aimeat 1.35.0 → 1.36.0

package/dist/.env.example

@@ -269,6 +269,31 @@ AIMEAT_PORT=40050
 # AIMEAT_GOOGLE_OAUTH_CLIENT_SECRET=""                         # OAuth 2.0 client secret
 # AIMEAT_GOOGLE_OAUTH_REDIRECT_URI=""                          # default: <baseUrl>/v1/ghii/login/google/callback
 
+# ── Social login — Casdoor sign-in (OIDC) ────────────────────
+# Casdoor is an open-source IdP. In its admin: create an Application, add the redirect URI below,
+# then copy the client id/secret here. Casdoor is the authority for its org's accounts, so AIMEAT
+# treats emails it returns as verified (enables link-by-email) — only enable IdPs you trust for that.
+# AIMEAT_CASDOOR_OAUTH_ENABLED=false
+# AIMEAT_CASDOOR_OAUTH_ENDPOINT=""                             # Casdoor server URL, e.g. https://casdoor.example.com
+# AIMEAT_CASDOOR_OAUTH_CLIENT_ID=""                            # Application client ID from Casdoor
+# AIMEAT_CASDOOR_OAUTH_CLIENT_SECRET=""                        # Application client secret from Casdoor
+# AIMEAT_CASDOOR_OAUTH_REDIRECT_URI=""                         # default: <baseUrl>/v1/ghii/login/casdoor/callback
+
+# ── Social login — Microsoft Entra ID sign-in (OIDC) ─────────
+# Register an app (free) at https://entra.microsoft.com → App registrations. Add a "Web" platform
+# with the redirect URI below and create a client secret. TENANT controls who may sign in:
+#   • a Directory (tenant) GUID  → ONLY that org's members (enterprise gating; AIMEAT also checks the
+#     `tid` claim and treats the email as verified so members auto-link).
+#   • common        → any work/school account AND personal Microsoft accounts (widest).
+#   • organizations → any work/school account (any org).  • consumers → personal accounts only.
+# Note: for the non-GUID modes strict issuer validation can be finicky; pin a tenant GUID for the
+# most reliable + gated setup.
+# AIMEAT_ENTRA_OAUTH_ENABLED=false
+# AIMEAT_ENTRA_OAUTH_TENANT="common"                           # tenant GUID | common | organizations | consumers
+# AIMEAT_ENTRA_OAUTH_CLIENT_ID=""                              # Application (client) ID from the app registration
+# AIMEAT_ENTRA_OAUTH_CLIENT_SECRET=""                          # Client secret value from the app registration
+# AIMEAT_ENTRA_OAUTH_REDIRECT_URI=""                           # default: <baseUrl>/v1/ghii/login/entra/callback
+
 # ── Consul (optional fleet management) ───────────────────────
 # Connect to HashiCorp Consul for centralized config management across nodes.
 # Values in Consul KV take precedence over file/.env but below database overrides.

package/dist/locales/en.json

@@ -4947,6 +4947,8 @@
     "cancelBtn": "Cancel",
     "orLabel": "OR",
     "googleSignIn": "Continue with Google",
+    "casdoorSignIn": "Continue with Casdoor",
+    "entraSignIn": "Continue with Microsoft",
     "working": "Working...",
     "errUserShort": "Username must be at least 3 characters",
     "errPassShort": "Password must be at least 4 characters",
@@ -4979,11 +4981,13 @@
     "sendUsername": "Send My Username",
     "usernameSent": "If an account with that email exists, your username was sent.",
     "signupTitle": "Choose your username",
-    "signupIntro": "You're signing in with Google for the first time. Pick the username for your AIMEAT account.",
+    "signupIntro": "You're signing in for the first time. Pick the username for your AIMEAT account.",
     "signupEmailNote": "Signing up as {email}",
     "signupUsernameLabel": "Username",
-    "signupSuggestedHint": "We suggested one from your Google account — change it to anything you like.",
+    "signupSuggestedHint": "We suggested one from your account — change it to anything you like.",
     "signupPermanentWarning": "⚠️ This username is permanent. It identifies you across AIMEAT and cannot be changed later — the only way to change it is to delete your account and create a new one.",
+    "signupDisplayNameLabel": "Display name",
+    "signupDisplayNameHint": "Shown to others — not permanent, you can change it anytime later.",
     "signupAvailable": "✓ Available",
     "signupTaken": "That username is already taken — pick another.",
     "signupInvalid": "Username must be 3–64 characters: lowercase letters, numbers and hyphens.",

