@nacre.work/api 0.0.0 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/NOTICE +9 -0
- package/dist/adapters.d.ts +326 -15
- package/dist/adapters.d.ts.map +1 -1
- package/dist/adapters.js +992 -52
- package/dist/adapters.js.map +1 -1
- package/dist/audit-export.d.ts +45 -0
- package/dist/audit-export.d.ts.map +1 -0
- package/dist/audit-export.js +155 -0
- package/dist/audit-export.js.map +1 -0
- package/dist/auth.d.ts +17 -0
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +17 -7
- package/dist/auth.js.map +1 -1
- package/dist/idempotency.d.ts +62 -0
- package/dist/idempotency.d.ts.map +1 -0
- package/dist/idempotency.js +147 -0
- package/dist/idempotency.js.map +1 -0
- package/dist/index.d.ts +11 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +10 -1
- package/dist/index.js.map +1 -1
- package/dist/init.d.ts +9 -0
- package/dist/init.d.ts.map +1 -1
- package/dist/init.js +50 -5
- package/dist/init.js.map +1 -1
- package/dist/limits.d.ts +80 -0
- package/dist/limits.d.ts.map +1 -0
- package/dist/limits.js +63 -0
- package/dist/limits.js.map +1 -0
- package/dist/login.d.ts +94 -0
- package/dist/login.d.ts.map +1 -0
- package/dist/login.js +283 -0
- package/dist/login.js.map +1 -0
- package/dist/main.js +136 -53
- package/dist/main.js.map +1 -1
- package/dist/pagination.d.ts +72 -0
- package/dist/pagination.d.ts.map +1 -0
- package/dist/pagination.js +110 -0
- package/dist/pagination.js.map +1 -0
- package/dist/rerank.d.ts +99 -0
- package/dist/rerank.d.ts.map +1 -0
- package/dist/rerank.js +138 -0
- package/dist/rerank.js.map +1 -0
- package/dist/server.d.ts +345 -6
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +1035 -24
- package/dist/server.js.map +1 -1
- package/dist/service-keys.d.ts +13 -5
- package/dist/service-keys.d.ts.map +1 -1
- package/dist/service-keys.js +54 -31
- package/dist/service-keys.js.map +1 -1
- package/dist/source.d.ts +53 -0
- package/dist/source.d.ts.map +1 -0
- package/dist/source.js +109 -0
- package/dist/source.js.map +1 -0
- package/package.json +28 -10
- package/dist/__tests__/admin-surface.test.d.ts +0 -2
- package/dist/__tests__/admin-surface.test.d.ts.map +0 -1
- package/dist/__tests__/admin-surface.test.js +0 -431
- package/dist/__tests__/admin-surface.test.js.map +0 -1
- package/dist/__tests__/init.test.d.ts +0 -2
- package/dist/__tests__/init.test.d.ts.map +0 -1
- package/dist/__tests__/init.test.js +0 -125
- package/dist/__tests__/init.test.js.map +0 -1
- package/dist/__tests__/service-keys.test.d.ts +0 -2
- package/dist/__tests__/service-keys.test.d.ts.map +0 -1
- package/dist/__tests__/service-keys.test.js +0 -204
- package/dist/__tests__/service-keys.test.js.map +0 -1
package/dist/server.d.ts
CHANGED
|
@@ -1,5 +1,11 @@
|
|
|
1
1
|
import { type Server } from 'node:http';
|
|
2
|
+
import { type Metadata, type ProtectedResourceMetadata } from '@nacre.work/core';
|
|
2
3
|
import { type AuthContext, type VerifyOptions } from './auth.js';
|
|
4
|
+
import { type IdempotencyStore } from './idempotency.js';
|
|
5
|
+
import { type LimitPolicy, type RateLimiter, type Resource } from './limits.js';
|
|
6
|
+
import type { Login } from './login.js';
|
|
7
|
+
import { type Page, type PageResult } from './pagination.js';
|
|
8
|
+
export type { Page, PageResult };
|
|
3
9
|
/**
|
|
4
10
|
* What the API needs from the rest of the system, as ports.
|
|
5
11
|
*
|
|
@@ -27,6 +33,18 @@ export interface Documents {
|
|
|
27
33
|
* grant had been revoked, and a service account with `write` and no `read`.
|
|
28
34
|
*/
|
|
29
35
|
read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
|
|
36
|
+
/**
|
|
37
|
+
* Replace a document's metadata, leaving its vectors alone.
