lorebase-store 0.2.3__py3-none-any.whl

lorebase_store/webhooks/keys.py

@@ -0,0 +1,126 @@
+"""Webhook signing keys at rest.
+
+The signing key of a webhook is `sha256(secret)` (`webhooks.signing`): whoever holds it can
+sign deliveries. With `webhooks.encryption_key` set, it is stored sealed (AES-256-GCM under a
+key derived from that secret, `lorebase_store.keyring`) in `webhooks.sealed_key`, and
+`secret_hash` stays null. Without it, the key is stored usable in `secret_hash`, as before
+revision 0016 (Keeper does so only with `webhooks.allow_unsealed_keys`); the delivery worker
+seals such rows once a key is configured (`seal_stored_keys`), so existing webhooks keep
+working through the change. Keys sealed under one of `previous_encryption_keys` still open and
+are sealed again under the current key.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from dataclasses import dataclass
+
+from sqlalchemy import select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from lorebase_store.keyring import Keyring
+from lorebase_store.models import metadata
+from lorebase_store.webhooks.settings import WebhookSettings
+
+WEBHOOKS = metadata.tables["webhooks"]
+NAMESPACE = "webhooks"
+PURPOSE = "signing-key"
+
+
+@dataclass(frozen=True, slots=True)
+class StoredKey:
+    """The columns that hold a signing key: exactly one is set."""
+
+    secret_hash: bytes | None
+    sealed_key: bytes | None
+
+
+@dataclass(frozen=True, slots=True)
+class OpenedKey:
+    """A usable signing key; `stale` when it is stored usable or under a previous key."""
+
+    key: bytes
+    stale: bool
+
+
+class SigningKeys:
+    """Seals and opens webhook signing keys under the configured encryption keys."""
+
+    def __init__(self, current: str | None, previous: Sequence[str] = ()) -> None:
+        self._current = None if current is None else Keyring(current, namespace=NAMESPACE)
+        self._previous = [Keyring(secret, namespace=NAMESPACE) for secret in previous]
+
+    @classmethod
+    def from_settings(cls, settings: WebhookSettings) -> SigningKeys:
+        current = settings.encryption_key
+        return cls(
+            None if current is None else current.get_secret_value(),
+            [key.get_secret_value() for key in settings.previous_encryption_keys],
+        )
+
+    @property
+    def sealing(self) -> bool:
+        """Whether new keys are stored sealed."""
+        return self._current is not None
+
+    @property
+    def rotating(self) -> bool:
+        """Whether keys sealed under a previous encryption key may exist."""
+        return bool(self._previous)
+
+    def store(self, key: bytes) -> StoredKey:
+        """The columns to store `key` in."""
+        if self._current is None:
+            return StoredKey(secret_hash=key, sealed_key=None)
+        return StoredKey(secret_hash=None, sealed_key=self._current.seal(PURPOSE, key))
+
+    def open(self, stored: StoredKey) -> OpenedKey | None:
+        """The usable key; None when it is sealed under a key that is not configured."""
+        if stored.secret_hash is not None:
+            return OpenedKey(bytes(stored.secret_hash), stale=self._current is not None)
+        if stored.sealed_key is None:
+            return None
+        sealed = bytes(stored.sealed_key)
+        if self._current is not None:
+            key = self._current.open(PURPOSE, sealed)
+            if key is not None:
+                return OpenedKey(key, stale=False)
+        for keyring in self._previous:
+            key = keyring.open(PURPOSE, sealed)
+            if key is not None:
+                return OpenedKey(key, stale=True)
+        return None
+
+
+async def seal_stored_keys(session: AsyncSession, keys: SigningKeys, *, limit: int) -> int:
+    """Seal up to `limit` keys stored usable or under a previous key; the number sealed.
+
+    Runs in the caller's transaction, which must see every Domain (RLS bypass). Rows are locked
+    with `SKIP LOCKED`, so concurrent workers seal different rows.
+    """
+    if not keys.sealing:
+        return 0
+    w = WEBHOOKS
+    query = (
+        select(w.c.domain_id, w.c.id, w.c.secret_hash, w.c.sealed_key)
+        .order_by(w.c.domain_id, w.c.id)
+        .with_for_update(skip_locked=True)
+    )
+    if not keys.rotating:  # only keys stored usable are stale: found without opening any
+        query = query.where(w.c.secret_hash.is_not(None)).limit(limit)
+    rows = list(await session.execute(query))
+    sealed = 0
+    for row in rows:
+        if sealed >= limit:
+            break
+        opened = keys.open(StoredKey(row.secret_hash, row.sealed_key))
+        if opened is None or not opened.stale:
+            continue
+        stored = keys.store(opened.key)
+        await session.execute(
+            update(w)
+            .where(w.c.domain_id == row.domain_id, w.c.id == row.id)
+            .values(secret_hash=stored.secret_hash, sealed_key=stored.sealed_key)
+        )
+        sealed += 1
+    return sealed

lorebase_store/webhooks/repository.py

@@ -0,0 +1,142 @@
+"""Webhooks of one Domain (management); deliveries are handled by `webhooks.delivery`."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from dataclasses import dataclass
+from datetime import datetime
+
+from sqlalchemy import Table, delete, func, insert, select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from lorebase_store.auth.scope import new_id
+from lorebase_store.models import metadata
+from lorebase_store.webhooks.keys import StoredKey
+
+WEBHOOKS: Table = metadata.tables["webhooks"]
+WEBHOOK_DELIVERIES: Table = metadata.tables["webhook_deliveries"]
+ID_PREFIX = "whk"
+
+
+@dataclass(frozen=True, slots=True)
+class WebhookRow:
+    id: str
+    domain_id: str
+    url: str
+    description: str | None
+    event_types: tuple[str, ...]
