB;AAAA;AAAA,EAES,mBAAmB,QAAsB;AAAA,EAAC;AAAA,EAC1C,WAAoB;AAC3B,WAAO;AAAA,EACT;AAAA,EAEA,MAAe,QAAW,SAAqC;AAC7D,QAAI;AACF,YAAM,OAAO,YAAY,SAAS,GAAG;AACrC,UAAI,CAAC,KAAM,OAAM,IAAI,gBAAgB,KAAK,qBAAqB;AAC/D,oBAAc,MAAM,KAAK,WAAW,KAAK,aAAa;AACtD,YAAM,QAAQ,cAAc,SAAS,GAAG;AAGxC,YAAM,SACJ,SACA,gBAAgB,QAAQ,MAAM,KAAK,WAAW;AAAA,QAC5C;AAAA,QACA;AAAA,MACF,CAAC,KACD,gBAAgB,QAAQ,OAAO,KAAK,WAAW;AAAA,QAC7C;AAAA,QACA;AAAA,MACF,CAAC;AACH,YAAM,YAAY,KAAK,eAAe;AAGtC,YAAM,SACJ,QAAQ,WAAW,UAAU,QAAQ,SAAS,eAC1C,CAAC,MAAM,IACP,QAAQ,WAAW,UACjB,2DAA2D;AAAA,QACzD,QAAQ;AAAA,MACV,IACA,CAAC,OAAO,IACR,QAAQ,WAAW,UACjB,QAAQ,SAAS,4BACjB,CAAC,SAAS,QAAQ,UAAU,UAAU,IACtC,QAAQ,WAAW,UACjB,6CAA6C;AAAA,QAC3C,QAAQ;AAAA,MACV,IACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA;AACZ,2BAAqB,QAAQ,MAAM,KAAK,WAAW;AAAA,QACjD;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,2BAAqB,QAAQ,OAAO,KAAK,WAAW;AAAA,QAClD;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,MAAM,MAAM,KAAK,QAAQ;AAAA,QAC3B,gBAAgB,OAAO;AAAA,QACvB,gBAAgB,KAAK,SAAS;AAAA,QAC9B,KAAK;AAAA,QACL,UAAU,gBAAgB,MAAM;AAAA,MAClC;AAGA,UACE,SACA,QAAQ,WAAW,SACnB,QAAQ,SAAS;AAEjB,cAAM,cAAc,KAAK,KAAK;AAChC,UACE,CAAC,QAAQ,kBACT,OACA,OAAO,QAAQ,YACf,CAAC,MAAM,QAAQ,GAAG,KAClB,UAAU,OACV,IAAI,SAAS,QACb,IAAI,SAAS;AAEb,eAAO,IAAI;AACb,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,iBAAiB,yBAAyB;AAC5C,cAAM,IAAI;AAAA,UACR,MAAM;AAAA,UACN,MAAM;AAAA,UACN,GAAG,MAAM,MAAM,KAAK,MAAM,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,YAAM,SACJ,iBAAiB,kBAAkB,MAAM,SAAS;AAGpD,UAAI,WAAW,OAAO,QAAQ,MAAM;AAClC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,OAAO;AAAA,UACP,GAAG,OAAO,WAAW,qCAAqC,KAAK,OAAO,IAAI;AAAA,UAC1E;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,OAAO,WAAW,KAAK;AAEpC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,OAAO,QAAQ,OAAO,UAAU;AAG7C,cAAM,UACJ,OAAO,YACN,WAAW,MACR,sDACA;AACN,cAAM,IAAI;AAAA,UACR,OAAO;AAAA,UACP,OAAO,QAAQ;AAAA,UACf,OAAO,QAAQ,CAAC,QAAQ,SAAS,OAAO,IAAI,IACxC,GAAG,OAAO,KAAK,OAAO,IAAI,MAC1B;AAAA,UACJ,EAAE,OAAO,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ,EAAE;AAAA,QAC1D;AAAA,MACF;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,WAAW,MACP,sDACA;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,cAAc,MAAc,OAAuB;AAC1D,SAAO,yBAAyB,IAAI,IAAI,IACpC,wDAAwD,KAAK,6DAC7D,kEAAkE,KAAK;AAC7E;AAEA,SAAS,OAAO,WAA4B;AAC1C,QAAM,UAAU,kBAAkB,SAAS;AAC3C,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,QACE,QAAQ;AAAA,QACR,cAAc,UAAU;AAAA,QACxB,WAAW,UAAU;AAAA,QACrB,QAAQ,UAAU;AAAA,QAClB,WAAW,UAAU;AAAA,QACrB,gBACE,UAAU,YAAY,SAAS,QAC3B,wDACA;AAAA,QACN,mBAAmB,QAAQ,IAAI,CAAC,UAAU;AAAA,UACxC,IAAI,KAAK;AAAA,UACT,MAAM,KAAK;AAAA,QACb,EAAE;AAAA,QACF,GAAI,QAAQ,WAAW,IACnB,EAAE,aAAa,QAAQ,CAAC,EAAE,IAAI,eAAe,QAAQ,CAAC,EAAE,KAAK,IAC7D,CAAC;AAAA,QACL,MACE,QAAQ,WAAW,IACf,wCACA,4DAA4D,eAAe,mCAAmC,aAAa,SAAS,CAAC;AAAA,QAC3I,eAAe,UAAU;AAAA,QACzB,QAAQ,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,uBACd,WACA,SACA,YACA,eACW;AACX,QAAM,QAAQ,gBAAgB,SAAS;AACvC,QAAM,YAAY,eAAe;AACjC,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,aAAa,SAAS,mBAAmB;AAAA,IACjD;AAAA,MACE,cACE;AAAA,IAOJ;AAAA,EACF;AAKA,QAAM,WAAW,OAAO,KAAK,KAAK,MAAM;AACxC,SAAO,QAAQ,IAAI,SAAgB;AACjC,UAAM,OAAO,KAAK,CAAC;AACnB,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,KAAK;AAG1B,UAAM,QACJ,OAAO,KAAK,CAAC,MAAM,YACnB,KAAK,CAAC,KACN,OAAO,KAAK,CAAC,MAAM,YACnB,EAAE,kBAAkB,KAAK,CAAC,KACrB,KAAK,CAAC,IACP;AACN,UAAM,cACJ,SACC,CAAC,iBAAiB,aAAa,EAAY;AAAA,MAAK,CAAC,QAChD,OAAO,OAAO,OAAO,GAAG;AAAA,IAC1B;AACF,UAAM,YACJ,UAAU,UACV,CAAC,eACD,CAAC,qBAAqB,IAAI,IAAI,KAC9B,CAAC,OAAO,OAAO,OAAO,eAAe;AACvC,QAAI,SAAS,CAAC,qBAAqB,IAAI,IAAI,GAAG;AAC5C,UAAI,WAAW;AACb,aAAK,CAAC,IAAI;AAAA,UACR,GAAG;AAAA,UACH,CAAC,eAAe,GAAGC,GAChB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,SAAS,EACT;AAAA,YACC,yBAAyB,IAAI,IAAI,IAC7B,yEACA;AAAA,UACN;AAAA,QACJ;AAAA,MACF;AACA,WAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,cAAc,MAAM,YAAY,kBAAkB,WAAY,CAAC;AAAA,IACxF;AACA,SAAK,KAAK,IAAI,UAAU,WAAkB;AACxC,UAAI;AACF,sBAAc,MAAM,OAAO,aAAa;AACxC,cAAM,SAAS;AAAA,UACb;AAAA,UACA,OAAO,CAAC;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,YAAI,SAAS,SAAU,QAAO,OAAO,KAAK;AAC1C,cAAM,QACJ,OAAO,CAAC,KAAK,OAAO,OAAO,CAAC,MAAM,WAC7B,OAAO,CAAC,IACT;AACN,YAAI,OAAO,eAAe;AACxB,iBAAO;AAAA,YACL;AAAA,UACF;AACF,YACE,CAAC,UACD,CAAC,qBAAqB,IAAI,IAAI,KAC9B,CAAC,yBAAyB,IAAI,IAAI,KAClC,CAAC,eAAe,KAAK,GACrB;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,8CAA8C,aAAa,KAAK,CAAC;AAAA,UACnE;AAAA,QACF;AACA,YAAI,OAAO;AAGT,cAAI,UAAW,QAAO,MAAM,eAAe;AAC3C,cAAI,SAAS,QAAQ;AACnB,gBAAI,OAAO,OAAO,OAAO,aAAa;AACpC,oBAAM,cAAc,OAAO;AAC7B,gBACE,OAAO,OAAO,OAAO,eAAe,KACpC,OAAO,SAAS;AAEhB,oBAAM,gBAAgB,OAAO;AAAA,UACjC;AAAA,QACF;AACA,cAAM,SAAS,MAAM,cAAc;AAAA,UAAI,EAAE,OAAO;AAAA,UAAG,MACjD,QAAQ,GAAG,MAAM;AAAA,QACnB;AAGA,YAAI,UAAU,QAAQ,QAAQ,gBAAgB,GAAG;AAC/C,iBAAO;AAAA,YACL,GAAG;AAAA,YACH,OAAO,EAAE,GAAG,OAAO,OAAO,uBAAuB,OAAO;AAAA,UAC1D;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB;AACnB,iBAAO,eAAe,KAAK;AAC7B,eAAO;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,GAAG,IAAI;AAAA,EACzB;AAEA,QAAM,SAAS,IAAI,aAAa,SAAS,OAAO,YAAY,aAAa;AACzE,kBAAgB,MAAM;AACtB,mBAAiB,QAAQ,MAAM;AAC/B,MAAI,eAAe,MAAM,UAAU,eAAe,MAAM,QAAQ;AAC9D,sBAAkB,QAAQ,QAAQ,aAAa;AAC/C,sBAAkB,QAAQ,MAAM;AAChC,2BAAuB,QAAQ,QAAQ,aAAa;AAAA,EACtD;AAEA,0BAAwB,QAAQ,MAAM;AACtC,uBAAqB,MAAM;AAC3B,qBAAmB,MAAM;AAEzB,oBAAkB,QAAQ,MAAM;AAChC,aAAW,QAAQ,uBAAuB,EAAE,YAAY,MAAM,KAAK,CAAC;AACpE,SAAO;AACT;;;AFtaA,IAAM,cAAc,KAAK,UAAU,EAAE,QAAQ,KAAK,CAAC;AAEnD,IAAM,qBAAqB,IAAI,OAAO,OAAO,KAAK;AAGlD,SAAS,WAAW,KAAkC;AACpD,QAAM,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AACtC,SAAO,SAAS;AAClB;AAEA,SAAS,MAAM,KAAqB,QAAgB,MAAqB;AACvE,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B;AAEA,eAAe,SAAS,KAAwC;AAC9D,MAAI,OAAO;AACX,QAAM,SAAmB,CAAC;AAC1B,mBAAiB,SAAS,KAAK;AAC7B,YAAQ,MAAM;AACd,QAAI,OAAO,mBAAoB,OAAM,IAAI,MAAM,gBAAgB;AAC/D,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAC1D;AAEO,SAAS,uBACd,QACA,SACA,MACA;AACA,QAAM,YAAY,IAAI,IAAI,OAAO,SAAS;AAC1C,QAAM,eAAe,wCAAwC,UAAU,aAAa,MAAM,KAAK,UAAU,QAAQ;AACjH,QAAM,cAAc,GAAG,UAAU,MAAM,GAAG,YAAY;AACtD,QAAM,SAAS,qBAAqB,SAAS,OAAO,WAAW,IAAI;AACnE,MAAI,SAAS;AACb,QAAM,iBAAiB,IAAI,mBAAmB;AAE9C,QAAM,SAAS,aAAa,OAAO,KAAK,QAAQ;AAI9C,QAAI,WAAW,IAAI,GAAG,GAAG;AACvB,UAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ;AACjD,YAAI,UAAU,KAAK,EAAE,OAAO,aAAa,iBAAiB,WAAW,CAAC;AACtE,YAAI,IAAI;AACR;AAAA,MACF;AACA,UAAI,UAAU,KAAK;AAAA,QACjB,gBAAgB;AAAA,QAChB,iBAAiB;AAAA,QACjB,kBAAkB,OAAO,WAAW,WAAW;AAAA,MACjD,CAAC;AACD,UAAI,IAAI,IAAI,WAAW,SAAS,SAAY,WAAW;AACvD;AAAA,IACF;AACA,QAAI,UAAU,0BAA0B,SAAS;AACjD,QAAI,OAAO,SAAU,KAAI,UAAU,yBAAyB,MAAM;AAClE,QAAI;AAGF,YAAM,YAAa,OAAO,QAAQ,GAA+B;AACjE,UACE,CAAC;AAAA,QACC,UAAU;AAAA,QACV,aAAa,SAAS;AAAA,QACtB,aAAa,SAAS;AAAA,MACxB,EAAE,SAAS,IAAI,QAAQ,QAAQ,EAAE,GACjC;AACA,cAAM,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;AACzC;AAAA,MACF;AACA,UAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,WAAW,UAAU,QAAQ;AACjE,cAAM,KAAK,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAC3C;AAAA,MACF;AACA,UAAI,IAAI,QAAQ,QAAQ;AACtB,YAAI,UAAU,+BAA+B,UAAU,MAAM;AAC7D,YAAI,UAAU,QAAQ,QAAQ;AAC9B,YAAI;AAAA,UACF;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM;AACpD,UACE,IAAI,WAAW,SACf,CAAC,cAAc,uCAAuC,EAAE;AAAA,QACtD,IAAI;AAAA,MACN,GACA;AACA,cAAM,KAAK,KAAK;AAAA,UACd,UAAU,OAAO;AAAA,UACjB,uBAAuB,CAAC,OAAO,MAAM;AAAA,UACrC,kBAAkB;AAAA,UAClB,0BAA0B,CAAC,QAAQ;AAAA,UACnC,eAAe,OAAO,WAClB,4CACA;AAAA,QACN,CAAC;AACD;AAAA,MACF;AACA,UAAI,IAAI,aAAa,UAAU,UAAU;AACvC,cAAM,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACtC;AAAA,MACF;AACA,UAAI,IAAI,QAAQ;AACd,cAAM,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAC3D;AAAA,MACF;AACA,UAAI,IAAI,WAAW,WAAW;AAC5B,YAAI;AAAA,UACF;AAAA,UACA;AAAA,QACF;AACA,YAAI;AAAA,UACF;AAAA,UACA;AAAA,QACF;AACA,YAAI,UAAU,GAAG;AACjB,YAAI,IAAI;AACR;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,WAAW;AAAA,QAChC,CAAC,GAAG,MACF,IAAI,MAAM,KAAK,IAAI,WAAW,CAAC,EAAE,YAAY,MAAM;AAAA,MACvD;AACA,YAAM,QAAQ,qBAAqB,KAAK,IAAI,QAAQ,iBAAiB,EAAE;AACvE,UAAI,WAAW,WAAW,KAAK,CAAC;AAC9B,cAAM,IAAI,gBAAgB,KAAK,eAAe;AAChD,YAAM,YAAY,MAAM,OAAO,MAAM,CAAC,CAAC;AACvC,UAAI,IAAI,WAAW,QAAQ;AACzB,YAAI,UAAU,SAAS,eAAe;AACtC,cAAM,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAC/C;AAAA,MACF;AACA,UACE,CAAC,IAAI,QAAQ,cAAc,GACvB,YAAY,EACb,WAAW,kBAAkB,GAChC;AACA,cAAM,KAAK,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACnD;AAAA,MACF;AACA,UAAI,UAAU,IAAI;AAChB,cAAM,KAAK,KAAK,EAAE,OAAO,cAAc,CAAC;AACxC;AAAA,MACF;AACA;AACA,UAAI;AACJ,UAAI;AACF,eAAO,MAAM,SAAS,GAAG;AAAA,MAC3B,QAAQ;AACN;AACA,cAAM,KAAK,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAC5C;AAAA,MACF;AACA,UAAI;AAGF,YAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,gBAAM,KAAK,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAChD;AAAA,QACF;AAEA,cAAM,aAAa,MAAM,CAAC,EAAE,WAAW,MAAM,IACzC,SACA,QAAQ,WAAW,MAAM,CAAC,GAAG,SAAS;AAG1C,YAAI,gBAA+B,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE;AAC1D,YAAI;AACJ,YAAI,QAAQ,kBAAkB;AAC5B,gBAAM,OAAO,MAAM,eAAe;AAAA,YAChC,GAAG,UAAU,SAAS,IAAI,UAAU,MAAM,IAAI,UAAU,cAAc;AAAA,YACtE,YAAY;AACV,kBAAI;AACJ,kBAAI;AACF,sBAAM,MAAM,QAAQ,iBAAkB,WAAW,UAAU;AAAA,cAC7D,SAAS,OAAO;AACd,oBAAI,iBAAiB,iBAAiB;AACpC,sBAAI,MAAM,QAAQ,WAAW;AAC3B,0BAAM,IAAI,iBAAiB,MAAM,YAAY;AAE/C,sBAAI,MAAM,WAAW,IAAK,QAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,gBAC1D;AACA,sBAAM;AAAA,cACR;AACA,kBAAI;AACF,uBAAO,mBAAmB,GAAG;AAAA,cAC/B,QAAQ;AAEN,uBAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,cAChC;AAAA,YACF;AAAA,UACF;AACA,0BAAgB,KAAK;AACrB,cAAI,KAAK,SAAU,uBAAsB,KAAK;AAAA,QAChD;AACA,YACE,MAAM,WAAW,gBACjB,OAAO,KAAK,QAAQ,SAAS,UAC7B;AACA,cAAI;AACF,0BAAc,KAAK,OAAO,MAAM,WAAW,aAAa;AACxD;AAAA,cACE,KAAK,OAAO;AAAA,cACZ,KAAK,OAAO;AAAA,cACZ;AAAA,cACA,eAAe;AAAA,cACf;AAAA,YACF;AAAA,UACF,SAAS,OAAO;AAGd,gBAAI,iBAAiB,yBAAyB;AAC5C,oBAAM,KAAK,KAAK;AAAA,gBACd,SAAS;AAAA,gBACT,IAAI,KAAK,MAAM;AAAA,gBACf,QAAQ,eAAe,KAAK;AAAA,cAC9B,CAAC;AACD;AAAA,YACF;AAIA,gBACE,iBAAiB,mBACjB,MAAM,SAAS,sBACf;AACA,oBAAM,UAAU;AAAA,gBACd,KAAK,OAAO;AAAA,gBACZ;AAAA,cACF,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC;AACrD,oBAAM,KAAK,KAAK;AAAA,gBACd,SAAS;AAAA,gBACT,IAAI,KAAK,MAAM;AAAA,gBACf,QAAQ,WAAW,OAAO;AAAA,cAC5B,CAAC;AACD;AAAA,YACF;AAGA,gBACE,wBAAwB,UACxB,iBAAiB,mBACjB,MAAM,SAAS,uBACf;AACA,oBAAM,KAAK,KAAK;AAAA,gBACd,SAAS;AAAA,gBACT,IAAI,KAAK,MAAM;AAAA,gBACf,QAAQ;AAAA,kBACN,0HAA0H,mBAAmB;AAAA,gBAC/I;AAAA,cACF,CAAC;AACD;AAAA,YACF;AACA,kBAAM;AAAA,UACR;AAAA,QACF;AACA,cAAM,MAAM;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF;AACA,cAAM,YAAY,IAAI,8BAA8B;AAAA,UAClD,oBAAoB;AAAA,UACpB,oBAAoB;AAAA,QACtB,CAAC;AACD,YAAI,SAAS;AACb,cAAM,QAAQ,MAAM;AAClB,cAAI,CAAC,QAAQ;AACX,qBAAS;AACT,iBAAK,IAAI,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,KAAK,SAAS,KAAK;AACvB,YAAI;AACF,gBAAM,IAAI,QAAQ,SAAS;AAC3B,gBAAM,UAAU,cAAc,KAAK,KAAK,IAAI;AAAA,QAC9C,UAAE;AACA,cAAI,IAAI,cAAe,OAAM;AAAA,QAC/B;AAAA,MACF,UAAE;AACA;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