@raytio/mcp-server 3.1.1 → 3.4.0

package/dist/generated-reads/query-builder.js

@@ -0,0 +1,240 @@
+/**
+ * PostgREST query builder for the schema-driven bounded read framework.
+ *
+ * The builder is the single choke point that turns caller-supplied
+ * filter/order/select/pagination input into a validated PostgREST URL.
+ * Every value that could influence the outbound URL is checked against
+ * the resource's declared capability allowlists BEFORE it is placed in
+ * the query — an unknown filter field, an unsupported operator, an
+ * unlisted order field, or a bogus select column is a hard input error,
+ * not something we silently forward.
+ *
+ * Safety contract, enforced here so the generated tools never have to
+ * hand-write it:
+ *
+ *  - Endpoint is fixed to the resource's `public_endpoint`; callers
+ *    cannot influence it.
+ *  - `select` is either the full field list or a caller-provided subset,
+ *    always constrained to declared fields. No dotted paths, no
+ *    parentheses — so no embedded resource traversal
+ *    (`select=id,foo(bar)`).
+ *  - Filters are `{field, op, value(s)}` — the operator is compared
+ *    against `filter_capabilities.supported_operators`, the field
+ *    against `filter_capabilities.filterable_fields`.
+ *  - `order` is `{field, direction}` — the field must be in
+ *    `order_capabilities.orderable_fields`; direction is `asc` | `desc`;
+ *    optional `nulls` is `first` | `last`.
+ *  - `limit` is clamped to {@link MAX_LIMIT} (200); `offset` must be
+ *    non-negative. Every response advertises `next_offset` so callers
+ *    cannot accidentally issue an unbounded scan.
+ */
+import { isSensitiveField } from './guardrails.js';
+/** Server-side ceiling. No caller can ask for more rows per page. */
+export const MAX_LIMIT = 200;
+/** Default page size when the caller does not supply one. */
+export const DEFAULT_LIMIT = 50;
+/** Direction values PostgREST accepts on an `order` clause. */
+export const ORDER_DIRECTIONS = ['asc', 'desc'];
+/** Nulls-placement modifiers PostgREST accepts on an `order` clause. */
+export const ORDER_NULLS = ['first', 'last'];
+export class QueryBuilderError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'QueryBuilderError';
+    }
+}
+/**
+ * Field names must be simple PostgREST-safe identifiers. This blocks
+ * dotted traversal, embedded resources, cast operators, and quoted
+ * relations from ever reaching the wire, even if the same string
+ * accidentally slipped into an allowlist.
+ */
+const FIELD_NAME_RE = /^[a-z_][a-z0-9_]*$/i;
+function assertSimpleFieldName(field, where) {
+    if (!FIELD_NAME_RE.test(field)) {
+        throw new QueryBuilderError(`${where} field "${field}" is not a simple identifier (dotted traversal / embedding is not supported).`);
+    }
+}
+function resourceFieldNames(resource) {
+    return resource.fields.map((f) => f.name);
+}
+function assertAllowedField(field, allowed, where) {
+    assertSimpleFieldName(field, where);
+    if (isSensitiveField(field)) {
+        // Belt-and-braces: even if a caller's allowlist includes a
+        // secret-shaped name (e.g. sensitive resource opted in via
+        // `includeSensitive`), the field must never reach the wire.
+        throw new QueryBuilderError(`${where} field "${field}" is redacted by the sensitive-field guardrail and cannot be requested.`);
+    }
+    if (!allowed.includes(field)) {
+        throw new QueryBuilderError(`${where} field "${field}" is not in the resource allowlist.`);
+    }
+}
+function assertAllowedOperator(op, supported) {
+    if (!/^[a-z]+$/.test(op)) {
+        throw new QueryBuilderError(`Filter operator "${op}" is not a lowercase identifier.`);
+    }
+    if (!supported.includes(op)) {
+        throw new QueryBuilderError(`Filter operator "${op}" is not supported by this resource.`);
+    }
+}
+function encodeScalar(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new QueryBuilderError(`Non-finite number in filter value: ${String(value)}`);
+        }
+        return String(value);
+    }
+    if (typeof value === 'string') {
+        // PostgREST treats `.` and `,` as syntactic in the value position.
+        // Wrap in double-quotes when the raw value could confuse the parser.
