@nacre.work/core 0.0.0 → 0.2.0

package/dist/config.d.ts

@@ -17,7 +17,18 @@
 export interface Config {
     readonly env: 'development' | 'production';
     readonly canonicalUrl: string;
-    readonly logLevel: string;
+    /**
+     * The identity provider in front of this installation, if there is one.
+     *
+     * Optional and empty by default, because a self-hosted Nacre usually has no
+     * OAuth authorization server at all: sign-in is email and password, and an
+     * agent presents a service account key. Named here only so the RFC 9728
+     * discovery document can point a client at the right place when a deployment
+     * *does* have one — see packages/core/oauth.ts for why pointing it at
+     * ourselves would be worse than leaving it out.
+     */
+    readonly oauthAuthorizationServer: string;
+    readonly logLevel: 'debug' | 'info' | 'warn' | 'error';
     readonly logFormat: 'json' | 'text';
     readonly pgUrl: string;
     readonly pgPoolMax: number;
@@ -31,9 +42,11 @@ export interface Config {
     readonly parserEndpoint: string;
     readonly rerankerEndpoint: string | undefined;
     readonly rerankerEnabled: boolean;
+    readonly rerankCandidates: number;
     readonly jwtIssuer: string;
     readonly jwtAudience: string;
     readonly accessTokenTtl: number;
+    readonly refreshTokenTtl: number;
     readonly aclCacheTtl: number;
     readonly aclPropagationSla: number;
     readonly aclTagHashBytes: number;
@@ -59,10 +72,51 @@ export interface Config {
     readonly indexMaxAttempts: number;
     readonly rateSearchPerMin: number;
     readonly rateIngestPerHour: number;
+    readonly rateLoginPer15Min: number;
+    readonly rateLoginSourcePer15Min: number;
+    readonly trustProxy: number;
+    readonly metricsToken: string | undefined;
     readonly maxDocumentBytes: number;
     readonly auditRetentionDays: number;
     readonly auditQueryText: boolean;
+    /** The reindex rollback window: how long a superseded collection survives. */
+    readonly collectionRetentionDays: number;
+    /** How long a presigned link to a document's bytes stays valid. */
+    readonly presignTtl: number;
+    /**
+     * Object storage, or `undefined` when a deployment has none.
+     *
+     * Absent is a supported configuration and not a degraded one: document bytes
+     * then live in `documents.source_ref`, which is what every deployment did
+     * before this existed. What is *not* supported is half of it — see the
+     * cross-field check, and the reason it is a check rather than a set of
+     * independent optionals.
+     */
+    readonly s3: {
+        readonly endpoint: string;
+        readonly bucket: string;
+        readonly region: string;
+        readonly accessKey: string;
+        readonly secretKey: string;
+        readonly forcePathStyle: boolean;
+    } | undefined;
+}
+/**
+ * The keys a token may be verified against, and the one it is signed with.
+ *
+ * Here rather than in each process because `api` and `mcp` verify with the same
+ * secret and must never disagree about which keys are current. Two copies of
+ * this function are two chances for a rotation to reach one and not the other,
+ * which produces 401s on part of the traffic and not the rest — the hardest
+ * failure of the set to read from outside.
+ */
+export interface JwtKeys {
+    /** Everything issued from now on is signed with this. */
+    readonly key: Uint8Array;
+    /** Accepted on verification, never used to sign. Empty outside a rotation. */
+    readonly alsoAccept: readonly Uint8Array[];
 }
+export declare function loadJwtKeys(env?: NodeJS.ProcessEnv): JwtKeys;
 export declare class ConfigError extends Error {
     readonly problems: readonly string[];
     constructor(problems: readonly string[]);

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA8DvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAoFzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IAIzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IAExC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EACP;QACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;KACjC,GACD,SAAS,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAA;CAC3C;AAED,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA0CzE;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA0JvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAmNzD"}

package/dist/config.js

@@ -14,6 +14,45 @@
  * obviously right value — and never fine for anything naming a host or
  * carrying a credential.
