@x12i/memorix-service 3.3.0 → 3.4.0

package/dist/restricted-store/types.d.ts

@@ -0,0 +1,78 @@
+/**
+ * FG-A3 restricted / encrypted object store.
+ * Metadata (redacted) in Mongo; full body only in BlobObjectStore (s3|disk).
+ * Never lands full body into Memory raw or abstracts.
+ */
+import type { BlobBackendKind } from "../blob-store/types.js";
+export declare const RESTRICTED_COLLECTIONS: {
+    readonly objects: "restricted_objects";
+    readonly audits: "restricted_access_audits";
+};
+export type RestrictedClassification = "restricted" | "config-backup";
+export type RestrictedObjectMeta = {
+    orgId: string;
+    objectId: string;
+    classification: RestrictedClassification;
+    /** Content hash of plaintext body (sha256 hex). */
+    contentHash: string;
+    sizeBytes: number;
+    deviceId?: string;
+    vdom?: string;
+    sourceRunId?: string;
+    contentType?: string;
+    createdAt: string;
+    createdBy?: string;
+    /** Blob key within org partition. */
+    blobKey: string;
+    blobBackend: BlobBackendKind;
+    /** true when body was AES-GCM wrapped (on-prem KEK). */
+    encryptedAtRest: boolean;
+    /** Optional retention expiry ISO. */
+    retainUntil?: string | null;
+    version?: string;
+};
+export type RestrictedPutInput = {
+    classification: RestrictedClassification;
+    /** Raw body as base64 (JSON API). */
+    bodyBase64: string;
+    deviceId?: string;
+    vdom?: string;
+    sourceRunId?: string;
+    contentType?: string;
+    version?: string;
+    createdBy?: string;
+    retainUntil?: string | null;
+    /** Optional client-supplied object id; default random. */
+    objectId?: string;
+};
+export type RestrictedAccessAudit = {
+    auditId: string;
+    orgId: string;
+    objectId: string;
+    contentHash: string;
+    at: string;
+    actor?: string;
+    reason?: string;
+    action: "content-get" | "put" | "delete" | "purge";
+};
+export type RestrictedObjectStore = {
+    put(input: RestrictedPutInput): Promise<RestrictedObjectMeta>;
+    getMeta(objectId: string): Promise<RestrictedObjectMeta | null>;
+    /** Break-glass body read — caller must authorize + audit. */
+    getContent(objectId: string): Promise<{
+        meta: RestrictedObjectMeta;
+        body: Buffer;
+    } | null>;
+    delete(objectId: string): Promise<boolean>;
+    purgeExpired(now?: Date): Promise<number>;
+    recordAccessAudit(entry: Omit<RestrictedAccessAudit, "auditId" | "orgId" | "at"> & {
+        at?: string;
+    }): Promise<RestrictedAccessAudit>;
+    listAccessAudits(opts?: {
+        objectId?: string;
+        limit?: number;
+    }): Promise<RestrictedAccessAudit[]>;
+};
+export declare const BREAK_GLASS_HEADER = "x-memorix-break-glass";
+export declare const BREAK_GLASS_REASON_HEADER = "x-memorix-break-glass-reason";
+//# sourceMappingURL=types.d.ts.map

package/dist/restricted-store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/restricted-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,eAAO,MAAM,sBAAsB;;;CAGzB,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,eAAe,CAAC;AAEtE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,wBAAwB,CAAC;IACzC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,eAAe,CAAC;IAC7B,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAC;IACzB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,cAAc,EAAE,wBAAwB,CAAC;IACzC,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9D,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAChE,6DAA6D;IAC7D,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACpC,IAAI,EAAE,oBAAoB,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,IAAI,CAAC,CAAC;IACV,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,iBAAiB,CACf,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG;QAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GACA,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,gBAAgB,CAAC,IAAI,CAAC,EAAE;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACtC,CAAC;AAEF,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D,eAAO,MAAM,yBAAyB,iCAAiC,CAAC"}

