aimeat 1.23.2 → 1.23.3

package/dist/src/middleware/subdomain.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file subdomain.ts
+ * @description Resolves the request's subdomain label into `req.subdomain`.
+ *              In production nginx proxies all `<sub>.<apex>` requests to this
+ *              backend with an `X-Subdomain: <sub>` header (apex requests carry
+ *              no such header). A hostname fallback covers dev setups where the
+ *              header is absent but the Host matches `<sub>.<apex-host>`.
+ * @structure subdomainMiddleware(config) — Express middleware factory.
+ * @usage app.use(subdomainMiddleware(config)); // before route mounting
+ * @version-history
+ *   v1.0.0 — 2026-06-12 — Initial: subdomain routing (operator-only management)
+ */
+import type { Request, Response, NextFunction } from 'express';
+import type { AimeatConfig } from '../config.js';
+declare global {
+    namespace Express {
+        interface Request {
+            subdomain?: string | null;
+        }
+    }
+}
+/**
+ * Sets `req.subdomain` to the lowercase leftmost label of the requested
+ * subdomain, or null for apex requests. Header wins; hostname is a fallback
+ * matched against the apex host derived from config.baseUrl.
+ */
+export declare function subdomainMiddleware(config: AimeatConfig): (req: Request, _res: Response, next: NextFunction) => void;
+//# sourceMappingURL=subdomain.d.ts.map

package/dist/src/middleware/subdomain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subdomain.d.ts","sourceRoot":"","sources":["../../../src/middleware/subdomain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC3B;KACF;CACF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,IAO9C,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,UAiBzD"}

package/dist/src/middleware/subdomain.js

@@ -0,0 +1,32 @@
+/**
+ * Sets `req.subdomain` to the lowercase leftmost label of the requested
+ * subdomain, or null for apex requests. Header wins; hostname is a fallback
+ * matched against the apex host derived from config.baseUrl.
+ */
+export function subdomainMiddleware(config) {
+    // "https://aimeat.io" → "aimeat.io" (empty for unparseable baseUrls)
+    let apexHost = '';
+    try {
+        apexHost = new URL(config.baseUrl).hostname.toLowerCase();
+    }
+    catch { /* no hostname fallback without a valid baseUrl */ }
+    return (req, _res, next) => {
+        const fromHeader = req.get('x-subdomain');
+        if (fromHeader) {
+            req.subdomain = fromHeader.trim().toLowerCase();
+            return next();
+        }
+        req.subdomain = null;
+        if (apexHost) {
+            const host = (req.hostname || '').toLowerCase();
+            if (host !== apexHost && host.endsWith('.' + apexHost)) {
+                const label = host.slice(0, -(apexHost.length + 1));
+                // Single-level subdomains only — nginx's server_name regex matches one label
+                if (label && !label.includes('.'))
+                    req.subdomain = label;
+            }
+        }
+        next();
+    };
+}
+//# sourceMappingURL=subdomain.js.map

package/dist/src/middleware/subdomain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subdomain.js","sourceRoot":"","sources":["../../../src/middleware/subdomain.ts"],"names":[],"mappings":"AAwBA;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,qEAAqE;IACrE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpD,6EAA6E;gBAC7E,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/models/offer-schemas.d.ts