  */
+export function loadJwtKeys(env = process.env) {
+    // Development uses a symmetric secret. Production is meant to load an Ed25519
+    // key through NACRE_JWT_PRIVATE_KEY_REF; until that lands, refusing is the
+    // honest behaviour — a hardcoded fallback here would be a signing key anyone
+    // reading the source can forge tokens with.
+    const secret = env.NACRE_JWT_SECRET;
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError([
+            'NACRE_JWT_SECRET is not set, or is shorter than 32 bytes. ' +
+                'Asymmetric keys through NACRE_JWT_PRIVATE_KEY_REF are not implemented yet; ' +
+                'until they are, this is required and there is no default.',
+        ]);
+    }
+    const previous = env.NACRE_JWT_SECRET_PREVIOUS;
+    if (previous === undefined || previous === '') {
+        return { key: new TextEncoder().encode(secret), alsoAccept: [] };
+    }
+    if (previous.length < 32) {
+        throw new ConfigError([
+            'NACRE_JWT_SECRET_PREVIOUS is set but shorter than 32 bytes. It holds the ' +
+                'key being rotated out, so it is held to the same floor as the one ' +
+                'replacing it. Unset it to finish the rotation.',
+        ]);
+    }
+    if (previous === secret) {
+        // Refused rather than deduplicated. Setting both to the same value is what
+        // an operator does when they mean to rotate and copy the wrong line, and
+        // it leaves an installation that believes it has rotated and has not.
+        throw new ConfigError([
+            'NACRE_JWT_SECRET_PREVIOUS is the same value as NACRE_JWT_SECRET. That is ' +
+                'not a rotation: it accepts one key twice. Set NACRE_JWT_SECRET to the ' +
+                'new key and NACRE_JWT_SECRET_PREVIOUS to the one it replaces.',
+        ]);
+    }
+    return {
+        key: new TextEncoder().encode(secret),
+        alsoAccept: [new TextEncoder().encode(previous)],
+    };
+}
 export class ConfigError extends Error {
     problems;
     constructor(problems) {
@@ -42,6 +81,23 @@ class Reader {
         const value = this.env[key]?.trim();
         return value === undefined || value === '' ? undefined : value;
     }
+    /**
+     * An optional secret with a floor on its length.
+     *
+     * Unset is fine and means the feature is off. Set to something short is not:
+     * a short token reads as protection and is a moment's guessing, which is
+     * worse than no token because it stops anyone looking again.
+     */
+    secret(key, minLength) {
+        const value = this.optional(key);
+        if (value === undefined)
+            return undefined;
+        if (value.length < minLength) {
+            this.problems.push(`${key} must be at least ${minLength} characters, or unset`);
+            return undefined;
+        }
+        return value;
+    }
     /** A default is allowed here: a tunable has an obviously right value. */
     number(key, fallback, { min = 1, max = Number.MAX_SAFE_INTEGER } = {}) {
         const raw = this.env[key]?.trim();
@@ -85,11 +141,79 @@ class Reader {
         return raw;
     }
 }
+/** The protocol, or an empty string when the value does not parse at all. */
+function safeProtocol(url) {
+    try {
+        return new URL(url).protocol;
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * The object-storage block, present only when a deployment configured one.
+ *
+ * Written as a group because it *is* one. Six independent optionals would
+ * accept an endpoint with no credential, or a credential with no bucket, and
+ * every one of those parses — the failure arrives later, as an ingest that
+ * cannot store bytes, on a deployment whose configuration looked accepted.
+ *
+ * `NACRE_S3_*` spent its whole life in `docs/config.md` and in the `full`
+ * Compose profile without `loadConfig` mentioning it once, so a wrong endpoint
+ * or a missing key was silent while MinIO sat there talking to nobody. That is
+ * the specific failure this shape exists to make impossible.
