@x12i/memorix-service 3.2.1 → 3.4.0

package/README.md

@@ -7,7 +7,7 @@ Remote apps should **call** this service over HTTP — not reinvent wiring by in
 ## Install / run
 
 ```bash
-npm install @x12i/memorix-service@3.0.3   # composition library / CLI
+npm install @x12i/memorix-service@3.4.0   # composition library / CLI
 ```
 
 Prefer the monorepo stack (service + Studio + opx-source):
@@ -33,6 +33,51 @@ MEMORIX_SERVICE_MODE=dev npm run dev   # metadata in-memory; durable routes 503
 
 Compliance: this process uses **`@x12i/core-service`** (zone port, health, live view, correlation-id).
 
+## Dual-mode org blob plane (cloud / on-prem)
+
+Not Magit. When storing **org/connector object payloads** that would use cloud buckets,
+on-prem must use **local disk**.
+
+| Env | Effect |
+|-----|--------|
+| `MEMORIX_BLOB_BACKEND` | `disk` / `onprem` (default) or `s3` / `cloud` |
+| `MEMORIX_BLOB_ROOT` | Disk root for on-prem (default `.memorix-blobs`) |
+| `MEMORIX_S3_BUCKET` | Required when backend=`s3` |
+| `MEMORIX_RESTRICTED_KEK` | Optional AES-GCM KEK for disk-encrypted restricted bodies |
+
+Used by **`/api/restricted-store/v1`** (FG-A3). See
+[restricted-store.md](../docs/connector-framework/restricted-store.md) and
+[integration-registry.md](../docs/connector-framework/integration-registry.md).
+
+## Magit package catalog
+
+Default-on when durable Mongo is configured (`METADATA_MAGIT=0` disables).
+
+| Mode | Config |
+|------|--------|
+| **A typed store** | `MAGIT_PACKAGE_STORE_SELECTOR` + `MAGIT_PACKAGE_TYPE_ID` |
+| **B flat catalog** | both unset |
+
+Requires `@x12i/magit@2.14.0`. Defaults: `MAGIT_CATALOG_TENANT=x12i`, `MAGIT_CATALOG_REPO=memorix`.
+
+Ops (provision / verify / recover / channels / smoke): see
+[documentation/magit-typed-store-runbook.md](../documentation/magit-typed-store-runbook.md).
+
+```bash
+npm run catalog:provision -- --out /secure/magit-store.env --confirm-allowed-kinds
+npm run catalog:verify
+npm run catalog:recover -- --store-id st_… --out /secure/magit-store.env
+npm run catalog:list
+npm run magit:cross-env-smoke
+npm run magit:cross-env-smoke -- --publish
+```
+
+**Owner mint:** repo `memorix`, Package stores **empty** until the store exists.  
+**Consumer:** store grant + `repoIds: []` (Repositories unchecked).  
+Channels and release sets need Mode A + publisher token to promote; consumers only resolve.
+
+Env examples: [memorix-service/.env.example](./.env.example). Selector never appears in Studio or `GET /api/diagnostics/scope`.
+
 ## Library exports
 
 When embedding the composition root in-process:
@@ -83,8 +128,21 @@ curl -s http://127.0.0.1:5100/api/diagnostics/scope \
 ### AI-services companions
 
