@nacre.work/api 0.0.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/LICENSE +202 -0
  2. package/NOTICE +9 -0
  3. package/dist/adapters.d.ts +421 -17
  4. package/dist/adapters.d.ts.map +1 -1
  5. package/dist/adapters.js +1092 -72
  6. package/dist/adapters.js.map +1 -1
  7. package/dist/audit-export.d.ts +45 -0
  8. package/dist/audit-export.d.ts.map +1 -0
  9. package/dist/audit-export.js +155 -0
  10. package/dist/audit-export.js.map +1 -0
  11. package/dist/auth.d.ts +17 -0
  12. package/dist/auth.d.ts.map +1 -1
  13. package/dist/auth.js +17 -7
  14. package/dist/auth.js.map +1 -1
  15. package/dist/idempotency.d.ts +62 -0
  16. package/dist/idempotency.d.ts.map +1 -0
  17. package/dist/idempotency.js +147 -0
  18. package/dist/idempotency.js.map +1 -0
  19. package/dist/index.d.ts +12 -3
  20. package/dist/index.d.ts.map +1 -1
  21. package/dist/index.js +10 -1
  22. package/dist/index.js.map +1 -1
  23. package/dist/init.d.ts +9 -0
  24. package/dist/init.d.ts.map +1 -1
  25. package/dist/init.js +50 -5
  26. package/dist/init.js.map +1 -1
  27. package/dist/limits.d.ts +80 -0
  28. package/dist/limits.d.ts.map +1 -0
  29. package/dist/limits.js +63 -0
  30. package/dist/limits.js.map +1 -0
  31. package/dist/login.d.ts +94 -0
  32. package/dist/login.d.ts.map +1 -0
  33. package/dist/login.js +283 -0
  34. package/dist/login.js.map +1 -0
  35. package/dist/main.js +171 -60
  36. package/dist/main.js.map +1 -1
  37. package/dist/pagination.d.ts +72 -0
  38. package/dist/pagination.d.ts.map +1 -0
  39. package/dist/pagination.js +110 -0
  40. package/dist/pagination.js.map +1 -0
  41. package/dist/rerank.d.ts +99 -0
  42. package/dist/rerank.d.ts.map +1 -0
  43. package/dist/rerank.js +138 -0
  44. package/dist/rerank.js.map +1 -0
  45. package/dist/server.d.ts +361 -6
  46. package/dist/server.d.ts.map +1 -1
  47. package/dist/server.js +1050 -31
  48. package/dist/server.js.map +1 -1
  49. package/dist/service-keys.d.ts +13 -5
  50. package/dist/service-keys.d.ts.map +1 -1
  51. package/dist/service-keys.js +54 -31
  52. package/dist/service-keys.js.map +1 -1
  53. package/dist/source.d.ts +53 -0
  54. package/dist/source.d.ts.map +1 -0
  55. package/dist/source.js +109 -0
  56. package/dist/source.js.map +1 -0
  57. package/package.json +28 -10
  58. package/dist/__tests__/admin-surface.test.d.ts +0 -2
  59. package/dist/__tests__/admin-surface.test.d.ts.map +0 -1
  60. package/dist/__tests__/admin-surface.test.js +0 -431
  61. package/dist/__tests__/admin-surface.test.js.map +0 -1
  62. package/dist/__tests__/init.test.d.ts +0 -2
  63. package/dist/__tests__/init.test.d.ts.map +0 -1
  64. package/dist/__tests__/init.test.js +0 -125
  65. package/dist/__tests__/init.test.js.map +0 -1
  66. package/dist/__tests__/service-keys.test.d.ts +0 -2
  67. package/dist/__tests__/service-keys.test.d.ts.map +0 -1
  68. package/dist/__tests__/service-keys.test.js +0 -204
  69. package/dist/__tests__/service-keys.test.js.map +0 -1
@@ -1,6 +1,7 @@
1
- import { aclTags, buildFilter, VectorStore } from '@nacre.work/core';
1
+ import { aclTags, buildFilter, VectorStore, type CacheStore, type Metadata } from '@nacre.work/core';
2
2
  import type { Pool } from 'pg';
3
- import type { AuditEvent, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, SearchHit, SearchService } from './server.js';
3
+ import { type Reranker } from './rerank.js';
4
+ import type { Reindex, ReindexOutcome, ReindexStatus, AuditEvent, AuditQuery, AuditReader, AuditRecord, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, Page, PageResult, Workspace, WorkspaceOutcome, Workspaces, SearchHit, SearchOptions, SearchService } from './server.js';
4
5
  import type { AuthContext } from './auth.js';
5
6
  /**
6
7
  * The adapters that put the permission model on the request path.
