@x12i/memorix-service 3.3.0 → 3.6.0

package/dist/blob-store/s3.js

@@ -0,0 +1,151 @@
+import { createHash } from "node:crypto";
+import { assertSafeBlobKey, assertSafeOrgId, } from "./types.js";
+function objectKey(prefix, orgId, key) {
+    const org = assertSafeOrgId(orgId);
+    const safeKey = assertSafeBlobKey(key);
+    const p = (prefix ?? "").replace(/^\/+|\/+$/g, "");
+    const rest = `${org}/${safeKey}`;
+    return p ? `${p}/${rest}` : rest;
+}
+/**
+ * Cloud object store (S3-compatible). Bodies never touch local disk.
+ * Pass a real AWS SDK client or a test double via `client`.
+ */
+export function createS3BlobStore(opts) {
+    if (!opts.bucket?.trim())
+        throw new Error("S3 bucket required");
+    const bucket = opts.bucket.trim();
+    const prefix = opts.prefix;
+    const sse = opts.serverSideEncryption === false
+        ? undefined
+        : (opts.serverSideEncryption ?? "AES256");
+    return {
+        backend: "s3",
+        async put(orgId, key, body, putOpts) {
+            const Key = objectKey(prefix, orgId, key);
+            const out = await opts.client.putObject({
+                Bucket: bucket,
+                Key,
+                Body: body,
+                ContentType: putOpts?.contentType,
+                ...(sse
+                    ? {
+                        ServerSideEncryption: sse,
+                        ...(sse === "aws:kms" && opts.sseKmsKeyId
+                            ? { SSEKMSKeyId: opts.sseKmsKeyId }
+                            : {}),
+                    }
+                    : {}),
+            });
+            const digest = createHash("sha256").update(body).digest("hex");
+            return {
+                backend: "s3",
+                orgId: assertSafeOrgId(orgId),
+                key: assertSafeBlobKey(key),
+                sizeBytes: body.byteLength,
+                contentType: putOpts?.contentType,
+                etag: out.ETag?.replace(/"/g, "") ?? `sha256:${digest}`,
+            };
+        },
+        async get(orgId, key) {
+            const Key = objectKey(prefix, orgId, key);
+            const out = await opts.client.getObject({ Bucket: bucket, Key });
+            if (!out?.Body)
+                return null;
+            return Buffer.isBuffer(out.Body)
+                ? out.Body
+                : Buffer.from(out.Body);
+        },
+        async head(orgId, key) {
+            const Key = objectKey(prefix, orgId, key);
+            const out = await opts.client.headObject({ Bucket: bucket, Key });
+            if (!out)
+                return null;
+            return {
+                orgId: assertSafeOrgId(orgId),
+                key: assertSafeBlobKey(key),
+                sizeBytes: out.ContentLength ?? 0,
+                contentType: out.ContentType,
+                etag: out.ETag?.replace(/"/g, ""),
+            };
+        },
+        async delete(orgId, key) {
+            const Key = objectKey(prefix, orgId, key);
+            const existing = await opts.client.headObject({ Bucket: bucket, Key });
+            if (!existing)
+                return false;
+            await opts.client.deleteObject({ Bucket: bucket, Key });
+            return true;
+        },
+    };
+}
+/**
+ * Build SDK client from env when backend=s3. Lazy-imports @aws-sdk/client-s3.
+ */
+export async function createAwsS3BlobClientFromEnv(env = process.env) {
+    const { S3Client, PutObjectCommand, GetObjectCommand, HeadObjectCommand, DeleteObjectCommand } = await import("@aws-sdk/client-s3");
+    const region = env.MEMORIX_S3_REGION?.trim() || env.AWS_REGION?.trim() || "us-east-1";
+    const endpoint = env.MEMORIX_S3_ENDPOINT?.trim() || undefined;
+    const client = new S3Client({
+        region,
+        ...(endpoint
+            ? {
+                endpoint,
+                forcePathStyle: env.MEMORIX_S3_FORCE_PATH_STYLE === "1" ||
+                    env.MEMORIX_S3_FORCE_PATH_STYLE === "true",
+            }
+            : {}),
+    });
+    return {
+        async putObject(input) {
+            const out = await client.send(new PutObjectCommand({
+                Bucket: input.Bucket,
+                Key: input.Key,
+                Body: input.Body,
+                ContentType: input.ContentType,
+                ServerSideEncryption: input.ServerSideEncryption,
+                SSEKMSKeyId: input.SSEKMSKeyId,
+            }));
+            return { ETag: out.ETag };
+        },
+        async getObject(input) {
+            try {
+                const out = await client.send(new GetObjectCommand(input));
+                if (!out.Body)
+                    return { Body: null, ContentType: out.ContentType };
+                const bytes = await out.Body.transformToByteArray();
+                return { Body: Buffer.from(bytes), ContentType: out.ContentType };
+            }
+            catch (err) {
+                if (err.name === "NoSuchKey")
+                    return null;
+                if (err.$metadata
+                    ?.httpStatusCode === 404)
+                    return null;
+                throw err;
+            }
+        },
+        async headObject(input) {
+            try {
+                const out = await client.send(new HeadObjectCommand(input));
+                return {
+                    ContentLength: out.ContentLength,
+                    ContentType: out.ContentType,
+                    ETag: out.ETag,
+                };
+            }
+            catch (err) {
+                if (err.name === "NotFound")
+                    return null;
+                if (err.$metadata
+                    ?.httpStatusCode === 404)
+                    return null;
+                throw err;
+            }
+        },
+        async deleteObject(input) {
+            await client.send(new DeleteObjectCommand(input));
+        },
+    };
+}
+//# sourceMappingURL=s3.js.map

