@x12i/memorix-service 3.6.4 → 3.7.1

package/README.md

@@ -1,191 +1,223 @@
-# `@x12i/memorix-service`
-
-Sole production **HTTP composition root** over accepted Memorix packages.
-
-Remote apps should **call** this service over HTTP — not reinvent wiring by installing every engine. Running the process (or a hosted deployment) is the product surface.
-
-## Install / run
-
-```bash
-npm install @x12i/memorix-service@3.6.0   # composition library / CLI
-```
-
-Prefer the monorepo stack (service + Studio + opx-source):
-
-```bash
-# from repo root
-node scripts/dev-stack.mjs
-```
-
-Or this package alone:
-
-```bash
-MEMORIX_SERVICE_MODE=prod MONGO_URI=mongodb://127.0.0.1:27017 npm run serve
-MEMORIX_SERVICE_MODE=dev npm run dev   # metadata in-memory; durable routes 503 without Mongo
-```
-
-| | |
-|--|--|
-| Default port | **5100** (`MEMORIX_SERVICE_PORT`, zone `memorix`) |
-| OpenAPI | `GET /api/openapi.json` |
-| Live view | `GET /_live` (`@x12i/core-service` → `@x12i/api-live-view`) |
-| Health | `GET /health` |
-
-Compliance: this process uses **`@x12i/core-service`** (zone port, health, live view, correlation-id).
-
-## Dual-mode org blob plane (cloud / on-prem)
-
-Not Magit. When storing **org/connector object payloads** that would use cloud buckets,
-on-prem must use **local disk**.
-
-| Env | Effect |
-|-----|--------|
-| `MEMORIX_BLOB_BACKEND` | `disk` / `onprem` (default) or `s3` / `cloud` |
-| `MEMORIX_BLOB_ROOT` | Disk root for on-prem (default `.memorix-blobs`) |
-| `MEMORIX_S3_BUCKET` | Required when backend=`s3` |
-| `MEMORIX_RESTRICTED_KEK` | Optional AES-GCM KEK for disk-encrypted restricted bodies |
-
-Used by **`/api/restricted-store/v1`** (FG-A3). See
-[restricted-store.md](../docs/connector-framework/restricted-store.md) and
-[integration-registry.md](../docs/connector-framework/integration-registry.md).
-
-## Magit package catalog
-
-Default-on when durable Mongo is configured (`METADATA_MAGIT=0` disables).
-
-| Mode | Config |
-|------|--------|
-| **A typed store** | `MAGIT_PACKAGE_STORE_SELECTOR` + `MAGIT_PACKAGE_TYPE_ID` |
-| **B flat catalog** | both unset |
-
-Requires `@x12i/magit@2.14.0`. Defaults: `MAGIT_CATALOG_TENANT=x12i`, `MAGIT_CATALOG_REPO=memorix`.
-
-Ops (provision / verify / recover / channels / smoke): see
-[documentation/magit-typed-store-runbook.md](../documentation/magit-typed-store-runbook.md).
-
-```bash
-npm run catalog:provision -- --out /secure/magit-store.env --confirm-allowed-kinds
-npm run catalog:verify
-npm run catalog:recover -- --store-id st_… --out /secure/magit-store.env
-npm run catalog:list
-npm run magit:cross-env-smoke
-npm run magit:cross-env-smoke -- --publish
-```
-
-**Owner mint:** repo `memorix`, Package stores **empty** until the store exists.  
-**Consumer:** store grant + `repoIds: []` (Repositories unchecked).  
-Channels and release sets need Mode A + publisher token to promote; consumers only resolve.
-
-Env examples: [memorix-service/.env.example](./.env.example). Selector never appears in Studio or `GET /api/diagnostics/scope`.
-
-## Library exports
-
-When embedding the composition root in-process:
-
-```ts
-import {
-  createMemorixPlatform,
-  createMemorixServiceApp,
-  startMemorixServiceHttp,
-} from "@x12i/memorix-service";
-```
-
-## Scope headers
-
-Every `/api/*` request requires:
-
-```http
-x-memorix-org-id: sandboxdemo
-x-memorix-agent-ids: opx
-```
-
-Singular `agentId` headers are rejected. `agentIds[]` selects **effective metadata**; `orgId` selects the **data** universe.
