@segmentstream-cloud/ontology 0.14.0 → 0.16.0

package/dist/migrate/plan.js

@@ -1,5 +1,5 @@
 import { isValueMatched, } from "../manifest.js";
-import { BLOB_TABLES_DDL } from "../storage/tables.js";
+import { ATTACHMENTS_TABLE, ATTACHMENT_TABLES_DDL, BLOB_TABLES_DDL } from "../storage/tables.js";
 import { SNAKE_CASE_NAME, isSystemProperty, toSnakeCase } from "../names.js";
 import { AGENT_TABLES, AGENT_TABLES_DDL, CATALOG_TABLE_DDL, MAX_IDENTIFIER_LENGTH, OAUTH_TABLES, OAUTH_TABLES_DDL, USER_TABLE, addConstraintStatement, columnDefinition, constraintDefinition, createEnumStatement, createIndexStatement, createTableStatement, defaultExpression, entityStorage, enumTypeName, fieldColumnName, joinTable, propertyCheck, blobForeignKey, propertyColumn, propertyEnum, quoteIdentifier, quoteLiteral, relationshipColumn, RUNTIME_TABLES_DDL, relationshipForeignKey, SYSTEM_COLUMNS, tableName, } from "./storage.js";
 const GLOBAL_KINDS = new Set(["table", "type", "index"]);
@@ -94,13 +94,23 @@ export function planMigration(input) {
             }));
         }
     }
-    if (storedTargets.some((entity) => entity.properties.some((property) => property.type === "blob")) &&
+    const storesFiles = storedTargets.some((entity) => entity.properties.some((property) => property.type === "blob"));
+    if (storesFiles &&
         !current?.entities.some((entity) => entity.properties.some((property) => property.type === "blob"))) {
         draft.runtimeTables.push(step({
             kind: "createCatalog",
             classification: "additive",
-            description: "Create the ontology's file revision and upload tables.",
-            sql: BLOB_TABLES_DDL,
+            description: "Create the ontology's file revision, upload and agent attachment tables.",
+            sql: [...BLOB_TABLES_DDL, ...ATTACHMENT_TABLES_DDL],
+        }));
+    }
+    else if (storesFiles && input.existingTables?.has(ATTACHMENTS_TABLE) === false) {
+        // File storage an earlier SDK created lacks the agent's attachments, added since.
+        draft.runtimeTables.push(step({
+            kind: "createCatalog",
+            classification: "additive",
+            description: "Create the agent's temporary attachment table beside the file tables.",
+            sql: ATTACHMENT_TABLES_DDL,
         }));
     }
     planDrops({ pairs, removedEntities, addedEntities, allowDrops, draft });

package/dist/permissions.d.ts

@@ -2,12 +2,18 @@
  * Permissions are `<entity>:<verb>` strings. The verbs are `read`, the generated `create`, `update`,
  * `delete`, `link` and `unlink`, and the snake_case name of an authored action. A role may use `*` for
  * the entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
- * holds a wildcard.
+ * holds a wildcard. A wildcard entity does not cover the entities in {@link EXPLICIT_GRANT_ENTITIES}.
  */
 /** Any entity or any verb, in a role's permissions. */
 export declare const WILDCARD = "*";
 /** The verb of every read: lists, queries, records, history, traversals and `include`. */
 export declare const READ_VERB = "read";
+/**
+ * Entities only a permission that names them covers: `*:read` or `*:*` grant nothing on them. The
+ * built-in agent chat is in every ontology, and member's default `*:read` would otherwise show anyone
+ * who signs in the workspace's chats and who is in them; `agent_chat:read` or `agent_chat:*` does.
+ */
+export declare const EXPLICIT_GRANT_ENTITIES: ReadonlySet<string>;
 /** What the built-in `member` role holds when `defineOntology` does not say: reading everything. */
 export declare const DEFAULT_MEMBER_PERMISSIONS: ReadonlyArray<string>;
 export interface ParsedPermission {
@@ -20,7 +26,10 @@ export interface ParsedPermission {
 export declare function parsePermission(value: unknown): ParsedPermission | undefined;
 /** `lead:changeStatus`. */
 export declare function permissionOf(entity: string, verb: string): string;
-/** Whether a granted permission, which may hold wildcards, covers the required one. */
+/**
+ * Whether a granted permission, which may hold wildcards, covers the required one. A wildcard entity
+ * covers every entity but those in {@link EXPLICIT_GRANT_ENTITIES}.
+ */
 export declare function grants(granted: string, required: string): boolean;
 /** Anything that holds permissions: a principal, or the reader of a catalog. */
 export interface PermissionHolder {

