@nacre.work/core 0.2.0 → 0.4.0

package/dist/authz/index.d.ts

@@ -9,7 +9,6 @@ export { buildFilter, METADATA_PREFIX } from './filter.js';
 export type { FilterClause, MetadataValue, Narrowing, QueryablePlan, VectorFilter } from './filter.js';
 export { ancestry, MemoryScopeTree } from './scope-tree.js';
 export type { ScopeTree, ScopeTreeData } from './scope-tree.js';
-export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
 export { cachedEffectivePrincipals, MemoryCache, RedisCache, principalsCacheKey } from './cache.js';
 export type { CacheStore, CachedPrincipalsOptions } from './cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACnG,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACnG,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA"}

package/dist/authz/index.js

@@ -4,6 +4,5 @@ export { resolve } from './resolve.js';
 export { referenceAllows } from './reference.js';
 export { buildFilter, METADATA_PREFIX } from './filter.js';
 export { ancestry, MemoryScopeTree } from './scope-tree.js';
-export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
 export { cachedEffectivePrincipals, MemoryCache, RedisCache, principalsCacheKey } from './cache.js';
 //# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/config.d.ts

@@ -14,6 +14,7 @@
  * obviously right value — and never fine for anything naming a host or
  * carrying a credential.
  */
+import { type KeyObject } from 'node:crypto';
 export interface Config {
     readonly env: 'development' | 'production';
     readonly canonicalUrl: string;
@@ -30,6 +31,14 @@ export interface Config {
     readonly oauthAuthorizationServer: string;
     readonly logLevel: 'debug' | 'info' | 'warn' | 'error';
     readonly logFormat: 'json' | 'text';
+    /**
+     * Packages to import at startup so they can register extensions.
+     *
+     * Named rather than imported, because this repository's CI fails if its
+     * source mentions the commercial package at all — see `extensions.ts`. Empty
+     * is the default and is the whole open-core product.
+     */
+    readonly modules: readonly string[];
     readonly pgUrl: string;
     readonly pgPoolMax: number;
     readonly qdrantUrl: string;
@@ -48,8 +57,6 @@ export interface Config {
     readonly accessTokenTtl: number;
     readonly refreshTokenTtl: number;
     readonly aclCacheTtl: number;
-    readonly aclPropagationSla: number;
-    readonly aclTagHashBytes: number;
     /**
      * How long a tombstoned document keeps its vectors before the sweep removes
      * them. A tunable, so a default is fine — and it is not a correctness knob:
@@ -81,6 +88,13 @@ export interface Config {
     readonly auditQueryText: boolean;
     /** The reindex rollback window: how long a superseded collection survives. */
     readonly collectionRetentionDays: number;
+    /**
+     * The recall a reindex must reach before its layer switches, as a fraction.
+     *
+     * Read from a whole-number percentage. Applies only to a layer that has a
+     * reference query set — there is no gate without one.
+     */
+    readonly reindexMinRecall: number;
     /** How long a presigned link to a document's bytes stays valid. */
     readonly presignTtl: number;
     /**
@@ -112,11 +126,103 @@ export interface Config {
  */
 export interface JwtKeys {
     /** Everything issued from now on is signed with this. */
-    readonly key: Uint8Array;
+    readonly signing: KeyObject | Uint8Array;
+    /**
+     * What a token is verified against.
+     *
+     * The same value as `signing` for a shared secret, and the **public half**
+     * for Ed25519 — which is the whole reason the asymmetric mode is worth
+     * having. A process that only verifies never needs the private key, so the
+     * blast radius of reading a container's environment stops at "can check
+     * tokens" instead of "can mint them".
+     */
+    readonly verification: KeyObject | Uint8Array;
     /** Accepted on verification, never used to sign. Empty outside a rotation. */
-    readonly alsoAccept: readonly Uint8Array[];
+    readonly alsoAccept: readonly (KeyObject | Uint8Array)[];
+    /**
+     * Pinned, and passed to `jwtVerify` rather than left to the token's header.
