aimeat 1.2.0

package/dist/src/middleware/cors.js

@@ -0,0 +1,112 @@
+/**
+ * CORS middleware — per-entity origin resolution.
+ *
+ * Phase 1: Node-level only (config.corsAllowedOrigins).
+ * Phase 2: GHII-level — authenticated users can restrict their origins.
+ *          Resolution: GHII.allowedOrigins → node default.
+ */
+export function corsMiddleware(config, getStorage) {
+    return async (req, res, next) => {
+        const origin = req.headers.origin;
+        // No Origin header = same-origin or non-browser client → allow
+        if (!origin) {
+            next();
+            return;
+        }
+        // Anonymous mode: when enabled and no JWT present, skip origin checks.
+        // All anonymous users share one identity and memory space — CORS adds no value.
+        if (config.anonymousMode && !req.headers.authorization) {
+            setCorsHeaders(res, '*');
+            if (req.method === 'OPTIONS') {
+                res.status(204).end();
+                return;
+            }
+            next();
+            return;
+        }
+        // Resolve the most specific allowedOrigins for this request
+        const storage = getStorage?.() ?? null;
+        const allowed = await resolveAllowedOrigins(req, config, storage);
+        if (allowed.includes('*') || allowed.includes(origin)) {
+            setCorsHeaders(res, origin);
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+            res.setHeader('Vary', 'Origin');
+        }
+        // If origin not allowed, we omit CORS headers — browser will block the response
+        if (req.method === 'OPTIONS') {
+            if (allowed.includes('*') || allowed.includes(origin)) {
+                res.setHeader('Access-Control-Max-Age', '3600');
+                res.status(204).end();
+            }
+            else {
+                res.status(403).end();
+            }
+            return;
+        }
+        next();
+    };
+}
+function setCorsHeaders(res, origin) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Idempotency-Key, mcp-session-id');
+    res.setHeader('Access-Control-Expose-Headers', 'mcp-session-id');
+}
+/**
+ * Resolve the effective allowedOrigins for a request.
+ * Phase 2: GHII → node default.
+ *
+ * Full resolution chain (most specific wins):
+ *   memory key → agent → GHII → node default
+ */
+async function resolveAllowedOrigins(req, config, storage) {
+    if (!req.auth?.owner || !storage) {
+        return config.corsAllowedOrigins;
+    }
+    try {
+        const sub = req.auth.sub; // GAII (agent) or owner name
+        const owner = req.auth.owner;
+        // Phase 4: Memory-level — check if this is a memory request with a key
+        const memoryKey = extractMemoryKey(req);
+        if (memoryKey) {
+            const record = await storage.getMemory(sub, memoryKey);
+            if (record?.allowedOrigins?.length) {
+                return record.allowedOrigins;
+            }
+        }
+        // Phase 3: Agent-level — check agent's allowedOrigins
+        if (sub !== owner) {
+            const agent = await storage.getAgent(sub);
+            if (agent?.allowedOrigins?.length) {
+                return agent.allowedOrigins;
+            }
+        }
+        // Phase 2: GHII-level — check owner's GHII allowedOrigins
+        const ghii = await storage.getGHIIByOwner(owner);
+        if (ghii?.allowedOrigins?.length) {
+            return ghii.allowedOrigins;
+        }
+    }
+    catch {
+        // Storage error — fall through to node default
+    }
+    // Node-level default
+    return config.corsAllowedOrigins;
+}
+/**
+ * Extract a memory key from the request path, if this is a memory endpoint.
+ * Matches: /v1/memory/:key, /v1/memory/cors/:key
+ */
+function extractMemoryKey(req) {
+    const path = req.path;
+    // /v1/memory/cors/:key
+    const corsMatch = path.match(/^\/v1\/memory\/cors\/(.+)$/);
+    if (corsMatch)
+        return decodeURIComponent(corsMatch[1]);
+    // /v1/memory/:key (but not /v1/memory/search, /v1/memory/:gaii/:key)
+    const keyMatch = path.match(/^\/v1\/memory\/([^/]+)$/);
+    if (keyMatch && keyMatch[1] !== 'search')
+        return decodeURIComponent(keyMatch[1]);
+    return null;
+}
+//# sourceMappingURL=cors.js.map

