@cerefox/memory 1.10.1 → 1.11.0

package/dist/bin/cerefox.js

@@ -7440,7 +7440,7 @@ var exports_meta = {};
 __export(exports_meta, {
   PKG_VERSION: () => PKG_VERSION
 });
-var PKG_VERSION = "1.10.1";
+var PKG_VERSION = "1.11.0";
 var init_meta = () => {};
 
 // ../../_shared/config/paths.ts
@@ -7468,12 +7468,12 @@ function resolveConfigDir(opts = {}) {
   }
   const here = opts.cwd ?? processCwd();
   const cwdEnv = join(here, ".env");
-  if (existsSync(cwdEnv) && cwdEnvHasCerefoxKey(cwdEnv)) {
+  if (existsSync(cwdEnv) && envFileHasCerefoxKey(cwdEnv)) {
     return resolvePath(here);
   }
   return userState;
 }
-function cwdEnvHasCerefoxKey(envPath) {
+function envFileHasCerefoxKey(envPath) {
   try {
     const contents = readFileSync(envPath, "utf8");
     return /^\s*CEREFOX_[A-Z0-9_]+\s*=/m.test(contents);
@@ -7494,7 +7494,7 @@ function isDevMode(opts = {}) {
     return false;
   const here = opts.cwd ?? processCwd();
   const cwdEnv = join(here, ".env");
-  return existsSync(cwdEnv) && cwdEnvHasCerefoxKey(cwdEnv);
+  return existsSync(cwdEnv) && envFileHasCerefoxKey(cwdEnv);
 }
 var USER_STATE_DIR_NAME = ".cerefox";
 var init_paths = () => {};
@@ -7565,6 +7565,7 @@ var init_env = __esm(() => {
 var exports_config = {};
 __export(exports_config, {
   USER_STATE_DIR_NAME: () => USER_STATE_DIR_NAME,
+  envFileHasCerefoxKey: () => envFileHasCerefoxKey,
   isDevMode: () => isDevMode,
   loadEnv: () => loadEnv,
   loadSettings: () => loadSettings,
@@ -26002,7 +26003,7 @@ var init_bundled_docs = __esm(() => {
 });
 
 // ../../_shared/ef-meta/index.ts
-var EF_VERSION = "1.10.1", CEREFOX_VERSION = "1.10.1", EF_LAST_CHANGED = "1.10.1";
+var EF_VERSION = "1.11.0", CEREFOX_VERSION = "1.11.0", EF_LAST_CHANGED = "1.11.0";
 var init_ef_meta = () => {};
 
 // ../../_shared/compatibility/index.ts
@@ -55096,9 +55097,13 @@ var init_audit_log = __esm(() => {
   };
 });
 
+// ../../_shared/mcp-tools/access-paths.ts
+var init_access_paths = () => {};
+
 // ../../_shared/mcp-tools/types.ts
 var McpInvalidParams;
 var init_types3 = __esm(() => {
+  init_access_paths();
   McpInvalidParams = class McpInvalidParams extends Error {
     constructor(message) {
       super(message);
@@ -77982,21 +77987,22 @@ function checkMcpConfigs() {
     detail: found.join(", ")
   };
 }
-function checkLegacyShadowEnv() {
-  const home = homedir6();
-  const homeEnv = join9(home, USER_STATE_DIR_NAME, ".env");
-  const cwdEnv = join9(process.cwd(), ".env");
-  if (!existsSync10(homeEnv) || !existsSync10(cwdEnv))
+function checkLegacyShadowEnv(opts = {}) {
+  const activeEnv = resolveEnvFile(opts);
+  const cwdEnv = join9(opts.cwd ?? process.cwd(), ".env");
+  if (!existsSync10(activeEnv) || !existsSync10(cwdEnv))
     return null;
   try {
-    if (realpathSync(homeEnv) === realpathSync(cwdEnv))
+    if (realpathSync(activeEnv) === realpathSync(cwdEnv))
       return null;
   } catch {}
+  if (!envFileHasCerefoxKey(cwdEnv))
+    return null;
   return {
     name: "legacy env",
     status: "skipped",
-    detail: `${cwdEnv} (shadowed by ~/.cerefox/.env)`,
-    hint: "Shadowed by ~/.cerefox/.env and no longer read by anything (Python was removed at v1.0.0). Safe to delete."
+    detail: `${cwdEnv} (shadowed by ${activeEnv})`,
+    hint: `Shadowed by ${activeEnv} and no longer read by anything (Python was removed at v1.0.0). Safe to delete.`
   };
 }
 async function checkPostgres() {
@@ -84457,7 +84463,7 @@ var CONFIG_CATALOG = [
   },
   {
     key: "require_requestor_identity",
-    description: "Require a requestor/author on MCP tool calls.",
+    description: "Require a requestor/author. Enforced on the Edge Functions (incl. remote MCP) ONLY — not local MCP, /api/v1 or the CLI.",
     kind: "boolean",
     defaultValue: "false",
     group: "Governance",
@@ -84569,6 +84575,78 @@ function validateConfigValue(key, value) {
 
