latticesql 3.2.1 → 3.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -0
- package/dist/cli.js +61555 -58372
- package/dist/index.cjs +47689 -27945
- package/dist/index.d.cts +168 -6
- package/dist/index.d.ts +168 -6
- package/dist/index.js +47451 -27708
- package/docs/assistant.md +78 -11
- package/docs/cloud.md +85 -10
- package/docs/collaboration.md +5 -1
- package/docs/security.md +323 -0
- package/docs/workspaces.md +13 -0
- package/package.json +2 -1
package/dist/index.d.cts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import Database from 'better-sqlite3';
|
|
2
|
+
import { Server } from 'node:http';
|
|
2
3
|
|
|
3
4
|
/**
|
|
4
5
|
* Per-file tracking info stored in the manifest.
|
|
@@ -756,6 +757,17 @@ interface LatticeOptions {
|
|
|
756
757
|
* (or `outputFile`) are unaffected.
|
|
757
758
|
*/
|
|
758
759
|
renderSkipsEmpty?: boolean;
|
|
760
|
+
/**
|
|
761
|
+
* Reject any insert/upsert/update whose row payload exceeds this many
|
|
762
|
+
* bytes (sum of UTF-8 byte lengths of string columns + buffer lengths).
|
|
763
|
+
* Off by default — when unset, only Postgres TOAST / SQLite blob limits
|
|
764
|
+
* (~1 GB) cap row size. A modest cap (e.g. 1 MiB) blocks one class of
|
|
765
|
+
* denial-of-service from a malicious member writing oversized rows; a
|
|
766
|
+
* production deployment should set this to whatever your app actually
|
|
767
|
+
* needs plus headroom. Throws `Error("Lattice: row exceeds maxRowBytes
|
|
768
|
+
* ...")` on violation, so callers can catch it.
|
|
769
|
+
*/
|
|
770
|
+
maxRowBytes?: number;
|
|
759
771
|
}
|
|
760
772
|
/**
|
|
761
773
|
* Retention policy for the change log.
|
|
@@ -1887,6 +1899,14 @@ declare class Lattice {
|
|
|
1887
1899
|
private readonly _errorHandlers;
|
|
1888
1900
|
private readonly _reverseSeedHandlers;
|
|
1889
1901
|
private readonly _writeHooks;
|
|
1902
|
+
/** Optional cap on per-row payload bytes; see LatticeOptions.maxRowBytes. */
|
|
1903
|
+
private _maxRowBytes;
|
|
1904
|
+
/**
|
|
1905
|
+
* Reject the row if its payload exceeds `_maxRowBytes`. Cost is dominated
|
|
1906
|
+
* by Buffer.byteLength() on string columns; we skip numbers/booleans
|
|
1907
|
+
* (negligible contribution). Off when `_maxRowBytes` is unset.
|
|
1908
|
+
*/
|
|
1909
|
+
private _assertRowSize;
|
|
1890
1910
|
constructor(pathOrConfig: string | LatticeConfigInput, options?: LatticeOptions);
|
|
1891
1911
|
/**
|
|
1892
1912
|
* Open a workspace under a `.lattice` root. Resolves the root (the
|
|
@@ -2030,11 +2050,12 @@ declare class Lattice {
|
|
|
2030
2050
|
* PK skip, etc.) and refreshes the column cache so subsequent
|
|
2031
2051
|
* `query`/`insert`/`update` calls are aware of the new column.
|
|
2032
2052
|
*
|
|
2033
|
-
*
|
|
2034
|
-
*
|
|
2035
|
-
*
|
|
2036
|
-
*
|
|
2037
|
-
*
|
|
2053
|
+
* Also mirrors the new column into the SchemaManager's stored
|
|
2054
|
+
* TableDefinition, so `getRegisteredColumns()` reflects the post-ALTER
|
|
2055
|
+
* schema. This matters because the Teams `share` flow serializes that def
|
|
2056
|
+
* to propagate the schema to teammates — without the mirror, a
|
|
2057
|
+
* runtime-added column was silently dropped from the shared spec. The
|
|
2058
|
+
* runtime column cache remains what insert/update/query consult.
|
|
2038
2059
|
*
|
|
2039
2060
|
* Idempotent: if the column already exists on the table, this is a
|
|
2040
2061
|
* no-op (introspect-first; skip the ALTER).
|
|
@@ -4368,6 +4389,19 @@ declare function secureCloud(db: Lattice): Promise<void>;
|
|
|
4368
4389
|
*/
|
|
4369
4390
|
/** Setting key for the chat system prompt an owner bundles into every member's chat. */
|
|
4370
4391
|
declare const CLOUD_SETTING_SYSTEM_PROMPT = "chat_system_prompt";
|
|
4392
|
+
/**
|
|
4393
|
+
* Setting key for the owner-set workspace logo — a `data:image/(png|jpeg);base64,…`
|
|
4394
|
+
* URI that replaces the default Lattice topbar mark for every member of the cloud.
|
|
4395
|
+
* Stored as text (base64) in the shared owner-write/member-read settings table.
|
|
4396
|
+
*/
|
|
4397
|
+
declare const CLOUD_SETTING_WORKSPACE_LOGO = "workspace_logo";
|
|
4398
|
+
/**
|
|
4399
|
+
* Setting key for the workspace logo's content hash (sha256 hex of the decoded
|
|
4400
|
+
* bytes, computed server-side on write). Used as the cache-busting `?v=` token and
|
|
4401
|
+
* the `ETag` — cheap to read (~64 bytes) so a member's per-load cost is one tiny
|
|
4402
|
+
* read, and the full blob is fetched at most once per logo version.