|
|
38
|
+
*
|
|
39
|
+
* `false` for every reason the write cannot happen — absent, another
|
|
40
|
+
* organization's, denied, or a caller with no `write` reaching it. Same rule
|
|
41
|
+
* as `read`: one answer for all of them, or the 403/404 distinction leaks
|
|
42
|
+
* through whatever the caller does with it.
|
|
43
|
+
*
|
|
44
|
+
* Absent from an implementation means the path answers `404`, like any other
|
|
45
|
+
* capability a surface does not have.
|
|
46
|
+
*/
|
|
47
|
+
updateMetadata?(auth: AuthContext, documentId: string, metadata: Metadata): Promise<boolean>;
|
|
30
48
|
}
|
|
31
49
|
/**
|
|
32
50
|
* A document, as a caller sees it.
|
|
@@ -48,6 +66,8 @@ export interface DocumentView {
|
|
|
48
66
|
readonly status: string;
|
|
49
67
|
readonly chunk_count: number;
|
|
50
68
|
readonly updated_at: string;
|
|
69
|
+
/** What the caller tagged it with, and what `filters` reads back. */
|
|
70
|
+
readonly metadata: Metadata;
|
|
51
71
|
}
|
|
52
72
|
/**
|
|
53
73
|
* One result, as the contract describes it.
|
|
@@ -71,8 +91,43 @@ export interface SearchHit {
|
|
|
71
91
|
readonly score: number;
|
|
72
92
|
readonly text: string;
|
|
73
93
|
}
|
|
94
|
+
/**
|
|
95
|
+
* What a caller may ask of a search beyond the query itself.
|
|
96
|
+
*
|
|
97
|
+
* `rerank` can only ever turn reranking **off**. A deployment without a
|
|
98
|
+
* reranker configured does not grow one because a client asked for it, so this
|
|
99
|
+
* is a preference and not a switch — which is the right way round: the client
|
|
100
|
+
* knows whether it wants latency or quality, the operator knows whether the
|
|
101
|
+
* model server exists.
|
|
102
|
+
*/
|
|
103
|
+
export interface SearchOptions {
|
|
104
|
+
readonly rerank?: boolean;
|
|
105
|
+
/**
|
|
106
|
+
* Layer slugs to restrict the search to. Narrowing only — a layer the caller
|
|
107
|
+
* cannot read contributes nothing whether or not they name it, and naming one
|
|
108
|
+
* that does not exist is the same answer as naming one they cannot see.
|
|
109
|
+
*/
|
|
110
|
+
readonly layers?: readonly string[];
|
|
111
|
+
/**
|
|
112
|
+
* Document metadata to restrict to, key to value. Narrowing only.
|
|
113
|
+
*
|
|
114
|
+
* Equality, and a list means "any of these". Never a negation, a range or a
|
|
115
|
+
* disjunction across keys — each of those is a way to widen if it is ever
|
|
116
|
+
* composed wrongly, and none is needed to answer "only documents from this
|
|
117
|
+
* source". Validated before it gets here.
|
|
118
|
+
*/
|
|
119
|
+
readonly filters?: Metadata;
|
|
120
|
+
/**
|
|
121
|
+
* `false` omits the chunk text from every hit.
|
|
122
|
+
*
|
|
123
|
+
* For a client that wants ids and scores — a reranking front end, a citation
|
|
124
|
+
* index — and does not want to pay for the bodies. Applied after reranking,
|
|
125
|
+
* because a reranker scores the query against the text.
|
|
126
|
+
*/
|
|
127
|
+
readonly includeContent?: boolean;
|
|
128
|
+
}
|
|
74
129
|
export interface SearchService {
|
|
75
|
-
search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
|
|
130
|
+
search(auth: AuthContext, query: string, topK: number, options?: SearchOptions): Promise<readonly SearchHit[]>;
|
|
76
131
|
}
|
|
77
132
|
export interface IngestRequest {
|
|
78
133
|
readonly layer: string;
|
|
@@ -80,6 +135,8 @@ export interface IngestRequest {
|
|
|
80
135
|
readonly title?: string;
|
|
81
136
|
readonly content?: string;
|
|
82
137
|
readonly url?: string;
|
|
138
|
+
/** Validated before it gets here. `{}` when the caller sent none. */
|
|
139
|
+
readonly metadata: Metadata;
|
|
83
140
|
}
|
|
84
141
|
export interface IngestOutcome {
|
|
85
142
|
readonly documentId: string;
|
|
@@ -120,6 +177,8 @@ export interface Layer {
|
|
|
120
177
|
readonly slug: string;
|
|
121
178
|
readonly name: string;
|
|
122
179
|
readonly workspaceId: string;
|
|
180
|
+
/** The cursor's sort key. Not serialized; it exists so paging is stable. */
|
|
181
|
+
readonly createdAt: string;
|
|
123
182
|
readonly description: string;
|
|
124
183
|
/**
|
|
125
184
|
* Live documents in the layer.
