@nacre.work/api 0.0.0 → 0.1.0

package/dist/idempotency.js

@@ -0,0 +1,147 @@
+import { createHash } from 'node:crypto';
+/**
+ * `Idempotency-Key`, cached for 24 hours.
+ *
+ * `POST /v1/documents` does not need this — it is idempotent on
+ * `(layer, external_id)` and the content hash, which is a stronger guarantee
+ * because it survives the cache expiring. This is for everything else unsafe:
+ * issuing a grant, revoking one, creating a service account. A client that
+ * times out and retries should not end up with two accounts.
+ *
+ * ## Scoped to the caller, not to the tenant
+ *
+ * The cache key mixes the key the caller sent with the organization, **the
+ * principal**, the method, the path, and a hash of the body. Three of those are
+ * not optional.
+ *
+ * The organization, because a key is a string the caller chose: without it,
+ * `Idempotency-Key: 1` from one tenant hands another tenant's response to
+ * whoever asks next.
+ *
+ * The principal, for the same reason one level down, and this one was missing.
+ * Two principals in one organization see different things — that is the whole
+ * product — so a cache scoped to the tenant let any of them replay any other's
+ * response, verbatim and unchecked, because a replay is sent before any handler
+ * runs. It bypassed the pre-filter (invariant 2), handed read results to a
+ * `write`-only service account (invariant 6), and kept serving a principal
+ * whose grant had been revoked for a further 24 hours (invariant 4).
+ *
+ * The body, because reusing a key with different content is a client bug, and
+ * the useful answer to it is `409` rather than silently replaying the first
+ * result. A caller who changes the payload and keeps the key is not asking for
+ * the old answer.
+ *
+ * ## Only responses, and only successful ones
+ *
+ * A failure is never stored. The point is to stop a retry repeating an
+ * **effect**, and a request that failed had none — while a cached `500` makes a
+ * transient fault permanent for a day and denies the retry the feature exists
+ * to serve.
+ *
+ * ## Failing open
+ *
+ * If Redis is unreachable the request is processed normally, uncached. The risk
+ * is a duplicate on a retry, which is what the feature exists to prevent — so
+ * this is a real degradation, logged as one. The alternative is refusing writes
+ * because a cache is down, which trades a rare duplicate for a certain outage.
+ */
+const TTL_SECONDS = 24 * 60 * 60;
+/**
+ * How long a reservation lives before the key frees itself.
+ *
+ * The reservation and the stored response used to share the 24-hour TTL, which
+ * made a crash permanent: `begin` reserves with `SET NX EX 86400` and only
+ * `store` overwrites it, so a process that was OOM-killed or SIGKILLed between
+ * the two left `pending: true` sitting there for a full day — and every retry
+ * of that exact request got `409 "the first attempt has not finished"`. The one
+ * situation the feature exists to serve, made impossible by the feature, with
+ * `redis-cli DEL` as the only way out.
+ *
+ * Sixty seconds is longer than any request this API serves and short enough
+ * that a crash costs a minute. The response TTL is untouched: once there is a
+ * result to replay, it is worth keeping for the full day.
+ */
+const RESERVATION_SECONDS = 60;
+/** Long enough that a collision is not a thing, short enough to read in a log. */
+const digest = (value) => createHash('sha256').update(value).digest('base64url').slice(0, 32);
+export const isReplay = (o) => 'cached' in o;
+export const isConflict = (o) => 'conflict' in o;
+/** Organization, then principal. Both, in that order, so neither can be crossed. */
+const orgId = (p) => `${p.orgId}:${p.type}:${p.id}`;
+export class Idempotency {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Look up a key, or reserve it.
+     *
+     * `SET NX` is what makes two concurrent retries safe: exactly one reserves
+     * the slot and runs the handler, and the other sees a reservation rather than
+     * a result. A reservation is reported as a conflict — the honest answer to
+     * "the first attempt is still in flight" is not to replay a response that
+     * does not exist yet.