package/dist/src/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,UAAiC;IAClF,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,+DAA+D;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,uEAAuE;QACvE,gFAAgF;QAChF,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACrD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACtB,OAAO;YACX,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,4DAA4D;QAC5D,MAAM,OAAO,GAAG,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAElE,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,gFAAgF;QAEhF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO;QACX,CAAC;QAED,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,GAAqD,EAAE,MAAc;IACzF,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACrD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC;IACjF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,8DAA8D,CAAC,CAAC;IAC9G,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAChC,GAAY,EACZ,MAAoB,EACpB,OAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,kBAAkB,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAK,6BAA6B;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QAE7B,uEAAuE;QACvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,cAAc,CAAC;YACjC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,cAAc,CAAC;YAChC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC;QAC/B,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,+CAA+C;IACnD,CAAC;IAED,qBAAqB;IACrB,OAAO,MAAM,CAAC,kBAAkB,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAY;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,uBAAuB;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3D,IAAI,SAAS;QAAE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/src/middleware/envelope.d.ts

@@ -0,0 +1,33 @@
+export interface HintAction {
+    description: string;
+    method: string;
+    url: string;
+    note?: string;
+    example_body?: Record<string, unknown>;
+}
+export interface AimeatResponse<T = unknown> {
+    ok: boolean;
+    protocol: 'aimeat';
+    version: 'v1';
+    node: string;
+    timestamp: string;
+    request_id: string;
+    data?: T;
+    error?: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+    hints?: {
+        next_actions: HintAction[];
+        help_url?: string;
+    };
+    meta?: {
+        page?: number;
+        per_page?: number;
+        total?: number;
+    };
+}
+export declare function success<T>(nodeId: string, data: T, hints?: HintAction[], meta?: AimeatResponse['meta']): AimeatResponse<T>;
+export declare function error(nodeId: string, code: string, message: string, httpStatus?: number, details?: unknown, hints?: HintAction[]): AimeatResponse;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/src/middleware/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../src/middleware/envelope.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7D,KAAK,CAAC,EAAE;QAAE,YAAY,EAAE,UAAU,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAY1H;AAED,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,cAAc,CAgBjJ"}

package/dist/src/middleware/envelope.js

@@ -0,0 +1,32 @@
+import { generateRequestId } from '../utils/tracking-code.js';
+export function success(nodeId, data, hints, meta) {
+    return {
+        ok: true,
+        protocol: 'aimeat',
+        version: 'v1',
+        node: nodeId,
+        timestamp: new Date().toISOString(),
+        request_id: generateRequestId(),
+        data,
+        hints: hints ? { next_actions: hints, help_url: '/v1/docs' } : undefined,
+        meta,
+    };
+}
+export function error(nodeId, code, message, httpStatus, details, hints) {
+    return {
+        ok: false,
+        protocol: 'aimeat',
+        version: 'v1',
+        node: nodeId,
+        timestamp: new Date().toISOString(),
+        request_id: generateRequestId(),
+        error: { code, message, details },
+        hints: hints ? { next_actions: hints, help_url: '/v1/docs' } : {
+            next_actions: [
+                { description: 'View API documentation', method: 'GET', url: '/v1/docs' },
+            ],
+            help_url: '/v1/docs',
+        },
+    };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/src/middleware/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/middleware/envelope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAuB9D,MAAM,UAAU,OAAO,CAAI,MAAc,EAAE,IAAO,EAAE,KAAoB,EAAE,IAA6B;IACrG,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,iBAAiB,EAAE;QAC/B,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QACxE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,UAAmB,EAAE,OAAiB,EAAE,KAAoB;IAC/H,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;QACjC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAC7D,YAAY,EAAE;gBACZ,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;aAC1E;YACD,QAAQ,EAAE,UAAU;SACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/src/middleware/idempotency.d.ts