,IAAI,aAAa;AACnB,YAAI,IAAI;AACR;AAAA,MACF;AACA,YAAM,SAAS,iBAAiB,kBAAkB,MAAM,SAAS;AACjE,UAAI,WAAW;AACb,YAAI;AAAA,UACF;AAAA,UACA,oDAAoD,WAAW;AAAA,QACjE;AACF,YAAM,KAAK,QAAQ;AAAA,QACjB,OACE,iBAAiB,kBACb,MAAM,OACN;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO,iBAAiB;AACxB,SAAO,iBAAiB;AACxB,SAAO,mBAAmB;AAC1B,SAAO;AACT;;;AIrVA,SAAS,KAAAC,UAAS;AAgBlB,IAAM,aAAa,wBAAwB,kBAAkB;AAC7D,IAAM,qBAAqB;AAE3B,IAAM,oBAAoB,oBAAI,IAAI,CAAC,iBAAiB,CAAC;AAE9C,IAAM,mBAAmB;AAKhC,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,SAAS,YACP,QACA,MACA,QACmB;AACnB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,OAAO;AAAA,EAClB;AACA,QAAM,WAAW,eAAe,MAAM;AAGtC,QAAM,QAAQ,aAAa,MAAM;AACjC,QAAM,OAAO,SAAS,SAAS,QAAQ,2BAA2B;AAClE,QAAM,UAAU,SAAS,WAAW;AACpC,QAAM,QAAQ,CAAC,OAA2B,QAAgB;AACxD,QAAI,CAAC,MAAO,QAAO;AAEnB,QAAI,MAAM,MAAM,QAAQ,2BAA2B,GAAG,EAAE,KAAK;AAC7D,QAAI,OAAQ,OAAM,IAAI,MAAM,MAAM,EAAE,KAAK,YAAY;AACrD,WAAO,IAAI,MAAM,GAAG,GAAG,KAAK;AAAA,EAC9B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ,0BAA0B,KAAK,IAAI,IAAI,OAAO;AAAA,IAC5D,SAAS,MAAM,SAAS,IAAI;AAAA,EAC9B;AACF;AAGA,SAAS,aAAa,MAAmC;AACvD,QAAM,WAAY,MAA4C;AAC9D,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,QAAQ,SAAS,QAAQ,CAAC,YAAY;AAC1C,UAAM,EAAE,IAAI,IAAI,SAAS,IAAK,WAAW,CAAC;AAK1C,QAAI,OAAO,SAAS,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtD,UAAM,QAAQ,SAAS,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACvE,WAAO,MAAM,SACT,CAAC,QAAQ,OAAO,OAAO,WAAW,KAAK,GAAG,KAAK,MAAM,KAAK,GAAG,CAAC,EAAE,IAChE,CAAC;AAAA,EACP,CAAC;AACD,SAAO,MAAM,SACT,gCAAgC,MAAM,KAAK,GAAG,CAAC,KAC/C;AACN;AAGO,SAAS,sBAAsB,QAAqC;AACzE,QAAM,SAAS,IAAI,IAAI,OAAO,MAAM;AACpC,MACE,OAAO,aAAa,YACpB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,MACP;AACA,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,QAAM,WAAW,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,EAAE;AAClE,QAAM,YAAY,IAAI,IAAI,OAAO,EAAE;AACnC,QAAM,WAAW,GAAG,OAAO;AAC3B,QAAM,eAAe,IAAI,IAAI,OAAO,SAAS,EAAE;AAE/C,QAAM,UAAU,oBAAI,QAAkC;AACtD,QAAM,iBAAiB,gBACpB,OAAO,EAAE,QAAQC,GAAE,QAAQ,OAAO,MAAM,EAAE,CAAC,EAC3C,MAAM;AACT,QAAM,UAAyB;AAAA,IAC7B,MAAM,YAAY,OAAO,UAAU;AACjC,UAAI;AAIF,cAAM,WAAW,MAAM,MAAM,UAAU;AAAA,UACrC,SAAS;AAAA,YACP,eAAe,UAAU,KAAK;AAAA,YAC9B,QAAQ;AAAA,UACV;AAAA,UACA,UAAU;AAAA,UACV,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC,CAAC;AACD,YAAI,CAAC,SAAS,IAAI;AAChB,cAAI,SAAS,WAAW,OAAO,SAAS,UAAU;AAChD,kBAAM,IAAI,gBAAgB,KAAK,yBAAyB;AAC1D,gBAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,QAChD;AACA,cAAM,EAAE,QAAQ,SAAS,GAAG,UAAU,IAAI,eAAe;AAAA,UACvD,MAAM,SAAS,KAAK;AAAA,QACtB;AACA,YACE,UAAU,aAAa,YACvB,UAAU,mBAAmB;AAE7B,gBAAM,IAAI,gBAAgB,KAAK,eAAe;AAChD,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,iBAAiB,gBAAiB,OAAM;AAC5C,cAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,kBAAkB;AACtB,YAAM,IAAI,gBAAgB,KAAK,iCAAiC;AAAA,IAClE;AAAA,IACA,SAAS,OAAO;AACd,YAAM,SAA2B,OAAO,OAAO;AAAA,QAC7C,MAAM;AAAA,MACR,CAAC;AACD,cAAQ,IAAI,QAAQ,KAAK;AACzB,aAAO;AAAA,IACT;AAAA,IACA,MAAM,eAAe,SAAS,WAAW,YAAY,WAAW;AAK9D,YAAM,SAAS,aAAa,QAAQ,IAAI,UAAU,IAAI;AACtD,UAAI,QAAQ,SAAS,UAAU,CAAC;AAC9B,cAAM,IAAI,gBAAgB,KAAK,oCAAoC;AACrE,UAAI,QAAQ,SAAS,UAAU,CAAC,QAAQ;AACtC,cAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACtD,UAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,QAAQ,KAAK,WAAW,IAAI;AAC/D,cAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACtD,YAAM,MAAM,IAAI,IAAI,GAAG,OAAO,GAAG,QAAQ,IAAI,EAAE;AAC/C,UAAI,IAAI,WAAW;AACjB,cAAM,IAAI,gBAAgB,KAAK,qBAAqB;AACtD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC;AAC3D,YAAI,aAAa,IAAI,KAAK,KAAK;AACjC,YAAM,UAAkC;AAAA,QACtC,QAAQ;AAAA,QACR,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,sBAAsB;AAAA,MACxB;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AAChE,YAAI,kBAAkB,IAAI,IAAI,YAAY,CAAC,EAAG,SAAQ,GAAG,IAAI;AAAA,MAC/D;AACA,YAAM,OAAO,YAAY,SAAS;AAClC,UAAI,MAAM;AACR,gBAAQ,sBAAsB,IAAI,KAAK;AACvC,gBAAQ,+BAA+B,IAAI,KAAK;AAChD,gBAAQ,iCAAiC,IAAI,KAAK;AAClD,gBAAQ,4BAA4B,IAAI,KAAK;AAAA,MAC/C;AACA,UAAI,QAAQ,SAAS,QAAQ;AAC3B,gBAAQ,gBAAgB,IAAI,QAAQ;AACpC,gBAAQ,SAAS;AAAA,MACnB,OAAO;AACL,gBAAQ,gBAAgB,UAAU,MAAM;AAGxC,YAAI,WAAW;AACb,cACE,CAAC,UAAU,mBAAmB;AAAA,YAC5B,CAAC,SAAS,KAAK,OAAO,UAAU;AAAA,UAClC,KACA,UAAU,gBAAgB,UAAU;AAEpC,kBAAM,IAAI,gBAAgB,KAAK,oBAAoB;AACrD,kBAAQ,gBAAgB,IAAI,UAAU;AAAA,QACxC;AAAA,MACF;AACA,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC,QAAQ,QAAQ;AAAA,QAChB;AAAA,QACA,UAAU;AAAA,QACV,MACE,QAAQ,SAAS,SAAY,SAAY,KAAK,UAAU,QAAQ,IAAI;AAAA,QACtE,QAAQ,YAAY,QAAQ,QAAQ,aAAa,kBAAkB;AAAA,MACrE,CAAC;AACD,YAAM,OACJ,QAAQ,mBAAmB,cAAc,SAAS,KAC9C,MAAM,eAAe,QAAQ,IAC7B,MAAM,SAAS,KAAK;AAC1B,UAAI,CAAC,SAAS,IAAI;AAIhB,cAAM,YACJ,SAAS,WAAW,MAAM,YAAY,KAAK,MAAM,MAAM,IAAI;AAC7D,YAAI,WAAW,QAAQ,cAAc,IAAI,UAAU,IAAI,GAAG;AACxD,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,YACA,UAAU,SAAS,wBACjB,QAAQ,SAAS,+BACf;AAAA,cACE,GAAG;AAAA,cACH,SACE;AAAA,YACJ,IACA;AAAA,UACN;AAAA,QACF;AACA,cAAM,SACJ,SAAS,WAAW,QACnB,QAAQ,mBAAmB,gBAC1B,QAAQ,mBAAmB,cACzB,MACA,SAAS,WAAW,MAClB,MACA,SAAS,UAAU,MACjB,MACA,SAAS,WAAW,OAAO,SAAS,WAAW,MAC7C,MACA;AACZ,cAAM,SACJ,WAAW,OAAO,WAAW,OAAO,SAAS,WAAW,MACpD,SACA,YAAY,SAAS,QAAQ,MAAM,MAAM;AAC/C,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS,WAAW,MAChB,gBAAgB,SAAS,QAAQ,IAAI,aAAa,CAAC,IACnD;AAAA,QACN;AAAA,MACF;AACA,UAAI;AACF,eAAO,QAAQ,mBAAmB,eAC9B,kBAAkB,IAAI,IACtB,QAAQ,mBAAmB,aACzB,gBAAgB,IAAI,IACpB,OACE,KAAK,MAAM,IAAI,IACf;AAAA,MACV,QAAQ;AACN,cAAM,IAAI,gBAAgB,KAAK,4BAA4B;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AACA,UAAQ,mBAAmB,CAAC,WAAW,eACrC,QAAQ;AAAA,IACN,EAAE,QAAQ,OAAO,MAAM,yBAAyB,MAAM,UAAU;AAAA,IAChE;AAAA,IACA;AAAA,EACF;AACF,SAAO;AACT;;;AN/QA,eAAsB,cAA6B;AACjD,QAAM,SAAS,iBAAiB;AAChC,MAAI;AACJ,MAAI,OAAO,UAAU;AACnB,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,QAAQ,CAAC,WAAW,IAAI;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,yBAAgB;AAC/D,cAAU,sBAAsB,IAAI;AAAA,EACtC,OAAO;AACL,UAAM,OAAO,QAAQ,IAAI;AACzB,QAAI,CAAC,MAAM;AACT,gBAAU,sBAAsB,MAAM;AACtC,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AAAA,IACF,OAAO;AACL,UAAI,CAAC,WAAW,IAAI;AAClB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AACF,UAAI;AACF,mBAAW,MAAM,OAAO,cAAc,IAAI,EAAE,OAAO;AAAA,MACrD,QAAQ;AACN,cAAM,IAAI,MAAM,4CAA4C;AAAA,MAC9D;AAAA,IACF;AACA,QACE,CAAC,WACD,CAAC,eAAe,mBAAmB,gBAAgB,EAAE;AAAA,MACnD,CAAC,QAAQ,OAAO,QAAQ,GAA0B,MAAM;AAAA,IAC1D;AAEA,YAAM,IAAI,MAAM,iCAAiC;AAAA,EACrD;AACA,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,WAAW,CAAC,WAAW,OAAO;AAChC,UAAM,IAAI,MAAM,4CAA4C;AAC9D,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA,UAAU,IAAI,aAAa,OAAO,IAAI;AAAA,EACxC;AACA,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,OAAO,MAAM,OAAO,MAAM,OAAO;AAAA,EACjD,CAAC;AACD,UAAQ,OAAO;AAAA,IACb,oCAAoC,OAAO,IAAI,IAAI,OAAO,IAAI,OAAO,OAAO,WAAW,qEAAgE,EAAE;AAAA;AAAA,EAC3J;AACA,QAAM,WAAW,MAAM;AACrB,WAAO,MAAM,MAAM,QAAQ,KAAK,CAAC,CAAC;AAClC,eAAW,MAAM;AACf,aAAO,oBAAoB;AAC3B,cAAQ,KAAK,CAAC;AAAA,IAChB,GAAG,GAAI,EAAE,MAAM;AAAA,EACjB;AACA,UAAQ,KAAK,UAAU,QAAQ;AAC/B,UAAQ,KAAK,WAAW,QAAQ;AAClC;","names":["z","z","z","z"]}

package/dist/{test-only-LJGOY2QA.js → test-only-VH3FF5ML.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 import {
   FilePatStore,
-  HostedAuthError,
   hashCredential
-} from "./chunk-X44C5GW2.js";
+} from "./chunk-MUZ3KEJX.js";
+import {
+  HostedAuthError
+} from "./chunk-3AH56XX7.js";
 
 // src/hosted/test-only.ts
 function createTestOnlyAdapter(path) {
@@ -21,12 +23,16 @@ function createTestOnlyAdapter(path) {
     },
     async executeRequest(options, principal) {
       if (options.method === "GET" && options.path === "/api/v2/workspace") {
-        const granted = principal.grantedWorkspaces ?? [{ id: principal.workspaceId, name: principal.workspaceName }];
-        return { data: granted.map((item) => ({
-          id: item.id,
-          name: item.name,
-          datamart: { name: "TEST ONLY \u2014 synthetic fixture, no live data" }
-        })) };
+        const granted = principal.grantedWorkspaces ?? [
+          { id: principal.workspaceId, name: principal.workspaceName }
+        ];
+        return {
+          data: granted.map((item) => ({
+            id: item.id,
+            name: item.name,
+            datamart: { name: "TEST ONLY \u2014 synthetic fixture, no live data" }
+          }))
+        };
       }
       throw new HostedAuthError(503, "test_fixture_operation_unavailable");
     }
@@ -35,4 +41,4 @@ function createTestOnlyAdapter(path) {
 export {
   createTestOnlyAdapter
 };
-//# sourceMappingURL=test-only-LJGOY2QA.js.map
+//# sourceMappingURL=test-only-VH3FF5ML.js.map

package/dist/test-only-VH3FF5ML.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hosted/test-only.ts"],"sourcesContent":["import { FilePatStore, hashCredential } from './auth.js';\nimport type { HostedAdapter } from './types.js';\nimport { HostedAuthError } from './types.js';\n\n/** Explicit fixture harness. No login, consent, token issuer, real membership or live data. */\nexport function createTestOnlyAdapter(path: string): HostedAdapter {\n  const fixtures = new FilePatStore(path);\n  return {\n    async verifyOAuth(token, resource) {\n      const record = await fixtures.findByHash(hashCredential(token));\n      if (\n        !record ||\n        record.revokedAt !== null ||\n        record.principal.resource !== resource\n      ) {\n        throw new HostedAuthError(401, 'invalid_token');\n      }\n      return record.principal;\n    },\n    async resolvePatGrant(principal) {\n      return principal;\n    },\n    async executeRequest(options, principal) {\n      if (options.method === 'GET' && options.path === '/api/v2/workspace') {\n        const granted = principal.grantedWorkspaces ?? [\n          { id: principal.workspaceId!, name: principal.workspaceName },\n        ];\n        return {\n          data: granted.map((item) => ({\n            id: item.id,\n            name: item.name,\n            datamart: { name: 'TEST ONLY — synthetic fixture, no live data' },\n          })),\n        };\n      }\n      throw new HostedAuthError(503, 'test_fixture_operation_unavailable');\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;AAKO,SAAS,sBAAsB,MAA6B;AACjE,QAAM,WAAW,IAAI,aAAa,IAAI;AACtC,SAAO;AAAA,IACL,MAAM,YAAY,OAAO,UAAU;AACjC,YAAM,SAAS,MAAM,SAAS,WAAW,eAAe,KAAK,CAAC;AAC9D,UACE,CAAC,UACD,OAAO,cAAc,QACrB,OAAO,UAAU,aAAa,UAC9B;AACA,cAAM,IAAI,gBAAgB,KAAK,eAAe;AAAA,MAChD;AACA,aAAO,OAAO;AAAA,IAChB;AAAA,IACA,MAAM,gBAAgB,WAAW;AAC/B,aAAO;AAAA,IACT;AAAA,IACA,MAAM,eAAe,SAAS,WAAW;AACvC,UAAI,QAAQ,WAAW,SAAS,QAAQ,SAAS,qBAAqB;AACpE,cAAM,UAAU,UAAU,qBAAqB;AAAA,UAC7C,EAAE,IAAI,UAAU,aAAc,MAAM,UAAU,cAAc;AAAA,QAC9D;AACA,eAAO;AAAA,UACL,MAAM,QAAQ,IAAI,CAAC,UAAU;AAAA,YAC3B,IAAI,KAAK;AAAA,YACT,MAAM,KAAK;AAAA,YACX,UAAU,EAAE,MAAM,mDAA8C;AAAA,UAClE,EAAE;AAAA,QACJ;AAAA,MACF;AACA,YAAM,IAAI,gBAAgB,KAAK,oCAAoC;AAAA,IACrE;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@databrainhq/mcp-server",
   "mcpName": "com.usedatabrain/mcp-server",
