Skip to content

fix(vector): Azure document keys cannot start with an underscore - #235

Merged
anilguleroglu merged 1 commit into
mainfrom
fix/azure-document-key-prefix
Aug 21, 2026
Merged

fix(vector): Azure document keys cannot start with an underscore#235
anilguleroglu merged 1 commit into
mainfrom
fix/azure-document-key-prefix

Conversation

@anilguleroglu

Copy link
Copy Markdown
Collaborator

Production is failing right now. Every Knowledge Engine upsert and delete against Azure AI Search is rejected:

Invalid document key: '_b64_YWtiYW5r…'. Keys cannot start with a leading underscore.

Cause

Azure's document-key rule has two halves: the charset (letters, digits, _, -, =) and "may not start with an underscore". The code carried the first half only, and the marker chosen for base64-encoded ids was _b64_ — so the marker itself was illegal and no id that needed encoding could ever be written. Knowledge Engine ids are module:documentId:chunkIndex, so every one of them needs encoding.

Fix

  • Marker starts with a letter: b64_.
  • SAFE_KEY_PATTERN rejects a leading underscore, so a caller id like _foo is encoded rather than passed through to the same rejection.
  • Decoding still accepts the old marker. Nothing was written under it — every such write failed — but tolerating it costs nothing.

Why the tests did not catch it

The contract suite did assert the produced key against a pattern. The pattern was the same incomplete rule, so it accepted _b64_ and stayed green while production rejected every batch. A mocked SDK can only check what the assertion knows, so the assertion now carries the whole rule, and a sweep asserts it across the id shapes a real deployment sends — including the one from the production error.

tsc clean · 3734 tests · npm run build clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KG71cnyfK5GGwbXb25pxsd

Every Knowledge Engine upsert and delete against Azure AI Search was failing in
production with

  Invalid document key: '_b64_YWtiYW5r…'. Keys cannot start with a leading
  underscore.

The marker for base64-encoded ids was `_b64_`. Azure's key rule is the charset
(letters, digits, underscore, dash, equals) AND "may not start with an
underscore"; the code carried the first half and not the second, so the marker
itself was illegal and no id needing encoding could ever be written.

The marker now starts with a letter (`b64_`), and SAFE_KEY_PATTERN rejects a
leading underscore so a caller id like `_foo` is encoded rather than passed
through to the same rejection. Decoding still accepts the old marker; nothing
was ever written under it, since every such write failed.

The contract suite did assert the produced key against a pattern — the pattern
was the same incomplete rule, so it accepted `_b64_` and stayed green while
production rejected every batch. The pattern now carries the whole rule, and a
sweep asserts it for the id shapes a real deployment sends.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@anilguleroglu
anilguleroglu merged commit db16db3 into main Aug 21, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant