@nacre.work/core 0.0.0

package/dist/config.js

@@ -0,0 +1,157 @@
+/**
+ * Configuration, validated whole at startup.
+ *
+ * Two rules from docs/config.md, and both are about the same failure:
+ *
+ * **Validate everything at boot and exit if anything is missing or
+ * contradictory.** Not on first use. A service that starts and then fails the
+ * first request that needs the missing value looks healthy to an orchestrator,
+ * gets traffic, and reports the problem as an error rate.
+ *
+ * **No silent defaults for secrets or URLs.** A default that quietly points at
+ * localhost is how a production deployment ends up talking to nothing and
+ * reporting success. Defaults are fine for tunables — a cache TTL has an
+ * obviously right value — and never fine for anything naming a host or
+ * carrying a credential.
+ */
+export class ConfigError extends Error {
+    problems;
+    constructor(problems) {
+        super(`configuration is not usable:\n${problems.map((p) => `  - ${p}`).join('\n')}\n` +
+            'Every one of these is required at startup. See docs/config.md.');
+        this.name = 'ConfigError';
+        this.problems = problems;
+    }
+}
+class Reader {
+    env;
+    problems = [];
+    constructor(env) {
+        this.env = env;
+    }
+    /** Required, with no fallback. Used for anything naming a host or a secret. */
+    required(key) {
+        const value = this.env[key]?.trim();
+        if (value === undefined || value === '') {
+            this.problems.push(`${key} is not set`);
+            return '';
+        }
+        return value;
+    }
+    optional(key) {
+        const value = this.env[key]?.trim();
+        return value === undefined || value === '' ? undefined : value;
+    }
+    /** A default is allowed here: a tunable has an obviously right value. */
+    number(key, fallback, { min = 1, max = Number.MAX_SAFE_INTEGER } = {}) {
+        const raw = this.env[key]?.trim();
+        if (raw === undefined || raw === '')
+            return fallback;
+        const value = Number(raw);
+        if (!Number.isFinite(value) || !Number.isInteger(value) || value < min || value > max) {
+            this.problems.push(`${key} must be an integer between ${min} and ${max}, got ${JSON.stringify(raw)}`);
+            return fallback;
+        }
+        return value;
+    }
+    boolean(key, fallback) {
+        const raw = this.env[key]?.trim().toLowerCase();
+        if (raw === undefined || raw === '')
+            return fallback;
+        if (raw === 'true' || raw === 'false')
+            return raw === 'true';
+        this.problems.push(`${key} must be true or false, got ${JSON.stringify(raw)}`);
+        return fallback;
+    }
+    oneOf(key, allowed, fallback) {
+        const raw = this.env[key]?.trim();
+        if (raw === undefined || raw === '')
+            return fallback;
+        if (allowed.includes(raw))
+            return raw;
+        this.problems.push(`${key} must be one of ${allowed.join(', ')}, got ${JSON.stringify(raw)}`);
+        return fallback;
+    }
+    url(key, { required = true } = {}) {
+        const raw = required ? this.required(key) : (this.optional(key) ?? '');
+        if (raw === '')
+            return '';
+        try {
+            new URL(raw);
+        }
+        catch {
+            this.problems.push(`${key} is not a URL: ${JSON.stringify(raw)}`);
+        }
+        return raw;
+    }
+}
+export function loadConfig(env = process.env) {
+    const r = new Reader(env);
+    const config = {
+        env: r.oneOf('NACRE_ENV', ['development', 'production'], 'development'),
+        canonicalUrl: r.url('NACRE_CANONICAL_URL'),
+        logLevel: r.oneOf('NACRE_LOG_LEVEL', ['debug', 'info', 'warn', 'error'], 'info'),
+        logFormat: r.oneOf('NACRE_LOG_FORMAT', ['json', 'text'], 'json'),
+        pgUrl: r.required('NACRE_PG_URL'),
+        pgPoolMax: r.number('NACRE_PG_POOL_MAX', 20, { min: 1, max: 1000 }),
+        qdrantUrl: r.url('NACRE_QDRANT_URL'),
+        qdrantApiKey: r.optional('NACRE_QDRANT_API_KEY'),
+        vectorTenancy: r.oneOf('NACRE_VECTOR_TENANCY', ['collection', 'shared'], 'collection'),
+        redisUrl: r.required('NACRE_REDIS_URL'),
+        embeddingEndpoint: r.url('NACRE_DEFAULT_EMBEDDING_ENDPOINT'),
+        embeddingModel: r.required('NACRE_DEFAULT_EMBEDDING_MODEL'),
+        embeddingDim: r.number('NACRE_DEFAULT_EMBEDDING_DIM', 1024, { min: 8, max: 16384 }),
+        parserEndpoint: r.url('NACRE_PARSER_ENDPOINT'),
+        rerankerEndpoint: r.optional('NACRE_RERANKER_ENDPOINT'),
+        // False, and it was true. `minimal` has no reranker by definition — the
+        // profile exists to run on a laptop without a GPU — so a default of true
+        // meant the documented starting profile refused to boot until the operator
+        // turned off a feature they had not asked for. It is also not implemented
+        // on the search path yet, so the refusal bought nothing at all.
+        rerankerEnabled: r.boolean('NACRE_RERANKER_ENABLED', false),
