@segmentstream/ontology 0.0.0-stage → 0.92.1

package/dist/runtime.d.ts

@@ -0,0 +1,310 @@
+import { Context, Effect } from "effect";
+import type { ActionError, ActionRejected, Conflict, NotFound, ScopeViolated } from "./errors.js";
+import type { ConnectionError } from "./connection.js";
+import type { ScopedPermission } from "./permissions.js";
+import type { Where } from "./query.js";
+import type { WorkloadExecution } from "./runtime/workload.js";
+/** Who runs an action: an app member or a service principal, both `user` records. */
+export interface Principal {
+    /** Present only for a verified managed pipeline worker. */
+    readonly execution?: WorkloadExecution;
+    /**
+     * Present only for a workflow's user: the workflow's wire name, whose runs it acts in, and its
+     * identity subject, `workflows:<workspace id>:<workflow name>`.
+     */
+    readonly workflow?: {
+        readonly name: string;
+        readonly subject: string;
+    };
+    /** Verified authentication mechanism for this request; action contexts always expose it. */
+    readonly authenticatedVia?: string;
+    /** The id of the principal's `user` record. */
+    readonly id: string;
+    readonly kind: "member" | "service";
+    /** Role names the principal holds. Every active member holds `member`. */
+    readonly roles: ReadonlyArray<string>;
+    /**
+     * What the principal may do: the union of its roles' permissions in the ontology, wildcards
+     * included. A role the ontology no longer declares grants nothing.
+     */
+    readonly permissions: ReadonlyArray<string>;
+    /**
+     * The scoped permissions of the held roles, with their `where` in wire form; a permission listed
+     * here is held only for the records its scopes match. Absent when no held role scopes one.
+     */
+    readonly scopes?: ReadonlyArray<ScopedPermission>;
+}
+/** A record as the runtime returns it, before an entity handle gives it the entity's type. */
+export type StoredRecord = Readonly<Record<string, unknown>>;
+/** Values to write, keyed by property and relationship name. */
+export type StoredValues = Readonly<Record<string, unknown>>;
+export interface GetOptions {
+    /** Lock the record until the action's transaction ends. */
+    readonly forUpdate?: boolean;
+}
+/**
+ * Conditions on one field of a record whose value has type `V`; see {@link FieldFilter}. A list,
+ * the user's `roles`, takes only `has` and `hasAny`.
+ */
+export type FieldCondition<V> = NonNullable<V> extends ReadonlyArray<infer Item> ? {
+    readonly has?: Item;
+    readonly hasAny?: ReadonlyArray<Item>;
+} : V | null | ScalarCondition<V>;
+type ScalarCondition<V> = {
+    readonly eq?: NonNullable<V>;
+    readonly ne?: NonNullable<V>;
+    readonly in?: ReadonlyArray<NonNullable<V>>;
+    readonly isNull?: boolean;
+    readonly contains?: string;
+    readonly startsWith?: string;
+    readonly gt?: NonNullable<V>;
+    readonly gte?: NonNullable<V>;
+    readonly lt?: NonNullable<V>;
+    readonly lte?: NonNullable<V>;
+    readonly between?: readonly [NonNullable<V>, NonNullable<V>];
+};
+/**
+ * A `where` on records of type `R`, in the query language of `src/query.ts`: conditions by field, a
+ * {@link Where} on the target of each relationship `L`, and `and`, `or` and `not`. The runtime checks
+ * which operators a field's type takes.
+ */
+export type RecordWhere<R, L extends string = never> = {
+    readonly [K in keyof R]?: FieldCondition<R[K]>;
+} & {
+    readonly [K in L]?: Where;
+} & {
+    readonly and?: ReadonlyArray<RecordWhere<R, L>>;
+    readonly or?: ReadonlyArray<RecordWhere<R, L>>;
+    readonly not?: RecordWhere<R, L>;
+};
+/**
+ * A query from an action handler: the query language, plus `forUpdate`. Included relationships are
+ * added to the records under their names, but are not part of the records' type.
