aimeat 1.2.0

package/dist/src/server-bootstrap/config-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-init.js","sourceRoot":"","sources":["../../../src/server-bootstrap/config-init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAE5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAS5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,aAA6B;IAE7B,mCAAmC;IACnC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAA2B;QAC5C,MAAM,EAAE,mDAAmD;QAC3D,MAAM,EAAE,WAAW,MAAM,CAAC,UAAU,GAAG;QACvC,OAAO,EAAE,YAAY,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,IAAI,QAAQ,GAAG;KACzF,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAEtE,yCAAyC;IACzC,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC;IAC1C,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAErD,IAAI,aAAa,EAAE,CAAC;QAClB,qEAAqE;QACrE,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,gBAAgB,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;IAED,yBAAyB;IACzB,0DAA0D;IAC1D,MAAM,aAAa,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;gBAC5D,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YAED,0EAA0E;YAC1E,aAAa,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE;gBACtC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC;gBACpF,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACvD,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3G,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,sCAAsC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAa,CAAC;gBAC1C,IAAI,QAAQ,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBACtC,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;4BAC3B,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;4BAC1C,WAAW,EAAE,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,UAAU,WAAW,4CAA4C,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,4EAA4E,CAAC,CAAC;IAExF,sEAAsE;IACtE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,wDAAwD;IACxD,eAAe,CAAC,OAAO,CAAC,CAAC;IAEzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAChD,CAAC"}

package/dist/src/server-bootstrap/middleware-guards.d.ts

@@ -0,0 +1,15 @@
+import express from 'express';
+import type { AimeatConfig } from '../config.js';
+import type { Storage, MaintenanceState } from '../storage/interface.js';
+/**
+ * Set up maintenance mode guard, node-type guards (relay/mirror),
+ * and first-run wizard redirect.
+ */
+export declare function setupGuards(app: express.Express, config: AimeatConfig, storage: Storage, maintenanceCache: {
+    get: () => MaintenanceState;
+}, invalidateHasOwnersCache: () => void): {
+    rejectForRelay: express.RequestHandler;
+    mirrorReadOnly: express.RequestHandler;
+    invalidateHasOwnersCache: () => void;
+};
+//# sourceMappingURL=middleware-guards.d.ts.map

package/dist/src/server-bootstrap/middleware-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-guards.d.ts","sourceRoot":"","sources":["../../../src/server-bootstrap/middleware-guards.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAczE;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE;IAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;CAAE,EACjD,wBAAwB,EAAE,MAAM,IAAI,GACnC;IAAE,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC;IAAC,wBAAwB,EAAE,MAAM,IAAI,CAAA;CAAE,CA4G1H"}

package/dist/src/server-bootstrap/middleware-guards.js

@@ -0,0 +1,244 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+function esc(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+/**
+ * Resolve the server-bootstrap directory for path resolution.
+ */
+function resolveServerDir() {
+    const __filename = fileURLToPath(import.meta.url);
+    return dirname(__filename);
+}
+/**
+ * Set up maintenance mode guard, node-type guards (relay/mirror),
+ * and first-run wizard redirect.
+ */
+export function setupGuards(app, config, storage, maintenanceCache, invalidateHasOwnersCache) {
+    const __dirname = resolveServerDir();
+    // ── Maintenance mode guard ──
+    // Returns 503 for non-essential paths when maintenance is enabled.
+    // Operators always pass. Essential paths (health, admin, spec, well-known) always pass.
