@fabric-harness/databricks 0.15.0 → 0.18.0

package/dist/governance.js

@@ -0,0 +1,111 @@
+import { redactJson } from '@fabric-harness/sdk';
+function metaString(tool, key) {
+    const value = tool.metadata?.[key];
+    return typeof value === 'string' ? value : undefined;
+}
+function inputString(input, key) {
+    if (input && typeof input === 'object' && key in input) {
+        const value = input[key];
+        if (typeof value === 'string')
+            return value;
+    }
+    return undefined;
+}
+/** Wraps one Databricks tool to stamp lineage/audit and enforce the optional catalog allowlist. */
+export function withGovernance(tool, options = {}) {
+    const inner = tool.execute;
+    if (!inner)
+        return tool;
+    const now = options.now ?? (() => new Date());
+    return {
+        ...tool,
+        metadata: { ...(tool.metadata ?? {}), governed: true },
+        async execute(input, context) {
+            const catalog = inputString(input, 'catalog');
+            const schema = inputString(input, 'schema');
+            if (options.catalogs && catalog && !options.catalogs.includes(catalog)) {
+                throw new Error(`databricks governance: catalog "${catalog}" is not in the allowed list (${options.catalogs.join(', ')}).`);
+            }
+            const startedAt = now().toISOString();
+            const service = metaString(tool, 'service');
+            const provider = metaString(tool, 'provider');
+            const base = {
+                tool: tool.name,
+                ...(service !== undefined ? { service } : {}),
+                ...(provider !== undefined ? { provider } : {}),
+                ...(options.principal !== undefined ? { principal: options.principal } : {}),
+                ...(catalog !== undefined ? { catalog } : {}),
+                ...(schema !== undefined ? { schema } : {}),
+                // Redact secret-ish keys before the input enters the audit/lineage record.
+                input: redactJson((input ?? {})),
+                startedAt,
+            };
+            try {
+                const result = await inner(input, context);
+                options.onLineage?.({ ...base, finishedAt: now().toISOString(), ok: true });
+                return result;
+            }
+            catch (error) {
+                options.onLineage?.({ ...base, finishedAt: now().toISOString(), ok: false, error: error instanceof Error ? error.message : String(error) });
+                throw error;
+            }
+        },
+    };
+}
+/** Wraps a set of Databricks tools with {@link withGovernance}. */
+export function withGovernanceTools(tools, options = {}) {
+    return tools.map((tool) => withGovernance(tool, options));
+}
+function shouldGate(tool, services) {
+    if (services)
+        return services.includes(metaString(tool, 'service') ?? '');
+    const effect = tool.metadata?.effect;
+    return effect === 'write' || effect === 'execute';
+}
+/** Builds approval rules (one per gated tool) for `CapabilityPolicy.toolPolicy.approvalRules`. */
+export function databricksApprovalRules(tools, options) {
+    return tools
+        .filter((tool) => shouldGate(tool, options.services))
+        .map((tool) => ({
+        pattern: tool.name,
+        audience: options.audience,
+        // ${name} is templated by the policy layer at request time — keep it literal here.
+        reason: options.reason ?? 'Databricks ${name} requires data-steward approval.',
+        ...(options.ttlSeconds !== undefined ? { ttlSeconds: options.ttlSeconds } : {}),
+    }));
+}
+function toHostPatterns(host) {
+    if (!host)
+        return [];
+    const list = Array.isArray(host) ? host : [host];
+    return list.map((entry) => {
+        try {
+            return new URL(entry.includes('://') ? entry : `https://${entry}`).host;
+        }
+        catch {
+            return entry;
+        }
+    });
+}
+/**
+ * Assembles a `CapabilityPolicy` for a Databricks tool set: approval routing for sensitive
+ * operations (if `stewardAudience` is set) plus an egress allowlist pinned to the workspace host(s).
+ * Used by the `databricks()` bundle; can also be merged into an agent's own policy.