+        if (/[.,()"]/.test(value)) {
+            return `"${value.replace(/"/g, '""')}"`;
+        }
+        return value;
+    }
+    throw new QueryBuilderError(`Unsupported filter value type: ${typeof value}`);
+}
+function encodeFilterValue(clause) {
+    if (clause.op === 'in') {
+        if (!Array.isArray(clause.values) || clause.values.length === 0) {
+            throw new QueryBuilderError('`in` filter requires a non-empty `values` array.');
+        }
+        return `in.(${clause.values.map(encodeScalar).join(',')})`;
+    }
+    if (clause.values !== undefined) {
+        throw new QueryBuilderError(`Filter op "${clause.op}" takes a single \`value\`; \`values\` is only for \`in\`.`);
+    }
+    if (clause.value === undefined) {
+        throw new QueryBuilderError(`Filter op "${clause.op}" requires a \`value\`.`);
+    }
+    if (clause.op === 'is') {
+        // PostgREST `is` allows only null / true / false / unknown — enforce.
+        const literals = new Set(['null', 'true', 'false', 'unknown']);
+        const encoded = encodeScalar(clause.value);
+        if (!literals.has(encoded)) {
+            throw new QueryBuilderError(`\`is\` filter accepts only null/true/false/unknown; got ${encoded}.`);
+        }
+        return `is.${encoded}`;
+    }
+    return `${clause.op}.${encodeScalar(clause.value)}`;
+}
+function normaliseLimit(input) {
+    const raw = input ?? DEFAULT_LIMIT;
+    if (!Number.isInteger(raw) || raw <= 0) {
+        throw new QueryBuilderError(`limit must be a positive integer; got ${raw}.`);
+    }
+    return Math.min(raw, MAX_LIMIT);
+}
+function normaliseOffset(input) {
+    const raw = input ?? 0;
+    if (!Number.isInteger(raw) || raw < 0) {
+        throw new QueryBuilderError(`offset must be a non-negative integer; got ${raw}.`);
+    }
+    return raw;
+}
+function buildSelectValue(select, resource) {
+    const allowed = resourceFieldNames(resource);
+    // Drop sensitive-looking columns from the default projection so a
+    // caller that omits `select` never lands on a redacted field. When a
+    // caller supplies an explicit `select`, assertAllowedField rejects any
+    // sensitive name outright — the two paths converge on the same rule.
+    const visible = allowed.filter((n) => !isSensitiveField(n));
+    if (!select || select.length === 0) {
+        return visible.join(',');
+    }
+    const seen = new Set();
+    const out = [];
+    for (const field of select) {
+        assertAllowedField(field, allowed, 'select');
+        if (seen.has(field))
+            continue;
+        seen.add(field);
+        out.push(field);
+    }
+    return out.join(',');
+}
+function buildOrderValue(order, resource) {
+    if (!order || order.length === 0)
+        return undefined;
+    const allowed = resource.order_capabilities.orderable_fields;
+    const parts = [];
+    for (const clause of order) {
+        assertAllowedField(clause.field, allowed, 'order');
+        const direction = clause.direction ?? 'asc';
+        if (!ORDER_DIRECTIONS.includes(direction)) {
+            throw new QueryBuilderError(`Order direction "${direction}" must be one of: ${ORDER_DIRECTIONS.join(', ')}.`);
+        }
+        let part = `${clause.field}.${direction}`;
+        if (clause.nulls !== undefined) {
+            if (!ORDER_NULLS.includes(clause.nulls)) {
+                throw new QueryBuilderError(`Order nulls "${clause.nulls}" must be one of: ${ORDER_NULLS.join(', ')}.`);
+            }
+            part += `.nulls${clause.nulls}`;
+        }
+        parts.push(part);
+    }
+    return parts.join(',');
+}
+/**
+ * Build a validated PostgREST list-query. Throws {@link QueryBuilderError}
+ * on any input that would breach the resource's declared safety envelope.
+ */
+export function buildListQuery(resource, input) {
+    const query = {};
+    query.select = buildSelectValue(input.select, resource);
+    if (input.filters) {
+        const filterable = resource.filter_capabilities.filterable_fields;
+        const operators = resource.filter_capabilities.supported_operators;
+        for (const clause of input.filters) {
+            assertAllowedField(clause.field, filterable, 'filter');
+            assertAllowedOperator(clause.op, operators);
+            const encoded = encodeFilterValue(clause);
+            // Multiple filters on the same field are permitted (e.g. gt + lt).