 Point memorix-service at FR-compliant processes via env (`FUNCX_URL`, `AI_SKILLS_URL`, `AI_TASKS_URL`, `GRAPH_ENGINE_URL`).  
-Stack: `AI_SERVICES=1 node scripts/dev-stack.mjs` or `--ai-services`.  
-Ops: [`.operational/ai-services-get-started.md`](../.operational/ai-services-get-started.md).
+Stack: AI companions are **on by default**; skip with `--no-ai-services` or `AI_SERVICES=0`.
+
+### Vendor pipeline workers (opt-in)
+
+Archetype-A HTTP companions invoke via `POST {origin}/pipeline`. Inject **base origin only** (no `/pipeline` path). Soft-skip when URL unset; fail-closed when set (`src/optional-companion-url.ts`).
+
+| Suite | Stack flag | Client env |
+|-------|------------|------------|
+| Exellix Apollo + M365 | `--exellix-connectors` / `EXELLIX_CONNECTORS=1` | `EXELLIX_APOLLO_READ_URL`, `EXELLIX_APOLLO_ACTIONS_URL`, `EXELLIX_M365_USER_READ_URL`, `EXELLIX_M365_USER_ACTION_URL` (ports 9711–9722, zone `exellix-connectors`) |
+| Neo security workers | `--neo-connectors` / `NEO_CONNECTORS=1` | `NEO_FIREWALL_URL`, `NEO_XDR_URL`, `NEO_NESSUS_URL`, `NEO_ENTRA_URL`, `NEO_SPLUNK_URL`, `NEO_CROWDSTRIKE_URL` (frozen ports; no zone remap) |
+| Neo status UI | `--neo-status-ui` / `NEO_STATUS_UI=1` | `NEO_STATUS_UI_URL` (:9001) |
+
+Optional hard gates: `EXELLIX_CONNECTORS_REQUIRED=1`, `NEO_CONNECTORS_REQUIRED=1`.
+
+**Neo packages** ship on GitHub Packages. Local install needs `.npmrc` scope + `NODE_AUTH_TOKEN` (see [`.npmrc.example`](../.npmrc.example)).
 
 ### Memory (operator + called-service)
 

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAIxD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAsBvB,MAAM,MAAM,8BAA8B,GAAG,YAAY,GAAG;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAuF5E;AAED,MAAM,MAAM,0BAA0B,GAAG,8BAA8B,GAAG;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B;;;;;GAM7E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAIxD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AA0BvB,MAAM,MAAM,8BAA8B,GAAG,YAAY,GAAG;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA2F5E;AAED,MAAM,MAAM,0BAA0B,GAAG,8BAA8B,GAAG;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B;;;;;GAM7E"}

package/dist/app.js

@@ -9,10 +9,14 @@ import { mapErrorToHttp, redactSecrets } from "./errors.js";
 import { createMemorixPlatform, } from "./platform.js";
 import { resolveScope } from "./request-scope.js";
 import { registerMetadataRoutes } from "./routes/metadata.js";
+import { registerCatalogRoutes } from "./routes/catalog.js";
 import { registerDataRoutes } from "./routes/data.js";
 import { registerRelationshipRoutes } from "./routes/relationships.js";
 import { registerMemoryRoutes } from "./routes/memory.js";
 import { registerConnectorInvocationRoutes } from "./routes/connector-invocations.js";
+import { registerConnectorOpsRoutes } from "./routes/connector-ops.js";
+import { registerIntegrationRoutes } from "./routes/integrations.js";
+import { registerRestrictedStoreRoutes } from "./routes/restricted-store.js";
 import { registerPipelineRoutes } from "./routes/pipelines.js";
 import { registerJobsRoutes } from "./routes/jobs.js";
 import { registerOperationsRoutes } from "./routes/operations.js";
@@ -88,10 +92,14 @@ export async function createMemorixServiceApp(opts) {
     });
     registerSimulationRoutes(app, simulation);
     await registerMetadataRoutes(app, platform);
+    await registerCatalogRoutes(app, platform);
     await registerDataRoutes(app, platform);
     await registerRelationshipRoutes(app, platform);
     await registerMemoryRoutes(app, platform);
     await registerConnectorInvocationRoutes(app, platform);
+    await registerConnectorOpsRoutes(app, platform);
+    await registerIntegrationRoutes(app, platform);
+    await registerRestrictedStoreRoutes(app, platform);
     await registerPipelineRoutes(app, platform);
     await registerJobsRoutes(app, platform);
     await registerOperationsRoutes(app, platform);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAE5E,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAO1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAY,EAAE;QACjD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE;YACR,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,mBAAmB;YAC7B,WAAW,EAAE,4BAA4B;SAC1C;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE;oBACV,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB;aACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,aAAa,GAChB,GAAkC,CAAC,aAAa,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAA6B,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI;gBACP,UAAU,EAAE,iCAAiC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1D,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,iCAAiC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE9C,iFAAiF;IACjF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAErD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAgC;IAC5E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAE5E,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAO1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAY,EAAE;QACjD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE;YACR,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,mBAAmB;YAC7B,WAAW,EAAE,4BAA4B;SAC1C;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,uBAAuB;gBAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE;oBACV,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB;aACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,aAAa,GAChB,GAAkC,CAAC,aAAa,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAA6B,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI;gBACP,UAAU,EAAE,iCAAiC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1D,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,iCAAiC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE9C,iFAAiF;IACjF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAErD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAgC;IAC5E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/blob-store/config.d.ts

