aimeat 1.2.0

package/dist/src/auth/node-keys.d.ts

@@ -0,0 +1,7 @@
+import type { AimeatConfig } from '../config.js';
+import type { Storage } from '../storage/interface.js';
+/**
+ * Initialize node keys: load from storage, fall back to persisted file, or generate new.
+ */
+export declare function initializeNode(config: AimeatConfig, storage: Storage): Promise<void>;
+//# sourceMappingURL=node-keys.d.ts.map

package/dist/src/auth/node-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-keys.d.ts","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA4GvD;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F"}

package/dist/src/auth/node-keys.js

@@ -0,0 +1,116 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { pbkdf2Sync, randomBytes as cryptoRandomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+import { generateKeyPair } from './keypair.js';
+import { initNodeKeys } from './jwt.js';
+import { logger } from '../utils/logger.js';
+function getNodeKeyPath() {
+    const home = process.env.HOME ?? process.env.USERPROFILE ?? '.';
+    return join(home, '.aimeat', 'node-key.json');
+}
+function encryptNodeKey(kp, passphrase) {
+    const salt = cryptoRandomBytes(32);
+    const iv = cryptoRandomBytes(12); // 96-bit IV for AES-256-GCM
+    const derivedKey = pbkdf2Sync(passphrase, salt, 100_000, 32, 'sha512');
+    const cipher = createCipheriv('aes-256-gcm', derivedKey, iv);
+    const plaintext = JSON.stringify({ publicKey: kp.publicKey, privateKey: kp.privateKey });
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return {
+        encrypted: true,
+        salt: salt.toString('hex'),
+        iv: iv.toString('hex'),
+        authTag: authTag.toString('hex'),
+        data: encrypted.toString('hex'),
+    };
+}
+function decryptNodeKey(file, passphrase) {
+    const salt = Buffer.from(file.salt, 'hex');
+    const iv = Buffer.from(file.iv, 'hex');
+    const authTag = Buffer.from(file.authTag, 'hex');
+    const encryptedData = Buffer.from(file.data, 'hex');
+    const derivedKey = pbkdf2Sync(passphrase, salt, 100_000, 32, 'sha512');
+    const decipher = createDecipheriv('aes-256-gcm', derivedKey, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+    const data = JSON.parse(decrypted.toString('utf-8'));
+    if (!data.publicKey || !data.privateKey) {
+        throw new Error('Decrypted key file does not contain valid key data');
+    }
+    return { publicKey: data.publicKey, privateKey: data.privateKey };
+}
+function loadPersistedNodeKey() {
+    const keyPath = getNodeKeyPath();
+    try {
+        if (!existsSync(keyPath))
+            return null;
+        const data = JSON.parse(readFileSync(keyPath, 'utf-8'));
+        // P3-8: Handle encrypted key file
+        if (data.encrypted) {
+            const passphrase = process.env.AIMEAT_KEY_PASSPHRASE;
+            if (!passphrase) {
+                logger.error('Node key file is encrypted but AIMEAT_KEY_PASSPHRASE is not set. Cannot decrypt.');
+                process.exit(1);
+            }
+            return decryptNodeKey(data, passphrase);
+        }
+        if (data.publicKey && data.privateKey)
+            return data;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function persistNodeKey(kp) {
+    const keyPath = getNodeKeyPath();
+    try {
+        const dir = dirname(keyPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const passphrase = process.env.AIMEAT_KEY_PASSPHRASE;
+        if (passphrase) {
+            // P3-8: Encrypt the key file using AES-256-GCM with passphrase-derived key
+            const encrypted = encryptNodeKey(kp, passphrase);
+            writeFileSync(keyPath, JSON.stringify(encrypted, null, 2) + '\n', { mode: 0o600 });
+            logger.info('Node key encrypted and saved to ~/.aimeat/node-key.json');
+        }
+        else {
+            // Backward compatible: write plaintext
+            writeFileSync(keyPath, JSON.stringify({ publicKey: kp.publicKey, privateKey: kp.privateKey }, null, 2) + '\n', { mode: 0o600 });
+        }
+    }
+    catch (err) {
+        logger.warn('Could not persist node key', { path: keyPath, error: err });
+    }
+}
+/**
+ * Initialize node keys: load from storage, fall back to persisted file, or generate new.
+ */
+export async function initializeNode(config, storage) {
+    try {
+        let nodeKey = await storage.getNodeKey();
+        if (!nodeKey) {
+            // I-3: Try loading persisted key from ~/.aimeat/node-key.json
+            nodeKey = loadPersistedNodeKey();
+            if (nodeKey) {
+                await storage.setNodeKey(nodeKey.publicKey, nodeKey.privateKey);
+                logger.info('Node key loaded from ~/.aimeat/node-key.json');
+            }
+            else {
+                logger.info('Generating node keypair...');
+                const kp = await generateKeyPair();
+                await storage.setNodeKey(kp.publicKey, kp.privateKey);
+                nodeKey = kp;
+                persistNodeKey(kp);
+                logger.info('Node keypair generated and saved to ~/.aimeat/node-key.json');
+            }
+        }
+        await initNodeKeys(nodeKey.publicKey, nodeKey.privateKey);
+        logger.info('Node keys initialized for JWT signing');
+    }
+    catch (err) {
+        logger.error('Failed to initialize node keys', { error: err });
+    }
+}
+//# sourceMappingURL=node-keys.js.map

