@x12i/memorix-service 3.6.4 → 3.7.0

package/dist/caller-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-identity.d.ts","sourceRoot":"","sources":["../src/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C,eAAO,MAAM,aAAa,qBAAqB,CAAC;AAEhD,6BAA6B;AAC7B,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAoC,CAAC;AAEhE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG;IAC5D,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;CACjB,CAwBA;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CASzD;AAED,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAKhE;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAQxE"}

package/dist/caller-identity.js

@@ -0,0 +1,77 @@
+import { ServiceError } from "./errors.js";
+export const CALLER_HEADER = "x-memorix-caller";
+/** Max length after trim. */
+export const CALLER_MAX_LEN = 128;
+/**
+ * Starts with alphanumeric or `@` (scoped package ids); then alnum, `.` `_` `@` `/` `-`.
+ * Examples: synapix-lander, map-store, memorix-studio, @x12i/memorix-client
+ */
+export const CALLER_PATTERN = /^[a-zA-Z0-9@][a-zA-Z0-9._@/-]*$/;
+export function readCallerFromHeaders(headers) {
+    const v = headers[CALLER_HEADER] ?? headers[CALLER_HEADER.toLowerCase()];
+    if (Array.isArray(v))
+        return typeof v[0] === "string" ? v[0] : undefined;
+    return typeof v === "string" ? v : undefined;
+}
+export function normalizeCaller(raw) {
+    return raw.trim();
+}
+export function validateCallerValue(raw) {
+    if (raw === undefined || raw.trim() === "") {
+        return {
+            ok: false,
+            code: "CALLER_REQUIRED",
+            message: `${CALLER_HEADER} is required on product /api requests`,
+        };
+    }
+    const caller = normalizeCaller(raw);
+    if (caller.length > CALLER_MAX_LEN) {
+        return {
+            ok: false,
+            code: "CALLER_INVALID",
+            message: `${CALLER_HEADER} must be at most ${CALLER_MAX_LEN} characters`,
+        };
+    }
+    if (!CALLER_PATTERN.test(caller)) {
+        return {
+            ok: false,
+            code: "CALLER_INVALID",
+            message: `${CALLER_HEADER} must match ${CALLER_PATTERN}`,
+        };
+    }
+    return { ok: true, caller };
+}
+/** True when the path is a product API that requires caller identity. */
+export function pathRequiresCaller(urlPath) {
+    const path = (urlPath.split("?")[0] ?? urlPath).trim() || "/";
+    return path === "/api" || path.startsWith("/api/");
+}
+/**
+ * Read + validate caller from the request. Throws ServiceError on failure.
+ * Returns the canonical caller string when valid.
+ */
+export function requireCaller(req) {
+    const raw = readCallerFromHeaders(req.headers);
+    const result = validateCallerValue(raw);
+    if (!result.ok) {
+        throw new ServiceError(result.code, result.message, 400);
+    }
+    return result.caller;
+}
+/** Fastify onRequest: enforce caller on /api/* only. */
+export function enforceCallerOnRequest(req) {
+    const path = req.url?.split("?")[0] ?? req.url ?? "";
+    if (!pathRequiresCaller(path))
+        return;
+    const caller = requireCaller(req);
+    req.memorixCaller = caller;
+}
+export function getRequestCaller(req) {
+    const tagged = req.memorixCaller;
+    if (tagged)
+        return tagged;
+    const raw = readCallerFromHeaders(req.headers);
+    const result = validateCallerValue(raw);
+    return result.ok ? result.caller : undefined;
+}
+//# sourceMappingURL=caller-identity.js.map