 // src/web/routes/config.ts
 init_config();
+
+// src/web/identity.ts
+var DEFAULT_WEB_AUTHOR = "web-ui";
+var DEFAULT_WEB_AUTHOR_TYPE = "user";
+var WEB_UI_IDENTITY = {
+  author: DEFAULT_WEB_AUTHOR,
+  authorType: DEFAULT_WEB_AUTHOR_TYPE,
+  requestor: DEFAULT_WEB_AUTHOR,
+  accessPath: "webapp",
+  named: false
+};
+var HEADER = {
+  author: "x-cerefox-author",
+  authorType: "x-cerefox-author-type",
+  requestor: "x-cerefox-requestor"
+};
+function readField(c2, headerName, body, bodyKey) {
+  const header = c2.req.header(headerName);
+  if (header !== undefined) {
+    if (header.trim() === "") {
+      return { ok: false, detail: `${headerName} must not be blank.` };
+    }
+    return { ok: true, value: header.trim() };
+  }
+  if (body && bodyKey in body) {
+    const raw2 = body[bodyKey];
+    if (raw2 === null || raw2 === undefined)
+      return { ok: true, value: undefined };
+    if (typeof raw2 !== "string") {
+      return { ok: false, detail: `${bodyKey} must be a string.` };
+    }
+    if (raw2.trim() === "") {
+      return { ok: false, detail: `${bodyKey} must not be blank.` };
+    }
+    return { ok: true, value: raw2.trim() };
+  }
+  return { ok: true, value: undefined };
+}
+function resolveCallerIdentity(c2, body) {
+  const author = readField(c2, HEADER.author, body, "author");
+  if (!author.ok)
+    return author;
+  const requestor = readField(c2, HEADER.requestor, body, "requestor");
+  if (!requestor.ok)
+    return requestor;
+  const authorType = readField(c2, HEADER.authorType, body, "author_type");
+  if (!authorType.ok)
+    return authorType;
+  if (authorType.value !== undefined && authorType.value !== "user" && authorType.value !== "agent") {
+    return {
+      ok: false,
+      detail: `author_type must be "user" or "agent" (got ${JSON.stringify(authorType.value)}).`
+    };
+  }
+  const named = author.value !== undefined || requestor.value !== undefined || authorType.value !== undefined;
+  if (!named)
+    return { ok: true, identity: WEB_UI_IDENTITY };
+  const resolvedAuthor = author.value ?? requestor.value ?? DEFAULT_WEB_AUTHOR;
+  const resolvedRequestor = requestor.value ?? author.value ?? DEFAULT_WEB_AUTHOR;
+  return {
+    ok: true,
+    identity: {
+      author: resolvedAuthor,
+      authorType: authorType.value ?? DEFAULT_WEB_AUTHOR_TYPE,
+      requestor: resolvedRequestor,
+      accessPath: "api",
+      named: true
+    }
+  };
+}
+
+// src/web/routes/config.ts
 init__utils();
 function unwrapScalarRpc(data) {
   if (typeof data === "string")
@@ -84640,11 +84718,14 @@ function registerConfigRoutes(app, ctx) {
     const invalid = validateConfigValue(key, value);
     if (invalid)
       return c2.json({ detail: invalid }, 400);
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { error: error3 } = await ctx.supabase.rpc("cerefox_set_config", {
       p_key: key,
       p_value: value,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const remediation = storeWriteRemediation(error3.message ?? "", "cerefox_set_config");
@@ -84662,8 +84743,8 @@ init__utils();
 function logWebUsage(ctx, params) {
   Promise.resolve(ctx.supabase.rpc("cerefox_log_usage", {
     p_operation: params.operation,
-    p_access_path: "webapp",
-    p_requestor: params.requestor ?? "web-ui",
+    p_access_path: params.access_path ?? "webapp",
+    p_requestor: params.requestor ?? DEFAULT_WEB_AUTHOR,
     p_document_id: params.document_id ?? null,
     p_project_id: params.project_id ?? null,
     p_query_text: params.query_text ?? null,
@@ -84989,7 +85070,16 @@ function registerDiscoveryRoutes(app, ctx) {
         results = results.filter((r) => statusMap.get(r.document_id) === reviewStatus);
       }
     }
-    logWebUsage(ctx, { operation: "search", query_text: q, result_count: results.length });
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    logWebUsage(ctx, {
+      operation: "search",
+      query_text: q,
+      result_count: results.length,
+      requestor: who.identity.requestor,
+      access_path: who.identity.accessPath
+    });
     return c2.json({
       results,
       query: q,
@@ -85314,7 +85404,15 @@ function registerDocumentReadRoutes(app, ctx) {
     const meta = await getDocumentRow(ctx, documentId);
     const projectIds = await listDocumentProjectIds(ctx, documentId);
     const versions3 = await listDocumentVersions(ctx, documentId);
-    logWebUsage(ctx, { operation: "get-document", document_id: documentId });
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    logWebUsage(ctx, {
+      operation: "get-document",
+      document_id: documentId,
+      requestor: who.identity.requestor,
+      access_path: who.identity.accessPath
