@nacre.work/core 0.1.0 → 0.3.0

package/dist/vector/search.js

@@ -1,5 +1,6 @@
 import { QdrantClient } from '@qdrant/js-client-rest';
 import { buildFilter, METADATA_PREFIX } from '../authz/filter.js';
+import { logger } from '../logging.js';
 import { buildHybridQuery, collectionConfig, collectionName, PAYLOAD_INDEXES, vectorParams } from './query.js';
 /**
  * What Qdrant actually said.
@@ -14,6 +15,118 @@ export function explainQdrant(cause) {
     const data = cause?.data;
     return data === undefined ? String(cause) : `${String(cause)} — ${JSON.stringify(data)}`;
 }
+/**
+ * How many metadata keys one collection will have indexes built for.
+ *
+ * The keys are the caller's, so unlike `PAYLOAD_INDEXES` the set is not known
+ * in advance and has no natural end: `parseMetadata` bounds a *document* to 32
+ * keys and says nothing about how many distinct ones an organization uses, so
+ * a caller putting an identifier in a key name would otherwise ask for an index
+ * per document.
+ *
+ * A constant rather than a `NACRE_` variable. Every configuration variable is a
+ * thing an operator has to understand and a thing `docs/config.md` has to
+ * explain, and the failure this bounds — a slower filter past the sixty-fourth
+ * distinct key — needs no per-deployment answer.
+ */
+export const METADATA_INDEX_LIMIT = 64;
+/**
+ * Payload indexes for the keys a caller filters on.
+ *
+ * `PAYLOAD_INDEXES` covers the fields the permission filter uses, which are
+ * fixed. A metadata filter reaches `meta.<key>`, and those fields had no index
+ * at all — so the narrowing that `filters` performs was evaluated by scanning,
+ * which is the failure the comment on `PAYLOAD_INDEXES` describes: it does not
+ * fail a test, it gets slow at a customer's volume.
+ *
+ * Built when metadata is written, because that is the only moment the keys are
+ * known. Three properties make that safe, and each was checked against a real
+ * Qdrant rather than read:
+ *
+ * - **A missing index is slow, never wrong.** A filter on an unindexed field —
+ *   and on one indexed under the wrong type — still returns exactly the right
+ *   points. Qdrant falls back to a scan. So this is an optimization end to end,
+ *   and everything below may fail without changing an answer.
+ * - **Creating one is idempotent**, and it back-fills: an index added after the
+ *   points covers them, so nothing has to be rebuilt or ordered.
+ * - **`keyword` is safe for every value type.** A number or a boolean under a
+ *   keyword index simply indexes nothing and still matches, and strings and
+ *   lists of strings — the case `filters` exists for, "only documents from this
+ *   source" — index properly.
+ *
+ * Which is why a failure here warns and returns. This is the opposite of
+ * invariant I3 and deliberately so: nothing about an index decides who sees
+ * what, and failing an ingest because an index could not be built would trade a
+ * slow query for a document that never arrives.
+ */
+export class MetadataIndexer {
+    #client;
+    #limit;
+    /** Per collection, the `meta.` fields known to be indexed. */
+    #known = new Map();
+    #atLimit = new Set();
+    constructor(client, limit = METADATA_INDEX_LIMIT) {
+        this.#client = client;
+        this.#limit = limit;
+    }
+    /**
+     * Held on the instance rather than in a module-level map: two stores against
+     * different collections must not share it, and a cache that outlives the
+     * process that built it is a cache nothing invalidates. Staleness is harmless
+     * anyway — the operation it saves is idempotent.
+     */
+    async #indexed(collection) {
