aimeat 1.2.0

package/dist/scripts/seed-digital-signage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-digital-signage.d.ts","sourceRoot":"","sources":["../../scripts/seed-digital-signage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/scripts/seed-digital-signage.js

@@ -0,0 +1,85 @@
+/**
+ * @file seed-digital-signage.ts
+ * @description Seeds example packages via the admin API. Uses admin password
+ *   from .env (AIMEAT_ADMIN_PASSWORD) to authenticate without needing a JWT.
+ * @usage
+ *   cd aimeat && pnpm seed:examples
+ * @version-history
+ *   v1.0.0 — 2026-03-15 — initial implementation
+ *   v2.0.0 — 2026-03-16 — auto-auth via admin password, uses admin seed endpoint
+ *   v2.0.1 — 2026-03-16 — fix: support AIMEAT_ADMIN_PASSWORD env var name and quoted values
+ */
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Load admin password from .env file
+function loadAdminPassword() {
+    const envPaths = [
+        resolve(__dirname, '..', '.env'),
+        resolve(__dirname, '..', '.env.local'),
+    ];
+    for (const envPath of envPaths) {
+        try {
+            const content = readFileSync(envPath, 'utf8');
+            // Support both AIMEAT_ADMIN_PASSWORD and ADMIN_PASSWORD
+            const match = content.match(/^(?:AIMEAT_)?ADMIN_PASSWORD=(?:"([^"]*)"|'([^']*)'|(.+))$/m);
+            if (match)
+                return (match[1] ?? match[2] ?? match[3] ?? '').trim();
+        }
+        catch { /* file not found */ }
+    }
+    return process.env.AIMEAT_ADMIN_PASSWORD ?? process.env.ADMIN_PASSWORD ?? '';
+}
+const BASE_URL = process.env.BASE_URL ?? 'http://localhost:40050';
+const ADMIN_PASSWORD = process.env.AIMEAT_ADMIN_PASSWORD ?? process.env.ADMIN_PASSWORD ?? loadAdminPassword();
+async function main() {
+    console.log('\n=== AIMEAT Example Package Seeder ===\n');
+    console.log(`  Server: ${BASE_URL}`);
+    // Check server is reachable
+    try {
+        const probe = await fetch(`${BASE_URL}/v1/health`);
+        if (!probe.ok)
+            throw new Error(`HTTP ${probe.status}`);
+    }
+    catch {
+        console.error(`\n  Server not reachable at ${BASE_URL}`);
+        console.error(`  Start the server first in another terminal: cd aimeat && pnpm dev\n`);
+        setTimeout(() => process.exit(1), 100);
+        return;
+    }
+    if (!ADMIN_PASSWORD) {
+        console.error('\n  AIMEAT_ADMIN_PASSWORD not found in .env or environment.');
+        console.error('  Set it in .env or pass it: AIMEAT_ADMIN_PASSWORD=xxx pnpm seed:examples\n');
+        setTimeout(() => process.exit(1), 100);
+        return;
+    }
+    console.log('  Seeding example packages via admin API...\n');
+    const res = await fetch(`${BASE_URL}/v1/admin/seed-examples`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'x-admin-password': ADMIN_PASSWORD,
+        },
+    });
+    const data = await res.json();
+    if (!data.ok) {
+        console.error(`  Failed: ${data.error?.message ?? JSON.stringify(data)}`);
+        setTimeout(() => process.exit(1), 100);
+        return;
+    }
+    const seeded = data.data?.seeded ?? [];
+    for (const pkg of seeded) {
+        const status = pkg.templateId === '(already exists)' ? 'already exists' : 'created';
+        console.log(`  ${status === 'created' ? '+' : '='} ${pkg.name} (${status})`);
+        if (status === 'created') {
+            console.log(`    Browse:  ${BASE_URL}/v1/packages/${encodeURIComponent(pkg.packageGroupId)}`);
+        }
+    }
+    console.log('\n  Done!\n');
+}
+main().catch(err => {
+    console.error('\nFATAL:', err.message);
+    setTimeout(() => process.exit(1), 100);
+});
+//# sourceMappingURL=seed-digital-signage.js.map