-  "version": "0.3.0-rc.13",
+  "version": "0.3.0-rc.15",
+  "packageManager": "pnpm@12.3.4",
   "description": "MCP server for Databrain embedded analytics - connect databases, create datamarts, configure embeds, and generate frontend code",
   "type": "module",
   "bin": {
@@ -19,13 +20,16 @@
     ".mcp.json"
   ],
   "scripts": {
-    "build": "tsup && node scripts/copy-custom-chart-assets.mjs",
+    "build": "tsup && node scripts/build-declarations.mjs && node scripts/copy-custom-chart-assets.mjs",
     "dev": "tsx src/index.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:live": "vitest run tests/integration/prompt-flows.test.ts",
-    "lint": "tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "lint": "biome check .",
+    "lint:fix": "biome check --write .",
+    "format": "biome format --write .",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "pnpm run build"
   },
   "keywords": [
     "mcp",
@@ -40,16 +44,23 @@
     "@posthog/mcp": "^0.10.7",
     "esbuild": "0.27.3",
     "fflate": "0.8.3",
-    "posthog-node": "^5.21.2",
+    "posthog-node": "5.60.1",
     "yaml": "^2.9.1",
-    "zod": "^3.24.0"
+    "zod": "^4.1.12"
   },
   "devDependencies": {
+    "@biomejs/biome": "2.5.15",
+    "@microsoft/api-extractor": "7.59.4",
     "@types/node": "^25.3.5",
     "tsup": "^8.4.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "typescript": "7.0.2",
+    "vitest": "^4.1.12"
+  },
+  "overrides": {
+    "@posthog/core": "1.61.2",
+    "@posthog/types": "1.418.0",
+    "rollup": "4.66.0"
   },
   "publishConfig": {
     "access": "public"
@@ -59,6 +70,6 @@
     "url": "git+https://github.com/databrainhq/mcp-server.git"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   }
 }

package/dist/chunk-233VGFHY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/apps/custom-chart-assets.ts","../src/apps/registry.ts","../src/apps/backend.ts","../src/apps/tile.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { CustomChartsApi } from '../api/custom-charts-api.js';\nimport { contentHash, validateBundle } from '../custom-chart/bundle.js';\nimport { READ_ONLY } from '../tools/annotations.js';\nimport { appMeta } from './feature.js';\nimport { bounded, MAX_CUSTOM_BUNDLE_CHARS, CUSTOM_BUNDLE_CHUNK_CHARS } from './contract.js';\nimport { readCustomChartBrowserRuntime } from '../custom-chart/assets.js';\n\n// Content-addressed immutable artifacts only. Authorization and the published pointer/hash\n// are fetched live before every cache lookup; no principal or API response is cached.\nconst assets = new Map<string, { text: string; expires: number }>();\n\n/** Chunk large code assets; every chunk rechecks the live published pointer and caller. */\nexport function registerCustomChartAssets(server: McpServer, client: DatabrainClient): void {\n  const runtime = server.tool('load_custom_chart_runtime',\n    'Load the trusted app/embed sandbox adapter for a custom chart tile. App-only; no company data or chart code.',\n    {}, READ_ONLY, async () => bounded({ content: [{ type: 'text' as const, text: 'Custom chart sandbox runtime.' }],\n      _meta: { 'databrain/custom-chart-runtime': readCustomChartBrowserRuntime() } }));\n  runtime.update({ _meta: appMeta(['app']) });\n  const api = new CustomChartsApi(client);\n  const tool = server.tool('load_custom_chart_bundle',\n    'Load one bounded chunk of the company published custom chart bundle for the tile. No draft version, credentials, or query rows.',\n    { key: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), offset: z.number().int().min(0).max(MAX_CUSTOM_BUNDLE_CHARS).default(0),\n      contentHash: z.string().regex(/^[a-f0-9]{64}$/).optional() }, READ_ONLY,\n    async ({ key, offset, contentHash: expected }) => {\n      try {\n        const detail = await api.get(key);\n        if (detail.status !== 'published' || !detail.publishedVersionId) throw new Error('not published');\n        const publishedHash = detail.versions?.find(version => version.id === detail.publishedVersionId)?.contentHash;\n        const cached = publishedHash && /^[a-f0-9]{64}$/.test(publishedHash) ? assets.get(publishedHash) : undefined;\n        let hash = publishedHash, asset = cached && cached.expires > Date.now() ? cached.text : undefined;\n        if (asset === undefined) {\n          const raw = await api.bundle(key, detail.publishedVersionId);\n          const bundle = { ...raw, bundleCss: raw.bundleCss ?? undefined };\n          if (validateBundle(bundle).length || bundle.manifest.id !== key) throw new Error('invalid bundle');\n          hash = contentHash(bundle);\n          if (publishedHash && publishedHash !== hash) throw new Error('published hash mismatch');\n          // Only runtime artifacts cross the bridge; never any API envelope or extra fields.\n          asset = JSON.stringify({ manifest: bundle.manifest, bundleJs: bundle.bundleJs, bundleCss: bundle.bundleCss ?? '', iconSvg: bundle.iconSvg });\n          if (assets.size >= 4) assets.delete(assets.keys().next().value!);\n          assets.set(hash, { text: asset, expires: Date.now() + 60_000 });\n        }\n        if (expected && hash !== expected) throw new Error('published version changed');\n        if (offset > asset.length) throw new Error('offset');\n        const chunk = asset.slice(offset, offset + CUSTOM_BUNDLE_CHUNK_CHARS);\n        return bounded({ content: [{ type: 'text' as const, text: 'Published custom chart asset chunk.' }],\n          structuredContent: { key, contentHash: hash, offset, chunk,\n            nextOffset: offset + chunk.length < asset.length ? offset + chunk.length : null } });\n      } catch {\n        return { isError: true, content: [{ type: 'text' as const,\n          text: `Could not load published custom:${key}. It may be unpublished, changed, or unavailable to this sign-in.` }] };\n      }\n    });\n  tool.update({ _meta: appMeta(['app']) });\n}\n","import { registerCustomChartAssets } from './custom-chart-assets.js';\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { DatabrainClient } from '../client/databrain-client.js';\nimport { DatabrainApiError } from '../utils/errors.js';\nimport { READ_ONLY } from '../tools/annotations.js';\nimport { toolContext } from '../utils/tool-context.js';\nimport { createChartBackend, type ChartBackend, type ChartAction } from './backend.js';\nimport { APP_MIME, CHART_URI, KPI_URI, dateRangeSchema, pageSchema, referenceSchema, viewSchema } from './contract.js';\nimport { appMeta, chartResult } from './feature.js';\nimport { tileHtml } from './tile.js';\nimport { draftSchema, draftPage, RENDER_TYPES, saveDraftAsDashboard, workspacesForDatamart } from './preview.js';\nimport { rowsSchema } from './contract.js';\nimport { WRITE_CREATE } from '../tools/annotations.js';\nimport { APPLY_TO_PRODUCTION_CONFIRMATION } from '../tools/widgets/production-guards.js';\n\nconst actions: Record<ChartAction, string> = {\n  render_chart: 'Render one authorized chart page as SVG with point metadata. Hosted reads use the signed-in workspace; embed references keep guest scope.',\n  refresh_widget: 'Refresh a chart in the current workspace or guest scope. Revalidates access before returning data.',\n  drill_down: 'Explore a server-issued drill identifier within the current chart and guest scope.',\n  change_date_range: 'Render a chart for an ordered date range within the current workspace or guest scope.',\n};\n\n/** Call after registerAllTools so existing registration policy/instrumentation remains active. */\nexport function registerChartApps(server: McpServer, client: DatabrainClient, backend: ChartBackend = createChartBackend(client)): void {\n  for (const [name, description] of Object.entries(actions)) {\n    const action = name as ChartAction;\n    const tool = server.tool(name, description, {\n      reference: referenceSchema, view: viewSchema.default({}),\n      context: z.string().max(200).optional().describe('Chart interaction context'),\n    }, READ_ONLY, async ({ reference, view }) => {\n      try {\n        if ((action === 'drill_down' && !view.drillId) || (action === 'change_date_range' && !view.dateRange)) throw new Error('Missing view selector');\n        const page = pageSchema.parse(await toolContext.run({ tool: name, category: 'embedding', workflowIntent: 'chart_app', inputMode: 'app' },\n          () => backend.execute(action, reference, view)));\n        // SVG is rendered as an isolated image, never inserted into the HTML DOM.\n        // Reject active/external/animated constructs as a further contract check.\n        if (page.svg && (!/^\\s*<svg\\b/i.test(page.svg) ||\n          /<\\s*(?:script|foreignObject|iframe|image|animate\\w*|set)\\b|<!DOCTYPE|<!ENTITY|\\bon\\w+\\s*=|@(?:import|keyframes)|\\banimation\\s*:|(?:href\\s*=\\s*[\"'](?!#)|url\\s*\\(\\s*[\"']?(?!#))/i.test(page.svg))) {\n          throw new Error('Unsafe SVG');\n        }\n        return chartResult(`${page.kind === 'kpi' ? 'KPI' : 'Chart'} ready. ${page.rows.length} rows in this page.${page.fallback ? ' ' + page.fallback : ''}${page.description ? ' ' + page.description : ''}`,  {\n          ...page, reference, view,\n        });\n      } catch (error) {\n        if (error instanceof DatabrainApiError) return error.toToolResponse();\n        return { isError: true, content: [{ type: 'text' as const,\n          text: 'Chart unavailable. Check dashboard access and the chart renderer integration, then retry.' }] };\n      }\n    });\n    tool.update({ _meta: appMeta(['app']) });\n  }\n  registerMetricTile(server, client, backend);\n  registerDraftTools(server, client);\n  registerCustomChartAssets(server, client);\n  for (const [uri, kind] of [[CHART_URI, 'chart'], [KPI_URI, 'kpi']] as const) {\n    server.resource(`Databrain ${kind} tile`, uri, { mimeType: APP_MIME, description: `Interactive ${kind} using host theme and scoped server tools` }, async () => ({\n      contents: [{ uri, mimeType: APP_MIME, text: tileHtml(kind), _meta: { ui: { prefersBorder: true, csp: { resourceDomains: [\"data:\", \"blob:\"], frameDomains: [\"blob:\"], connectDomains: [] } } } }],\n    }));\n  }\n}\n\n/** The tile's controls over an unsaved answer. `preview_chart` is the \"show as\" row and\n *  is app-only: the model already has ask_question. `save_chart_as_dashboard` is the commit,\n *  visible to both, and gated the way every production write here is gated. */\nfunction registerDraftTools(server: McpServer, client: DatabrainClient): void {\n  const preview = server.tool('preview_chart',\n    'Redraw an unsaved ask_question answer as another chart type, from the rows already on screen. No query runs.',\n    { draft: draftSchema, rows: rowsSchema, chartType: z.enum(RENDER_TYPES),\n      context: z.string().max(200).optional().describe('Chart interaction context') },\n    READ_ONLY, async ({ draft, rows, chartType }) => {\n      try {\n        const page = await draftPage(client, draft, rows, chartType);\n        return chartResult(`${page.kind === 'table' ? 