+        const cached = this.#known.get(collection);
+        if (cached !== undefined)
+            return cached;
+        const info = await this.#client.getCollection(collection);
+        const schema = (info.payload_schema ?? {});
+        const fields = new Set(Object.keys(schema).filter((field) => field.startsWith(`${METADATA_PREFIX}.`)));
+        this.#known.set(collection, fields);
+        return fields;
+    }
+    async ensure(collection, keys) {
+        const wanted = [...keys];
+        if (wanted.length === 0)
+            return;
+        try {
+            const indexed = await this.#indexed(collection);
+            for (const key of wanted) {
+                const field = `${METADATA_PREFIX}.${key}`;
+                if (indexed.has(field))
+                    continue;
+                if (indexed.size >= this.#limit) {
+                    // Once per collection per process. The filter still answers
+                    // correctly; it stops being answered from an index.
+                    if (!this.#atLimit.has(collection)) {
+                        this.#atLimit.add(collection);
+                        logger.warn('metadata index limit reached', { collection,
+                            limit: this.#limit,
+                            unindexed: field });
+                    }
+                    continue;
+                }
+                await this.#client.createPayloadIndex(collection, {
+                    field_name: field,
+                    field_schema: 'keyword',
+                    wait: true,
+                });
+                indexed.add(field);
+            }
+        }
+        catch (cause) {
+            // Never fatal. See the note on this class.
+            logger.warn('metadata index build failed', { collection,
+                error: explainQdrant(cause) });
+        }
+    }
+    /** The `meta.` indexes a collection already has, for carrying across a copy. */
+    static async fieldsOf(client, collection) {
+        const info = await client.getCollection(collection);
+        const schema = (info.payload_schema ?? {});
+        return Object.keys(schema).filter((field) => field.startsWith(`${METADATA_PREFIX}.`));
+    }
+}
 /**
  * The vector store.
  *
@@ -28,6 +141,7 @@ export function explainQdrant(cause) {
  */
 export class VectorStore {
     #client;
+    #metadataIndexes;
     constructor(options) {
         // exactOptionalPropertyTypes distinguishes "absent" from "present and
         // undefined", and the client's parameters mean it: passing apiKey:
@@ -35,6 +149,7 @@ export class VectorStore {
         this.#client = new QdrantClient(options.apiKey === undefined
             ? { url: options.url }
             : { url: options.url, apiKey: options.apiKey });
+        this.#metadataIndexes = new MetadataIndexer(this.#client);
     }
     /**
      * Create an organization's first collection, if it is not there.
@@ -85,7 +200,7 @@ export class VectorStore {
      * Replace the caller's metadata on every point of a document.
      *
      * `setPayload` under the reserved key, which merges at the top level and so
-     * leaves `org_id`, `deleted`, `acl_tags` and the rest exactly as they were —
+     * leaves `org_id`, `deleted`, `doc_id` and the rest exactly as they were —
      * the namespace is what makes that safe rather than a list of fields to
      * preserve.
      *
@@ -109,6 +224,63 @@ export class VectorStore {
         catch (cause) {
             throw new Error(`metadata write to ${collection} rejected: ${explainQdrant(cause)}`, { cause });
         }
+        // After the write, not before: an index built for a write that then failed