+    branches: tuple[str, ...] | None
+    created_by: str
+    created_at: datetime
+    clearances: tuple[str, ...] = ()
+    """Sensitivity tags whose values the webhook receives in clear."""
+
+
+_COLUMNS = (
+    WEBHOOKS.c.id,
+    WEBHOOKS.c.domain_id,
+    WEBHOOKS.c.url,
+    WEBHOOKS.c.description,
+    WEBHOOKS.c.event_types,
+    WEBHOOKS.c.branches,
+    WEBHOOKS.c.created_by,
+    WEBHOOKS.c.created_at,
+    WEBHOOKS.c.clearances,
+)
+
+
+def webhook_row(row: object) -> WebhookRow:
+    values = row._mapping  # type: ignore[attr-defined]
+    branches = values["branches"]
+    return WebhookRow(
+        id=values["id"],
+        domain_id=values["domain_id"],
+        url=values["url"],
+        description=values["description"],
+        event_types=tuple(values["event_types"]),
+        branches=None if branches is None else tuple(branches),
+        created_by=values["created_by"],
+        created_at=values["created_at"],
+        clearances=tuple(values.get("clearances") or ()),
+    )
+
+
+class WebhookRepository:
+    """Webhooks of one Domain, in the caller's transaction (scoped to the Domain)."""
+
+    def __init__(self, session: AsyncSession, domain_id: str) -> None:
+        self._session = session
+        self._domain = domain_id
+
+    async def add(
+        self,
+        *,
+        url: str,
+        description: str | None,
+        event_types: Sequence[str],
+        branches: Sequence[str] | None,
+        signing_key: StoredKey,
+        created_by: str,
+        clearances: Sequence[str] = (),
+    ) -> WebhookRow:
+        result = await self._session.execute(
+            insert(WEBHOOKS)
+            .values(
+                domain_id=self._domain,
+                id=new_id(ID_PREFIX),
+                url=url,
+                description=description,
+                event_types=list(event_types),
+                branches=None if branches is None else list(branches),
+                secret_hash=signing_key.secret_hash,
+                sealed_key=signing_key.sealed_key,
+                created_by=created_by,
+                clearances=sorted(set(clearances)),
+            )
+            .returning(*_COLUMNS)
+        )
+        return webhook_row(result.one())
+
+    async def all(self) -> list[WebhookRow]:
+        result = await self._session.execute(
+            select(*_COLUMNS)
+            .where(WEBHOOKS.c.domain_id == self._domain)
+            .order_by(WEBHOOKS.c.created_at, WEBHOOKS.c.id)
+        )
+        return [webhook_row(row) for row in result]
+
+    async def count(self) -> int:
+        found = await self._session.scalar(
+            select(func.count()).select_from(WEBHOOKS).where(WEBHOOKS.c.domain_id == self._domain)
+        )
+        return int(found or 0)
+
+    async def get(self, webhook_id: str, *, for_update: bool = False) -> WebhookRow | None:
+        """One webhook of the Domain, row-locked when `for_update`; None when absent."""
+        query = select(*_COLUMNS).where(
+            WEBHOOKS.c.domain_id == self._domain, WEBHOOKS.c.id == webhook_id
+        )
+        found = (
+            await self._session.execute(query.with_for_update() if for_update else query)
+        ).first()
+        return None if found is None else webhook_row(found)
+
+    async def set_clearances(self, webhook_id: str, clearances: Sequence[str]) -> WebhookRow | None:
+        """Replace the clearances of a webhook; None when it does not exist."""
+        result = await self._session.execute(
+            update(WEBHOOKS)
+            .where(WEBHOOKS.c.domain_id == self._domain, WEBHOOKS.c.id == webhook_id)
+            .values(clearances=sorted(set(clearances)))
+            .returning(*_COLUMNS)
+        )
+        found = result.first()
+        return None if found is None else webhook_row(found)
+
+    async def delete(self, webhook_id: str) -> bool:
+        """Delete a webhook and its deliveries; false when it does not exist."""
+        result = await self._session.execute(
+            delete(WEBHOOKS)
+            .where(WEBHOOKS.c.domain_id == self._domain, WEBHOOKS.c.id == webhook_id)
+            .returning(WEBHOOKS.c.id)
+        )
+        return result.first() is not None

lorebase_store/webhooks/settings.py

@@ -0,0 +1,138 @@
+"""The `webhooks` settings section: targets Keeper accepts and how the worker delivers."""
+
+from __future__ import annotations
+
+from typing import Self
+
+from pydantic import Field, model_validator
+
+from lorebase_platform.secrets import SecretValue
+from lorebase_platform.settings import SectionModel, Settings, register_section
+
+SECTION = "webhooks"
+MIN_ENCRYPTION_KEY_LENGTH = 32
+
+
+class WebhookSettings(SectionModel):
+    """Webhook management (Keeper) and delivery (`deliver_pending`)."""
+
+    allowed_schemes: tuple[str, ...] = Field(
+        default=("https",), min_length=1, description="URL schemes a webhook may use."
+    )
+    allow_private_targets: bool = Field(
+        default=False,
+        description="Allow loopback, private and link-local target addresses. Off by default so "
+        "Domain administrators cannot reach internal services.",
+    )
+    max_per_domain: int = Field(default=20, ge=1, description="Webhooks of one Domain.")
+    secret_bytes: int = Field(default=32, ge=16, description="Random bytes of a new secret.")
