@nacre.work/api 0.7.0 → 0.10.0

package/dist/auth.d.ts

@@ -20,7 +20,18 @@ export interface AuthContext {
      */
     readonly delegation?: {
         readonly id: string;
-        readonly layers?: readonly string[];
+        /**
+         * The narrowing, and each layer's own ceiling where the person set one.
+         *
+         * `undefined` means no narrowing — never "narrowed to nothing", which is a
+         * different state and is deliberately not expressible. A layer with no
+         * `permissions` of its own inherits the connection's, which is what every
+         * narrowing written before per-layer ceilings meant and still means.
+         */
+        readonly layers?: readonly {
+            readonly id: string;
+            readonly permissions?: readonly Permission[];
+        }[];
         /**
          * The permissions this token may exercise. Absent means no ceiling.
          *
@@ -49,7 +60,11 @@ export interface Delegations {
     resolve(orgId: string, id: string): Promise<{
         userId: string;
         role: OrgRole;
-        layers?: readonly string[];
+        /** The narrowing, each layer carrying its own ceiling where one was set. */
+        layers?: readonly {
+            readonly id: string;
+            readonly permissions?: readonly Permission[];
+        }[];
         permissions?: readonly Permission[];
     } | undefined>;
 }
@@ -160,7 +175,25 @@ export declare function administersTenants(auth: AuthContext): boolean;
  * its target — where the same restriction has to hold and there is no traversal
  * to put it inside of.
  */
-export declare function withinDelegation(auth: AuthContext, layerId: string): boolean;
+export declare function withinDelegation(auth: AuthContext, layerId: string, permission: Permission): boolean;
+/**
+ * The layers this delegation admits for one permission, or `undefined` for no
+ * narrowing at all.
+ *
+ * The permission argument is the whole of per-layer ceilings: a narrowing used
+ * to be one set of layer ids and is now one set *per permission*, because
+ * "read the handbook, write to scratch" is what a person means and a single set
+ * cannot say it.
+ *
+ * Required rather than optional, so every existing call site is a compile error
+ * until it says which permission it is asking about. That is the check here —
+ * the rule has to hold in five places and nothing else knows five.
+ *
+ * An empty result is a real answer and not the same as `undefined`: it means
+ * the narrowing exists and no layer in it admits this permission, which every
+ * caller turns into the same nothing an unreachable object gets.
+ */
+export declare function delegatedLayers(auth: AuthContext, permission: Permission): readonly string[] | undefined;
 export declare function findTenantOverride(value: unknown, path?: string[]): string | undefined;
 /**
  * T2. A body, path, or header naming an organization is refused with 403.

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjE,OAAO,EAA2B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAA;AAEnE,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC;;;;;;WAMG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KAC7C,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,CACL,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,GAClG,SAAS,CACZ,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;KACvD,CAAA;IACD;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAGpF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAEtD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG5E;AAcD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,MAAM,GAAG,SAAS,CAW1F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,GAAG,SAAS,CAgBrB;AAqBD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,CAkIhC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjE,OAAO,EAA2B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAA;AAEnE,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;YACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;YACnB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;SAC7C,EAAE,CAAA;QACH;;;;;;WAMG;QACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KAC7C,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,CACL,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CACN;QACE,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,EAAE,OAAO,CAAA;QACb,4EAA4E;QAC5E,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;SAAE,EAAE,CAAA;QACzF,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KACpC,GACD,SAAS,CACZ,CAAA;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACzD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;KACvD,CAAA;IACD;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAGpF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAEtD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,UAAU,GACrB,OAAO,CAGT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,UAAU,GACrB,SAAS,MAAM,EAAE,GAAG,SAAS,CAM/B;AAcD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,MAAM,GAAG,SAAS,CAW1F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,GAAG,SAAS,CAgBrB;AAqBD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,CAkIhC"}

package/dist/auth.js

@@ -60,9 +60,34 @@ export function administersTenants(auth) {
  * its target — where the same restriction has to hold and there is no traversal
  * to put it inside of.
