memtrails 0.3.0 → 0.4.1

package/dist/core/qdrant-binary.js

@@ -1,15 +1,16 @@
 /**
  * The Qdrant binary memory runs when you give it no Qdrant server of your own: one pinned release, fetched on first use
  * from Qdrant's GitHub release, verified against the size and SHA-256 pinned below, unpacked next to it (cache dir,
- * paths.ts), and trusted after that through a `.verified` marker.
+ * paths.ts), and trusted after that through a `.verified` marker while the folder is this user's alone.
  *
  * Qdrant publishes no checksums, so the hashes are pinned here from its release. Upgrading means a new version and new
  * hashes; Qdrant reads storage only from the minor version before it, so after a version change the index is written
  * again from the logs (rebuild.ts) rather than migrated: it is derived data.
  */
-import { createHash } from 'node:crypto';
-import { chmodSync, createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, closeSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, statSync, utimesSync, writeFileSync, writeSync, } from 'node:fs';
+import { hostname } from 'node:os';
+import { dirname, join } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { spawn } from 'node:child_process';
@@ -34,75 +35,223 @@ export function qdrantBinaryPath(a = qdrantAsset()) {
 }
 export const QDRANT_RELEASE_BASE = `https://github.com/qdrant/qdrant/releases/download/v${QDRANT_VERSION}`;
 const assetUrl = (a) => `${QDRANT_RELEASE_BASE}/${a.asset}`;
-/** The binary is in place and its archive was verified when it was unpacked. */
+/**
+ * Run only what this user alone could have put there: the cache, the folder, the binary and its marker owned by this
+ * user, no symlink, writable by no one else. The archive's hash is pinned but not the unpacked binary's (that needs every
+ * platform's archive to compute), so on a shared machine this is what stops a binary swapped in after unpacking.
+ * Windows has no owner bits; there the user's profile ACLs keep others out.
+ */
+export function ownedSafely(path) {
+    if (typeof process.getuid !== 'function')
+        return !lstatSync(path).isSymbolicLink();
+    const st = lstatSync(path);
+    return !st.isSymbolicLink() && st.uid === process.getuid() && (st.mode & 0o022) === 0;
+}
+/**
+ * The folder made (0700) or made private, and this user's alone — or refused. What is verified in it is run or loaded
+ * later: a folder others could write to lets them swap a binary between its check and its run, or a download between
+ * its hash and its unpacking. (`mkdirSync`'s mode applies only to a folder it makes.)
+ */
+export function privateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    if (!ownedSafely(dir)) {
+        throw new Error(`${dir} is not this user's alone (its owner, its permissions, or it is a link): set MEMTRAILS_CACHE to a folder of your own`);
+    }
+}
+/** The binary is in place, its archive was verified when it was unpacked, and no one else could have changed it since. */
 export function qdrantReady(a = qdrantAsset()) {
     const bin = qdrantBinaryPath(a);
-    if (!a || !bin || !existsSync(bin))
+    if (!a || !bin)
         return false;
+    const marker = join(qdrantDir(), '.verified');
     try {
-        return readFileSync(join(qdrantDir(), '.verified'), 'utf8').trim() === `${a.size}:${a.sha256}`;
+        return readFileSync(marker, 'utf8').trim() === `${a.size}:${a.sha256}` && statSync(bin).size > 0 &&
+            [dirname(qdrantDir()), qdrantDir(), bin, marker].every(ownedSafely);
     }
     catch {
         return false;
     }
 }
+/** The system's tar; on Windows by full path, so a `tar.exe` in the working folder or on a planted PATH is not run. */
+function tarProgram() {
+    return process.platform === 'win32' ? join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') : 'tar';
+}
 /** Unpack one archive with the system's tar (bsdtar on macOS and Windows reads zip too). */
 function untar(archive, into) {
     return new Promise((resolve, reject) => {
-        const child = spawn('tar', ['-xf', archive, '-C', into], { stdio: 'ignore' });
+        const child = spawn(tarProgram(), ['-xf', archive, '-C', into], { stdio: 'ignore' });
         child.once('error', reject);
         child.once('exit', (code) => (code === 0 ? resolve() : reject(new Error(`tar exited ${code}`))));
     });
 }
+/** A download given up after this long without a byte (the answer's headers included). */
+export const DOWNLOAD_STALL_MS = 60_000;
 /**
- * Fetch, verify and unpack the binary unless it is already there. Throws on a network failure, a size or hash
- * mismatch (the download is deleted), or a platform Qdrant does not ship for; the caller retries with backoff.