@@ -15,8 +16,46 @@ export interface Embedder {
15
16
  }
16
17
  export declare class PostgresDocuments implements Documents {
17
18
  private readonly pool;
19
+ /**
20
+ * What writes metadata into the payload of a document's points.
21
+ *
22
+ * Narrow on purpose, like the delete path's tombstone port: this endpoint
23
+ * has no business searching, and a port that could would let a later change
24
+ * reach the index without a plan.
25
+ */
26
+ private readonly payload;
18
27
  private readonly role?;
19
- constructor(pool: Pool, role?: string | undefined);
28
+ /** See `principalsFor`. Absent means recompute the closure every time. */
29
+ private readonly principalsCache?;
30
+ /**
31
+ * Where a `source_url` comes from, when a deployment has object storage.
32
+ *
33
+ * Absent leaves the field off the response entirely, which is what every
34
+ * deployment without a bucket should see: a document whose bytes are in
35
+ * `documents.source_ref` has nothing to link to.
36
+ */
37
+ private readonly presign?;
38
+ constructor(pool: Pool,
39
+ /**
40
+ * What writes metadata into the payload of a document's points.
41
+ *
42
+ * Narrow on purpose, like the delete path's tombstone port: this endpoint
43
+ * has no business searching, and a port that could would let a later change
44
+ * reach the index without a plan.
45
+ */
46
+ payload: DocumentMetadataWriter, role?: string | undefined,
47
+ /** See `principalsFor`. Absent means recompute the closure every time. */
48
+ principalsCache?: PrincipalsCache | undefined,
49
+ /**
50
+ * Where a `source_url` comes from, when a deployment has object storage.
51
+ *
52
+ * Absent leaves the field off the response entirely, which is what every
53
+ * deployment without a bucket should see: a document whose bytes are in
54
+ * `documents.source_ref` has nothing to link to.
55
+ */
56
+ presign?: {
57
+ url(key: string): string;
58
+ } | undefined);
20
59
  /**
21
60
  * Undefined for absent, for another organization's, and for one this caller
22
61
  * has no grant reaching — one answer for all three.
@@ -28,20 +67,118 @@ export declare class PostgresDocuments implements Documents {
28
67
  * inside a tenant, and it is the one that was missing.
29
68
  */
30
69
  read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
70
+ /**
71
+ * Replace a document's metadata without re-embedding it.
72
+ *
73
+ * This is the cheap path `docs/api.md` said was not built. Ingest treats a
74
+ * metadata change as a change: the row and the vector payload would otherwise
75
+ * disagree and the document would carry a tag it does not answer to, so a
76
+ * re-tag cost a full re-parse, re-chunk and re-embed. Here the vectors are
77
+ * untouched and only the payload is rewritten — the same `setPayload` the ACL
78
+ * retag sweep uses, for the same reason.
79
+ *
80
+ * `write`, not `read`, and rule 6 means those are not the same set. The
81
+ * answer carries no body at all: a caller who may write to a document and not
82
+ * read it must not learn its title or its layer from a successful PATCH.
83
+ *
84
+ * Row first, then payload, both inside one transaction. A payload write that
85
+ * throws rolls the row back, so the two cannot end up disagreeing in the
86
+ * direction that matters — the row is what the worker rebuilds the payload
87
+ * from on the next index, so a row that ran ahead would be reverted while a
88
+ * payload that ran ahead would not.
