@fusionvault/query

A typed predicate DSL that compiles to an OpenSearch query, and the label-policy filter that enforces mandatory access control on every read. Pure functions: no OpenSearch client here.

import { buildLabelFilter, buildSearchBody, toQuery, type Predicate } from "@fusionvault/query";

const predicate: Predicate = {
  op: "and",
  clauses: [
    { op: "eq", field: "status", value: "ACTIVE" },
    { op: "range", field: "speed", gt: 40 },
  ],
};

toQuery(predicate);
// → { bool: { must: [ { term: { status: "ACTIVE" } }, { range: { speed: { gt: 40 } } } ] } }

// The subject's grants become filter clauses no query can escape.
const labelFilter = buildLabelFilter(taxonomy, { classification: 2, caveats: ["FIN"] });
const body = buildSearchBody({ predicate, labelFilter, size: 50 });

evalPredicate(predicate, doc) evaluates the same predicate in memory, for previews and for subscriptions, and is checked against the contract's predicate vectors so it matches the Rust evaluator. subjectCanSee(taxonomy, grants, labels) answers the access question for one document.

Part of the FusionVault SDK. Apache-2.0.