-
-### Org identity is case-insensitive (MX-ORG-01)
-
-Org ids are canonicalized with trim + `toLocaleLowerCase("en-US")`. Matching is
-case-insensitive (`TGI` / `tgi` / `Tgi` are the same org). `scope.orgId`,
-`addressing.orgId`, and storage keys always use that canonical form, so writers
-and readers that differ only by case share one tenant bag. Empty / missing org
-is still rejected (400).
-
-### Minimal curl
-
-```bash
-curl -s http://127.0.0.1:5100/health
-curl -s http://127.0.0.1:5100/api/diagnostics/scope \
-  -H 'x-memorix-org-id: sandboxdemo' \
-  -H 'x-memorix-agent-ids: opx'
-```
-
-## Route families
-
-| Family | Role |
-|--------|------|
-| `/api/metadata` | Kinds, definitions, install/publish, pack versions (Magit default-on; `METADATA_MAGIT=0` disables) |
-| `/api/data` | Content get/list/write, compose, abstract |
-| `/api/relationships` | Query / discover / verify / rebuild (**no** ad-hoc link PUT) |
-| `/api/memory` | Pull, raw, sources, **checkpoints**, schedules, runs, `commit-page`, connection probe |
-| `/api/pipelines` | Definitions, start, runs, retry/resume |
-| `/api/operations` | Operational helpers |
-| `/api/workflow` | Workflow sibling content |
-| `/api/intelligence` | Profiles / proposals (never auto-install) |
-| `/api/data-journey` | Evidence cone + expected-vs-filled coverage |
-| `/api/ai-services` | Companion AI-services (function / skill / task / graph) — list, items, invoke proxy |
-
-### AI-services companions
-
-Point memorix-service at FR-compliant processes via env (`FUNCX_URL`, `AI_SKILLS_URL`, `AI_TASKS_URL`, `GRAPH_ENGINE_URL`).  
-Stack: AI companions are **on by default**; skip with `--no-ai-services` or `AI_SERVICES=0`.
-
-### Vendor pipeline workers (opt-in)
-
-Archetype-A HTTP companions invoke via `POST {origin}/pipeline`. Inject **base origin only** (no `/pipeline` path). Soft-skip when URL unset; fail-closed when set (`src/optional-companion-url.ts`).
-
-| Suite | Stack flag | Client env |
-|-------|------------|------------|
-| Exellix Apollo + M365 | `--exellix-connectors` / `EXELLIX_CONNECTORS=1` | `EXELLIX_APOLLO_READ_URL`, `EXELLIX_APOLLO_ACTIONS_URL`, `EXELLIX_M365_USER_READ_URL`, `EXELLIX_M365_USER_ACTION_URL` (ports 9711–9722, zone `exellix-connectors`) |
-| Neo security workers | `--neo-connectors` / `NEO_CONNECTORS=1` | `NEO_FIREWALL_URL`, `NEO_XDR_URL`, `NEO_NESSUS_URL`, `NEO_ENTRA_URL`, `NEO_SPLUNK_URL`, `NEO_CROWDSTRIKE_URL` (frozen ports; no zone remap) |
-| Neo status UI | `--neo-status-ui` / `NEO_STATUS_UI=1` | `NEO_STATUS_UI_URL` (:9001) |
-
-Optional hard gates: `EXELLIX_CONNECTORS_REQUIRED=1`, `NEO_CONNECTORS_REQUIRED=1`.
-
-**Neo packages** ship on GitHub Packages. Local install needs `.npmrc` scope + `NODE_AUTH_TOKEN` (see [`.npmrc.example`](../.npmrc.example)).
-
-### Memory (operator + called-service)
-
-| Method | Path | Notes |
-|--------|------|-------|
-| `GET` | `/api/memory/sources/{sourceId}/connection` | Probe configured URL |
-| `GET`/`PUT`/`POST` | `…/checkpoints` (+ `/reset`) | Source position per OT × route |
-| `POST` | `…/commit-page` | Model B atomic land + checkpoint |
-| `POST` | `/api/memory/pull` | **Operator-only** — rejected when `x-memorix-invocation-grant` is present |
-
-Called services with `memorixAccess` receive an HMAC grant scoped to `explore` · `checkpoints` · `raw`. Prefer **`@x12i/memorix-sdk`** (`/client` / `/worker`) over raw fetch.