+        // is an index for a key no point carries.
+        await this.#metadataIndexes.ensure(collection, Object.keys(metadata));
+    }
+    /**
+     * Remove a collection.
+     *
+     * Tolerates one that is not there. The caller is the retire sweep, which
+     * drops before it forgets the row — so a pass that dropped and then failed to
+     * forget comes back to a name whose collection is already gone, and that is a
+     * completed job rather than an error. The alternative order loses the only
+     * record that the collection exists.
+     *
+     * There is no confirmation and no dry run because there is no ambiguity at
+     * this level: by the time a name reaches here it has been through the
+     * rollback window and been checked against every organization's pointer.
+     */
+    async dropCollection(collection) {
+        try {
+            await this.#client.deleteCollection(collection);
+        }
+        catch (cause) {
+            const existing = await this.#client.getCollections();
+            if (existing.collections.some((c) => c.name === collection)) {
+                throw new Error(`deleting ${collection} rejected: ${explainQdrant(cause)}`, { cause });
+            }
+        }
+    }
+    /**
+     * Drop one named vector's data from a layer's points.
+     *
+     * Qdrant cannot remove a named vector from a collection's schema — that is
+     * the constraint the whole reindex design turns on — but it can remove the
+     * *data* for one from a chosen set of points, and the data is what costs
+     * anything: a float per dimension per point, in memory by default.
+     *
+     * Scoped to one layer, because a collection holds several and only the ones
+     * that finished migrating have a slot to give back.
+     *
+     * The consequence to be careful about, checked by asking a running Qdrant: a
+     * point with no vector under the queried name does not error, it simply does
+     * not match. So calling this for a slot something still searches would empty
+     * that layer's results silently — which is why the caller selects only
+     * layers whose `vector_name` has already moved, and never the slot it moved
+     * to.
+     */
+    async dropLayerVector(collection, layerId, vectorName) {
+        try {
+            await this.#client.deleteVectors(collection, {
+                wait: true,
+                vector: [vectorName],
+                filter: { must: [{ key: 'layer_id', match: { value: layerId } }] },
+            });
+        }
+        catch (cause) {
+            throw new Error(`dropping ${vectorName} from ${collection} rejected: ${explainQdrant(cause)}`, { cause });
+        }
     }
     /**
      * The named vectors a collection has, and their widths.
@@ -170,6 +342,18 @@ export class VectorStore {
                 wait: true,
             });
         }
+        // The metadata indexes too, or a reindex quietly undoes them: the new
+        // collection is built from `PAYLOAD_INDEXES`, which by construction knows
+        // nothing about keys a caller chose, so every metadata filter in that
+        // organization would go back to scanning the moment the pointer moved. The
+        // source is the only record of which keys are in use.
+        for (const field of await MetadataIndexer.fieldsOf(this.#client, input.from)) {
+            await this.#client.createPayloadIndex(input.to, {
+                field_name: field,
+                field_schema: 'keyword',
+                wait: true,
+            });
+        }
         const batch = input.batch ?? 256;
         let offset = undefined;
         let copied = 0;

