sliftutils 1.4.87 → 1.5.0

package/index.d.ts

@@ -72,7 +72,7 @@ declare module "sliftutils/misc/https/certs" {
     import * as forge from "node-forge";
     import { MaybePromise } from "socket-function/src/types";
     export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-    export declare const identityStorageKey = "machineCA_10";
+    export declare const identityStorageKey = "machineCA_11";
     export type IdentityStorageType = {
         domain: string;
         certB64: string;
@@ -99,7 +99,7 @@ declare module "sliftutils/misc/https/certs" {
     export declare const sign: (keyPair: {
         key: string | Buffer;
     }, data: unknown) => string;
-    export declare function verify(cert: string, signature: string, data: unknown): boolean;
+    export declare function verify(cert: string, signature: string, data: unknown): void;
     export declare function validateCACert(domain: string, cert: string | Buffer): void;
     export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
     export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
@@ -108,21 +108,22 @@ declare module "sliftutils/misc/https/certs" {
     export declare function createCertFromCA(config: {
         CAKeyPair: X509KeyPair;
     }): X509KeyPair;
-    export declare function getMachineId(domainName: string): string;
+    export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
     export type NodeIdParts = {
         threadId: string;
         machineId: string;
         domain: string;
         port: number;
     };
-    export declare function decodeNodeId(nodeId: string): NodeIdParts | undefined;
-    export declare function decodeNodeIdAssert(nodeId: string): NodeIdParts;
+    export declare function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined;
+    export declare function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts;
     export declare function encodeNodeId(parts: NodeIdParts): string;
     export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
     export declare function loadIdentityCA(domain: string): Promise<void>;
     export declare function getIdentityCA(domain: string): X509KeyPair;
     export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
     export declare function getOwnMachineId(domain: string): string;
+    export declare function getOwnThreadId(domain: string): string;
     /** Part of the machineId comes from the publicKey, so we can use it to verify */
     export declare function verifyMachineIdForPublicKey(config: {
         machineId: string;
@@ -291,6 +292,11 @@ declare module "sliftutils/misc/random" {
 
 }
 
+declare module "sliftutils/misc/strings" {
+    export declare function ellipsize(text: string, maxLength: number): string;
+
+}
+
 declare module "sliftutils/misc/types" {
     export declare function isDefined<T>(value: T | undefined | null): value is T;
     export declare function freezeObject(value: unknown): unknown;
@@ -1153,6 +1159,7 @@ declare module "sliftutils/storage/BulkDatabase2/BulkDatabaseFormat" {
     export declare function buildFileBuffer(rows: Record<string, unknown>[], times: number[], targetBytes?: number): BuiltFile[];
     export declare function buildFileBufferRaw(rows: RawRow[], targetBytes?: number): BuiltFile[];
     export type BaseBulkDatabaseReader = {
+        name?: string;
         rowCount: number;
         totalBytes: number;
         minTime: number;
@@ -1194,6 +1201,7 @@ declare module "sliftutils/storage/BulkDatabase2/BulkDatabaseFormat" {
     export declare function loadBulkDatabase(config: {
         totalBytes: number;
         getRange: (start: number, end: number) => Promise<Buffer>;
+        name?: string;
     }): Promise<BaseBulkDatabaseReader>;
 
 }
@@ -2393,7 +2401,7 @@ declare module "sliftutils/storage/proxydatabase/ivfEmbeddingDatabase" {
     };
     export declare function rebuildStructure(database: Database<IvfEmbeddingRoot>): void;
     export declare function searchEmbeddings(database: Database<IvfEmbeddingRoot>, query: StoredEmbedding, options: {
-        probeCellCount: number;
+        probeBudget: number;
         resultCount: number;
     }): SearchHit[] | undefined;
     export declare function lookupEmbeddings(database: Database<IvfEmbeddingRoot>, refs: string[]): Map<string, StoredEmbedding> | undefined;