+ */
+function s3From(r, env) {
+    const keys = [
+        'NACRE_S3_ENDPOINT',
+        'NACRE_S3_BUCKET',
+        'NACRE_S3_ACCESS_KEY',
+        'NACRE_S3_SECRET_KEY',
+    ];
+    const present = keys.filter((k) => (env[k] ?? '').trim() !== '');
+    if (present.length === 0)
+        return undefined;
+    if (present.length < keys.length) {
+        const missing = keys.filter((k) => !present.includes(k));
+        r.problems.push(`object storage is half configured: ${present.join(', ')} set, ` +
+            `${missing.join(', ')} missing. Set all four to store document bytes in ` +
+            'object storage, or none to keep them in Postgres. There is no partial ' +
+            'mode — the endpoint without the credential is a deployment that accepts ' +
+            'documents and cannot store them.');
+        return undefined;
+    }
+    // `r.url` only asks whether `new URL` parses, and `minio:9000` does — it
+    // reads as the scheme `minio:` with the path `9000`, with an empty host. That
+    // would start, and then every request would be built against a URL with
+    // nowhere to send it. A missing `http://` is the likeliest thing to be wrong
+    // in this variable, so it is the one thing worth checking twice.
+    const endpoint = r.url('NACRE_S3_ENDPOINT');
+    if (endpoint !== '' && !/^https?:$/.test(safeProtocol(endpoint))) {
+        r.problems.push(`NACRE_S3_ENDPOINT must be an http or https URL, and is ${JSON.stringify(endpoint)}. ` +
+            'A bare host and port parses as a URL — the host ends up empty and every ' +
+            'request goes nowhere.');
+    }
+    return {
+        endpoint,
+        bucket: r.required('NACRE_S3_BUCKET'),
+        // A default is fine here and nowhere else in this block: the region names
+        // no host and carries no credential, MinIO ignores it entirely, and it is
+        // signed into every request so it has to be *something*.
+        region: r.optional('NACRE_S3_REGION') ?? 'us-east-1',
+        accessKey: r.required('NACRE_S3_ACCESS_KEY'),
+        secretKey: r.required('NACRE_S3_SECRET_KEY'),
+        // True by default because the default deployment is self-hosted: MinIO, or
+        // an endpoint reached by a name that is not a wildcard DNS entry. AWS
+        // proper is the case that has to say so.
+        forcePathStyle: r.boolean('NACRE_S3_FORCE_PATH_STYLE', true),
+    };
+}
 export function loadConfig(env = process.env) {
     const r = new Reader(env);
     const config = {
         env: r.oneOf('NACRE_ENV', ['development', 'production'], 'development'),
         canonicalUrl: r.url('NACRE_CANONICAL_URL'),
+        oauthAuthorizationServer: r.url('NACRE_OAUTH_AUTHORIZATION_SERVER', { required: false }),
         logLevel: r.oneOf('NACRE_LOG_LEVEL', ['debug', 'info', 'warn', 'error'], 'info'),
         logFormat: r.oneOf('NACRE_LOG_FORMAT', ['json', 'text'], 'json'),
         pgUrl: r.required('NACRE_PG_URL'),
@@ -106,12 +230,21 @@ export function loadConfig(env = process.env) {
         // False, and it was true. `minimal` has no reranker by definition — the
         // profile exists to run on a laptop without a GPU — so a default of true
         // meant the documented starting profile refused to boot until the operator
-        // turned off a feature they had not asked for. It is also not implemented
-        // on the search path yet, so the refusal bought nothing at all.
+        // turned off a feature they had not asked for.
         rerankerEnabled: r.boolean('NACRE_RERANKER_ENABLED', false),
+        // The candidate set a cross-encoder reorders. 50 is what
+        // docs/architecture.md specifies. The maximum is bounded because every
+        // candidate is a row hydrated from Postgres and a text sent to the model:
+        // this is the one tunable here that trades latency for quality directly,
+        // and there is a value at which a search stops answering in time.
+        rerankCandidates: r.number('NACRE_RERANK_CANDIDATES', 50, { min: 1, max: 500 }),
         jwtIssuer: r.required('NACRE_JWT_ISSUER'),
         jwtAudience: r.required('NACRE_JWT_AUDIENCE'),
         accessTokenTtl: r.number('NACRE_ACCESS_TOKEN_TTL', 900, { min: 60, max: 86_400 }),
+        // 30 days. The upper bound is a year rather than unbounded: a refresh token
+        // is the credential a stolen laptop still holds, and "never expires" is a
+        // choice nobody makes deliberately.
