pg-admin-mcp 0.0.0-stage → 0.1.0

package/dist/core/classifier.js

@@ -0,0 +1,279 @@
+import { PgMcpError } from './errors.js';
+/**
+ * PostgreSQL treats every non-ASCII byte as an identifier/tag character. The
+ * ranges are spelled as a codepoint test rather than a regex range so this file
+ * stays pure ASCII — an invisible character in a security-relevant scanner is
+ * exactly the kind of thing nobody spots in review.
+ *
+ * Failing to recognize a tag would make the scanner *over*-split on `;`, which
+ * fails closed (the call is refused), never open.
+ */
+function isHigh(ch) {
+    return ch.charCodeAt(0) > 127;
+}
+function isTagStart(ch) {
+    return /[A-Za-z_]/.test(ch) || isHigh(ch);
+}
+function isTagChar(ch) {
+    return /[A-Za-z0-9_]/.test(ch) || isHigh(ch);
+}
+/** `$` is an identifier character in PostgreSQL, which is why `a$$b$$` is not a dollar quote. */
+function isIdentChar(ch) {
+    return /[A-Za-z0-9_$]/.test(ch) || isHigh(ch);
+}
+/**
+ * End index (exclusive) of a `'…'` or `"…"` run. A doubled quote continues it.
+ * `escapes` is only ever true for an `E'…'` string — in a plain string under
+ * `standard_conforming_strings = on` a backslash is an ordinary character, and
+ * treating `\'` as an escape there would swallow the real terminator and, with
+ * it, any `;` that followed. Unterminated runs stop at end of input; PostgreSQL
+ * gets to reject those itself.
+ */
+function scanQuoted(sql, start, quote, escapes) {
+    for (let i = start + 1; i < sql.length; i++) {
+        const ch = sql.charAt(i);
+        if (escapes && ch === '\\') {
+            i++;
+            continue;
+        }
+        if (ch !== quote)
+            continue;
+        if (sql.charAt(i + 1) === quote) {
+            i++;
+            continue;
+        }
+        return i + 1;
+    }
+    return sql.length;
+}
+/** True when the quote at `i` opens an `E'…'` escape string. */
+function hasEscapePrefix(sql, i) {
+    const prev = sql.charAt(i - 1);
+    if (prev !== 'E' && prev !== 'e')
+        return false;
+    return i < 2 || !isIdentChar(sql.charAt(i - 2));
+}
+/** PostgreSQL block comments nest, so this counts depth instead of stopping at the first close. */
+function scanBlockComment(sql, start) {
+    let depth = 1;
+    let i = start + 2;
+    while (i < sql.length) {
+        if (sql.charAt(i) === '/' && sql.charAt(i + 1) === '*') {
+            depth++;
+            i += 2;
+            continue;
+        }
+        if (sql.charAt(i) === '*' && sql.charAt(i + 1) === '/') {
+            depth--;
+            i += 2;
+            if (depth === 0)
+                return i;
+            continue;
+        }
+        i++;
+    }
+    return sql.length;
+}
+/**
+ * End index of a `$tag$ … $tag$` body, or `start` when the `$` is not a
+ * dollar-quote opener at all (`$1` placeholders, `a$b` identifiers). Only an
+ * exact repeat of the opening tag closes the body — which is precisely why a
+ * `$inner$` sequence inside a `$outer$` body is inert text and needs no nesting
+ * logic of its own.
+ */
+function scanDollarQuoted(sql, start) {
+    if (start > 0 && isIdentChar(sql.charAt(start - 1)))
+        return start;
+    let i = start + 1;
+    if (i < sql.length && isTagStart(sql.charAt(i))) {
+        i++;
+        while (i < sql.length && isTagChar(sql.charAt(i)))
+            i++;
+    }
+    if (sql.charAt(i) !== '$')
+        return start;
+    const tag = sql.slice(start, i + 1);
+    const close = sql.indexOf(tag, i + 1);
+    return close === -1 ? sql.length : close + tag.length;
+}
+/**
+ * The one scanner. Both exported functions consume it, so they cannot drift
+ * into disagreeing about where a string or a comment ends.
