@cerefox/memory 1.13.0 → 1.13.2

package/dist/server-assets/_shared/mcp-tools/partial-edits.ts

@@ -38,6 +38,7 @@ import {
 import { activeEmbedderName, embedBatch, resolveEmbedderKind } from "../embeddings/index.ts";
 import { extractConflictHashes, isMissingFunctionError, logUsage } from "./_utils.ts";
 import { McpInvalidParams, type MCPSupabaseClient, type ToolContext, type ToolDefinition } from "./types.ts";
+import { AUTHOR_PARAM_WRITE, DEFAULT_IDENTITY, callerIdentity } from "./identity.ts";
 
 /**
  * Who to record as the author. Derived from the access path rather than taken
@@ -440,7 +441,7 @@ async function insertHandler(
     documentId,
     operations,
     expectedHash,
-    requestor: (args.requestor as string | undefined) ?? defaultRequestor(ctx),
+    requestor: callerIdentity(args) ?? defaultRequestor(ctx),
     toolLabel: "insert",
     authorType: resolveAuthorType(ctx, args),
   });
@@ -493,10 +494,7 @@ export const insertTool: ToolDefinition = {
         description:
           "content_hash of the version you are basing this on. Required — no last-write-wins.",
       },
-      requestor: {
-        type: "string",
-        description: 'Agent or user making this request. Recorded in the usage log. Defaults to "mcp-agent".',
-      },
+      author: AUTHOR_PARAM_WRITE,
       author_type: {
         type: "string",
         enum: ["user", "agent"],
@@ -538,7 +536,7 @@ async function editHandler(
     documentId,
     operations,
     expectedHash,
-    requestor: (args.requestor as string | undefined) ?? defaultRequestor(ctx),
+    requestor: callerIdentity(args) ?? defaultRequestor(ctx),
     toolLabel: "edit",
     authorType: resolveAuthorType(ctx, args),
   });
@@ -618,10 +616,7 @@ export const editTool: ToolDefinition = {
         description:
           "content_hash of the version you are basing these edits on. Required — no last-write-wins.",
       },
-      requestor: {
-        type: "string",
-        description: 'Agent or user making this request. Recorded in the usage log. Defaults to "mcp-agent".',
-      },
+      author: AUTHOR_PARAM_WRITE,
       author_type: {
         type: "string",
         enum: ["user", "agent"],

package/dist/server-assets/_shared/mcp-tools/relations.ts

@@ -15,6 +15,7 @@
 import { logUsage } from "./_utils.ts";
 import { McpInvalidParams, type ToolContext, type ToolDefinition } from "./types.ts";
 import type { MCPSupabaseClient } from "./types.ts";
+import { AUTHOR_PARAM_READ, AUTHOR_PARAM_WRITE, DEFAULT_IDENTITY, callerIdentity } from "./identity.ts";
 
 /** Relation types that carry behaviour; any other string is accepted too. */
 const KNOWN_TYPES =
@@ -44,7 +45,7 @@ async function setHandler(
     p_source_id: source,
     p_target_id: target,
     p_rel_type: relType,
-    p_author: (args.author as string | undefined) ?? "mcp-agent",
+    p_author: callerIdentity(args) ?? DEFAULT_IDENTITY,
     p_author_type: "agent",
     p_metadata: (args.metadata as Record<string, unknown> | undefined) ?? {},
   });
@@ -57,7 +58,7 @@ async function setHandler(
   logUsage(supabase, {
     operation: "set_relation",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: callerIdentity(args),
     document_id: source,
   });
 
@@ -103,8 +104,7 @@ export const setRelationTool: ToolDefinition = {
         type: "object",
         description: "Optional JSON context for the edge (note, confidence, …)",
       },
-      author: { type: "string", description: "Who is creating this relation" },
-      requestor: { type: "string", description: "Name of the agent making this request" },
+      author: AUTHOR_PARAM_WRITE,
     },
   },
   handler: setHandler,
@@ -126,7 +126,7 @@ async function deleteHandler(
     p_source_id: source,
     p_target_id: target,
     p_rel_type: relType,
-    p_author: (args.author as string | undefined) ?? "mcp-agent",
+    p_author: callerIdentity(args) ?? DEFAULT_IDENTITY,
     p_author_type: "agent",
   });
   if (error) throw new Error(`RPC error: ${error.message}`);
@@ -135,7 +135,7 @@ async function deleteHandler(
   logUsage(supabase, {
     operation: "delete_relation",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: callerIdentity(args),
     document_id: source,
   });
 