  */
-export function withinDelegation(auth, layerId) {
+export function withinDelegation(auth, layerId, permission) {
+    const admitted = delegatedLayers(auth, permission);
+    return admitted === undefined || admitted.includes(layerId);
+}
+/**
+ * The layers this delegation admits for one permission, or `undefined` for no
+ * narrowing at all.
+ *
+ * The permission argument is the whole of per-layer ceilings: a narrowing used
+ * to be one set of layer ids and is now one set *per permission*, because
+ * "read the handbook, write to scratch" is what a person means and a single set
+ * cannot say it.
+ *
+ * Required rather than optional, so every existing call site is a compile error
+ * until it says which permission it is asking about. That is the check here —
+ * the rule has to hold in five places and nothing else knows five.
+ *
+ * An empty result is a real answer and not the same as `undefined`: it means
+ * the narrowing exists and no layer in it admits this permission, which every
+ * caller turns into the same nothing an unreachable object gets.
+ */
+export function delegatedLayers(auth, permission) {
     const narrowing = auth.delegation?.layers;
-    return narrowing === undefined || narrowing.includes(layerId);
+    if (narrowing === undefined)
+        return undefined;
+    return narrowing
+        .filter((l) => l.permissions === undefined || l.permissions.includes(permission))
+        .map((l) => l.id);
 }
 /**
  * Fields a request body, path, or query string may never carry.

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAA;AAiHnE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,UAAsB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAA;IAC5C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,OAAe;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAA;IACzC,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEpG,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAiB,EAAE;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEjE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,KAAsB,EACtB,OAAsD,EACtD,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,MAAM,IAAI,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,GAAG,IAAI,CAAC,CAAA;QAClG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAkBD,MAAM,KAAK,GAAuB,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,OAAsB,EACtB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1D,OAAO,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACjF,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAA+B,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,GAAG,EAAE;gBACzD,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAA;YACF,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAA;YACzB,MAAK;QACP,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,8CAA8C;QAC9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,EAAE,CAAC;YACvC,IAAI,QAAuC,CAAA;YAC3C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,0CAA0C;gBAC1C,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAA;IAEpC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,IAAI,GAAgB;QACxB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAyB,EAAE,EAAE,EAAE,GAAG,EAAE;QACvD,IAAI,EAAE,IAAe;KACtB,CAAA;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEzC,0BAA0B;IAC1B,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE;IACF,iEAAiE;IACjE,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE;QAClD,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YACzE,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SACzF;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAA;AAkInE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,UAAsB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAA;IAC5C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,OAAO,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAiB,EACjB,OAAe,EACf,UAAsB;IAEtB,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAClD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAA;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,SAAS;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEpG,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAiB,EAAE;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEjE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,KAAsB,EACtB,OAAsD,EACtD,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,MAAM,IAAI,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,GAAG,IAAI,CAAC,CAAA;QAClG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAkBD,MAAM,KAAK,GAAuB,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,OAAsB,EACtB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1D,OAAO,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACjF,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAA+B,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,GAAG,EAAE;gBACzD,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAA;YACF,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAA;YACzB,MAAK;QACP,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,uEAAuE;QACvE,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,8CAA8C;QAC9C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,EAAE,CAAC;YACvC,IAAI,QAAuC,CAAA;YAC3C,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,0CAA0C;gBAC1C,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAA;IAEpC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,IAAI,GAAgB;QACxB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAyB,EAAE,EAAE,EAAE,GAAG,EAAE;QACvD,IAAI,EAAE,IAAe;KACtB,CAAA;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEzC,0BAA0B;IAC1B,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE;IACF,iEAAiE;IACjE,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE;QAClD,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YACzE,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;SACzF;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,14 +1,15 @@
