@nacre.work/api 0.0.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/NOTICE +9 -0
- package/dist/adapters.d.ts +421 -17
- package/dist/adapters.d.ts.map +1 -1
- package/dist/adapters.js +1092 -72
- package/dist/adapters.js.map +1 -1
- package/dist/audit-export.d.ts +45 -0
- package/dist/audit-export.d.ts.map +1 -0
- package/dist/audit-export.js +155 -0
- package/dist/audit-export.js.map +1 -0
- package/dist/auth.d.ts +17 -0
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +17 -7
- package/dist/auth.js.map +1 -1
- package/dist/idempotency.d.ts +62 -0
- package/dist/idempotency.d.ts.map +1 -0
- package/dist/idempotency.js +147 -0
- package/dist/idempotency.js.map +1 -0
- package/dist/index.d.ts +12 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +10 -1
- package/dist/index.js.map +1 -1
- package/dist/init.d.ts +9 -0
- package/dist/init.d.ts.map +1 -1
- package/dist/init.js +50 -5
- package/dist/init.js.map +1 -1
- package/dist/limits.d.ts +80 -0
- package/dist/limits.d.ts.map +1 -0
- package/dist/limits.js +63 -0
- package/dist/limits.js.map +1 -0
- package/dist/login.d.ts +94 -0
- package/dist/login.d.ts.map +1 -0
- package/dist/login.js +283 -0
- package/dist/login.js.map +1 -0
- package/dist/main.js +171 -60
- package/dist/main.js.map +1 -1
- package/dist/pagination.d.ts +72 -0
- package/dist/pagination.d.ts.map +1 -0
- package/dist/pagination.js +110 -0
- package/dist/pagination.js.map +1 -0
- package/dist/rerank.d.ts +99 -0
- package/dist/rerank.d.ts.map +1 -0
- package/dist/rerank.js +138 -0
- package/dist/rerank.js.map +1 -0
- package/dist/server.d.ts +361 -6
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +1050 -31
- package/dist/server.js.map +1 -1
- package/dist/service-keys.d.ts +13 -5
- package/dist/service-keys.d.ts.map +1 -1
- package/dist/service-keys.js +54 -31
- package/dist/service-keys.js.map +1 -1
- package/dist/source.d.ts +53 -0
- package/dist/source.d.ts.map +1 -0
- package/dist/source.js +109 -0
- package/dist/source.js.map +1 -0
- package/package.json +28 -10
- package/dist/__tests__/admin-surface.test.d.ts +0 -2
- package/dist/__tests__/admin-surface.test.d.ts.map +0 -1
- package/dist/__tests__/admin-surface.test.js +0 -431
- package/dist/__tests__/admin-surface.test.js.map +0 -1
- package/dist/__tests__/init.test.d.ts +0 -2
- package/dist/__tests__/init.test.d.ts.map +0 -1
- package/dist/__tests__/init.test.js +0 -125
- package/dist/__tests__/init.test.js.map +0 -1
- package/dist/__tests__/service-keys.test.d.ts +0 -2
- package/dist/__tests__/service-keys.test.d.ts.map +0 -1
- package/dist/__tests__/service-keys.test.js +0 -204
- package/dist/__tests__/service-keys.test.js.map +0 -1
package/dist/adapters.d.ts
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
|
-
import { aclTags, buildFilter, VectorStore } from '@nacre.work/core';
|
|
1
|
+
import { aclTags, buildFilter, VectorStore, type CacheStore, type Metadata } from '@nacre.work/core';
|
|
2
2
|
import type { Pool } from 'pg';
|
|
3
|
-
import
|
|
3
|
+
import { type Reranker } from './rerank.js';
|
|
4
|
+
import type { Reindex, ReindexOutcome, ReindexStatus, AuditEvent, AuditQuery, AuditReader, AuditRecord, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, Page, PageResult, Workspace, WorkspaceOutcome, Workspaces, SearchHit, SearchOptions, SearchService } from './server.js';
|
|
4
5
|
import type { AuthContext } from './auth.js';
|
|
5
6
|
/**
|
|
6
7
|
* The adapters that put the permission model on the request path.
|
|
@@ -15,8 +16,46 @@ export interface Embedder {
|
|
|
15
16
|
}
|
|
16
17
|
export declare class PostgresDocuments implements Documents {
|
|
17
18
|
private readonly pool;
|
|
19
|
+
/**
|
|
20
|
+
* What writes metadata into the payload of a document's points.
|
|
21
|
+
*
|
|
22
|
+
* Narrow on purpose, like the delete path's tombstone port: this endpoint
|
|
23
|
+
* has no business searching, and a port that could would let a later change
|
|
24
|
+
* reach the index without a plan.