package/dist/scripts/seed-digital-signage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-digital-signage.js","sourceRoot":"","sources":["../../scripts/seed-digital-signage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,qCAAqC;AACrC,SAAS,iBAAiB;IACxB,MAAM,QAAQ,GAAG;QACf,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC;QAChC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC;KACvC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9C,wDAAwD;YACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC1F,IAAI,KAAK;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,wBAAwB,CAAC;AAClE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC;AAE9G,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;IAErC,4BAA4B;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACvF,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,yBAAyB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,cAAc;SACnC;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAS,CAAC;IAErC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,KAAK,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC"}

package/dist/src/auth/jwt.d.ts

@@ -0,0 +1,40 @@
+import type { Storage } from '../storage/interface.js';
+export declare function initNodeKeys(publicKeyBase64: string, privateKeyBase64: string): Promise<void>;
+export interface JWTPayload {
+    sub: string;
+    owner: string;
+    node: string;
+    roles: string[];
+    scopes?: string[];
+    mcp_client?: string;
+}
+/** Generate a unique session ID for JWT tracking. */
+export declare function generateSessionId(): string;
+export declare function issueJWT(payload: JWTPayload, ttlSeconds: number, sessionId?: string): Promise<string>;
+export interface VerifiedToken {
+    sub: string;
+    owner: string;
+    node: string;
+    roles: string[];
+    exp: number;
+    scopes: string[];
+    anonymous?: boolean;
+    sessionId?: string;
+    mcp_client?: string;
+}
+export declare function verifyJWT(token: string): Promise<VerifiedToken | null>;
+/**
+ * Initialize the token revocation system with a persistent storage backend.
+ * Must be called once during server startup (after storage is created).
+ */
+export declare function initRevocationStorage(storage: Storage): void;
+/**
+ * Revoke a token. Persists to storage and updates the in-memory cache.
+ */
+export declare function revokeToken(token: string, expiresAt: number): Promise<void>;
+/**
+ * Check if a token has been revoked.
+ * Uses in-memory cache as L1, falls back to storage for cache misses.
+ */
+export declare function isRevoked(token: string): Promise<boolean>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/src/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAQvD,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB3G;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoB5E;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmB5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjF;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D"}

