@x12i/memorix-service 3.2.1 → 3.4.0

package/dist/restricted-store/crypto.js

@@ -0,0 +1,43 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+/**
+ * Optional on-prem field encryption for restricted bodies.
+ * KEK: 32 raw bytes as base64, or 64 hex chars.
+ */
+export function parseRestrictedKek(raw) {
+    if (!raw?.trim())
+        return null;
+    const s = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(s)) {
+        return Buffer.from(s, "hex");
+    }
+    const buf = Buffer.from(s, "base64");
+    if (buf.byteLength !== 32) {
+        throw new Error("MEMORIX_RESTRICTED_KEK must be 32-byte key (base64) or 64 hex chars");
+    }
+    return buf;
+}
+/** Envelope: v1 | iv(12) | tag(16) | ciphertext */
+export function encryptRestrictedBody(plain, kek) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", kek, iv);
+    const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([Buffer.from([1]), iv, tag, ciphertext]);
+}
+export function decryptRestrictedBody(blob, kek) {
+    if (blob.byteLength < 1 + 12 + 16) {
+        throw new Error("encrypted body too short");
+    }
+    if (blob[0] !== 1)
+        throw new Error("unsupported restricted envelope version");
+    const iv = blob.subarray(1, 13);
+    const tag = blob.subarray(13, 29);
+    const ciphertext = blob.subarray(29);
+    const decipher = createDecipheriv("aes-256-gcm", kek, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+export function sha256Hex(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+//# sourceMappingURL=crypto.js.map

package/dist/restricted-store/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/restricted-store/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA8B;IAE9B,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,GAAW;IAC9D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,GAAW;IAC7D,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}

package/dist/restricted-store/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export { parseRestrictedKek, encryptRestrictedBody, decryptRestrictedBody, sha256Hex, } from "./crypto.js";
+export { createInMemoryRestrictedObjectStore, createMongoRestrictedObjectStore, } from "./object-store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/restricted-store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/restricted-store/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC"}

package/dist/restricted-store/index.js

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export { parseRestrictedKek, encryptRestrictedBody, decryptRestrictedBody, sha256Hex, } from "./crypto.js";
+export { createInMemoryRestrictedObjectStore, createMongoRestrictedObjectStore, } from "./object-store.js";
+//# sourceMappingURL=index.js.map

package/dist/restricted-store/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/restricted-store/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC"}

package/dist/restricted-store/object-store.d.ts

@@ -0,0 +1,12 @@
+import type { MongoClient } from "mongodb";
+import type { BlobObjectStore } from "../blob-store/types.js";
+import { type RestrictedObjectStore } from "./types.js";
+export declare function createInMemoryRestrictedObjectStore(orgId: string, blobs: BlobObjectStore, opts?: {
+    kek?: Buffer | null;
+    kekEnv?: string;
+}): RestrictedObjectStore;
+export declare function createMongoRestrictedObjectStore(client: MongoClient, orgId: string, blobs: BlobObjectStore, opts?: {
+    kek?: Buffer | null;
+    kekEnv?: string;
+}): RestrictedObjectStore;
+//# sourceMappingURL=object-store.d.ts.map

package/dist/restricted-store/object-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store.d.ts","sourceRoot":"","sources":["../../src/restricted-store/object-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EAKL,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AAoLpB,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,qBAAqB,CAiCvB;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,EACtB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C,qBAAqB,CAoDvB"}

package/dist/restricted-store/object-store.js

@@ -0,0 +1,233 @@
+import { randomUUID } from "node:crypto";
+import { decryptRestrictedBody, encryptRestrictedBody, parseRestrictedKek, sha256Hex, } from "./crypto.js";
+import { RESTRICTED_COLLECTIONS, } from "./types.js";
+function operationalDbName(orgId) {
+    return `${orgId}_operational`;
+}
+function assertClassification(raw) {
+    if (raw === "restricted" || raw === "config-backup")
+        return raw;
+    throw new Error("classification must be restricted|config-backup");
+}
+function createStoreCore(orgId, blobs, kek, meta) {
+    return {
+        async put(input) {
+            const classification = assertClassification(input.classification);
+            if (!input.bodyBase64?.trim()) {
+                throw new Error("bodyBase64 required");
+            }
+            let plain;
+            try {
+                plain = Buffer.from(input.bodyBase64, "base64");
+            }
+            catch {
+                throw new Error("bodyBase64 invalid");
+            }
+            if (plain.byteLength === 0)
+                throw new Error("body empty");
+            const contentHash = sha256Hex(plain);
+            const objectId = input.objectId?.trim() || `rso_${randomUUID().replace(/-/g, "").slice(0, 24)}`;
+            const blobKey = `restricted/${objectId}`;
+            let storeBody = plain;
+            let encryptedAtRest = false;
+            if (kek) {
+                storeBody = encryptRestrictedBody(plain, kek);
+                encryptedAtRest = true;
+            }
+            await blobs.put(orgId, blobKey, storeBody, {
+                contentType: input.contentType ?? "application/octet-stream",
+            });
+            const now = new Date().toISOString();
+            const doc = {
+                orgId,
+                objectId,
+                classification,
+                contentHash,
+                sizeBytes: plain.byteLength,
+                blobKey,
+                blobBackend: blobs.backend,
+                encryptedAtRest,
+                createdAt: now,
+                ...(input.deviceId != null ? { deviceId: String(input.deviceId) } : {}),
+                ...(input.vdom != null ? { vdom: String(input.vdom) } : {}),
+                ...(input.sourceRunId != null
+                    ? { sourceRunId: String(input.sourceRunId) }
+                    : {}),
+                ...(input.contentType != null
+                    ? { contentType: String(input.contentType) }
+                    : {}),
+                ...(input.version != null ? { version: String(input.version) } : {}),
+                ...(input.createdBy != null ? { createdBy: String(input.createdBy) } : {}),
+                ...(input.retainUntil !== undefined
+                    ? { retainUntil: input.retainUntil }
+                    : {}),
+            };
+            await meta.upsert(doc);
+            await meta.insertAudit({
+                auditId: randomUUID(),
+                orgId,
+                objectId,
+                contentHash,
+                at: now,
+                actor: input.createdBy,
+                action: "put",
+            });
+            return doc;
+        },
+        async getMeta(objectId) {
+            return meta.get(objectId);
+        },
+        async getContent(objectId) {
+            const m = await meta.get(objectId);
+            if (!m)
+                return null;
+            const raw = await blobs.get(orgId, m.blobKey);
+            if (!raw)
+                return null;
+            let body = raw;
+            if (m.encryptedAtRest) {
+                if (!kek) {
+                    throw new Error("restricted body is encrypted but MEMORIX_RESTRICTED_KEK is not configured");
+                }
+                body = decryptRestrictedBody(raw, kek);
+            }
+            const hash = sha256Hex(body);
+            if (hash !== m.contentHash) {
+                throw new Error("restricted body contentHash mismatch");
+            }
+            return { meta: m, body };
+        },
+        async delete(objectId) {
+            const m = await meta.get(objectId);
+            if (!m)
+                return false;
+            await blobs.delete(orgId, m.blobKey);
+            await meta.delete(objectId);
+            await meta.insertAudit({
+                auditId: randomUUID(),
+                orgId,
+                objectId,
+                contentHash: m.contentHash,
+                at: new Date().toISOString(),
+                action: "delete",
+            });
+            return true;
+        },
+        async purgeExpired(now = new Date()) {
+            const all = await meta.list();
+            const iso = now.toISOString();
+            let n = 0;
+            for (const m of all) {
+                if (m.retainUntil && m.retainUntil <= iso) {
+                    await blobs.delete(orgId, m.blobKey);
+                    await meta.delete(m.objectId);
+                    await meta.insertAudit({
+                        auditId: randomUUID(),
+                        orgId,
+                        objectId: m.objectId,
+                        contentHash: m.contentHash,
+                        at: iso,
+                        action: "purge",
+                    });
+                    n += 1;
+                }
+            }
+            return n;
+        },
+        async recordAccessAudit(entry) {
+            const row = {
+                auditId: randomUUID(),
+                orgId,
+                objectId: entry.objectId,
+                contentHash: entry.contentHash,
+                at: entry.at ?? new Date().toISOString(),
+                actor: entry.actor,
+                reason: entry.reason,
+                action: entry.action,
+            };
+            await meta.insertAudit(row);
+            return row;
+        },
+        async listAccessAudits(opts) {
+            return meta.listAudits(opts);
+        },
+    };
+}
+export function createInMemoryRestrictedObjectStore(orgId, blobs, opts) {
+    const map = new Map();
+    const audits = [];
+    const kek = opts?.kek !== undefined
+        ? opts.kek
+        : parseRestrictedKek(opts?.kekEnv);
+    return createStoreCore(orgId, blobs, kek, {
+        async get(objectId) {
+            return map.get(objectId) ?? null;
+        },
+        async upsert(doc) {
+            map.set(doc.objectId, doc);
+        },
+        async delete(objectId) {
+            return map.delete(objectId);
+        },
+        async list() {
+            return [...map.values()];
+        },
+        async insertAudit(row) {
+            audits.unshift(row);
+        },
+        async listAudits(opts) {
+            let rows = audits;
+            if (opts?.objectId) {
+                rows = rows.filter((a) => a.objectId === opts.objectId);
+            }
+            const limit = Math.min(Math.max(opts?.limit ?? 50, 1), 200);
+            return rows.slice(0, limit);
+        },
+    });
+}
+export function createMongoRestrictedObjectStore(client, orgId, blobs, opts) {
+    const db = client.db(operationalDbName(orgId));
+    const col = db.collection(RESTRICTED_COLLECTIONS.objects);
+    const auditCol = db.collection(RESTRICTED_COLLECTIONS.audits);
+    const kek = opts?.kek !== undefined
+        ? opts.kek
+        : parseRestrictedKek(opts?.kekEnv ?? process.env.MEMORIX_RESTRICTED_KEK);
+    return createStoreCore(orgId, blobs, kek, {
+        async get(objectId) {
+            const doc = await col.findOne({ orgId, objectId });
+            if (!doc)
+                return null;
+            const { _id: _d, ...rest } = doc;
+            return rest;
+        },
+        async upsert(doc) {
+            await col.replaceOne({ orgId, objectId: doc.objectId }, doc, {
+                upsert: true,
+            });
+        },
+        async delete(objectId) {
+            const r = await col.deleteOne({ orgId, objectId });
+            return r.deletedCount > 0;
+        },
+        async list() {
+            const rows = await col.find({ orgId }).toArray();
+            return rows.map(({ _id: _d, ...rest }) => rest);
+        },
+        async insertAudit(row) {
+            await auditCol.insertOne(row);
+        },
+        async listAudits(opts) {
+            const filter = { orgId };
+            if (opts?.objectId)
+                filter.objectId = opts.objectId;
+            const limit = Math.min(Math.max(opts?.limit ?? 50, 1), 200);
+            const rows = await auditCol
+                .find(filter)
+                .sort({ at: -1 })
+                .limit(limit)
+                .toArray();
+            return rows.map(({ _id: _d, ...rest }) => rest);
+        },
+    });
+}
+//# sourceMappingURL=object-store.js.map

