@nacre.work/core 0.0.0 → 0.2.0

package/dist/vector/search.d.ts

@@ -1,22 +1,102 @@
-import { type QueryablePlan } from '../authz/filter.js';
+import { QdrantClient } from '@qdrant/js-client-rest';
+import { type Narrowing, type QueryablePlan } from '../authz/filter.js';
 import { type Branch } from './query.js';
+/**
+ * What Qdrant actually said.
+ *
+ * The REST client throws `Error: Bad Request` with the reason in a `data`
+ * property nobody looks at, so an unhandled one reaches a log as four words
+ * that name no collection, no vector and no cause. Both times a query in this
+ * repository was malformed, the message alone was useless and the reason was
+ * one line inside `data`.
+ */
+export declare function explainQdrant(cause: unknown): string;
 export interface VectorStoreOptions {
     readonly url: string;
     readonly apiKey?: string;
 }
 export interface SearchRequest {
     readonly orgId: string;
-    readonly orgSlug: string;
+    /**
+     * The organization's collection, read from `organizations.vector_collection`.
+     *
+     * Not derived from the slug. It was, everywhere, and the column was written
+     * once at `init` and read by nothing — so a reindex that moved the pointer
+     * moved a pointer no query followed, and the copy it had just finished sat
+     * unused while search carried on against the old collection. The name is a
+     * value the database owns; deriving it in six places is what let the two
+     * disagree silently.
+     */
+    readonly collection: string;
     /** What the caller may reach. `none` is not accepted — see buildFilter. */
     readonly plan: QueryablePlan;
     readonly branches: readonly Branch[];
     readonly topK: number;
+    /**
+     * A restriction the caller asked for, layered on top of the permission one.
+     *
+     * Still not a filter the caller assembles — it is a list of layer ids that
+     * `buildFilter` turns into a `must`, so it can only ever remove results. The
+     * distinction is the whole reason this is not `filter?: VectorFilter`.
+     */
+    readonly narrow?: Narrowing;
 }
 export interface Hit {
     readonly id: string;
     readonly score: number;
     readonly payload: Record<string, unknown>;
 }
+/**
+ * How many metadata keys one collection will have indexes built for.
+ *
+ * The keys are the caller's, so unlike `PAYLOAD_INDEXES` the set is not known
+ * in advance and has no natural end: `parseMetadata` bounds a *document* to 32
+ * keys and says nothing about how many distinct ones an organization uses, so
+ * a caller putting an identifier in a key name would otherwise ask for an index
+ * per document.
+ *
+ * A constant rather than a `NACRE_` variable. Every configuration variable is a
+ * thing an operator has to understand and a thing `docs/config.md` has to
+ * explain, and the failure this bounds — a slower filter past the sixty-fourth
+ * distinct key — needs no per-deployment answer.
+ */
+export declare const METADATA_INDEX_LIMIT = 64;
+/**
+ * Payload indexes for the keys a caller filters on.
+ *
+ * `PAYLOAD_INDEXES` covers the fields the permission filter uses, which are
+ * fixed. A metadata filter reaches `meta.<key>`, and those fields had no index
+ * at all — so the narrowing that `filters` performs was evaluated by scanning,
+ * which is the failure the comment on `PAYLOAD_INDEXES` describes: it does not
+ * fail a test, it gets slow at a customer's volume.
+ *
+ * Built when metadata is written, because that is the only moment the keys are
+ * known. Three properties make that safe, and each was checked against a real
+ * Qdrant rather than read:
+ *
+ * - **A missing index is slow, never wrong.** A filter on an unindexed field —
+ *   and on one indexed under the wrong type — still returns exactly the right
+ *   points. Qdrant falls back to a scan. So this is an optimization end to end,
+ *   and everything below may fail without changing an answer.
+ * - **Creating one is idempotent**, and it back-fills: an index added after the
+ *   points covers them, so nothing has to be rebuilt or ordered.
+ * - **`keyword` is safe for every value type.** A number or a boolean under a
+ *   keyword index simply indexes nothing and still matches, and strings and
+ *   lists of strings — the case `filters` exists for, "only documents from this
+ *   source" — index properly.