+    encryption_key: SecretValue | None = Field(
+        default=None,
+        description="Key (at least 32 characters) that encrypts webhook signing keys in the "
+        "database, e.g. secret://env/LOREBASE_WEBHOOK_KEY; Keeper and Scribe need the same "
+        "value. Unset: Keeper refuses to create webhooks unless allow_unsealed_keys is true. "
+        "Once set, the delivery worker encrypts the keys stored usable before.",
+    )
+    allow_unsealed_keys: bool = Field(
+        default=False,
+        description="For local development only: without encryption_key, store the signing "
+        "keys of new webhooks usable instead of refusing to create them.",
+    )
+    previous_encryption_keys: tuple[SecretValue, ...] = Field(
+        default=(),
+        description="Earlier encryption keys, tried when the current one does not open a "
+        "signing key; the worker encrypts such keys again under encryption_key. Remove one "
+        "once no webhook uses it.",
+    )
+    signature_header: str = Field(default="Lorebase-Signature", min_length=1)
+    event_header: str = Field(default="Lorebase-Event", min_length=1)
+    delivery_header: str = Field(default="Lorebase-Delivery", min_length=1)
+    idempotency_header: str = Field(
+        default="Idempotency-Key",
+        min_length=1,
+        description="Header carrying `evt_<sequence>`, the same on every attempt of an event: "
+        "deliveries are at least once, receivers drop the repeats by it.",
+    )
+    masked_value: str = Field(
+        default="***",
+        description="What a sensitive value is replaced by for a webhook not cleared for it.",
+    )
+    erased_value: str = Field(
+        default="[erased]",
+        description="What a cleared webhook receives for a vault value erased before sending.",
+    )
+    timeout_s: float = Field(
+        default=10.0,
+        gt=0,
+        description="Time budget of one attempt as a whole: host lookup, connection to each "
+        "checked address, sending and the answer's status. Past it the attempt fails and is "
+        "retried like any other failure.",
+    )
+    connect_timeout_s: float = Field(
+        default=5.0,
+        gt=0,
+        description="Time to open a connection to one address; the next checked address is "
+        "tried after it, within timeout_s.",
+    )
+    max_attempts: int = Field(
+        default=8, ge=1, description="Attempts before a delivery is marked dead."
+    )
+    backoff_base_s: float = Field(default=30.0, gt=0, description="Delay after the first failure.")
+    backoff_factor: float = Field(default=2.0, ge=1, description="Growth of each next delay.")
+    backoff_max_s: float = Field(default=3600.0, gt=0, description="Longest delay.")
+    lease_s: float = Field(
+        default=120.0,
+        gt=0,
+        description="A claimed delivery is retried by another worker after this long if its "
+        "result was never recorded; a pass running longer than this is abandoned.",
+    )
+    batch: int = Field(default=100, ge=1, description="Events and deliveries per worker pass.")
+    concurrency: int = Field(
+        default=8,
+        ge=1,
+        description="Attempts of one pass in flight at the same time, so a target that does "
+        "not answer holds one of them, not the whole pass.",
+    )
+    pass_timeout_s: float = Field(
+        default=60.0,
+        gt=0,
+        description="A pass starts no attempt after this long; the deliveries it claimed and did "
+        "not attempt are released to the next pass without counting an attempt.",
+    )
+    changed_keys_max: int = Field(
+        default=100, ge=0, description="Changed Record keys listed per event payload."
+    )
+    retention_s: float = Field(
+        default=7 * 24 * 3600.0,
+        gt=0,
+        description="Finished deliveries older than this are deleted by the worker (outbox "
+        "events follow store.outbox.retention_s).",
+    )
+
+    @model_validator(mode="after")
+    def _consistent(self) -> Self:
+        if self.backoff_base_s > self.backoff_max_s:
+            raise ValueError("backoff_base_s cannot exceed backoff_max_s")
+        if self.connect_timeout_s > self.timeout_s:
+            raise ValueError("connect_timeout_s cannot exceed timeout_s")
+        if self.lease_s <= self.pass_timeout_s + self.timeout_s:
+            raise ValueError("lease_s must exceed pass_timeout_s + timeout_s")
+        keys = [self.encryption_key, *self.previous_encryption_keys]
+        if any(
+            key is not None and len(key.get_secret_value()) < MIN_ENCRYPTION_KEY_LENGTH
+            for key in keys
+        ):
+            raise ValueError(
+                f"webhook encryption keys need at least {MIN_ENCRYPTION_KEY_LENGTH} characters"
+            )
+        if self.previous_encryption_keys and self.encryption_key is None:
+            raise ValueError("previous_encryption_keys need an encryption_key")
+        return self
+
+
+register_section(SECTION, WebhookSettings)
+
+
+def webhook_settings(settings: Settings) -> WebhookSettings:
+    """The validated `webhooks` section."""
+    return settings.section(SECTION, WebhookSettings)

lorebase_store/webhooks/signing.py

@@ -0,0 +1,50 @@
+"""Webhook secrets and signatures.
+
+A webhook secret is shown once, when the webhook is created. Lorebase keeps only its SHA-256
+digest, which is also the HMAC key: receivers compute `sha256(secret)` once and verify
+
+    signature header = "t=<unix seconds>,v1=<hex HMAC-SHA256(key, "<t>." + body)>"
+
+The timestamp lets receivers refuse replays older than their tolerance. Storing the digest
+keeps the secret itself out of the database; a leaked digest still allows forging signatures,
+so the digest is stored sealed when `webhooks.encryption_key` is set (`webhooks.keys`). Rotate
+a webhook (delete and create) when the database and that key may have been exposed.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+SECRET_PREFIX = "whsec_"
+SIGNATURE_VERSION = "v1"
+
+
+def new_secret(nbytes: int) -> str:
+    """A new random webhook secret."""
+    return SECRET_PREFIX + secrets.token_urlsafe(nbytes)
+
+
+def signing_key(secret: str) -> bytes:
+    """The stored digest of a secret, used as the HMAC key."""
+    return hashlib.sha256(secret.encode()).digest()
+
+
+def signature(key: bytes, timestamp: int, body: bytes) -> str:
+    """Value of the signature header for `body` sent at `timestamp`."""