'Table' : 'Chart'} ready as ${chartType}.`, page);\n      } catch {\n        return { isError: true, content: [{ type: 'text' as const, text: 'Chart preview unavailable. Ask the question again to retry.' }] };\n      }\n    });\n  preview.update({ _meta: appMeta(['app']) });\n\n  const save = server.tool('save_chart_as_dashboard',\n    'Save an ask_question answer: creates a workspace metric from its SQL and a new dashboard holding it. ' +\n    `Production write; requires confirm: \"${APPLY_TO_PRODUCTION_CONFIRMATION}\". ` +\n    'A workspaceName is needed when the datamart backs more than one workspace.',\n    { draft: draftSchema, chartType: z.enum(RENDER_TYPES),\n      dashboardTitle: z.string().trim().min(1).max(200),\n      workspaceName: z.string().trim().min(1).max(256).optional(),\n      attemptId: z.string().trim().min(1).max(64).optional()\n        .describe('Identifies one save attempt. Reuse it to retry safely; omit or change it to save again on purpose.'),\n      confirm: z.string().optional(),\n      context: z.string().max(200).optional().describe('Chart interaction context') },\n    WRITE_CREATE, async ({ draft, chartType, dashboardTitle, workspaceName, attemptId, confirm }) => {\n      if (confirm !== APPLY_TO_PRODUCTION_CONFIRMATION) {\n        return { isError: true, content: [{ type: 'text' as const,\n          text: `Saving writes to production. Retry with confirm: \"${APPLY_TO_PRODUCTION_CONFIRMATION}\".` }] };\n      }\n      // The draft's workspace list is a hint for the tile. The caller wrote it, so the\n      // set a save may target is recomputed here from the datamart, on the server's own credential.\n      const choices = await workspacesForDatamart(client, draft.datamartName, 'authorize');\n      const refuse = (text: string) => ({ isError: true, content: [{ type: 'text' as const, text }],\n        structuredContent: { kind: 'save', ok: false, choices } });\n      // A named workspace must be one the draft's datamart can serve, spelled the draft's way.\n      const target = workspaceName\n        ? choices.find(w => w.trim().toLowerCase() === workspaceName.toLowerCase())\n        : choices.length === 1 ? choices[0] : undefined;\n      if (workspaceName && !target) {\n        return refuse(`Workspace \"${workspaceName}\" cannot run this datamart's SQL. Choose one of: ${choices.join(', ')}.`);\n      }\n      if (!target) {\n        return refuse(choices.length\n          ? `Choose a workspace: ${choices.join(', ')}.`\n          : `No workspace is built on datamart \"${draft.datamartName}\". Create one in Databrain, then save again.`);\n      }\n      try {\n        const saved = await saveDraftAsDashboard(client, draft, { chartType, dashboardTitle, workspaceName: target, attemptId });\n        return chartResult(`Saved \"${saved.title}\" to workspace ${saved.workspaceName} (dashboard ${saved.dashboardId}, metric ${saved.metricId}).`,\n          { kind: 'save', ok: true, ...saved, draft: { ...draft, chartType } });\n      } catch (error) {\n        const code = error instanceof DatabrainApiError ? error.code : 'SAVE_FAILED';\n        return { isError: true, content: [{ type: 'text' as const,\n          text: `Could not save (${code}). Check the workspace name and your access, then try again.` }],\n          structuredContent: { kind: 'save', ok: false, code } };\n      }\n    });\n  save.update({ _meta: appMeta(['model', 'app']) });\n}\n\n/** Model entry point for stored metrics; controls reuse the exact same reference and grant. */\nfunction registerMetricTile(server: McpServer, client: DatabrainClient, backend: ChartBackend): void {\n  const tool = server.tool('render_metric_tile',\n    'Render an existing workspace metric without an embed, data app or datamart. Use metricRef from get_dashboard. ' +\n    'Client-scoped metrics require their saved clientId. KPI shows the saved scalar, or the sum of one numeric chart series.',\n    { workspaceName: z.string().min(1).optional(), workspaceId: z.string().min(1).optional(),\n      metricId: z.string().trim().min(1).max(256), dashboardId: z.string().trim().min(1).max(256).optional(),\n      display: z.enum(['chart', 'kpi']).default('chart'), clientId: z.string().trim().min(1).max(256).optional(),\n      dateRange: dateRangeSchema.optional(), context: z.string().max(200).optional() },\n    READ_ONLY, async ({ workspaceName, workspaceId, metricId, dashboardId, display, clientId, dateRange }) => {\n      try {\n        if (!client.isHosted()) throw new Error('Use the hosted sign-in for workspace metrics. API-key connections retain list_widgets with an embed and clientId.');\n        const resolved = await client.request<{ dashboardId: string; clientId: string | null }>({\n          method: 'POST', path: '/api/v2/workspace/dashboard/widgets', auth: 'service',\n          body: { workspaceName, workspaceId, metricId, ...(dashboardId ? { dashboardId } : {}) },\n        });\n        if (resolved.clientId && clientId !== resolved.clientId) {\n          throw new Error(`CLIENT_REQUIRED: Pass clientId ${JSON.stringify(resolved.clientId)}, saved on this dashboard/workspace. No unscoped fallback is allowed.`);\n        }\n        const reference = { dashboardId: resolved.dashboardId, widgetId: metricId, display,\n          ...(clientId ? { clientId } : {}) };\n        const view = dateRange ? { dateRange } : {};\n        const page = pageSchema.parse(await backend.execute('render_chart', reference, view));\n        if (page.svg && (!/^\\s*<svg\\b/i.test(page.svg) ||\n          /<\\s*(?:script|foreignObject|iframe|image|animate\\w*|set)\\b|<!DOCTYPE|<!ENTITY|\\bon\\w+\\s*=|@(?:import|keyframes)|\\banimation\\s*:|(?:href\\s*=\\s*[\"'](?!#)|url\\s*\\(\\s*[\"']?(?!#))/i.test(page.svg))) throw new Error('Unsafe SVG');\n        return chartResult(`${page.kind === 'kpi' ? 'KPI' : 'Chart'} ready. ${page.rows.length} rows in this page.${page.description ? ' ' + page.description : ''}`, { ...page, reference, view });\n      } catch (error) {\n        if (error instanceof DatabrainApiError) return error.toToolResponse();\n        return { isError: true, content: [{ type: 'text' as const, text: (error as Error).message.startsWith('CLIENT_REQUIRED:') || (error as Error).message.startsWith('Use the hosted sign-in')\n          ? (error as Error).message : 'Chart unavailable. Check metric access and the saved tenant settings, then retry.' }] };\n      }\n    });\n  tool.update({ _meta: appMeta(['model', 'app']) });\n}\n","import { DatabrainClient } from '../client/databrain-client.js';\nimport type { RequestOptions } from '../client/types.js';\nimport { createServiceBundle } from '../services/factory.js';\nimport { pageSchema, referenceSchema, viewSchema, type ChartPage, type ChartReference, type ChartView } from './contract.js';\n\nexport const RENDER_PATH = '/api/v2/dashboard/mcp-chart';\nexport type ChartAction = 'render_chart' | 'refresh_widget' | 'drill_down' | 'change_date_range';\nexport interface ChartBackend {\n  execute(action: ChartAction, reference: ChartReference, view: ChartView): Promise<ChartPage>;\n}\n\nclass UncachedChartClient extends DatabrainClient {\n  constructor(private readonly delegate: DatabrainClient) {\n    super({ apiUrl: delegate.getApiUrl(), demoDomain: delegate.getDemoDomain() });\n  }\n  override request<T>(options: RequestOptions): Promise<T> {\n    return this.delegate.request<T>({ ...options, cacheKey: undefined, cacheTtlMs: undefined });\n  }\n}\n\n/** Proposed backend route; no local renderer, ambient service fallback, or UI credentials. */\nexport function createChartBackend(client: DatabrainClient): ChartBackend {\n  // The general embed lookup caches for five minutes. Authorization must not.\n  const services = createServiceBundle(new UncachedChartClient(client));\n  return {\n    async execute(action, rawReference, rawView) {\n      const reference = referenceSchema.parse(rawReference);\n      const view = viewSchema.parse(rawView);\n      if ('dashboardId' in reference) {\n        if (!client.isHosted()) throw new Error('Hosted sign-in required');\n        return pageSchema.parse(await client.request<unknown>({\n          method: 'POST', path: '/api/v2/workspace/dashboard/chart', auth: 'service',\n          body: { action, dashboardId: reference.dashboardId, widgetId: reference.widgetId,\n            ...(reference.clientId ? { clientId: reference.clientId } : {}),\n            ...(reference.display ? { display: reference.display } : {}), ...view,\n            pageSize: 50, width: 600, height: 320, animation: false },\n          skipDataUnwrap: true,\n        }));\n      }\n      // Every page/refresh/drill re-reads the embed live, so a revoked tenant stops working at once.\n      const app = await services.widgetService.resolveDataAppName(reference.dataAppName, reference.embedId);\n      if (!app.ok) throw new Error('Chart scope unavailable');\n      const scope = await services.widgetService.ensureReadableDashboardScope({\n        embedId: reference.embedId, clientId: reference.clientId, dataAppName: app.value });\n      if (!scope.ok) throw new Error('Chart scope denied');\n      const { token } = await services.guestTokenService.generateToken({\n        clientId: reference.clientId, dataAppName: app.value, allowedEmbeds: [reference.embedId],\n        permissions: { isDisableMetricCreation: true, isEnableManageMetrics: false,\n          isEnableMetricUpdation: false, isEnableArchiveMetrics: false },\n      });\n      if (!token) throw new Error('Guest scope unavailable');\n      const page = await client.request<unknown>({\n        method: 'POST', path: RENDER_PATH, auth: 'none', token,\n        body: { action, embedId: reference.embedId, widgetId: reference.widgetId, ...view,\n          pageSize: 50, width: 600, height: 320, animation: false },\n        skipDataUnwrap: true,\n      });\n      return pageSchema.parse(page);\n    },\n  };\n}\n","import { transformSync } from 'esbuild';\nimport { MAX_CUSTOM_BUNDLE_CHARS, CUSTOM_BUNDLE_CHUNK_CHARS } from './contract.js';\n\n/** No iframe imports. All requests use the host bridge. */\nexport const TILE_SCRIPT = String.raw`(()=>{\nconst $=id=>document.getElementById(id),root=document.documentElement,pending=new Map();\nlet seq=0,origin='*',ready=false,early=[],closed=false,ref=null,view={},next=null,context={},busy=false,revision=0,rawSvg=null,dialect=null,shown=false,draft=null,rows=[],saved=null,attempt='',workspace=null,custom=null,customMode=false;\n/* One lifecycle, two sets of names. Hosts ship either or both, so notifications go out\n   under both and arrive under either. Same order in both rows: result, input, context. */\nconst DASH=['ui/notifications/tool-result','ui/notifications/tool-input','ui/notifications/host-context-changed'],\nSNAKE=['notifications/tools/call/result','notifications/tools/call/input','notifications/host_context/changed'],\nINIT=['ui/notifications/initialized','notifications/initialized'],\nSIZE=['ui/notifications/size-changed','notifications/size_changed'],\nDISPLAY=['ui/request-display-mode','requestDisplayMode'];\nfunction send(message){if(!closed)parent.postMessage({jsonrpc:'2.0',...message},origin)}\nfunction notify(names,params){for(const method of names)send({method,params})}\nfunction rpc(method,params){return new Promise((resolve,reject)=>{const id=++seq;\nconst timer=setTimeout(()=>{pending.delete(id);reject(Error('timeout'))},65000);\npending.set(id,{resolve,reject,timer});send({id,method,params})})}\n/* Try each alias while the host says it never heard of it; any other error stands. */\nasync function ask(names,params){let last;\nfor(const method of names){try{return await rpc(method,params)}catch(error){last=error;if(error.code!