pg-admin-mcp 0.0.0-stage → 0.1.0

package/dist/core/identifiers.js

@@ -0,0 +1,431 @@
+import { listSchemas } from '../db/catalog.js';
+import { withSession } from '../db/session.js';
+import { unsafeBrand } from './brands.js';
+import { PgMcpError } from './errors.js';
+/**
+ * The single legitimate producer of {@link SafeIdent}.
+ *
+ * Every identifier this server ever puts into SQL text (schema, table, column,
+ * …) is resolved against `pg_catalog` here first — **never `information_schema`**,
+ * which silently drops partial-index predicates and row-level-security policies
+ * (design.md risk 5). A name that does not exist in the catalog can never become
+ * a `SafeIdent`; it throws `IDENTIFIER_UNKNOWN` instead, with near-miss
+ * suggestions so the caller (an LLM agent) can self-correct without a round trip
+ * to `postgres_list_objects`.
+ */
+const CANDIDATE_RELKINDS = ['r', 'p', 'v', 'm', 'f'];
+/** `pg_class.relkind` -> the public `RelationKind` this server exposes. */
+const RELKIND_MAP = {
+    r: 'table',
+    p: 'partitioned_table',
+    v: 'view',
+    m: 'materialized_view',
+    f: 'foreign_table',
+};
+/**
+ * Quotes a catalog-returned identifier for safe interpolation into SQL text.
+ * Doubles embedded `"` (PostgreSQL's own escaping rule) and wraps in `"..."`
+ * unconditionally — that also documents at every call site that the value
+ * originated from the catalog, not from user input.
+ *
+ * Only ever call this on a string that just came back from `pg_catalog` — see
+ * `core/brands.ts` for why a raw user-supplied string must never reach here.
+ */
+export function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/** Levenshtein edit distance — cheap, dependency-free, good enough for a handful of near-miss suggestions. */
+function levenshtein(a, b) {
+    const rows = a.length + 1;
+    const cols = b.length + 1;
+    // Single flat array, row-major: prev/curr are just index offsets. Avoids
+    // allocating `rows` sub-arrays for what is always a short identifier.
+    let prev = Array.from({ length: cols }, (_, j) => j);
+    let curr = new Array(cols).fill(0);
+    for (let i = 1; i < rows; i++) {
+        curr[0] = i;
+        for (let j = 1; j < cols; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            curr[j] = Math.min((prev[j] ?? 0) + 1, // deletion
+            (curr[j - 1] ?? 0) + 1, // insertion
+            (prev[j - 1] ?? 0) + cost);
+        }
+        [prev, curr] = [curr, prev];
+    }
+    return prev[cols - 1] ?? 0;
+}
+/** Small enough to feel like a typo, not a different word — three edits on a short identifier is usually unrelated. */
+const MAX_SUGGESTION_DISTANCE = 3;
+const MAX_SUGGESTIONS = 5;
+/**
+ * Ranks `candidates` by edit distance to `target` and returns the closest
+ * handful. Pure and exported standalone so unit tests can check ranking
+ * without a database.
+ */
+export function suggestSimilar(target, candidates, limit = MAX_SUGGESTIONS) {
+    const needle = target.toLowerCase();
+    return candidates
+        .map((c) => ({ name: c, distance: levenshtein(needle, c.toLowerCase()) }))
+        .filter((c) => c.distance <= MAX_SUGGESTION_DISTANCE)
+        .sort((x, y) => x.distance - y.distance || x.name.localeCompare(y.name))
+        .slice(0, limit)
+        .map((c) => c.name);
+}
+/**
+ * Schemas PostgreSQL itself owns — excluded from "all schemas" whenever a
+ * profile leaves `schemas` unset, so an unscoped profile does not accidentally
+ * expose `pg_catalog`/`information_schema` internals through `list_objects`.
+ */
+const SYSTEM_SCHEMAS = new Set(['pg_catalog', 'information_schema', 'pg_toast']);
+function isSystemSchema(name) {
+    return SYSTEM_SCHEMAS.has(name) || name.startsWith('pg_toast_temp') || name.startsWith('pg_temp');
+}
+/**
+ * Enforces `Profile.schemas` (unset = every non-system schema is in scope).