+ * `url` fetched into a fresh temp folder inside `dir`, never to a fixed name: two first runs at once (two processes, or
+ * two memories opened together in one) wrote the same `.part` and could rename each other's half-written file. The
+ * file is then checked as it is on disk, not as it streamed past, against its pinned size and SHA-256. Returns the
+ * file and its folder; the caller renames the file into place and removes the folder. Throws (leaving nothing) on a
+ * failure, a mismatch, or `stallMs` without a byte.
  */
-export async function ensureQdrant(opts = {}) {
-    const a = qdrantAsset();
-    if (!a)
-        throw new Error(`no Qdrant build for ${process.platform}-${process.arch}`);
-    const bin = qdrantBinaryPath(a);
-    if (qdrantReady(a))
-        return bin;
-    const dir = qdrantDir();
+export async function downloadVerified(url, dir, pin, o = {}) {
     mkdirSync(dir, { recursive: true });
-    const archive = join(dir, a.asset);
-    const part = `${archive}.part`;
-    rmSync(part, { force: true });
-    opts.log?.(`[memtrails] fetching Qdrant ${QDRANT_VERSION} (${Math.round(a.size / 1e6)} MB)`);
-    const res = await (opts.fetchImpl ?? fetch)(assetUrl(a), { signal: opts.signal, redirect: 'follow' });
-    if (!res.ok || !res.body)
-        throw new Error(`HTTP ${res.status} for ${a.asset}`);
-    const hash = createHash('sha256');
-    let size = 0;
+    const tmp = mkdtempSync(join(dir, '.download-'));
+    const file = join(tmp, 'file');
+    const name = url.slice(url.lastIndexOf('/') + 1);
+    const stallMs = o.stallMs ?? DOWNLOAD_STALL_MS;
+    const stalled = new AbortController();
+    let timer;
+    const arm = () => {
+        clearTimeout(timer);
+        timer = setTimeout(() => stalled.abort(new Error(`${name}: no data for ${Math.round(stallMs / 1000)} s`)), stallMs);
+    };
+    const signal = o.signal ? AbortSignal.any([o.signal, stalled.signal]) : stalled.signal;
     try {
+        arm();
+        const res = await (o.fetchImpl ?? fetch)(url, { signal, redirect: 'follow' });
+        if (!res.ok || !res.body)
+            throw new Error(`HTTP ${res.status} for ${name}`);
+        let size = 0;
         await pipeline(Readable.fromWeb(res.body), async function* (src) {
             for await (const chunk of src) {
-                const b = chunk;
-                hash.update(b);
-                size += b.length;
-                yield b;
+                arm();
+                size += chunk.length;
+                if (size > pin.size)
+                    throw new Error(`${name}: more than the expected ${pin.size} bytes`);
+                yield chunk;
             }
-        }, createWriteStream(part));
+        }, createWriteStream(file, { flags: 'wx', mode: 0o600 }), { signal });
+        clearTimeout(timer);
+        const hash = createHash('sha256');
+        for await (const chunk of createReadStream(file))
+            hash.update(chunk);
+        const got = { size: statSync(file).size, sha256: hash.digest('hex') };
+        if (got.size !== pin.size || got.sha256 !== pin.sha256) {
+            throw new Error(`${name}: got ${got.size} bytes sha256 ${got.sha256}, expected ${pin.size} ${pin.sha256}`);
+        }
+        return { file, tmp };
     }
     catch (err) {
-        rmSync(part, { force: true });
-        throw err;
+        rmSync(tmp, { recursive: true, force: true });
+        throw stalled.signal.aborted ? stalled.signal.reason : err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** A lock not touched for this long is a dead holder's (the holder touches it every quarter of this). */
+export const LOCK_STALE_MS = 120_000;
+function lockStale(lock, staleMs) {
+    try {
+        const [pid, host] = readFileSync(lock, 'utf8').split(' ');
+        if (host === hostname() && Number(pid) !== process.pid) {
+            try {
+                process.kill(Number(pid), 0);
+            }
+            catch (err) {
+                if (err.code === 'ESRCH')
+                    return true; // its process is gone
+            }
+        }
+        return Date.now() - statSync(lock).mtimeMs > staleMs;
+    }
+    catch {
+        return false; // gone meanwhile: just try again
+    }
+}
+/**
+ * `f` run holding `<path>.lock`, created with O_EXCL: a second first run, in another process or this one, waits and
+ * then finds the first one's result. A lock whose process is gone, or untouched for `staleMs`, is taken over. Nothing
+ * rests on the lock for correctness (every file is verified in a private temp and renamed into place); it keeps two
+ * runs from fetching the same hundreds of MB, and from swapping folders under each other.