+        refreshTokenTtl: r.number('NACRE_REFRESH_TOKEN_TTL', 2_592_000, { min: 300, max: 31_536_000 }),
         aclCacheTtl: r.number('NACRE_ACL_CACHE_TTL', 60, { min: 0, max: 3600 }),
         aclPropagationSla: r.number('NACRE_ACL_PROPAGATION_SLA', 60, { min: 1, max: 3600 }),
         gcGrace: r.number('NACRE_GC_GRACE', 3600, { min: 0, max: 2_592_000 }),
@@ -124,9 +257,75 @@ export function loadConfig(env = process.env) {
         aclTagHashBytes: r.number('NACRE_ACL_TAG_HASH_BYTES', 8, { min: 4, max: 32 }),
         rateSearchPerMin: r.number('NACRE_RATE_SEARCH_PER_MIN', 60, { min: 1 }),
         rateIngestPerHour: r.number('NACRE_RATE_INGEST_PER_HOUR', 600, { min: 1 }),
+        // Ten attempts per quarter hour, counted per email address. Low enough that
+        // guessing is not a strategy, high enough that someone who genuinely cannot
+        // remember which password they used is not locked out for the afternoon.
+        rateLoginPer15Min: r.number('NACRE_RATE_LOGIN_PER_15MIN', 10, { min: 1, max: 1000 }),
+        // The same window, counted per client instead of per address, because the
+        // per-address limit does not bound the attack people actually run: one
+        // password against ten thousand addresses never repeats a key. Six times
+        // looser, because a whole office behind one NAT is one source here and the
+        // job of this limit is to stop a directory being ground down, not to make
+        // shared egress unusable.
+        rateLoginSourcePer15Min: r.number('NACRE_RATE_LOGIN_SOURCE_PER_15MIN', 60, {
+            min: 1,
+            max: 10_000,
+        }),
+        // How many proxies sit in front of this process. Zero — the default — means
+        // X-Forwarded-For is ignored entirely and the socket address is the client.
+        //
+        // Neither default is safe, which is why this is configuration rather than a
+        // guess. Trusting the header unconditionally keys the limit above on a
+        // string the attacker picks, which is worse than having no limit: a fresh
+        // value per request costs a Redis round trip and accomplishes nothing.
+        // Ignoring it unconditionally means that behind an ingress every request
+        // carries the proxy's address, so one bad client rate-limits everybody.
+        trustProxy: r.number('NACRE_TRUST_PROXY', 0, { min: 0, max: 8 }),
+        // Optional, and off by default. Requiring a token would break every
+        // existing scrape config for a product people self-host, and the default is
+        // right for the deployment this is designed around — the port is on an
+        // internal network. It stops being right the moment somebody puts the API
+        // behind a public ingress without carving /metrics out, so the operator who
+        // knows they are in that situation has a way to say so.
+        //
+        // A minimum length, because a two-character scrape token is worse than none
+        // — it reads as protection and is a moment's guessing.
+        metricsToken: r.secret('NACRE_METRICS_TOKEN', 16),
         maxDocumentBytes: r.number('NACRE_MAX_DOCUMENT_BYTES', 52_428_800, { min: 1024 }),
-        auditRetentionDays: r.number('NACRE_AUDIT_RETENTION_DAYS', 400, { min: 1 }),
+        // The floor is 30 and it is not a tunable. Retention is now enforced —
+        // `prune_audit_events` deletes past this horizon — and the database refuses
+        // anything shorter, because below a month "retention" stops meaning
+        // retention and becomes a way to make recent events go away, which is the
+        // thing the append-only grant exists to prevent. Refused here rather than
+        // raised hourly by the worker: a value the deployment can never act on
+        // should stop the deployment, not fill a log.
+        auditRetentionDays: r.number('NACRE_AUDIT_RETENTION_DAYS', 400, { min: 30 }),
         auditQueryText: r.boolean('NACRE_AUDIT_QUERY_TEXT', false),
+        // How long a superseded collection survives a model migration.
