@nacre.work/api 0.0.0

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA+BxC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,+FAA+F,CAAA;QACxG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,+FAA+F,CAAA;IACxG,CAAC;IACD,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,4GAA4G,IAAI,EAAE,CAAA;IAC3H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAA;IAElF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;KAChD,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAiC,EAAE,EAAQ,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC,CAAA;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAAgB,EAChB,QAAiE,EACjE,UAAkB,EAClB,MAA8D,GAAG,EAAE,CAAC,SAAS;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;;;;;;eAQS,EACT,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CACzC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,EAAE;YACzE,MAAM,EAAE,GAAG,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAElF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC;;oBAEc,EACd,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CACxB,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC5E,GAAG,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAElE,2EAA2E;QAC3E,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5C;;;;;;;;;eASS,EACT,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAA;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACnC,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC9F,GAAG,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAEnF,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7C;;;;;;;;;;;eAWS,EACT,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC/C,CAAA;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACtF,GAAG,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;QAE9E,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4EAA4E;gBAC1E,4EAA4E;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,IAAI,EACJ,MAAM,EACN;YACE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;SAChC,EACD,UAAU,EACV,GAAG,CACJ,CAAA;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;QACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QAEhF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,WAAW;SAClB,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;aACtB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;aAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;aAC/B,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAEzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,YAAY,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,eAAe,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;QACjG,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,CAAC,WAAW,yCAAyC,CACrF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,mCAAmC;AACnC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,113 @@
+import { createHash } from 'node:crypto';
+import { collectDatabaseGauges, createMetrics, createPool, loadConfig, Registry, VectorStore, vectorName, withOrg, ConfigError, } from '@nacre.work/core';
+import { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, } from './adapters.js';
+import { PostgresServiceAccounts, PostgresServiceKeys } from './service-keys.js';
+import { createApi } from './server.js';
+/**
+ * The REST API process.
+ *
+ * Configuration is read and validated before anything is constructed, so a
+ * missing variable is a refusal to start rather than an error rate. Nothing
+ * below this line has a fallback.
+ */
+const APP_ROLE = 'nacre_app';
+function jwtKey(config) {
+    // Development uses a symmetric secret. Production is meant to load an Ed25519
+    // key through NACRE_JWT_PRIVATE_KEY_REF; until that lands, refusing is the
+    // honest behaviour — a hardcoded fallback here would be a signing key anyone
+    // reading the source can forge tokens with.
+    const secret = process.env.NACRE_JWT_SECRET;
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError([
+            'NACRE_JWT_SECRET is not set, or is shorter than 32 bytes. ' +
+                'Asymmetric keys through NACRE_JWT_PRIVATE_KEY_REF are not implemented yet; ' +
+                'until they are, this is required and there is no default.',
+        ]);
+    }
+    void config;
+    return new TextEncoder().encode(secret);
+}
+async function main() {
+    const config = loadConfig();
+    const key = jwtKey({});
+    const pool = createPool({ connectionString: config.pgUrl, max: config.pgPoolMax });
+    const vectors = new VectorStore(config.qdrantApiKey === undefined
+        ? { url: config.qdrantUrl }
+        : { url: config.qdrantUrl, apiKey: config.qdrantApiKey });
+    const embedder = new HttpEmbedder(config.embeddingEndpoint, config.embeddingModel, config.embeddingDim);
+    // Slugs change rarely and are read on every search. A tiny cache keyed on the
+    // organization keeps a search from costing an extra round trip; it is not
+    // permission data, so staleness here cannot widen access.