+ * Throws `IDENTIFIER_UNKNOWN` — from the caller's perspective an out-of-scope
+ * schema and a nonexistent one look identical, and treating scope as a
+ * separate error code would leak which schemas exist on the server to a
+ * caller who is not allowed to see them.
+ */
+export function assertSchemaAllowed(profile, schema) {
+    if (profile.schemas === undefined) {
+        if (!isSystemSchema(schema))
+            return;
+    }
+    else if (profile.schemas.includes(schema)) {
+        return;
+    }
+    const allowed = profile.schemas ?? [];
+    throw new PgMcpError({
+        code: 'IDENTIFIER_UNKNOWN',
+        message: `schema "${schema}" is not accessible on profile "${profile.alias}"`,
+        hint: allowed.length > 0
+            ? `this profile is scoped to: ${allowed.join(', ')} — use one of those`
+            : `run postgres_list_objects on profile "${profile.alias}" to see the schemas actually in scope`,
+        details: { profile: profile.alias, schema, allowedSchemas: allowed },
+    });
+}
+async function lookupRelation(client, schema, name) {
+    const { rows } = await client.query(`SELECT c.oid::text AS oid, n.nspname AS schema, c.relname AS name, c.relkind AS relkind
+       FROM pg_catalog.pg_class c
+       JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = $1
+        AND c.relname = $2
+        AND c.relkind = ANY($3::"char"[])`, [schema, name, CANDIDATE_RELKINDS]);
+    return rows[0];
+}
+async function schemaCandidates(client, profile) {
+    if (profile.schemas !== undefined)
+        return [...profile.schemas];
+    const { rows } = await client.query(`SELECT nspname FROM pg_catalog.pg_namespace WHERE nspname !~ '^pg_' AND nspname <> 'information_schema'`);
+    return rows.map((r) => r.nspname);
+}
+async function relationCandidates(client, schemas) {
+    if (schemas.length === 0)
+        return [];
+    const { rows } = await client.query(`SELECT c.relname
+       FROM pg_catalog.pg_class c
+       JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = ANY($1)
+        AND c.relkind = ANY($2::"char"[])`, [schemas, CANDIDATE_RELKINDS]);
+    return rows.map((r) => r.relname);
+}
+/**
+ * Resolves `schema.name` against `pg_catalog` and brands both parts as
+ * {@link SafeIdent}. Runs a single-shot lookup via `withSession` — deliberately
+ * outside any guard/dry-run transaction, since identifier resolution is a
+ * read-only step that happens *before* `BEGIN` in the dry-run protocol
+ * (design.md).
+ *
+ * Unknown identifier -> `IDENTIFIER_UNKNOWN` with near-miss suggestions drawn
+ * from whichever level actually has candidates: if the schema itself has no
+ * match, suggestions are schema names; if the schema is fine, suggestions are
+ * relation names within it.
+ */
+export async function resolveRelation(profile, schema, name) {
+    return withSession(profile, async (client) => {
+        assertSchemaAllowed(profile, schema);
+        const row = await lookupRelation(client, schema, name);
+        if (row !== undefined) {
+            const kind = RELKIND_MAP[row.relkind];
+            return {
+                oid: Number(row.oid),
+                schema: unsafeBrand(quoteIdent(row.schema)),
+                name: unsafeBrand(quoteIdent(row.name)),
+                kind,
+            };
+        }
+        const schemas = await schemaCandidates(client, profile);
+        const schemaExists = schemas.includes(schema);
+        const suggestions = schemaExists
+            ? suggestSimilar(name, await relationCandidates(client, [schema]))
+            : suggestSimilar(schema, schemas);
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: schemaExists
+                ? `relation "${schema}.${name}" does not exist`
+                : `schema "${schema}" does not exist`,
+            hint: suggestions.length > 0
+                ? `did you mean: ${suggestions.join(', ')}? Run postgres_list_objects to see the full list`
+                : 'run postgres_list_objects to see the exact schema/table names available on this profile',
+            details: { profile: profile.alias, schema, name, suggestions },
+        });
+    });
+}
+/**
+ * Resolves the schema scope for `list_objects`/`get_schema`: an explicit
+ * `requested` list (validated one-by-one via {@link assertSchemaAllowed}), or
+ * `Profile.schemas` when unset, or every non-system schema when neither is
+ * set. Takes an already-checked-out `client` (same convention as `db/catalog.ts`)
+ * so callers can batch it with their other catalog calls in one session.
