@nifrajs/mcp-db 3.5.0 → 4.0.2

package/dist/internal/pg-lexer.js

@@ -0,0 +1,273 @@
+/**
+ * A Postgres tokenizer for the parser layer of `@nifrajs/mcp-db/postgres`. It is the SECOND layer: the
+ * server already refuses several statements (extended protocol), anything but a query (the cursor),
+ * and writes (the read-only transaction). This layer adds what the server allows but a dev agent must
+ * not do: call a function that reaches outside the query (server files, locks, other sessions,
+ * settings, notifications, another database), or one that runs SQL from a string where the plan check
+ * cannot see it (`query_to_xml`).
+ *
+ * The lexer follows Postgres with `standard_conforming_strings = on`, which the engine sets on every
+ * connection so the server reads string boundaries exactly as this lexer does.
+ */
+const WORD_START = /[A-Za-z_\u0080-￿]/;
+const WORD_PART = /[A-Za-z0-9_$\u0080-￿]/;
+const DOLLAR_TAG = /^\$(?:[A-Za-z_\u0080-￿][A-Za-z0-9_\u0080-￿]*)?\$/;
+/** Tokenize Postgres SQL far enough to see statements, parentheses and function calls. */
+export function lexPostgres(sql) {
+    const tokens = [];
+    let unterminated = false;
+    let unicodeIdentifier = false;
+    let i = 0;
+    const skipString = (escapes) => {
+        i++; // past the opening quote
+        while (i < sql.length) {
+            const char = sql[i];
+            if (escapes && char === "\\") {
+                i += 2;
+                continue;
+            }
+            if (char === "'") {
+                if (sql[i + 1] === "'") {
+                    i += 2;
+                    continue;
+                }
+                i++;
+                return;
+            }
+            i++;
+        }
+        unterminated = true;
+    };
+    while (i < sql.length) {
+        const char = sql.charAt(i);
+        const next = sql[i + 1];
+        if (/\s/.test(char)) {
+            i++;
+        }
+        else if (char === "-" && next === "-") {
+            const end = sql.indexOf("\n", i);
+            i = end === -1 ? sql.length : end + 1;
+        }
+        else if (char === "/" && next === "*") {
+            // Postgres block comments nest.
+            let depth = 1;
+            i += 2;
+            while (i < sql.length && depth > 0) {
+                if (sql[i] === "/" && sql[i + 1] === "*") {
+                    depth++;
+                    i += 2;
+                }
+                else if (sql[i] === "*" && sql[i + 1] === "/") {
+                    depth--;
+                    i += 2;
+                }
+                else
+                    i++;
+            }
+            if (depth > 0)
+                unterminated = true;
+        }
+        else if (char === "'") {
+            skipString(false);
+        }
+        else if ((char === "E" || char === "e") && next === "'") {
+            i++;
+            skipString(true);
+        }
+        else if ((char === "U" || char === "u") && next === "&" && sql[i + 2] === "'") {
+            i += 2;
+            skipString(false);
+        }
+        else if ((char === "U" || char === "u") && next === "&" && sql[i + 2] === '"') {
+            unicodeIdentifier = true;
+            i += 2;
+        }
+        else if ((char === "B" ||
+            char === "b" ||
+            char === "X" ||
+            char === "x" ||
+            char === "N" ||
+            char === "n") &&
+            next === "'") {
+            i++;
+            skipString(false);
+        }
+        else if (char === '"') {
+            const offset = i;
+            let value = "";
+            let closed = false;
+            i++;
+            while (i < sql.length) {
+                if (sql[i] === '"') {
+                    if (sql[i + 1] === '"') {
+                        value += '"';
+                        i += 2;
+                        continue;
+                    }
+                    i++;
+                    closed = true;
+                    break;
+                }
+                value += sql[i];
+                i++;
+            }
+            if (!closed)
+                unterminated = true;
+            tokens.push({ kind: "word", value, bare: false, offset });
+        }
+        else if (char === "$") {
+            const tag = DOLLAR_TAG.exec(sql.slice(i, i + 64))?.[0];
+            if (tag !== undefined) {
+                const end = sql.indexOf(tag, i + tag.length);
+                if (end === -1) {
+                    unterminated = true;
+                    i = sql.length;
+                }
+                else
+                    i = end + tag.length;
+            }
+            else if (next !== undefined && next >= "0" && next <= "9") {
+                const start = i;
+                i++;
+                while (i < sql.length && /[0-9]/.test(sql.charAt(i)))
+                    i++;
+                tokens.push({ kind: "param", value: sql.slice(start, i), bare: false, offset: start });
+            }
+            else {
+                tokens.push({ kind: "punct", value: char, bare: false, offset: i });
+                i++;
+            }
+        }
+        else if (WORD_START.test(char)) {
+            const start = i;
+            while (i < sql.length && WORD_PART.test(sql.charAt(i)))
+                i++;
+            tokens.push({ kind: "word", value: sql.slice(start, i), bare: true, offset: start });
+        }
+        else if ((char >= "0" && char <= "9") ||
+            (char === "." && next !== undefined && /[0-9]/.test(next))) {
+            // Digits only: a letter right after a number starts a new word, so `1pg_sleep(` still shows
+            // the call (older servers lex it the same way).