package/dist/blob-store/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../src/blob-store/s3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,eAAe,GAGhB,MAAM,YAAY,CAAC;AAiCpB,SAAS,SAAS,CAAC,MAA0B,EAAE,KAAa,EAAE,GAAW;IACvE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,GAAG,GACP,IAAI,CAAC,oBAAoB,KAAK,KAAK;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,QAAQ,CAAC,CAAC;IAE9C,OAAO;QACL,OAAO,EAAE,IAAI;QAEb,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO;YACjC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM;gBACd,GAAG;gBACH,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,OAAO,EAAE,WAAW;gBACjC,GAAG,CAAC,GAAG;oBACL,CAAC,CAAC;wBACE,oBAAoB,EAAE,GAAG;wBACzB,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW;4BACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;4BACnC,CAAC,CAAC,EAAE,CAAC;qBACR;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,WAAW,EAAE,OAAO,EAAE,WAAW;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,UAAU,MAAM,EAAE;aAChC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG;YAClB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC9B,CAAC,CAAC,GAAG,CAAC,IAAI;gBACV,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG;YACnB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO;gBACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,GAAG,CAAC;gBAC3B,SAAS,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;gBACjC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aAClC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG;YACrB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,GAC5F,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;IACtF,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;QAC1B,MAAM;QACN,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,QAAQ;gBACR,cAAc,EACZ,GAAG,CAAC,2BAA2B,KAAK,GAAG;oBACvC,GAAG,CAAC,2BAA2B,KAAK,MAAM;aAC7C;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAGf;gBACb,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CACH,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3D,IAAI,CAAC,GAAG,CAAC,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACpD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAAyB,CAAC,IAAI,KAAK,WAAW;oBAAE,OAAO,IAAI,CAAC;gBACjE,IAAK,GAAmD,CAAC,SAAS;oBAChE,EAAE,cAAc,KAAK,GAAG;oBACxB,OAAO,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5D,OAAO;oBACL,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAAyB,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO,IAAI,CAAC;gBAChE,IAAK,GAAmD,CAAC,SAAS;oBAChE,EAAE,cAAc,KAAK,GAAG;oBACxB,OAAO,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAK;YACtB,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/blob-store/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Dual-mode object/blob plane: cloud (S3-compatible) vs on-prem local disk.
+ * Any org/connector object payload that would use cloud buckets MUST use disk when
+ * MEMORIX_BLOB_BACKEND=disk (on-prem). Not Magit/metadata.
+ */
+export type BlobBackendKind = "s3" | "disk" | "memory";
+export type BlobHead = {
+    orgId: string;
+    key: string;
+    sizeBytes: number;
+    contentType?: string;
+    /** Opaque integrity / storage etag when available. */
+    etag?: string;
+};
+export type BlobPutResult = BlobHead & {
+    backend: BlobBackendKind;
+};
+export type BlobObjectStore = {
+    readonly backend: BlobBackendKind;
+    put(orgId: string, key: string, body: Buffer, opts?: {
+        contentType?: string;
+    }): Promise<BlobPutResult>;
+    get(orgId: string, key: string): Promise<Buffer | null>;
+    head(orgId: string, key: string): Promise<BlobHead | null>;
+    delete(orgId: string, key: string): Promise<boolean>;
+};
+/** Reject path traversal / empty segments. Keys are relative object ids. */
+export declare function assertSafeBlobKey(key: string): string;
+export declare function assertSafeOrgId(orgId: string): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/blob-store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/blob-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG;IACrC,OAAO,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,GAAG,CACD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoBrD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD"}