+ */
+export async function resolveSchemaScope(client, profile, requested) {
+    if (requested !== undefined) {
+        for (const schema of requested)
+            assertSchemaAllowed(profile, schema);
+        return [...requested];
+    }
+    if (profile.schemas !== undefined)
+        return [...profile.schemas];
+    const schemas = await listSchemas(client);
+    return schemas.map((s) => s.name);
+}
+/**
+ * Builds a {@link RelationRef} directly from data that already came out of a
+ * `pg_catalog` listing (e.g. `listRelations`) rather than re-resolving it via
+ * {@link resolveRelation} — saves a redundant round trip when `get_schema` is
+ * enriching dozens/hundreds of relations it just listed. The caller vouches
+ * that `schema`/`name`/`kind` are catalog-sourced, not raw user input; this
+ * does the exact same `unsafeBrand(quoteIdent(...))` transform `lookupRelation`
+ * above does for its own catalog rows.
+ */
+export function relationRefFromCatalog(oid, schema, name, kind) {
+    return { oid, schema: unsafeBrand(quoteIdent(schema)), name: unsafeBrand(quoteIdent(name)), kind };
+}
+/**
+ * Brands a column name that already came from `db/catalog.ts#getColumns`
+ * (trusted, catalog-sourced) — the column-level counterpart to
+ * {@link relationRefFromCatalog}.
+ */
+export function columnIdentFromCatalog(name) {
+    return unsafeBrand(quoteIdent(name));
+}
+/**
+ * Validates a column name against a relation's real columns and brands it —
+ * the column-level counterpart to {@link resolveRelation}. `knownColumns`
+ * comes from `db/catalog.ts#getColumns` for the exact relation being
+ * queried, so this never issues SQL of its own. An unknown column throws
+ * `IDENTIFIER_UNKNOWN` with near-miss suggestions, never a raw SQL error —
+ * `postgres_select` relies on this running for every column name (`columns`,
+ * `where[].column`, `orderBy[].column`) before any of them reach SQL text.
+ */
+export function resolveColumn(schema, table, columnName, knownColumns) {
+    if (!knownColumns.includes(columnName)) {
+        const suggestions = suggestSimilar(columnName, knownColumns);
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `column "${columnName}" does not exist on "${schema}.${table}"`,
+            hint: suggestions.length > 0
+                ? `did you mean: ${suggestions.join(', ')}? Run postgres_describe_object on "${schema}.${table}" to see the exact column list`
+                : `run postgres_describe_object on "${schema}.${table}" to see the exact column list`,
+            details: { schema, table, column: columnName, suggestions },
+        });
+    }
+    return columnIdentFromCatalog(columnName);
+}
+async function roleCandidates(client) {
+    const { rows } = await client.query(`SELECT rolname FROM pg_catalog.pg_roles`);
+    return rows.map((r) => r.rolname);
+}
+/** Resolves an existing role by name against `pg_roles` — the role-level counterpart to {@link resolveRelation}. */
+export async function resolveRole(profile, name) {
+    return withSession(profile, async (client) => {
+        const { rows } = await client.query(`SELECT oid::text AS oid, rolname FROM pg_catalog.pg_roles WHERE rolname = $1`, [name]);
+        const row = rows[0];
+        if (row !== undefined)
+            return { oid: Number(row.oid), name: unsafeBrand(quoteIdent(row.rolname)) };
+        const suggestions = suggestSimilar(name, await roleCandidates(client));
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `role "${name}" does not exist`,
+            hint: suggestions.length > 0
+                ? `did you mean: ${suggestions.join(', ')}? Run postgres_admin with op "roles_list" to see the full list`
+                : 'run postgres_admin with op "roles_list" to see the exact role names available',
+            details: { profile: profile.alias, role: name, suggestions },
+        });
+    });
+}
+/**
+ * For `roles_create`: confirms no existing role uses `name`, then quotes and
+ * brands it — the "does not yet exist" counterpart to {@link resolveRole}.