+        jwtIssuer: r.required('NACRE_JWT_ISSUER'),
+        jwtAudience: r.required('NACRE_JWT_AUDIENCE'),
+        accessTokenTtl: r.number('NACRE_ACCESS_TOKEN_TTL', 900, { min: 60, max: 86_400 }),
+        aclCacheTtl: r.number('NACRE_ACL_CACHE_TTL', 60, { min: 0, max: 3600 }),
+        aclPropagationSla: r.number('NACRE_ACL_PROPAGATION_SLA', 60, { min: 1, max: 3600 }),
+        gcGrace: r.number('NACRE_GC_GRACE', 3600, { min: 0, max: 2_592_000 }),
+        // 15 minutes: long enough for a large PDF through parse, chunk, embed, and
+        // upsert, short enough that a drained node's documents are not stuck for an
+        // afternoon. The minimum is 60 rather than 0 — a zero lease reclaims a
+        // document the instant it is claimed, which is a loop, not a setting.
+        indexLease: r.number('NACRE_INDEX_LEASE', 900, { min: 60, max: 86_400 }),
+        indexMaxAttempts: r.number('NACRE_INDEX_MAX_ATTEMPTS', 5, { min: 1, max: 100 }),
+        aclTagHashBytes: r.number('NACRE_ACL_TAG_HASH_BYTES', 8, { min: 4, max: 32 }),
+        rateSearchPerMin: r.number('NACRE_RATE_SEARCH_PER_MIN', 60, { min: 1 }),
+        rateIngestPerHour: r.number('NACRE_RATE_INGEST_PER_HOUR', 600, { min: 1 }),
+        maxDocumentBytes: r.number('NACRE_MAX_DOCUMENT_BYTES', 52_428_800, { min: 1024 }),
+        auditRetentionDays: r.number('NACRE_AUDIT_RETENTION_DAYS', 400, { min: 1 }),
+        auditQueryText: r.boolean('NACRE_AUDIT_QUERY_TEXT', false),
+    };
+    // Cross-field checks. Each one is a combination that parses fine and is
+    // wrong, which is exactly the class a per-variable check cannot catch.
+    if (config.rerankerEnabled && config.rerankerEndpoint === undefined) {
+        r.problems.push('NACRE_RERANKER_ENABLED is true but NACRE_RERANKER_ENDPOINT is not set. ' +
+            'Turning reranking on is worth more than any chunking tuning, and it ' +
+            'needs somewhere to send the request — the full profile provides one.');
+    }
+    if (config.aclCacheTtl > config.aclPropagationSla) {
+        // The cache would still be serving a revoked grant after the SLA has
+        // passed, and nacre_acl_propagation_lag_seconds would report compliance.
+        r.problems.push(`NACRE_ACL_CACHE_TTL (${config.aclCacheTtl}) is longer than ` +
+            `NACRE_ACL_PROPAGATION_SLA (${config.aclPropagationSla}); a revoked grant ` +
+            'would still be served after the SLA it promises.');
+    }
+    if (config.env === 'production' && config.canonicalUrl.startsWith('http://')) {
+        // The canonical URL is the OAuth issuer and goes into every token ever
+        // issued. Over plaintext it is also the thing an attacker rewrites.
+        r.problems.push('NACRE_CANONICAL_URL must be https in production; it is the OAuth issuer');
+    }
+    if (config.env === 'production' && /(^|\/\/)(localhost|127\.0\.0\.1)/.test(config.canonicalUrl)) {
+        r.problems.push('NACRE_CANONICAL_URL points at localhost in production');
+    }
+    if (r.problems.length > 0)
+        throw new ConfigError(r.problems);
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6DH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CACH,iCAAiC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7E,gEAAgE,CACnE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAID,MAAM,MAAM;IAEmB;IADpB,QAAQ,GAAa,EAAE,CAAA;IAChC,YAA6B,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,+EAA+E;IAC/E,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,GAAG,QAAQ,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,QAAiB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,MAAM,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAmB,GAAW,EAAE,OAAqB,EAAE,QAAW;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAK,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAQ,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAU,EAAE,aAAa,CAAC;QAChF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,MAAM,CAAC;QACzF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU,EAAE,MAAM,CAAC;QAEzE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU,EAAE,YAAY,CAAC;QAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAEvC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACvD,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAE3D,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC/E,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAE7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3E,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;KAC3D,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IAEvE,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,yEAAyE;YACvE,sEAAsE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClD,qEAAqE;QACrE,yEAAyE;QACzE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,wBAAwB,MAAM,CAAC,WAAW,mBAAmB;YAC3D,8BAA8B,MAAM,CAAC,iBAAiB,qBAAqB;YAC3E,kDAAkD,CACrD,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,uEAAuE;QACvE,oEAAoE;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/db/client.d.ts