package/dist/blob-store/types.js

@@ -0,0 +1,38 @@
+/**
+ * Dual-mode object/blob plane: cloud (S3-compatible) vs on-prem local disk.
+ * Any org/connector object payload that would use cloud buckets MUST use disk when
+ * MEMORIX_BLOB_BACKEND=disk (on-prem). Not Magit/metadata.
+ */
+/** Reject path traversal / empty segments. Keys are relative object ids. */
+export function assertSafeBlobKey(key) {
+    const k = key.trim();
+    if (!k)
+        throw new Error("blob key required");
+    if (k.length > 512)
+        throw new Error("blob key too long");
+    if (k.includes("\0"))
+        throw new Error("blob key invalid");
+    if (k.startsWith("/") || k.endsWith("/")) {
+        throw new Error("blob key must not start or end with /");
+    }
+    const parts = k.split("/");
+    for (const p of parts) {
+        if (!p || p === "." || p === "..") {
+            throw new Error("blob key path escape rejected");
+        }
+        if (!/^[A-Za-z0-9._-]+$/.test(p)) {
+            throw new Error("blob key segments must be [A-Za-z0-9._-]+ (no path escape)");
+        }
+    }
+    return k;
+}
+export function assertSafeOrgId(orgId) {
+    const o = orgId.trim();
+    if (!o)
+        throw new Error("orgId required");
+    if (!/^[A-Za-z0-9._-]+$/.test(o)) {
+        throw new Error("orgId must match [A-Za-z0-9._-]+");
+    }
+    return o;
+}
+//# sourceMappingURL=types.js.map

package/dist/blob-store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/blob-store/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8BH,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/catalog-store-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-store-cli.d.ts","sourceRoot":"","sources":["../src/catalog-store-cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;IAC3E,EAAE,EAAE,cAAc,CAAC;CACpB,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,uBAAuB,IAAI,gBAAgB,CA8C1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcrF;AA2BD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CA4BjB"}
+{"version":3,"file":"catalog-store-cli.d.ts","sourceRoot":"","sources":["../src/catalog-store-cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;IAC3E,EAAE,EAAE,cAAc,CAAC;CACpB,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,uBAAuB,IAAI,gBAAgB,CA8C1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcrF;AA2BD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACtC,OAAO,CAAC,MAAM,CAAC,CAgCjB"}

package/dist/catalog-store-cli.js

@@ -5,7 +5,7 @@
 import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { ServiceError } from "./errors.js";
-import { createMagitPackService, isMetadataMagitEnabled, resolveMagitRepoRootParent, resolveMagitStorageTokenEnv, } from "./magit/magit-pack-service.js";
+import { createMagitPackService, DEFAULT_TYPED_STORE_ALLOWED_KINDS, isMetadataMagitEnabled, resolveMagitRepoRootParent, resolveMagitStorageTokenEnv, } from "./magit/magit-pack-service.js";
 export function parseFlag(argv, name) {
     const i = argv.indexOf(name);
     if (i < 0)
@@ -99,11 +99,15 @@ export async function runCatalogStoreCommand(sub, argv, partialDeps) {
         if (sub === "list")
             return await list(deps);
         io.error(`Usage:
-  memorix-service catalog-store provision [--out <file>] [--force] [--package-type-id <id>]
+  memorix-service catalog-store provision --out <file>
+      [--force] [--package-type-id <id>]
+      --allowed-kinds agent,connector,service,agent-bundle
+      | --confirm-allowed-kinds   (accept default kinds above)
   memorix-service catalog-store verify
-  memorix-service catalog-store recover --store-id <id> [--out <file>]
+  memorix-service catalog-store recover --store-id <id> --out <file>
   memorix-service catalog-store list
 