@@ -0,0 +1,3 @@
+import type { Request, Response, NextFunction } from 'express';
+export declare function idempotency(): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/src/middleware/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAqB/D,wBAAgB,WAAW,KACf,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAsD1D"}

package/dist/src/middleware/idempotency.js

@@ -0,0 +1,64 @@
+const cache = new Map();
+const TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const MAX_CACHE_SIZE = 10_000;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// Cleanup expired entries every 5 minutes
+setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of cache) {
+        if (now - entry.storedAt > TTL_MS)
+            cache.delete(key);
+    }
+}, 300_000);
+export function idempotency() {
+    return (req, res, next) => {
+        // Only applies to POST/PUT methods
+        if (req.method !== 'POST' && req.method !== 'PUT') {
+            next();
+            return;
+        }
+        const idempotencyKey = req.headers['idempotency-key'];
+        if (!idempotencyKey) {
+            next();
+            return;
+        }
+        // SECURITY: Validate key format to prevent cache key abuse
+        if (!UUID_REGEX.test(idempotencyKey)) {
+            res.status(400).json({
+                error: { code: 'INVALID_IDEMPOTENCY_KEY', message: 'Idempotency-Key must be a valid UUID (e.g., 550e8400-e29b-41d4-a716-446655440000)' },
+            });
+            return;
+        }
+        // Check cache
+        const cached = cache.get(idempotencyKey);
+        if (cached) {
+            res.status(cached.status).json(cached.body);
+            return;
+        }
+        // SECURITY: Evict oldest entry if cache is full (prevent unbounded memory growth)
+        if (cache.size >= MAX_CACHE_SIZE) {
+            let oldestKey = null;
+            let oldestTime = Infinity;
+            for (const [key, entry] of cache) {
+                if (entry.storedAt < oldestTime) {
+                    oldestTime = entry.storedAt;
+                    oldestKey = key;
+                }
+            }
+            if (oldestKey)
+                cache.delete(oldestKey);
+        }
+        // Intercept response to cache it
+        const originalJson = res.json.bind(res);
+        res.json = function (body) {
+            cache.set(idempotencyKey, {
+                status: res.statusCode,
+                body,
+                storedAt: Date.now(),
+            });
+            return originalJson(body);
+        };
+        next();
+    };
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/src/middleware/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAQA,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;AAChD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAC/C,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,UAAU,GAAG,iEAAiE,CAAC;AAErF,0CAA0C;AAC1C,WAAW,CAAC,GAAG,EAAE;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;AACL,CAAC,EAAE,OAAO,CAAC,CAAC;AAEZ,MAAM,UAAU,WAAW;IACvB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAChD,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAuB,CAAC;QAC5E,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,mFAAmF,EAAE;aAC3I,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACX,CAAC;QAED,kFAAkF;QAClF,IAAI,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC/B,IAAI,SAAS,GAAkB,IAAI,CAAC;YACpC,IAAI,UAAU,GAAG,QAAQ,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC/B,IAAI,KAAK,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC;oBAC9B,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;oBAC5B,SAAS,GAAG,GAAG,CAAC;gBACpB,CAAC;YACL,CAAC;YACD,IAAI,SAAS;gBAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,GAAG,UAAU,IAAa;YAC9B,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE;gBACtB,MAAM,EAAE,GAAG,CAAC,UAAU;gBACtB,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;aACvB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;AACN,CAAC"}

package/dist/src/middleware/metrics.d.ts

@@ -0,0 +1,8 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { Registry } from 'prom-client';
+/**
+ * Express middleware that records HTTP request count and duration
+ * into the Prometheus registry created by createMetricsRegistry().
+ */
+export declare function metricsMiddleware(registry: Registry): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/src/middleware/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../../src/middleware/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAsB,MAAM,aAAa,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,IAI1C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAmBxD"}