@@ -166,8 +166,7 @@ export const deleteRelationTool: ToolDefinition = {
       source_id: { type: "string", description: "UUID of the source document" },
       target_id: { type: "string", description: "UUID of the target document" },
       rel_type: { type: "string", description: "Relation type to remove" },
-      author: { type: "string", description: "Who is removing this relation" },
-      requestor: { type: "string", description: "Name of the agent making this request" },
+      author: AUTHOR_PARAM_WRITE,
     },
   },
   handler: deleteHandler,
@@ -197,7 +196,7 @@ async function getRelationsHandler(
   logUsage(supabase, {
     operation: "get_relations",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: callerIdentity(args),
     document_id: docId,
     result_count: rows.length,
   });
@@ -231,7 +230,7 @@ export const getRelationsTool: ToolDefinition = {
     required: ["document_id"],
     properties: {
       document_id: { type: "string", description: "UUID of the document" },
-      requestor: { type: "string", description: "Name of the agent making this request" },
+      author: AUTHOR_PARAM_READ,
     },
   },
   handler: getRelationsHandler,
@@ -268,7 +267,7 @@ async function getNeighborsHandler(
   logUsage(supabase, {
     operation: "get_neighbors",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: callerIdentity(args),
     document_id: docId,
     result_count: rows.length,
   });
@@ -307,7 +306,7 @@ export const getNeighborsTool: ToolDefinition = {
       from_time: { type: "string", description: "ISO-8601: only neighbours created on/after" },
       to_time: { type: "string", description: "ISO-8601: only neighbours created on/before" },
       limit: { type: "integer", description: "Max documents to return (default 50, max 200)" },
-      requestor: { type: "string", description: "Name of the agent making this request" },
+      author: AUTHOR_PARAM_READ,
     },
   },
   handler: getNeighborsHandler,

package/dist/server-assets/_shared/mcp-tools/restore-document.ts

@@ -21,6 +21,7 @@ import type { MCPSupabaseClient } from "./types.ts";
 
 import { isDocumentNotFoundError, isMissingFunctionError, logUsage } from "./_utils.ts";
 import { McpInvalidParams, type ToolContext, type ToolDefinition } from "./types.ts";
+import { AUTHOR_PARAM_WRITE, DEFAULT_IDENTITY, callerIdentity } from "./identity.ts";
 
 async function handler(
   supabase: MCPSupabaseClient,
@@ -32,7 +33,7 @@ async function handler(
 
   if (!document_id) throw new McpInvalidParams("document_id is required");
 
-  const author = (args.author as string | undefined) ?? (args.requestor as string | undefined);
+  const author = callerIdentity(args);
   // Derived from the transport, never taken from the caller: an agent must not
   // be able to record itself as a user. Matches the delete handler.
   const authorType = ctx.accessPath === "cli" ? "user" : "agent";
@@ -81,7 +82,7 @@ async function handler(
   logUsage(supabase, {
     operation: "restore",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: author,
     document_id,
     result_count: 1,
   });
@@ -116,14 +117,7 @@ export const restoreDocumentTool: ToolDefinition = {
         description:
           "Why this document is being restored. Recorded in the audit-log entry. Short and specific beats long.",
       },
-      author: {
-        type: "string",
-        description: "Who is making this change. Recorded in the audit log.",
-      },
-      requestor: {
-        type: "string",
-        description: "Name of the agent or user making this request. Recorded in the usage log.",
-      },
+      author: AUTHOR_PARAM_WRITE,
     },
   },
   handler,

