pg-admin-mcp 0.0.0-stage → 0.1.0

package/dist/core/guards.js

@@ -0,0 +1,513 @@
+import { createHash } from 'node:crypto';
+import { withTx } from '../db/session.js';
+import { noteAudit } from './audit-context.js';
+import { scanSegments } from './classifier.js';
+import { PgMcpError } from './errors.js';
+import { confirmPolicyFor, effectiveRowDrift, requireCapability } from './policy.js';
+function missingWhere(message, hint, ctx, details = {}) {
+    throw new PgMcpError({
+        code: 'GUARD_MISSING_WHERE',
+        message,
+        hint,
+        details: {
+            profile: ctx.profile,
+            operation: ctx.operation,
+            ...(ctx.target === undefined ? {} : { target: ctx.target }),
+            ...details,
+        },
+    });
+}
+/** A structured `where` must carry at least one predicate — an empty array is an unfiltered statement written the polite way. */
+export function assertStructuredWhere(predicateCount, ctx) {
+    if (predicateCount > 0)
+        return;
+    missingWhere(`${ctx.operation} was called with no filter, which would affect every row of ${ctx.target ?? 'the target relation'}`, 'add at least one predicate to `where`; to empty a table deliberately, use postgres_execute_sql with TRUNCATE ' +
+        'on a profile that allows DDL', ctx);
+}
+/**
+ * Words that carry no row-dependence. A WHERE clause built **only** out of
+ * these plus literals and operators matches every row, so it is refused.
+ * Anything else — a column, a function call, a subquery — counts as a real
+ * reference and passes.
+ */
+const CONSTANT_WORDS = new Set([
+    'and',
+    'or',
+    'not',
+    'is',
+    'isnull',
+    'notnull',
+    'true',
+    'false',
+    'null',
+    'unknown',
+    'between',
+    'symmetric',
+    'asymmetric',
+    'in',
+    'like',
+    'ilike',
+    'similar',
+    'to',
+    'escape',
+    'distinct',
+    'from',
+    'as',
+    'collate',
+    'cast',
+    'uescape',
+]);
+/**
+ * The letters PostgreSQL allows in front of a string literal (`E'…'`, `B'…'`,
+ * `X'…'`, `N'…'`, `U&'…'`). The scanner hands the literal back as a literal but
+ * the prefix back as *code*, where a bare `E` reads exactly like a column name —
+ * which is how `WHERE E'a' = E'a'` used to pass the check below.
+ */
+const LITERAL_PREFIX_RE = /(?:[EeBbXxNn]|[Uu]&)$/;
+/**
+ * A word that could be a column or a function name. The non-ASCII range is
+ * spelled with escapes so this file stays pure ASCII, same rule as
+ * `core/classifier.ts` and for the same reason: an invisible character in a
+ * security-relevant scanner is what nobody spots in review.
+ */
+const WORD_RE = /[A-Za-z_\u0080-\uFFFF][A-Za-z0-9_$\u0080-\uFFFF]*/g;
+/**
+ * A cast's type name (`'a'::text`, `id::bigint[]`) is code, but it is no more a
+ * column reference than the `text` in `CAST('a' AS text)` is. Struck out before
+ * the word scan so `WHERE 'a'::text = 'a'` is refused like `WHERE 'a' = 'a'`.
+ * Built from {@link WORD_RE} so the two agree on what a word is.
+ */
+const CAST_TYPE_RE = new RegExp(`::\\s*${WORD_RE.source}(?:\\s*\\[\\s*\\])*`, 'g');
+/**
+ * Blanks every literal, comment and terminator, preserving offsets, so a
+ * keyword search sees only real SQL code. `WHERE` inside `'…'`, `"…"`,
+ * `$tag$…$tag$`, `-- …` or a nested `/* … *\/` is invisible here, exactly as it
+ * is to PostgreSQL. The scanner is `core/classifier.ts`'s — the same one that
+ * backs multi-statement rejection, so the two cannot disagree about where a
+ * literal ends.
+ */
+function codeMask(sql) {
+    let out = '';
+    for (const seg of scanSegments(sql)) {
+        const text = sql.slice(seg.start, seg.end);
+        if (seg.kind === 'code') {
+            out += text;
+            continue;
+        }
+        // The `E`/`B`/`X`/`N`/`U&` in front of a literal is part of the literal's
+        // syntax, not a reference to anything — blank it with the literal it opens.