+        //
+        // It is a rollback window and nothing else. The cheap rollback in
+        // `rollback-layer-reindex.md` is "move the pointer back", which works for
+        // exactly as long as the collection it points back to still exists; past
+        // this horizon that option is gone and a rollback means reindexing.
+        //
+        // The floor is 1 rather than 0 because a collection deleted the instant the
+        // pointer moved would make a migration irreversible at the moment it is
+        // most likely to be found wrong. Setting it high costs disk: each retained
+        // collection is a full copy of the organization's vectors.
+        collectionRetentionDays: r.number('NACRE_COLLECTION_RETENTION_DAYS', 7, { min: 1 }),
+        // How long a `source_url` outlives the permission check that minted it.
+        //
+        // A presigned URL is a bearer capability: whoever holds it fetches that
+        // object without a Nacre credential, and a revocation inside the window
+        // does not reach it. So the ceiling is a week — SigV4's own maximum, and
+        // already far longer than any reason to hand one out — and the floor is a
+        // minute, because a link that expires while the client is still following
+        // the redirect is a link that never worked.
+        presignTtl: r.number('NACRE_PRESIGN_TTL', 900, { min: 60, max: 604_800 }),
+        // All of it or none of it — see the cross-field check below. Read here so
+        // that a malformed endpoint is a startup problem like any other; whether
+        // the *set* is coherent is a question no per-variable check can answer.
+        s3: s3From(r, env),
     };
     // Cross-field checks. Each one is a combination that parses fine and is
     // wrong, which is exactly the class a per-variable check cannot catch.
@@ -135,12 +334,51 @@ export function loadConfig(env = process.env) {
             'Turning reranking on is worth more than any chunking tuning, and it ' +
             'needs somewhere to send the request — the full profile provides one.');
     }
+    // ─── settings that would silently do nothing ───
+    //
+    // Eight variables were validated here and read nowhere. Most of those are
+    // quality-of-life and are documented as unimplemented; these two are not,
+    // because ignoring them changes something an operator is relying on.
+    //
+    // Refusing at startup rather than warning: an operator who sets these has
+    // made a decision about isolation or about collision probability, and a
+    // process that starts anyway has silently overruled them. `docs/config.md`
+    // already says a silent default is how a deployment talks to nothing and
+    // reports success — this is the same failure with a value supplied.
+    if (config.vectorTenancy !== 'collection') {
+        r.problems.push('NACRE_VECTOR_TENANCY=shared is not implemented. Every collection is named ' +
+            'per organization (org_{slug}) and there is no code path that shares one, ' +
+            'so accepting this would give you a single-collection deployment that ' +
+            'believes it is isolated. Use `collection`, which is the default.');
+    }
+    if (config.aclTagHashBytes !== 8) {
+        r.problems.push('NACRE_ACL_TAG_HASH_BYTES is not implemented: the tag width is fixed at 8 ' +
+            'bytes in the code that writes and matches tags. Setting it changes the ' +
+            'collision probability you think you have and nothing else. Leave it at 8.');
+    }
+    if (config.refreshTokenTtl <= config.accessTokenTtl) {
+        r.problems.push('NACRE_REFRESH_TOKEN_TTL is not longer than NACRE_ACCESS_TOKEN_TTL. A refresh ' +
+            'token that expires no later than the access token it renews cannot renew ' +
+            'anything, so every session would end at the first refresh.');
+    }
     if (config.aclCacheTtl > config.aclPropagationSla) {
-        // The cache would still be serving a revoked grant after the SLA has
-        // passed, and nacre_acl_propagation_lag_seconds would report compliance.
+        // Kept, and the reason it is kept has changed.
+        //
+        // It used to say a longer TTL would serve a revoked grant past the SLA.
+        // That is not true of the cache that now runs: the key carries
+        // `organizations.groups_version`, which triggers bump on every change to
+        // groups, group_members and grants, so a revoked grant is never served —
+        // the next request composes a different key. The TTL bounds memory.