+     */
+    async begin(key, principal, method, path, body) {
+        const fingerprint = digest(JSON.stringify({ method, path, body: body ?? null }));
+        // The organization AND the principal, and the second one is not optional.
+        //
+        // Scoped to the organization alone, this was a cross-principal read: the
+        // key is a string the caller chose, so any principal in the tenant who
+        // presented the same key and the same body was handed whatever the first
+        // one got — replayed verbatim, with no permission check on the way out,
+        // because the cached response is sent before any handler runs.
+        //
+        // That is invariant 2 bypassed (the answer comes from a cache rather than
+        // from a filtered index traversal), invariant 6 bypassed (a `write`-only
+        // service account receives read results), and invariant 4 defeated for
+        // 24 hours (a principal whose grant was revoked replays their own key and
+        // keeps being served). One convenience feature, four rules.
+        const cacheKey = `nacre:idem:${orgId(principal)}:${digest(key)}`;
+        try {
+            const existing = await this.options.redis.command('GET', cacheKey);
+            if (typeof existing === 'string') {
+                const record = JSON.parse(existing);
+                if (record.fingerprint !== fingerprint)
+                    return { conflict: true };
+                if (record.pending === true)
+                    return { conflict: true };
+                return { cached: { status: record.status, body: record.body } };
+            }
+            const reserved = await this.options.redis.command('SET', cacheKey, JSON.stringify({ fingerprint, pending: true }), 'NX', 'EX', 
+            // The reservation, not the answer. See RESERVATION_SECONDS.
+            String(RESERVATION_SECONDS));
+            // Somebody else reserved it between the GET and the SET.
+            if (reserved === null)
+                return { conflict: true };
+            return {
+                proceed: true,
+                store: async (status, responseBody) => {
+                    // Only what succeeded. A cached failure is never useful and is often
+                    // harmful: the point of this cache is to stop a retry repeating an
+                    // *effect*, and a request that failed had none to repeat. Storing one
+                    // makes a transient 500 permanent for 24 hours and turns the retry
+                    // the feature exists to serve into the one thing it cannot do.
+                    if (status >= 400) {
+                        await this.options.redis.command('DEL', cacheKey).catch(() => undefined);
+                        return;
+                    }
+                    try {
+                        await this.options.redis.command('SET', cacheKey, JSON.stringify({ fingerprint, status, body: responseBody }), 'EX', String(TTL_SECONDS));
+                    }
+                    catch (error) {
+                        // The work is already done and the caller is getting their answer.
+                        // Losing the cache entry means a retry redoes it, which is the
+                        // situation before this feature existed.
+                        this.options.onDegraded?.(error);
+                    }
+                },
+            };
+        }
+        catch (error) {
+            this.options.onDegraded?.(error);
+            return { proceed: true, store: async () => { } };
+        }
+    }
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEhC;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,kFAAkF;AAClF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CACvC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAyBrE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAA;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,UAAU,IAAI,CAAC,CAAA;AAgCxE,oFAAoF;AACpF,MAAM,KAAK,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAA;AAOtE,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAE5D;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CACT,GAAW,EACX,SAAoB,EACpB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QAChF,0EAA0E;QAC1E,EAAE;QACF,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,cAAc,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAElE,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAKjC,CAAA;gBACD,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW;oBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;gBACjE,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;gBACtD,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;YAC3E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC/C,KAAK,EACL,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAC9C,IAAI,EACJ,IAAI;YACJ,4DAA4D;YAC5D,MAAM,CAAC,mBAAmB,CAAC,CAC5B,CAAA;YAED,yDAAyD;YACzD,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YAEhD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;oBACpC,qEAAqE;oBACrE,mEAAmE;oBACnE,sEAAsE;oBACtE,mEAAmE;oBACnE,+DAA+D;oBAC/D,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;wBAClB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;wBACxE,OAAM;oBACR,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC9B,KAAK,EACL,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAC3D,IAAI,EACJ,MAAM,CAAC,WAAW,CAAC,CACpB,CAAA;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,mEAAmE;wBACnE,+DAA+D;wBAC/D,yCAAyC;wBACzC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAA;oBAClC,CAAC;gBACH,CAAC;aACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAA;YAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;QACjD,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,10 +1,19 @@