 export { createApi } from './server.js';
 export type { ApiOptions, AuditEvent, AuditQuery, AuditReader, AuditRecord, Reindex, ReindexOutcome, ReindexStatus, ReferenceQueries, ReferenceQuery, RecallCheck, AuditWriter, DocumentView, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, Layers, SearchHit, SearchOptions, SearchService, ServiceAccountPort, ServiceAccountView, } from './server.js';
-export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, withinDelegation, } from './auth.js';
+export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, delegatedLayers, withinDelegation, } from './auth.js';
 export type { AuthContext, Delegations, VerifyOptions } from './auth.js';
 export { postgresVerification } from './verification.js';
 export { PostgresDelegations, PostgresOAuthAuthorizations, PostgresOAuthClients, PostgresOAuthConsents, PostgresOAuthRefreshTokens, } from './oauth-store.js';
 export type { Consent, ConsentSubject, MintRequest, OAuthAuthorizations, OAuthClients, OAuthConsents, OAuthRefreshTokens, PendingAuthorization, RegisteredClient, } from './oauth-store.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
-export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresEmbeddingProviders, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
 export type { DocumentTombstone, Embedder, IngestDeps, ObjectStore, PrincipalsCache, SearchDeps, } from './adapters.js';
-export { PostgresGroups, PostgresUsers, generatePassword, looksLikeEmail } from './principals.js';
+export { PostgresGroups, PostgresUsers, looksLikeEmail } from './principals.js';
+export { generatePassword } from '@nacre.work/core';
 export type { GroupMember, Groups, GroupView, Users, UserView } from './principals.js';
 export { applyRanking, HttpReranker, rerankerFor } from './rerank.js';
 export type { Reranker } from './rerank.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,OAAO,EACP,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAI/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK5F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC3F,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,10 +1,14 @@
 export { createApi } from './server.js';
-export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, withinDelegation, } from './auth.js';
+export { administers, administersTenants, authenticate, delegationPermits, findTenantOverride, rejectTenantOverride, delegatedLayers, withinDelegation, } from './auth.js';
 export { postgresVerification } from './verification.js';
 export { PostgresDelegations, PostgresOAuthAuthorizations, PostgresOAuthClients, PostgresOAuthConsents, PostgresOAuthRefreshTokens, } from './oauth-store.js';
 export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
-export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
-export { PostgresGroups, PostgresUsers, generatePassword, looksLikeEmail } from './principals.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresEmbeddingProviders, PostgresLayers, PostgresWorkspaces, PostgresReferenceQueries, PostgresReindex, } from './adapters.js';
+export { PostgresGroups, PostgresUsers, looksLikeEmail } from './principals.js';
+// Re-exported rather than defined here. It moved to the core when the second
+// copy of its word list was found; this keeps an existing importer working and
+// makes it visibly one function rather than two agreeing.
+export { generatePassword } from '@nacre.work/core';
 export { applyRanking, HttpReranker, rerankerFor } from './rerank.js';
 export { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from './service-keys.js';
 // The limiter, so the MCP transport can share it rather than growing a second

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAiCvC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEjG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAE1B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAiCvC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAChB,MAAM,eAAe,CAAA;AAStB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,0DAA0D;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAE1B,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE3F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA"}

package/dist/init.d.ts

@@ -1,68 +1,22 @@
-import type { Pool } from 'pg';
+import type { ProvisionOptions } from '@nacre.work/core';
 /**
- * Create the first organization.
+ * Create the first organization — the command, not the provisioning.
  *
- * Everything else in this repository assumes an organization, a user, an
- * embedding provider, a workspace and a Qdrant collection already exist.
- * Nothing created them. A new installation could start every process, get
- * `{"status":"ok"}` from health, and have no way to reach a single endpoint
- * that does anything — the quickstart began one step after where a real
- * installation begins.
+ * What a new organization is made of lives in `provisionOrganization`, in the
+ * core, because this command is one caller and not the definition. Everything
+ * here is what a *terminal* needs and an API caller does not: parsing
+ * arguments, generating a password that must never come from one, minting a
+ * token to get through the quickstart, and printing all of it.
  *
  * A one-shot command rather than an endpoint, because an HTTP route that
- * creates the first organization has to be reachable before any organization
+ * creates the *first* organization has to be reachable before any organization
  * exists, which means unauthenticated, which means it has to be disabled again
  * afterwards. Every version of that is a race between the first deploy and the
  * internet. A command runs where the operator already has credentials.
