pg-admin-mcp 0.0.0-stage → 0.1.0

package/dist/tools/admin/grants.js

@@ -0,0 +1,207 @@
+import { z } from 'zod';
+import { PgMcpError } from '../../core/errors.js';
+import { CONFIRM_PROTOCOL_DESCRIPTION, runGuardedMutation } from '../../core/guards.js';
+import { resolveCurrentDatabase, resolveFunctionSignature, resolveRelation, resolveRole, resolveSchemaIdent, resolveSequence } from '../../core/identifiers.js';
+import { getPermissionsByKind } from '../../db/catalog.js';
+import { withSession } from '../../db/session.js';
+import { confirmFragment, toExpectToken } from '../_batch_shared.js';
+import { reportList } from './_shared.js';
+/**
+ * `grants` sub-operation. `grants_get` (read-only, no capability) reports
+ * effective privileges via `getPermissionsByKind`, which is the fix for the
+ * `acldefault('r', …)` bug: table/sequence/function/database/schema each get
+ * their own `aclexplode` type code.
+ *
+ * `grants_grant`/`grants_revoke` require `admin` — matching
+ * `execute_sql.ts`'s `WRITE_PATH_CAPABILITY` table, which already maps
+ * GRANT/REVOKE to `admin`. Unlike `execute_sql`'s raw-SQL path, this tool
+ * does not additionally require `write`: `postgres_admin` is a
+ * purpose-built administrative tool, and an operator who wants to hand out
+ * grants without also opening the DML write path should not have to enable
+ * both.
+ *
+ * Mutation is supported for table/sequence/schema/function objects.
+ * Database-level GRANT is deliberately out of scope (read-only via
+ * `grants_get` only) to avoid adding a caller-supplied database-name
+ * resolver purely for a rarely-used case — see `resolveCurrentDatabase`'s
+ * doc comment for why database grants always target the profile's own
+ * database when read.
+ */
+const readObjectKind = z.enum(['table', 'sequence', 'function', 'database', 'schema']);
+const mutableObjectKind = z.enum(['table', 'sequence', 'schema', 'function']);
+const PRIVILEGES_BY_KIND = {
+    table: ['SELECT', 'INSERT', 'UPDATE', 'DELETE', 'TRUNCATE', 'REFERENCES', 'TRIGGER', 'ALL'],
+    sequence: ['SELECT', 'UPDATE', 'USAGE', 'ALL'],
+    schema: ['CREATE', 'USAGE', 'ALL'],
+    function: ['EXECUTE', 'ALL'],
+};
+const ON_WORD = {
+    table: 'TABLE',
+    sequence: 'SEQUENCE',
+    schema: 'SCHEMA',
+    function: 'FUNCTION',
+};
+export const grantsGetSchema = z
+    .object({
+    op: z.literal('grants_get'),
+    objectKind: readObjectKind,
+    schema: z.string().min(1).optional(),
+    name: z.string().min(1).optional().describe('Object name. Not used (and not required) when objectKind is "schema" or "database".'),
+})
+    .superRefine((v, ctx) => {
+    if (v.objectKind === 'database')
+        return;
+    if (v.objectKind === 'schema') {
+        if (v.schema === undefined)
+            ctx.addIssue({ code: 'custom', message: 'objectKind "schema" requires "schema"' });
+        return;
+    }
+    if (v.schema === undefined || v.name === undefined) {
+        ctx.addIssue({ code: 'custom', message: `objectKind "${v.objectKind}" requires both "schema" and "name"` });
+    }
+});
+const grantsMutationBase = {
+    objectKind: mutableObjectKind,
+    schema: z.string().min(1),
+    name: z.string().min(1).optional().describe('Required unless objectKind is "schema" (the schema itself is the object).'),
+    roles: z.array(z.string().min(1)).min(1).describe('Grantee role names, or "PUBLIC".'),
+    privileges: z.array(z.string().min(1)).min(1).describe('Privilege keywords valid for objectKind, e.g. SELECT/INSERT/UPDATE/DELETE for a table, USAGE for a schema, EXECUTE for a function, or ALL.'),
+};
+export const grantsGrantSchema = z
+    .object({
+    op: z.literal('grants_grant'),
+    ...grantsMutationBase,
+    grantOption: z.boolean().optional().default(false).describe('Adds WITH GRANT OPTION.'),
+    ...confirmFragment,
+})
+    .superRefine((v, ctx) => {
+    if (v.objectKind !== 'schema' && v.name === undefined)
+        ctx.addIssue({ code: 'custom', message: `objectKind "${v.objectKind}" requires "name"` });
+});
+export const grantsRevokeSchema = z
+    .object({
+    op: z.literal('grants_revoke'),
+    ...grantsMutationBase,
+    cascade: z.boolean().optional().default(false),
+    ...confirmFragment,
+})
+    .superRefine((v, ctx) => {
+    if (v.objectKind !== 'schema' && v.name === undefined)
+        ctx.addIssue({ code: 'custom', message: `objectKind "${v.objectKind}" requires "name"` });
+});
+async function resolveGrantObject(profile, objectKind, schema, name) {
+    switch (objectKind) {
+        case 'table': {
+            const rel = await resolveRelation(profile, schema, name);
+            return { target: `${rel.schema}.${rel.name}`, aclKind: 'table' };
+        }
+        case 'sequence': {
+            const seq = await resolveSequence(profile, schema, name);
+            return { target: `${seq.schema}.${seq.name}`, aclKind: 'sequence' };
+        }