+     *
+     * A verifier that accepts whatever `alg` a token claims is the classic JWT
+     * mistake. `jose` already refuses the worst shapes — `none`, and an HMAC
+     * algorithm against an asymmetric `KeyObject` — but "the library happens to
+     * stop it" is not the same statement as "this deployment accepts exactly one
+     * algorithm", and only the second one survives a dependency upgrade.
+     */
+    readonly algorithm: 'HS256' | 'EdDSA';
+    /**
+     * The current key's `kid`, put in the header of every token this process
+     * signs so a JWKS consumer can select rather than try each. Absent for HMAC,
+     * where it would name nothing anyone could fetch.
+     */
+    readonly keyId?: string;
+    /**
+     * What `/.well-known/jwks.json` serves. Absent for HMAC.
+     *
+     * A shared secret has no publishable half, and serving one would be serving
+     * the signing key — so this is optional rather than always present, and the
+     * endpoint exists only when there is something safe to put in it.
+     *
+     * The retired key is in here too during a rotation, for the same reason it is
+     * still accepted: there are tokens in the wild signed with it, and a verifier
+     * outside this process has to be able to check them. Assembled here rather
+     * than by each caller, because a JWKS missing the previous key is a rotation
+     * that breaks every external verifier at the restart.
+     */
+    readonly jwks?: readonly Record<string, unknown>[];
+}
+/**
+ * What a process that only *verifies* tokens needs — the verification key, the
+ * keys still accepted during a rotation, and the one algorithm it will honour.
+ * No `signing`, no `jwks` to publish: a resource server such as the MCP
+ * transport checks tokens and never mints them, and `loadJwtVerification` lets
+ * it be configured with only the public half, so reading its environment gets
+ * an attacker to "can check tokens" and no further.
+ */
+export interface JwtVerification {
+    readonly verification: KeyObject | Uint8Array;
+    readonly alsoAccept: readonly (KeyObject | Uint8Array)[];
+    readonly algorithm: 'HS256' | 'EdDSA';
 }
+/**
+ * A short, non-reversible name for whichever key is in use, for a startup line.
+ *
+ * An operator needs to know *which* key a process loaded when two environments
+ * disagree — and nobody needs the key itself in a log. `api` and `mcp` each had
+ * their own copy of this, taking a `Uint8Array`; two copies of a function that
+ * hashes a secret is two chances for one of them to log the wrong thing.
+ *
+ * For an asymmetric key it is a digest of the **public** half, which means the
+ * value printed by a process holding the private key matches the one printed by
+ * a process holding only the public key. That is precisely the comparison this
+ * exists to let someone make.
+ */
+export declare function keyFingerprint(key: KeyObject | Uint8Array): string;
 export declare function loadJwtKeys(env?: NodeJS.ProcessEnv): JwtKeys;
+/**
+ * Verification-only key material, for a process that checks tokens and never
+ * signs one — the MCP transport, which is a resource server.
+ *
+ * Three ways to name the key, exactly one of them at a time:
+ *
+ * - `NACRE_JWT_PUBLIC_KEY_REF` — the Ed25519 **public** key, and nothing else.
+ *   This is the one that makes the asymmetric mode worth what it claims: the
+ *   verifier holds no secret and no private key, so an attacker who reads its
+ *   environment can check tokens and cannot mint them. `NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF`
+ *   is its rotation overlap, mirroring the private side.
+ * - `NACRE_JWT_PRIVATE_KEY_REF` — the private key, from which the public half is
+ *   derived. Accepted so a process co-located with the signer, or one that
+ *   simply has the private key, still verifies; it just does not get the
+ *   separation the public-only path does.