-
-### Data journey (read-only)
-
-| Method | Path |
-|--------|------|
-| `GET` | `/api/data-journey/object-types` |
-| `GET` | `/api/data-journey/journeys` |
-| `POST` | `/api/data-journey/matrix/query` |
-| `POST` | `/api/data-journey/matrix/columns/query` |
-| `POST` | `/api/data-journey/matrix/cells/query` |
-| `GET` | `/api/data-journey/evidence/:evidenceRef` |
-| `GET` | `/api/data-journey/expected-slots` |
-| `POST` | `/api/data-journey/coverage` |
-
-## Hard rules
-
-- Prod rejects missing Mongo and in-memory durable fallbacks
-- `/api/relationships/links` → **405** (no ad-hoc link mutation)
-- Intelligence never auto-installs/publishes
-- Only `credentialRef` may cross Memory APIs
-
-## Docs
-
-- [`documentation/http-api.md`](../documentation/http-api.md) · OpenAPI in-repo [`openapi/openapi.json`](./openapi/openapi.json)
-- Capability SDK: [`@x12i/memorix-sdk`](../memorix-sdk/) · HTTP client: [`@x12i/memorix-client`](../memorix-client/)
-- Ebooks: [Platform Overview](../memorix-docs/00-platform-overview/) · [Services](../memorix-docs/07-services/) · [Runtime Data Client](../memorix-docs/02-runtime-data-client/)
-- Hub: [https://docs.memorix.x12i.com](https://docs.memorix.x12i.com) · npm `@x12i/memorix-docs`
+# `@x12i/memorix-service`
+
+Sole production **HTTP composition root** over accepted Memorix packages.
+
+Remote apps should **call** this service over HTTP — not reinvent wiring by installing every engine. Running the process (or a hosted deployment) is the product surface.
+
+## Install / run
+
+```bash
+npm install @x12i/memorix-service@3.6.0   # composition library / CLI
+```
+
+Prefer the monorepo stack (service + Studio + opx-source):
+
+```bash
+# from repo root
+node scripts/dev-stack.mjs
+```
+
+Or this package alone:
+
+```bash
+MEMORIX_SERVICE_MODE=prod MONGO_URI=mongodb://127.0.0.1:27017 npm run serve
+MEMORIX_SERVICE_MODE=dev npm run dev   # metadata in-memory; durable routes 503 without Mongo
+```
+
+| | |
+|--|--|
+| Default port | **5100** (`MEMORIX_SERVICE_PORT`, zone `memorix`) |
+| OpenAPI | `GET /api/openapi.json` |
+| Live view | `GET /_live` (`@x12i/core-service` → `@x12i/api-live-view`) |
+| Health | `GET /health` |
+
+Compliance: this process uses **`@x12i/core-service`** (zone port, health, live view, correlation-id).
+
+## Dual-mode org blob plane (cloud / on-prem)
+
+Not Magit. When storing **org/connector object payloads** that would use cloud buckets,
+on-prem must use **local disk**.
+
+| Env | Effect |
+|-----|--------|
+| `MEMORIX_BLOB_BACKEND` | `disk` / `onprem` (default) or `s3` / `cloud` |
+| `MEMORIX_BLOB_ROOT` | Disk root for on-prem (default `.memorix-blobs`) |
+| `MEMORIX_S3_BUCKET` | Required when backend=`s3` |
+| `MEMORIX_RESTRICTED_KEK` | Optional AES-GCM KEK for disk-encrypted restricted bodies |
+
+Used by **`/api/restricted-store/v1`** (FG-A3). See
+[restricted-store.md](../docs/connector-framework/restricted-store.md) and
+[integration-registry.md](../docs/connector-framework/integration-registry.md).
+
+## Magit package catalog
+
+Default-on when durable Mongo is configured (`METADATA_MAGIT=0` disables).