+        case 'function': {
+            const fn = await resolveFunctionSignature(profile, schema, name);
+            return { target: fn.signature, aclKind: 'function' };
+        }
+        case 'schema': {
+            const sch = await resolveSchemaIdent(profile, schema);
+            return { target: sch.name, aclKind: 'schema' };
+        }
+    }
+}
+async function resolveGranteeIdent(profile, name) {
+    if (name.toUpperCase() === 'PUBLIC')
+        return 'PUBLIC';
+    const role = await resolveRole(profile, name);
+    return role.name;
+}
+function validatePrivileges(objectKind, privileges) {
+    const allowed = PRIVILEGES_BY_KIND[objectKind];
+    const normalized = privileges.map((p) => p.toUpperCase());
+    for (const p of normalized) {
+        if (!allowed.includes(p)) {
+            throw new PgMcpError({
+                code: 'PG_ERROR',
+                message: `privilege "${p}" is not valid for objectKind "${objectKind}"`,
+                hint: `valid privileges for "${objectKind}": ${allowed.join(', ')}`,
+                details: { objectKind, privilege: p, allowed },
+            });
+        }
+    }
+    return normalized;
+}
+export async function handleGrantsGet(profile, args) {
+    let aclKind;
+    let oid;
+    let label;
+    if (args.objectKind === 'database') {
+        const db = await resolveCurrentDatabase(profile);
+        aclKind = 'database';
+        oid = db.oid;
+        label = profile.database;
+    }
+    else if (args.objectKind === 'schema') {
+        const sch = await resolveSchemaIdent(profile, args.schema);
+        aclKind = 'schema';
+        oid = sch.oid;
+        label = args.schema;
+    }
+    else if (args.objectKind === 'sequence') {
+        const seq = await resolveSequence(profile, args.schema, args.name);
+        aclKind = 'sequence';
+        oid = seq.oid;
+        label = `${args.schema}.${args.name}`;
+    }
+    else if (args.objectKind === 'function') {
+        const fn = await resolveFunctionSignature(profile, args.schema, args.name);
+        aclKind = 'function';
+        oid = fn.oid;
+        label = `${args.schema}.${args.name}`;
+    }
+    else {
+        const rel = await resolveRelation(profile, args.schema, args.name);
+        aclKind = 'table';
+        oid = rel.oid;
+        label = `${args.schema}.${args.name}`;
+    }
+    const perms = await withSession(profile, (client) => getPermissionsByKind(client, aclKind, oid), { operation: 'admin_grants_get' });
+    return reportList(profile, perms.map((p) => ({ object: label, objectKind: args.objectKind, ...p })));
+}
+export async function handleGrantsGrant(profile, args) {
+    const { target } = await resolveGrantObject(profile, args.objectKind, args.schema, args.name);
+    const privileges = validatePrivileges(args.objectKind, args.privileges);
+    const grantees = await Promise.all(args.roles.map((r) => resolveGranteeIdent(profile, r)));
+    const sql = `GRANT ${privileges.join(', ')} ON ${ON_WORD[args.objectKind]} ${target} TO ${grantees.join(', ')}${args.grantOption ? ' WITH GRANT OPTION' : ''}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_grants_grant',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export async function handleGrantsRevoke(profile, args) {
+    const { target } = await resolveGrantObject(profile, args.objectKind, args.schema, args.name);
+    const privileges = validatePrivileges(args.objectKind, args.privileges);
+    const grantees = await Promise.all(args.roles.map((r) => resolveGranteeIdent(profile, r)));
+    const sql = `REVOKE ${privileges.join(', ')} ON ${ON_WORD[args.objectKind]} ${target} FROM ${grantees.join(', ')}${args.cascade ? ' CASCADE' : ''}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_grants_revoke',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export const GRANTS_DESCRIPTION = `\`grants_get\` (read-only, no capability) inspects effective privileges — correct aclexplode/acldefault type code per object kind ` +
+    `('r' table, 'S' sequence, 'f' function, 'd' database, 'n' schema). \`grants_grant\`/\`grants_revoke\` require \`admin\` (matching ` +
+    `execute_sql's GRANT/REVOKE routing) and support table/sequence/schema/function objects; database-level GRANT is read-only here. ${CONFIRM_PROTOCOL_DESCRIPTION}`;
+//# sourceMappingURL=grants.js.map