 export { createApi } from './server.js';
-export type { ApiOptions, AuditEvent, AuditSink, DocumentView, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, Layers, SearchHit, SearchService, ServiceAccountPort, ServiceAccountView, } from './server.js';
+export type { ApiOptions, AuditEvent, AuditQuery, AuditReader, AuditRecord, Reindex, ReindexOutcome, ReindexStatus, AuditSink, DocumentView, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, Layers, SearchHit, SearchOptions, SearchService, ServiceAccountPort, ServiceAccountView, } from './server.js';
 export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
 export type { AuthContext, VerifyOptions } from './auth.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
-export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, } from './adapters.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReindex, } from './adapters.js';
 export type { DocumentTombstone, Embedder, IngestDeps, SearchDeps } from './adapters.js';
+export { applyRanking, HttpReranker, rerankerFor } from './rerank.js';
+export type { Reranker } from './rerank.js';
 export { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from './service-keys.js';
 export type { ServiceAccount, ServiceAccounts, ServiceKeyResolver } from './service-keys.js';
+export { auditFormat, auditJson, readAuditQuery, toCsv, toNdjson } from './audit-export.js';
+export type { AuditFormat } from './audit-export.js';
+export { limitHeaders, RateLimiter } from './limits.js';
+export type { LimitDecision, LimitPolicy, Resource } from './limits.js';
+export { clientSource } from './source.js';
+export { Login } from './login.js';
+export type { LoginDeps, LoginRequest, Tokens } from './login.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAClF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AACxF,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,EACb,SAAS,EACT,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAClF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AACxF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,6 +1,15 @@
 export { createApi } from './server.js';
 export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
-export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, } from './adapters.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReindex, } from './adapters.js';
+export { applyRanking, HttpReranker, rerankerFor } from './rerank.js';
 export { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from './service-keys.js';
+// The limiter, so the MCP transport can share it rather than growing a second
+// one. Two limiters would be two buckets, and a caller out of budget on one
+// surface would simply use the other — which is what happened before this was
+// exported: NACRE_RATE_* applied to REST only.
+export { auditFormat, auditJson, readAuditQuery, toCsv, toNdjson } from './audit-export.js';
+export { limitHeaders, RateLimiter } from './limits.js';
+export { clientSource } from './source.js';
+export { Login } from './login.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAuBvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAElF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA8BvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAElF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,GAChB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAE1B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}

package/dist/init.d.ts

@@ -25,6 +25,15 @@ export interface Options {
     readonly name: string;
     readonly email: string;
     readonly workspace: string;
+    /**
+     * Set on the administrator, when there is one to set.
+     *
+     * Passed in already hashed rather than as a plaintext to hash here: `init`
+     * runs in a terminal and its arguments end up in a shell history and in
+     * `ps`, so the password is generated rather than accepted, and the plaintext
+     * exists in exactly one place — the line printed at the end.
+     */
+    readonly passwordHash?: string;
 }
 export declare function parseArgs(argv: readonly string[]): Options | string;
 export interface InitResult {

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAG9B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,CA6BnE;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACjE,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAsB,GAC5E,OAAO,CAAC,UAAU,CAAC,CAsFrB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAI9B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,CA6BnE;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACjE,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAsB,GAC5E,OAAO,CAAC,UAAU,CAAC,CA2FrB"}

package/dist/init.js

@@ -1,5 +1,6 @@
-import { collectionName, ConfigError, createPool, loadConfig, vectorName, VectorStore, } from '@nacre.work/core';
+import { collectionName, ConfigError, createPool, hashPassword, loadConfig, vectorName, VectorStore, } from '@nacre.work/core';
 import { SignJWT } from 'jose';
+import { randomInt } from 'node:crypto';
 import { pathToFileURL } from 'node:url';
 export function parseArgs(argv) {
     const values = new Map();
@@ -64,9 +65,15 @@ export async function initialize(pool, options, provider, collection, log = () =
         // the organization in the transaction-local setting. The organizations row
         // itself is not covered — it is the tenant registry, not tenant data.
