@nacre.work/api 0.0.0 → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Nacre
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+Nacre
+Copyright 2026 Nacre
+
+This product includes software developed at Nacre (https://nacre.work).
+
+Licensed under the Apache License, Version 2.0. See LICENSE.
+
+"Nacre" and the Nacre mark are trademarks. Section 6 of the Apache License
+grants no trademark rights; permitted use is described in TRADEMARK.md.

package/dist/adapters.d.ts

@@ -1,6 +1,7 @@
-import { aclTags, buildFilter, VectorStore } from '@nacre.work/core';
+import { aclTags, buildFilter, VectorStore, type Metadata } from '@nacre.work/core';
 import type { Pool } from 'pg';
-import type { AuditEvent, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, SearchHit, SearchService } from './server.js';
+import { type Reranker } from './rerank.js';
+import type { Reindex, ReindexOutcome, ReindexStatus, AuditEvent, AuditQuery, AuditReader, AuditRecord, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, Page, PageResult, Workspace, WorkspaceOutcome, Workspaces, SearchHit, SearchOptions, SearchService } from './server.js';
 import type { AuthContext } from './auth.js';
 /**
  * The adapters that put the permission model on the request path.
@@ -15,8 +16,24 @@ export interface Embedder {
 }
 export declare class PostgresDocuments implements Documents {
     private readonly pool;
+    /**
+     * What writes metadata into the payload of a document's points.
+     *
+     * Narrow on purpose, like the delete path's tombstone port: this endpoint
+     * has no business searching, and a port that could would let a later change
+     * reach the index without a plan.
+     */
+    private readonly payload;
     private readonly role?;
-    constructor(pool: Pool, role?: string | undefined);
+    constructor(pool: Pool, 
+    /**
+     * What writes metadata into the payload of a document's points.
+     *
+     * Narrow on purpose, like the delete path's tombstone port: this endpoint
+     * has no business searching, and a port that could would let a later change
+     * reach the index without a plan.
+     */
+    payload: DocumentMetadataWriter, role?: string | undefined);
     /**
      * Undefined for absent, for another organization's, and for one this caller
      * has no grant reaching — one answer for all three.
@@ -28,20 +45,116 @@ export declare class PostgresDocuments implements Documents {
      * inside a tenant, and it is the one that was missing.
      */
     read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
+    /**
+     * Replace a document's metadata without re-embedding it.
+     *
+     * This is the cheap path `docs/api.md` said was not built. Ingest treats a
+     * metadata change as a change: the row and the vector payload would otherwise
+     * disagree and the document would carry a tag it does not answer to, so a
+     * re-tag cost a full re-parse, re-chunk and re-embed. Here the vectors are
+     * untouched and only the payload is rewritten — the same `setPayload` the ACL
+     * retag sweep uses, for the same reason.
+     *
+     * `write`, not `read`, and rule 6 means those are not the same set. The
+     * answer carries no body at all: a caller who may write to a document and not
+     * read it must not learn its title or its layer from a successful PATCH.
+     *
+     * Row first, then payload, both inside one transaction. A payload write that
+     * throws rolls the row back, so the two cannot end up disagreeing in the
+     * direction that matters — the row is what the worker rebuilds the payload
+     * from on the next index, so a row that ran ahead would be reverted while a
+     * payload that ran ahead would not.
+     */
+    updateMetadata(auth: AuthContext, documentId: string, metadata: Metadata): Promise<boolean>;
+}
+export interface DocumentMetadataWriter {
+    setMetadata(collection: string, documentId: string, metadata: Metadata): Promise<void>;
 }
 export interface SearchDeps {
     readonly pool: Pool;
     readonly vectors: VectorStore;
-    readonly embedder: Embedder;
-    /** Resolved per organization; the collection name is derived from it. */
-    readonly orgSlug: (orgId: string) => Promise<string | undefined>;
-    readonly vectorName: string;
+    /**
+     * The query embedder for a given provider.