@@ -0,0 +1,31 @@
+import { type S3BlobClient } from "./s3.js";
+import type { BlobBackendKind, BlobObjectStore } from "./types.js";
+export type BlobStoreConfig = {
+    backend: BlobBackendKind;
+    /** disk root (absolute). */
+    rootDir?: string;
+    s3Bucket?: string;
+    s3Prefix?: string;
+    s3Sse?: "AES256" | "aws:kms" | false;
+    s3KmsKeyId?: string;
+};
+/**
+ * Resolve blob backend from env.
+ * - disk (default / on-prem): local filesystem
+ * - s3 (cloud): S3-compatible bucket required
+ * - memory: tests / explicit only
+ */
+export declare function resolveBlobStoreConfig(env?: NodeJS.ProcessEnv): BlobStoreConfig;
+export type CreatePlatformBlobStoreOptions = {
+    env?: NodeJS.ProcessEnv;
+    /** Inject S3 client (tests). */
+    s3Client?: S3BlobClient;
+    /** Force memory backend (unit tests). */
+    forceMemory?: boolean;
+};
+/**
+ * Create the process-wide BlobObjectStore used by restricted store bodies.
+ * Fail-closed: s3 without bucket throws.
+ */
+export declare function createPlatformBlobStore(opts?: CreatePlatformBlobStoreOptions): Promise<BlobObjectStore>;
+//# sourceMappingURL=config.d.ts.map

package/dist/blob-store/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/blob-store/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAgCjB;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,yCAAyC;IACzC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,eAAe,CAAC,CA2B1B"}

package/dist/blob-store/config.js

@@ -0,0 +1,68 @@
+import { resolve } from "node:path";
+import { createDiskBlobStore } from "./disk.js";
+import { createMemoryBlobStore } from "./memory.js";
+import { createAwsS3BlobClientFromEnv, createS3BlobStore, } from "./s3.js";
+/**
+ * Resolve blob backend from env.
+ * - disk (default / on-prem): local filesystem
+ * - s3 (cloud): S3-compatible bucket required
+ * - memory: tests / explicit only
+ */
+export function resolveBlobStoreConfig(env = process.env) {
+    const raw = (env.MEMORIX_BLOB_BACKEND ?? "disk").trim().toLowerCase();
+    let backend;
+    if (raw === "s3" || raw === "cloud")
+        backend = "s3";
+    else if (raw === "memory")
+        backend = "memory";
+    else if (raw === "disk" || raw === "onprem" || raw === "on-prem")
+        backend = "disk";
+    else {
+        throw new Error(`MEMORIX_BLOB_BACKEND must be s3|disk|memory (or cloud|onprem), got "${raw}"`);
+    }
+    const rootDir = resolve(env.MEMORIX_BLOB_ROOT?.trim() || resolve(process.cwd(), ".memorix-blobs"));
+    const s3SseRaw = env.MEMORIX_S3_SSE?.trim();
+    let s3Sse = "AES256";
+    if (s3SseRaw === "0" || s3SseRaw === "false" || s3SseRaw === "none") {
+        s3Sse = false;
+    }
+    else if (s3SseRaw === "aws:kms" || s3SseRaw === "kms") {
+        s3Sse = "aws:kms";
+    }
+    return {
+        backend,
+        rootDir,
+        s3Bucket: env.MEMORIX_S3_BUCKET?.trim() || undefined,
+        s3Prefix: env.MEMORIX_S3_PREFIX?.trim() || "memorix",
+        s3Sse,
+        s3KmsKeyId: env.MEMORIX_S3_KMS_KEY_ID?.trim() || undefined,
+    };
+}
+/**
+ * Create the process-wide BlobObjectStore used by restricted store bodies.
+ * Fail-closed: s3 without bucket throws.
+ */
+export async function createPlatformBlobStore(opts = {}) {
+    if (opts.forceMemory)
+        return createMemoryBlobStore();
+    const env = opts.env ?? process.env;
+    const cfg = resolveBlobStoreConfig(env);
+    if (cfg.backend === "memory")
+        return createMemoryBlobStore();
+    if (cfg.backend === "disk") {
+        return createDiskBlobStore({ rootDir: cfg.rootDir });
+    }
+    // s3
+    if (!cfg.s3Bucket) {
+        throw new Error("MEMORIX_BLOB_BACKEND=s3 requires MEMORIX_S3_BUCKET (cloud object store)");
+    }
+    const client = opts.s3Client ?? (await createAwsS3BlobClientFromEnv(env));
+    return createS3BlobStore({
+        bucket: cfg.s3Bucket,
+        prefix: cfg.s3Prefix,
+        client,
+        serverSideEncryption: cfg.s3Sse,
+        sseKmsKeyId: cfg.s3KmsKeyId,
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/blob-store/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/blob-store/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAElB,MAAM,SAAS,CAAC;AAajB;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,OAAwB,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,IAAI,CAAC;SAC/C,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,QAAQ,CAAC;SACzC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,CAAC;SAC9E,CAAC;QACJ,MAAM,IAAI,KAAK,CACb,uEAAuE,GAAG,GAAG,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CACrB,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAC1E,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,GAAiC,QAAQ,CAAC;IACnD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpE,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACxD,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;QACpD,QAAQ,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;QACpD,KAAK;QACL,UAAU,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS;KAC3D,CAAC;AACJ,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC,EAAE;IAEzC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,qBAAqB,EAAE,CAAC;IAErD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,qBAAqB,EAAE,CAAC;IAE7D,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,mBAAmB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK;IACL,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,QAAQ;QACpB,MAAM,EAAE,GAAG,CAAC,QAAQ;QACpB,MAAM;QACN,oBAAoB,EAAE,GAAG,CAAC,KAAK;QAC/B,WAAW,EAAE,GAAG,CAAC,UAAU;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/blob-store/disk.d.ts