+    });
     return c2.json({
       document_id: documentId,
       full_content: doc2.full_content ?? "",
@@ -85451,6 +85549,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ success: false, error: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const title = String(body.title ?? "").trim();
     const content = String(body.content ?? "");
     const projectIds = Array.isArray(body.project_ids) ? body.project_ids : [];
@@ -85491,8 +85592,8 @@ function registerDocumentWriteRoutes(app, ctx) {
           source: "manual",
           projectIds: Array.isArray(body.project_ids) ? body.project_ids : undefined,
           metadata: body.metadata != null ? metadata : undefined,
-          author: "web-ui",
-          authorType: "user",
+          author: who.identity.author,
+          authorType: who.identity.authorType,
           expectedContentHash: typeof body.expected_content_hash === "string" ? body.expected_content_hash : null
         });
         return c2.json({ success: true, reindexed: result.reindexed });
@@ -85537,9 +85638,9 @@ function registerDocumentWriteRoutes(app, ctx) {
         title: body.title !== undefined && title !== doc2.title ? title : undefined,
         metadata: body.metadata != null ? metadata : undefined,
         projectIds: Array.isArray(body.project_ids) ? projectIds : undefined,
-        author: "web-ui",
-        authorType: "user",
-        accessPath: "webapp"
+        author: who.identity.author,
+        authorType: who.identity.authorType,
+        accessPath: who.identity.accessPath
       });
       return c2.json({ success: true, reindexed: false, ...facets });
     } catch (err) {
@@ -85556,10 +85657,20 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.delete("/api/v1/documents/:document_id", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
+    const expectedHash = (c2.req.header("x-cerefox-expected-content-hash") ?? c2.req.query("expected_content_hash") ?? "").trim();
+    if (who.identity.named && expectedHash === "") {
+      return c2.json({
+        detail: "CEREFOX_TOKEN_REQUIRED: an identified caller must send the content_hash it read, " + "as the X-Cerefox-Expected-Content-Hash header or an expected_content_hash query " + "parameter. A delete must follow a read."
+      }, 400);
+    }
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_delete_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType,
+      p_expected_content_hash: expectedHash === "" ? null : expectedHash
     });
     if (error3) {
       if (isDocumentNotFoundError(error3)) {
@@ -85572,10 +85683,13 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.post("/api/v1/documents/:document_id/restore", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_restore_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       if (isDocumentNotFoundError(error3)) {
@@ -85588,10 +85702,13 @@ function registerDocumentWriteRoutes(app, ctx) {
   });
   app.delete("/api/v1/documents/:document_id/purge", async (c2) => {
     const documentId = c2.req.param("document_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { error: error3 } = await ctx.supabase.rpc("cerefox_purge_document", {
       p_document_id: documentId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3)
       return c2.json({ detail: error3.message }, 500);
@@ -85605,6 +85722,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ detail: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const status = body.status;
     if (status !== "approved" && status !== "pending_review") {
       return c2.json({ detail: `Invalid status: ${JSON.stringify(status)}` }, 400);
@@ -85619,7 +85739,8 @@ function registerDocumentWriteRoutes(app, ctx) {
       return c2.json({ detail: error3.message }, 500);
     await createAuditEntry(ctx, {
       operation: "status-change",
-      author: "user",
+      author: who.identity.author,
+      authorType: who.identity.authorType,
       documentId,
       description: `Review status changed from '${oldStatus}' to '${status}'`
     });
@@ -85634,6 +85755,9 @@ function registerDocumentWriteRoutes(app, ctx) {
     } catch {
       return c2.json({ detail: "Invalid JSON body" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const archived = Boolean(body.archived);
     const { data, error: error3 } = await ctx.supabase.from("cerefox_document_versions").update({ archived }).eq("id", versionId).select("document_id, version_number").maybeSingle();
     if (error3)
@@ -85642,7 +85766,8 @@ function registerDocumentWriteRoutes(app, ctx) {
     const op = archived ? "archive" : "unarchive";
     await createAuditEntry(ctx, {
       operation: op,
-      author: "user",
