@neverinfamous/postgres-mcp 1.0.1

package/dist/codemode/types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * postgres-mcp - Code Mode Types
+ *
+ * Type definitions for the sandboxed code execution environment.
+ */
+import type { ToolGroup } from "../types/index.js";
+/**
+ * Options for sandbox execution
+ */
+export interface SandboxOptions {
+    /** Memory limit in MB (default: 128) */
+    memoryLimitMb?: number;
+    /** Execution timeout in milliseconds (default: 30000) */
+    timeoutMs?: number;
+    /** CPU time limit in milliseconds (default: 10000) */
+    cpuLimitMs?: number;
+}
+/**
+ * Options for the sandbox pool
+ */
+export interface PoolOptions {
+    /** Minimum instances to keep warm (default: 2) */
+    minInstances?: number;
+    /** Maximum instances in pool (default: 10) */
+    maxInstances?: number;
+    /** Idle timeout before disposing instance (default: 60000ms) */
+    idleTimeoutMs?: number;
+}
+/**
+ * Default sandbox configuration
+ */
+export declare const DEFAULT_SANDBOX_OPTIONS: Required<SandboxOptions>;
+/**
+ * Default pool configuration
+ */
+export declare const DEFAULT_POOL_OPTIONS: Required<PoolOptions>;
+/**
+ * Metrics collected during sandbox execution
+ */
+export interface ExecutionMetrics {
+    /** Wall clock time in milliseconds */
+    wallTimeMs: number;
+    /** CPU time consumed in milliseconds */
+    cpuTimeMs: number;
+    /** Peak memory usage in MB */
+    memoryUsedMb: number;
+}
+/**
+ * Result of sandbox code execution
+ */
+export interface SandboxResult {
+    /** Whether execution completed successfully */
+    success: boolean;
+    /** Return value from the code (if successful) */
+    result?: unknown;
+    /** Error message (if failed) */
+    error?: string | undefined;
+    /** Stack trace (if failed) */
+    stack?: string | undefined;
+    /** Execution metrics */
+    metrics: ExecutionMetrics;
+}
+/**
+ * Security configuration for code validation
+ */
+export interface SecurityConfig {
+    /** Maximum code length in bytes (default: 50KB) */
+    maxCodeLength: number;
+    /** Maximum executions per minute per client (default: 60) */
+    maxExecutionsPerMinute: number;
+    /** Maximum result size in bytes (default: 10MB) */
+    maxResultSize: number;
+    /** Patterns to block in code */
+    blockedPatterns: RegExp[];
+}
+/**
+ * Default security configuration
+ */
+export declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
+/**
+ * Validation result from security checks
+ */
+export interface ValidationResult {
+    /** Whether the code passed validation */
+    valid: boolean;
+    /** Validation errors (if any) */
+    errors: string[];
+}
+/**
+ * Execution record for audit logging
+ */
+export interface ExecutionRecord {
+    /** Unique execution ID */
+    id: string;
+    /** Client identifier (for rate limiting) */
+    clientId?: string | undefined;
+    /** Timestamp of execution start */
+    timestamp: Date;
+    /** Code that was executed (truncated for logging) */
+    codePreview: string;
+    /** Execution result */
+    result: SandboxResult;
+    /** Whether code was in readonly mode */
+    readonly: boolean;
+}
+/**
+ * Tool group API interface - each group exposes its tools as methods
+ */
+export interface GroupApi {
+    /** Tool group name */
+    readonly groupName: ToolGroup;
+}
+/**
+ * Options passed to pg_execute_code tool
+ */
+export interface ExecuteCodeOptions {
+    /** TypeScript code to execute */
+    code: string;
+    /** Timeout in milliseconds (max 30000) */
+    timeout?: number;
+    /** Restrict to read-only operations */
+    readonly?: boolean;
+}
+/**
+ * Result returned by pg_execute_code tool
+ */
+export interface ExecuteCodeResult {
+    /** Whether execution succeeded */
+    success: boolean;
+    /** Return value from the code */
+    result?: unknown;
+    /** Error message (if failed) */
+    error?: string;
+    /** Execution metrics */
+    metrics: ExecutionMetrics;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/codemode/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/codemode/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAMnD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAI5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAItD,CAAC;AAMF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAoBrC,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,iCAAiC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAC;IAChB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sBAAsB;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,OAAO,EAAE,gBAAgB,CAAC;CAC3B"}