+ */
+export function databricksGovernancePolicy(options) {
+    const policy = {};
+    if (options.stewardAudience) {
+        policy.toolPolicy = {
+            approvalRules: databricksApprovalRules(options.tools, {
+                audience: options.stewardAudience,
+                ...(options.approvalServices ? { services: options.approvalServices } : {}),
+                ...(options.ttlSeconds !== undefined ? { ttlSeconds: options.ttlSeconds } : {}),
+            }),
+        };
+    }
+    const hosts = toHostPatterns(options.host);
+    if (hosts.length > 0)
+        policy.network = { mode: 'allowlist', hosts };
+    return policy;
+}
+//# sourceMappingURL=governance.js.map

package/dist/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAyCjD,SAAS,UAAU,CAAC,IAAa,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAI,IAAI,CAAC,QAAgD,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,GAAW;IAC9C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;QACvD,MAAM,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,cAAc,CAAO,IAAmB,EAAE,UAAuC,EAAE;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE9C,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;QACtD,KAAK,CAAC,OAAO,CAAC,KAAQ,EAAE,OAAO;YAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,iCAAiC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9H,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,2EAA2E;gBAC3E,KAAK,EAAE,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAe,CAAC;gBAC9C,SAAS;aACV,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC3C,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5E,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5I,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,KAAgB,EAAE,UAAuC,EAAE;IAC7F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAWD,SAAS,UAAU,CAAC,IAAa,EAAE,QAAmB;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAI,IAAI,CAAC,QAAgD,EAAE,MAAM,CAAC;IAC9E,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC;AACpD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,uBAAuB,CAAC,KAAgB,EAAE,OAAsC;IAC9F,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,OAAO,EAAE,IAAI,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,mFAAmF;QACnF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,oDAAoD;QAC9E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC,CAAC;AACR,CAAC;AAYD,SAAS,cAAc,CAAC,IAAmC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C;IACnF,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,CAAC,UAAU,GAAG;YAClB,aAAa,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE;gBACpD,QAAQ,EAAE,OAAO,CAAC,eAAe;gBACjC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A bearer-token resolver awaited per request. Shape matches what {@link DatabricksRestClient},
+ * {@link databricksFoundationModelProvider} (via `tokenProvider`), and the Lakebase store accept,
+ * so a single principal threads through model calls, data calls, and state.
+ */
+export type DatabricksTokenProvider = () => Promise<string>;
+export type DatabricksPrincipal = 
+/** Personal access token. Dev / single-user only. */
+{
+    kind: 'pat';
+    token: string;
+    label?: string;
+}
+/** OAuth machine-to-machine (client-credentials). The agent acts as one governed identity. */
+ | {
+    kind: 'service-principal';
+    host: string;
+    clientId: string;
+    clientSecret: string;
+    /** OAuth scope; defaults to `all-apis`. */
+    scope?: string;
+    /** Refresh this many seconds before expiry to avoid using a token that expires mid-flight. Default 60. */
+    refreshSkewSeconds?: number;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * On-behalf-of a specific end user. The caller binds the user's token resolver (e.g. from a
+ * channel `actor`), so Unity Catalog enforces *that human's* grants. The resolver is responsible
+ * for its own caching/refresh.