package/dist/vector/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsC,MAAM,oBAAoB,CAAA;AACrG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3H;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAA;IACvD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1F,CAAC;AAwCD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAc;IAE9B,YAAY,OAA2B;QACrC,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAC7B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YACtB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACjD,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;QACtE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAElE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAU,CAAC,CAAA;QAEtF,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,UAAkB;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;SAC3D,CAAC,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CACf,UAAkB,EAClB,UAAkB,EAClB,QAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;gBACxC,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;aAC3D,CAAC,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qBAAqB,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACnE,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAsC,CAAA;QACzF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,gCAAgC,KAAK,CAAC,SAAS,CAAC,IAAI,uBAAuB,CACzF,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAElE,mDAAmD;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC5C,OAAO,EAAE,OAAgB;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC5B,iBAAiB,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE;YAChD,eAAe,EAAE,IAAI;SACb,CAAC,CAAA;QAEX,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAA;QAChC,IAAI,MAAM,GAAY,SAAS,CAAA;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;QAEd,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,IAAI;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aACtD,CAAC,CAAA;YAEX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;oBAClC,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,+DAA+D;wBAC/D,sCAAsC;wBACtC,MAAM,EAAE,CAAC,CAAC,MAAe;wBACzB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;qBACzB,CAAC,CAAC;iBACK,CAAC,CAAA;gBACX,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;gBACvB,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAChC,CAAC,QAAQ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAc,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,iBAAiB,OAAO,CAAC,UAAU,SAAS;gBAC1C,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACtF,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAA4B;SACtD,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa,EAAE,IAAoB;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,kBAAkB;oBAC/D,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,KAAK,EAAE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,KAAK;QACT,0EAA0E;QAC1E,0BAA0B;IAC5B,CAAC;CACF"}
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../vector/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAsC,MAAM,oBAAoB,CAAA;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAe,MAAM,YAAY,CAAA;AAE3H;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAA;IACvD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAA;AAC1F,CAAC;AAwCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,CAAc;IACrB,MAAM,CAAQ;IACvB,8DAA8D;IACrD,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,YAAY,MAAoB,EAAE,QAAgB,oBAAoB;QACpE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QAEvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAA;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAC/E,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QACnC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,IAAsB;QACrD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAA;QACxB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YAE/C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,GAAG,eAAe,IAAI,GAAG,EAAE,CAAA;gBACzC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAQ;gBAEhC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChC,4DAA4D;oBAC5D,oDAAoD;oBACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;wBAC7B,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,UAAU;4BACpD,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;oBACzB,CAAC;oBACD,SAAQ;gBACV,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE;oBAChD,UAAU,EAAE,KAAK;oBACjB,YAAY,EAAE,SAAkB;oBAChC,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2CAA2C;YAC3C,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,UAAU;gBACnD,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAoB,EAAE,UAAkB;QAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAA4B,CAAA;QACrE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,eAAe,GAAG,CAAC,CAAC,CAAA;IACvF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAc;IACrB,gBAAgB,CAAiB;IAE1C,YAAY,OAA2B;QACrC,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAC7B,OAAO,CAAC,MAAM,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YACtB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CACjD,CAAA;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;QACtE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAElE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAU,CAAC,CAAA;QAEtF,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,UAAkB;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;SAC3D,CAAC,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CACf,UAAkB,EAClB,UAAkB,EAClB,QAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE;gBACxC,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE;gBACxC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;aAC3D,CAAC,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qBAAqB,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACnE,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;YACpD,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,OAAe,EAAE,UAAkB;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC3C,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,CAAC,UAAU,CAAC;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;aAC1D,CAAC,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,SAAS,UAAU,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EAC7E,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAsC,CAAA;QACzF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CACxE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,cAAc,CAAC,KAQpB;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,gCAAgC,KAAK,CAAC,SAAS,CAAC,IAAI,uBAAuB,CACzF,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,CAAA;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAElE,mDAAmD;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACpE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC5C,OAAO,EAAE,OAAgB;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC5B,iBAAiB,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE;YAChD,eAAe,EAAE,IAAI;SACb,CAAC,CAAA;QAEX,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAqB;gBACzC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9C,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,SAAkB;gBAChC,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAA;QAChC,IAAI,MAAM,GAAY,SAAS,CAAA;QAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;QAEd,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,IAAI;gBACjB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aACtD,CAAC,CAAA;YAEX,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;YAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;oBAClC,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,+DAA+D;wBAC/D,sCAAsC;wBACtC,MAAM,EAAE,CAAC,CAAC,MAAe;wBACzB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;qBACzB,CAAC,CAAC;iBACK,CAAC,CAAA;gBACX,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;gBACvB,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAA;YAC5B,CAAC;YAED,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QAChC,CAAC,QAAQ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAC,CAAA;QAEF,IAAI,MAAM,CAAA;QACV,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAc,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,iBAAiB,OAAO,CAAC,UAAU,SAAS;gBAC1C,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,aAAa,CAAC,KAAK,CAAC,EAAE,EACtF,EAAE,KAAK,EAAE,CACV,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAA4B;SACtD,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,KAAa,EAAE,IAAoB;QACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yCAAyC,GAAG,CAAC,EAAE,kBAAkB;oBAC/D,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,KAAK,EAAE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,KAAK;QACT,0EAA0E;QAC1E,0BAA0B;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nacre.work/core",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Nacre core: data model, permission resolver, and shared types",
   "repository": {
     "type": "git",