+ *
+ * Which is why a failure here warns and returns. This is the opposite of
+ * invariant I3 and deliberately so: nothing about an index decides who sees
+ * what, and failing an ingest because an index could not be built would trade a
+ * slow query for a document that never arrives.
+ */
+export declare class MetadataIndexer {
+    #private;
+    constructor(client: QdrantClient, limit?: number);
+    ensure(collection: string, keys: Iterable<string>): Promise<void>;
+    /** The `meta.` indexes a collection already has, for carrying across a copy. */
+    static fieldsOf(client: QdrantClient, collection: string): Promise<readonly string[]>;
+}
 /**
  * The vector store.
  *
@@ -32,7 +112,15 @@ export interface Hit {
 export declare class VectorStore {
     #private;
     constructor(options: VectorStoreOptions);
-    ensureCollection(orgSlug: string, vectorName: string, size: number): Promise<void>;
+    /**
+     * Create an organization's first collection, if it is not there.
+     *
+     * `collectionName(orgSlug)` is the *initial* name and only that. Once a
+     * reindex has rebuilt the collection the organization's name no longer
+     * derives from its slug, which is why every other method here takes the
+     * collection rather than working it out.
+     */
+    ensureCollection(orgSlug: string, vectorName: string, size: number): Promise<string>;
     /**
      * Mark every point of a document deleted.
      *
@@ -46,7 +134,82 @@ export declare class VectorStore {
      * is tombstoned in Postgres but not here stays searchable until a background
      * job gets to it. That window is exactly what invariant I5 forbids.
      */
-    tombstone(orgSlug: string, documentId: string): Promise<void>;
+    tombstone(collection: string, documentId: string): Promise<void>;
+    /**
+     * Replace the caller's metadata on every point of a document.
+     *
+     * `setPayload` under the reserved key, which merges at the top level and so
+     * leaves `org_id`, `deleted`, `acl_tags` and the rest exactly as they were —
+     * the namespace is what makes that safe rather than a list of fields to
+     * preserve.
+     *
+     * Whole-object replacement inside that key, not a merge: a caller sending
+     * `{source: "notion"}` after `{source: "confluence", team: "legal"}` means
+     * the document now has one tag, and merging would leave a tag they removed
+     * still matching filters. `PATCH` names the resource, not the field.
+     *
+     * The vectors are untouched. Re-embedding a document because a tag moved
+     * would make a bulk retag cost as much as a bulk ingest, which is the same
+     * argument the ACL retag path is built on.
+     */
+    setMetadata(collection: string, documentId: string, metadata: Record<string, unknown>): Promise<void>;
+    /**
+     * Remove a collection.
+     *
+     * Tolerates one that is not there. The caller is the retire sweep, which
+     * drops before it forgets the row — so a pass that dropped and then failed to
+     * forget comes back to a name whose collection is already gone, and that is a
+     * completed job rather than an error. The alternative order loses the only
+     * record that the collection exists.
+     *
+     * There is no confirmation and no dry run because there is no ambiguity at
+     * this level: by the time a name reaches here it has been through the
+     * rollback window and been checked against every organization's pointer.
+     */
+    dropCollection(collection: string): Promise<void>;
+    /**
+     * The named vectors a collection has, and their widths.
+     *
+     * The set is fixed when the collection is created. That is the fact the whole
+     * reindex design turns on, and it was worth checking rather than assuming:
+     * `update_collection` adjusts the parameters of vectors that already exist and
+     * answers `Not existing vector name error` for anything else, so there is no
+     * way to add one to a live collection.
+     */
+    vectorsOf(collection: string): Promise<Record<string, number>>;
+    /**
+     * Copy an organization's collection into a new one that also has room for a
+     * new model.
+     *
+     * This exists because a named vector cannot be added to a collection after it
+     * is created. The way around that is not to add one — it is to create a
+     * collection that already has the slot, move the points across as they are,
+     * and switch which collection the organization points at.
+     *
+     * **No embeddings are computed here.** The vectors that come out of the old
+     * collection go into the new one unchanged. That is what makes this the cheap
+     * half of a model migration: the expensive half — computing vectors with the
+     * new model — happens afterwards, one layer at a time, into the slot this
+     * created.