@@ -0,0 +1,229 @@
+/**
+ * @file offer-schemas.ts
+ * @description Zod validation for an agent's published "offers" — the human-readable face of the
+ *   agent's machine contract ("here's what I can do for you, with an example, the outcome, and a
+ *   sample deliverable"). An agent publishes `agents.{name}.offers`; the profile Offers surface renders
+ *   it (goal-first search → Ask), and the mesh consumes the same record for delegate selection. This is
+ *   the single shared contract — keep it in sync with docs/plans/2026-06-12-agent-offers-surface.md §4.
+ * @structure
+ *   - OfferSchema — one offer (ask/example/cost/latency/verification/dataHandling/requirements/
+ *     consequences/availability/deliverable)
+ *   - OffersDocSchema — the published document { version, updatedAt, offers: Offer[] }
+ * @usage import { OffersDocSchema } from '../models/offer-schemas.js';
+ *   const parsed = OffersDocSchema.safeParse(req.body);
+ * @version-history
+ *   v1.0.0 -- 2026-06-12 -- Initial: offer descriptor (Agent Offers surface v1).
+ *   v2.0.0 -- 2026-06-12 -- Billable offers: price + visibility + callable binding. An offer is a
+ *     billable capability — free for the owner's own use, debited (morsels owner→provider) when a
+ *     different owner invokes it. `visibility:'public'` lists it in the catalogue; `callable` binds it
+ *     to a machine-invocable action/webhook. All v2 fields optional → v1 docs validate unchanged.
+ *     See docs/plans/2026-06-12-services-to-offers-migration.md.
+ */
+import { z } from 'zod';
+export declare const OfferSchema: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    ask: z.ZodString;
+    example: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    cost: z.ZodOptional<z.ZodEnum<{
+        free: "free";
+        cheap: "cheap";
+        expensive: "expensive";
+    }>>;
+    latency: z.ZodOptional<z.ZodEnum<{
+        seconds: "seconds";
+        minutes: "minutes";
+        "long-running": "long-running";
+    }>>;
+    repeatability: z.ZodOptional<z.ZodEnum<{
+        idempotent: "idempotent";
+        accumulative: "accumulative";
+        destructive: "destructive";
+    }>>;
+    verification: z.ZodOptional<z.ZodEnum<{
+        deterministic: "deterministic";
+        gated: "gated";
+        ungated: "ungated";
+    }>>;
+    dataHandling: z.ZodOptional<z.ZodEnum<{
+        "local-only": "local-only";
+        "llm-provider": "llm-provider";
+        "third-party": "third-party";
+    }>>;
+    availability: z.ZodOptional<z.ZodObject<{
+        boundToLastSeen: z.ZodOptional<z.ZodBoolean>;
+        scheduleBorn: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            scheduleId: z.ZodString;
+            human: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>]>>>;
+    }, z.core.$strip>>;
+    requirements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        need: z.ZodString;
+        fix: z.ZodOptional<z.ZodString>;
+        instruction: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    inputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        required: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    consequences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            "creates-agent": "creates-agent";
+            "creates-schedule": "creates-schedule";
+            "mutates-host": "mutates-host";
+            "publishes-public": "publishes-public";
+            "external-send": "external-send";
+            "mutates-live-app": "mutates-live-app";
+            "delegates-to-agent": "delegates-to-agent";
+        }>;
+        persistent: z.ZodOptional<z.ZodBoolean>;
+        requiresApproval: z.ZodOptional<z.ZodBoolean>;
+        dynamic: z.ZodOptional<z.ZodBoolean>;
+        ratesThirdParties: z.ZodOptional<z.ZodBoolean>;
+        allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    deliverable: z.ZodObject<{
+        format: z.ZodEnum<{
+            file: "file";
+            app: "app";
+            document: "document";
+            record: "record";
+            "board-post": "board-post";
+        }>;
+        location: z.ZodOptional<z.ZodObject<{
+            space: z.ZodOptional<z.ZodString>;
+            key: z.ZodOptional<z.ZodString>;
+            url: z.ZodOptional<z.ZodString>;
+            visibility: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        sample: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodLiteral<"untested">]>>;
+    }, z.core.$strip>;
+    price: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        morsels: z.ZodNumber;
+        unit: z.ZodOptional<z.ZodEnum<{
+            "per-call": "per-call";
+            "per-result": "per-result";
+            subscription: "subscription";
+        }>>;
+    }, z.core.$strip>>>;