package/dist/src/middleware/metrics.js

@@ -0,0 +1,25 @@
+/**
+ * Express middleware that records HTTP request count and duration
+ * into the Prometheus registry created by createMetricsRegistry().
+ */
+export function metricsMiddleware(registry) {
+    const requestCounter = registry.getSingleMetric('aimeat_http_requests_total');
+    const durationHistogram = registry.getSingleMetric('aimeat_http_request_duration_ms');
+    return (req, res, next) => {
+        const start = Date.now();
+        res.on('finish', () => {
+            const duration = Date.now() - start;
+            const route = req.route?.path ?? 'unmatched';
+            const method = req.method;
+            const status = String(res.statusCode);
+            if (requestCounter) {
+                requestCounter.inc({ method, route, status });
+            }
+            if (durationHistogram) {
+                durationHistogram.observe({ method, route }, duration);
+            }
+        });
+        next();
+    };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/src/middleware/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/middleware/metrics.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,eAAe,CAAC,4BAA4B,CAAY,CAAC;IACzF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,CAAC,iCAAiC,CAAc,CAAC;IAEnG,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACpC,MAAM,KAAK,GAAI,GAAG,CAAC,KAAK,EAAE,IAAe,IAAI,WAAW,CAAC;YACzD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAEtC,IAAI,cAAc,EAAE,CAAC;gBACnB,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/rate-limit.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { RateLimitTier, RoleMultipliers } from '../config.js';
+export declare function rateLimit(opts?: Partial<RateLimitTier>, roleMultipliers?: RoleMultipliers): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/src/middleware/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AASnE,wBAAgB,SAAS,CAAC,IAAI,GAAE,OAAO,CAAC,aAAa,CAAM,EAAE,eAAe,CAAC,EAAE,eAAe,IAgBlF,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAuD1D"}

package/dist/src/middleware/rate-limit.js

@@ -0,0 +1,73 @@
+import { getStats } from '../services/stats.js';
+import { getPromMetrics } from '../services/prometheus.js';
+export function rateLimit(opts = {}, roleMultipliers) {
+    const windowMs = opts.windowMs ?? 60_000;
+    const baseMax = opts.max ?? 100;
+    // Each rate limiter instance has its own bucket store
+    const buckets = new Map();
+    // Cleanup expired buckets every 60 seconds
+    const cleanup = setInterval(() => {
+        const now = Date.now();
+        for (const [key, bucket] of buckets) {
+            if (now > bucket.resetAt)
+                buckets.delete(key);
+        }
+    }, 60_000);
+    cleanup.unref();
+    return (req, res, next) => {
+        // Key by GAII if authenticated, otherwise by IP
+        const key = req.auth?.sub ?? req.ip ?? 'unknown';
+        const now = Date.now();
+        // Determine role-based multiplier
+        let multiplier = 1;
+        if (roleMultipliers) {
+            const roles = req.auth?.roles;
+            if (roles?.includes('operator'))
+                multiplier = roleMultipliers.operator;
+            else if (roles?.includes('owner'))
+                multiplier = roleMultipliers.owner;
+            else if (req.auth)
+                multiplier = roleMultipliers.agent;
+            else
+                multiplier = roleMultipliers.anonymous;
+        }
+        const max = Math.ceil(baseMax * multiplier);
+        let bucket = buckets.get(key);
+        if (!bucket || now > bucket.resetAt) {
+            bucket = { count: 0, resetAt: now + windowMs };
+            buckets.set(key, bucket);
+        }
+        bucket.count++;
+        res.setHeader('X-RateLimit-Limit', max);
+        res.setHeader('X-RateLimit-Remaining', Math.max(0, max - bucket.count));
+        res.setHeader('X-RateLimit-Reset', Math.ceil(bucket.resetAt / 1000));
+        if (bucket.count > max) {
+            const stats = getStats();
+            if (stats)
+                stats.increment('rate_limit_hits_total');
+            const prom = getPromMetrics();
+            if (prom)
+                prom.rateLimitHitsTotal.inc();
+            const retryAfterSec = Math.ceil((bucket.resetAt - now) / 1000);
+            res.setHeader('Retry-After', retryAfterSec);
+            res.status(429).json({
+                ok: false,
+                protocol: 'aimeat',
+                version: 'v1',
+                timestamp: new Date().toISOString(),
+                error: {
+                    code: 'RATE_LIMITED',
+                    message: `Too many requests. Limit: ${max} per ${windowMs / 1000}s. Try again at ${new Date(bucket.resetAt).toISOString()}`,
+                },
+                hints: {
+                    next_actions: [
+                        { description: 'Wait and retry', method: 'GET', url: '/' },
+                    ],
+                },
+            });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/src/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAO3D,MAAM,UAAU,SAAS,CAAC,OAA+B,EAAE,EAAE,eAAiC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;IAEhC,sDAAsD;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,2CAA2C;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YAClC,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACL,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,gDAAgD;QAChD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,kCAAkC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,eAAe,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAA6B,CAAC;YACtD,IAAI,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC;gBAAE,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC;iBAClE,IAAI,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC;iBACjE,IAAI,GAAG,CAAC,IAAI;gBAAE,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC;;gBACjD,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC;QAE5C,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACxC,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAErE,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;YAC9B,IAAI,IAAI;gBAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE;oBACH,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,6BAA6B,GAAG,QAAQ,QAAQ,GAAG,IAAI,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;iBAC9H;gBACD,KAAK,EAAE;oBACH,YAAY,EAAE;wBACV,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;qBAC7D;iBACJ;aACJ,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;AACN,CAAC"}