package/dist/src/auth/jwt.js

@@ -0,0 +1,139 @@
+import { SignJWT, jwtVerify } from 'jose';
+import { createHash, randomBytes } from 'node:crypto';
+// We use EdDSA JWTs signed with the node's private key
+// jose requires CryptoKey objects, so we convert from raw Ed25519 bytes
+let nodePrivateKey = null;
+let nodePublicKey = null;
+export async function initNodeKeys(publicKeyBase64, privateKeyBase64) {
+    const publicKeyBytes = Buffer.from(publicKeyBase64, 'base64');
+    const privateKeyBytes = Buffer.from(privateKeyBase64, 'base64');
+    // Import raw Ed25519 keys into CryptoKey via JWK format
+    const publicKeyJwk = {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: Buffer.from(publicKeyBytes).toString('base64url'),
+    };
+    const privateKeyJwk = {
+        kty: 'OKP',
+        crv: 'Ed25519',
+        x: Buffer.from(publicKeyBytes).toString('base64url'),
+        d: Buffer.from(privateKeyBytes).toString('base64url'),
+    };
+    nodePublicKey = await crypto.subtle.importKey('jwk', publicKeyJwk, { name: 'Ed25519' }, true, ['verify']);
+    nodePrivateKey = await crypto.subtle.importKey('jwk', privateKeyJwk, { name: 'Ed25519' }, true, ['sign']);
+}
+/** Generate a unique session ID for JWT tracking. */
+export function generateSessionId() {
+    return `sid-${randomBytes(16).toString('hex')}`;
+}
+export async function issueJWT(payload, ttlSeconds, sessionId) {
+    if (!nodePrivateKey)
+        throw new Error('Node keys not initialized');
+    const builder = new SignJWT({
+        owner: payload.owner,
+        node: payload.node,
+        roles: payload.roles,
+        scopes: payload.scopes ?? ['*'],
+        ...(payload.mcp_client ? { mcp_client: payload.mcp_client } : {}),
+    })
+        .setProtectedHeader({ alg: 'EdDSA', typ: 'JWT' })
+        .setSubject(payload.sub)
+        .setIssuedAt()
+        .setExpirationTime(`${ttlSeconds}s`);
+    // P3-7: Embed session ID for server-side session tracking
+    if (sessionId) {
+        builder.setJti(sessionId);
+    }
+    return builder.sign(nodePrivateKey);
+}
+export async function verifyJWT(token) {
+    if (!nodePublicKey)
+        throw new Error('Node keys not initialized');
+    try {
+        const { payload } = await jwtVerify(token, nodePublicKey, {
+            algorithms: ['EdDSA'],
+        });
+        return {
+            sub: payload.sub,
+            owner: payload.owner,
+            node: payload.node,
+            roles: payload.roles,
+            exp: payload.exp,
+            scopes: payload.scopes ?? ['*'],
+            sessionId: payload.jti,
+            mcp_client: payload.mcp_client,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ── Token Revocation (storage-backed with in-memory cache) ─────────────
+/** Hash a raw JWT token to a fixed-length hex string for storage. */
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+// In-memory cache for fast repeated lookups (TTL 60 seconds).
+// Entries are { revoked: boolean, cachedAt: number }.
+const revocationCache = new Map();
+const CACHE_TTL_MS = 60_000;
+// Reference to the storage layer, set via initRevocationStorage().
+let _storage = null;
+let _cleanupInterval = null;
+/**
+ * Initialize the token revocation system with a persistent storage backend.
+ * Must be called once during server startup (after storage is created).
+ */
+export function initRevocationStorage(storage) {
+    _storage = storage;
+    // Periodic cleanup of expired revoked tokens (every 60 seconds)
+    if (_cleanupInterval)
+        clearInterval(_cleanupInterval);
+    _cleanupInterval = setInterval(async () => {
+        try {
+            await storage.cleanExpiredRevocations();
+        }
+        catch {
+            // Swallow cleanup errors silently — non-critical
+        }
+        // Also evict stale cache entries
+        const now = Date.now();
+        for (const [key, entry] of revocationCache) {
+            if (now - entry.cachedAt > CACHE_TTL_MS) {
+                revocationCache.delete(key);
+            }
+        }
+    }, 60_000);
+}
+/**
+ * Revoke a token. Persists to storage and updates the in-memory cache.
+ */
+export async function revokeToken(token, expiresAt) {
+    const hash = hashToken(token);
+    // Persist to storage
+    if (_storage) {
+        await _storage.revokeToken(hash, expiresAt);
+    }
+    // Update cache
+    revocationCache.set(hash, { revoked: true, cachedAt: Date.now() });
+}
+/**
+ * Check if a token has been revoked.
+ * Uses in-memory cache as L1, falls back to storage for cache misses.
+ */
+export async function isRevoked(token) {
+    const hash = hashToken(token);
+    // L1: Check in-memory cache
+    const cached = revocationCache.get(hash);
+    if (cached && (Date.now() - cached.cachedAt) < CACHE_TTL_MS) {
+        return cached.revoked;
+    }
+    // L2: Check storage
+    if (_storage) {
+        const revoked = await _storage.isTokenRevoked(hash);
+        revocationCache.set(hash, { revoked, cachedAt: Date.now() });
+        return revoked;
+    }
+    return false;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/src/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAoD,MAAM,MAAM,CAAC;AAE5F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,uDAAuD;AACvD,wEAAwE;AAExE,IAAI,cAAc,GAAqB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAqB,IAAI,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,eAAuB,EAAE,gBAAwB;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEhE,wDAAwD;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AAWD,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAkB,EAAE,SAAkB;IACxF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE;YACxD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAc;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAiB;YAChC,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,MAAM,EAAG,OAAO,CAAC,MAAmB,IAAI,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,OAAO,CAAC,GAAyB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAgC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,qEAAqE;AACrE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,8DAA8D;AAC9D,sDAAsD;AACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,mEAAmE;AACnE,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,QAAQ,GAAG,OAAO,CAAC;IAEnB,gEAAgE;IAChE,IAAI,gBAAgB;QAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;gBACxC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,qBAAqB;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;IACf,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/auth/keypair.d.ts