package/dist/codemode/types.js

@@ -0,0 +1,46 @@
+/**
+ * postgres-mcp - Code Mode Types
+ *
+ * Type definitions for the sandboxed code execution environment.
+ */
+/**
+ * Default sandbox configuration
+ */
+export const DEFAULT_SANDBOX_OPTIONS = {
+    memoryLimitMb: 128,
+    timeoutMs: 30000,
+    cpuLimitMs: 10000,
+};
+/**
+ * Default pool configuration
+ */
+export const DEFAULT_POOL_OPTIONS = {
+    minInstances: 2,
+    maxInstances: 10,
+    idleTimeoutMs: 60000,
+};
+/**
+ * Default security configuration
+ */
+export const DEFAULT_SECURITY_CONFIG = {
+    maxCodeLength: 50 * 1024, // 50KB
+    maxExecutionsPerMinute: 60,
+    maxResultSize: 10 * 1024 * 1024, // 10MB
+    blockedPatterns: [
+        /\brequire\s*\(/, // No require()
+        /\bimport\s*\(/, // No dynamic import()
+        /\bprocess\./, // No process access
+        /\bglobal\./, // No global access
+        /\bglobalThis\./, // No globalThis access
+        /\beval\s*\(/, // No eval()
+        /\bFunction\s*\(/, // No Function constructor
+        /\b__proto__\b/, // No prototype pollution
+        /\bconstructor\.constructor/, // No constructor chaining
+        /\bchild_process/, // No child processes
+        /\bfs\./, // No filesystem
+        /\bnet\./, // No networking
+        /\bhttp\./, // No HTTP
+        /\bhttps\./, // No HTTPS
+    ],
+};
+//# sourceMappingURL=types.js.map

package/dist/codemode/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/codemode/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgCH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA6B;IAC/D,aAAa,EAAE,GAAG;IAClB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IACzD,YAAY,EAAE,CAAC;IACf,YAAY,EAAE,EAAE;IAChB,aAAa,EAAE,KAAK;CACrB,CAAC;AAoDF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO;IACjC,sBAAsB,EAAE,EAAE;IAC1B,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;IACxC,eAAe,EAAE;QACf,gBAAgB,EAAE,eAAe;QACjC,eAAe,EAAE,sBAAsB;QACvC,aAAa,EAAE,oBAAoB;QACnC,YAAY,EAAE,mBAAmB;QACjC,gBAAgB,EAAE,uBAAuB;QACzC,aAAa,EAAE,YAAY;QAC3B,iBAAiB,EAAE,0BAA0B;QAC7C,eAAe,EAAE,yBAAyB;QAC1C,4BAA4B,EAAE,0BAA0B;QACxD,iBAAiB,EAAE,qBAAqB;QACxC,QAAQ,EAAE,gBAAgB;QAC1B,SAAS,EAAE,gBAAgB;QAC3B,UAAU,EAAE,UAAU;QACtB,WAAW,EAAE,WAAW;KACzB;CACF,CAAC"}

package/dist/codemode/worker-sandbox.d.ts

@@ -0,0 +1,82 @@
+/**
+ * postgres-mcp - Code Mode Worker Sandbox
+ *
+ * Enhanced sandboxed execution using worker_threads for process-level isolation.
+ * Provides stronger isolation than vm module by running code in a separate thread
+ * with isolated memory space.
+ *
+ * Features:
+ * - Separate V8 instance per worker thread
+ * - Hard timeout enforcement (worker termination)
+ * - Isolated memory space
+ * - Clean process state on each execution
+ */
+import { type SandboxOptions, type PoolOptions, type SandboxResult } from "./types.js";
+/**
+ * A sandboxed execution context using worker_threads
+ * Provides stronger isolation than vm module with separate V8 instance
+ */
+export declare class WorkerSandbox {
+    private readonly options;
+    private disposed;
+    private constructor();
+    /**
+     * Create a new worker sandbox instance
+     */
+    static create(options?: SandboxOptions): WorkerSandbox;
+    /**
+     * Execute code in a worker thread
+     * Each execution spawns a fresh worker for maximum isolation
+     */
+    execute(code: string, apiBindings: Record<string, unknown>): Promise<SandboxResult>;
+    /**
+     * Serialize API bindings for worker transfer
+     * We can't transfer functions directly, so we send method names
+     */
+    private serializeBindings;
+    /**
+     * Calculate execution metrics
+     */
+    private calculateMetrics;
+    /**
+     * Check if sandbox is healthy
+     */
+    isHealthy(): boolean;
+    /**
+     * Dispose of the sandbox
+     */
+    dispose(): void;
+}
+/**
+ * Pool of worker sandboxes
+ * Unlike VM pool, worker sandboxes are created fresh for each execution
+ * so this pool is simpler (mainly for statistics and control)
+ */
+export declare class WorkerSandboxPool {
+    private readonly options;
+    private readonly sandboxOptions;
+    private activeCount;
+    private disposed;
+    constructor(poolOptions?: PoolOptions, sandboxOptions?: SandboxOptions);
+    /**
+     * Initialize the pool
+     */
+    initialize(): void;
+    /**
+     * Execute code using a worker sandbox
+     */
+    execute(code: string, apiBindings: Record<string, unknown>): Promise<SandboxResult>;
+    /**
+     * Get pool statistics
+     */
+    getStats(): {
+        available: number;
+        inUse: number;
+        max: number;
+    };
+    /**
+     * Dispose of the pool
+     */
+    dispose(): void;
+}
+//# sourceMappingURL=worker-sandbox.d.ts.map