package/dist/tools/admin/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/tools/admin/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAChK,OAAO,EAAE,oBAAoB,EAAsB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvF,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAE9E,MAAM,kBAAkB,GAAiE;IACvF,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC;IAC3F,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;IAC9C,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;IAClC,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;CAC7B,CAAC;AAEF,MAAM,OAAO,GAAsD;IACjE,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3B,UAAU,EAAE,cAAc;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;CACnI,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO;IACxC,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QAC/G,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,UAAU,qCAAqC,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,kBAAkB,GAAG;IACzB,UAAU,EAAE,iBAAiB;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;IACxH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IACrF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4IAA4I,CAAC;CACrM,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7B,GAAG,kBAAkB;IACrB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACtF,GAAG,eAAe;CACnB,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,UAAU,mBAAmB,EAAE,CAAC,CAAC;AACnJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAC9B,GAAG,kBAAkB;IACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,GAAG,eAAe;CACnB,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,UAAU,mBAAmB,EAAE,CAAC,CAAC;AACnJ,CAAC,CAAC,CAAC;AAEL,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,UAA6C,EAC7C,MAAc,EACd,IAAwB;IAExB,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAc,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAc,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACtE,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAc,CAAC,CAAC;YAC3E,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,IAAY;IAC/D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAA6C,EAAE,UAA6B;IACtG,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,cAAc,CAAC,kCAAkC,UAAU,GAAG;gBACvE,IAAI,EAAE,yBAAyB,UAAU,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnE,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAqC;IAC3F,IAAI,OAAsB,CAAC;IAC3B,IAAI,GAAW,CAAC;IAChB,IAAI,KAAa,CAAC;IAElB,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,GAAG,UAAU,CAAC;QACrB,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;QACb,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAgB,CAAC,CAAC;QACrE,OAAO,GAAG,QAAQ,CAAC;QACnB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,KAAK,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAgB,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;QACvF,OAAO,GAAG,UAAU,CAAC;QACrB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAgB,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;QAC/F,OAAO,GAAG,UAAU,CAAC;QACrB,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;QACb,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAgB,EAAE,IAAI,CAAC,IAAc,CAAC,CAAC;QACvF,OAAO,GAAG,OAAO,CAAC;QAClB,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpI,OAAO,UAAU,CACf,OAAO,EACP,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAAuC;IAC/F,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,GAAG,GAAG,SAAS,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/J,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,oBAAoB;QAC/B,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,IAAwC;IACjG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3F,MAAM,GAAG,GAAG,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,MAAM,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpJ,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,qBAAqB;QAChC,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAC7B,oIAAoI;IACpI,oIAAoI;IACpI,mIAAmI,4BAA4B,EAAE,CAAC"}

package/dist/tools/admin/index.js

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { loadProfiles } from '../../config/profiles.js';
+import { toToolResult } from '../../core/errors.js';
+import { formatOutcome } from '../../core/format.js';
+import { assertNever, defineTool, profileParam } from '../_shared.js';
+import { extensionsCreateSchema, extensionsDropSchema, extensionsListSchema, EXTENSIONS_DESCRIPTION, handleExtensionsCreate, handleExtensionsDrop, handleExtensionsList } from './extensions.js';
+import { grantsGetSchema, grantsGrantSchema, grantsRevokeSchema, GRANTS_DESCRIPTION, handleGrantsGet, handleGrantsGrant, handleGrantsRevoke } from './grants.js';
+import { handleMaintenanceAnalyze, handleMaintenanceReindex, handleMaintenanceVacuum, maintenanceAnalyzeSchema, maintenanceReindexSchema, maintenanceVacuumSchema, MAINTENANCE_DESCRIPTION } from './maintenance.js';
+import { handleRolesAlter, handleRolesCreate, handleRolesDrop, handleRolesList, rolesAlterSchema, rolesCreateSchema, rolesDropSchema, rolesListSchema, ROLES_DESCRIPTION } from './roles.js';
+import { handleSessionsCancel, handleSessionsList, handleSessionsTerminate, sessionsCancelSchema, sessionsListSchema, sessionsTerminateSchema, SESSIONS_DESCRIPTION } from './sessions.js';
+import { handleStatsActivity, handleStatsIndexes, handleStatsTables, statsActivitySchema, statsIndexesSchema, statsTablesSchema, STATS_DESCRIPTION } from './stats.js';
+/**
+ * `postgres_admin` — one dispatcher, six sub-operations, each its own file.