package/dist/src/middleware/request-id.d.ts

@@ -0,0 +1,18 @@
+import type { Request, Response, NextFunction } from 'express';
+declare global {
+    namespace Express {
+        interface Request {
+            requestId?: string;
+        }
+    }
+}
+/**
+ * Assigns a unique request ID to every HTTP request.
+ * Uses incoming X-Request-Id header if present (for distributed tracing).
+ * Generates a UUIDv4 if absent.
+ *
+ * Wraps the downstream handler chain in an AsyncLocalStorage context so
+ * that every Winston log entry automatically includes the requestId.
+ */
+export declare function requestIdMiddleware(): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/src/middleware/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../../src/middleware/request-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB;KACF;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,KACzB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD"}

package/dist/src/middleware/request-id.js

@@ -0,0 +1,23 @@
+import { v4 as uuidv4 } from 'uuid';
+import { requestContext } from '../utils/logger.js';
+/**
+ * Assigns a unique request ID to every HTTP request.
+ * Uses incoming X-Request-Id header if present (for distributed tracing).
+ * Generates a UUIDv4 if absent.
+ *
+ * Wraps the downstream handler chain in an AsyncLocalStorage context so
+ * that every Winston log entry automatically includes the requestId.
+ */
+export function requestIdMiddleware() {
+    return (req, res, next) => {
+        const requestId = req.headers['x-request-id'] ?? uuidv4();
+        req.requestId = requestId;
+        res.setHeader('X-Request-Id', requestId);
+        const ctx = {
+            requestId,
+            gaii: req.auth?.sub,
+        };
+        requestContext.run(ctx, () => next());
+    };
+}
+//# sourceMappingURL=request-id.js.map

package/dist/src/middleware/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../../src/middleware/request-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYpD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY,IAAI,MAAM,EAAE,CAAC;QACtE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAmB;YAC1B,SAAS;YACT,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG;SACpB,CAAC;QAEF,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/stats.d.ts