+        // Length-preserving, so offsets still line up.
+        out = out.replace(LITERAL_PREFIX_RE, (prefix) => ' '.repeat(prefix.length));
+        out += ' '.repeat(text.length);
+    }
+    // `segments` partitions the whole input, so offsets are preserved exactly.
+    return out;
+}
+/** Index just past a depth-0 occurrence of `keyword`, or -1. Parenthesised occurrences (a subquery's own WHERE) are skipped. */
+function findTopLevelKeyword(mask, keyword) {
+    const re = new RegExp(`\\b${keyword}\\b`, 'gi');
+    let depth = 0;
+    let scanned = 0;
+    for (let match = re.exec(mask); match !== null; match = re.exec(mask)) {
+        for (; scanned < match.index; scanned++) {
+            const ch = mask.charAt(scanned);
+            if (ch === '(')
+                depth++;
+            else if (ch === ')')
+                depth--;
+        }
+        if (depth === 0)
+            return match.index + match[0].length;
+    }
+    return -1;
+}
+/**
+ * Rejects a raw `UPDATE`/`DELETE` whose WHERE clause is absent or matches
+ * everything.
+ *
+ * **What this cannot do, stated plainly.** It is a lexical check, not a
+ * planner. `WHERE id = id`, `WHERE x IS NOT NULL` on a `NOT NULL` column,
+ * `WHERE coalesce(x, x) = x`, `WHERE id > -1` — every one of those references a
+ * column, passes here, and still matches every row. Enumerating tautologies is
+ * a losing game, and a check that appeared to win it would be trusted as a
+ * guarantee it cannot provide.
+ *
+ * So this guard catches exactly one class: the clause that is *obviously*
+ * unconditional because it mentions no column at all — no WHERE, `WHERE true`,
+ * `WHERE 1=1`, `WHERE 'a' = 'a'`, `WHERE E'a' = E'a'`, `WHERE 'a'::text = 'a'`,
+ * `WHERE (1=1) AND true`, `WHERE NOT false`. It is the cheap guard, and its
+ * value is a fast, readable refusal.
+ *
+ * Even inside that one class it is lexical, so a spelling that hides a constant
+ * behind something word-shaped still slips past: `CAST('a' AS text) = 'a'` (the
+ * type name after `AS` is indistinguishable from a column here),
+ * `'a'::pg_catalog.text = 'a'`, `length('a') > 0`. Those are refusals not made,
+ * never wrong commits — and the row count below is what actually stops one.
+ *
+ * **The row count is the real guard.** The dry run runs the actual mutation and
+ * reports the actual number of rows it touched; an agent that asked to delete
+ * one row and is shown 4,000,000 has the information the WHERE check could
+ * never have derived. Do not oversell this function.
+ */
+export function assertRawWhere(sql, ctx) {
+    const mask = codeMask(sql);
+    const whereEnd = findTopLevelKeyword(mask, 'WHERE');
+    if (whereEnd === -1) {
+        missingWhere(`${ctx.operation} received a statement with no top-level WHERE clause, which would affect every row`, 'add a WHERE clause that selects only the rows you mean; to empty a table deliberately, use TRUNCATE on a ' +
+            'profile that allows DDL', ctx);
+    }
+    // `DELETE … WHERE … RETURNING *` — the RETURNING list is not part of the filter.
+    const returningStart = findTopLevelKeyword(mask.slice(whereEnd), 'RETURNING');
+    const clause = returningStart === -1 ? mask.slice(whereEnd) : mask.slice(whereEnd, whereEnd + returningStart - 'RETURNING'.length);
+    const words = clause.replace(CAST_TYPE_RE, '').match(WORD_RE) ?? [];
+    if (words.some((word) => !CONSTANT_WORDS.has(word.toLowerCase())))
+        return;
+    missingWhere(`${ctx.operation} received a WHERE clause that references no column (${clause.trim() === '' ? 'empty' : clause.trim()}), so it matches every row`, 'add a predicate on a real column; to empty a table deliberately, use TRUNCATE on a profile that allows DDL', ctx, { clause: clause.trim() });
+}
+// ---------------------------------------------------------------------------
+// The hash
+// ---------------------------------------------------------------------------
+/**
+ * Canonicalizes SQL text for hashing. **Exactly two things change, and nothing
+ * else:**
+ *
+ * 1. **Whitespace runs outside literals and comments collapse.** A run
+ *    containing a newline becomes a single `\n`; any other run becomes a single
+ *    space. Respacing within a line is free; **introducing or removing a line
+ *    break is not** and costs one extra dry run.