+ * - `NACRE_JWT_SECRET` — the shared secret. Verifying and signing are the same
+ *   key here by definition, so there is no separation to be had and the process
+ *   holds the secret regardless; this exists so a Compose deployment that runs
+ *   on a shared secret still starts.
+ *
+ * Setting more than one is refused, for the same reason `loadJwtKeys` refuses
+ * two answers to "what signs a token": whichever won, the others would be
+ * configured, apparently in use, and ignored.
+ */
+export declare function loadJwtVerification(env?: NodeJS.ProcessEnv): JwtVerification;
 export declare class ConfigError extends Error {
     readonly problems: readonly string[];
     constructor(problems: readonly string[]);

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IAIzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IAExC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EACP;QACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;KACjC,GACD,SAAS,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAA;CAC3C;AAED,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA0CzE;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA0JvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAmNzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAI3F,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IAIzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EACP;QACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;KACjC,GACD,SAAS,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,GAAG,UAAU,CAAA;IAC7C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACxD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,GAAG,UAAU,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAA;CACtC;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CASlE;AAmHD,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAkGzE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CA0GzF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA0JvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CA8MzD"}

package/dist/config.js

@@ -14,22 +14,218 @@
  * obviously right value — and never fine for anything naming a host or
  * carrying a credential.
  */
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** A stable identifier for a key, from its public bytes. Never from the secret. */
+function fingerprint(der) {
+    return createHash('sha256').update(der).digest('base64url').slice(0, 16);
+}
+/**
+ * One public key as a JWK.
+ *
+ * `kid` is derived from the public bytes rather than configured, so it is
+ * stable across restarts and identical in every process without anyone having
+ * to keep two settings in step.
+ */
+function publicJwk(key) {
+    const der = key.export({ type: 'spki', format: 'der' });
+    return {
+        ...key.export({ format: 'jwk' }),
+        kid: fingerprint(der),
+        use: 'sig',
+        alg: 'EdDSA',
+    };
+}
+/**
+ * A short, non-reversible name for whichever key is in use, for a startup line.
+ *
+ * An operator needs to know *which* key a process loaded when two environments
+ * disagree — and nobody needs the key itself in a log. `api` and `mcp` each had
+ * their own copy of this, taking a `Uint8Array`; two copies of a function that
+ * hashes a secret is two chances for one of them to log the wrong thing.
+ *
+ * For an asymmetric key it is a digest of the **public** half, which means the
+ * value printed by a process holding the private key matches the one printed by
+ * a process holding only the public key. That is precisely the comparison this
+ * exists to let someone make.
+ */
+export function keyFingerprint(key) {
+    if (key instanceof Uint8Array) {
+        return `sha256:${createHash('sha256').update(key).digest('hex').slice(0, 12)}`;
+    }
+    const der = (key.type === 'private' ? createPublicKey(key) : key).export({
+        type: 'spki',
+        format: 'der',
+    });
+    return `ed25519:${fingerprint(der)}`;
+}
+/**
+ * One Ed25519 key from a `file://` reference, plus its public half.
+ *
+ * `file://` only, and that is the whole of the scheme support. The variable is
+ * named `_REF` because `docs/config.md` requires secrets to be references into
+ * a secret store rather than values, and every platform that has one — Docker
+ * secrets, Kubernetes, systemd credentials — presents it as a file. A `vault://`
+ * or `aws-kms://` scheme would be a network client on the startup path, which
+ * is a different feature with different failure modes.
+ */
+/**
+ * Read the PEM a `file://` reference names. Shared by the private- and
+ * public-key loaders so the `file://`-only rule and its error wording live in
+ * one place; `kind` only changes the noun in the messages.