+ * Quoting (not the existence check) is what makes this injection-safe; the
+ * check is a UX precondition, a readable "already exists" error instead of
+ * PostgreSQL's raw `42710 duplicate_object`.
+ */
+export async function assertRoleAvailable(profile, name) {
+    return withSession(profile, async (client) => {
+        const { rows } = await client.query(`SELECT rolname FROM pg_catalog.pg_roles WHERE rolname = $1`, [name]);
+        if (rows.length > 0) {
+            throw new PgMcpError({
+                code: 'PG_ERROR',
+                message: `role "${name}" already exists`,
+                hint: 'use op "roles_alter" to change an existing role, or pick a different name',
+                details: { profile: profile.alias, role: name },
+            });
+        }
+        return unsafeBrand(quoteIdent(name));
+    });
+}
+async function extensionCandidates(client, source) {
+    const col = source === 'pg_extension' ? 'extname' : 'name';
+    const { rows } = await client.query(`SELECT ${col} AS n FROM pg_catalog.${source}`);
+    return rows.map((r) => r.n);
+}
+/** Resolves an installed extension name against `pg_extension` — used by `extensions_drop`. */
+export async function resolveInstalledExtension(profile, name) {
+    return withSession(profile, async (client) => {
+        const { rows } = await client.query(`SELECT extname FROM pg_catalog.pg_extension WHERE extname = $1`, [name]);
+        const row = rows[0];
+        if (row !== undefined)
+            return unsafeBrand(quoteIdent(row.extname));
+        const suggestions = suggestSimilar(name, await extensionCandidates(client, 'pg_extension'));
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `extension "${name}" is not installed`,
+            hint: suggestions.length > 0
+                ? `did you mean: ${suggestions.join(', ')}? Run postgres_admin with op "extensions_list" to see installed extensions`
+                : 'run postgres_admin with op "extensions_list" to see installed extensions',
+            details: { profile: profile.alias, extension: name, suggestions },
+        });
+    });
+}
+/**
+ * Resolves an extension name against `pg_available_extensions` — used by
+ * `extensions_create`. Validating against the available list (rather than
+ * just quoting) catches a typo before `CREATE EXTENSION` runs arbitrary
+ * install-script SQL as superuser.
+ */
+export async function resolveAvailableExtension(profile, name) {
+    return withSession(profile, async (client) => {
+        const { rows } = await client.query(`SELECT name FROM pg_catalog.pg_available_extensions WHERE name = $1`, [name]);
+        const row = rows[0];
+        if (row !== undefined)
+            return unsafeBrand(quoteIdent(row.name));
+        const suggestions = suggestSimilar(name, await extensionCandidates(client, 'pg_available_extensions'));
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `extension "${name}" is not available on this server (not found in pg_available_extensions)`,
+            hint: suggestions.length > 0 ? `did you mean: ${suggestions.join(', ')}?` : "the extension's control file is not installed on this PostgreSQL server; ask an operator to install the OS package",
+            details: { profile: profile.alias, extension: name, suggestions },
+        });
+    });
+}
+/** Resolves `schema.name` against `pg_class` where `relkind = 'S'` — `resolveRelation` deliberately excludes sequences (see `CANDIDATE_RELKINDS`), so `grants` needs its own lookup for `GRANT ... ON SEQUENCE`. */
+export async function resolveSequence(profile, schema, name) {
+    return withSession(profile, async (client) => {
+        assertSchemaAllowed(profile, schema);
+        const { rows } = await client.query(`SELECT c.oid::text AS oid, n.nspname AS schema, c.relname AS name
+         FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = $1 AND c.relname = $2 AND c.relkind = 'S'`, [schema, name]);
+        const row = rows[0];
+        if (row !== undefined)
+            return { oid: Number(row.oid), schema: unsafeBrand(quoteIdent(row.schema)), name: unsafeBrand(quoteIdent(row.name)) };