+    digest = hmac.new(key, f"{timestamp}.".encode() + body, hashlib.sha256).hexdigest()
+    return f"t={timestamp},{SIGNATURE_VERSION}={digest}"
+
+
+def verify(secret: str, header: str, body: bytes, *, now: int, tolerance_s: int) -> bool:
+    """Receiver side: whether `header` signs `body` with `secret` within the tolerance."""
+    parts = dict(part.split("=", 1) for part in header.split(",") if "=" in part)
+    try:
+        timestamp = int(parts["t"])
+    except (KeyError, ValueError):
+        return False
+    if abs(now - timestamp) > tolerance_s:
+        return False
+    expected = signature(signing_key(secret), timestamp, body)
+    return hmac.compare_digest(expected, header)

lorebase_store-0.2.3.dist-info/METADATA

@@ -0,0 +1,13 @@
+Metadata-Version: 2.5
+Name: lorebase-store
+Version: 0.2.3
+Summary: Lorebase store: persistence, repositories, migrations and materializer
+Requires-Python: >=3.12
+Requires-Dist: alembic>=1.13
+Requires-Dist: asyncpg>=0.29
+Requires-Dist: cryptography>=42
+Requires-Dist: lorebase-core<0.3,>=0.2
+Requires-Dist: lorebase-platform<0.3,>=0.2
+Requires-Dist: opentelemetry-api>=1.25
+Requires-Dist: pgvector>=0.3
+Requires-Dist: sqlalchemy[asyncio]>=2.0.30

lorebase_store-0.2.3.dist-info/RECORD

@@ -0,0 +1,163 @@
+lorebase_store/__init__.py,sha256=PNiDER4qM19h9zdsdfgKt2_dT4WgYK7EguJ8RU2qA_g,22
+lorebase_store/blobs.py,sha256=Ovrb2wnHt2t0vYBBsgzMBGQMo0_ojElHGGc4sDtCu2I,2762
+lorebase_store/bm25.py,sha256=3jLns00FdVhZi0_pTFhXY_TSwPqHL27Xa8uvK5B-lHE,13818
+lorebase_store/bulk.py,sha256=06KKakOqqv7NuN1xbuk9VgzlWKA5f8uj0Ev92kC7Z1Q,4979
+lorebase_store/bundle.py,sha256=7LRwxYj6cIHz-IZxJC8YyV4tvHVTlvvMNK51csxrQyQ,74328
+lorebase_store/changefeed.py,sha256=ztgumUGGeUEkNwh_7-LcBd1iIrbSAyujzCOCEWNShsU,9673
+lorebase_store/db.py,sha256=4mGzh8vnmBZWGuayIIZiqvwnJbXEzVZrCD3rOr_i2EU,2165
+lorebase_store/definer.py,sha256=r9_hujWxd-DsWlENZk-SkvVaYgWtN7BYyWdWpt5dfsc,1943
+lorebase_store/digests.py,sha256=lC5FgSiR7ZUDrNdBBzCYJYc9TdRZYMUZZL_hUvSZDtQ,4102
+lorebase_store/embeddings.py,sha256=mchl7VtNJXm7Y4qi-RkSrT-JdYACbLgfSJW6COjSliw,15943
+lorebase_store/endpoint_modes.py,sha256=Jch2pu-pBhX6_veR4Waf4aNtoQ3S-LK1LtswFUPcV98,2388
+lorebase_store/gc.py,sha256=1NTQkeszB4970oBwNfdF6Y9Xqe1Ao-VLOcXWrweSY8Q,39953
+lorebase_store/indexes.py,sha256=KSlNvpGO0qYW813g-DI86XkTyT7_9ofEQvJQzVXLNq8,42076
+lorebase_store/jobs.py,sha256=fIyJsuWr6LiokoDu8yZZOmKCLpfnD13_Jy11oL8FZYs,25251
+lorebase_store/keyring.py,sha256=bs-6gHA7_t-yn9L19wWDAke8T85eHReOEYXc-UGkmVs,3109
+lorebase_store/layout.py,sha256=wekZqurX-9-KPFCY4S3QUaaksr4t9frK9XPAGyOuVXA,15545
+lorebase_store/migrations.py,sha256=HJF-_1QmuUCkeHUQtp1foz3WQ85geEZsKE5eyOOIrM0,4987
+lorebase_store/nodestore.py,sha256=vL1ukHW6yKQX_WseuCXVdelPkl604IfIIOCrae6v_eM,15170
+lorebase_store/objectstore.py,sha256=4D3JM31H-3Dc583yMBZVxfPl1x0AUGouszuLkC_jWi8,5938
+lorebase_store/outbox_events.py,sha256=7uAgwHAh7B8-sIsKhUz-1QcbtButeBPJlzfJ8uru8sU,6653
+lorebase_store/ratelimit.py,sha256=B128PTSD70YiKT__pV-fwzUX79sS8RcHbQIbb1pHt_Y,4527
+lorebase_store/reads.py,sha256=6NPtwldtd9YwGBtcTVhI9T2BfUmKj8nb1KVMQo_xkUI,59349
+lorebase_store/replicas.py,sha256=w9JJlQHoyeeelEVYdvWBuknR8yhtalxNAjNFXdONLks,16376
+lorebase_store/runtime.py,sha256=6O8DXC5wmUkYyzTIufj_sFRDFPddxjL9wg9SlOvFZuc,3179
+lorebase_store/schema_cache.py,sha256=DC3Mh7Qf2UEMyc1Br_Too6OjwEgnMWBxMoChuglfUoM,1728
+lorebase_store/settings.py,sha256=U0ARHtwXmzL6Sl4ekUzWYsg6YXf8EgXNI76DDxqNPec,37851