         await client.query('SELECT set_config($1, $2, true)', ['app.current_org', org.id]);
-        const { rows: users } = await client.query(`INSERT INTO users (org_id, email, role) VALUES ($1,$2,'org_admin')
-       ON CONFLICT (org_id, email) DO UPDATE SET email = EXCLUDED.email
-       RETURNING id`, [org.id, options.email]);
+        const { rows: users } = await client.query(
+        // The password is set only when this run generated one — re-running init
+        // against an existing organization must not silently reset the
+        // administrator's password and lock them out of their own installation.
+        `INSERT INTO users (org_id, email, role, password_hash) VALUES ($1,$2,'org_admin',$3)
+       ON CONFLICT (org_id, email) DO UPDATE
+         SET email = EXCLUDED.email,
+             password_hash = COALESCE(users.password_hash, EXCLUDED.password_hash)
+       RETURNING id`, [org.id, options.email, options.passwordHash ?? null]);
         const userId = users[0]?.id;
         if (userId === undefined)
             throw new Error('the user insert returned no row');
@@ -115,6 +122,30 @@ export async function initialize(pool, options, provider, collection, log = () =
         client.release();
     }
 }
+/**
+ * Six words and a number, from the CSPRNG.
+ *
+ * Roughly 70 bits with this list, which is more than a person would choose and
+ * still something they can read off a terminal and type into a form once. A
+ * base64 string of the same strength gets copied wrong, and the recovery from
+ * that is re-running init against a live installation.
+ */
+function generatePassword() {
+    const words = [
+        'abalone', 'anchor', 'aurora', 'basalt', 'beacon', 'bramble', 'cinder', 'clover',
+        'compass', 'coral', 'crest', 'current', 'delta', 'drift', 'ember', 'estuary',
+        'fathom', 'ferry', 'fjord', 'granite', 'harbor', 'haven', 'iris', 'kelp',
+        'lantern', 'ledger', 'lichen', 'mantle', 'marlin', 'meadow', 'mica', 'nacre',
+        'nautilus', 'obsidian', 'onyx', 'opal', 'orbit', 'pearl', 'pelagic', 'pillar',
+        'plover', 'quarry', 'quartz', 'reef', 'ripple', 'salt', 'sextant', 'shale',
+        'shoal', 'silt', 'slate', 'spindrift', 'stratum', 'tide', 'trawler', 'trench',
+        'vellum', 'wharf', 'willow', 'zephyr',
+    ];
+    // randomInt rather than Math.random or a modulo of randomBytes: one is not a
+    // CSPRNG and the other is biased unless the range divides evenly.
+    const chosen = Array.from({ length: 6 }, () => words[randomInt(words.length)]);
+    return `${chosen.join('-')}-${String(randomInt(10, 100))}`;
+}
 async function main() {
     const parsed = parseArgs(process.argv.slice(2));
     if (typeof parsed === 'string')
@@ -127,11 +158,17 @@ async function main() {
                 'issue the first token, and the API will refuse to start without it either.',
         ]);
     }
+    // Generated, never taken from an argument: `init` runs in a terminal, and an
+    // argument ends up in the shell history and in `ps` on a shared machine. Six
+    // words from the CSPRNG rather than a random string, because this is typed
+    // by a person into a sign-in form at least once.