+ * The widest-blast-radius tool in this server: it can create/alter/drop
+ * roles, grant/revoke privileges, install/remove extensions (arbitrary SQL
+ * as superuser), cancel/terminate other sessions, and run maintenance that
+ * takes locks. Every mutating op requires `admin`; every destructive one
+ * routes through `runGuardedMutation`'s confirm protocol or, where that
+ * protocol cannot be honest (see `maintenance.ts`/`sessions.ts`), a plain
+ * `confirm: true` gate with no dry run offered rather than a fake one.
+ *
+ * One flat `z.discriminatedUnion('op', [...])` rather than nested unions —
+ * Zod's nested-discriminated-union support is friction for nineteen leaf
+ * shapes with no shared parent shape worth factoring out, and a flat union
+ * still gives each `op` its own independently typed argument shape with
+ * schema-level rejection of any invalid op/argument combination.
+ */
+const inputSchema = z.discriminatedUnion('op', [
+    rolesListSchema,
+    rolesCreateSchema,
+    rolesAlterSchema,
+    rolesDropSchema,
+    grantsGetSchema,
+    grantsGrantSchema,
+    grantsRevokeSchema,
+    extensionsListSchema,
+    extensionsCreateSchema,
+    extensionsDropSchema,
+    sessionsListSchema,
+    sessionsCancelSchema,
+    sessionsTerminateSchema,
+    maintenanceVacuumSchema,
+    maintenanceAnalyzeSchema,
+    maintenanceReindexSchema,
+    statsTablesSchema,
+    statsIndexesSchema,
+    statsActivitySchema,
+]);
+// z.discriminatedUnion does not support spreading profileParam into each
+// branch without repeating it in all nineteen schemas, so profile is layered
+// on as an intersection instead: `profileParam` first (broad), intersected
+// with the discriminated union (narrow, decides `op`'s shape). TypeScript
+// still narrows `args.op` correctly through the intersection — verified: an
+// intersection of an object type with a union distributes for discriminant
+// narrowing the same way the union alone would.
+const adminInputSchema = z.intersection(z.object(profileParam), inputSchema);
+export const adminTool = defineTool('postgres_admin', {
+    title: 'PostgreSQL administrative operations',
+    description: 'Widest-blast-radius tool in this server. Six sub-operations selected by `op`: roles_* (create/alter/drop a role), ' +
+        'grants_* (GRANT/REVOKE), extensions_* (CREATE/DROP EXTENSION — installing runs arbitrary SQL as superuser), ' +
+        'sessions_* (cancel/terminate another backend), maintenance_* (VACUUM/ANALYZE/REINDEX), stats_* (read-only). Every ' +
+        'mutating op requires the `admin` capability. ' +
+        `${ROLES_DESCRIPTION} ${GRANTS_DESCRIPTION} ${EXTENSIONS_DESCRIPTION} ${SESSIONS_DESCRIPTION} ${MAINTENANCE_DESCRIPTION} ${STATS_DESCRIPTION}`,
+    inputSchema: adminInputSchema,
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+}, async (args) => {
+    try {
+        const registry = loadProfiles();
+        const profile = registry.get(args.profile);
+        let outcome;
+        switch (args.op) {
+            case 'roles_list':
+                outcome = await handleRolesList(profile, args);
+                break;
+            case 'roles_create':
+                outcome = await handleRolesCreate(profile, args);
+                break;
+            case 'roles_alter':
+                outcome = await handleRolesAlter(profile, args);
+                break;
+            case 'roles_drop':
+                outcome = await handleRolesDrop(profile, args);
+                break;
+            case 'grants_get':
+                outcome = await handleGrantsGet(profile, args);
+                break;
+            case 'grants_grant':
+                outcome = await handleGrantsGrant(profile, args);
+                break;
+            case 'grants_revoke':
+                outcome = await handleGrantsRevoke(profile, args);
+                break;
+            case 'extensions_list':
+                outcome = await handleExtensionsList(profile, args);
+                break;
+            case 'extensions_create':
+                outcome = await handleExtensionsCreate(profile, args);
+                break;
+            case 'extensions_drop':
+                outcome = await handleExtensionsDrop(profile, args);
+                break;
+            case 'sessions_list':
+                outcome = await handleSessionsList(profile, args);
+                break;
+            case 'sessions_cancel':
+                outcome = await handleSessionsCancel(profile, args);
+                break;
+            case 'sessions_terminate':
+                outcome = await handleSessionsTerminate(profile, args);
+                break;
+            case 'maintenance_vacuum':
+                outcome = await handleMaintenanceVacuum(profile, args);
+                break;
+            case 'maintenance_analyze':
+                outcome = await handleMaintenanceAnalyze(profile, args);
+                break;
