aimeat 1.2.0

package/dist/src/services/organism-reputation.js

@@ -0,0 +1,107 @@
+// Phase 3.4 — Organism Reputation Calculation Service
+import { logger } from '../utils/logger.js';
+// ── Weights ─────────────────────────────────────────────────────────
+const WEIGHT_MEMBERS = 0.20;
+const WEIGHT_ACTIVITY = 0.25;
+const WEIGHT_TRUST = 0.25;
+const WEIGHT_AGE = 0.15;
+const WEIGHT_FLAGS = 0.15;
+// ── Normalization constants ─────────────────────────────────────────
+const MAX_MEMBERS_REFERENCE = 1000; // log10(members) / log10(1000)
+const ACTIVITY_CAP_PER_WEEK = 50; // 50 posts/week = 1.0
+const AGE_MATURITY_DAYS = 365; // 1 year = fully mature
+export function createOrganismReputationService(_config, storage) {
+    async function calculateReputation(organismId) {
+        // 1. Load organism
+        const organism = await storage.getOrganism(organismId);
+        if (!organism) {
+            logger.warn('organism-reputation: organism not found', { organismId });
+            return null;
+        }
+        // 2. Get active members
+        const members = await storage.listMembers(organismId, { status: 'active' });
+        const memberCount = members.length;
+        // ── Member count score ──────────────────────────────────────────
+        // log10(members) / log10(max_members), clamped to [0, 1]
+        const memberScore = memberCount > 0
+            ? Math.min(Math.log10(memberCount) / Math.log10(MAX_MEMBERS_REFERENCE), 1.0)
+            : 0;
+        // ── Activity score ──────────────────────────────────────────────
+        // Use organism's board to count recent posts. If the board lookup
+        // is not viable, fall back to a member-count proxy.
+        let activityScore = 0;
+        try {
+            const board = await storage.getBoard(organism.boardId);
+            if (board) {
+                const posts = await storage.listPosts(board.id, {});
+                // Count posts from the last 28 days (4 weeks)
+                const fourWeeksAgo = Date.now() - 28 * 24 * 60 * 60 * 1000;
+                const recentPosts = posts.filter(p => new Date(p.createdAt).getTime() >= fourWeeksAgo);
+                const postsPerWeek = recentPosts.length / 4;
+                activityScore = Math.min(postsPerWeek / ACTIVITY_CAP_PER_WEEK, 1.0);
+            }
+        }
+        catch {
+            // Fallback: use member count as a rough proxy for activity
+            activityScore = Math.min(memberCount / 100, 1.0);
+            logger.debug('organism-reputation: board activity lookup failed, using member proxy', { organismId });
+        }
+        // ── Member trust average ────────────────────────────────────────
+        // Look up each member's GHII record for trustScore (0-100)
+        let trustScoreAvg = 0;
+        if (memberCount > 0) {
+            let totalTrust = 0;
+            let counted = 0;
+            for (const member of members) {
+                const ghiiRecord = await storage.getGHII(member.ghii);
+                if (ghiiRecord && typeof ghiiRecord.trustScore === 'number') {
+                    totalTrust += ghiiRecord.trustScore;
+                    counted++;
+                }
+            }
+            // Normalize to 0-1 (trustScore is 0-100)
+            trustScoreAvg = counted > 0 ? (totalTrust / counted) / 100 : 0;
+        }
+        // ── Age score ───────────────────────────────────────────────────
+        // min(age_days / 365, 1.0)
+        const ageDays = (Date.now() - new Date(organism.createdAt).getTime()) / (24 * 60 * 60 * 1000);
+        const ageScore = Math.min(ageDays / AGE_MATURITY_DAYS, 1.0);
+        // ── Flag history score ──────────────────────────────────────────
+        // max(1.0 - (total_flags / (members * 0.1)), 0)
+        // We don't track organism-level flags separately yet, so total_flags = 0
+        const totalFlags = 0;
+        const flagDenominator = memberCount * 0.1;
+        const flagScore = flagDenominator > 0
+            ? Math.max(1.0 - (totalFlags / flagDenominator), 0)
+            : 1.0; // No members = no flag penalty
+        // ── Final weighted score (0-100) ────────────────────────────────
+        const rawScore = (memberScore * WEIGHT_MEMBERS +
+            activityScore * WEIGHT_ACTIVITY +
+            trustScoreAvg * WEIGHT_TRUST +
+            ageScore * WEIGHT_AGE +
+            flagScore * WEIGHT_FLAGS) * 100;
+        const score = Math.max(0, Math.min(100, Math.round(rawScore * 100) / 100));
+        const record = {
+            organismId,
+            score,
+            breakdown: {
+                memberScore: Math.round(memberScore * 10000) / 10000,
+                activityScore: Math.round(activityScore * 10000) / 10000,
+                trustScore: Math.round(trustScoreAvg * 10000) / 10000,
+                ageScore: Math.round(ageScore * 10000) / 10000,
+                flagScore: Math.round(flagScore * 10000) / 10000,
+            },
+            calculatedAt: new Date().toISOString(),
+        };
+        // Persist
+        await storage.setOrganismReputation(record);
+        logger.info('organism-reputation: calculated', {
+            organismId,
+            score,
+            members: memberCount,
+        });
+        return record;
+    }
+    return { calculateReputation };
+}
+//# sourceMappingURL=organism-reputation.js.map