|
|
@@ -147,6 +206,37 @@ export interface Layer {
|
|
|
147
206
|
* discloses exactly one bit, that the slug is taken somewhere in their own
|
|
148
207
|
* organization, and slugs are organization-unique by design (migration 0006).
|
|
149
208
|
*/
|
|
209
|
+
/** A workspace, as a caller sees it. */
|
|
210
|
+
export interface Workspace {
|
|
211
|
+
readonly id: string;
|
|
212
|
+
readonly slug: string;
|
|
213
|
+
readonly name: string;
|
|
214
|
+
/**
|
|
215
|
+
* Live layers in it — not "layers this caller may read".
|
|
216
|
+
*
|
|
217
|
+
* The same choice the layer listing makes for its document count: a count
|
|
218
|
+
* that varied by who asked would leak the shape of somebody else's grants,
|
|
219
|
+
* and a caller comparing two of them could infer what they cannot see.
|
|
220
|
+
*/
|
|
221
|
+
readonly layerCount: number;
|
|
222
|
+
readonly createdAt: string;
|
|
223
|
+
}
|
|
224
|
+
export type WorkspaceOutcome = {
|
|
225
|
+
readonly kind: 'created';
|
|
226
|
+
readonly workspace: Workspace;
|
|
227
|
+
} | {
|
|
228
|
+
readonly kind: 'denied';
|
|
229
|
+
} | {
|
|
230
|
+
readonly kind: 'conflict';
|
|
231
|
+
};
|
|
232
|
+
export interface Workspaces {
|
|
233
|
+
/** Only the workspaces this caller can reach. The plan decides, not the caller. */
|
|
234
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<Workspace>>;
|
|
235
|
+
create(auth: AuthContext, input: {
|
|
236
|
+
slug: string;
|
|
237
|
+
name: string;
|
|
238
|
+
}): Promise<WorkspaceOutcome>;
|
|
239
|
+
}
|
|
150
240
|
export type LayerOutcome = {
|
|
151
241
|
readonly kind: 'created';
|
|
152
242
|
readonly layer: Layer;
|
|
@@ -154,15 +244,56 @@ export type LayerOutcome = {
|
|
|
154
244
|
readonly kind: 'denied';
|
|
155
245
|
} | {
|
|
156
246
|
readonly kind: 'conflict';
|
|
247
|
+
}
|
|
248
|
+
/**
|
|
249
|
+
* The named provider is not one this organization may use, or the
|
|
250
|
+
* organization runs more than one and the caller named none.
|
|
251
|
+
*
|
|
252
|
+
* 400 rather than 404: the caller has already proved admin on the workspace,
|
|
253
|
+
* so this is a statement about their request. Same reasoning as the reindex
|
|
254
|
+
* path's `unknown_provider`, and a provider is installation configuration
|
|
255
|
+
* rather than a tenant object with visibility rules of its own.
|
|
256
|
+
*/
|
|
257
|
+
| {
|
|
258
|
+
readonly kind: 'provider';
|
|
259
|
+
readonly detail: string;
|
|
157
260
|
};
|
|
158
261
|
export interface Layers {
|
|
159
|
-
/**
|
|
160
|
-
|
|
262
|
+
/**
|
|
263
|
+
* Only the layers this caller may read. The plan decides, not the caller.
|
|
264
|
+
*
|
|
265
|
+
* Takes the page rather than returning everything for the handler to slice:
|
|
266
|
+
* slicing after the fact is the same mistake as a post-filter, one layer up —
|
|
267
|
+
* the database reads rows nobody will see, and the cost grows with the
|
|
268
|
+
* collection rather than with the page.