package/dist/codemode/worker-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-sandbox.d.ts","sourceRoot":"","sources":["../../src/codemode/worker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AAMpB;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO;IAIP;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,aAAa;IAKtD;;;OAGG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC;IAyIzB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,OAAO,IAAI,IAAI;CAGhB;AAED;;;;GAIG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAS;gBAEb,WAAW,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,cAAc;IAKtE;;OAEG;IACH,UAAU,IAAI,IAAI;IASlB;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC;IA0BzB;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAQ7D;;OAEG;IACH,OAAO,IAAI,IAAI;CAMhB"}

package/dist/codemode/worker-sandbox.js

@@ -0,0 +1,244 @@
+/**
+ * postgres-mcp - Code Mode Worker Sandbox
+ *
+ * Enhanced sandboxed execution using worker_threads for process-level isolation.
+ * Provides stronger isolation than vm module by running code in a separate thread
+ * with isolated memory space.
+ *
+ * Features:
+ * - Separate V8 instance per worker thread
+ * - Hard timeout enforcement (worker termination)
+ * - Isolated memory space
+ * - Clean process state on each execution
+ */
+import { Worker } from "node:worker_threads";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { logger } from "../utils/logger.js";
+import { DEFAULT_SANDBOX_OPTIONS, DEFAULT_POOL_OPTIONS, } from "./types.js";
+// Get directory for worker script
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const WORKER_SCRIPT_PATH = join(__dirname, "worker-script.js");
+/**
+ * A sandboxed execution context using worker_threads
+ * Provides stronger isolation than vm module with separate V8 instance
+ */
+export class WorkerSandbox {
+    options;
+    disposed = false;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Create a new worker sandbox instance
+     */
+    static create(options) {
+        const opts = { ...DEFAULT_SANDBOX_OPTIONS, ...options };
+        return new WorkerSandbox(opts);
+    }
+    /**
+     * Execute code in a worker thread
+     * Each execution spawns a fresh worker for maximum isolation
+     */
+    async execute(code, apiBindings) {
+        if (this.disposed) {
+            return {
+                success: false,
+                error: "Sandbox has been disposed",
+                metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 },
+            };
+        }
+        const startTime = performance.now();
+        const startMemory = process.memoryUsage().heapUsed;
+        return new Promise((resolve) => {
+            let worker = null;
+            let timeoutId = null;
+            let resolved = false;
+            const cleanup = () => {
+                if (timeoutId) {
+                    clearTimeout(timeoutId);
+                    timeoutId = null;
+                }
+                if (worker) {
+                    worker.terminate().catch(() => {
+                        /* intentionally empty */
+                    });
+                    worker = null;
+                }
+            };
+            const respond = (result) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                cleanup();
+                resolve(result);
+            };
+            try {
+                worker = new Worker(WORKER_SCRIPT_PATH, {
+                    workerData: {
+                        code,
+                        apiBindings: this.serializeBindings(apiBindings),
+                        timeout: this.options.timeoutMs,
+                    },
+                });
+                // Set hard timeout (will kill worker)
+                timeoutId = setTimeout(() => {
+                    const endTime = performance.now();
+                    const endMemory = process.memoryUsage().heapUsed;
+                    respond({
+                        success: false,
+                        error: `Execution timeout: exceeded ${String(this.options.timeoutMs)}ms limit`,
+                        metrics: this.calculateMetrics(startTime, endTime, startMemory, endMemory),
+                    });
+                }, this.options.timeoutMs + 1000); // Extra buffer for cleanup
+                worker.on("message", (result) => {
+                    const endTime = performance.now();
+                    const endMemory = process.memoryUsage().heapUsed;
+                    respond({
+                        success: result.success,
+                        result: result.result,
+                        error: result.error,
+                        stack: result.stack,
+                        metrics: this.calculateMetrics(startTime, endTime, startMemory, endMemory),