package/dist/src/services/organism-reputation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organism-reputation.js","sourceRoot":"","sources":["../../../src/services/organism-reputation.ts"],"names":[],"mappings":"AAAA,sDAAsD;AAItD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,uEAAuE;AACvE,MAAM,cAAc,GAAI,IAAI,CAAC;AAC7B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAM,IAAI,CAAC;AAC7B,MAAM,UAAU,GAAQ,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAM,IAAI,CAAC;AAE7B,uEAAuE;AACvE,MAAM,qBAAqB,GAAI,IAAI,CAAC,CAAG,+BAA+B;AACtE,MAAM,qBAAqB,GAAI,EAAE,CAAC,CAAK,sBAAsB;AAC7D,MAAM,iBAAiB,GAAQ,GAAG,CAAC,CAAI,wBAAwB;AAM/D,MAAM,UAAU,+BAA+B,CAC7C,OAAqB,EACrB,OAAgB;IAGhB,KAAK,UAAU,mBAAmB,CAAC,UAAkB;QACnD,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;QAEnC,mEAAmE;QACnE,yDAAyD;QACzD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,GAAG,CAAC;YAC5E,CAAC,CAAC,CAAC,CAAC;QAEN,mEAAmE;QACnE,kEAAkE;QAClE,oDAAoD;QACpD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpD,8CAA8C;gBAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,CAAC;gBACvF,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC5C,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,qBAAqB,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,uEAAuE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,mEAAmE;QACnE,2DAA2D;QAC3D,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtD,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;oBAC5D,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC;oBACpC,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,yCAAyC;YACzC,aAAa,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,mEAAmE;QACnE,2BAA2B;QAC3B,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAE5D,mEAAmE;QACnE,gDAAgD;QAChD,yEAAyE;QACzE,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,eAAe,GAAG,WAAW,GAAG,GAAG,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,GAAG,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,CAAE,+BAA+B;QAEzC,mEAAmE;QACnE,MAAM,QAAQ,GACZ,CAAC,WAAW,GAAI,cAAc;YAC7B,aAAa,GAAG,eAAe;YAC/B,aAAa,GAAG,YAAY;YAC5B,QAAQ,GAAQ,UAAU;YAC1B,SAAS,GAAO,YAAY,CAAC,GAAG,GAAG,CAAC;QAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAE3E,MAAM,MAAM,GAA6B;YACvC,UAAU;YACV,KAAK;YACL,SAAS,EAAE;gBACT,WAAW,EAAI,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,KAAK;gBACtD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,GAAG,KAAK;gBACxD,UAAU,EAAK,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,GAAG,KAAK;gBACxD,QAAQ,EAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK;gBACnD,SAAS,EAAM,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,KAAK;aACrD;YACD,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QAEF,UAAU;QACV,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC7C,UAAU;YACV,KAAK;YACL,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,mBAAmB,EAAE,CAAC;AACjC,CAAC"}