+    app.use((req, res, next) => {
+        const mc = maintenanceCache.get();
+        if (!mc.enabled) {
+            next();
+            return;
+        }
+        // Operators always bypass
+        if (req.auth?.roles?.includes('operator')) {
+            next();
+            return;
+        }
+        // Essential paths always bypass
+        const p = req.path;
+        if (p === '/' ||
+            p === '/v1/health' ||
+            p.startsWith('/v1/admin') ||
+            p.startsWith('/v1/spec') ||
+            p.startsWith('/.well-known') ||
+            p.startsWith('/v1/federation/peer/introduce') ||
+            p.startsWith('/v1/federation/directory') ||
+            p.startsWith('/favicon') ||
+            req.method === 'OPTIONS') {
+            next();
+            return;
+        }
+        const msg = mc.message || 'This node is temporarily offline for maintenance.';
+        // Serve HTML for browsers, JSON for API clients
+        if (req.accepts(['html', 'json']) === 'html') {
+            res.status(503).type('text/html').send(maintenancePageHtml(config.nodeId, msg));
+            return;
+        }
+        res.status(503).json({
+            ok: false, protocol: 'aimeat', version: 'v1', node: config.nodeId,
+            timestamp: new Date().toISOString(),
+            error: { code: 'MAINTENANCE_MODE', message: msg },
+        });
+    });
+    // ── Node-type guards ──
+    // Relay nodes: stateless routers — no agent hosting, memory, work, boards
+    const rejectForRelay = (_req, res, next) => {
+        if (config.nodeType === 'relay') {
+            res.status(503).json({
+                ok: false, protocol: 'aimeat', version: 'v1', node: config.nodeId,
+                timestamp: new Date().toISOString(),
+                error: { code: 'NODE_TYPE_UNSUPPORTED', message: 'Relay nodes do not host agents or data. Use a Full node.' },
+            });
+            return;
+        }
+        next();
+    };
+    // Mirror nodes: read-only replicas — block all write operations
+    const mirrorReadOnly = (req, res, next) => {
+        if (config.nodeType === 'mirror' && !['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
+            // Allow federation replication inbound (mirror receives data from peers)
+            if (req.path.startsWith('/v1/federation/replicate') || req.path.startsWith('/v1/federation/catalogue-sync')) {
+                next();
+                return;
+            }
+            res.status(503).json({
+                ok: false, protocol: 'aimeat', version: 'v1', node: config.nodeId,
+                timestamp: new Date().toISOString(),
+                error: { code: 'MIRROR_READ_ONLY', message: 'Mirror nodes are read-only. Direct writes to a Full node.' },
+            });
+            return;
+        }
+        next();
+    };
+    // First-run detection: redirect to wizard if no owners exist
+    let hasOwners = null;
+    const originalInvalidate = invalidateHasOwnersCache;
+    const wrappedInvalidate = () => { hasOwners = true; originalInvalidate(); };
+    app.use(async (req, res, next) => {
+        // Skip for API routes, static assets, and wizard page
+        if (req.path.startsWith('/v1/') || req.path.includes('.') || req.path === '/wizard.html') {
+            next();
+            return;
+        }
+        // Cache the check
+        if (hasOwners === null) {
+            const owners = await storage.listOwners();
+            hasOwners = owners.length > 0;
+        }
+        if (!hasOwners) {
+            // Serve wizard inline (resolvePublicFile pattern)
+            const wizardCandidates = [
+                join(process.cwd(), 'public', 'wizard.html'),
+                join(__dirname, '..', '..', 'public', 'wizard.html'),
+                join(__dirname, '..', '..', '..', 'public', 'wizard.html'),
+            ];
+            const wizardPath = wizardCandidates.find(p => existsSync(p));
+            if (wizardPath) {
+                res.type('text/html').send(readFileSync(wizardPath, 'utf-8'));
+            }
+            else {
+                res.redirect(302, '/v1/setup/status');
+            }
+            return;
+        }
+        next();
+    });
+    return { rejectForRelay, mirrorReadOnly, invalidateHasOwnersCache: wrappedInvalidate };
+}
+function maintenancePageHtml(nodeId, message) {
+    return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>
+<meta http-equiv="refresh" content="30"/>