package/dist/restricted-store/types.js

@@ -0,0 +1,12 @@
+/**
+ * FG-A3 restricted / encrypted object store.
+ * Metadata (redacted) in Mongo; full body only in BlobObjectStore (s3|disk).
+ * Never lands full body into Memory raw or abstracts.
+ */
+export const RESTRICTED_COLLECTIONS = {
+    objects: "restricted_objects",
+    audits: "restricted_access_audits",
+};
+export const BREAK_GLASS_HEADER = "x-memorix-break-glass";
+export const BREAK_GLASS_REASON_HEADER = "x-memorix-break-glass-reason";
+//# sourceMappingURL=types.js.map

package/dist/restricted-store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/restricted-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,0BAA0B;CAC1B,CAAC;AA0EX,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC"}

package/dist/routes/integrations.d.ts

@@ -0,0 +1,5 @@
+import type { FastifyInstance } from "fastify";
+import type { MemorixPlatform } from "../platform.js";
+/** Stage −1 integration instance registry. */
+export declare function registerIntegrationRoutes(app: FastifyInstance, platform: MemorixPlatform): Promise<void>;
+//# sourceMappingURL=integrations.d.ts.map

package/dist/routes/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../src/routes/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAoCtD,8CAA8C;AAC9C,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAyHf"}

package/dist/routes/integrations.js

@@ -0,0 +1,126 @@
+import { ServiceError } from "../errors.js";
+import { hasRegistrySecretPayload, } from "../integrations/index.js";
+import { resolveConnectorOpsOrg } from "./connector-ops.js";
+function header(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(v))
+        return v[0];
+    return typeof v === "string" ? v : undefined;
+}
+function mapStoreError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const code = err.code;
+    if (code === "ETAG_MISMATCH" || /etag mismatch/i.test(msg)) {
+        throw new ServiceError("ETAG_MISMATCH", msg, 412);
+    }
+    if (/already exists/i.test(msg)) {
+        throw new ServiceError("CONFLICT", msg, 409);
+    }
+    if (/secret|credentialRef is required|connectorId is required/i.test(msg)) {
+        throw new ServiceError(msg.includes("secret") ? "PAYLOAD_REJECTED" : "VALIDATION_ERROR", msg, 400);
+    }
+    throw new ServiceError("VALIDATION_ERROR", msg, 400);
+}
+/** Stage −1 integration instance registry. */
+export async function registerIntegrationRoutes(app, platform) {
+    const prefix = "/api/integrations/v1";
+    app.get(`${prefix}/orgs/:orgId/instances`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const q = (req.query ?? {});
+        const connectorId = typeof q.connectorId === "string" ? q.connectorId.trim() : undefined;
+        const enabled = q.enabled === "true" ? true : q.enabled === "false" ? false : undefined;
+        return platform.integrationInstancesFor(orgId).list({
+            ...(connectorId ? { connectorId } : {}),
+            ...(enabled != null ? { enabled } : {}),
+        });
+    });
+    app.post(`${prefix}/orgs/:orgId/instances`, async (req, reply) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const body = (req.body ?? {});
+        if (hasRegistrySecretPayload(body)) {
+            throw new ServiceError("PAYLOAD_REJECTED", "instance payload must not contain secrets; credentialRef only", 400);
+        }
+        try {
+            const created = await platform
+                .integrationInstancesFor(orgId)
+                .create(body);
+            return reply.code(201).send(created);
+        }
+        catch (err) {
+            mapStoreError(err);
+        }
+    });
+    app.get(`${prefix}/orgs/:orgId/instances/:instanceId`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const params = req.params;
+        const instanceId = params.instanceId?.trim() ?? "";
+        if (!instanceId) {
+            throw new ServiceError("VALIDATION_ERROR", "instanceId required", 400);
+        }
+        const doc = await platform
+            .integrationInstancesFor(orgId)
+            .get(instanceId);
+        if (!doc) {
+            throw new ServiceError("NOT_FOUND", "integration instance not found", 404);
+        }
+        return doc;
+    });
+    app.put(`${prefix}/orgs/:orgId/instances/:instanceId`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const params = req.params;
+        const instanceId = params.instanceId?.trim() ?? "";
+        if (!instanceId) {
+            throw new ServiceError("VALIDATION_ERROR", "instanceId required", 400);
+        }
+        const body = (req.body ?? {});
+        if (hasRegistrySecretPayload(body)) {
+            throw new ServiceError("PAYLOAD_REJECTED", "instance payload must not contain secrets; credentialRef only", 400);
+        }
+        const ifMatch = header(req.headers, "if-match") ??
+            header(req.headers, "If-Match") ??
+            null;
+        try {
+            return await platform
+                .integrationInstancesFor(orgId)
+                .put(instanceId, body, { ifMatch });
+        }
+        catch (err) {
+            mapStoreError(err);
+        }
+    });
+    app.delete(`${prefix}/orgs/:orgId/instances/:instanceId`, async (req, reply) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const params = req.params;
+        const instanceId = params.instanceId?.trim() ?? "";
+        if (!instanceId) {
+            throw new ServiceError("VALIDATION_ERROR", "instanceId required", 400);
+        }
+        const ifMatch = header(req.headers, "if-match") ??
+            header(req.headers, "If-Match") ??
+            null;
+        try {
+            const ok = await platform
+                .integrationInstancesFor(orgId)
+                .delete(instanceId, { ifMatch });
+            if (!ok) {
+                throw new ServiceError("NOT_FOUND", "integration instance not found", 404);
+            }
+            return reply.code(204).send();
+        }
+        catch (err) {
+            if (err instanceof ServiceError)
+                throw err;
+            mapStoreError(err);
+        }
+    });
+    app.get(`${prefix}/orgs/:orgId/mutations`, async (req) => {
+        const orgId = resolveConnectorOpsOrg(req);
+        const q = (req.query ?? {});
+        const limit = q.limit != null ? Number(q.limit) : undefined;
+        const items = await platform
+            .integrationInstancesFor(orgId)
+            .listMutations({ limit });
+        return { orgId, mutations: items };
+    });
+}
+//# sourceMappingURL=integrations.js.map