+     *
+     * Per provider and not one for the whole process. `NACRE_EMBEDDING_MODEL`
+     * used to decide both the named vector a search looked in and the model the
+     * query was embedded with, for every layer in every organization — so a layer
+     * created against a second provider was silently unsearchable: its points
+     * carry `v_small_v2_768` and the query went to `v_bge_m3_1024`, which matches
+     * nothing and raises nothing. `embedding_providers` has had an `org_id`
+     * column and a documented "NULL = global default" since the first migration;
+     * the search path was the half that never honoured it.
+     */
+    readonly embedderFor: (provider: EmbeddingProvider) => Embedder;
     readonly role?: string;
+    /** Absent means reranking is off, which is what the `minimal` profile is. */
+    readonly reranker?: Reranker;
+    /** Candidates to rerank. docs/architecture.md says 50. */
+    readonly rerankCandidates?: number;
+    /**
+     * Reranking stopped working, with the search still answering in fusion order.
+     * An operator who turned reranking on is entitled to know it is not running.
+     */
+    readonly onRerankFailed?: (error: unknown) => void;
+}
+/** What a layer needs embedded with, and where. */
+export interface EmbeddingProvider {
+    readonly id: string;
+    readonly endpoint: string;
+    readonly model: string;
+    readonly dimensions: number;
 }
 export declare class NacreSearchService implements SearchService {
     private readonly deps;
     constructor(deps: SearchDeps);
-    search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
+    search(auth: AuthContext, query: string, topK: number, options?: SearchOptions): Promise<readonly SearchHit[]>;
+    /**
+     * The organization's layers, grouped by the model they are indexed with.
+     *
+     * Restricted first to what this search can actually reach — the permission
+     * plan, then the caller's own `layers` narrowing — so a query never embeds
+     * against a provider whose layers contribute nothing. That is not only a
+     * saving: an embedding endpoint that is down would otherwise fail a search
+     * over layers that have no connection to it.
+     *
+     * A plan carrying `extraDocs` keeps every group. Documents granted
+     * individually can sit in any layer, including one the caller reaches no
+     * other way, so dropping a group here would answer empty where the correct
+     * answer is "the documents you were granted".
+     */
+    private groupsInScope;
+    /**
+     * Layer slugs to ids, within one organization.
+     *
+     * Scoped through `withOrg` like every other tenant read, so a slug belonging
+     * to another organization resolves to nothing rather than to their layer. The
+     * result is intersected with what the caller may reach by the filter itself —
+     * the ids become a `must` and the permission constraint stays a `should`, so
+     * a layer this caller cannot read contributes no results even when it
+     * resolves here.
+     *
+     * Unknown slugs are dropped rather than reported. Answering "no such layer"
+     * would separate "does not exist" from "you cannot see it", which is exactly
+     * the distinction invariant I4 exists to prevent.
+     */
+    private layerIds;
+    /**
+     * Reorder by cross-encoder score, or answer in fusion order and say so.
+     *
+     * The text comes from the hydration that had to happen anyway. A reranker
+     * scores query against text, and the vector store holds no text — so the
+     * order here is search, hydrate the candidates, rerank, cut. Hydrating fifty
+     * rows rather than ten is one query with a wider `ANY($2)`, which is the cost
+     * of the quality this buys.
+     *
+     * Failure answers with what fusion produced rather than raising. Reranking
+     * decides ordering over candidates that were all permitted before it saw
+     * them, so a reranker being down is a quality degradation and not a
+     * permissions one — and making the product's central operation depend on an
+     * optional model server would be the worse trade. It is reported, never
+     * silent.
+     */
+    private rerank;
     /**
      * Turn hits into results a caller can read.
      *
@@ -92,7 +205,20 @@ export declare class HttpEmbedder implements Embedder {
     private readonly endpoint;
     private readonly model;
     private readonly dimensions;
-    constructor(endpoint: string, model: string, dimensions: number);
+    /** One query, one vector, and a caller waiting on it. */
+    private readonly timeoutMs;
+    constructor(endpoint: string, model: string, dimensions: number, 
+    /** One query, one vector, and a caller waiting on it. */
+    timeoutMs?: number);
+    /**
+     * One embedder per provider, built once and reused.