package/misc/https/certs.d.ts

@@ -5,7 +5,7 @@
 import * as forge from "node-forge";
 import { MaybePromise } from "socket-function/src/types";
 export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-export declare const identityStorageKey = "machineCA_10";
+export declare const identityStorageKey = "machineCA_11";
 export type IdentityStorageType = {
     domain: string;
     certB64: string;
@@ -32,7 +32,7 @@ export declare function getPublicIdentifier(PEMorDER: string | Buffer): Buffer;
 export declare const sign: (keyPair: {
     key: string | Buffer;
 }, data: unknown) => string;
-export declare function verify(cert: string, signature: string, data: unknown): boolean;
+export declare function verify(cert: string, signature: string, data: unknown): void;
 export declare function validateCACert(domain: string, cert: string | Buffer): void;
 export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
 export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
@@ -41,21 +41,22 @@ export declare function generateTestCA(domain: string): X509KeyPair;
 export declare function createCertFromCA(config: {
     CAKeyPair: X509KeyPair;
 }): X509KeyPair;
-export declare function getMachineId(domainName: string): string;
+export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
 export type NodeIdParts = {
     threadId: string;
     machineId: string;
     domain: string;
     port: number;
 };
-export declare function decodeNodeId(nodeId: string): NodeIdParts | undefined;
-export declare function decodeNodeIdAssert(nodeId: string): NodeIdParts;
+export declare function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined;
+export declare function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts;
 export declare function encodeNodeId(parts: NodeIdParts): string;
 export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
 export declare function loadIdentityCA(domain: string): Promise<void>;
 export declare function getIdentityCA(domain: string): X509KeyPair;
 export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
 export declare function getOwnMachineId(domain: string): string;
+export declare function getOwnThreadId(domain: string): string;
 /** Part of the machineId comes from the publicKey, so we can use it to verify */
 export declare function verifyMachineIdForPublicKey(config: {
     machineId: string;

package/misc/https/certs.ts

@@ -19,6 +19,7 @@ import { MaybePromise } from "socket-function/src/types";
 import { SocketFunction } from "socket-function/SocketFunction";
 import { resetAllNodeCallFactories } from "socket-function/src/nodeCache";
 import { getKeyStore } from "./persistentLocalStorage";
+import { ellipsize } from "../strings";
 
 setFlag(require, "node-forge", "allowclient", true);
 setFlag(require, "js-sha256", "allowclient", true);
@@ -27,7 +28,7 @@ const timeInDay = 1000 * 60 * 60 * 24;
 
 export const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
 
-export const identityStorageKey = "machineCA_10";
+export const identityStorageKey = "machineCA_11";
 export type IdentityStorageType = { domain: string; certB64: string; keyB64: string };
 
 function getIdentityStore(domain: string) {
@@ -99,21 +100,17 @@ export function createX509(
                     //{ type: 7, ip: "127.0.0.1" }
                 ]
             },
-            // NOTE: nameConstraints are supported with our branch. But... chrome doesn't support them, so there's no point in using them.
+            // NOTE: nameConstraints require our forked node-forge:
             //      "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
-            // {
-            //     name: "nameConstraints",
-            //     permittedSubtrees: [
-            //         // Chrome doesn't respect nameConstraints per https://bugs.chromium.org/p/chromium/issues/detail?id=1072083,
-            //         //  as the spec decided that "free to process or ignore such information" (when present in self
-            //         //  signed certificates), and therefore the chrome implementation decided "The first order is to behave predictably",
-            //         //  so... they're not going to support it, because why have a feature in one place, if it isn't
-            //         //  on android as well... ugh...
-            //         // Works fine on Edge though
-            //         { type: 2, value: forge.util.encodeUtf8(domain) },
-            //         { type: 2, value: forge.util.encodeUtf8(localHostDomain) },
-            //     ]
-            // },
+            //  Chrome ignores them (https://bugs.chromium.org/p/chromium/issues/detail?id=1072083),
+            //  but our own validation (validateCACert/validateCertificate) enforces them.
+            {
+                name: "nameConstraints",
+                permittedSubtrees: [
+                    { type: 2, value: forge.util.encodeUtf8(domain) },
+                    { type: 2, value: forge.util.encodeUtf8(localHostDomain) },
+                ]
+            },
         ]);
         certObj.setExtensions(extensions);
 