package/dist/routes/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../src/routes/integrations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,SAAS,MAAM,CACb,OAAsD,EACtD,IAAY;IAEZ,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;IAC7C,IAAI,IAAI,KAAK,eAAe,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,2DAA2D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,YAAY,CACpB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,EAChE,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,QAAyB;IAEzB,MAAM,MAAM,GAAG,sBAAsB,CAAC;IAEtC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QACvD,MAAM,WAAW,GACf,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAClD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC;QAC1D,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,+DAA+D,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ;iBAC3B,uBAAuB,CAAC,KAAK,CAAC;iBAC9B,MAAM,CAAC,IAAI,CAAC,CAAC;YAChB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ;aACvB,uBAAuB,CAAC,KAAK,CAAC;aAC9B,GAAG,CAAC,UAAU,CAAC,CAAC;QACnB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC;QAC1D,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,+DAA+D,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;YAC/B,IAAI,CAAC;QACP,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ;iBAClB,uBAAuB,CAAC,KAAK,CAAC;iBAC9B,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CACR,GAAG,MAAM,oCAAoC,EAC7C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GACX,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC;YAC/B,IAAI,CAAC;QACP,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,QAAQ;iBACtB,uBAAuB,CAAC,KAAK,CAAC;iBAC9B,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,gCAAgC,EAChC,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,YAAY;gBAAE,MAAM,GAAG,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QACvD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,QAAQ;aACzB,uBAAuB,CAAC,KAAK,CAAC;aAC9B,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/routes/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAsMtD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAmiCf"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/routes/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAsMtD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,IAAI,CAAC,CAq8Cf"}