|
|
4403
|
+
*/
|
|
4404
|
+
declare const CLOUD_SETTING_WORKSPACE_LOGO_ETAG = "workspace_logo_etag";
|
|
4371
4405
|
/**
|
|
4372
4406
|
* Install the workspace-settings table + helpers. Idempotent (`CREATE TABLE IF
|
|
4373
4407
|
* NOT EXISTS` / `CREATE OR REPLACE FUNCTION`). No-op on SQLite. Run as the cloud
|
|
@@ -4601,6 +4635,14 @@ interface CrawlOptions {
|
|
|
4601
4635
|
* degrades silently when Playwright or a browser is absent.
|
|
4602
4636
|
*/
|
|
4603
4637
|
noJs?: boolean;
|
|
4638
|
+
/**
|
|
4639
|
+
* Render with headless Chromium up front rather than only as a low-text
|
|
4640
|
+
* fallback — for SPA-heavy pages whose static HTML is an empty shell. When
|
|
4641
|
+
* Playwright is absent this degrades to the static extraction with a single
|
|
4642
|
+
* loud warning (it is an optional dependency, not a hard requirement).
|
|
4643
|
+
* Ignored when `noJs` is set. Default false.
|
|
4644
|
+
*/
|
|
4645
|
+
forceJs?: boolean;
|
|
4604
4646
|
}
|
|
4605
4647
|
declare function crawlUrl(rawUrl: string, opts?: CrawlOptions): Promise<CrawlResult>;
|
|
4606
4648
|
|
|
@@ -4678,4 +4720,124 @@ interface PdfOptions {
|
|
|
4678
4720
|
*/
|
|
4679
4721
|
declare function describePdf(auth: ClaudeAuth, path: string, opts?: PdfOptions): Promise<string>;
|
|
4680
4722
|
|
|
4681
|
-
|
|
4723
|
+
interface StartGuiServerOptions {
|
|
4724
|
+
/**
|
|
4725
|
+
* Active workspace config to open. NULL/empty ⇒ boot into the zero-workspace
|
|
4726
|
+
* "virgin" state (no active DB): the server serves the shell + the
|
|
4727
|
+
* workspace-management & onboarding routes, and every data route 409s until a
|
|
4728
|
+
* workspace is created or joined. `latticeRoot` must be set in that case so the
|
|
4729
|
+
* onboarding routes can register the new workspace.
|
|
4730
|
+
*/
|
|
4731
|
+
configPath?: string | null;
|
|
4732
|
+
/** Render output dir for the active workspace. NULL/empty in the virgin state. */
|
|
4733
|
+
outputDir?: string | null;
|
|
4734
|
+
/**
|
|
4735
|
+
* The `.lattice` root. Normally discovered from `configPath`, but MUST be passed
|
|
4736
|
+
* when booting virgin (no config to discover it from) so the management routes
|
|
4737
|
+
* can add the first workspace into the right registry.
|
|
4738
|
+
*/
|
|
4739
|
+
latticeRoot?: string | null;
|
|
4740
|
+
port?: number;
|
|
4741
|
+
openBrowser?: boolean;
|
|
4742
|
+
/**
|
|
4743
|
+
* Bind address. Defaults to `127.0.0.1`. Use `0.0.0.0` (or a specific
|
|
4744
|
+
* interface) to expose the server outside localhost.
|
|
4745
|
+
*/
|
|
4746
|
+
host?: string;
|
|
4747
|
+
/**
|
|
4748
|
+
* Workspace mode: derive canonical entity contexts for tables without one
|
|
4749
|
+
* and keep the rendered Context/ tree synced via auto-render on every write.
|
|
4750
|
+
* Set by `lattice gui` when opening a `.lattice` workspace. Off for a plain
|
|
4751
|
+
* `--config` GUI (which serves only externally-rendered context).
|
|
4752
|
+
*/
|
|
4753
|
+
autoRender?: boolean;
|
|
4754
|
+
/**
|
|
4755
|
+
* Package version string (no leading `v`), stamped into the served GUI shell
|
|
4756
|
+
* at the `<!--LATTICE_VERSION-->` placeholder (shown left of the settings
|
|
4757
|
+
* gear). Passed in by `cli.ts` (`getVersion()`) so the version is resolved in
|
|
4758
|
+
* the ESM entrypoint — server.ts is bundled to both CJS and ESM, and reading
|
|
4759
|
+
* package.json via `import.meta.url` here would break the CJS bundle. Omitted
|
|
4760
|
+
* ⇒ the version chip stays hidden.
|
|
4761
|
+
*/
|
|
4762
|
+
version?: string;
|
|
4763
|
+
/**
|
|
4764
|
+
* Realtime backstop liveness-poll interval (ms) for the RealtimeBroker. A
|
|
4765
|
+
* managed-Postgres proxy (e.g. AWS RDS Proxy) can silently drop the LISTEN
|
|
4766
|
+
* without closing the socket; the poll re-delivers missed changes regardless.
|
|
4767
|
+
* Omitted ⇒ the broker's default (20s). 0 disables it.
|
|
4768
|
+
*/
|
|
4769
|
+
realtimeWatchdogMs?: number;
|
|
4770
|
+
}
|
|
4771
|
+
interface GuiServerHandle {
|
|
4772
|
+
server: Server;
|
|
4773
|
+
port: number;
|
|
4774
|
+
url: string;
|
|
4775
|
+
close: () => Promise<void>;
|
|
4776
|
+
}
|
|
4777
|
+
declare function startGuiServer(options: StartGuiServerOptions): Promise<GuiServerHandle>;
|
|
4778
|
+
|
|
4779
|
+
/**
|
|
4780
|
+
* Durable, file-backed {@link SourceKeyStore} for production deployments.