@@ -0,0 +1,38 @@
+import { Pool, type PoolClient } from 'pg';
+export interface DbOptions {
+    readonly connectionString: string;
+    readonly max?: number;
+}
+export declare function createPool(options: DbOptions): Pool;
+/**
+ * Run `fn` on a connection scoped to one organization.
+ *
+ * `app.current_org` is what every row-level security policy reads. It is set
+ * with `set_config(..., true)` — local to the transaction — so it cannot leak
+ * to the next borrower of a pooled connection. A pool plus a session-level
+ * setting is the classic way this goes wrong: the setting outlives the request
+ * and the next tenant inherits it.
+ *
+ * The transaction is therefore not optional. It is the thing that scopes the
+ * setting.
+ *
+ * This is the second line of defense, not the mechanism. Queries still name
+ * `org_id` themselves, and invariant I1 is still re-checked when a response is
+ * serialized. RLS exists so that one forgotten `WHERE` returns nothing instead
+ * of another tenant's rows.
+ */
+export interface WithOrgOptions {
+    /**
+     * Switch to this role for the transaction, with `SET LOCAL ROLE`.
+     *
+     * Row-level security does not apply to a superuser at all, and applies to the
+     * table owner only where the table is FORCE'd. Migrations run as the owner,
+     * so a deployment that reuses that connection for the application gets
+     * policies that are enabled and inert. Connecting as an unprivileged role is
+     * the fix; this option exists for deployments that cannot, and for tests that
+     * need to prove the policies bite.
+     */
+    readonly role?: string;
+}
+export declare function withOrg<T>(pool: Pool, orgId: string, fn: (client: PoolClient) => Promise<T>, options?: WithOrgOptions): Promise<T>;
+//# sourceMappingURL=client.d.ts.map

package/dist/db/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,CAAA;AAE1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAEnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,OAAO,CAAC,CAAC,EAC7B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,EACtC,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,CAAC,CAAC,CA0BZ"}

package/dist/db/client.js

@@ -0,0 +1,34 @@
+import { Pool } from 'pg';
+export function createPool(options) {
+    return new Pool({ connectionString: options.connectionString, max: options.max ?? 20 });
+}
+export async function withOrg(pool, orgId, fn, options = {}) {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        if (options.role !== undefined) {
+            // Not parameterizable — a role name is an identifier, not a value. The
+            // caller supplies it from configuration, never from a request.
+            if (!/^[a-z_][a-z0-9_]*$/i.test(options.role)) {
+                throw new Error(`refusing to set an unrecognizable role name: ${options.role}`);
+            }
+            await client.query(`SET LOCAL ROLE ${options.role}`);
+        }
+        await client.query('SELECT set_config($1, $2, true)', ['app.current_org', orgId]);
+        const result = await fn(client);
+        await client.query('COMMIT');
+        return result;
+    }
+    catch (cause) {
+        await client.query('ROLLBACK').catch(() => {
+            // A rollback that itself fails means the connection is unusable. Releasing
+            // it with an error below discards it rather than returning it to the pool
+            // with an open transaction and someone else's org setting on it.
+        });
+        throw cause;
+    }
+    finally {
+        client.release();
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/db/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAA;AAO1C,MAAM,UAAU,UAAU,CAAC,OAAkB;IAC3C,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAiCD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAAU,EACV,KAAa,EACb,EAAsC,EACtC,UAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,gDAAgD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACjF,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,2EAA2E;YAC3E,0EAA0E;YAC1E,iEAAiE;QACnE,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/db/migrate.d.ts