+ *
+ *    That asymmetry is the point, not an oversight. A line comment is
+ *    terminated by a newline, so collapsing newlines into spaces would give
+ *    `SELECT 1 -- c\nFROM t` and `SELECT 1 -- c FROM t` — two statements that
+ *    mean entirely different things — the same digest, and a confirming call
+ *    could then execute something the dry run never previewed. Every
+ *    normalization decision in this function fails in the *mismatch* direction:
+ *    the worst case is a re-run of the dry run, never a wrong commit.
+ *    Whitespace inside a string, a quoted identifier or a dollar-quoted body is
+ *    part of the value and is left alone.
+ * 2. **Trailing `;` and trailing whitespace are dropped**, and internal
+ *    terminators normalize to a bare `;`. `DELETE …` and `DELETE …;` are the
+ *    same statement.
+ *
+ * Deliberately **not** normalized:
+ *
+ * - **Case.** `"Col"` and `"col"` are different columns; `$Tag$` and `$tag$`
+ *   are different dollar-quote tags. Folding buys nothing (an agent replaying a
+ *   statement does not re-case it) and could merge two statements that differ.
+ * - **Comments.** Stripping them would buy full reformat-insensitivity, and it
+ *   was rejected: it would make a *security* decision depend on the scanner
+ *   agreeing with PostgreSQL about where a comment ends. Keeping them means a
+ *   scanner disagreement can only produce a false mismatch (a re-run), never a
+ *   false match (a wrong commit). The hash is the state; it covers what was
+ *   actually sent.
+ * - **Parameter values.** They are not in the SQL at all — they are hashed
+ *   separately as `JSON(params)`, so `$1 = 7` and `$1 = 8` differ.
+ */
+export function normalizeSql(sql) {
+    let out = '';
+    for (const seg of scanSegments(sql)) {
+        const text = sql.slice(seg.start, seg.end);
+        if (seg.kind === 'code')
+            out += text.replace(/\s+/g, (ws) => (ws.includes('\n') ? '\n' : ' '));
+        else if (seg.kind === 'terminator')
+            out += ';';
+        else
+            out += text;
+    }
+    return out.replace(/[\s;]+$/, '').trim();
+}
+/**
+ * `sha256(profile ∥ database ∥ normalizedSql ∥ JSON(params))`, per design.md.
+ * The four parts go through `JSON.stringify` of a tuple rather than string
+ * concatenation, so the separators are unambiguous and no combination of a
+ * profile alias and a statement can be re-spelled as a different pair.
+ *
+ * **Deliberately not the cursor shape hash.** `core/paginate.ts#computeShapeHash`
+ * is 64 bits of sha256 and exists to stop a cursor being replayed against a
+ * differently-shaped query — a *correctness* construct where a collision costs
+ * a rejected page. This one is a *security* construct: it is what stands
+ * between "the agent previewed X" and "the agent committed Y", so it keeps the
+ * full 256-bit digest and lives in a different module. Do not merge them.
+ */
+export function computeSqlHash(input) {
+    return createHash('sha256')
+        .update(JSON.stringify([input.profile, input.database, normalizeSql(input.sql), input.params]))
+        .digest('hex');
+}
+// ---------------------------------------------------------------------------
+// The two-call protocol
+// ---------------------------------------------------------------------------
+/** Named rather than random so it is greppable in a server log. */
+const TARGET_CTE = 'pg_admin_mcp_target';
+const KEYS_CTE = 'pg_admin_mcp_keys';
+/** design.md: "SELECT up to 20 affected primary keys for the preview". */
+export const PREVIEW_LIMIT = 20;
+/**
+ * Wraps the mutation so PostgreSQL returns the row count, the key checksum and
+ * the preview in **one** round trip.
+ *
+ * A data-modifying CTE executes exactly once, so this is the same single
+ * mutation either way — but the affected keys never cross the wire as
+ * individual rows, which matters when the statement touches millions of them.
+ *
+ * Computing the checksum from the mutation's own `RETURNING` rather than from a
+ * `SELECT` issued just before it is a strengthening, not a shortcut: there is
+ * no window at all between "the rows I measured" and "the rows I changed".