+ */
+function readPemRef(ref, variable, kind) {
+    let path;
+    try {
+        const url = new URL(ref);
+        if (url.protocol !== 'file:') {
+            throw new Error(`scheme ${url.protocol} is not supported`);
+        }
+        path = fileURLToPath(url);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} is not a file:// URL: ${String(cause)}. ` +
+                `It names a file holding a PEM ${kind} key, for example ` +
+                'file:///run/secrets/jwt_ed25519.',
+        ]);
+    }
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names ${path}, which cannot be read: ${String(cause)}.`,
+        ]);
+    }
+}
+/**
+ * The public half of an Ed25519 key, from a `file://` reference to a PEM public
+ * key. This is what a process that only *verifies* tokens needs — and all it
+ * needs, which is the point: reading its environment gets an attacker to "can
+ * check tokens" and no further. See `loadJwtVerification`.
+ */
+function loadEd25519Public(ref, variable) {
+    const pem = readPemRef(ref, variable, 'public');
+    // `createPublicKey` will happily extract the public half from a *private* PEM,
+    // which would let an operator paste the private key into the public-key
+    // variable and never notice — leaving the file this variable exists to keep
+    // off this process sitting right on it. Refuse it by name: the whole point of
+    // a verify-only process is that the private key is nowhere near it.
+    if (/PRIVATE KEY/.test(pem)) {
+        throw new ConfigError([
+            `${variable} names a file that contains a PRIVATE key. This variable is for ` +
+                'the public half only — a process that verifies must not be given the ' +
+                'signing key. Export the public half with ' +
+                '`openssl pkey -in jwt_ed25519.pem -pubout -out jwt_ed25519.pub`.',
+        ]);
+    }
+    let key;
+    try {
+        key = createPublicKey(pem);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names a file that is not a PEM public key: ${String(cause)}. ` +
+                'Export one from the signing key with ' +
+                '`openssl pkey -in jwt_ed25519.pem -pubout -out jwt_ed25519.pub`.',
+        ]);
+    }
+    if (key.asymmetricKeyType !== 'ed25519') {
+        throw new ConfigError([
+            `${variable} names a ${String(key.asymmetricKeyType)} public key. Only Ed25519 ` +
+                'is accepted — it must match the signing key, which is Ed25519.',
+        ]);
+    }
+    return key;
+}
+function loadEd25519(ref, variable) {
+    const pem = readPemRef(ref, variable, 'private');
+    let key;
+    try {
+        key = createPrivateKey(pem);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names a file that is not a PEM private key: ${String(cause)}.`,
+        ]);
+    }
+    if (key.asymmetricKeyType !== 'ed25519') {
+        // One algorithm, refused rather than adapted. RSA needs a size check and a
+        // padding choice, and EC needs a curve-to-algorithm mapping — each a place
+        // to be wrong about something a token's signature depends on. Ed25519 has
+        // no parameters, and it is what `docs/config.md` has named in its example
+        // since the variable was written.
+        throw new ConfigError([
+            `${variable} names a ${String(key.asymmetricKeyType)} key. Only Ed25519 is ` +
+                'accepted: it has no parameters to get wrong, and it is what the example ' +
+                'in docs/config.md names. Generate one with ' +
+                '`openssl genpkey -algorithm ed25519 -out jwt_ed25519.pem`.',
+        ]);
+    }
+    return { private: key, public: createPublicKey(key) };
+}
 export function loadJwtKeys(env = process.env) {
-    // Development uses a symmetric secret. Production is meant to load an Ed25519
-    // key through NACRE_JWT_PRIVATE_KEY_REF; until that lands, refusing is the
-    // honest behaviour — a hardcoded fallback here would be a signing key anyone
-    // reading the source can forge tokens with.
     const secret = env.NACRE_JWT_SECRET;
+    const ref = env.NACRE_JWT_PRIVATE_KEY_REF;
+    if (secret !== undefined && secret !== '' && ref !== undefined && ref !== '') {
+        // Refused rather than resolved by precedence. Whichever one this picked, the
+        // other would be configured, apparently in use, and silently ignored — and
+        // the operator would find out when the tokens they expected to be Ed25519
+        // turned out to be HMAC, or the other way round.