+        //
+        // What it still catches is an operator who believes otherwise. Setting this
+        // above the SLA is what someone does when they have read it as "how long a
+        // stale permission may live", and a deployment configured on that belief
+        // has a misunderstanding worth interrupting at boot rather than a setting
+        // worth honouring.
         r.problems.push(`NACRE_ACL_CACHE_TTL (${config.aclCacheTtl}) is longer than ` +
-            `NACRE_ACL_PROPAGATION_SLA (${config.aclPropagationSla}); a revoked grant ` +
-            'would still be served after the SLA it promises.');
+            `NACRE_ACL_PROPAGATION_SLA (${config.aclPropagationSla}). The cache is keyed ` +
+            'on the permission epoch, so this does not delay a revocation — but a value ' +
+            'above the SLA usually means it was read as though it did.');
     }
     if (config.env === 'production' && config.canonicalUrl.startsWith('http://')) {
         // The canonical URL is the OAuth issuer and goes into every token ever

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6DH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CACH,iCAAiC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7E,gEAAgE,CACnE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAID,MAAM,MAAM;IAEmB;IADpB,QAAQ,GAAa,EAAE,CAAA;IAChC,YAA6B,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,+EAA+E;IAC/E,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,GAAG,QAAQ,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,QAAiB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,MAAM,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAmB,GAAW,EAAE,OAAqB,EAAE,QAAW;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAK,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAQ,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAU,EAAE,aAAa,CAAC;QAChF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,MAAM,CAAC;QACzF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU,EAAE,MAAM,CAAC;QAEzE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU,EAAE,YAAY,CAAC;QAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAEvC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACvD,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAE3D,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC/E,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAE7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3E,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;KAC3D,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IAEvE,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,yEAAyE;YACvE,sEAAsE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClD,qEAAqE;QACrE,yEAAyE;QACzE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,wBAAwB,MAAM,CAAC,WAAW,mBAAmB;YAC3D,8BAA8B,MAAM,CAAC,iBAAiB,qBAAqB;YAC3E,kDAAkD,CACrD,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,uEAAuE;QACvE,oEAAoE;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0HH,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4DAA4D;gBAC1D,6EAA6E;gBAC7E,2DAA2D;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,oEAAoE;gBACpE,gDAAgD;SACnD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,wEAAwE;gBACxE,+DAA+D;SAClE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,UAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;KACjD,CAAA;AACH,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CACH,iCAAiC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7E,gEAAgE,CACnE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAID,MAAM,MAAM;IAEmB;IADpB,QAAQ,GAAa,EAAE,CAAA;IAChC,YAA6B,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,+EAA+E;IAC/E,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAW,EAAE,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,qBAAqB,SAAS,uBAAuB,CAAC,CAAA;YAC/E,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,GAAG,QAAQ,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,QAAiB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,MAAM,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAmB,GAAW,EAAE,OAAqB,EAAE,QAAW;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAK,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAQ,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,MAAM,CAAC,CAAS,EAAE,GAAQ;IACjC,MAAM,IAAI,GAAG;QACX,mBAAmB;QACnB,iBAAiB;QACjB,qBAAqB;QACrB,qBAAqB;KACb,CAAA;IAEV,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC9D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,kCAAkC,CACrC,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI;YACpF,0EAA0E;YAC1E,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACrC,0EAA0E;QAC1E,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,WAAW;QACpD,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC5C,2EAA2E;QAC3E,sEAAsE;QACtE,yCAAyC;QACzC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAU,EAAE,aAAa,CAAC;QAChF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,MAAM,CAAC;QACzF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU,EAAE,MAAM,CAAC;QAEzE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU,EAAE,YAAY,CAAC;QAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAEvC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACvD,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAC3D,yDAAyD;QACzD,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAE/E,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjF,4EAA4E;QAC5E,0EAA0E;QAC1E,oCAAoC;QACpC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAE9F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC/E,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAE7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,0BAA0B;QAC1B,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,mCAAmC,EAAE,EAAE,EAAE;YACzE,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,MAAM;SACZ,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,wDAAwD;QACxD,EAAE;QACF,4EAA4E;QAC5E,uDAAuD;QACvD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjF,uEAAuE;QACvE,4EAA4E;QAC5E,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC5E,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAE1D,+DAA+D;QAC/D,EAAE;QACF,kEAAkE;QAClE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,EAAE;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,2DAA2D;QAC3D,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAEnF,wEAAwE;QACxE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAEzE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;KACnB,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IAEvE,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,yEAAyE;YACvE,sEAAsE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,kDAAkD;IAClD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,4EAA4E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,kEAAkE,CACrE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,2EAA2E;YACzE,yEAAyE;YACzE,2EAA2E,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,+EAA+E;YAC7E,2EAA2E;YAC3E,4DAA4D,CAC/D,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClD,+CAA+C;QAC/C,EAAE;QACF,wEAAwE;QACxE,+DAA+D;QAC/D,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,mBAAmB;QACnB,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,wBAAwB,MAAM,CAAC,WAAW,mBAAmB;YAC3D,8BAA8B,MAAM,CAAC,iBAAiB,wBAAwB;YAC9E,6EAA6E;YAC7E,2DAA2D,CAC9D,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,uEAAuE;QACvE,oEAAoE;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/db/client.d.ts

@@ -34,5 +34,44 @@ export interface WithOrgOptions {
      */
     readonly role?: string;
 }
+/**
+ * Run a lookup that resolves a credential, which cannot be scoped to an
+ * organization because the credential is what says which organization it is.
+ *
+ * `app.authenticating` opens a second row-level security policy on
+ * `service_accounts` for the length of the transaction — see migration 0008.
+ * Without it the query raises `unrecognized configuration parameter` on any
+ * connection that is subject to row-level security, which is every connection
+ * a deployment following `docs/config.md` will make.
+ *
+ * **This is the one path in the system that reads across tenants, and it must
+ * stay the only one.** Two things keep it narrow, and both are load-bearing:
+ * the flag is `SET LOCAL`, so it cannot outlive the transaction or come back
+ * on a pooled connection, and the policy it opens is `FOR SELECT`, so this
+ * cannot write a row into an organization it has not identified yet.
+ *
+ * Read the credential and nothing else. Anything joined from tenant data here
+ * is a cross-tenant read with the guard rail switched off.
+ */
+export declare function whileAuthenticating<T>(pool: Pool, fn: (client: PoolClient) => Promise<T>, options?: WithOrgOptions): Promise<T>;
+/**
+ * Run a query that legitimately spans every tenant, under the role the schema
+ * gives BYPASSRLS.
+ *
+ * The worker's queue is the only thing that needs this: claiming the next
+ * document to index means looking at all of them, which is what a queue is.
+ * `0001_init.sql` has said "background worker jobs run under a separate role
+ * with BYPASSRLS" since the beginning and no migration created that role until
+ * 0008, so these queries ran with no organization set and raised
+ * `unrecognized configuration parameter` on any connection subject to
+ * row-level security — every connection a deployment following
+ * `docs/config.md` makes. Indexing stopped entirely, and the Compose stack
+ * never showed it because `POSTGRES_USER` connects as a superuser.
+ *
+ * **This turns the second line of defence off.** Every query run inside it
+ * names `org_id` explicitly, because with row-level security bypassed that is
+ * the only line left.
+ */
+export declare function acrossOrganizations<T>(pool: Pool, fn: (client: PoolClient) => Promise<T>, role?: string): Promise<T>;
 export declare function withOrg<T>(pool: Pool, orgId: string, fn: (client: PoolClient) => Promise<T>, options?: WithOrgOptions): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/db/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,CAAA;AAE1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAEnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,OAAO,CAAC,CAAC,EAC7B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC,CA0BZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,CAAA;AAE1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAEnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC,CAsBZ;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,IAAI,SAAiB,GACpB,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED,wBAAsB,OAAO,CAAC,CAAC,EAC7B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC,CA0BZ"}

package/dist/db/client.js

@@ -2,6 +2,88 @@ import { Pool } from 'pg';
 export function createPool(options) {
     return new Pool({ connectionString: options.connectionString, max: options.max ?? 20 });
 }
+/**
+ * Run a lookup that resolves a credential, which cannot be scoped to an
+ * organization because the credential is what says which organization it is.