package/dist/caller-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-identity.js","sourceRoot":"","sources":["../src/caller-identity.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEhD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEhE,MAAM,UAAU,qBAAqB,CACnC,OAAsD;IAEtD,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IAQzD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,aAAa,uCAAuC;SACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,aAAa,oBAAoB,cAAc,aAAa;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,GAAG,aAAa,eAAe,cAAc,EAAE;SACzD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;IAC9D,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB;IAC/C,MAAM,GAAG,GAAG,qBAAqB,CAC/B,GAAG,CAAC,OAAwD,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,GAAmD,CAAC,aAAa,GAAG,MAAM,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,MAAM,GAAI,GAAmD,CAAC,aAAa,CAAC;IAClF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,qBAAqB,CAC/B,GAAG,CAAC,OAAwD,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}

package/dist/catalog-store-cli.js

@@ -98,17 +98,17 @@ export async function runCatalogStoreCommand(sub, argv, partialDeps) {
             return await recover(argv, deps);
         if (sub === "list")
             return await list(deps);
-        io.error(`Usage:
-  memorix-service catalog-store provision --out <file>
-      [--force] [--package-type-id <id>]
-      --allowed-kinds agent,connector,service,agent-bundle
-      | --confirm-allowed-kinds   (accept default kinds above)
-  memorix-service catalog-store verify
-  memorix-service catalog-store recover --store-id <id> --out <file>
-  memorix-service catalog-store list
-
-allowedKinds is write-once on createGlobalStore — a forgotten kind needs a second store.
-Secrets (MAGIT_PACKAGE_STORE_SELECTOR, tokens) are never printed on stdout.
+        io.error(`Usage:
+  memorix-service catalog-store provision --out <file>
+      [--force] [--package-type-id <id>]
+      --allowed-kinds agent,connector,service,agent-bundle
+      | --confirm-allowed-kinds   (accept default kinds above)
+  memorix-service catalog-store verify
+  memorix-service catalog-store recover --store-id <id> --out <file>
+  memorix-service catalog-store list
+
+allowedKinds is write-once on createGlobalStore — a forgotten kind needs a second store.
+Secrets (MAGIT_PACKAGE_STORE_SELECTOR, tokens) are never printed on stdout.
 Provision/recover write selector lines to --out with mode 0600.`);
         return 1;
     }

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAcA,0FAA0F;AAC1F,wBAAgB,UAAU,IAAI,IAAI,CAuBjC;AAOD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCpF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAcA,0FAA0F;AAC1F,wBAAgB,UAAU,IAAI,IAAI,CAuBjC;AAOD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCpF"}

package/dist/cli.js

@@ -58,6 +58,8 @@ export async function runCli(argv = process.argv.slice(2)) {
             mode,
             mongoUri,
             logger: true,
+            // Prefer /_live request-stats over Pino per-request spam.
+            disableRequestLogging: true,
             host,
         });
         console.log(`memorix-service listening on http://${boundHost}:${port} (mode=${mode})`);
@@ -66,11 +68,11 @@ export async function runCli(argv = process.argv.slice(2)) {
     if (cmd === "catalog-store") {
         return runCatalogStoreCommand(argv[1], argv.slice(2));
     }
-    console.error(`Usage:
-  memorix-service serve
-  memorix-service catalog-store provision [--out <file>] [--force] [--package-type-id <id>]
-  memorix-service catalog-store verify
-  memorix-service catalog-store recover --store-id <id> [--out <file>]
+    console.error(`Usage:
+  memorix-service serve
+  memorix-service catalog-store provision [--out <file>] [--force] [--package-type-id <id>]
+  memorix-service catalog-store verify
+  memorix-service catalog-store recover --store-id <id> [--out <file>]
   memorix-service catalog-store list`);
     return 1;
 }