+    const password = generatePassword();
+    const passwordHash = await hashPassword(password);
     const pool = createPool({ connectionString: config.pgUrl, max: 2 });
     const vector = vectorName(config.embeddingModel, config.embeddingDim);
     const collection = collectionName(parsed.slug);
     try {
-        const ids = await initialize(pool, parsed, {
+        const ids = await initialize(pool, { ...parsed, passwordHash }, {
             endpoint: config.embeddingEndpoint,
             model: config.embeddingModel,
             dimensions: config.embeddingDim,
@@ -173,6 +210,14 @@ async function main() {
         console.log('');
         console.log(`  export NACRE_TOKEN=${token}`);
         console.log('');
+        console.log('And a password for signing in, which is not printed again:');
+        console.log('');
+        console.log(`  ${password}`);
+        console.log('');
+        console.log(`  curl -X POST ${config.canonicalUrl}/v1/auth/login \\`);
+        console.log(`    -H 'Content-Type: application/json' \\`);
+        console.log(`    -d '{"email":"${parsed.email}","password":"…"}'`);
+        console.log('');
         console.log('Create a layer with it, then follow docs/quickstart.md:');
         console.log('');
         console.log(`  curl -X POST ${config.canonicalUrl}/v1/layers \\`);

package/dist/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA+BxC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,+FAA+F,CAAA;QACxG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,+FAA+F,CAAA;IACxG,CAAC;IACD,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,4GAA4G,IAAI,EAAE,CAAA;IAC3H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAA;IAElF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;KAChD,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAiC,EAAE,EAAQ,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC,CAAA;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAAgB,EAChB,QAAiE,EACjE,UAAkB,EAClB,MAA8D,GAAG,EAAE,CAAC,SAAS;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;;;;;;eAQS,EACT,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CACzC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,EAAE;YACzE,MAAM,EAAE,GAAG,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAElF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC;;oBAEc,EACd,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CACxB,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC5E,GAAG,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAElE,2EAA2E;QAC3E,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5C;;;;;;;;;eASS,EACT,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAA;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACnC,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC9F,GAAG,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAEnF,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7C;;;;;;;;;;;eAWS,EACT,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC/C,CAAA;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACtF,GAAG,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;QAE9E,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4EAA4E;gBAC1E,4EAA4E;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,IAAI,EACJ,MAAM,EACN;YACE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;SAChC,EACD,UAAU,EACV,GAAG,CACJ,CAAA;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;QACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QAEhF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,WAAW;SAClB,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;aACtB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;aAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;aAC/B,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAEzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,YAAY,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,eAAe,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;QACjG,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,CAAC,WAAW,yCAAyC,CACrF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,mCAAmC;AACnC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAwCxC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,+FAA+F,CAAA;QACxG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,+FAA+F,CAAA;IACxG,CAAC;IACD,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,4GAA4G,IAAI,EAAE,CAAA;IAC3H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAA;IAElF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;KAChD,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAiC,EAAE,EAAQ,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC,CAAA;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAAgB,EAChB,QAAiE,EACjE,UAAkB,EAClB,MAA8D,GAAG,EAAE,CAAC,SAAS;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;;;;;;eAQS,EACT,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CACzC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,EAAE;YACzE,MAAM,EAAE,GAAG,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAElF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;QACxC,yEAAyE;QACzE,+DAA+D;QAC/D,wEAAwE;QACxE;;;;oBAIc,EACd,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,CACtD,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC5E,GAAG,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAElE,2EAA2E;QAC3E,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5C;;;;;;;;;eASS,EACT,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAA;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACnC,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC9F,GAAG,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAEnF,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7C;;;;;;;;;;;eAWS,EACT,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC/C,CAAA;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACtF,GAAG,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;QAE9E,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;QAChF,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;QAC5E,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;QACxE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;QAC5E,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ;QAC7E,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;QAC1E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;QAC7E,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;KAC7B,CAAA;IAEV,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4EAA4E;gBAC1E,4EAA4E;SAC/E,CAAC,CAAA;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,IAAI,EACJ,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAC3B;YACE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;SAChC,EACD,UAAU,EACV,GAAG,CACJ,CAAA;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;QACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QAEhF,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,WAAW;SAClB,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;aACtB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;aAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;aAC/B,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAEzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,YAAY,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAA;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,mBAAmB,CAAC,CAAA;QACrE,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;QACzD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,oBAAoB,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,eAAe,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;QACjG,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,CAAC,WAAW,yCAAyC,CACrF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,mCAAmC;AACnC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/limits.d.ts

@@ -0,0 +1,80 @@
+import type { Redis } from '@nacre.work/core';
+/**
+ * Rate limiting, per organization.