|
|
4781
|
+
*
|
|
4782
|
+
* The default {@link InMemorySourceKeyStore} keeps source keys in process
|
|
4783
|
+
* memory only — a restart implicitly shreds every key, making every
|
|
4784
|
+
* sealed value unrecoverable. For real crypto-shred semantics you need a
|
|
4785
|
+
* shred-DURABLE store: keys that survive restarts but can be irreversibly
|
|
4786
|
+
* destroyed when you want to forget a source.
|
|
4787
|
+
*
|
|
4788
|
+
* This store writes keys to a single JSON file (one map of sourceId →
|
|
4789
|
+
* 32-byte AES key, base64-encoded). The file is created with mode 0600
|
|
4790
|
+
* and rewritten atomically (write-then-rename) on every change. An
|
|
4791
|
+
* optional passphrase enables AES-256-GCM encryption-at-rest using
|
|
4792
|
+
* scrypt-derived keys, so a stolen file is unreadable without the secret.
|
|
4793
|
+
*
|
|
4794
|
+
* **Threat-model note.** Keys should live SEPARATE from data so a
|
|
4795
|
+
* database compromise alone doesn't surrender every shredded value's
|
|
4796
|
+
* plaintext. This store satisfies that when its file is on a separate
|
|
4797
|
+
* filesystem / volume / backup-policy from the Postgres data — the
|
|
4798
|
+
* common production pattern is to mount this file from a secrets volume
|
|
4799
|
+
* (AWS Secrets Manager file ref, mounted via Secrets Store CSI; or a
|
|
4800
|
+
* dedicated EBS volume excluded from DB backups). Keeping the file on
|
|
4801
|
+
* the same disk as Postgres data is *better than InMemory* but does not
|
|
4802
|
+
* provide the strongest crypto-shred guarantee.
|
|
4803
|
+
*
|
|
4804
|
+
* For KMS-backed deployments, implement {@link SourceKeyStore} directly
|
|
4805
|
+
* against the KMS API — this class is the simplest durable option for
|
|
4806
|
+
* teams who don't want a KMS dependency.
|
|
4807
|
+
*/
|
|
4808
|
+
interface FileSourceKeyStoreOptions {
|
|
4809
|
+
/**
|
|
4810
|
+
* Absolute or relative filesystem path where the key map is persisted.
|
|
4811
|
+
* Created if missing along with its parent directory. The file is
|
|
4812
|
+
* always chmod'd to 0600 (owner read/write only) on write.
|
|
4813
|
+
*/
|
|
4814
|
+
path: string;
|
|
4815
|
+
/**
|
|
4816
|
+
* Optional passphrase. When set, the file is encrypted at rest with
|
|
4817
|
+
* AES-256-GCM under a scrypt-derived key (random salt per write). When
|
|
4818
|
+
* omitted, the file is stored as plaintext JSON — only acceptable if
|
|
4819
|
+
* the underlying filesystem already enforces secrecy (e.g. a Secrets
|
|
4820
|
+
* Manager mount, an LUKS-encrypted volume, or an HSM-backed disk).
|
|
4821
|
+
*/
|
|
4822
|
+
passphrase?: string;
|
|
4823
|
+
}
|
|
4824
|
+
declare class FileSourceKeyStore implements SourceKeyStore {
|
|
4825
|
+
private readonly path;
|
|
4826
|
+
private readonly passphrase;
|
|
4827
|
+
private readonly cache;
|
|
4828
|
+
constructor(opts: FileSourceKeyStoreOptions);
|
|
4829
|
+
get(sourceId: string): Buffer | undefined;
|
|
4830
|
+
getOrCreate(sourceId: string): Buffer;
|
|
4831
|
+
destroy(sourceId: string): void;
|
|
4832
|
+
/**
|
|
4833
|
+
* Number of keys currently held — useful for diagnostics. Not part of
|
|
4834
|
+
* the SourceKeyStore interface.
|
|
4835
|
+
*/
|
|
4836
|
+
size(): number;
|
|
4837
|
+
private load;
|
|
4838
|
+
private persist;
|
|
4839
|
+
private decodeFile;
|
|
4840
|
+
private encodeFile;
|
|
4841
|
+
}
|
|
4842
|
+
|
|
4843
|
+
export { type AddWorkspaceOptions, type AdoptNativeOptions, type AdoptResult, type ApplyWriteResult, type AudienceRowCtx, type AuditEvent, type AutoUpdateResult, type BelongsToRelation, type BelongsToSource, type BlobMetadata, type BuiltinTemplateName, CLOUD_SETTING_SYSTEM_PROMPT, CLOUD_SETTING_WORKSPACE_LOGO, CLOUD_SETTING_WORKSPACE_LOGO_ETAG, CONFIG_SUBDIR, type CatalogEntity, type CatalogRecord, type ChangeEntry, type ChangelogOptions, type ClassifyMatch, type CleanupOptions, type CleanupResult, type CloudProbeResult, type CountOptions, type CrawlOptions, type CrawlResult, type CustomSource, DEFAULT_ENTRY_TYPES, DEFAULT_TYPE_ALIASES, type DiscoveredTable, type EmbeddingsConfig, type EnrichOptions, type EnrichResult, type EnrichedSource, type EnrichmentLookup, type EntityContextDefinition, type EntityContextManifestEntry, type EntityFileManifestInfo, type EntityFileSource, type EntityFileSpec, type EntityProfileField, type EntityProfileSection, type EntityProfileTemplate, type EntityRenderSpec, type EntityRenderTemplate, type EntitySectionPerRow, type EntitySectionsTemplate, type EntityTableColumn, type EntityTableTemplate, type ExtractedObject, FileSourceKeyStore, type FileSourceKeyStoreOptions, type FilesRow, type Filter, type FilterOp, FoldCache, type FtsConfig, type FtsGroup, type FtsHit, type FtsOptions, type FtsResult, type GuiServerHandle, type HasManyRelation, type HasManySource, InMemorySourceKeyStore, InMemoryStateStore, type InitOptions, LOCAL_DB_RELPATH, Lattice, type LatticeConfig, type LatticeConfigInput, type LatticeEntityDef, type LatticeEntityRenderSpec, type LatticeFieldDef, type LatticeFieldType, type