package/dist/server-assets/_shared/mcp-tools/search.ts

@@ -22,6 +22,7 @@ import { applyByteBudget, getConfiguredMinSearchScore, getConfiguredSearchAlpha,
   getMaxResponseBytes, getMinTermCoverage, logUsage } from "./_utils.ts";
 import { lookupProjectId } from "./_projects.ts";
 import { McpInvalidParams, type ToolContext, type ToolDefinition } from "./types.ts";
+import { AUTHOR_PARAM_READ, callerIdentity } from "./identity.ts";
 
 async function handler(
   supabase: MCPSupabaseClient,
@@ -135,7 +136,7 @@ async function handler(
   logUsage(supabase, {
     operation: "search",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: callerIdentity(args),
     query_text: query,
     project_id: projectId,
     result_count: accepted.length,
@@ -244,11 +245,7 @@ export const searchTool: ToolDefinition = {
         description:
           "Optional response size budget in bytes. Results are dropped whole until the budget is satisfied; a truncated flag is set when results are dropped. Defaults to the server maximum (200000). Pass a smaller value if your context window is limited. Values above the server maximum are silently capped.",
       },
-      requestor: {
-        type: "string",
-        description:
-          'Name of the agent or user making this request (e.g., "Claude Code", "archiver"). Recorded in the usage log for attribution. Defaults to "mcp-agent" if not provided. May be enforced via server config.',
-      },
+      author: AUTHOR_PARAM_READ,
     },
   },
   handler,

package/dist/server-assets/_shared/mcp-tools/set-document-metadata.ts

@@ -21,6 +21,7 @@ import type { MCPSupabaseClient } from "./types.ts";
 
 import { logUsage } from "./_utils.ts";
 import { McpInvalidParams, type ToolContext, type ToolDefinition } from "./types.ts";
+import { AUTHOR_PARAM_WRITE, DEFAULT_IDENTITY, callerIdentity } from "./identity.ts";
 
 async function handler(
   supabase: MCPSupabaseClient,
@@ -48,7 +49,7 @@ async function handler(
     );
   }
 
-  const author = (args.author as string | undefined) ?? (args.requestor as string | undefined);
+  const author = callerIdentity(args);
   // Derived from the transport, never taken from the caller: an agent must not
   // be able to record itself as a user. Matches the partial-edit handlers.
   const authorType = ctx.accessPath === "cli" ? "user" : "agent";
@@ -71,7 +72,7 @@ async function handler(
   logUsage(supabase, {
     operation: "update_metadata",
     accessPath: ctx.accessPath,
-    requestor: args.requestor as string | undefined,
+    requestor: author,
     document_id,
     result_count: 1,
   });
@@ -119,14 +120,7 @@ export const setDocumentMetadataTool: ToolDefinition = {
         description:
           "Set the metadata to EXACTLY this object, discarding any key not listed. Defaults to false (merge). Use only when you mean to reset a document's tags wholesale.",
       },
-      author: {
-        type: "string",
-        description: "Who is making this change. Recorded in the audit log.",
-      },
-      requestor: {
-        type: "string",
-        description: "Name of the agent or user making this request. Recorded in the usage log.",
-      },
+      author: AUTHOR_PARAM_WRITE,
     },
   },
   handler,

package/dist/server-assets/_shared/mcp-tools/set-document-projects.ts

@@ -13,6 +13,7 @@ import type { MCPSupabaseClient } from "./types.ts";
 
 import { replaceDocumentProjects } from "./_projects.ts";
 import { McpInvalidParams, type ToolContext, type ToolDefinition } from "./types.ts";
+import { AUTHOR_PARAM_WRITE, DEFAULT_IDENTITY, callerIdentity } from "./identity.ts";
 
 async function handler(
   supabase: MCPSupabaseClient,
@@ -21,7 +22,7 @@ async function handler(
 ): Promise<string> {
   const document_id = (args.document_id as string | undefined)?.trim();
   const project_names_raw = args.project_names;
-  const author = (args.author as string | undefined) ?? "mcp-agent";
+  const author = callerIdentity(args) ?? DEFAULT_IDENTITY;
 