+            // We rely on the api-client's URLSearchParams encoder to preserve
+            // insertion order for repeated keys, but PostgREST is order-agnostic.
+            const existing = query[clause.field];
+            query[clause.field] = existing === undefined ? encoded : `${existing},${encoded}`;
+        }
+    }
+    const orderValue = buildOrderValue(input.order, resource);
+    if (orderValue !== undefined) {
+        query.order = orderValue;
+    }
+    const limit = normaliseLimit(input.limit);
+    const offset = normaliseOffset(input.offset);
+    query.limit = String(limit);
+    if (offset > 0)
+        query.offset = String(offset);
+    return { path: resource.public_endpoint, query, limit, offset };
+}
+/**
+ * Build a validated PostgREST get-by-primary-key query. Resources with
+ * a composite primary key are not supported here — the caller must check
+ * {@link isSingletonPrimaryKey} before invoking.
+ */
+export function buildGetQuery(resource, input) {
+    if (!isSingletonPrimaryKey(resource)) {
+        throw new QueryBuilderError(`Resource "${resource.resource_id}" has no scalar primary key; get-by-id is not supported.`);
+    }
+    const pkColumn = resource.primary_key;
+    if (typeof input.id !== 'string' || input.id.length === 0) {
+        throw new QueryBuilderError('`id` must be a non-empty string.');
+    }
+    const select = buildSelectValue(input.select, resource);
+    const query = {
+        select,
+        [pkColumn]: `eq.${encodeScalar(input.id)}`,
+        limit: '1',
+    };
+    return { path: resource.public_endpoint, query, limit: 1, offset: 0 };
+}
+/** `true` iff the resource's primary key is a single scalar column. */
+export function isSingletonPrimaryKey(resource) {
+    return typeof resource.primary_key === 'string' && resource.primary_key.length > 0;
+}
+//# sourceMappingURL=query-builder.js.map

package/dist/generated-reads/query-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-builder.js","sourceRoot":"","sources":["../../src/generated-reads/query-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAC7B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,CAAU,CAAC;AAGzD,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAiDtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAE5C,SAAS,qBAAqB,CAAC,KAAa,EAAE,KAAa;IACzD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,WAAW,KAAK,+EAA+E,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAyB;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,OAA0B,EAC1B,KAAa;IAEb,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,2DAA2D;QAC3D,2DAA2D;QAC3D,4DAA4D;QAC5D,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,WAAW,KAAK,yEAAyE,CAClG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CACzB,GAAG,KAAK,WAAW,KAAK,qCAAqC,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,EAAU,EACV,SAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EAAE,sCAAsC,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAuC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,OAAO,KAAK,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,cAAc,MAAM,CAAC,EAAE,4DAA4D,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CAAC,cAAc,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,2DAA2D,OAAO,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,GAAG,GAAG,KAAK,IAAI,aAAa,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,GAAG,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA4B,EAC5B,QAAyB;IAEzB,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,kEAAkE;IAClE,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CAAC,KAAgC,EAAE,QAAyB;IAClF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,SAAS,qBAAqB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,MAAM,CAAC,KAAK,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,KAAqB;IAErB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAExD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;QACnE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvD,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1C,mEAAmE;YACnE,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB,EACzB,KAAoB;IAEpB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CACzB,aAAa,QAAQ,CAAC,WAAW,0DAA0D,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAqB,CAAC;IAChD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,KAAK,GAA2B;QACpC,MAAM;QACN,CAAC,QAAQ,CAAC,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QAC1C,KAAK,EAAE,GAAG;KACX,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,OAAO,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;AACrF,CAAC"}

package/dist/generated-reads/resource-tools.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Factory that turns one pinned {@link PersistResource} into the three
+ * generated read tools:
+ *
+ *   `<resource_id>_describe` — no-args tool that returns the resource
+ *     metadata (fields, filter/order allowlists, primary key, permission,
+ *     sensitivity, side-effect markers, allowed CRUD operations).
+ *
+ *   `<resource_id>_list` — bounded list/search. Allowed filters, order
+ *     fields, and select subset are derived from the same contract; the
+ *     query builder enforces the safety envelope before any HTTP call.
+ *
+ *   `<resource_id>_get` — get-by-primary-key. Omitted for resources with
+ *     no scalar primary key.