+ */
+function segments(sql) {
+    const out = [];
+    let i = 0;
+    let codeStart = 0;
+    const flushCode = (upTo) => {
+        if (upTo > codeStart)
+            out.push({ kind: 'code', start: codeStart, end: upTo });
+    };
+    const push = (kind, end) => {
+        flushCode(i);
+        out.push({ kind, start: i, end });
+        i = end;
+        codeStart = end;
+    };
+    while (i < sql.length) {
+        const ch = sql.charAt(i);
+        const next = sql.charAt(i + 1);
+        if (ch === "'") {
+            push('literal', scanQuoted(sql, i, "'", hasEscapePrefix(sql, i)));
+        }
+        else if (ch === '"') {
+            push('literal', scanQuoted(sql, i, '"', false));
+        }
+        else if (ch === '-' && next === '-') {
+            const nl = sql.indexOf('\n', i);
+            push('comment', nl === -1 ? sql.length : nl);
+        }
+        else if (ch === '/' && next === '*') {
+            push('comment', scanBlockComment(sql, i));
+        }
+        else if (ch === ';') {
+            push('terminator', i + 1);
+        }
+        else if (ch === '$') {
+            const end = scanDollarQuoted(sql, i);
+            if (end > i)
+                push('literal', end);
+            else
+                i++; // `$1` and friends stay part of the surrounding code segment
+        }
+        else {
+            i++;
+        }
+    }
+    flushCode(sql.length);
+    return out;
+}
+/**
+ * The raw segmentation, for consumers that need to look at SQL *text* without
+ * being fooled by a keyword hiding in a string literal or a comment —
+ * `core/guards.ts` uses it for both the WHERE guard and `normalizeSql`.
+ *
+ * Exported as a thin pass-through on purpose: `segments` itself stays private
+ * so the scanner has exactly one implementation, and everything that needs to
+ * reason about literal-vs-code boundaries agrees with `splitStatements` by
+ * construction.
+ */
+export function scanSegments(sql) {
+    return segments(sql);
+}
+/**
+ * Splits `sql` into executable statements, with the `;` terminators stripped.
+ * Whitespace-only and comment-only runs yield nothing — a trailing `;`, a
+ * trailing `-- note`, and `''` all produce zero extra statements rather than a
+ * phantom empty one.
+ */
+export function splitStatements(sql) {
+    const out = [];
+    let start = 0;
+    let significant = false;
+    for (const seg of segments(sql)) {
+        if (seg.kind === 'terminator') {
+            if (significant)
+                out.push(sql.slice(start, seg.start).trim());
+            start = seg.end;
+            significant = false;
+            continue;
+        }
+        if (seg.kind === 'literal')
+            significant = true;
+        else if (seg.kind === 'code' && sql.slice(seg.start, seg.end).trim() !== '')
+            significant = true;
+    }
+    if (significant)
+        out.push(sql.slice(start).trim());
+    return out;
+}
+/** Statements that write, recognized by their leading keyword only. See the file header for why it stops there. */
+const WRITE_KEYWORDS = new Set([
+    'INSERT',
+    'UPDATE',
+    'DELETE',
+    'MERGE',
+    'DROP',
+    'CREATE',
+    'ALTER',
+    'TRUNCATE',
+    'GRANT',
+    'REVOKE',
+]);
+/**
+ * The statement's leading keyword, upper-cased — or `undefined` when the
+ * statement opens with something that is not a bare word at all (a string
+ * literal, `(`-wrapped nothing, an empty statement).
+ *
+ * Leading comments are skipped (a commented preamble in front of an INSERT is
+ * still an INSERT), and a keyword that only appears inside a string literal or
+ * a quoted identifier is invisible here — the scanner never hands those back as
+ * code.
+ *
+ * **Only ever the FIRST word.** It answers "what kind of statement does this
+ * look like", never "what does this statement do": `WITH x AS (INSERT …) SELECT`
+ * reads as `WITH`, and that is deliberate — see {@link obviousWriteKeyword}.
+ */
+export function leadingKeyword(statement) {
+    for (const seg of segments(statement)) {
+        if (seg.kind === 'comment' || seg.kind === 'terminator')
+            continue;
+        if (seg.kind === 'literal')
+            return undefined; // a statement that opens with a literal is not keyword-led
+        const word = /^[\s(]*([A-Za-z_]+)/.exec(statement.slice(seg.start, seg.end));
+        if (word === null)
+            continue; // whitespace-only code run, keep looking
+        return (word[1] ?? '').toUpperCase();
+    }
+    return undefined;
+}
+/**
+ * The statement's leading keyword when it is an obvious writer, else
+ * `undefined`.