package/dist/permissions.js

@@ -3,12 +3,18 @@ import { GENERATED_UPSERT_PREFIX, toSnakeCase } from "./names.js";
  * Permissions are `<entity>:<verb>` strings. The verbs are `read`, the generated `create`, `update`,
  * `delete`, `link` and `unlink`, and the snake_case name of an authored action. A role may use `*` for
  * the entity (`*:read`), the verb (`lead:*`) or both (`*:*`); what an action or a read requires never
- * holds a wildcard.
+ * holds a wildcard. A wildcard entity does not cover the entities in {@link EXPLICIT_GRANT_ENTITIES}.
  */
 /** Any entity or any verb, in a role's permissions. */
 export const WILDCARD = "*";
 /** The verb of every read: lists, queries, records, history, traversals and `include`. */
 export const READ_VERB = "read";
+/**
+ * Entities only a permission that names them covers: `*:read` or `*:*` grant nothing on them. The
+ * built-in agent chat is in every ontology, and member's default `*:read` would otherwise show anyone
+ * who signs in the workspace's chats and who is in them; `agent_chat:read` or `agent_chat:*` does.
+ */
+export const EXPLICIT_GRANT_ENTITIES = new Set(["agent_chat"]);
 /** What the built-in `member` role holds when `defineOntology` does not say: reading everything. */
 export const DEFAULT_MEMBER_PERMISSIONS = [`${WILDCARD}:${READ_VERB}`];
 /** `<entity>:<verb>` with lowercase snake_case entities and lowercase snake_case verbs, or `*` for either. */
@@ -25,14 +31,20 @@ export function parsePermission(value) {
 export function permissionOf(entity, verb) {
     return `${entity}:${verb}`;
 }
-/** Whether a granted permission, which may hold wildcards, covers the required one. */
+/**
+ * Whether a granted permission, which may hold wildcards, covers the required one. A wildcard entity
+ * covers every entity but those in {@link EXPLICIT_GRANT_ENTITIES}.
+ */
 export function grants(granted, required) {
     const held = parsePermission(granted);
     const wanted = parsePermission(required);
     if (held === undefined || wanted === undefined) {
         return false;
     }
-    return ((held.entity === WILDCARD || toSnakeCase(held.entity) === toSnakeCase(wanted.entity)) &&
+    const entity = toSnakeCase(wanted.entity);
+    return ((held.entity === WILDCARD
+        ? !EXPLICIT_GRANT_ENTITIES.has(entity)
+        : toSnakeCase(held.entity) === entity) &&
         (held.verb === WILDCARD || toSnakeCase(held.verb) === toSnakeCase(wanted.verb)));
 }
 /**

package/dist/replication/baseline.js

@@ -23,7 +23,7 @@ export const createReplicationBaseline = (sql, input) => sql.withTransaction(Eff
     yield* Effect.sync(() => validateReplicationSelection(manifest, input.selection));
     // Drain older SDK transactions that started before the compatibility fence was enabled.
     const tables = manifest.entities
-        .filter((e) => e.source === undefined && e.name !== "user")
+        .filter((e) => e.source === undefined && !e.builtIn)
         .flatMap((e) => [
         tableName(e.name),
         ...e.relationships

package/dist/replication/model.js

@@ -69,7 +69,7 @@ export function validateReplicationSelection(manifest, selection) {
     };
     for (const item of selection) {
         const entity = manifest.entities.find((e) => e.id === item.entityId);
-        if (!entity || entity.name === "user" || entity.source !== undefined) {
+        if (!entity || entity.builtIn || entity.source !== undefined) {
             throw new Error(`Only stored business entities can be replicated: ${item.entityId}.`);
         }
         addView(entity.name);
@@ -82,7 +82,7 @@ export function validateReplicationSelection(manifest, selection) {
             const target = manifest.entities.find((e) => e.name === relationship?.to);
             if (relationship?.cardinality !== "many" ||
                 !target ||
-                target.name === "user" ||
+                target.builtIn ||
                 !selection.some((s) => s.entityId === target.id)) {
                 throw new Error(`Replication of ${entity.name}.${name} requires both business entities.`);
             }