+    const slugs = new Map();
+    const orgSlug = async (orgId) => {
+        const cached = slugs.get(orgId);
+        if (cached !== undefined)
+            return cached;
+        const found = await withOrg(pool, orgId, async (client) => {
+            const { rows } = await client.query('SELECT slug FROM organizations WHERE id = $1 AND deleted_at IS NULL', [orgId]);
+            return rows[0]?.slug;
+        }, { role: APP_ROLE });
+        if (found !== undefined)
+            slugs.set(orgId, found);
+        return found;
+    };
+    const registry = new Registry();
+    const metrics = createMetrics(registry);
+    registry.collect(collectDatabaseGauges(pool, metrics, APP_ROLE));
+    const server = createApi({
+        verify: {
+            key,
+            issuer: config.jwtIssuer,
+            audience: config.jwtAudience,
+            serviceKeys: new PostgresServiceKeys(pool, APP_ROLE),
+        },
+        metrics: registry,
+        documents: new PostgresDocuments(pool, APP_ROLE),
+        search: new NacreSearchService({
+            pool,
+            vectors,
+            embedder,
+            orgSlug,
+            vectorName: vectorName(config.embeddingModel, config.embeddingDim),
+            role: APP_ROLE,
+        }),
+        ingest: new NacreIngest({ pool, tombstone: vectors, orgSlug, role: APP_ROLE }),
+        audit: new PostgresAudit(pool, APP_ROLE),
+        jobs: new PostgresJobs(pool, APP_ROLE),
+        layers: new PostgresLayers(pool, APP_ROLE),
+        grants: new PostgresGrants(pool, APP_ROLE),
+        serviceAccounts: new PostgresServiceAccounts(pool, APP_ROLE),
+    });
+    const port = Number(process.env.PORT ?? 8080);
+    server.listen(port, () => {
+        // The fingerprint, never the secret. An operator needs to know which key is
+        // in use when two environments disagree; nobody needs the key in a log.
+        const fingerprint = createHash('sha256').update(key).digest('hex').slice(0, 12);
+        console.log(JSON.stringify({
+            msg: 'api listening',
+            port,
+            env: config.env,
+            issuer: config.jwtIssuer,
+            jwt_key: `sha256:${fingerprint}`,
+        }));
+    });
+    const shutdown = (signal) => {
+        console.log(JSON.stringify({ msg: 'shutting down', signal }));
+        // Stop accepting, let in-flight requests finish, then release the pool.
+        // Dropping a request mid-flight would leave its audit event unwritten.
+        server.close(() => {
+            void pool.end().then(() => process.exit(0));
+        });
+    };
+    process.on('SIGTERM', () => shutdown('SIGTERM'));
+    process.on('SIGINT', () => shutdown('SIGINT'));
+}
+main().catch((error) => {
+    if (error instanceof ConfigError) {
+        console.error(error.message);
+        process.exit(2);
+    }
+    console.error(JSON.stringify({ msg: 'failed to start', error: String(error) }));
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,UAAU,EACV,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,SAAS,MAAM,CAAC,MAA8B;IAC5C,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4DAA4D;gBAC1D,6EAA6E;gBAC7E,2DAA2D;SAC9D,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,MAAM,CAAA;IACX,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IAEtB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;QAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;IACD,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IAEvG,8EAA8E;IAC9E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA+B,EAAE;QACnE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QAEvC,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,IAAI,EACJ,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,qEAAqE,EACrE,CAAC,KAAK,CAAC,CACR,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAA;QACtB,CAAC,EACD,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAA;QAED,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAChD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAEhE,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,MAAM,EAAE;YACN,GAAG;YACH,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC;SACrD;QACD,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,IAAI,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAChD,MAAM,EAAE,IAAI,kBAAkB,CAAC;YAC7B,IAAI;YACJ,OAAO;YACP,QAAQ;YACR,OAAO;YACP,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC;YAClE,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC9E,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC1C,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC1C,eAAe,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;KAC7D,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,eAAe;YACpB,IAAI;YACJ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,OAAO,EAAE,UAAU,WAAW,EAAE;SACjC,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QAC7D,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/server.d.ts

@@ -0,0 +1,239 @@
+import { type Server } from 'node:http';
+import { type AuthContext, type VerifyOptions } from './auth.js';
+/**
+ * What the API needs from the rest of the system, as ports.
+ *
+ * Injected rather than imported so the surface can be tested without a
+ * database or a vector store. The parts that must be tested here — the token is
+ * the only source of the organization, and invisible is indistinguishable from
+ * absent — are properties of this layer, and a test that has to stand up
+ * Postgres to check them is a test nobody runs.
+ */
+export interface Documents {
+    /**
+     * The document, or undefined.
+     *
+     * **Undefined must mean the same thing for every reason it can be
+     * undefined** — absent, another organization's, or one this caller has no
+     * grant reaching. If this ever grows a second answer, the 403/404
+     * distinction leaks through whatever the caller does with it.