@@ -0,0 +1,4 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { StatsCollector } from '../services/stats.js';
+export declare function statsMiddleware(stats: StatsCollector): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=stats.d.ts.map

package/dist/src/middleware/stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.d.ts","sourceRoot":"","sources":["../../../src/middleware/stats.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,IAC3C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD"}

package/dist/src/middleware/stats.js

@@ -0,0 +1,11 @@
+export function statsMiddleware(stats) {
+    return (req, res, next) => {
+        stats.increment('requests_total');
+        stats.incrementMethod(req.method);
+        res.on('finish', () => {
+            stats.incrementStatus(res.statusCode);
+        });
+        next();
+    };
+}
+//# sourceMappingURL=stats.js.map

package/dist/src/middleware/stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats.js","sourceRoot":"","sources":["../../../src/middleware/stats.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/middleware/workspace-access.d.ts

@@ -0,0 +1,16 @@
+import type { RequestHandler } from 'express';
+import type { AimeatConfig } from '../config.js';
+import type { Storage } from '../storage/interface.js';
+/**
+ * Workspace access middleware — Phase 2.3
+ *
+ * Intercepts memory operations on organism.* namespace keys
+ * and enforces membership + role-based access control.
+ *
+ * Namespace conventions:
+ *   organism.{id}.shared.*  — All members + organism agents can read/write
+ *   organism.{id}.meta.*    — All members can read, only admins/creators can write
+ *   organism.{id}.member.{owner}.* — All members can read, only the specific member can write
+ */
+export declare function workspaceAccessMiddleware(config: AimeatConfig, storage: Storage): RequestHandler;
+//# sourceMappingURL=workspace-access.d.ts.map

package/dist/src/middleware/workspace-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-access.d.ts","sourceRoot":"","sources":["../../../src/middleware/workspace-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGvD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,GACf,cAAc,CAsHhB"}