==-32601)throw error}}\nthrow last}\n/* Fixed codes only; never log customer rows. */\nfunction trouble(code){send({method:'notifications/error',params:{code}})}\n/* One formatter for rail, table, KPI and answer line. Compact past 10K, grouped past 100,\n   two decimals below; null is an absence, so it prints as a dash and never as 0. */\nfunction fmt(v){if(typeof v!=='number')return v==null||v===''?'\\u2014':String(v);const a=Math.abs(v);\nreturn new Intl.NumberFormat(navigator.language||'en',a>=1e4?{notation:'compact',maximumFractionDigits:1}:a>=100?{maximumFractionDigits:0}:{maximumFractionDigits:2}).format(v)}\nfunction exact(el,v){el.title=typeof v==='number'?String(v):''}\n/* The answer line: what this shows, and the headline value. Gated on carrying a number or\n   a count, so it never renders as a second title or an empty reserved slot. */\nfunction answer(p){if(p.description)return p.description;const bits=[];\nif(p.kind==='dashboard'){const n=p.widgets?.length||0;return n?n+(n===1?' chart':' charts')+' on this dashboard':''}\nconst [dim,measure]=p.columns||[];const pts=(p.points||[]).filter(q=>typeof q.value==='number');\nif(pts.length<2)return '';if(dim&&measure&&!p.draft)bits.push(measure+' by '+dim);\nconst top=pts.reduce((a,b)=>b.value>a.value?b:a);bits.push(top.label.split(' \\u2014 ')[0]+' highest at '+fmt(top.value));return bits.join(' \\u00b7 ')}\nfunction status(text,bad,ok){const s=$('status');s.textContent=text;s.toggleAttribute('data-error',!!bad);s.toggleAttribute('data-ok',!!ok);if(bad)$('plot').dataset.state='off'}\nfunction paint(){const img=$('chart-image');if(!img||!rawSvg)return;\nconst c=getComputedStyle(document.body).color,mix=pc=>'color-mix(in srgb,'+c+' '+pc+'%,transparent)';\nimg.src='data:image/svg+xml,'+encodeURIComponent(rawSvg.replace(/<\\/svg>\\s*$/i,'<style>text{fill:'+mix(72)+'!important}'\n+'[stroke=\"#dbdee4\"],[stroke=\"#f1f1f2\" i]{stroke:'+mix(13)+'!important}[stroke=\"#54555a\"],[stroke=\"#d4d4d8\" i]{stroke:'+mix(30)+'!important}'\n+'</style></svg>'))}\nfunction controls(){document.querySelectorAll('button,input,select').forEach(e=>{e.disabled=busy});\n$('refresh').hidden=!ref;$('next').hidden=!next;$('range').hidden=!ref||customMode;$('plot').toggleAttribute('data-busy',busy);\n$('save').hidden=!draft||!!saved||!$('form').hidden;\n$('expand').hidden=!shown||root.dataset.kind==='dashboard'||!context.availableDisplayModes?.includes('fullscreen');\nroot.toggleAttribute('data-deep',context.displayMode==='fullscreen'||$('expand').hidden)}\nfunction host(change){context={...context,...change};if(change.theme==='dark'||change.theme==='light')root.style.colorScheme=change.theme;\nconst vars=change.styles?.variables||{};for(const [key,value] of Object.entries(vars)){\nif(/^--(?:color-|font-|border-|shadow-)/.test(key)&&typeof value==='string'&&!/url\\s*\\(|@import/i.test(value))root.style.setProperty(key,value)}\nconst face=change.styles?.css?.fonts;if(typeof face==='string'&&face.length<4000&&!/@import|javascript:/i.test(face))$('hostfont').textContent=face;\nconst insets=change.safeAreaInsets;if(insets)for(const edge of ['top','right','bottom','left']){\nconst n=insets[edge];if(Number.isFinite(n))root.style.setProperty('--safe-'+edge,Math.max(0,Math.min(n,200))+'px')}\nroot.dataset.mode=context.displayMode==='fullscreen'?'full':'inline';\n$('expand').textContent=context.displayMode==='fullscreen'?'Back to conversation':'Expand';paint();custom?.update();controls()}\nfunction scope(p,n){const bits=[];\nif(p.kind==='chart'||p.kind==='table')bits.push(p.rowsTotal>n?'first '+n+' of '+p.rowsTotal+' rows':n?(n===1?'1 row':n+' rows'):'No rows in this view');\nif(view.dateRange)bits.push(view.dateRange.from+' to '+view.dateRange.to);\nif(next)bits.push('more pages available');\nif(p.customChart&&n)bits.push('calculations use this page');\n$('scope').textContent=bits.join(' · ')}\nfunction resize(){if(ready)notify(SIZE,{width:document.body.scrollWidth,height:document.body.scrollHeight})}\nfunction table(rows,columns){$('rows').replaceChildren();$('data').hidden=!rows?.length;if(!rows?.length)return;\n$('count').textContent=rows.length===1?'1 row behind this':rows.length+' rows behind this';\nconst t=document.createElement('table');\nconst num=name=>rows.some(r=>typeof r[name]==='number');\nconst header=document.createElement('tr');for(const name of columns){const th=document.createElement('th');th.scope='col';th.textContent=name;if(num(name))th.className='n';header.append(th)}\nconst head=document.createElement('thead');head.append(header);t.append(head);const body=document.createElement('tbody');\nfor(const row of rows.slice(0,50)){const tr=document.createElement('tr');for(const key of columns){const td=document.createElement('td');td.textContent=fmt(row[key]);exact(td,row[key]);if(num(key))td.className='n';tr.append(td)}body.append(tr)}t.append(body);$('rows').append(t)}\nasync function display(mode){try{const answer=await ask(DISPLAY,{mode});\nhost({displayMode:answer.mode||context.displayMode});if(root.dataset.mode==='full'&&!$('data').hidden)$('data').open=true;resize()}\ncatch{status('Expand is unavailable in this host.',1)}}\nfunction wait(){busy=true;if(!$('plot').firstChild)$('plot').dataset.state='wait';status('Loading chart…');controls()}\nasync function call(name,extra={}){if(!ready||!ref||busy)return;run(name,{reference:ref,view:{...view,...extra}})}\n/* The draft tools take the draft and the rows on screen instead of a reference. */\nasync function run(name,args){if(!ready||busy)return;wait();const rev=++revision;\nconst selection=workspace?(name==='save_chart_as_dashboard'?{workspaceName:args.workspaceName||workspace.name}:{workspace:workspace.id}):{};\ntry{const result=await rpc('tools/call',{name,arguments:{...args,...selection,context:'tile'}});\nif(rev===revision)render(result)}catch{if(rev===revision){trouble('tool-call-failed');if(name==='save_chart_as_dashboard'){$('plot').dataset.state='ready';status('Could not save. Try again.',1)}else if(name==='preview_chart'){status('Could not draw that. Pick another type.',1);$('plot').dataset.state='ready'}else stale()}}finally{busy=false;controls()}}\nfunction stale(){if(shown&&$('plot').firstChild){status('Could not refresh. Showing the last chart that loaded. Select Refresh to try again.',1);$('plot').dataset.state='stale'}else status('Could not load the chart. Select Refresh to try again.',1)}\nfunction render(result){busy=false;controls();\nif(result?._meta?.['databrain/workspace'])workspace=result._meta['databrain/workspace'];\nconst sp=result?.structuredContent;if(sp&&sp.kind==='save'){$('plot').dataset.state='ready';if(sp.ok){saved=sp;$('form').hidden=true;status('Saved \"'+sp.title+'\" to workspace '+sp.workspaceName+'.',0,1)}\nelse if(sp.choices?.length){choose(sp.choices);status('Choose a workspace, then save again.',1)}\nelse status((result.content?.[0]?.text)||'Could not save. Try again.',1);controls();resize();return}\nif(result?.isError&&draft&&$('form').hidden===false){$('plot').dataset.state='ready';status((result.content?.[0]?.text)||'Could not save. Try again.',1);controls();return}\nif(result?.isError){trouble('tool-returned-error');\nif(shown&&$('plot').firstChild){stale();controls();return}shown=false;controls();\nstatus(ref?'Chart unavailable. Check your access to this dashboard, then Refresh.'\n:'Chart unavailable. Ask again to retry.',1);return}\nconst p=result?.structuredContent;if(!p||typeof p!=='object'){shown=false;controls();status('No chart data came back for this result.',1);return}\nrevision++;custom?.dispose();custom=null;customMode=!!p.customChart;shown=true;rawSvg=null;$('plot').replaceChildren();$('plot').dataset.state='ready';$('choices').replaceChildren();delete $('rail').dataset.value;\nref=p.reference||null;view=p.view||{};next=p.nextCursor||null;draft=p.draft||null;rows=p.rows||[];saved=null;$('form').hidden=true;\n$('title').textContent=p.title||'Analytics';$('description').textContent=answer(p);root.dataset.kind=p.kind;$('choices').toggleAttribute('data-grid',p.kind==='dashboard');\nif(p.kind==='dashboard'){$('plot').dataset.state='off';\nfor(const item of p.widgets||[]){const b=document.createElement('button');b.textContent=item.name||'Untitled widget';b.onclick=()=>{ref=item.reference;view={};call('render_chart')};$('choices').append(b)}\nstatus(p.widgets?.length?'':'No charts on this dashboard yet. Add one in Databrain.');\n}else if(p.kind==='kpi'){\nconst number=document.createElement('p');number.className='kpi';number.textContent=fmt(p.value);exact(number,p.value);$('plot').append(number);status('');\n}else if(p.customChart){\nif(!rows.length){$('plot').dataset.state='off';status('No rows in this view.');}\nelse{status('Loading custom chart…');const rev=revision;\nconst box=document.createElement('div');box.style.width='100%';$('plot').append(box);\nloadCustom(result,p,box,rev);}\n}else if(p.svg){\nconst box=document.createElement('div');box.className='chart';box.style.aspectRatio=p.width+'/'+p.height;\nconst img=document.createElement('img');img.id='chart-image';rawSvg=p.svg;img.alt=p.title||'Chart';img.onerror=()=>{status('The chart could not be drawn. The rows are below.',1);$('data').open=$('data').toggleAttribute('data-only',true)};box.append(img);\nfor(const point of p.points||[]){const b=document.createElement('button');b.className='point';b.setAttribute('aria-label',point.label+': '+fmt(point.value));b.setAttribute('aria-pressed','false');\nb.style.left=100*point.x/p.width+'%';b.style.top=100*point.y/p.height+'%';b.style.width=100*point.width/p.width+'%';b.style.height=100*point.height/p.height+'%';\nconst hover=()=>{$('vlabel').textContent=point.label;$('vnum').textContent=fmt(point.value);exact($('vnum'),point.value);$('rail').dataset.value='1'};b.onmouseenter=hover;b.onfocus=hover;\nb.onclick=()=>{box.querySelectorAll('.point').forEach(e=>e.setAttribute('aria-pressed','false'));b.setAttribute('aria-pressed','true');hover();\n$('choices').replaceChildren();if(point.drillId){const drill=document.createElement('button');drill.className='primary';drill.textContent='Explore selected data';drill.onclick=()=>call('drill_down',{drillId:point.drillId,cursor:undefined});$('choices').append(drill)}};box.append(b)}$('plot').append(box);\nstatus('');\n}else if(p.kind==='table'){\n// ask_question returns a table by design; calling that a missing chart called success a failure.