+        throw new ConfigError([
+            'NACRE_JWT_SECRET and NACRE_JWT_PRIVATE_KEY_REF are both set. They are two ' +
+                'answers to "what signs a token" and there is no order of precedence ' +
+                'worth inventing. Set one.',
+        ]);
+    }
+    if (ref !== undefined && ref !== '') {
+        const current = loadEd25519(ref, 'NACRE_JWT_PRIVATE_KEY_REF');
+        const der = current.public.export({ type: 'spki', format: 'der' });
+        const previousRef = env.NACRE_JWT_PREVIOUS_KEY_REF;
+        const previous = previousRef === undefined || previousRef === ''
+            ? undefined
+            : loadEd25519(previousRef, 'NACRE_JWT_PREVIOUS_KEY_REF');
+        if (previous !== undefined &&
+            previous.public.export({ type: 'spki', format: 'der' }).equals(der)) {
+            // The same refusal the symmetric path makes, for the same reason: this is
+            // what an operator does when they mean to rotate and copy the wrong path,
+            // and it leaves an installation that believes it has rotated and has not.
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_KEY_REF names the same key as NACRE_JWT_PRIVATE_KEY_REF. ' +
+                    'That is not a rotation: it accepts one key twice. Point ' +
+                    'NACRE_JWT_PRIVATE_KEY_REF at the new key and NACRE_JWT_PREVIOUS_KEY_REF ' +
+                    'at the one it replaces.',
+            ]);
+        }
+        return {
+            signing: current.private,
+            verification: current.public,
+            alsoAccept: previous === undefined ? [] : [previous.public],
+            algorithm: 'EdDSA',
+            keyId: fingerprint(der),
+            jwks: [
+                publicJwk(current.public),
+                ...(previous === undefined ? [] : [publicJwk(previous.public)]),
+            ],
+        };
+    }
+    // A symmetric secret is still supported and is still the default. It is what
+    // a laptop and a Compose file want, and refusing it would make the asymmetric
+    // path mandatory for a product whose first run is `docker compose up`.
     if (secret === undefined || secret.length < 32) {
         throw new ConfigError([
             'NACRE_JWT_SECRET is not set, or is shorter than 32 bytes. ' +
-                'Asymmetric keys through NACRE_JWT_PRIVATE_KEY_REF are not implemented yet; ' +
-                'until they are, this is required and there is no default.',
+                'Set it, or point NACRE_JWT_PRIVATE_KEY_REF at an Ed25519 private key. ' +
+                'There is no default: a signing key in the source is one anybody reading ' +
+                'the source can forge tokens with.',
         ]);
     }
     const previous = env.NACRE_JWT_SECRET_PREVIOUS;
     if (previous === undefined || previous === '') {
-        return { key: new TextEncoder().encode(secret), alsoAccept: [] };
+        const key = new TextEncoder().encode(secret);
+        return { signing: key, verification: key, alsoAccept: [], algorithm: 'HS256' };
     }
     if (previous.length < 32) {
         throw new ConfigError([
@@ -48,9 +244,127 @@ export function loadJwtKeys(env = process.env) {
                 'new key and NACRE_JWT_SECRET_PREVIOUS to the one it replaces.',
         ]);
     }
+    const key = new TextEncoder().encode(secret);
     return {
-        key: new TextEncoder().encode(secret),
+        signing: key,
+        verification: key,
         alsoAccept: [new TextEncoder().encode(previous)],
+        algorithm: 'HS256',
+    };
+}
+/**
+ * Verification-only key material, for a process that checks tokens and never
+ * signs one — the MCP transport, which is a resource server.
+ *
+ * Three ways to name the key, exactly one of them at a time:
+ *
+ * - `NACRE_JWT_PUBLIC_KEY_REF` — the Ed25519 **public** key, and nothing else.