LatticeManifest, type LatticeOptions, type LinkOptions, type LlmClient, type LlmMessage, MEMBER_GROUP, type ManyToManySource, type MarkdownTableColumn, type MigrateResult, type Migration, type MigrationOptions, type MigrationProgress, type MigrationResult, type MultiTableDefinition, NATIVE_ENTITY_DEFS, NATIVE_ENTITY_NAMES, NATIVE_REGISTRY_TABLE, type Observation, type OrderBySpec, type OrganizeOptions, type OrganizeResult, type OrganizedCreation, type OrganizedLink, type ParseError, type ParseResult, type ParsedConfig, type PdfOptions, type PdfSenderInput, type PkLookup, PostgresAdapter, type PostgresAdapterOptions, type PreparedStatement, type PrimaryKey, ProgressThrottle, type QueryOptions, READ_ONLY_HEADER, ROOT_DIRNAME, type ReadOnlyHeaderOptions, type ReconcileOptions, type ReconcileResult, type RefKind, type RefProvider, type ReferenceMetadata, ReferenceUnavailableError, type Relation, type RemoteBlobStore, type RenderHooks, type RenderOptions, type RenderProgress, type RenderProgressCallback, type RenderProgressKind, type RenderResult, type RenderSpec, type ReportConfig, type ReportResult, type ReportSection, type ReportSectionResult, type ResolveOptions, type ReverseSeedDetection, type ReverseSeedResult, type ReverseSeedTableResult, type ReverseSyncError, type ReverseSyncResult, type ReverseSyncUpdate, type RewardScores, type Row, type RowVisibilityDefault, type S3Config, type S3StoreConfig, S3UnavailableError, SQLiteAdapter, type SchemaEntity, type SearchOptions, type SearchResult, type SecurityOptions, type SeedConfig, type SeedLinkSpec, SeedReconciliationError, type SeedResult, type SelfSource, type SessionEntry, type SessionParseOptions, type SessionWriteEntry, type SessionWriteOp, type SessionWriteParseResult, type SourceHandle, type SourceKeyStore, type SourceMetadata, type SourceQueryOptions, SourceShreddedError, type StartGuiServerOptions, type StopFn, type StorageAdapter, type SyncResult, type TableDefinition, type TablePolicy, type TemplateRenderSpec, type TurnParams, type TurnResult, type UnresolvedLink, type UpsertByNaturalKeyOptions, type UserIdentity, type UserPreferences, type Viewer, type VisionOptions, type VisionSenderInput, WORKSPACES_SUBDIR, type WatchOptions, type WorkspacePaths, type WorkspaceRecord, type WorkspaceRegistry, type WriteHook, type WriteHookContext, type WritebackDefinition, type WritebackStateStore, type WritebackValidationResult, activeWorkspaceLabel, addWorkspace, adoptNativeEntities, analyticsEnabled, applyTokenBudget, applyWriteEntry, archiveLocalSqlite, assertSafeUrl, attachBlob, audiencePredicate, audienceViewSql, autoFtsColumns, autoUpdate, backfillOwnership, canManageRoles, classifyLinks, cloudRlsInstalled, configDir, contentHash, crawlUrl, createReadOnlyHeader, createS3Store, createSQLiteStateStore, decrypt, defaultWorkspaceYaml, deleteDbCredential, deleteToken, deriveCanonicalContexts, deriveKey, describeImage, describePdf, discoverCloudTables, enableAudienceView, enableChangelogRls, enableRlsForTable, encrypt, enrichKnowledge, ensureFtsIndex, ensureLatticeRoot, entityFileNames, estimateTokens, extractObjects, findLatticeRoot, fixSchemaConflicts, foldEntity, frontmatter, ftsTableName, fullTextSearch, generateEntryId, generateMemberPassword, generateWriteEntryId, getActiveWorkspace, getCloudSetting, getDbCredential, getOrCreateMasterKey, getTablePolicy, getWorkspace, grantCell, hasFtsIndex, hashFile, importLegacyUserConfig, installCloudRls, installCloudSettings, isEncrypted, isNativeEntity, isPostgresUrl, isPrivateIp, isRowAudience, isV1EntityFiles, listDbCredentials, listNativeBindings, listTokens, listWorkspaces, loadColumnPolicy, manifestPath, markdownTable, memberRoleName, migrateLatticeData, normalizeEntityFiles, observationVisible, observationsFromChange, openTargetLatticeForMigration, openUnderSource, organizeSource, parseConfigFile, parseConfigString, parseMarkdownEntries, parseMatches, parseObjects, parseSessionMD, parseSessionWrites, probeCloud, providerForUrl, provisionMemberRole, readIdentity, readManifest, readPreferences, readRegistry, readToken, referenceLocalFile, referenceUrl, regenerateAudienceViewFromDb, registerNativeEntities, registryPath, resolveActiveS3Config, resolveLatticeRoot, resolveSource, resolveWorkspacePaths, revokeCell, revokeMemberRole, rootConfigDir, s3Key, saveDbCredential, saveDbCredentialForTeam, sealUnderSource, secureCloud, seedColumnPolicyFromYaml, setActiveWorkspace, setCloudSetting, setColumnAudience, setRowVisibility, setTableDefaultVisibility, setTableNeverShare, shredSource, slugify, startGuiServer, summarizeText, tableNeedsAudienceView, toSafeDirName, truncate, validateEntryId, workspaceBlobsDir, workspaceConfigPath, workspaceContextDir, workspaceDataDir, workspaceDbPath, workspaceDir, workspacesDir, writeIdentity, writeManifest, writePreferences, writeRegistry, writeToken };
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import Database from 'better-sqlite3';
|
|
2
|
+
import { Server } from 'node:http';
|
|
2
3
|
|
|
3
4
|
/**
|
|
4
5
|
* Per-file tracking info stored in the manifest.