|
|
25
|
+
*/
|
|
26
|
+
private readonly payload;
|
|
18
27
|
private readonly role?;
|
|
19
|
-
|
|
28
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
29
|
+
private readonly principalsCache?;
|
|
30
|
+
/**
|
|
31
|
+
* Where a `source_url` comes from, when a deployment has object storage.
|
|
32
|
+
*
|
|
33
|
+
* Absent leaves the field off the response entirely, which is what every
|
|
34
|
+
* deployment without a bucket should see: a document whose bytes are in
|
|
35
|
+
* `documents.source_ref` has nothing to link to.
|
|
36
|
+
*/
|
|
37
|
+
private readonly presign?;
|
|
38
|
+
constructor(pool: Pool,
|
|
39
|
+
/**
|
|
40
|
+
* What writes metadata into the payload of a document's points.
|
|
41
|
+
*
|
|
42
|
+
* Narrow on purpose, like the delete path's tombstone port: this endpoint
|
|
43
|
+
* has no business searching, and a port that could would let a later change
|
|
44
|
+
* reach the index without a plan.
|
|
45
|
+
*/
|
|
46
|
+
payload: DocumentMetadataWriter, role?: string | undefined,
|
|
47
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
48
|
+
principalsCache?: PrincipalsCache | undefined,
|
|
49
|
+
/**
|
|
50
|
+
* Where a `source_url` comes from, when a deployment has object storage.
|
|
51
|
+
*
|
|
52
|
+
* Absent leaves the field off the response entirely, which is what every
|
|
53
|
+
* deployment without a bucket should see: a document whose bytes are in
|
|
54
|
+
* `documents.source_ref` has nothing to link to.
|
|
55
|
+
*/
|
|
56
|
+
presign?: {
|
|
57
|
+
url(key: string): string;
|
|
58
|
+
} | undefined);
|
|
20
59
|
/**
|
|
21
60
|
* Undefined for absent, for another organization's, and for one this caller
|
|
22
61
|
* has no grant reaching — one answer for all three.
|
|
@@ -28,20 +67,118 @@ export declare class PostgresDocuments implements Documents {
|
|
|
28
67
|
* inside a tenant, and it is the one that was missing.
|
|
29
68
|
*/
|
|
30
69
|
read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
|
|
70
|
+
/**
|
|
71
|
+
* Replace a document's metadata without re-embedding it.
|
|
72
|
+
*
|
|
73
|
+
* This is the cheap path `docs/api.md` said was not built. Ingest treats a
|
|
74
|
+
* metadata change as a change: the row and the vector payload would otherwise
|
|
75
|
+
* disagree and the document would carry a tag it does not answer to, so a
|
|
76
|
+
* re-tag cost a full re-parse, re-chunk and re-embed. Here the vectors are
|
|
77
|
+
* untouched and only the payload is rewritten — the same `setPayload` the ACL
|
|
78
|
+
* retag sweep uses, for the same reason.
|
|
79
|
+
*
|
|
80
|
+
* `write`, not `read`, and rule 6 means those are not the same set. The
|
|
81
|
+
* answer carries no body at all: a caller who may write to a document and not
|
|
82
|
+
* read it must not learn its title or its layer from a successful PATCH.
|
|
83
|
+
*
|
|
84
|
+
* Row first, then payload, both inside one transaction. A payload write that
|
|
85
|
+
* throws rolls the row back, so the two cannot end up disagreeing in the
|
|
86
|
+
* direction that matters — the row is what the worker rebuilds the payload
|
|
87
|
+
* from on the next index, so a row that ran ahead would be reverted while a
|
|
88
|
+
* payload that ran ahead would not.
|
|
89
|
+
*/
|
|
90
|
+
updateMetadata(auth: AuthContext, documentId: string, metadata: Metadata): Promise<boolean>;
|
|
91
|
+
}
|
|
92
|
+
export interface DocumentMetadataWriter {
|
|
93
|
+
setMetadata(collection: string, documentId: string, metadata: Metadata): Promise<void>;
|
|
31
94
|
}
|
|
32
95
|
export interface SearchDeps {
|
|
33
96
|
readonly pool: Pool;
|
|
97
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
98
|
+
readonly principalsCache?: PrincipalsCache;
|
|
34
99
|
readonly vectors: VectorStore;
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
100
|
+
/**
|
|
101
|
+
* The query embedder for a given provider.