@@ -0,0 +1,10 @@
+import { type BlobObjectStore } from "./types.js";
+export type DiskBlobStoreOptions = {
+    rootDir: string;
+};
+/**
+ * On-prem object store: `{root}/{orgId}/{key...}`.
+ * Atomic write via tmp + rename. Never walks outside root.
+ */
+export declare function createDiskBlobStore(opts: DiskBlobStoreOptions): BlobObjectStore;
+//# sourceMappingURL=disk.d.ts.map

package/dist/blob-store/disk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disk.d.ts","sourceRoot":"","sources":["../../src/blob-store/disk.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAcF;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,oBAAoB,GACzB,eAAe,CAgFjB"}

package/dist/blob-store/disk.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, stat, unlink, writeFile, } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import { assertSafeBlobKey, assertSafeOrgId, } from "./types.js";
+function resolveObjectPath(rootDir, orgId, key) {
+    const org = assertSafeOrgId(orgId);
+    const safeKey = assertSafeBlobKey(key);
+    const root = resolve(rootDir);
+    const full = resolve(join(root, org, ...safeKey.split("/")));
+    const prefix = root.endsWith(sep) ? root : root + sep;
+    if (full !== root && !full.startsWith(prefix)) {
+        throw new Error("blob path escape rejected");
+    }
+    return full;
+}
+/**
+ * On-prem object store: `{root}/{orgId}/{key...}`.
+ * Atomic write via tmp + rename. Never walks outside root.
+ */
+export function createDiskBlobStore(opts) {
+    const rootDir = resolve(opts.rootDir);
+    return {
+        backend: "disk",
+        async put(orgId, key, body, putOpts) {
+            const path = resolveObjectPath(rootDir, orgId, key);
+            await mkdir(dirname(path), { recursive: true });
+            const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+            await writeFile(tmp, body);
+            await rename(tmp, path);
+            const contentType = putOpts?.contentType;
+            if (contentType) {
+                await writeFile(`${path}.meta.json`, JSON.stringify({ contentType }), "utf8");
+            }
+            const digest = createHash("sha256").update(body).digest("hex");
+            return {
+                backend: "disk",
+                orgId: assertSafeOrgId(orgId),
+                key: assertSafeBlobKey(key),
+                sizeBytes: body.byteLength,
+                contentType,
+                etag: `sha256:${digest}`,
+            };
+        },
+        async get(orgId, key) {
+            const path = resolveObjectPath(rootDir, orgId, key);
+            try {
+                return await readFile(path);
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    return null;
+                throw err;
+            }
+        },
+        async head(orgId, key) {
+            const path = resolveObjectPath(rootDir, orgId, key);
+            try {
+                const st = await stat(path);
+                let contentType;
+                try {
+                    const metaRaw = await readFile(`${path}.meta.json`, "utf8");
+                    const meta = JSON.parse(metaRaw);
+                    contentType = meta.contentType;
+                }
+                catch {
+                    /* no meta */
+                }
+                const buf = await readFile(path);
+                const digest = createHash("sha256").update(buf).digest("hex");
+                return {
+                    orgId: assertSafeOrgId(orgId),
+                    key: assertSafeBlobKey(key),
+                    sizeBytes: st.size,
+                    contentType,
+                    etag: `sha256:${digest}`,
+                };
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    return null;
+                throw err;
+            }
+        },
+        async delete(orgId, key) {
+            const path = resolveObjectPath(rootDir, orgId, key);
+            try {
+                await unlink(path);
+                try {
+                    await unlink(`${path}.meta.json`);
+                }
+                catch {
+                    /* ignore meta */
+                }
+                return true;
+            }
+            catch (err) {
+                if (err.code === "ENOENT")
+                    return false;
+                throw err;
+            }
+        },
+    };
+}
+//# sourceMappingURL=disk.js.map