+     *
+     * Idempotent by construction: if the target already exists it is deleted and
+     * rebuilt. A half-copied collection is worse than none, and there is no way to
+     * tell one from a complete one by looking at it — the source is still live and
+     * still authoritative until the pointer moves, so throwing away a partial
+     * attempt costs only the time it took.
+     */
+    copyCollection(input: {
+        from: string;
+        to: string;
+        /** Added alongside everything the source already has. */
+        addVector: {
+            name: string;
+            size: number;
+        };
+        /** Points per scroll page and per upsert. */
+        batch?: number;
+        onProgress?: (copied: number) => void;
+    }): Promise<void>;
     search(request: SearchRequest): Promise<readonly Hit[]>;
     /**
      * Re-check the tenant on the way out.
@@ -57,6 +220,14 @@ export declare class VectorStore {
      * and a bug that produces one cross-tenant row will produce more.
      */
     static assertTenant(orgId: string, hits: readonly Hit[]): readonly Hit[];
+    /**
+     * Whether the vector store is answering.
+     *
+     * `getCollections` rather than a bare TCP connect: Qdrant accepting a socket
+     * while refusing queries is the failure a readiness probe exists to catch,
+     * and the Compose healthcheck already covers the socket.
+     */
+    ready(): Promise<boolean>;
     close(): Promise<void>;
 }
 //# sourceMappingURL=search.d.ts.map

package/dist/vector/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAuE,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAE7G,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;;gBAGV,OAAO,EAAE,kBAAkB;IAWjC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxF;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ7D,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;IAiB7D;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE;IAYlE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAgC,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAErG,OAAO,EAAqF,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AAE3H;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,eAAe;;gBAOd,MAAM,EAAE,YAAY,EAAE,KAAK,GAAE,MAA6B;IAwBhE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCvE,gFAAgF;WACnE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;CAK5F;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;;gBAIV,OAAO,EAAE,kBAAkB;IAYvC;;;;;;;OAOG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB1F;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtE;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;;;;;;;;OAYG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD;;;;;;;;OAQG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQpE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,IAAI,EAAE,MAAM,CAAA;QACZ,EAAE,EAAE,MAAM,CAAA;QACV,yDAAyD;QACzD,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACzC,6CAA6C;QAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC;IA4EX,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;IA4B7D;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE;IAYxE;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAKzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/vector/search.js

@@ -1,6 +1,132 @@
 import { QdrantClient } from '@qdrant/js-client-rest';
-import { buildFilter } from '../authz/filter.js';
-import { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES } from './query.js';
+import { buildFilter, METADATA_PREFIX } from '../authz/filter.js';
+import { logger } from '../logging.js';
+import { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES, vectorParams } from './query.js';
+/**
+ * What Qdrant actually said.
+ *
+ * The REST client throws `Error: Bad Request` with the reason in a `data`
+ * property nobody looks at, so an unhandled one reaches a log as four words
+ * that name no collection, no vector and no cause. Both times a query in this
+ * repository was malformed, the message alone was useless and the reason was
+ * one line inside `data`.
+ */
+export function explainQdrant(cause) {
+    const data = cause?.data;
+    return data === undefined ? String(cause) : `${String(cause)} — ${JSON.stringify(data)}`;
+}
+/**
+ * How many metadata keys one collection will have indexes built for.
+ *
+ * The keys are the caller's, so unlike `PAYLOAD_INDEXES` the set is not known
+ * in advance and has no natural end: `parseMetadata` bounds a *document* to 32
+ * keys and says nothing about how many distinct ones an organization uses, so
+ * a caller putting an identifier in a key name would otherwise ask for an index
+ * per document.
+ *
+ * A constant rather than a `NACRE_` variable. Every configuration variable is a
+ * thing an operator has to understand and a thing `docs/config.md` has to
+ * explain, and the failure this bounds — a slower filter past the sixty-fourth
+ * distinct key — needs no per-deployment answer.
+ */
+export const METADATA_INDEX_LIMIT = 64;
+/**
+ * Payload indexes for the keys a caller filters on.
+ *
+ * `PAYLOAD_INDEXES` covers the fields the permission filter uses, which are
+ * fixed. A metadata filter reaches `meta.<key>`, and those fields had no index
+ * at all — so the narrowing that `filters` performs was evaluated by scanning,
+ * which is the failure the comment on `PAYLOAD_INDEXES` describes: it does not
+ * fail a test, it gets slow at a customer's volume.