package/dist/src/auth/node-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-keys.js","sourceRoot":"","sources":["../../../src/auth/node-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,IAAI,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAY5C,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC;IAChE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,EAA6C,EAC7C,UAAkB;IAElB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B;IAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAsB,EACtB,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAExD,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;gBACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAA6C;IACnE,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,2EAA2E;YAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACjD,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,uCAAuC;YACvC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,OAAgB;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8DAA8D;YAC9D,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAC1C,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;gBACtD,OAAO,GAAG,EAAE,CAAC;gBACb,cAAc,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/src/cli/config-export.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CLI command: aimeat config export
+ * Exports current config to various formats (env, ini, json, consul).
+ */
+import type { AimeatConfig } from '../config.js';
+type ExportFormat = 'env' | 'ini' | 'json' | 'consul';
+export declare function runConfigExport(config: AimeatConfig, format: ExportFormat): Promise<void>;
+export {};
+//# sourceMappingURL=config-export.d.ts.map

package/dist/src/cli/config-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-export.d.ts","sourceRoot":"","sources":["../../../src/cli/config-export.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,KAAK,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,wBAAsB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAY/F"}

package/dist/src/cli/config-export.js

@@ -0,0 +1,90 @@
+/**
+ * CLI command: aimeat config export
+ * Exports current config to various formats (env, ini, json, consul).
+ */
+import ini from 'ini';
+import { CONFIG_FIELDS, serializeConfigValue } from '../services/config-schema.js';
+import { createConsulConfigService } from '../services/consul-config.js';
+export async function runConfigExport(config, format) {
+    if (format === 'consul') {
+        return exportToConsul(config);
+    }
+    const output = format === 'env'
+        ? exportToEnv(config)
+        : format === 'ini'
+            ? exportToIni(config)
+            : exportToJson(config);
+    process.stdout.write(output);
+}
+function exportToEnv(config) {
+    const lines = ['# AIMEAT configuration (exported)', ''];
+    let lastSection = '';
+    for (const field of CONFIG_FIELDS) {
+        const section = field.dotPath.split('.')[0];
+        if (section !== lastSection) {
+            if (lastSection)
+                lines.push('');
+            lines.push(`# ${section}`);
+            lastSection = section;
+        }
+        const value = config[field.key];
+        if (value !== undefined && value !== null && value !== '') {
+            lines.push(`${field.envVar}=${serializeConfigValue(value)}`);
+        }
+    }
+    return lines.join('\n') + '\n';
+}
+function exportToIni(config) {
+    const sections = {};
+    for (const field of CONFIG_FIELDS) {
+        const parts = field.dotPath.split('.');
+        const section = parts.length > 1 ? parts.slice(0, -1).join('.') : 'node';
+        const key = parts[parts.length - 1];
+        if (!sections[section])
+            sections[section] = {};
+        const value = config[field.key];
+        if (value !== undefined && value !== null && value !== '') {
+            sections[section][key] = serializeConfigValue(value);
+        }
+    }
+    return '; AIMEAT configuration (exported)\n\n' + ini.stringify(sections);
+}
+function exportToJson(config) {
+    const result = {};
+    for (const field of CONFIG_FIELDS) {
+        const parts = field.dotPath.split('.');
+        const section = parts.length > 1 ? parts[0] : 'node';
+        const key = parts.length > 1 ? parts.slice(1).join('_') : parts[0];
+        if (!result[section])
+            result[section] = {};
+        const value = config[field.key];
+        if (value !== undefined && value !== null && value !== '') {
+            result[section][key] = value;
+        }
+    }
+    return JSON.stringify(result, null, 2) + '\n';
+}
+async function exportToConsul(config) {
+    const consulService = createConsulConfigService(config);
+    if (!consulService) {
+        console.error('Error: Consul is not enabled. Set AIMEAT_CONSUL_ENABLED=true and AIMEAT_CONSUL_URL.');
+        process.exit(1);
+    }
+    let exported = 0;
+    for (const field of CONFIG_FIELDS) {
+        if (field.immutable)
+            continue;
+        const value = config[field.key];
+        if (value !== undefined && value !== null) {
+            try {
+                await consulService.set(field.dotPath, serializeConfigValue(value));
+                exported++;
+            }
+            catch (err) {
+                console.warn(`  Warning: Failed to export ${field.dotPath}: ${err.message}`);
+            }
+        }
+    }
+    console.log(`Exported ${exported} mutable config values to Consul KV`);
+}
+//# sourceMappingURL=config-export.js.map