|
|
269
|
+
*/
|
|
270
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<Layer>>;
|
|
161
271
|
create(auth: AuthContext, input: {
|
|
162
272
|
workspaceId: string;
|
|
163
273
|
slug: string;
|
|
164
274
|
name: string;
|
|
275
|
+
providerId?: string;
|
|
165
276
|
}): Promise<LayerOutcome>;
|
|
277
|
+
/**
|
|
278
|
+
* Rename a layer, or change its description.
|
|
279
|
+
*
|
|
280
|
+
* Deliberately not the slug: clients address a layer by slug — `layers` on
|
|
281
|
+
* search, `layer` on ingest — so renaming one silently breaks every caller
|
|
282
|
+
* that stored it, and there is no redirect to soften it.
|
|
283
|
+
*
|
|
284
|
+
* Deliberately not the provider or the chunk configuration either. Both
|
|
285
|
+
* decide how the layer's vectors were built, so changing one without
|
|
286
|
+
* rebuilding them leaves the column disagreeing with the index — which is
|
|
287
|
+
* what `POST /v1/layers/{id}/reindex` is, and it is not something to get by
|
|
288
|
+
* accident from a PATCH.
|
|
289
|
+
*
|
|
290
|
+
* `false` for absent, for another organization's, and for one this caller may
|
|
291
|
+
* not administer. One answer for all three.
|
|
292
|
+
*/
|
|
293
|
+
update?(auth: AuthContext, layerId: string, input: {
|
|
294
|
+
name?: string;
|
|
295
|
+
description?: string;
|
|
296
|
+
}): Promise<boolean>;
|
|
166
297
|
}
|
|
167
298
|
export interface GrantInput {
|
|
168
299
|
readonly principalType: 'user' | 'group' | 'service_account';
|
|
@@ -178,7 +309,7 @@ export interface GrantRecord extends GrantInput {
|
|
|
178
309
|
}
|
|
179
310
|
export interface Grants {
|
|
180
311
|
/** Grants in the caller's organization. Admin only; the caller is checked above. */
|
|
181
|
-
list(auth: AuthContext): Promise<
|
|
312
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<GrantRecord>>;
|
|
182
313
|
/** `undefined` when the caller may not administer the scope, or it does not exist. */
|
|
183
314
|
issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
|
|
184
315
|
/**
|
|
@@ -201,11 +332,12 @@ export interface ServiceAccountView {
|
|
|
201
332
|
readonly revokedAt: string | null;
|
|
202
333
|
}
|
|
203
334
|
export interface ServiceAccountPort {
|
|
204
|
-
list(auth: AuthContext): Promise<
|
|
335
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<ServiceAccountView>>;
|
|
336
|
+
/** `undefined` when the name is already taken in this organization. */
|
|
205
337
|
create(auth: AuthContext, name: string): Promise<{
|
|
206
338
|
account: ServiceAccountView;
|
|
207
339
|
key: string;
|
|
208
|
-
}>;
|
|
340
|
+
} | undefined>;
|
|
209
341
|
revoke(auth: AuthContext, id: string): Promise<boolean>;
|
|
210
342
|
}
|
|
211
343
|
export interface AuditEvent {
|
|
@@ -215,17 +347,222 @@ export interface AuditEvent {
|
|
|
215
347
|
readonly result: 'allow' | 'deny' | 'error';
|
|
216
348
|
readonly detail: Record<string, unknown>;
|
|
217
349
|
readonly requestId: string;
|
|
350
|
+
/**
|
|
351
|
+
* Which surface the call came in on.
|
|
352
|
+
*
|
|
353
|
+
* Was hardcoded `'api'` in the adapter, and the MCP server shares that sink —
|
|
354
|
+
* so every agent's read was logged as though a human had made it over REST.
|
|
355
|
+
* The column existed, the schema declared the enum, and nothing could tell
|
|
356
|
+
* the two apart. Defaults to `api` so an omission is the common case rather
|
|
357
|
+
* than a lie.
|
|
358
|
+
*/
|
|
359
|
+
readonly surface?: 'api' | 'mcp' | 'admin' | 'system';
|
|
360
|
+
/**
|
|
361
|
+
* What the call was about, as `docs/audit.md` specifies it.
|
|
362
|
+
*
|
|
363
|
+
* Was hardcoded `'{}'::jsonb`, so the `gin (target)` index built for it
|
|
364
|
+
* indexed nothing and the document's opening promise — "show me which
|
|
365
|
+
* documents your agent read last quarter" — could not be answered at all.
|
|
366
|
+
* Search fills in the layers and the ids it returned; the rest name what they
|
|
367
|
+
* touched.