+<link rel="icon" href="/favicon.svg" type="image/svg+xml">
+<title>Maintenance — ${esc(nodeId)}</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+body{background:#1a1025;color:#f0e6ff;font-family:system-ui,-apple-system,sans-serif;display:flex;flex-direction:column;justify-content:center;align-items:center;min-height:100vh;padding:20px;overflow:hidden}
+
+/* ── Warm ambient gradient base ── */
+body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellipse at 30% 20%,rgba(168,85,247,.12) 0%,transparent 50%),radial-gradient(ellipse at 70% 80%,rgba(236,72,153,.1) 0%,transparent 50%),radial-gradient(ellipse at 50% 50%,rgba(139,92,246,.06) 0%,transparent 70%);z-index:0}
+
+/* ── PS-style flowing waves — warm and bright ── */
+.waves{position:fixed;top:0;left:0;width:100%;height:100%;z-index:0;pointer-events:none}
+.wave{position:absolute;width:200%;height:200%;border-radius:42%;animation:drift linear infinite}
+.wave:nth-child(1){background:linear-gradient(135deg,#c084fc,#f472b6,#fb923c);top:-60%;left:-50%;animation-duration:25s;opacity:.07}
+.wave:nth-child(2){background:linear-gradient(225deg,#a78bfa,#f9a8d4,#fdba74);top:-65%;left:-55%;animation-duration:30s;animation-delay:-5s;opacity:.06}
+.wave:nth-child(3){background:linear-gradient(315deg,#e879f9,#fb7185,#c084fc);top:-70%;left:-45%;animation-duration:35s;animation-delay:-10s;opacity:.05}
+.wave:nth-child(4){background:linear-gradient(45deg,#f0abfc,#fda4af,#d8b4fe);top:-55%;left:-60%;animation-duration:40s;animation-delay:-15s;opacity:.04}
+@keyframes drift{from{transform:rotate(0deg)}to{transform:rotate(360deg)}}
+
+/* ── Floating hearts + particles ── */
+.particles{position:fixed;top:0;left:0;width:100%;height:100%;z-index:0;pointer-events:none}
+.particle{position:absolute;opacity:0;animation:float linear infinite}
+.particle.dot{border-radius:50%}
+.particle.heart::before{content:'\\2665';font-size:inherit;color:inherit}
+.particle:nth-child(1){font-size:14px;color:rgba(244,114,182,.5);left:8%;animation-duration:14s;animation-delay:0s}
+.particle:nth-child(2){width:3px;height:3px;background:#c084fc;left:20%;animation-duration:16s;animation-delay:-2s}
+.particle:nth-child(3){font-size:10px;color:rgba(192,132,252,.4);left:35%;animation-duration:12s;animation-delay:-5s}
+.particle:nth-child(4){width:2px;height:2px;background:#f9a8d4;left:48%;animation-duration:18s;animation-delay:-3s}
+.particle:nth-child(5){font-size:16px;color:rgba(251,113,133,.4);left:62%;animation-duration:15s;animation-delay:-7s}
+.particle:nth-child(6){width:3px;height:3px;background:#fda4af;left:75%;animation-duration:13s;animation-delay:-1s}
+.particle:nth-child(7){font-size:12px;color:rgba(216,180,254,.4);left:88%;animation-duration:17s;animation-delay:-9s}
+.particle:nth-child(8){width:2px;height:2px;background:#f0abfc;left:50%;animation-duration:20s;animation-delay:-11s}
+.particle:nth-child(9){font-size:8px;color:rgba(249,168,212,.35);left:15%;animation-duration:19s;animation-delay:-6s}
+.particle:nth-child(10){width:4px;height:4px;background:rgba(244,114,182,.3);left:42%;animation-duration:11s;animation-delay:-4s}
+@keyframes float{0%{transform:translateY(100vh) scale(0);opacity:0}10%{opacity:.7}90%{opacity:.7}100%{transform:translateY(-10vh) scale(1);opacity:0}}
+
+/* ── Card ── */
+.card{position:relative;z-index:1;background:rgba(30,20,45,.65);backdrop-filter:blur(28px);-webkit-backdrop-filter:blur(28px);border:1px solid rgba(192,132,252,.2);border-radius:28px;padding:56px 48px;max-width:520px;width:100%;text-align:center;box-shadow:0 0 100px rgba(168,85,247,.1),0 0 40px rgba(236,72,153,.06),0 4px 32px rgba(0,0,0,.2);animation:cardIn .8s cubic-bezier(.16,1,.3,1)}
+@keyframes cardIn{from{opacity:0;transform:translateY(20px) scale(.97)}to{opacity:1;transform:translateY(0) scale(1)}}
+
+/* ── Heart-beat loader ── */
+.loader{position:relative;width:80px;height:80px;margin:0 auto 28px}
+.heart-icon{font-size:40px;line-height:80px;animation:heartbeat 1.6s ease-in-out infinite;filter:drop-shadow(0 0 12px rgba(244,114,182,.4))}
+@keyframes heartbeat{0%,100%{transform:scale(1)}14%{transform:scale(1.15)}28%{transform:scale(1)}42%{transform:scale(1.1)}56%{transform:scale(1)}}
+.loader-ring{position:absolute;inset:0;border-radius:50%;border:2px solid transparent}
+.loader-ring:nth-child(1){border-top-color:rgba(192,132,252,.5);animation:spin 3s linear infinite}
+.loader-ring:nth-child(2){inset:4px;border-right-color:rgba(244,114,182,.4);animation:spin 4s linear infinite reverse}
+@keyframes spin{to{transform:rotate(360deg)}}