+ *
+ * Every generated tool declares its capability requirement from the
+ * resource's `permission.resource_group` / `permission.resource_name`
+ * at `SELECT@OWN_RECORDS`. The describe tool declares no capability —
+ * metadata is safe to advertise even to callers without SELECT rights,
+ * but returns a fixed shape the caller can plan against.
+ *
+ * Tools returned by this factory are pure functions of the input
+ * resource. Two calls with equal input produce byte-for-byte identical
+ * `name`, `description`, and JSON-Schema output — the deterministic-
+ * metadata acceptance criterion for WI-0003500.
+ */
+import type { PersistResource } from '../contracts/persist-resource-contract.js';
+import { Tool } from '../tools/registry.js';
+/** Stable error codes emitted by generated read tools. */
+export declare const GENERATED_READ_ERRORS: {
+    readonly INPUT: "GENERATED_READ_INPUT";
+    readonly UPSTREAM: "GENERATED_READ_UPSTREAM";
+    readonly NOT_FOUND: "GENERATED_READ_NOT_FOUND";
+};
+/** Shape emitted on a successful list call. */
+export interface GeneratedListResponse<T = unknown> {
+    resource_id: string;
+    items: T[];
+    count: number;
+    limit: number;
+    offset: number;
+    /** Set when the previous page hit the effective limit. Null on the last page. */
+    next_offset: number | null;
+}
+/** Shape emitted by the describe tool. */
+export interface GeneratedDescribeResponse {
+    resource_id: string;
+    module: string;
+    table: string;
+    schema_name: string | null;
+    schema_version: string | null;
+    public_endpoint: string;
+    primary_key: string | string[] | null;
+    title: string | null;
+    title_plural: string | null;
+    description: string | null;
+    operations: readonly string[];
+    sensitivity: PersistResource['sensitivity'];
+    side_effects: readonly string[];
+    permission: PersistResource['permission'];
+    fields: PersistResource['fields'];
+    filter_capabilities: PersistResource['filter_capabilities'];
+    order_capabilities: PersistResource['order_capabilities'];
+    read_limits: {
+        default: number;
+        max: number;
+    };
+    /**
+     * Guardrail metadata surfaced so callers understand the safety
+     * envelope enforced by this tool bundle before they plan a query.
+     */
+    guardrails: {
+        /** `SELECT@OWN_RECORDS` — every generated read enforces this. */
+        scope: 'OWN_RECORDS';
+        /** `true` iff this bundle was materialised for a sensitive resource. */
+        sensitive: boolean;
+        /** Field names redacted from every response and rejected in `select`. */
+        redacted_fields: readonly string[];
+        /**
+         * PostgREST operations declared on the resource but never surfaced
+         * by the generator (writes must be dedicated tools with explicit
+         * confirmation and idempotency semantics).
+         */
+        write_operations_blocked: readonly string[];
+    };
+}
+/** Bundle returned per resource. */
+export interface GeneratedResourceTools {
+    describe: Tool;
+    list: Tool;
+    /** `null` when the resource has no scalar primary key. */
+    get: Tool | null;
+}
+/**
+ * Produce the describe/list/get triple for a single pinned resource.
+ *
+ * The output is deterministic — tool names, descriptions, and schema
+ * bodies depend only on the resource fields, so two invocations with an
+ * equal input yield equal tools. The doc generator relies on this.
+ *
+ * A hard guardrail refuses to build tools for a resource that
+ * {@link evaluateResourceEligibility} rejects with a `side_effects` reason:
+ * generic CRUD around a side-effecting resource is prohibited, and no
+ * caller-passed opt-in changes that. Sensitive resources reach this
+ * function only when the catalogue explicitly opts in via
+ * `includeSensitive`; the sensitivity marker is preserved on the
+ * describe payload so downstream tooling still knows to warn.