+allowedKinds is write-once on createGlobalStore — a forgotten kind needs a second store.
 Secrets (MAGIT_PACKAGE_STORE_SELECTOR, tokens) are never printed on stdout.
 Provision/recover write selector lines to --out with mode 0600.`);
         return 1;
@@ -126,9 +130,34 @@ async function provision(argv, deps) {
     }
     const force = hasFlag(argv, "--force");
     const packageTypeId = parseFlag(argv, "--package-type-id");
+    const allowedKindsRaw = parseFlag(argv, "--allowed-kinds");
+    const confirmDefault = hasFlag(argv, "--confirm-allowed-kinds");
+    let allowedKinds;
+    if (allowedKindsRaw) {
+        allowedKinds = allowedKindsRaw
+            .split(",")
+            .map((k) => k.trim())
+            .filter(Boolean);
+        if (allowedKinds.length === 0) {
+            deps.io.error("--allowed-kinds must list at least one kind");
+            return 2;
+        }
+    }
+    else if (confirmDefault) {
+        allowedKinds = [...DEFAULT_TYPED_STORE_ALLOWED_KINDS];
+    }
+    else {
+        deps.io.error([
+            "provision freezes allowedKinds forever on the Magit store (write-once).",
+            `Default would be: ${DEFAULT_TYPED_STORE_ALLOWED_KINDS.join(",")}`,
+            "Pass --allowed-kinds agent,connector,... OR --confirm-allowed-kinds to accept the default.",
+        ].join("\n"));
+        return 2;
+    }
     const magitSvc = deps.createMagit();
     const result = await magitSvc.provisionTypedPackageStore({
         packageTypeId: packageTypeId || undefined,
+        allowedKinds,
         force,
     });
     deps.writeSecretEnvFile(out, publisherEnv(result));
@@ -140,12 +169,14 @@ async function provision(argv, deps) {
         action: "provision",
         packageTypeId: result.packageTypeId,
         storeId: result.storeId,
+        allowedKinds: result.allowedKinds,
         pushed: result.pushed,
         existingStoreCount: result.existingStoreCount,
         secretsFile: abs,
         next: [
             `Install ${out} into the service secret env (never commit).`,
-            "Mint Authix store grants: publisher write + consumer read.",
+            "Set MAGIT_CATALOG_TENANT=x12i MAGIT_CATALOG_REPO=memorix (defaults).",
+            "Mint Authix store grants: publisher write + consumer read (repoIds empty on consumer).",
             "Run: memorix-service catalog-store verify",
             "Optional: node scripts/magit-backfill-pack-catalog.mjs",
         ],