+
+/* ── Brand ── */
+.brand{font-size:.85rem;font-weight:600;letter-spacing:.15em;text-transform:uppercase;margin-bottom:6px;color:rgba(216,180,254,.6)}
+h1{font-size:1.6rem;font-weight:700;margin-bottom:14px;background:linear-gradient(135deg,#f0abfc,#f9a8d4,#fda4af);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;letter-spacing:-.01em}
+.msg{color:#c4b5d4;font-size:1rem;margin-bottom:28px;line-height:1.7}
+.reason{background:rgba(192,132,252,.08);border:1px solid rgba(192,132,252,.18);border-radius:12px;padding:14px 20px;color:#d8b4fe;font-size:.9rem;margin-bottom:28px;letter-spacing:.01em}
+.node-id{display:inline-flex;align-items:center;gap:8px;background:rgba(255,255,255,.05);border:1px solid rgba(255,255,255,.08);border-radius:10px;padding:8px 16px;margin-bottom:20px}
+.node-id code{color:#a78bfa;font-family:'SF Mono',Consolas,monospace;font-size:.75rem}
+.status-dot{width:7px;height:7px;border-radius:50%;background:#f472b6;animation:pulse 2s ease-in-out infinite}
+@keyframes pulse{0%,100%{opacity:1;box-shadow:0 0 0 0 rgba(244,114,182,.5)}50%{opacity:.6;box-shadow:0 0 0 8px rgba(244,114,182,0)}}
+.footer{color:rgba(167,139,250,.4);font-size:.7rem;margin-top:8px;letter-spacing:.04em;text-transform:uppercase}
+
+/* ── Progress bar — warm gradient ── */
+.progress{width:100%;height:3px;background:rgba(255,255,255,.06);border-radius:2px;margin-top:24px;overflow:hidden}
+.progress-bar{height:100%;width:100%;background:linear-gradient(90deg,#c084fc,#f472b6,#fb923c,#c084fc);background-size:300% 100%;border-radius:2px;animation:shimmer 2.5s linear infinite}
+@keyframes shimmer{from{background-position:300% 0}to{background-position:0 0}}
+
+/* ── Tagline ── */
+.tagline{position:relative;z-index:1;margin-top:24px;font-size:.75rem;color:rgba(216,180,254,.3);letter-spacing:.08em}
+</style></head><body>
+
+<!-- PS-style flowing waves -->
+<div class="waves">
+<div class="wave"></div>
+<div class="wave"></div>
+<div class="wave"></div>
+<div class="wave"></div>
+</div>
+
+<!-- Floating hearts + particles -->
+<div class="particles">
+<div class="particle heart"></div>
+<div class="particle dot"></div>
+<div class="particle heart"></div>
+<div class="particle dot"></div>
+<div class="particle heart"></div>
+<div class="particle dot"></div>
+<div class="particle heart"></div>
+<div class="particle dot"></div>
+<div class="particle heart"></div>
+<div class="particle dot"></div>
+</div>
+
+<div class="card">
+  <!-- Heart-beat loader with orbiting rings -->
+  <div class="loader">
+    <div class="loader-ring"></div>
+    <div class="loader-ring"></div>
+    <div class="heart-icon">&#x2665;</div>
+  </div>
+
+  <p class="brand">AIME AT</p>
+  <h1>We'll Be Right Back</h1>
+  <p class="msg">Making things even better for you.<br>This won't take long.</p>
+  ${message ? `<div class="reason">${esc(message)}</div>` : ''}
+
+  <div class="node-id">
+    <span class="status-dot"></span>
+    <code>${esc(nodeId)}</code>
+  </div>
+
+  <div class="progress"><div class="progress-bar"></div></div>
+  <p class="footer">Auto-refreshes every 30 seconds</p>
+</div>
+
+<p class="tagline">AI Memory Exchange &amp; Action Transfer</p>
+</body></html>`;
+}
+//# sourceMappingURL=middleware-guards.js.map

package/dist/src/server-bootstrap/middleware-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-guards.js","sourceRoot":"","sources":["../../../src/server-bootstrap/middleware-guards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACtG,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,MAAoB,EACpB,OAAgB,EAChB,gBAAiD,EACjD,wBAAoC;IAEpC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IAErC,+BAA+B;IAC/B,mEAAmE;IACnE,wFAAwF;IACxF,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAEpC,0BAA0B;QAC1B,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAE9D,gCAAgC;QAChC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,IACE,CAAC,KAAK,GAAG;YACT,CAAC,KAAK,YAAY;YAClB,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YACzB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACxB,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YAC5B,CAAC,CAAC,UAAU,CAAC,+BAA+B,CAAC;YAC7C,CAAC,CAAC,UAAU,CAAC,0BAA0B,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,EACxB,CAAC;YAAC,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAErB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,IAAI,mDAAmD,CAAC;QAE9E,gDAAgD;QAChD,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM;YACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