+ *
+ * **Per organization and not per token**, which is the whole point: a limit
+ * counted per credential is bypassed by minting another credential, and this
+ * product hands out service account keys through an endpoint.
+ *
+ * A fixed window rather than a sliding one. The cost is a burst at the
+ * boundary — a caller can spend a full window at 11:59:59 and another at
+ * 12:00:00 — and the benefit is that the whole thing is one `INCR` against a
+ * key whose name contains the window, so there is no set to trim and nothing to
+ * clean up. Stated rather than hidden because "60 per minute" is not quite what
+ * the boundary delivers.
+ *
+ * ## Failing open, deliberately
+ *
+ * If Redis is unreachable the request is **allowed**. That is the opposite of
+ * invariant I3, and the difference is the point: I3 is about permissions, where
+ * an unanswerable question must deny. A rate limit is availability protection,
+ * and failing closed would turn a Redis restart into a total outage of a
+ * product whose selling point is that it runs in your own network. The
+ * degradation is logged, and `nacre_rate_limit_unavailable_total` is what an
+ * operator alerts on.
+ */
+/**
+ * What a limit is counted against.
+ *
+ * `search` and `ingest` are counted per organization — a per-token limit is
+ * bypassed by issuing another key, and this API hands out keys. Login runs
+ * before there is an organization, so it is counted twice, on two different
+ * things, because either one alone leaves a hole:
+ *
+ * - `login` counts per email address, and defends one account against being
+ *   guessed at. On its own it is nearly useless against the attack people
+ *   actually run: one password sprayed across ten thousand addresses never
+ *   repeats a key and never meets the limit.
+ * - `login_source` counts per client, and is what bounds that. On its own it
+ *   over-trusts topology — everyone behind one NAT shares a bucket — which is
+ *   why it is the looser of the two and why the address limit stays.
+ *
+ * Failing open matters more on both rather than less: a cache outage that
+ * locked everybody out of signing in would be the outage.
+ */
+export type Resource = 'search' | 'ingest' | 'login' | 'login_source';
+export interface LimitDecision {
+    readonly allowed: boolean;
+    /** RFC 9331 `RateLimit-Limit`. */
+    readonly limit: number;
+    /** RFC 9331 `RateLimit-Remaining`, never negative. */
+    readonly remaining: number;
+    /** Seconds until the window resets — `RateLimit-Reset` and `Retry-After`. */
+    readonly reset: number;
+    /** True when the check could not run and the request was let through. */
+    readonly degraded: boolean;
+}
+export interface LimitPolicy {
+    /** Requests allowed per window. */
+    readonly limit: number;
+    /** Window length in seconds. */
+    readonly windowSeconds: number;
+}
+export interface RateLimiterOptions {
+    readonly redis: Redis;
+    readonly policies: Readonly<Record<Resource, LimitPolicy>>;
+    readonly onDegraded?: (resource: Resource, error: unknown) => void;
+}
+export declare class RateLimiter {
+    private readonly options;
+    constructor(options: RateLimiterOptions);
+    check(orgId: string, resource: Resource): Promise<LimitDecision>;
+}
+/**
+ * RFC 9331 headers, plus `Retry-After` when the answer is 429.
+ *
+ * `RateLimit-Policy` names the window so a client can tell 60/minute from
+ * 60/hour without guessing from `Reset`.