+            const start = i;
+            while (i < sql.length && /[0-9_.]/.test(sql.charAt(i)))
+                i++;
+            if ((sql[i] === "e" || sql[i] === "E") && /[0-9+-]/.test(sql[i + 1] ?? "")) {
+                i += 2;
+                while (i < sql.length && /[0-9]/.test(sql.charAt(i)))
+                    i++;
+            }
+            tokens.push({ kind: "number", value: sql.slice(start, i), bare: false, offset: start });
+        }
+        else {
+            tokens.push({ kind: "punct", value: char, bare: false, offset: i });
+            i++;
+        }
+    }
+    return { tokens, unterminated, unicodeIdentifier };
+}
+/**
+ * Function-name prefixes the parser layer refuses. Each reaches outside a read-only query or runs SQL
+ * from a string the plan check cannot see; the server lets a read-only transaction call most of them.
+ */
+export const DENIED_FUNCTION_PREFIXES = [
+    "dblink",
+    "lo_",
+    "pg_read_",
+    "pg_ls_",
+    "pg_stat_file",
+    "pg_terminate_backend",
+    "pg_cancel_backend",
+    "pg_reload_conf",
+    "set_config",
+    "pg_advisory",
+    "pg_try_advisory",
+    "pg_notify",
+    "query_to_xml",
+    "table_to_xml",
+    "cursor_to_xml",
+    "schema_to_xml",
+    "database_to_xml",
+    "pg_file_",
+    "pg_logical_emit_message",
+    "pg_stat_reset",
+    "pg_stat_get_",
+    "pg_switch_wal",
+    "pg_create_restore_point",
+    "pg_promote",
+    "pg_rotate_logfile",
+    "nextval",
+    "setval",
+];
+const READ_HEADS = new Set(["select", "with", "values", "table"]);
+const LOCKING_STRENGTHS = new Set(["update", "share", "no", "key"]);
+/**
+ * Lint one statement: a single read-only query with balanced parentheses, no unicode-escaped
+ * identifier and no denied function call. `undefined` when it passes.