|
|
102
|
+
*
|
|
103
|
+
* Per provider and not one for the whole process. `NACRE_EMBEDDING_MODEL`
|
|
104
|
+
* used to decide both the named vector a search looked in and the model the
|
|
105
|
+
* query was embedded with, for every layer in every organization — so a layer
|
|
106
|
+
* created against a second provider was silently unsearchable: its points
|
|
107
|
+
* carry `v_small_v2_768` and the query went to `v_bge_m3_1024`, which matches
|
|
108
|
+
* nothing and raises nothing. `embedding_providers` has had an `org_id`
|
|
109
|
+
* column and a documented "NULL = global default" since the first migration;
|
|
110
|
+
* the search path was the half that never honoured it.
|
|
111
|
+
*/
|
|
112
|
+
readonly embedderFor: (provider: EmbeddingProvider) => Embedder;
|
|
39
113
|
readonly role?: string;
|
|
114
|
+
/** Absent means reranking is off, which is what the `minimal` profile is. */
|
|
115
|
+
readonly reranker?: Reranker;
|
|
116
|
+
/** Candidates to rerank. docs/architecture.md says 50. */
|
|
117
|
+
readonly rerankCandidates?: number;
|
|
118
|
+
/**
|
|
119
|
+
* Reranking stopped working, with the search still answering in fusion order.
|
|
120
|
+
* An operator who turned reranking on is entitled to know it is not running.
|
|
121
|
+
*/
|
|
122
|
+
readonly onRerankFailed?: (error: unknown) => void;
|
|
123
|
+
}
|
|
124
|
+
/** What a layer needs embedded with, and where. */
|
|
125
|
+
export interface EmbeddingProvider {
|
|
126
|
+
readonly id: string;
|
|
127
|
+
readonly endpoint: string;
|
|
128
|
+
readonly model: string;
|
|
129
|
+
readonly dimensions: number;
|
|
40
130
|
}
|
|
41
131
|
export declare class NacreSearchService implements SearchService {
|
|
42
132
|
private readonly deps;
|
|
43
133
|
constructor(deps: SearchDeps);
|
|
44
|
-
search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
|
|
134
|
+
search(auth: AuthContext, query: string, topK: number, options?: SearchOptions): Promise<readonly SearchHit[]>;
|
|
135
|
+
/**
|
|
136
|
+
* The organization's layers, grouped by the model they are indexed with.
|
|
137
|
+
*
|
|
138
|
+
* Restricted first to what this search can actually reach — the permission
|
|
139
|
+
* plan, then the caller's own `layers` narrowing — so a query never embeds
|
|
140
|
+
* against a provider whose layers contribute nothing. That is not only a
|
|
141
|
+
* saving: an embedding endpoint that is down would otherwise fail a search
|
|
142
|
+
* over layers that have no connection to it.
|
|
143
|
+
*
|
|
144
|
+
* A plan carrying `extraDocs` keeps every group. Documents granted
|
|
145
|
+
* individually can sit in any layer, including one the caller reaches no
|
|
146
|
+
* other way, so dropping a group here would answer empty where the correct
|
|
147
|
+
* answer is "the documents you were granted".
|
|
148
|
+
*/
|
|
149
|
+
private groupsInScope;
|
|
150
|
+
/**
|
|
151
|
+
* Layer slugs to ids, within one organization.
|
|
152
|
+
*
|
|
153
|
+
* Scoped through `withOrg` like every other tenant read, so a slug belonging
|
|
154
|
+
* to another organization resolves to nothing rather than to their layer. The
|
|
155
|
+
* result is intersected with what the caller may reach by the filter itself —
|
|
156
|
+
* the ids become a `must` and the permission constraint stays a `should`, so
|
|
157
|
+
* a layer this caller cannot read contributes no results even when it
|
|
158
|
+
* resolves here.
|
|
159
|
+
*
|
|
160
|
+
* Unknown slugs are dropped rather than reported. Answering "no such layer"
|
|
161
|
+
* would separate "does not exist" from "you cannot see it", which is exactly
|
|
162
|
+
* the distinction invariant I4 exists to prevent.
|
|
163
|
+
*/
|
|
164
|
+
private layerIds;
|
|
165
|
+
/**
|
|
166
|
+
* Reorder by cross-encoder score, or answer in fusion order and say so.
|
|
167
|
+
*
|
|
168
|
+
* The text comes from the hydration that had to happen anyway. A reranker
|
|
169
|
+
* scores query against text, and the vector store holds no text — so the
|
|
170
|
+
* order here is search, hydrate the candidates, rerank, cut. Hydrating fifty
|
|
171
|
+
* rows rather than ten is one query with a wider `ANY($2)`, which is the cost
|
|
172
|
+
* of the quality this buys.