|
|
@@ -756,6 +757,17 @@ interface LatticeOptions {
|
|
|
756
757
|
* (or `outputFile`) are unaffected.
|
|
757
758
|
*/
|
|
758
759
|
renderSkipsEmpty?: boolean;
|
|
760
|
+
/**
|
|
761
|
+
* Reject any insert/upsert/update whose row payload exceeds this many
|
|
762
|
+
* bytes (sum of UTF-8 byte lengths of string columns + buffer lengths).
|
|
763
|
+
* Off by default — when unset, only Postgres TOAST / SQLite blob limits
|
|
764
|
+
* (~1 GB) cap row size. A modest cap (e.g. 1 MiB) blocks one class of
|
|
765
|
+
* denial-of-service from a malicious member writing oversized rows; a
|
|
766
|
+
* production deployment should set this to whatever your app actually
|
|
767
|
+
* needs plus headroom. Throws `Error("Lattice: row exceeds maxRowBytes
|
|
768
|
+
* ...")` on violation, so callers can catch it.
|
|
769
|
+
*/
|
|
770
|
+
maxRowBytes?: number;
|
|
759
771
|
}
|
|
760
772
|
/**
|
|
761
773
|
* Retention policy for the change log.
|
|
@@ -1887,6 +1899,14 @@ declare class Lattice {
|
|
|
1887
1899
|
private readonly _errorHandlers;
|
|
1888
1900
|
private readonly _reverseSeedHandlers;
|
|
1889
1901
|
private readonly _writeHooks;
|
|
1902
|
+
/** Optional cap on per-row payload bytes; see LatticeOptions.maxRowBytes. */
|
|
1903
|
+
private _maxRowBytes;
|
|
1904
|
+
/**
|
|
1905
|
+
* Reject the row if its payload exceeds `_maxRowBytes`. Cost is dominated
|
|
1906
|
+
* by Buffer.byteLength() on string columns; we skip numbers/booleans
|
|
1907
|
+
* (negligible contribution). Off when `_maxRowBytes` is unset.
|
|
1908
|
+
*/
|
|
1909
|
+
private _assertRowSize;
|
|
1890
1910
|
constructor(pathOrConfig: string | LatticeConfigInput, options?: LatticeOptions);
|
|
1891
1911
|
/**
|
|
1892
1912
|
* Open a workspace under a `.lattice` root. Resolves the root (the
|
|
@@ -2030,11 +2050,12 @@ declare class Lattice {
|
|
|
2030
2050
|
* PK skip, etc.) and refreshes the column cache so subsequent
|
|
2031
2051
|
* `query`/`insert`/`update` calls are aware of the new column.
|
|
2032
2052
|
*
|
|
2033
|
-
*
|
|
2034
|
-
*
|
|
2035
|
-
*
|
|
2036
|
-
*
|
|
2037
|
-
*
|
|
2053
|
+
* Also mirrors the new column into the SchemaManager's stored
|
|
2054
|
+
* TableDefinition, so `getRegisteredColumns()` reflects the post-ALTER
|
|
2055
|
+
* schema. This matters because the Teams `share` flow serializes that def
|
|
2056
|
+
* to propagate the schema to teammates — without the mirror, a
|
|
2057
|
+
* runtime-added column was silently dropped from the shared spec. The
|
|
2058
|
+
* runtime column cache remains what insert/update/query consult.
|
|
2038
2059
|
*
|
|
2039
2060
|
* Idempotent: if the column already exists on the table, this is a
|
|
2040
2061
|
* no-op (introspect-first; skip the ALTER).
|
|
@@ -4368,6 +4389,19 @@ declare function secureCloud(db: Lattice): Promise<void>;
|
|
|
4368
4389
|
*/
|
|
4369
4390
|
/** Setting key for the chat system prompt an owner bundles into every member's chat. */
|
|
4370
4391
|
declare const CLOUD_SETTING_SYSTEM_PROMPT = "chat_system_prompt";
|
|
4392
|
+
/**
|
|
4393
|
+
* Setting key for the owner-set workspace logo — a `data:image/(png|jpeg);base64,…`
|
|
4394
|
+
* URI that replaces the default Lattice topbar mark for every member of the cloud.
|
|
4395
|
+
* Stored as text (base64) in the shared owner-write/member-read settings table.
|
|
4396
|
+
*/
|
|
4397
|
+
declare const CLOUD_SETTING_WORKSPACE_LOGO = "workspace_logo";
|
|
4398
|
+
/**
|
|
4399
|
+
* Setting key for the workspace logo's content hash (sha256 hex of the decoded
|
|
4400
|
+
* bytes, computed server-side on write). Used as the cache-busting `?v=` token and
|
|
4401
|
+
* the `ETag` — cheap to read (~64 bytes) so a member's per-load cost is one tiny
|
|
4402
|
+
* read, and the full blob is fetched at most once per logo version.
|
|
4403
|
+
*/
|
|
4404
|
+
declare const CLOUD_SETTING_WORKSPACE_LOGO_ETAG = "workspace_logo_etag";
|
|
4371
4405
|
/**
|
|
4372
4406
|
* Install the workspace-settings table + helpers. Idempotent (`CREATE TABLE IF
|
|
4373
4407
|
* NOT EXISTS` / `CREATE OR REPLACE FUNCTION`). No-op on SQLite. Run as the cloud
|
|
@@ -4601,6 +4635,14 @@ interface CrawlOptions {
|
|
|
4601
4635
|
* degrades silently when Playwright or a browser is absent.