+ */
+export function lintPostgres(sql) {
+    const { tokens, unterminated, unicodeIdentifier } = lexPostgres(sql);
+    if (unterminated) {
+        return { kind: "statement", message: "the statement has an unterminated string or comment" };
+    }
+    if (unicodeIdentifier) {
+        return { kind: "statement", message: 'unicode-escaped identifiers (U&"...") are not accepted' };
+    }
+    const terminator = tokens.findIndex((token) => token.kind === "punct" && token.value === ";");
+    if (terminator !== -1 && tokens.slice(terminator + 1).length > 0) {
+        return { kind: "statement", message: "only a single statement is allowed" };
+    }
+    const body = terminator === -1 ? tokens : tokens.slice(0, terminator);
+    const head = body.find((token) => !(token.kind === "punct" && token.value === "("));
+    if (head === undefined)
+        return { kind: "statement", message: "empty query" };
+    if (!head.bare || !READ_HEADS.has(head.value.toLowerCase())) {
+        return {
+            kind: "statement",
+            message: `only a read-only query (SELECT, WITH, VALUES or TABLE) is allowed, not ${head.value.toUpperCase()}`,
+        };
+    }
+    let depth = 0;
+    for (const [index, token] of body.entries()) {
+        if (token.kind !== "punct" && token.kind !== "word")
+            continue;
+        const next = body[index + 1];
+        if (token.bare &&
+            token.value.toLowerCase() === "for" &&
+            next?.bare === true &&
+            LOCKING_STRENGTHS.has(next.value.toLowerCase())) {
+            return {
+                kind: "statement",
+                message: "row-locking clauses (FOR UPDATE, FOR SHARE) are refused: they take locks",
+            };
+        }
+        if (token.value === "(" && token.kind === "punct") {
+            depth++;
+            const callee = body[index - 1];
+            if (callee?.kind === "word") {
+                const name = callee.value.toLowerCase();
+                if (DENIED_FUNCTION_PREFIXES.some((prefix) => name.startsWith(prefix))) {
+                    return {
+                        kind: "function",
+                        name,
+                        message: `${name}() is refused: it reaches outside a read-only query`,
+                    };
+                }
+            }
+        }
+        else if (token.value === ")" && token.kind === "punct") {
+            depth--;
+            if (depth < 0) {
+                return { kind: "statement", message: "the statement closes a parenthesis it never opened" };
+            }
+        }
+    }
+    if (depth !== 0)
+        return { kind: "statement", message: "the statement leaves a parenthesis open" };
+    return undefined;
+}
+/** The statement without a final `;` (comments after it included), ready to wrap in a subquery. */
+export function withoutTerminator(sql) {
+    const last = lexPostgres(sql).tokens.at(-1);
+    return last?.kind === "punct" && last.value === ";" ? sql.slice(0, last.offset) : sql;
+}
+//# sourceMappingURL=pg-lexer.js.map

package/dist/internal/pg-lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-lexer.js","sourceRoot":"","sources":["../../src/internal/pg-lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqBH,MAAM,UAAU,GAAG,mBAAmB,CAAA;AACtC,MAAM,SAAS,GAAG,uBAAuB,CAAA;AACzC,MAAM,UAAU,GAAG,kDAAkD,CAAA;AAErE,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAc,EAAE,CAAA;IAC5B,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAQ,EAAE;QAC5C,CAAC,EAAE,CAAA,CAAC,yBAAyB;QAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,OAAO,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7B,CAAC,IAAI,CAAC,CAAA;gBACN,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,CAAC,IAAI,CAAC,CAAA;oBACN,SAAQ;gBACV,CAAC;gBACD,CAAC,EAAE,CAAA;gBACH,OAAM;YACR,CAAC;YACD,CAAC,EAAE,CAAA;QACL,CAAC;QACD,YAAY,GAAG,IAAI,CAAA;IACrB,CAAC,CAAA;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,CAAC,EAAE,CAAA;QACL,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAChC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;QACvC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxC,gCAAgC;YAChC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,CAAC,IAAI,CAAC,CAAA;YACN,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACzC,KAAK,EAAE,CAAA;oBACP,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;qBAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAChD,KAAK,EAAE,CAAA;oBACP,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;;oBAAM,CAAC,EAAE,CAAA;YACZ,CAAC;YACD,IAAI,KAAK,GAAG,CAAC;gBAAE,YAAY,GAAG,IAAI,CAAA;QACpC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;aAAM,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1D,CAAC,EAAE,CAAA;YACH,UAAU,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;aAAM,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAChF,CAAC,IAAI,CAAC,CAAA;YACN,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;aAAM,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAChF,iBAAiB,GAAG,IAAI,CAAA;YACxB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IACL,CAAC,IAAI,KAAK,GAAG;YACX,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,GAAG,CAAC;YACf,IAAI,KAAK,GAAG,EACZ,CAAC;YACD,CAAC,EAAE,CAAA;YACH,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,CAAC,CAAA;YAChB,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACtB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvB,KAAK,IAAI,GAAG,CAAA;wBACZ,CAAC,IAAI,CAAC,CAAA;wBACN,SAAQ;oBACV,CAAC;oBACD,CAAC,EAAE,CAAA;oBACH,MAAM,GAAG,IAAI,CAAA;oBACb,MAAK;gBACP,CAAC;gBACD,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;gBACf,CAAC,EAAE,CAAA;YACL,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