89
+ */
90
+ updateMetadata(auth: AuthContext, documentId: string, metadata: Metadata): Promise<boolean>;
91
+ }
92
+ export interface DocumentMetadataWriter {
93
+ setMetadata(collection: string, documentId: string, metadata: Metadata): Promise<void>;
31
94
  }
32
95
  export interface SearchDeps {
33
96
  readonly pool: Pool;
97
+ /** See `principalsFor`. Absent means recompute the closure every time. */
98
+ readonly principalsCache?: PrincipalsCache;
34
99
  readonly vectors: VectorStore;
35
- readonly embedder: Embedder;
36
- /** Resolved per organization; the collection name is derived from it. */
37
- readonly orgSlug: (orgId: string) => Promise<string | undefined>;
38
- readonly vectorName: string;
100
+ /**
101
+ * The query embedder for a given provider.
102
+ *
103
+ * Per provider and not one for the whole process. `NACRE_EMBEDDING_MODEL`
104
+ * used to decide both the named vector a search looked in and the model the
105
+ * query was embedded with, for every layer in every organization — so a layer
106
+ * created against a second provider was silently unsearchable: its points
107
+ * carry `v_small_v2_768` and the query went to `v_bge_m3_1024`, which matches
108
+ * nothing and raises nothing. `embedding_providers` has had an `org_id`
109
+ * column and a documented "NULL = global default" since the first migration;
110
+ * the search path was the half that never honoured it.
111
+ */
112
+ readonly embedderFor: (provider: EmbeddingProvider) => Embedder;
39
113
  readonly role?: string;
114
+ /** Absent means reranking is off, which is what the `minimal` profile is. */
115
+ readonly reranker?: Reranker;
116
+ /** Candidates to rerank. docs/architecture.md says 50. */
117
+ readonly rerankCandidates?: number;
118
+ /**
119
+ * Reranking stopped working, with the search still answering in fusion order.
120
+ * An operator who turned reranking on is entitled to know it is not running.
121
+ */
122
+ readonly onRerankFailed?: (error: unknown) => void;
123
+ }
124
+ /** What a layer needs embedded with, and where. */
125
+ export interface EmbeddingProvider {
126
+ readonly id: string;
127
+ readonly endpoint: string;
128
+ readonly model: string;
129
+ readonly dimensions: number;
40
130
  }
41
131
  export declare class NacreSearchService implements SearchService {
42
132
  private readonly deps;
43
133
  constructor(deps: SearchDeps);
44
- search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
134
+ search(auth: AuthContext, query: string, topK: number, options?: SearchOptions): Promise<readonly SearchHit[]>;
135
+ /**
136
+ * The organization's layers, grouped by the model they are indexed with.
137
+ *
138
+ * Restricted first to what this search can actually reach — the permission
139
+ * plan, then the caller's own `layers` narrowing — so a query never embeds
140
+ * against a provider whose layers contribute nothing. That is not only a
141
+ * saving: an embedding endpoint that is down would otherwise fail a search
142
+ * over layers that have no connection to it.
143
+ *
144
+ * A plan carrying `extraDocs` keeps every group. Documents granted
145
+ * individually can sit in any layer, including one the caller reaches no
146
+ * other way, so dropping a group here would answer empty where the correct
147
+ * answer is "the documents you were granted".
148
+ */
149
+ private groupsInScope;
150
+ /**
151
+ * Layer slugs to ids, within one organization.
152
+ *
153
+ * Scoped through `withOrg` like every other tenant read, so a slug belonging
154
+ * to another organization resolves to nothing rather than to their layer. The
155
+ * result is intersected with what the caller may reach by the filter itself —
156
+ * the ids become a `must` and the permission constraint stays a `should`, so
157
+ * a layer this caller cannot read contributes no results even when it
158
+ * resolves here.
159
+ *
160
+ * Unknown slugs are dropped rather than reported. Answering "no such layer"
161
+ * would separate "does not exist" from "you cannot see it", which is exactly
162
+ * the distinction invariant I4 exists to prevent.
163
+ */
164
+ private layerIds;
165
+ /**
166
+ * Reorder by cross-encoder score, or answer in fusion order and say so.
