@x12i/credorix-docs 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -0
- package/bin/credorix-docs.js +2 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +56 -0
- package/dist/cli.js.map +1 -0
- package/dist/generated/bundle.d.ts +450 -0
- package/dist/generated/bundle.d.ts.map +1 -0
- package/dist/generated/bundle.js +738 -0
- package/dist/generated/bundle.js.map +1 -0
- package/dist/index.d.ts +8 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +15 -0
- package/dist/index.js.map +1 -0
- package/package.json +55 -0
|
@@ -0,0 +1,738 @@
|
|
|
1
|
+
/* Auto-generated by credorix-docs/scripts/build-knowledge.mjs — do not edit */
|
|
2
|
+
export const catalog = {
|
|
3
|
+
"roles": [
|
|
4
|
+
{
|
|
5
|
+
"id": "developers",
|
|
6
|
+
"label": "Developers",
|
|
7
|
+
"tagline": "Wire Credorix",
|
|
8
|
+
"description": "Engineers who call leases and the broker, register profiles, and integrate workers or BFFs with Credorix."
|
|
9
|
+
},
|
|
10
|
+
{
|
|
11
|
+
"id": "builders",
|
|
12
|
+
"label": "Builders",
|
|
13
|
+
"tagline": "Operate and harden",
|
|
14
|
+
"description": "Operators and platform builders who deploy Credorix, set SERVICE_MODE gates, and own credential policy."
|
|
15
|
+
}
|
|
16
|
+
],
|
|
17
|
+
"families": [
|
|
18
|
+
{
|
|
19
|
+
"id": "credorix",
|
|
20
|
+
"name": "Credorix",
|
|
21
|
+
"tagline": "Isolated credential and authentication runtime for outbound calls.",
|
|
22
|
+
"description": "Caller auth, auth profiles, secret resolution, leases, and request brokering — without secrets in business envelopes.",
|
|
23
|
+
"color": "#0f2a44"
|
|
24
|
+
}
|
|
25
|
+
],
|
|
26
|
+
"books": [
|
|
27
|
+
{
|
|
28
|
+
"id": "00-platform-overview",
|
|
29
|
+
"familyId": "credorix",
|
|
30
|
+
"audiences": [
|
|
31
|
+
"developers",
|
|
32
|
+
"builders"
|
|
33
|
+
],
|
|
34
|
+
"status": "available",
|
|
35
|
+
"kicker": "CASE FILE · CRX-00",
|
|
36
|
+
"title": "Platform Overview",
|
|
37
|
+
"subtitle": "What Credorix owns",
|
|
38
|
+
"blurb": "What Credorix is, the two trust relationships, packages, and where to start.",
|
|
39
|
+
"tags": [
|
|
40
|
+
"platform",
|
|
41
|
+
"start-here",
|
|
42
|
+
"overview"
|
|
43
|
+
],
|
|
44
|
+
"color": "#0f2a44",
|
|
45
|
+
"dir": "00-platform-overview"
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"id": "01-architecture",
|
|
49
|
+
"familyId": "credorix",
|
|
50
|
+
"audiences": [
|
|
51
|
+
"developers"
|
|
52
|
+
],
|
|
53
|
+
"status": "available",
|
|
54
|
+
"kicker": "CASE FILE · CRX-01",
|
|
55
|
+
"title": "Architecture",
|
|
56
|
+
"subtitle": "Profiles, cache, delivery",
|
|
57
|
+
"blurb": "Service components, profile resolution, cache identity, lease vs broker, and extension seams.",
|
|
58
|
+
"tags": [
|
|
59
|
+
"architecture",
|
|
60
|
+
"runtime"
|
|
61
|
+
],
|
|
62
|
+
"color": "#16324f",
|
|
63
|
+
"dir": "01-architecture"
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
"id": "02-http-api",
|
|
67
|
+
"familyId": "credorix",
|
|
68
|
+
"audiences": [
|
|
69
|
+
"developers"
|
|
70
|
+
],
|
|
71
|
+
"status": "available",
|
|
72
|
+
"kicker": "CASE FILE · CRX-02",
|
|
73
|
+
"title": "HTTP API",
|
|
74
|
+
"subtitle": "Caller and admin surfaces",
|
|
75
|
+
"blurb": "Health, metadata, leases, broker, token-state ingest, and administration routes.",
|
|
76
|
+
"tags": [
|
|
77
|
+
"http",
|
|
78
|
+
"api",
|
|
79
|
+
"leases",
|
|
80
|
+
"broker"
|
|
81
|
+
],
|
|
82
|
+
"color": "#1b3a57",
|
|
83
|
+
"dir": "02-http-api"
|
|
84
|
+
},
|
|
85
|
+
{
|
|
86
|
+
"id": "03-providers-and-secrets",
|
|
87
|
+
"familyId": "credorix",
|
|
88
|
+
"audiences": [
|
|
89
|
+
"developers"
|
|
90
|
+
],
|
|
91
|
+
"status": "available",
|
|
92
|
+
"kicker": "CASE FILE · CRX-03",
|
|
93
|
+
"title": "Providers and Secrets",
|
|
94
|
+
"subtitle": "Schemes and credential sources",
|
|
95
|
+
"blurb": "Built-in auth providers, credential URI schemes, and pluggable CredentialSource.",
|
|
96
|
+
"tags": [
|
|
97
|
+
"providers",
|
|
98
|
+
"secrets",
|
|
99
|
+
"oauth"
|
|
100
|
+
],
|
|
101
|
+
"color": "#214666",
|
|
102
|
+
"dir": "03-providers-and-secrets"
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
"id": "04-security",
|
|
106
|
+
"familyId": "credorix",
|
|
107
|
+
"audiences": [
|
|
108
|
+
"developers",
|
|
109
|
+
"builders"
|
|
110
|
+
],
|
|
111
|
+
"status": "available",
|
|
112
|
+
"kicker": "CASE FILE · CRX-04",
|
|
113
|
+
"title": "Security Model",
|
|
114
|
+
"subtitle": "Invariants and controls",
|
|
115
|
+
"blurb": "Security invariants, encrypted persistence, broker SSRF controls, audit, and rotation.",
|
|
116
|
+
"tags": [
|
|
117
|
+
"security",
|
|
118
|
+
"ssrf",
|
|
119
|
+
"encryption"
|
|
120
|
+
],
|
|
121
|
+
"color": "#2a5478",
|
|
122
|
+
"dir": "04-security"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "05-production",
|
|
126
|
+
"familyId": "credorix",
|
|
127
|
+
"audiences": [
|
|
128
|
+
"developers",
|
|
129
|
+
"builders"
|
|
130
|
+
],
|
|
131
|
+
"status": "available",
|
|
132
|
+
"kicker": "CASE FILE · CRX-05",
|
|
133
|
+
"title": "Production Hardening",
|
|
134
|
+
"subtitle": "Deployment boundary",
|
|
135
|
+
"blurb": "Supported deployment shape, SERVICE_MODE gates, and what stays deployment-owned.",
|
|
136
|
+
"tags": [
|
|
137
|
+
"production",
|
|
138
|
+
"ops",
|
|
139
|
+
"hardening"
|
|
140
|
+
],
|
|
141
|
+
"color": "#336089",
|
|
142
|
+
"dir": "05-production"
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"id": "06-memorix-integration",
|
|
146
|
+
"familyId": "credorix",
|
|
147
|
+
"audiences": [
|
|
148
|
+
"developers"
|
|
149
|
+
],
|
|
150
|
+
"status": "available",
|
|
151
|
+
"kicker": "CASE FILE · CRX-06",
|
|
152
|
+
"title": "Memorix Integration",
|
|
153
|
+
"subtitle": "MPS 1.4.0 contract",
|
|
154
|
+
"blurb": "How Memorix / pipeline-services consumes Credorix via credential-ref and token-ref — pinned to MPS 1.4.0.",
|
|
155
|
+
"tags": [
|
|
156
|
+
"memorix",
|
|
157
|
+
"pipeline",
|
|
158
|
+
"mps"
|
|
159
|
+
],
|
|
160
|
+
"color": "#3c6c9a",
|
|
161
|
+
"dir": "06-memorix-integration"
|
|
162
|
+
}
|
|
163
|
+
]
|
|
164
|
+
};
|
|
165
|
+
export const useCases = {
|
|
166
|
+
"useCases": [
|
|
167
|
+
{
|
|
168
|
+
"id": "orient-credorix",
|
|
169
|
+
"title": "Orient on Credorix",
|
|
170
|
+
"goal": "Understand what Credorix owns, the two trust relationships, and which package to install.",
|
|
171
|
+
"audiences": [
|
|
172
|
+
"developers",
|
|
173
|
+
"builders"
|
|
174
|
+
],
|
|
175
|
+
"tags": [
|
|
176
|
+
"platform",
|
|
177
|
+
"start-here"
|
|
178
|
+
],
|
|
179
|
+
"path": [
|
|
180
|
+
{
|
|
181
|
+
"bookId": "00-platform-overview",
|
|
182
|
+
"audience": "developers",
|
|
183
|
+
"chapters": [
|
|
184
|
+
"the-central-idea",
|
|
185
|
+
"1-what-credorix-is",
|
|
186
|
+
"2-packages",
|
|
187
|
+
"3-where-to-go-next"
|
|
188
|
+
]
|
|
189
|
+
}
|
|
190
|
+
],
|
|
191
|
+
"alsoSee": [
|
|
192
|
+
"01-architecture",
|
|
193
|
+
"02-http-api"
|
|
194
|
+
],
|
|
195
|
+
"prerequisites": [],
|
|
196
|
+
"successCriteria": [],
|
|
197
|
+
"nextUseCases": [],
|
|
198
|
+
"scenarioIds": [],
|
|
199
|
+
"guideIds": [],
|
|
200
|
+
"troubleshooting": []
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "call-lease-and-broker",
|
|
204
|
+
"title": "Call leases and the broker",
|
|
205
|
+
"goal": "Authenticate as a caller, obtain a short-lived lease, or broker an outbound request through Credorix.",
|
|
206
|
+
"audiences": [
|
|
207
|
+
"developers"
|
|
208
|
+
],
|
|
209
|
+
"tags": [
|
|
210
|
+
"http",
|
|
211
|
+
"leases",
|
|
212
|
+
"broker",
|
|
213
|
+
"sdk"
|
|
214
|
+
],
|
|
215
|
+
"path": [
|
|
216
|
+
{
|
|
217
|
+
"bookId": "02-http-api",
|
|
218
|
+
"audience": "developers",
|
|
219
|
+
"chapters": [
|
|
220
|
+
"caller-authentication",
|
|
221
|
+
"leases",
|
|
222
|
+
"broker-fetch"
|
|
223
|
+
]
|
|
224
|
+
},
|
|
225
|
+
{
|
|
226
|
+
"bookId": "01-architecture",
|
|
227
|
+
"audience": "developers",
|
|
228
|
+
"chapters": [
|
|
229
|
+
"delivery-modes"
|
|
230
|
+
]
|
|
231
|
+
}
|
|
232
|
+
],
|
|
233
|
+
"alsoSee": [
|
|
234
|
+
"00-platform-overview",
|
|
235
|
+
"04-security"
|
|
236
|
+
],
|
|
237
|
+
"prerequisites": [],
|
|
238
|
+
"successCriteria": [],
|
|
239
|
+
"nextUseCases": [],
|
|
240
|
+
"scenarioIds": [],
|
|
241
|
+
"guideIds": [],
|
|
242
|
+
"troubleshooting": []
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "choose-auth-provider",
|
|
246
|
+
"title": "Choose an auth provider",
|
|
247
|
+