,YAAY,GAAG,IAAI,CAAA;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACtD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;gBAC5C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,YAAY,GAAG,IAAI,CAAA;oBACnB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAA;gBAChB,CAAC;;oBAAM,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;YAC7B,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;gBAC5D,MAAM,KAAK,GAAG,CAAC,CAAA;gBACf,CAAC,EAAE,CAAA;gBACH,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAA;gBACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;YACxF,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;gBACnE,CAAC,EAAE,CAAA;YACL,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAA;YAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACtF,CAAC;aAAM,IACL,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC;YAC5B,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAC1D,CAAC;YACD,4FAA4F;YAC5F,gDAAgD;YAChD,MAAM,KAAK,GAAG,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAA;YAC3D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3E,CAAC,IAAI,CAAC,CAAA;gBACN,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAAE,CAAC,EAAE,CAAA;YAC3D,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACzF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;YACnE,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,QAAQ;IACR,KAAK;IACL,UAAU;IACV,QAAQ;IACR,cAAc;IACd,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,cAAc;IACd,cAAc;IACd,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,UAAU;IACV,yBAAyB;IACzB,eAAe;IACf,cAAc;IACd,eAAe;IACf,yBAAyB;IACzB,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,QAAQ;CACT,CAAA;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAOnE;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACpE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAA;IAC9F,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAA;IACjG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;IAC7F,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAA;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAA;IACnF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IAC5E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,0EAA0E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;SAC9G,CAAA;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAC5B,IACE,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK;YACnC,IAAI,EAAE,IAAI,KAAK,IAAI;YACnB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAC/C,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0EAA0E;aACpF,CAAA;QACH,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClD,KAAK,EAAE,CAAA;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC9B,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;gBACvC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACvE,OAAO;wBACL,IAAI,EAAE,UAAU;wBAChB,IAAI;wBACJ,OAAO,EAAE,GAAG,IAAI,qDAAqD;qBACtE,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACzD,KAAK,EAAE,CAAA;YACP,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAA;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAA;IACjG,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,OAAO,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AACvF,CAAC"}

package/dist/internal/shared.d.ts

@@ -0,0 +1,161 @@
+/**
+ * What both database engines share and the MCP layer reuses: the refusal codes, the SQLite statement
+ * gates, the caps and the JSON-safe result shape. No runtime imports, so `@nifrajs/mcp-db` itself
+ * stays free of `node:*` modules; `engine.ts` re-exports all of it.
+ */
+/** The structural slice of `bun:sqlite`'s `Database` this package needs. */
+export interface SqliteDatabaseLike {
+    /** Prepare a statement; `all` runs it and returns row objects. */
+    prepare(sql: string): {
+        all(...params: unknown[]): unknown[];
+    };
+    /** Execute a statement for its side effect (used only for `PRAGMA query_only`). */
+    run(sql: string): unknown;
+    /** Optional path this database was opened from; a file-backed one can be reopened read-only in a
+     * worker so `run_query` runs off the serving connection. `:memory:` and the empty anonymous
+     * database cannot, and run in process. */
+    readonly filename?: string;
+}
+/** Every reason a database call is refused or fails, as a stable code. */
+export type DbRefusalCode = "NIFRA_DB_NOT_DECLARED" | "NIFRA_DB_CONFIG" | "NIFRA_DB_OUTSIDE_ROOT" | "NIFRA_DB_REMOTE_HOST" | "NIFRA_DB_SUPERUSER" | "NIFRA_DB_EXTENSION" | "NIFRA_DB_QUERY_OFF" | "NIFRA_DB_WRITE_REFUSED" | "NIFRA_DB_FUNCTION_REFUSED" | "NIFRA_DB_TABLE_EXCLUDED" | "NIFRA_DB_COLUMN_REFUSED" | "NIFRA_DB_TIMEOUT" | "NIFRA_DB_QUERY_FAILED" | "NIFRA_DB_DRIVER";
+/** A refused or failed call: what happened, the fix, and its anchor under `https://nifra.dev/docs/`. */
+export interface DbRefusal {
+    readonly code: DbRefusalCode;
+    readonly message: string;
+    readonly fix: string;
+    readonly docsAnchor: string;
+}
+/** Build a {@link DbRefusal} for `code` with its fix and docs anchor. */
+export declare function dbRefusal(code: DbRefusalCode, message: string): DbRefusal;
+/** True for a value {@link dbRefusal} built. */
+export declare function isDbRefusal(value: unknown): value is DbRefusal;
+/** Reject multi-statement input: allow one terminator only when it is the final character. */
+/**
+ * Names a statement defines as CTEs, column lists included (`WITH RECURSIVE c(x) AS (...)`), which
+ * {@link gateSqliteStatement}'s relation scan does not see past. Only for callers whose own check of
+ * the compiled statement is the authority on real tables: a CTE that reads a table still opens it.