+lorebase_store/storage.py,sha256=tFdGKqzxRn7PRrb1le8I90Vhs7XgQT-kMAD8rNZs1N8,60783
+lorebase_store/telemetry.py,sha256=f_xeyo-csHRJM_xzymf5-7ZmxF4V8Pqkb9Xei96YK7A,5344
+lorebase_store/testing.py,sha256=BAJcDEji6_hhlLViWCHjekKhr5fzy-KKyRG306zDOMI,4245
+lorebase_store/tracing.py,sha256=sfTkJEXoMHOizUgBtXyWvqTdr-StaN3spEtPLlruUmg,20820
+lorebase_store/traverse.py,sha256=ebrY6Cp2ZEn9GGCXAWgzYWF2-tSJPLM1tu4zGbwo37M,24716
+lorebase_store/auth/__init__.py,sha256=B71QGpW1Pg8InKOevimx7MC90ToSXXVEqmp8qqHBtl8,1359
+lorebase_store/auth/api_keys.py,sha256=MecexRi41Q4GSQXwNVkZ7OeN9qhgRLtdOnE6sqcvUQY,5809
+lorebase_store/auth/audit.py,sha256=F3WAFNNsHNi9AVAqw3DaeYlR_qAEQyvKxbqXn50nCsg,14446
+lorebase_store/auth/checkpoints.py,sha256=GhaaUedf8ua8zpUFWCPWEkVl_JI6ugzWeu0Ak27Qnwk,7729
+lorebase_store/auth/grants.py,sha256=o_7-Zc8qRJ0a7W2zhoGdvRsDmNXURrZuP8GFEgjevQA,6048
+lorebase_store/auth/principals.py,sha256=O9uQ7ia-R3EygnS3cmMsZDzNg4G-4w3GXFkhLrEHblc,5835
+lorebase_store/auth/scope.py,sha256=DGvHdOsqmJSOs1AS2ourG-JGeMFo8dIvln_Sk_97FLo,2713
+lorebase_store/auth/sessions.py,sha256=_UXTl0LDJ3U-eZk0ll5xBcERgJbC98rM5xNSw9OkO6M,5599
+lorebase_store/auth/unit.py,sha256=-GF0C-zXvFD4Mjf_FTUCKsJNEEpK9N_znKez5X5yisc,1975
+lorebase_store/auth/usage.py,sha256=FR1IgUUqBQ2s_NDW9-2zvPqR590wqD-kh07RyQ5Bqes,2554
+lorebase_store/commit/__init__.py,sha256=1LeF-Div59pBygS9LhkxpoiKZj9XDitCWjL8xRBBSe0,1004
+lorebase_store/commit/changes.py,sha256=jHo6yRQ6QeEwJmBmxuyhyNeDQ5jdnjUq8JAa6n4-WEQ,1849
+lorebase_store/commit/errors.py,sha256=m3CQBzefn6t1leFQBq0o-LP7gcRJISyqGSsoNwvJ1RI,2147
+lorebase_store/commit/migrations.py,sha256=rSaT9mM06B8nA1O8h4Bn2Ql2uZuQ4wDAbatVKZ0dd38,13155
+lorebase_store/commit/pipeline.py,sha256=yosi-ldfePGvvgqBSlaciQ2JHdGKqWwz4LySGgMKkeY,27566
+lorebase_store/commit/schema.py,sha256=tZiowPmiCVOs2YFO2zTCzfQoyMsbr76woTvG9TLiPJ8,4649
+lorebase_store/extraction/__init__.py,sha256=8vexzkAxE9zLWGG83E1aJfEadG0N7PMyJZRiWIGLyvg,1477
+lorebase_store/extraction/items.py,sha256=ZeoaJAt6nnNjSuOprnyTNZq4YUyV2qc-hUeHo5XplLY,7453
+lorebase_store/extraction/materialize.py,sha256=uKVpbjvKe6i5gb0N3r8tfnH3GFcVrFcj4ZWt2pE7p0A,14776
+lorebase_store/extraction/proposal.py,sha256=c_mL5W_84BQnGIG1OKt9Hk7_0hvn5cUHcTqjotk-2F8,2557
+lorebase_store/extraction/review.py,sha256=MSfAzvQMZXWNojxfc4E9bJYi_B_BG4xjRN-E9kmJLwI,6826
+lorebase_store/materialize/__init__.py,sha256=0-fhxvxwVryEV4Yay0WHYBpRu0OXmwyO8QVxhs-lpPA,2688
+lorebase_store/materialize/apply.py,sha256=eqMsVD198ak-ad1BtfTwp2Rof842iZn3qdW6b7UzKAE,17796
+lorebase_store/materialize/background.py,sha256=WljOHRgODjBGhwATA4la1rUkVIEAITLxFZ70QvotGRQ,48732
+lorebase_store/materialize/branch.py,sha256=NupMtd_d_QeZqSy3bmD9WUrel5mX5NLDsyNlwZkia1A,11157
+lorebase_store/materialize/build.py,sha256=H4IdURNnN40Mirh9luj7Ii2xCFy62NK_HLF0Zjx4LPU,20269
+lorebase_store/materialize/derived.py,sha256=yDFRhGZy0NL0CyC80L5IB_096USF3hfZSosRoKRMibw,22812
+lorebase_store/materialize/lineage_backfill.py,sha256=xTcov8xa3vyH5iW4L0WruTuHfMuRt5y85eYynBDhv5Q,20272
+lorebase_store/materialize/links.py,sha256=uoAlsxfXosq-kjd0PVQaKfgJJD9lwgMfmAuCWVtR4nA,11114
+lorebase_store/materialize/overlay.py,sha256=__CRKrCOvdiY6mZe7vukGjZstd0WC-fjLaTxLJKncyA,12725
+lorebase_store/materialize/paths.py,sha256=eDWCwpreyzzDrvRTxUb8A9c6TUlGTae8CbWqjQU23Kw,14599
+lorebase_store/materialize/rebuild.py,sha256=XH0ye2SuNEmuuucIze1KuyLeuBjapwe7G6F_cGQMQqA,12726
+lorebase_store/materialize/rows.py,sha256=dWd9FMReeSTDl7NRaa4v1glnxvF0kp-O5iqegCP-TvY,6161