   if (!document_id) {
     throw new McpInvalidParams(
@@ -96,11 +97,7 @@ export const setDocumentProjectsTool: ToolDefinition = {
         description:
           "Explicit list of project names. Each created if absent. Order is preserved. Empty list = remove from all projects.",
       },
-      author: {
-        type: "string",
-        description:
-          'Agent or tool name recorded in the audit log. Defaults to "mcp-agent". May be enforced via server config.',
-      },
+      author: AUTHOR_PARAM_WRITE,
     },
   },
   handler,

package/dist/server-assets/db/migrations/0031_review_workflow_toggle.sql

@@ -7,8 +7,10 @@
 -- write ever overrides a value an operator has set (ON CONFLICT DO NOTHING).
 --
 -- The decision "agent write → pending_review" moves out of the six client call
--- sites and into cerefox_ingest_document, which reads this flag. That RPC
--- lives in rpcs.sql, which `cerefox server deploy` re-applies.
+-- sites and into cerefox_ingest_document. That RPC lives in rpcs.sql, which
+-- `cerefox server deploy` re-applies. (0.16.0 also had the RPC read this flag
+-- on write and store 'approved' for everyone while off; 0.16.1 removed that —
+-- the flag governs visibility only, the stored value follows author_type.)
 --
 -- #240: cerefox_hybrid_search / cerefox_search_docs gain p_review_status so a
 -- filtered search is applied before the limit, not after. A new argument is a

package/dist/server-assets/db/rpcs.sql

@@ -1395,9 +1395,10 @@ $$;
 --                       update keeps the existing metadata (v0.11.1). Pass '{}'
 --                       explicitly to clear all metadata.
 --   p_review_status   : ACCEPTED AND IGNORED since 0.16.0 (#241). The status is
---                       decided here from p_author_type and the store's
---                       `review_workflow_enabled` flag, so every transport
---                       behaves the same and a toggle needs no client change.
+--                       decided here from p_author_type alone (agent →
+--                       pending_review, user → approved), so every transport
+--                       behaves the same. The `review_workflow_enabled` flag
+--                       only governs what surfaces show (0.16.1).
 --                       Kept in the signature so no caller breaks.
 --   p_chunks          : JSONB array of chunk objects, each with:
 --                        chunk_index, heading_path, heading_level, title,
@@ -1583,15 +1584,17 @@ BEGIN
             USING ERRCODE = '22023';  -- deterministic; never a retryable SQLSTATE
     END IF;
 
-    -- Review status is decided HERE, not by the caller (#241). With the
-    -- workflow on, an agent write is queued for a person to look at; with it
-    -- off, every write lands approved and no surface shows the column. The
-    -- fallback FALSE matches the fresh-install seed; migration 0031 seeds TRUE
-    -- on stores that predate the flag, so it only applies if the row is gone.
-    -- p_review_status is deliberately not consulted — six clients used to
-    -- compute it and they could not have agreed on a store-level policy.
+    -- Review status is decided HERE, not by the caller (#241), from the
+    -- author type alone: an agent write is 'pending_review', a person's is
+    -- 'approved'. The `review_workflow_enabled` flag is deliberately NOT
+    -- consulted (0.16.1): it governs what the surfaces show and enforce, not
+    -- what is stored, so a store that turns the workflow off and later back on
+    -- sees exactly the statuses it would have had all along. 0.16.0 wrote
+    -- 'approved' for every author while the flag was off; that made a stored
+    -- 'approved' mean two different things depending on when it was written.
+    -- p_review_status is not consulted either — six clients used to compute
+    -- it and they could not have agreed on a store-level policy.
     v_status := CASE
-                    WHEN NOT cerefox_config_bool('review_workflow_enabled', FALSE) THEN 'approved'
                     WHEN p_author_type = 'agent' THEN 'pending_review'
                     ELSE 'approved'
                 END;
@@ -3088,6 +3091,10 @@ SET search_path = public, pg_catalog
 AS $$
     -- Keep in lockstep with the `@version:` marker in schema.sql (cut_release.ts
     -- enforces it). Bump whenever schema.sql OR rpcs.sql changes.
+    -- 0.16.1 (v1.13.1): cerefox_ingest_document no longer consults
+    -- `review_workflow_enabled` — review_status follows author_type whatever
+    -- the flag says; the flag governs visibility/enforcement only. RPC-only,
+    -- no migration (server deploy re-applies rpcs.sql).
     -- 0.16.0 (#241, #240): `review_workflow_enabled` config key (seeded false
     -- on fresh installs, true by migration 0031 on existing ones);
     -- cerefox_ingest_document decides review_status itself from author_type
@@ -3117,7 +3124,7 @@ AS $$
     -- 0.11.0 supersedes 0.10.6 (v1.2.1, #191): this branch carries that fix plus
     -- the partial-edit surface, and both migrations (0019, 0020) are in the
     -- sequence, so a store deploying this gets everything from both lines.
-    SELECT '0.16.0'::TEXT;
+    SELECT '0.16.1'::TEXT;
 $$;
 