+ */
+export async function withLock(path, f, o = {}) {
+    const lock = `${path}.lock`;
+    const staleMs = o.staleMs ?? LOCK_STALE_MS;
+    const mine = `${process.pid} ${hostname()} ${randomBytes(8).toString('hex')}`;
+    mkdirSync(dirname(lock), { recursive: true });
+    for (;;) {
+        try {
+            const fd = openSync(lock, 'wx', 0o600);
+            writeSync(fd, mine);
+            closeSync(fd);
+            break;
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        if (lockStale(lock, staleMs)) {
+            rmSync(lock, { force: true });
+            continue;
+        }
+        o.signal?.throwIfAborted();
+        await new Promise((ok) => setTimeout(ok, o.pollMs ?? 250));
     }
-    const digest = hash.digest('hex');
-    if (size !== a.size || digest !== a.sha256) {
-        rmSync(part, { force: true });
-        throw new Error(`${a.asset}: got ${size} bytes sha256 ${digest}, expected ${a.size} ${a.sha256}`);
+    const beat = setInterval(() => {
+        try {
+            utimesSync(lock, new Date(), new Date());
+        }
+        catch { /* taken over: nothing to keep alive */ }
+    }, Math.max(10, staleMs / 4));
+    beat.unref();
+    try {
+        return await f();
     }
-    renameSync(part, archive);
-    await untar(archive, dir);
-    rmSync(archive, { force: true });
-    if (!existsSync(bin) || statSync(bin).size === 0)
-        throw new Error(`${a.asset} did not contain ${a.exe}`);
-    if (process.platform !== 'win32')
-        chmodSync(bin, 0o755);
-    writeFileSync(join(dir, '.verified'), `${a.size}:${a.sha256}\n`);
-    opts.log?.(`[memtrails] Qdrant ${QDRANT_VERSION} ready`);
-    return bin;
+    finally {
+        clearInterval(beat);
+        try {
+            if (readFileSync(lock, 'utf8') === mine)
+                rmSync(lock, { force: true }); // not one taken over meanwhile
+        }
+        catch { /* already gone */ }
+    }
+}
+/**
+ * Fetch, verify and unpack the binary unless it is already there. Throws on a network failure or stall, a size or
+ * hash mismatch (the download is deleted), a platform Qdrant does not ship for, or a folder others could change; the
+ * caller retries with backoff. `asset` is for tests: another archive with its own pins.
+ */
+export async function ensureQdrant(opts = {}) {
+    const a = opts.asset ?? qdrantAsset();
+    if (!a)
+        throw new Error(`no Qdrant build for ${process.platform}-${process.arch}`);
+    const bin = qdrantBinaryPath(a);
+    if (qdrantReady(a))
+        return bin;
+    const dir = qdrantDir();
+    const cache = dirname(dir);
+    privateDir(cache);
+    return withLock(dir, async () => {
+        if (qdrantReady(a))
+            return bin; // another run finished it while this one waited
+        opts.log?.(`[memtrails] fetching Qdrant ${QDRANT_VERSION} (${Math.round(a.size / 1e6)} MB)`);
+        const { file, tmp } = await downloadVerified(assetUrl(a), cache, a, opts);
+        try {
+            // Unpacked into a fresh folder and moved into place whole: never a half-unpacked binary under the real name.