package/dist/src/cli/config-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-export.js","sourceRoot":"","sources":["../../../src/cli/config-export.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAoB,EAAE,MAAoB;IAC9E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK;QAC7B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QACrB,CAAC,CAAC,MAAM,KAAK,KAAK;YAChB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAE3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,KAAK,GAAa,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC3B,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAE5D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,uCAAuC,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,MAAM,GAA4C,EAAE,CAAC;IAE3D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAoB;IAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,SAAS;YAAE,SAAS;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpE,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,qCAAqC,CAAC,CAAC;AACzE,CAAC"}

package/dist/src/cli/config-import.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CLI command: aimeat config import
+ * Imports config from a file or Consul into the database.
+ */
+import type { AimeatConfig } from '../config.js';
+export declare function runConfigImport(config: AimeatConfig, options: {
+    file?: string;
+    from?: string;
+}): Promise<void>;
+//# sourceMappingURL=config-import.d.ts.map

package/dist/src/cli/config-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-import.d.ts","sourceRoot":"","sources":["../../../src/cli/config-import.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+CjD,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAgFf"}

package/dist/src/cli/config-import.js

@@ -0,0 +1,124 @@
+/**
+ * CLI command: aimeat config import
+ * Imports config from a file or Consul into the database.
+ */
+import { existsSync } from 'node:fs';
+import * as readline from 'node:readline';
+import { loadFileSource } from '../services/config-loader.js';
+import { MUTABLE_CONFIG_MAP, isImmutable, parseConfigValue } from '../services/config-schema.js';
+import { createConsulConfigService } from '../services/consul-config.js';
+import { createStorage } from '../storage/storage-factory.js';
+function classifyValues(values) {
+    const mutable = [];
+    const immutable = [];
+    const unknown = [];
+    for (const dotPath of Object.keys(values)) {
+        const field = MUTABLE_CONFIG_MAP[dotPath];
+        if (field) {
+            // Validate the value can be parsed
+            try {
+                const parsed = parseConfigValue(field, values[dotPath]);
+                if (field.validate(parsed)) {
+                    mutable.push(dotPath);
+                }
+                else {
+                    unknown.push(dotPath); // Valid field but invalid value
+                }
+            }
+            catch {
+                unknown.push(dotPath);
+            }
+        }
+        else if (isImmutable(dotPath)) {
+            immutable.push(dotPath);
+        }
+        else {
+            unknown.push(dotPath);
+        }
+    }
+    return { mutable, immutable, unknown };
+}
+async function confirm(message) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise(resolve => {
+        rl.question(`${message} [Y/n] `, answer => {
+            rl.close();
+            resolve(!answer || answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+        });
+    });
+}
+export async function runConfigImport(config, options) {
+    // Verify persistent storage
+    if (config.storageProvider === 'memory') {
+        console.error(`Error: Config import requires a persistent database (MongoDB or SQLite). Current storage: ${config.storageProvider}`);
+        console.error('Tip: Start with --db sqlite or --db mongodb to enable config persistence.');
+        process.exit(1);
+    }
+    let values;
+    if (options.from === 'consul') {
+        // Import from Consul KV
+        const consulService = createConsulConfigService(config);
+        if (!consulService) {
+            console.error('Error: Consul is not enabled. Set AIMEAT_CONSUL_ENABLED=true and AIMEAT_CONSUL_URL.');
+            process.exit(1);
+        }
+        console.log('Loading config from Consul KV...');
+        values = await consulService.loadAll();
+    }
+    else if (options.file) {
+        // Import from file
+        if (!existsSync(options.file)) {
+            console.error(`Error: File not found: ${options.file}`);
+            process.exit(1);
+        }
+        console.log(`Loading config from ${options.file}...`);
+        const fileSource = loadFileSource(options.file);