+    visibility: z.ZodOptional<z.ZodEnum<{
+        public: "public";
+        private: "private";
+        unlisted: "unlisted";
+    }>>;
+    callable: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        action_id: z.ZodOptional<z.ZodString>;
+        webhook_url: z.ZodOptional<z.ZodString>;
+        input_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        output_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const OffersDocSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodNumber>;
+    updatedAt: z.ZodOptional<z.ZodString>;
+    offers: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        ask: z.ZodString;
+        example: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        cost: z.ZodOptional<z.ZodEnum<{
+            free: "free";
+            cheap: "cheap";
+            expensive: "expensive";
+        }>>;
+        latency: z.ZodOptional<z.ZodEnum<{
+            seconds: "seconds";
+            minutes: "minutes";
+            "long-running": "long-running";
+        }>>;
+        repeatability: z.ZodOptional<z.ZodEnum<{
+            idempotent: "idempotent";
+            accumulative: "accumulative";
+            destructive: "destructive";
+        }>>;
+        verification: z.ZodOptional<z.ZodEnum<{
+            deterministic: "deterministic";
+            gated: "gated";
+            ungated: "ungated";
+        }>>;
+        dataHandling: z.ZodOptional<z.ZodEnum<{
+            "local-only": "local-only";
+            "llm-provider": "llm-provider";
+            "third-party": "third-party";
+        }>>;
+        availability: z.ZodOptional<z.ZodObject<{
+            boundToLastSeen: z.ZodOptional<z.ZodBoolean>;
+            scheduleBorn: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                scheduleId: z.ZodString;
+                human: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>]>>>;
+        }, z.core.$strip>>;
+        requirements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            need: z.ZodString;
+            fix: z.ZodOptional<z.ZodString>;
+            instruction: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        inputs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            required: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>>;
+        consequences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<{
+                "creates-agent": "creates-agent";
+                "creates-schedule": "creates-schedule";
+                "mutates-host": "mutates-host";
+                "publishes-public": "publishes-public";
+                "external-send": "external-send";
+                "mutates-live-app": "mutates-live-app";
+                "delegates-to-agent": "delegates-to-agent";
+            }>;
+            persistent: z.ZodOptional<z.ZodBoolean>;
+            requiresApproval: z.ZodOptional<z.ZodBoolean>;
+            dynamic: z.ZodOptional<z.ZodBoolean>;
+            ratesThirdParties: z.ZodOptional<z.ZodBoolean>;
+            allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            note: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        deliverable: z.ZodObject<{
+            format: z.ZodEnum<{
+                file: "file";
+                app: "app";
+                document: "document";
+                record: "record";
+                "board-post": "board-post";
+            }>;
+            location: z.ZodOptional<z.ZodObject<{
+                space: z.ZodOptional<z.ZodString>;
+                key: z.ZodOptional<z.ZodString>;
+                url: z.ZodOptional<z.ZodString>;
+                visibility: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            sample: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodLiteral<"untested">]>>;
+        }, z.core.$strip>;
+        price: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            morsels: z.ZodNumber;
+            unit: z.ZodOptional<z.ZodEnum<{
+                "per-call": "per-call";
+                "per-result": "per-result";
+                subscription: "subscription";
+            }>>;
+        }, z.core.$strip>>>;
+        visibility: z.ZodOptional<z.ZodEnum<{
+            public: "public";
+            private: "private";
+            unlisted: "unlisted";
+        }>>;
+        callable: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            action_id: z.ZodOptional<z.ZodString>;
+            webhook_url: z.ZodOptional<z.ZodString>;
+            input_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            output_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Offer = z.infer<typeof OfferSchema>;
+export type OffersDoc = z.infer<typeof OffersDocSchema>;
+//# sourceMappingURL=offer-schemas.d.ts.map