+            const archive = join(tmp, a.asset);
+            renameSync(file, archive);
+            const unpacked = join(tmp, 'unpacked');
+            mkdirSync(unpacked);
+            await untar(archive, unpacked);
+            const exe = join(unpacked, a.exe);
+            if (!existsSync(exe) || !lstatSync(exe).isFile() || statSync(exe).size === 0)
+                throw new Error(`${a.asset} did not contain ${a.exe}`);
+            chmodSync(exe, 0o755);
+            writeFileSync(join(unpacked, '.verified'), `${a.size}:${a.sha256}\n`, { mode: 0o644 });
+            chmodSync(join(unpacked, '.verified'), 0o644);
+            chmodSync(unpacked, 0o755);
+            if (existsSync(dir))
+                renameSync(dir, join(tmp, 'old')); // unverified or not this user's alone; removed with tmp
+            renameSync(unpacked, dir);
+        }
+        finally {
+            rmSync(tmp, { recursive: true, force: true });
+        }
+        if (!qdrantReady(a))
+            throw new Error(`${dir} is not this user's alone (its owner or permissions): not running a binary others could change`);
+        opts.log?.(`[memtrails] Qdrant ${QDRANT_VERSION} ready`);
+        return bin;
+    }, { signal: opts.signal });
 }

package/dist/core/qdrant-client.d.ts

@@ -1,15 +1,14 @@
 import type { QdrantEndpoint } from './qdrant-process.js';
 export declare const COLLECTION = "memory";
-/** The payload field a tenant client keys every point by, and the original point id it keeps beside the scoped one. */
-export declare const TENANT_FIELD = "user";
 export declare const DIMS: 768;
 /** What the index is made of; a change empties it and it is written in again from the logs (rebuild.ts).
  *  2: binary quantisation with rescoring (½ the RAM of int8, recall 0.98–1.00 measured at 1–3M points), keyword terms
  *  folded and segmented for every language (text.ts); 3: on-disk binary copy, HNSW and payload indexes;
  *  4: remote EmbeddingGemma GPU vectors (768 dimensions, explicit runtime/pooling tag in embedder.ts); 5: nothing cut —
  *  every chunk of a body (no 12-chunk limit), short-term entries chunked too, cues numbered below the key, full payloads;
- *  6: every captured request indexed for good — however old, consolidated or not (the raw record is the truth). */
-export declare const INDEX_LAYOUT = 6;
+ *  6: every captured request indexed for good — however old, consolidated or not (the raw record is the truth);
+ *  7: a record's kind (`engine`) on every point of it and indexed, so a kinds filter finds a record by its chunks. */
+export declare const INDEX_LAYOUT = 7;
 export interface SparseVector {
     indices: number[];
     values: number[];
@@ -33,25 +32,14 @@ export declare class QdrantError extends Error {
 export interface QdrantClientOptions {
     /** The collection (COLLECTION when not given). */
     collection?: string;
-    /** Many users in one collection: the user every call is for — read on each call from the caller's context; null or ''
-     *  refuses the call. */
-    tenant?: () => string | null | undefined;
 }
 export declare class QdrantClient {
     private readonly endpoint;
     private readonly timeoutMs;
-    private readonly opts;
-    private readonly collection;
+    /** `/collections/<name>`, the name encoded: a name you give is a path segment, never more of the path. */
+    private readonly at;
     /** `endpoint` may start Qdrant (the service runs it only while memory has work): every call waits for it. */
     constructor(endpoint: () => QdrantEndpoint | null | Promise<QdrantEndpoint | null>, timeoutMs?: number, opts?: QdrantClientOptions);
-    /** The user this call is for (a tenant client), or null (one person's own index). Throws when a tenant client has none. */
-    private user;
-    /** A filter with the user added — unchanged for one person's own index. */
-    private scoped;
-    /** A point's id in a shared collection: the user's and the item's (pointId of both), so users never share a point. */
-    private scopedId;
-    /** What a read hands back: the point's own id (as the writer named it) and only this user's points. */
-    private own;
     private call;
     /** Drop the whole collection: the index is derived, written again from the logs (rebuild.ts). */
     dropCollection(): Promise<void>;
@@ -74,11 +62,8 @@ export declare class QdrantClient {
         score: number;
         payload: Record<string, unknown>;
     }>>;
-    /** Each of these items' best cosine to one vector among its points of one part (key, child, cue) — the ranker's
-     *  per-family similarities. An item with no such point is not in the map. */
-    bestPerItem(vector: number[], items: string[], part: string, timeoutMs?: number): Promise<Map<string, number>>;
     /** `nearest` for several vectors in one call. */
-    /** `fields`: only these payload fields (and the item and its user), for a caller that needs no more — a walk over
+    /** `fields`: only these payload fields (and the item), for a caller that needs no more — a walk over
      *  many neighbours reads ids, not the bodies of long requests. */
     nearestMany(vectors: number[][], filter: Filter, limit?: number, timeoutMs?: number, fields?: string[]): Promise<Array<Array<{
         item: string;

package/dist/core/qdrant-client.js

@@ -10,27 +10,19 @@
  * A query ranks items once per query vector and once by keywords (each hit grouped by item, so an item found through
  * several children counts once), then fuses those item rankings by rank (RRF). Only `active` items are ever returned
  * to recall; superseded and archived ones stay in the log, out of the index.