+
+| Mode | Config |
+|------|--------|
+| **A typed store** | `MAGIT_PACKAGE_STORE_SELECTOR` + `MAGIT_PACKAGE_TYPE_ID` |
+| **B flat catalog** | both unset |
+
+Requires `@x12i/magit@2.14.0`. Defaults: `MAGIT_CATALOG_TENANT=x12i`, `MAGIT_CATALOG_REPO=memorix`.
+
+Ops (provision / verify / recover / channels / smoke): see
+[documentation/magit-typed-store-runbook.md](../documentation/magit-typed-store-runbook.md).
+
+```bash
+npm run catalog:provision -- --out /secure/magit-store.env --confirm-allowed-kinds
+npm run catalog:verify
+npm run catalog:recover -- --store-id st_… --out /secure/magit-store.env
+npm run catalog:list
+npm run magit:cross-env-smoke
+npm run magit:cross-env-smoke -- --publish
+```
+
+**Owner mint:** repo `memorix`, Package stores **empty** until the store exists.  
+**Consumer:** store grant + `repoIds: []` (Repositories unchecked).  
+Channels and release sets need Mode A + publisher token to promote; consumers only resolve.
+
+Env examples: [memorix-service/.env.example](./.env.example). Selector never appears in Studio or `GET /api/diagnostics/scope`.
+
+## Library exports
+
+When embedding the composition root in-process:
+
+```ts
+import {
+  createMemorixPlatform,
+  createMemorixServiceApp,
+  startMemorixServiceHttp,
+} from "@x12i/memorix-service";
+```
+
+## Scope headers
+
+Every `/api/*` request requires:
+
+```http
+x-memorix-org-id: sandboxdemo
+x-memorix-agent-ids: opx
+```
+
+Singular `agentId` headers are rejected. `agentIds[]` selects **effective metadata**; `orgId` selects the **data** universe.
+
+### Org identity is case-insensitive (MX-ORG-01)
+
+Org ids are canonicalized with trim + `toLocaleLowerCase("en-US")`. Matching is
+case-insensitive (`TGI` / `tgi` / `Tgi` are the same org). `scope.orgId`,
+`addressing.orgId`, and storage keys always use that canonical form, so writers
+and readers that differ only by case share one tenant bag. Empty / missing org
+is still rejected (400).
+
+### Deployment writer / reader (MX-AUTH-01)
+
+Default: **off** (scope headers only). To separate Synapix lander (writer) from
+map-store (read-only):
+
+```bash
+MEMORIX_DEPLOYMENT_AUTH=required   # or optional
+MEMORIX_DEPLOYMENT_HMAC_SECRET=…   # optional; falls back to callback/service secret
+```
+
+Mint tokens (same process secret):
+
+```ts
+import { issueDeploymentIdentity } from "@x12i/memorix-service";
+const writer = issueDeploymentIdentity({ orgId: "tgi", role: "writer" });
+const reader = issueDeploymentIdentity({ orgId: "tgi", role: "reader" });
+```
+
+Send `x-memorix-deployment-identity: <token>` on every product call. Readers may
+GET/list/compose; only writers may POST content / install metadata.
+
+### Content miss status (MX-CONTENT-01)
+
+`GET /api/data/content?…&id=` for a missing record returns **404** `READ_NOT_FOUND`
+(not 500).
+
+### Metadata hot-reload (MX-META-01)
+
+After pack install the live catalog is flushed and OrgPorts cleared — no restart
+required in-process. Ops may also call `POST /api/metadata/reload` with
+`{ "confirm": true }` (e.g. after Magit apply on another worker).
+
+### Minimal curl
+
+```bash
+curl -s http://127.0.0.1:5100/health
+curl -s http://127.0.0.1:5100/api/diagnostics/scope \
+  -H 'x-memorix-org-id: sandboxdemo' \
+  -H 'x-memorix-agent-ids: opx'
+```
+
+## Route families
+
+| Family | Role |
+|--------|------|
+| `/api/metadata` | Kinds, definitions, install/publish, pack versions (Magit default-on; `METADATA_MAGIT=0` disables) |
+| `/api/data` | Content get/list/write, compose, abstract |
+| `/api/relationships` | Query / discover / verify / rebuild (**no** ad-hoc link PUT) |
+| `/api/memory` | Pull, raw, sources, **checkpoints**, schedules, runs, `commit-page`, connection probe |
+| `/api/pipelines` | Definitions, start, runs, retry/resume |
+| `/api/operations` | Operational helpers |
+| `/api/workflow` | Workflow sibling content |
+| `/api/intelligence` | Profiles / proposals (never auto-install) |
+| `/api/data-journey` | Evidence cone + expected-vs-filled coverage |
+| `/api/ai-services` | Companion AI-services (function / skill / task / graph) — list, items, invoke proxy |
+
+### AI-services companions
+
+Point memorix-service at FR-compliant processes via env (`FUNCX_URL`, `AI_SKILLS_URL`, `AI_TASKS_URL`, `GRAPH_ENGINE_URL`).  