@@ -0,0 +1,32 @@
+export interface Migration {
+    readonly name: string;
+    readonly sql: string;
+}
+/**
+ * Migrations in filename order. Numbered prefixes are compared as numbers, so
+ * `0010` sorts after `0009` rather than between `0001` and `0002`.
+ */
+export declare function loadMigrations(dir?: string): readonly Migration[];
+export interface MigrateResult {
+    readonly applied: readonly string[];
+    readonly skipped: readonly string[];
+}
+/**
+ * Apply every migration that has not been applied yet.
+ *
+ * Two properties worth stating, because both are load-bearing:
+ *
+ * **Each migration runs inside its own transaction**, together with the ledger
+ * row that records it. A migration that fails halfway leaves the database as it
+ * was — the alternative is a schema that is neither the old one nor the new one
+ * and no record of which, which is the worst state to debug a permissions
+ * system in.
+ *
+ * **Applied migrations are checksummed and re-checked.** Editing a file that
+ * has already run is the mistake this catches: it works on the author's fresh
+ * database and does nothing on every environment that already applied the old
+ * text, so the two silently diverge. Migrations are forward-only; fixing one
+ * means adding another.
+ */
+export declare function migrate(connectionString: string, migrations?: readonly Migration[]): Promise<MigrateResult>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAuB,GAAG,SAAS,SAAS,EAAE,CAyBjF;AAeD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,SAAS,SAAS,EAAqB,GAClD,OAAO,CAAC,aAAa,CAAC,CAmDxB"}