|
|
4602
4636
|
*/
|
|
4603
4637
|
noJs?: boolean;
|
|
4638
|
+
/**
|
|
4639
|
+
* Render with headless Chromium up front rather than only as a low-text
|
|
4640
|
+
* fallback — for SPA-heavy pages whose static HTML is an empty shell. When
|
|
4641
|
+
* Playwright is absent this degrades to the static extraction with a single
|
|
4642
|
+
* loud warning (it is an optional dependency, not a hard requirement).
|
|
4643
|
+
* Ignored when `noJs` is set. Default false.
|
|
4644
|
+
*/
|
|
4645
|
+
forceJs?: boolean;
|
|
4604
4646
|
}
|
|
4605
4647
|
declare function crawlUrl(rawUrl: string, opts?: CrawlOptions): Promise<CrawlResult>;
|
|
4606
4648
|
|
|
@@ -4678,4 +4720,124 @@ interface PdfOptions {
|
|
|
4678
4720
|
*/
|
|
4679
4721
|
declare function describePdf(auth: ClaudeAuth, path: string, opts?: PdfOptions): Promise<string>;
|
|
4680
4722
|
|
|
4681
|
-
|
|
4723
|
+
interface StartGuiServerOptions {
|
|
4724
|
+
/**
|
|
4725
|
+
* Active workspace config to open. NULL/empty ⇒ boot into the zero-workspace
|
|
4726
|
+
* "virgin" state (no active DB): the server serves the shell + the
|
|
4727
|
+
* workspace-management & onboarding routes, and every data route 409s until a
|
|
4728
|
+
* workspace is created or joined. `latticeRoot` must be set in that case so the
|
|
4729
|
+
* onboarding routes can register the new workspace.
|
|
4730
|
+
*/
|
|
4731
|
+
configPath?: string | null;
|
|
4732
|
+
/** Render output dir for the active workspace. NULL/empty in the virgin state. */
|
|
4733
|
+
outputDir?: string | null;
|
|
4734
|
+
/**
|
|
4735
|
+
* The `.lattice` root. Normally discovered from `configPath`, but MUST be passed
|
|
4736
|
+
* when booting virgin (no config to discover it from) so the management routes
|
|
4737
|
+
* can add the first workspace into the right registry.
|
|
4738
|
+
*/
|
|
4739
|
+
latticeRoot?: string | null;
|
|
4740
|
+
port?: number;
|
|
4741
|
+
openBrowser?: boolean;
|
|
4742
|
+
/**
|
|
4743
|
+
* Bind address. Defaults to `127.0.0.1`. Use `0.0.0.0` (or a specific
|
|
4744
|
+
* interface) to expose the server outside localhost.
|
|
4745
|
+
*/
|
|
4746
|
+
host?: string;
|
|
4747
|
+
/**
|
|
4748
|
+
* Workspace mode: derive canonical entity contexts for tables without one
|
|
4749
|
+
* and keep the rendered Context/ tree synced via auto-render on every write.
|
|
4750
|
+
* Set by `lattice gui` when opening a `.lattice` workspace. Off for a plain
|
|
4751
|
+
* `--config` GUI (which serves only externally-rendered context).
|
|
4752
|
+
*/
|
|
4753
|
+
autoRender?: boolean;
|
|
4754
|
+
/**
|
|
4755
|
+
* Package version string (no leading `v`), stamped into the served GUI shell
|
|
4756
|
+
* at the `<!--LATTICE_VERSION-->` placeholder (shown left of the settings
|
|
4757
|
+
* gear). Passed in by `cli.ts` (`getVersion()`) so the version is resolved in
|
|
4758
|
+
* the ESM entrypoint — server.ts is bundled to both CJS and ESM, and reading
|
|
4759
|
+
* package.json via `import.meta.url` here would break the CJS bundle. Omitted
|
|
4760
|
+
* ⇒ the version chip stays hidden.
|
|
4761
|
+
*/
|
|
4762
|
+
version?: string;
|
|
4763
|
+
/**
|
|
4764
|
+
* Realtime backstop liveness-poll interval (ms) for the RealtimeBroker. A
|
|
4765
|
+
* managed-Postgres proxy (e.g. AWS RDS Proxy) can silently drop the LISTEN
|
|
4766
|
+
* without closing the socket; the poll re-delivers missed changes regardless.
|
|
4767
|
+
* Omitted ⇒ the broker's default (20s). 0 disables it.
|
|
4768
|
+
*/
|
|
4769
|
+
realtimeWatchdogMs?: number;
|
|
4770
|
+
}
|
|
4771
|
+
interface GuiServerHandle {
|
|
4772
|
+
server: Server;
|
|
4773
|
+
port: number;
|
|
4774
|
+
url: string;
|
|
4775
|
+
close: () => Promise<void>;
|
|
4776
|
+
}
|
|
4777
|
+
declare function startGuiServer(options: StartGuiServerOptions): Promise<GuiServerHandle>;
|
|
4778
|
+
|
|
4779
|
+
/**
|
|
4780
|
+
* Durable, file-backed {@link SourceKeyStore} for production deployments.
|
|
4781
|
+
*
|
|
4782
|
+
* The default {@link InMemorySourceKeyStore} keeps source keys in process
|
|
4783
|
+
* memory only — a restart implicitly shreds every key, making every
|
|
4784
|
+
* sealed value unrecoverable. For real crypto-shred semantics you need a
|
|
4785
|
+
* shred-DURABLE store: keys that survive restarts but can be irreversibly
|
|
4786
|
+
* destroyed when you want to forget a source.