+ */
+ | {
+    kind: 'on-behalf-of';
+    userToken: () => string | Promise<string>;
+    label?: string;
+};
+/** Builds a cached, auto-refreshing token provider for a Databricks principal. */
+export declare function databricksIdentity(principal: DatabricksPrincipal): DatabricksTokenProvider;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAE5D,MAAM,MAAM,mBAAmB;AAC7B,qDAAqD;AACnD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAChD,8FAA8F;GAC5F;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AACH;;;;GAIG;GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAQxF,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,mBAAmB,GAAG,uBAAuB,CAU1F"}

package/dist/identity.js

@@ -0,0 +1,56 @@
+import { redactText } from '@fabric-harness/sdk';
+/** Builds a cached, auto-refreshing token provider for a Databricks principal. */
+export function databricksIdentity(principal) {
+    if (principal.kind === 'pat') {
+        const { token } = principal;
+        return async () => token;
+    }
+    if (principal.kind === 'on-behalf-of') {
+        const { userToken } = principal;
+        return async () => userToken();
+    }
+    return servicePrincipalProvider(principal);
+}
+function servicePrincipalProvider(principal) {
+    const host = principal.host.replace(/\/$/, '');
+    const scope = principal.scope ?? 'all-apis';
+    const skewMs = (principal.refreshSkewSeconds ?? 60) * 1000;
+    const fetchImpl = principal.fetchImpl ?? fetch;
+    const basic = base64(`${principal.clientId}:${principal.clientSecret}`);
+    let cached;
+    let inflight;
+    const refresh = async () => {
+        const response = await fetchImpl(`${host}/oidc/v1/token`, {
+            method: 'POST',
+            headers: {
+                authorization: `Basic ${basic}`,
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body: `grant_type=client_credentials&scope=${encodeURIComponent(scope)}`,
+        });
+        if (!response.ok) {
+            const text = redactText(await response.text(), { additionalSecrets: [principal.clientSecret] });
+            throw new Error(`databricks oauth: ${response.status} ${response.statusText}: ${text.slice(0, 500)}`);
+        }
+        const json = (await response.json());
+        if (!json.access_token)
+            throw new Error('databricks oauth: response missing access_token.');
+        const ttlMs = (json.expires_in ?? 3600) * 1000;
+        cached = { token: json.access_token, refreshAtMs: Date.now() + Math.max(0, ttlMs - skewMs) };
+        return json.access_token;
+    };
+    return async () => {
+        if (cached && Date.now() < cached.refreshAtMs)
+            return cached.token;
+        // Dedupe concurrent refreshes so a burst of requests triggers a single token exchange.
+        if (!inflight)
+            inflight = refresh().finally(() => { inflight = undefined; });
+        return inflight;
+    };
+}
+function base64(value) {
+    if (typeof Buffer !== 'undefined')
+        return Buffer.from(value, 'utf8').toString('base64');
+    return btoa(value);
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAqCjD,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,SAA8B;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;QAC5B,OAAO,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;QAChC,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAsE;IACtG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,UAAU,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,IAAI,MAA+B,CAAC;IACpC,IAAI,QAAqC,CAAC;IAE1C,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;QAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,gBAAgB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,KAAK,EAAE;gBAC/B,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,uCAAuC,kBAAkB,CAAC,KAAK,CAAC,EAAE;SACzE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAC/C,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC;QAC7F,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC,CAAC;IAEF,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACnE,uFAAuF;QACvF,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC"}

package/dist/index.d.ts

@@ -1,85 +1,136 @@
-import type { FilesystemSource, JsonObject, ToolDef } from '@fabric-harness/sdk';
-export interface DatabricksClientOptions {
+import type { CapabilityPolicy, EmbeddingProvider, FilesystemSource, ModelProvider, Retriever, SessionStore, ToolDef } from '@fabric-harness/sdk';
+import { DatabricksRestClient } from './client.js';
+import type { DatabricksWorkspaceSourceOptions } from './tools.js';
+import type { DatabricksPrincipal, DatabricksTokenProvider } from './identity.js';
+import type { DatabricksLineageRecord } from './governance.js';
+import type { LakebaseClient, LakebasePoolFactory } from './lakebase.js';