package/dist/catalog-store-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-store-cli.js","sourceRoot":"","sources":["../src/catalog-store-cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,GAE5B,MAAM,+BAA+B,CAAC;AAavC,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,IAAY;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,wEAAwE,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,kDAAkD,EAClD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,qBAAqB,QAAQ,qDAAqD,EAClF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACtC,kBAAkB,CAAC;IACrB,OAAO,sBAAsB,CAAC;QAC5B,cAAc,EAAE,0BAA0B,EAAE;QAC5C,WAAW,EAAE,WAAW;QACxB,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9D,eAAe,EAAE,QAAQ;QACzB,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAClB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAClD,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAA2B;IAC7E,MAAM,KAAK,GAAG;QACZ,8DAA8D;QAC9D,wEAAwE;QACxE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;KACpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAmC;IACtD,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,uBAAuB;QAC5D,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,kBAAkB;QACrE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI;YACjB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAGrB;IACC,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,aAAa;QAC3C,4BAA4B,EAAE,MAAM,CAAC,aAAa;QAClD,0BAA0B,EACxB,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC7D,8BAA8B,EAC5B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,iBAAiB;KAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAuB,EACvB,IAAc,EACd,WAAuC;IAEvC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC;;;;;;;gEAOmD,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GACX,GAAG,YAAY,YAAY;YACzB,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,GAAG,YAAY,KAAK;gBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,IAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC;QACvD,aAAa,EAAE,aAAa,IAAI,SAAS;QACzC,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,WAAW;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE;YACJ,WAAW,GAAG,8CAA8C;YAC5D,4DAA4D;YAC5D,2CAA2C;YAC3C,wDAAwD;SACzD;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAsB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,kBAAkB,EAAE,OAAO,CACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CACjD;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAc,EACd,IAAsB;IAEtB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,SAAS;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE;YACJ,uEAAuE;YACvE,iEAAiE;YACjE,2CAA2C;SAC5C;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAsB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAC1D,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"catalog-store-cli.js","sourceRoot":"","sources":["../src/catalog-store-cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,GAE5B,MAAM,+BAA+B,CAAC;AAavC,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,IAAY;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,wEAAwE,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,kDAAkD,EAClD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CACpB,YAAY,EACZ,qBAAqB,QAAQ,qDAAqD,EAClF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACtC,kBAAkB,CAAC;IACrB,OAAO,sBAAsB,CAAC;QAC5B,cAAc,EAAE,0BAA0B,EAAE;QAC5C,WAAW,EAAE,WAAW;QACxB,QAAQ;QACR,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9D,eAAe,EAAE,QAAQ;QACzB,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAClB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAClD,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,GAA2B;IAC7E,MAAM,KAAK,GAAG;QACZ,8DAA8D;QAC9D,wEAAwE;QACxE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;KACpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAmC;IACtD,OAAO;QACL,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,uBAAuB;QAC5D,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,kBAAkB;QACrE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI;YACjB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAGrB;IACC,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,aAAa;QAC3C,4BAA4B,EAAE,MAAM,CAAC,aAAa;QAClD,0BAA0B,EACxB,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,SAAS;QAC7D,8BAA8B,EAC5B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,iBAAiB;KAC1E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAuB,EACvB,IAAc,EACd,WAAuC;IAEvC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC;;;;;;;;;;;gEAWmD,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GACX,GAAG,YAAY,YAAY;YACzB,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,GAAG,YAAY,KAAK;gBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,IAAsB;IAEtB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,4EAA4E,CAC7E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAChE,IAAI,YAAkC,CAAC;IACvC,IAAI,eAAe,EAAE,CAAC;QACpB,YAAY,GAAG,eAAe;aAC3B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;SAAM,IAAI,cAAc,EAAE,CAAC;QAC1B,YAAY,GAAG,CAAC,GAAG,iCAAiC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,CAAC,KAAK,CACX;YACE,yEAAyE;YACzE,qBAAqB,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClE,4FAA4F;SAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,0BAA0B,CAAC;QACvD,aAAa,EAAE,aAAa,IAAI,SAAS;QACzC,YAAY;QACZ,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,WAAW;QACnB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE;YACJ,WAAW,GAAG,8CAA8C;YAC5D,sEAAsE;YACtE,wFAAwF;YACxF,2CAA2C;YAC3C,wDAAwD;SACzD;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAsB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,kBAAkB,EAAE,OAAO,CACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CACjD;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAc,EACd,IAAsB;IAEtB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,EAAE,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,SAAS;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE;YACJ,uEAAuE;YACvE,iEAAiE;YACjE,2CAA2C;SAC5C;KACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAsB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAC1D,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/connector-ops/checkpoint-store.d.ts