+ *
+ * `COLLATE "C"` pins the sort to byte order, so the checksum does not depend on
+ * the database's collation or on any lc_collate change between the two calls.
+ */
+function buildProbedSql(sql, keyColumns) {
+    return [
+        `WITH ${TARGET_CTE} AS (`,
+        sql,
+        // `::text` on every key column, deliberately: `to_jsonb` renders a bigint
+        // as a JSON *number*, and a bigint past 2^53 loses precision the moment the
+        // driver parses it — the preview would then show a key that does not exist.
+        // Text also makes the sort, and therefore the checksum, independent of the
+        // column's type.
+        `RETURNING ${keyColumns.map((column) => `${column}::text AS ${column}`).join(', ')}`,
+        `), ${KEYS_CTE} AS (`,
+        `SELECT ${TARGET_CTE}::text AS key_text, to_jsonb(${TARGET_CTE}) AS key_json FROM ${TARGET_CTE}`,
+        ')',
+        'SELECT count(*)::text AS row_count,',
+        `md5(coalesce(string_agg(key_text, E'\\n' ORDER BY key_text COLLATE "C"), '')) AS key_checksum,`,
+        `to_jsonb((array_agg(key_json ORDER BY key_text COLLATE "C"))[1:${PREVIEW_LIMIT}]) AS preview`,
+        `FROM ${KEYS_CTE}`,
+    ].join('\n');
+}
+/**
+ * Runs the mutation. `queryMode: 'extended'` is not decoration — see
+ * `tools/execute_sql.ts`'s header: without it, `pg` uses simple-query mode
+ * whenever `params` is empty, which would run a multi-statement string as one
+ * implicit transaction. That is the structural fence behind
+ * `planStatements`.
+ */
+async function runMutation(client, text, params, probed) {
+    if (!probed) {
+        const res = await client.query({ text, values: [...params], queryMode: 'extended' });
+        return { rowCount: res.rowCount ?? 0, keyChecksum: undefined, preview: [] };
+    }
+    const res = await client.query({ text, values: [...params], queryMode: 'extended' });
+    const row = res.rows[0];
+    // `to_jsonb(NULL::jsonb[])` is the JSON scalar `null`, which is what a
+    // zero-row mutation produces — hence the shape check rather than `?? []`.
+    const preview = row !== undefined && Array.isArray(row.preview) ? row.preview : [];
+    return {
+        rowCount: Number(row?.row_count ?? '0'),
+        keyChecksum: row?.key_checksum,
+        preview,
+    };
+}
+/**
+ * Paste into every guarded tool's `description` so the honest limitation
+ * reaches the agent, not just this file.
+ *
+ * The limitation is stated as it actually behaves, which is **not** what
+ * design.md's one-line summary claims. `keyChecksum` is `md5` over the sorted
+ * list of affected **primary keys**, so it pins *which* rows a statement
+ * touches — it says nothing about their contents. A row whose non-key columns
+ * changed between the two calls, leaving the primary-key set and the row count
+ * identical, is invisible to both checks. What `keyChecksum` does close, and
+ * `rowCount` alone does not, is the substitution: one matching row disappearing
+ * while a different one starts matching keeps the count identical and changes
+ * the key set. That is why production requires it.
+ */
+export const CONFIRM_PROTOCOL_DESCRIPTION = 'Two calls. Call it once WITHOUT confirm to get a dry run: the real mutation runs inside a transaction that is ' +
+    'always rolled back, and you get back the true row count, up to 20 affected primary keys, and an `expect` token. ' +
+    'Read the row count — it is the guard that matters. Then call again with confirm:true and `expect` passed back ' +
+    'verbatim; the server recomputes the hash from your arguments (nothing is stored between calls), re-verifies the ' +
+    'row count and key checksum INSIDE the committing transaction, and rolls back instead of committing if anything ' +
+    'moved. LIMITATION: keyChecksum is md5 over the sorted primary keys of the affected rows, so it detects a ' +
+    'different SET of rows (including a substitution that keeps the count identical) but NOT a change to a row\'s ' +
+    'contents when its primary key and the total row count both stayed the same. envClass=production requires ' +
+    '`expect` including keyChecksum and forces allowRowDrift to 0 — the one exception is INSERT, which creates the rows ' +
+    'it affects instead of selecting pre-existing ones, so there production verifies the row count alone (still with ' +
+    '`expect` and the hash). development accepts a bare confirm:true.';
+function confirmRequired(message, hint, profile, details = {}) {
+    throw new PgMcpError({
+        code: 'GUARD_CONFIRM_REQUIRED',
+        message,
+        hint,
+        details: { profile: profile.alias, envClass: profile.envClass, ...details },
+    });
+}
+/**
+ * The dry-run / confirm protocol, end to end.