 -- ── cerefox_find_dead_links ──────────────────────────────────────────────────

package/dist/server-assets/db/schema.sql

@@ -5,7 +5,7 @@
 -- Requires extensions: vector (pgvector), uuid-ossp
 -- These are enabled at the top of db_deploy.py before this file is applied.
 --
--- @version: 0.16.0
+-- @version: 0.16.1
 -- The `@version` marker above is read by the schema-version-mismatch banner
 -- (see /api/v1/schema-version). Bump it whenever schema.sql OR rpcs.sql
 -- changes in a way that requires `cerefox server deploy` to be re-run —
@@ -56,9 +56,9 @@ CREATE TABLE IF NOT EXISTS cerefox_documents (
     -- review_status: human governance flag. 'approved' = validated by human,
     -- 'pending_review' = modified by agent, not yet reviewed.
     -- Content is searchable in both states. Written ONLY by
-    -- cerefox_ingest_document, which consults `review_workflow_enabled`
-    -- (#241): with the workflow off every write lands 'approved' and every
-    -- surface hides the column; existing values are left as they are.
+    -- cerefox_ingest_document, from author_type alone. The store-level
+    -- `review_workflow_enabled` flag (#241) governs whether any surface shows
+    -- or enforces the column; it never changes what is stored (0.16.1).
     review_status   TEXT        NOT NULL DEFAULT 'approved',
     -- lifecycle_status: where this document stands relative to the graph —
     -- 'active' | 'superseded' | 'stale' | 'archived'. Distinct from

package/dist/server-assets/supabase/functions/cerefox-get-audit-log/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 
 /**
  * cerefox-get-audit-log -- Supabase Edge Function
@@ -61,9 +62,9 @@ Deno.serve(async (req: Request): Promise<Response> => {
 
     const body = await req.json().catch(() => ({}));
 
-    // Configurable requestor enforcement
-    const identityField = "requestor";
-    const identityValue = body[identityField];
+    // Configurable caller-identity enforcement: `author`, or `requestor` as the pre-1.13.2 alias (#244)
+    const identityField = "author";
+    const identityValue = callerIdentity(body as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {
@@ -85,7 +86,8 @@ Deno.serve(async (req: Request): Promise<Response> => {
 
     const params: Record<string, unknown> = {};
     if (body.document_id) params.p_document_id = body.document_id;
-    if (body.author) params.p_author = body.author;
+    // v1.13.2: the entries filter is `by_author`; `author` is the caller's identity (#244).
+    if (body.by_author) params.p_author = body.by_author;
     if (body.operation) params.p_operation = body.operation;
     if (body.since) params.p_since = body.since;
     if (body.until) params.p_until = body.until;
@@ -107,7 +109,7 @@ Deno.serve(async (req: Request): Promise<Response> => {
     Promise.resolve(supabase.rpc("cerefox_log_usage", {
       p_operation: "get_audit_log",
       p_access_path: "edge-function",
-      p_requestor: body.requestor ?? null,
+      p_requestor: identityValue ?? null,
       p_result_count: (data ?? []).length,
     })).catch(() => {});
 

package/dist/server-assets/supabase/functions/cerefox-get-document/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 
 /**
  * cerefox-get-document — Supabase Edge Function
@@ -67,9 +68,9 @@ Deno.serve(async (req: Request): Promise<Response> => {
     const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
     const supabase = createClient(supabaseUrl, supabaseKey);
 