+ */
+export declare function buildResourceTools(resource: PersistResource): GeneratedResourceTools;
+//# sourceMappingURL=resource-tools.d.ts.map

package/dist/generated-reads/resource-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-tools.d.ts","sourceRoot":"","sources":["../../src/generated-reads/resource-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,IAAI,EAAe,MAAM,sBAAsB,CAAC;AAoBzD,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,OAAO;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC,aAAa,CAAC,CAAC;IAC5C,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,mBAAmB,EAAE,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC5D,kBAAkB,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC1D,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF;;;OAGG;IACH,UAAU,EAAE;QACV,iEAAiE;QACjE,KAAK,EAAE,aAAa,CAAC;QACrB,wEAAwE;QACxE,SAAS,EAAE,OAAO,CAAC;QACnB,yEAAyE;QACzE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC;;;;WAIG;QACH,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;CACH;AAED,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,0DAA0D;IAC1D,GAAG,EAAE,IAAI,GAAG,IAAI,CAAC;CAClB;AA8PD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,eAAe,GAAG,sBAAsB,CAwCpF"}

package/dist/generated-reads/resource-tools.js

@@ -0,0 +1,280 @@
+/**
+ * Factory that turns one pinned {@link PersistResource} into the three
+ * generated read tools:
+ *
+ *   `<resource_id>_describe` — no-args tool that returns the resource
+ *     metadata (fields, filter/order allowlists, primary key, permission,
+ *     sensitivity, side-effect markers, allowed CRUD operations).
+ *
+ *   `<resource_id>_list` — bounded list/search. Allowed filters, order
+ *     fields, and select subset are derived from the same contract; the
+ *     query builder enforces the safety envelope before any HTTP call.
+ *
+ *   `<resource_id>_get` — get-by-primary-key. Omitted for resources with
+ *     no scalar primary key.
+ *
+ * Every generated tool declares its capability requirement from the
+ * resource's `permission.resource_group` / `permission.resource_name`
+ * at `SELECT@OWN_RECORDS`. The describe tool declares no capability —
+ * metadata is safe to advertise even to callers without SELECT rights,
+ * but returns a fixed shape the caller can plan against.
+ *
+ * Tools returned by this factory are pure functions of the input
+ * resource. Two calls with equal input produce byte-for-byte identical
+ * `name`, `description`, and JSON-Schema output — the deterministic-
+ * metadata acceptance criterion for WI-0003500.
+ */
+import { z } from 'zod';
+import { errorResponse, successResponse } from '../tools/types.js';
+import { buildGetQuery, buildListQuery, DEFAULT_LIMIT, isSingletonPrimaryKey, MAX_LIMIT, QueryBuilderError, } from './query-builder.js';
+import { assertNoAutoGeneratedWrites, hasSideEffects, isSensitiveResource, redactRow, redactRows, sensitiveFieldNames, } from './guardrails.js';
+/** Stable error codes emitted by generated read tools. */
+export const GENERATED_READ_ERRORS = {
+    INPUT: 'GENERATED_READ_INPUT',
+    UPSTREAM: 'GENERATED_READ_UPSTREAM',
+    NOT_FOUND: 'GENERATED_READ_NOT_FOUND',
+};
+const scalarFilterValueSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+]);
+const filterClauseSchema = z.object({
+    field: z.string().min(1),
+    op: z.string().min(1),
+    value: scalarFilterValueSchema.optional(),
+    values: z.array(scalarFilterValueSchema).optional(),
+});
+const orderClauseSchema = z.object({
+    field: z.string().min(1),
+    direction: z.enum(['asc', 'desc']).optional(),
+    nulls: z.enum(['first', 'last']).optional(),
+});
+function listInputSchema(resource) {
+    const filterable = resource.filter_capabilities.filterable_fields;
+    const operators = resource.filter_capabilities.supported_operators;
+    const orderable = resource.order_capabilities.orderable_fields;
+    const fieldNames = resource.fields.map((f) => f.name);
+    return z
+        .object({
+        filters: z
+            .array(filterClauseSchema)
+            .max(20)
+            .optional()
+            .describe(`Filter clauses. Allowed fields: [${filterable.join(', ')}]. ` +
+            `Allowed ops: [${operators.join(', ')}]. Use \`values\` (array) for op=in; use \`value\` (scalar) otherwise.`),
+        order: z
+            .array(orderClauseSchema)
+            .max(4)
+            .optional()
+            .describe(`Order clauses. Allowed fields: [${orderable.join(', ')}]. direction=asc|desc (default asc); optional nulls=first|last.`),
+        select: z
+            .array(z.string().min(1))
+            .max(fieldNames.length)
+            .optional()
+            .describe(`Optional projection (subset of resource fields). Full field list: [${fieldNames.join(', ')}]. Embedded resources are not supported.`),
+        limit: z
+            .number()
+            .int()
+            .positive()
+            .optional()
+            .describe(`Page size (default ${DEFAULT_LIMIT}, hard maximum ${MAX_LIMIT}).`),
+        offset: z
+            .number()
+            .int()
+            .nonnegative()
+            .optional()
+            .describe('Offset for pagination (default 0).'),
+    })
+        .strict();
+}
+function getInputSchema(resource) {
+    const pk = resource.primary_key;
+    const fieldNames = resource.fields.map((f) => f.name);
+    return z
+        .object({
+        id: z.string().min(1).describe(`Primary-key value for the \`${pk}\` column.`),
+        select: z
+            .array(z.string().min(1))
+            .max(fieldNames.length)
+            .optional()
+            .describe(`Optional projection (subset of resource fields). Full field list: [${fieldNames.join(', ')}]. Embedded resources are not supported.`),
+    })
+        .strict();
+}
+function describeInputSchema() {
+    return z.object({}).strict();
+}
+function selectCapability(resource) {
+    return {
+        resourceGroup: resource.permission.resource_group,
+        resourceName: resource.permission.resource_name,
+        operation: 'SELECT',
+        scope: 'OWN_RECORDS',
+    };
+}
+function humanLabel(resource) {
+    return (resource.title_plural ??