package/dist/db/migrate.js

@@ -0,0 +1,103 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from 'pg';
+const MIGRATIONS_DIR = fileURLToPath(new URL('../migrations/', import.meta.url));
+/**
+ * Migrations in filename order. Numbered prefixes are compared as numbers, so
+ * `0010` sorts after `0009` rather than between `0001` and `0002`.
+ */
+export function loadMigrations(dir = MIGRATIONS_DIR) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch (cause) {
+        // The built package resolves this to dist/migrations, which tsc does not
+        // create — it compiles .ts and ignores .sql. Saying so beats an ENOENT
+        // naming a path the caller has no reason to recognise.
+        throw new Error(`no migrations directory at ${dir}. In a published build this means the ` +
+            'SQL was not copied into dist; see packages/core/scripts/copy-migrations.mjs.', { cause });
+    }
+    const migrations = entries.filter((f) => f.endsWith('.sql'));
+    if (migrations.length === 0) {
+        // Applying nothing and reporting success would leave a fresh database with
+        // no tables and a ledger saying everything is up to date.
+        throw new Error(`no .sql files in ${dir}; there is nothing to apply and that is not "already migrated"`);
+    }
+    return migrations
+        .sort((a, b) => Number.parseInt(a, 10) - Number.parseInt(b, 10) || a.localeCompare(b))
+        .map((name) => ({ name, sql: readFileSync(join(dir, name), 'utf8') }));
+}
+const LEDGER = `
+  CREATE TABLE IF NOT EXISTS schema_migrations (
+    name       text PRIMARY KEY,
+    checksum   text NOT NULL,
+    applied_at timestamptz NOT NULL DEFAULT now()
+  )
+`;
+async function checksum(sql) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(sql));
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Apply every migration that has not been applied yet.
+ *
+ * Two properties worth stating, because both are load-bearing:
+ *
+ * **Each migration runs inside its own transaction**, together with the ledger
+ * row that records it. A migration that fails halfway leaves the database as it
+ * was — the alternative is a schema that is neither the old one nor the new one
+ * and no record of which, which is the worst state to debug a permissions
+ * system in.
+ *
+ * **Applied migrations are checksummed and re-checked.** Editing a file that
+ * has already run is the mistake this catches: it works on the author's fresh
+ * database and does nothing on every environment that already applied the old
+ * text, so the two silently diverge. Migrations are forward-only; fixing one
+ * means adding another.
+ */
+export async function migrate(connectionString, migrations = loadMigrations()) {
+    const client = new Client({ connectionString });
+    await client.connect();
+    const applied = [];
+    const skipped = [];
+    try {
+        await client.query(LEDGER);
+        const { rows } = await client.query('SELECT name, checksum FROM schema_migrations');
+        const ledger = new Map(rows.map((r) => [r.name, r.checksum]));
+        for (const migration of migrations) {
+            const sum = await checksum(migration.sql);
+            const recorded = ledger.get(migration.name);
+            if (recorded !== undefined) {
+                if (recorded !== sum) {
+                    throw new Error(`migration ${migration.name} was modified after it was applied ` +
+                        '(checksum mismatch). Migrations are forward-only: add a new one ' +
+                        'rather than editing this file, or the databases that already ran ' +
+                        'the old text will never receive the change.');
+                }
+                skipped.push(migration.name);
+                continue;
+            }
+            await client.query('BEGIN');
+            try {
+                await client.query(migration.sql);
+                await client.query('INSERT INTO schema_migrations (name, checksum) VALUES ($1, $2)', [
+                    migration.name,
+                    sum,
+                ]);
+                await client.query('COMMIT');
+                applied.push(migration.name);
+            }
+            catch (cause) {
+                await client.query('ROLLBACK');
+                throw new Error(`migration ${migration.name} failed and was rolled back`, { cause });
+            }
+        }
+    }
+    finally {
+        await client.end();
+    }
+    return { applied, skipped };
+}
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAE3B,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAOhF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,cAAc;IACzD,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,wCAAwC;YACvE,8EAA8E,EAChF,EAAE,KAAK,EAAE,CACV,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,gEAAgE,CAAC,CAAA;IAC1G,CAAC;IAED,OAAO,UAAU;SACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACrF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,MAAM,GAAG;;;;;;CAMd,CAAA;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACnF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,gBAAwB,EACxB,aAAmC,cAAc,EAAE;IAEnD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC/C,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IAEtB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAE1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8CAA8C,CAC/C,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;QAE7D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAE3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,aAAa,SAAS,CAAC,IAAI,qCAAqC;wBAC9D,kEAAkE;wBAClE,mEAAmE;wBACnE,6CAA6C,CAChD,CAAA;gBACH,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC5B,SAAQ;YACV,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACjC,MAAM,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE;oBACnF,SAAS,CAAC,IAAI;oBACd,GAAG;iBACJ,CAAC,CAAA;gBACF,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAC5B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,SAAS,CAAC,IAAI,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAA;IACpB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export * from './types.js';
+export * from './authz/index.js';
+export { loadConfig, ConfigError } from './config.js';
+export type { Config } from './config.js';
+export { createPool, withOrg } from './db/client.js';
+export type { DbOptions, WithOrgOptions } from './db/client.js';
+export { migrate, loadMigrations } from './db/migrate.js';
+export { loadGrants, loadGroupsVersion, loadScopeTree, PostgresGroupGraph } from './authz/store.js';
+export { VectorStore } from './vector/search.js';
+export type { Hit, SearchRequest, VectorStoreOptions } from './vector/search.js';
+export { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES, vectorName } from './vector/query.js';
+export type { Branch, HybridQuery } from './vector/query.js';
+export { Counter, Gauge, Histogram, Registry, createMetrics } from './metrics.js';
+export type { Labels, Metrics } from './metrics.js';
+export { collectDatabaseGauges } from './observability.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACpD,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnH,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACjF,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export * from './types.js';
+export * from './authz/index.js';
+export { loadConfig, ConfigError } from './config.js';
+export { createPool, withOrg } from './db/client.js';
+export { migrate, loadMigrations } from './db/migrate.js';
+export { loadGrants, loadGroupsVersion, loadScopeTree, PostgresGroupGraph } from './authz/store.js';
+export { VectorStore } from './vector/search.js';
+export { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES, vectorName } from './vector/query.js';
+export { Counter, Gauge, Histogram, Registry, createMetrics } from './metrics.js';
+export { collectDatabaseGauges } from './observability.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEhD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEnH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/metrics.d.ts

