The scope is documented as a non-secret opaque fingerprint; digesting it is
what keeps that promise enforceable rather than assumed, and keeps the raw
value out of the persistent cache key (columnarBatchCacheKey) and out of
every telemetry span.
It lives in this module rather than in batch-cache.ts so the hot-path
columnar modules can bind span identity without importing the cache — the
rule has exactly one implementation and it is this one.
Parameters
scope: string
Returns Promise<`sha256:${string}`>
Throws
HonuaGeoArrowError missing-peer when the host exposes no Web Crypto
SHA-256. The digest is never approximated and the raw scope is never
substituted for it.
Opaque digest of an authorization scope.
The scope is documented as a non-secret opaque fingerprint; digesting it is what keeps that promise enforceable rather than assumed, and keeps the raw value out of the persistent cache key (
columnarBatchCacheKey) and out of every telemetry span.It lives in this module rather than in
batch-cache.tsso the hot-path columnar modules can bind span identity without importing the cache — the rule has exactly one implementation and it is this one.