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,0FAA0F;AAC1F,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;gBAAE,SAAS;YACvC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IAE/B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAmB,CAAC;QAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;YACxC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,uBAAuB,CAAC;YAC9D,IAAI;YACJ,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,IAAI;SACL,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,SAAS,IAAI,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,KAAK,CAAC;;;;;qCAKqB,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC;AAEzD,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,EAAE,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE;QACP,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,OAAO,GACX,GAAG,YAAY,YAAY;YACzB,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,GAAG,YAAY,KAAK;gBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,0FAA0F;AAC1F,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;gBAAE,SAAS;YACvC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IAE/B,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAmB,CAAC;QAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE;YACxC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE;YACxB,WAAW,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,uBAAuB,CAAC;YAC9D,IAAI;YACJ,QAAQ;YACR,MAAM,EAAE,IAAI;YACZ,0DAA0D;YAC1D,qBAAqB,EAAE,IAAI;YAC3B,IAAI;SACL,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,SAAS,IAAI,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,KAAK,CAAC;;;;;qCAKqB,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC;AAEzD,IAAI,MAAM,EAAE,CAAC;IACX,MAAM,EAAE,CAAC,IAAI,CACX,CAAC,IAAI,EAAE,EAAE;QACP,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,OAAO,GACX,GAAG,YAAY,YAAY;YACzB,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,GAAG,YAAY,KAAK;gBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/deployment-identity.d.ts

@@ -0,0 +1,19 @@
+export type DeploymentRole = "writer" | "reader";
+export type DeploymentIdentityPayload = {
+    orgId: string;
+    role: DeploymentRole;
+    exp: number;
+};
+export type DeploymentAuthMode = "off" | "optional" | "required";
+export type DeploymentAccessKind = "read" | "write";
+export declare function resolveDeploymentAuthMode(raw?: string | undefined): DeploymentAuthMode;
+export declare function resolveDeploymentHmacSecret(): string;
+export declare function issueDeploymentIdentity(input: {
+    orgId: string;
+    role: DeploymentRole;
+    ttlMs?: number;
+}, secret?: string): string;
+export declare function verifyDeploymentIdentity(token: string, secret?: string): DeploymentIdentityPayload | null;
+export declare function identityAllows(identity: DeploymentIdentityPayload, access: DeploymentAccessKind): boolean;
+export declare function readDeploymentTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | undefined;
+//# sourceMappingURL=deployment-identity.d.ts.map

package/dist/deployment-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-identity.d.ts","sourceRoot":"","sources":["../src/deployment-identity.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,CAAC;AAIpD,wBAAgB,yBAAyB,CACvC,GAAG,qBAAsC,GACxC,kBAAkB,CAKpB;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAOpD;AAiBD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9D,MAAM,SAAgC,GACrC,MAAM,CAgBR;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,MAAM,SAAgC,GACrC,yBAAyB,GAAG,IAAI,CA0BlC;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAGT;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,GAAG,SAAS,CAMpB"}