package/dist/replication/schema.js

@@ -55,7 +55,7 @@ export function snapshotExpression(entity, alias) {
 /** History is the durable source. Triggers also reject old writers while capture is enabled. */
 export function replicationEntityDdl(manifest) {
     return manifest.entities
-        .filter((e) => e.source === undefined && e.name !== "user")
+        .filter((e) => e.source === undefined && !e.builtIn)
         .flatMap((entity) => {
         const history = qi(historyTableName(entity.name));
         const table = qi(tableName(entity.name));

package/dist/runtime/agents.d.ts

@@ -5,5 +5,6 @@ import type { AgentStore } from "../service/runtime-contract.js";
  * The agent store on the runtime's agent tables, as `ontology_app`. Expiry is the database's
  * `now()`; a pairing is consumed with one `UPDATE … WHERE "consumed_at" IS NULL`, so two concurrent
  * approvals cannot both succeed. Ids that are not UUIDs find nothing rather than fail the cast.
+ * Chats the agent sees are `agent_chat` records, written as the platform with history.
  */
 export declare function sqlAgentStore(ontology: Ontology, sql: SqlClient.SqlClient): AgentStore;

package/dist/runtime/agents.js

@@ -1,8 +1,13 @@
+import { randomUUID } from "node:crypto";
 import { Effect } from "effect";
 import { SqlClient } from "effect/unstable/sql";
+import { AgentChat } from "../agent-chat.js";
 import { AGENT_IDENTITIES_TABLE, AGENT_PAIRINGS_TABLE, USER_TABLE } from "../migrate/storage.js";
+import { MAX_QUERY_LIMIT } from "../query.js";
+import { beginReplicationWrite } from "../replication/transaction.js";
 import { resolveMemberById } from "./principals.js";
 import { isRecordId } from "./records.js";
+import { makeOntologyRuntime } from "./sql-runtime.js";
 const PAIRINGS = `"${AGENT_PAIRINGS_TABLE}"`;
 const IDENTITIES = `"${AGENT_IDENTITIES_TABLE}"`;
 const USERS = `"${USER_TABLE}"`;
@@ -14,6 +19,16 @@ const PAIRING_COLUMNS = `"id"::text AS "id", "provider", "external_id", "display
     `${epochMs(`"expires_at"`)} AS "expires_at"`;
 const IDENTITY_COLUMNS = `"id"::text AS "id", "provider", "external_id", "user_id"::text AS "user_id", "display", ` +
     `${epochMs(`"created_at"`)} AS "created_at", ${epochMs(`"revoked_at"`)} AS "revoked_at"`;
+/**
+ * How often a chat's `last_message_at` is recorded: each record is a history row, and a busy chat
+ * would otherwise add one per message.
+ */
+const CHAT_MESSAGE_RECORD_INTERVAL_MS = 15 * 60 * 1000;
+/** Whether a chat's latest message is recorded: it has none yet, or none this interval. */
+function messageDue(lastMessageAt, now) {
+    const last = typeof lastMessageAt === "string" ? Date.parse(lastMessageAt) : Number.NaN;
+    return Number.isNaN(last) || now.getTime() - last >= CHAT_MESSAGE_RECORD_INTERVAL_MS;
+}
 function nullableText(value) {
     return value === null || value === undefined ? null : String(value);
 }
@@ -41,6 +56,7 @@ function identityOf(row) {
  * The agent store on the runtime's agent tables, as `ontology_app`. Expiry is the database's
  * `now()`; a pairing is consumed with one `UPDATE … WHERE "consumed_at" IS NULL`, so two concurrent
  * approvals cannot both succeed. Ids that are not UUIDs find nothing rather than fail the cast.
+ * Chats the agent sees are `agent_chat` records, written as the platform with history.
  */
 export function sqlAgentStore(ontology, sql) {
     const rows = (statement, values = []) => sql.unsafe(statement, values).pipe(Effect.orDie);
@@ -141,5 +157,149 @@ export function sqlAgentStore(ontology, sql) {
             const [paired] = yield* rows(`SELECT 1 FROM ${IDENTITIES} WHERE "user_id" = $1::uuid AND "revoked_at" IS NULL LIMIT 1`, [userId]);
             return paired === undefined ? undefined : yield* memberPrincipal(userId);
         }),
+        seeChat: ({ provider, externalId, title, memberId, leftMemberId, agentLeft, migratedFrom }) => sql
+            .withTransaction(Effect.gen(function* () {
+            yield* beginReplicationWrite(sql);
+            const previous = migratedFrom === undefined || migratedFrom === externalId ? undefined : migratedFrom;
+            // Calls for one chat run one after the other: the first creates it, the rest find it. A
+            // migration locks both chats, in one order, so that two calls never wait on each other.
+            for (const id of [externalId, ...(previous === undefined ? [] : [previous])].sort()) {
+                yield* rows(`SELECT pg_advisory_xact_lock(hashtext($1))`, [`chat:${provider}:${id}`]);
+            }
+            const runtime = makeOntologyRuntime(ontology, sql, {
+                action: `${AgentChat.name}.seen`,
+                actionId: randomUUID(),
+                principalId: null,
+            });
+            const now = new Date();
+            const chatOf = (id) => runtime
+                .find({
+                entity: AgentChat.name,
+                options: { where: { provider, external_id: id }, limit: 1, forUpdate: true },
+            })
+                .pipe(Effect.map(([chat]) => chat));
+            const membersOf = (id) => runtime
+                .related({
+                entity: AgentChat.name,
+                id,
+                relationship: "members",
+                query: { limit: MAX_QUERY_LIMIT },
+            })
+                .pipe(Effect.map((page) => page.items.map((member) => String(member.id))));