package/dist/routes/metadata.js

@@ -806,10 +806,10 @@ export async function registerMetadataRoutes(app, platform) {
             }
         }
         const note = saved.published === false
-            ? "Pack wrote locally but was not published to the central store (published=false)."
+            ? "Published locally but not to the shared catalog (published=false)."
             : saved.published === true
-                ? "Pack published to the Magit typed package store."
-                : "Pack stored in the central Magit package catalog.";
+                ? "Published to the shared package catalog."
+                : "Published to the package catalog.";
         return {
             packed: true,
             kind,
@@ -917,7 +917,7 @@ export async function registerMetadataRoutes(app, platform) {
             checksum: fetched.checksum,
             targetOrgId: scope.orgId,
             result,
-            note: "Restored from the central Magit package catalog into this environment. Org is the restore target only.",
+            note: "Installed from the shared package catalog into this organization. Organization is the install target only.",
         };
     });
     app.post("/api/metadata/packages/diff", async (req) => {
@@ -976,6 +976,330 @@ export async function registerMetadataRoutes(app, platform) {
             note: "Compare package versions or version vs installed. Not env→env copy.",
         };
     });
+    // Magit 2.14 — package channels & release sets (Mode A only; fail closed if unset)
+    app.get("/api/metadata/packages/capabilities", async () => {
+        const magit = requireMagit(platform);
+        const caps = magit.packageCatalogCapabilities();
+        return {
+            ...caps,
+            note: "Safe capability flags for Packages UI. Never includes tokens or store selector.",
+        };
+    });
+    app.post("/api/metadata/packages/channels/promote", async (req) => {
+        const magit = requireMagit(platform);
+        const body = req.body;
+        const kind = parseKind(body.kind);
+        const id = body.id?.trim();
+        const channel = body.channel?.trim();
+        const version = body.version?.trim();
+        if (!id)
+            throw new ServiceError("VALIDATION", "id required", 400);
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        if (!version)
+            throw new ServiceError("VALIDATION", "version required", 400);
+        const result = await magit.setPackageChannel({
+            kind,
+            id,
+            channel,
+            version,
+            message: body.message?.trim() || undefined,
+            expectedVersion: body.expectedVersion,
+        });
+        return {
+            ...result,
+            note: "Channel pointer updated. Packages do not move; promote does not install into organizations.",
+        };
+    });
+    app.get("/api/metadata/packages/:kind/:id/channels", async (req) => {
+        const magit = requireMagit(platform);
+        const kind = parseKind(req.params.kind);
+        const id = String(req.params.id ?? "").trim();
+        if (!id)
+            throw new ServiceError("VALIDATION", "id required", 400);
+        const channels = await magit.listPackageChannels({ kind, id });
+        return {
+            kind,
+            id,
+            channels,
+            note: "Known channel heads for this package (shared catalog).",
+        };
+    });
+    app.get("/api/metadata/packages/:kind/:id/channels/:channel", async (req) => {
+        const magit = requireMagit(platform);
+        const kind = parseKind(req.params.kind);
+        const id = String(req.params.id ?? "").trim();
+        const channel = String(req.params.channel ?? "").trim();
+        if (!id)
+            throw new ServiceError("VALIDATION", "id required", 400);
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        const result = await magit.resolvePackageChannel({ kind, id, channel });
+        return {
+            ...result,
+            note: "Resolved after Magit sync (fresh channel head).",
+        };
+    });
+    app.get("/api/metadata/packages/:kind/:id/channels/:channel/history", async (req) => {
+        const magit = requireMagit(platform);
+        const kind = parseKind(req.params.kind);
+        const id = String(req.params.id ?? "").trim();
+        const channel = String(req.params.channel ?? "").trim();
+        if (!id)
+            throw new ServiceError("VALIDATION", "id required", 400);
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        const history = await magit.packageChannelHistory({ kind, id, channel });
+        return {
+            kind,
+            id,
+            channel,
+            history,
+            note: "Package channel history — promote a previous version to roll back the pointer.",
+        };
+    });
+    app.post("/api/metadata/packages/releases/pack", async (req) => {
+        const magit = requireMagit(platform);
+        const body = req.body;
+        const members = (body.members ?? []).map((m) => ({
+            kind: parseKind(m.kind),
+            id: String(m.id ?? "").trim(),
+            version: String(m.version ?? "").trim(),
+        }));
+        if (members.length === 0) {
+            throw new ServiceError("VALIDATION", "members must list at least one { kind, id, version }", 400);