- *
- * MANY USERS (a server holding a memory per user): one collection for all of them, its `user` field a
- * tenant index (`is_tenant`). A client made with `tenant` adds that user to every query, count, scroll, update and
- * delete, stamps it on every point it writes, and keys each point by user and item, so two users' identical items are
- * two points. The user comes from the caller's context (whose work this is), never from a query's words; a call made
- * with no user is refused before it reaches Qdrant.
  */
 import { createHash } from 'node:crypto';
 import { MEMORY_EMBEDDER } from './embedder.js';
 export const COLLECTION = 'memory';
-/** The payload field a tenant client keys every point by, and the original point id it keeps beside the scoped one. */
-export const TENANT_FIELD = 'user';
-const TENANT_PID = 'pid';
 export const DIMS = MEMORY_EMBEDDER.dims;
 /** What the index is made of; a change empties it and it is written in again from the logs (rebuild.ts).
  *  2: binary quantisation with rescoring (½ the RAM of int8, recall 0.98–1.00 measured at 1–3M points), keyword terms
  *  folded and segmented for every language (text.ts); 3: on-disk binary copy, HNSW and payload indexes;
  *  4: remote EmbeddingGemma GPU vectors (768 dimensions, explicit runtime/pooling tag in embedder.ts); 5: nothing cut —
  *  every chunk of a body (no 12-chunk limit), short-term entries chunked too, cues numbered below the key, full payloads;
- *  6: every captured request indexed for good — however old, consolidated or not (the raw record is the truth). */
-export const INDEX_LAYOUT = 6;
+ *  6: every captured request indexed for good — however old, consolidated or not (the raw record is the truth);
+ *  7: a record's kind (`engine`) on every point of it and indexed, so a kinds filter finds a record by its chunks. */
+export const INDEX_LAYOUT = 7;
 /** The memory-mapped 1-bit copy finds candidates; full vectors on disk re-score 3× as many as asked. */
 const RESCORE = { quantization: { rescore: true, oversampling: 3.0 } };
 /** Two segments: Qdrant's default is one a core, which costs a laptop RAM and per-query work for nothing at memory's
@@ -65,42 +57,13 @@ export class QdrantError extends Error {
 export class QdrantClient {
     endpoint;
     timeoutMs;
-    opts;
-    collection;
+    /** `/collections/<name>`, the name encoded: a name you give is a path segment, never more of the path. */
+    at;
     /** `endpoint` may start Qdrant (the service runs it only while memory has work): every call waits for it. */
     constructor(endpoint, timeoutMs = 10_000, opts = {}) {
         this.endpoint = endpoint;
         this.timeoutMs = timeoutMs;
-        this.opts = opts;
-        this.collection = opts.collection ?? COLLECTION;
-    }
-    /** The user this call is for (a tenant client), or null (one person's own index). Throws when a tenant client has none. */
-    user() {
-        if (!this.opts.tenant)
-            return null;
-        const u = this.opts.tenant();
-        if (!u)
-            throw new QdrantError('memory index: this call names no user, so it is refused', 403);
-        return u;
-    }
-    /** A filter with the user added — unchanged for one person's own index. */
-    scoped(filter, user) {
-        if (user === null)
-            return filter;
-        return { ...filter, must: [{ key: TENANT_FIELD, match: { value: user } }, ...(filter?.must ?? [])] };
-    }
-    /** A point's id in a shared collection: the user's and the item's (pointId of both), so users never share a point. */
-    scopedId(id, user) {
-        return user === null ? id : pointId(`${user}\u0000${id}`, 0);
-    }
-    /** What a read hands back: the point's own id (as the writer named it) and only this user's points. */
-    own(points, user) {
-        if (user === null)
-            return points;
-        return points.filter((p) => p.payload[TENANT_FIELD] === user).map((p) => {
-            const { [TENANT_FIELD]: _u, [TENANT_PID]: pid, ...payload } = p.payload;
-            return { ...p, id: String(pid ?? p.id), payload };
-        });
+        this.at = `/collections/${encodeURIComponent(opts.collection ?? COLLECTION)}`;
     }
     async call(method, path, body, timeoutMs = this.timeoutMs) {
         const e = await this.endpoint();
@@ -138,7 +101,7 @@ export class QdrantClient {
     }
     /** Drop the whole collection: the index is derived, written again from the logs (rebuild.ts). */
     async dropCollection() {
-        await this.call('DELETE', `/collections/${this.collection}`).catch(() => undefined);
+        await this.call('DELETE', this.at).catch(() => undefined);
     }
     /** The collection and its payload indexes, made if missing — an index added since a collection was made is added to
      *  it in place. All of it on disk, memory-mapped — the vectors, their 1-bit copy, the graph, the payloads and their
@@ -148,14 +111,14 @@ export class QdrantClient {
     async ensureCollection() {
         let info = null;
         try {
-            info = (await this.call('GET', `/collections/${this.collection}`)) ?? {};
+            info = (await this.call('GET', this.at)) ?? {};
         }
         catch (err) {
             if (!(err instanceof QdrantError) || err.status !== 404)
                 throw err;
         }
         if (!info) {
-            await this.call('PUT', `/collections/${this.collection}`, {
+            await this.call('PUT', this.at, {
                 vectors: { dense: { size: DIMS, distance: 'Cosine', on_disk: true } },
                 sparse_vectors: { bm25: { modifier: 'idf', index: { on_disk: true } } },
                 quantization_config: { binary: { always_ram: false } },
@@ -167,41 +130,34 @@ export class QdrantClient {
         }
         else if (info.config?.optimizer_config?.default_segment_number !== SMALL.optimizers_config.default_segment_number) {
             // Made before: two segments from now on (the optimiser merges them in the background).