+                    });
+                });
+                worker.on("error", (error) => {
+                    const endTime = performance.now();
+                    const endMemory = process.memoryUsage().heapUsed;
+                    respond({
+                        success: false,
+                        error: error.message,
+                        stack: error.stack,
+                        metrics: this.calculateMetrics(startTime, endTime, startMemory, endMemory),
+                    });
+                });
+                worker.on("exit", (exitCode) => {
+                    if (!resolved && exitCode !== 0) {
+                        const endTime = performance.now();
+                        const endMemory = process.memoryUsage().heapUsed;
+                        respond({
+                            success: false,
+                            error: `Worker exited with code ${String(exitCode)}`,
+                            metrics: this.calculateMetrics(startTime, endTime, startMemory, endMemory),
+                        });
+                    }
+                });
+            }
+            catch (error) {
+                const endTime = performance.now();
+                const endMemory = process.memoryUsage().heapUsed;
+                respond({
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                    stack: error instanceof Error ? error.stack : undefined,
+                    metrics: this.calculateMetrics(startTime, endTime, startMemory, endMemory),
+                });
+            }
+        });
+    }
+    /**
+     * Serialize API bindings for worker transfer
+     * We can't transfer functions directly, so we send method names
+     */
+    serializeBindings(bindings) {
+        const serialized = {};
+        for (const [group, methods] of Object.entries(bindings)) {
+            if (typeof methods === "object" && methods !== null) {
+                serialized[group] = Object.keys(methods);
+            }
+        }
+        return serialized;
+    }
+    /**
+     * Calculate execution metrics
+     */
+    calculateMetrics(startTime, endTime, startMemory, endMemory) {
+        return {
+            wallTimeMs: Math.round(endTime - startTime),
+            cpuTimeMs: Math.round(endTime - startTime), // Approximation
+            memoryUsedMb: Math.round(((endMemory - startMemory) / (1024 * 1024)) * 100) / 100,
+        };
+    }
+    /**
+     * Check if sandbox is healthy
+     */
+    isHealthy() {
+        return !this.disposed;
+    }
+    /**
+     * Dispose of the sandbox
+     */
+    dispose() {
+        this.disposed = true;
+    }
+}
+/**
+ * Pool of worker sandboxes
+ * Unlike VM pool, worker sandboxes are created fresh for each execution
+ * so this pool is simpler (mainly for statistics and control)
+ */
+export class WorkerSandboxPool {
+    options;
+    sandboxOptions;
+    activeCount = 0;
+    disposed = false;
+    constructor(poolOptions, sandboxOptions) {
+        this.options = { ...DEFAULT_POOL_OPTIONS, ...poolOptions };
+        this.sandboxOptions = { ...DEFAULT_SANDBOX_OPTIONS, ...sandboxOptions };
+    }
+    /**
+     * Initialize the pool
+     */
+    initialize() {
+        logger.info(`Worker sandbox pool initialized (max: ${String(this.options.maxInstances)} concurrent)`, {
+            module: "CODEMODE",
+        });
+    }
+    /**
+     * Execute code using a worker sandbox
+     */
+    async execute(code, apiBindings) {
+        if (this.disposed) {
+            return {
+                success: false,
+                error: "Pool has been disposed",
+                metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 },
+            };
+        }
+        if (this.activeCount >= this.options.maxInstances) {
+            return {
+                success: false,
+                error: `Worker pool exhausted (max: ${String(this.options.maxInstances)} concurrent)`,
+                metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 },
+            };
+        }
+        this.activeCount++;
+        try {
+            const sandbox = WorkerSandbox.create(this.sandboxOptions);
+            return await sandbox.execute(code, apiBindings);
+        }
+        finally {
+            this.activeCount--;
+        }
+    }
+    /**
+     * Get pool statistics
+     */
+    getStats() {
+        return {
+            available: this.options.maxInstances - this.activeCount,
+            inUse: this.activeCount,
+            max: this.options.maxInstances,
+        };
+    }
+    /**
+     * Dispose of the pool
+     */
+    dispose() {
+        this.disposed = true;
+        logger.info("Worker sandbox pool disposed", {
+            module: "CODEMODE",
+        });
+    }
+}
+//# sourceMappingURL=worker-sandbox.js.map