+     *
+     * Keyed on the provider's id, so an operator who edits an endpoint has to
+     * restart — which is true of every other piece of configuration here, and the
+     * alternative is a cache that has to be invalidated from a table nothing
+     * watches.
+     */
+    static pool(timeoutMs?: number): (provider: EmbeddingProvider) => Embedder;
     embed(texts: readonly string[]): Promise<readonly (readonly number[])[]>;
 }
 export { aclTags };
@@ -112,12 +238,10 @@ export interface IngestDeps {
      * would let a later change reach the index without a plan.
      */
     readonly tombstone: DocumentTombstone;
-    /** Resolved per organization; the collection name is derived from it. */
-    readonly orgSlug: (orgId: string) => Promise<string | undefined>;
     readonly role?: string;
 }
 export interface DocumentTombstone {
-    tombstone(orgSlug: string, documentId: string): Promise<void>;
+    tombstone(collection: string, documentId: string): Promise<void>;
 }
 export declare class NacreIngest implements Ingest {
     private readonly deps;
@@ -145,8 +269,34 @@ export declare class PostgresJobs implements Jobs {
 }
 export declare class PostgresLayers implements Layers {
     private readonly pool;
+    /**
+     * Only to ask which named vectors the organization's collection has.
+     *
+     * A layer is created against a provider, and the provider decides which
+     * named vector the layer's points go into. Qdrant fixes that set when the
+     * collection is created and has no way to extend it, so a layer on a
+     * provider the collection has no slot for is a layer whose every document
+     * fails in the worker with `Not existing vector name` — after the API has
+     * answered 202 and the row says `pending`. Checking here is what turns that
+     * into a collection rebuild instead.
+     */
+    private readonly vectors;
     private readonly role?;
-    constructor(pool: Pool, role?: string | undefined);
+    constructor(pool: Pool, 
+    /**
+     * Only to ask which named vectors the organization's collection has.
+     *
+     * A layer is created against a provider, and the provider decides which
+     * named vector the layer's points go into. Qdrant fixes that set when the
+     * collection is created and has no way to extend it, so a layer on a
+     * provider the collection has no slot for is a layer whose every document
+     * fails in the worker with `Not existing vector name` — after the API has
+     * answered 202 and the row says `pending`. Checking here is what turns that
+     * into a collection rebuild instead.
+     */
+    vectors: {
+        vectorsOf(collection: string): Promise<Record<string, number>>;
+    }, role?: string | undefined);
     private get scope();
     /**
      * The layers this caller may read.
@@ -156,13 +306,71 @@ export declare class PostgresLayers implements Layers {
      * break invariant I2 — but writing it the other way keeps one habit for both
      * and removes the question of which endpoints are allowed to be sloppy.
      */
-    list(auth: AuthContext): Promise<readonly Layer[]>;
+    list(auth: AuthContext, page?: Page): Promise<PageResult<Layer>>;
+    update(auth: AuthContext, layerId: string, input: {
+        name?: string;
+        description?: string;
+    }): Promise<boolean>;
     create(auth: AuthContext, input: {
         workspaceId: string;
         slug: string;
         name: string;
+        providerId?: string;
     }): Promise<LayerOutcome>;
 }
+/**
+ * Workspaces.
+ *
+ * The missing link in the API's own flow: creating a layer takes a
+ * `workspace_id`, and until this existed the only way to have one was the line
+ * `init` printed. `docs/quickstart.md` said as much — "the workspace id is the
+ * one `init` printed" — so a second administrator, a client library, or anyone
+ * who closed that terminal had no way forward that did not involve reading the
+ * database directly.
+ */
+export declare class PostgresWorkspaces implements Workspaces {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    /**
+     * The workspaces this caller can reach, newest last, cursor-paged.