;SAClD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,0EAA0E;IAC1E,MAAM,cAAc,GAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM;gBACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,0DAA0D,EAAE;aAC9G,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,gEAAgE;IAChE,MAAM,cAAc,GAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,yEAAyE;YACzE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,CAAC;gBAC5G,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM;gBACjE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,2DAA2D,EAAE;aAC1G,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,6DAA6D;IAC7D,IAAI,SAAS,GAAmB,IAAI,CAAC;IACrC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;IACpD,MAAM,iBAAiB,GAAG,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,sDAAsD;QACtD,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,kBAAkB;QAClB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,kDAAkD;YAClD,MAAM,gBAAgB,GAAG;gBACvB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC;gBAC5C,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC;gBACpD,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC;aAC3D,CAAC;YACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,OAAe;IAC1D,OAAO;;;;uBAIc,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoG9B,OAAO,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;;;;YAIlD,GAAG,CAAC,MAAM,CAAC;;;;;;;;eAQR,CAAC;AAChB,CAAC"}

package/dist/src/server-bootstrap/routes-loader.d.ts

@@ -0,0 +1,35 @@
+import express from 'express';
+import type { AimeatConfig } from '../config.js';
+import type { Storage, MaintenanceState } from '../storage/interface.js';
+import type { ConfigProvenance } from '../services/config-provenance.js';
+import type { ConsulConfigService } from '../services/consul-config.js';
+import type { PeerInfo } from '../services/federation.js';
+import type { DirectoryService } from '../services/directory.js';
+import type { TunnelManager } from '../services/personal-tunnel.js';
+import { RealtimeManager } from '../services/realtime-manager.js';
+import type { MailboxNotificationService } from '../services/mailbox-notification.js';
+import type { Scheduler } from '../services/scheduler.js';
+export interface MountRoutesOptions {
+    rejectForRelay: express.RequestHandler;
+    mirrorReadOnly: express.RequestHandler;
+    maintenanceState: {
+        get: () => MaintenanceState;
+        set: (state: MaintenanceState) => void;
+    };
+    provenance: ConfigProvenance;
+    consulService: ConsulConfigService | null;
+    directoryService: DirectoryService;
+    peers: Map<string, PeerInfo>;
+    tunnelManager: TunnelManager | null;
+    mailboxNotificationService: MailboxNotificationService | null;
+    scheduler: Scheduler;
+    invalidateHasOwnersCache: () => void;
+}
+export interface MountRoutesResult {
+    realtimeManager: RealtimeManager | null;
+}
+/**
+ * Mount all 40+ route handlers on the Express app.
+ */
+export declare function mountRoutes(app: express.Express, config: AimeatConfig, storage: Storage, opts: MountRoutesOptions): MountRoutesResult;
+//# sourceMappingURL=routes-loader.d.ts.map

package/dist/src/server-bootstrap/routes-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-loader.d.ts","sourceRoot":"","sources":["../../../src/server-bootstrap/routes-loader.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAyF1D,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC;IACvC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC;IACvC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,gBAAgB,CAAC;QAC5B,GAAG,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;KACxC,CAAC;IACF,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7B,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,0BAA0B,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC9D,SAAS,EAAE,SAAS,CAAC;IACrB,wBAAwB,EAAE,MAAM,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,kBAAkB,GACvB,iBAAiB,CA6OnB"}

package/dist/src/server-bootstrap/routes-loader.js

@@ -0,0 +1,290 @@
+import { RealtimeManager } from '../services/realtime-manager.js';
+import { requireAuth, requireRole } from '../auth/middleware.js';
+import { success, error } from '../middleware/envelope.js';
+import { workspaceAccessMiddleware } from '../middleware/workspace-access.js';
+import { logger } from '../utils/logger.js';
+// Routes
+import { bootstrapRouter } from '../routes/bootstrap.js';
+import { wellknownRouter } from '../routes/wellknown.js';
+import { authRouter } from '../routes/auth.js';