+ *
+ * Call 1 (`confirm` absent or false) runs the mutation under
+ * `withTx({ rollbackAlways: true })` and returns a `dryRun` outcome carrying the
+ * `expect` token. Call 2 (`confirm: true`) recomputes the hash from the
+ * incoming arguments, then re-runs the mutation in a real transaction and
+ * commits only if the checksum and row count still hold.
+ *
+ * Callers must have resolved identifiers **before** calling this: it opens a
+ * transaction and takes a pool checkout, and taking a second checkout inside
+ * one is the deadlock the Phase 2 review found (`resolveRelation` opens its own
+ * session). Nothing inside this function acquires a client.
+ */
+export async function runGuardedMutation(req) {
+    requireCapability(req.capability, req.profile);
+    const policy = confirmPolicyFor(req.profile.envClass);
+    const executor = req.executor;
+    const wrapped = executor === undefined && req.keyColumns.length > 0;
+    const probed = executor === undefined ? wrapped : executor.providesKeyChecksum;
+    // See `noPreexistingRows`: an INSERT's affected rows are its own input, so
+    // `sqlHash` + `rowCount` is the whole receipt and production accepts it.
+    const checksumRequired = policy.requireKeyChecksum && req.noPreexistingRows !== true;
+    if (checksumRequired && !probed) {
+        // Refused here rather than after a dry run the agent could never confirm.
+        // The two ways to get here are different situations and the caller can act
+        // on exactly one of them, so they do not share a message.
+        if (executor !== undefined) {
+            confirmRequired(`profile "${req.profile.alias}" is envClass ${req.profile.envClass}, which requires expect.keyChecksum, but ` +
+                `${req.operation} issues its statement through an executor that reports no checksum`, 'use a profile whose PG_<ALIAS>_ENV is development or staging — this operation cannot pin which rows it ' +
+                'wrote, so there is nothing a production confirm could verify', req.profile, { operation: req.operation });
+        }
+        confirmRequired(`profile "${req.profile.alias}" is envClass ${req.profile.envClass}, which requires expect.keyChecksum, but ` +
+            `${req.operation} has no primary key to compute one from`, 'run this against a relation with a primary key, or use a profile whose PG_<ALIAS>_ENV is development or staging', req.profile, { operation: req.operation });
+    }
+    const text = wrapped ? buildProbedSql(req.sql, req.keyColumns) : req.sql;
+    // The hash covers the statement that actually executes, wrapper included —
+    // so the key columns are folded in for free and the digest is provably the
+    // text PostgreSQL received, not an approximation of it.
+    const sqlHash = computeSqlHash({
+        profile: req.profile.alias,
+        database: req.profile.database,
+        sql: text,
+        params: req.params,
+    });
+    const execute = async (client) => {
+        if (executor === undefined)
+            return runMutation(client, text, req.params, wrapped);
+        const done = await executor.run(client);
+        // The presence half of `providesKeyChecksum` — the only half this module can
+        // check. Without it the claim is what unlocked a production profile up
+        // front, and the missing checksum surfaces two calls later as a
+        // GUARD_CONFIRM_REQUIRED aimed at the caller for a server-side bug.
+        if (executor.providesKeyChecksum && done.keyChecksum === undefined) {
+            throw new PgMcpError({
+                code: 'PG_ERROR',
+                message: `${req.operation} declares providesKeyChecksum but returned no keyChecksum — that claim is what let this ` +
+                    'call past the envClass check, so the guard refuses rather than hand out a token it cannot verify',
+                hint: 'this is a bug in the tool, not in your call — report it; nothing was committed',
+                details: { profile: req.profile.alias, operation: req.operation },
+            });
+        }
+        return { rowCount: done.rowCount, keyChecksum: done.keyChecksum, preview: done.preview ?? [] };
+    };
+    const txOpts = {
+        operation: req.operation,
+        ...(req.statementTimeoutMs === undefined ? {} : { statementTimeoutMs: req.statementTimeoutMs }),
+        ...(req.lockTimeoutMs === undefined ? {} : { lockTimeoutMs: req.lockTimeoutMs }),
+    };
+    // Both branches below produce a `GuardedOutcome` and fall through to the
+    // single `noteAudit` call at the very end of this function instead of
+    // returning directly, so there is exactly one call site regardless of
+    // which branch ran.