  *
- * Idempotent: run it twice and the second run reports what already existed and
- * changes nothing. Half-finished state is the normal outcome of a first
- * install — the collection created, the process killed before the workspace —
- * and refusing to continue from it would leave no way forward but manual SQL.
+ * Idempotent, because the function it calls is: run it twice and the second run
+ * reports what already existed and changes nothing.
  */
-export interface Options {
-    readonly slug: string;
-    readonly name: string;
-    readonly email: string;
-    readonly workspace: string;
-    /**
-     * Set on the administrator, when there is one to set.
-     *
-     * Passed in already hashed rather than as a plaintext to hash here: `init`
-     * runs in a terminal and its arguments end up in a shell history and in
-     * `ps`, so the password is generated rather than accepted, and the plaintext
-     * exists in exactly one place — the line printed at the end.
-     */
-    readonly passwordHash?: string;
-}
+export type Options = ProvisionOptions;
 export declare function parseArgs(argv: readonly string[]): Options | string;
-export interface InitResult {
-    readonly orgId: string;
-    readonly userId: string;
-    readonly workspaceId: string;
-    /** False when the organization was already there — the run changed nothing. */
-    readonly created: boolean;
-    /**
-     * Whether **this run** set the administrator's password.
-     *
-     * False on every re-run, because the upsert deliberately leaves an existing
-     * hash alone. The caller needs to know because it generated a plaintext
-     * before calling, and printing one the database did not accept is worse than
-     * printing nothing: an operator writes it down, discards the real one, and
-     * finds out an hour later when the token from the first run expires.
-     */
-    readonly passwordSet: boolean;
-}
-/**
- * The database half, in one transaction.
- *
- * Separate from `main` so it can be tested: idempotency is the property that
- * matters here and the one that regresses silently, because the second run of
- * something non-idempotent usually still exits zero.
- */
-export declare function initialize(pool: Pool, options: Options, provider: {
-    endpoint: string;
-    model: string;
-    dimensions: number;
-}, collection: string, log?: (msg: string, extra?: Record<string, unknown>) => void): Promise<InitResult>;
 //# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAI9B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,CA6BnE;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACjE,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAsB,GAC5E,OAAO,CAAC,UAAU,CAAC,CAwHrB"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAIxD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAEtC,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,CA6BnE"}

package/dist/init.js

@@ -1,6 +1,5 @@
-import { collectionName, ConfigError, createPool, hashPassword, loadConfig, loadJwtKeys, vectorName, VectorStore, } from '@nacre.work/core';
+import { ConfigError, createPool, generatePassword, hashPassword, loadConfig, loadJwtKeys, organizationSlugError, provisionOrganization, VectorStore, vectorStoreOptions, } from '@nacre.work/core';
 import { SignJWT } from 'jose';
-import { randomInt } from 'node:crypto';
 import { pathToFileURL } from 'node:url';
 export function parseArgs(argv) {
     const values = new Map();
@@ -17,11 +16,12 @@ export function parseArgs(argv) {
     if (slug === undefined || email === undefined) {
         return 'usage: nacre-init --org <slug> --email <address> [--name <display name>] [--workspace <slug>]';
     }
-    // The slug becomes the Qdrant collection name, so the characters it may
-    // contain are not a matter of taste.
-    if (!/^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]$/.test(slug)) {
-        return `--org must be 2-40 characters of lowercase letters, digits and hyphens, not starting or ending with one: ${slug}`;
-    }
+    // The same rule `provisionOrganization` applies, asked here only to turn it
+    // into a usage message. The function refuses regardless, which is what keeps
+    // this from being the copy that drifts.
+    const wrong = organizationSlugError(slug);
+    if (wrong !== undefined)
+        return `--org ${wrong}`;
     if (!email.includes('@'))
         return `--email does not look like an address: ${email}`;
     return {
@@ -34,147 +34,6 @@ export function parseArgs(argv) {
 const say = (msg, extra = {}) => {
     console.log(JSON.stringify({ msg, ...extra }));
 };
-/**
- * The database half, in one transaction.