|
|
368
|
+
*/
|
|
369
|
+
readonly target?: Record<string, unknown>;
|
|
370
|
+
}
|
|
371
|
+
/**
|
|
372
|
+
* The counters and histograms the request path fills in.
|
|
373
|
+
*
|
|
374
|
+
* Deliberately a narrow port rather than the whole `Metrics` object: the server
|
|
375
|
+
* should not be able to reach the gauges that a background collector owns, and
|
|
376
|
+
* a test should not need a registry to check that a denial was counted.
|
|
377
|
+
*/
|
|
378
|
+
export interface RequestMetrics {
|
|
379
|
+
searchDuration: {
|
|
380
|
+
observe(seconds: number, labels?: Record<string, string>): void;
|
|
381
|
+
};
|
|
382
|
+
searchResults: {
|
|
383
|
+
inc(labels?: Record<string, string>, by?: number): void;
|
|
384
|
+
};
|
|
385
|
+
aclDenials: {
|
|
386
|
+
inc(labels?: Record<string, string>, by?: number): void;
|
|
387
|
+
};
|
|
388
|
+
ingestDuration: {
|
|
389
|
+
observe(seconds: number, labels?: Record<string, string>): void;
|
|
390
|
+
};
|
|
391
|
+
authFailures: {
|
|
392
|
+
inc(labels?: Record<string, string>, by?: number): void;
|
|
393
|
+
};
|
|
218
394
|
}
|
|
219
395
|
export interface AuditSink {
|
|
220
396
|
/** Awaited before the response goes out. A lost event is worse than a slow response. */
|
|
221
397
|
write(event: AuditEvent): Promise<void>;
|
|
222
398
|
}
|
|
399
|
+
/**
|
|
400
|
+
* One event as it is read back, which is not the shape it was written in.
|
|
401
|
+
*
|
|
402
|
+
* `AuditEvent` is what a handler hands to the sink; this is what the table
|
|
403
|
+
* holds — an id, a timestamp, and the actor split into the three columns
|
|
404
|
+
* `docs/audit.md` specifies rather than the single label the writer supplies.
|
|
405
|
+
*/
|
|
406
|
+
export interface AuditRecord {
|
|
407
|
+
readonly id: string;
|
|
408
|
+
readonly occurredAt: string;
|
|
409
|
+
readonly actorType: string;
|
|
410
|
+
readonly actorId: string | null;
|
|
411
|
+
readonly actorLabel: string;
|
|
412
|
+
readonly action: string;
|
|
413
|
+
readonly surface: string;
|
|
414
|
+
readonly client: string | null;
|
|
415
|
+
readonly target: Record<string, unknown>;
|
|
416
|
+
readonly result: string;
|
|
417
|
+
readonly detail: Record<string, unknown>;
|
|
418
|
+
readonly requestId: string | null;
|
|
419
|
+
}
|
|
420
|
+
/**
|
|
421
|
+
* What a caller may narrow the log to.
|
|
422
|
+
*
|
|
423
|
+
* Every one of these is applied. That is worth stating because the last three
|
|
424
|
+
* search parameters in this contract were declared and ignored, and an audit
|
|
425
|
+
* filter that silently does nothing is worse than a search filter that does:
|
|
426
|
+
* the person running it is answering a compliance question and will believe the
|
|
427
|
+
* answer.
|
|
428
|
+
*/
|
|
429
|
+
export interface AuditQuery {
|
|
430
|
+
/** Inclusive lower bound on `occurred_at`, as an ISO timestamp. */
|
|
431
|
+
readonly from?: string;
|
|
432
|
+
/** Exclusive upper bound on `occurred_at`. */
|
|
433
|
+
readonly to?: string;
|
|
434
|
+
readonly actorId?: string;
|
|
435
|
+
readonly action?: string;
|
|
436
|
+
readonly result?: 'allow' | 'deny' | 'error';
|
|
437
|
+
/**
|
|
438
|
+
* Restrict to administrative actions — everything that is not a substantive
|
|
439
|
+
* access to a document's contents.
|
|
440
|
+
*
|
|
441
|
+
* Not a caller-supplied filter. It is set by the handler for a
|
|
442
|
+
* `platform_admin`, because `docs/audit.md` gives that role administrative
|
|
443
|
+
* visibility and explicitly withholds records of document access. Keeping it
|
|
444
|
+
* in this type rather than in the SQL means the rule is stated once, at the
|
|
445
|
+
* boundary, where it can be read next to the role check that sets it.