+ *
+ * Built when metadata is written, because that is the only moment the keys are
+ * known. Three properties make that safe, and each was checked against a real
+ * Qdrant rather than read:
+ *
+ * - **A missing index is slow, never wrong.** A filter on an unindexed field —
+ *   and on one indexed under the wrong type — still returns exactly the right
+ *   points. Qdrant falls back to a scan. So this is an optimization end to end,
+ *   and everything below may fail without changing an answer.
+ * - **Creating one is idempotent**, and it back-fills: an index added after the
+ *   points covers them, so nothing has to be rebuilt or ordered.
+ * - **`keyword` is safe for every value type.** A number or a boolean under a
+ *   keyword index simply indexes nothing and still matches, and strings and
+ *   lists of strings — the case `filters` exists for, "only documents from this
+ *   source" — index properly.
+ *
+ * Which is why a failure here warns and returns. This is the opposite of
+ * invariant I3 and deliberately so: nothing about an index decides who sees
+ * what, and failing an ingest because an index could not be built would trade a
+ * slow query for a document that never arrives.
+ */
+export class MetadataIndexer {
+    #client;
+    #limit;
+    /** Per collection, the `meta.` fields known to be indexed. */
+    #known = new Map();
+    #atLimit = new Set();
+    constructor(client, limit = METADATA_INDEX_LIMIT) {
+        this.#client = client;
+        this.#limit = limit;
+    }
+    /**
+     * Held on the instance rather than in a module-level map: two stores against
+     * different collections must not share it, and a cache that outlives the
+     * process that built it is a cache nothing invalidates. Staleness is harmless
+     * anyway — the operation it saves is idempotent.
+     */
+    async #indexed(collection) {
+        const cached = this.#known.get(collection);
+        if (cached !== undefined)
+            return cached;
+        const info = await this.#client.getCollection(collection);
+        const schema = (info.payload_schema ?? {});
+        const fields = new Set(Object.keys(schema).filter((field) => field.startsWith(`${METADATA_PREFIX}.`)));
+        this.#known.set(collection, fields);
+        return fields;
+    }
+    async ensure(collection, keys) {
+        const wanted = [...keys];
+        if (wanted.length === 0)
+            return;
+        try {
+            const indexed = await this.#indexed(collection);
+            for (const key of wanted) {
+                const field = `${METADATA_PREFIX}.${key}`;
+                if (indexed.has(field))
+                    continue;
+                if (indexed.size >= this.#limit) {
+                    // Once per collection per process. The filter still answers
+                    // correctly; it stops being answered from an index.
+                    if (!this.#atLimit.has(collection)) {
+                        this.#atLimit.add(collection);
+                        logger.warn('metadata index limit reached', { collection,
+                            limit: this.#limit,
+                            unindexed: field });
+                    }
+                    continue;
+                }
+                await this.#client.createPayloadIndex(collection, {
+                    field_name: field,
+                    field_schema: 'keyword',
+                    wait: true,
+                });
+                indexed.add(field);
+            }
+        }
+        catch (cause) {
+            // Never fatal. See the note on this class.
+            logger.warn('metadata index build failed', { collection,
+                error: explainQdrant(cause) });
+        }
+    }
+    /** The `meta.` indexes a collection already has, for carrying across a copy. */
+    static async fieldsOf(client, collection) {
+        const info = await client.getCollection(collection);
+        const schema = (info.payload_schema ?? {});
+        return Object.keys(schema).filter((field) => field.startsWith(`${METADATA_PREFIX}.`));
+    }
+}
 /**
  * The vector store.
  *
@@ -15,6 +141,7 @@ import { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES } f
  */
 export class VectorStore {
     #client;
+    #metadataIndexes;
     constructor(options) {
         // exactOptionalPropertyTypes distinguishes "absent" from "present and
         // undefined", and the client's parameters mean it: passing apiKey:
@@ -22,12 +149,21 @@ export class VectorStore {
         this.#client = new QdrantClient(options.apiKey === undefined
             ? { url: options.url }
             : { url: options.url, apiKey: options.apiKey });
+        this.#metadataIndexes = new MetadataIndexer(this.#client);
     }
+    /**
+     * Create an organization's first collection, if it is not there.