"goal": "Pick the right built-in scheme and credential source for a destination API.",
|
|
248
|
+
"audiences": [
|
|
249
|
+
"developers"
|
|
250
|
+
],
|
|
251
|
+
"tags": [
|
|
252
|
+
"providers",
|
|
253
|
+
"oauth",
|
|
254
|
+
"secrets"
|
|
255
|
+
],
|
|
256
|
+
"path": [
|
|
257
|
+
{
|
|
258
|
+
"bookId": "03-providers-and-secrets",
|
|
259
|
+
"audience": "developers",
|
|
260
|
+
"chapters": [
|
|
261
|
+
"built-in-providers",
|
|
262
|
+
"credential-sources",
|
|
263
|
+
"choosing-a-scheme"
|
|
264
|
+
]
|
|
265
|
+
}
|
|
266
|
+
],
|
|
267
|
+
"alsoSee": [
|
|
268
|
+
"04-security",
|
|
269
|
+
"06-memorix-integration"
|
|
270
|
+
],
|
|
271
|
+
"prerequisites": [],
|
|
272
|
+
"successCriteria": [],
|
|
273
|
+
"nextUseCases": [],
|
|
274
|
+
"scenarioIds": [],
|
|
275
|
+
"guideIds": [],
|
|
276
|
+
"troubleshooting": []
|
|
277
|
+
},
|
|
278
|
+
{
|
|
279
|
+
"id": "harden-production",
|
|
280
|
+
"title": "Harden for production",
|
|
281
|
+
"goal": "Deploy Credorix inside its supported boundary with SERVICE_MODE gates and encrypted persistence.",
|
|
282
|
+
"audiences": [
|
|
283
|
+
"developers",
|
|
284
|
+
"builders"
|
|
285
|
+
],
|
|
286
|
+
"tags": [
|
|
287
|
+
"production",
|
|
288
|
+
"ops",
|
|
289
|
+
"hardening"
|
|
290
|
+
],
|
|
291
|
+
"path": [
|
|
292
|
+
{
|
|
293
|
+
"bookId": "05-production",
|
|
294
|
+
"audience": "developers",
|
|
295
|
+
"chapters": [
|
|
296
|
+
"supported-deployment-boundary",
|
|
297
|
+
"runtime-mode",
|
|
298
|
+
"implemented-in-this-repository"
|
|
299
|
+
]
|
|
300
|
+
},
|
|
301
|
+
{
|
|
302
|
+
"bookId": "04-security",
|
|
303
|
+
"audience": "developers",
|
|
304
|
+
"chapters": [
|
|
305
|
+
"invariants",
|
|
306
|
+
"secret-storage"
|
|
307
|
+
]
|
|
308
|
+
}
|
|
309
|
+
],
|
|
310
|
+
"alsoSee": [
|
|
311
|
+
"00-platform-overview"
|
|
312
|
+
],
|
|
313
|
+
"prerequisites": [],
|
|
314
|
+
"successCriteria": [],
|
|
315
|
+
"nextUseCases": [],
|
|
316
|
+
"scenarioIds": [],
|
|
317
|
+
"guideIds": [],
|
|
318
|
+
"troubleshooting": []
|
|
319
|
+
},
|
|
320
|
+
{
|
|
321
|
+
"id": "integrate-memorix-pipeline",
|
|
322
|
+
"title": "Integrate Memorix pipelines",
|
|
323
|
+
"goal": "Map MPS credential-ref / token-ref envelopes to Credorix profiles and broker helpers.",
|
|
324
|
+
"audiences": [
|
|
325
|
+
"developers"
|
|
326
|
+
],
|
|
327
|
+
"tags": [
|
|
328
|
+
"memorix",
|
|
329
|
+
"pipeline",
|
|
330
|
+
"mps"
|
|
331
|
+
],
|
|
332
|
+
"path": [
|
|
333
|
+
{
|
|
334
|
+
"bookId": "06-memorix-integration",
|
|
335
|
+
"audience": "developers",
|
|
336
|
+
"chapters": [
|
|
337
|
+
"pinned-contract",
|
|
338
|
+
"credential-profiles",
|
|
339
|
+
"worker-to-vendor",
|
|
340
|
+
"consent-custody"
|
|
341
|
+
]
|
|
342
|
+
}
|
|
343
|
+
],
|
|
344
|
+
"alsoSee": [
|
|
345
|
+
"02-http-api",
|
|
346
|
+
"01-architecture"
|
|
347
|
+
],
|
|
348
|
+
"prerequisites": [],
|
|
349
|
+
"successCriteria": [],
|
|
350
|
+
"nextUseCases": [],
|
|
351
|
+
"scenarioIds": [],
|
|
352
|
+
"guideIds": [],
|
|
353
|
+
"troubleshooting": []
|
|
354
|
+
},
|
|
355
|
+
{
|
|
356
|
+
"id": "operate-admin-api",
|
|
357
|
+
"title": "Operate the admin API",
|
|
358
|
+
"goal": "Register profiles and callers, rotate tokens, and use idempotent admin mutations.",
|
|
359
|
+
"audiences": [
|
|
360
|
+
"developers",
|
|
361
|
+
"builders"
|
|
362
|
+
],
|
|
363
|
+
"tags": [
|
|
364
|
+
"admin",
|
|
365
|
+
"http",
|
|
366
|
+
"ops"
|
|
367
|
+
],
|
|
368
|
+
"path": [
|
|
369
|
+
{
|
|
370
|
+
"bookId": "02-http-api",
|
|
371
|
+
"audience": "developers",
|
|
372
|
+
"chapters": [
|
|
373
|
+
"administration-api",
|
|
374
|
+
"profiles-and-callers"
|
|
375
|
+
]
|
|
376
|
+
},
|
|
377
|
+
{
|
|
378
|
+
"bookId": "04-security",
|
|
379
|
+
"audience": "developers",
|
|
380
|
+
"chapters": [
|
|
381
|
+
"caller-bootstrap",
|
|
382
|
+
"rotation"
|
|
383
|
+
]
|
|
384
|
+
}
|
|
385
|
+
],
|
|
386
|
+
"alsoSee": [
|
|
387
|
+
"05-production"
|
|
388
|
+
],
|
|
389
|
+
"prerequisites": [],
|
|
390
|
+
"successCriteria": [],
|
|
391
|
+
"nextUseCases": [],
|
|
392
|
+
"scenarioIds": [],
|
|
393
|
+
"guideIds": [],
|
|
394
|
+
"troubleshooting": []
|
|
395
|
+
}
|
|
396
|
+
]
|
|
397
|
+
};
|
|
398
|
+
export const site = {
|
|
399
|
+
"product": "credorix",
|
|
400
|
+
"brand": "x12i · Credorix",
|
|
401
|
+
"brandAccent": "credorix",
|
|
402
|
+
"siteUrl": "https://docs.credorix.x12i.com",
|
|
403
|
+
"knowledgePackage": "@x12i/credorix-docs",
|
|
404
|
+
"footer": "Credorix",
|
|
405
|
+
"accent": "oklch(45% 0.12 230)",
|
|
406
|
+
"accentAlt": "oklch(55% 0.14 40)",
|
|
407
|
+
"productUrl": "https://github.com/x12i/credorix",
|
|
408
|
+
"nav": [
|
|
409
|
+
{
|
|
410
|
+
"label": "Getting started",
|
|
411
|
+
"href": "/getting-started"
|
|
412
|
+
},
|
|
413
|
+
{
|
|
414
|
+
"label": "Use cases",
|
|
415
|
+
"href": "/use-cases"
|
|
416
|
+
},
|
|
417
|
+
{
|
|
418
|
+
"label": "Catalog",
|
|
419
|
+
"href": "/catalog"
|
|
420
|
+
}
|
|
421
|
+
],
|
|
422
|
+
"footerLinks": [
|
|
423
|
+
{
|
|
424
|
+
"label": "Docs home",
|
|
425
|
+
"href": "/docs"
|
|
426
|
+
},
|
|
427
|
+
{
|
|
428
|
+
"label": "Use cases",
|
|
429
|
+
"href": "/use-cases"
|
|
430
|
+
},
|
|
431
|
+
{
|
|
432
|
+
"label": "Agents/SDK",
|
|
433
|
+
"href": "/agents"
|
|
434
|
+
},
|
|
435
|
+
{
|
|
436
|
+
"label": "Repository",
|
|
437
|
+
"href": "https://github.com/x12i/credorix"
|
|
438
|
+
}
|
|
439
|
+
]
|
|
440
|
+
};
|
|
441
|
+
export const manifest = {
|
|
442
|
+
"version": 1,
|
|
443
|
+
"product": "credorix",
|
|
444
|
+
"site": "https://docs.credorix.x12i.com",
|
|
445
|
+
"knowledgePackage": "@x12i/credorix-docs",
|
|
446
|
+
"roles": [
|
|
447
|
+
"developers",
|
|
448
|
+
"builders"
|
|
449
|
+
],
|
|
450
|
+
"books": [
|
|
451
|
+
{
|
|
452
|
+
"id": "00-platform-overview",
|
|
453
|
+
"audiences": [
|
|
454
|
+
"developers",
|
|
455
|
+
"builders"
|
|
456
|
+
],
|
|
457
|
+
"md": {
|
|
458
|
+
"developers": "downloads/books/00-platform-overview/developers.md",
|
|
459
|
+
"builders": "downloads/books/00-platform-overview/builders.md"
|
|
460
|
+
},
|
|
461
|
+
"pdf": {
|
|
462
|
+
"developers": null,
|
|
463
|
+
"builders": null
|
|
464
|
+
},
|
|
465
|
+
"chapters": {
|
|
466
|
+
"developers": "downloads/books/00-platform-overview/developers.chapters.json",
|
|
467
|
+
"builders": "downloads/books/00-platform-overview/builders.chapters.json"
|
|
468
|
+
}
|
|
469
|
+
},
|
|
470
|
+
{
|
|
471
|
+
"id": "01-architecture",
|
|
472
|
+
"audiences": [
|
|
473
|
+
"developers"
|
|
474
|
+
],
|
|
475
|
+
"md": {
|
|
476
|
+
"developers": "downloads/books/01-architecture/developers.md"
|
|
477
|
+
},
|
|
478
|
+
"pdf": {
|
|
479
|
+
"developers": null
|
|
480
|
+
},
|
|
481
|
+
"chapters": {
|
|
482
|
+
"developers": "downloads/books/01-architecture/developers.chapters.json"
|
|
483
|
+
}
|
|
484
|
+
},
|
|
485
|
+
{
|
|
486
|
+
"id": "02-http-api",
|
|
487
|
+
"audiences": [
|
|
488
|
+
"developers"
|
|
489
|
+
],
|
|
490
|
+
"md": {
|
|
491
|
+
"developers": "downloads/books/02-http-api/developers.md"
|
|
492
|
+
},
|
|
493
|
+
"pdf": {
|
|
494
|
+
"developers": null
|
|
495
|
+
},
|
|
496
|
+
"chapters": {
|
|
497
|
+
"developers": "downloads/books/02-http-api/developers.chapters.json"
|
|
498
|
+
}
|
|
499
|
+
},
|
|
500
|
+
{
|
|
501
|
+
"id": "03-providers-and-secrets",
|
|
502
|
+
"audiences": [
|
|
503
|
+
"developers"
|
|
504
|
+
],
|
|
505
|
+
"md": {
|
|
506
|
+
"developers": "downloads/books/03-providers-and-secrets/developers.md"
|
|
507
|
+
},
|
|
508
|
+
"pdf": {
|
|
509
|
+
"developers": null
|
|
510
|
+
},
|
|
511
|
+
"chapters": {
|
|
512
|
+
"developers": "downloads/books/03-providers-and-secrets/developers.chapters.json"
|
|
513
|
+
}
|
|
514
|
+
},
|
|
515
|
+
{
|
|
516
|
+
"id": "04-security",
|
|
517
|
+
"audiences": [
|
|
518
|
+
"developers",
|
|
519
|
+
"builders"
|
|
520
|
+
],
|
|
521
|
+
"md": {
|
|
522
|
+
"developers": "downloads/books/04-security/developers.md",
|
|
523
|
+
"builders": "downloads/books/04-security/builders.md"
|
|
524
|
+
},
|
|
525
|
+
"pdf": {
|
|
526
|
+
"developers": null,
|
|
527
|
+
"builders": null
|
|
528
|
+
},
|
|
529
|
+
"chapters": {
|
|
530
|
+
"developers": "downloads/books/04-security/developers.chapters.json",
|
|
531
|
+
"builders": "downloads/books/04-security/builders.chapters.json"
|
|
532
|
+
}
|
|
533
|
+
},
|
|
534
|
+
{
|
|
535
|
+
"id": "05-production",
|
|
536
|
+
"audiences": [
|
|
537
|
+
"developers",
|
|
538
|
+
"builders"
|
|
539
|
+
],
|
|
540
|
+
"md": {
|
|
541