package/dist/src/services/package-hash.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @file package-hash.ts
+ * @description Utility for computing SHA-256 content hashes of AIMEAT components.
+ *   Used by the package system to detect user customizations after installation.
+ * @structure
+ *   - computeHash(content: string) — SHA-256 hex hash of content string
+ * @usage
+ *   import { computeHash } from '../services/package-hash.js';
+ *   const hash = computeHash(componentContent);
+ * @version-history
+ *   v1.0.0 — 2026-03-15 — initial implementation (Phase 3)
+ */
+/**
+ * Compute a SHA-256 hex digest of the given content string.
+ * Used for change detection: comparing originalHash at install time
+ * against current content to detect user customizations.
+ */
+export declare function computeHash(content: string): string;
+//# sourceMappingURL=package-hash.d.ts.map

package/dist/src/services/package-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-hash.d.ts","sourceRoot":"","sources":["../../../src/services/package-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/src/services/package-hash.js

@@ -0,0 +1,22 @@
+/**
+ * @file package-hash.ts
+ * @description Utility for computing SHA-256 content hashes of AIMEAT components.
+ *   Used by the package system to detect user customizations after installation.
+ * @structure
+ *   - computeHash(content: string) — SHA-256 hex hash of content string
+ * @usage
+ *   import { computeHash } from '../services/package-hash.js';
+ *   const hash = computeHash(componentContent);
+ * @version-history
+ *   v1.0.0 — 2026-03-15 — initial implementation (Phase 3)
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Compute a SHA-256 hex digest of the given content string.
+ * Used for change detection: comparing originalHash at install time
+ * against current content to detect user customizations.
+ */
+export function computeHash(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+//# sourceMappingURL=package-hash.js.map

package/dist/src/services/package-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-hash.js","sourceRoot":"","sources":["../../../src/services/package-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC"}

package/dist/src/services/package-zip.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @file package-zip.ts
+ * @description ZIP serialization/deserialization service for AIMEAT packages.
+ *   Converts PackageRecord objects to ZIP buffers (buildZip) and validates/extracts
+ *   ZIP buffers back into ParsedPackage objects (parseZip) with a multi-layer
+ *   security validation chain (magic bytes, size limits, zip bomb detection,
+ *   path traversal prevention, manifest validation).
+ * @structure
+ *   - ZipValidationError — typed error class with code field
+ *   - ZipOptions — configuration for parseZip limits
+ *   - ParsedComponent / ParsedPackage — output types from parseZip
+ *   - buildZip(pkg) — PackageRecord → ZIP Buffer
+ *   - parseZip(buffer, options) — ZIP Buffer → ParsedPackage (with validation)
+ * @version-history
+ *   v1.0.0 — 2026-03-20 — Initial implementation
+ */
+import type { PackageRecord } from '../storage/interface.js';
+export type ZipErrorCode = 'INVALID_FORMAT' | 'SIZE_EXCEEDED' | 'DECOMPRESSION_BOMB' | 'PATH_TRAVERSAL' | 'MISSING_MANIFEST' | 'INVALID_MANIFEST' | 'MISSING_COMPONENT';
+export declare class ZipValidationError extends Error {
+    readonly code: ZipErrorCode;
+    constructor(code: ZipErrorCode, message: string);
+}
+export interface ZipOptions {
+    maxSizeMb: number;
+    maxFiles?: number;
+    maxDepth?: number;
+    maxFileSizeMb?: number;
+    decompressionRatio?: number;
+}
+export interface ParsedComponent {
+    id: string;
+    type: string;
+    label: string;
+    content: string;
+    contentHash: string;
+    dependencies: string[];
+}
+export interface ParsedPackage {
+    name: string;
+    author: string;
+    authorGhii?: string;
+    version: string;
+    description: string;
+    category: string;
+    tags: string[];
+    blueprint?: Record<string, unknown>;
+    changelog?: string;
+    components: ParsedComponent[];
+}
+/**
+ * Convert a PackageRecord into a ZIP buffer containing manifest.yaml
+ * and all component files under components/.
+ */
+export declare function buildZip(pkg: PackageRecord): Promise<Buffer>;
+/**
+ * Validate and extract a ZIP buffer into a ParsedPackage.
+ * Applies a multi-layer security validation chain in order.
+ */
+export declare function parseZip(buffer: Buffer, options: ZipOptions): Promise<ParsedPackage>;
+//# sourceMappingURL=package-zip.d.ts.map