+ */
+export interface FindOptions<R = StoredRecord, L extends string = never> {
+    readonly where?: RecordWhere<R, L>;
+    readonly orderBy?: ReadonlyArray<{
+        readonly field: keyof R & string;
+        readonly direction?: "asc" | "desc";
+    }>;
+    /** Relationships to add to each record: `["owner", "tags"]`, or `{ owner: true, tags: true }`. */
+    readonly include?: ReadonlyArray<L> | {
+        readonly [K in L]?: true;
+    };
+    readonly after?: string;
+    readonly limit?: number;
+    /** Lock the matching records until the action's transaction ends. */
+    readonly forUpdate?: boolean;
+}
+/**
+ * A fresh metric query from an action: metrics the entity declares, computed in the workspace
+ * database over the records `where` matches, in the action's transaction. `where` is the query
+ * language of `find` and must match an indexed field of the entity with `eq` or `in`; see
+ * docs/ontology.md, "Fresh metric queries inside an action".
+ */
+export interface FreshMetricQueryOptions<R = StoredRecord, L extends string = never, Metric extends string = string, Group extends string = string> {
+    /** Metrics of the entity, as `defineOntology` declares them. */
+    readonly metrics: readonly [Metric, ...Metric[]];
+    /** Fields to group by: properties and `<relationship>Id` keys. Without it, one row. */
+    readonly groupBy?: ReadonlyArray<Group>;
+    readonly where: RecordWhere<R, L>;
+}
+export interface UpsertResult<R = StoredRecord> {
+    readonly record: R;
+    readonly created: boolean;
+}
+/** Whether a batch returns its records or only outcome counts. Defaults to `records`. */
+export type BatchReturning = "records" | "summary";
+export interface BatchOptions {
+    readonly returning?: BatchReturning;
+}
+/** Outcome counts, which together equal the number of inputs in a successful batch. */
+export interface BatchSummaryResult {
+    readonly created: number;
+    readonly updated: number;
+    readonly unchanged: number;
+}
+/** One result per input, in input order, including records whose values did not change. */
+export interface BatchRecordResult<R = StoredRecord> extends BatchSummaryResult {
+    readonly items: ReadonlyArray<{
+        readonly index: number;
+        readonly status: "created" | "updated" | "unchanged";
+        readonly record: R;
+    }>;
+}
+export type BatchResult<R = StoredRecord> = BatchRecordResult<R> | BatchSummaryResult;
+/** Raw batch inputs use wire entity and field names. */
+export interface CreateManyInput extends BatchOptions {
+    readonly entity: string;
+    readonly records: ReadonlyArray<StoredValues>;
+}
+export interface UpdateManyInput extends BatchOptions {
+    readonly entity: string;
+    readonly records: ReadonlyArray<{
+        readonly id: string;
+        readonly values: StoredValues;
+    }>;
+}
+export interface UpsertManyInput extends CreateManyInput {
+    readonly on: readonly [string, ...string[]];
+}
+type BatchWriteError = ActionRejected | Conflict | NotFound | ScopeViolated;
+interface BatchWrite<Input extends BatchOptions> {
+    (input: Input & {
+        readonly returning: "summary";
+    }): Effect.Effect<BatchSummaryResult, BatchWriteError>;
+    (input: Input & {
+        readonly returning?: "records";
+    }): Effect.Effect<BatchRecordResult, BatchWriteError>;
+    (input: Input): Effect.Effect<BatchResult, BatchWriteError>;
+}
+type ReadsService = {
+    readonly get: (input: {
+        readonly entity: string;
+        readonly id: string;
+        readonly forUpdate?: boolean;
+    }) => Effect.Effect<StoredRecord, NotFound>;
+    readonly find: (input: {
+        readonly entity: string;
+        readonly options: FindOptions;
+    }) => Effect.Effect<ReadonlyArray<StoredRecord>>;
+    /**
+     * A fresh metric query in wire names: one row per group, keyed by the grouped fields' and the
+     * metrics' wire names, metrics as decimal strings or `null`. Without `groupBy`, exactly one row.