package/dist/blob-store/disk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disk.js","sourceRoot":"","sources":["../../src/blob-store/disk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,MAAM,EACN,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EACL,iBAAiB,EACjB,eAAe,GAIhB,MAAM,YAAY,CAAC;AAMpB,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa,EAAE,GAAW;IACpE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA0B;IAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtC,OAAO;QACL,OAAO,EAAE,MAAM;QAEf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO;YACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;YACvD,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;YACzC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,IAAI,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,WAAW;gBACX,IAAI,EAAE,UAAU,MAAM,EAAE;aACD,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG;YAClB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAClE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG;YACnB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,IAAI,WAA+B,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6B,CAAC;oBAC7D,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa;gBACf,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,OAAO;oBACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;oBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;oBAC3B,SAAS,EAAE,EAAE,CAAC,IAAI;oBAClB,WAAW;oBACX,IAAI,EAAE,UAAU,MAAM,EAAE;iBACN,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAClE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG;YACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBACnE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/blob-store/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./types.js";
+export { createDiskBlobStore } from "./disk.js";
+export { createMemoryBlobStore } from "./memory.js";
+export { createS3BlobStore, createAwsS3BlobClientFromEnv, type S3BlobClient, type S3BlobStoreOptions, } from "./s3.js";
+export { resolveBlobStoreConfig, createPlatformBlobStore, type BlobStoreConfig, type CreatePlatformBlobStoreOptions, } from "./config.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/blob-store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blob-store/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,8BAA8B,GACpC,MAAM,aAAa,CAAC"}

package/dist/blob-store/index.js

@@ -0,0 +1,6 @@
+export * from "./types.js";
+export { createDiskBlobStore } from "./disk.js";
+export { createMemoryBlobStore } from "./memory.js";
+export { createS3BlobStore, createAwsS3BlobClientFromEnv, } from "./s3.js";
+export { resolveBlobStoreConfig, createPlatformBlobStore, } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/blob-store/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/blob-store/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,4BAA4B,GAG7B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,aAAa,CAAC"}

package/dist/blob-store/memory.d.ts

@@ -0,0 +1,4 @@
+import { type BlobObjectStore } from "./types.js";
+/** In-process blob store for unit tests and no-mongo dev. */
+export declare function createMemoryBlobStore(): BlobObjectStore;
+//# sourceMappingURL=memory.d.ts.map

package/dist/blob-store/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/blob-store/memory.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,YAAY,CAAC;AAOpB,6DAA6D;AAC7D,wBAAgB,qBAAqB,IAAI,eAAe,CAgDvD"}