+        const { rows: cand } = await client.query(`SELECT c.relname FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = $1 AND c.relkind = 'S'`, [schema]);
+        const suggestions = suggestSimilar(name, cand.map((r) => r.relname));
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `sequence "${schema}.${name}" does not exist`,
+            hint: suggestions.length > 0 ? `did you mean: ${suggestions.join(', ')}?` : 'run postgres_list_objects to see the exact sequence names available',
+            details: { profile: profile.alias, schema, name, suggestions },
+        });
+    });
+}
+/** Resolves `schema.name` against `pg_class` where `relkind = 'i'` — used by `maintenance_reindex`'s `target: 'index'` form. */
+export async function resolveIndex(profile, schema, name) {
+    return withSession(profile, async (client) => {
+        assertSchemaAllowed(profile, schema);
+        const { rows } = await client.query(`SELECT c.oid::text AS oid, n.nspname AS schema, c.relname AS name
+         FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = $1 AND c.relname = $2 AND c.relkind = 'i'`, [schema, name]);
+        const row = rows[0];
+        if (row !== undefined)
+            return { oid: Number(row.oid), schema: unsafeBrand(quoteIdent(row.schema)), name: unsafeBrand(quoteIdent(row.name)) };
+        const { rows: cand } = await client.query(`SELECT c.relname FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE n.nspname = $1 AND c.relkind = 'i'`, [schema]);
+        const suggestions = suggestSimilar(name, cand.map((r) => r.relname));
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `index "${schema}.${name}" does not exist`,
+            hint: suggestions.length > 0 ? `did you mean: ${suggestions.join(', ')}?` : 'run postgres_list_objects to see the exact index names available',
+            details: { profile: profile.alias, schema, name, suggestions },
+        });
+    });
+}
+/** Resolves an existing schema name against `pg_namespace` (after the usual scope check) and brands it — used by `GRANT ... ON SCHEMA`. */
+export async function resolveSchemaIdent(profile, schema) {
+    return withSession(profile, async (client) => {
+        assertSchemaAllowed(profile, schema);
+        const { rows } = await client.query(`SELECT oid::text AS oid, nspname FROM pg_catalog.pg_namespace WHERE nspname = $1`, [schema]);
+        const row = rows[0];
+        if (row !== undefined)
+            return { oid: Number(row.oid), name: unsafeBrand(quoteIdent(row.nspname)) };
+        throw new PgMcpError({
+            code: 'IDENTIFIER_UNKNOWN',
+            message: `schema "${schema}" does not exist`,
+            hint: 'run postgres_list_objects to see the exact schema names available',
+            details: { profile: profile.alias, schema },
+        });
+    });
+}
+/** The current database's own row in `pg_database`, branded — `GRANT ... ON DATABASE` always targets the profile's own database, never a caller-supplied name, so there is nothing to validate beyond confirming the round trip works. */
+export async function resolveCurrentDatabase(profile) {
+    return withSession(profile, async (client) => {
+        const { rows } = await client.query(`SELECT oid::text AS oid, datname FROM pg_catalog.pg_database WHERE datname = current_database()`);
+        const row = rows[0];
+        if (row === undefined) {
+            throw new PgMcpError({
+                code: 'PG_ERROR',
+                message: 'could not resolve the current database in pg_database',
+                hint: 'this should never happen on a reachable connection; report it',
+                details: { profile: profile.alias },
+            });
+        }
+        return { oid: Number(row.oid), name: unsafeBrand(quoteIdent(row.datname)) };
+    });
+}
+/**
+ * Resolves `schema.name` to exactly one function's full signature. PostgreSQL
+ * allows overloading, and `GRANT ON FUNCTION` needs the argument types to
+ * disambiguate — when more than one overload matches, this refuses rather
+ * than guessing, and points at `postgres_execute_sql` (which can take the
+ * exact signature the caller wants) instead.