+     *
+     * It takes the whole `AuthContext` and not an `orgId`, and that is the
+     * point: with an organization alone the implementation is structurally
+     * incapable of consulting the resolver, and the first version of this
+     * signature was exactly that. Search filtered correctly while
+     * `GET /v1/documents/{id}` returned the title of any document in the
+     * organization to anyone holding any token for it — including a caller whose
+     * grant had been revoked, and a service account with `write` and no `read`.
+     */
+    read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
+}
+/**
+ * A document, as a caller sees it.
+ *
+ * It was `{ id, title }`, which is not enough to do anything with: no layer, no
+ * status, no size. A client that got a `202` from ingest and then wanted to
+ * know whether the document had indexed had to go to `/v1/jobs/{id}` and knew
+ * to only because the two ids happen to be the same value.
+ *
+ * Nothing here is permission data — the caller has already been resolved
+ * against this document, so every field describes something they may see. The
+ * text is not included: chunks are what search returns, and a whole-document
+ * body on this endpoint would be a second, unpaginated way to read everything.
+ */
+export interface DocumentView {
+    readonly document_id: string;
+    readonly layer: string;
+    readonly title: string | null;
+    readonly status: string;
+    readonly chunk_count: number;
+    readonly updated_at: string;
+}
+/**
+ * One result, as the contract describes it.
+ *
+ * Not the vector store's hit. That carried the raw payload — `acl_tags`,
+ * `acl_version`, `org_id`, `layer_id` — straight to the client, and carried no
+ * text at all, so the product's central operation answered with identifiers and
+ * a score and nothing a caller could read. `docs/openapi.yaml` had said
+ * otherwise since before there was a server.
+ *
+ * The tags are the part worth naming: an acl tag is a hash over the grant set
+ * reaching a document, so publishing it lets a client group documents by which
+ * permissions they share. Not a cross-tenant leak, and still the shape of the
+ * organization's access structure handed to anyone who can search.
+ */
+export interface SearchHit {
+    readonly chunk_id: string;
+    readonly doc_id: string;
+    readonly layer: string;
+    readonly title: string | null;
+    readonly score: number;
+    readonly text: string;
+}
+export interface SearchService {
+    search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
+}
+export interface IngestRequest {
+    readonly layer: string;
+    readonly externalId: string;
+    readonly title?: string;
+    readonly content?: string;
+    readonly url?: string;
+}
+export interface IngestOutcome {
+    readonly documentId: string;
+    readonly jobId: string;
+    /** True when the idempotency key and content hash both matched. */
+    readonly unchanged: boolean;
+}
+export interface Ingest {
+    /**
+     * Queue a document, or refuse.
+     *
+     * `undefined` means the caller may not write to that layer — and it must mean
+     * the same for a layer that does not exist. Ingest is the cheapest oracle in
+     * the system otherwise: a caller with no read access could enumerate layer
+     * names by watching which ones accept a document.
+     */
+    queue(auth: AuthContext, request: IngestRequest): Promise<IngestOutcome | undefined>;
+    /** Tombstone. `false` for absent and for not-permitted alike. */
+    remove(auth: AuthContext, documentId: string): Promise<boolean>;
+}
+export interface Job {
+    readonly jobId: string;
+    readonly documentId: string;
+    readonly status: 'queued' | 'parsing' | 'embedding' | 'indexed' | 'failed';
+    readonly progress: number;
+    readonly error?: string;
+}
+export interface Jobs {
+    /**
+     * `undefined` for absent, for another organization's, and for one the caller
+     * has no grant reaching — a job names a document and carries its error
+     * string, so it is exactly as much of an oracle as the document is.
+     */
+    read(auth: AuthContext, jobId: string): Promise<Job | undefined>;
+}
+export interface Layer {
+    readonly id: string;
+    readonly slug: string;
+    readonly name: string;
+    readonly workspaceId: string;
+    readonly description: string;
+    /**
+     * Live documents in the layer.
+     *
+     * Not "documents this caller may read": layer-scoped grants are all this
+     * build has, so anyone who can see the layer reaches everything in it. When
+     * document-level grants exist this stops being true, and the number has to be
+     * computed per caller or removed — a count is a small disclosure and still a
+     * disclosure.