@@ -191,7 +188,9 @@ export const sign = measureWrap(function sign(keyPair: { key: string | Buffer },
 
 export function verify(cert: string, signature: string, data: unknown) {
     let certObj = parseCert(cert);
-    return (certObj.publicKey as forge.pki.rsa.PublicKey).verify(JSON.stringify(data), signature);
+    if (!(certObj.publicKey as forge.pki.rsa.PublicKey).verify(JSON.stringify(data), signature)) {
+        throw new Error(`Signature verification failed. Signature: ${JSON.stringify(signature)} | Data: ${ellipsize(JSON.stringify(data), 1024)}`);
+    }
 }
 
 function normalizeCertToPEM(PEMorDER: string | Buffer): string {
@@ -211,7 +210,7 @@ function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forg
     } else {
         bytes = Buffer.from(new Uint32Array((publicKey as any).n.data).buffer);
     }
-    return "b" + sha265.sha256(Buffer.from(bytes)).slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
+    return "b" + Buffer.from(sha265.sha256.array(Buffer.from(bytes))).toString("base64").slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
 }
 
 export function validateCACert(domain: string, cert: string | Buffer) {
@@ -440,8 +439,8 @@ export function createCertFromCA(config: {
     });
 }
 
-export function getMachineId(domainName: string) {
-    return domainName.split(".").slice(-3).join(".");
+export function getMachineId(domainNameOrNodeId: string, domain: string) {
+    return decodeNodeIdAssert(domainNameOrNodeId, domain, "allowMissingThreadId").machineId;
 }
 
 export type NodeIdParts = {
@@ -450,13 +449,18 @@ export type NodeIdParts = {
     domain: string;
     port: number;
 };
-export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
+export function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined {
     let locationObj = getNodeIdLocation(nodeId);
     if (!locationObj) {
         return undefined;
     }
     let parts = locationObj.address.split(".");
-    if (nodeId.startsWith("127-0-0-1.") && parts.length === 3) {
+    // NOTE: We have to only allow localhost domains on our own domain, as the underlying domain
+    //  gets stripped when we're looking at the machineId. So if we allowed localhost domains on
+    //  other domains, a server could trick us into connecting to it, and then once the connection
+    //  is established, it could talk back and we would think it has a localhost machineId, which
+    //  is implicitly trusted, which would then give it access to everything.
+    if (locationObj.address === `127-0-0-1.${domain}` && nodeId.includes(":")) {
         return {
             threadId: "",
             machineId: parts.at(-3) || "",
@@ -464,7 +468,8 @@ export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
             port: locationObj.port,
         };
     }
-    if (parts.length < 4) {
+    let isValid = parts.length >= 4 || allowMissingThreadId && parts.length === 3;
+    if (!isValid) {
         return undefined;
     }
     return {
@@ -474,10 +479,10 @@ export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
         port: locationObj.port,
     };
 }
-export function decodeNodeIdAssert(nodeId: string): NodeIdParts {
-    let result = decodeNodeId(nodeId);
+export function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts {
+    let result = decodeNodeId(nodeId, domain, allowMissingThreadId);
     if (!result) {
-        throw new Error(`Invalid nodeId: ${nodeId}`);
+        throw new Error(`Invalid nodeId: ${JSON.stringify(nodeId)}`);
     }
     return result;
 }
@@ -523,7 +528,10 @@ export function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>
 
 
 export function getOwnMachineId(domain: string) {
-    return getMachineId(getIdentityCA(domain).domain);
+    return getMachineId(getIdentityCA(domain).domain, domain);
+}
+export function getOwnThreadId(domain: string) {
+    return decodeNodeIdAssert(getThreadKeyCert(domain).domain, domain).threadId;
 }
 