+ */
+export async function resolveFunctionSignature(profile, schema, name) {
+    return withSession(profile, async (client) => {
+        assertSchemaAllowed(profile, schema);
+        const { rows } = await client.query(`SELECT p.oid::text AS oid, pg_catalog.pg_get_function_identity_arguments(p.oid) AS arg_types
+         FROM pg_catalog.pg_proc p JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = $1 AND p.proname = $2`, [schema, name]);
+        if (rows.length === 0) {
+            throw new PgMcpError({
+                code: 'IDENTIFIER_UNKNOWN',
+                message: `function "${schema}.${name}" does not exist`,
+                hint: 'run postgres_list_objects to see the exact function names available',
+                details: { profile: profile.alias, schema, name },
+            });
+        }
+        if (rows.length > 1) {
+            const overloads = rows.map((r) => `${name}(${r.arg_types})`);
+            throw new PgMcpError({
+                code: 'IDENTIFIER_UNKNOWN',
+                message: `"${schema}.${name}" is overloaded (${rows.length} signatures) — postgres_admin cannot tell which one you mean`,
+                hint: `use postgres_execute_sql naming the exact signature, e.g. one of: ${overloads.join(', ')}`,
+                details: { profile: profile.alias, schema, name, overloads },
+            });
+        }
+        const row = rows[0];
+        if (row === undefined)
+            throw new Error('unreachable: length === 1 guaranteed a row');
+        return { oid: Number(row.oid), signature: unsafeBrand(`${quoteIdent(schema)}.${quoteIdent(name)}(${row.arg_types})`) };
+    });
+}
+//# sourceMappingURL=identifiers.js.map

package/dist/core/identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../../src/core/identifiers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;GAUG;AAEH,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAE9D,2EAA2E;AAC3E,MAAM,WAAW,GAA8D;IAC7E,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,mBAAmB;IACtB,CAAC,EAAE,eAAe;CACnB,CAAC;AASF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,8GAA8G;AAC9G,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,GAAG,IAAI,KAAK,CAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAChB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW;YAC/B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY;YACpC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAC1B,CAAC;QACJ,CAAC;QACD,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,uHAAuH;AACvH,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,UAA6B,EAAE,KAAK,GAAG,eAAe;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;SACzE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,uBAAuB,CAAC;SACpD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACvE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEjF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,MAAc;IAClE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO;IACtC,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,UAAU,CAAC;QACnB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,WAAW,MAAM,mCAAmC,OAAO,CAAC,KAAK,GAAG;QAC7E,IAAI,EACF,OAAO,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;YACvE,CAAC,CAAC,yCAAyC,OAAO,CAAC,KAAK,wCAAwC;QACpG,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE;KACrE,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,MAAc,EAAE,IAAY;IAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;0CAKsC,EACtC,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,CACnC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,OAAgB;IAClE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,yGAAyG,CAC1G,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,OAA0B;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;0CAIsC,EACtC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAC9B,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,MAAc,EAAE,IAAY;IAClF,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAA8C,CAAC,CAAC;YAC7E,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBACpB,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI;aACL,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,YAAY;YAC9B,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,YAAY;gBACnB,CAAC,CAAC,aAAa,MAAM,IAAI,IAAI,kBAAkB;gBAC/C,CAAC,CAAC,WAAW,MAAM,kBAAkB;YACvC,IAAI,EACF,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;gBAC3F,CAAC,CAAC,yFAAyF;YAC/F,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,OAAgB,EAAE,SAA6B;IAC1G,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,SAAS;YAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY,EAAE,IAAkB;IAClG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa,EAAE,UAAkB,EAAE,YAA+B;IAC9G,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,WAAW,UAAU,wBAAwB,MAAM,IAAI,KAAK,GAAG;YACxE,IAAI,EACF,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,MAAM,IAAI,KAAK,gCAAgC;gBAC9H,CAAC,CAAC,oCAAoC,MAAM,IAAI,KAAK,gCAAgC;YACzF,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAaD,KAAK,UAAU,cAAc,CAAC,MAAkB;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB,yCAAyC,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAY;IAC9D,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,CACP,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAEnG,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,SAAS,IAAI,kBAAkB;YACxC,IAAI,EACF,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;gBACzG,CAAC,CAAC,+EAA+E;YACrF,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,IAAY;IACtE,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB,4DAA4D,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