+            // Unlinks every member of the chat, linking each to `to` first when given. Each page
+            // unlinked is gone, so the first page is read until it is empty.
+            const releaseMembers = (id, to) => Effect.gen(function* () {
+                for (;;) {
+                    const members = yield* membersOf(id);
+                    if (members.length === 0) {
+                        return;
+                    }
+                    for (const targetId of members) {
+                        if (to !== undefined) {
+                            yield* runtime.link({
+                                entity: AgentChat.name,
+                                relationship: "members",
+                                id: to,
+                                targetId,
+                            });
+                        }
+                        yield* runtime.unlink({
+                            entity: AgentChat.name,
+                            relationship: "members",
+                            id,
+                            targetId,
+                        });
+                    }
+                }
+            });
+            let found = yield* chatOf(externalId);
+            if (previous !== undefined) {
+                const old = yield* chatOf(previous);
+                if (old !== undefined && found === undefined) {
+                    // The group became a supergroup: the chat keeps its record under its new id.
+                    found = yield* runtime.update({
+                        entity: AgentChat.name,
+                        id: String(old.id),
+                        values: { external_id: externalId },
+                    });
+                }
+                else if (old !== undefined && found !== undefined) {
+                    // Both were recorded: the new one keeps what members said and gains the members,
+                    // and the old one is deleted.
+                    const kept = {};
+                    for (const key of ["purpose", "when_to_use"]) {
+                        if (nullableText(found[key]) === null && nullableText(old[key]) !== null) {
+                            kept[key] = old[key];
+                        }
+                    }
+                    if (Object.keys(kept).length > 0) {
+                        found = yield* runtime.update({
+                            entity: AgentChat.name,
+                            id: String(found.id),
+                            values: kept,
+                        });
+                    }
+                    yield* releaseMembers(String(old.id), String(found.id));
+                    yield* runtime.delete({ entity: AgentChat.name, id: String(old.id) });
+                }
+            }
+            const changes = {
+                ...(found?.title === title ? {} : { title }),
+                ...(messageDue(found?.last_message_at, now)
+                    ? { last_message_at: now.toISOString() }
+                    : {}),
+            };
+            const chat = found === undefined
+                ? yield* runtime.create({
+                    entity: AgentChat.name,
+                    values: { provider, external_id: externalId, ...changes },
+                })
+                : Object.keys(changes).length === 0
+                    ? found
+                    : yield* runtime.update({
+                        entity: AgentChat.name,
+                        id: String(found.id),
+                        values: changes,
+                    });
+            if (memberId !== undefined && isRecordId(memberId)) {
+                const [member] = yield* rows(`SELECT 1 FROM ${USERS} WHERE "id" = $1::uuid AND "kind"::text = 'member' AND "active"`, [memberId]);
+                // A link already there changes nothing and records no history.
+                if (member !== undefined) {
+                    yield* runtime.link({
+                        entity: AgentChat.name,
+                        relationship: "members",
+                        id: String(chat.id),
+                        targetId: memberId,
+                    });
+                }
+            }
+            if (leftMemberId !== undefined && isRecordId(leftMemberId)) {
+                const [user] = yield* rows(`SELECT 1 FROM ${USERS} WHERE "id" = $1::uuid`, [
+                    leftMemberId,
+                ]);
+                // Whatever their state now; a member who is not linked changes nothing and records no
+                // history.
+                if (user !== undefined) {
+                    yield* runtime.unlink({
+                        entity: AgentChat.name,
+                        relationship: "members",
+                        id: String(chat.id),
+                        targetId: leftMemberId,
+                    });
+                }
+            }
+            if (agentLeft === true) {
+                // The agent left: no member is in the chat with it any more. The chat stays; members
+                // link again when they write after the agent is back.
+                yield* releaseMembers(String(chat.id));
+            }
+            return {
+                id: String(chat.id),
+                title: String(chat.title),
+                purpose: nullableText(chat.purpose),
+                whenToUse: nullableText(chat.when_to_use),
+            };
+        }))
+            .pipe(Effect.orDie),
     };
 }