package/dist/restricted-store/object-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store.js","sourceRoot":"","sources":["../../src/restricted-store/object-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,GAMvB,MAAM,YAAY,CAAC;AAEpB,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,GAAG,KAAK,cAAc,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW;IAEX,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,eAAe;QAAE,OAAO,GAAG,CAAC;IAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CACtB,KAAa,EACb,KAAsB,EACtB,GAAkB,EAClB,IAUC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAK;YACb,MAAM,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAE1D,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,cAAc,QAAQ,EAAE,CAAC;YACzC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IAAI,GAAG,EAAE,CAAC;gBACR,SAAS,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9C,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;YAED,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,0BAA0B;aAC7D,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAyB;gBAChC,KAAK;gBACL,QAAQ;gBACR,cAAc;gBACd,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,OAAO;gBACP,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,eAAe;gBACf,SAAS,EAAE,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI;oBAC3B,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;oBAC5C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI;oBAC3B,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;oBAC5C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;oBACpC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,UAAU,EAAE;gBACrB,KAAK;gBACL,QAAQ;gBACR,WAAW;gBACX,EAAE,EAAE,GAAG;gBACP,KAAK,EAAE,KAAK,CAAC,SAAS;gBACtB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,IAAI,GAAG,GAAG,CAAC;YACf,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,OAAO,EAAE,UAAU,EAAE;gBACrB,KAAK;gBACL,QAAQ;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;oBACrC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;oBAC9B,MAAM,IAAI,CAAC,WAAW,CAAC;wBACrB,OAAO,EAAE,UAAU,EAAE;wBACrB,KAAK;wBACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;wBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,EAAE,EAAE,GAAG;wBACP,MAAM,EAAE,OAAO;qBAChB,CAAC,CAAC;oBACH,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAAK;YAC3B,MAAM,GAAG,GAA0B;gBACjC,OAAO,EAAE,UAAU,EAAE;gBACrB,KAAK;gBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACxC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,IAAI;YACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAa,EACb,KAAsB,EACtB,IAA+C;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,GAAG,GACP,IAAI,EAAE,GAAG,KAAK,SAAS;QACrB,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEvC,OAAO,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;QACxC,KAAK,CAAC,GAAG,CAAC,QAAQ;YAChB,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,IAAI;YACR,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG;YACnB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,IAAI,IAAI,GAAG,MAAM,CAAC;YAClB,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACnB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAmB,EACnB,KAAa,EACb,KAAsB,EACtB,IAA+C;IAE/C,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CACvB,sBAAsB,CAAC,OAAO,CAC/B,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAC5B,sBAAsB,CAAC,MAAM,CAC9B,CAAC;IACF,MAAM,GAAG,GACP,IAAI,EAAE,GAAG,KAAK,SAAS;QACrB,CAAC,CAAC,IAAI,CAAC,GAAG;QACV,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAE7E,OAAO,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE;QACxC,KAAK,CAAC,GAAG,CAAC,QAAQ;YAChB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAE5B,CAAC;YACF,OAAO,IAA4B,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE;gBAC3D,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAA4B,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,GAAG;YACnB,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,MAAM,GAA4B,EAAE,KAAK,EAAE,CAAC;YAClD,IAAI,IAAI,EAAE,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YACpD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ;iBACxB,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;iBAChB,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAA6B,CACxD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/restricted-store/types.d.ts

@@ -0,0 +1,78 @@
+/**
+ * FG-A3 restricted / encrypted object store.
+ * Metadata (redacted) in Mongo; full body only in BlobObjectStore (s3|disk).
+ * Never lands full body into Memory raw or abstracts.
+ */
+import type { BlobBackendKind } from "../blob-store/types.js";
+export declare const RESTRICTED_COLLECTIONS: {
+    readonly objects: "restricted_objects";
+    readonly audits: "restricted_access_audits";
+};
+export type RestrictedClassification = "restricted" | "config-backup";
+export type RestrictedObjectMeta = {
+    orgId: string;
+    objectId: string;
+    classification: RestrictedClassification;
+    /** Content hash of plaintext body (sha256 hex). */
+    contentHash: string;
+    sizeBytes: number;
+    deviceId?: string;
+    vdom?: string;
+    sourceRunId?: string;
+    contentType?: string;
+    createdAt: string;
+    createdBy?: string;
+    /** Blob key within org partition. */
+    blobKey: string;
+    blobBackend: BlobBackendKind;
+    /** true when body was AES-GCM wrapped (on-prem KEK). */
+    encryptedAtRest: boolean;
+    /** Optional retention expiry ISO. */
+    retainUntil?: string | null;
+    version?: string;
+};
+export type RestrictedPutInput = {
+    classification: RestrictedClassification;
+    /** Raw body as base64 (JSON API). */
+    bodyBase64: string;
+    deviceId?: string;
+    vdom?: string;
+    sourceRunId?: string;
+    contentType?: string;
+    version?: string;
+    createdBy?: string;
+    retainUntil?: string | null;
+    /** Optional client-supplied object id; default random. */
+    objectId?: string;
+};
+export type RestrictedAccessAudit = {
+    auditId: string;
+    orgId: string;
+    objectId: string;
+    contentHash: string;
+    at: string;
+    actor?: string;
+    reason?: string;
+    action: "content-get" | "put" | "delete" | "purge";
+};
+export type RestrictedObjectStore = {
+    put(input: RestrictedPutInput): Promise<RestrictedObjectMeta>;
+    getMeta(objectId: string): Promise<RestrictedObjectMeta | null>;
+    /** Break-glass body read — caller must authorize + audit. */
+    getContent(objectId: string): Promise<{
+        meta: RestrictedObjectMeta;
+        body: Buffer;
+    } | null>;
+    delete(objectId: string): Promise<boolean>;
+    purgeExpired(now?: Date): Promise<number>;
+    recordAccessAudit(entry: Omit<RestrictedAccessAudit, "auditId" | "orgId" | "at"> & {
+        at?: string;
+    }): Promise<RestrictedAccessAudit>;
+    listAccessAudits(opts?: {
+        objectId?: string;
+        limit?: number;
+    }): Promise<RestrictedAccessAudit[]>;
+};
+export declare const BREAK_GLASS_HEADER = "x-memorix-break-glass";
+export declare const BREAK_GLASS_REASON_HEADER = "x-memorix-break-glass-reason";
+//# sourceMappingURL=types.d.ts.map