- *
- * Separate from `main` so it can be tested: idempotency is the property that
- * matters here and the one that regresses silently, because the second run of
- * something non-idempotent usually still exits zero.
- */
-export async function initialize(pool, options, provider, collection, log = () => undefined) {
-    const client = await pool.connect();
-    try {
-        await client.query('BEGIN');
-        const { rows: orgs } = await client.query(`WITH ins AS (
-         INSERT INTO organizations (slug, name, vector_collection)
-         VALUES ($1,$2,$3) ON CONFLICT (slug) DO NOTHING
-         RETURNING id
-       )
-       SELECT id, false AS existed FROM ins
-       UNION ALL
-       SELECT id, true AS existed FROM organizations WHERE slug = $1
-       LIMIT 1`, [options.slug, options.name, collection]);
-        const org = orgs[0];
-        if (org === undefined)
-            throw new Error('the organization insert returned no row');
-        log(org.existed ? 'organization already existed' : 'organization created', {
-            org_id: org.id,
-            slug: options.slug,
-        });
-        // RLS is forced on every tenant table, so everything below this line needs
-        // the organization in the transaction-local setting. The organizations row
-        // itself is not covered — it is the tenant registry, not tenant data.
-        await client.query('SELECT set_config($1, $2, true)', ['app.current_org', org.id]);
-        const { rows: users } = await client.query(
-        // The password is set only when this run generated one — re-running init
-        // against an existing organization must not silently reset the
-        // administrator's password and lock them out of their own installation.
-        //
-        // `password_set` reports whether the COALESCE above took this run's value
-        // or kept the stored one, by comparing the row as written against what
-        // was offered. The caller has a plaintext in hand either way and must not
-        // print it when the answer is no: the hash carries its own salt, so two
-        // hashes of the same password differ, and equality here can only mean
-        // this statement is what put it there.
-        `INSERT INTO users (org_id, email, role, password_hash) VALUES ($1,$2,'org_admin',$3)
-       ON CONFLICT (org_id, email) DO UPDATE
-         SET email = EXCLUDED.email,
-             password_hash = COALESCE(users.password_hash, EXCLUDED.password_hash)
-       RETURNING id, ($3 IS NOT NULL AND password_hash IS NOT DISTINCT FROM $3) AS password_set`, [org.id, options.email, options.passwordHash ?? null]);
-        const userId = users[0]?.id;
-        if (userId === undefined)
-            throw new Error('the user insert returned no row');
-        log('admin user ready', {
-            user_id: userId,
-            email: options.email,
-            password_set: users[0]?.password_set === true,
-        });
-        // Shared across organizations by default: one endpoint serves every tenant
-        // in a self-hosted install, and a per-organization provider is the
-        // exception rather than the shape to create on day one.
-        //
-        // This row carries `org_id = NULL`, and since 0019 a tenant-scoped role
-        // cannot write one — the RESTRICTIVE policies on `embedding_providers`
-        // require `org_id = current_setting('app.current_org')`, which NULL fails.
-        // That is the point: the installation default is not a tenant's to change.
-        // Writing it is a bootstrap act, so this one statement runs under
-        // `nacre_worker`, the BYPASSRLS role the worker's queue already uses;
-        // `nacre_app` is a member of it (migration 0008), so the switch is
-        // available wherever init connects. `SET LOCAL` reverts at COMMIT, and it
-        // is reset immediately below so nothing after it bypasses RLS.
-        await client.query('SET LOCAL ROLE nacre_worker');
-        const { rows: providers } = await client.query(`WITH ins AS (
-         INSERT INTO embedding_providers (org_id, name, endpoint, model, dimensions)
-         SELECT NULL,'default',$1,$2,$3
-         WHERE NOT EXISTS (SELECT 1 FROM embedding_providers WHERE org_id IS NULL)
-         RETURNING id
-       )
-       SELECT id FROM ins
-       UNION ALL
-       SELECT id FROM embedding_providers WHERE org_id IS NULL
-       LIMIT 1`, [provider.endpoint, provider.model, provider.dimensions]);
-        await client.query('RESET ROLE');
-        const providerId = providers[0]?.id;
-        if (providerId === undefined)
-            throw new Error('the embedding provider insert returned no row');
-        log('embedding provider ready', { provider_id: providerId, model: provider.model });
-        const { rows: workspaces } = await client.query(`WITH ins AS (
-         -- slug and name take separate parameters despite the same value: slug
-         -- is citext, name is text, and Postgres refuses to deduce one type for
-         -- a parameter feeding both.