package/dist/runtime/generated-actions.d.ts

@@ -12,7 +12,8 @@ export declare function upsertActionName(property: string): string;
  * are ordinary actions and run through the same pipeline. Their `permission` is unset: each requires
  * the permission named after it (`lead:create`), and `upsert_by_<property>` both `create` and `update`,
  * as `generatedActionPermissions` says. The built-in User has none: members are created by sign-in
- * and services by the app or the CLI.
+ * and services by the app or the CLI. The built-in agent chat has only `update`, for its unmanaged
+ * properties: the agent records chats and their members.
  */
 export declare function generatedActions(ontology: Ontology, entityName: string): GeneratedActions;
 /** An action's input as JSON Schema (draft 2020-12), as the manifest describes authored actions. */

package/dist/runtime/generated-actions.js

@@ -64,7 +64,7 @@ function valueFields(entity, { mode }) {
                 ? target
                 : Schema.optionalKey(link.optional ? Schema.NullOr(target) : target);
         }
-        else if (link.via === "join" && !link.inverse) {
+        else if (link.via === "join" && !link.inverse && !entity.resolved.builtIn) {
             fields[link.name] = Schema.optionalKey(Schema.Array(reference(link, `The id of a ${link.target} record.`)).annotate({
                 description: `${relationshipDescription(entity, link)} The list replaces the current links.`,
             }));
@@ -87,7 +87,8 @@ function valuesOf(input, omit) {
  * are ordinary actions and run through the same pipeline. Their `permission` is unset: each requires
  * the permission named after it (`lead:create`), and `upsert_by_<property>` both `create` and `update`,
  * as `generatedActionPermissions` says. The built-in User has none: members are created by sign-in
- * and services by the app or the CLI.
+ * and services by the app or the CLI. The built-in agent chat has only `update`, for its unmanaged
+ * properties: the agent records chats and their members.
  */
 export function generatedActions(ontology, entityName) {
     if (ontology.manifest.entities.find((e) => e.name === entityName)?.source !== undefined) {
@@ -101,7 +102,7 @@ export function generatedActions(ontology, entityName) {
 }
 function buildGeneratedActions(ontology, entityName) {
     const entity = entityModel(ontologyModel(ontology), entityName);
-    if (entity.resolved.builtIn) {
+    if (entity.resolved.builtIn && entity.resolved.permissions.update === undefined) {
         return {};
     }
     const label = entity.label.toLowerCase();
@@ -109,22 +110,26 @@ function buildGeneratedActions(ontology, entityName) {
     const managed = entity.fields
         .filter((field) => field.property?.definition.managed === true)
         .map((field) => field.name);
+    const update = action({
+        description: `Change ${article(label)}'s properties and relationships; omitted values stay as they are.` +
+            (managed.length > 0 ? ` ${managed.join(", ")} change only through other actions.` : ""),
+        input: Schema.Struct({ id: id("change"), ...valueFields(entity, { mode: "update" }) }),
+        handler: ({ input }) => Effect.flatMap(OntologyWrites, (runtime) => runtime.update({
+            entity: entityName,
+            id: input.id,
+            values: valuesOf(input, ["id"]),
+        })),
+    });
+    if (entity.resolved.builtIn) {
+        return { update };
+    }
     const actions = {
         create: action({
             description: `Create ${article(label)}.`,
             input: Schema.Struct(valueFields(entity, { mode: "create" })),
             handler: ({ input }) => Effect.flatMap(OntologyWrites, (runtime) => runtime.create({ entity: entityName, values: input })),
         }),
-        update: action({
-            description: `Change ${article(label)}'s properties and relationships; omitted values stay as they are.` +
-                (managed.length > 0 ? ` ${managed.join(", ")} change only through other actions.` : ""),
-            input: Schema.Struct({ id: id("change"), ...valueFields(entity, { mode: "update" }) }),
-            handler: ({ input }) => Effect.flatMap(OntologyWrites, (runtime) => runtime.update({
-                entity: entityName,
-                id: input.id,
-                values: valuesOf(input, ["id"]),
-            })),
-        }),
+        update,
         delete: action({
             description: `Delete ${article(label)}. Records that refer to it are deleted, cleared or protect it, ` +
                 "as each relationship's onDelete says.",