|
+
"developers": "downloads/books/05-production/developers.md",
|
|
542
|
+
"builders": "downloads/books/05-production/builders.md"
|
|
543
|
+
},
|
|
544
|
+
"pdf": {
|
|
545
|
+
"developers": null,
|
|
546
|
+
"builders": null
|
|
547
|
+
},
|
|
548
|
+
"chapters": {
|
|
549
|
+
"developers": "downloads/books/05-production/developers.chapters.json",
|
|
550
|
+
"builders": "downloads/books/05-production/builders.chapters.json"
|
|
551
|
+
}
|
|
552
|
+
},
|
|
553
|
+
{
|
|
554
|
+
"id": "06-memorix-integration",
|
|
555
|
+
"audiences": [
|
|
556
|
+
"developers"
|
|
557
|
+
],
|
|
558
|
+
"md": {
|
|
559
|
+
"developers": "downloads/books/06-memorix-integration/developers.md"
|
|
560
|
+
},
|
|
561
|
+
"pdf": {
|
|
562
|
+
"developers": null
|
|
563
|
+
},
|
|
564
|
+
"chapters": {
|
|
565
|
+
"developers": "downloads/books/06-memorix-integration/developers.chapters.json"
|
|
566
|
+
}
|
|
567
|
+
}
|
|
568
|
+
],
|
|
569
|
+
"useCases": [
|
|
570
|
+
{
|
|
571
|
+
"id": "orient-credorix",
|
|
572
|
+
"title": "Orient on Credorix",
|
|
573
|
+
"md": "downloads/use-cases/orient-credorix.md",
|
|
574
|
+
"path": [
|
|
575
|
+
{
|
|
576
|
+
"bookId": "00-platform-overview",
|
|
577
|
+
"audience": "developers",
|
|
578
|
+
"chapters": [
|
|
579
|
+
"the-central-idea",
|
|
580
|
+
"1-what-credorix-is",
|
|
581
|
+
"2-packages",
|
|
582
|
+
"3-where-to-go-next"
|
|
583
|
+
]
|
|
584
|
+
}
|
|
585
|
+
]
|
|
586
|
+
},
|
|
587
|
+
{
|
|
588
|
+
"id": "call-lease-and-broker",
|
|
589
|
+
"title": "Call leases and the broker",
|
|
590
|
+
"md": "downloads/use-cases/call-lease-and-broker.md",
|
|
591
|
+
"path": [
|
|
592
|
+
{
|
|
593
|
+
"bookId": "02-http-api",
|
|
594
|
+
"audience": "developers",
|
|
595
|
+
"chapters": [
|
|
596
|
+
"caller-authentication",
|
|
597
|
+
"leases",
|
|
598
|
+
"broker-fetch"
|
|
599
|
+
]
|
|
600
|
+
},
|
|
601
|
+
{
|
|
602
|
+
"bookId": "01-architecture",
|
|
603
|
+
"audience": "developers",
|
|
604
|
+
"chapters": [
|
|
605
|
+
"delivery-modes"
|
|
606
|
+
]
|
|
607
|
+
}
|
|
608
|
+
]
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "choose-auth-provider",
|
|
612
|
+
"title": "Choose an auth provider",
|
|
613
|
+
"md": "downloads/use-cases/choose-auth-provider.md",
|
|
614
|
+
"path": [
|
|
615
|
+
{
|
|
616
|
+
"bookId": "03-providers-and-secrets",
|
|
617
|
+
"audience": "developers",
|
|
618
|
+
"chapters": [
|
|
619
|
+
"built-in-providers",
|
|
620
|
+
"credential-sources",
|
|
621
|
+
"choosing-a-scheme"
|
|
622
|
+
]
|
|
623
|
+
}
|
|
624
|
+
]
|
|
625
|
+
},
|
|
626
|
+
{
|
|
627
|
+
"id": "harden-production",
|
|
628
|
+
"title": "Harden for production",
|
|
629
|
+
"md": "downloads/use-cases/harden-production.md",
|
|
630
|
+
"path": [
|
|
631
|
+
{
|
|
632
|
+
"bookId": "05-production",
|
|
633
|
+
"audience": "developers",
|
|
634
|
+
"chapters": [
|
|
635
|
+
"supported-deployment-boundary",
|
|
636
|
+
"runtime-mode",
|
|
637
|
+
"implemented-in-this-repository"
|
|
638
|
+
]
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"bookId": "04-security",
|
|
642
|
+
"audience": "developers",
|
|
643
|
+
"chapters": [
|
|
644
|
+
"invariants",
|
|
645
|
+
"secret-storage"
|
|
646
|
+
]
|
|
647
|
+
}
|
|
648
|
+
]
|
|
649
|
+
},
|
|
650
|
+
{
|
|
651
|
+
"id": "integrate-memorix-pipeline",
|
|
652
|
+
"title": "Integrate Memorix pipelines",
|
|
653
|
+
"md": "downloads/use-cases/integrate-memorix-pipeline.md",
|
|
654
|
+
"path": [
|
|
655
|
+
{
|
|
656
|
+
"bookId": "06-memorix-integration",
|
|
657
|
+
"audience": "developers",
|
|
658
|
+
"chapters": [
|
|
659
|
+
"pinned-contract",
|
|
660
|
+
"credential-profiles",
|
|
661
|
+
"worker-to-vendor",
|
|
662
|
+
"consent-custody"
|
|
663
|
+
]
|
|
664
|
+
}
|
|
665
|
+
]
|
|
666
|
+
},
|
|
667
|
+
{
|
|
668
|
+
"id": "operate-admin-api",
|
|
669
|
+
"title": "Operate the admin API",
|
|
670
|
+
"md": "downloads/use-cases/operate-admin-api.md",
|
|
671
|
+
"path": [
|
|
672
|
+
{
|
|
673
|
+
"bookId": "02-http-api",
|
|
674
|
+
"audience": "developers",
|
|
675
|
+
"chapters": [
|
|
676
|
+
"administration-api",
|
|
677
|
+
"profiles-and-callers"
|
|
678
|
+
]
|
|
679
|
+
},
|
|
680
|
+
{
|
|
681
|
+
"bookId": "04-security",
|
|
682
|
+
"audience": "developers",
|
|
683
|
+
"chapters": [
|
|
684
|
+
"caller-bootstrap",
|
|
685
|
+
"rotation"
|
|
686
|
+
]
|
|
687
|
+
}
|
|
688
|
+
]
|
|
689
|
+
}
|
|
690
|
+
],
|
|
691
|
+
"indexes": {
|
|
692
|
+
"indexMd": "INDEX.md",
|
|
693
|
+
"searchJson": "SEARCH.json"
|
|
694
|
+
},
|
|
695
|
+
"concepts": [],
|
|
696
|
+
"guides": [],
|
|
697
|
+
"scenarios": [],
|
|
698
|
+
"decisions": [],
|
|
699
|
+
"glossary": [],
|
|
700
|
+
"visuals": [],
|
|
701
|
+
"diagrams": [],
|
|
702
|
+
"relationships": [],
|
|
703
|
+
"tutorials": [],
|
|
704
|
+
"examples": [],
|
|
705
|
+
"sampleData": [],
|
|
706
|
+
"uiClients": [],
|
|
707
|
+
"apis": [],
|
|
708
|
+
"packs": []
|
|
709
|
+
};
|
|
710
|
+
export const files = {
|
|
711
|
+
"downloads/books/00-platform-overview/builders.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"the-central-idea\",\n \"title\": \"The central idea\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"1-what-credorix-is\",\n \"title\": \"1. What Credorix is\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"2-packages\",\n \"title\": \"2. Packages\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"3-where-to-go-next\",\n \"title\": \"3. Where to go next\",\n \"level\": 2,\n \"order\": 4\n }\n]",
|
|
712
|
+
"downloads/books/00-platform-overview/builders.md": "# Platform Overview — Builders\r\n\r\n**Audience:** Operators and platform builders deploying Credorix. \r\n**Related:** [Production Hardening](../../05-production/developers/BOOK.md) · [Security Model](../../04-security/developers/BOOK.md)\r\n\r\n---\r\n\r\n## The central idea\r\n\r\nCredorix owns credentials and outbound auth for internal callers. Deploy one active owner on a private network; keep secrets out of product envelopes and browsers.\r\n\r\n---\r\n\r\n## 1. What Credorix is\r\n\r\nCallers authenticate to Credorix, then request a lease or a brokered fetch against an `authRef`. Profiles hold **references** to secrets — not raw material.\r\n\r\n---\r\n\r\n## 2. Packages\r\n\r\nOperators run `@x12i/credorix-service` from this monorepo (`npm start`). Downstream apps install `@x12i/credorix` / `@x12i/credorix-client`. Agents use `@x12i/credorix-docs` as a **devDependency**.\r\n\r\n---\r\n\r\n## 3. Where to go next\r\n\r\n| Goal | Book |\r\n|---|---|\r\n| Deploy boundary + SERVICE_MODE | Production Hardening |\r\n| Encryption, SSRF, rotation | Security Model |\r\n| Admin API | HTTP API |\r\n",
|
|
713
|
+
"downloads/books/00-platform-overview/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"the-central-idea\",\n \"title\": \"The central idea\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"1-what-credorix-is\",\n \"title\": \"1. What Credorix is\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"2-packages\",\n \"title\": \"2. Packages\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"3-where-to-go-next\",\n \"title\": \"3. Where to go next\",\n \"level\": 2,\n \"order\": 4\n }\n]",
|
|
714
|
+
"downloads/books/00-platform-overview/developers.md": "# Platform Overview — Developers\r\n\r\n**Audience:** Engineers wiring Credorix into callers, workers, and BFFs. \r\n**Related:** [Architecture](../../01-architecture/developers/BOOK.md) · [HTTP API](../../02-http-api/developers/BOOK.md)\r\n\r\n---\r\n\r\n## The central idea\r\n\r\n**Credorix** is an isolated credential and authentication runtime for outbound service and API calls.\r\n\r\nApplications reference a logical profile such as `authRef: \"explorer-api\"`. Credorix authenticates the caller, verifies that it may use the profile, resolves the underlying secret or identity, obtains or renews authentication, and either returns a short-lived credential lease or performs the request through a protected broker.\r\n\r\nBusiness envelopes carry **refs**, never raw secrets.\r\n\r\n---\r\n\r\n## 1. What Credorix is\r\n\r\nCredorix manages two different authentication relationships:\r\n\r\n```text\r\n1. Caller ──authenticates──▶ Credorix\r\n2. Credorix/SDK ──authenticates──▶ destination\r\n```\r\n\r\nThe first step is never skipped. Knowing an `authRef` does not grant access to it.\r\n\r\nCredorix is not tied to Memorix. Memorix workers, Explorer, vendor integrations, pipeline systems, UIs and other products are ordinary consumers.