+ */
+export declare function limitHeaders(decision: LimitDecision, policy: LimitPolicy, resource: Resource): Record<string, string>;
+//# sourceMappingURL=limits.d.ts.map

package/dist/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,gCAAgC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACnE;AAED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;CA4CvE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,QAAQ,GACjB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB"}

package/dist/limits.js

@@ -0,0 +1,63 @@
+export class RateLimiter {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async check(orgId, resource) {
+        const policy = this.options.policies[resource];
+        const windowMs = policy.windowSeconds * 1000;
+        const now = Date.now();
+        const windowStart = Math.floor(now / windowMs) * windowMs;
+        const reset = Math.ceil((windowStart + windowMs - now) / 1000);
+        // The window is in the key, so a stale key belongs to a window nobody will
+        // ask about again and expiry is the only cleanup there is.
+        const key = `nacre:rl:${resource}:${orgId}:${windowStart}`;
+        try {
+            // INCR and PEXPIRE together: one round trip, and the TTL is refreshed on
+            // every hit rather than only on the first. Setting it once would leave
+            // the key immortal if the process died in between, and refreshing a
+            // window-scoped key changes nothing about when it actually expires.
+            const [count] = await this.options.redis.pipeline(['INCR', key], ['PEXPIRE', key, String(windowMs + 1000)]);
+            const used = typeof count === 'number' ? count : Number(count ?? 0);
+            return {
+                allowed: used <= policy.limit,
+                limit: policy.limit,
+                remaining: Math.max(0, policy.limit - used),
+                reset,
+                degraded: false,
+            };
+        }
+        catch (error) {
+            this.options.onDegraded?.(resource, error);
+            return {
+                allowed: true,
+                limit: policy.limit,
+                // Reporting the full allowance would claim a budget nothing is
+                // counting. Reporting the truth — the check did not run — is what the
+                // `degraded` flag is for, and the headers say the limit rather than a
+                // remaining figure that would be fiction.
+                remaining: policy.limit,
+                reset,
+                degraded: true,
+            };
+        }
+    }
+}
+/**
+ * RFC 9331 headers, plus `Retry-After` when the answer is 429.
+ *
+ * `RateLimit-Policy` names the window so a client can tell 60/minute from
+ * 60/hour without guessing from `Reset`.
+ */
+export function limitHeaders(decision, policy, resource) {
+    const headers = {
+        'ratelimit-limit': String(decision.limit),
+        'ratelimit-remaining': String(decision.remaining),
+        'ratelimit-reset': String(decision.reset),
+        'ratelimit-policy': `${resource};q=${policy.limit};w=${policy.windowSeconds}`,
+    };
+    if (!decision.allowed)
+        headers['retry-after'] = String(decision.reset);
+    return headers;
+}
+//# sourceMappingURL=limits.js.map

package/dist/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAyEA,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAE5D,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAkB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAA;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAA;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QAE9D,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,GAAG,GAAG,YAAY,QAAQ,IAAI,KAAK,IAAI,WAAW,EAAE,CAAA;QAE1D,IAAI,CAAC;YACH,yEAAyE;YACzE,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAC/C,CAAC,MAAM,EAAE,GAAG,CAAC,EACb,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAC1C,CAAA;YAED,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;YACnE,OAAO;gBACL,OAAO,EAAE,IAAI,IAAI,MAAM,CAAC,KAAK;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;gBAC3C,KAAK;gBACL,QAAQ,EAAE,KAAK;aAChB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC1C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,+DAA+D;gBAC/D,sEAAsE;gBACtE,sEAAsE;gBACtE,0CAA0C;gBAC1C,SAAS,EAAE,MAAM,CAAC,KAAK;gBACvB,KAAK;gBACL,QAAQ,EAAE,IAAI;aACf,CAAA;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAuB,EACvB,MAAmB,EACnB,QAAkB;IAElB,MAAM,OAAO,GAA2B;QACtC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjD,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,kBAAkB,EAAE,GAAG,QAAQ,MAAM,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,aAAa,EAAE;KAC9E,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,94 @@
+import type { Pool } from 'pg';
+export interface LoginRequest {
+    readonly email: string;
+    readonly password: string;
+    /** Optional; see the note on invariant I1 above. */
+    readonly organization?: string;
+}
+export interface Tokens {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresIn: number;
+    /**
+     * Who this was issued to, so the caller can audit it.