package/dist/src/services/package-zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-zip.d.ts","sourceRoot":"","sources":["../../../src/services/package-zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,yBAAyB,CAAC;AAMnF,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,IAAI,EAAE,YAAY,CAAC;gBACvB,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM;CAKhD;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAsBD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAwClE;AAuGD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAwG1F"}

package/dist/src/services/package-zip.js

@@ -0,0 +1,267 @@
+/**
+ * @file package-zip.ts
+ * @description ZIP serialization/deserialization service for AIMEAT packages.
+ *   Converts PackageRecord objects to ZIP buffers (buildZip) and validates/extracts
+ *   ZIP buffers back into ParsedPackage objects (parseZip) with a multi-layer
+ *   security validation chain (magic bytes, size limits, zip bomb detection,
+ *   path traversal prevention, manifest validation).
+ * @structure
+ *   - ZipValidationError — typed error class with code field
+ *   - ZipOptions — configuration for parseZip limits
+ *   - ParsedComponent / ParsedPackage — output types from parseZip
+ *   - buildZip(pkg) — PackageRecord → ZIP Buffer
+ *   - parseZip(buffer, options) — ZIP Buffer → ParsedPackage (with validation)
+ * @version-history
+ *   v1.0.0 — 2026-03-20 — Initial implementation
+ */
+import { createHash } from 'node:crypto';
+import archiver from 'archiver';
+import yauzl from 'yauzl';
+import YAML from 'yaml';
+export class ZipValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ZipValidationError';
+        this.code = code;
+    }
+}
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const COMPONENT_EXTENSIONS = {
+    csm: '.yaml',
+    extension: '.yaml',
+    cortex: '.yaml',
+    app: '.html',
+    msm: '.yaml',
+    memory: '.json',
+    translation: '.json',
+};
+const ZIP_MAGIC = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+// ---------------------------------------------------------------------------
+// buildZip
+// ---------------------------------------------------------------------------
+/**
+ * Convert a PackageRecord into a ZIP buffer containing manifest.yaml
+ * and all component files under components/.
+ */
+export async function buildZip(pkg) {
+    return new Promise((resolve, reject) => {
+        const archive = archiver('zip', { zlib: { level: 6 } });
+        const chunks = [];
+        archive.on('data', (chunk) => chunks.push(chunk));
+        archive.on('end', () => resolve(Buffer.concat(chunks)));
+        archive.on('error', reject);
+        // Build manifest object
+        const manifest = {
+            'aimeat-package': '1.0',
+            name: pkg.name,
+            author: pkg.author,
+            authorGhii: pkg.authorGhii,
+            version: pkg.version,
+            description: pkg.description,
+            category: pkg.category,
+            tags: pkg.tags,
+            components: pkg.components.map(c => ({
+                id: c.id,
+                type: c.type,
+                label: c.label,
+                file: `components/${c.id}${COMPONENT_EXTENSIONS[c.type]}`,
+                dependencies: c.dependencies,
+            })),
+            changelog: pkg.changelog,
+        };
+        // Append manifest.yaml
+        archive.append(YAML.stringify(manifest), { name: 'manifest.yaml' });
+        // Append each component file
+        for (const comp of pkg.components) {
+            const ext = COMPONENT_EXTENSIONS[comp.type];
+            archive.append(comp.content, { name: `components/${comp.id}${ext}` });
+        }
+        archive.finalize();
+    });
+}
+// ---------------------------------------------------------------------------
+// parseZip — internal helpers
+// ---------------------------------------------------------------------------
+/** Read all entries from a yauzl zipfile into a map of filename → Buffer. */
+function readAllEntries(zipfile, opts, zipSize) {
+    return new Promise((resolve, reject) => {
+        const files = new Map();
+        let totalDecompressed = 0;
+        const maxDecompressed = zipSize * opts.decompressionRatio;
+        let fileCount = 0;
+        zipfile.on('error', reject);
+        zipfile.on('entry', (entry) => {
+            fileCount++;
+            // Max files
+            if (fileCount > opts.maxFiles) {
+                zipfile.close();
+                return reject(new ZipValidationError('DECOMPRESSION_BOMB', `ZIP contains more than ${opts.maxFiles} files`));
+            }
+            const fileName = entry.fileName;
+            // Path traversal checks
+            if (fileName.includes('../') || fileName.startsWith('/')) {
+                zipfile.close();
+                return reject(new ZipValidationError('PATH_TRAVERSAL', `Dangerous path detected: ${fileName}`));
+            }
+            // Symlink check (Unix external attributes, upper 16 bits)
+            const externalAttrs = entry.externalFileAttributes;
+            const unixMode = (externalAttrs >> 16) & 0xffff;
+            if ((unixMode & 0o170000) === 0o120000) {
+                zipfile.close();
+                return reject(new ZipValidationError('PATH_TRAVERSAL', `Symlink detected: ${fileName}`));
+            }
+            // Directory depth
+            const depth = fileName.split('/').length - 1;
+            if (depth > opts.maxDepth) {
+                zipfile.close();
+                return reject(new ZipValidationError('DECOMPRESSION_BOMB', `Directory depth exceeds ${opts.maxDepth}: ${fileName}`));