|
|
173
|
+
*
|
|
174
|
+
* Failure answers with what fusion produced rather than raising. Reranking
|
|
175
|
+
* decides ordering over candidates that were all permitted before it saw
|
|
176
|
+
* them, so a reranker being down is a quality degradation and not a
|
|
177
|
+
* permissions one — and making the product's central operation depend on an
|
|
178
|
+
* optional model server would be the worse trade. It is reported, never
|
|
179
|
+
* silent.
|
|
180
|
+
*/
|
|
181
|
+
private rerank;
|
|
45
182
|
/**
|
|
46
183
|
* Turn hits into results a caller can read.
|
|
47
184
|
*
|
|
@@ -92,7 +229,20 @@ export declare class HttpEmbedder implements Embedder {
|
|
|
92
229
|
private readonly endpoint;
|
|
93
230
|
private readonly model;
|
|
94
231
|
private readonly dimensions;
|
|
95
|
-
|
|
232
|
+
/** One query, one vector, and a caller waiting on it. */
|
|
233
|
+
private readonly timeoutMs;
|
|
234
|
+
constructor(endpoint: string, model: string, dimensions: number,
|
|
235
|
+
/** One query, one vector, and a caller waiting on it. */
|
|
236
|
+
timeoutMs?: number);
|
|
237
|
+
/**
|
|
238
|
+
* One embedder per provider, built once and reused.
|
|
239
|
+
*
|
|
240
|
+
* Keyed on the provider's id, so an operator who edits an endpoint has to
|
|
241
|
+
* restart — which is true of every other piece of configuration here, and the
|
|
242
|
+
* alternative is a cache that has to be invalidated from a table nothing
|
|
243
|
+
* watches.
|
|
244
|
+
*/
|
|
245
|
+
static pool(timeoutMs?: number): (provider: EmbeddingProvider) => Embedder;
|
|
96
246
|
embed(texts: readonly string[]): Promise<readonly (readonly number[])[]>;
|
|
97
247
|
}
|
|
98
248
|
export { aclTags };
|
|
@@ -106,18 +256,31 @@ export { aclTags };
|
|
|
106
256
|
*/
|
|
107
257
|
export interface IngestDeps {
|
|
108
258
|
readonly pool: Pool;
|
|
259
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
260
|
+
readonly principalsCache?: PrincipalsCache;
|
|
109
261
|
/**
|
|
110
262
|
* What takes a document out of results. Narrower than `VectorStore` on
|
|
111
263
|
* purpose: the delete path has no business searching, and a port that could
|
|
112
264
|
* would let a later change reach the index without a plan.
|
|
113
265
|
*/
|
|
114
266
|
readonly tombstone: DocumentTombstone;
|
|
115
|
-
/**
|
|
116
|
-
|
|
267
|
+
/**
|
|
268
|
+
* Where document bytes go, when a deployment has object storage.
|
|
269
|
+
*
|
|
270
|
+
* Absent is the supported default and not a degraded mode: bytes then live in
|
|
271
|
+
* `documents.source_ref`, which is what every deployment did before this. The
|
|
272
|
+
* difference is what a Postgres dump weighs — with this set it holds
|
|
273
|
+
* references, without it, every document in full.
|
|
274
|
+
*/
|
|
275
|
+
readonly objects?: ObjectStore;
|
|
117
276
|
readonly role?: string;
|
|
118
277
|
}
|
|
278
|
+
export interface ObjectStore {
|
|
279
|
+
put(key: string, body: Uint8Array, contentType?: string): Promise<void>;
|
|
280
|
+
remove(key: string): Promise<void>;
|
|
281
|
+
}
|
|
119
282
|
export interface DocumentTombstone {
|
|
120
|
-
tombstone(
|
|
283
|
+
tombstone(collection: string, documentId: string): Promise<void>;
|
|
121
284
|
}
|
|
122
285
|
export declare class NacreIngest implements Ingest {
|
|
123
286
|
private readonly deps;
|
|
@@ -140,13 +303,77 @@ export declare class NacreIngest implements Ingest {
|
|
|
140
303
|
export declare class PostgresJobs implements Jobs {
|
|
141
304
|
private readonly pool;
|
|
142
305
|
private readonly role?;
|
|
143
|
-
|
|
306
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
307
|
+
private readonly principalsCache?;
|
|
308
|
+
constructor(pool: Pool, role?: string | undefined,
|
|
309
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
310
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
144
311
|
read(auth: AuthContext, jobId: string): Promise<Job | undefined>;
|
|
145
312
|
}
|
|
313
|
+
/**
|
|
314
|
+
* Where the effective-principals cache is consulted, and the only place.