+Stack: AI companions are **on by default**; skip with `--no-ai-services` or `AI_SERVICES=0`.
+
+### Vendor pipeline workers (opt-in)
+
+Archetype-A HTTP companions invoke via `POST {origin}/pipeline`. Inject **base origin only** (no `/pipeline` path). Soft-skip when URL unset; fail-closed when set (`src/optional-companion-url.ts`).
+
+| Suite | Stack flag | Client env |
+|-------|------------|------------|
+| Exellix Apollo + M365 | `--exellix-connectors` / `EXELLIX_CONNECTORS=1` | `EXELLIX_APOLLO_READ_URL`, `EXELLIX_APOLLO_ACTIONS_URL`, `EXELLIX_M365_USER_READ_URL`, `EXELLIX_M365_USER_ACTION_URL` (ports 9711–9722, zone `exellix-connectors`) |
+| Neo security workers | `--neo-connectors` / `NEO_CONNECTORS=1` | `NEO_FIREWALL_URL`, `NEO_XDR_URL`, `NEO_NESSUS_URL`, `NEO_ENTRA_URL`, `NEO_SPLUNK_URL`, `NEO_CROWDSTRIKE_URL` (zone **neo-proagentics** **10000–10100**) |
+| Neo status UI | `--neo-status-ui` / `NEO_STATUS_UI=1` | `NEO_STATUS_UI_URL` (:10001) |
+
+Optional hard gates: `EXELLIX_CONNECTORS_REQUIRED=1`, `NEO_CONNECTORS_REQUIRED=1`.
+
+**Neo packages** ship on GitHub Packages. Local install needs `.npmrc` scope + `NODE_AUTH_TOKEN` (see [`.npmrc.example`](../.npmrc.example)).
+
+### Memory (operator + called-service)
+
+| Method | Path | Notes |
+|--------|------|-------|
+| `GET` | `/api/memory/sources/{sourceId}/connection` | Probe configured URL |
+| `GET`/`PUT`/`POST` | `…/checkpoints` (+ `/reset`) | Source position per OT × route |
+| `POST` | `…/commit-page` | Model B atomic land + checkpoint |
+| `POST` | `/api/memory/pull` | **Operator-only** — rejected when `x-memorix-invocation-grant` is present |
+
+Called services with `memorixAccess` receive an HMAC grant scoped to `explore` · `checkpoints` · `raw`. Prefer **`@x12i/memorix-sdk`** (`/client` / `/worker`) over raw fetch.
+
+### Data journey (read-only)
+
+| Method | Path |
+|--------|------|
+| `GET` | `/api/data-journey/object-types` |
+| `GET` | `/api/data-journey/journeys` |
+| `POST` | `/api/data-journey/matrix/query` |
+| `POST` | `/api/data-journey/matrix/columns/query` |
+| `POST` | `/api/data-journey/matrix/cells/query` |
+| `GET` | `/api/data-journey/evidence/:evidenceRef` |
+| `GET` | `/api/data-journey/expected-slots` |
+| `POST` | `/api/data-journey/coverage` |
+
+## Hard rules
+
+- Prod rejects missing Mongo and in-memory durable fallbacks
+- `/api/relationships/links` → **405** (no ad-hoc link mutation)
+- Intelligence never auto-installs/publishes
+- Only `credentialRef` may cross Memory APIs
+
+## Docs
+
+- [`documentation/http-api.md`](../documentation/http-api.md) · OpenAPI in-repo [`openapi/openapi.json`](./openapi/openapi.json)
+- Capability SDK: [`@x12i/memorix-sdk`](../memorix-sdk/) · HTTP client: [`@x12i/memorix-client`](../memorix-client/)
+- Ebooks: [Platform Overview](../memorix-docs/00-platform-overview/) · [Services](../memorix-docs/07-services/) · [Runtime Data Client](../memorix-docs/02-runtime-data-client/)
+- Hub: [https://docs.memorix.x12i.com](https://docs.memorix.x12i.com) · npm `@x12i/memorix-docs`

package/dist/access-gate.d.ts

@@ -1,11 +1,22 @@
 /**
  * Enforce callback grants on Explore / Memory / checkpoint routes.