,SAAS,IAAI,kBAAkB;gBACxC,IAAI,EAAE,2EAA2E;gBACjF,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAkB,EAAE,MAAkD;IACvG,MAAM,GAAG,GAAG,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAgB,UAAU,GAAG,yBAAyB,MAAM,EAAE,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,IAAY;IAC5E,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB,gEAAgE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACnI,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,cAAc,IAAI,oBAAoB;YAC/C,IAAI,EACF,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;gBACrH,CAAC,CAAC,0EAA0E;YAChF,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;SAClE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB,EAAE,IAAY;IAC5E,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAmB,qEAAqE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrI,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACvG,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,cAAc,IAAI,0EAA0E;YACrG,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oHAAoH;YAChM,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE;SAClE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,oNAAoN;AACpN,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,MAAc,EAAE,IAAY;IAClF,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;oEAE8D,EAC9D,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAE7I,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC,+IAA+I,EAC/I,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,aAAa,MAAM,IAAI,IAAI,kBAAkB;YACtD,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qEAAqE;YACjJ,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,gIAAgI;AAChI,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAc,EAAE,IAAY;IAC/E,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;oEAE8D,EAC9D,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAE7I,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC,+IAA+I,EAC/I,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,UAAU,MAAM,IAAI,IAAI,kBAAkB;YACnD,IAAI,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kEAAkE;YAC9I,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,2IAA2I;AAC3I,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,MAAc;IACvE,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAmC,kFAAkF,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACpK,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,UAAU,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,WAAW,MAAM,kBAAkB;YAC5C,IAAI,EAAE,mEAAmE;YACzE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0OAA0O;AAC1O,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAgB;IAC3D,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAmC,iGAAiG,CAAC,CAAC;QACzK,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,+DAA+D;gBACrE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAgB,EAAE,MAAc,EAAE,IAAY;IAC3F,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3C,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;gDAE0C,EAC1C,CAAC,MAAM,EAAE,IAAI,CAAC,CACf,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,aAAa,MAAM,IAAI,IAAI,kBAAkB;gBACtD,IAAI,EAAE,qEAAqE;gBAC3E,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,MAAM,IAAI,IAAI,oBAAoB,IAAI,CAAC,MAAM,8DAA8D;gBACxH,IAAI,EAAE,qEAAqE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjG,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACrF,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;IACzH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/limits.js

@@ -0,0 +1,79 @@
+import { readInt } from '../config/env.js';
+/**
+ * Central output caps — resolved once per tool call as
+ * `min(global, per-profile, per-call)`; the tightest of the three always wins.
+ *
+ * **Row caps.** `config/profiles.ts#buildProfile` already resolves
+ * `min(PG_MCP_MAX_ROWS, PG_<ALIAS>_MAX_ROWS)` into `Profile.maxRows` — that
+ * number IS the ceiling this module receives, so `resolveLimits` only has to
+ * apply the optional per-call value on top of it.
+ *
+ * **Byte caps.** There is no per-profile byte override (`docs/design.md`
+ * §"Env var contract" lists only the global `PG_MCP_MAX_BYTES`, no
+ * `PG_<ALIAS>_MAX_BYTES`), so the ceiling here is the global value alone —
+ * parsed with the shared `readInt` helper from `config/env.ts` rather than a
+ * bespoke parse, per the phase brief.
+ */
+const DEFAULT_MAX_ROWS = 500;
+const DEFAULT_MAX_BYTES = 262_144;
+/** A fallback for callers that render outside a resolved-profile context (e.g. tests). Mirrors the documented global defaults. */
+export const DEFAULT_LIMITS = { maxRows: DEFAULT_MAX_ROWS, maxBytes: DEFAULT_MAX_BYTES };
+/** `undefined` or a non-positive request is "no opinion" — falls back to the ceiling untouched, never loosens it. */
+function tighten(ceiling, requested) {
+    if (requested === undefined || requested <= 0)
+        return ceiling;
+    return Math.min(ceiling, requested);
+}
+/**
+ * Resolves the effective `{ maxRows, maxBytes }` for one tool call.
+ *
+ * @param profileMaxRows the calling profile's already-resolved `Profile.maxRows`
+ * @param call optional per-call caps; each can only tighten its ceiling
+ * @param env injectable for tests; defaults to `process.env`
+ */
+export function resolveLimits(profileMaxRows, call = {}, env = process.env) {
+    const globalMaxBytes = readInt(env, 'PG_MCP_MAX_BYTES', { default: DEFAULT_MAX_BYTES, min: 1 });
+    return {
+        maxRows: tighten(profileMaxRows, call.maxRows),
+        maxBytes: tighten(globalMaxBytes, call.maxBytes),
+    };
+}
+/**
+ * Keeps rows up to `caps.maxRows` and `caps.maxBytes`, whichever binds first.