package/dist/authz/tags.d.ts

@@ -1,40 +0,0 @@
-import type { PrincipalRef } from '../types.js';
-/**
- * ACL tags: the denormalization described in docs/authz.md 3.6.
- *
- * Each indexed chunk carries hashes of the principals allowed to read it, so a
- * filter can narrow on the payload instead of joining back to Postgres. The
- * thing to keep in view is what it is *not*:
- *
- * **`acl_tags` is a cache. The `grants` table is the source of truth.** A grant
- * change starts a background recomputation, and until it finishes the tags are
- * stale. That is why the layer bound stays in every query rather than being
- * "simplified" away once tags exist — see the collision note below.
- */
-/** Bytes kept from each hash. The default matches `NACRE_ACL_TAG_HASH_BYTES`. */
-export declare const DEFAULT_TAG_BYTES = 8;
-/**
- * Hash one principal reference into a tag.
- *
- * Truncation is deliberate and it does collide: 8 bytes over a large enough
- * population will eventually produce two principals with the same tag, and a
- * collision means a false tag match — a chunk appearing to be readable by
- * someone it was not granted to.
- *
- * That is only safe because **the query is also bounded by the allowed
- * `layer_id` list**. A colliding tag inside a layer the caller may already read
- * changes nothing; a colliding tag in a layer they may not read never gets
- * considered, because the layer bound excludes it first. Remove the layer bound
- * and the truncation becomes a leak — which is the single most important thing
- * to know before touching this file.
- */
-export declare function principalTag(ref: PrincipalRef, bytes?: number): string;
-/**
- * The tags for a set of principals, sorted so the payload is stable.
- *
- * Stability matters for the recomputation job: an unstable order makes every
- * chunk look changed on every pass, and the propagation metric stops meaning
- * anything.
- */
-export declare function aclTags(principals: Iterable<PrincipalRef>, bytes?: number): readonly string[];
-//# sourceMappingURL=tags.d.ts.map

package/dist/authz/tags.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../authz/tags.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,IAAI,CAAA;AAElC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,GAAE,MAA0B,GAAG,MAAM,CAMzF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,EAClC,KAAK,GAAE,MAA0B,GAChC,SAAS,MAAM,EAAE,CAEnB"}

package/dist/authz/tags.js

@@ -1,48 +0,0 @@
-import { createHash } from 'node:crypto';
-/**
- * ACL tags: the denormalization described in docs/authz.md 3.6.
- *
- * Each indexed chunk carries hashes of the principals allowed to read it, so a
- * filter can narrow on the payload instead of joining back to Postgres. The
- * thing to keep in view is what it is *not*:
- *
- * **`acl_tags` is a cache. The `grants` table is the source of truth.** A grant
- * change starts a background recomputation, and until it finishes the tags are
- * stale. That is why the layer bound stays in every query rather than being
- * "simplified" away once tags exist — see the collision note below.
- */
-/** Bytes kept from each hash. The default matches `NACRE_ACL_TAG_HASH_BYTES`. */
-export const DEFAULT_TAG_BYTES = 8;
-/**
- * Hash one principal reference into a tag.
- *
- * Truncation is deliberate and it does collide: 8 bytes over a large enough
- * population will eventually produce two principals with the same tag, and a
- * collision means a false tag match — a chunk appearing to be readable by
- * someone it was not granted to.
- *
- * That is only safe because **the query is also bounded by the allowed
- * `layer_id` list**. A colliding tag inside a layer the caller may already read
- * changes nothing; a colliding tag in a layer they may not read never gets
- * considered, because the layer bound excludes it first. Remove the layer bound
- * and the truncation becomes a leak — which is the single most important thing
- * to know before touching this file.
- */
-export function principalTag(ref, bytes = DEFAULT_TAG_BYTES) {
-    if (bytes < 1 || bytes > 32) {
-        throw new Error(`tag width must be between 1 and 32 bytes, got ${bytes}`);
-    }
-    const digest = createHash('sha256').update(ref, 'utf8').digest();
-    return `h:${digest.subarray(0, bytes).toString('hex')}`;
-}
-/**
- * The tags for a set of principals, sorted so the payload is stable.
- *
- * Stability matters for the recomputation job: an unstable order makes every
- * chunk look changed on every pass, and the propagation metric stops meaning
- * anything.
- */
-export function aclTags(principals, bytes = DEFAULT_TAG_BYTES) {
-    return [...new Set([...principals].map((p) => principalTag(p, bytes)))].sort();
-}
-//# sourceMappingURL=tags.js.map

package/dist/authz/tags.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../authz/tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAElC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,QAAgB,iBAAiB;IAC/E,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IAChE,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,UAAkC,EAClC,QAAgB,iBAAiB;IAEjC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAChF,CAAC"}