package/dist/src/models/offer-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offer-schemas.d.ts","sourceRoot":"","sources":["../../../src/models/offer-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2DxB,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoBtB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI1B,CAAC;AAEH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/src/models/offer-schemas.js

@@ -0,0 +1,100 @@
+/**
+ * @file offer-schemas.ts
+ * @description Zod validation for an agent's published "offers" — the human-readable face of the
+ *   agent's machine contract ("here's what I can do for you, with an example, the outcome, and a
+ *   sample deliverable"). An agent publishes `agents.{name}.offers`; the profile Offers surface renders
+ *   it (goal-first search → Ask), and the mesh consumes the same record for delegate selection. This is
+ *   the single shared contract — keep it in sync with docs/plans/2026-06-12-agent-offers-surface.md §4.
+ * @structure
+ *   - OfferSchema — one offer (ask/example/cost/latency/verification/dataHandling/requirements/
+ *     consequences/availability/deliverable)
+ *   - OffersDocSchema — the published document { version, updatedAt, offers: Offer[] }
+ * @usage import { OffersDocSchema } from '../models/offer-schemas.js';
+ *   const parsed = OffersDocSchema.safeParse(req.body);
+ * @version-history
+ *   v1.0.0 -- 2026-06-12 -- Initial: offer descriptor (Agent Offers surface v1).
+ *   v2.0.0 -- 2026-06-12 -- Billable offers: price + visibility + callable binding. An offer is a
+ *     billable capability — free for the owner's own use, debited (morsels owner→provider) when a
+ *     different owner invokes it. `visibility:'public'` lists it in the catalogue; `callable` binds it
+ *     to a machine-invocable action/webhook. All v2 fields optional → v1 docs validate unchanged.
+ *     See docs/plans/2026-06-12-services-to-offers-migration.md.
+ */
+import { z } from 'zod';
+// ── v2: billable / listable / callable ──────────────────────────────────────
+// Concrete morsel price for cross-owner invocation. `null`/absent = not for sale (self-use only).
+// Distinct from the qualitative `cost` ('free'|'cheap'|'expensive') hint, which stays for goal-search.
+const PriceSchema = z.object({
+    morsels: z.number().int().nonnegative(),
+    unit: z.enum(['per-call', 'per-result', 'subscription']).optional(), // default per-call at the billing site
+}).nullable();
+// Machine-invocable binding. Present ⇒ a non-owner can invoke and be billed; absent ⇒ human-prompt/task offer.
+const CallableSchema = z.object({
+    action_id: z.string().max(200).optional(), // an existing capability/action id that backs this offer
+    webhook_url: z.string().max(500).optional(), // or a direct webhook
+    input_schema: z.record(z.string(), z.unknown()).optional(),
+    output_schema: z.record(z.string(), z.unknown()).optional(),
+}).nullable();
+const RequirementSchema = z.object({
+    need: z.string().min(1).max(200),
+    fix: z.string().max(64).optional(), // a one-click fix chip id (e.g. 'join', 'adopt-contract')
+    instruction: z.string().max(500).optional(), // guidance text when no one-click fix exists (machine-local preconditions)
+});
+const ConsequenceSchema = z.object({
+    // Only what SURVIVES the task — persistent / approval / external / host. In-process fan-out is not here.
+    type: z.enum([
+        'creates-agent', 'creates-schedule', 'mutates-host', 'publishes-public',
+        'external-send', 'mutates-live-app', 'delegates-to-agent',
+    ]),
+    persistent: z.boolean().optional(),
+    requiresApproval: z.boolean().optional(),
+    dynamic: z.boolean().optional(), // the real chain renders live from task events, not the manifest
+    ratesThirdParties: z.boolean().optional(), // a coordinator may write ratings to the agents it delegates to
+    allowlist: z.array(z.string().max(200)).max(50).optional(), // for external-send
+    note: z.string().max(300).optional(),
+});
+const AvailabilitySchema = z.object({
+    boundToLastSeen: z.boolean().optional(),
+    // string (human label) OR { scheduleId, human } so Run can trigger the schedule.
+    scheduleBorn: z.union([
+        z.string().max(200),
+        z.object({ scheduleId: z.string().max(100), human: z.string().max(200).optional() }),
+    ]).nullable().optional(),
+}).optional();
+const DeliverableSchema = z.object({
+    format: z.enum(['document', 'record', 'board-post', 'file', 'app']),
+    location: z.object({
+        space: z.string().max(200).optional(),
+        key: z.string().max(400).optional(),
+        url: z.string().max(500).optional(),
+        visibility: z.string().max(40).optional(),
+    }).optional(),
+    // A REAL excerpt from the last successful deliverable, or the literal "untested". Object | string.
+    sample: z.union([z.string().max(8000), z.record(z.string(), z.unknown()), z.literal('untested')]).optional(),
+});
+export const OfferSchema = z.object({
+    id: z.string().min(1).max(100),
+    title: z.string().min(1).max(120),
+    ask: z.string().min(1).max(500), // plain-language invite incl. negative scope
+    example: z.string().max(500).optional(),
+    tags: z.array(z.string().max(64)).max(20).optional(), // reuse existing machine tags for goal-search
+    cost: z.enum(['free', 'cheap', 'expensive']).optional(),
+    latency: z.enum(['seconds', 'minutes', 'long-running']).optional(),
+    repeatability: z.enum(['idempotent', 'accumulative', 'destructive']).optional(),
+    verification: z.enum(['deterministic', 'gated', 'ungated']).optional(), // deterministic = no LLM in I/O path (strongest)
+    dataHandling: z.enum(['local-only', 'llm-provider', 'third-party']).optional(), // where input data flows
+    availability: AvailabilitySchema,
+    requirements: z.array(RequirementSchema).max(20).optional(),
+    inputs: z.array(z.object({ name: z.string().max(80), required: z.boolean().optional() })).max(20).optional(),
+    consequences: z.array(ConsequenceSchema).max(20).optional(),
+    deliverable: DeliverableSchema,
+    // ── v2 billable/listable/callable (all optional; default to private, not-for-sale, human-driven) ──
+    price: PriceSchema.optional(),
+    visibility: z.enum(['private', 'unlisted', 'public']).optional(), // default 'private' at read/list time
+    callable: CallableSchema.optional(),
+});
+export const OffersDocSchema = z.object({
+    version: z.number().int().nonnegative().optional(),
+    updatedAt: z.string().max(40).optional(),
+    offers: z.array(OfferSchema).max(40),
+});
+//# sourceMappingURL=offer-schemas.js.map