\n$('plot').dataset.state='off';status('');\n}else{$('plot').dataset.state='off';\nstatus('Nothing to show. Try a wider date range, then Refresh.',1)}\nif(draft&&p.previewTypes?.length){for(const t of p.previewTypes){const b=document.createElement('button');b.textContent=t[0].toUpperCase()+t.slice(1);b.className='chip';b.setAttribute('aria-pressed',String(t===draft.chartType));\nb.onclick=()=>run('preview_chart',{draft,rows,chartType:t});$('choices').append(b)}$('choices').dataset.chips='1'}else delete $('choices').dataset.chips;\nif(p.previewError)status('Cannot draw this as '+(p.draft?.chartType||'a chart')+' ('+p.previewError+'). Showing the rows.',1);\npaint();table(p.rows||[],p.columns||Object.keys(p.rows?.[0]||{}));scope(p,p.rows?.length||0);\nconst only=!p.svg&&!p.customChart&&p.value===undefined&&p.kind!=='dashboard';$('data').open=only;$('data').toggleAttribute('data-only',only);controls();resize()}\nasync function loadCustom(result,p,box,rev){try{\nif(!globalThis.DbnCustomChartRuntime){\nconst runtime=await rpc('tools/call',{name:'load_custom_chart_runtime',arguments:{context:'tile'}});\nif(rev!==revision)return;\nconst code=runtime._meta?.['databrain/custom-chart-runtime'];\nif(runtime.isError||typeof code!=='string'||code.length>64000)throw Error('runtime unavailable');\nconst script=document.createElement('script');script.textContent=code;document.head.append(script);script.remove();\nif(!globalThis.DbnCustomChartRuntime)throw Error('runtime unavailable');\n}\nlet bundle=result._meta?.['databrain/custom-chart-bundle'];\nif(!bundle){let text='',offset=0,hash;\nfor(let chunks=0;chunks<${Math.ceil(MAX_CUSTOM_BUNDLE_CHARS / CUSTOM_BUNDLE_CHUNK_CHARS)};chunks++){\nconst r=await rpc('tools/call',{name:'load_custom_chart_bundle',arguments:{context:'tile',key:p.customChart.key,offset,...(hash?{contentHash:hash}:{})}});\nif(rev!==revision)return;\nif(r.isError)throw Error('unavailable');const part=r.structuredContent;\nif(!part||part.key!==p.customChart.key||part.offset!==offset||typeof part.chunk!=='string'||part.chunk.length>${CUSTOM_BUNDLE_CHUNK_CHARS}||!part.chunk.length)throw Error('invalid chunk');\nif(hash&&hash!==part.contentHash)throw Error('changed');hash=part.contentHash;text+=part.chunk;\nif(text.length>${MAX_CUSTOM_BUNDLE_CHARS})throw Error('too large');if(part.nextOffset===null){bundle=JSON.parse(text);break}\nif(part.nextOffset!==offset+part.chunk.length)throw Error('invalid offset');offset=part.nextOffset;\n}\n}\nif(rev!==revision)return;if(!bundle||bundle.manifest.id!==p.customChart.key)throw Error('invalid bundle');\ncustom=DbnCustomChartRuntime.mount(box,bundle,p.customChart,p.rows||[],message=>{if(rev!==revision)return;status(message,!!message);if(message){$('data').open=true;$('data').setAttribute('data-only','')}resize()});\n}catch{if(rev===revision){status(result._meta?.['databrain/custom-chart-bundle']?'Draft preview could not open. Check the bindings and sandbox support. The rows are below.':'Published custom chart unavailable, or this host cannot open its sandbox. The rows are below.',1);$('data').open=true;$('data').setAttribute('data-only','');resize()}}}\n$('refresh').onclick=()=>call('refresh_widget',{cursor:undefined});$('next').onclick=()=>call('render_chart',{cursor:next});\nfunction choose(names){const w=$('ws');w.replaceChildren();for(const n of names){const o=document.createElement('option');o.value=n;o.textContent=n;w.append(o)}$('wsrow').hidden=names.length<2;$('wsone').textContent=names.length===1?'in workspace '+names[0]:'';$('form').hidden=false;$('dtitle').focus();controls();resize()}\n$('save').onclick=()=>{attempt=crypto.randomUUID();$('dtitle').value=draft?.title||'';choose(draft?.workspaces||[])};\n$('cancel').onclick=()=>{$('form').hidden=true;status('');controls();resize()};\n$('commit').onclick=()=>{const t=$('dtitle').value.trim();if(!t){status('Name the dashboard.',1);return}\nrun('save_chart_as_dashboard',{draft,chartType:draft.chartType,dashboardTitle:t,workspaceName:$('wsrow').hidden?undefined:$('ws').value,attemptId:attempt,confirm:'APPLY_TO_PRODUCTION'})};\n$('expand').onclick=()=>display(context.displayMode==='fullscreen'?'inline':'fullscreen');\n$('dates').onclick=()=>{const from=$('from').value,to=$('to').value;if(!from||!to||from>to){status('Start date must not be after the end date.',1);return}call('change_date_range',{dateRange:{from,to},cursor:undefined,drillId:undefined})};\nfunction receive(event){if(event.source!==parent||closed)return;const m=event.data;\nif(!m||Array.isArray(m)||m.jsonrpc!=='2.0'||(origin!=='*'&&event.origin!==origin))return;\nif(!m.method&&pending.has(m.id)&&('result'in m||'error'in m)){if(origin==='*'&&event.origin!=='null')origin=event.origin;\nconst p=pending.get(m.id);pending.delete(m.id);clearTimeout(p.timer);\nif(m.error){const error=Error('host error');error.code=m.error.code;p.reject(error)}else p.resolve(m.result);return}\nif(m.method==='ping'&&m.id!==undefined){send({id:m.id,result:{}});return}\nif(m.method==='ui/resource-teardown'){send({id:m.id,result:{}});closed=true;revision++;custom?.dispose();custom=null;for(const p of pending.values()){clearTimeout(p.timer);p.reject(Error('closed'))}pending.clear();observer.disconnect();removeEventListener('message',receive);return}\nif(m.id!==undefined)return;\n/* A host can post the result before it answers initialize. Keep it for the replay. */\nif(!ready){if(early.length<8)early.push(m);return}\nhandle(m)}\nfunction handle(m){\nlet slot=DASH.indexOf(m.method),kind='dashed';\nif(slot<0){slot=SNAKE.indexOf(m.method);kind='snake'}\nif(slot>=0){\n/* A dual host posts each notification twice. Lock to the first name and drop its twin:\n   same payload, and a second render is a visible flicker. */\nif(!dialect)dialect=kind;if(dialect!==kind)return;\n// The snake result nests one level deeper.\nif(slot===0)render(kind==='snake'?m.params&&m.params.result:m.params);\nelse if(slot===1)wait();\nelse{host(m.params||{});resize()}\nreturn}\nif(m.method==='ui/notifications/tool-cancelled'){revision++;custom?.dispose();custom=null;busy=false;$('plot').dataset.state='off';status('Request cancelled.');controls()}}\naddEventListener('message',receive);const observer=new ResizeObserver(resize);observer.observe(document.body);controls();\n/* Many tiles mount at once while a reply streams. A host that attaches its listener\n   after this frame's first initialize never sees it, and the tile then waits with no\n   size and no body until a reload. Ask again with backoff; the first answer wins. */\nlet started=false,tries=0;\nfunction fail(){if(started)return;started=true;trouble('initialize-failed');status('This chart needs an MCP Apps host.',1)}\nfunction start(){if(started||closed)return;tries++;\nrpc('ui/initialize',{protocolVersion:'2026-01-26',appInfo:{name:'Databrain tile',version:'1.0.0'},appCapabilities:{availableDisplayModes:['inline','fullscreen']}})\n.then(r=>{if(started)return;if(r.protocolVersion!=='2026-01-26'){fail();return}started=true;\nfor(const p of pending.values())clearTimeout(p.timer);pending.clear();\nhost(r.hostContext||{});ready=true;notify(INIT,{});for(const m of early.splice(0))handle(m);resize()})\n.catch(e=>{if(e.code!==undefined||tries>=10)fail()});\nif(tries<10)setTimeout(start,Math.min(8000,400*2**tries))}\nstart();\n})();`;\n\n/** Compact the trusted bridge once, preserving the existing built-in result budget. */\nconst SERVED_SCRIPT = transformSync(TILE_SCRIPT, { minify: true, target: 'es2020' }).code;\nexport function tileHtml(kind: 'chart' | 'kpi' = 'chart'): string {\n  return strip(`<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; font-src data:; connect-src 'none'; frame-src blob:; base-uri 'none'; form-action 'none'\">\n<title>Databrain ${kind} tile</title><style id=\"hostfont\"></style><style>\n/* Host tokens are the Claude MCP Apps style-variable names. Every one carries a fallback:\n   hosts may ship any subset, so nothing here may depend on a token existing. */\n:root{color-scheme:light dark;\n--dbn-bg:var(--color-background-primary,Canvas);--dbn-text:var(--color-text-primary,CanvasText);\n--dbn-mute:var(--color-text-secondary,GrayText);--dbn-faint:var(--color-text-tertiary,GrayText);\n--dbn-edge:var(--color-border-secondary,color-mix(in srgb,currentColor 20%,transparent));\n--dbn-line:var(--color-border-tertiary,color-mix(in srgb,currentColor 9%,transparent));\n--dbn-accent:var(--color-text-info,LinkText);--dbn-ring:var(--color-ring-primary,var(--dbn-accent));\n--dbn-bad:var(--color-text-danger,var(--dbn-text));\n--dbn-quiet:color-mix(in srgb,currentColor 6%,transparent);\n--bw:var(--border-width-regular,1px);--r-s:var(--border-radius-sm,6px);--r-m:var(--border-radius-md,8px);\n--med:var(--font-weight-medium,500);--semi:var(--font-weight-semibold,600);--xs:var(--font-text-xs-size,12px);\n/* One curve. Quick / standard / display-mode. Corporate: no overshoot. */\n--e:cubic-bezier(.2,0,0,1);--q:120ms;--s:300ms;--l:400ms}\n*{box-sizing:border-box}\nbody{margin:0;padding:var(--safe-top,0px) var(--safe-right,0px) var(--safe-bottom,0px) var(--safe-left,0px);background:var(--dbn-bg);color:var(--dbn-text);\nfont:var(--font-text-sm-size,14px)/var(--font-text-sm-line-height,1.4) var(--font-sans,system-ui)}\nmain{padding:20px;max-width:1200px;margin:auto;transition:padding var(--l) var(--e)}\nheader{display:flex;align-items:start;justify-content:space-between;gap:12px}header>div{min-width:0}\n.acts{display:flex;gap:6px;flex:none;align-items:center}\nh1{font-size:var(--font-heading-md-size,18px);line-height:var(--font-heading-md-line-height,1.4);margin:0 0 6px;font-weight:var(--semi);letter-spacing:-.01em;overflow-wrap:anywhere;transition:font-size var(--l) var(--e)}\np{margin:6px 0;color:var(--dbn-mute);overflow-wrap:anywhere}\n#description{font-size:var(--xs);display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden;margin-top:2px}#description:empty{display:none}\nbutton,input,select{font:inherit;color:inherit;background:var(--dbn-bg);border:var(--bw) solid