-            await this.call('PATCH', `/collections/${this.collection}`, { optimizers_config: SMALL.optimizers_config });
+            await this.call('PATCH', this.at, { optimizers_config: SMALL.optimizers_config });
         }
         const have = info.payload_schema ?? {};
-        // Many users: the user field first, as Qdrant's tenant index (its points kept together on disk, searched per user).
-        if (this.opts.tenant && !(TENANT_FIELD in have)) {
-            await this.call('PUT', `/collections/${this.collection}/index?wait=true`, { field_name: TENANT_FIELD, field_schema: { type: 'keyword', is_tenant: true, on_disk: true } });
-        }
         for (const [field_name, field_schema] of [['item', 'keyword'], ['part', 'keyword'], ['tier', 'keyword'], ['status', 'keyword'],
-            ['kind', 'keyword'], ['scope', 'keyword'], ['project', 'keyword'], ['session', 'keyword'], ['ts', 'integer'],
+            ['kind', 'keyword'], ['engine', 'keyword'], ['scope', 'keyword'], ['project', 'keyword'], ['session', 'keyword'], ['ts', 'integer'],
             ['synthetic', 'bool'], ['concepts', 'keyword'], ['eventFrom', 'integer'], ['eventTo', 'integer']]) {
             const schema = field_schema === 'keyword' || field_schema === 'integer' ? { type: field_schema, on_disk: true } : field_schema;
             if (!(field_name in have))
-                await this.call('PUT', `/collections/${this.collection}/index?wait=true`, { field_name, field_schema: schema });
+                await this.call('PUT', `${this.at}/index?wait=true`, { field_name, field_schema: schema });
         }
     }
     async upsert(points, wait = false) {
         if (!points.length)
             return;
-        const user = this.user();
-        const out = user === null ? points
-            : points.map((p) => ({ ...p, id: this.scopedId(p.id, user), payload: { ...p.payload, [TENANT_FIELD]: user, [TENANT_PID]: p.id } }));
-        await this.call('PUT', `/collections/${this.collection}/points?wait=${wait}`, { points: out }, 60_000);
+        await this.call('PUT', `${this.at}/points?wait=${wait}`, { points }, 60_000);
     }
     /** Every point of these items — before an item is written again (its children may be fewer now). */
     async deleteItems(items) {
         if (!items.length)
             return;
-        await this.call('POST', `/collections/${this.collection}/points/delete?wait=true`, { filter: this.scoped({ must: [{ key: 'item', match: { any: items } }] }, this.user()) }, 60_000);
+        await this.call('POST', `${this.at}/points/delete?wait=true`, { filter: { must: [{ key: 'item', match: { any: items } }] } }, 60_000);
     }
     /** One kind of point of these items (`cue`), before that part is written again. */
     async deleteParts(items, part) {
         if (!items.length)
             return;
-        await this.call('POST', `/collections/${this.collection}/points/delete?wait=true`, {
-            filter: this.scoped({ must: [{ key: 'item', match: { any: items } }, { key: 'part', match: { value: part } }] }, this.user()),
+        await this.call('POST', `${this.at}/points/delete?wait=true`, {
+            filter: { must: [{ key: 'item', match: { any: items } }, { key: 'part', match: { value: part } }] },
         }, 60_000);
     }
     /** Change some payload fields of these items' points (status, a merged key's display fields). */
@@ -211,65 +167,47 @@ export class QdrantClient {
         const must = [{ key: 'item', match: { any: items } }];
         if (keyOnly)
             must.push({ key: 'part', match: { value: 'key' } });
-        await this.call('POST', `/collections/${this.collection}/points/payload?wait=true`, { payload, filter: this.scoped({ must }, this.user()) }, 60_000);
+        await this.call('POST', `${this.at}/points/payload?wait=true`, { payload, filter: { must } }, 60_000);
     }
     /** The nearest key points to one vector (consolidation's "do I know this already?"), with their cosine. */
     async neighbors(vector, filter, limit = 5) {