+ */
+export declare function sqliteCteNames(sql: string): string[];
+/** The outcome of {@link gateSqliteStatement}. A refusal's `text` is the message `run_query` returns. */
+export type SqliteGate = {
+    readonly ok: true;
+    readonly query: string;
+} | {
+    readonly ok: false;
+    readonly reason: "empty" | "multiple" | "not-read" | "unexposed";
+    readonly text: string;
+    readonly relation?: string;
+};
+/**
+ * Gate one statement before SQLite sees it: non-empty, a single statement, SELECT/WITH only, and every
+ * relation it names after `FROM`/`JOIN` exposed. Returns the statement without its terminator, ready
+ * to wrap. Relation names are checked here as well as in the plan because SQLite's plan names an
+ * alias as the scan target (`users AS habits` plans as `SCAN habits`).
+ */
+export declare function gateSqliteStatement(input: string, exposed: (relation: string) => boolean): SqliteGate;
+/**
+ * The first relation an `EXPLAIN QUERY PLAN` result scans or searches that `exposed` rejects, as the
+ * plan spells it, or `undefined` when every scanned relation is exposed.
+ */
+export declare function unexposedPlanRelation(planRows: readonly {
+    readonly detail?: unknown;
+}[], exposed: (relation: string) => boolean): string | undefined;
+/** Wrap a gated query so SQLite materializes at most one row beyond `maxRows`. */
+export declare function boundedSqliteQuery(query: string, maxRows: number): string;
+/** Wrap a gated query to count its rows (re-executes it). */
+export declare function countSqliteQuery(query: string): string;
+/**
+ * Serialize `build(shown)` for the largest `shown <= count` (halving from `count`) whose JSON fits
+ * `maxBytes`. `undefined` when even `build(0)` does not fit.
+ */
+export declare function fitToBytes<T>(count: number, build: (shown: number) => T, maxBytes: number): {
+    readonly value: T;
+    readonly serialized: string;
+    readonly shown: number;
+} | undefined;
+/** What keeps secrets out of a result: which columns to mask, and how to scrub text. */
+export interface DbRedaction {
+    /** True for a column (or a key inside a JSON value) whose values must not leave the process. */
+    readonly column?: (name: string) => boolean;
+    /** Scrub one string value: key formats, tokens, environment values. */
+    readonly text?: (value: string) => string;
+}
+/** The value a masked cell carries. */
+export declare const REDACTED_CELL = "[redacted]";
+/**
+ * One database value as JSON: bytes become `<n bytes>`, a bigint outside the safe range a string,
+ * a date an ISO string, a non-finite number a string. Strings go through `redaction.text`, and a
+ * key inside a JSON value that `redaction.column` matches is masked.
+ */
+export declare function toJsonCell(value: unknown, redaction?: DbRedaction, depth?: number): unknown;
+/** Options for {@link shapeRows}. */
+export interface ShapeRowsOptions {
+    readonly maxRows: number;
+    readonly maxResultBytes: number;
+    readonly redaction?: DbRedaction;
+}
+/** Rows ready to leave the process: capped, masked and JSON-safe. */
+export interface DbRows {
+    readonly columns: readonly string[];
+    readonly rows: readonly (readonly unknown[])[];
+    readonly rowCount: number;
+    /** More rows exist than `rows` carries (the row cap or the byte cap cut them). */
+    readonly truncated: boolean;
+    /** Columns whose values were replaced by {@link REDACTED_CELL}. */
+    readonly redactedColumns: readonly string[];
+}
+/**
+ * Cap, mask and normalize rows fetched as arrays (at most `maxRows + 1`, so truncation is known
+ * without counting). The byte cap halves the row count until the JSON fits.