  * Product hosts without a grant keep full org-scoped access.
+ *
+ * MX-AUTH-01: optional deployment writer/reader identities (see
+ * `requireDeploymentAccess`) — default off for lab compatibility.
  */
 import type { FastifyRequest } from "fastify";
 import type { MemorixServiceAccess } from "@x12i/memorix-pipeline/v2";
 import { type CallbackGrantPayload } from "./callback-grant.js";
+import { type DeploymentAccessKind } from "./deployment-identity.js";
 export declare function readInvocationGrant(req: FastifyRequest): CallbackGrantPayload | null;
+/**
+ * MX-AUTH-01 — gate product APIs by deployment role when auth mode is on.
+ * - off (default): no check
+ * - optional: missing token allowed; present token must match org + role
+ * - required: valid writer/reader token required
+ */
+export declare function requireDeploymentAccess(req: FastifyRequest, access: DeploymentAccessKind): void;
 export declare function requireCallbackAccess(req: FastifyRequest, surface: MemorixServiceAccess): void;
 /**
  * Fail-closed grant for MGC landing ports (raw-records, target-receipts, artifacts).

package/dist/access-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-gate.d.ts","sourceRoot":"","sources":["../src/access-gate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAI7B,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAClB,oBAAoB,GAAG,IAAI,CAK7B;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CA2BN;AAWD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAiCA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAQ7D"}
+{"version":3,"file":"access-gate.d.ts","sourceRoot":"","sources":["../src/access-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAIlC,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,GAClB,oBAAoB,GAAG,IAAI,CAK7B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,oBAAoB,GAC3B,IAAI,CAwCN;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CA+BN;AAWD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAiCA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAQ7D"}

package/dist/access-gate.js

@@ -1,6 +1,7 @@
 import { ServiceError } from "./errors.js";
 import { decodeLandingGrantToken } from "./mgc-landing-stores.js";
 import { grantHasAccess, verifyCallbackGrant, } from "./callback-grant.js";
+import { identityAllows, readDeploymentTokenFromHeaders, resolveDeploymentAuthMode, verifyDeploymentIdentity, } from "./deployment-identity.js";
 import { resolveScope } from "./request-scope.js";
 import { orgIdsEqual, normalizeOrgId } from "./scope.js";
 export function readInvocationGrant(req) {
@@ -10,7 +11,39 @@ export function readInvocationGrant(req) {
         return null;
     return verifyCallbackGrant(token);
 }
+/**
+ * MX-AUTH-01 — gate product APIs by deployment role when auth mode is on.
+ * - off (default): no check
+ * - optional: missing token allowed; present token must match org + role
+ * - required: valid writer/reader token required
+ */
+export function requireDeploymentAccess(req, access) {
+    const mode = resolveDeploymentAuthMode();
+    if (mode === "off")
+        return;
+    const token = readDeploymentTokenFromHeaders(req.headers);
+    if (!token) {
+        if (mode === "optional")
+            return;
+        throw new ServiceError("ACCESS_DENIED", "x-memorix-deployment-identity required (writer or reader)", 401);
+    }
+    const identity = verifyDeploymentIdentity(token);
+    if (!identity) {
+        throw new ServiceError("ACCESS_DENIED", "deployment identity invalid or expired", 401);
+    }
+    const scope = resolveScope(req);
+    if (!orgIdsEqual(identity.orgId, scope.orgId)) {
+        throw new ServiceError("ACCESS_DENIED", "deployment identity orgId mismatch", 403);
+    }
+    if (!identityAllows(identity, access)) {
+        throw new ServiceError("ACCESS_DENIED", `deployment role "${identity.role}" cannot ${access}`, 403);
+    }
+}
 export function requireCallbackAccess(req, surface) {
+    // Explore surfaces are reads; raw/checkpoints stay grant-scoped separately.