package/dist/deployment-identity.js

@@ -0,0 +1,105 @@
+/**
+ * MX-AUTH-01 — deployment writer vs read-only reader identities.
+ *
+ * Org ids are always canonicalized (MX-ORG-01). Lab default is auth off so
+ * existing scope-header clients keep working; set MEMORIX_DEPLOYMENT_AUTH=required
+ * (or optional) to enforce roles.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { normalizeOrgId } from "./scope.js";
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+export function resolveDeploymentAuthMode(raw = process.env.MEMORIX_DEPLOYMENT_AUTH) {
+    const v = (raw ?? "off").trim().toLowerCase();
+    if (v === "required" || v === "on" || v === "1" || v === "true")
+        return "required";
+    if (v === "optional")
+        return "optional";
+    return "off";
+}
+export function resolveDeploymentHmacSecret() {
+    return (process.env.MEMORIX_DEPLOYMENT_HMAC_SECRET?.trim() ||
+        process.env.MEMORIX_CALLBACK_HMAC_SECRET?.trim() ||
+        process.env.MEMORIX_SERVICE_SECRET?.trim() ||
+        "memorix-dev-deployment-secret");
+}
+function b64url(buf) {
+    const b = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
+    return b
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function fromB64url(s) {
+    const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - (s.length % 4));
+    const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + pad;
+    return Buffer.from(b64, "base64");
+}
+export function issueDeploymentIdentity(input, secret = resolveDeploymentHmacSecret()) {
+    const orgId = normalizeOrgId(input.orgId);
+    if (!orgId) {
+        throw new Error("orgId is required and must be a non-empty string");
+    }
+    if (input.role !== "writer" && input.role !== "reader") {
+        throw new Error('role must be "writer" or "reader"');
+    }
+    const payload = {
+        orgId,
+        role: input.role,
+        exp: Date.now() + (input.ttlMs ?? DEFAULT_TTL_MS),
+    };
+    const body = b64url(JSON.stringify(payload));
+    const sig = b64url(createHmac("sha256", secret).update(body).digest());
+    return `${body}.${sig}`;
+}
+export function verifyDeploymentIdentity(token, secret = resolveDeploymentHmacSecret()) {
+    const parts = token.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [body, sig] = parts;
+    if (!body || !sig)
+        return null;
+    const expected = b64url(createHmac("sha256", secret).update(body).digest());
+    try {
+        const a = Buffer.from(sig);
+        const b = Buffer.from(expected);
+        if (a.length !== b.length || !timingSafeEqual(a, b))
+            return null;
+    }
+    catch {
+        return null;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(fromB64url(body).toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!payload?.orgId || (payload.role !== "writer" && payload.role !== "reader")) {
+        return null;
+    }
+    if (typeof payload.exp !== "number" || Date.now() > payload.exp)
+        return null;
+    const orgId = normalizeOrgId(payload.orgId);
+    if (!orgId)
+        return null;
+    return { ...payload, orgId };
+}
+export function identityAllows(identity, access) {
+    if (access === "read")
+        return identity.role === "reader" || identity.role === "writer";
+    return identity.role === "writer";
+}
+export function readDeploymentTokenFromHeaders(headers) {
+    // Dedicated header only — do not reuse Authorization Bearer (gateway MEMORIX_TOKEN).
+    return (header(headers, "x-memorix-deployment-identity") ??
+        header(headers, "x-memorix-identity"));
+}
+function header(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(v))
+        return typeof v[0] === "string" ? v[0] : undefined;
+    return typeof v === "string" ? v : undefined;
+}
+//# sourceMappingURL=deployment-identity.js.map

package/dist/deployment-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-identity.js","sourceRoot":"","sources":["../src/deployment-identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAc5C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,yBAAyB,CACvC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB;IAEzC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IACnF,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE;QAClD,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE;QAChD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAC1C,+BAA+B,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB;IAClC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAA8D,EAC9D,MAAM,GAAG,2BAA2B,EAAE;IAEtC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAA8B;QACzC,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC;KAClD,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,MAAM,GAAG,2BAA2B,EAAE;IAEtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAkC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8B,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAmC,EACnC,MAA4B;IAE5B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IACvF,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAsD;IAEtD,qFAAqF;IACrF,OAAO,CACL,MAAM,CAAC,OAAO,EAAE,+BAA+B,CAAC;QAChD,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,OAAsD,EACtD,IAAY;IAEZ,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC"}

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KAC/C,CAAC;CACH,CAAC;AAEF,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO/E;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAsCA;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2BrD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KAC/C,CAAC;CACH,CAAC;AAEF,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEf,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAO/E;AA+DD,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAoDA;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA2BrD"}