+ *   This is the one that makes the asymmetric mode worth what it claims: the
+ *   verifier holds no secret and no private key, so an attacker who reads its
+ *   environment can check tokens and cannot mint them. `NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF`
+ *   is its rotation overlap, mirroring the private side.
+ * - `NACRE_JWT_PRIVATE_KEY_REF` — the private key, from which the public half is
+ *   derived. Accepted so a process co-located with the signer, or one that
+ *   simply has the private key, still verifies; it just does not get the
+ *   separation the public-only path does.
+ * - `NACRE_JWT_SECRET` — the shared secret. Verifying and signing are the same
+ *   key here by definition, so there is no separation to be had and the process
+ *   holds the secret regardless; this exists so a Compose deployment that runs
+ *   on a shared secret still starts.
+ *
+ * Setting more than one is refused, for the same reason `loadJwtKeys` refuses
+ * two answers to "what signs a token": whichever won, the others would be
+ * configured, apparently in use, and ignored.
+ */
+export function loadJwtVerification(env = process.env) {
+    const secret = env.NACRE_JWT_SECRET;
+    const publicRef = env.NACRE_JWT_PUBLIC_KEY_REF;
+    const privateRef = env.NACRE_JWT_PRIVATE_KEY_REF;
+    const named = [
+        secret !== undefined && secret !== '' ? 'NACRE_JWT_SECRET' : undefined,
+        publicRef !== undefined && publicRef !== '' ? 'NACRE_JWT_PUBLIC_KEY_REF' : undefined,
+        privateRef !== undefined && privateRef !== '' ? 'NACRE_JWT_PRIVATE_KEY_REF' : undefined,
+    ].filter((v) => v !== undefined);
+    if (named.length > 1) {
+        throw new ConfigError([
+            `${named.join(' and ')} are set together. They are ${named.length} answers to ` +
+                '"what verifies a token" and there is no order of precedence worth ' +
+                'inventing. A resource server needs exactly one: the public key ' +
+                '(NACRE_JWT_PUBLIC_KEY_REF) if the deployment signs with Ed25519, or ' +
+                'NACRE_JWT_SECRET if it signs with a shared secret.',
+        ]);
+    }
+    const sameSpki = (a, b) => a
+        .export({ type: 'spki', format: 'der' })
+        .equals(b.export({ type: 'spki', format: 'der' }));
+    if (publicRef !== undefined && publicRef !== '') {
+        const current = loadEd25519Public(publicRef, 'NACRE_JWT_PUBLIC_KEY_REF');
+        const prevRef = env.NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF;
+        const previous = prevRef === undefined || prevRef === ''
+            ? undefined
+            : loadEd25519Public(prevRef, 'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF');
+        if (previous !== undefined && sameSpki(current, previous)) {
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF names the same key as ' +
+                    'NACRE_JWT_PUBLIC_KEY_REF. That is not a rotation: it accepts one key ' +
+                    'twice. Point NACRE_JWT_PUBLIC_KEY_REF at the new public key and ' +
+                    'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF at the one it replaces.',
+            ]);
+        }
+        return {
+            verification: current,
+            alsoAccept: previous === undefined ? [] : [previous],
+            algorithm: 'EdDSA',
+        };
+    }
+    if (privateRef !== undefined && privateRef !== '') {
+        const current = loadEd25519(privateRef, 'NACRE_JWT_PRIVATE_KEY_REF');
+        const prevRef = env.NACRE_JWT_PREVIOUS_KEY_REF;
+        const previous = prevRef === undefined || prevRef === ''
+            ? undefined
+            : loadEd25519(prevRef, 'NACRE_JWT_PREVIOUS_KEY_REF');
+        if (previous !== undefined && sameSpki(current.public, previous.public)) {
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_KEY_REF names the same key as NACRE_JWT_PRIVATE_KEY_REF. ' +
+                    'That is not a rotation: it accepts one key twice.',
+            ]);
+        }
+        return {
+            verification: current.public,