 /** Part of the machineId comes from the publicKey, so we can use it to verify */
@@ -533,7 +541,8 @@ export function verifyMachineIdForPublicKey(config: {
 }): boolean {
     let { machineId, publicKey } = config;
     let domainPart = getDomainPartFromPublicKey(publicKey);
-    return machineId.split(".").at(-3) === domainPart;
+    // machineId is the bare key-hash label, but also accept legacy "hash.domain.tld" forms
+    return machineId.split(".")[0] === domainPart;
 }
 
 // NOTE: We don't have a cache per CA, as... the CA should be set first

package/misc/strings.d.ts

@@ -0,0 +1 @@
+export declare function ellipsize(text: string, maxLength: number): string;

package/misc/strings.ts

@@ -0,0 +1,8 @@
+module.allowclient = true;
+
+export function ellipsize(text: string, maxLength: number): string {
+    if (text.length <= maxLength) {
+        return text;
+    }
+    return text.slice(0, maxLength - 3) + "...";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.4.87",
+    "version": "1.5.0",
     "main": "index.js",
     "license": "MIT",
     "files": [

package/storage/BulkDatabase2/BulkDatabaseFormat.d.ts

@@ -41,6 +41,7 @@ export interface BuiltFile {
 export declare function buildFileBuffer(rows: Record<string, unknown>[], times: number[], targetBytes?: number): BuiltFile[];
 export declare function buildFileBufferRaw(rows: RawRow[], targetBytes?: number): BuiltFile[];
 export type BaseBulkDatabaseReader = {
+    name?: string;
     rowCount: number;
     totalBytes: number;
     minTime: number;
@@ -82,4 +83,5 @@ export declare function loadBulkHeader(getRange: (start: number, end: number) =>
 export declare function loadBulkDatabase(config: {
     totalBytes: number;
     getRange: (start: number, end: number) => Promise<Buffer>;
+    name?: string;
 }): Promise<BaseBulkDatabaseReader>;

package/storage/BulkDatabase2/BulkDatabaseFormat.ts

@@ -410,6 +410,9 @@ export function buildFileBufferRaw(rows: RawRow[], targetBytes = TARGET_FILE_BYT
 }
 
 export type BaseBulkDatabaseReader = {
+    // Identifies the source this reader came from (the bulk file name, or "(streams)") so the join can
+    // name the offending file when one of its reads fails. Undefined for readers built without one.
+    name?: string;
     rowCount: number;
     totalBytes: number;
     // Write-time bounds of this reader's data (0 if unknown — old bulk files).
@@ -468,6 +471,7 @@ export async function loadBulkHeader(getRange: (start: number, end: number) => P
 export async function loadBulkDatabase(config: {
     totalBytes: number;
     getRange: (start: number, end: number) => Promise<Buffer>;
+    name?: string;
 }): Promise<BaseBulkDatabaseReader> {
     const headerLength = (await config.getRange(0, 4)).readUInt32LE(0);
     if (headerLength <= 0 || headerLength > config.totalBytes) {
@@ -502,6 +506,7 @@ export async function loadBulkDatabase(config: {
         : keys.map(() => header.maxTime || 0);
 
     return {
+        name: config.name,
         rowCount,
         totalBytes: config.totalBytes,
         minTime: header.minTime || 0,

package/storage/BulkDatabase2/LoadedIndex.ts

@@ -257,7 +257,7 @@ export async function loadFileReader(name: string, storage: FileStorage, f: Bulk
     const raw = await makeRawGetRange(storage, f.fileName);
     const fileId = nullJoin(name, f.fileName);
     const opened = await blockCache.open(fileId, raw.size, raw.rawGetRange);
-    const reader = await loadBulkDatabase({ totalBytes: opened.uncompressedSize, getRange: opened.getRange });
+    const reader = await loadBulkDatabase({ totalBytes: opened.uncompressedSize, getRange: opened.getRange, name: f.fileName });
     cache.set(f.fileName, reader);
     return reader;
 }
@@ -327,6 +327,19 @@ function pruneSubCaches(bulkFiles: BulkFileInfo[], streamFiles: StreamFileInfo[]
     for (const n of subCaches.stream.keys()) if (!liveStream.has(n)) subCaches.stream.delete(n);
 }
 