|
|
4787
|
+
*
|
|
4788
|
+
* This store writes keys to a single JSON file (one map of sourceId →
|
|
4789
|
+
* 32-byte AES key, base64-encoded). The file is created with mode 0600
|
|
4790
|
+
* and rewritten atomically (write-then-rename) on every change. An
|
|
4791
|
+
* optional passphrase enables AES-256-GCM encryption-at-rest using
|
|
4792
|
+
* scrypt-derived keys, so a stolen file is unreadable without the secret.
|
|
4793
|
+
*
|
|
4794
|
+
* **Threat-model note.** Keys should live SEPARATE from data so a
|
|
4795
|
+
* database compromise alone doesn't surrender every shredded value's
|
|
4796
|
+
* plaintext. This store satisfies that when its file is on a separate
|
|
4797
|
+
* filesystem / volume / backup-policy from the Postgres data — the
|
|
4798
|
+
* common production pattern is to mount this file from a secrets volume
|
|
4799
|
+
* (AWS Secrets Manager file ref, mounted via Secrets Store CSI; or a
|
|
4800
|
+
* dedicated EBS volume excluded from DB backups). Keeping the file on
|
|
4801
|
+
* the same disk as Postgres data is *better than InMemory* but does not
|
|
4802
|
+
* provide the strongest crypto-shred guarantee.
|
|
4803
|
+
*
|
|
4804
|
+
* For KMS-backed deployments, implement {@link SourceKeyStore} directly
|
|
4805
|
+
* against the KMS API — this class is the simplest durable option for
|
|
4806
|
+
* teams who don't want a KMS dependency.
|
|
4807
|
+
*/
|
|
4808
|
+
interface FileSourceKeyStoreOptions {
|
|
4809
|
+
/**
|
|
4810
|
+
* Absolute or relative filesystem path where the key map is persisted.
|
|
4811
|
+
* Created if missing along with its parent directory. The file is
|
|
4812
|
+
* always chmod'd to 0600 (owner read/write only) on write.
|
|
4813
|
+
*/
|
|
4814
|
+
path: string;
|
|
4815
|
+
/**
|
|
4816
|
+
* Optional passphrase. When set, the file is encrypted at rest with
|
|
4817
|
+
* AES-256-GCM under a scrypt-derived key (random salt per write). When
|
|
4818
|
+
* omitted, the file is stored as plaintext JSON — only acceptable if
|
|
4819
|
+
* the underlying filesystem already enforces secrecy (e.g. a Secrets
|
|
4820
|
+
* Manager mount, an LUKS-encrypted volume, or an HSM-backed disk).
|
|
4821
|
+
*/
|
|
4822
|
+
passphrase?: string;
|
|
4823
|
+
}
|
|
4824
|
+
declare class FileSourceKeyStore implements SourceKeyStore {
|
|
4825
|
+
private readonly path;
|
|
4826
|
+
private readonly passphrase;
|
|
4827
|
+
private readonly cache;
|
|
4828
|
+
constructor(opts: FileSourceKeyStoreOptions);
|
|
4829
|
+
get(sourceId: string): Buffer | undefined;
|
|
4830
|
+
getOrCreate(sourceId: string): Buffer;
|
|
4831
|
+
destroy(sourceId: string): void;
|
|
4832
|
+
/**
|
|
4833
|
+
* Number of keys currently held — useful for diagnostics. Not part of
|
|
4834
|
+
* the SourceKeyStore interface.
|
|
4835
|
+
*/
|
|
4836
|
+
size(): number;
|
|
4837
|
+
private load;
|
|
4838
|
+
private persist;
|
|
4839
|
+
private decodeFile;
|
|
4840
|
+
private encodeFile;
|
|
4841
|
+
}
|
|
4842
|
+
|
|
4843
|
+
export { type AddWorkspaceOptions, type AdoptNativeOptions, type AdoptResult, type ApplyWriteResult, type AudienceRowCtx, type AuditEvent, type AutoUpdateResult, type BelongsToRelation, type BelongsToSource, type BlobMetadata, type BuiltinTemplateName, CLOUD_SETTING_SYSTEM_PROMPT, CLOUD_SETTING_WORKSPACE_LOGO, CLOUD_SETTING_WORKSPACE_LOGO_ETAG, CONFIG_SUBDIR, type CatalogEntity, type CatalogRecord, type ChangeEntry, type ChangelogOptions, type ClassifyMatch, type CleanupOptions, type CleanupResult, type CloudProbeResult, type CountOptions, type CrawlOptions, type CrawlResult, type CustomSource, DEFAULT_ENTRY_TYPES, DEFAULT_TYPE_ALIASES, type DiscoveredTable, type EmbeddingsConfig, type EnrichOptions, type EnrichResult, type EnrichedSource, type EnrichmentLookup, type EntityContextDefinition, type EntityContextManifestEntry, type EntityFileManifestInfo, type EntityFileSource, type EntityFileSpec, type EntityProfileField, type EntityProfileSection, type EntityProfileTemplate, type EntityRenderSpec, type EntityRenderTemplate, type EntitySectionPerRow, type EntitySectionsTemplate, type EntityTableColumn, type EntityTableTemplate, type ExtractedObject, FileSourceKeyStore, type FileSourceKeyStoreOptions, type FilesRow, type Filter, type FilterOp, FoldCache, type FtsConfig, type FtsGroup, type FtsHit, type FtsOptions, type FtsResult, type GuiServerHandle, type HasManyRelation, type HasManySource, InMemorySourceKeyStore, InMemoryStateStore, type InitOptions, LOCAL_DB_RELPATH, Lattice, type LatticeConfig, type LatticeConfigInput, type LatticeEntityDef, type LatticeEntityRenderSpec, type LatticeFieldDef, type LatticeFieldType, type LatticeManifest, type LatticeOptions, type LinkOptions, type LlmClient, type LlmMessage, MEMBER_GROUP, type