+            alsoAccept: previous === undefined ? [] : [previous.public],
+            algorithm: 'EdDSA',
+        };
+    }
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError([
+            'no verification key is set, or NACRE_JWT_SECRET is shorter than 32 bytes. ' +
+                'A resource server needs one of NACRE_JWT_PUBLIC_KEY_REF (Ed25519 public ' +
+                'key), NACRE_JWT_PRIVATE_KEY_REF, or NACRE_JWT_SECRET — matching how the ' +
+                'issuer signs.',
+        ]);
+    }
+    const previousSecret = env.NACRE_JWT_SECRET_PREVIOUS;
+    if (previousSecret !== undefined && previousSecret !== '') {
+        if (previousSecret.length < 32) {
+            throw new ConfigError([
+                'NACRE_JWT_SECRET_PREVIOUS is set but shorter than 32 bytes. It holds the ' +
+                    'key being rotated out and is held to the same floor as the one replacing it.',
+            ]);
+        }
+        if (previousSecret === secret) {
+            throw new ConfigError([
+                'NACRE_JWT_SECRET_PREVIOUS is the same value as NACRE_JWT_SECRET. That is ' +
+                    'not a rotation: it accepts one key twice.',
+            ]);
+        }
+    }
+    const key = new TextEncoder().encode(secret);
+    return {
+        verification: key,
+        alsoAccept: previousSecret === undefined || previousSecret === ''
+            ? []
+            : [new TextEncoder().encode(previousSecret)],
+        algorithm: 'HS256',
     };
 }
 export class ConfigError extends Error {
@@ -238,6 +552,14 @@ export function loadConfig(env = process.env) {
         // this is the one tunable here that trades latency for quality directly,
         // and there is a value at which a search stops answering in time.
         rerankCandidates: r.number('NACRE_RERANK_CANDIDATES', 50, { min: 1, max: 500 }),
+        // Comma-separated, trimmed, empties dropped. A module that cannot be
+        // imported fails startup rather than warning: naming one is a statement
+        // that the deployment is paying for what it does, and coming up without it
+        // would silently be a different product.
+        modules: (env.NACRE_MODULES ?? '')
+            .split(',')
+            .map((m) => m.trim())
+            .filter((m) => m !== ''),
         jwtIssuer: r.required('NACRE_JWT_ISSUER'),
         jwtAudience: r.required('NACRE_JWT_AUDIENCE'),
         accessTokenTtl: r.number('NACRE_ACCESS_TOKEN_TTL', 900, { min: 60, max: 86_400 }),
@@ -246,7 +568,6 @@ export function loadConfig(env = process.env) {
         // choice nobody makes deliberately.
         refreshTokenTtl: r.number('NACRE_REFRESH_TOKEN_TTL', 2_592_000, { min: 300, max: 31_536_000 }),
         aclCacheTtl: r.number('NACRE_ACL_CACHE_TTL', 60, { min: 0, max: 3600 }),
-        aclPropagationSla: r.number('NACRE_ACL_PROPAGATION_SLA', 60, { min: 1, max: 3600 }),
         gcGrace: r.number('NACRE_GC_GRACE', 3600, { min: 0, max: 2_592_000 }),
         // 15 minutes: long enough for a large PDF through parse, chunk, embed, and
         // upsert, short enough that a drained node's documents are not stuck for an
@@ -254,7 +575,6 @@ export function loadConfig(env = process.env) {
         // document the instant it is claimed, which is a loop, not a setting.
         indexLease: r.number('NACRE_INDEX_LEASE', 900, { min: 60, max: 86_400 }),
         indexMaxAttempts: r.number('NACRE_INDEX_MAX_ATTEMPTS', 5, { min: 1, max: 100 }),
-        aclTagHashBytes: r.number('NACRE_ACL_TAG_HASH_BYTES', 8, { min: 4, max: 32 }),
         rateSearchPerMin: r.number('NACRE_RATE_SEARCH_PER_MIN', 60, { min: 1 }),
         rateIngestPerHour: r.number('NACRE_RATE_INGEST_PER_HOUR', 600, { min: 1 }),
         // Ten attempts per quarter hour, counted per email address. Low enough that
@@ -313,6 +633,23 @@ export function loadConfig(env = process.env) {
         // most likely to be found wrong. Setting it high costs disk: each retained
         // collection is a full copy of the organization's vectors.