+     *
+     * Two ways to reach one, and the second is the reason this endpoint had to
+     * exist at all:
+     *
+     * 1. it holds a layer the read plan reaches — the ordinary case, and the same
+     *    narrowing the layer listing does;
+     * 2. the caller holds a grant on the workspace itself. An **empty** workspace
+     *    has no layers to be reached through, so without this an administrator
+     *    who had just been granted one could not see it, and therefore could not
+     *    create the first layer in it. That is the exact deadlock this endpoint
+     *    is here to break.
+     *
+     * Filtered in memory rather than in SQL because the second rule is the
+     * resolver's to answer, not a join's, and an organization has tens of
+     * workspaces rather than thousands. The listing is narrowed before it is
+     * paged — a page assembled first and filtered second would leak the count.
+     */
+    list(auth: AuthContext, page?: Page): Promise<PageResult<Workspace>>;
+    /**
+     * Create a workspace. `org_admin` only.
+     *
+     * There is no scope above a workspace to hold a grant on — `scope_type` is
+     * one of workspace, layer, document — so there is no one to ask except the
+     * role. `referenceAllows` would answer this with `role === 'org_admin'` and
+     * nothing else, so the check is written plainly rather than routed through a
+     * resolver call that can only return one thing.
+     *
+     * `platform_admin` is refused along with everyone else. Rule 2: it
+     * administers organizations and reads no documents, and a workspace is where
+     * documents live.
+     */
+    create(auth: AuthContext, input: {
+        slug: string;
+        name: string;
+    }): Promise<WorkspaceOutcome>;
+}
 export declare class PostgresGrants implements Grants {
     private readonly pool;
     private readonly role?;
@@ -176,7 +384,20 @@ export declare class PostgresGrants implements Grants {
      * than none — an administrator who cannot see an existing grant revokes the
      * wrong thing.
      */
-    list(auth: AuthContext): Promise<readonly GrantRecord[]>;
+    /**
+     * Paginated, and the page may be short.
+     *
+     * Which grants a caller may see is decided by `referenceAllows` against the
+     * scope tree, which SQL cannot express — so rows are fetched by cursor and
+     * filtered afterwards. That makes `items.length < limit` normal rather than a
+     * signal, and `next_cursor` the only thing that says whether more exist.
+     *
+     * The cursor comes from the last row **fetched**, not the last returned.
+     * Deriving it from the last returned row would skip everything the filter
+     * removed after it, which is a page of grants silently missing from an
+     * administrator's view of who can reach what.
+     */
+    list(auth: AuthContext, page?: Page): Promise<PageResult<GrantRecord>>;
     issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
     /**
      * Withdraw a grant.
@@ -194,4 +415,94 @@ export declare class PostgresGrants implements Grants {
      */
     revoke(auth: AuthContext, grantId: string): Promise<boolean>;
 }
+/**
+ * Reading the access log back.
+ *
+ * Scoped through `withOrg` like every other tenant read, so the row-level
+ * policy on `audit_events` is the second line of defence behind the role check
+ * in the handler. `SELECT` is the only grant the application role has on this
+ * table and that stays true — nothing here writes.
+ *
+ * ## Newest first, and what that does to the cursor
+ *
+ * Every other paged collection here reads oldest-first, because a catalog is a
+ * set and the order is arbitrary. A log is not: the useful end is the recent
+ * one, and an auditor paging forward from the beginning of a 400-day retention
+ * window to find yesterday is not a feature. So this orders
+ * `(occurred_at, id) DESC` and the seek predicate is `<` rather than `>`.
+ *
+ * The cursor still means "everything after the last row you saw", which is the
+ * same contract read in the other direction. It is worth being explicit because
+ * copying the seek clause from the layers adapter — where it is `>` — would
+ * produce a first page that works and a second page that silently returns the
+ * beginning of the log.
+ */
+export declare class PostgresAuditReader implements AuditReader {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    /**
+     * Actions that record a substantive access to a document's contents.
+     *
+     * Withheld from `platform_admin`, per rule 2 in docs/authz.md as
+     * docs/audit.md applies it to the journal. Named as a deny-list rather than
+     * an allow-list of administrative actions, and that is the uncomfortable
+     * direction: a new action defaults to *visible* to a platform administrator
+     * rather than hidden.