+      author: who.identity.author,
+      authorType: who.identity.authorType,
       documentId: ver?.document_id ?? documentId,
       versionId,
       description: `Version ${ver?.version_number ?? "?"} ${op}d`
@@ -85671,6 +85796,9 @@ function registerIngestRoutes(app, ctx) {
       return c2.json(notReady("Title is required."), 200);
     if (!content.trim())
       return c2.json(notReady("Content cannot be empty."), 200);
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85684,8 +85812,8 @@ function registerIngestRoutes(app, ctx) {
         metadata: body.metadata ?? null,
         updateExisting: Boolean(body.update_existing),
         documentId: body.document_id ?? null,
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType
       });
       const skipped = result.action === "skipped";
       const resp = {
@@ -85697,7 +85825,12 @@ function registerIngestRoutes(app, ctx) {
       };
       if (result.note)
         resp.note = result.note;
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
+      });
       return c2.json(resp, 200);
     } catch (err) {
       return c2.json(notReady(err instanceof Error ? err.message : String(err)), 200);
@@ -85736,6 +85869,9 @@ function registerIngestRoutes(app, ctx) {
         metadata = null;
       }
     }
+    const who = resolveCallerIdentity(c2, form);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85749,11 +85885,16 @@ function registerIngestRoutes(app, ctx) {
         projectIds,
         metadata,
         updateExisting,
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType
       });
       const skipped = result.action === "skipped";
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
+      });
       return c2.json({
         success: !skipped,
         document_id: result.documentId,
@@ -85790,6 +85931,9 @@ function registerIngestRoutes(app, ctx) {
     if (!existing)
       return c2.json(notReady("Document not found"), 404);
     const title = existing.title || file.name || "Untitled";
+    const who = resolveCallerIdentity(c2, form);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     try {
       const pipeline2 = new IngestionPipeline({
         supabase: ctx.supabase,
@@ -85800,10 +85944,17 @@ function registerIngestRoutes(app, ctx) {
         text,
         title,
         source: "file",
-        author: "web-ui",
-        authorType: "user"
+        author: who.identity.author,
+        authorType: who.identity.authorType,
+        expectedContentHash: typeof form.expected_content_hash === "string" && form.expected_content_hash.trim() !== "" ? form.expected_content_hash.trim() : null,
+        lastWriteWins: String(form.last_write_wins ?? "") === "true"
+      });
+      logWebUsage(ctx, {
+        operation: "ingest",
+        document_id: result.documentId,
+        requestor: who.identity.requestor,
+        access_path: who.identity.accessPath
       });
-      logWebUsage(ctx, { operation: "ingest", document_id: result.documentId });
       return c2.json({
         success: true,
         document_id: result.documentId,
@@ -86154,11 +86305,14 @@ function registerProjectsRoutes(app, ctx) {
     if (!name)
       return c2.json({ detail: "Project name is required" }, 400);
     const description = String(body.description ?? "").trim();
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_create_project", {
       p_name: name,
       p_description: description,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const msg = error3.message ?? "";
@@ -86194,12 +86348,15 @@ function registerProjectsRoutes(app, ctx) {
     if (Object.keys(update).length === 0) {
       return c2.json({ detail: "Nothing to update — pass name and/or description" }, 400);
     }
+    const who = resolveCallerIdentity(c2, body);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_update_project", {
       p_project_id: projectId,
       p_name: update.name ?? null,
       p_description: update.description ?? null,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3) {
       const msg = error3.message ?? "";
@@ -86217,10 +86374,13 @@ function registerProjectsRoutes(app, ctx) {
   });
   app.delete("/api/v1/projects/:project_id", async (c2) => {
     const projectId = c2.req.param("project_id");
+    const who = resolveCallerIdentity(c2);
+    if (!who.ok)
+      return c2.json({ detail: who.detail }, 400);
     const { data, error: error3 } = await ctx.supabase.rpc("cerefox_delete_project", {
       p_project_id: projectId,
-      p_author: "web-ui",
-      p_author_type: "user"
+      p_author: who.identity.author,
+      p_author_type: who.identity.authorType
     });
     if (error3)
       return c2.json({ detail: error3.message }, 500);