167
+ *
168
+ * The text comes from the hydration that had to happen anyway. A reranker
169
+ * scores query against text, and the vector store holds no text — so the
170
+ * order here is search, hydrate the candidates, rerank, cut. Hydrating fifty
171
+ * rows rather than ten is one query with a wider `ANY($2)`, which is the cost
172
+ * of the quality this buys.
173
+ *
174
+ * Failure answers with what fusion produced rather than raising. Reranking
175
+ * decides ordering over candidates that were all permitted before it saw
176
+ * them, so a reranker being down is a quality degradation and not a
177
+ * permissions one — and making the product's central operation depend on an
178
+ * optional model server would be the worse trade. It is reported, never
179
+ * silent.
180
+ */
181
+ private rerank;
45
182
  /**
46
183
  * Turn hits into results a caller can read.
47
184
  *
@@ -92,7 +229,20 @@ export declare class HttpEmbedder implements Embedder {
92
229
  private readonly endpoint;
93
230
  private readonly model;
94
231
  private readonly dimensions;
95
- constructor(endpoint: string, model: string, dimensions: number);
232
+ /** One query, one vector, and a caller waiting on it. */
233
+ private readonly timeoutMs;
234
+ constructor(endpoint: string, model: string, dimensions: number,
235
+ /** One query, one vector, and a caller waiting on it. */
236
+ timeoutMs?: number);
237
+ /**
238
+ * One embedder per provider, built once and reused.
239
+ *
240
+ * Keyed on the provider's id, so an operator who edits an endpoint has to
241
+ * restart — which is true of every other piece of configuration here, and the
242
+ * alternative is a cache that has to be invalidated from a table nothing
243
+ * watches.
244
+ */
245
+ static pool(timeoutMs?: number): (provider: EmbeddingProvider) => Embedder;
96
246
  embed(texts: readonly string[]): Promise<readonly (readonly number[])[]>;
97
247
  }
98
248
  export { aclTags };
@@ -106,18 +256,31 @@ export { aclTags };
106
256
  */
107
257
  export interface IngestDeps {
108
258
  readonly pool: Pool;
259
+ /** See `principalsFor`. Absent means recompute the closure every time. */
260
+ readonly principalsCache?: PrincipalsCache;
109
261
  /**
110
262
  * What takes a document out of results. Narrower than `VectorStore` on
111
263
  * purpose: the delete path has no business searching, and a port that could
112
264
  * would let a later change reach the index without a plan.
113
265
  */
114
266
  readonly tombstone: DocumentTombstone;
115
- /** Resolved per organization; the collection name is derived from it. */
116
- readonly orgSlug: (orgId: string) => Promise<string | undefined>;
267
+ /**
268
+ * Where document bytes go, when a deployment has object storage.
269
+ *
270
+ * Absent is the supported default and not a degraded mode: bytes then live in
271
+ * `documents.source_ref`, which is what every deployment did before this. The
272
+ * difference is what a Postgres dump weighs — with this set it holds
273
+ * references, without it, every document in full.
274
+ */
275
+ readonly objects?: ObjectStore;
117
276
  readonly role?: string;
118
277
  }
278
+ export interface ObjectStore {
279
+ put(key: string, body: Uint8Array, contentType?: string): Promise<void>;
280
+ remove(key: string): Promise<void>;
281
+ }
119
282
  export interface DocumentTombstone {
120
- tombstone(orgSlug: string, documentId: string): Promise<void>;
283
+ tombstone(collection: string, documentId: string): Promise<void>;
121
284
  }
122
285
  export declare class NacreIngest implements Ingest {
123
286
  private readonly deps;
@@ -140,13 +303,77 @@ export declare class NacreIngest implements Ingest {
140
303
  export declare class PostgresJobs implements Jobs {
141
304
  private readonly pool;
142
305
  private readonly role?;
143
- constructor(pool: Pool, role?: string | undefined);
306
+ /** See `principalsFor`. Absent means recompute the closure every time. */
307
+ private readonly principalsCache?;
308
+ constructor(pool: Pool, role?: string | undefined,
309
+ /** See `principalsFor`. Absent means recompute the closure every time. */
310
+ principalsCache?: PrincipalsCache | undefined);
144
311
  read(auth: AuthContext, jobId: string): Promise<Job | undefined>;
145
312
  }
313
+ /**
314
+ * Where the effective-principals cache is consulted, and the only place.