package/dist/runtime/service-binding.js

@@ -3,6 +3,7 @@ import { Effect, Layer, Redacted } from "effect";
 import { SqlClient } from "effect/unstable/sql";
 import { neonBlobProvider } from "../storage/neon.js";
 import { maintainBlobStorage } from "../storage/maintenance.js";
+import { attachmentRuntime } from "../storage/attachments.js";
 import { blobRuntime } from "../storage/sessions.js";
 import { readCatalog } from "../migrate/apply.js";
 import { NotInvited, OntologyBackend, } from "../service/runtime-contract.js";
@@ -33,8 +34,10 @@ export function backendLayer(ontology, blobStorage) {
             ? yield* Effect.acquireRelease(Effect.sync(() => neonBlobProvider(binding)), (provider) => Effect.sync(() => provider.close?.()))
             : undefined;
         const blobs = provider ? blobRuntime(ontology, sql, provider) : undefined;
+        const attachments = provider ? attachmentRuntime(ontology, sql, provider) : undefined;
         return OntologyBackend.of({
             ...(blobs ? { blobs } : {}),
+            ...(attachments ? { attachments } : {}),
             ...(provider ? { maintainBlobs: maintainBlobStorage(sql, provider) } : {}),
             runAction: (input) => withSql(runAction(ontology, {
                 entity: input.entity,

package/dist/service/agent/attachments.d.ts

@@ -0,0 +1,37 @@
+import { Layer } from "effect";
+import { HttpRouter } from "effect/unstable/http";
+import { type TokenVerifier } from "../authentication.js";
+import type { AfterCommitHook } from "../config.js";
+import type { ConnectionTransportFactory } from "../connections.js";
+import { RequestId } from "../errors.js";
+import type { ApiPlan } from "../plan.js";
+import type { ReplicationKick } from "../replication.js";
+import { OntologyBackend } from "../runtime-contract.js";
+import { type RuntimeTokenVerifier } from "../runtime-identity.js";
+import type { AgentChannelFactory } from "./channel.js";
+/**
+ * The agent's temporary attachments over HTTP (`docs/agent.md`, "Attachments"). Only the
+ * deployment's runtime token reaches these routes, acting as the member in `X-SegmentStream-Act-As`
+ * while they are active and paired. The chat and the agent session come from the agent's runtime in
+ * `X-SegmentStream-Agent-Conversation` and `X-SegmentStream-Agent-Session`, never from the model's
+ * tool arguments; every operation is confined to that member, chat and session.
+ */
+export declare const ATTACHMENTS_PATH = "/api/ontology/agent/attachments";
+/** The chat an attachment belongs to, such as `telegram:12345`. */
+export declare const CONVERSATION_HEADER = "x-segmentstream-agent-conversation";
+/** The agent session the request comes from. */
+export declare const SESSION_HEADER = "x-segmentstream-agent-session";
+export interface AttachmentRoutesOptions {
+    readonly plan: ApiPlan;
+    readonly hooks: ReadonlyMap<string, AfterCommitHook>;
+    readonly connections: ConnectionTransportFactory;
+    readonly replicate: ReplicationKick;
+    readonly agentChannel?: AgentChannelFactory | undefined;
+    readonly verifyToken: TokenVerifier;
+    readonly verifyRuntime: RuntimeTokenVerifier | undefined;
+}
+/**
+ * The attachment routes. Without file storage or the agent tables, or while runtime authentication
+ * is disabled, it serves nothing.
+ */
+export declare function attachmentsLayer(options: AttachmentRoutesOptions): Layer.Layer<never, never, OntologyBackend | HttpRouter.HttpRouter | HttpRouter.Request<"Requires", RequestId>>;