-    // Configurable requestor enforcement
-    const identityField = "requestor";
-    const identityValue = body[identityField];
+    // Configurable caller-identity enforcement: `author`, or `requestor` as the pre-1.13.2 alias (#244)
+    const identityField = "author";
+    const identityValue = callerIdentity(body as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {
@@ -120,7 +121,7 @@ Deno.serve(async (req: Request): Promise<Response> => {
     Promise.resolve(supabase.rpc("cerefox_log_usage", {
       p_operation: "get_document",
       p_access_path: "edge-function",
-      p_requestor: body.requestor ?? null,
+      p_requestor: identityValue ?? null,
       p_document_id: document_id,
       p_result_count: 1,
     })).catch(() => {});

package/dist/server-assets/supabase/functions/cerefox-ingest/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 import { capEmbeddingInput } from "../../../_shared/embeddings/index.ts";
 import {
   ensureDocumentInProject,
@@ -52,6 +53,8 @@ interface IngestRequest {
   metadata?: Record<string, unknown>;
   update_if_exists?: boolean;
   author?: string;
+  /** Alias of `author` (#244). */
+  requestor?: string;
   author_type?: string; // 'user' | 'agent'
   // Optimistic concurrency (iter-32): REQUIRED on content updates — the
   // content_hash of the version this edit was based on. Conflict → HTTP 409.
@@ -275,7 +278,8 @@ Deno.serve(async (req: Request) => {
   // metadata: null = "not provided" — the RPC keeps existing metadata on
   // update and uses {} on create (v0.11.1; a `= {}` default here used to wipe
   // a document's tags on every content update that didn't re-pass them).
-  const { title, content, document_id = null, project_name, source = "agent", metadata = null, update_if_exists = false, author = "agent", author_type = "agent", expected_content_hash = null, last_write_wins = false } = body;
+  const { title, content, document_id = null, project_name, source = "agent", metadata = null, update_if_exists = false, author_type = "agent", expected_content_hash = null, last_write_wins = false } = body;
+  const author = callerIdentity(body as unknown as Record<string, unknown>) ?? "agent";
 
   // metadata must be a plain JSON object (or absent). A scalar/array stored in
   // the JSONB column poisons cerefox_list_metadata_keys for the whole dataset
@@ -303,10 +307,10 @@ Deno.serve(async (req: Request) => {
   const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
   const supabase = createClient(supabaseUrl, supabaseKey);
 
-  // Configurable requestor enforcement
+  // Configurable caller-identity enforcement: `author`, or `requestor` as the alias (#244)
   {
     const identityField = "author";
-    const identityValue = body[identityField as keyof IngestRequest] as string | undefined;
+    const identityValue = callerIdentity(body as unknown as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {

package/dist/server-assets/supabase/functions/cerefox-list-projects/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 
 /**
  * cerefox-list-projects -- Supabase Edge Function
@@ -15,7 +16,7 @@ import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
  *
  * Note: cerefox-mcp calls the RPC directly (not this Edge Function).
  *
- * Request body (JSON): {} or { requestor?: string }
+ * Request body (JSON): {} or { author?: string }
  * Response (200): Array of { id, name, description }
  */
 
@@ -51,9 +52,9 @@ Deno.serve(async (req: Request): Promise<Response> => {
     const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
     const supabase = createClient(supabaseUrl, supabaseKey);
 