+ *
+ * **Never serializes past the cap.** Each row is serialized once, in order,
+ * to measure its real byte size (`Buffer.byteLength`, not an estimate); as
+ * soon as adding it would cross `caps.maxBytes` — or `caps.maxRows` is
+ * already met — the loop stops. No row beyond that point is ever touched, so
+ * a multi-GB result set is never serialized in full just to discover it is
+ * too big.
+ */
+export function truncateRows(rows, caps, serialize) {
+    const kept = [];
+    let bytes = 0;
+    let reason = null;
+    for (let i = 0; i < rows.length; i++) {
+        if (kept.length >= caps.maxRows) {
+            reason = 'rows';
+            break;
+        }
+        // Safe: `i < rows.length` is the loop condition, so this index always exists.
+        const row = rows[i];
+        const size = Buffer.byteLength(serialize(row), 'utf8');
+        if (bytes + size > caps.maxBytes) {
+            reason = 'bytes';
+            break;
+        }
+        bytes += size;
+        kept.push(row);
+    }
+    return {
+        rows: kept,
+        truncation: {
+            truncatedRows: rows.length - kept.length,
+            truncatedBytes: bytes,
+            reason,
+        },
+    };
+}
+//# sourceMappingURL=limits.js.map

package/dist/core/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/core/limits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAOlC,kIAAkI;AAClI,MAAM,CAAC,MAAM,cAAc,GAAmB,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AAQzG,qHAAqH;AACrH,SAAS,OAAO,CAAC,OAAe,EAAE,SAA6B;IAC7D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,cAAsB,EACtB,OAAiB,EAAE,EACnB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC;QAC9C,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC;KACjD,CAAC;AACJ,CAAC;AAoBD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAkB,EAClB,IAAoB,EACpB,SAA6B;IAE7B,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAyB,IAAI,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,MAAM,CAAC;YAChB,MAAM;QACR,CAAC;QACD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAM,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,GAAG,OAAO,CAAC;YACjB,MAAM;QACR,CAAC;QACD,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV,aAAa,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;YACxC,cAAc,EAAE,KAAK;YACrB,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/core/logger.js

@@ -0,0 +1,34 @@
+import process from 'node:process';
+/**
+ * Tiny leveled logger. **Writes to stderr only, always.**
+ *
+ * stdout belongs exclusively to the JSON-RPC frame stream; a single stray byte
+ * there corrupts the session. Level comes from `PG_MCP_LOG_LEVEL` (default
+ * `warn`) and is read per call so tests can flip it without module reloads.
+ */
+const LEVELS = { error: 0, warn: 1, info: 2, debug: 3 };
+function threshold(env) {
+    const raw = (env['PG_MCP_LOG_LEVEL'] ?? 'warn').toLowerCase();
+    return Object.hasOwn(LEVELS, raw) ? LEVELS[raw] : LEVELS.warn;
+}
+function emit(level, message, extra) {
+    if (LEVELS[level] > threshold(process.env))
+        return;
+    const tail = extra === undefined ? '' : ` ${safeJson(extra)}`;
+    process.stderr.write(`[pg-admin-mcp] ${level}: ${message}${tail}\n`);
+}
+function safeJson(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+export const logger = {
+    error: (message, extra) => emit('error', message, extra),
+    warn: (message, extra) => emit('warn', message, extra),
+    info: (message, extra) => emit('info', message, extra),
+    debug: (message, extra) => emit('debug', message, extra),
+};
+//# sourceMappingURL=logger.js.map

package/dist/core/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAIjE,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,IAAI,CAAC,KAAe,EAAE,OAAe,EAAE,KAAe;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO;IACnD,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,OAAO,GAAG,IAAI,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;IAChF,IAAI,EAAE,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;IAC9E,IAAI,EAAE,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;IAC9E,KAAK,EAAE,CAAC,OAAe,EAAE,KAAe,EAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;CACjF,CAAC"}