+ */
+export declare function shapeRows(columns: readonly string[], rows: readonly (readonly unknown[])[], options: ShapeRowsOptions): DbRows;
+/** A plan for a statement, as the engine reports it. */
+export interface DbPlan {
+    readonly plan: unknown;
+    /** True when the plan carries actual timings (Postgres `EXPLAIN ANALYZE`). */
+    readonly analyzed: boolean;
+    readonly truncated: boolean;
+}
+/** A column in {@link DbSchemaTable}. */
+export interface DbSchemaColumn {
+    readonly name: string;
+    readonly type: string;
+    readonly nullable: boolean;
+    readonly default: string | null;
+    readonly primaryKey: boolean;
+    /** Query results mask this column's values. */
+    readonly redacted: boolean;
+}
+/** A foreign key in {@link DbSchemaTable}. */
+export interface DbSchemaForeignKey {
+    readonly columns: readonly string[];
+    readonly references: {
+        readonly schema?: string;
+        readonly table: string;
+        readonly columns: readonly string[];
+    };
+}
+/** An index in {@link DbSchemaTable}. */
+export interface DbSchemaIndex {
+    readonly name: string;
+    readonly columns: readonly string[];
+    readonly unique: boolean;
+}
+/** One exposed table or view. */
+export interface DbSchemaTable {
+    readonly schema?: string;
+    readonly name: string;
+    readonly kind: "table" | "view" | "materialized view" | "foreign table" | "partitioned table";
+    /** Rows, estimated by the engine's statistics; `null` when it keeps none. */
+    readonly rowEstimate: number | null;
+    readonly columns: readonly DbSchemaColumn[];
+    readonly foreignKeys: readonly DbSchemaForeignKey[];
+    readonly indexes: readonly DbSchemaIndex[];
+}
+/** The exposed schema, built only from catalog queries the engine writes itself. */
+export interface DbSchemaReport {
+    readonly tables: readonly DbSchemaTable[];
+    /** Relations left out: named in `exclude`, or (Postgres) inheriting from or reading one. */
+    readonly excludedCount: number;
+}
+//# sourceMappingURL=shared.d.ts.map

package/dist/internal/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/internal/shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAA;KAAE,CAAA;IAC9D,mFAAmF;IACnF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB;;8CAE0C;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAMD,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GACrB,uBAAuB,GACvB,iBAAiB,GACjB,uBAAuB,GACvB,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,2BAA2B,GAC3B,yBAAyB,GACzB,yBAAyB,GACzB,kBAAkB,GAClB,uBAAuB,GACvB,iBAAiB,CAAA;AAErB,wGAAwG;AACxG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAgCD,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAUzE;AAED,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAU9D;AA+LD,8FAA8F;AAC9F;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBpD;AA0GD,yGAAyG;AACzG,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAA;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACrC,UAAU,CAyBZ;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,EAClD,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACrC,MAAM,GAAG,SAAS,CAwBpB;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD;AAMD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,EAC3B,QAAQ,EAAE,MAAM,GACf;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYxF;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1C;AAED,uCAAuC;AACvC,eAAO,MAAM,aAAa,eAAe,CAAA;AAMzC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,GAAE,WAAgB,EAAE,KAAK,SAAI,GAAG,OAAO,CA+B1F;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;CACjC;AAED,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,CAAC,EAAE,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,EAAE,SAAS,CAAC,SAAS,OAAO,EAAE,CAAC,EAAE,EACrC,OAAO,EAAE,gBAAgB,GACxB,MAAM,CA0BR;AAED,wDAAwD;AACxD,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KACpC,CAAA;CACF;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,mBAAmB,GAAG,eAAe,GAAG,mBAAmB,CAAA;IAC7F,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;CAC3C;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAA;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B"}