\r\n\r\n**Supported production shape:** one active Credorix process on a private network / VPN (not public internet, not multi-replica HA).\r\n\r\n---\r\n\r\n## 2. Packages\r\n\r\n| Package | Purpose |\r\n|---|---|\r\n| `@x12i/credorix` | Convenience facade (`client` + `./core` + `./fastify`) |\r\n| `@x12i/credorix-core` | Profiles, schemas, errors, redaction |\r\n| `@x12i/credorix-client` | Lease client, auth injection, broker, 401 retry |\r\n| `@x12i/credorix-providers` | Credential sources and built-in auth providers |\r\n| `@x12i/credorix-fastify` | Inbound JWT/JWKS and static-Bearer guards |\r\n| `@x12i/credorix-service` | Central registry, policy, lifecycle, broker (this repo) |\r\n| `@x12i/credorix-docs` | Knowledge SDK for agents (devDependency only) |\r\n\r\n```bash\r\nnpm install @x12i/credorix\r\nnpm i -D @x12i/credorix-docs # agents / tooling\r\n```\r\n\r\n---\r\n\r\n## 3. Where to go next\r\n\r\n| Goal | Book |\r\n|---|---|\r\n| Runtime shape | Architecture (`01-architecture`) |\r\n| Lease / broker / admin | HTTP API (`02-http-api`) |\r\n| Schemes and secrets | Providers and Secrets (`03-providers-and-secrets`) |\r\n| Invariants | Security Model (`04-security`) |\r\n| Deploy | Production Hardening (`05-production`) |\r\n| MPS / pipelines | Memorix Integration (`06-memorix-integration`) |\r\n",
|
|
715
|
+
"downloads/books/01-architecture/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"components\",\n \"title\": \"Components\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"profile-resolution\",\n \"title\": \"Profile resolution\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"cache-identity\",\n \"title\": \"Cache identity\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"delivery-modes\",\n \"title\": \"Delivery modes\",\n \"level\": 2,\n \"order\": 4\n },\n {\n \"slug\": \"renewal-coordination\",\n \"title\": \"Renewal coordination\",\n \"level\": 2,\n \"order\": 5\n },\n {\n \"slug\": \"extension-interfaces\",\n \"title\": \"Extension interfaces\",\n \"level\": 2,\n \"order\": 6\n }\n]",
|
|
716
|
+
"downloads/books/01-architecture/developers.md": "# Architecture — Developers\r\n\r\n**Audience:** Engineers extending or integrating the Credorix runtime. \r\n**Related:** [HTTP API](../../02-http-api/developers/BOOK.md) · [Security](../../04-security/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Components\r\n\r\n```text\r\nCaller\r\n │ caller authentication\r\n ▼\r\nCredorix HTTP service\r\n ├── CallerAuthenticator\r\n ├── ProfileRepository\r\n ├── CallerRepository\r\n ├── AuthEngine\r\n │ ├── authorization policy\r\n │ ├── provider registry\r\n │ ├── renewal coordination\r\n │ └── lease index\r\n ├── CredentialSource\r\n ├── TokenStateStore\r\n └── Broker network policy\r\n```\r\n\r\n---\r\n\r\n## Profile resolution\r\n\r\nAn auth profile combines:\r\n\r\n- provider scheme and provider configuration\r\n- named credential references\r\n- allowed callers\r\n- single-tenant or multi-tenant policy\r\n- delivery mode\r\n- destination allowlist\r\n- security and audit metadata\r\n\r\nThe profile never contains raw secret material.\r\n\r\n---\r\n\r\n## Cache identity\r\n\r\nAuthentication state is keyed by:\r\n\r\n```text\r\nauthRef + audience + normalized scopes + tenant + delegated subject\r\n```\r\n\r\nThis permits safe reuse when callers intentionally share one service identity, while separating tokens that differ in audience, scope, tenant or subject.\r\n\r\n---\r\n\r\n## Delivery modes\r\n\r\n### Token lease\r\n\r\nThe authorized internal caller receives only the short-lived material needed for the request. Long-lived client credentials and refresh tokens stay in Credorix.\r\n\r\n### Request broker\r\n\r\nCredorix performs the target request. This is required for HMAC signing and recommended for high-impact credentials that must never enter application memory.\r\n\r\n---\r\n\r\n## Renewal coordination\r\n\r\nOne process-level single-flight promise prevents duplicate renewals for the same cache key inside a single active Credorix process. Multi-replica / distributed locking is unsupported; run only one active owner for mutating work.\r\n\r\n---\r\n\r\n## Extension interfaces\r\n\r\n- `AuthProvider`\r\n- `CredentialSource`\r\n- `CallerAuthenticator`\r\n- `TokenStateStore`\r\n\r\nThese are the stable seams for cloud, IdP, vault and persistence adapters.\r\n",
|
|
717
|
+
"downloads/books/02-http-api/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"public-endpoints\",\n \"title\": \"Public endpoints\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"caller-authentication\",\n \"title\": \"Caller authentication\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"leases\",\n \"title\": \"Leases\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"broker-fetch\",\n \"title\": \"Broker fetch\",\n \"level\": 2,\n \"order\": 4\n },\n {\n \"slug\": \"administration-api\",\n \"title\": \"Administration API\",\n \"level\": 2,\n \"order\": 5\n },\n {\n \"slug\": \"profiles-and-callers\",\n \"title\": \"Profiles and callers\",\n \"level\": 2,\n \"order\": 6\n }\n]",
|
|
718
|
+
"downloads/books/02-http-api/developers.md": "# HTTP API — Developers\r\n\r\n**Audience:** Engineers calling Credorix over HTTP or via `@x12i/credorix-client`. \r\n**Related:** [Architecture](../../01-architecture/developers/BOOK.md) · [Memorix Integration](../../06-memorix-integration/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Public endpoints\r\n\r\n### Health, readiness, and live view\r\n\r\n- `GET /health` — liveness (`{ ok, service, package }`)\r\n- `GET /ready` — readiness (persistence available)\r\n- `GET /_live` — embeddable status + live request UI (`@x12i/api-live-view`)\r\n\r\n### Metadata\r\n\r\n`GET /metadata` returns sanitized capabilities for discovery (including the status UI):\r\n\r\n- `service`, `package`, `version`, `persistence`\r\n- `capabilities` — feature flags and supported schemes\r\n- `endpoints[]` — `{ method, path, description, access }` (`public` \\| `caller` \\| `admin`)\r\n- `operations[]` — tryable caller flows with examples\r\n\r\n---\r\n\r\n## Caller authentication\r\n\r\nAll caller routes require:\r\n\r\n```http\r\nAuthorization: Bearer <caller-token>\r\nX-Credorix-Caller: <caller-id>\r\n```\r\n\r\n`CallerAuthenticator` is injectable so production can replace bootstrap tokens with workload identity, JWT, SPIFFE or mTLS.\r\n\r\n---\r\n\r\n## Leases\r\n\r\n### Obtain a lease\r\n\r\n`POST /v1/leases`\r\n\r\n```json\r\n{\r\n \"authRef\": \"vendor-api\",\r\n \"audience\": \"vendor\",\r\n \"scopes\": [\"read\"],\r\n \"tenantId\": \"org-123\",\r\n \"subject\": \"user-456\",\r\n \"forceRefresh\": false\r\n}\r\n```\r\n\r\n### Invalidate\r\n\r\n`POST /v1/leases/:id/invalidate` with `{ \"reason\": \"target_unauthorized\" }` — idempotent.\r\n\r\n### Profile metadata\r\n\r\n`GET /v1/profiles/:id` returns sanitized metadata when the caller may use the profile. May include non-secret `consent` hints. Never includes credentials.\r\n\r\n### Token-state ingest\r\n\r\n`POST /v1/profiles/:id/token-state` binds consent-exchanged tokens into encrypted runtime state for an `oauth2-refresh-token` profile. Response never echoes tokens.\r\n\r\n---\r\n\r\n## Broker fetch\r\n\r\n`POST /v1/broker/fetch`\r\n\r\n```json\r\n{\r\n \"authRef\": \"vendor-api\",\r\n \"url\": \"https://vendor.example/v1/items\",\r\n \"method\": \"POST\",\r\n \"headers\": { \"x-correlation-id\": \"abc\" },\r\n \"body\": { \"query\": \"example\" },\r\n \"timeoutMs\": 30000\r\n}\r\n```\r\n\r\nBroker destinations are allowlisted. Prefer the broker for HMAC and high-impact credentials.\r\n\r\nSDK helpers: `createCredorixClient`, lease APIs, and `brokerFetch` / Memorix pipeline helpers in `@x12i/credorix-client`.\r\n\r\n---\r\n\r\n## Administration API\r\n\r\nAdmin routes require:\r\n\r\n```http\r\nAuthorization: Bearer <admin-token>\r\n```\r\n\r\nMutating routes also require `Idempotency-Key`. Same key + same body → cached response; same key + different body → `409`.\r\n\r\n---\r\n\r\n## Profiles and callers\r\n\r\n### Profiles\r\n\r\n- `GET /admin/profiles`, `GET /admin/profiles/:id`\r\n- `POST /admin/profiles`, `PUT /admin/profiles/:id`, `DELETE /admin/profiles/:id`\r\n- `POST /admin/profiles/:id/token-state` — ops bootstrap of encrypted token state\r\n\r\n### Callers\r\n\r\n- `GET /admin/callers`\r\n- `POST /admin/callers`, `PUT /admin/callers/:id`\r\n- `POST /admin/callers/:id/rotate-token`\r\n\r\nRaw token hashes and credential values are never returned.\r\n",
|
|
719
|
+