@@ -0,0 +1,8 @@
+export interface KeyPair {
+    publicKey: string;
+    privateKey: string;
+}
+export declare function generateKeyPair(): Promise<KeyPair>;
+export declare function sign(privateKeyBase64: string, message: string): Promise<string>;
+export declare function verify(publicKeyBase64: string, message: string, signatureBase64: string): Promise<boolean>;
+//# sourceMappingURL=keypair.d.ts.map

package/dist/src/auth/keypair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.d.ts","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAED,wBAAsB,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKrF;AAED,wBAAsB,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAShH"}

package/dist/src/auth/keypair.js

@@ -0,0 +1,35 @@
+import * as ed from '@noble/ed25519';
+import { createHash } from 'node:crypto';
+// noble/ed25519 v2+ requires setting the sha512 sync function
+ed.etc.sha512Sync = (...m) => {
+    const hash = createHash('sha512');
+    for (const chunk of m)
+        hash.update(chunk);
+    return new Uint8Array(hash.digest());
+};
+export async function generateKeyPair() {
+    const privateKeyBytes = ed.utils.randomSecretKey();
+    const publicKeyBytes = await ed.getPublicKeyAsync(privateKeyBytes);
+    return {
+        publicKey: Buffer.from(publicKeyBytes).toString('base64'),
+        privateKey: Buffer.from(privateKeyBytes).toString('base64'),
+    };
+}
+export async function sign(privateKeyBase64, message) {
+    const privateKey = Buffer.from(privateKeyBase64, 'base64');
+    const msgBytes = new TextEncoder().encode(message);
+    const signature = await ed.signAsync(msgBytes, privateKey);
+    return Buffer.from(signature).toString('base64');
+}
+export async function verify(publicKeyBase64, message, signatureBase64) {
+    try {
+        const publicKey = Buffer.from(publicKeyBase64, 'base64');
+        const msgBytes = new TextEncoder().encode(message);
+        const signature = Buffer.from(signatureBase64, 'base64');
+        return await ed.verifyAsync(signature, msgBytes, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=keypair.js.map

package/dist/src/auth/keypair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../../../src/auth/keypair.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8DAA8D;AAC7D,EAAE,CAAC,GAAW,CAAC,UAAU,GAAG,CAAC,GAAG,CAAe,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC;AAOF,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,eAAe,GAAG,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,gBAAwB,EAAE,OAAe;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,eAAuB,EAAE,OAAe,EAAE,eAAuB;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/auth/middleware.d.ts