|
|
446
|
+
*/
|
|
447
|
+
readonly administrativeOnly?: boolean;
|
|
448
|
+
}
|
|
449
|
+
/**
|
|
450
|
+
* Moving a layer onto a different embedding model.
|
|
451
|
+
*
|
|
452
|
+
* Two operations and no more: start one, and ask how it is going. There is no
|
|
453
|
+
* cancel, and that is a decision rather than an omission — a half-written
|
|
454
|
+
* shadow vector is harmless (nothing reads it until the switch) and a cancel
|
|
455
|
+
* that has to decide whether to unwind it is a second, more dangerous path.
|
|
456
|
+
* Starting a reindex back onto the current model is how you undo one.
|
|
457
|
+
*/
|
|
458
|
+
export interface Reindex {
|
|
459
|
+
/**
|
|
460
|
+
* `undefined` for a layer the caller may not administer **and** for one that
|
|
461
|
+
* does not exist — the usual rule. `conflict` when a reindex is already
|
|
462
|
+
* running: that is not a permission answer, and the caller has already proved
|
|
463
|
+
* they can administer the layer by the time it can happen.
|
|
464
|
+
*/
|
|
465
|
+
start(auth: AuthContext, layerId: string, providerId: string): Promise<ReindexOutcome | undefined>;
|
|
466
|
+
status(auth: AuthContext, layerId: string): Promise<ReindexStatus | undefined>;
|
|
467
|
+
}
|
|
468
|
+
export type ReindexOutcome = {
|
|
469
|
+
readonly kind: 'started';
|
|
470
|
+
readonly status: ReindexStatus;
|
|
471
|
+
} | {
|
|
472
|
+
readonly kind: 'conflict';
|
|
473
|
+
readonly status: ReindexStatus;
|
|
474
|
+
} | {
|
|
475
|
+
readonly kind: 'unknown_provider';
|
|
476
|
+
}
|
|
477
|
+
/** The provider names the vector the layer already uses. */
|
|
478
|
+
| {
|
|
479
|
+
readonly kind: 'already_current';
|
|
480
|
+
readonly vectorName: string;
|
|
481
|
+
};
|
|
482
|
+
export interface ReindexStatus {
|
|
483
|
+
readonly layerId: string;
|
|
484
|
+
readonly status: 'running' | 'complete' | 'failed';
|
|
485
|
+
/**
|
|
486
|
+
* `copying` while the organization's collection is being rebuilt with room
|
|
487
|
+
* for the new model — org-wide, no embeddings computed. `embedding` while
|
|
488
|
+
* this layer's chunks are being embedded into that room.
|
|
489
|
+
*/
|
|
490
|
+
readonly phase: 'copying' | 'embedding';
|
|
491
|
+
readonly shadowVector: string;
|
|
492
|
+
readonly currentVector: string;
|
|
493
|
+
readonly providerId: string;
|
|
494
|
+
readonly startedAt: string;
|
|
495
|
+
readonly finishedAt: string | null;
|
|
496
|
+
readonly total: number;
|
|
497
|
+
readonly done: number;
|
|
498
|
+
readonly failed: number;
|
|
499
|
+
readonly progress: number;
|
|
500
|
+
readonly error: string | null;
|
|
501
|
+
}
|
|
502
|
+
export interface AuditReader {
|
|
503
|
+
read(auth: AuthContext, query: AuditQuery, page: Page): Promise<PageResult<AuditRecord>>;
|
|
504
|
+
}
|
|
223
505
|
export interface ApiOptions {
|
|
224
506
|
readonly verify: VerifyOptions;
|
|
225
507
|
/** Rendered at /metrics. Absent means the endpoint answers 404. */
|
|
226
508
|
readonly metrics?: {
|
|
227
509
|
render(): Promise<string>;
|
|
228
510
|
};
|
|
511
|
+
/**
|
|
512
|
+
* Where the request path writes what it measured.
|
|
513
|
+
*
|
|
514
|
+
* Four of these were registered and never written: `/metrics` served
|
|
515
|
+
* `nacre_search_results_total 0` and `nacre_acl_denials_total 0` forever, and
|
|
516
|
+
* the two histograms rendered nothing at all. A series pinned at zero reads
|
|
517
|
+
* as health, so the p95 target `docs/config.md` sets was not merely unmet —
|
|
518
|
+
* it was unmeasurable, and looked fine.