+     */
+    readonly queryMetrics: (input: {
+        readonly entity: string;
+        readonly options: FreshMetricQueryOptions;
+    }) => Effect.Effect<ReadonlyArray<StoredRecord>>;
+};
+type WritesService = {
+    readonly createMany: BatchWrite<CreateManyInput>;
+    readonly updateMany: BatchWrite<UpdateManyInput>;
+    readonly upsertMany: BatchWrite<UpsertManyInput>;
+    readonly create: (input: {
+        readonly entity: string;
+        readonly values: StoredValues;
+    }) => Effect.Effect<StoredRecord, Conflict | NotFound | ScopeViolated>;
+    readonly update: (input: {
+        readonly entity: string;
+        readonly id: string;
+        readonly values: StoredValues;
+    }) => Effect.Effect<StoredRecord, Conflict | NotFound | ScopeViolated>;
+    readonly upsertBy: (input: {
+        readonly entity: string;
+        readonly property: string;
+        readonly values: StoredValues;
+    }) => Effect.Effect<UpsertResult, Conflict | NotFound | ScopeViolated>;
+    readonly delete: (input: {
+        readonly entity: string;
+        readonly id: string;
+    }) => Effect.Effect<void, Conflict | NotFound | ScopeViolated>;
+    readonly link: (input: {
+        readonly entity: string;
+        readonly relationship: string;
+        readonly id: string;
+        readonly targetId: string;
+    }) => Effect.Effect<void, NotFound | ScopeViolated>;
+    readonly unlink: (input: {
+        readonly entity: string;
+        readonly relationship: string;
+        readonly id: string;
+        readonly targetId: string;
+    }) => Effect.Effect<void, NotFound | ScopeViolated>;
+    /**
+     * Grants roles the ontology declares to a member, as `user.grant_roles` does. A role that is not
+     * declared, or `member`, is ActionRejected; a service or an unknown id is NotFound. Each member
+     * write returns the user with its new `roles`; role names are wire names.
+     */
+    readonly grantUserRoles: (input: {
+        readonly id: string;
+        readonly roles: ReadonlyArray<string>;
+    }) => Effect.Effect<StoredRecord, ActionRejected | NotFound>;
+    /** Revokes roles from a member, or every role, as `user.revoke_roles` does. */
+    readonly revokeUserRoles: (input: {
+        readonly id: string;
+        readonly roles: ReadonlyArray<string> | "all";
+    }) => Effect.Effect<StoredRecord, ActionRejected | NotFound>;
+    /** Creates a member for an email no user has, as `user.invite` does; a known email is Conflict. */
+    readonly inviteUser: (input: {
+        readonly email: string;
+        readonly name?: string | undefined;
+        readonly roles?: ReadonlyArray<string> | undefined;
+    }) => Effect.Effect<StoredRecord, ActionRejected | Conflict>;
+    /** Deactivates a member, ending their sessions, or reactivates one. */
+    readonly setUserActive: (input: {
+        readonly id: string;
+        readonly active: boolean;
+    }) => Effect.Effect<StoredRecord, NotFound>;
+    /**
+     * Queues an email with a sign-in link for an active member, sent once the action commits: one of
+     * the ontology's `emails` by wire name, filled with `values`, or the platform's own email without
+     * `template`. The link opens `returnTo`, a path of the app, `/` by default. An inactive member, an
+     * unknown email, a missing or unused value, or a path outside the app is ActionRejected; a
+     * service or an unknown id is NotFound.
+     */
+    readonly sendUserSignInLink: (input: {
+        readonly id: string;
+        readonly template?: string | undefined;
+        readonly returnTo?: string | undefined;
+        readonly values?: Readonly<Record<string, string>> | undefined;
+    }) => Effect.Effect<void, ActionRejected | NotFound>;
+};
+declare const OntologyReads_base: Context.ServiceClass<OntologyReads, "@segmentstream/ontology/OntologyReads", ReadsService>;
+/**
+ * The reads an action runs against: `get`, `find` and `queryMetrics` of entity handles require it. An
+ * action's `prepare` has the reads alone, outside any transaction; its `handler` has them inside
+ * the transaction, with {@link OntologyWrites}.
+ */
+export declare class OntologyReads extends OntologyReads_base {
+}
+declare const OntologyWrites_base: Context.ServiceClass<OntologyWrites, "@segmentstream/ontology/OntologyWrites", WritesService>;
+/**
+ * The writes an action handler runs, inside the action's transaction: `create`, `update`,
+ * `upsertBy`, the batch methods, `delete`, `link` and `unlink` of entity handles require it, and the
+ * member writes of the `User` handle. `prepare` never has it.