@@ -0,0 +1,50 @@
+import type { Request, Response, NextFunction } from 'express';
+import { type VerifiedToken } from './jwt.js';
+import type { Storage } from '../storage/interface.js';
+/** Initialize session-aware auth middleware. Called once during server startup. */
+export declare function initSessionAuth(storage: Storage): void;
+/** Called by server.ts after anonymous setup to enable anonymous fallback in auth middleware */
+export declare function enableAnonymousAuth(gaii: string, owner: string): void;
+/** Check if anonymous mode is enabled */
+export declare function isAnonymousMode(): boolean;
+/** Get anonymous credentials (gaii + owner) — only valid when isAnonymousMode() is true */
+export declare function getAnonymousCredentials(): {
+    gaii: string;
+    owner: string;
+};
+declare global {
+    namespace Express {
+        interface Request {
+            auth?: VerifiedToken;
+        }
+    }
+}
+/**
+ * Optional auth middleware — parses JWT if present, does not reject if absent.
+ * Use requireAuth() or requireRole() for endpoints that need auth.
+ */
+export declare function optionalAuth(): (req: Request, _res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Require authentication. Returns 401 if no valid JWT.
+ * If req.auth is already set (e.g. by optionalAuth() in anonymous mode), skips token check.
+ */
+export declare function requireAuth(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Require authentication OR anonymous credentials.
+ * Use for endpoints that should be accessible in anonymous mode
+ * (e.g. public catalogue searches, board reads, directory listing).
+ */
+export declare function requireAuthOrAnonymous(): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Require a specific role. Must be used after requireAuth().
+ */
+export declare function requireRole(role: string): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Require specific scopes. Must be used after requireAuth().
+ * Checks if the agent's JWT scopes include the required scopes.
+ * Supports exact match, domain wildcards (memory:*), and global wildcard (*).
+ * Owner/operator role bypasses scope checks (they act as owners, not scoped agents).
+ * Agents with explicit scopes are always enforced, even if their owner is an operator.
+ */
+export declare function requireScope(...requiredScopes: string[]): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/src/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAMvD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAOD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,yCAAyC;AACzC,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEzE;AAGD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,aAAa,CAAC;SACtB;KACF;CACF;AAED;;;GAGG;AACH,wBAAgB,YAAY,KACZ,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,mBA0B/D;AAED;;;GAGG;AACH,wBAAgB,WAAW,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBA6D9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAuBxD;AAOD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAmCxD"}