package/dist/locales/fi.json

@@ -4947,6 +4947,8 @@
     "cancelBtn": "Peruuta",
     "orLabel": "TAI",
     "googleSignIn": "Jatka Googlella",
+    "casdoorSignIn": "Jatka Casdoorilla",
+    "entraSignIn": "Jatka Microsoftilla",
     "working": "Käsitellään...",
     "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
     "errPassShort": "Salasanan tulee olla vähintään 4 merkkiä",
@@ -4979,11 +4981,13 @@
     "sendUsername": "Lähetä käyttäjätunnukseni",
     "usernameSent": "Jos sähköpostiosoitteella on tili, käyttäjätunnus lähetettiin.",
     "signupTitle": "Valitse käyttäjätunnuksesi",
-    "signupIntro": "Kirjaudut Googlella ensimmäistä kertaa. Valitse AIMEAT-tilisi käyttäjätunnus.",
+    "signupIntro": "Kirjaudut ensimmäistä kertaa. Valitse AIMEAT-tilisi käyttäjätunnus.",
     "signupEmailNote": "Rekisteröidyt osoitteella {email}",
     "signupUsernameLabel": "Käyttäjätunnus",
-    "signupSuggestedHint": "Ehdotimme tunnusta Google-tilisi perusteella — voit vaihtaa sen mihin tahansa.",
+    "signupSuggestedHint": "Ehdotimme tunnusta tilisi perusteella — voit vaihtaa sen mihin tahansa.",
     "signupPermanentWarning": "⚠️ Tämä käyttäjätunnus on pysyvä. Se tunnistaa sinut koko AIMEATissa eikä sitä voi vaihtaa jälkikäteen — ainoa tapa muuttaa se on poistaa tili ja luoda uusi.",
+    "signupDisplayNameLabel": "Näyttönimi",
+    "signupDisplayNameHint": "Näkyy muille — ei pysyvä, voit vaihtaa sen milloin tahansa myöhemmin.",
     "signupAvailable": "✓ Vapaa",
     "signupTaken": "Tämä käyttäjätunnus on jo varattu — valitse toinen.",
     "signupInvalid": "Käyttäjätunnuksen pituus 3–64 merkkiä: pieniä kirjaimia, numeroita ja väliviivoja.",

package/dist/public/spa.html

@@ -544,6 +544,9 @@
       const [morsels, setMorsels] = useState(null);
       const [menuOpen, setMenuOpen] = useState(false);
       const [secretaryAvailable, setSecretaryAvailable] = useState(false);
+      // Node feature flags from /v1/site/header-nav (e.g. { secretary }). Empty until the fetch resolves,
+      // so optional surfaces stay hidden until we positively learn they're enabled (no flash).
+      const [features, setFeatures] = useState({});
       // Header nav config: { order, hidden }. Defaults to all visible in declared order
       // until the public /v1/site/header-nav fetch resolves (no flash of empty nav).
       const [navConfig, setNavConfig] = useState({ order: PUBLIC_NAV_LINKS.map(l => l.id), hidden: [] });
@@ -574,6 +577,7 @@
             const order = Array.isArray(d.data.order) ? d.data.order : PUBLIC_NAV_LINKS.map(l => l.id);
             const hidden = Array.isArray(d.data.hidden) ? d.data.hidden : [];
             setNavConfig({ order, hidden });
+            setFeatures(d.data.features || {});
           })
           .catch(e => console.warn('Header nav fetch failed:', e.message));
         return () => { cancelled = true; };
@@ -644,7 +648,7 @@
                   class="${link.matchActive !== false && currentPath === link.path ? 'active' : ''}">${t(link.key) || link.fallback || link.key}</a>
               `)}
               ${session && html`
-                ${secretaryAvailable && html`
+                ${secretaryAvailable && features.secretary && html`
                   <a href="/v1/secretary" class="sec-nav-link ${currentPath === '/v1/secretary' ? 'active' : ''}"
                     title=${t('nav.secretary')} onClick=${(e) => { handleNav(e, '/v1/secretary'); setMenuOpen(false); }}>
                     <span class="sec-nav-icon"><svg viewBox="0 0 24 24" aria-hidden="true">

package/dist/public/views/my-company.js

@@ -22,6 +22,8 @@
  *     (revenue / orders / cost-per-task / commission income + per-agent table) from GET /v1/orgs/:slug/governance.
  *   v0.7.0 — 2026-06-24 — Secretary Phase 6 (slice 1): Company model admin subtab — prompt-driven builder
  *     (describe → generate in-app / copy-prompt → review → apply) for departments/roles/people/reporting (GET/PUT /v1/orgs/:slug/model).
+ *   v0.8.0 — 2026-07-01 — Company Secretary subtab hidden unless the node enables the Secretary feature
+ *     (AIMEAT_SECRETARY_ENABLED, read from /v1/site/header-nav `features.secretary`). Governance + model unaffected.
  */
 import { h } from 'preact';
 import { useState, useEffect, useCallback } from 'preact/hooks';
@@ -760,6 +762,7 @@ export default function MyCompanyView() {
   const [newName, setNewName] = useState('');
   const [newBusinessId, setNewBusinessId] = useState('');
   const [busy, setBusy] = useState(false);
+  const [featSecretary, setFeatSecretary] = useState(false);  // node opt-in: show the company Secretary subtab
 