+     */
+    readonly documentCount: number;
+}
+/**
+ * Three outcomes, not two.
+ *
+ * `denied` covers "may not administer this workspace" and "no such workspace"
+ * together, which is the usual rule. `conflict` is deliberately separate: the
+ * caller has already proved admin on the target workspace by the time it can
+ * happen, so the answer is about the resource rather than about what they can
+ * see.
+ *
+ * Folding it into `denied` was the first shape and it makes the endpoint
+ * unusable — an administrator who picks a name already in use gets a 404 and
+ * cannot tell it from having no permission, so the next move is to guess. It
+ * discloses exactly one bit, that the slug is taken somewhere in their own
+ * organization, and slugs are organization-unique by design (migration 0006).
+ */
+export type LayerOutcome = {
+    readonly kind: 'created';
+    readonly layer: Layer;
+} | {
+    readonly kind: 'denied';
+} | {
+    readonly kind: 'conflict';
+};
+export interface Layers {
+    /** Only the layers this caller may read. The plan decides, not the caller. */
+    list(auth: AuthContext): Promise<readonly Layer[]>;
+    create(auth: AuthContext, input: {
+        workspaceId: string;
+        slug: string;
+        name: string;
+    }): Promise<LayerOutcome>;
+}
+export interface GrantInput {
+    readonly principalType: 'user' | 'group' | 'service_account';
+    readonly principalId: string;
+    readonly scopeType: 'workspace' | 'layer';
+    readonly scopeId: string;
+    readonly permission: 'read' | 'write' | 'admin';
+}
+export interface GrantRecord extends GrantInput {
+    readonly id: string;
+    readonly effect: 'allow' | 'deny';
+    readonly source: string;
+}
+export interface Grants {
+    /** Grants in the caller's organization. Admin only; the caller is checked above. */
+    list(auth: AuthContext): Promise<readonly GrantRecord[]>;
+    /** `undefined` when the caller may not administer the scope, or it does not exist. */
+    issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
+    /**
+     * Withdraw a grant. `false` when it is absent, in another organization, or on
+     * a scope this caller may not administer — one answer for all three.
+     *
+     * This is the operation `nacre_acl_propagation_lag_seconds` measures and the
+     * one docs/authz.md builds its SLA around, and there was no way to perform it
+     * through the API at all. Three documents described revocation; the only
+     * implementation was a DELETE against the table by hand.
+     */
+    revoke(auth: AuthContext, grantId: string): Promise<boolean>;
+}
+export interface ServiceAccountView {
+    readonly id: string;
+    readonly name: string;
+    readonly keyPrefix: string;
+    readonly createdAt: string;
+    readonly lastUsedAt: string | null;
+    readonly revokedAt: string | null;
+}
+export interface ServiceAccountPort {
+    list(auth: AuthContext): Promise<readonly ServiceAccountView[]>;
+    create(auth: AuthContext, name: string): Promise<{
+        account: ServiceAccountView;
+        key: string;
+    }>;
+    revoke(auth: AuthContext, id: string): Promise<boolean>;
+}
+export interface AuditEvent {
+    readonly orgId: string;
+    readonly actor: string;
+    readonly action: string;
+    readonly result: 'allow' | 'deny' | 'error';
+    readonly detail: Record<string, unknown>;
+    readonly requestId: string;
+}
+export interface AuditSink {
+    /** Awaited before the response goes out. A lost event is worse than a slow response. */
+    write(event: AuditEvent): Promise<void>;
+}
+export interface ApiOptions {
+    readonly verify: VerifyOptions;
+    /** Rendered at /metrics. Absent means the endpoint answers 404. */
+    readonly metrics?: {
+        render(): Promise<string>;
+    };
+    readonly documents: Documents;
+    readonly search: SearchService;
+    readonly ingest: Ingest;
+    readonly audit: AuditSink;
+    readonly jobs?: Jobs;
+    readonly layers?: Layers;
+    readonly grants?: Grants;
+    readonly serviceAccounts?: ServiceAccountPort;
+}
+export declare function createApi(options: ApiOptions): Server;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAGpG;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACtF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IACpF,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAAA;IAClD,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;IACxD,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9F,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;CAC9C;AAuGD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQrD"}