315
+ *
316
+ * `NACRE_ACL_CACHE_TTL` was validated at startup and read by nothing: the cache
317
+ * in `packages/core/authz/cache.ts` was written, tested and never called, so
318
+ * every request recomputed the transitive group closure. `docs/authz.md` went
319
+ * further and described the cache as the reason T11 is satisfied *more strongly*
320
+ * than specified — a claim about a code path that did not run.
321
+ *
322
+ * The safety of caching a permission input at all rests on one property, and it
323
+ * is structural rather than temporal: **the key carries
324
+ * `organizations.groups_version`**, which database triggers bump on every change
325
+ * to `groups`, `group_members` and `grants`. A revoked grant is not served
326
+ * stale, it is not served at all — the next request composes a different key.
327
+ * Checked against a running database rather than read: create a group, add a
328
+ * member, remove one, grant, revoke, delete the group; the version moved for
329
+ * every one.
330
+ *
331
+ * So the TTL is a memory bound. It is not what makes revocation take effect,
332
+ * and lowering it does not make anything safer.
333
+ *
334
+ * Absent cache means compute it. That is the pre-existing behaviour and it is
335
+ * the slow direction, never the permissive one — which is also why
336
+ * `cachedEffectivePrincipals` may swallow a Redis failure without touching
337
+ * invariant I3: the fallback computes the same answer from the same rows.
338
+ */
339
+ export interface PrincipalsCache {
340
+ readonly store: CacheStore;
341
+ readonly ttlSeconds: number;
342
+ }
146
343
  export declare class PostgresLayers implements Layers {
147
344
  private readonly pool;
345
+ /**
346
+ * Only to ask which named vectors the organization's collection has.
347
+ *
348
+ * A layer is created against a provider, and the provider decides which
349
+ * named vector the layer's points go into. Qdrant fixes that set when the
350
+ * collection is created and has no way to extend it, so a layer on a
351
+ * provider the collection has no slot for is a layer whose every document
352
+ * fails in the worker with `Not existing vector name` — after the API has
353
+ * answered 202 and the row says `pending`. Checking here is what turns that
354
+ * into a collection rebuild instead.
355
+ */
356
+ private readonly vectors;
148
357
  private readonly role?;
149
- constructor(pool: Pool, role?: string | undefined);
358
+ /** See `principalsFor`. Absent means recompute the closure every time. */
359
+ private readonly principalsCache?;
360
+ constructor(pool: Pool,
361
+ /**
362
+ * Only to ask which named vectors the organization's collection has.
363
+ *
364
+ * A layer is created against a provider, and the provider decides which
365
+ * named vector the layer's points go into. Qdrant fixes that set when the
366
+ * collection is created and has no way to extend it, so a layer on a
367
+ * provider the collection has no slot for is a layer whose every document
368
+ * fails in the worker with `Not existing vector name` — after the API has
369
+ * answered 202 and the row says `pending`. Checking here is what turns that
370
+ * into a collection rebuild instead.
371
+ */
372
+ vectors: {
373
+ vectorsOf(collection: string): Promise<Record<string, number>>;
374
+ }, role?: string | undefined,
375
+ /** See `principalsFor`. Absent means recompute the closure every time. */
376
+ principalsCache?: PrincipalsCache | undefined);
150
377
  private get scope();
151
378
  /**
152
379
  * The layers this caller may read.
@@ -156,17 +383,83 @@ export declare class PostgresLayers implements Layers {
156
383
  * break invariant I2 — but writing it the other way keeps one habit for both
157
384
  * and removes the question of which endpoints are allowed to be sloppy.