package/dist/src/auth/middleware.js

@@ -0,0 +1,241 @@
+import { verifyJWT, isRevoked } from './jwt.js';
+import { getStats } from '../services/stats.js';
+import { getPromMetrics } from '../services/prometheus.js';
+import { logger } from '../utils/logger.js';
+// P3-7: Reference to storage for session revocation checks
+let _sessionStorage = null;
+/** Initialize session-aware auth middleware. Called once during server startup. */
+export function initSessionAuth(storage) {
+    _sessionStorage = storage;
+}
+// Anonymous mode: when enabled, inject this identity for unauthenticated requests
+let _anonymousMode = false;
+let _anonymousGaii = '';
+let _anonymousOwner = '';
+/** Called by server.ts after anonymous setup to enable anonymous fallback in auth middleware */
+export function enableAnonymousAuth(gaii, owner) {
+    _anonymousMode = true;
+    _anonymousGaii = gaii;
+    _anonymousOwner = owner;
+}
+/** Check if anonymous mode is enabled */
+export function isAnonymousMode() {
+    return _anonymousMode;
+}
+/** Get anonymous credentials (gaii + owner) — only valid when isAnonymousMode() is true */
+export function getAnonymousCredentials() {
+    return { gaii: _anonymousGaii, owner: _anonymousOwner };
+}
+/**
+ * Optional auth middleware — parses JWT if present, does not reject if absent.
+ * Use requireAuth() or requireRole() for endpoints that need auth.
+ */
+export function optionalAuth() {
+    return async (req, _res, next) => {
+        const token = extractToken(req);
+        if (token) {
+            if (await isRevoked(token)) {
+                req.auth = undefined;
+            }
+            else {
+                const verified = await verifyJWT(token);
+                if (verified) {
+                    req.auth = verified;
+                }
+            }
+        }
+        // Anonymous mode: inject anonymous identity when no auth present
+        if (!req.auth && _anonymousMode) {
+            req.auth = {
+                sub: _anonymousGaii,
+                owner: _anonymousOwner,
+                node: '',
+                roles: ['agent'],
+                exp: Math.floor(Date.now() / 1000) + 86400,
+                scopes: ['memory:read', 'catalogue:read', 'social:read'],
+                anonymous: true,
+            };
+        }
+        next();
+    };
+}
+/**
+ * Require authentication. Returns 401 if no valid JWT.
+ * If req.auth is already set (e.g. by optionalAuth() in anonymous mode), skips token check.
+ */
+export function requireAuth() {
+    return async (req, res, next) => {
+        // If auth was already resolved by global optionalAuth() (e.g. anonymous mode)
+        if (req.auth) {
+            // SECURITY: Reject anonymous credentials — requireAuth() requires real authentication
+            if (req.auth.anonymous) {
+                const stats = getStats();
+                if (stats)
+                    stats.increment('auth_failures_total');
+                const prom = getPromMetrics();
+                if (prom)
+                    prom.authFailuresTotal.inc();
+                res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'This endpoint requires authentication'));
+                return;
+            }
+            next();
+            return;
+        }
+        const token = extractToken(req);
+        if (!token) {
+            const stats = getStats();
+            if (stats)
+                stats.increment('auth_failures_total');
+            const prom = getPromMetrics();
+            if (prom)
+                prom.authFailuresTotal.inc();
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            return;
+        }
+        if (await isRevoked(token)) {
+            const stats = getStats();
+            if (stats)
+                stats.increment('auth_failures_total');
+            const prom = getPromMetrics();
+            if (prom)
+                prom.authFailuresTotal.inc();
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Token has been revoked'));
+            return;
+        }
+        const verified = await verifyJWT(token);
+        if (!verified) {
+            const stats = getStats();
+            if (stats)
+                stats.increment('auth_failures_total');
+            const prom = getPromMetrics();
+            if (prom)
+                prom.authFailuresTotal.inc();
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Invalid or expired token'));
+            return;
+        }
+        // P3-7: Check if the session has been revoked
+        if (verified.sessionId && _sessionStorage) {
+            const sessionRevoked = await _sessionStorage.isSessionRevoked(verified.sessionId);
+            if (sessionRevoked) {
+                const stats = getStats();
+                if (stats)
+                    stats.increment('auth_failures_total');
+                const prom = getPromMetrics();
+                if (prom)
+                    prom.authFailuresTotal.inc();
+                res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Session has been revoked'));
+                return;
+            }
+        }
+        req.auth = verified;
+        next();
+    };
+}
+/**
+ * Require authentication OR anonymous credentials.
+ * Use for endpoints that should be accessible in anonymous mode
+ * (e.g. public catalogue searches, board reads, directory listing).
+ */
+export function requireAuthOrAnonymous() {
+    return (req, res, next) => {
+        if (!req.auth) {
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            return;
+        }
+        // Allow both authenticated and anonymous
+        next();
+    };
+}
+/**
+ * Require a specific role. Must be used after requireAuth().
+ */
+export function requireRole(role) {
+    return (req, res, next) => {
+        if (!req.auth) {
+            const stats = getStats();
+            if (stats)