@@ -0,0 +1,7 @@
+import type { MongoClient } from "mongodb";
+import { type PutStreamCheckpoint, type StreamCheckpointMethod, type StreamCheckpointStore } from "./checkpoint-types.js";
+export declare function assertCheckpointMethod(raw: unknown): StreamCheckpointMethod;
+export declare function validatePutCheckpoint(body: PutStreamCheckpoint): void;
+export declare function createInMemoryStreamCheckpointStore(orgId: string): StreamCheckpointStore;
+export declare function createMongoStreamCheckpointStore(client: MongoClient, orgId: string): StreamCheckpointStore;
+//# sourceMappingURL=checkpoint-store.d.ts.map

package/dist/connector-ops/checkpoint-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-store.d.ts","sourceRoot":"","sources":["../../src/connector-ops/checkpoint-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAM,WAAW,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,EAGL,KAAK,mBAAmB,EAExB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAW/B,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,GACX,sBAAsB,CAUxB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAoBrE;AAUD,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,GACZ,qBAAqB,CA+CvB;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,qBAAqB,CAyEvB"}

package/dist/connector-ops/checkpoint-store.js

@@ -0,0 +1,135 @@
+import { ServiceError } from "../errors.js";
+import { hasSecretPayload } from "./sanitize.js";
+import { MCO_COLLECTIONS_CHECKPOINT, STREAM_CHECKPOINT_METHODS, } from "./checkpoint-types.js";
+function operationalDbName(orgId) {
+    return `${orgId}_operational`;
+}
+function stripMongo(doc) {
+    const { _id: _drop, ...rest } = doc;
+    return rest;
+}
+export function assertCheckpointMethod(raw) {
+    if (typeof raw === "string" &&
+        STREAM_CHECKPOINT_METHODS.includes(raw)) {
+        return raw;
+    }
+    throw new Error(`method must be one of: ${STREAM_CHECKPOINT_METHODS.join(", ")}`);
+}
+export function validatePutCheckpoint(body) {
+    assertCheckpointMethod(body.method);
+    if (hasSecretPayload(body)) {
+        throw new Error("checkpoint payload must not contain secrets or response bodies");
+    }
+    const method = body.method;
+    if (method === "watermark" && body.watermark == null) {
+        throw new Error("watermark required when method is watermark");
+    }
+    if (method === "revision" && body.revision == null) {
+        throw new Error("revision required when method is revision");
+    }
+    if (method === "fullScanHash" && body.fullScanHash == null) {
+        throw new Error("fullScanHash required when method is fullScanHash");
+    }
+    if (method === "cursor" && (body.cursor == null || body.cursor === "")) {
+        throw new Error("cursor required when method is cursor");
+    }
+}
+function streamKey(connectorId, instanceId, streamId) {
+    return `${connectorId}\0${instanceId}\0${streamId}`;
+}
+export function createInMemoryStreamCheckpointStore(orgId) {
+    const byKey = new Map();
+    return {
+        async get(connectorId, instanceId, streamId) {
+            const doc = byKey.get(streamKey(connectorId, instanceId, streamId));
+            return doc ? { ...doc } : null;
+        },
+        async put(connectorId, instanceId, streamId, body) {
+            validatePutCheckpoint(body);
+            const k = streamKey(connectorId, instanceId, streamId);
+            const existing = byKey.get(k);
+            if (body.expectedCheckpointRevision != null &&
+                (existing?.checkpointRevision ?? 0) !== body.expectedCheckpointRevision) {
+                throw new ServiceError("CHECKPOINT_REVISION_CONFLICT", `checkpoint revision conflict: expected ${body.expectedCheckpointRevision}, got ${existing?.checkpointRevision ?? 0}`, 409);
+            }
+            const now = new Date().toISOString();
+            const doc = {
+                orgId,
+                connectorId,
+                instanceId,
+                streamId,
+                method: body.method,
+                watermark: body.watermark ?? null,
+                revision: body.revision ?? null,
+                fullScanHash: body.fullScanHash ?? null,
+                cursor: body.cursor ?? null,
+                contentHash: body.contentHash ?? null,
+                producerRunId: body.producerRunId ?? null,
+                checkpointRevision: (existing?.checkpointRevision ?? 0) + 1,
+                updatedAt: now,
+            };
+            byKey.set(k, doc);
+            return { ...doc };
+        },
+        async clear(connectorId, instanceId, streamId) {
+            return byKey.delete(streamKey(connectorId, instanceId, streamId));
+        },
+    };
+}
+export function createMongoStreamCheckpointStore(client, orgId) {
+    const db = client.db(operationalDbName(orgId));
+    const col = () => db.collection(MCO_COLLECTIONS_CHECKPOINT.checkpoints);
+    let indexesReady = null;
+    const ensureIndexes = async () => {
+        if (!indexesReady) {
+            indexesReady = (async () => {
+                await col().createIndex({ connectorId: 1, instanceId: 1, streamId: 1 }, { unique: true, name: "mco_stream_checkpoint_unique" });
+            })();
+        }
+        await indexesReady;
+    };
+    return {
+        async get(connectorId, instanceId, streamId) {
+            await ensureIndexes();
+            const doc = await col().findOne({ connectorId, instanceId, streamId });
+            return doc ? stripMongo(doc) : null;
+        },
+        async put(connectorId, instanceId, streamId, body) {
+            await ensureIndexes();
+            validatePutCheckpoint(body);
+            const existing = await col().findOne({
+                connectorId,
+                instanceId,
+                streamId,
+            });
+            if (body.expectedCheckpointRevision != null &&
+                (existing?.checkpointRevision ?? 0) !== body.expectedCheckpointRevision) {
+                throw new ServiceError("CHECKPOINT_REVISION_CONFLICT", `checkpoint revision conflict: expected ${body.expectedCheckpointRevision}, got ${existing?.checkpointRevision ?? 0}`, 409);
+            }
+            const now = new Date().toISOString();
+            const doc = {
+                orgId,
+                connectorId,
+                instanceId,
+                streamId,
+                method: body.method,
+                watermark: body.watermark ?? null,
+                revision: body.revision ?? null,
+                fullScanHash: body.fullScanHash ?? null,
+                cursor: body.cursor ?? null,
+                contentHash: body.contentHash ?? null,
+                producerRunId: body.producerRunId ?? null,
+                checkpointRevision: (existing?.checkpointRevision ?? 0) + 1,
+                updatedAt: now,
+            };
+            await col().replaceOne({ connectorId, instanceId, streamId }, doc, { upsert: true });
+            return { ...doc };
+        },
+        async clear(connectorId, instanceId, streamId) {
+            await ensureIndexes();
+            const res = await col().deleteOne({ connectorId, instanceId, streamId });
+            return res.deletedCount > 0;
+        },
+    };
+}
+//# sourceMappingURL=checkpoint-store.js.map

