aimeat 1.2.0

package/dist/src/utils/gaii.js

@@ -0,0 +1,148 @@
+import { randomBytes } from 'node:crypto';
+// GAII format: agent#owner@node
+// agent: ^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$
+// owner: ^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$
+// node:  ^aimeat-[a-z]{2,10}-[0-9]{3}-[a-z0-9-]{1,32}$
+const AGENT_RE = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
+const OWNER_RE = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
+const NODE_RE = /^aimeat-[a-z]{2,10}-[0-9]{3}-[a-z0-9-]{1,32}$/;
+const GAII_RE = /^([a-z0-9][a-z0-9-]{1,62}[a-z0-9])#([a-z0-9][a-z0-9-]{1,62}[a-z0-9])@(aimeat-[a-z]{2,10}-[0-9]{3}-[a-z0-9-]{1,32})$/;
+export const RESERVED_NAMES = new Set([
+    'admin', 'system', 'root', 'operator', 'meat', 'aimeat', 'node', 'network',
+    'registry', 'anonymous', 'null', 'undefined', 'test', 'debug', 'internal',
+    'public', 'private', 'shared', 'all', 'none', 'any', 'self', 'global',
+]);
+export function parseGAII(gaii) {
+    const match = GAII_RE.exec(gaii);
+    if (!match)
+        return null;
+    return { agent: match[1], owner: match[2], node: match[3], full: gaii };
+}
+export function buildGAII(agent, owner, node) {
+    return `${agent}#${owner}@${node}`;
+}
+export function validateAgentName(name) {
+    if (!AGENT_RE.test(name))
+        return 'Agent name must be 3-64 lowercase alphanumeric characters with hyphens';
+    if (RESERVED_NAMES.has(name))
+        return `Name "${name}" is reserved`;
+    return null;
+}
+export function validateOwnerName(name) {
+    if (!OWNER_RE.test(name))
+        return 'Owner name must be 3-64 lowercase alphanumeric characters with hyphens';
+    if (RESERVED_NAMES.has(name))
+        return `Name "${name}" is reserved`;
+    return null;
+}
+export function validateNodeId(nodeId) {
+    if (!NODE_RE.test(nodeId))
+        return 'Node ID must match format: aimeat-{region}-{number}-{name}';
+    return null;
+}
+export function isValidGAII(gaii) {
+    return GAII_RE.test(gaii);
+}
+/**
+ * Resolve the effective storage identity from a request's auth context.
+ * - Owner sessions (GHII): JWT sub is bare username → returns `owner@nodeId` (GHII format)
+ * - Agent sessions (GAII): JWT sub is already full GAII → returns it as-is
+ *
+ * This MUST be used everywhere data is stored/retrieved by identity (memory, files,
+ * consent, knowledge, etc.) to ensure owner sessions use GHII and agents use GAII.
+ */
+export function resolveIdentity(auth, nodeId) {
+    const isOwnerSession = auth.roles.includes('owner') && !auth.roles.includes('agent');
+    return isOwnerSession ? `${auth.owner}@${nodeId}` : auth.sub;
+}
+/**
+ * Lenient GAII parser — extracts owner and node without strict validation.
+ * Handles both `agent#owner@node` and `owner@node` formats.
+ * Returns empty strings for missing parts instead of null.
+ */
+export function parseGaiiLoose(gaii) {
+    const hashIdx = gaii.indexOf('#');
+    const atIdx = gaii.lastIndexOf('@');
+    if (atIdx < 0)
+        return { agent: '', owner: '', node: '' };
+    return {
+        agent: hashIdx >= 0 ? gaii.slice(0, hashIdx) : '',
+        owner: hashIdx >= 0 ? gaii.slice(hashIdx + 1, atIdx) : gaii.slice(0, atIdx),
+        node: gaii.slice(atIdx + 1),
+    };
+}
+/**
+ * Check if two GAII/GHII identities belong to the same owner.
+ * Handles both GHII ("alice@node") and GAII ("agent#alice@node") formats.
+ */
+export function isSameOwner(gaiiA, gaiiB) {
+    return parseGaiiLoose(gaiiA).owner === parseGaiiLoose(gaiiB).owner;
+}
+export function buildChatInstanceId(platform, appName, owner, node) {
+    return `${platform}-${appName}#${owner}@${node}`;
+}
+/**
+ * Generate a human-readable user code for device authorization (RFC 8628).
+ * Format: XXXX-XXXX using unambiguous characters.
+ */
+export function generateUserCode() {
+    const CHARS = 'CDFGHJKMNPQRTVWXYZ2346789';
+    const bytes = randomBytes(8);
+    let code = '';
+    for (let i = 0; i < 8; i++) {
+        code += CHARS[bytes[i] % CHARS.length];
+        if (i === 3)
+            code += '-';
+    }
+    return code;
+}
+export function parseChatInstanceId(id) {
+    // Format: platform-appname#owner@node
+    const hashIdx = id.indexOf('#');
+    if (hashIdx < 0)
+        return null;
+    const beforeHash = id.substring(0, hashIdx);
+    const afterHash = id.substring(hashIdx + 1);
+    const atIdx = afterHash.indexOf('@');
+    if (atIdx < 0)
+        return null;
+    const ownerName = afterHash.substring(0, atIdx);
+    const nodeId = afterHash.substring(atIdx + 1);
+    if (!NODE_RE.test(nodeId))
+        return null;
+    if (!OWNER_RE.test(ownerName))
+        return null;
+    // Split beforeHash into platform and appName
+    // The appName is the last hyphen-separated segment
+    // EXCEPT for anonymous: "chatgpt-anon-1709337600" → platform=chatgpt, appName=anon-1709337600
+    const firstHyphen = beforeHash.indexOf('-');
+    if (firstHyphen < 0)
+        return null;
+    const lastHyphen = beforeHash.lastIndexOf('-');
+    const afterLastHyphen = beforeHash.substring(lastHyphen + 1);
+    const beforeLastHyphen = beforeHash.substring(0, lastHyphen);
+    let platform;
+    let appName;
+    if (/^\d+$/.test(afterLastHyphen) && beforeLastHyphen.endsWith('-anon')) {
+        // Anonymous: "chatgpt-anon-1709337600" → platform=chatgpt, appName=anon-1709337600
+        const anonIdx = beforeLastHyphen.lastIndexOf('-anon');
+        platform = beforeLastHyphen.substring(0, anonIdx);
+        appName = beforeLastHyphen.substring(anonIdx + 1) + '-' + afterLastHyphen;
+    }
+    else {
+        // Normal: last hyphen separates platform from appName
+        platform = beforeLastHyphen;
+        appName = afterLastHyphen;
+    }
+    if (!platform || !appName)
+        return null;
+    return {
+        platform,
+        appName,
+        ownerName,
+        nodeId,
+        full: id,
+        isAnonymous: ownerName === 'anonymous',
+    };
+}
+//# sourceMappingURL=gaii.js.map