-    // Configurable requestor enforcement
-    const identityField = "requestor";
-    const identityValue = body[identityField];
+    // Configurable caller-identity enforcement: `author`, or `requestor` as the pre-1.13.2 alias (#244)
+    const identityField = "author";
+    const identityValue = callerIdentity(body as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {
@@ -86,7 +87,7 @@ Deno.serve(async (req: Request): Promise<Response> => {
     Promise.resolve(supabase.rpc("cerefox_log_usage", {
       p_operation: "list_projects",
       p_access_path: "edge-function",
-      p_requestor: body.requestor ?? null,
+      p_requestor: identityValue ?? null,
       p_result_count: (data ?? []).length,
     })).catch(() => {});
 

package/dist/server-assets/supabase/functions/cerefox-list-versions/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 
 /**
  * cerefox-list-versions — Supabase Edge Function
@@ -65,9 +66,9 @@ Deno.serve(async (req: Request): Promise<Response> => {
     const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
     const supabase = createClient(supabaseUrl, supabaseKey);
 
-    // Configurable requestor enforcement
-    const identityField = "requestor";
-    const identityValue = body[identityField];
+    // Configurable caller-identity enforcement: `author`, or `requestor` as the pre-1.13.2 alias (#244)
+    const identityField = "author";
+    const identityValue = callerIdentity(body as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {
@@ -102,7 +103,7 @@ Deno.serve(async (req: Request): Promise<Response> => {
     Promise.resolve(supabase.rpc("cerefox_log_usage", {
       p_operation: "list_versions",
       p_access_path: "edge-function",
-      p_requestor: body.requestor ?? null,
+      p_requestor: identityValue ?? null,
       p_document_id: document_id,
       p_result_count: (data ?? []).length,
     })).catch(() => {});

package/dist/server-assets/supabase/functions/cerefox-mcp/index.ts

@@ -105,12 +105,12 @@ async function handleToolsCall(
 
   // Configurable caller identity enforcement.
   // When require_requestor_identity is "true" in cerefox_config, all tool calls
-  // must include a requestor (reads) or author (writes) parameter.
-  // When requestor_identity_format is set, the value must match the regex.
-  const identityParam = toolName === "cerefox_ingest" || toolName === "cerefox_set_document_projects"
-    ? "author"
-    : "requestor";
-  const identityValue = args[identityParam] as string | undefined;
+  // must include the caller's identity; when requestor_identity_format is set,
+  // the value must match the regex. Since v1.13.1 every tool takes `author`
+  // and silently accepts `requestor` as the pre-1.13.1 alias (mirrors
+  // `callerIdentity()` in _shared/mcp-tools/identity.ts).
+  const identityParam = "author";
+  const identityValue = (args.author ?? args.requestor) as string | undefined;
 
   // deno-lint-ignore no-explicit-any
   const supabase: any = makeSupabaseClient();

package/dist/server-assets/supabase/functions/cerefox-metadata/index.ts

@@ -2,6 +2,7 @@ import "jsr:@supabase/functions-js/edge-runtime.d.ts";
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { isVersionRequest, versionResponse } from "../../../_shared/ef-meta/index.ts";
 import { efAuthGate } from "../../../_shared/ef-auth/index.ts";
+import { callerIdentity } from "../../../_shared/mcp-tools/identity.ts";
 
 /**
  * cerefox-metadata — Supabase Edge Function
@@ -54,9 +55,9 @@ Deno.serve(async (req: Request): Promise<Response> => {
     const supabaseKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
     const supabase = createClient(supabaseUrl, supabaseKey);
 
-    // Configurable requestor enforcement
-    const identityField = "requestor";
-    const identityValue = body[identityField];
+    // Configurable caller-identity enforcement: `author`, or `requestor` as the pre-1.13.2 alias (#244)
+    const identityField = "author";
+    const identityValue = callerIdentity(body as Record<string, unknown>);
     const { data: reqConfig } = await supabase.rpc("cerefox_get_config", { p_key: "require_requestor_identity" });
     if (reqConfig === "true") {
       if (!identityValue || (typeof identityValue === "string" && identityValue.trim() === "")) {
@@ -89,7 +90,7 @@ Deno.serve(async (req: Request): Promise<Response> => {
     Promise.resolve(supabase.rpc("cerefox_log_usage", {
       p_operation: "list_metadata_keys",
       p_access_path: "edge-function",
-      p_requestor: body.requestor ?? null,
+      p_requestor: identityValue ?? null,
       p_result_count: (data ?? []).length,
     })).catch(() => {});