var(--dbn-edge);border-radius:var(--r-s);padding:7px 10px}\nbutton{cursor:pointer;transition:background-color var(--q) var(--e),border-color var(--q) var(--e)}\ninput{max-width:160px;min-width:0}button:hover:not(:disabled){background:var(--dbn-quiet)}button:disabled{color:var(--dbn-faint);cursor:default}\nbutton:focus-visible,input:focus-visible,summary:focus-visible{outline:2px solid var(--dbn-ring);outline-offset:2px}\n/* The picker is a scannable grid of quiet chips: 26 charts fit in nine rows, not a wall. */\n#choices[data-grid]{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:6px;margin-top:12px}\n#choices[data-grid] button{text-align:left;border-color:var(--dbn-line);padding:8px 10px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;min-width:0}\n#choices[data-grid] button:hover:not(:disabled){background:var(--dbn-quiet);border-color:var(--dbn-edge)}\n/* One primary per state: the drill pill, and Next page when there is a next page. */\n#choices button.primary,#next{flex:none;text-align:center;border:var(--bw) solid var(--dbn-accent);\nborder-radius:var(--r-s);padding:7px 10px;font-weight:var(--med);color:var(--dbn-accent)}\n#choices button.primary{align-self:flex-start;margin-top:10px}\n/* Refresh is a re-fetch, not a choice. Quiet it so it stops reading as a fifth chart. */\n#refresh{border-color:transparent;color:var(--dbn-mute);padding:7px 8px}\n#refresh:hover:not(:disabled){color:var(--dbn-text);background:none;text-decoration:underline}\n#status:empty{margin:0}\n#status[data-ok],#status[data-error]{font-weight:var(--med);border-left:2px solid;border-radius:0 var(--r-m) var(--r-m) 0;padding:10px 12px;margin:10px 0;background:color-mix(in srgb,currentColor 5%,transparent)}\n#status[data-ok]{color:var(--color-text-success,var(--dbn-text));border-color:var(--color-border-success,color-mix(in srgb,currentColor 40%,transparent))}\n/* \"Show as\": one row of quiet chips, the current type pressed. Never a second title. */\n#choices[data-chips]{flex-direction:row;flex-wrap:wrap;gap:6px;margin-top:10px}\n.chip{border-color:var(--dbn-line);border-radius:999px;padding:5px 11px;font-size:var(--xs);color:var(--dbn-mute)}\n.chip:hover:not(:disabled){color:var(--dbn-text);border-color:var(--dbn-edge)}\n.chip[aria-pressed=true]{color:var(--dbn-text);border-color:var(--dbn-text);background:var(--dbn-quiet)}\n/* Save is the one commit on a draft, so it is the one filled button in the tile. */\n#save,#commit{border-color:var(--dbn-accent);background:var(--dbn-accent);color:var(--dbn-bg);font-weight:var(--med)}\n#save:hover:not(:disabled),#commit:hover:not(:disabled){background:color-mix(in srgb,var(--dbn-accent) 85%,var(--dbn-text))}\n#form{margin-top:12px;padding:12px;border:var(--bw) solid var(--dbn-line);border-radius:var(--r-m);display:flex;flex-direction:column;gap:8px}\n[hidden]{display:none!important}#form label{flex-direction:column;align-items:stretch;gap:4px;font-size:var(--xs)}\n#form input,#form select{max-width:none;width:100%;background:color-mix(in srgb,currentColor 4%,var(--dbn-bg))}\n#wsone{color:var(--dbn-mute);font-size:var(--xs)}#wsone:empty{display:none}\n#status[data-error]{color:var(--dbn-bad);border-color:var(--color-border-danger,color-mix(in srgb,currentColor 40%,transparent));background:var(--color-background-danger,color-mix(in srgb,currentColor 5%,transparent))}\n/* Reserved plot. The skeleton is a static bar silhouette matching the 15:8 backend render:\n   Claude's guidance asks for a skeleton that matches the final layout, and bans nothing here,\n   but shimmer is banned by our own motion budget - so this paints once and never repaints. */\n#plot{position:relative;transition:opacity var(--q) var(--e)}#plot[data-busy],#plot[data-state=stale]{opacity:.55}\n#plot[data-state=wait]{aspect-ratio:15/8}\n#plot[data-state=wait]::before,#plot[data-state=ready]::before{content:'';position:absolute;pointer-events:none;inset:16% 6% 13%;\nborder-bottom:var(--bw) solid var(--dbn-line);transition:opacity var(--s) var(--e);\n--g:linear-gradient(var(--dbn-quiet),var(--dbn-quiet));background:var(--g) 0 100%/11% 44% no-repeat,var(--g) 22% 100%/11% 71% no-repeat,var(--g) 44% 100%/11% 57% no-repeat,var(--g) 66% 100%/11% 86% no-repeat,var(--g) 88% 100%/11% 33% no-repeat}\n#plot[data-state=ready]::before{opacity:0}\n.chart{position:relative;width:100%;margin:12px 0}.chart img{width:100%;height:100%;display:block}\n/* A point's geometry comes from the renderer and can be 8px; the hit area must not.\n   ::after pads it to at least 24px; ::before is the marker that says \"you can pick this\". */\n.point{position:absolute;padding:0;border:0;background:transparent;border-radius:50%}\n.point::after{content:'';position:absolute;inset:-8px}\n.point::before{content:'';position:absolute;left:50%;top:50%;width:8px;height:8px;margin:-4px;border-radius:50%;\nbackground:var(--dbn-accent);box-shadow:0 0 0 2px var(--dbn-bg);opacity:0;transform:scale(.6);transition:opacity var(--q) var(--e),transform var(--q) var(--e)}\n.point:hover::before,.point:focus-visible::before{opacity:.7;transform:none}\n.point[aria-pressed=true]::before{opacity:1;transform:none;box-shadow:0 0 0 2px var(--dbn-bg),0 0 0 4px color-mix(in srgb,var(--dbn-accent) 35%,transparent)}\n.kpi{overflow-wrap:anywhere;font-size:clamp(34px,10vw,44px);line-height:1.1;font-weight:var(--semi);letter-spacing:-.025em;font-variant-numeric:tabular-nums;color:var(--dbn-text);margin:14px 0 6px;transition:font-size var(--l) var(--e)}\n/* The readout rail. At rest it states the scope of what is on screen; on selection it\n   becomes the value. One slot, two jobs, so selecting a bar never reflows the tile. */\n#rail{display:flex;align-items:center;min-height:2.5em;margin:2px 0 0}\n#scope,#value{margin:0;display:none;overflow-wrap:anywhere}\n#rail:not([data-value]) #scope{display:block;color:var(--dbn-mute);font-size:var(--xs)}\n#rail:not([data-value]):has(#scope:empty){display:none}\n#rail[data-value] #value{display:flex;flex-direction:column;gap:1px;line-height:1.15}\n#vlabel{color:var(--dbn-mute);font-size:var(--xs)}\n#vnum{font-size:var(--font-heading-md-size,18px);font-weight:var(--semi);letter-spacing:-.015em;font-variant-numeric:tabular-nums}\n[data-mode=full] #vnum{font-size:var(--font-heading-xl-size,24px)}\nfooter,.dates{display:flex;gap:8px;flex-wrap:wrap;align-items:center}\n#choices{display:flex;flex-direction:column;align-items:stretch;margin:10px 0 0}footer{margin-top:12px}footer:not(:has(button:not([hidden]))){display:none}.dates{margin:8px 0 2px}\nlabel{display:flex;align-items:center;gap:6px;color:var(--dbn-mute)}\n#range{margin-top:10px}#data{margin-top:2px}\nhtml:not([data-deep]) #range,html:not([data-deep]) #data:not([data-only]){display:none}\nsummary{cursor:pointer;color:var(--dbn-mute);font-size:var(--xs);padding:5px 0;width:fit-content;transition:color var(--q) var(--e)}summary:hover{color:var(--dbn-text)}\n#rows{overflow:auto;max-height:260px;border-radius:var(--r-s)}\ntable{border-collapse:collapse;width:100%;font-size:var(--xs)}\nth,td{text-align:left;padding:8px;border-bottom:var(--bw) solid var(--dbn-line);overflow-wrap:anywhere}\ntd.n,th.n{text-align:right;font-variant-numeric:tabular-nums}\nth{font-weight:var(--semi);position:sticky;top:0;background:var(--dbn-bg);color:var(--dbn-mute);\nfont-size:var(--xs);letter-spacing:.02em;text-transform:uppercase}\n/* Inline to fullscreen is a layout morph, not a new screen: main widens over 400ms on the\n   one curve and every dependent box follows it. Fullscreen is the detailed view, so the\n   table loses its inline height cap. */\n/* The SVG is rendered at 600x320 and scaled by width, so an unbounded fullscreen column\n   makes the chart's own axis type larger than the tile's heading. Hold a measure. */\n[data-mode=full] main{padding:28px 32px;max-width:900px}\n[data-mode=full] h1{font-size:var(--font-heading-xl-size,24px);line-height:var(--font-heading-xl-line-height,1.25)}\n[data-mode=full] .kpi{overflow-wrap:anywhere;font-size:clamp(44px,7vw,72px)}\n[data-mode=full] #rows{max-height:none}\n/* Touch: the host gives vertical pan to the conversation, so a nested scroller is a trap. */\n@media(pointer:coarse){button,input{min-height:44px}summary{padding:12px 0}#rows{max-height:none;overflow:visible}}\nhtml[data-kind=table] #rows{max-height:360px;overflow:auto}html[data-kind=table] table{min-width:480px}\n@media(max-width:480px){main{padding:14px}}\n/* Entrance. Content first, chrome 60ms later: 300+60 = 360ms, inside the 400ms budget.\n   No stagger past two groups - a chat tile that cascades reads as lag, not luxury. */\n@keyframes rise{from{opacity:0;transform:translateY(6px)}}\n@keyframes land{from{opacity:0;transform:translateY(4px) scale(.995)}}\nheader,#status,#plot{animation:rise var(--s) var(--e) both}\n#rail,#choices,footer,#range,#data{animation:rise var(--s) var(--e) 60ms both}\n.chart,.kpi{animation:land var(--s) var(--e) both}\n@media(prefers-reduced-motion:reduce){*,*::before,*::after{animation:none!important;transition:none!important}}\n</style></head><body><main id=\"tile\"><header><div><h1 id=\"title\">Analytics</h1><p id=\"description\"></p></div><div class=\"acts\"><button id=\"refresh\" hidden>Refresh</button><button id=\"expand\" hidden>Expand</button></div></header>\n<p id=\"status\" role=\"status\">Loading chart…</p><div id=\"plot\" data-state=\"wait\"></div>\n<div id=\"rail\"><p id=\"scope\"></p><p id=\"value\"><span id=\"vlabel\"></span><b id=\"vnum\"></b></p></div><div id=\"choices\"></div>\n<footer><button id=\"save\" hidden>Save as dashboard</button><button id=\"next\" hidden>Next page</button></footer>\n<form id=\"form\" hidden onsubmit=\"return false\"><label>Dashboard name<input id=\"dtitle\" type=\"text\" maxlength=\"200\" autocomplete=\"off\"></label>\n<label id=\"wsrow\" hidden>Workspace<select id=\"ws\"></select></label><p id=\"wsone\"></p>\n<div class=\"dates\"><button id=\"commit\" type=\"button\">Save to Databrain</button><button id=\"cancel\" type=\"button\">Cancel</button></div></form>\n<details id=\"range\" hidden><summary>Change the date range</summary><div class=\"dates\"><label>From <input id=\"from\" type=\"date\"></label><label>To <input id=\"to\" type=\"date\"></label><button id=\"dates\" type=\"button\">Apply dates</button></div></details>\n<details id=\"data\" hidden><summary id=\"count\">Show the data behind this</summary><div id=\"rows\" tabindex=\"0\" role=\"region\" aria-label=\"Chart data\"></div></details></main><script>${SERVED_SCRIPT}</script></body></html>`);\n}\nfunction strip(html: string): string {\n  return html.replace(/\\/\\*[\\s\\S]*?\\*\\//g, '').replace(/\\n{2,}/g, '\\n')\n    .replace(/<style>([\\s\\S]*?)