+// A corrupt/unreadable column in ONE underlying file must not break the whole joined read. When a
+// source's column read throws, we drop that source for that column (falling through to older readers,
+// exactly as if the file never set the column) and warn once per (file, column) so the corruption is
+// visible without flooding the log on every rebuild.
+const warnedCorruptReads = new Set<string>();
+function warnCorruptRead(db: BaseBulkDatabaseReader, column: string, e: unknown): void {
+    const fileName = db.name || "(unknown source)";
+    const dedupeKey = nullJoin(fileName, column);
+    if (warnedCorruptReads.has(dedupeKey)) return;
+    warnedCorruptReads.add(dedupeKey);
+    console.warn(`${red("corrupt read")}: file ${fileName} column ${JSON.stringify(column)} could not be read - skipping it (its data is dropped from results): ${(e as Error).message}`);
+}
+
 function joinBulkDatabases(databases: BaseBulkDatabaseReader[]): ResolvedReader {
     const deleteTime = new Map<string, number>();
     for (const db of databases) {
@@ -367,8 +380,13 @@ function joinBulkDatabases(databases: BaseBulkDatabaseReader[]): ResolvedReader
         async getColumn(column) {
             const perReader = await Promise.all(databases.map(async db => {
                 if (!db.columns.some(c => c.column === column)) return undefined;
-                const entries = await db.getColumn(column);
-                return new Map(entries.map(e => [e.key, { value: e.value, time: e.time }]));
+                try {
+                    const entries = await db.getColumn(column);
+                    return new Map(entries.map(e => [e.key, { value: e.value, time: e.time }]));
+                } catch (e) {
+                    warnCorruptRead(db, column, e);
+                    return undefined;
+                }
             }));
             return keys.map(key => {
                 let bestTime = -Infinity;
@@ -391,7 +409,13 @@ function joinBulkDatabases(databases: BaseBulkDatabaseReader[]): ResolvedReader
             let found = false;
             for (const db of databases) {
                 if (!db.columns.some(c => c.column === column)) continue;
-                const r = await db.getSingleField(key, column);
+                let r;
+                try {
+                    r = await db.getSingleField(key, column);
+                } catch (e) {
+                    warnCorruptRead(db, column, e);
+                    continue;
+                }
                 if (r === ABSENT) continue;
                 if (r.time > bestTime) { bestTime = r.time; bestVal = r.value; found = true; }
             }

package/storage/BulkDatabase2/streamLog.ts

@@ -106,6 +106,7 @@ export function streamReaderFromEntries(entries: StreamEntry[], totalBytes: numb
     }
     const keyIndexMap = buildKeyIndex(keys);
     let reader: BaseBulkDatabaseReader = {
+        name: "(streams)",
         totalBytes,
         rowCount: keys.length,
         minTime: times.size ? minTime : 0,

package/storage/proxydatabase/ivfDbCheck.ts

@@ -72,7 +72,7 @@ async function main() {
         const sampleCount = 100;
         for (let index = 0; index < sampleCount; index++) {
             const query = allInputs[Math.floor(index * run.size / sampleCount)];
-            const hits = searchEmbeddings(database, query.embedding, { probeCellCount: 64, resultCount: 1 });
+            const hits = searchEmbeddings(database, query.embedding, { probeBudget: 512, resultCount: 1 });
             if (hits && hits.length && hits[0].ref === query.ref) {
                 found++;
             }