+        resource.title ??
+        resource.resource_id.replace(/_/g, ' '));
+}
+function humanSingular(resource) {
+    return resource.title ?? resource.resource_id.replace(/_/g, ' ');
+}
+function describeDescription(resource) {
+    return (`Describe the \`${resource.resource_id}\` resource: fields, allowed filter operators, ` +
+        `orderable fields, primary key, sensitivity, and required permission. Metadata-only — ` +
+        `does not read any rows. Call this before ${resource.resource_id}_list to plan a query.`);
+}
+function listDescription(resource) {
+    return (`List/search \`${humanLabel(resource)}\` (${resource.public_endpoint}) with bounded ` +
+        `pagination and validated filter/order/select clauses. Server clamps limit to ${MAX_LIMIT}; ` +
+        `embedded traversal is not supported. Filters and order fields must come from the ` +
+        `resource's declared capabilities — call ${resource.resource_id}_describe first if unsure.`);
+}
+function getDescription(resource) {
+    const pk = resource.primary_key;
+    return (`Fetch a single \`${humanSingular(resource)}\` from ${resource.public_endpoint} by ` +
+        `its \`${pk}\` primary key. Returns the full row (or a caller-selected projection). ` +
+        `Bounded (limit 1) — cannot fan out.`);
+}
+async function callListHandler(resource, args, ctx) {
+    let built;
+    try {
+        built = buildListQuery(resource, args);
+    }
+    catch (error) {
+        if (error instanceof QueryBuilderError) {
+            return errorResponse(GENERATED_READ_ERRORS.INPUT, error.message, {
+                resource_id: resource.resource_id,
+            });
+        }
+        throw error;
+    }
+    try {
+        const items = await ctx.apiClient.get(`${ctx.apiClient.dbBasePath}${built.path}`, { query: built.query });
+        // Defence-in-depth: even though the select allowlist already
+        // excludes sensitive fields, redact the returned rows before
+        // handing them to the caller. Catches upstream shape changes and
+        // PostgREST default projections.
+        const redacted = redactRows(items);
+        const next_offset = redacted.length === built.limit ? built.offset + built.limit : null;
+        return successResponse({
+            resource_id: resource.resource_id,
+            items: redacted,
+            count: redacted.length,
+            limit: built.limit,
+            offset: built.offset,
+            next_offset,
+        });
+    }
+    catch (error) {
+        return errorResponse(GENERATED_READ_ERRORS.UPSTREAM, `Failed to list ${resource.resource_id}: ${error.message}`, { resource_id: resource.resource_id });
+    }
+}
+async function callGetHandler(resource, args, ctx) {
+    let built;
+    try {
+        built = buildGetQuery(resource, args);
+    }
+    catch (error) {
+        if (error instanceof QueryBuilderError) {
+            return errorResponse(GENERATED_READ_ERRORS.INPUT, error.message, {
+                resource_id: resource.resource_id,
+            });
+        }
+        throw error;
+    }
+    try {
+        const rows = await ctx.apiClient.get(`${ctx.apiClient.dbBasePath}${built.path}`, { query: built.query });
+        if (!Array.isArray(rows) || rows.length === 0) {
+            return errorResponse(GENERATED_READ_ERRORS.NOT_FOUND, `No ${humanSingular(resource)} with id "${args.id}".`, { resource_id: resource.resource_id });
+        }
+        return successResponse(redactRow(rows[0]));
+    }
+    catch (error) {
+        return errorResponse(GENERATED_READ_ERRORS.UPSTREAM, `Failed to get ${resource.resource_id}: ${error.message}`, { resource_id: resource.resource_id });
+    }
+}
+function describeHandler(resource) {
+    const redacted = sensitiveFieldNames(resource);
+    const writeOperationsBlocked = resource.operations.filter((op) => op === 'create' || op === 'update' || op === 'delete');
+    const payload = {
+        resource_id: resource.resource_id,
+        module: resource.module,
+        table: resource.table,
+        schema_name: resource.schema_name,
+        schema_version: resource.schema_version,
+        public_endpoint: resource.public_endpoint,
+        primary_key: resource.primary_key,
+        title: resource.title,
+        title_plural: resource.title_plural,
+        description: resource.description,