+            case 'maintenance_reindex':
+                outcome = await handleMaintenanceReindex(profile, args);
+                break;
+            case 'stats_tables':
+                outcome = await handleStatsTables(profile, args);
+                break;
+            case 'stats_indexes':
+                outcome = await handleStatsIndexes(profile, args);
+                break;
+            case 'stats_activity':
+                outcome = await handleStatsActivity(profile, args);
+                break;
+            default:
+                return assertNever(args);
+        }
+        return formatOutcome(outcome);
+    }
+    catch (err) {
+        return toToolResult(err);
+    }
+});
+//# sourceMappingURL=index.js.map

package/dist/tools/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACjM,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjK,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACrN,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7L,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3L,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEvK;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IAC7C,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;IACpB,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,gDAAgD;AAChD,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CACjC,gBAAgB,EAChB;IACE,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EACT,oHAAoH;QACpH,8GAA8G;QAC9G,oHAAoH;QACpH,+CAA+C;QAC/C,GAAG,iBAAiB,IAAI,kBAAkB,IAAI,sBAAsB,IAAI,oBAAoB,IAAI,uBAAuB,IAAI,iBAAiB,EAAE;IAChJ,WAAW,EAAE,gBAAgB;IAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;CACxG,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;IACb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,OAAoB,CAAC;QACzB,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,KAAK,YAAY;gBACf,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM;YACR,KAAK,cAAc;gBACjB,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAChD,MAAM;YACR,KAAK,YAAY;gBACf,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM;YACR,KAAK,YAAY;gBACf,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM;YACR,KAAK,cAAc;gBACjB,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM;YACR,KAAK,eAAe;gBAClB,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,mBAAmB;gBACtB,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtD,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,eAAe;gBAClB,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,oBAAoB;gBACvB,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,oBAAoB;gBACvB,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACvD,MAAM;YACR,KAAK,qBAAqB;gBACxB,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM;YACR,KAAK,qBAAqB;gBACxB,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM;YACR,KAAK,cAAc;gBACjB,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM;YACR,KAAK,eAAe;gBAClB,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACnD,MAAM;YACR;gBACE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/tools/admin/maintenance.js

@@ -0,0 +1,106 @@
+import { z } from 'zod';
+import { CONFIRM_PROTOCOL_DESCRIPTION, runGuardedMutation } from '../../core/guards.js';
+import { resolveIndex, resolveRelation } from '../../core/identifiers.js';
+import { requireCapability } from '../../core/policy.js';
+import { withSession } from '../../db/session.js';
+import { confirmFragment, toExpectToken } from '../_batch_shared.js';
+/**
+ * `maintenance` sub-operation: VACUUM, ANALYZE, REINDEX. All require `admin`.
+ *
+ * **The transaction-block problem, and the decision.** `runGuardedMutation`
+ * always opens a transaction (`withTx`, for both the dry-run and the confirm
+ * call — confirmed by reading it end to end, there is no code path that
+ * skips `BEGIN`). PostgreSQL refuses `VACUUM` inside a transaction block
+ * unconditionally, and refuses `REINDEX ... CONCURRENTLY` inside one too
+ * (plain `REINDEX TABLE`/`REINDEX INDEX` on a single object CAN run inside a
+ * transaction). Wrapping either operation in a `GuardedExecutor` would not
+ * help: an executor's `run(client)` still executes inside whatever
+ * transaction `withTx` opened around it — it does not escape it. So:
+ *
+ * - `maintenance_vacuum` and `maintenance_analyze` never go through
+ *   `runGuardedMutation`. They run immediately via `withSession` (no
+ *   transaction at all), gated by an explicit `requireCapability('admin', …)`
+ *   call since there is no guard to do it for them. No dry run is offered —
+ *   one is not possible, and pretending otherwise (e.g. by wrapping VACUUM in
+ *   a transaction that always rolls back) would either lie about what
+ *   happened or simply fail with PostgreSQL's own
+ *   `25001 VACUUM cannot run inside a transaction block`. Neither VACUUM nor
+ *   ANALYZE deletes or hides live rows a caller can see — the honest
+ *   description is "no dry run because none is possible for a
+ *   non-transactional operation", not "defeats the guard".