+import { ownersRouter } from '../routes/owners.js';
+import { agentsRouter } from '../routes/agents.js';
+import { schemaRouter } from '../routes/schemas.js';
+import { consentRouter } from '../routes/consent.js';
+import { permissionsRouter } from '../routes/permissions.js';
+import { memoryRouter } from '../routes/memory.js';
+import { actionsRouter } from '../routes/actions.js';
+import { catalogueRouter } from '../routes/catalogue.js';
+import { workRouter } from '../routes/work.js';
+import { walletRouter } from '../routes/wallet.js';
+import { boardsRouter } from '../routes/boards.js';
+import { promptsRouter } from '../routes/prompts.js';
+import { adminRouter } from '../routes/admin.js';
+import { federationRouter } from '../routes/federation.js';
+import { organismsRouter } from '../routes/organisms.js';
+import { specRouter } from '../routes/spec.js';
+import { disputesRouter } from '../routes/disputes.js';
+import { microMemoryRouter } from '../routes/micro-memory.js';
+import { storageFilesRouter } from '../routes/storage-files.js';
+import { validateRouter } from '../routes/validate.js';
+import { mcpRouter } from '../mcp/index.js';
+import { portalRouter } from '../routes/portal.js';
+import { portfolioRouter } from '../routes/portfolio.js';
+import { portalApiRouter } from '../routes/portal-api.js';
+import { csmRouter } from '../routes/csm.js';
+import { msmRouter } from '../routes/msm.js';
+import { ghiiRouter } from '../routes/ghii.js';
+import { chatInstancesRouter } from '../routes/chat-instances.js';
+import { totpRouter } from '../routes/totp.js';
+import { libsRouter } from '../routes/libs.js';
+import { appsRouter } from '../routes/apps.js';
+import { appStoreRouter } from '../routes/app-store.js';
+import { flagsRouter } from '../routes/flags.js';
+import { appealsRouter } from '../routes/appeals.js';
+import { matchesRouter } from '../routes/matches.js';
+import { personalRouter } from '../routes/personal.js';
+import { pushRouter } from '../routes/push.js';
+import { verificationRouter } from '../routes/verification.js';
+import { knowledgeRouter } from '../routes/knowledge.js';
+import { siteRouter } from '../routes/site.js';
+import { realtimeRouter } from '../routes/realtime.js';
+import { sseRouter } from '../routes/sse.js';
+import { adminFeaturesRouter } from '../routes/admin-features.js';
+import { setupRouter } from '../routes/setup.js';
+import { extensionsRouter } from '../routes/extensions.js';
+import { cortexRouter } from '../routes/cortex.js';
+import { packagesRouter } from '../routes/packages.js';
+import { instancesRouter } from '../routes/instances.js';
+import { templatesRouter } from '../routes/templates.js';
+import { adminSchedulerRouter } from '../routes/admin-scheduler.js';
+import { adminExtensionsRouter } from '../routes/admin-extensions.js';
+import { adminPromptsRouter } from '../routes/admin-prompts.js';
+import { statsRouter } from '../routes/stats.js';
+import { generatorRouter } from '../routes/generator.js';
+import { generatorAutopilotRouter } from '../routes/generator-autopilot.js';
+import { foundryRouter } from '../routes/foundry.js';
+import { calibratorRouter } from '../routes/calibrator.js';
+import { openrouterRouter } from '../routes/openrouter.js';
+// Services needed during route mounting
+import { createPushService } from '../services/push.js';
+import { createEudiwService } from '../services/eudiw.js';
+import { createVcIssuerService } from '../services/vc-issuer.js';
+import { createMyDataReceiptService } from '../services/mydata-receipt.js';
+import { createEmailService } from '../services/email.js';
+import { SiteService } from '../services/site.js';
+import { startSiteSyncJob, triggerSiteSync } from '../services/site-sync.js';
+import { startMatchNotificationJob } from '../services/match-notification.js';
+import { createMatchingEngine, startMatchingScheduler } from '../services/matching.js';
+import { createGenesisPeeringService } from '../services/genesis-peering.js';
+import { createGenesisSyncService } from '../services/genesis-sync.js';
+import { startCacheCleanupJob } from '../services/cache-cleanup.js';
+import { startSyncScheduler } from '../services/sync-scheduler.js';
+import { initStats } from '../services/stats.js';
+import { createMetricsRegistry } from '../services/prometheus.js';
+import { seedCoreScheduledJobs } from '../services/job-seeding.js';
+/**
+ * Mount all 40+ route handlers on the Express app.