+ *
+ * Returns `undefined` for `WITH x AS (INSERT …) SELECT …` **on purpose**: that
+ * statement is rejected by the read-only transaction with SQLSTATE 25006, which
+ * is the actual mechanism, and a pre-check that appeared to cover it would
+ * invite the next reader to trust this function as the fence.
+ */
+export function obviousWriteKeyword(statement) {
+    const keyword = leadingKeyword(statement);
+    return keyword !== undefined && WRITE_KEYWORDS.has(keyword) ? keyword : undefined;
+}
+/**
+ * Splits `sql` and enforces the multi-statement policy of design.md risk 7.
+ *
+ * The `hasParams` case is called out separately because the failure mode it
+ * prevents is silent: `pg` would fall back to simple-query mode and **drop the
+ * parameters on the floor**, running whatever the SQL text happened to say.
+ */
+export function planStatements(sql, policy) {
+    const statements = splitStatements(sql);
+    if (statements.length === 0) {
+        throw new PgMcpError({
+            code: 'PG_ERROR',
+            message: 'sql contains no executable statement (it is empty, whitespace, or only comments)',
+            hint: 'pass one SQL statement in sql and re-run',
+        });
+    }
+    if (statements.length > 1 && policy.hasParams) {
+        throw new PgMcpError({
+            code: 'PG_ERROR',
+            message: `sql contains ${statements.length} statements and params were supplied — PostgreSQL only binds parameters in ` +
+                'extended query mode, which accepts exactly one statement, so a multi-statement string would otherwise run ' +
+                'with the parameters silently dropped',
+            hint: 'split this into one statement per call, each with its own params, and re-run',
+            details: { statements: statements.length },
+        });
+    }
+    if (statements.length > 1 && !policy.allowMultiple) {
+        throw new PgMcpError({
+            code: 'PG_ERROR',
+            message: `sql contains ${statements.length} statements, and multi-statement strings are refused by default`,
+            hint: 'send one statement per call, or pass allowMultiple: true if running all of them really is intended',
+            details: { statements: statements.length },
+        });
+    }
+    return statements;
+}
+//# sourceMappingURL=classifier.js.map

package/dist/core/classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../../src/core/classifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsEzC;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAChC,CAAC;AACD,SAAS,UAAU,CAAC,EAAU;IAC5B,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC;AACD,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AACD,iGAAiG;AACjG,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,KAAa,EAAE,OAAgB;IAC7E,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC3B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,KAAK;YAAE,SAAS;QAC3B,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YAChC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAW,EAAE,CAAS;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,KAAK,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,KAAK,EAAE,CAAC;YACR,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElE,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,CAAC,EAAE,CAAC;QACJ,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAQ,EAAE;QACvC,IAAI,IAAI,GAAG,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAiB,EAAE,GAAW,EAAQ,EAAE;QACpD,SAAS,CAAC,CAAC,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC,GAAG,GAAG,CAAC;QACR,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAE/B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;;gBAC7B,CAAC,EAAE,CAAC,CAAC,6DAA6D;QACzE,CAAC;aAAM,CAAC;YACN,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,IAAI,WAAW;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9D,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;YAChB,WAAW,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;aAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,WAAW,GAAG,IAAI,CAAC;IAClG,CAAC;IAED,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mHAAmH;AACnH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,UAAU;IACV,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,SAAS;QAClE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,CAAC,2DAA2D;QACzG,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS,CAAC,yCAAyC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAuB;IACjE,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kFAAkF;YAC3F,IAAI,EAAE,0CAA0C;SACjD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,gBAAgB,UAAU,CAAC,MAAM,6EAA6E;gBAC9G,4GAA4G;gBAC5G,sCAAsC;YACxC,IAAI,EAAE,8EAA8E;YACpF,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,gBAAgB,UAAU,CAAC,MAAM,iEAAiE;YAC3G,IAAI,EAAE,oGAAoG;YAC1G,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/core/errors.js

@@ -0,0 +1,197 @@
+import { inContainer } from '../runtime/environment.js';
+export class PgMcpError extends Error {
+    code;
+    hint;
+    details;
+    constructor(init) {
+        if (init.hint.trim() === '') {
+            throw new Error('PgMcpError requires a non-empty hint — an actionless error cannot be constructed.');
+        }
+        super(`${init.message} → ${init.hint}`, init.cause === undefined ? undefined : { cause: init.cause });
+        // No manual prototype patch needed: at `target: ES2023`, `class ... extends
+        // Error` compiles to a native class, and `super()` already sets the
+        // prototype from `new.target` — including for subclasses.