+lorebase_store/materialize/sensitivity.py,sha256=ei4O8MroGOQdyZj_CrgytbqbVrYVCUTn8obTA6KA7i8,3115
+lorebase_store/materialize/snapshot.py,sha256=mVPX53ouHA1L5UiS5u1r3_6c_WoEziIDOHNkfWXuhbU,8125
+lorebase_store/materialize/stale.py,sha256=cQLqX8koJ9RyTv8bT5J43nuvFxAlDHU2_NVzJ7_pcH0,17706
+lorebase_store/materialize/verify.py,sha256=bUH7ZAq2nBrN3jZ-CBP9QckufpHalTimzWacbwfdpOQ,12762
+lorebase_store/merging/__init__.py,sha256=zQztCkfgAIyC2Z0jdSrRfflTaduKS8dkKmynFOpVc7U,888
+lorebase_store/merging/attempts.py,sha256=-klgIFOOZ-6SdiwCLY3-se6JuEiFUdbUoh6ytqvNtKU,12691
+lorebase_store/merging/lineage.py,sha256=VBifjGEsVgJ3ebK7vUFhzPX2uQ_5DAmBfui72NPUcfM,5066
+lorebase_store/merging/service.py,sha256=GkN8c83MerojalTOeVGDILPpg-pXVXqTuOWxGSi0gtQ,26052
+lorebase_store/models/__init__.py,sha256=4Lyzk8Jx9WIevkhVmdW22Zu2lfoFoPn0u1qhJwIzZLI,2791
+lorebase_store/models/base.py,sha256=9wt0IZzBv-A211yGgb2EFcz0-dpA2sPms5MTfUpnmyc,2029
+lorebase_store/models/enums.py,sha256=p_YtbNNFK8MGVb4ZXczaZ2Fb6c2cBqgopqRT4_uPRAs,3305
+lorebase_store/models/governance.py,sha256=-w5o5g0dt4uDgw8P9rkzo3iGwgzGURRoCBORBpRaJAc,9112
+lorebase_store/models/ingestion.py,sha256=LcXMnwvafk1TBR8xh6oE-7dm1hy9uXbXxlcOWvqq3t4,11124
+lorebase_store/models/materialized.py,sha256=NZqf7nVRI0KbNyDkIQVmRVVx36pvTPfVffoWmWzE3hc,11047
+lorebase_store/models/proposals.py,sha256=VOI96cdjDPs8hJxMLBOkWg_U21enZWZj252MRzAFhBc,6650
+lorebase_store/models/queues.py,sha256=ZhI-CwepbLx9Lo2WfFJBAMUSvklT1L2yoo-M_CdtWgg,3357
+lorebase_store/models/tracing.py,sha256=TPVwedRNAEtMj1nMFBj7a2IhL8n81Vv2W9PEWsI8tVQ,4361
+lorebase_store/models/versioning.py,sha256=GFfWe9PbIXqc9QY1RK9ryRzbALYh48HpTyZezpNq4Dg,7106
+lorebase_store/models/webhooks.py,sha256=r-9yjuOrRhvCDMWBh32Y-vrZuQhgeBcUxPoIthboMaU,3796
+lorebase_store/profiling/__init__.py,sha256=5wUCtS7Q4aDZC2N3sO1eovb3lkDXx-7EzPvDiEYOFeA,1626
+lorebase_store/profiling/delimited.py,sha256=vhKaD34icYjcG5g-B3Uqds5RKXhbCW5VQUK9-BViBcw,4211
+lorebase_store/profiling/postgres.py,sha256=1eg0Uu5GsMX7x4eq-1zYpOWS2tKj7XMEpue_EnnKV-8,7890
+lorebase_store/profiling/record_files.py,sha256=m8OKbLK2c6oYlY7ZCZApWusTg6RdFd3kpNsJ4uZousU,5226
+lorebase_store/profiling/records.py,sha256=lMAFGLRrr53eoDXE6i7xXgUKHBRq9vwMzBXpvBjXqDw,3610
+lorebase_store/profiling/sql_databases.py,sha256=6HDWYpkJWJvXrPZYfqKlan8wbzjU1n5h3uoMqSQOApw,11672
+lorebase_store/repositories/__init__.py,sha256=Vrt3CUbbQCdCEc05whbjutCaw4Ib4SCRX0QyZFY-p1s,3978
+lorebase_store/repositories/changesets.py,sha256=a4VhoueHECVQx3c51WME9JwAyHvgW4MAT4021U_1DNg,2166
+lorebase_store/repositories/deferred_events.py,sha256=KIdknMeqZdwmmY4xPVq1_oTHgcbtc21A_J8G9IDYu_4,5442
+lorebase_store/repositories/documents.py,sha256=mBooqei0W94QtJ6W_auS2BzgIxf5fuaD1nfi92P0OeY,10976
+lorebase_store/repositories/domains.py,sha256=T8Gaui8JFQZ4AirpUa1LjtFgMM2Iivhk01Gk-rS3opk,3278
+lorebase_store/repositories/events.py,sha256=_qj56nK3DiME8uyUR6_IcVtvqRytrWXDEezyW3DXWzE,7990
+lorebase_store/repositories/index_view.py,sha256=BBuZXf9LQeWpkKo1QI8-EJErPlVPVgO592WjjjAY0H8,21277
+lorebase_store/repositories/invocations.py,sha256=gWQNhowWn97piO6mdKfE1PrKd49-HqYBdUyZ8crf26Y,2247
+lorebase_store/repositories/materializations.py,sha256=ZhNWvtDjkCzoaHqn9vJUKchQmU4llqSJ0f6z_QaI9hM,10304
+lorebase_store/repositories/materialized.py,sha256=F2YA2H42uBtI6nZIfrLQKHch5RNqzmxE67-W848q5W8,44173
+lorebase_store/repositories/merges.py,sha256=ktGg6uiDElEkATTRENEo6ZWPNvjV4NYDrmLXC80x8w8,15804