package/dist/connector-ops/checkpoint-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-store.js","sourceRoot":"","sources":["../../src/connector-ops/checkpoint-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAK1B,MAAM,uBAAuB,CAAC;AAE/B,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,GAAG,KAAK,cAAc,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAmB,GAA0B;IAC9D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAA4B,CAAC;IAC7D,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,GAAY;IAEZ,IACE,OAAO,GAAG,KAAK,QAAQ;QACtB,yBAA+C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC9D,CAAC;QACD,OAAO,GAA6B,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,0BAA0B,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,KAAK,cAAc,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,WAAmB,EACnB,UAAkB,EAClB,QAAgB;IAEhB,OAAO,GAAG,WAAW,KAAK,UAAU,KAAK,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAElD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI;YAC/C,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9B,IACE,IAAI,CAAC,0BAA0B,IAAI,IAAI;gBACvC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,0BAA0B,EACvE,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,IAAI,CAAC,0BAA0B,SAAS,QAAQ,EAAE,kBAAkB,IAAI,CAAC,EAAE,EACrH,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAqB;gBAC5B,KAAK;gBACL,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;gBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;gBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;gBACzC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC3D,SAAS,EAAE,GAAG;aACf,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClB,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAmB,EACnB,KAAa;IAEb,MAAM,EAAE,GAAO,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,EAAE,CACf,EAAE,CAAC,UAAU,CAAmB,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,YAAY,GAAyB,IAAI,CAAC;IAE9C,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,GAAG,EAAE,CAAC,WAAW,CACrB,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CACvD,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,MAAM,YAAY,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ;YACzC,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI;YAC/C,MAAM,aAAa,EAAE,CAAC;YACtB,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;gBACnC,WAAW;gBACX,UAAU;gBACV,QAAQ;aACT,CAAC,CAAC;YACH,IACE,IAAI,CAAC,0BAA0B,IAAI,IAAI;gBACvC,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,0BAA0B,EACvE,CAAC;gBACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,IAAI,CAAC,0BAA0B,SAAS,QAAQ,EAAE,kBAAkB,IAAI,CAAC,EAAE,EACrH,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,GAAG,GAAqB;gBAC5B,KAAK;gBACL,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;gBAC/B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;gBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;gBACzC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC;gBAC3D,SAAS,EAAE,GAAG;aACf,CAAC;YACF,MAAM,GAAG,EAAE,CAAC,UAAU,CACpB,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,EACrC,GAAG,EACH,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;YACF,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ;YAC3C,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzE,OAAO,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connector-ops/checkpoint-types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * INC-01 stream checkpoints — offsets/cursors for continuous acquisition.
+ * Distinct from Memory OT source checkpoints (sourceId × mode × workRef).
+ */
+export type StreamCheckpointMethod = "watermark" | "revision" | "fullScanHash" | "cursor";
+export type StreamCheckpoint = {
+    orgId: string;
+    connectorId: string;
+    instanceId: string;
+    streamId: string;
+    method: StreamCheckpointMethod;
+    /** Splunk-style _indextime / time watermark. */
+    watermark?: string | number | null;
+    /** FortiGate revision / sequence. */
+    revision?: string | number | null;
+    /** Full-scan content hash gate. */
+    fullScanHash?: string | null;
+    /** Opaque cursor (Entra @odata.deltaLink, Falcon offset, …). */
+    cursor?: string | null;
+    contentHash?: string | null;
+    producerRunId?: string | null;
+    /** Checkpoint document revision for optional CAS on put. */
+    checkpointRevision: number;
+    updatedAt: string;
+};
+export type PutStreamCheckpoint = {
+    method: StreamCheckpointMethod;
+    watermark?: string | number | null;
+    revision?: string | number | null;
+    fullScanHash?: string | null;
+    cursor?: string | null;
+    contentHash?: string | null;
+    producerRunId?: string | null;
+    /** When set, put fails unless current checkpointRevision matches. */
+    expectedCheckpointRevision?: number;
+};
+export type StreamCheckpointStore = {
+    get(connectorId: string, instanceId: string, streamId: string): Promise<StreamCheckpoint | null>;
+    put(connectorId: string, instanceId: string, streamId: string, body: PutStreamCheckpoint): Promise<StreamCheckpoint>;
+    clear(connectorId: string, instanceId: string, streamId: string): Promise<boolean>;
+};
+export declare const STREAM_CHECKPOINT_METHODS: readonly StreamCheckpointMethod[];
+export declare const MCO_COLLECTIONS_CHECKPOINT: {
+    readonly checkpoints: "mco_stream_checkpoints";
+};
+//# sourceMappingURL=checkpoint-types.d.ts.map