+        this.name = 'PgMcpError';
+        this.code = init.code;
+        this.hint = init.hint;
+        this.details = init.details;
+    }
+    toString() {
+        return `${this.code}: ${this.message}`;
+    }
+}
+/**
+ * `dev` -> `PG_DEV`; unknown profile -> `PG_<ALIAS>` so the hint still reads as
+ * a template. Exported so `config/profiles.ts` derives the exact same
+ * per-profile env prefix from an alias — one definition, so the two cannot
+ * drift apart.
+ */
+export function envPrefix(profile) {
+    if (profile === undefined || profile === '')
+        return 'PG_<ALIAS>';
+    return `PG_${profile.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
+}
+function errCode(err) {
+    if (typeof err === 'object' && err !== null && 'code' in err) {
+        const code = err.code;
+        if (typeof code === 'string')
+            return code;
+    }
+    return undefined;
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+const UNREACHABLE_SOCKET_CODES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EHOSTUNREACH']);
+/** The socket errnos {@link fromPgError} maps to `PROFILE_UNREACHABLE`. `db/session.ts` asks before routing. */
+export function isUnreachableErrno(err) {
+    const code = errCode(err);
+    return code !== undefined && UNREACHABLE_SOCKET_CODES.has(code);
+}
+/**
+ * `pg-pool`'s two `connectionTimeoutMillis` failures. Matched on message
+ * because `pg-pool` constructs a bare `Error` with no `code` for both — the
+ * literals are copied verbatim from `pg-pool@3.14.0`'s `index.js` (queue wait,
+ * and new-client connect respectively) and are covered by a unit test so a
+ * dependency bump that reworded them shows up as a failure rather than as a
+ * silent downgrade to `PG_ERROR`.
+ */
+const CONNECT_TIMEOUT_MESSAGES = [
+    'timeout exceeded when trying to connect',
+    'Connection terminated due to connection timeout',
+];
+export function isConnectTimeout(err) {
+    if (!(err instanceof Error))
+        return false;
+    return CONNECT_TIMEOUT_MESSAGES.some((m) => err.message === m);
+}
+/**
+ * Maps a PostgreSQL (or socket) error onto the taxonomy. SQLSTATE is always
+ * preserved in `details.sqlstate`, including for the `PG_ERROR` fallthrough.
+ * Socket errnos (`ECONNREFUSED` etc.) are not SQLSTATEs — those are preserved
+ * in `details.errno` instead, matching {@link enrichUnreachable}.
+ */
+export function fromPgError(err, ctx = {}) {
+    if (err instanceof PgMcpError)
+        return err;
+    const rawCode = errCode(err);
+    const isSocketCode = rawCode !== undefined && UNREACHABLE_SOCKET_CODES.has(rawCode);
+    const sqlstate = isSocketCode ? undefined : rawCode;
+    const prefix = envPrefix(ctx.profile);
+    const message = errMessage(err);
+    const details = {
+        ...(sqlstate === undefined ? {} : { sqlstate }),
+        ...(isSocketCode ? { errno: rawCode } : {}),
+        ...(ctx.profile === undefined ? {} : { profile: ctx.profile }),
+        ...(ctx.operation === undefined ? {} : { operation: ctx.operation }),
+    };
+    const make = (code, hint) => new PgMcpError({ code, message, hint, details, cause: err });
+    switch (sqlstate) {
+        case '25006': // read_only_sql_transaction
+            // Two entirely different situations share this SQLSTATE, and telling the
+            // second one to set a flag it already set sends an agent into a loop.
+            // With `ALLOW_WRITE` off, the profile is the reason. With it ON, the only
+            // way to reach 25006 is a statement whose *leading keyword* does not say
+            // it writes (`WITH x AS (INSERT … RETURNING) SELECT`, `SELECT nextval()`,
+            // a VOLATILE function that writes), so it took the read path — see
+            // `tools/execute_sql.ts`'s routing section. The fix is to rewrite the
+            // statement, not to change the environment.