+import type { DatabricksConsumption } from './consumption.js';
+export { DatabricksRestClient, createDatabricksClient, waitForDatabricksRun, waitForDatabricksStatement } from './client.js';
+export type { DatabricksClientOptions, DatabricksWaitOptions } from './client.js';
+export { databricksSqlTool, databricksRunJobTool, databricksNotebookTool, databricksMlflowLogMetricTool, databricksMlflowLogParamTool, unityCatalogTablesTool, databricksTableInfoTool, databricksWorkspaceSource } from './tools.js';
+export type { DatabricksSqlToolOptions, DatabricksWorkspaceSourceOptions } from './tools.js';
+export { databricksFoundationModelProvider, registerDatabricksModelProvider } from './model.js';
+export type { DatabricksModelOptions } from './model.js';
+export { databricksIdentity } from './identity.js';
+export type { DatabricksPrincipal, DatabricksTokenProvider } from './identity.js';
+export { withGovernance, withGovernanceTools, databricksApprovalRules, databricksGovernancePolicy } from './governance.js';
+export type { DatabricksGovernanceOptions, DatabricksLineageRecord, DatabricksApprovalRuleOptions, DatabricksGovernancePolicyOptions } from './governance.js';
+export { lakebaseClient } from './lakebase.js';
+export type { LakebaseClient, LakebaseClientOptions, LakebasePoolConfig, LakebasePoolFactory } from './lakebase.js';
+export { databricksEmbeddings } from './embeddings.js';
+export type { DatabricksEmbeddingsOptions } from './embeddings.js';
+export { databricksVectorSearch } from './vector-search.js';
+export type { DatabricksVectorSearchOptions } from './vector-search.js';
+export { databricksAiQueryTool } from './ai.js';
+export type { DatabricksAiQueryToolOptions } from './ai.js';
+export { databricksGenieTool } from './genie.js';
+export type { DatabricksGenieToolOptions } from './genie.js';
+export { databricksLakeflowTools, databricksPipelineListTool, databricksPipelineStatusTool, databricksPipelineStartTool, databricksPipelineStopTool } from './lakeflow.js';
+export { databricksConsumption, databricksConsumptionTool } from './consumption.js';
+export type { ConsumptionGroupBy, ConsumptionSummary, ConsumptionSummaryOptions, DatabricksConsumption, DatabricksConsumptionOptions, DatabricksConsumptionToolOptions } from './consumption.js';
+export { databricksActualCostSource, databricksTenantCostLimit } from './cost-budget-actuals.js';
+export type { DatabricksActualCostSourceOptions } from './cost-budget-actuals.js';
+export { databricksFeatureLookupTool } from './feature-serving.js';
+export type { DatabricksFeatureLookupToolOptions } from './feature-serving.js';
+export { databricksAgent, defineDatabricksAgent, resolveToolRefs } from './agent.js';
+export type { DatabricksAgentOptions, DefineDatabricksAgentOptions } from './agent.js';
+export { MockDatabricksModelProvider } from './mock-provider.js';
+export type { MockDatabricksModelProviderOptions } from './mock-provider.js';
+export interface DatabricksBundleConfig {
+    /** Workspace host, e.g. https://adb-1234567890.0.cloud.databricks.com */
     host: string;
-    token: string | (() => string | Promise<string>);
+    /** Acting identity — UC enforces this principal's grants on every call. */
+    principal: DatabricksPrincipal;
+    /** Default serving-endpoint name for the returned model provider. */
+    model?: string;
+    /** SQL Warehouse id; when set, a governed `databricks_sql` tool is included. */
+    warehouseId?: string;
+    /** Extra Databricks tools to include; governed alongside the defaults. */
+    tools?: ToolDef[];
+    governance?: {
+        /** When set, sensitive (write/execute) tools route to this approval audience. */
+        stewardAudience?: string;
+        approvalServices?: string[];
+        /** Belt-and-suspenders catalog allowlist enforced before tool execution (UC stays source of truth). */
+        catalogs?: string[];
+        approvalTtlSeconds?: number;
+        /** Label recorded in lineage for the acting principal (never a token). */
+        principalLabel?: string;
+        /** Sink for audit/lineage records; wire to OTel / onEvent at the app layer. */
+        onLineage?: (record: DatabricksLineageRecord) => void;
+    };
+    /** Lakebase (managed Postgres) connection for durable session/journal state. */
+    lakebase?: {
+        host: string;
+        database: string;
+        user: string;
+        port?: number;
+        ssl?: boolean | {
+            rejectUnauthorized?: boolean;
+        };
+        poolFactory?: LakebasePoolFactory;
+    };
+    /**
+     * Builds a SessionStore from the Lakebase client. Injected so this package stays decoupled from
+     * `@fabric-harness/node` — e.g. `(client) => new PostgresSessionStore({ client })`.