"downloads/books/03-providers-and-secrets/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"built-in-providers\",\n \"title\": \"Built-in providers\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"credential-sources\",\n \"title\": \"Credential sources\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"choosing-a-scheme\",\n \"title\": \"Choosing a scheme\",\n \"level\": 2,\n \"order\": 3\n }\n]",
|
|
720
|
+
"downloads/books/03-providers-and-secrets/developers.md": "# Providers and Secrets — Developers\r\n\r\n**Audience:** Engineers choosing schemes and wiring credential sources. \r\n**Related:** [Security](../../04-security/developers/BOOK.md) · [HTTP API](../../02-http-api/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Built-in providers\r\n\r\n| Scheme | Lease | Broker | Notes |\r\n|---|---:|---:|---|\r\n| Static Bearer | Yes | Yes | Re-read secret after invalidation/rotation |\r\n| Projected token file | Yes | Yes | Re-read token file |\r\n| API key | Yes | Yes | Header preferred; query only when enabled |\r\n| Basic authentication | Yes | Yes | Username/password resolved separately |\r\n| OAuth 2 client credentials | Yes | Yes | App-only; proactive renewal |\r\n| OAuth 2 refresh token | Yes | Yes | Rotated refresh state encrypted; optional ingest seeding |\r\n| HMAC-SHA256 request signing | No | Yes | Sign every request |\r\n| Custom provider | Provider-defined | Provider-defined | Via `AuthProvider` |\r\n\r\nOAuth client-credentials supports `client_secret_basic`, `client_secret_post`, public-client `none`, audience, resource, scopes, and extra form fields.\r\n\r\n---\r\n\r\n## Credential sources\r\n\r\nProfiles reference secrets via URI schemes such as:\r\n\r\n- `env://VAR_NAME`\r\n- `file://relative/path`\r\n- `memory://name` for tests\r\n\r\n`CredentialSource` is pluggable for Vault, Azure Key Vault, AWS Secrets Manager, Google Secret Manager, Kubernetes CSI, HSM/KMS or another secure store.\r\n\r\nPersisted profiles, callers, and token state are always AES-256-GCM encrypted with `CREDORIX_MASTER_KEY` (Mongo or on-disk) — independent of where source secrets live.\r\n\r\n---\r\n\r\n## Choosing a scheme\r\n\r\n| Destination need | Prefer |\r\n|---|---|\r\n| Fixed service token | Static Bearer or API key |\r\n| K8s / projected workload token | Token file |\r\n| App-only OAuth (client id/secret) | OAuth 2 client credentials |\r\n| User-delegated OAuth after BFF consent | OAuth 2 refresh token + token-state ingest |\r\n| HMAC signed requests | HMAC (broker only) |\r\n| Secret must never enter app memory | Broker delivery |\r\n\r\nWorkers and pipelines should emit `credentialRef` / `tokenRef` values that match Credorix profile ids — never materialize secrets into envelopes.\r\n",
|
|
721
|
+
"downloads/books/04-security/builders.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"invariants\",\n \"title\": \"Invariants\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"secret-storage\",\n \"title\": \"Secret storage\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"caller-bootstrap\",\n \"title\": \"Caller bootstrap\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"broker-ssrf-controls\",\n \"title\": \"Broker SSRF controls\",\n \"level\": 2,\n \"order\": 4\n },\n {\n \"slug\": \"rotation\",\n \"title\": \"Rotation\",\n \"level\": 2,\n \"order\": 5\n },\n {\n \"slug\": \"audit-and-logging\",\n \"title\": \"Audit and logging\",\n \"level\": 2,\n \"order\": 6\n }\n]",
|
|
722
|
+
"downloads/books/04-security/builders.md": "# Security Model — Builders\r\n\r\n**Audience:** Operators owning Credorix security posture. \r\n**Related:** [Production Hardening](../../05-production/builders/BOOK.md)\r\n\r\n---\r\n\r\n## Invariants\r\n\r\nNever put secrets in business payloads or browsers. Profiles hold refs. Callers are authenticated and authorized per profile. Broker destinations are allowlisted. BFF and worker callers stay least-privilege and separate.\r\n\r\n---\r\n\r\n## Secret storage\r\n\r\nInject `CREDORIX_MASTER_KEY` from a deployment secret mechanism. Persistence (disk or Mongo) stores AES-256-GCM envelopes only.\r\n\r\n---\r\n\r\n## Caller bootstrap\r\n\r\nPrefer replacing demo/bootstrap bearer tokens with platform identity via `CallerAuthenticator` in production.\r\n\r\n---\r\n\r\n## Broker SSRF controls\r\n\r\nKeep Credorix off the public internet. Do not enable private-network broker access in `SERVICE_MODE=prod`.\r\n\r\n---\r\n\r\n## Rotation\r\n\r\nOwn caller token rotation, secret-store rotation, and emergency disable (`enabled: false` on profiles).\r\n\r\n---\r\n\r\n## Audit and logging\r\n\r\nRely on structured audit fields on the service logger; never log raw provider token material.\r\n",
|
|
723
|
+
"downloads/books/04-security/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"invariants\",\n \"title\": \"Invariants\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"secret-storage\",\n \"title\": \"Secret storage\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"caller-bootstrap\",\n \"title\": \"Caller bootstrap\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"broker-ssrf-controls\",\n \"title\": \"Broker SSRF controls\",\n \"level\": 2,\n \"order\": 4\n },\n {\n \"slug\": \"rotation\",\n \"title\": \"Rotation\",\n \"level\": 2,\n \"order\": 5\n },\n {\n \"slug\": \"audit-and-logging\",\n \"title\": \"Audit and logging\",\n \"level\": 2,\n \"order\": 6\n }\n]",
|
|
724
|
+
"downloads/books/04-security/developers.md": "# Security Model — Developers\r\n\r\n**Audience:** Engineers and operators enforcing Credorix security invariants. \r\n**Related:** [Production](../../05-production/developers/BOOK.md) · [Providers](../../03-providers-and-secrets/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Invariants\r\n\r\n1. Business payloads never contain credentials.\r\n2. Profile records contain references, not raw secrets.\r\n3. Refresh tokens never leave the service (including after consent ingest — GET profiles never returns token state).\r\n4. A caller must be authenticated and independently authorized for the requested profile.\r\n5. Multi-tenant values participate in authorization and cache identity.\r\n6. Broker destinations are allowlisted.\r\n7. Sensitive keys are redacted from logs and errors.\r\n8. Authentication failures retry at most once at the SDK boundary.\r\n9. A `403` is not treated as an expired token.\r\n10. Missing authentication never silently downgrades a protected call.\r\n11. BFF and worker callers use distinct registrations with least-privilege `allowedAuthRefs`.\r\n12. Consent redirects stay in the product BFF; Credorix does not host OAuth UIs or exchange authorization codes.\r\n\r\n---\r\n\r\n## Secret storage\r\n\r\nThe default service supports environment and file credential references (`env://`, `file://`).\r\n\r\nPersisted service state is always encrypted with AES-256-GCM using `CREDORIX_MASTER_KEY`. Backend selection (first match wins):\r\n\r\n1. `CREDORIX_MONGODB_URI`\r\n2. `MONGODB_URI`\r\n3. Encrypted files under `CREDORIX_DATA_DIR`\r\n\r\nThe master key must come from a deployment secret mechanism and must not be committed alongside encrypted state.\r\n\r\n---\r\n\r\n## Caller bootstrap\r\n\r\nThe included bootstrap token is generated at high entropy, returned once and stored only as an HMAC hash. It is a compatibility method, not a requirement of the protocol. Use `CallerAuthenticator` to adopt workload identity, mTLS or JWT.\r\n\r\n---\r\n\r\n## Broker SSRF controls\r\n\r\nThe broker requires an exact origin allowlist. It blocks private-network destinations by default, removes caller-controlled credential headers, disables redirects and checks DNS results before dispatch. When `SERVICE_MODE=prod` (the default), `CREDORIX_ALLOW_PRIVATE_NETWORK=true` is rejected.\r\n\r\nA network egress proxy remains a strong deployment control.\r\n\r\n---\r\n\r\n## Rotation\r\n\r\n- rotate caller bootstrap tokens through the admin API\r\n- rotate source secrets in the underlying secret store\r\n- invalidate leases after target rejection\r\n- use broker-only delivery for high-impact credentials\r\n- use separate profiles for materially different privilege levels\r\n\r\n---\r\n\r\n## Audit and logging\r\n\r\nWhen `profile.security.audit` is not `false`, Credorix emits structured audit events (no secrets) through the Fastify/pino logger. Do not add raw provider responses to application logs; Credorix redacts common token, secret, cookie and password fields.\r\n",
|
|
725
|
+