+ */
+export function mountRoutes(app, config, storage, opts) {
+    const { rejectForRelay, mirrorReadOnly, maintenanceState, provenance, consulService, directoryService, peers, tunnelManager, mailboxNotificationService, scheduler, invalidateHasOwnersCache, } = opts;
+    // Statistics collector
+    const stats = initStats();
+    // Prometheus metrics registry (opt-in)
+    const metricsRegistry = config.metricsEnabled
+        ? createMetricsRegistry(config)
+        : undefined;
+    // Mount routes
+    app.use(setupRouter(config, storage, invalidateHasOwnersCache));
+    app.use(bootstrapRouter(config, storage, tunnelManager ?? undefined));
+    app.use(statsRouter(config, storage, stats, metricsRegistry));
+    app.use(wellknownRouter(config, storage));
+    // IndexNow key verification file (serves /{key}.txt for Bing/Yandex)
+    if (config.indexNowKey) {
+        app.get(`/${config.indexNowKey}.txt`, (_req, res) => {
+            res.type('text/plain').send(config.indexNowKey);
+        });
+    }
+    app.use(authRouter(config, storage));
+    app.use(sseRouter(config, storage));
+    // Relay nodes skip agent-hosting routes entirely
+    app.use('/v1/owners', rejectForRelay);
+    app.use('/v1/agents', rejectForRelay);
+    app.use('/v1/memory', rejectForRelay);
+    app.use('/v1/work', rejectForRelay);
+    app.use('/v1/wallet', rejectForRelay);
+    app.use('/v1/boards', rejectForRelay);
+    app.use('/v1/disputes', rejectForRelay);
+    app.use('/v1/micro-memory', rejectForRelay);
+    app.use('/v1/storage', rejectForRelay);
+    // Mirror nodes block writes (except federation replication)
+    app.use(mirrorReadOnly);
+    app.use(ownersRouter(config, storage));
+    app.use(agentsRouter(config, storage));
+    const notifyDirectoryChange = () => directoryService.notifyChange();
+    app.use(consentRouter(config, storage, stats, notifyDirectoryChange)); // Phase 0.3
+    app.use(permissionsRouter(config, storage)); // Phase 0.3 — permission listing API
+    app.use(schemaRouter(config, storage)); // MUST be before memoryRouter (Phase 0.1)
+    app.use('/v1/memory', workspaceAccessMiddleware(config, storage)); // Phase 2.3 — organism workspace access
+    app.use(memoryRouter(config, storage, stats, notifyDirectoryChange, peers));
+    if (config.generatorEnabled) {
+        app.use(generatorRouter(config, storage)); // Agent-driven service generator
+        app.use(generatorAutopilotRouter(config, storage)); // Backend autopilot for generator
+    }
+    if (config.foundryEnabled) {
+        app.use(foundryRouter(config, storage)); // Prompt-driven service builder
+    }
+    if (config.calibratorEnabled) {
+        app.use(calibratorRouter(config, storage)); // Prompt calibration tool
+    }
+    app.use(openrouterRouter(config, storage)); // OpenRouter AI autopilot
+    app.use(csmRouter(config, storage)); // Phase 0.2 — CSM management
+    app.use(msmRouter(config, storage)); // MSM — Machine Service Manifest
+    app.use(actionsRouter(config, storage));
+    app.use(catalogueRouter(config, storage, directoryService, () => {
+        // realtimeManager may be initialized later; use closure to capture the reference
+        return null;
+    }));
+    app.use(workRouter(config, storage, peers, mailboxNotificationService));
+    app.use(walletRouter(config, storage));
+    app.use(knowledgeRouter(config, storage));
+    // Extended features guard — returns 503 when extended features are disabled
+    const requireExtended = (_req, res, next) => {
+        if (!config.extendedFeaturesEnabled) {
+            res.status(503).json({
+                ok: false, protocol: 'aimeat', version: 'v1', node: config.nodeId,
+                timestamp: new Date().toISOString(),
+                error: { code: 'FEATURE_DISABLED', message: 'Extended features are disabled on this node' },
+            });
+            return;
+        }
+        next();
+    };
+    app.use('/v1/boards', requireExtended);
+    app.use('/v1/federation', (req, res, next) => {
+        // Allow unauthenticated introduce endpoints (federation join flow)
+        if (req.path.startsWith('/peer/introduce'))
+            return next();
+        // Allow public directory and heartbeat/ping
+        if (req.path === '/directory' || req.path === '/ping' || req.path === '/heartbeat')
+            return next();
+        return requireExtended(req, res, next);
+    });
+    app.use('/v1/storage', requireExtended);
+    app.use('/v1/validate', requireExtended);
+    app.use(boardsRouter(config, storage));
+    app.use(promptsRouter(config, storage));
+    app.use(adminRouter(config, storage, maintenanceState, provenance, consulService));
+    app.use(organismsRouter(config, storage));
+    app.use(federationRouter(config, storage, peers));
+    app.use(disputesRouter(config, storage));
+    app.use(flagsRouter(config, storage));
+    app.use(appealsRouter(config, storage));
+    app.use(matchesRouter(config, storage));
+    app.use(microMemoryRouter(config, storage));
+    app.use(storageFilesRouter(config, storage));
+    app.use(validateRouter(config));
+    app.use(mcpRouter(config, storage));
+    const siteService = new SiteService(config, storage);