+ */
+export declare class OntologyWrites extends OntologyWrites_base {
+}
+/** Stable invocation and creation identities for actions that attach upload tickets. */
+export interface ActionRunOptions {
+    readonly idempotencyKey?: string;
+    readonly createIntent?: string;
+}
+declare const OntologyActions_base: Context.ServiceClass<OntologyActions, "@segmentstream/ontology/OntologyActions", {
+    readonly run: (input: {
+        /** The entity's wire name, `lead`. */
+        readonly entity: string;
+        /** The action's wire name, `add_note`. */
+        readonly action: string;
+        /** The input in TypeScript names, as the action's handler receives it decoded. */
+        readonly input: unknown;
+        readonly options?: ActionRunOptions;
+    }) => Effect.Effect<unknown, ActionError | ConnectionError>;
+}>;
+/**
+ * Runs an authored action as the current caller, through the same path as the action's HTTP route:
+ * its permission check, validation, transaction, history and after-commit hook. What
+ * `Lead.actions.addNote(input)` requires. A workflow step's `run` provides it; action handlers do
+ * not have it, since an action never runs another action.
+ */
+export declare class OntologyActions extends OntologyActions_base {
+}
+/**
+ * The data access an action handler runs against, inside the action's transaction: the reads and the
+ * writes. The ontology service provides it; this package declares only the contract. Entity handles
+ * (`Lead.get`, `Lead.create`, …) call it with their entity's name and type the records it returns, so
+ * the runtime must decode every record against that entity's definition before returning it.
+ */
+export type OntologyRuntime = OntologyReads | OntologyWrites;
+/** One implementation of both the reads and the writes, as the SQL runtime provides them. */
+export type OntologyRuntimeService = ReadsService & WritesService;
+export declare const OntologyRuntime: {
+    /** Types an implementation of the reads and the writes. */
+    of: (service: OntologyRuntimeService) => OntologyRuntimeService;
+    /** A context holding the implementation as both {@link OntologyReads} and {@link OntologyWrites}. */
+    context: (service: OntologyRuntimeService) => Context.Context<OntologyRuntime>;
+    /** Provides the implementation as both {@link OntologyReads} and {@link OntologyWrites}. */
+    provide: (service: OntologyRuntimeService) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, Exclude<R, OntologyRuntime>>;
+};
+export {};

package/dist/runtime.js

@@ -0,0 +1,31 @@
+import { Context, Effect } from "effect";
+/**
+ * The reads an action runs against: `get`, `find` and `queryMetrics` of entity handles require it. An
+ * action's `prepare` has the reads alone, outside any transaction; its `handler` has them inside
+ * the transaction, with {@link OntologyWrites}.
+ */
+export class OntologyReads extends Context.Service()("@segmentstream/ontology/OntologyReads") {
+}
+/**
+ * The writes an action handler runs, inside the action's transaction: `create`, `update`,
+ * `upsertBy`, the batch methods, `delete`, `link` and `unlink` of entity handles require it, and the
+ * member writes of the `User` handle. `prepare` never has it.
+ */
+export class OntologyWrites extends Context.Service()("@segmentstream/ontology/OntologyWrites") {
+}
+/**
+ * Runs an authored action as the current caller, through the same path as the action's HTTP route:
+ * its permission check, validation, transaction, history and after-commit hook. What
+ * `Lead.actions.addNote(input)` requires. A workflow step's `run` provides it; action handlers do
+ * not have it, since an action never runs another action.
+ */
+export class OntologyActions extends Context.Service()("@segmentstream/ontology/OntologyActions") {
+}
+export const OntologyRuntime = {
+    /** Types an implementation of the reads and the writes. */
+    of: (service) => service,
+    /** A context holding the implementation as both {@link OntologyReads} and {@link OntologyWrites}. */
+    context: (service) => Context.make(OntologyReads, service).pipe(Context.add(OntologyWrites, service)),
+    /** Provides the implementation as both {@link OntologyReads} and {@link OntologyWrites}. */
+    provide: (service) => (effect) => Effect.provideContext(effect, OntologyRuntime.context(service)),
+};

package/dist/server.d.ts

@@ -0,0 +1,23 @@
+import { type PlatformWorkflows } from "./workflow-runtime.js";
+/**
+ * Prepares the process for serving the ontology's runs; the starter's `server/plugin.ts` calls it
+ * at startup. Until the flow handler loads, which sets the Workflow SDK's base path itself from the
+ * build, it sets the base path to `/api/ontology`, so that runs started first call back at
+ * `/api/ontology/.well-known/workflow/v1/*`; once a base path is set it changes nothing. It also
+ * registers synchronous argument codecs and the Workflow SDK's runtime operations, loaded on
+ * first use, for the service's workflow routes, which refuse to serve until registered. Only this
+ * entry exports it, so that neither the service nor a workflow file's imports load the Workflow SDK.