         const must = [...(filter.must ?? []), { key: 'part', match: { value: 'key' } }];
-        const r = await this.call('POST', `/collections/${this.collection}/points/query`, {
-            query: vector, using: 'dense', limit, params: RESCORE, filter: this.scoped({ ...filter, must }, this.user()), with_payload: ['item', 'title', 'summary', 'kind', 'scope', 'project', 'status'],
+        const r = await this.call('POST', `${this.at}/points/query`, {
+            query: vector, using: 'dense', limit, params: RESCORE, filter: { ...filter, must }, with_payload: ['item', 'title', 'summary', 'kind', 'scope', 'project', 'status'],
         });
         return (r?.points ?? []).map((p) => ({ item: String(p.payload?.item ?? ''), score: p.score, payload: p.payload ?? {} }));
     }
-    /** Each of these items' best cosine to one vector among its points of one part (key, child, cue) — the ranker's
-     *  per-family similarities. An item with no such point is not in the map. */
-    async bestPerItem(vector, items, part, timeoutMs = 2000) {
-        if (!items.length)
-            return new Map();
-        const r = await this.call('POST', `/collections/${this.collection}/points/query/groups`, {
-            query: vector, using: 'dense', params: RESCORE,
-            filter: this.scoped({ must: [{ key: 'item', match: { any: items } }, { key: 'part', match: { value: part } }] }, this.user()),
-            group_by: 'item', group_size: 1, limit: items.length, with_payload: false,
-        }, timeoutMs);
-        return new Map((r?.groups ?? []).map((g) => [String(g.id), g.hits[0]?.score ?? 0]));
-    }
     /** `nearest` for several vectors in one call. */
-    /** `fields`: only these payload fields (and the item and its user), for a caller that needs no more — a walk over
+    /** `fields`: only these payload fields (and the item), for a caller that needs no more — a walk over
      *  many neighbours reads ids, not the bodies of long requests. */
     async nearestMany(vectors, filter, limit = 10, timeoutMs = 5000, fields) {
         if (!vectors.length)
             return [];
-        const user = this.user();
-        const withPayload = fields ? [...new Set([...fields, 'item', TENANT_FIELD])] : true;
-        const r = await this.call('POST', `/collections/${this.collection}/points/query/batch`, {
-            searches: vectors.map((v) => ({ query: v, using: 'dense', limit, params: RESCORE, filter: this.scoped(filter, user), with_payload: withPayload })),
+        const withPayload = fields ? [...new Set([...fields, 'item'])] : true;
+        const r = await this.call('POST', `${this.at}/points/query/batch`, {
+            searches: vectors.map((v) => ({ query: v, using: 'dense', limit, params: RESCORE, filter, with_payload: withPayload })),
         }, timeoutMs);
-        return (r ?? []).map((x) => this.own((x?.points ?? []).map((p) => ({ id: '', payload: p.payload ?? {}, score: p.score })), user)
-            .map((p) => ({ item: String(p.payload.item ?? ''), score: p.score, payload: p.payload })));
+        return (r ?? []).map((x) => (x?.points ?? []).map((p) => ({ item: String(p.payload?.item ?? ''), score: p.score, payload: p.payload ?? {} })));
     }
     /** Points within a filter, with their payload (and dense vector when asked) — at most `limit`. */
     async scroll(filter, limit = 256, withVector = false, timeoutMs = 5000) {
-        const user = this.user();
-        const r = await this.call('POST', `/collections/${this.collection}/points/scroll`, {
-            filter: this.scoped(filter, user), limit, with_payload: true, with_vector: withVector ? ['dense'] : false,
+        const r = await this.call('POST', `${this.at}/points/scroll`, {
+            filter, limit, with_payload: true, with_vector: withVector ? ['dense'] : false,
         }, timeoutMs);
-        return this.own((r?.points ?? []).map((p) => ({ id: String(p.id), payload: p.payload ?? {}, ...(p.vector?.dense ? { vector: p.vector.dense } : {}) })), user);
+        return (r?.points ?? []).map((p) => ({ id: String(p.id), payload: p.payload ?? {}, ...(p.vector?.dense ? { vector: p.vector.dense } : {}) }));