+            return make('POLICY_READ_ONLY', ctx.write === true
+                ? 'this profile already allows writes, so the statement reached the read-only path: its leading keyword ' +
+                    'does not say it writes (WITH ... INSERT ... RETURNING, SELECT nextval(), a VOLATILE function that ' +
+                    'writes), and only a statement that starts with INSERT/UPDATE/DELETE/MERGE gets the guarded write path. ' +
+                    'Rewrite it as a plain INSERT/UPDATE/DELETE and re-run, so the change goes through the dry-run/confirm ' +
+                    'protocol'
+                : `this profile runs writes inside a read-only transaction; set ${prefix}_ALLOW_WRITE=true for this profile and re-run`);
+        case '57014': // query_canceled (statement_timeout)
+            return make('TIMEOUT', `narrow the query, or raise ${prefix}_STATEMENT_TIMEOUT_MS and re-run`);
+        case '55P03': // lock_not_available (lock_timeout)
+            return make('LOCK_TIMEOUT', `another session holds the lock; retry once it clears, or raise ${prefix}_LOCK_TIMEOUT_MS`);
+        case '42P01': // undefined_table
+        case '42703': // undefined_column
+            return make('IDENTIFIER_UNKNOWN', 'run postgres_list_tables or postgres_describe_table to get the exact name, then re-run with it');
+        default:
+            break;
+    }
+    if (isSocketCode) {
+        return make('PROFILE_UNREACHABLE', `run postgres_connection_status to see the host and port this profile resolves to, then fix ${prefix}_URL`);
+    }
+    return make('PG_ERROR', 'fix the statement reported above and re-run; PostgreSQL rejected it as written');
+}
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
+export function isLoopbackHost(host) {
+    return LOOPBACK_HOSTS.has(host.trim().toLowerCase().replace(/^\[|\]$/g, ''));
+}
+/**
+ * The container-networking diagnosis — the #1 support issue.
+ *
+ * Fires when the server runs in a container and the profile points at loopback,
+ * and ALSO on a bare `ECONNREFUSED` whatever the literal host: a host that was
+ * rewritten but is still wrong produces exactly the same symptom, and the
+ * remediation block is the answer in both cases.
+ *
+ * `opts.inContainer` exists purely as a test seam.
+ */
+export function enrichUnreachable(err, profile, opts = {}) {
+    if (err instanceof PgMcpError)
+        return err;
+    // A pool checkout that ran out of time is neither a socket errno nor a
+    // SQLSTATE, so `fromPgError` would label it `PG_ERROR` and tell the caller to
+    // fix their statement. It is one of exactly two things, and the hint says so.
+    if (isConnectTimeout(err)) {
+        return new PgMcpError({
+            code: 'PROFILE_UNREACHABLE',
+            message: `profile "${profile.alias}" could not check out a connection within PG_MCP_CONNECT_TIMEOUT_MS`,
+            hint: `either the pool is saturated (raise ${envPrefix(profile.alias)}_POOL_MAX, or run fewer concurrent calls) or ` +
+                `${profile.host}:${profile.port ?? 5432} is not answering — run postgres_connection_status to check. If this ` +
+                'fired on a single idle server, a tool took a second pool checkout while still holding the first',
+            details: {
+                profile: profile.alias,
+                host: profile.host,
+                port: profile.port ?? 5432,
+            },
+            cause: err,
+        });
+    }
+    const inside = opts.inContainer ?? inContainer();
+    const code = errCode(err);
+    const loopback = isLoopbackHost(profile.host);
+    const target = `${profile.host}:${profile.port ?? 5432}`;
+    const prefix = envPrefix(profile.alias);
+    if (!(code === 'ECONNREFUSED' || (inside && loopback))) {
+        return fromPgError(err, { profile: profile.alias });
+    }
+    const message = inside && loopback
+        ? `profile "${profile.alias}" points at ${target}, but this server runs inside a container where localhost is the container itself`
+        : `profile "${profile.alias}" is unreachable at ${target} (${code ?? 'connection refused'})`;
+    return new PgMcpError({
+        code: 'PROFILE_UNREACHABLE',
+        message,
+        hint: [
+            '',
+            `  • DB on your host, Docker Desktop → set ${prefix}_URL host to host.docker.internal`,
+            '  • DB on your host, Linux          → same, plus --add-host=host.docker.internal:host-gateway',
+            '  • DB in another container         → --network <net> and use the service name as host',
+        ].join('\n'),
+        details: {
+            profile: profile.alias,
+            host: profile.host,
+            port: profile.port ?? 5432,
+            runtime: inside ? 'container' : 'host',
+            ...(code === undefined ? {} : { errno: code }),
+        },
+        cause: err,
+    });
+}
+/**
+ * Converts anything into the SDK tool-result shape. Tools call this from their
+ * `catch` instead of rethrowing — see the file header for why.