+            }
+            // Skip directories
+            if (fileName.endsWith('/')) {
+                zipfile.readEntry();
+                return;
+            }
+            // Individual file size check (uncompressed)
+            const maxFileBytes = opts.maxFileSizeMb * 1024 * 1024;
+            if (entry.uncompressedSize > maxFileBytes) {
+                zipfile.close();
+                return reject(new ZipValidationError('DECOMPRESSION_BOMB', `File ${fileName} exceeds ${opts.maxFileSizeMb} MB`));
+            }
+            zipfile.openReadStream(entry, (err, stream) => {
+                if (err) {
+                    zipfile.close();
+                    return reject(err);
+                }
+                const chunks = [];
+                stream.on('data', (chunk) => {
+                    totalDecompressed += chunk.length;
+                    if (totalDecompressed > maxDecompressed) {
+                        zipfile.close();
+                        return reject(new ZipValidationError('DECOMPRESSION_BOMB', 'Decompression ratio exceeded'));
+                    }
+                    chunks.push(chunk);
+                });
+                stream.on('end', () => {
+                    files.set(fileName, Buffer.concat(chunks));
+                    zipfile.readEntry();
+                });
+                stream.on('error', (e) => { zipfile.close(); reject(e); });
+            });
+        });
+        zipfile.on('end', () => resolve(files));
+        zipfile.readEntry();
+    });
+}
+/** Open a buffer with yauzl (promisified). */
+function openZipBuffer(buffer) {
+    return new Promise((resolve, reject) => {
+        yauzl.fromBuffer(buffer, { lazyEntries: true }, (err, zipfile) => {
+            if (err)
+                return reject(err);
+            resolve(zipfile);
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// parseZip
+// ---------------------------------------------------------------------------
+/**
+ * Validate and extract a ZIP buffer into a ParsedPackage.
+ * Applies a multi-layer security validation chain in order.
+ */
+export async function parseZip(buffer, options) {
+    // 1. Magic bytes
+    if (buffer.length < 4 || !buffer.subarray(0, 4).equals(ZIP_MAGIC)) {
+        throw new ZipValidationError('INVALID_FORMAT', 'Buffer does not start with ZIP magic bytes (PK\\x03\\x04)');
+    }
+    // 2. ZIP size
+    const maxBytes = options.maxSizeMb * 1024 * 1024;
+    if (buffer.length > maxBytes) {
+        throw new ZipValidationError('SIZE_EXCEEDED', `ZIP size ${buffer.length} exceeds limit of ${maxBytes} bytes`);
+    }
+    // 3. Open and read entries with bomb protection + path traversal checks
+    const opts = {
+        maxFiles: options.maxFiles ?? 200,
+        maxDepth: options.maxDepth ?? 5,
+        maxFileSizeMb: options.maxFileSizeMb ?? 20,
+        decompressionRatio: options.decompressionRatio ?? 10,
+    };
+    let zipfile;
+    try {
+        zipfile = await openZipBuffer(buffer);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('relative path') || msg.includes('absolute path')) {
+            throw new ZipValidationError('PATH_TRAVERSAL', msg);
+        }
+        throw new ZipValidationError('INVALID_FORMAT', `Failed to open ZIP: ${msg}`);
+    }
+    let files;
+    try {
+        files = await readAllEntries(zipfile, opts, buffer.length);
+    }
+    catch (err) {
+        if (err instanceof ZipValidationError)
+            throw err;
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes('relative path') || msg.includes('absolute path')) {
+            throw new ZipValidationError('PATH_TRAVERSAL', msg);
+        }
+        throw err;
+    }
+    // 5. Manifest presence
+    const manifestBuf = files.get('manifest.yaml');
+    if (!manifestBuf) {
+        throw new ZipValidationError('MISSING_MANIFEST', 'ZIP does not contain manifest.yaml at root');
+    }
+    // 6. Manifest validation
+    let manifest;
+    try {
+        manifest = YAML.parse(manifestBuf.toString('utf-8'));
+    }
+    catch {
+        throw new ZipValidationError('INVALID_MANIFEST', 'manifest.yaml is not valid YAML');
+    }
+    const requiredFields = ['name', 'author', 'version', 'description', 'category'];
+    for (const field of requiredFields) {
+        if (!manifest[field]) {
+            throw new ZipValidationError('INVALID_MANIFEST', `manifest.yaml missing required field: ${field}`);
+        }
+    }
+    // 7. Component files exist + 8. Compute contentHash
+    const manifestComponents = (manifest.components ?? []);
+    const components = [];
+    for (const mc of manifestComponents) {
+        const fileBuf = files.get(mc.file);
+        if (!fileBuf) {
+            throw new ZipValidationError('MISSING_COMPONENT', `Component file not found in ZIP: ${mc.file}`);
+        }
+        const content = fileBuf.toString('utf-8');
+        const contentHash = createHash('sha256').update(content).digest('hex');
+        components.push({
+            id: mc.id,
+            type: mc.type,
+            label: mc.label,
+            content,
+            contentHash,
+            dependencies: mc.dependencies ?? [],
+        });
+    }
+    return {
+        name: manifest.name,
+        author: manifest.author,
+        authorGhii: manifest.authorGhii,
+        version: manifest.version,
+        description: manifest.description,
+        category: manifest.category,
+        tags: manifest.tags ?? [],
+        blueprint: manifest.blueprint,
+        changelog: manifest.changelog,
+        components,
+    };
+}
+//# sourceMappingURL=package-zip.js.map

