Deployment

Run MAP as a production HTTP service with environment-driven configuration.

Deployment profiles

Profile	Use case	Signed requests	Tenant required	Key algorithm
open	Development	Optional	Optional	HS256 or RS256
verified	Staging / Production	Required	Optional	RS256 only
regulated	Finance / Healthcare	Required	Required	RS256 only

MAP_DEPLOYMENT_PROFILE=regulated

Environment variables

Variable	Default	Description
PORT	8787	Server port
MAP_DEPLOYMENT_PROFILE	open	open, verified, or regulated
MAP_POLICY_PATH	-	Path to JSON policy file
MAP_SIGNING_SECRET	demo key	HMAC signing secret
MAP_APPROVAL_WEBHOOK_URL	-	Default webhook for approval notifications
MAP_SERVER_BASE_URL	-	Server base URL used in approval payloads
MAP_ADMIN_TOKEN	-	Token for admin endpoints
MAP_REQUIRE_TENANT	false	Require tenant_id on all requests
MAP_PAYMENT_API_KEY	-	Payment provider API key
MAP_DB_CONNECTION_STRING	-	PostgreSQL connection string

Start the server

MAP_POLICY_PATH=./policy.json \
MAP_APPROVAL_WEBHOOK_URL=https://your-app.com/approvals \
MAP_SIGNING_SECRET=your-secret \
npm run dev:server

Async execution

Long-running tasks run on an async queue with exponential backoff, jitter, and dead-letter handling. Dispatch with delivery_mode: 'async', then poll task status or stream it over WebSocket. Failed tasks land in the dead-letter store (directory 0700, files 0600) for inspection and replay.

Multi-tenancy

Strict tenant isolation: requests scoped to one tenant cannot access another tenant's data (verified at Level 2 conformance). Enable MAP_REQUIRE_TENANT=true to reject any request without a tenant_id. Admin token is SHA-256 hashed with timing-safe comparison.

Observability stack

• OpenTelemetry tracing - scoped spans with kind and status; plug any OTel exporter.
• Prometheus metrics - map_dispatch_total, map_active_tasks, per-capability counters.
• Health checks - HTTP, WebSocket, TCP, and custom checks via HealthCheckBuilder; /health and /ready endpoints.
• Audit trail - GET /audit-events streams the hash-chained log; checkpoints are signed for offline verification.
• Storage - SQLiteStorage('./map.db') persists tasks, receipts, and dead letters.

Hardening checklist

The reference server ships with: SSRF protection blocking 0.0.0.0, IPv6, and AWS metadata addresses; prototype-pollution protection in the body parser; HMAC secret rotation; signed receipts on every decision; and a 24-code typed error taxonomy so clients can react programmatically (approval_expired, tenant_mismatch, idempotency_conflict).