+ *
+ * This process serves the ontology's queue only, so it names the ontology's queue namespace in
+ * `WORKFLOW_QUEUE_NAMESPACE`, where the Workflow SDK reads it whenever its API takes none:
+ * `resumeHook`, which an agent task's result resumes its workflow with, enqueues the run there.
+ * `start` and the flow handler name the namespace themselves.
+ */
+export declare function installWorkflowRuntime(): void;
+/**
+ * Registers the platform's workflow functions, compiled by the Workflow SDK in the server build:
+ * the plugin `ontologyWorkflows()` generates calls it at startup with the functions of the file it
+ * wrote beside the workspace's workflows. Without it, an action whose triggers may fire is refused,
+ * since the service could not arm the recovery run that guarantees its starts.
+ */
+export declare function registerPlatformWorkflows(workflows: PlatformWorkflows): void;

package/dist/server.js

@@ -0,0 +1,107 @@
+/**
+ * The ontology service's server-side setup, for the starter's `server/plugin.ts`. This entry loads
+ * the Workflow SDK; the package root and the `workflows` entry, which workflow files import and the
+ * Workflow SDK bundles for a runtime without Node built-ins, do not.
+ */
+import { setWorkflowBasePath } from "@workflow/utils";
+import { deploymentFromEnv, requireDeploymentCapability } from "./deployment.js";
+import { setPlatformWorkflows, setWorkflowSdk, } from "./workflow-runtime.js";
+import { ONTOLOGY_QUEUE_NAMESPACE, WORKFLOW_BASE_PATH } from "./workflow-topics.js";
+import { installWorkflowArgumentCodecs } from "./service/workflow-argument-serialization.js";
+import { installWorkflowLogging } from "./service/workflow-logging.js";
+import { fenceWorkflowQueue } from "./service/workflow-queue-fence.js";
+const BASE_PATH = Symbol.for("@workflow/core/basePath");
+const globals = globalThis;
+let preparingCallback;
+/**
+ * Prepares the process for serving the ontology's runs; the starter's `server/plugin.ts` calls it
+ * at startup. Until the flow handler loads, which sets the Workflow SDK's base path itself from the
+ * build, it sets the base path to `/api/ontology`, so that runs started first call back at
+ * `/api/ontology/.well-known/workflow/v1/*`; once a base path is set it changes nothing. It also
+ * registers synchronous argument codecs and the Workflow SDK's runtime operations, loaded on
+ * first use, for the service's workflow routes, which refuse to serve until registered. Only this
+ * entry exports it, so that neither the service nor a workflow file's imports load the Workflow SDK.
+ *
+ * This process serves the ontology's queue only, so it names the ontology's queue namespace in
+ * `WORKFLOW_QUEUE_NAMESPACE`, where the Workflow SDK reads it whenever its API takes none:
+ * `resumeHook`, which an agent task's result resumes its workflow with, enqueues the run there.
+ * `start` and the flow handler name the namespace themselves.