package/dist/src/services/package-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-zip.js","sourceRoot":"","sources":["../../../src/services/package-zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AAgBxB,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3B,IAAI,CAAe;IACnC,YAAY,IAAkB,EAAE,OAAe;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAgCD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,oBAAoB,GAAyC;IACjE,GAAG,EAAE,OAAO;IACZ,SAAS,EAAE,OAAO;IAClB,MAAM,EAAE,OAAO;IACf,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,OAAO;IACf,WAAW,EAAE,OAAO;CACrB,CAAC;AAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAExD,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAkB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE5B,wBAAwB;QACxB,MAAM,QAAQ,GAA4B;YACxC,gBAAgB,EAAE,KAAK;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;gBACzD,YAAY,EAAE,CAAC,CAAC,YAAY;aAC7B,CAAC,CAAC;YACH,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QAEF,uBAAuB;QACvB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAEpE,6BAA6B;QAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,6EAA6E;AAC7E,SAAS,cAAc,CACrB,OAAsB,EACtB,IAAkG,EAClG,OAAe;IAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,MAAM,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE5B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAkB,EAAE,EAAE;YACzC,SAAS,EAAE,CAAC;YAEZ,YAAY;YACZ,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,0BAA0B,IAAI,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC;YAC/G,CAAC;YAED,MAAM,QAAQ,GAAW,KAAK,CAAC,QAAQ,CAAC;YAExC,wBAAwB;YACxB,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,4BAA4B,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClG,CAAC;YAED,0DAA0D;YAC1D,MAAM,aAAa,GAAG,KAAK,CAAC,sBAAsB,CAAC;YACnD,MAAM,QAAQ,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC;YAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC3F,CAAC;YAED,kBAAkB;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7C,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,2BAA2B,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvH,CAAC;YAED,mBAAmB;YACnB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,4CAA4C;YAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;YACtD,IAAI,KAAK,CAAC,gBAAgB,GAAG,YAAY,EAAE,CAAC;gBAC1C,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,QAAQ,QAAQ,YAAY,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC;YACnH,CAAC;YAED,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBACjD,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACnC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAC;oBAClC,IAAI,iBAAiB,GAAG,eAAe,EAAE,CAAC;wBACxC,OAAO,CAAC,KAAK,EAAE,CAAC;wBAChB,OAAO,MAAM,CAAC,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC,CAAC;oBAC9F,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,MAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC3C,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,CAAC,CAAC,CAAC;gBACH,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,SAAS,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC/D,IAAI,GAAG;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,OAAQ,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAmB;IAChE,iBAAiB;IACjB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,2DAA2D,CAAC,CAAC;IAC9G,CAAC;IAED,cAAc;IACd,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,YAAY,MAAM,CAAC,MAAM,qBAAqB,QAAQ,QAAQ,CAAC,CAAC;IAChH,CAAC;IAED,wEAAwE;IACxE,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC1C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE;KACrD,CAAC;IAEF,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,kBAAkB;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,uBAAuB;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IACjG,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA4B,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAChF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,yCAAyC,KAAK,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAMnD,CAAC;IAEH,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,UAAU,CAAC,IAAI,CAAC;YACd,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,OAAO;YACP,WAAW;YACX,YAAY,EAAE,EAAE,CAAC,YAAY,IAAI,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAc;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAgB;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAgC;QACrD,OAAO,EAAE,QAAQ,CAAC,OAAiB;QACnC,WAAW,EAAE,QAAQ,CAAC,WAAqB;QAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAkB;QACrC,IAAI,EAAG,QAAQ,CAAC,IAAiB,IAAI,EAAE;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAgD;QACpE,SAAS,EAAE,QAAQ,CAAC,SAA+B;QACnD,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/src/services/password.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Password hashing with scrypt.
+ *
+ * Shared service used by ghii.ts, setup.ts, and admin.ts
+ * to avoid code duplication (Phase 1 gap closure).
+ */
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/src/services/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/services/password.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQpE;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrF"}