158
385
  */
159
- list(auth: AuthContext): Promise<readonly Layer[]>;
386
+ list(auth: AuthContext, page?: Page): Promise<PageResult<Layer>>;
387
+ update(auth: AuthContext, layerId: string, input: {
388
+ name?: string;
389
+ description?: string;
390
+ }): Promise<boolean>;
160
391
  create(auth: AuthContext, input: {
161
392
  workspaceId: string;
162
393
  slug: string;
163
394
  name: string;
395
+ providerId?: string;
164
396
  }): Promise<LayerOutcome>;
165
397
  }
398
+ /**
399
+ * Workspaces.
400
+ *
401
+ * The missing link in the API's own flow: creating a layer takes a
402
+ * `workspace_id`, and until this existed the only way to have one was the line
403
+ * `init` printed. `docs/quickstart.md` said as much — "the workspace id is the
404
+ * one `init` printed" — so a second administrator, a client library, or anyone
405
+ * who closed that terminal had no way forward that did not involve reading the
406
+ * database directly.
407
+ */
408
+ export declare class PostgresWorkspaces implements Workspaces {
409
+ private readonly pool;
410
+ private readonly role?;
411
+ /** See `principalsFor`. Absent means recompute the closure every time. */
412
+ private readonly principalsCache?;
413
+ constructor(pool: Pool, role?: string | undefined,
414
+ /** See `principalsFor`. Absent means recompute the closure every time. */
415
+ principalsCache?: PrincipalsCache | undefined);
416
+ private get scope();
417
+ /**
418
+ * The workspaces this caller can reach, newest last, cursor-paged.
419
+ *
420
+ * Two ways to reach one, and the second is the reason this endpoint had to
421
+ * exist at all:
422
+ *
423
+ * 1. it holds a layer the read plan reaches — the ordinary case, and the same
424
+ * narrowing the layer listing does;
425
+ * 2. the caller holds a grant on the workspace itself. An **empty** workspace
426
+ * has no layers to be reached through, so without this an administrator
427
+ * who had just been granted one could not see it, and therefore could not
428
+ * create the first layer in it. That is the exact deadlock this endpoint
429
+ * is here to break.
430
+ *
431
+ * Filtered in memory rather than in SQL because the second rule is the
432
+ * resolver's to answer, not a join's, and an organization has tens of
433
+ * workspaces rather than thousands. The listing is narrowed before it is
434
+ * paged — a page assembled first and filtered second would leak the count.
435
+ */
436
+ list(auth: AuthContext, page?: Page): Promise<PageResult<Workspace>>;
437
+ /**
438
+ * Create a workspace. `org_admin` only.
439
+ *
440
+ * There is no scope above a workspace to hold a grant on — `scope_type` is
441
+ * one of workspace, layer, document — so there is no one to ask except the
442
+ * role. `referenceAllows` would answer this with `role === 'org_admin'` and
443
+ * nothing else, so the check is written plainly rather than routed through a
444
+ * resolver call that can only return one thing.
445
+ *
446
+ * `platform_admin` is refused along with everyone else. Rule 2: it
447
+ * administers organizations and reads no documents, and a workspace is where
448
+ * documents live.
449
+ */
450
+ create(auth: AuthContext, input: {
451
+ slug: string;
452
+ name: string;
453
+ }): Promise<WorkspaceOutcome>;
454
+ }
166
455
  export declare class PostgresGrants implements Grants {
167
456
  private readonly pool;
168
457
  private readonly role?;
169
- constructor(pool: Pool, role?: string | undefined);
458
+ /** See `principalsFor`. Absent means recompute the closure every time. */
459
+ private readonly principalsCache?;
460
+ constructor(pool: Pool, role?: string | undefined,
461
+ /** See `principalsFor`. Absent means recompute the closure every time. */
462
+ principalsCache?: PrincipalsCache | undefined);
170
463
  private get scope();
171
464
  /**
172
465
  * Every grant in the organization, for a caller who may administer it.
@@ -176,7 +469,20 @@ export declare class PostgresGrants implements Grants {
176
469
  * than none — an administrator who cannot see an existing grant revokes the
177
470
  * wrong thing.
178
471
  */
179
- list(auth: AuthContext): Promise<readonly GrantRecord[]>;
472
+ /**
473
+ * Paginated, and the page may be short.