"downloads/books/05-production/builders.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"supported-deployment-boundary\",\n \"title\": \"Supported deployment boundary\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"runtime-mode\",\n \"title\": \"Runtime mode\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"implemented-in-this-repository\",\n \"title\": \"Implemented in this repository\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"deployment-owned\",\n \"title\": \"Deployment-owned\",\n \"level\": 2,\n \"order\": 4\n }\n]",
|
|
726
|
+
"downloads/books/05-production/builders.md": "# Production Hardening — Builders\r\n\r\n**Audience:** Operators owning Credorix deployment. \r\n**Related:** [Security Model](../../04-security/builders/BOOK.md)\r\n\r\n---\r\n\r\n## Supported deployment boundary\r\n\r\nOne active Credorix process on a private network / VPN. Not a public edge service; not multi-replica HA.\r\n\r\n---\r\n\r\n## Runtime mode\r\n\r\nDefault is **prod**. Use `SERVICE_MODE=dev` only for local soft defaults. Missing/empty is prod — not dev.\r\n\r\n---\r\n\r\n## Implemented in this repository\r\n\r\nEncrypted persistence, single-flight renewal, SSRF allowlist, admin idempotency, health/ready/`/_live`, and prod gates on admin token + master key.\r\n\r\n---\r\n\r\n## Deployment-owned\r\n\r\nNetwork isolation, secret injection, identity strategy, profile ownership, and backups remain yours.\r\n",
|
|
727
|
+
"downloads/books/05-production/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"supported-deployment-boundary\",\n \"title\": \"Supported deployment boundary\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"runtime-mode\",\n \"title\": \"Runtime mode\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"implemented-in-this-repository\",\n \"title\": \"Implemented in this repository\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"deployment-owned\",\n \"title\": \"Deployment-owned\",\n \"level\": 2,\n \"order\": 4\n }\n]",
|
|
728
|
+
"downloads/books/05-production/developers.md": "# Production Hardening — Developers\r\n\r\n**Audience:** Engineers deploying Credorix. \r\n**Related:** [Security](../../04-security/developers/BOOK.md) · [Platform Overview](../../00-platform-overview/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Supported deployment boundary\r\n\r\nCredorix is an **internal** credential service for:\r\n\r\n- A single machine, or multiple machines on a **private network / VPN**\r\n- **One active owner** for scheduled and mutating work (token renewal, admin mutations)\r\n- **No direct public internet exposure**\r\n\r\n**Unsupported:** multi-replica active-active coordination, horizontal scaling of mutating work, multi-region, public-internet edge controls, distributed locks.\r\n\r\n---\r\n\r\n## Runtime mode\r\n\r\n| `SERVICE_MODE` | Behavior |\r\n|---|---|\r\n| missing / empty | **prod** |\r\n| `prod` | production-safe gates |\r\n| `dev` | soft defaults allowed |\r\n| anything else | startup failure |\r\n\r\nDevelopment behavior is never entered because configuration is missing.\r\n\r\n---\r\n\r\n## Implemented in this repository\r\n\r\n1. AES-256-GCM encrypted persistence for profiles, callers, and token state.\r\n2. In-process single-flight for token renewal (one active process only).\r\n3. Caller/admin authentication, bootstrap token hashing, log redaction, broker SSRF allowlist + private-network block.\r\n4. Structured audit fields when `profile.security.audit` is not `false`.\r\n5. Production gates when `SERVICE_MODE=prod`: require non-placeholder `CREDORIX_ADMIN_TOKEN` and `CREDORIX_MASTER_KEY`; reject private-network broker and demo caller token.\r\n6. Admin mutating routes require `Idempotency-Key`.\r\n7. `/health`, `/ready`, and `/_live`.\r\n\r\n---\r\n\r\n## Deployment-owned\r\n\r\n1. Keep Credorix off the public internet.\r\n2. Inject `CREDORIX_MASTER_KEY`; do not commit it.\r\n3. Prefer platform identity over bootstrap bearer tokens when needed.\r\n4. Define profile owners, expiration reviews, and emergency disable procedures.\r\n5. Back up profile and caller policy data.\r\n",
|
|
729
|
+
"downloads/books/06-memorix-integration/developers.chapters.json": "[\n {\n \"slug\": \"preamble\",\n \"title\": \"Introduction\",\n \"level\": 2,\n \"order\": 0\n },\n {\n \"slug\": \"pinned-contract\",\n \"title\": \"Pinned contract\",\n \"level\": 2,\n \"order\": 1\n },\n {\n \"slug\": \"credential-profiles\",\n \"title\": \"Credential profiles\",\n \"level\": 2,\n \"order\": 2\n },\n {\n \"slug\": \"worker-to-vendor\",\n \"title\": \"Worker to vendor\",\n \"level\": 2,\n \"order\": 3\n },\n {\n \"slug\": \"consent-custody\",\n \"title\": \"Consent custody\",\n \"level\": 2,\n \"order\": 4\n }\n]",
|
|
730
|
+
"downloads/books/06-memorix-integration/developers.md": "# Memorix Integration — Developers\r\n\r\n**Audience:** Engineers connecting Memorix / pipeline-services to Credorix. \r\n**Pinned:** `@x12i/memorix-pipeline-services@1.4.0` \r\n**Related:** [HTTP API](../../02-http-api/developers/BOOK.md) · [Providers](../../03-providers-and-secrets/developers/BOOK.md)\r\n\r\n---\r\n\r\n## Pinned contract\r\n\r\nMemorix / pipeline-services is a **consumer** of Credorix, not part of Credorix.\r\n\r\nPipeline envelope `contractVersion: \"1.0\"` from MPS **1.4.0**. Credorix maps:\r\n\r\n| Memorix (MPS 1.4.0) | Credorix |\r\n|---|---|\r\n| `auth.mode: \"credential-ref\"` + `auth.credentialRef` | profile `authRef` |\r\n| `auth.mode: \"token-ref\"` + `auth.tokenRef` | profile `authRef` |\r\n| `scope.orgId` (else `run.orgId`) | `tenantId` |\r\n| `execution.timeoutMs` | broker `timeoutMs` |\r\n| Raw secrets in envelopes | **forbidden** — use refs only |\r\n\r\nHelpers (no runtime dependency on MPS; types tested against 1.4.0):\r\n\r\n```ts\r\nimport {\r\n leaseRequestFromPipelineAuth,\r\n brokerRequestFromPipelineAuth,\r\n brokerFetchForPipeline,\r\n} from \"@x12i/credorix-client\";\r\n```\r\n\r\n---\r\n\r\n## Credential profiles\r\n\r\nRegister Credorix profiles whose **ids match** the `credentialRef` / `tokenRef` values workers and orchestrators emit, for example:\r\n\r\n- `customer-a:paloalto-prod-readonly`\r\n- `memorix-skill-workers`\r\n- `explorer-api`\r\n\r\nUse multi-tenant profiles when `orgId` must participate in cache identity and authorization.\r\n\r\n---\r\n\r\n## Worker to vendor\r\n\r\n```ts\r\nimport { createCredorixClient, brokerFetchForPipeline } from \"@x12i/credorix\";\r\n\r\nconst credorix = createCredorixClient({\r\n serviceUrl: process.env.CREDORIX_BASE_URL!,\r\n callerId: process.env.CREDORIX_CALLER_ID!,\r\n callerToken: process.env.CREDORIX_CALLER_TOKEN!,\r\n});\r\n\r\nexport async function handleLive(request) {\r\n const brokered = await brokerFetchForPipeline(credorix, request, {\r\n url: \"https://vendor.example/api/v1/resources\",\r\n method: \"GET\",\r\n timeoutMs: request.execution?.timeoutMs ?? 30_000,\r\n });\r\n return {\r\n status: \"success\",\r\n result: brokered.body,\r\n metrics: { apiCalls: 1 },\r\n };\r\n}\r\n```\r\n\r\nStatus UI / BFF → worker `/pipeline` should hold the Credorix **caller** token server-side and broker the worker call. No vendor secret or Credorix admin token in the browser.\r\n\r\n---\r\n\r\n## Consent custody\r\n\r\nBrowser redirect and PKCE stay in the product BFF. Credorix stores and renews tokens.\r\n\r\n```text\r\nBrowser → BFF (authorize + code exchange)\r\n → Credorix POST /v1/profiles/{tokenRef}/token-state\r\nWorker → Credorix POST /v1/leases { authRef: tokenRef }\r\n → vendor API (or broker)\r\n```\r\n\r\nUse **separate callers** for BFF and workers with distinct `allowedAuthRefs`. Credorix does **not** implement the MPS registry, Catalox store, stub fixture packs, or invoke router.\r\n",
|
|
731
|
+