package/dist/restricted-store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/restricted-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,eAAO,MAAM,sBAAsB;;;CAGzB,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,eAAe,CAAC;AAEtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,wBAAwB,CAAC;IACzC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,eAAe,CAAC;IAC7B,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAC;IACzB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,wBAAwB,CAAC;IACzC,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChE,6DAA6D;IAC7D,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACpC,IAAI,EAAE,oBAAoB,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI,CAAC,CAAC;IACV,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,iBAAiB,CACf,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG;QAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GACA,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,gBAAgB,CAAC,IAAI,CAAC,EAAE;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D,eAAO,MAAM,yBAAyB,iCAAiC,CAAC"}

package/dist/restricted-store/types.js

@@ -0,0 +1,12 @@
+/**
+ * FG-A3 restricted / encrypted object store.
+ * Metadata (redacted) in Mongo; full body only in BlobObjectStore (s3|disk).
+ * Never lands full body into Memory raw or abstracts.
+ */
+export const RESTRICTED_COLLECTIONS = {
+    objects: "restricted_objects",
+    audits: "restricted_access_audits",
+};
+export const BREAK_GLASS_HEADER = "x-memorix-break-glass";
+export const BREAK_GLASS_REASON_HEADER = "x-memorix-break-glass-reason";
+//# sourceMappingURL=types.js.map

package/dist/restricted-store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/restricted-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,0BAA0B;CAC1B,CAAC;AA0EX,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC"}

package/dist/routes/catalog.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+import type { MemorixPlatform } from "../platform.js";
+export declare function registerCatalogRoutes(app: FastifyInstance, platform: MemorixPlatform): Promise<void>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/routes/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/routes/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAkCtD,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAiGf"}