|
|
315
|
+
*
|
|
316
|
+
* `NACRE_ACL_CACHE_TTL` was validated at startup and read by nothing: the cache
|
|
317
|
+
* in `packages/core/authz/cache.ts` was written, tested and never called, so
|
|
318
|
+
* every request recomputed the transitive group closure. `docs/authz.md` went
|
|
319
|
+
* further and described the cache as the reason T11 is satisfied *more strongly*
|
|
320
|
+
* than specified — a claim about a code path that did not run.
|
|
321
|
+
*
|
|
322
|
+
* The safety of caching a permission input at all rests on one property, and it
|
|
323
|
+
* is structural rather than temporal: **the key carries
|
|
324
|
+
* `organizations.groups_version`**, which database triggers bump on every change
|
|
325
|
+
* to `groups`, `group_members` and `grants`. A revoked grant is not served
|
|
326
|
+
* stale, it is not served at all — the next request composes a different key.
|
|
327
|
+
* Checked against a running database rather than read: create a group, add a
|
|
328
|
+
* member, remove one, grant, revoke, delete the group; the version moved for
|
|
329
|
+
* every one.
|
|
330
|
+
*
|
|
331
|
+
* So the TTL is a memory bound. It is not what makes revocation take effect,
|
|
332
|
+
* and lowering it does not make anything safer.
|
|
333
|
+
*
|
|
334
|
+
* Absent cache means compute it. That is the pre-existing behaviour and it is
|
|
335
|
+
* the slow direction, never the permissive one — which is also why
|
|
336
|
+
* `cachedEffectivePrincipals` may swallow a Redis failure without touching
|
|
337
|
+
* invariant I3: the fallback computes the same answer from the same rows.
|
|
338
|
+
*/
|
|
339
|
+
export interface PrincipalsCache {
|
|
340
|
+
readonly store: CacheStore;
|
|
341
|
+
readonly ttlSeconds: number;
|
|
342
|
+
}
|
|
146
343
|
export declare class PostgresLayers implements Layers {
|
|
147
344
|
private readonly pool;
|
|
345
|
+
/**
|
|
346
|
+
* Only to ask which named vectors the organization's collection has.
|
|
347
|
+
*
|
|
348
|
+
* A layer is created against a provider, and the provider decides which
|
|
349
|
+
* named vector the layer's points go into. Qdrant fixes that set when the
|
|
350
|
+
* collection is created and has no way to extend it, so a layer on a
|
|
351
|
+
* provider the collection has no slot for is a layer whose every document
|
|
352
|
+
* fails in the worker with `Not existing vector name` — after the API has
|
|
353
|
+
* answered 202 and the row says `pending`. Checking here is what turns that
|
|
354
|
+
* into a collection rebuild instead.
|
|
355
|
+
*/
|
|
356
|
+
private readonly vectors;
|
|
148
357
|
private readonly role?;
|
|
149
|
-
|
|
358
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
359
|
+
private readonly principalsCache?;
|
|
360
|
+
constructor(pool: Pool,
|
|
361
|
+
/**
|
|
362
|
+
* Only to ask which named vectors the organization's collection has.
|
|
363
|
+
*
|
|
364
|
+
* A layer is created against a provider, and the provider decides which
|
|
365
|
+
* named vector the layer's points go into. Qdrant fixes that set when the
|
|
366
|
+
* collection is created and has no way to extend it, so a layer on a
|
|
367
|
+
* provider the collection has no slot for is a layer whose every document
|
|
368
|
+
* fails in the worker with `Not existing vector name` — after the API has
|
|
369
|
+
* answered 202 and the row says `pending`. Checking here is what turns that
|
|
370
|
+
* into a collection rebuild instead.
|
|
371
|
+
*/
|
|
372
|
+
vectors: {
|
|
373
|
+
vectorsOf(collection: string): Promise<Record<string, number>>;
|
|
374
|
+
}, role?: string | undefined,
|
|
375
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
376
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
150
377
|
private get scope();
|
|
151
378
|
/**
|
|
152
379
|
* The layers this caller may read.
|
|
@@ -156,17 +383,83 @@ export declare class PostgresLayers implements Layers {
|
|
|
156
383
|
* break invariant I2 — but writing it the other way keeps one habit for both
|
|
157
384
|
* and removes the question of which endpoints are allowed to be sloppy.