+        operations: resource.operations,
+        sensitivity: resource.sensitivity,
+        side_effects: resource.side_effects,
+        permission: resource.permission,
+        fields: resource.fields,
+        filter_capabilities: resource.filter_capabilities,
+        order_capabilities: resource.order_capabilities,
+        read_limits: { default: DEFAULT_LIMIT, max: MAX_LIMIT },
+        guardrails: {
+            scope: 'OWN_RECORDS',
+            sensitive: isSensitiveResource(resource),
+            redacted_fields: redacted,
+            write_operations_blocked: writeOperationsBlocked,
+        },
+    };
+    return async () => successResponse(payload);
+}
+/**
+ * Produce the describe/list/get triple for a single pinned resource.
+ *
+ * The output is deterministic — tool names, descriptions, and schema
+ * bodies depend only on the resource fields, so two invocations with an
+ * equal input yield equal tools. The doc generator relies on this.
+ *
+ * A hard guardrail refuses to build tools for a resource that
+ * {@link evaluateResourceEligibility} rejects with a `side_effects` reason:
+ * generic CRUD around a side-effecting resource is prohibited, and no
+ * caller-passed opt-in changes that. Sensitive resources reach this
+ * function only when the catalogue explicitly opts in via
+ * `includeSensitive`; the sensitivity marker is preserved on the
+ * describe payload so downstream tooling still knows to warn.
+ */
+export function buildResourceTools(resource) {
+    if (hasSideEffects(resource)) {
+        throw new Error(`Refusing to build generated read tools for ${resource.resource_id}: ` +
+            'resource declares side effects and requires a dedicated tool with ' +
+            'explicit confirmation and idempotency semantics.');
+    }
+    assertNoAutoGeneratedWrites(resource);
+    const selectReq = selectCapability(resource);
+    const describe = {
+        name: `${resource.resource_id}_describe`,
+        description: describeDescription(resource),
+        inputSchema: describeInputSchema(),
+        handler: describeHandler(resource),
+        // Metadata is safe to advertise — no rows are read.
+        capabilities: [],
+    };
+    const list = {
+        name: `${resource.resource_id}_list`,
+        description: listDescription(resource),
+        inputSchema: listInputSchema(resource),
+        handler: (args, ctx) => callListHandler(resource, args, ctx),
+        capabilities: [selectReq],
+    };
+    const get = isSingletonPrimaryKey(resource)
+        ? {
+            name: `${resource.resource_id}_get`,
+            description: getDescription(resource),
+            inputSchema: getInputSchema(resource),
+            handler: (args, ctx) => callGetHandler(resource, args, ctx),
+            capabilities: [selectReq],
+        }
+        : null;
+    return { describe, list, get };
+}
+//# sourceMappingURL=resource-tools.js.map

package/dist/generated-reads/resource-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-tools.js","sourceRoot":"","sources":["../../src/generated-reads/resource-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAgB,MAAM,mBAAmB,CAAC;AACjF,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,qBAAqB,EACrB,SAAS,EACT,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,2BAA2B,EAE3B,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,sBAAsB;IAC7B,QAAQ,EAAE,yBAAyB;IACnC,SAAS,EAAE,0BAA0B;CAC7B,CAAC;AAgEX,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC;IACtC,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;CACT,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,QAAyB;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;IAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC;aACP,KAAK,CAAC,kBAAkB,CAAC;aACzB,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,EAAE;aACV,QAAQ,CACP,oCAAoC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5D,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,wEAAwE,CAChH;QACH,KAAK,EAAE,CAAC;aACL,KAAK,CAAC,iBAAiB,CAAC;aACxB,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CACP,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iEAAiE,CACzH;QACH,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACxB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;aACtB,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CACtI;