+    let outcome;
+    if (req.confirm !== true) {
+        const probe = await withTx(req.profile, execute, {
+            ...txOpts,
+            rollbackAlways: true,
+        });
+        outcome = {
+            kind: 'dryRun',
+            rowCount: probe.rowCount,
+            preview: probe.preview,
+            expect: {
+                sqlHash,
+                rowCount: probe.rowCount,
+                ...(probe.keyChecksum === undefined ? {} : { keyChecksum: probe.keyChecksum }),
+            },
+        };
+    }
+    else {
+        const expect = req.expect;
+        if (policy.requireExpect && expect === undefined) {
+            confirmRequired(`profile "${req.profile.alias}" is envClass ${req.profile.envClass}, which does not accept a bare confirm:true`, 'call this tool once without confirm to get a dry run, then re-run with confirm:true and the returned expect ' +
+                'object passed back verbatim', req.profile, { operation: req.operation });
+        }
+        if (expect !== undefined && expect.sqlHash !== sqlHash) {
+            throw new PgMcpError({
+                code: 'GUARD_HASH_MISMATCH',
+                message: `the expect.sqlHash you passed back does not match the statement this call would run — the arguments changed ` +
+                    'between the dry run and the confirm, so confirming would commit something you never previewed',
+                hint: 're-run the dry run with the arguments you actually want, then confirm with the expect object it returns',
+                details: {
+                    profile: req.profile.alias,
+                    operation: req.operation,
+                    expected: sqlHash,
+                    received: expect.sqlHash,
+                },
+            });
+        }
+        // `Math.abs(NaN - n) > drift` is `false`, so a non-numeric `expect.rowCount`
+        // would sail through the drift check below and COMMIT — measured: `NaN`,
+        // `undefined` and `{}` all committed, only `'2'` and `null` were refused. No
+        // tool can send those today (`tools/_batch_shared.ts#expectTokenSchema` is
+        // `z.number().int().min(0)`), but this module's whole claim is that it never
+        // fails open, and it is the seam Phase 5's destructive sub-ops reuse. The
+        // comparison below is *also* inverted to `!(… <= …)` so a value that somehow
+        // reaches it fails closed rather than silently passing.
+        if (expect !== undefined && !Number.isInteger(expect.rowCount)) {
+            confirmRequired(`expect.rowCount is ${typeof expect.rowCount === 'number' ? String(expect.rowCount) : typeof expect.rowCount}, ` +
+                'not a whole number, so there is nothing to compare the committing statement against', 'pass back the whole expect object the dry run returned, verbatim — do not hand-build it', req.profile, { operation: req.operation });
+        }
+        if (checksumRequired && expect?.keyChecksum === undefined) {
+            confirmRequired(`profile "${req.profile.alias}" is envClass ${req.profile.envClass}, which requires expect.keyChecksum`, 'pass back the whole expect object the dry run returned, including keyChecksum — do not hand-build it', req.profile, { operation: req.operation });
+        }
+        const allowedDrift = effectiveRowDrift(policy, req.allowRowDrift, req.profile.alias);
+        // Everything below runs INSIDE the committing transaction. A throw here makes
+        // `withTx` ROLLBACK, so a concurrent change between the two calls aborts the
+        // commit rather than silently widening the blast radius.
+        const applied = await withTx(req.profile, async (client) => {
+            const result = await execute(client);
+            if (expect?.keyChecksum !== undefined && result.keyChecksum !== expect.keyChecksum) {
+                throw new PgMcpError({
+                    code: 'GUARD_ROW_DRIFT',
+                    message: `the set of rows this statement affects changed since the dry run: expected key checksum ` +
+                        `${expect.keyChecksum}, got ${result.keyChecksum ?? '(none)'} — the row count alone would not have ` +
+                        'caught this, so a different set of rows was about to be committed',
+                    hint: 're-run the dry run to see the current target rows, then confirm with the new expect object',
+                    details: {
+                        profile: req.profile.alias,
+                        operation: req.operation,
+                        expectedKeyChecksum: expect.keyChecksum,
+                        actualKeyChecksum: result.keyChecksum ?? null,
+                        expectedRowCount: expect.rowCount,
+                        actualRowCount: result.rowCount,
+                        // Reported even though this check ignores it: an agent that passed
+                        // allowRowDrift needs to see the value that actually applied, or a
+                        // refusal on a production profile looks like the tolerance was lost.