|
|
158
385
|
*/
|
|
159
|
-
list(auth: AuthContext): Promise<
|
|
386
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<Layer>>;
|
|
387
|
+
update(auth: AuthContext, layerId: string, input: {
|
|
388
|
+
name?: string;
|
|
389
|
+
description?: string;
|
|
390
|
+
}): Promise<boolean>;
|
|
160
391
|
create(auth: AuthContext, input: {
|
|
161
392
|
workspaceId: string;
|
|
162
393
|
slug: string;
|
|
163
394
|
name: string;
|
|
395
|
+
providerId?: string;
|
|
164
396
|
}): Promise<LayerOutcome>;
|
|
165
397
|
}
|
|
398
|
+
/**
|
|
399
|
+
* Workspaces.
|
|
400
|
+
*
|
|
401
|
+
* The missing link in the API's own flow: creating a layer takes a
|
|
402
|
+
* `workspace_id`, and until this existed the only way to have one was the line
|
|
403
|
+
* `init` printed. `docs/quickstart.md` said as much — "the workspace id is the
|
|
404
|
+
* one `init` printed" — so a second administrator, a client library, or anyone
|
|
405
|
+
* who closed that terminal had no way forward that did not involve reading the
|
|
406
|
+
* database directly.
|
|
407
|
+
*/
|
|
408
|
+
export declare class PostgresWorkspaces implements Workspaces {
|
|
409
|
+
private readonly pool;
|
|
410
|
+
private readonly role?;
|
|
411
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
412
|
+
private readonly principalsCache?;
|
|
413
|
+
constructor(pool: Pool, role?: string | undefined,
|
|
414
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
415
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
416
|
+
private get scope();
|
|
417
|
+
/**
|
|
418
|
+
* The workspaces this caller can reach, newest last, cursor-paged.
|
|
419
|
+
*
|
|
420
|
+
* Two ways to reach one, and the second is the reason this endpoint had to
|
|
421
|
+
* exist at all:
|
|
422
|
+
*
|
|
423
|
+
* 1. it holds a layer the read plan reaches — the ordinary case, and the same
|
|
424
|
+
* narrowing the layer listing does;
|
|
425
|
+
* 2. the caller holds a grant on the workspace itself. An **empty** workspace
|
|
426
|
+
* has no layers to be reached through, so without this an administrator
|
|
427
|
+
* who had just been granted one could not see it, and therefore could not
|
|
428
|
+
* create the first layer in it. That is the exact deadlock this endpoint
|
|
429
|
+
* is here to break.
|
|
430
|
+
*
|
|
431
|
+
* Filtered in memory rather than in SQL because the second rule is the
|
|
432
|
+
* resolver's to answer, not a join's, and an organization has tens of
|
|
433
|
+
* workspaces rather than thousands. The listing is narrowed before it is
|
|
434
|
+
* paged — a page assembled first and filtered second would leak the count.
|
|
435
|
+
*/
|
|
436
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<Workspace>>;
|
|
437
|
+
/**
|
|
438
|
+
* Create a workspace. `org_admin` only.
|
|
439
|
+
*
|
|
440
|
+
* There is no scope above a workspace to hold a grant on — `scope_type` is
|
|
441
|
+
* one of workspace, layer, document — so there is no one to ask except the
|
|
442
|
+
* role. `referenceAllows` would answer this with `role === 'org_admin'` and
|
|
443
|
+
* nothing else, so the check is written plainly rather than routed through a
|
|
444
|
+
* resolver call that can only return one thing.
|
|
445
|
+
*
|
|
446
|
+
* `platform_admin` is refused along with everyone else. Rule 2: it
|
|
447
|
+
* administers organizations and reads no documents, and a workspace is where
|
|
448
|
+
* documents live.
|
|
449
|
+
*/
|
|
450
|
+
create(auth: AuthContext, input: {
|
|
451
|
+
slug: string;
|
|
452
|
+
name: string;
|
|
453
|
+
}): Promise<WorkspaceOutcome>;
|
|
454
|
+
}
|
|
166
455
|
export declare class PostgresGrants implements Grants {
|
|
167
456
|
private readonly pool;
|
|
168
457
|
private readonly role?;
|
|
169
|
-
|
|
458
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
459
|
+
private readonly principalsCache?;
|
|
460
|
+
constructor(pool: Pool, role?: string | undefined,
|
|
461
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
462
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
170
463
|
private get scope();
|
|
171
464
|
/**
|
|
172
465
|
* Every grant in the organization, for a caller who may administer it.
|
|
@@ -176,7 +469,20 @@ export declare class PostgresGrants implements Grants {
|
|
|
176
469
|
* than none — an administrator who cannot see an existing grant revokes the
|
|
177
470
|
* wrong thing.