package/dist/codemode/worker-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-sandbox.js","sourceRoot":"","sources":["../../src/codemode/worker-sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAKrB,MAAM,YAAY,CAAC;AAEpB,kCAAkC;AAClC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,OAAO,aAAa;IACP,OAAO,CAA2B;IAC3C,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAoB,OAAiC;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAM,CAAC,OAAwB;QACpC,MAAM,IAAI,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;QACxD,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,WAAoC;QAEpC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,2BAA2B;gBAClC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC1D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,SAAS,GAA0B,IAAI,CAAC;YAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,SAAS,EAAE,CAAC;oBACd,YAAY,CAAC,SAAS,CAAC,CAAC;oBACxB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;gBACD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAS,EAAE;wBAClC,yBAAyB;oBAC3B,CAAC,CAAC,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,MAAqB,EAAQ,EAAE;gBAC9C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,EAAE;oBACtC,UAAU,EAAE;wBACV,IAAI;wBACJ,WAAW,EAAE,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;wBAChD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;qBAChC;iBACF,CAAC,CAAC;gBAEH,sCAAsC;gBACtC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;oBACjD,OAAO,CAAC;wBACN,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,+BAA+B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU;wBAC9E,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,SAAS,CACV;qBACF,CAAC,CAAC;gBACL,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,2BAA2B;gBAE9D,MAAM,CAAC,EAAE,CACP,SAAS,EACT,CAAC,MAKA,EAAE,EAAE;oBACH,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;oBACjD,OAAO,CAAC;wBACN,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,SAAS,CACV;qBACF,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;oBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;oBACjD,OAAO,CAAC;wBACN,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,KAAK,CAAC,OAAO;wBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,SAAS,CACV;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,QAAgB,EAAE,EAAE;oBACrC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;wBAChC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;wBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;wBACjD,OAAO,CAAC;4BACN,OAAO,EAAE,KAAK;4BACd,KAAK,EAAE,2BAA2B,MAAM,CAAC,QAAQ,CAAC,EAAE;4BACpD,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,SAAS,CACV;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;gBACjD,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBACvD,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAC5B,SAAS,EACT,OAAO,EACP,WAAW,EACX,SAAS,CACV;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,iBAAiB,CACvB,QAAiC;QAEjC,MAAM,UAAU,GAA6B,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACpD,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,gBAAgB,CACtB,SAAiB,EACjB,OAAe,EACf,WAAmB,EACnB,SAAiB;QAEjB,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;YAC3C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,EAAE,gBAAgB;YAC5D,YAAY,EACV,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG;SACtE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAAwB;IAC/B,cAAc,CAA2B;IAClD,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,WAAyB,EAAE,cAA+B;QACpE,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,cAAc,EAAE,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,EACxF;YACE,MAAM,EAAE,UAAmB;SAC5B,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,WAAoC;QAEpC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC1D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+BAA+B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc;gBACrF,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;aAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC1D,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW;YACvD,KAAK,EAAE,IAAI,CAAC,WAAW;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC1C,MAAM,EAAE,UAAmB;SAC5B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/codemode/worker-script.d.ts

@@ -0,0 +1,8 @@
+/**
+ * postgres-mcp - Code Mode Worker Script
+ *
+ * This script runs in a worker thread to execute user code in isolation.
+ * It uses Node.js vm module within the worker for additional sandboxing.
+ */
+export {};
+//# sourceMappingURL=worker-script.d.ts.map

package/dist/codemode/worker-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-script.d.ts","sourceRoot":"","sources":["../../src/codemode/worker-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/codemode/worker-script.js