"downloads/use-cases/call-lease-and-broker.md": "# Call leases and the broker\n\n> **Use case id:** `call-lease-and-broker`\n> **Goal:** Authenticate as a caller, obtain a short-lived lease, or broker an outbound request through Credorix.\n> **Audiences:** developers\n> **Tags:** http, leases, broker, sdk\n\n## Reading path\n\n1. **HTTP API** (developers) → chapters: `caller-authentication`, `leases`, `broker-fetch`\n1. **Architecture** (developers) → chapters: `delivery-modes`\n\n## From: HTTP API — Caller authentication\n\nAll caller routes require:\n\n```http\nAuthorization: Bearer <caller-token>\nX-Credorix-Caller: <caller-id>\n```\n\n`CallerAuthenticator` is injectable so production can replace bootstrap tokens with workload identity, JWT, SPIFFE or mTLS.\n\n---\n\n## From: HTTP API — Leases\n\n### Obtain a lease\n\n`POST /v1/leases`\n\n```json\n{\n \"authRef\": \"vendor-api\",\n \"audience\": \"vendor\",\n \"scopes\": [\"read\"],\n \"tenantId\": \"org-123\",\n \"subject\": \"user-456\",\n \"forceRefresh\": false\n}\n```\n\n### Invalidate\n\n`POST /v1/leases/:id/invalidate` with `{ \"reason\": \"target_unauthorized\" }` — idempotent.\n\n### Profile metadata\n\n`GET /v1/profiles/:id` returns sanitized metadata when the caller may use the profile. May include non-secret `consent` hints. Never includes credentials.\n\n### Token-state ingest\n\n`POST /v1/profiles/:id/token-state` binds consent-exchanged tokens into encrypted runtime state for an `oauth2-refresh-token` profile. Response never echoes tokens.\n\n---\n\n## From: HTTP API — Broker fetch\n\n`POST /v1/broker/fetch`\n\n```json\n{\n \"authRef\": \"vendor-api\",\n \"url\": \"https://vendor.example/v1/items\",\n \"method\": \"POST\",\n \"headers\": { \"x-correlation-id\": \"abc\" },\n \"body\": { \"query\": \"example\" },\n \"timeoutMs\": 30000\n}\n```\n\nBroker destinations are allowlisted. Prefer the broker for HMAC and high-impact credentials.\n\nSDK helpers: `createCredorixClient`, lease APIs, and `brokerFetch` / Memorix pipeline helpers in `@x12i/credorix-client`.\n\n---\n\n## From: Architecture — Delivery modes\n\n### Token lease\n\nThe authorized internal caller receives only the short-lived material needed for the request. Long-lived client credentials and refresh tokens stay in Credorix.\n\n### Request broker\n\nCredorix performs the target request. This is required for HMAC signing and recommended for high-impact credentials that must never enter application memory.\n\n---\n\n## Also see\n\n- **Platform Overview** (`00-platform-overview`) — What Credorix is, the two trust relationships, packages, and where to start.\n- **Security Model** (`04-security`) — Security invariants, encrypted persistence, broker SSRF controls, audit, and rotation.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n",
|
|
732
|
+
"downloads/use-cases/choose-auth-provider.md": "# Choose an auth provider\n\n> **Use case id:** `choose-auth-provider`\n> **Goal:** Pick the right built-in scheme and credential source for a destination API.\n> **Audiences:** developers\n> **Tags:** providers, oauth, secrets\n\n## Reading path\n\n1. **Providers and Secrets** (developers) → chapters: `built-in-providers`, `credential-sources`, `choosing-a-scheme`\n\n## From: Providers and Secrets — Built-in providers\n\n| Scheme | Lease | Broker | Notes |\n|---|---:|---:|---|\n| Static Bearer | Yes | Yes | Re-read secret after invalidation/rotation |\n| Projected token file | Yes | Yes | Re-read token file |\n| API key | Yes | Yes | Header preferred; query only when enabled |\n| Basic authentication | Yes | Yes | Username/password resolved separately |\n| OAuth 2 client credentials | Yes | Yes | App-only; proactive renewal |\n| OAuth 2 refresh token | Yes | Yes | Rotated refresh state encrypted; optional ingest seeding |\n| HMAC-SHA256 request signing | No | Yes | Sign every request |\n| Custom provider | Provider-defined | Provider-defined | Via `AuthProvider` |\n\nOAuth client-credentials supports `client_secret_basic`, `client_secret_post`, public-client `none`, audience, resource, scopes, and extra form fields.\n\n---\n\n## From: Providers and Secrets — Credential sources\n\nProfiles reference secrets via URI schemes such as:\n\n- `env://VAR_NAME`\n- `file://relative/path`\n- `memory://name` for tests\n\n`CredentialSource` is pluggable for Vault, Azure Key Vault, AWS Secrets Manager, Google Secret Manager, Kubernetes CSI, HSM/KMS or another secure store.\n\nPersisted profiles, callers, and token state are always AES-256-GCM encrypted with `CREDORIX_MASTER_KEY` (Mongo or on-disk) — independent of where source secrets live.\n\n---\n\n## From: Providers and Secrets — Choosing a scheme\n\n| Destination need | Prefer |\n|---|---|\n| Fixed service token | Static Bearer or API key |\n| K8s / projected workload token | Token file |\n| App-only OAuth (client id/secret) | OAuth 2 client credentials |\n| User-delegated OAuth after BFF consent | OAuth 2 refresh token + token-state ingest |\n| HMAC signed requests | HMAC (broker only) |\n| Secret must never enter app memory | Broker delivery |\n\nWorkers and pipelines should emit `credentialRef` / `tokenRef` values that match Credorix profile ids — never materialize secrets into envelopes.\n\n## Also see\n\n- **Security Model** (`04-security`) — Security invariants, encrypted persistence, broker SSRF controls, audit, and rotation.\n- **Memorix Integration** (`06-memorix-integration`) — How Memorix / pipeline-services consumes Credorix via credential-ref and token-ref — pinned to MPS 1.4.0.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n",
|
|
733
|
+
"downloads/use-cases/harden-production.md": "# Harden for production\n\n> **Use case id:** `harden-production`\n> **Goal:** Deploy Credorix inside its supported boundary with SERVICE_MODE gates and encrypted persistence.\n> **Audiences:** developers, builders\n> **Tags:** production, ops, hardening\n\n## Reading path\n\n1. **Production Hardening** (developers) → chapters: `supported-deployment-boundary`, `runtime-mode`, `implemented-in-this-repository`\n1. **Security Model** (developers) → chapters: `invariants`, `secret-storage`\n\n## From: Production Hardening — Supported deployment boundary\n\nCredorix is an **internal** credential service for:\n\n- A single machine, or multiple machines on a **private network / VPN**\n- **One active owner** for scheduled and mutating work (token renewal, admin mutations)\n- **No direct public internet exposure**\n\n**Unsupported:** multi-replica active-active coordination, horizontal scaling of mutating work, multi-region, public-internet edge controls, distributed locks.\n\n---\n\n## From: Production Hardening — Runtime mode\n\n| `SERVICE_MODE` | Behavior |\n|---|---|\n| missing / empty | **prod** |\n| `prod` | production-safe gates |\n| `dev` | soft defaults allowed |\n| anything else | startup failure |\n\nDevelopment behavior is never entered because configuration is missing.\n\n---\n\n## From: Production Hardening — Implemented in this repository\n\n1. AES-256-GCM encrypted persistence for profiles, callers, and token state.\n2. In-process single-flight for token renewal (one active process only).\n3. Caller/admin authentication, bootstrap token hashing, log redaction, broker SSRF allowlist + private-network block.\n4. Structured audit fields when `profile.security.audit` is not `false`.\n5. Production gates when `SERVICE_MODE=prod`: require non-placeholder `CREDORIX_ADMIN_TOKEN` and `CREDORIX_MASTER_KEY`; reject private-network broker and demo caller token.\n6. Admin mutating routes require `Idempotency-Key`.\n7. `/health`, `/ready`, and `/_live`.\n\n---\n\n## From: Security Model — Invariants\n\n1. Business payloads never contain credentials.\n2. Profile records contain references, not raw secrets.\n3. Refresh tokens never leave the service (including after consent ingest — GET profiles never returns token state).\n4. A caller must be authenticated and independently authorized for the requested profile.\n5. Multi-tenant values participate in authorization and cache identity.\n6. Broker destinations are allowlisted.\n7. Sensitive keys are redacted from logs and errors.\n8. Authentication failures retry at most once at the SDK boundary.\n9. A `403` is not treated as an expired token.\n10. Missing authentication never silently downgrades a protected call.\n11. BFF and worker callers use distinct registrations with least-privilege `allowedAuthRefs`.\n12. Consent redirects stay in the product BFF; Credorix does not host OAuth UIs or exchange authorization codes.\n\n---\n\n## From: Security Model — Secret storage\n\nThe default service supports environment and file credential references (`env://`, `file://`).\n\nPersisted service state is always encrypted with AES-256-GCM using `CREDORIX_MASTER_KEY`. Backend selection (first match wins):\n\n1. `CREDORIX_MONGODB_URI`\n2. `MONGODB_URI`\n3. Encrypted files under `CREDORIX_DATA_DIR`\n\nThe master key must come from a deployment secret mechanism and must not be committed alongside encrypted state.\n\n---\n\n## Also see\n\n- **Platform Overview** (`00-platform-overview`) — What Credorix is, the two trust relationships, packages, and where to start.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n",
|
|
734
|
+