package/dist/errors.js

@@ -10,6 +10,60 @@ export class ServiceError extends Error {
         this.details = details;
     }
 }
+/**
+ * Map Memorix data-plane error codes (ReaderError / WriterError / AbstractWriteError)
+ * to HTTP status. MX-CONTENT-01: content miss is 404, not 500.
+ */
+const DATA_PLANE_STATUS = {
+    // Misses
+    READ_NOT_FOUND: 404,
+    WRITE_NOT_FOUND: 404,
+    ABSTRACT_WRITE_NOT_FOUND: 404,
+    DIRECTORY_CONTENT_NOT_REGISTERED: 404,
+    // Conflicts
+    WRITE_STALE_REVISION: 409,
+    WRITE_NOT_ABSENT: 409,
+    DIRECTORY_CONFLICT_OBJECT_TYPE: 409,
+    DIRECTORY_CONFLICT_DATA_CATEGORY: 409,
+    DIRECTORY_IDENTITY_REUSE_FORBIDDEN: 409,
+    DIRECTORY_NOT_RESERVED: 409,
+    // Unavailable / dependency
+    READ_UNAVAILABLE: 503,
+    ABSTRACT_WRITE_UNAVAILABLE: 503,
+    READ_RELATIONSHIP_STORE_REQUIRED: 503,
+};
+const DATA_PLANE_ERROR_NAMES = new Set([
+    "DataPlaneError",
+    "ReaderError",
+    "WriterError",
+    "AbstractWriteError",
+]);
+function dataPlaneStatus(code) {
+    if (DATA_PLANE_STATUS[code] !== undefined)
+        return DATA_PLANE_STATUS[code];
+    // Validation / routing / query shape → 400
+    if (code.startsWith("READ_") ||
+        code.startsWith("WRITE_") ||
+        code.startsWith("ROUTE_") ||
+        code.startsWith("SCOPE_") ||
+        code.startsWith("ABSTRACT_WRITE_") ||
+        code.startsWith("DIRECTORY_")) {
+        return 400;
+    }
+    return undefined;
+}
+function isDataPlaneLike(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    if (!("code" in err) || typeof err.code !== "string") {
+        return false;
+    }
+    const name = err instanceof Error ? err.name : undefined;
+    if (name && DATA_PLANE_ERROR_NAMES.has(name))
+        return true;
+    // Duck-type when packages are duplicated across bundles
+    return dataPlaneStatus(err.code) !== undefined;
+}
 export function mapErrorToHttp(err, correlationId) {
     if (err && typeof err === "object" && "code" in err && "statusCode" in err) {
         const e = err;
@@ -37,6 +91,20 @@ export function mapErrorToHttp(err, correlationId) {
             },
         };
     }
+    if (isDataPlaneLike(err)) {
+        const status = dataPlaneStatus(err.code) ?? 500;
+        return {
+            status,
+            body: {
+                error: {
+                    code: err.code,
+                    message: err.message,
+                    correlationId,
+                    details: err.details,
+                },
+            },
+        };
+    }
     const message = err instanceof Error ? err.message : String(err);
     return {
         status: 500,