|
|
519
|
+
*/
|
|
520
|
+
readonly observe?: RequestMetrics;
|
|
521
|
+
/**
|
|
522
|
+
* Answered at `/v1/ready`. Absent means the endpoint answers 404.
|
|
523
|
+
*
|
|
524
|
+
* One boolean per dependency, and never an error string: this endpoint is
|
|
525
|
+
* unauthenticated, so what it says about the inside of the deployment is what
|
|
526
|
+
* anyone who can reach the port learns.
|
|
527
|
+
*/
|
|
528
|
+
readonly ready?: () => Promise<Record<string, boolean>>;
|
|
529
|
+
/**
|
|
530
|
+
* Per-organization rate limiting. Absent means unlimited, which is the right
|
|
531
|
+
* default for a surface being tested and the wrong one for a deployment —
|
|
532
|
+
* `main.ts` always provides it.
|
|
533
|
+
*/
|
|
534
|
+
readonly limits?: RateLimiter;
|
|
535
|
+
readonly limitPolicies?: Readonly<Record<Resource, LimitPolicy>>;
|
|
536
|
+
/**
|
|
537
|
+
* How many proxies sit in front of this process, for the per-client login
|
|
538
|
+
* limit. Absent or 0 means `X-Forwarded-For` is ignored and the socket
|
|
539
|
+
* address is the client — see `source.ts` for why neither default is safe.
|
|
540
|
+
*/
|
|
541
|
+
readonly trustProxy?: number;
|
|
542
|
+
/**
|
|
543
|
+
* A bearer token required on `/metrics`. Absent leaves the endpoint open,
|
|
544
|
+
* which is the default and is right for an internal port — see the handler.
|
|
545
|
+
*/
|
|
546
|
+
readonly metricsToken?: string;
|
|
547
|
+
/**
|
|
548
|
+
* The RFC 9728 document served at `/.well-known/oauth-protected-resource`.
|
|
549
|
+
*
|
|
550
|
+
* Passed in rather than built here so the API and the MCP transport serve
|
|
551
|
+
* byte-identical bytes: two builders would drift, and a client that read one
|
|
552
|
+
* and authenticated against the other would be audience-bound to a string
|
|
553
|
+
* neither agreed on.
|
|
554
|
+
*/
|
|
555
|
+
readonly resourceMetadata?: ProtectedResourceMetadata;
|
|
556
|
+
/** Absent means the workspace paths answer 404, like any capability a surface lacks. */
|
|
557
|
+
readonly workspaces?: Workspaces;
|
|
558
|
+
/** Layer reindex. Absent means the reindex paths answer 404. */
|
|
559
|
+
readonly reindex?: Reindex;
|
|
560
|
+
/** Reads the access log back. Absent means `/v1/audit` answers 404. */
|
|
561
|
+
readonly auditReader?: AuditReader;
|
|
562
|
+
/** `Idempotency-Key` on unsafe methods. Absent means the header is ignored. */
|
|
563
|
+
readonly idempotency?: IdempotencyStore;
|
|
564
|
+
/** Email and password sign-in. Absent means `/v1/auth/*` is 404. */
|
|
565
|
+
readonly login?: Login;
|
|
229
566
|
readonly documents: Documents;
|
|
230
567
|
readonly search: SearchService;
|
|
231
568
|
readonly ingest: Ingest;
|
|
@@ -234,6 +571,8 @@ export interface ApiOptions {
|
|
|
234
571
|
readonly layers?: Layers;
|
|
235
572
|
readonly grants?: Grants;
|
|
236
573
|
readonly serviceAccounts?: ServiceAccountPort;
|
|
574
|
+
/** `NACRE_MAX_DOCUMENT_BYTES`. Over it is `413`, not `400`. */
|
|
575
|
+
readonly maxBodyBytes?: number;
|
|
237
576
|
}
|
|
238
577
|
export declare function createApi(options: ApiOptions): Server;
|
|
239
578
|
//# sourceMappingURL=server.d.ts.map
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAGpG;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACtF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IACpF,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAA;IAClD,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;IACxD,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9F,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;CAC9C;AAuGD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQrD"}
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAML,KAAK,QAAQ,EACb,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpG,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAAU,MAAM,YAAY,CAAA;AAS/C,OAAO,EAAY,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7F;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IACpF,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACtE,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;IACrD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAieD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQrD"}
|