@@ -0,0 +1,77 @@
+/**
+ * A minimal Prometheus registry.
+ *
+ * Dependency-free because the exposition format is four lines of rules and this
+ * container reads documents for a living — every dependency in it is something
+ * to keep patched. If the needs here outgrow histograms and gauges, replace it
+ * with prom-client rather than growing this file.
+ */
+export type Labels = Readonly<Record<string, string>>;
+interface Metric {
+    readonly name: string;
+    readonly help: string;
+    readonly type: 'counter' | 'gauge' | 'histogram';
+    render(): string[];
+}
+export declare class Counter implements Metric {
+    #private;
+    readonly name: string;
+    readonly help: string;
+    readonly type: "counter";
+    constructor(name: string, help: string);
+    inc(labels?: Labels, by?: number): void;
+    render(): string[];
+}
+export declare class Gauge implements Metric {
+    #private;
+    readonly name: string;
+    readonly help: string;
+    readonly type: "gauge";
+    constructor(name: string, help: string);
+    set(value: number, labels?: Labels): void;
+    reset(): void;
+    render(): string[];
+}
+export declare class Histogram implements Metric {
+    #private;
+    readonly name: string;
+    readonly help: string;
+    readonly buckets: readonly number[];
+    readonly type: "histogram";
+    constructor(name: string, help: string, buckets?: readonly number[]);
+    observe(seconds: number, labels?: Labels): void;
+    /** Times `fn`, recording however it ends. A failure has a duration too. */
+    time<T>(labels: Labels, fn: () => Promise<T>): Promise<T>;
+    render(): string[];
+}
+export declare class Registry {
+    #private;
+    register<T extends Metric>(metric: T): T;
+    /**
+     * A function run before every scrape, for values that are queries rather than
+     * counters — document counts, the propagation lag, pending tombstones.
+     */
+    collect(fn: () => Promise<void>): void;
+    render(): Promise<string>;
+}
+/**
+ * The metrics docs/config.md requires.
+ *
+ * `nacre_acl_propagation_lag_seconds` is the one with an alert on it, and the
+ * reason is worth restating where the metric is defined: it is the only
+ * external evidence that invariant I4 — a revoked grant reflected within the
+ * SLA — still holds. Everything else here describes how the system is doing.
+ * This one describes whether it is still correct.
+ */
+export declare function createMetrics(registry: Registry): {
+    searchDuration: Histogram;
+    searchResults: Counter;
+    aclDenials: Counter;
+    aclPropagationLag: Gauge;
+    ingestDuration: Histogram;
+    documents: Gauge;
+    tombstonesPending: Gauge;
+};
+export type Metrics = ReturnType<typeof createMetrics>;
+export {};
+//# sourceMappingURL=metrics.d.ts.map

package/dist/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAgBrD,UAAU,MAAM;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,CAAA;IAChD,MAAM,IAAI,MAAM,EAAE,CAAA;CACnB;AAED,qBAAa,OAAQ,YAAW,MAAM;;IAKlC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IALvB,QAAQ,CAAC,IAAI,EAAG,SAAS,CAAS;gBAIvB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;IAKvB,GAAG,CAAC,MAAM,GAAE,MAAW,EAAE,EAAE,SAAI,GAAG,IAAI;IAOtC,MAAM,IAAI,MAAM,EAAE;CAOnB;AAED,qBAAa,KAAM,YAAW,MAAM;;IAKhC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IALvB,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAS;gBAIrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;IAKvB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI;IAI7C,KAAK,IAAI,IAAI;IAIb,MAAM,IAAI,MAAM,EAAE;CAInB;AAID,qBAAa,SAAU,YAAW,MAAM;;IAKpC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IANrC,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;gBAIzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,SAAS,MAAM,EAAoB;IAKvD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI;IAgBnD,2EAA2E;IACrE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAS/D,MAAM,IAAI,MAAM,EAAE;CAmBnB;AAED,qBAAa,QAAQ;;IAInB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC;IAQxC;;;OAGG;IACH,OAAO,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIhC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAahC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ;;;;;;;;EA8B/C;AAED,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAA"}