+ * - `maintenance_reindex` with `concurrently: false` (default) targets a
+ *   single table or index, which CAN run inside a transaction — it goes
+ *   through `runGuardedMutation` like any other DDL-shaped mutation
+ *   (`keyColumns: []`, no `RETURNING`). Its dry run genuinely rebuilds the
+ *   index and then rolls back: a truthful, if I/O-costly, proof that the
+ *   REINDEX will succeed — unlike VACUUM, this one is not a lie.
+ * - `maintenance_reindex` with `concurrently: true` cannot run inside a
+ *   transaction block either (PostgreSQL's own restriction), so it takes the
+ *   same immediate/no-dry-run path as VACUUM, documented the same way.
+ */
+const targetKind = z.enum(['table', 'index']);
+export const maintenanceVacuumSchema = z.object({
+    op: z.literal('maintenance_vacuum'),
+    schema: z.string().min(1),
+    table: z.string().min(1),
+    full: z.boolean().optional().default(false).describe('VACUUM FULL rewrites the table and takes ACCESS EXCLUSIVE — no dry run either way.'),
+    analyze: z.boolean().optional().default(false).describe('Also update planner statistics in the same pass.'),
+});
+export const maintenanceAnalyzeSchema = z.object({
+    op: z.literal('maintenance_analyze'),
+    schema: z.string().min(1),
+    table: z.string().min(1),
+});
+export const maintenanceReindexSchema = z.object({
+    op: z.literal('maintenance_reindex'),
+    target: targetKind,
+    schema: z.string().min(1),
+    name: z.string().min(1),
+    concurrently: z.boolean().optional().default(false).describe('REINDEX CONCURRENTLY cannot run inside a transaction block, so no dry run is offered when true.'),
+    ...confirmFragment,
+});
+export async function handleMaintenanceVacuum(profile, args) {
+    requireCapability('admin', profile);
+    const rel = await resolveRelation(profile, args.schema, args.table);
+    const options = [args.full ? 'FULL' : null, args.analyze ? 'ANALYZE' : null].filter((o) => o !== null);
+    const sql = options.length > 0 ? `VACUUM (${options.join(', ')}) ${rel.schema}.${rel.name}` : `VACUUM ${rel.schema}.${rel.name}`;
+    await withSession(profile, (client) => client.query({ text: sql, values: [], queryMode: 'extended' }), { operation: 'admin_maintenance_vacuum' });
+    return { kind: 'mutation', rowCount: 0, committed: true };
+}
+export async function handleMaintenanceAnalyze(profile, args) {
+    requireCapability('admin', profile);
+    const rel = await resolveRelation(profile, args.schema, args.table);
+    const sql = `ANALYZE ${rel.schema}.${rel.name}`;
+    await withSession(profile, (client) => client.query({ text: sql, values: [], queryMode: 'extended' }), { operation: 'admin_maintenance_analyze' });
+    return { kind: 'mutation', rowCount: 0, committed: true };
+}
+export async function handleMaintenanceReindex(profile, args) {
+    const targetIdent = args.target === 'table' ? await resolveRelation(profile, args.schema, args.name) : await resolveIndex(profile, args.schema, args.name);
+    const onWord = args.target === 'table' ? 'TABLE' : 'INDEX';
+    const object = `${targetIdent.schema}.${targetIdent.name}`;
+    if (args.concurrently) {
+        requireCapability('admin', profile);
+        const sql = `REINDEX ${onWord} CONCURRENTLY ${object}`;
+        await withSession(profile, (client) => client.query({ text: sql, values: [], queryMode: 'extended' }), { operation: 'admin_maintenance_reindex_concurrently' });
+        return { kind: 'mutation', rowCount: 0, committed: true };
+    }
+    const sql = `REINDEX ${onWord} ${object}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_maintenance_reindex',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export const MAINTENANCE_DESCRIPTION = '`maintenance_vacuum`/`maintenance_analyze` require `admin` and run immediately with NO dry run — VACUUM cannot run inside a transaction ' +
+    'block at all, so no truthful preview is possible; neither operation deletes or hides live rows. `maintenance_reindex` with ' +
+    'concurrently:false (default, single table/index) DOES support a real dry run through the usual confirm protocol — it actually rebuilds ' +
+    'the index inside a rolled-back transaction. concurrently:true cannot run inside a transaction either, so it also runs immediately with ' +
+    'no dry run. REINDEX without CONCURRENTLY takes an ACCESS EXCLUSIVE lock on the target — expect it to block other queries on a busy ' +
+    `table. ${CONFIRM_PROTOCOL_DESCRIPTION}`;
+//# sourceMappingURL=maintenance.js.map