+ *
+ * `app.authenticating` opens a second row-level security policy on
+ * `service_accounts` for the length of the transaction — see migration 0008.
+ * Without it the query raises `unrecognized configuration parameter` on any
+ * connection that is subject to row-level security, which is every connection
+ * a deployment following `docs/config.md` will make.
+ *
+ * **This is the one path in the system that reads across tenants, and it must
+ * stay the only one.** Two things keep it narrow, and both are load-bearing:
+ * the flag is `SET LOCAL`, so it cannot outlive the transaction or come back
+ * on a pooled connection, and the policy it opens is `FOR SELECT`, so this
+ * cannot write a row into an organization it has not identified yet.
+ *
+ * Read the credential and nothing else. Anything joined from tenant data here
+ * is a cross-tenant read with the guard rail switched off.
+ */
+export async function whileAuthenticating(pool, fn, options = {}) {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        if (options.role !== undefined) {
+            if (!/^[a-z_][a-z0-9_]*$/i.test(options.role)) {
+                throw new Error(`refusing to set an unrecognizable role name: ${options.role}`);
+            }
+            await client.query(`SET LOCAL ROLE ${options.role}`);
+        }
+        // `true` is the local flag: it goes away with the transaction, so a pooled
+        // connection cannot hand it to the next caller.
+        await client.query('SELECT set_config($1, $2, true)', ['app.authenticating', 'on']);
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (cause) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw cause;
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * Run a query that legitimately spans every tenant, under the role the schema
+ * gives BYPASSRLS.
+ *
+ * The worker's queue is the only thing that needs this: claiming the next
+ * document to index means looking at all of them, which is what a queue is.
+ * `0001_init.sql` has said "background worker jobs run under a separate role
+ * with BYPASSRLS" since the beginning and no migration created that role until
+ * 0008, so these queries ran with no organization set and raised
+ * `unrecognized configuration parameter` on any connection subject to
+ * row-level security — every connection a deployment following
+ * `docs/config.md` makes. Indexing stopped entirely, and the Compose stack
+ * never showed it because `POSTGRES_USER` connects as a superuser.
+ *
+ * **This turns the second line of defence off.** Every query run inside it
+ * names `org_id` explicitly, because with row-level security bypassed that is
+ * the only line left.
+ */
+export async function acrossOrganizations(pool, fn, role = 'nacre_worker') {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        if (!/^[a-z_][a-z0-9_]*$/i.test(role)) {
+            throw new Error(`refusing to set an unrecognizable role name: ${role}`);
+        }
+        await client.query(`SET LOCAL ROLE ${role}`);
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (cause) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw cause;
+    }
+    finally {
+        client.release();
+    }
+}
 export async function withOrg(pool, orgId, fn, options = {}) {
     const client = await pool.connect();
     try {

package/dist/db/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAA;AAO1C,MAAM,UAAU,UAAU,CAAC,OAAkB;IAC3C,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAiCD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,KAAa,EACb,EAAsC,EACtC,UAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,2EAA2E;YAC3E,0EAA0E;YAC1E,iEAAiE;QACnE,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAA;AAO1C,MAAM,UAAU,UAAU,CAAC,OAAkB;IAC3C,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,EAAsC,EACtC,UAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,2EAA2E;QAC3E,gDAAgD;QAChD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAA;QACnF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,EAAsC,EACtC,IAAI,GAAG,cAAc;IAErB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,KAAa,EACb,EAAsC,EACtC,UAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,2EAA2E;YAC3E,0EAA0E;YAC1E,iEAAiE;QACnE,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAuB,GAAG,SAAS,SAAS,EAAE,CAyBjF;AAeD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,SAAS,SAAS,EAAqB,GAClD,OAAO,CAAC,aAAa,CAAC,CAmDxB"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAuB,GAAG,SAAS,SAAS,EAAE,CAyBjF;AAeD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,SAAS,SAAS,EAAqB,GAClD,OAAO,CAAC,aAAa,CAAC,CA4FxB"}