+     *
+     * Chosen anyway, because the alternative fails worse. An allow-list means a
+     * new administrative action is invisible to the operator who administers the
+     * installation until someone remembers to add it — a silent gap in an
+     * operational tool. This way a new *access* action is visible until someone
+     * adds it here, which is a disclosure to an already highly-privileged role
+     * within one installation. Both are bugs; only one of them is quiet.
+     *
+     * The `audit-event` skill's checklist is where this list is kept in step.
+     */
+    private static readonly DOCUMENT_ACCESS;
+    read(auth: AuthContext, query: AuditQuery, page: Page): Promise<PageResult<AuditRecord>>;
+    private scopeFor;
+}
+/**
+ * Starting a reindex, and reporting on one.
+ *
+ * The work is the worker's. This writes the intent — `layers.reindex_state` —
+ * counts what there is to do, and declares the new named vector on the
+ * collection.
+ *
+ * That last part belongs here and an earlier version of this comment said the
+ * opposite: that Qdrant creates a named vector when a point is first written
+ * with it, so the worker's first batch would bring it into existence. It does
+ * not. `updateVectors` against an undeclared name answers
+ * `Not existing vector name error`, and the reindex that assumed otherwise
+ * started cleanly, reported `running`, and failed every document forever with
+ * the progress gauge sitting at zero — which is step 1 of the sequence in
+ * docs/architecture.md being skipped, and the document has it first for a
+ * reason.
+ *
+ * Doing it here rather than in the worker also puts the failure where somebody
+ * is looking: an operator who cannot create the vector finds out from the
+ * response to their own request, not by watching a counter not move.
+ */
+export declare class PostgresReindex implements Reindex {
+    private readonly pool;
+    private readonly vectors;
+    private readonly role?;
+    constructor(pool: Pool, vectors: {
+        vectorsOf(collection: string): Promise<Record<string, number>>;
+    }, role?: string | undefined);
+    private get scope();
+    start(auth: AuthContext, layerId: string, providerId: string): Promise<ReindexOutcome | undefined>;
+    status(auth: AuthContext, layerId: string): Promise<ReindexStatus | undefined>;
+    /**
+     * Live documents in the layer that do not yet carry this vector.
+     *
+     * The same predicate the worker's claim uses and the same one the switch is
+     * guarded by. Three places, one meaning — and if they ever disagree, the
+     * switch is the one that is right, because it is the only one inside the
+     * statement that performs it.
+     */
+    private remaining;
+    private statusOf;
+}
 //# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAOX,WAAW,EAIZ,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEvE;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAwDrF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAoD3F;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IAG/B,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAiC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA6BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAqDpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAoEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAiCD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC;IAkDlD,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC;CAmFzB;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;IA+CxD,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE"}
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAUX,WAAW,EAIX,KAAK,QAAQ,EAId,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAG1C,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IAE/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBATL,IAAI,EAAE,IAAI;IAC3B;;;;;;OAMG;IACc,OAAO,EAAE,sBAAsB,EAC/B,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+DpF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC;CAgDpB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,CAAA;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACnD;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AASD,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IA0LhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,aAAa;IA6DrB;;;;;;;;;;;;;OAaG;YACW,QAAQ;IAwBtB;;;;;;;;;;;;;;;OAeG;YACW,MAAM;IAoBpB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAJT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IACnC,yDAAyD;IACxC,SAAS,SAAS;IAGrC;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ;IAgBpE,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAsC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjE;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA6BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAkEpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAyEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAkCD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAbL,IAAI,EAAE,IAAI;IAC3B;;;;;;;;;;OAUG;IACc,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAgEhE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC;CA6JzB;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IAEjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA+D1E;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;CAyC7B;AA6DD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAkEtE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE;AAGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA4D;IAE7F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAuE9F,OAAO,CAAC,QAAQ;CAGjB;AAiBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,YAAW,OAAO;IAE3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAFL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,KAAK,CACT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAkJhC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAsCpF;;;;;;;OAOG;YACW,SAAS;IAevB,OAAO,CAAC,QAAQ;CAwBjB"}