+ */
+export function installWorkflowRuntime() {
+    installWorkflowArgumentCodecs();
+    installWorkflowLogging();
+    process.env.WORKFLOW_QUEUE_NAMESPACE = ONTOLOGY_QUEUE_NAMESPACE;
+    if (globals[BASE_PATH] === undefined) {
+        setWorkflowBasePath(WORKFLOW_BASE_PATH);
+    }
+    setWorkflowSdk({
+        allocateRun: async () => {
+            const { getWorld } = await import("workflow/runtime");
+            const { allocateWorkflowRun } = await import("./service/workflow-admission-provider.js");
+            const world = await getWorld();
+            return allocateWorkflowRun(world, {
+                deploymentId: await world.getDeploymentId(),
+                namespace: ONTOLOGY_QUEUE_NAMESPACE,
+            });
+        },
+        prepareCallback: () => {
+            preparingCallback ??= (async () => {
+                const { getWorld, setWorld } = await import("workflow/runtime");
+                setWorld(fenceWorkflowQueue(await getWorld()));
+            })().catch((error) => {
+                preparingCallback = undefined;
+                throw error;
+            });
+            return preparingCallback;
+        },
+        start: async (workflow, args, options) => {
+            requireDeploymentCapability(deploymentFromEnv(), "workflows");
+            const { start } = await import("workflow/api");
+            if (options.reservation) {
+                const { getWorld } = await import("workflow/runtime");
+                const { startReservedWorkflowRun } = await import("./service/workflow-admission-provider.js");
+                const id = workflow.workflowId;
+                if (!id || !options.reservation.admissionId) {
+                    throw new Error("The durable workflow admission binding is incomplete.");
+                }
+                return startReservedWorkflowRun(await getWorld(), { workflowId: id }, args, {
+                    reservation: options.reservation,
+                    admissionId: options.reservation.admissionId,
+                    ...(options.attributes ? { attributes: options.attributes } : {}),
+                });
+            }
+            return start(workflow, args, options);
+        },
+        world: async () => {
+            const { getWorld } = await import("workflow/runtime");
+            return getWorld();
+        },
+        resumeHook: async (token, payload) => {
+            requireDeploymentCapability(deploymentFromEnv(), "workflows");
+            const { resumeHook } = await import("workflow/api");
+            return resumeHook(token, payload);
+        },
+        hydrateError: async (value, run, kind) => {
+            const { getWorld } = await import("workflow/runtime");
+            const { hydrateRunError, hydrateStepError } = await import("@workflow/core/serialization");
+            const { importKey } = await import("@workflow/core/encryption");
+            const world = await getWorld();
+            const rawKey = await world.getEncryptionKeyForRun?.(run.runId, {
+                deploymentId: run.deploymentId,
+            });
+            const key = rawKey === undefined ? undefined : await importKey(rawKey);
+            return kind === "step"
+                ? hydrateStepError(value, run.runId, key)
+                : hydrateRunError(value, run.runId, key);
+        },
+    });
+}
+/**
+ * Registers the platform's workflow functions, compiled by the Workflow SDK in the server build:
+ * the plugin `ontologyWorkflows()` generates calls it at startup with the functions of the file it
+ * wrote beside the workspace's workflows. Without it, an action whose triggers may fire is refused,
+ * since the service could not arm the recovery run that guarantees its starts.
+ */
+export function registerPlatformWorkflows(workflows) {
+    setPlatformWorkflows(workflows);
+}

package/dist/service/agent/attachments.d.ts

@@ -0,0 +1,33 @@
+import { Layer } from "effect";
+import { HttpRouter } from "effect/unstable/http";
+import { type TokenVerifier } from "../authentication.js";
+import type { AfterCommitHook } from "../config.js";
+import type { ConnectionTransportFactory } from "../connections.js";
+import { RequestId } from "../errors.js";
+import type { ApiPlan } from "../plan.js";
+import type { ReplicationKick } from "../replication.js";
+import { OntologyBackend } from "../runtime-contract.js";
+import type { RuntimeTokenVerifier } from "../runtime-identity.js";
+export { CONVERSATION_HEADER, SESSION_HEADER } from "./authentication.js";
+/**
+ * The agent's temporary attachments over HTTP (`docs/agent.md`, "Attachments"). Only the
+ * deployment's runtime token reaches these routes, acting as the member in `X-SegmentStream-Act-As`
+ * while they are active. The chat and the agent session come from the agent's runtime in
+ * `X-SegmentStream-Agent-Conversation` and `X-SegmentStream-Agent-Session`, never from the model's
+ * tool arguments. Storage checks current group participation or chat administration; private files
+ * remain confined to their sender and session.
+ */
+export declare const ATTACHMENTS_PATH = "/api/ontology/agent/attachments";
+export interface AttachmentRoutesOptions {
+    readonly plan: ApiPlan;
+    readonly hooks: ReadonlyMap<string, AfterCommitHook>;
+    readonly connections: ConnectionTransportFactory;
+    readonly replicate: ReplicationKick;
+    readonly verifyToken: TokenVerifier;
+    readonly verifyRuntime: RuntimeTokenVerifier | undefined;
+}
+/**
+ * The attachment routes. Without file storage or the agent tables, or while runtime authentication
+ * is disabled, it serves nothing.
+ */
+export declare function attachmentsLayer(options: AttachmentRoutesOptions): Layer.Layer<never, never, OntologyBackend | HttpRouter.HttpRouter | HttpRouter.Request<"Requires", RequestId>>;