package/dist/blob-store/memory.js

@@ -0,0 +1,47 @@
+import { createHash } from "node:crypto";
+import { assertSafeBlobKey, assertSafeOrgId, } from "./types.js";
+/** In-process blob store for unit tests and no-mongo dev. */
+export function createMemoryBlobStore() {
+    const map = new Map();
+    const id = (orgId, key) => `${assertSafeOrgId(orgId)}\0${assertSafeBlobKey(key)}`;
+    return {
+        backend: "memory",
+        async put(orgId, key, body, opts) {
+            const k = id(orgId, key);
+            map.set(k, {
+                body: Buffer.from(body),
+                contentType: opts?.contentType,
+            });
+            const digest = createHash("sha256").update(body).digest("hex");
+            return {
+                backend: "memory",
+                orgId: assertSafeOrgId(orgId),
+                key: assertSafeBlobKey(key),
+                sizeBytes: body.byteLength,
+                contentType: opts?.contentType,
+                etag: `sha256:${digest}`,
+            };
+        },
+        async get(orgId, key) {
+            const e = map.get(id(orgId, key));
+            return e ? Buffer.from(e.body) : null;
+        },
+        async head(orgId, key) {
+            const e = map.get(id(orgId, key));
+            if (!e)
+                return null;
+            const digest = createHash("sha256").update(e.body).digest("hex");
+            return {
+                orgId: assertSafeOrgId(orgId),
+                key: assertSafeBlobKey(key),
+                sizeBytes: e.body.byteLength,
+                contentType: e.contentType,
+                etag: `sha256:${digest}`,
+            };
+        },
+        async delete(orgId, key) {
+            return map.delete(id(orgId, key));
+        },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/dist/blob-store/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/blob-store/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,eAAe,GAGhB,MAAM,YAAY,CAAC;AAOpB,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IAErC,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CACxC,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,QAAQ;QAEjB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE;gBACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvB,WAAW,EAAE,IAAI,EAAE,WAAW;aAC/B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,WAAW,EAAE,IAAI,EAAE,WAAW;gBAC9B,IAAI,EAAE,UAAU,MAAM,EAAE;aACD,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG;YAClB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG;YACnB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjE,OAAO;gBACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU;gBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,IAAI,EAAE,UAAU,MAAM,EAAE;aACzB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG;YACrB,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/blob-store/s3.d.ts

@@ -0,0 +1,52 @@
+import { type BlobObjectStore } from "./types.js";
+/** Minimal S3 client surface so tests can inject mocks without network. */
+export type S3BlobClient = {
+    putObject(input: {
+        Bucket: string;
+        Key: string;
+        Body: Buffer;
+        ContentType?: string;
+        ServerSideEncryption?: string;
+        SSEKMSKeyId?: string;
+    }): Promise<{
+        ETag?: string;
+    }>;
+    getObject(input: {
+        Bucket: string;
+        Key: string;
+    }): Promise<{
+        Body?: Uint8Array | Buffer | null;
+        ContentType?: string;
+    } | null>;
+    headObject(input: {
+        Bucket: string;
+        Key: string;
+    }): Promise<{
+        ContentLength?: number;
+        ContentType?: string;
+        ETag?: string;
+    } | null>;
+    deleteObject(input: {
+        Bucket: string;
+        Key: string;
+    }): Promise<void>;
+};
+export type S3BlobStoreOptions = {
+    bucket: string;
+    /** Optional key prefix (no leading/trailing slash required). */
+    prefix?: string;
+    client: S3BlobClient;
+    /** Default AES256 (SSE-S3). Set false to disable. */
+    serverSideEncryption?: "AES256" | "aws:kms" | false;
+    sseKmsKeyId?: string;
+};
+/**
+ * Cloud object store (S3-compatible). Bodies never touch local disk.
+ * Pass a real AWS SDK client or a test double via `client`.
+ */
+export declare function createS3BlobStore(opts: S3BlobStoreOptions): BlobObjectStore;
+/**
+ * Build SDK client from env when backend=s3. Lazy-imports @aws-sdk/client-s3.
+ */
+export declare function createAwsS3BlobClientFromEnv(env?: NodeJS.ProcessEnv): Promise<S3BlobClient>;
+//# sourceMappingURL=s3.d.ts.map

package/dist/blob-store/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/blob-store/s3.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,eAAe,EAErB,MAAM,YAAY,CAAC;AAEpB,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,KAAK,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/B,SAAS,CAAC,KAAK,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAChF,UAAU,CAAC,KAAK,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAUF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAqE3E;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,YAAY,CAAC,CAqEvB"}