package/dist/tools/admin/maintenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintenance.js","sourceRoot":"","sources":["../../../src/tools/admin/maintenance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,oFAAoF,CAAC;IAC1I,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC;CAC5G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACpC,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,iGAAiG,CAAC;IAC/J,GAAG,eAAe;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAgB,EAAE,IAA6C;IAC3G,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEjI,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAClJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAgB,EAAE,IAA8C;IAC7G,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,WAAW,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACnJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAgB,EAAE,IAA8C;IAC7G,MAAM,WAAW,GACf,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzI,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;IAE3D,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,WAAW,MAAM,iBAAiB,MAAM,EAAE,CAAC;QACvD,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,wCAAwC,EAAE,CAAC,CAAC;QAChK,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,MAAM,IAAI,MAAM,EAAE,CAAC;IAC1C,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,2BAA2B;QACtC,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAClC,0IAA0I;IAC1I,6HAA6H;IAC7H,yIAAyI;IACzI,yIAAyI;IACzI,qIAAqI;IACrI,UAAU,4BAA4B,EAAE,CAAC"}

package/dist/tools/admin/roles.js

@@ -0,0 +1,144 @@
+import { z } from 'zod';
+import { PgMcpError } from '../../core/errors.js';
+import { CONFIRM_PROTOCOL_DESCRIPTION, runGuardedMutation } from '../../core/guards.js';
+import { assertRoleAvailable, resolveRole } from '../../core/identifiers.js';
+import { requireCapability } from '../../core/policy.js';
+import { getRoleDependencies, listRoles } from '../../db/catalog.js';
+import { withSession } from '../../db/session.js';
+import { confirmFragment, toExpectToken } from '../_batch_shared.js';
+import { reportList } from './_shared.js';
+/**
+ * `roles` sub-operation: list roles/attributes/memberships (read-only, no
+ * capability), and create/alter/drop a role (requires `admin`, guarded via
+ * `runGuardedMutation` — no `RETURNING`, so `keyColumns` is always empty and
+ * the dry run's row count is not meaningful for these, same caveat as DDL in
+ * `execute_sql`).
+ */
+export const rolesListSchema = z.object({
+    op: z.literal('roles_list'),
+    namePattern: z.string().optional().describe('SQL ILIKE pattern to filter role names, e.g. "app_%".'),
+});
+export const rolesCreateSchema = z.object({
+    op: z.literal('roles_create'),
+    role: z.string().min(1),
+    login: z.boolean().optional().default(false),
+    superuser: z.boolean().optional().default(false),
+    createDb: z.boolean().optional().default(false),
+    createRole: z.boolean().optional().default(false),
+    replication: z.boolean().optional().default(false),
+    connectionLimit: z.number().int().optional().describe('-1 (default in PostgreSQL) means unlimited.'),
+    ...confirmFragment,
+});
+export const rolesAlterSchema = z.object({
+    op: z.literal('roles_alter'),
+    role: z.string().min(1),
+    set: z
+        .object({
+        login: z.boolean().optional(),
+        superuser: z.boolean().optional(),
+        createDb: z.boolean().optional(),
+        createRole: z.boolean().optional(),
+        replication: z.boolean().optional(),
+        connectionLimit: z.number().int().optional(),
+        validUntil: z.string().datetime().nullable().optional().describe('ISO 8601 timestamp; null clears it to VALID UNTIL infinity.'),
+    })
+        .refine((v) => Object.values(v).some((x) => x !== undefined), { message: 'set must include at least one attribute to change' })
+        .describe('Attributes to change. Password changes are out of scope for postgres_admin — use postgres_execute_sql on a profile with ALLOW_DDL for ALTER ROLE ... PASSWORD.'),
+    ...confirmFragment,
+});
+export const rolesDropSchema = z.object({
+    op: z.literal('roles_drop'),
+    role: z.string().min(1),
+    ...confirmFragment,
+});
+export async function handleRolesList(profile, args) {
+    const roles = await withSession(profile, (client) => listRoles(client, args.namePattern), { operation: 'admin_roles_list' });
+    return reportList(profile, roles);
+}
+function alterOptionClause(set) {
+    const parts = [];
+    if (set.login !== undefined)
+        parts.push(set.login ? 'LOGIN' : 'NOLOGIN');
+    if (set.superuser !== undefined)
+        parts.push(set.superuser ? 'SUPERUSER' : 'NOSUPERUSER');
+    if (set.createDb !== undefined)
+        parts.push(set.createDb ? 'CREATEDB' : 'NOCREATEDB');
+    if (set.createRole !== undefined)
+        parts.push(set.createRole ? 'CREATEROLE' : 'NOCREATEROLE');
+    if (set.replication !== undefined)
+        parts.push(set.replication ? 'REPLICATION' : 'NOREPLICATION');
+    if (set.connectionLimit !== undefined)
+        parts.push(`CONNECTION LIMIT ${set.connectionLimit}`);
+    return parts;
+}
+export async function handleRolesCreate(profile, args) {