+lorebase_store/repositories/proposal_items.py,sha256=XTe7lKHKmX8zB0Q0x6GMTeyyb2-dSNUVsSEJlVR4l2w,6921
+lorebase_store/repositories/proposals.py,sha256=aF5vnzjLGxGZH_l61Wm4_Wjycqd90lGn5r6f99YidNo,6492
+lorebase_store/repositories/provenance.py,sha256=nBK-8AC6phLpzvHA3tc62fWX8bKS0MrefjPt9FqABrQ,2655
+lorebase_store/repositories/refs.py,sha256=pTV9S1xrblRPpS1Yn4uisZfscpInY1gsqGNDJn60ORM,16590
+lorebase_store/repositories/revisions.py,sha256=gjPx5V9mz-KnNSUuenuB7d90SRPf1pzVBV4Bl-RN5do,9607
+lorebase_store/repositories/scope.py,sha256=Sykom1CVJI8H5-Wq9omzchXdhMML98hA3_XeAV4Amrg,1063
+lorebase_store/repositories/source_runs.py,sha256=cMRJuEN6uxdx_iuC1ko3ExmpDRJOuiN1jnVclVGkOmY,4277
+lorebase_store/repositories/suggestions.py,sha256=c7whqpZq0Iawxjnb4bf1bRXoDy3bSYk0vjZoBUvhOfs,25325
+lorebase_store/vault/__init__.py,sha256=sau_lwwm-sGjgFFsH1p3WAmJdLMP5TYJH3fLqKKY3A8,1169
+lorebase_store/vault/keys.py,sha256=L22sv6TScdx7yz_Y9ciTDQBwJOVrNLlf8j0BEUB4xFw,8699
+lorebase_store/vault/quotes.py,sha256=VUaVxvQsn1PBnSjimXKVnHOwvM4josJaIN4z2C_uoOM,5385
+lorebase_store/vault/rotation.py,sha256=-0dQS32xzXGJMNZuCrfjhIsxOrARAo_kUS_9wdAB7TA,7705
+lorebase_store/vault/settings.py,sha256=NacLjXVAbW0UqtpK_R-qlmrLhu9ciT2Nesuf9mwVo9I,6452
+lorebase_store/vault/store.py,sha256=uc8_Zm8xfOorwstc7wfXBWElC_Gml-K0VWBqWeVb5Cs,37459
+lorebase_store/vault/transfer.py,sha256=RqW6pUYCJ9QbSX_A0hP47bKca84hOxyQ6CD4gh-zAQ0,21820
+lorebase_store/webhooks/__init__.py,sha256=gZtmp6q9AWHxHLpuS07qAOk8OjDmELHUO7DzeFG7ISw,780
+lorebase_store/webhooks/delivery.py,sha256=JwPwnbbjN7xQgR94DcWbwBoGPqaa1bFgJU1Cn-Ylu2I,26017
+lorebase_store/webhooks/keys.py,sha256=i4tmjSPvR1ZGcASxUPUKyU6Tvbmt6Nht3RbFQ2xsvlY,4819
+lorebase_store/webhooks/repository.py,sha256=-SfzHk0Kv5eWJ4_ShaoWs2E_7pceIMYAniNLLh2Rm4Y,4894
+lorebase_store/webhooks/settings.py,sha256=c0UQ-XTmARFj8FeSN6fyi5Efa_qd4o5H_8aOD1TC32U,6148
+lorebase_store/webhooks/signing.py,sha256=6S2FNtF0-jhG0B9QV9aLdyyAI5aHrsZhdT7_UdMf8Ro,1913
+lorebase_store/_migrations/env.py,sha256=PlYCxYsyZns9DD2Jgls6o6ptZNiQSoU94qdXhZSrcvM,3534
+lorebase_store/_migrations/script.py.mako,sha256=rIDRZIc2ykfzBOs7iolUSB4ja9y2Wc3FFx5lxy7g09M,632
+lorebase_store/_migrations/versions/0001_initial_schema.py,sha256=-2IuDifNsvztNRyrqe4wgh83AI00vB3Sdqh8kuV_fYo,43852
+lorebase_store/_migrations/versions/0002_merge_attempt_details.py,sha256=8QsNbw9T8F8Geixps0Xfn1GiZS3k7Gjn0UFuEr4Qe74,2699
+lorebase_store/_migrations/versions/0003_webhooks.py,sha256=Ga1OPS9P2B-FZe8nTNKIHdpmpaDRvT1TWzxhna1Hes8,4733
+lorebase_store/_migrations/versions/0004_defer_revision_references.py,sha256=QkX6DPZcSS5l7lOVWQZkteWAaPwEnvGEg8AActwB_Hw,1325
+lorebase_store/_migrations/versions/0005_security_definer_reads.py,sha256=ixcbJU9LnSqON6lnN2-H-z2WLVQukT86ep03VZBqPSE,18233
+lorebase_store/_migrations/versions/0006_api_key_usage.py,sha256=o7_zEpHREKyaLGXTYD4mjfMf2YI6a88R4k5dYQMlwBQ,1491
+lorebase_store/_migrations/versions/0007_document_extraction.py,sha256=VtUhBjxbH1mpSmvMs58Fvs1MpVnuYOdigRGRUgP9S7E,5860
+lorebase_store/_migrations/versions/0008_definer_argument_checks.py,sha256=SxX37etFtPpNoR7ZY-YmtFpL67I_ZLz94mqTpRYBqoc,7034
+lorebase_store/_migrations/versions/0009_api_key_networks.py,sha256=DKrKwHGVySsA5oNoFBjrj0u0L7r8RJpO69T1STF_tIQ,890
+lorebase_store/_migrations/versions/0010_overlay_branches.py,sha256=b32yqZwCLY7i22s9_SLg4vmMhaqCRPjWgbErPWaK82M,25016
+lorebase_store/_migrations/versions/0011_branch_scoped_search_index.py,sha256=p7D-YAFXl4XEaanb6PrVpy4v0cnWMO20wAAjINE-a1I,9019