ManyToManySource, type MarkdownTableColumn, type MigrateResult, type Migration, type MigrationOptions, type MigrationProgress, type MigrationResult, type MultiTableDefinition, NATIVE_ENTITY_DEFS, NATIVE_ENTITY_NAMES, NATIVE_REGISTRY_TABLE, type Observation, type OrderBySpec, type OrganizeOptions, type OrganizeResult, type OrganizedCreation, type OrganizedLink, type ParseError, type ParseResult, type ParsedConfig, type PdfOptions, type PdfSenderInput, type PkLookup, PostgresAdapter, type PostgresAdapterOptions, type PreparedStatement, type PrimaryKey, ProgressThrottle, type QueryOptions, READ_ONLY_HEADER, ROOT_DIRNAME, type ReadOnlyHeaderOptions, type ReconcileOptions, type ReconcileResult, type RefKind, type RefProvider, type ReferenceMetadata, ReferenceUnavailableError, type Relation, type RemoteBlobStore, type RenderHooks, type RenderOptions, type RenderProgress, type RenderProgressCallback, type RenderProgressKind, type RenderResult, type RenderSpec, type ReportConfig, type ReportResult, type ReportSection, type ReportSectionResult, type ResolveOptions, type ReverseSeedDetection, type ReverseSeedResult, type ReverseSeedTableResult, type ReverseSyncError, type ReverseSyncResult, type ReverseSyncUpdate, type RewardScores, type Row, type RowVisibilityDefault, type S3Config, type S3StoreConfig, S3UnavailableError, SQLiteAdapter, type SchemaEntity, type SearchOptions, type SearchResult, type SecurityOptions, type SeedConfig, type SeedLinkSpec, SeedReconciliationError, type SeedResult, type SelfSource, type SessionEntry, type SessionParseOptions, type SessionWriteEntry, type SessionWriteOp, type SessionWriteParseResult, type SourceHandle, type SourceKeyStore, type SourceMetadata, type SourceQueryOptions, SourceShreddedError, type StartGuiServerOptions, type StopFn, type StorageAdapter, type SyncResult, type TableDefinition, type TablePolicy, type TemplateRenderSpec, type TurnParams, type TurnResult, type UnresolvedLink, type UpsertByNaturalKeyOptions, type UserIdentity, type UserPreferences, type Viewer, type VisionOptions, type VisionSenderInput, WORKSPACES_SUBDIR, type WatchOptions, type WorkspacePaths, type WorkspaceRecord, type WorkspaceRegistry, type WriteHook, type WriteHookContext, type WritebackDefinition, type WritebackStateStore, type WritebackValidationResult, activeWorkspaceLabel, addWorkspace, adoptNativeEntities, analyticsEnabled, applyTokenBudget, applyWriteEntry, archiveLocalSqlite, assertSafeUrl, attachBlob, audiencePredicate, audienceViewSql, autoFtsColumns, autoUpdate, backfillOwnership, canManageRoles, classifyLinks, cloudRlsInstalled, configDir, contentHash, crawlUrl, createReadOnlyHeader, createS3Store, createSQLiteStateStore, decrypt, defaultWorkspaceYaml, deleteDbCredential, deleteToken, deriveCanonicalContexts, deriveKey, describeImage, describePdf, discoverCloudTables, enableAudienceView, enableChangelogRls, enableRlsForTable, encrypt, enrichKnowledge, ensureFtsIndex, ensureLatticeRoot, entityFileNames, estimateTokens, extractObjects, findLatticeRoot, fixSchemaConflicts, foldEntity, frontmatter, ftsTableName, fullTextSearch, generateEntryId, generateMemberPassword, generateWriteEntryId, getActiveWorkspace, getCloudSetting, getDbCredential, getOrCreateMasterKey, getTablePolicy, getWorkspace, grantCell, hasFtsIndex, hashFile, importLegacyUserConfig, installCloudRls, installCloudSettings, isEncrypted, isNativeEntity, isPostgresUrl, isPrivateIp, isRowAudience, isV1EntityFiles, listDbCredentials, listNativeBindings, listTokens, listWorkspaces, loadColumnPolicy, manifestPath, markdownTable, memberRoleName, migrateLatticeData, normalizeEntityFiles, observationVisible, observationsFromChange, openTargetLatticeForMigration, openUnderSource, organizeSource, parseConfigFile, parseConfigString, parseMarkdownEntries, parseMatches, parseObjects, parseSessionMD, parseSessionWrites, probeCloud, providerForUrl, provisionMemberRole, readIdentity, readManifest, readPreferences, readRegistry, readToken, referenceLocalFile, referenceUrl, regenerateAudienceViewFromDb, registerNativeEntities, registryPath, resolveActiveS3Config, resolveLatticeRoot, resolveSource, resolveWorkspacePaths, revokeCell, revokeMemberRole, rootConfigDir, s3Key, saveDbCredential, saveDbCredentialForTeam, sealUnderSource, secureCloud, seedColumnPolicyFromYaml, setActiveWorkspace, setCloudSetting, setColumnAudience, setRowVisibility, setTableDefaultVisibility, setTableNeverShare, shredSource, slugify, startGuiServer, summarizeText, tableNeedsAudienceView, toSafeDirName, truncate, validateEntryId, workspaceBlobsDir, workspaceConfigPath, workspaceContextDir, workspaceDataDir, workspaceDbPath, workspaceDir, workspacesDir, writeIdentity, writeManifest, writePreferences, writeRegistry, writeToken };
|