<\\/style><\\/head>/, (_m, css: string) => `<style>${css.replace(/;}/g, '}').replace(/\\n/g, '')}</style></head>`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAYlB,IAAM,SAAS,oBAAI,IAA+C;AAG3D,SAAS,0BAA0B,QAAmB,QAA+B;AAC1F,QAAM,UAAU,OAAO;AAAA,IAAK;AAAA,IAC1B;AAAA,IACA,CAAC;AAAA,IAAG;AAAA,IAAW,YAAY,QAAQ;AAAA,MAAE,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,gCAAgC,CAAC;AAAA,MAC7G,OAAO,EAAE,kCAAkC,8BAA8B,EAAE;AAAA,IAAE,CAAC;AAAA,EAAC;AACnF,UAAQ,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,QAAM,MAAM,IAAI,gBAAgB,MAAM;AACtC,QAAM,OAAO,OAAO;AAAA,IAAK;AAAA,IACvB;AAAA,IACA;AAAA,MAAE,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB;AAAA,MAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,uBAAuB,EAAE,QAAQ,CAAC;AAAA,MACxH,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB,EAAE,SAAS;AAAA,IAAE;AAAA,IAAG;AAAA,IAChE,OAAO,EAAE,KAAK,QAAQ,aAAa,SAAS,MAAM;AAChD,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,IAAI,GAAG;AAChC,YAAI,OAAO,WAAW,eAAe,CAAC,OAAO,mBAAoB,OAAM,IAAI,MAAM,eAAe;AAChG,cAAM,gBAAgB,OAAO,UAAU,KAAK,aAAW,QAAQ,OAAO,OAAO,kBAAkB,GAAG;AAClG,cAAM,SAAS,iBAAiB,iBAAiB,KAAK,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI;AACnG,YAAI,OAAO,eAAe,QAAQ,UAAU,OAAO,UAAU,KAAK,IAAI,IAAI,OAAO,OAAO;AACxF,YAAI,UAAU,QAAW;AACvB,gBAAM,MAAM,MAAM,IAAI,OAAO,KAAK,OAAO,kBAAkB;AAC3D,gBAAM,SAAS,EAAE,GAAG,KAAK,WAAW,IAAI,aAAa,OAAU;AAC/D,cAAI,eAAe,MAAM,EAAE,UAAU,OAAO,SAAS,OAAO,IAAK,OAAM,IAAI,MAAM,gBAAgB;AACjG,iBAAO,YAAY,MAAM;AACzB,cAAI,iBAAiB,kBAAkB,KAAM,OAAM,IAAI,MAAM,yBAAyB;AAEtF,kBAAQ,KAAK,UAAU,EAAE,UAAU,OAAO,UAAU,UAAU,OAAO,UAAU,WAAW,OAAO,aAAa,IAAI,SAAS,OAAO,QAAQ,CAAC;AAC3I,cAAI,OAAO,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,EAAE,KAAK,EAAE,KAAM;AAC/D,iBAAO,IAAI,MAAM,EAAE,MAAM,OAAO,SAAS,KAAK,IAAI,IAAI,IAAO,CAAC;AAAA,QAChE;AACA,YAAI,YAAY,SAAS,SAAU,OAAM,IAAI,MAAM,2BAA2B;AAC9E,YAAI,SAAS,MAAM,OAAQ,OAAM,IAAI,MAAM,QAAQ;AACnD,cAAM,QAAQ,MAAM,MAAM,QAAQ,SAAS,yBAAyB;AACpE,eAAO,QAAQ;AAAA,UAAE,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,sCAAsC,CAAC;AAAA,UAC/F,mBAAmB;AAAA,YAAE;AAAA,YAAK,aAAa;AAAA,YAAM;AAAA,YAAQ;AAAA,YACnD,YAAY,SAAS,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,SAAS;AAAA,UAAK;AAAA,QAAE,CAAC;AAAA,MACzF,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM,mCAAmC,GAAG;AAAA,QAAoE,CAAC,EAAE;AAAA,MACvH;AAAA,IACF;AAAA,EAAC;AACH,OAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC;;;ACvDA,SAAS,KAAAA,UAAS;;;ACIX,IAAM,cAAc;AAM3B,IAAM,sBAAN,cAAkC,gBAAgB;AAAA,EAChD,YAA6B,UAA2B;AACtD,UAAM,EAAE,QAAQ,SAAS,UAAU,GAAG,YAAY,SAAS,cAAc,EAAE,CAAC;AADjD;AAAA,EAE7B;AAAA,EACS,QAAW,SAAqC;AACvD,WAAO,KAAK,SAAS,QAAW,EAAE,GAAG,SAAS,UAAU,QAAW,YAAY,OAAU,CAAC;AAAA,EAC5F;AACF;AAGO,SAAS,mBAAmB,QAAuC;AAExE,QAAM,WAAW,oBAAoB,IAAI,oBAAoB,MAAM,CAAC;AACpE,SAAO;AAAA,IACL,MAAM,QAAQ,QAAQ,cAAc,SAAS;AAC3C,YAAM,YAAY,gBAAgB,MAAM,YAAY;AACpD,YAAM,OAAO,WAAW,MAAM,OAAO;AACrC,UAAI,iBAAiB,WAAW;AAC9B,YAAI,CAAC,OAAO,SAAS,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACjE,eAAO,WAAW,MAAM,MAAM,OAAO,QAAiB;AAAA,UACpD,QAAQ;AAAA,UAAQ,MAAM;AAAA,UAAqC,MAAM;AAAA,UACjE,MAAM;AAAA,YAAE;AAAA,YAAQ,aAAa,UAAU;AAAA,YAAa,UAAU,UAAU;AAAA,YACtE,GAAI,UAAU,WAAW,EAAE,UAAU,UAAU,SAAS,IAAI,CAAC;AAAA,YAC7D,GAAI,UAAU,UAAU,EAAE,SAAS,UAAU,QAAQ,IAAI,CAAC;AAAA,YAAI,GAAG;AAAA,YACjE,UAAU;AAAA,YAAI,OAAO;AAAA,YAAK,QAAQ;AAAA,YAAK,WAAW;AAAA,UAAM;AAAA,UAC1D,gBAAgB;AAAA,QAClB,CAAC,CAAC;AAAA,MACJ;AAEA,YAAM,MAAM,MAAM,SAAS,cAAc,mBAAmB,UAAU,aAAa,UAAU,OAAO;AACpG,UAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,yBAAyB;AACtD,YAAM,QAAQ,MAAM,SAAS,cAAc,6BAA6B;AAAA,QACtE,SAAS,UAAU;AAAA,QAAS,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,MAAM,CAAC;AACpF,UAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,oBAAoB;AACnD,YAAM,EAAE,MAAM,IAAI,MAAM,SAAS,kBAAkB,cAAc;AAAA,QAC/D,UAAU,UAAU;AAAA,QAAU,aAAa,IAAI;AAAA,QAAO,eAAe,CAAC,UAAU,OAAO;AAAA,QACvF,aAAa;AAAA,UAAE,yBAAyB;AAAA,UAAM,uBAAuB;AAAA,UACnE,wBAAwB;AAAA,UAAO,wBAAwB;AAAA,QAAM;AAAA,MACjE,CAAC;AACD,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yBAAyB;AACrD,YAAM,OAAO,MAAM,OAAO,QAAiB;AAAA,QACzC,QAAQ;AAAA,QAAQ,MAAM;AAAA,QAAa,MAAM;AAAA,QAAQ;AAAA,QACjD,MAAM;AAAA,UAAE;AAAA,UAAQ,SAAS,UAAU;AAAA,UAAS,UAAU,UAAU;AAAA,UAAU,GAAG;AAAA,UAC3E,UAAU;AAAA,UAAI,OAAO;AAAA,UAAK,QAAQ;AAAA,UAAK,WAAW;AAAA,QAAM;AAAA,QAC1D,gBAAgB;AAAA,MAClB,CAAC;AACD,aAAO,WAAW,MAAM,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;;;AC5DA,SAAS,qBAAqB;AAIvB,IAAM,cAAc,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAmIR,KAAK,KAAK,0BAA0B,yBAAyB,CAAC;AAAA;AAAA;AAAA;AAAA,gHAIwB,yBAAyB;AAAA;AAAA,iBAExH,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwDxC,IAAM,gBAAgB,cAAc,aAAa,EAAE,QAAQ,MAAM,QAAQ,SAAS,CAAC,EAAE;AAC9E,SAAS,SAAS,OAAwB,SAAiB;AAChE,SAAO,MAAM;AAAA;AAAA,mBAEI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oLA6H6J,aAAa,yBAAyB;AAC1N;AACA,SAAS,MAAM,MAAsB;AACnC,SAAO,KAAK,QAAQ,qBAAqB,EAAE,EAAE,QAAQ,WAAW,IAAI,EACjE,QAAQ,sCAAsC,CAAC,IAAI,QAAgB,UAAU,IAAI,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE,CAAC,iBAAiB;AAC7I;;;AF3TA,IAAM,UAAuC;AAAA,EAC3C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,YAAY;AAAA,EACZ,mBAAmB;AACrB;AAGO,SAAS,kBAAkB,QAAmB,QAAyB,UAAwB,mBAAmB,MAAM,GAAS;AACtI,aAAW,CAAC,MAAM,WAAW,KAAK,OAAO,QAAQ,OAAO,GAAG;AACzD,UAAM,SAAS;AACf,UAAM,OAAO,OAAO,KAAK,MAAM,aAAa;AAAA,MAC1C,WAAW;AAAA,MAAiB,MAAM,WAAW,QAAQ,CAAC,CAAC;AAAA,MACvD,SAASC,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAC9E,GAAG,WAAW,OAAO,EAAE,WAAW,KAAK,MAAM;AAC3C,UAAI;AACF,YAAK,WAAW,gBAAgB,CAAC,KAAK,WAAa,WAAW,uBAAuB,CAAC,KAAK,UAAY,OAAM,IAAI,MAAM,uBAAuB;AAC9I,cAAM,OAAO,WAAW,MAAM,MAAM,YAAY;AAAA,UAAI,EAAE,MAAM,MAAM,UAAU,aAAa,gBAAgB,aAAa,WAAW,MAAM;AAAA,UACrI,MAAM,QAAQ,QAAQ,QAAQ,WAAW,IAAI;AAAA,QAAC,CAAC;AAGjD,YAAI,KAAK,QAAQ,CAAC,cAAc,KAAK,KAAK,GAAG,KAC3C,kLAAkL,KAAK,KAAK,GAAG,IAAI;AACnM,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AACA,eAAO,YAAY,GAAG,KAAK,SAAS,QAAQ,QAAQ,OAAO,WAAW,KAAK,KAAK,MAAM,sBAAsB,KAAK,WAAW,MAAM,KAAK,WAAW,EAAE,GAAG,KAAK,cAAc,MAAM,KAAK,cAAc,EAAE,IAAK;AAAA,UACxM,GAAG;AAAA,UAAM;AAAA,UAAW;AAAA,QACtB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,YAAI,iBAAiB,kBAAmB,QAAO,MAAM,eAAe;AACpE,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM;AAAA,QAA4F,CAAC,EAAE;AAAA,MACzG;AAAA,IACF,CAAC;AACD,SAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,EACzC;AACA,qBAAmB,QAAQ,QAAQ,OAAO;AAC1C,qBAAmB,QAAQ,MAAM;AACjC,4BAA0B,QAAQ,MAAM;AACxC,aAAW,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,WAAW,OAAO,GAAG,CAAC,SAAS,KAAK,CAAC,GAAY;AAC3E,WAAO,SAAS,aAAa,IAAI,SAAS,KAAK,EAAE,UAAU,UAAU,aAAa,eAAe,IAAI,4CAA4C,GAAG,aAAa;AAAA,MAC/J,UAAU,CAAC,EAAE,KAAK,UAAU,UAAU,MAAM,SAAS,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,eAAe,MAAM,KAAK,EAAE,iBAAiB,CAAC,SAAS,OAAO,GAAG,cAAc,CAAC,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;AAAA,IACjM,EAAE;AAAA,EACJ;AACF;AAKA,SAAS,mBAAmB,QAAmB,QAA+B;AAC5E,QAAM,UAAU,OAAO;AAAA,IAAK;AAAA,IAC1B;AAAA,IACA;AAAA,MAAE,OAAO;AAAA,MAAa,MAAM;AAAA,MAAY,WAAWA,GAAE,KAAK,YAAY;AAAA,MACpE,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAAE;AAAA,IAChF;AAAA,IAAW,OAAO,EAAE,OAAO,MAAM,UAAU,MAAM;AAC/C,UAAI;AACF,cAAM,OAAO,MAAM,UAAU,QAAQ,OAAO,MAAM,SAAS;AAC3D,eAAO,YAAY,GAAG,KAAK,SAAS,UAAU,UAAU,OAAO,aAAa,SAAS,KAAK,IAAI;AAAA,MAChG,QAAQ;AACN,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,8DAA8D,CAAC,EAAE;AAAA,MACpI;AAAA,IACF;AAAA,EAAC;AACH,UAAQ,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAE1C,QAAM,OAAO,OAAO;AAAA,IAAK;AAAA,IACvB,6IACwC,gCAAgC;AAAA,IAExE;AAAA,MAAE,OAAO;AAAA,MAAa,WAAWA,GAAE,KAAK,YAAY;AAAA,MAClD,gBAAgBA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAChD,eAAeA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC1D,WAAWA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAClD,SAAS,oGAAoG;AAAA,MAChH,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,MAC7B,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,IAAE;AAAA,IAChF;AAAA,IAAc,OAAO,EAAE,OAAO,WAAW,gBAAgB,eAAe,WAAW,QAAQ,MAAM;AAC/F,UAAI,YAAY,kCAAkC;AAChD,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC;AAAA,UAAE,MAAM;AAAA,UACxC,MAAM,qDAAqD,gCAAgC;AAAA,QAAK,CAAC,EAAE;AAAA,MACvG;AAGA,YAAM,UAAU,MAAM,sBAAsB,QAAQ,MAAM,cAAc,WAAW;AACnF,YAAM,SAAS,CAAC,UAAkB;AAAA,QAAE,SAAS;AAAA,QAAM,SAAS,CAAC,EAAE,MAAM,QAAiB,KAAK,CAAC;AAAA,QAC1F,mBAAmB,EAAE,MAAM,QAAQ,IAAI,OAAO,QAAQ;AAAA,MAAE;AAE1D,YAAM,SAAS,gBACX,QAAQ,KAAK,OAAK,EAAE,KAAK,EAAE,YAAY,MAAM,cAAc,YAAY,CAAC,IACxE,QAAQ,WAAW,IAAI,QAAQ,CAAC,IAAI;AACxC,UAAI,iBAAiB,CAAC,QAAQ;AAC5B,eAAO,OAAO,cAAc,aAAa,oDAAoD,QAAQ,KAAK,IAAI,CAAC,GAAG;AAAA,MACpH;AACA,UAAI,CAAC,QAAQ;AACX,eAAO,OAAO,QAAQ,SAClB,uBAAuB,QAAQ,KAAK,IAAI,CAAC,MACzC,sCAAsC,MAAM,YAAY,8CAA8C;AAAA,MAC5G;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,qBAAqB,QAAQ,OAAO,EAAE,WAAW,gBAAgB,eAAe,QAAQ,UAAU,CAAC;AACvH,eAAO;AAAA,UAAY,UAAU,MAAM,KAAK,kBAAkB,MAAM,aAAa,eAAe,MAAM,WAAW,YAAY,MAAM,QAAQ;AAAA,UACrI,EAAE,MAAM,QAAQ,IAAI,MAAM,GAAG,OAAO,OAAO,EAAE,GAAG,OAAO,UAAU,EAAE;AAAA,QAAC;AAAA,MACxE,SAAS,OAAO;AACd,cAAM,OAAO,iBAAiB,oBAAoB,MAAM,OAAO;AAC/D,eAAO;AAAA,UAAE,SAAS;AAAA,UAAM,SAAS,CAAC;AAAA,YAAE,MAAM;AAAA,YACxC,MAAM,mBAAmB,IAAI;AAAA,UAA+D,CAAC;AAAA,UAC7F,mBAAmB,EAAE,MAAM,QAAQ,IAAI,OAAO,KAAK;AAAA,QAAE;AAAA,MACzD;AAAA,IACF;AAAA,EAAC;AACH,OAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;AAClD;AAGA,SAAS,mBAAmB,QAAmB,QAAyB,SAA6B;AACnG,QAAM,OAAO,OAAO;AAAA,IAAK;AAAA,IACvB;AAAA,IAEA;AAAA,MAAE,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAAG,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MACrF,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MAAG,aAAaA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MACrG,SAASA,GAAE,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,QAAQ,OAAO;AAAA,MAAG,UAAUA,GAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MACzG,WAAW,gBAAgB,SAAS;AAAA,MAAG,SAASA,GAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IAAE;AAAA,IACjF;AAAA,IAAW,OAAO,EAAE,eAAe,aAAa,UAAU,aAAa,SAAS,UAAU,UAAU,MAAM;AACxG,UAAI;AACF,YAAI,CAAC,OAAO,SAAS,EAAG,OAAM,IAAI,MAAM,mHAAmH;AAC3J,cAAM,WAAW,MAAM,OAAO,QAA0D;AAAA,UACtF,QAAQ;AAAA,UAAQ,MAAM;AAAA,UAAuC,MAAM;AAAA,UACnE,MAAM,EAAE,eAAe,aAAa,UAAU,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC,EAAG;AAAA,QACxF,CAAC;AACD,YAAI,SAAS,YAAY,aAAa,SAAS,UAAU;AACvD,gBAAM,IAAI,MAAM,kCAAkC,KAAK,UAAU,SAAS,QAAQ,CAAC,uEAAuE;AAAA,QAC5J;AACA,cAAM,YAAY;AAAA,UAAE,aAAa,SAAS;AAAA,UAAa,UAAU;AAAA,UAAU;AAAA,UACzE,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QAAG;AACpC,cAAM,OAAO,YAAY,EAAE,UAAU,IAAI,CAAC;AAC1C,cAAM,OAAO,WAAW,MAAM,MAAM,QAAQ,QAAQ,gBAAgB,WAAW,IAAI,CAAC;AACpF,YAAI,KAAK,QAAQ,CAAC,cAAc,KAAK,KAAK,GAAG,KAC3C,kLAAkL,KAAK,KAAK,GAAG,GAAI,OAAM,IAAI,MAAM,YAAY;AACjO,eAAO,YAAY,GAAG,KAAK,SAAS,QAAQ,QAAQ,OAAO,WAAW,KAAK,KAAK,MAAM,sBAAsB,KAAK,cAAc,MAAM,KAAK,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,KAAK,CAAC;AAAA,MAC5L,SAAS,OAAO;AACd,YAAI,iBAAiB,kBAAmB,QAAO,MAAM,eAAe;AACpE,eAAO,EAAE,SAAS,MAAM,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAO,MAAgB,QAAQ,WAAW,kBAAkB,KAAM,MAAgB,QAAQ,WAAW,wBAAwB,IACnL,MAAgB,UAAU,oFAAoF,CAAC,EAAE;AAAA,MACxH;AAAA,IACF;AAAA,EAAC;AACH,OAAK,OAAO,EAAE,OAAO,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;AAClD;","names":["z","z"]}