474
+ *
475
+ * Which grants a caller may see is decided by `referenceAllows` against the
476
+ * scope tree, which SQL cannot express — so rows are fetched by cursor and
477
+ * filtered afterwards. That makes `items.length < limit` normal rather than a
478
+ * signal, and `next_cursor` the only thing that says whether more exist.
479
+ *
480
+ * The cursor comes from the last row **fetched**, not the last returned.
481
+ * Deriving it from the last returned row would skip everything the filter
482
+ * removed after it, which is a page of grants silently missing from an
483
+ * administrator's view of who can reach what.
484
+ */
485
+ list(auth: AuthContext, page?: Page): Promise<PageResult<GrantRecord>>;
180
486
  issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
181
487
  /**
182
488
  * Withdraw a grant.
@@ -194,4 +500,102 @@ export declare class PostgresGrants implements Grants {
194
500
  */
195
501
  revoke(auth: AuthContext, grantId: string): Promise<boolean>;
196
502
  }
503
+ /**
504
+ * Reading the access log back.
505
+ *
506
+ * Scoped through `withOrg` like every other tenant read, so the row-level
507
+ * policy on `audit_events` is the second line of defence behind the role check
508
+ * in the handler. `SELECT` is the only grant the application role has on this
509
+ * table and that stays true — nothing here writes.
510
+ *
511
+ * ## Newest first, and what that does to the cursor
512
+ *
513
+ * Every other paged collection here reads oldest-first, because a catalog is a
514
+ * set and the order is arbitrary. A log is not: the useful end is the recent
515
+ * one, and an auditor paging forward from the beginning of a 400-day retention
516
+ * window to find yesterday is not a feature. So this orders
517
+ * `(occurred_at, id) DESC` and the seek predicate is `<` rather than `>`.
518
+ *
519
+ * The cursor still means "everything after the last row you saw", which is the
520
+ * same contract read in the other direction. It is worth being explicit because
521
+ * copying the seek clause from the layers adapter — where it is `>` — would
522
+ * produce a first page that works and a second page that silently returns the
523
+ * beginning of the log.
524
+ */
525
+ export declare class PostgresAuditReader implements AuditReader {
526
+ private readonly pool;
527
+ private readonly role?;
528
+ /** See `principalsFor`. Absent means recompute the closure every time. */
529
+ private readonly principalsCache?;
530
+ constructor(pool: Pool, role?: string | undefined,
531
+ /** See `principalsFor`. Absent means recompute the closure every time. */
532
+ principalsCache?: PrincipalsCache | undefined);
533
+ /**
534
+ * Actions that record a substantive access to a document's contents.
535
+ *
536
+ * Withheld from `platform_admin`, per rule 2 in docs/authz.md as
537
+ * docs/audit.md applies it to the journal. Named as a deny-list rather than
538
+ * an allow-list of administrative actions, and that is the uncomfortable
539
+ * direction: a new action defaults to *visible* to a platform administrator
540
+ * rather than hidden.
541
+ *
542
+ * Chosen anyway, because the alternative fails worse. An allow-list means a
543
+ * new administrative action is invisible to the operator who administers the
544
+ * installation until someone remembers to add it — a silent gap in an
545
+ * operational tool. This way a new *access* action is visible until someone
546
+ * adds it here, which is a disclosure to an already highly-privileged role
547
+ * within one installation. Both are bugs; only one of them is quiet.
548
+ *
549
+ * The `audit-event` skill's checklist is where this list is kept in step.
550
+ */
551
+ private static readonly DOCUMENT_ACCESS;
552
+ read(auth: AuthContext, query: AuditQuery, page: Page): Promise<PageResult<AuditRecord>>;
553
+ private scopeFor;
554
+ }
555
+ /**
556
+ * Starting a reindex, and reporting on one.
557
+ *
558
+ * The work is the worker's. This writes the intent — `layers.reindex_state` —
559
+ * counts what there is to do, and declares the new named vector on the
560
+ * collection.