package/dist/src/utils/gaii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gaii.js","sourceRoot":"","sources":["../../../src/utils/gaii.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,gCAAgC;AAChC,2CAA2C;AAC3C,2CAA2C;AAC3C,uDAAuD;AAEvD,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AACrD,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AACrD,MAAM,OAAO,GAAG,+CAA+C,CAAC;AAChE,MAAM,OAAO,GAAG,qHAAqH,CAAC;AAEtI,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS;IAC1E,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU;IACzE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ;CACtE,CAAC,CAAC;AASH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,IAAY;IAClE,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,wEAAwE,CAAC;IAC1G,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,IAAI,eAAe,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,wEAAwE,CAAC;IAC1G,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,IAAI,eAAe,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,4DAA4D,CAAC;IAC/F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAqD,EAAE,MAAc;IACnG,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrF,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzD,OAAO;QACL,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACjD,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;QAC3E,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,KAAa;IACtD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AACrE,CAAC;AAiBD,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa,EAAE,IAAY;IAChG,OAAO,GAAG,QAAQ,IAAI,OAAO,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,2BAA2B,CAAC;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,IAAI,GAAG,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,sCAAsC;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAE9C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,6CAA6C;IAC7C,mDAAmD;IACnD,8FAA8F;IAC9F,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE7D,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAe,CAAC;IAEpB,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,mFAAmF;QACnF,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,QAAQ,GAAG,gBAAgB,CAAC;QAC5B,OAAO,GAAG,eAAe,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEvC,OAAO;QACL,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM;QACN,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,SAAS,KAAK,WAAW;KACvC,CAAC;AACJ,CAAC"}

package/dist/src/utils/ghii-resolver.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file ghii-resolver.ts
+ * @description Shared utility to resolve an owner's GHII (Global Human Identity Identifier)
+ *   from the storage identity system, falling back to the provided GAII.
+ * @usage
+ *   import { resolveGhii } from '../utils/ghii-resolver.js';
+ *   const ghii = await resolveGhii(storage, ownerName, req.auth!.sub);
+ * @version-history
+ *   v1.0.0 — 2026-03-15 — extracted from packages.ts, instances.ts, templates.ts
+ */
+import type { Storage } from '../storage/interface.js';
+/** Resolve owner's GHII, falling back to agent GAII */
+export declare function resolveGhii(storage: Storage, ownerName: string, fallback: string): Promise<string>;
+//# sourceMappingURL=ghii-resolver.d.ts.map