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,QAAQ,CAAC,sBAAsB,aAAa,kBAAkB,SAAS,IAAI,CAAC;QAC/E,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,EAAE;aACL,WAAW,EAAE;aACb,QAAQ,EAAE;aACV,QAAQ,CAAC,oCAAoC,CAAC;KAClD,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,QAAyB;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAqB,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC;SACL,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,EAAE,YAAY,CAAC;QAC7E,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACxB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;aACtB,QAAQ,EAAE;aACV,QAAQ,CACP,sEAAsE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CACtI;KACJ,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAyB;IACjD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,cAAc;QACjD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa;QAC/C,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,aAAa;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAyB;IAC3C,OAAO,CACL,QAAQ,CAAC,YAAY;QACrB,QAAQ,CAAC,KAAK;QACd,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACpD,OAAO,CACL,kBAAkB,QAAQ,CAAC,WAAW,iDAAiD;QACvF,uFAAuF;QACvF,4CAA4C,QAAQ,CAAC,WAAW,wBAAwB,CACzF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAyB;IAChD,OAAO,CACL,iBAAiB,UAAU,CAAC,QAAQ,CAAC,OAAO,QAAQ,CAAC,eAAe,iBAAiB;QACrF,gFAAgF,SAAS,IAAI;QAC7F,mFAAmF;QACnF,2CAA2C,QAAQ,CAAC,WAAW,4BAA4B,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAyB;IAC/C,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAqB,CAAC;IAC1C,OAAO,CACL,oBAAoB,aAAa,CAAC,QAAQ,CAAC,WAAW,QAAQ,CAAC,eAAe,MAAM;QACpF,SAAS,EAAE,0EAA0E;QACrF,qCAAqC,CACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAyB,EACzB,IAAa,EACb,GAAgB;IAEhB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAa,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC/D,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CACnC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,EAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,6DAA6D;QAC7D,6DAA6D;QAC7D,iEAAiE;QACjE,iCAAiC;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,WAAW,GACf,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,eAAe,CAAwB;YAC5C,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAClB,qBAAqB,CAAC,QAAQ,EAC9B,kBAAkB,QAAQ,CAAC,WAAW,KAAM,KAAe,CAAC,OAAO,EAAE,EACrE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAyB,EACzB,IAAa,EACb,GAAgB;IAEhB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAa,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE;gBAC/D,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAClC,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,EAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,aAAa,CAClB,qBAAqB,CAAC,SAAS,EAC/B,MAAM,aAAa,CAAC,QAAQ,CAAC,aAAc,IAAuB,CAAC,EAAE,IAAI,EACzE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAClB,qBAAqB,CAAC,QAAQ,EAC9B,iBAAiB,QAAQ,CAAC,WAAW,KAAM,KAAe,CAAC,OAAO,EAAE,EACpE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,sBAAsB,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,CAC9D,CAAC;IACF,MAAM,OAAO,GAA8B;QACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,WAAW,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE;QACvD,UAAU,EAAE;YACV,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YACxC,eAAe,EAAE,QAAQ;YACzB,wBAAwB,EAAE,sBAAsB;SACjD;KACF,CAAC;IACF,OAAO,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAyB;IAC1D,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,8CAA8C,QAAQ,CAAC,WAAW,IAAI;YACpE,oEAAoE;YACpE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAS;QACrB,IAAI,EAAE,GAAG,QAAQ,CAAC,WAAW,WAAW;QACxC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,mBAAmB,EAAE;QAClC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC;QAClC,oDAAoD;QACpD,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,MAAM,IAAI,GAAS;QACjB,IAAI,EAAE,GAAG,QAAQ,CAAC,WAAW,OAAO;QACpC,WAAW,EAAE,eAAe,CAAC,QAAQ,CAAC;QACtC,WAAW,EAAE,eAAe,CAAC,QAAQ,CAAC;QACtC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;QAC5D,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B,CAAC;IAEF,MAAM,GAAG,GAAgB,qBAAqB,CAAC,QAAQ,CAAC;QACtD,CAAC,CAAC;YACE,IAAI,EAAE,GAAG,QAAQ,CAAC,WAAW,MAAM;YACnC,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC;YACrC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC;YAC3D,YAAY,EAAE,CAAC,SAAS,CAAC;SAC1B;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACjC,CAAC"}