+    const roleIdent = await assertRoleAvailable(profile, args.role);
+    const parts = alterOptionClause(args);
+    const sql = `CREATE ROLE ${roleIdent} WITH ${parts.join(' ')}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_roles_create',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export async function handleRolesAlter(profile, args) {
+    const role = await resolveRole(profile, args.role);
+    const parts = alterOptionClause(args.set);
+    if (args.set.validUntil !== undefined) {
+        const escaped = (args.set.validUntil ?? 'infinity').replace(/'/g, "''");
+        parts.push(`VALID UNTIL '${escaped}'`);
+    }
+    const sql = `ALTER ROLE ${role.name} WITH ${parts.join(' ')}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_roles_alter',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export async function handleRolesDrop(profile, args) {
+    // Extra catalog work (the dependency precheck) happens outside
+    // runGuardedMutation, so it needs its own gate — resolveRole/create/alter
+    // above rely on runGuardedMutation's internal check, same as
+    // delete_batch.ts's resolveRelation-before-guard convention.
+    requireCapability('admin', profile);
+    const role = await resolveRole(profile, args.role);
+    const deps = await withSession(profile, (client) => getRoleDependencies(client, role.oid), { operation: 'admin_roles_drop_precheck' });
+    if (deps.length > 0) {
+        const shown = deps.slice(0, 20);
+        throw new PgMcpError({
+            code: 'PG_ERROR',
+            message: `role "${args.role}" owns or is referenced by ${deps.length} object(s) and cannot be dropped as-is: ${shown.join('; ')}${deps.length > shown.length ? ', …' : ''}`,
+            hint: 'reassign ownership first — e.g. `REASSIGN OWNED BY <role> TO <new_owner>; DROP OWNED BY <role>;` via postgres_execute_sql on a profile with ' +
+                `ALLOW_DDL — or run \`SELECT * FROM pg_shdepend WHERE refobjid = '${args.role}'::regrole\` to see every dependent yourself, then retry roles_drop`,
+            details: { profile: profile.alias, role: args.role, dependents: deps },
+        });
+    }
+    const sql = `DROP ROLE ${role.name}`;
+    return runGuardedMutation({
+        profile,
+        capability: 'admin',
+        operation: 'admin_roles_drop',
+        sql,
+        params: [],
+        keyColumns: [],
+        confirm: args.confirm,
+        expect: toExpectToken(args.expect),
+        allowRowDrift: args.allowRowDrift,
+    });
+}
+export const ROLES_DESCRIPTION = `\`roles_list\` (read-only, no capability) lists roles with attributes and memberships. \`roles_create\`/\`roles_alter\`/\`roles_drop\` ` +
+    `require the \`admin\` capability. Password changes are out of scope — use postgres_execute_sql for those. \`roles_drop\` checks ` +
+    `pg_shdepend first and refuses with the exact dependent objects instead of PostgreSQL's raw error when the role still owns something. ${CONFIRM_PROTOCOL_DESCRIPTION}`;
+//# sourceMappingURL=roles.js.map

package/dist/tools/admin/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/tools/admin/roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;CACrG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACpG,GAAG,eAAe;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7B,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;KAChI,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;SAC9H,QAAQ,CAAC,gKAAgK,CAAC;IAC7K,GAAG,eAAe;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,GAAG,eAAe;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAqC;IAC3F,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC7H,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAO1B;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IACjG,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAAuC;IAC/F,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,SAAS,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/D,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,oBAAoB;QAC/B,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,IAAsC;IAC7F,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,IAAI,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,mBAAmB;QAC9B,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAqC;IAC3F,+DAA+D;IAC/D,0EAA0E;IAC1E,6DAA6D;IAC7D,6DAA6D;IAC7D,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,SAAS,IAAI,CAAC,IAAI,8BAA8B,IAAI,CAAC,MAAM,2CAA2C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3K,IAAI,EACF,8IAA8I;gBAC9I,oEAAoE,IAAI,CAAC,IAAI,qEAAqE;YACpJ,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,kBAAkB,CAAC;QACxB,OAAO;QACP,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,kBAAkB;QAC7B,GAAG;QACH,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yIAAyI;IACzI,kIAAkI;IAClI,wIAAwI,4BAA4B,EAAE,CAAC"}