package/dist/src/middleware/workspace-access.js

@@ -0,0 +1,115 @@
+import { error } from './envelope.js';
+/**
+ * Workspace access middleware — Phase 2.3
+ *
+ * Intercepts memory operations on organism.* namespace keys
+ * and enforces membership + role-based access control.
+ *
+ * Namespace conventions:
+ *   organism.{id}.shared.*  — All members + organism agents can read/write
+ *   organism.{id}.meta.*    — All members can read, only admins/creators can write
+ *   organism.{id}.member.{owner}.* — All members can read, only the specific member can write
+ */
+export function workspaceAccessMiddleware(config, storage) {
+    return async (req, res, next) => {
+        // Extract memory key from request
+        // Memory routes use :key param in URLs like /v1/memory/:key
+        const key = req.params.key;
+        if (!key)
+            return next();
+        // Only intercept organism.* namespace keys
+        const match = key.match(/^organism\.([^.]+)\./);
+        if (!match)
+            return next();
+        const organismId = match[1];
+        const ownerName = req.auth?.owner;
+        // Require authentication for all workspace operations
+        if (!ownerName) {
+            res.status(401).json(error(config.nodeId, 'AUTH_REQUIRED', 'Authentication required for workspace access'));
+            return;
+        }
+        // Look up the organism
+        const organism = await storage.getOrganism(organismId);
+        if (!organism) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', `Organism not found: ${organismId}`));
+            return;
+        }
+        // Check if the request is from an organism agent
+        if (req.auth?.sub && organism.agentGaiis.includes(req.auth.sub)) {
+            // Agent access — allowed for shared namespace reads and writes
+            if (key.startsWith(`organism.${organismId}.shared.`)) {
+                return next();
+            }
+            // Agents can read meta namespace
+            if (key.startsWith(`organism.${organismId}.meta.`) && ['GET', 'HEAD'].includes(req.method)) {
+                return next();
+            }
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Agent not authorized for this workspace namespace'));
+            return;
+        }
+        // Resolve the user's GHII via their ownerName
+        const userGhii = await storage.getGHIIByOwner(ownerName);
+        if (!userGhii) {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not a member of this organism'));
+            return;
+        }
+        const membership = await storage.getMembership(organismId, userGhii.ghii);
+        if (!membership || membership.status !== 'active') {
+            res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Not an active member of this organism'));
+            return;
+        }
+        // --- Consent check (Phase 2.3) ---
+        // Determine if consent is required for this operation.
+        // Consent is NOT required for:
+        //   - Writes to the member's own namespace (organism.{id}.member.{owner}.*)
+        // Consent IS required for:
+        //   - All READ operations on shared/meta namespaces
+        //   - Writes to shared namespace (not own member namespace)
+        const isRead = ['GET', 'HEAD'].includes(req.method);
+        const ownMemberPrefix = `organism.${organismId}.member.${ownerName}.`;
+        const isOwnMemberNamespace = key.startsWith(ownMemberPrefix);
+        // Skip consent for writes to your own member namespace
+        const needsConsent = isRead
+            ? !isOwnMemberNamespace // reads outside own namespace need consent
+            : !isOwnMemberNamespace; // writes outside own namespace need consent
+        if (needsConsent) {
+            // Look up all agents for this owner
+            const agents = await storage.getAgentsByOwner(ownerName);
+            if (agents.length === 0) {
+                res.status(403).json(error(config.nodeId, 'CONSENT_REQUIRED', 'No agent found — consent cannot be verified'));
+                return;
+            }
+            // Check if ANY of the owner's agents have a matching active consent
+            const accessorPattern = `organism.${organismId}`;
+            let hasConsent = false;
+            for (const agent of agents) {
+                const matching = await storage.findMatchingConsents(agent.gaii, key, accessorPattern);
+                if (matching.length > 0) {
+                    hasConsent = true;
+                    break;
+                }
+            }
+            if (!hasConsent) {
+                res.status(403).json(error(config.nodeId, 'CONSENT_REQUIRED', `Active consent required for organism workspace access (key: ${key})`));
+                return;
+            }
+        }
+        // Meta namespace: only admins/creators can write
+        if (key.startsWith(`organism.${organismId}.meta.`) && !['GET', 'HEAD'].includes(req.method)) {
+            if (membership.role !== 'admin' && membership.role !== 'creator') {
+                res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Admin access required for meta namespace'));
+                return;
+            }
+        }
+        // Member namespace: only the specific member can write
+        const memberMatch = key.match(/^organism\.[^.]+\.member\.([^.]+)\./);
+        if (memberMatch && !['GET', 'HEAD'].includes(req.method)) {
+            if (memberMatch[1] !== ownerName) {
+                res.status(403).json(error(config.nodeId, 'ACCESS_DENIED', 'Cannot write to another member\'s workspace'));
+                return;
+            }
+        }
+        next();
+    };
+}
+//# sourceMappingURL=workspace-access.js.map

package/dist/src/middleware/workspace-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../../../src/middleware/workspace-access.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB,EACpB,OAAgB;IAEhB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,kCAAkC;QAClC,4DAA4D;QAC5D,MAAM,GAAG,GAAI,GAAG,CAAC,MAAiC,CAAC,GAAG,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAExB,2CAA2C;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QAElC,sDAAsD;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,8CAA8C,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,uBAAuB,UAAU,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,+DAA+D;YAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,UAAU,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,iCAAiC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,mDAAmD,CAAC,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,uDAAuD;QACvD,+BAA+B;QAC/B,4EAA4E;QAC5E,2BAA2B;QAC3B,oDAAoD;QACpD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,YAAY,UAAU,WAAW,SAAS,GAAG,CAAC;QACtE,MAAM,oBAAoB,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAE7D,uDAAuD;QACvD,MAAM,YAAY,GAAG,MAAM;YACzB,CAAC,CAAC,CAAC,oBAAoB,CAAG,2CAA2C;YACrE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAE,4CAA4C;QAExE,IAAI,YAAY,EAAE,CAAC;YACjB,oCAAoC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAEzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,6CAA6C,CAAC,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,MAAM,eAAe,GAAG,YAAY,UAAU,EAAE,CAAC;YACjD,IAAI,UAAU,GAAG,KAAK,CAAC;YAEvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;gBACtF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAC1D,+DAA+D,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,UAAU,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5F,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrE,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}