+        }
+        for (const m of members) {
+            if (!m.id || !m.version) {
+                throw new ServiceError("VALIDATION", "each member needs kind, id, and version", 400);
+            }
+        }
+        const result = await magit.packRelease({
+            members,
+            message: body.message?.trim() || undefined,
+        });
+        return {
+            ...result,
+            note: "Immutable release set (content-addressed). Promote via release channel. Install separately into a target organization.",
+        };
+    });
+    app.post("/api/metadata/packages/releases/channels/promote", async (req) => {
+        const magit = requireMagit(platform);
+        const body = req.body;
+        const channel = body.channel?.trim();
+        const releaseId = body.releaseId?.trim();
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        if (!releaseId) {
+            throw new ServiceError("VALIDATION", "releaseId required", 400);
+        }
+        const result = await magit.setReleaseChannel({
+            channel,
+            releaseId,
+            message: body.message?.trim() || undefined,
+            expectedReleaseId: body.expectedReleaseId,
+        });
+        return {
+            ...result,
+            note: "Release channel updated in one write (atomic set promote). Does not install into organizations.",
+        };
+    });
+    app.get("/api/metadata/packages/releases/channels", async () => {
+        const magit = requireMagit(platform);
+        const channels = await magit.listReleaseChannels();
+        return {
+            channels,
+            note: "Release channel heads with member sets.",
+        };
+    });
+    app.get("/api/metadata/packages/releases/channels/:channel", async (req) => {
+        const magit = requireMagit(platform);
+        const channel = String(req.params.channel ?? "").trim();
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        const result = await magit.resolveReleaseChannel({ channel });
+        return {
+            ...result,
+            note: "Resolved release channel with full member set (Magit syncs first).",
+        };
+    });
+    app.get("/api/metadata/packages/releases/channels/:channel/history", async (req) => {
+        const magit = requireMagit(platform);
+        const channel = String(req.params.channel ?? "").trim();
+        if (!channel)
+            throw new ServiceError("VALIDATION", "channel required", 400);
+        const history = await magit.releaseChannelHistory({ channel });
+        return {
+            channel,
+            history,
+            note: "Rollback list: promote a previous releaseId to move the channel back.",
+        };
+    });
+    /**
+     * Atomic install of a release set into the target org.
+     * Body: { confirm:true, channel? | releaseId?, message? }
+     * Installs members with agent-first ordering; rolls back prior installs on failure.
+     */
+    app.post("/api/metadata/packages/releases/install", async (req) => {
+        const scope = resolveScope(req);
+        const magit = requireMagit(platform);
+        const body = req.body;
+        if (!body?.confirm) {
+            throw new ServiceError("CONFIRMATION_REQUIRED", "explicit confirm:true required for release install", 400);
+        }
+        if (!scope.orgId?.trim()) {
+            throw new ServiceError("VALIDATION", "x-memorix-org-id required — organization is the install target", 400);
+        }
+        let members;
+        let releaseId;
+        let channel = null;
+        if (body.channel?.trim()) {
+            channel = body.channel.trim();
+            const live = await magit.resolveReleaseChannel({ channel });
+            releaseId = live.releaseId;
+            members = live.release.members;
+        }
+        else if (body.releaseId?.trim()) {
+            releaseId = body.releaseId.trim();
+            // Resolve via channel history is not available for bare releaseId —
+            // pack response members must be re-fetched through channel or re-cut.
+            // Prefer channel path; for releaseId-only, resolve from listReleaseChannels.
+            const listed = await magit.listReleaseChannels();
+            const match = listed.find((c) => c.releaseId === releaseId);
+            if (match) {
+                members = match.release.members;
+                channel = match.channel;
+            }
+            else {
+                throw new ServiceError("VALIDATION", "releaseId not found on any release channel; pass channel to install from a channel head", 400);
+            }
+        }
+        else {
+            throw new ServiceError("VALIDATION", "channel or releaseId required", 400);
+        }
+        if (members.length === 0) {
+            throw new ServiceError("VALIDATION", "release has no members", 400);
+        }
+        // Install agent members first so connector/service merges have a host pack.
+        const ordered = [...members].sort((a, b) => {
+            const rank = (k) => k === "agent" ? 0 : k === "connector" ? 1 : 2;
+            return rank(a.kind) - rank(b.kind);
+        });
+        const priors = [];
+        const installed = [];
+        const packs = installedPacks();
+        try {