+     */
+    sessionStoreFactory?: (client: LakebaseClient) => SessionStore;
+    /** Mosaic AI Vector Search for RAG. Adds a governed `search` tool and exposes `retriever`. */
+    vectorSearch?: {
+        /** Full index name `catalog.schema.index`. */
+        index: string;
+        /** Column holding the chunk text. */
+        textColumn: string;
+        columns?: string[];
+        idColumn?: string;
+        /** `'text'` (managed-embedding index, default) or `'vector'` (self-managed; requires `embeddingEndpoint`). */
+        queryType?: 'text' | 'vector';
+        /** Serving-endpoint name for query embeddings (required for `queryType: 'vector'`). */
+        embeddingEndpoint?: string;
+        /** Override the search tool name (default `search`). */
+        searchToolName?: string;
+    };
+    /** Add the governed `ai_query` tool (in-warehouse model inference). Requires `warehouseId`. */
+    aiFunctions?: boolean;
+    /** Add the governed Genie tool for natural-language analytics over a Genie space. */
+    genie?: {
+        spaceId: string;
+    };
+    /** Add governed Lakeflow pipeline tools (list/status read; start/stop execute). */
+    lakeflow?: boolean;
+    /** Add the System-Tables consumption tool + expose `bundle.consumption`. Requires `warehouseId`. */
+    consumption?: boolean;
+    /** Add a governed low-latency feature-lookup tool against a Feature Serving endpoint. */
+    featureServing?: {
+        endpoint: string;
+    };
     fetchImpl?: typeof fetch;
 }
-export declare class DatabricksRestClient {
-    private readonly host;
-    private readonly token;
-    private readonly fetchImpl;
-    constructor(options: DatabricksClientOptions);
-    get<T>(path: string, query?: Record<string, string | number | boolean | undefined>): Promise<T>;
-    post<T>(path: string, body?: unknown, query?: Record<string, string | number | boolean | undefined>): Promise<T>;
-    request<T>(method: string, path: string, body?: unknown, query?: Record<string, string | number | boolean | undefined>): Promise<T>;
+export interface DatabricksBundle {
+    /** Rotating token provider shared by the model provider, REST client, and Lakebase client. */
+    identity: DatabricksTokenProvider;
+    modelProvider: ModelProvider;
+    client: DatabricksRestClient;
+    /** Governed Databricks tools (lineage-stamped, catalog-allowlisted). */
+    tools: ToolDef[];
+    /** Approval routing + egress allowlist for the tool set. Merge into the agent's policy. */
+    policy: CapabilityPolicy;
+    lakebase?: LakebaseClient;
+    store?: SessionStore;
+    /** Mount Databricks workspace files as a read-only context source. */
+    workspaceSource: (rootPath: string, options?: DatabricksWorkspaceSourceOptions) => FilesystemSource;
+    /** Vector Search retriever, when `vectorSearch` is configured. */
+    retriever?: Retriever;
+    /** Query-embedding provider, when `vectorSearch.embeddingEndpoint` is configured. */
+    embeddings?: EmbeddingProvider;
+    /** System-Tables consumption reporter, when `consumption` is enabled (needs `warehouseId`). */
+    consumption?: DatabricksConsumption;
 }
-export declare function createDatabricksClient(options: DatabricksClientOptions): DatabricksRestClient;
-export interface DatabricksWaitOptions {
-    pollIntervalMs?: number;
-    timeoutMs?: number;
-}
-export declare function waitForDatabricksRun(client: DatabricksRestClient, runId: number, options?: DatabricksWaitOptions): Promise<Record<string, unknown>>;
-export declare function waitForDatabricksStatement(client: DatabricksRestClient, statementId: string, options?: DatabricksWaitOptions): Promise<Record<string, unknown>>;
-export interface DatabricksSqlToolOptions {
-    warehouseId: string;
-    name?: string;
-    description?: string;
-    waitTimeout?: string;
-    disposition?: 'INLINE' | 'EXTERNAL_LINKS';
-}
-export declare function databricksSqlTool(client: DatabricksRestClient, options: DatabricksSqlToolOptions): ToolDef<{
-    statement: string;
-    catalog?: string;
-    schema?: string;
-}, unknown>;
-export declare function databricksRunJobTool(client: DatabricksRestClient, options?: {
-    name?: string;
-    description?: string;
-}): ToolDef<{
-    jobId: number;
-    notebookParams?: JsonObject;
-    pythonParams?: string[];
-    jarParams?: string[];
-}, unknown>;
-export declare function databricksNotebookTool(client: DatabricksRestClient, options?: {
-    name?: string;
-    description?: string;
-    existingClusterId?: string;
-}): ToolDef<{
-    notebookPath: string;
-    baseParameters?: JsonObject;
-    runName?: string;
-}, unknown>;
-export declare function databricksMlflowLogMetricTool(client: DatabricksRestClient, options?: {
-    name?: string;
-    description?: string;
-}): ToolDef<{
-    runId: string;
-    key: string;
-    value: number;
-    step?: number;
-    timestamp?: number;
-}, unknown>;
-export declare function databricksMlflowLogParamTool(client: DatabricksRestClient, options?: {
-    name?: string;