+        if (!fileSource) {
+            console.error(`Error: Could not parse config file: ${options.file}`);
+            process.exit(1);
+        }
+        values = fileSource.values;
+    }
+    else {
+        console.error('Error: Specify --file <path> or --from consul');
+        process.exit(1);
+    }
+    if (Object.keys(values).length === 0) {
+        console.log('No config values found. Nothing to import.');
+        return;
+    }
+    // Classify values
+    const stats = classifyValues(values);
+    console.log(`\nFound ${Object.keys(values).length} config values:`);
+    console.log(`  ${stats.mutable.length} mutable → will import to database`);
+    console.log(`  ${stats.immutable.length} immutable → will skip (${stats.immutable.slice(0, 3).join(', ')}${stats.immutable.length > 3 ? ', ...' : ''})`);
+    console.log(`  ${stats.unknown.length} unknown/invalid → will skip`);
+    if (stats.mutable.length === 0) {
+        console.log('\nNo mutable values to import.');
+        return;
+    }
+    // Confirm
+    const proceed = await confirm(`\nImport ${stats.mutable.length} mutable values to database?`);
+    if (!proceed) {
+        console.log('Cancelled.');
+        return;
+    }
+    // Connect to storage and write
+    const storage = await createStorage({
+        provider: config.storageProvider,
+        sqlitePath: config.sqlitePath,
+        dbUrl: config.dbUrl ?? undefined,
+    });
+    let imported = 0;
+    for (const dotPath of stats.mutable) {
+        try {
+            await storage.setConfigValue(dotPath, values[dotPath]);
+            imported++;
+        }
+        catch (err) {
+            console.warn(`  Warning: Failed to import ${dotPath}: ${err.message}`);
+        }
+    }
+    console.log(`\nImported ${imported} values to database (${stats.immutable.length + stats.unknown.length} skipped)`);
+}
+//# sourceMappingURL=config-import.js.map

package/dist/src/cli/config-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-import.js","sourceRoot":"","sources":["../../../src/cli/config-import.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,SAAS,CAAC;AACnD,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAoB,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAiB,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAS9D,SAAS,cAAc,CAAC,MAA8B;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,mCAAmC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC;gBACzD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,SAAS,EAAE,MAAM,CAAC,EAAE;YACxC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAoB,EACpB,OAAyC;IAEzC,4BAA4B;IAC5B,IAAI,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,6FAA6F,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QACrI,OAAO,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAA8B,CAAC;IAEnC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,wBAAwB;QACxB,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,mBAAmB;QACnB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uCAAuC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,kBAAkB;IAClB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAErC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,oCAAoC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,2BAA2B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzJ,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,UAAU;IACV,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,KAAK,CAAC,OAAO,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,+BAA+B;IAC/B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;KACjC,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,QAAQ,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,wBAAwB,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;AACtH,CAAC"}

package/dist/src/cli/federation-join.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `aimeat join [url]` — guided federation join flow.
+ *
+ * Handles: discovery → role selection → introduce → approval polling →
+ * key exchange → .env update → done.
+ *
+ * Two paths:
+ *  - Contributor: auto-approved, instant join
+ *  - Operator: pending approval, polls until approved/rejected
+ */
+import type { AimeatConfig } from '../config.js';
+export declare function runFederationJoin(config: AimeatConfig, targetUrl?: string, locale?: string): Promise<void>;
+//# sourceMappingURL=federation-join.d.ts.map

package/dist/src/cli/federation-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"federation-join.d.ts","sourceRoot":"","sources":["../../../src/cli/federation-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA8HjD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CA2Mf"}