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,OAAO,CAAW;IAE3B,YAAY,IAAY,EAAE,OAAe,EAAE,UAAU,GAAG,GAAG,EAAE,OAAiB;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,aAAqB;IAIhE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QAC3E,MAAM,CAAC,GAAG,GAAmB,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,UAAU;YACpB,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,aAAa;oBACb,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB;aACF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,aAAa;iBACd;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO;gBACP,aAAa;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QACrF,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACjF,2DAA2D;QAC3D,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC;QACtE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IACE,kHAAkH,CAAC,IAAI,CACrH,CAAC,CACF,EACD,CAAC;gBACD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,OAAO,CAAW;IAE3B,YAAY,IAAY,EAAE,OAAe,EAAE,UAAU,GAAG,GAAG,EAAE,OAAiB;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,SAAS;IACT,cAAc,EAAE,GAAG;IACnB,eAAe,EAAE,GAAG;IACpB,wBAAwB,EAAE,GAAG;IAC7B,gCAAgC,EAAE,GAAG;IAErC,YAAY;IACZ,oBAAoB,EAAE,GAAG;IACzB,gBAAgB,EAAE,GAAG;IACrB,8BAA8B,EAAE,GAAG;IACnC,gCAAgC,EAAE,GAAG;IACrC,kCAAkC,EAAE,GAAG;IACvC,sBAAsB,EAAE,GAAG;IAE3B,2BAA2B;IAC3B,gBAAgB,EAAE,GAAG;IACrB,0BAA0B,EAAE,GAAG;IAC/B,gCAAgC,EAAE,GAAG;CACtC,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1E,2CAA2C;IAC3C,IACE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,GAAY;IAEZ,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,OAAQ,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,IAAI,IAAI,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,wDAAwD;IACxD,OAAO,eAAe,CAAE,GAAwB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,aAAqB;IAIhE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QAC3E,MAAM,CAAC,GAAG,GAAmB,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,UAAU;YACpB,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,aAAa;oBACb,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB;aACF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,aAAa;iBACd;aACF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAChD,OAAO;YACL,MAAM;YACN,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,aAAa;oBACb,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO;gBACP,aAAa;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QACrF,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACjF,2DAA2D;QAC3D,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC;QACtE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IACE,kHAAkH,CAAC,IAAI,CACrH,CAAC,CACF,EACD,CAAC;gBACD,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+export { CALLER_HEADER, CALLER_MAX_LEN, CALLER_PATTERN, enforceCallerOnRequest, getRequestCaller, normalizeCaller, pathRequiresCaller, readCallerFromHeaders, requireCaller, validateCallerValue, } from "./caller-identity.js";
+export { createRequestCountex, attachRequestCountex, registerRequestStatsRoute, HTTP_REQUESTS_COUNTER_ID, REQUEST_STATS_GLOBAL_SCOPE, type RequestCountexHandle, type RequestStatsPayload, type RequestStatsRow, } from "./request-countex.js";
 export { canonicalizeScope, normalizeOrgId, orgIdsEqual, scopeFromHeaders, ScopeValidationError, type MemorixScope, } from "./scope.js";
 export { resolveScope } from "./request-scope.js";
 export { ServiceError, mapErrorToHttp, redactSecrets, type ServiceErrorBody, } from "./errors.js";
@@ -10,4 +12,6 @@ export { createInMemoryMcoAttemptStore, createInMemoryMcoOverrideStore, createMo
 export { createDiskBlobStore, createMemoryBlobStore, createS3BlobStore, createPlatformBlobStore, resolveBlobStoreConfig, assertSafeBlobKey, type BlobObjectStore, type BlobBackendKind, type BlobHead, type S3BlobClient, } from "./blob-store/index.js";
 export { createInMemoryIntegrationInstanceStore, createMongoIntegrationInstanceStore, hasRegistrySecretPayload, INTEGRATION_COLLECTIONS, type IntegrationInstance, type IntegrationInstanceInput, type IntegrationListPage, type IntegrationInstanceStore, type IntegrationMutationAudit, } from "./integrations/index.js";
 export { createInMemoryRestrictedObjectStore, createMongoRestrictedObjectStore, parseRestrictedKek, sha256Hex, RESTRICTED_COLLECTIONS, BREAK_GLASS_HEADER, BREAK_GLASS_REASON_HEADER, type RestrictedObjectMeta, type RestrictedObjectStore, type RestrictedPutInput, type RestrictedClassification, type RestrictedAccessAudit, } from "./restricted-store/index.js";
+export { issueDeploymentIdentity, verifyDeploymentIdentity, identityAllows, resolveDeploymentAuthMode, resolveDeploymentHmacSecret, type DeploymentRole, type DeploymentIdentityPayload, type DeploymentAuthMode, } from "./deployment-identity.js";