+                stats.increment('auth_failures_total');
+            const prom = getPromMetrics();
+            if (prom)
+                prom.authFailuresTotal.inc();
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            return;
+        }
+        // Role hierarchy: operator > owner > agent
+        const hasRole = req.auth.roles.includes(role) ||
+            (role === 'agent' && req.auth.roles.includes('owner')) ||
+            (role === 'agent' && req.auth.roles.includes('operator')) ||
+            (role === 'owner' && req.auth.roles.includes('operator'));
+        if (!hasRole) {
+            res.status(403).json(errorEnvelope('ACCESS_DENIED', `Role "${role}" required`));
+            return;
+        }
+        next();
+    };
+}
+// Generator scopes (agent-driven service generation):
+// generator:read    — read projects, interview specs, components, session state
+// generator:write   — create projects, save interview spec, submit blueprint and components
+// generator:execute — claim/release sessions, register and activate components, write logs
+/**
+ * Require specific scopes. Must be used after requireAuth().
+ * Checks if the agent's JWT scopes include the required scopes.
+ * Supports exact match, domain wildcards (memory:*), and global wildcard (*).
+ * Owner/operator role bypasses scope checks (they act as owners, not scoped agents).
+ * Agents with explicit scopes are always enforced, even if their owner is an operator.
+ */
+export function requireScope(...requiredScopes) {
+    return (req, res, next) => {
+        if (!req.auth) {
+            res.status(401).json(errorEnvelope('AUTH_REQUIRED', 'Authentication required'));
+            return;
+        }
+        // Owner-role requests bypass scope checks (owners act on behalf of all their agents)
+        // But agent-role requests MUST respect scopes, even if their owner is an operator
+        if (req.auth.roles.includes('owner') && !req.auth.roles.includes('agent')) {
+            next();
+            return;
+        }
+        const agentScopes = req.auth.scopes;
+        // Global wildcard
+        if (agentScopes.includes('*')) {
+            next();
+            return;
+        }
+        for (const required of requiredScopes) {
+            const [domain] = required.split(':');
+            const hasExact = agentScopes.includes(required);
+            const hasDomainWild = agentScopes.includes(`${domain}:*`);
+            if (!hasExact && !hasDomainWild) {
+                logger.warn(`[scope-denied] ${req.auth.sub} needs "${required}", has [${agentScopes.join(', ')}] on ${req.method} ${req.path}`);
+                res.status(403).json(errorEnvelope('SCOPE_DENIED', `Scope "${required}" required. Agent scopes: [${agentScopes.join(', ')}]`));
+                return;
+            }
+        }
+        next();
+    };
+}
+function extractToken(req) {
+    const authHeader = req.headers.authorization;
+    if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+        return authHeader.slice(7);
+    }
+    // SECURITY: JWT tokens must NOT be accepted via URL query parameters.
+    // Tokens in URLs are logged in access logs, browser history, and referrer headers.
+    return null;
+}
+function errorEnvelope(code, message) {
+    return {
+        ok: false,
+        protocol: 'aimeat',
+        version: 'v1',
+        timestamp: new Date().toISOString(),
+        error: { code, message },
+        hints: {
+            next_actions: [
+                { description: 'Authenticate to get a JWT token', method: 'POST', url: '/v1/auth/token' },
+            ],
+        },
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/src/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAsB,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,2DAA2D;AAC3D,IAAI,eAAe,GAAmB,IAAI,CAAC;AAE3C,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,eAAe,GAAG,OAAO,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,cAAc,GAAG,EAAE,CAAC;AACxB,IAAI,eAAe,GAAG,EAAE,CAAC;AAEzB,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,cAAc,GAAG,IAAI,CAAC;IACtB,cAAc,GAAG,IAAI,CAAC;IACtB,eAAe,GAAG,KAAK,CAAC;AAC1B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC1D,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,GAAG;gBACT,GAAG,EAAE,cAAc;gBACnB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,EAAE;gBACR,KAAK,EAAE,CAAC,OAAO,CAAC;gBAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK;gBAC1C,MAAM,EAAE,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,CAAC;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,8EAA8E;QAC9E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,sFAAsF;YACtF,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;YAC1C,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK;oBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;gBACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,yCAAyC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,2CAA2C;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC3C,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzD,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,gFAAgF;AAChF,4FAA4F;AAC5F,2FAA2F;AAE3F;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAG,cAAwB;IACtD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,qFAAqF;QACrF,kFAAkF;QAClF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAEpC,kBAAkB;QAClB,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;YAE1D,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,QAAQ,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,UAAU,QAAQ,8BAA8B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/H,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,sEAAsE;IACtE,mFAAmF;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe;IAClD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACxB,KAAK,EAAE;YACL,YAAY,EAAE;gBACZ,EAAE,WAAW,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE;aAC1F;SACF;KACF,CAAC;AACJ,CAAC"}