+ */
+export function toToolResult(err) {
+    const pgErr = err instanceof PgMcpError ? err : fromPgError(err);
+    return {
+        content: [{ type: 'text', text: pgErr.toString() }],
+        isError: true,
+    };
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAqDxD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IACrB,IAAI,CAAS;IACb,OAAO,CAAsC;IAEtD,YAAY,IAAoB;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtG,4EAA4E;QAC5E,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAEQ,QAAQ;QACf,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;CACF;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAA2B;IACnD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACjE,OAAO,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAExF,gHAAgH;AAChH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,KAAK,SAAS,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG;IAC/B,yCAAyC;IACzC,iDAAiD;CAClD,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,MAAsB,EAAE;IAChE,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAC;IAE1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAA4B;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;KACrE,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,IAAY,EAAc,EAAE,CAC9D,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAE/D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,EAAE,4BAA4B;YACxC,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,mEAAmE;YACnE,sEAAsE;YACtE,4CAA4C;YAC5C,OAAO,IAAI,CACT,kBAAkB,EAClB,GAAG,CAAC,KAAK,KAAK,IAAI;gBAChB,CAAC,CAAC,uGAAuG;oBACvG,oGAAoG;oBACpG,yGAAyG;oBACzG,wGAAwG;oBACxG,UAAU;gBACZ,CAAC,CAAC,gEAAgE,MAAM,+CAA+C,CAC1H,CAAC;QACJ,KAAK,OAAO,EAAE,qCAAqC;YACjD,OAAO,IAAI,CACT,SAAS,EACT,8BAA8B,MAAM,kCAAkC,CACvE,CAAC;QACJ,KAAK,OAAO,EAAE,oCAAoC;YAChD,OAAO,IAAI,CACT,cAAc,EACd,kEAAkE,MAAM,kBAAkB,CAC3F,CAAC;QACJ,KAAK,OAAO,CAAC,CAAC,kBAAkB;QAChC,KAAK,OAAO,EAAE,mBAAmB;YAC/B,OAAO,IAAI,CACT,oBAAoB,EACpB,gGAAgG,CACjG,CAAC;QACJ;YACE,MAAM;IACV,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CACT,qBAAqB,EACrB,8FAA8F,MAAM,MAAM,CAC3G,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,UAAU,EAAE,gFAAgF,CAAC,CAAC;AAC5G,CAAC;AASD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAY,EACZ,OAA2B,EAC3B,OAAkC,EAAE;IAEpC,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAC;IAE1C,uEAAuE;IACvE,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,UAAU,CAAC;YACpB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,YAAY,OAAO,CAAC,KAAK,qEAAqE;YACvG,IAAI,EACF,uCAAuC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,+CAA+C;gBAC9G,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,uEAAuE;gBAC9G,iGAAiG;YACnG,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,KAAK;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;aAC3B;YACD,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAExC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GACX,MAAM,IAAI,QAAQ;QAChB,CAAC,CAAC,YAAY,OAAO,CAAC,KAAK,eAAe,MAAM,mFAAmF;QACnI,CAAC,CAAC,YAAY,OAAO,CAAC,KAAK,uBAAuB,MAAM,KAAK,IAAI,IAAI,oBAAoB,GAAG,CAAC;IAEjG,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,EAAE,qBAAqB;QAC3B,OAAO;QACP,IAAI,EAAE;YACJ,EAAE;YACF,6CAA6C,MAAM,mCAAmC;YACtF,+FAA+F;YAC/F,wFAAwF;SACzF,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YACtC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/C;QACD,KAAK,EAAE,GAAG;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC"}