+lorebase_store/_migrations/versions/0012_overlay_neighborhood_lookups.py,sha256=ddX9gX5rxRdT7i40UWJFbZNyryNxhVcwbTBSP1SDa00,8617
+lorebase_store/_migrations/versions/0013_web_sessions.py,sha256=2CoXk2sgL9ilmut-eBYBDHxFJzuJsBrAWns8oTN5IK8,2706
+lorebase_store/_migrations/versions/0014_embedding_jobs.py,sha256=Vc0ikNxfc2zI6O07ihXHIy2Dd3ZS3kM0aKelUz2_3No,2772
+lorebase_store/_migrations/versions/0015_append_only_audit_log.py,sha256=7IcdT6kBA5RuoReFJkgemykJduOSVz6r4ofKIYeAgWQ,3050
+lorebase_store/_migrations/versions/0016_sealed_webhook_keys.py,sha256=ShAET0lduSQscOTa3OAhy6c05V35zBAvtQsKv03uiXE,2167
+lorebase_store/_migrations/versions/0017_background_branch_copies.py,sha256=szv90WrkCM0mCmmNZmF7y4oFsW0m4Zs01_hjgmwPuqk,3369
+lorebase_store/_migrations/versions/0018_search_lexicon.py,sha256=3KJcKrDx0usRAsZ4WkiVDmhxcMgQpb0hDWIlD7NueqQ,20829
+lorebase_store/_migrations/versions/0019_vault_bindings.py,sha256=ciG8gO6i__RrVsBu32Pkc2Jy1C9smHrfOhL7Ejg67iw,2247
+lorebase_store/_migrations/versions/0020_outbox_consumers.py,sha256=xeC083IeaNsjZ0AA-NqBcZbKMudgk1cOCEDgU6cvLIQ,5709
+lorebase_store/_migrations/versions/0021_schema_suggestions.py,sha256=j3jJ2MtP8-vWNP-8Zvci_kQR7DEB7hScQjqW2sEI0Vw,4307
+lorebase_store/_migrations/versions/0022_read_audit_and_shared_rate_limits.py,sha256=pXmIjcvIMBe9AD_oYJg9RZYlqZkZIstZtaJYYYrCPG4,5197
+lorebase_store/_migrations/versions/0023_agent_trace.py,sha256=Z_BDxsAgX7R11fVIbTmsYxtK1fEHrqTBzFBO18GSUj0,3967
+lorebase_store/_migrations/versions/0024_embedding_template_keys.py,sha256=qWChmPIhGJIuOVdU9jHsWcQZFSAdIHJNz5tXlgUDHk8,7898
+lorebase_store/_migrations/versions/0025_snapshot_refs.py,sha256=oTYN3G_7pbERLFz72VcbykjMsOZwgML3HCwzakM47hc,1213
+lorebase_store/_migrations/versions/0026_plain_reverse_link_index.py,sha256=wITdejx4XpzGKYoH_uT4LpolnkisJbiJQFppXb455q4,3900
+lorebase_store/_migrations/versions/0027_vault_rotation_and_tombstones.py,sha256=jYxJK89VfrpEgVOLWmG7fCjHh8XSiKbPMvmqRXazZRk,5503
+lorebase_store/_migrations/versions/0028_operation_deferred_events.py,sha256=-zCvkPLmXOMLAZ5spj8Zt2n9MHVK0_0rqG23b9ELNvg,2556
+lorebase_store/_migrations/versions/0029_agent_trace_sessions.py,sha256=OrvTaERUoNl1dc5_HfgoWf6Mbl5teRNrCEVx7G10YdA,4689
+lorebase_store/_migrations/versions/0030_path_fanout.py,sha256=kir14QfKXTgCnlX2I1UlmKbbU20n5MeX1PwDfaiJMVA,931
+lorebase_store/_migrations/versions/0031_branch_builds.py,sha256=fjBre0w7ouJtiKeCoaB2o68MgXU4ksi9iyUQFEuAHNg,3291
+lorebase_store/_migrations/versions/0032_lineage_revisions.py,sha256=LTJDAUHSDbwbTo0T_6-mgYTNsmfR7jSOh0MGdKFalGs,1067
+lorebase_store/_migrations/versions/0033_vault_moved_tokens.py,sha256=yW_316lRs9qnwoZ-J7N9aZ78aVMsLnQ4fND7F_tCo0E,891
+lorebase_store/_migrations/versions/0034_inference_endpoint_modes.py,sha256=z-8fKTFCQyXy-TcGmIPNiKxswhxK-4LFbASv7ERNzQI,2574
+lorebase_store/_migrations/versions/0035_search_truncation.py,sha256=fCqOf7CCX1TYYYmalPj73Iddp_PHN06VWKsGnIhdwgM,4136
+lorebase_store/_migrations/versions/0036_lineage_maps.py,sha256=9fSyUbI8cVkMHXPhjsu8_qJBlFEaPCISgP1ttgDv5bA,13494
+lorebase_store/_migrations/versions/0037_bm25_search.py,sha256=__P7OlhcmK_nCztsXP-wt1ubkzEVkBx9mw6bDxlq8I0,17297
+lorebase_store-0.2.3.dist-info/METADATA,sha256=egOn_416Kpbk3mo-1vRR6IPcx4Xr2SrR0by_Z7sYs4c,445
+lorebase_store-0.2.3.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+lorebase_store-0.2.3.dist-info/RECORD,,

lorebase_store-0.2.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any