package/dist/src/utils/ghii-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ghii-resolver.d.ts","sourceRoot":"","sources":["../../../src/utils/ghii-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,uDAAuD;AACvD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOxG"}

package/dist/src/utils/ghii-resolver.js

@@ -0,0 +1,21 @@
+/**
+ * @file ghii-resolver.ts
+ * @description Shared utility to resolve an owner's GHII (Global Human Identity Identifier)
+ *   from the storage identity system, falling back to the provided GAII.
+ * @usage
+ *   import { resolveGhii } from '../utils/ghii-resolver.js';
+ *   const ghii = await resolveGhii(storage, ownerName, req.auth!.sub);
+ * @version-history
+ *   v1.0.0 — 2026-03-15 — extracted from packages.ts, instances.ts, templates.ts
+ */
+/** Resolve owner's GHII, falling back to agent GAII */
+export async function resolveGhii(storage, ownerName, fallback) {
+    try {
+        const ghiiRecord = await storage.getGHIIByOwner(ownerName);
+        return ghiiRecord?.ghii ?? fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+//# sourceMappingURL=ghii-resolver.js.map

package/dist/src/utils/ghii-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ghii-resolver.js","sourceRoot":"","sources":["../../../src/utils/ghii-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,SAAiB,EAAE,QAAgB;IACrF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO,UAAU,EAAE,IAAI,IAAI,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/src/utils/logger.d.ts

@@ -0,0 +1,9 @@
+import winston from 'winston';
+import { AsyncLocalStorage } from 'node:async_hooks';
+export interface RequestContext {
+    requestId?: string;
+    gaii?: string;
+}
+export declare const requestContext: AsyncLocalStorage<RequestContext>;
+export declare const logger: winston.Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/src/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,cAAc,mCAA0C,CAAC;AAwBtE,eAAO,MAAM,MAAM,gBAmBjB,CAAC"}

package/dist/src/utils/logger.js

@@ -0,0 +1,36 @@
+import winston from 'winston';
+import { AsyncLocalStorage } from 'node:async_hooks';
+export const requestContext = new AsyncLocalStorage();
+/** Custom Winston format that injects request context from AsyncLocalStorage. */
+const contextFormat = winston.format((info) => {
+    const ctx = requestContext.getStore();
+    if (ctx) {
+        if (ctx.requestId)
+            info.requestId = ctx.requestId;
+        if (ctx.gaii)
+            info.gaii = ctx.gaii;
+    }
+    return info;
+});
+/** SECURITY: Mask sensitive fields in log output to prevent credential leaks. */
+const SENSITIVE_FIELDS = ['token', 'password', 'private_key', 'privateKey', 'secret', 'authorization', 'cookie', 'encryptionKey'];
+const maskSensitive = winston.format((info) => {
+    for (const field of SENSITIVE_FIELDS) {
+        if (info[field] !== undefined) {
+            info[field] = '***REDACTED***';
+        }
+    }
+    return info;
+});
+export const logger = winston.createLogger({
+    level: process.env.LOG_LEVEL ?? 'info',
+    defaultMeta: { node_id: process.env.AIMEAT_NODE_ID || 'aimeat-local-001-dev' },
+    format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), contextFormat(), maskSensitive(), process.env.NODE_ENV === 'production'
+        ? winston.format.json()
+        : winston.format.combine(winston.format.colorize(), winston.format.printf(({ timestamp, level, message, node_id: _nid, ...meta }) => {
+            const extra = Object.keys(meta).length ? ` ${JSON.stringify(meta)}` : '';
+            return `${timestamp} ${level}: ${message}${extra}`;
+        }))),
+    transports: [new winston.transports.Console()],
+});
+//# sourceMappingURL=logger.js.map

package/dist/src/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,iFAAiF;AACjF,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAC5C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAClD,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAElI,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAC5C,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;IACtC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sBAAsB,EAAE;IAC9E,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACtC,aAAa,EAAE,EACf,aAAa,EAAE,EACf,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,EACzB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE;YAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,GAAG,SAAS,IAAI,KAAK,KAAK,OAAO,GAAG,KAAK,EAAE,CAAC;QACrD,CAAC,CAAC,CACH,CACJ;IACD,UAAU,EAAE,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;CAC/C,CAAC,CAAC"}

package/dist/src/utils/otk.d.ts

@@ -0,0 +1,2 @@
+export declare function generateOtk(): string;
+//# sourceMappingURL=otk.d.ts.map

package/dist/src/utils/otk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otk.d.ts","sourceRoot":"","sources":["../../../src/utils/otk.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/src/utils/otk.js