+            for (const m of ordered) {
+                const kind = parseKind(m.kind);
+                const key = `${kind}:${m.id}`;
+                let agentId = body.agentIdByMember?.[key]?.trim() ||
+                    (kind === "agent" ? m.id : "");
+                if (!agentId) {
+                    try {
+                        agentId = resolveOwnerAgent(packs, kind, m.id, undefined);
+                    }
+                    catch {
+                        agentId = kind === "agent" ? m.id : "";
+                    }
+                }
+                if (!agentId) {
+                    throw new ServiceError("VALIDATION", `agentId required to install ${kind}/${m.id}`, 400);
+                }
+                const priorPack = packs[agentId]
+                    ? structuredClone(packs[agentId])
+                    : null;
+                priors.push({ agentId, pack: priorPack });
+                const sliceAgentId = catalogAgentId(kind, m.id, agentId);
+                const fetched = await magit.fetchPackage({
+                    kind,
+                    id: m.id,
+                    version: m.version,
+                });
+                let installPack = packagePayloadToPack(sliceAgentId, fetched.payload);
+                if (kind === "connector" || kind === "service") {
+                    const live = packs[agentId] ?? emptyPackForRestore(agentId);
+                    if (kind === "connector") {
+                        const keepRefs = new Set((installPack.sources ?? [])
+                            .map((s) => s && typeof s === "object" && "connectorRef" in s
+                            ? String(s.connectorRef ?? "")
+                            : "")
+                            .filter(Boolean));
+                        const otherSources = (live.sources ?? []).filter((s) => {
+                            const ref = s && typeof s === "object" && "connectorRef" in s
+                                ? String(s.connectorRef ?? "")
+                                : "";
+                            return !keepRefs.has(ref);
+                        });
+                        installPack = {
+                            ...live,
+                            agentId,
+                            sources: [...otherSources, ...(installPack.sources ?? [])],
+                        };
+                    }
+                    else {
+                        const svcId = m.id;
+                        const otherServices = (live.services ?? []).filter((s) => !(s &&
+                            typeof s === "object" &&
+                            "id" in s &&
+                            String(s.id) === svcId));
+                        installPack = {
+                            ...live,
+                            agentId,
+                            services: [...otherServices, ...(installPack.services ?? [])],
+                        };
+                    }
+                }
+                installPack = stripOrgRuntimeSourcesFromPack(installPack);
+                const validation = validateMetadataPack(installPack);
+                if (!validation.ok) {
+                    throw new ServiceError("VALIDATION", `release member ${kind}/${m.id} failed validation`, 400, { issues: validation.issues });
+                }
+                const message = body.message?.trim() ||
+                    `Install release ${releaseId.slice(0, 12)} member ${kind}/${m.id}`;
+                const result = platform.metadata.install(installPack, {
+                    reinstall: true,
+                    magitCommit: m.version,
+                    magitRelease: releaseId,
+                    source: "rollback",
+                    message,
+                    environment: "live",
+                });
+                if (!result.ok) {
+                    throw new ServiceError("VALIDATION", result.issues.map((i) => i.message).join("; ") ||
+                        `install failed for ${kind}/${m.id}`, 400);
+                }
+                installed.push({ kind, id: m.id, version: m.version, agentId });
+            }
+        }
+        catch (err) {
+            // Best-effort rollback to prior packs for successfully installed members.
+            for (let i = priors.length - 1; i >= 0; i--) {
+                const prior = priors[i];
+                if (prior.pack) {
+                    try {
+                        platform.metadata.install(prior.pack, {
+                            reinstall: true,
+                            source: "rollback",
+                            message: `Rollback after failed release install ${releaseId.slice(0, 12)}`,
+                            environment: "live",
+                        });
+                    }
+                    catch {
+                        // keep original error
+                    }
+                }
+            }
+            throw err;
+        }
+        return {
+            installed: true,
+            releaseId,
+            channel,
+            targetOrgId: scope.orgId,
+            members: installed,
+            note: "Atomic release install into the target organization. On failure, prior packs are restored.",
+        };
+    });
 }
 function emptyPackForRestore(agentId) {
     return {