-         INSERT INTO workspaces (org_id, slug, name) VALUES ($1,$2,$3)
-         ON CONFLICT (org_id, slug) DO NOTHING
-         RETURNING id
-       )
-       SELECT id FROM ins
-       UNION ALL
-       SELECT id FROM workspaces WHERE org_id = $1 AND slug = $2
-       LIMIT 1`, [org.id, options.workspace, options.workspace]);
-        const workspaceId = workspaces[0]?.id;
-        if (workspaceId === undefined)
-            throw new Error('the workspace insert returned no row');
-        log('workspace ready', { workspace_id: workspaceId, slug: options.workspace });
-        await client.query('COMMIT');
-        return {
-            orgId: org.id,
-            userId,
-            workspaceId,
-            created: !org.existed,
-            passwordSet: users[0]?.password_set === true,
-        };
-    }
-    catch (error) {
-        await client.query('ROLLBACK').catch(() => { });
-        throw error;
-    }
-    finally {
-        client.release();
-    }
-}
-/**
- * Six words and a number, from the CSPRNG.
- *
- * Roughly 70 bits with this list, which is more than a person would choose and
- * still something they can read off a terminal and type into a form once. A
- * base64 string of the same strength gets copied wrong, and the recovery from
- * that is re-running init against a live installation.
- */
-function generatePassword() {
-    const words = [
-        'abalone', 'anchor', 'aurora', 'basalt', 'beacon', 'bramble', 'cinder', 'clover',
-        'compass', 'coral', 'crest', 'current', 'delta', 'drift', 'ember', 'estuary',
-        'fathom', 'ferry', 'fjord', 'granite', 'harbor', 'haven', 'iris', 'kelp',
-        'lantern', 'ledger', 'lichen', 'mantle', 'marlin', 'meadow', 'mica', 'nacre',
-        'nautilus', 'obsidian', 'onyx', 'opal', 'orbit', 'pearl', 'pelagic', 'pillar',
-        'plover', 'quarry', 'quartz', 'reef', 'ripple', 'salt', 'sextant', 'shale',
-        'shoal', 'silt', 'slate', 'spindrift', 'stratum', 'tide', 'trawler', 'trench',
-        'vellum', 'wharf', 'willow', 'zephyr',
-    ];
-    // randomInt rather than Math.random or a modulo of randomBytes: one is not a
-    // CSPRNG and the other is biased unless the range divides evenly.
-    const chosen = Array.from({ length: 6 }, () => words[randomInt(words.length)]);
-    return `${chosen.join('-')}-${String(randomInt(10, 100))}`;
-}
 async function main() {
     const parsed = parseArgs(process.argv.slice(2));
     if (typeof parsed === 'string')
@@ -192,26 +51,17 @@ async function main() {
     const password = generatePassword();
     const passwordHash = await hashPassword(password);
     const pool = createPool({ connectionString: config.pgUrl, max: 2 });
-    const vector = vectorName(config.embeddingModel, config.embeddingDim);
-    const collection = collectionName(parsed.slug);
+    const vectors = new VectorStore(vectorStoreOptions(config));
     try {
-        const ids = await initialize(pool, { ...parsed, passwordHash }, {
+        // Both stores, in the order that survives a failure between them, and with
+        // the collection's slot named after the provider that was actually
+        // resolved rather than after this process's configuration. See
+        // `provisionOrganization`.
+        const ids = await provisionOrganization(pool, vectors, { ...parsed, passwordHash }, {
             endpoint: config.embeddingEndpoint,
             model: config.embeddingModel,
             dimensions: config.embeddingDim,
-        }, collection, say);
-        // Qdrant after Postgres commits. The reverse order can leave a collection
-        // belonging to an organization that was rolled back, and the next run with
-        // the same slug would then adopt it.