package/dist/connector-ops/checkpoint-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-types.d.ts","sourceRoot":"","sources":["../../src/connector-ops/checkpoint-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,sBAAsB,GAC9B,WAAW,GACX,UAAU,GACV,cAAc,GACd,QAAQ,CAAC;AAEb,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClC,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4DAA4D;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qEAAqE;IACrE,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CACD,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC,GAAG,CACD,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,SAAS,sBAAsB,EAK7D,CAAC;AAEX,eAAO,MAAM,0BAA0B;;CAE7B,CAAC"}

package/dist/connector-ops/checkpoint-types.js

@@ -0,0 +1,14 @@
+/**
+ * INC-01 stream checkpoints — offsets/cursors for continuous acquisition.
+ * Distinct from Memory OT source checkpoints (sourceId × mode × workRef).
+ */
+export const STREAM_CHECKPOINT_METHODS = [
+    "watermark",
+    "revision",
+    "fullScanHash",
+    "cursor",
+];
+export const MCO_COLLECTIONS_CHECKPOINT = {
+    checkpoints: "mco_stream_checkpoints",
+};
+//# sourceMappingURL=checkpoint-types.js.map

package/dist/connector-ops/checkpoint-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-types.js","sourceRoot":"","sources":["../../src/connector-ops/checkpoint-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4DH,MAAM,CAAC,MAAM,yBAAyB,GAAsC;IAC1E,WAAW;IACX,UAAU;IACV,cAAc;IACd,QAAQ;CACA,CAAC;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,WAAW,EAAE,wBAAwB;CAC7B,CAAC"}