@@ -0,0 +1,5 @@
+import { randomBytes } from 'node:crypto';
+export function generateOtk() {
+    return `otk-${randomBytes(16).toString('hex')}`;
+}
+//# sourceMappingURL=otk.js.map

package/dist/src/utils/otk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otk.js","sourceRoot":"","sources":["../../../src/utils/otk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC"}

package/dist/src/utils/tracking-code.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Generate a tracking code: tc-{unix_ms}-{8char_random}
+ */
+export declare function generateTrackingCode(): string;
+/**
+ * Generate a request ID: req-{8char_random}
+ */
+export declare function generateRequestId(): string;
+//# sourceMappingURL=tracking-code.d.ts.map

package/dist/src/utils/tracking-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking-code.d.ts","sourceRoot":"","sources":["../../../src/utils/tracking-code.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/src/utils/tracking-code.js

@@ -0,0 +1,16 @@
+import { randomBytes } from 'node:crypto';
+/**
+ * Generate a tracking code: tc-{unix_ms}-{8char_random}
+ */
+export function generateTrackingCode() {
+    const timestamp = Date.now();
+    const random = randomBytes(4).toString('hex');
+    return `tc-${timestamp}-${random}`;
+}
+/**
+ * Generate a request ID: req-{8char_random}
+ */
+export function generateRequestId() {
+    return `req-${randomBytes(4).toString('hex')}`;
+}
+//# sourceMappingURL=tracking-code.js.map

package/dist/src/utils/tracking-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking-code.js","sourceRoot":"","sources":["../../../src/utils/tracking-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/src/utils/url-validator.d.ts

@@ -0,0 +1,5 @@
+export declare function validateOutboundUrl(urlStr: string): Promise<{
+    valid: boolean;
+    reason?: string;
+}>;
+//# sourceMappingURL=url-validator.d.ts.map

package/dist/src/utils/url-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validator.d.ts","sourceRoot":"","sources":["../../../src/utils/url-validator.ts"],"names":[],"mappings":"AAeA,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8CtG"}

package/dist/src/utils/url-validator.js

@@ -0,0 +1,56 @@
+import { URL } from 'node:url';
+import { lookup } from 'node:dns/promises';
+const BLOCKED_RANGES = [
+    /^127\./, // Loopback
+    /^10\./, // Private class A
+    /^172\.(1[6-9]|2\d|3[01])\./, // Private class B
+    /^192\.168\./, // Private class C
+    /^169\.254\./, // Link-local / cloud metadata
+    /^0\./, // Current network
+    /^::1$/, // IPv6 loopback
+    /^fc00:/i, // IPv6 unique local
+    /^fe80:/i, // IPv6 link-local
+];
+export async function validateOutboundUrl(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch {
+        return { valid: false, reason: 'Invalid URL format' };
+    }
+    // Only allow http/https
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return { valid: false, reason: `Protocol ${parsed.protocol} not allowed` };
+    }
+    // In dev mode, allow loopback for local webhook/hook testing
+    const devMode = process.env.AIMEAT_DEV_MODE === 'true';
+    const hostname = parsed.hostname.toLowerCase();
+    if (devMode && (hostname === 'localhost' || hostname === '::1' || /^127\./.test(hostname))) {
+        return { valid: true };
+    }
+    // Block localhost hostnames
+    if (hostname === 'localhost' || hostname === '::1') {
+        return { valid: false, reason: 'Localhost not allowed' };
+    }
+    // Check IP against blocked ranges
+    for (const range of BLOCKED_RANGES) {
+        if (range.test(hostname)) {
+            return { valid: false, reason: 'Private/reserved IP not allowed' };
+        }
+    }
+    // DNS resolution check (prevent DNS rebinding)
+    try {
+        const { address } = await lookup(hostname);
+        for (const range of BLOCKED_RANGES) {
+            if (range.test(address)) {
+                return { valid: false, reason: 'Resolved IP is private/reserved' };
+            }
+        }
+    }
+    catch {
+        return { valid: false, reason: 'DNS resolution failed' };
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=url-validator.js.map

package/dist/src/utils/url-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validator.js","sourceRoot":"","sources":["../../../src/utils/url-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,MAAM,cAAc,GAAG;IACrB,QAAQ,EAAY,WAAW;IAC/B,OAAO,EAAa,kBAAkB;IACtC,4BAA4B,EAAG,kBAAkB;IACjD,aAAa,EAAO,kBAAkB;IACtC,aAAa,EAAO,8BAA8B;IAClD,MAAM,EAAc,kBAAkB;IACtC,OAAO,EAAa,gBAAgB;IACpC,SAAS,EAAW,oBAAoB;IACxC,SAAS,EAAW,kBAAkB;CACvC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,QAAQ,cAAc,EAAE,CAAC;IAC7E,CAAC;IAED,6DAA6D;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,4BAA4B;IAC5B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3D,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}