package/dist/src/models/offer-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offer-schemas.js","sourceRoot":"","sources":["../../../src/models/offer-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,kGAAkG;AAClG,uGAAuG;AACvG,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,uCAAuC;CAC7G,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEd,+GAA+G;AAC/G,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAI,yDAAyD;IACtG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,sBAAsB;IACnE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEd,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAW,0DAA0D;IACvG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,2EAA2E;CACzH,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,yGAAyG;IACzG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB;QACvE,eAAe,EAAE,kBAAkB,EAAE,oBAAoB;KAC1D,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAW,iEAAiE;IAC3G,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,gEAAgE;IAC3G,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,oBAAoB;IAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC;QACpB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACnB,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzB,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEd,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC1C,CAAC,CAAC,QAAQ,EAAE;IACb,mGAAmG;IACnG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAA0B,6CAA6C;IACtG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAK,8CAA8C;IACvG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,iDAAiD;IACzH,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IACzG,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5G,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,iBAAiB;IAC9B,qGAAqG;IACrG,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,sCAAsC;IACxG,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrC,CAAC,CAAC"}

package/dist/src/routes/agent-tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tasks.d.ts","sourceRoot":"","sources":["../../../src/routes/agent-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAA8E,MAAM,yBAAyB,CAAC;AAYnI,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAsBpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAotCtH"}
+{"version":3,"file":"agent-tasks.d.ts","sourceRoot":"","sources":["../../../src/routes/agent-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAA8E,MAAM,yBAAyB,CAAC;AAYnI,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAsBpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAqvCtH"}

package/dist/src/routes/agent-tasks.js

@@ -1160,6 +1160,39 @@ export function agentTasksRouter(config, storage, webhookDispatcher) {
             per_page: perPage,
         }));
     });
+    /* ── GET /v1/deliverables — the Offers "Inbox": everything that came back, across ALL agents ──
+     * Owner aggregate of non-draft tasks (queued/active/done/failed/…), newest first, with provenance
+     * (agent, status, timestamps), the deliverable key, the verification expectation, and any existing
+     * rating. The follow-up half of the Offers surface — check + rate without clicking through agents.
+     * Failures are included AS failures (status='failed'); rate the deliverable via the locked
+     * POST /v1/agents/:name/tasks/:id/rate. */
+    router.get('/v1/deliverables', requireAuth(), requireRole('owner'), async (req, res) => {
+        const owner = resolve(req);
+        const all = [];
+        for (let p = 1; p <= 10; p++) {
+            const r = await storage.listAgentTasksByOwner(owner, { page: p, perPage: 200 });
+            all.push(...r.tasks);
+            if (r.tasks.length < 200)
+                break;
+        }
+        const deliverables = all
+            .filter(t => t.status !== 'draft')
+            .sort((a, b) => String(b.updatedAt).localeCompare(String(a.updatedAt)))
+            .slice(0, 100)
+            .map(t => ({
+            task_id: t.id,
+            agent: t.agentGaii.split('#')[0],
+            agent_gaii: t.agentGaii, // full GAII so the Inbox can read the agent's memory namespace
+            title: t.title,
+            status: t.status,
+            completed_at: t.completedAt ?? null,
+            updated_at: t.updatedAt,
+            deliverable_key: t.deliverableKey ?? null,
+            verification: t.verification?.userExpects ?? null,
+            rating: t.rating ?? null,
+        }));
+        res.json(success(config.nodeId, { deliverables, total: deliverables.length }));
+    });
     return router;
 }
 //# sourceMappingURL=agent-tasks.js.map