+     *
+     * `collectionName(orgSlug)` is the *initial* name and only that. Once a
+     * reindex has rebuilt the collection the organization's name no longer
+     * derives from its slug, which is why every other method here takes the
+     * collection rather than working it out.
+     */
     async ensureCollection(orgSlug, vectorName, size) {
         const name = collectionName(orgSlug);
         const existing = await this.#client.getCollections();
         if (existing.collections.some((c) => c.name === name))
-            return;
+            return name;
         await this.#client.createCollection(name, collectionConfig(vectorName, size));
         // Created here rather than left to an operator: a filter that falls back to
         // a scan is a latency problem that only shows up at a customer's volume.
@@ -38,6 +174,7 @@ export class VectorStore {
                 wait: true,
             });
         }
+        return name;
     }
     /**
      * Mark every point of a document deleted.
@@ -52,21 +189,186 @@ export class VectorStore {
      * is tombstoned in Postgres but not here stays searchable until a background
      * job gets to it. That window is exactly what invariant I5 forbids.
      */
-    async tombstone(orgSlug, documentId) {
-        await this.#client.setPayload(collectionName(orgSlug), {
+    async tombstone(collection, documentId) {
+        await this.#client.setPayload(collection, {
             wait: true,
             payload: { deleted: true },
             filter: { must: [{ key: 'doc_id', match: { value: documentId } }] },
         });
     }
+    /**
+     * Replace the caller's metadata on every point of a document.
+     *
+     * `setPayload` under the reserved key, which merges at the top level and so
+     * leaves `org_id`, `deleted`, `acl_tags` and the rest exactly as they were —
+     * the namespace is what makes that safe rather than a list of fields to
+     * preserve.
+     *
+     * Whole-object replacement inside that key, not a merge: a caller sending
+     * `{source: "notion"}` after `{source: "confluence", team: "legal"}` means
+     * the document now has one tag, and merging would leave a tag they removed
+     * still matching filters. `PATCH` names the resource, not the field.
+     *
+     * The vectors are untouched. Re-embedding a document because a tag moved
+     * would make a bulk retag cost as much as a bulk ingest, which is the same
+     * argument the ACL retag path is built on.
+     */
+    async setMetadata(collection, documentId, metadata) {
+        try {
+            await this.#client.setPayload(collection, {
+                wait: true,
+                payload: { [METADATA_PREFIX]: metadata },
+                filter: { must: [{ key: 'doc_id', match: { value: documentId } }] },
+            });
+        }
+        catch (cause) {
+            throw new Error(`metadata write to ${collection} rejected: ${explainQdrant(cause)}`, { cause });
+        }
+        // After the write, not before: an index built for a write that then failed
+        // is an index for a key no point carries.
+        await this.#metadataIndexes.ensure(collection, Object.keys(metadata));
+    }
+    /**
+     * Remove a collection.
+     *
+     * Tolerates one that is not there. The caller is the retire sweep, which
+     * drops before it forgets the row — so a pass that dropped and then failed to
+     * forget comes back to a name whose collection is already gone, and that is a
+     * completed job rather than an error. The alternative order loses the only
+     * record that the collection exists.
+     *
+     * There is no confirmation and no dry run because there is no ambiguity at
+     * this level: by the time a name reaches here it has been through the
+     * rollback window and been checked against every organization's pointer.
+     */
+    async dropCollection(collection) {
+        try {
+            await this.#client.deleteCollection(collection);
+        }
+        catch (cause) {
+            const existing = await this.#client.getCollections();
+            if (existing.collections.some((c) => c.name === collection)) {
+                throw new Error(`deleting ${collection} rejected: ${explainQdrant(cause)}`, { cause });
+            }
+        }
+    }
+    /**
+     * The named vectors a collection has, and their widths.
+     *
+     * The set is fixed when the collection is created. That is the fact the whole
+     * reindex design turns on, and it was worth checking rather than assuming:
+     * `update_collection` adjusts the parameters of vectors that already exist and
+     * answers `Not existing vector name error` for anything else, so there is no
+     * way to add one to a live collection.