package/dist/routes/catalog.js

@@ -0,0 +1,103 @@
+import { createCatalogService } from "../catalog/catalog-service.js";
+import { isCatalogComponentKind } from "../catalog/types.js";
+import { ServiceError } from "../errors.js";
+import { resolveScope } from "../request-scope.js";
+function requireMagit(platform) {
+    if (!platform.magit) {
+        throw new ServiceError("MAGIT_UNAVAILABLE", "global catalog requires Magit (durable Mongo metadata + Magit enabled)", 503);
+    }
+    return platform.magit;
+}
+function parseInclude(raw) {
+    const values = [];
+    if (typeof raw === "string") {
+        values.push(...raw.split(",").map((s) => s.trim()).filter(Boolean));
+    }
+    else if (Array.isArray(raw)) {
+        for (const v of raw) {
+            if (typeof v === "string") {
+                values.push(...v.split(",").map((s) => s.trim()).filter(Boolean));
+            }
+        }
+    }
+    return {
+        releases: values.includes("releases"),
+        deployments: values.includes("deployments"),
+    };
+}
+export async function registerCatalogRoutes(app, platform) {
+    app.get("/api/catalog", async (req) => {
+        const magit = requireMagit(platform);
+        const catalog = createCatalogService({
+            magit,
+            metadata: platform.metadata,
+            connectorRegistry: platform.connectorRegistry,
+            genericConnectors: platform.genericConnectors,
+        });
+        const q = req.query;
+        const include = parseInclude(q.include);
+        const scope = resolveScope(req);
+        if (include.deployments && !scope.orgId?.trim()) {
+            throw new ServiceError("VALIDATION", "include=deployments requires x-memorix-org-id", 400);
+        }
+        let kind = "all";
+        if (q.kind?.trim() && q.kind.trim() !== "all") {
+            if (!isCatalogComponentKind(q.kind.trim())) {
+                throw new ServiceError("VALIDATION", `unsupported kind: ${q.kind}`, 400);
+            }
+            kind = q.kind.trim();
+        }
+        return catalog.listComponents({
+            kind,
+            publisher: q.publisher,
+            q: q.q,
+            includeReleases: include.releases,
+            includeDeployments: include.deployments,
+            orgId: scope.orgId,
+            agentIds: scope.agentIds,
+        });
+    });
+    app.get("/api/catalog/:kind/:id", async (req) => {
+        const magit = requireMagit(platform);
+        const catalog = createCatalogService({
+            magit,
+            metadata: platform.metadata,
+            connectorRegistry: platform.connectorRegistry,
+            genericConnectors: platform.genericConnectors,
+        });
+        const params = req.params;
+        const q = req.query;
+        const include = parseInclude(q.include);
+        const scope = resolveScope(req);
+        if (include.deployments && !scope.orgId?.trim()) {
+            throw new ServiceError("VALIDATION", "include=deployments requires x-memorix-org-id", 400);
+        }
+        const component = await catalog.getComponent(params.kind ?? "", params.id ?? "", {
+            publisher: q.publisher,
+            includeReleases: include.releases || true,
+            includeDeployments: include.deployments,
+            orgId: scope.orgId,
+            agentIds: scope.agentIds,
+        });
+        return { component };
+    });
+    app.get("/api/catalog/:kind/:id/releases", async (req) => {
+        const magit = requireMagit(platform);
+        const catalog = createCatalogService({
+            magit,
+            metadata: platform.metadata,
+            connectorRegistry: platform.connectorRegistry,
+            genericConnectors: platform.genericConnectors,
+        });
+        const params = req.params;
+        const q = req.query;
+        const maxCount = q.maxCount ? Number(q.maxCount) : undefined;
+        return catalog.listReleases(params.kind ?? "", params.id ?? "", {
+            publisher: q.publisher,
+            maxCount: maxCount != null && Number.isFinite(maxCount)
+                ? Math.min(Math.max(1, maxCount), 500)
+                : undefined,
+        });
+    });
+}
+//# sourceMappingURL=catalog.js.map

package/dist/routes/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/routes/catalog.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,SAAS,YAAY,CAAC,QAAyB;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,wEAAwE,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAoB,EACpB,QAAyB;IAEzB,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,KAKb,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,+CAA+C,EAC/C,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAA+D,KAAK,CAAC;QAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9C,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,qBAAqB,CAAC,CAAC,IAAI,EAAE,EAC7B,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAwD,CAAC;QAC7E,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,CAAC;YAC5B,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,eAAe,EAAE,OAAO,CAAC,QAAQ;YACjC,kBAAkB,EAAE,OAAO,CAAC,WAAW;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAwC,CAAC;QAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,KAGb,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,+CAA+C,EAC/C,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE;YAC/E,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,eAAe,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YACzC,kBAAkB,EAAE,OAAO,CAAC,WAAW;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAwC,CAAC;QAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,KAAkD,CAAC;QACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE;YAC9D,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EACN,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC;gBACtC,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/connector-ops.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyInstance } from "fastify";
+import type { MemorixPlatform } from "../platform.js";
+/**
+ * Path orgId must match scope header (fail-closed). Returns path orgId.
+ */
+export declare function resolveConnectorOpsOrg(req: {
+    headers: Record<string, string | string[] | undefined>;
+    params?: unknown;
+}): string;
+/** MCO-01 / MCO-02 connector-op control plane. */
+export declare function registerConnectorOpsRoutes(app: FastifyInstance, platform: MemorixPlatform): Promise<void>;
+//# sourceMappingURL=connector-ops.d.ts.map

package/dist/routes/connector-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-ops.d.ts","sourceRoot":"","sources":["../../src/routes/connector-ops.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAoBtD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GACA,MAAM,CA2BR;AA0BD,kDAAkD;AAClD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAwKf"}