+     *
+     * The audit log is per-organization, and on a successful sign-in there is one
+     * to write to. On a failure there is not — an address that matches no user
+     * belongs to no tenant, and inventing an owner for that row would put one
+     * organization's failed attempts in another's access log. Failures are logged
+     * by the process instead; see the handler.
+     */
+    readonly orgId: string;
+    readonly userId: string;
+}
+export interface LoginDeps {
+    readonly pool: Pool;
+    readonly key: Uint8Array;
+    readonly issuer: string;
+    readonly audience: string;
+    readonly accessTokenTtl: number;
+    readonly refreshTokenTtl: number;
+    readonly role?: string;
+    /** Injected so tests are not asked to wait for wall-clock expiry. */
+    readonly now?: () => Date;
+}
+export declare class Login {
+    private readonly deps;
+    constructor(deps: LoginDeps);
+    private get scope();
+    private get clock();
+    /**
+     * Sign in, or refuse.
+     *
+     * `undefined` for every reason it can fail. The caller turns it into one
+     * `401` with one message.
+     */
+    login(request: LoginRequest): Promise<Tokens | undefined>;
+    /**
+     * Find the one user this login is about, without saying how many nearly were.
+     *
+     * `organizations` carries no row-level security — an organization is not
+     * inside one — so the slug resolves on an ordinary connection, and the user
+     * is then read through `withOrg` like everything else. That is why the login
+     * path needs no cross-tenant read and no escape hatch: it is two scoped
+     * queries rather than one unscoped one.
+     */
+    private find;
+    private orgIdForSlug;
+    private allOrgIds;
+    private userIn;
+    /**
+     * Exchange a refresh token for a new pair, or refuse.
+     *
+     * Rotation on every use. A token presented after it has been used is not
+     * tolerated as a client retry: the legitimate holder already exchanged it, so
+     * a second presentation means two parties hold the same token and one of them
+     * took it. Which one is unknowable from here, so the whole family is revoked
+     * and both sign in again.
+     */
+    refresh(token: string): Promise<Tokens | undefined>;
+    /** Sign out. Ends the family, not just this token. */
+    logout(token: string): Promise<boolean>;
+    /**
+     * End every token descended from one login.
+     *
+     * Takes the same advisory lock the rotation path takes, and that is what
+     * makes it complete rather than approximately complete. Without it the two
+     * interleave badly: a statement's snapshot is fixed when the statement
+     * starts, so a revoke that begins before a rotation commits will not see the
+     * row that rotation inserts — and the token the racing party just obtained
+     * survives the revocation that was supposed to catch it. Serialized on the
+     * family, the revoke either runs first (and the rotation then finds the
+     * family revoked) or runs second (and sees the new row).
+     */
+    private revokeFamily;
+    /**
+     * Mint an access token and the refresh token that succeeds it.
+     *
+     * `family` carries across a rotation so the whole chain from one login can be
+     * revoked together; a fresh login starts a new one, so signing out of one
+     * device does not sign out of the others.
+     */
+    private issue;
+}
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAyC1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAeD,qBAAa,KAAK;IACJ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAE5C,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAiC/D;;;;;;;;OAQG;YACW,IAAI;YAuBJ,YAAY;YAaZ,SAAS;YAYT,MAAM;IAgBpB;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+FzD,sDAAsD;IAChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB7C;;;;;;;;;;;OAWG;YACW,YAAY;IAe1B;;;;;;OAMG;YACW,KAAK;CA+CpB"}