+     */
+    async vectorsOf(collection) {
+        const info = await this.#client.getCollection(collection);
+        const vectors = (info.config?.params?.vectors ?? {});
+        return Object.fromEntries(Object.entries(vectors).map(([name, v]) => [name, Number(v.size ?? 0)]));
+    }
+    /**
+     * Copy an organization's collection into a new one that also has room for a
+     * new model.
+     *
+     * This exists because a named vector cannot be added to a collection after it
+     * is created. The way around that is not to add one — it is to create a
+     * collection that already has the slot, move the points across as they are,
+     * and switch which collection the organization points at.
+     *
+     * **No embeddings are computed here.** The vectors that come out of the old
+     * collection go into the new one unchanged. That is what makes this the cheap
+     * half of a model migration: the expensive half — computing vectors with the
+     * new model — happens afterwards, one layer at a time, into the slot this
+     * created.
+     *
+     * Idempotent by construction: if the target already exists it is deleted and
+     * rebuilt. A half-copied collection is worse than none, and there is no way to
+     * tell one from a complete one by looking at it — the source is still live and
+     * still authoritative until the pointer moves, so throwing away a partial
+     * attempt costs only the time it took.
+     */
+    async copyCollection(input) {
+        const existing = await this.vectorsOf(input.from);
+        if (input.addVector.name in existing) {
+            throw new Error(`${input.from} already has a vector called ${input.addVector.name}; nothing to copy for`);
+        }
+        const vectors = {};
+        for (const [name, size] of Object.entries(existing)) {
+            vectors[name] = vectorParams(size);
+        }
+        vectors[input.addVector.name] = vectorParams(input.addVector.size);
+        // Rebuilt rather than resumed. See the note above.
+        await this.#client.deleteCollection(input.to).catch(() => undefined);
+        await this.#client.createCollection(input.to, {
+            vectors: vectors,
+            sparse_vectors: { bm25: {} },
+            optimizers_config: { default_segment_number: 4 },
+            on_disk_payload: true,
+        });
+        for (const index of PAYLOAD_INDEXES) {
+            await this.#client.createPayloadIndex(input.to, {
+                field_name: index.field_name,
+                field_schema: index.field_schema,
+                wait: true,
+            });
+        }
+        // The metadata indexes too, or a reindex quietly undoes them: the new
+        // collection is built from `PAYLOAD_INDEXES`, which by construction knows
+        // nothing about keys a caller chose, so every metadata filter in that
+        // organization would go back to scanning the moment the pointer moved. The
+        // source is the only record of which keys are in use.
+        for (const field of await MetadataIndexer.fieldsOf(this.#client, input.from)) {
+            await this.#client.createPayloadIndex(input.to, {
+                field_name: field,
+                field_schema: 'keyword',
+                wait: true,
+            });
+        }
+        const batch = input.batch ?? 256;
+        let offset = undefined;
+        let copied = 0;
+        do {
+            const page = await this.#client.scroll(input.from, {
+                limit: batch,
+                with_payload: true,
+                with_vector: true,
+                ...(offset === undefined || offset === null ? {} : { offset }),
+            });
+            const points = page.points ?? [];
+            if (points.length > 0) {
+                await this.#client.upsert(input.to, {
+                    wait: true,
+                    points: points.map((p) => ({
+                        id: p.id,
+                        // Whatever the source had, unchanged. The new slot stays empty
+                        // until a layer is reindexed into it.
+                        vector: p.vector,
+                        payload: p.payload ?? {},
+                    })),
+                });
+                copied += points.length;
+                input.onProgress?.(copied);
+            }
+            offset = page.next_page_offset;
+        } while (offset !== undefined && offset !== null);
+    }
     async search(request) {
-        const filter = buildFilter(request.orgId, request.plan);
+        const filter = buildFilter(request.orgId, request.plan, request.narrow);
         const query = buildHybridQuery({
             branches: request.branches,
             filter,
             limit: request.topK,
         });
-        const result = await this.#client.query(collectionName(request.orgSlug), query);
+        let result;
+        try {
+            result = await this.#client.query(request.collection, query);
+        }
+        catch (cause) {
+            // Named, because the query has as many branches as the organization has
+            // models and "Bad Request" does not say which one Qdrant objected to.