     }
     async count(filter) {
-        const scoped = this.scoped(filter, this.user());
-        const r = await this.call('POST', `/collections/${this.collection}/points/count`, { exact: false, ...(scoped ? { filter: scoped } : {}) });
+        const r = await this.call('POST', `${this.at}/points/count`, { exact: false, ...(filter ? { filter } : {}) });
         return r?.count ?? 0;
     }
     /** The items behind `ids` (key points), with their payload — and their dense vector when asked. */
     async retrieve(ids, withVector = false) {
         if (!ids.length)
             return [];
-        const user = this.user();
-        const r = await this.call('POST', `/collections/${this.collection}/points`, {
-            ids: ids.map((id) => this.scopedId(id, user)), with_payload: true, with_vector: withVector ? ['dense'] : false,
+        const r = await this.call('POST', `${this.at}/points`, {
+            ids, with_payload: true, with_vector: withVector ? ['dense'] : false,
         });
-        // A point is fetched by its id alone; another user's (a hash of their id and the item) is dropped all the same.
-        return this.own((r ?? []).map((p) => ({ id: String(p.id), payload: p.payload ?? {}, ...(p.vector?.dense ? { vector: p.vector.dense } : {}) })), user);
+        return (r ?? []).map((p) => ({ id: String(p.id), payload: p.payload ?? {}, ...(p.vector?.dense ? { vector: p.vector.dense } : {}) }));
     }
     /** The best items for the query, fused by rank — each with the point that matched best (`point`: its key, a chunk of
      *  its text, or a cue), so a caller can show the passage that matched. Each channel (a query vector, the keywords)
@@ -277,8 +215,7 @@ export class QdrantClient {
     async fusedItems(q, timeoutMs = 3000) {
         const limit = q.limit ?? 40;
         const per = q.per ?? Math.max(limit, 50);
-        const user = this.user();
-        const filter = this.scoped(q.filter, user);
+        const filter = q.filter;
         const channels = [];
         const sparse = q.sparse?.indices.length ? q.sparse : null;
         const denseWeight = (sparse ? DENSE_SHARE : 1) / Math.max(1, q.dense.length);
@@ -292,24 +229,23 @@ export class QdrantClient {
             channels.push({ query: sparse, using: 'bm25', weight: 1 - DENSE_SHARE });
         if (!channels.length)
             return [];
-        const lists = await Promise.all(channels.map((c) => this.call('POST', `/collections/${this.collection}/points/query/groups`, {
+        const lists = await Promise.all(channels.map((c) => this.call('POST', `${this.at}/points/query/groups`, {
             query: c.query, using: c.using, ...(c.params ? { params: c.params } : {}),
             ...(c.filter ?? filter ? { filter: c.filter ?? filter } : {}),
             group_by: 'item',
             group_size: 1,
             limit: per,
-            // A shared collection's point ids are scoped: the writer's own id is in the payload.
-            with_payload: user === null ? false : [TENANT_FIELD, TENANT_PID],
+            with_payload: false,
         }, timeoutMs)));
         const fused = new Map();
         lists.forEach((r, c) => {
-            const groups = (r?.groups ?? []).filter((g) => user === null || g.hits[0]?.payload?.[TENANT_FIELD] === user);
+            const groups = r?.groups ?? [];
             const scores = groups.map((g) => g.hits[0]?.score ?? 0);
             const lo = Math.min(...scores);
             const hi = Math.max(...scores);
             groups.forEach((g, rank) => {
                 const item = String(g.id);
-                const raw = user === null ? g.hits[0]?.id : g.hits[0]?.payload?.[TENANT_PID];
+                const raw = g.hits[0]?.id;
                 const at = fused.get(item) ?? { score: 0, rank: Infinity };
                 // A channel whose items all score alike (or that found one) counts each of them fully.
                 at.score += channels[c].weight * (hi > lo ? (scores[rank] - lo) / (hi - lo) : 1);