+                        allowRowDrift: allowedDrift,
+                    },
+                });
+            }
+            // `!(… <= …)`, never `… > …`: the negated form is the one that refuses a
+            // NaN instead of passing it. `expect.rowCount` is already validated above;
+            // this is the second lock on the same door.
+            if (expect !== undefined && !(Math.abs(result.rowCount - expect.rowCount) <= allowedDrift)) {
+                throw new PgMcpError({
+                    code: 'GUARD_ROW_DRIFT',
+                    message: `this statement affected ${result.rowCount} row(s) but the dry run previewed ${expect.rowCount}` +
+                        `${allowedDrift > 0 ? ` (allowRowDrift ${allowedDrift})` : ''} — the data changed between the two calls, ` +
+                        'so the transaction was rolled back instead of committed',
+                    hint: 're-run the dry run to see the current row count, then confirm with the new expect object',
+                    details: {
+                        profile: req.profile.alias,
+                        operation: req.operation,
+                        expectedRowCount: expect.rowCount,
+                        actualRowCount: result.rowCount,
+                        allowRowDrift: allowedDrift,
+                    },
+                });
+            }
+            return result;
+        }, txOpts);
+        outcome = { kind: 'mutation', rowCount: applied.rowCount, committed: true };
+    }
+    noteAudit({ sql: text, sqlHash, rowCount: outcome.rowCount });
+    return outcome;
+}
+//# sourceMappingURL=guards.js.map

package/dist/core/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/core/guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAoGrF,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY,EAAE,GAAiB,EAAE,UAAmC,EAAE;IAC3G,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,qBAAqB;QAC3B,OAAO;QACP,IAAI;QACJ,OAAO,EAAE;YACP,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,GAAG,OAAO;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,iIAAiI;AACjI,MAAM,UAAU,qBAAqB,CAAC,cAAsB,EAAE,GAAiB;IAC7E,IAAI,cAAc,GAAG,CAAC;QAAE,OAAO;IAC/B,YAAY,CACV,GAAG,GAAG,CAAC,SAAS,+DAA+D,GAAG,CAAC,MAAM,IAAI,qBAAqB,EAAE,EACpH,+GAA+G;QAC7G,8BAA8B,EAChC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;IACT,WAAW;IACX,YAAY;IACZ,IAAI;IACJ,MAAM;IACN,OAAO;IACP,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,MAAM;IACN,IAAI;IACJ,SAAS;IACT,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,GAAG,oDAAoD,CAAC;AAErE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,SAAS,OAAO,CAAC,MAAM,qBAAqB,EAAE,GAAG,CAAC,CAAC;AAEnF;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,GAAG,IAAI,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,+CAA+C;QAC/C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,2EAA2E;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gIAAgI;AAChI,SAAS,mBAAmB,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACnB,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,GAAiB;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,YAAY,CACV,GAAG,GAAG,CAAC,SAAS,oFAAoF,EACpG,2GAA2G;YACzG,yBAAyB,EAC3B,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnI,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAAE,OAAO;IAE1E,YAAY,CACV,GAAG,GAAG,CAAC,SAAS,uDAAuD,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,4BAA4B,EACjJ,4GAA4G,EAC5G,GAAG,EACH,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC1F,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,GAAG,IAAI,GAAG,CAAC;;YAC1C,GAAG,IAAI,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;SAC9F,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;;;;;GAcG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,UAAgC;IACnE,OAAO;QACL,QAAQ,UAAU,OAAO;QACzB,GAAG;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,iBAAiB;QACjB,aAAa,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,aAAa,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpF,MAAM,QAAQ,OAAO;QACrB,UAAU,UAAU,gCAAgC,UAAU,sBAAsB,UAAU,EAAE;QAChG,GAAG;QACH,qCAAqC;QACrC,gGAAgG;QAChG,kEAAkE,aAAa,eAAe;QAC9F,QAAQ,QAAQ,EAAE;KACnB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAuED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAAkB,EAClB,IAAY,EACZ,MAA0B,EAC1B,MAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,OAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,GAAG,CAAC;QACvC,WAAW,EAAE,GAAG,EAAE,YAAY;QAC9B,OAAO;KACR,CAAC;AACJ,CAAC;AA6DD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,gHAAgH;IAChH,kHAAkH;IAClH,gHAAgH;IAChH,kHAAkH;IAClH,iHAAiH;IACjH,2GAA2G;IAC3G,+GAA+G;IAC/G,2GAA2G;IAC3G,qHAAqH;IACrH,kHAAkH;IAClH,kEAAkE,CAAC;AAErE,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY,EAAE,OAAgB,EAAE,UAAmC,EAAE;IAC7G,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,wBAAwB;QAC9B,OAAO;QACP,IAAI;QACJ,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,EAAE;KAC5E,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAA2B;IAClE,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC;IAErF,IAAI,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,0EAA0E;QAC1E,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,eAAe,CACb,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,2CAA2C;gBAC3G,GAAG,GAAG,CAAC,SAAS,oEAAoE,EACtF,yGAAyG;gBACvG,8DAA8D,EAChE,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAC7B,CAAC;QACJ,CAAC;QACD,eAAe,CACb,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,2CAA2C;YAC3G,GAAG,GAAG,CAAC,SAAS,yCAAyC,EAC3D,iHAAiH,EACjH,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;QAC1B,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;QAC9B,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,EAAE,MAAkB,EAAwB,EAAE;QACjE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,6EAA6E;QAC7E,uEAAuE;QACvE,gEAAgE;QAChE,oEAAoE;QACpE,IAAI,QAAQ,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,UAAU;gBAChB,OAAO,EACL,GAAG,GAAG,CAAC,SAAS,0FAA0F;oBAC1G,kGAAkG;gBACpG,IAAI,EAAE,gFAAgF;gBACtF,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IACjG,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;KACjF,CAAC;IAEF,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAuB,CAAC;IAE5B,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE;YAC/C,GAAG,MAAM;YACT,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,OAAO,GAAG;YACR,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE;gBACN,OAAO;gBACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;aAC/E;SACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAE1B,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,eAAe,CACb,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,6CAA6C,EAC/G,8GAA8G;gBAC5G,6BAA6B,EAC/B,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,8GAA8G;oBAC9G,+FAA+F;gBACjG,IAAI,EAAE,yGAAyG;gBAC/G,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;oBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,MAAM,CAAC,OAAO;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,wDAAwD;QACxD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,eAAe,CACb,sBAAsB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,QAAQ,IAAI;gBAC9G,qFAAqF,EACvF,yFAAyF,EACzF,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1D,eAAe,CACb,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,iBAAiB,GAAG,CAAC,OAAO,CAAC,QAAQ,qCAAqC,EACvG,sGAAsG,EACtG,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAErF,8EAA8E;QAC9E,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,OAAO,GAAG,MAAM,MAAM,CAC1B,GAAG,CAAC,OAAO,EACX,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAErC,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;gBACnF,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EACL,0FAA0F;wBAC1F,GAAG,MAAM,CAAC,WAAW,SAAS,MAAM,CAAC,WAAW,IAAI,QAAQ,wCAAwC;wBACpG,mEAAmE;oBACrE,IAAI,EAAE,4FAA4F;oBAClG,OAAO,EAAE;wBACP,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;wBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,mBAAmB,EAAE,MAAM,CAAC,WAAW;wBACvC,iBAAiB,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;wBAC7C,gBAAgB,EAAE,MAAM,CAAC,QAAQ;wBACjC,cAAc,EAAE,MAAM,CAAC,QAAQ;wBAC/B,mEAAmE;wBACnE,mEAAmE;wBACnE,qEAAqE;wBACrE,aAAa,EAAE,YAAY;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,4CAA4C;YAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,UAAU,CAAC;oBACnB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EACL,2BAA2B,MAAM,CAAC,QAAQ,qCAAqC,MAAM,CAAC,QAAQ,EAAE;wBAChG,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,6CAA6C;wBAC1G,yDAAyD;oBAC3D,IAAI,EAAE,0FAA0F;oBAChG,OAAO,EAAE;wBACP,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;wBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;wBACjC,cAAc,EAAE,MAAM,CAAC,QAAQ;wBAC/B,aAAa,EAAE,YAAY;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC,EACD,MAAM,CACP,CAAC;QAEF,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IAED,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC;AACjB,CAAC"}