+    if (surface === "explore") {
+        requireDeploymentAccess(req, "read");
+    }
     const grant = readInvocationGrant(req);
     if (!grant)
         return; // product host — no grant restriction

package/dist/access-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-gate.js","sourceRoot":"","sources":["../src/access-gate.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,UAAU,mBAAmB,CACjC,GAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,OAA6B;IAE7B,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,sCAAsC;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iCAAiC,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,oCAAoC,EACpC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,sCAAsC,OAAO,GAAG,EAChD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAmB,EACnB,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IAMrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qCAAqC,EACrC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GACb,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC;QACpC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/B,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iCAAiC,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uGAAuG,EACvG,GAAG,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-gate.js","sourceRoot":"","sources":["../src/access-gate.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,UAAU,mBAAmB,CACjC,GAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAmB,EACnB,MAA4B;IAE5B,MAAM,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACzC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO;IAE3B,MAAM,KAAK,GAAG,8BAA8B,CAC1C,GAAG,CAAC,OAAwD,CAC7D,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO;QAChC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,2DAA2D,EAC3D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,wCAAwC,EACxC,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,oCAAoC,EACpC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,oBAAoB,QAAQ,CAAC,IAAI,YAAY,MAAM,EAAE,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,OAA6B;IAE7B,4EAA4E;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,sCAAsC;IAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iCAAiC,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,oCAAoC,EACpC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,sCAAsC,OAAO,GAAG,EAChD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAmB,EACnB,IAAY;IAEZ,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IAMrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qCAAqC,EACrC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,SAAS,GACb,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC;QACpC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/B,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,iCAAiC,EACjC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uGAAuG,EACvG,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/dist/app.d.ts

@@ -2,6 +2,8 @@ import Fastify, { type FastifyInstance } from "fastify";
 import { type MemorixPlatform, type PlatformDeps } from "./platform.js";
 export type CreateMemorixServiceAppOptions = PlatformDeps & {
     logger?: boolean;
+    /** When true (CLI serve), skip per-request access log lines; use /_live counters. */
+    disableRequestLogging?: boolean;
     platform?: MemorixPlatform;
 };
 export declare function createMemorixServiceApp(opts: CreateMemorixServiceAppOptions): Promise<{

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAIxD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AA6BvB,MAAM,MAAM,8BAA8B,GAAG,YAAY,GAAG;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAwG5E;AAED,MAAM,MAAM,0BAA0B,GAAG,8BAA8B,GAAG;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B;;;;;GAM7E"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAIA,OAAO,OAAO,EAAE,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAIxD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAmCvB,MAAM,MAAM,8BAA8B,GAAG,YAAY,GAAG;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B,CAAC;AAEF,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAwH5E;AAED,MAAM,MAAM,0BAA0B,GAAG,8BAA8B,GAAG;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B;;;;;GAM7E"}

package/dist/app.js

@@ -32,12 +32,26 @@ import { registerAiServicesRoutes } from "./routes/ai-services.js";
 import { createSimulationController } from "./simulation.js";
 import { memorixLiveRing } from "./live.js";
 import { resolveConfiguredAiServiceOrigins } from "./ai-services/config.js";
+import { enforceCallerOnRequest } from "./caller-identity.js";
+import { attachRequestCountex, createRequestCountex, registerRequestStatsRoute, } from "./request-countex.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 export async function createMemorixServiceApp(opts) {
     const platform = opts.platform ?? (await createMemorixPlatform(opts));
     const simulation = createSimulationController();
-    const app = Fastify({ logger: opts.logger ?? false });
+    const app = Fastify({
+        logger: opts.logger ?? false,
+        // Prefer /_live Counters over per-request Pino spam.
+        disableRequestLogging: opts.disableRequestLogging ?? true,
+    });
     await app.register(cors, { origin: true });
+    // MX-CALLER-01: every /api/* request must identify the calling app.