package/storage/proxydatabase/ivfEmbeddingDatabase.d.ts

@@ -31,7 +31,7 @@ export type SearchHit = {
 };
 export declare function rebuildStructure(database: Database<IvfEmbeddingRoot>): void;
 export declare function searchEmbeddings(database: Database<IvfEmbeddingRoot>, query: StoredEmbedding, options: {
-    probeCellCount: number;
+    probeBudget: number;
     resultCount: number;
 }): SearchHit[] | undefined;
 export declare function lookupEmbeddings(database: Database<IvfEmbeddingRoot>, refs: string[]): Map<string, StoredEmbedding> | undefined;

package/storage/proxydatabase/ivfEmbeddingDatabase.ts

@@ -2,7 +2,6 @@ import cborx from "cbor-x";
 import { Database, namespaceDatabase } from "./Database";
 import { TransactionSetStore, transactionRead, transactionMutate, transactionDelete, replayTransactionStore } from "./transactionSet";
 import { StoredEmbedding, EmbeddingFormat, getCloseness, embeddingToFloat32, releaseFloat32, encodeEmbedding, hashEmbedding } from "../embeddingFormats";
-import { isDefined } from "../../misc/types";
 
 export type IvfConfig = {
     model: string;
@@ -218,8 +217,7 @@ export function rebuildStructure(database: Database<IvfEmbeddingRoot>): void {
 export function searchEmbeddings(
     database: Database<IvfEmbeddingRoot>,
     query: StoredEmbedding,
-    // NOTE: We do a progressive search, so probe cell count can be very high.
-    options: { probeCellCount: number; resultCount: number },
+    options: { probeBudget: number; resultCount: number },
 ): SearchHit[] | undefined {
     const config = database.readData(root => root.config);
     if (!config) return undefined;
@@ -240,36 +238,14 @@ export function searchEmbeddings(
     const centroids = transactionRead(centroidStore(database));
     if (!centroids) return undefined;
     if (!centroids.size) return [];
-    const probeCellCount = Math.min(centroids.size, options.probeCellCount);
-
-    let rankedCellIds = rankCellsByCloseness(query, centroids);
-    let stores: TransactionSetStore<StoredEmbedding>[] = [];
-    // A somewhat strange search, trying to load more and more data. The reason we can't load everything at once is because the server has no way of knowing what we want first, and so it'll just wait until it can give us everything at once. By waiting until all of the earlier values load before even requesting the later values, it means that we will receive the earlier values sooner. Which will result in the search immediately returning results with very few accesses, And then the results improving in quality as time goes on, which is very desirable. 
-    {
-        let stopAtNextKeyPoint = false;
-        let keyPoints: number[] = [];
-        let currentProbeAdd = 4;
-        let currentTarget = currentProbeAdd;
-        while (currentTarget < probeCellCount) {
-            keyPoints.push(currentTarget);
-            currentTarget += currentProbeAdd;
-            currentProbeAdd *= 2;
-        }
-        for (let i = 0; i < probeCellCount; i++) {
-            if (keyPoints.includes(i) && stopAtNextKeyPoint) break;
-            let store = database.readData(root => root.cells[rankedCellIds[i]]);
-            if (!store) {
-                stopAtNextKeyPoint = true;
-                continue;
-            }
-            stores.push(store);
-        }
-    }
-
+    const probeCellCount = Math.max(1, Math.ceil(options.probeBudget / config.cellTargetSize));
+    const probeCellIds = rankCellsByCloseness(query, centroids).slice(0, probeCellCount);
+    const stores = database.readData(root => probeCellIds.map(cellId => root.cells[cellId]));
+    if (!stores) return undefined;
     for (const store of stores) {
         const members = replayTransactionStore<StoredEmbedding>(store);
-        for (const [ref, value] of members) {
-            hits.push({ ref, closeness: getCloseness(query, value) });
+        for (const ref of members.keys()) {
+            hits.push({ ref, closeness: getCloseness(query, members.get(ref)!) });
         }
     }
     hits.sort((left, right) => right.closeness - left.closeness);