@@ -0,0 +1,113 @@
+/**
+ * postgres-mcp - Code Mode Worker Script
+ *
+ * This script runs in a worker thread to execute user code in isolation.
+ * It uses Node.js vm module within the worker for additional sandboxing.
+ */
+import { parentPort, workerData } from "node:worker_threads";
+import vm from "node:vm";
+/**
+ * Execute code in a sandboxed vm context within the worker
+ */
+async function executeCode() {
+    const { code, timeout } = workerData;
+    try {
+        // Create minimal sandbox context
+        const logBuffer = [];
+        const sandbox = {
+            console: {
+                log: (...args) => {
+                    logBuffer.push(args
+                        .map((a) => typeof a === "object" && a !== null
+                        ? JSON.stringify(a)
+                        : String(a))
+                        .join(" "));
+                },
+                warn: (...args) => logBuffer.push("[WARN] " + args.map((a) => String(a)).join(" ")),
+                error: (...args) => logBuffer.push("[ERROR] " + args.map((a) => String(a)).join(" ")),
+                info: (...args) => logBuffer.push("[INFO] " + args.map((a) => String(a)).join(" ")),
+            },
+            // Block dangerous globals
+            require: undefined,
+            process: undefined,
+            global: undefined,
+            globalThis: undefined,
+            __dirname: undefined,
+            __filename: undefined,
+            module: undefined,
+            exports: undefined,
+            // Safe built-ins
+            JSON,
+            Math,
+            Date,
+            Array,
+            Object,
+            String,
+            Number,
+            Boolean,
+            Map,
+            Set,
+            Promise,
+            Error,
+            TypeError,
+            RangeError,
+            SyntaxError,
+            // Disabled for security
+            setTimeout: undefined,
+            setInterval: undefined,
+            setImmediate: undefined,
+            // pg API placeholder (populated by main thread via message passing)
+            pg: {},
+        };
+        const context = vm.createContext(sandbox);
+        // Wrap code in async IIFE to support await
+        const wrappedCode = `
+            (async () => {
+                ${code}
+            })();
+        `;
+        // Compile and run with timeout
+        const script = new vm.Script(wrappedCode, {
+            filename: "worker-codemode-script.js",
+        });
+        const result = await script.runInContext(context, {
+            timeout,
+            breakOnSigint: true,
+        });
+        const response = {
+            success: true,
+            result,
+        };
+        parentPort?.postMessage(response);
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        const stack = error instanceof Error ? error.stack : undefined;
+        // Check for timeout
+        if (errorMessage.includes("Script execution timed out")) {
+            const response = {
+                success: false,
+                error: `Execution timeout: exceeded ${String(timeout)}ms limit`,
+                stack,
+            };
+            parentPort?.postMessage(response);
+            return;
+        }
+        const response = {
+            success: false,
+            error: errorMessage,
+            stack,
+        };
+        parentPort?.postMessage(response);
+    }
+}
+// Execute immediately
+executeCode().catch((error) => {
+    const response = {
+        success: false,
+        error: error instanceof Error ? error.message : String(error),
+        stack: error instanceof Error ? error.stack : undefined,
+    };
+    parentPort?.postMessage(response);
+});
+//# sourceMappingURL=worker-script.js.map

package/dist/codemode/worker-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-script.js","sourceRoot":"","sources":["../../src/codemode/worker-script.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,MAAM,SAAS,CAAC;AAezB;;GAEG;AACH,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAwB,CAAC;IAEnD,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC1B,SAAS,CAAC,IAAI,CACZ,IAAI;yBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;wBACjC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;wBACnB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACd;yBACA,IAAI,CAAC,GAAG,CAAC,CACb,CAAC;gBACJ,CAAC;gBACD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAC5B,SAAS,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAC3B,SAAS,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACnE;YACD,0BAA0B;YAC1B,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,iBAAiB;YACjB,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,MAAM;YACN,MAAM;YACN,MAAM;YACN,OAAO;YACP,GAAG;YACH,GAAG;YACH,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,WAAW;YACX,wBAAwB;YACxB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,SAAS;YACtB,YAAY,EAAE,SAAS;YACvB,oEAAoE;YACpE,EAAE,EAAE,EAAE;SACP,CAAC;QAEF,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,2CAA2C;QAC3C,MAAM,WAAW,GAAG;;kBAEN,IAAI;;SAEb,CAAC;QAEN,+BAA+B;QAC/B,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;YACxC,QAAQ,EAAE,2BAA2B;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAO,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;YACjD,OAAO;YACP,aAAa,EAAE,IAAI;SACpB,CAAsB,CAAC;QAExB,MAAM,QAAQ,GAAiB;YAC7B,OAAO,EAAE,IAAI;YACb,MAAM;SACP,CAAC;QAEF,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/D,oBAAoB;QACpB,IAAI,YAAY,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAiB;gBAC7B,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,+BAA+B,MAAM,CAAC,OAAO,CAAC,UAAU;gBAC/D,KAAK;aACN,CAAC;YACF,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAiB;YAC7B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,YAAY;YACnB,KAAK;SACN,CAAC;QAEF,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,sBAAsB;AACtB,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACrC,MAAM,QAAQ,GAAiB;QAC7B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACxD,CAAC;IACF,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC"}