|
|
178
471
|
*/
|
|
179
|
-
|
|
472
|
+
/**
|
|
473
|
+
* Paginated, and the page may be short.
|
|
474
|
+
*
|
|
475
|
+
* Which grants a caller may see is decided by `referenceAllows` against the
|
|
476
|
+
* scope tree, which SQL cannot express — so rows are fetched by cursor and
|
|
477
|
+
* filtered afterwards. That makes `items.length < limit` normal rather than a
|
|
478
|
+
* signal, and `next_cursor` the only thing that says whether more exist.
|
|
479
|
+
*
|
|
480
|
+
* The cursor comes from the last row **fetched**, not the last returned.
|
|
481
|
+
* Deriving it from the last returned row would skip everything the filter
|
|
482
|
+
* removed after it, which is a page of grants silently missing from an
|
|
483
|
+
* administrator's view of who can reach what.
|
|
484
|
+
*/
|
|
485
|
+
list(auth: AuthContext, page?: Page): Promise<PageResult<GrantRecord>>;
|
|
180
486
|
issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
|
|
181
487
|
/**
|
|
182
488
|
* Withdraw a grant.
|
|
@@ -194,4 +500,102 @@ export declare class PostgresGrants implements Grants {
|
|
|
194
500
|
*/
|
|
195
501
|
revoke(auth: AuthContext, grantId: string): Promise<boolean>;
|
|
196
502
|
}
|
|
503
|
+
/**
|
|
504
|
+
* Reading the access log back.
|
|
505
|
+
*
|
|
506
|
+
* Scoped through `withOrg` like every other tenant read, so the row-level
|
|
507
|
+
* policy on `audit_events` is the second line of defence behind the role check
|
|
508
|
+
* in the handler. `SELECT` is the only grant the application role has on this
|
|
509
|
+
* table and that stays true — nothing here writes.
|
|
510
|
+
*
|
|
511
|
+
* ## Newest first, and what that does to the cursor
|
|
512
|
+
*
|
|
513
|
+
* Every other paged collection here reads oldest-first, because a catalog is a
|
|
514
|
+
* set and the order is arbitrary. A log is not: the useful end is the recent
|
|
515
|
+
* one, and an auditor paging forward from the beginning of a 400-day retention
|
|
516
|
+
* window to find yesterday is not a feature. So this orders
|
|
517
|
+
* `(occurred_at, id) DESC` and the seek predicate is `<` rather than `>`.
|
|
518
|
+
*
|
|
519
|
+
* The cursor still means "everything after the last row you saw", which is the
|
|
520
|
+
* same contract read in the other direction. It is worth being explicit because
|
|
521
|
+
* copying the seek clause from the layers adapter — where it is `>` — would
|
|
522
|
+
* produce a first page that works and a second page that silently returns the
|
|
523
|
+
* beginning of the log.
|
|
524
|
+
*/
|
|
525
|
+
export declare class PostgresAuditReader implements AuditReader {
|
|
526
|
+
private readonly pool;
|
|
527
|
+
private readonly role?;
|
|
528
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
529
|
+
private readonly principalsCache?;
|
|
530
|
+
constructor(pool: Pool, role?: string | undefined,
|
|
531
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
532
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
533
|
+
/**
|
|
534
|
+
* Actions that record a substantive access to a document's contents.
|
|
535
|
+
*
|
|
536
|
+
* Withheld from `platform_admin`, per rule 2 in docs/authz.md as
|
|
537
|
+
* docs/audit.md applies it to the journal. Named as a deny-list rather than
|
|
538
|
+
* an allow-list of administrative actions, and that is the uncomfortable
|
|
539
|
+
* direction: a new action defaults to *visible* to a platform administrator
|
|
540
|
+
* rather than hidden.
|
|
541
|
+
*
|
|
542
|
+
* Chosen anyway, because the alternative fails worse. An allow-list means a
|
|
543
|
+
* new administrative action is invisible to the operator who administers the
|
|
544
|
+
* installation until someone remembers to add it — a silent gap in an
|
|
545
|
+
* operational tool. This way a new *access* action is visible until someone
|
|
546
|
+
* adds it here, which is a disclosure to an already highly-privileged role
|
|
547
|
+
* within one installation. Both are bugs; only one of them is quiet.
|
|
548
|
+
*
|
|
549
|
+
* The `audit-event` skill's checklist is where this list is kept in step.
|
|
550
|
+
*/
|
|
551
|
+
private static readonly DOCUMENT_ACCESS;
|
|
552
|
+
read(auth: AuthContext, query: AuditQuery, page: Page): Promise<PageResult<AuditRecord>>;
|
|
553
|
+
private scopeFor;
|
|
554
|
+
}
|
|
555
|
+
/**
|
|
556
|
+
* Starting a reindex, and reporting on one.