         collectionRetentionDays: r.number('NACRE_COLLECTION_RETENTION_DAYS', 7, { min: 1 }),
+        // The floor a reindex's recall check must reach before the layer switches.
+        //
+        // A whole-number percentage rather than a fraction, because this reader
+        // takes integers and `0.8` typed into an environment file is a value two
+        // different parsers would disagree about. Divided here so everything
+        // downstream works in the [0, 1] the arithmetic produces.
+        //
+        // The default is 80 and it gates nothing on its own: a layer with no
+        // reference query set has no check at all, so this applies to deployments
+        // that went and wrote one — which is a deployment asking for a gate.
+        //
+        // 0 is allowed and means measure without blocking. That is arithmetic
+        // rather than a special case for "disabled": every recall is at least 0, so
+        // the comparison passes and the number is still recorded. `min: 1` would be
+        // wrong here for exactly the reason it is right on the retention window
+        // above — there the low value destroys something, here it destroys nothing.
+        reindexMinRecall: r.number('NACRE_REINDEX_MIN_RECALL', 80, { min: 0, max: 100 }) / 100,
         // How long a `source_url` outlives the permission check that minted it.
         //
         // A presigned URL is a bearer capability: whoever holds it fetches that
@@ -351,35 +688,11 @@ export function loadConfig(env = process.env) {
             'so accepting this would give you a single-collection deployment that ' +
             'believes it is isolated. Use `collection`, which is the default.');
     }
-    if (config.aclTagHashBytes !== 8) {
-        r.problems.push('NACRE_ACL_TAG_HASH_BYTES is not implemented: the tag width is fixed at 8 ' +
-            'bytes in the code that writes and matches tags. Setting it changes the ' +
-            'collision probability you think you have and nothing else. Leave it at 8.');
-    }
     if (config.refreshTokenTtl <= config.accessTokenTtl) {
         r.problems.push('NACRE_REFRESH_TOKEN_TTL is not longer than NACRE_ACCESS_TOKEN_TTL. A refresh ' +
             'token that expires no later than the access token it renews cannot renew ' +
             'anything, so every session would end at the first refresh.');
     }
-    if (config.aclCacheTtl > config.aclPropagationSla) {
-        // Kept, and the reason it is kept has changed.
-        //
-        // It used to say a longer TTL would serve a revoked grant past the SLA.
-        // That is not true of the cache that now runs: the key carries
-        // `organizations.groups_version`, which triggers bump on every change to
-        // groups, group_members and grants, so a revoked grant is never served —
-        // the next request composes a different key. The TTL bounds memory.
-        //
-        // What it still catches is an operator who believes otherwise. Setting this
-        // above the SLA is what someone does when they have read it as "how long a
-        // stale permission may live", and a deployment configured on that belief
-        // has a misunderstanding worth interrupting at boot rather than a setting
-        // worth honouring.
-        r.problems.push(`NACRE_ACL_CACHE_TTL (${config.aclCacheTtl}) is longer than ` +
-            `NACRE_ACL_PROPAGATION_SLA (${config.aclPropagationSla}). The cache is keyed ` +
-            'on the permission epoch, so this does not delay a revocation — but a value ' +
-            'above the SLA usually means it was read as though it did.');
-    }
     if (config.env === 'production' && config.canonicalUrl.startsWith('http://')) {
         // The canonical URL is the OAuth issuer and goes into every token ever
         // issued. Over plaintext it is also the thing an attacker rewrites.