561
+ *
562
+ * That last part belongs here and an earlier version of this comment said the
563
+ * opposite: that Qdrant creates a named vector when a point is first written
564
+ * with it, so the worker's first batch would bring it into existence. It does
565
+ * not. `updateVectors` against an undeclared name answers
566
+ * `Not existing vector name error`, and the reindex that assumed otherwise
567
+ * started cleanly, reported `running`, and failed every document forever with
568
+ * the progress gauge sitting at zero — which is step 1 of the sequence in
569
+ * docs/architecture.md being skipped, and the document has it first for a
570
+ * reason.
571
+ *
572
+ * Doing it here rather than in the worker also puts the failure where somebody
573
+ * is looking: an operator who cannot create the vector finds out from the
574
+ * response to their own request, not by watching a counter not move.
575
+ */
576
+ export declare class PostgresReindex implements Reindex {
577
+ private readonly pool;
578
+ private readonly vectors;
579
+ private readonly role?;
580
+ /** See `principalsFor`. Absent means recompute the closure every time. */
581
+ private readonly principalsCache?;
582
+ constructor(pool: Pool, vectors: {
583
+ vectorsOf(collection: string): Promise<Record<string, number>>;
584
+ }, role?: string | undefined,
585
+ /** See `principalsFor`. Absent means recompute the closure every time. */
586
+ principalsCache?: PrincipalsCache | undefined);
587
+ private get scope();
588
+ start(auth: AuthContext, layerId: string, providerId: string): Promise<ReindexOutcome | undefined>;
589
+ status(auth: AuthContext, layerId: string): Promise<ReindexStatus | undefined>;
590
+ /**
591
+ * Live documents in the layer that do not yet carry this vector.
592
+ *
593
+ * The same predicate the worker's claim uses and the same one the switch is
594
+ * guarded by. Three places, one meaning — and if they ever disagree, the
595
+ * switch is the one that is right, because it is the only one inside the
596
+ * statement that performs it.
597
+ */
598
+ private remaining;
599
+ private statusOf;
600
+ }
197
601
  //# sourceMappingURL=adapters.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAOX,WAAW,EAIZ,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEvE;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAwDrF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAoD3F;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IAG/B,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAiC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA6BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAqDpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAoEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAiCD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC;IAkDlD,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC;CAmFzB;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;IA+CxD,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE"}
1
+ {"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAaX,WAAW,EAGX,KAAK,UAAU,EAEf,KAAK,QAAQ,EAId,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAG1C,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IAE/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAnBR,IAAI,EAAE,IAAI;IAC3B;;;;;;OAMG;IACc,OAAO,EAAE,sBAAsB,EAC/B,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAClD;;;;;;OAMG;IACc,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,YAAA;IAGzD;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA4EpF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAClB,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC;CAgDpB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ,CAAA;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACnD;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AASD,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAyLhC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,aAAa;IA6DrB;;;;;;;;;;;;;OAaG;YACW,QAAQ;IAwBtB;;;;;;;;;;;;;;;OAeG;YACW,MAAM;IAoBpB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAJT,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IACnC,yDAAyD;IACxC,SAAS,SAAS;IAGrC;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,QAAQ,EAAE,iBAAiB,KAAK,QAAQ;IAgBpE,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAsC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACjE;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA4BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAuFpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAwEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAG9C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AA2DD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAfhB,IAAI,EAAE,IAAI;IAC3B;;;;;;;;;;OAUG;IACc,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAgEhE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;IAIb,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC;CA6JzB;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IAEjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA+D1E;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;CAyC7B;AA8DD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;OAYG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAkEtE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE;AAGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAA4D;IAE7F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAuE9F,OAAO,CAAC,QAAQ;CAGjB;AAiBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,YAAW,OAAO;IAE3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAJhB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE;QAAE,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,EAC3E,IAAI,CAAC,EAAE,MAAM,YAAA;IAC9B,0EAA0E;IACzD,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAEK,KAAK,CACT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAkJhC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAsCpF;;;;;;;OAOG;YACW,SAAS;IAevB,OAAO,CAAC,QAAQ;CAwBjB"}