-    description?: string;
-}): ToolDef<{
-    runId: string;
-    key: string;
-    value: string;
-}, unknown>;
-export declare function unityCatalogTablesTool(client: DatabricksRestClient, options?: {
-    name?: string;
-    description?: string;
-}): ToolDef<{
-    catalog: string;
-    schema: string;
-}, unknown>;
-export interface DatabricksWorkspaceSourceOptions {
-    name?: string;
-    include?: (path: string) => boolean;
-    recursive?: boolean;
-    format?: 'SOURCE' | 'HTML' | 'JUPYTER' | 'DBC';
-}
-export declare function databricksWorkspaceSource(client: DatabricksRestClient, rootPath: string, options?: DatabricksWorkspaceSourceOptions): FilesystemSource;
+/**
+ * One-call wiring for a Databricks-native agent: model serving, a UC principal threaded through
+ * model + data + state, governed tools, an approval/egress policy, and (optionally) Lakebase-backed
+ * durable state. Also registers `databricks/*` + `mosaic-ai/*` model refs. Everything is layered on
+ * Unity Catalog — never a replacement for it.
+ */
+export declare function databricks(config: DatabricksBundleConfig): DatabricksBundle;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAGlG,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,uBAAuB;IAM5C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI/F,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI1G,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CAmB9I;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,oBAAoB,CAE7F;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS7J;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CASzK;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,QAAQ,GAAG,gBAAgB,CAAC;CAC3C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,CAwB7K;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,OAAO,CAAC,CAuBzO;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,CAwBjP;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,CAyBrO;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,CAajM;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,CAAC,CAajL;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;CAChD;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gCAAqC,GAAG,gBAAgB,CAQ1J"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAElJ,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAGlF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAOzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAM9D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC7H,YAAY,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACtO,YAAY,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAE7F,OAAO,EAAE,iCAAiC,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAChG,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC3H,YAAY,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,iBAAiB,CAAC;AAC9J,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAChD,YAAY,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3K,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACpF,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AACjM,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACjG,YAAY,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EAAE,kCAAkC,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,YAAY,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,kCAAkC,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,SAAS,EAAE,mBAAmB,CAAC;IAC/B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE;QACX,iFAAiF;QACjF,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,uGAAuG;QACvG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,0EAA0E;QAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,+EAA+E;QAC/E,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,CAAC;KACvD,CAAC;IACF,gFAAgF;IAChF,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,OAAO,GAAG;YAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACjD,WAAW,CAAC,EAAE,mBAAmB,CAAC;KACnC,CAAC;IACF;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,YAAY,CAAC;IAC/D,8FAA8F;IAC9F,YAAY,CAAC,EAAE;QACb,8CAA8C;QAC9C,KAAK,EAAE,MAAM,CAAC;QACd,qCAAqC;QACrC,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,8GAA8G;QAC9G,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;QAC9B,uFAAuF;QACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,wDAAwD;QACxD,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,+FAA+F;IAC/F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oGAAoG;IACpG,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yFAAyF;IACzF,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8FAA8F;IAC9F,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,wEAAwE;IACxE,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,2FAA2F;IAC3F,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,sEAAsE;IACtE,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gCAAgC,KAAK,gBAAgB,CAAC;IACpG,kEAAkE;IAClE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,qFAAqF;IACrF,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,+FAA+F;IAC/F,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAqE3E"}