"downloads/use-cases/integrate-memorix-pipeline.md": "# Integrate Memorix pipelines\n\n> **Use case id:** `integrate-memorix-pipeline`\n> **Goal:** Map MPS credential-ref / token-ref envelopes to Credorix profiles and broker helpers.\n> **Audiences:** developers\n> **Tags:** memorix, pipeline, mps\n\n## Reading path\n\n1. **Memorix Integration** (developers) → chapters: `pinned-contract`, `credential-profiles`, `worker-to-vendor`, `consent-custody`\n\n## From: Memorix Integration — Pinned contract\n\nMemorix / pipeline-services is a **consumer** of Credorix, not part of Credorix.\n\nPipeline envelope `contractVersion: \"1.0\"` from MPS **1.4.0**. Credorix maps:\n\n| Memorix (MPS 1.4.0) | Credorix |\n|---|---|\n| `auth.mode: \"credential-ref\"` + `auth.credentialRef` | profile `authRef` |\n| `auth.mode: \"token-ref\"` + `auth.tokenRef` | profile `authRef` |\n| `scope.orgId` (else `run.orgId`) | `tenantId` |\n| `execution.timeoutMs` | broker `timeoutMs` |\n| Raw secrets in envelopes | **forbidden** — use refs only |\n\nHelpers (no runtime dependency on MPS; types tested against 1.4.0):\n\n```ts\nimport {\n leaseRequestFromPipelineAuth,\n brokerRequestFromPipelineAuth,\n brokerFetchForPipeline,\n} from \"@x12i/credorix-client\";\n```\n\n---\n\n## From: Memorix Integration — Credential profiles\n\nRegister Credorix profiles whose **ids match** the `credentialRef` / `tokenRef` values workers and orchestrators emit, for example:\n\n- `customer-a:paloalto-prod-readonly`\n- `memorix-skill-workers`\n- `explorer-api`\n\nUse multi-tenant profiles when `orgId` must participate in cache identity and authorization.\n\n---\n\n## From: Memorix Integration — Worker to vendor\n\n```ts\nimport { createCredorixClient, brokerFetchForPipeline } from \"@x12i/credorix\";\n\nconst credorix = createCredorixClient({\n serviceUrl: process.env.CREDORIX_BASE_URL!,\n callerId: process.env.CREDORIX_CALLER_ID!,\n callerToken: process.env.CREDORIX_CALLER_TOKEN!,\n});\n\nexport async function handleLive(request) {\n const brokered = await brokerFetchForPipeline(credorix, request, {\n url: \"https://vendor.example/api/v1/resources\",\n method: \"GET\",\n timeoutMs: request.execution?.timeoutMs ?? 30_000,\n });\n return {\n status: \"success\",\n result: brokered.body,\n metrics: { apiCalls: 1 },\n };\n}\n```\n\nStatus UI / BFF → worker `/pipeline` should hold the Credorix **caller** token server-side and broker the worker call. No vendor secret or Credorix admin token in the browser.\n\n---\n\n## From: Memorix Integration — Consent custody\n\nBrowser redirect and PKCE stay in the product BFF. Credorix stores and renews tokens.\n\n```text\nBrowser → BFF (authorize + code exchange)\n → Credorix POST /v1/profiles/{tokenRef}/token-state\nWorker → Credorix POST /v1/leases { authRef: tokenRef }\n → vendor API (or broker)\n```\n\nUse **separate callers** for BFF and workers with distinct `allowedAuthRefs`. Credorix does **not** implement the MPS registry, Catalox store, stub fixture packs, or invoke router.\n\n## Also see\n\n- **HTTP API** (`02-http-api`) — Health, metadata, leases, broker, token-state ingest, and administration routes.\n- **Architecture** (`01-architecture`) — Service components, profile resolution, cache identity, lease vs broker, and extension seams.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n",
|
|
735
|
+
"downloads/use-cases/operate-admin-api.md": "# Operate the admin API\n\n> **Use case id:** `operate-admin-api`\n> **Goal:** Register profiles and callers, rotate tokens, and use idempotent admin mutations.\n> **Audiences:** developers, builders\n> **Tags:** admin, http, ops\n\n## Reading path\n\n1. **HTTP API** (developers) → chapters: `administration-api`, `profiles-and-callers`\n1. **Security Model** (developers) → chapters: `caller-bootstrap`, `rotation`\n\n## From: HTTP API — Administration API\n\nAdmin routes require:\n\n```http\nAuthorization: Bearer <admin-token>\n```\n\nMutating routes also require `Idempotency-Key`. Same key + same body → cached response; same key + different body → `409`.\n\n---\n\n## From: HTTP API — Profiles and callers\n\n### Profiles\n\n- `GET /admin/profiles`, `GET /admin/profiles/:id`\n- `POST /admin/profiles`, `PUT /admin/profiles/:id`, `DELETE /admin/profiles/:id`\n- `POST /admin/profiles/:id/token-state` — ops bootstrap of encrypted token state\n\n### Callers\n\n- `GET /admin/callers`\n- `POST /admin/callers`, `PUT /admin/callers/:id`\n- `POST /admin/callers/:id/rotate-token`\n\nRaw token hashes and credential values are never returned.\n\n## From: Security Model — Caller bootstrap\n\nThe included bootstrap token is generated at high entropy, returned once and stored only as an HMAC hash. It is a compatibility method, not a requirement of the protocol. Use `CallerAuthenticator` to adopt workload identity, mTLS or JWT.\n\n---\n\n## From: Security Model — Rotation\n\n- rotate caller bootstrap tokens through the admin API\n- rotate source secrets in the underlying secret store\n- invalidate leases after target rejection\n- use broker-only delivery for high-impact credentials\n- use separate profiles for materially different privilege levels\n\n---\n\n## Also see\n\n- **Production Hardening** (`05-production`) — Supported deployment shape, SERVICE_MODE gates, and what stays deployment-owned.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n",
|
|
736
|
+
"downloads/use-cases/orient-credorix.md": "# Orient on Credorix\n\n> **Use case id:** `orient-credorix`\n> **Goal:** Understand what Credorix owns, the two trust relationships, and which package to install.\n> **Audiences:** developers, builders\n> **Tags:** platform, start-here\n\n## Reading path\n\n1. **Platform Overview** (developers) → chapters: `the-central-idea`, `1-what-credorix-is`, `2-packages`, `3-where-to-go-next`\n\n## From: Platform Overview — The central idea\n\n**Credorix** is an isolated credential and authentication runtime for outbound service and API calls.\n\nApplications reference a logical profile such as `authRef: \"explorer-api\"`. Credorix authenticates the caller, verifies that it may use the profile, resolves the underlying secret or identity, obtains or renews authentication, and either returns a short-lived credential lease or performs the request through a protected broker.\n\nBusiness envelopes carry **refs**, never raw secrets.\n\n---\n\n## From: Platform Overview — 1. What Credorix is\n\nCredorix manages two different authentication relationships:\n\n```text\n1. Caller ──authenticates──▶ Credorix\n2. Credorix/SDK ──authenticates──▶ destination\n```\n\nThe first step is never skipped. Knowing an `authRef` does not grant access to it.\n\nCredorix is not tied to Memorix. Memorix workers, Explorer, vendor integrations, pipeline systems, UIs and other products are ordinary consumers.\n\n**Supported production shape:** one active Credorix process on a private network / VPN (not public internet, not multi-replica HA).\n\n---\n\n## From: Platform Overview — 2. Packages\n\n| Package | Purpose |\n|---|---|\n| `@x12i/credorix` | Convenience facade (`client` + `./core` + `./fastify`) |\n| `@x12i/credorix-core` | Profiles, schemas, errors, redaction |\n| `@x12i/credorix-client` | Lease client, auth injection, broker, 401 retry |\n| `@x12i/credorix-providers` | Credential sources and built-in auth providers |\n| `@x12i/credorix-fastify` | Inbound JWT/JWKS and static-Bearer guards |\n| `@x12i/credorix-service` | Central registry, policy, lifecycle, broker (this repo) |\n| `@x12i/credorix-docs` | Knowledge SDK for agents (devDependency only) |\n\n```bash\nnpm install @x12i/credorix\nnpm i -D @x12i/credorix-docs # agents / tooling\n```\n\n---\n\n## From: Platform Overview — 3. Where to go next\n\n| Goal | Book |\n|---|---|\n| Runtime shape | Architecture (`01-architecture`) |\n| Lease / broker / admin | HTTP API (`02-http-api`) |\n| Schemes and secrets | Providers and Secrets (`03-providers-and-secrets`) |\n| Invariants | Security Model (`04-security`) |\n| Deploy | Production Hardening (`05-production`) |\n| MPS / pipelines | Memorix Integration (`06-memorix-integration`) |\n\n## Also see\n\n- **Architecture** (`01-architecture`) — Service components, profile resolution, cache identity, lease vs broker, and extension seams.\n- **HTTP API** (`02-http-api`) — Health, metadata, leases, broker, token-state ingest, and administration routes.\n\n---\n\n_Generated use-case pack for agents and humans. See `agent-manifest.json` for discovery._\n"
|
|
737
|
+
};
|
|
738
|
+
//# sourceMappingURL=bundle.js.map
|