+    app.use(siteRouter(config, storage, siteService)); // Node Portal — GET / + /v1/site/*
+    // Site LB sync — manual trigger endpoint + background job
+    if (config.siteLbEnabled && config.siteLbOriginUrl) {
+        app.post('/v1/admin/site/sync', requireAuth(), requireRole('operator'), async (_req, res) => {
+            try {
+                const result = await triggerSiteSync(config, storage, siteService);
+                res.json(success(config.nodeId, { synced: true, template_updated: result.templateUpdated, memory_keys_synced: result.memoryKeysSynced }));
+            }
+            catch (err) {
+                res.status(502).json(error(config.nodeId, 'SYNC_FAILED', err instanceof Error ? err.message : 'Sync failed'));
+            }
+        });
+        startSiteSyncJob(config, storage, siteService);
+    }
+    if (config.portfolioEnabled) {
+        app.use(portfolioRouter(config, storage));
+    }
+    app.use(portalRouter(config, storage));
+    app.use(portalApiRouter(config, storage));
+    // Phase 1.1 — Email service for verification and magic links
+    const emailService = createEmailService(config);
+    // Push notification service — Phase 3.1
+    const pushService = createPushService(config, storage);
+    app.use(pushRouter(config, storage, pushService));
+    // EUDIW / VC / MyData services — Phase 3.3
+    const eudiwService = createEudiwService(config, storage);
+    const vcIssuerService = createVcIssuerService(config);
+    const mydataReceiptService = createMyDataReceiptService(config);
+    app.use(verificationRouter(config, storage, eudiwService, vcIssuerService, mydataReceiptService));
+    // Match notification job — Phase 1.6
+    startMatchNotificationJob(config, storage, emailService, directoryService);
+    // AI Matching — Phase 2.1
+    const matchingEngine = createMatchingEngine(config, storage, directoryService, emailService);
+    startMatchingScheduler(config, matchingEngine);
+    // Genesis peering service — Phase 3.4
+    const genesisPeeringService = createGenesisPeeringService(config, storage);
+    // Admin features — Phase 1-3 dashboard endpoints
+    app.use(adminFeaturesRouter(config, storage, {
+        emailService,
+        directoryService,
+        matchingEngine,
+        pushService,
+        genesisPeeringService,
+    }));
+    app.use(totpRouter(config, storage)); // Phase 0.5 — MUST be before ghiiRouter (TOTP routes use /v1/ghii/totp/*)
+    app.use(ghiiRouter(config, storage, emailService, notifyDirectoryChange));
+    app.use(chatInstancesRouter(config, storage));
+    app.use(libsRouter(config, storage));
+    app.use(appsRouter(config, storage, peers));
+    app.use(appStoreRouter(config, storage));
+    // Node Extensions (Sandboxed)
+    if (config.extensionsEnabled) {
+        app.use(extensionsRouter(config, storage, scheduler, emailService));
+        logger.info('Extension system enabled');
+    }
+    // Cortex Extensions (Manifest-based)
+    if (config.cortexEnabled) {
+        app.use(cortexRouter(config, storage));
+        logger.info('Cortex extension system enabled');
+    }
+    // Packages, Instances & Templates
+    if (config.packagesEnabled) {
+        app.use(packagesRouter(config, storage));
+        app.use(instancesRouter(config, storage));
+    }
+    if (config.packagesEnabled && config.templatesEnabled) {
+        app.use(templatesRouter(config, storage));
+    }
+    // Scheduler admin routes
+    app.use(adminSchedulerRouter(config, storage, scheduler));
+    // Bundled extensions admin routes
+    app.use(adminExtensionsRouter(config, storage, scheduler));
+    // System prompts admin routes
+    app.use(adminPromptsRouter(config, storage));
+    // Seed core scheduled jobs (idempotent — only creates if not already present)
+    seedCoreScheduledJobs(config, storage).catch(err => logger.error('Failed to seed core scheduled jobs', { error: String(err) }));
+    // Start the scheduler (loads enabled jobs from storage)
+    scheduler.start().catch(err => logger.error('Scheduler start failed', { error: String(err) }));
+    // Genesis Sync Scheduler (Phase 3.4)
+    const genesisSyncService = createGenesisSyncService(config, storage);
+    if (genesisSyncService) {
+        genesisSyncService.start();
+    }
+    // Cache Cleanup Scheduler (G.1) — prunes expired federated/replica/genesis memory entries hourly
+    startCacheCleanupJob(config, storage);
+    // Sync Scheduler (B.4) — coordinates catalogue sync + memory replication based on syncMode
+    startSyncScheduler(config, storage, peers);
+    app.use(specRouter());
+    // Personal node management routes
+    if (config.personalNodesEnabled) {
+        app.use(personalRouter(config, storage, tunnelManager, mailboxNotificationService));
+    }
+    // Realtime P2P rooms — Phase 0
+    let realtimeManager = null;
+    if (config.realtimeEnabled) {
+        realtimeManager = new RealtimeManager(config, storage);
+        app.use(realtimeRouter(config, storage, realtimeManager, peers));
+        realtimeManager.startCleanupJob();
+        logger.info('Realtime P2P rooms enabled', { maxRooms: config.realtimeMaxRooms });
+    }
+    return { realtimeManager };
+}
+//# sourceMappingURL=routes-loader.js.map