+            throw new Error(`query against ${request.collection} using ` +
+                `${query.prefetch.map((b) => b.using).join(', ')} rejected: ${explainQdrant(cause)}`, { cause });
+        }
         return result.points.map((p) => ({
             id: String(p.id),
             score: p.score,
@@ -90,6 +392,17 @@ export class VectorStore {
         }
         return hits;
     }
+    /**
+     * Whether the vector store is answering.
+     *
+     * `getCollections` rather than a bare TCP connect: Qdrant accepting a socket
+     * while refusing queries is the failure a readiness probe exists to catch,
+     * and the Compose healthcheck already covers the socket.
+     */
+    async ready() {
+        await this.#client.getCollections();
+        return true;
+    }
     async close() {
         // The REST client holds no pool; this exists so callers have one shape to
         // depend on when it does.

package/dist/vector/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,WAAW,EAAsB,MAAM,oBAAoB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAe,MAAM,YAAY,CAAA;AAsB7G;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAc;IAE9B,YAAY,OAA2B;QACrC,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAC7B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YACtB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACjD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;QACtE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAM;QAE7D,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAU,CAAC,CAAA;QAEtF,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,UAAkB;QACjD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE;YACrD,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;SAC3D,CAAC,CAAA;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAc,CAAC,CAAA;QAExF,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAA4B;SACtD,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa,EAAE,IAAoB;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,kBAAkB;oBAC/D,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,KAAK,EAAE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,KAAK;QACT,0EAA0E;QAC1E,0BAA0B;IAC5B,CAAC;CACF"}
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsC,MAAM,oBAAoB,CAAA;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3H;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAA;IACvD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1F,CAAC;AAwCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,CAAc;IACrB,MAAM,CAAQ;IACvB,8DAA8D;IACrD,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,YAAY,MAAoB,EAAE,QAAgB,oBAAoB;QACpE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QAEvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAA;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAC/E,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QACnC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,IAAsB;QACrD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YAE/C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,GAAG,eAAe,IAAI,GAAG,EAAE,CAAA;gBACzC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAQ;gBAEhC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,4DAA4D;oBAC5D,oDAAoD;oBACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;wBAC7B,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,UAAU;4BACpD,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;oBACzB,CAAC;oBACD,SAAQ;gBACV,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE;oBAChD,UAAU,EAAE,KAAK;oBACjB,YAAY,EAAE,SAAkB;oBAChC,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2CAA2C;YAC3C,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,UAAU;gBACnD,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAoB,EAAE,UAAkB;QAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAA;QACrE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAAA;IACvF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAc;IACrB,gBAAgB,CAAiB;IAE1C,YAAY,OAA2B;QACrC,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAC7B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YACtB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACjD,CAAA;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;QACtE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAElE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAU,CAAC,CAAA;QAEtF,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,UAAkB;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;SAC3D,CAAC,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CACf,UAAkB,EAClB,UAAkB,EAClB,QAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;gBACxC,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;aAC3D,CAAC,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qBAAqB,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACnE,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;YACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAsC,CAAA;QACzF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,gCAAgC,KAAK,CAAC,SAAS,CAAC,IAAI,uBAAuB,CACzF,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAElE,mDAAmD;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC5C,OAAO,EAAE,OAAgB;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC5B,iBAAiB,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE;YAChD,eAAe,EAAE,IAAI;SACb,CAAC,CAAA;QAEX,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9C,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,SAAkB;gBAChC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAA;QAChC,IAAI,MAAM,GAAY,SAAS,CAAA;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;QAEd,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,IAAI;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aACtD,CAAC,CAAA;YAEX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;oBAClC,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,+DAA+D;wBAC/D,sCAAsC;wBACtC,MAAM,EAAE,CAAC,CAAC,MAAe;wBACzB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;qBACzB,CAAC,CAAC;iBACK,CAAC,CAAA;gBACX,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;gBACvB,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAChC,CAAC,QAAQ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAc,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,iBAAiB,OAAO,CAAC,UAAU,SAAS;gBAC1C,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACtF,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAA4B;SACtD,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa,EAAE,IAAoB;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,kBAAkB;oBAC/D,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,KAAK,EAAE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,KAAK;QACT,0EAA0E;QAC1E,0BAA0B;IAC5B,CAAC;CACF"}