@devilsdev/rag-core 3.8.0 → 3.8.1

package/dist/index.cjs

@@ -302,6 +302,19 @@ var require_plugin_signature_verifier = __commonJS({
         format: "jwk"
       });
     }
+    function rejectReservedKeys(value) {
+      if (value === null || typeof value !== "object") return;
+      if (Array.isArray(value)) {
+        value.forEach(rejectReservedKeys);
+        return;
+      }
+      for (const key of Object.keys(value)) {
+        if (key === "__proto__") {
+          throw new Error(`Invalid manifest: reserved key "${key}"`);
+        }
+        rejectReservedKeys(value[key]);
+      }
+    }
     function computeContentDigest({ files = [], baseDir, contents = {} } = {}) {
       const root = path.resolve(baseDir || process.cwd());
       const entries = /* @__PURE__ */ new Map();
@@ -465,7 +478,7 @@ var require_plugin_signature_verifier = __commonJS({
        * @private
        */
       _verifyContentDigest(canonicalManifest, content) {
-        const declared = canonicalManifest.contentDigest;
+        const declared = Object.hasOwn(canonicalManifest, "contentDigest") ? canonicalManifest.contentDigest : void 0;
         const hasContent = content && (Array.isArray(content.files) && content.files.length > 0 || content.contents && Object.keys(content.contents).length > 0);
         if (declared === void 0 || declared === null) {
           if (this.requireContentDigest) {
@@ -514,6 +527,7 @@ var require_plugin_signature_verifier = __commonJS({
        */
       _canonicalizeManifest(manifest) {
         const canonical = JSON.parse(JSON.stringify(manifest));
+        rejectReservedKeys(canonical);
         delete canonical.signature;
         delete canonical.signerId;
         delete canonical.signedAt;
@@ -1370,7 +1384,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@devilsdev/rag-pipeline-utils",
-      version: "3.8.0",
+      version: "3.8.1",
       description: "Composable retrieval-augmented generation (RAG) for Node.js: grounded citations, evaluation, guardrails, hybrid retrieval and a CLI.",
       main: "dist/index.cjs",
       type: "commonjs",
@@ -1629,10 +1643,10 @@ var require_package = __commonJS({
         "why-is-node-running": "^3.2.2"
       },
       dependencies: {
-        "@devilsdev/rag-connectors": "3.8.0",
-        "@devilsdev/rag-core": "3.8.0",
-        "@devilsdev/rag-eval": "3.8.0",
-        "@devilsdev/rag-guardrails": "3.8.0",
+        "@devilsdev/rag-connectors": "3.8.1",
+        "@devilsdev/rag-core": "3.8.1",
+        "@devilsdev/rag-eval": "3.8.1",
+        "@devilsdev/rag-guardrails": "3.8.1",
         ajv: "^8.17.1",
         axios: "^1.21.0",
         chokidar: "^4.0.3",
@@ -5227,11 +5241,26 @@ var require_chunking_engine = __commonJS({
   }
 });
 
+// src/retrieval/access-fields.js
+var require_access_fields = __commonJS({
+  "src/retrieval/access-fields.js"(exports2, module2) {
+    "use strict";
+    function accessFields(doc) {
+      const fields = {};
+      if (doc.acl !== void 0) fields.acl = doc.acl;
+      if (doc.requiredRole !== void 0) fields.requiredRole = doc.requiredRole;
+      return fields;
+    }
+    module2.exports = { accessFields };
+  }
+});
+
 // src/retrieval/bm25-search.js
 var require_bm25_search = __commonJS({
   "src/retrieval/bm25-search.js"(exports2, module2) {
     "use strict";
     var { EventEmitter } = require("events");
+    var { accessFields } = require_access_fields();
     var scoring = require_scoring();
     var DEFAULT_CONFIG = { k1: 1.2, b: 0.75 };
     var BM25Search = class extends EventEmitter {
@@ -5320,7 +5349,8 @@ var require_bm25_search = __commonJS({
             id: doc.id,
             score,
             content: doc.content || doc.text || "",
-            metadata: doc.metadata || {}
+            metadata: doc.metadata || {},
+            ...accessFields(doc)
           });
         }
         results.sort((a, b2) => b2.score - a.score);
@@ -7285,6 +7315,7 @@ var require_memory_retriever = __commonJS({
     var { randomBytes } = require("crypto");
     var { BaseConnector } = require_base_connector();
     var { throwIfAborted } = require_connector_utils();
+    var { accessFields } = require_access_fields();
     var DEFAULT_CONFIG = {
       maxDocuments: 1e5,
       // 'error' rejects a store() that would exceed maxDocuments; 'fifo' evicts
@@ -7366,7 +7397,8 @@ var require_memory_retriever = __commonJS({
           this.documents.set(doc.id, {
             vector: doc.vector,
             metadata: doc.metadata || {},
-            content: doc.content || ""
+            content: doc.content || "",
+            ...accessFields(doc)
           });
         }
         if (vectors.length > 0) this.dimensions = dimensions;
@@ -7424,7 +7456,8 @@ var require_memory_retriever = __commonJS({
             id,
             score,
             metadata: doc.metadata,
-            content: doc.content
+            content: doc.content,
+            ...accessFields(doc)
           });
         }
         results.sort((a, b) => b.score - a.score);
@@ -7592,6 +7625,7 @@ var modules = {
   "reranker/cascade-reranker.js": () => require_cascade_reranker(),
   "reranker/embedding-reranker.js": () => require_embedding_reranker(),
   "reranker/scoring-reranker.js": () => require_scoring_reranker(),
+  "retrieval/access-fields.js": () => require_access_fields(),
   "retrieval/bm25-search.js": () => require_bm25_search(),
   "retrieval/hybrid-retriever.js": () => require_hybrid_retriever(),
   "retrieval/rank-fusion.js": () => require_rank_fusion(),

package/dist/types/retrieval/access-fields.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The access fields (`acl`, `requiredRole`) set on a document's top level.
+ * Stores keep them on each result, as well as whatever metadata holds, so
+ * RetrievalGuard sees a restriction wherever it was set.
+ * @param {object} doc
+ * @returns {object}
+ */
+export function accessFields(doc: object): object;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devilsdev/rag-core",
-  "version": "3.8.0",
+  "version": "3.8.1",
   "description": "createRagPipeline and its building blocks: retrieval, reranking, caching, cost tracking and model routing.",
   "keywords": [
     "rag",