-        //
-        // `ensureCollection` is already idempotent and already creates the payload
-        // indexes, which is the part worth not reimplementing: a filter that falls
-        // back to a scan is a latency problem that only appears at volume.
-        const vectors = new VectorStore(config.qdrantApiKey === undefined
-            ? { url: config.qdrantUrl }
-            : { url: config.qdrantUrl, apiKey: config.qdrantApiKey });
-        await vectors.ensureCollection(parsed.slug, vector, config.embeddingDim);
-        say('collection ready', { collection, vector, dimensions: config.embeddingDim });
+        }, say);
         // A short life on purpose. It is signed by the same key the API verifies
         // with, printed to a terminal and probably into a shell history; it exists
         // to get through the quickstart, not to be the credential an installation
@@ -276,10 +126,10 @@ async function main() {
         await pool.end();
     }
 }
-// Only when run as a command. This module is also imported — `initialize` is
-// the part with a test on it — and an unguarded call here runs the whole
-// command on import, which under a test runner means `process.exit(2)` in the
-// middle of somebody else's suite.
+// Only when run as a command. This module is also imported — `parseArgs` is the
+// part with a test on it — and an unguarded call here runs the whole command on
+// import, which under a test runner means `process.exit(2)` in the middle of
+// somebody else's suite.
 if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
     main().catch((error) => {
         if (error instanceof ConfigError) {

package/dist/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,EACV,WAAW,GACZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAwCxC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,+FAA+F,CAAA;QACxG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,+FAA+F,CAAA;IACxG,CAAC;IACD,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,4GAA4G,IAAI,EAAE,CAAA;IAC3H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAA;IAElF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;KAChD,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAiC,EAAE,EAAQ,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC,CAAA;AAoBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,OAAgB,EAChB,QAAiE,EACjE,UAAkB,EAClB,MAA8D,GAAG,EAAE,CAAC,SAAS;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAE3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACvC;;;;;;;;eAQS,EACT,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CACzC,CAAA;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,sBAAsB,EAAE;YACzE,MAAM,EAAE,GAAG,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;QAEF,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAElF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;QACxC,yEAAyE;QACzE,+DAA+D;QAC/D,wEAAwE;QACxE,EAAE;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,uCAAuC;QACvC;;;;gGAI0F,EAC1F,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,CACtD,CAAA;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC5E,GAAG,CAAC,kBAAkB,EAAE;YACtB,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI;SAC9C,CAAC,CAAA;QAEF,2EAA2E;QAC3E,mEAAmE;QACnE,wDAAwD;QACxD,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,kEAAkE;QAClE,sEAAsE;QACtE,mEAAmE;QACnE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACjD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5C;;;;;;;;;eASS,EACT,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CACzD,CAAA;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACnC,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC9F,GAAG,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAEnF,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7C;;;;;;;;;;;eAWS,EACT,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAC/C,CAAA;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACrC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACtF,GAAG,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;QAE9E,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM;YACN,WAAW;YACX,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO;YACrB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI;SAC7C,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG;QACZ,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;QAChF,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;QAC5E,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;QACxE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO;QAC5E,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ;QAC7E,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO;QAC1E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;QAC7E,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;KAC7B,CAAA;IAEV,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;IACrE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,IAAI,EACJ,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAC3B;YACE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;SAChC,EACD,UAAU,EACV,GAAG,CACJ,CAAA;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,WAAW,CAC7B,MAAM,CAAC,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,CAC3D,CAAA;QACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAA;QACxE,GAAG,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;QAEhF,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,WAAW;QACX,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,WAAW;SAClB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACvD,CAAC;aACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;aACtB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;aAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;aAC/B,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,YAAY,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEf,qCAAqC;QACrC,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,mBAAmB,CAAC,CAAA;YACrE,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;YACzD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,oBAAoB,CAAC,CAAA;YAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAA;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAA;YAClF,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAA;YACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,eAAe,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;QACjG,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,CAAC,WAAW,yCAAyC,CACrF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,mCAAmC;AACnC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAuBxC,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,+FAA+F,CAAA;QACxG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,+FAA+F,CAAA;IACxG,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wCAAwC;IACxC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,KAAK,EAAE,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,0CAA0C,KAAK,EAAE,CAAA;IAElF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;QAChC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;KAChD,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,QAAiC,EAAE,EAAQ,EAAE;IACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAE/D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;IAE3D,IAAI,CAAC;QACH,2EAA2E;QAC3E,mEAAmE;QACnE,+DAA+D;QAC/D,2BAA2B;QAC3B,MAAM,GAAG,GAAG,MAAM,qBAAqB,CACrC,IAAI,EACJ,OAAO,EACP,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,EAC3B;YACE,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,UAAU,EAAE,MAAM,CAAC,YAAY;SAChC,EACD,GAAG,CACJ,CAAA;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,WAAW;QACX,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,GAAG,EAAE,GAAG,CAAC,KAAK;YACd,cAAc,EAAE,MAAM;YACtB,IAAI,EAAE,WAAW;SAClB,CAAC;aACC,kBAAkB,CAAC;YAClB,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACvD,CAAC;aACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;aACtB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;aAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;aAC/B,iBAAiB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,YAAY,CAAC,CAAA;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEf,qCAAqC;QACrC,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,mBAAmB,CAAC,CAAA;YACrE,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;YACzD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,oBAAoB,CAAC,CAAA;YAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAA;YAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACf,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAA;YAClF,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAA;YACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAA;QACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,YAAY,eAAe,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAA;QACjG,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,CAAC,WAAW,yCAAyC,CACrF,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/main.js

@@ -1,5 +1,5 @@
-import { configureLogging, collectDatabaseGauges, createMetrics, createPool, loadConfig, loadedExtensions, loadModules, logger, loadJwtKeys, keyFingerprint, protectedResourceMetadata, Redis, RedisCache, Registry, S3, VectorStore, pendingMigrations, withOrg, ConfigError, installGuards, onListenError, } from '@nacre.work/core';
-import { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresReferenceQueries, PostgresReindex, PostgresWorkspaces, } from './adapters.js';
+import { configureLogging, collectDatabaseGauges, createMetrics, createPool, loadConfig, loadedExtensions, loadModules, logger, loadJwtKeys, keyFingerprint, protectedResourceMetadata, Redis, RedisCache, Registry, S3, VectorStore, vectorStoreOptions, pendingMigrations, withOrg, ConfigError, installGuards, onListenError, } from '@nacre.work/core';
+import { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresReferenceQueries, PostgresReindex, PostgresEmbeddingProviders, PostgresWorkspaces, } from './adapters.js';
 import { SignJWT } from 'jose';
 import { Idempotency } from './idempotency.js';
 import { Login } from './login.js';
@@ -31,9 +31,7 @@ async function main() {
     await loadModules(config.modules);
     const jwt = loadJwtKeys();
     const pool = createPool({ connectionString: config.pgUrl, max: config.pgPoolMax });
-    const vectors = new VectorStore(config.qdrantApiKey === undefined
-        ? { url: config.qdrantUrl }
-        : { url: config.qdrantUrl, apiKey: config.qdrantApiKey });
+    const vectors = new VectorStore(vectorStoreOptions(config));
     // Absent when a deployment has none, which is supported and is the default:
     // document bytes then live in `documents.source_ref`. `loadConfig` refuses a
     // half-configured block, so this is either fully usable or not there at all.
@@ -258,6 +256,7 @@ async function main() {
         jobs: new PostgresJobs(pool, APP_ROLE, principalsCache),
         layers: new PostgresLayers(pool, vectors, APP_ROLE, principalsCache),
         workspaces: new PostgresWorkspaces(pool, APP_ROLE, principalsCache),
+        embeddingProviders: new PostgresEmbeddingProviders(pool, APP_ROLE),
         grants: new PostgresGrants(pool, APP_ROLE, principalsCache),
         serviceAccounts: new PostgresServiceAccounts(pool, APP_ROLE),
         users: new PostgresUsers(pool, APP_ROLE),