package/dist/src/services/password.js

@@ -0,0 +1,32 @@
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * Password hashing with scrypt.
+ *
+ * Shared service used by ghii.ts, setup.ts, and admin.ts
+ * to avoid code duplication (Phase 1 gap closure).
+ */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, 64, (err, derivedKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve(salt.toString('hex') + ':' + derivedKey.toString('hex'));
+        });
+    });
+}
+export async function verifyPassword(password, hash) {
+    const [saltHex, keyHex] = hash.split(':');
+    const salt = Buffer.from(saltHex, 'hex');
+    const storedKey = Buffer.from(keyHex, 'hex');
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, 64, (err, derivedKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve(timingSafeEqual(storedKey, derivedKey));
+        });
+    });
+}
+//# sourceMappingURL=password.js.map

package/dist/src/services/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/services/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAC3C,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC/D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAC3C,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/services/personal-routing.d.ts

@@ -0,0 +1,21 @@
+import type { TunnelManager, TunnelMessage } from './personal-tunnel.js';
+import { MailboxService } from './mailbox.js';
+import type { MailboxNotificationService } from './mailbox-notification.js';
+import type { Storage } from '../storage/interface.js';
+export interface RoutingResult {
+    delivered: boolean;
+    response?: TunnelMessage;
+    queued?: boolean;
+    reason?: string;
+}
+/**
+ * Route a message to an agent on a personal node.
+ * If the node is online, forward via WebSocket tunnel and await response.
+ * If offline, queue to mailbox and return 202-style result.
+ */
+export declare function routeToPersonalNode(tunnelManager: TunnelManager, mailboxService: MailboxService, storage: Storage, targetGaii: string, message: {
+    type: 'action_request' | 'work_assignment' | 'board_notification' | 'federation_sync';
+    fromGaii: string;
+    payload: string;
+}, notificationService?: MailboxNotificationService | null): Promise<RoutingResult>;
+//# sourceMappingURL=personal-routing.d.ts.map

package/dist/src/services/personal-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personal-routing.d.ts","sourceRoot":"","sources":["../../../src/services/personal-routing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAKvD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,aAAa,EAC5B,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,EACD,mBAAmB,CAAC,EAAE,0BAA0B,GAAG,IAAI,GACtD,OAAO,CAAC,aAAa,CAAC,CAyExB"}