+export { requireDeploymentAccess } from "./access-gate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,QAAQ,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,GAChC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACnC,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,kBAAkB,EAClB,SAAS,EACT,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,QAAQ,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,GAChC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACnC,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,kBAAkB,EAClB,SAAS,EACT,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,3 +1,5 @@
+export { CALLER_HEADER, CALLER_MAX_LEN, CALLER_PATTERN, enforceCallerOnRequest, getRequestCaller, normalizeCaller, pathRequiresCaller, readCallerFromHeaders, requireCaller, validateCallerValue, } from "./caller-identity.js";
+export { createRequestCountex, attachRequestCountex, registerRequestStatsRoute, HTTP_REQUESTS_COUNTER_ID, REQUEST_STATS_GLOBAL_SCOPE, } from "./request-countex.js";
 export { canonicalizeScope, normalizeOrgId, orgIdsEqual, scopeFromHeaders, ScopeValidationError, } from "./scope.js";
 export { resolveScope } from "./request-scope.js";
 export { ServiceError, mapErrorToHttp, redactSecrets, } from "./errors.js";
@@ -10,4 +12,6 @@ export { createInMemoryMcoAttemptStore, createInMemoryMcoOverrideStore, createMo
 export { createDiskBlobStore, createMemoryBlobStore, createS3BlobStore, createPlatformBlobStore, resolveBlobStoreConfig, assertSafeBlobKey, } from "./blob-store/index.js";
 export { createInMemoryIntegrationInstanceStore, createMongoIntegrationInstanceStore, hasRegistrySecretPayload, INTEGRATION_COLLECTIONS, } from "./integrations/index.js";
 export { createInMemoryRestrictedObjectStore, createMongoRestrictedObjectStore, parseRestrictedKek, sha256Hex, RESTRICTED_COLLECTIONS, BREAK_GLASS_HEADER, BREAK_GLASS_REASON_HEADER, } from "./restricted-store/index.js";
+export { issueDeploymentIdentity, verifyDeploymentIdentity, identityAllows, resolveDeploymentAuthMode, resolveDeploymentHmacSecret, } from "./deployment-identity.js";
+export { requireDeploymentAccess } from "./access-gate.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,GAEd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAKrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GAEf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,GAIjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,cAAc,GASf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAKlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACnC,wBAAwB,EACxB,uBAAuB,GAMxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,kBAAkB,EAClB,SAAS,EACT,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,GAM1B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,GAEd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAKrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAGxB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GAEf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,GAIjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,WAAW,EACX,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,GAIpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,cAAc,GASf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,GAKlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACnC,wBAAwB,EACxB,uBAAuB,GAMxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,gCAAgC,EAChC,kBAAkB,EAClB,SAAS,EACT,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,GAM1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,cAAc,EACd,yBAAyB,EACzB,2BAA2B,GAI5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/live.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AA4BnC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,oBAAoB,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,iBAAiB,KACxB,OAAO,CAAC,IAAI,CAAC,CAAC;AAKnB,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GACpC,IAAI,CAEN;AAwBD,eAAO,MAAM,eAAe;;;;UAxDlB,CAAC;;;UAIJ,CAAA;;iEAEK,CAAC;;;;;;CAkDqC,CAAC;AAEnD,mEAAmE;AACnE,eAAO,MAAM,eAAe,cAE1B,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,cAE9B,CAAC;AAsQH,iGAAiG;AACjG,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB;AAslBD,iFAAiF;AACjF,eAAO,MAAM,kBAAkB;;wBAEH,oBAAoB,KAAG,OAAO,CAAC,mBAAmB,CAAC;CAsC9E,CAAC"}
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AA4BnC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,oBAAoB,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,iBAAiB,KACxB,OAAO,CAAC,IAAI,CAAC,CAAC;AAKnB,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GACpC,IAAI,CAEN;AAwBD,eAAO,MAAM,eAAe;;;;UAzDxB,CAAC;;;UAIQ,CAAC;;iEAC0B,CAAC;;;;;;CAoDS,CAAC;AAEnD,mEAAmE;AACnE,eAAO,MAAM,eAAe,cAE1B,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,cAE9B,CAAC;AAuQH,iGAAiG;AACjG,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB;AAslBD,iFAAiF;AACjF,eAAO,MAAM,kBAAkB;;wBAEH,oBAAoB,KAAG,OAAO,CAAC,mBAAmB,CAAC;CAsC9E,CAAC"}

package/dist/live.js

@@ -78,6 +78,7 @@ async function fetchExistingKnowxForAssociate(memorix) {
     const headers = {
         "x-memorix-org-id": memorix.orgId,
         "x-memorix-agent-ids": memorix.agentIds.join(","),
+        "x-memorix-caller": "pipeline-worker",
     };
     if (memorix.grant)
         headers["x-memorix-invocation-grant"] = memorix.grant;