+    app.addHook("onRequest", async (req) => {
+        enforceCallerOnRequest(req);
+    });
+    const requestCountex = await createRequestCountex({
+        mongoUri: opts.mongoUri ?? process.env.MONGO_URI?.trim(),
+    });
+    attachRequestCountex(app, requestCountex);
     const healthPayload = async () => {
         const sim = simulation.getState();
         return {
@@ -70,6 +84,7 @@ export async function createMemorixServiceApp(opts) {
         },
         getHealth: healthPayload,
     });
+    registerRequestStatsRoute(app, requestCountex);
     app.setErrorHandler((err, req, reply) => {
         const correlationId = req.correlationId ?? randomUUID();
         const mapped = mapErrorToHttp(err, correlationId);

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAE5E,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAO1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,cAAc,EAAE;gBACd,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,OAAO;aACd;YACD,UAAU,EAAE;gBACV,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAY,EAAE;QACjD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE;YACR,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,mBAAmB;YAC7B,WAAW,EAAE,4BAA4B;SAC1C;QACD,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,aAAa,GAChB,GAAkC,CAAC,aAAa,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAA6B,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IAE1C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI;gBACP,UAAU,EAAE,iCAAiC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1D,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,iCAAiC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,mCAAmC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,8BAA8B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE9C,iFAAiF;IACjF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,gCAAgC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAElE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAgC;IAC5E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAS1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,qDAAqD;QACrD,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,IAAI,IAAI;KAC1D,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,oEAAoE;IACpE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrC,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC;QAChD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE;KACzD,CAAC,CAAC;IACH,oBAAoB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,uBAAuB;YAChC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,cAAc,EAAE;gBACd,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,OAAO;aACd;YACD,UAAU,EAAE;gBACV,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAY,EAAE;QACjD,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE;YACR,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,mBAAmB;YAC7B,WAAW,EAAE,4BAA4B;SAC1C;QACD,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,yBAAyB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE/C,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,aAAa,GAChB,GAAkC,CAAC,aAAa,IAAI,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAA6B,CAAC;QACjF,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IAE1C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO;YACL,KAAK;YACL,QAAQ,EAAE;gBACR,GAAG,IAAI;gBACP,UAAU,EAAE,iCAAiC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1D,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;aACJ;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,iCAAiC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,mCAAmC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,8BAA8B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE9C,iFAAiF;IACjF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,gCAAgC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAElE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAgC;IAC5E,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/caller-identity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * MX-CALLER-01 — mandatory product caller identity.
+ *
+ * Every `/api/*` request must send `x-memorix-caller` identifying the app
+ * that is pushing or fetching (e.g. synapix-lander, map-store, memorix-studio).
+ * Scope headers (org/agents) are separate; this names the HTTP client.
+ */
+import type { FastifyRequest } from "fastify";
+export declare const CALLER_HEADER = "x-memorix-caller";
+/** Max length after trim. */
+export declare const CALLER_MAX_LEN = 128;
+/**
+ * Starts with alphanumeric or `@` (scoped package ids); then alnum, `.` `_` `@` `/` `-`.
+ * Examples: synapix-lander, map-store, memorix-studio, @x12i/memorix-client
+ */
+export declare const CALLER_PATTERN: RegExp;
+export declare function readCallerFromHeaders(headers: Record<string, string | string[] | undefined>): string | undefined;
+export declare function normalizeCaller(raw: string): string;
+export declare function validateCallerValue(raw: string | undefined): {
+    ok: true;
+    caller: string;
+} | {
+    ok: false;
+    code: "CALLER_REQUIRED" | "CALLER_INVALID";
+    message: string;
+};
+/** True when the path is a product API that requires caller identity. */
+export declare function pathRequiresCaller(urlPath: string): boolean;
+/**
+ * Read + validate caller from the request. Throws ServiceError on failure.
+ * Returns the canonical caller string when valid.
+ */
+export declare function requireCaller(req: FastifyRequest): string;
+/** Fastify onRequest: enforce caller on /api/* only. */
+export declare function enforceCallerOnRequest(req: FastifyRequest): void;
+export declare function getRequestCaller(req: FastifyRequest): string | undefined;
+//# sourceMappingURL=caller-identity.d.ts.map