|
|
557
|
+
*
|
|
558
|
+
* The work is the worker's. This writes the intent — `layers.reindex_state` —
|
|
559
|
+
* counts what there is to do, and declares the new named vector on the
|
|
560
|
+
* collection.
|
|
561
|
+
*
|
|
562
|
+
* That last part belongs here and an earlier version of this comment said the
|
|
563
|
+
* opposite: that Qdrant creates a named vector when a point is first written
|
|
564
|
+
* with it, so the worker's first batch would bring it into existence. It does
|
|
565
|
+
* not. `updateVectors` against an undeclared name answers
|
|
566
|
+
* `Not existing vector name error`, and the reindex that assumed otherwise
|
|
567
|
+
* started cleanly, reported `running`, and failed every document forever with
|
|
568
|
+
* the progress gauge sitting at zero — which is step 1 of the sequence in
|
|
569
|
+
* docs/architecture.md being skipped, and the document has it first for a
|
|
570
|
+
* reason.
|
|
571
|
+
*
|
|
572
|
+
* Doing it here rather than in the worker also puts the failure where somebody
|
|
573
|
+
* is looking: an operator who cannot create the vector finds out from the
|
|
574
|
+
* response to their own request, not by watching a counter not move.
|
|
575
|
+
*/
|
|
576
|
+
export declare class PostgresReindex implements Reindex {
|
|
577
|
+
private readonly pool;
|
|
578
|
+
private readonly vectors;
|
|
579
|
+
private readonly role?;
|
|
580
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
581
|
+
private readonly principalsCache?;
|
|
582
|
+
constructor(pool: Pool, vectors: {
|
|
583
|
+
vectorsOf(collection: string): Promise<Record<string, number>>;
|
|
584
|
+
}, role?: string | undefined,
|
|
585
|
+
/** See `principalsFor`. Absent means recompute the closure every time. */
|
|
586
|
+
principalsCache?: PrincipalsCache | undefined);
|
|
587
|
+
private get scope();
|
|
588
|
+
start(auth: AuthContext, layerId: string, providerId: string): Promise<ReindexOutcome | undefined>;
|
|
589
|
+
status(auth: AuthContext, layerId: string): Promise<ReindexStatus | undefined>;
|
|
590
|
+
/**
|
|
591
|
+
* Live documents in the layer that do not yet carry this vector.
|
|
592
|
+
*
|
|
593
|
+
* The same predicate the worker's claim uses and the same one the switch is
|
|
594
|
+
* guarded by. Three places, one meaning — and if they ever disagree, the
|
|
595
|
+
* switch is the one that is right, because it is the only one inside the
|
|
596
|
+
* statement that performs it.
|
|
597
|
+
*/
|
|
598
|
+
private remaining;
|
|
599
|
+
private statusOf;
|
|
600
|
+
}
|
|
197
601
|
//# sourceMappingURL=adapters.d.ts.map
|
package/dist/adapters.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,
|
|
1
|
+
{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAaX,WAAW,EAGX,KAAK,UAAU,EAEf,KAAK,QAAQ,EAId,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAG1C,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IAE/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAnBR,IAAI,EAAE,IAAI;IAC3B;;;;;;OAMG;IACc,OAAO,EAAE,sBAAsB,EAC/B,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAClD;;;;;;OAMG;IACc,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,YAAA;IAGzD;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4EpF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC;CAgDpB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,CAAA;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACnD;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AASD,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAyLhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,aAAa;IA6DrB;;;;;;;;;;;;;OAaG;YACW,QAAQ;IAwBtB;;;;;;;;;;;;;;;OAeG;YACW,MAAM;IAoBpB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAJT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IACnC,yDAAyD;IACxC,SAAS,SAAS;IAGrC;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ;IAgBpE,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAsC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjE;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA4BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAuFpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAwEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAG9C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AA2DD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAfhB,IAAI,EAAE,IAAI;IAC3B;;;;;;;;;;OAUG;IACc,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAgEhE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC;CA6JzB;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IAEjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA+D1E;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;CAyC7B;AA8DD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAkEtE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE;AAGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA4D;IAE7F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAuE9F,OAAO,CAAC,QAAQ;CAGjB;AAiBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,YAAW,OAAO;IAE3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAJhB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAEK,KAAK,CACT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAkJhC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAsCpF;;;;;;;OAOG;YACW,SAAS;IAevB,OAAO,CAAC,QAAQ;CAwBjB"}
|