   async function loadOrgs() {
     setState('loading');
@@ -771,6 +774,15 @@ export default function MyCompanyView() {
     }
   }
   useEffect(() => { loadOrgs(); }, []);
+  // Company Secretary is opt-in per node (AIMEAT_SECRETARY_ENABLED); hide its admin subtab when off.
+  useEffect(() => {
+    let cancelled = false;
+    fetch('/v1/site/header-nav')
+      .then(r => r.json())
+      .then(d => { if (!cancelled && d?.ok) setFeatSecretary(!!(d.data?.features && d.data.features.secretary)); })
+      .catch(() => {});
+    return () => { cancelled = true; };
+  }, []);
 
   async function loadOrders(org) {
     try { const r = await apiGet(`/v1/orgs/${encodeURIComponent(org.slug)}/orders`); setOrdersReceived(r.data?.orders ?? []); }
@@ -872,7 +884,7 @@ export default function MyCompanyView() {
             </div>
 
             <div class="mc-subtabs">
-              ${['catalog', ...(selected.role === 'admin' ? ['orders', 'customers', 'portfolio', 'secretary', 'governance', 'model', 'settings'] : []), 'members'].map(id => html`
+              ${['catalog', ...(selected.role === 'admin' ? ['orders', 'customers', 'portfolio', ...(featSecretary ? ['secretary'] : []), 'governance', 'model', 'settings'] : []), 'members'].map(id => html`
                 <button class="mc-subtab ${subTab === id ? 'active' : ''}" key=${id} onClick=${() => setSubTab(id)}>${t('myCompany.tab' + id.charAt(0).toUpperCase() + id.slice(1))}</button>`)}
               <span class="mc-role-chip">${t('myCompany.role' + (selected.role || 'member').charAt(0).toUpperCase() + (selected.role || 'member').slice(1))}</span>
             </div>

package/dist/public/views/secretary.js

@@ -11,6 +11,9 @@
  * @structure SECRETARY_ICON · SecretaryView (default) — state, effects, handlers, layout (cards in ./secretary/cards.js + ./secretary/cards-reach.js + dashboard chrome in ./secretary/dashboard.js)
  * @usage routed at /v1/secretary by spa.html (+ portal.ts spaRoutes).
  * @version-history
+ *   v0.26.0 — 2026-07-01 — Opt-in feature: the Secretary is now gated on AIMEAT_SECRETARY_ENABLED (off by
+ *     default). The header nav link is hidden and this view redirects to /v1/profile when the node has it
+ *     disabled (flag read from /v1/site/header-nav `features.secretary`).
  *   v0.25.0 — 2026-07-01 — Light-vs-heavy seam: setup no longer cheap-authors content (that hallucinated).
  *     applyResult now CREATES the workspace structure and then proposes grounded Work Briefs (POST
  *     /v1/secretary/brief) the user hands to a Builder (a connected big AI via the appdev MCP tools). Drops
@@ -131,6 +134,16 @@ export const SECRETARY_ICON = html`
 
 export default function SecretaryView() {
   useViewCSS('/css/views/secretary.css');
+  // Secretary is opt-in per node (AIMEAT_SECRETARY_ENABLED). If it's disabled but this view is reached
+  // via a direct URL/bookmark (no nav link is rendered when off), bounce back to the profile.
+  useEffect(() => {
+    let cancelled = false;
+    fetch('/v1/site/header-nav')
+      .then(r => r.json())
+      .then(d => { if (!cancelled && d?.ok && d.data?.features && d.data.features.secretary === false) window.location.replace('/v1/profile'); })
+      .catch(() => {});
+    return () => { cancelled = true; };
+  }, []);
   const { showToast, ToastContainer } = useToast();
   const [secretary, setSecretary] = useState(undefined); // undefined=loading, null=not provisioned
   const [hasOpenRouterKey, setHasOpenRouterKey] = useState(false); // owner has an OpenRouter key configured

package/dist/scripts/archive-stale-versions.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * @file archive-stale-versions.ts
+ * @description One-time, REVERSIBLE cleanup of accumulated workspace-record version bloat. Publishing a
+ *   workspace record used to append a new `.version.N` on every publish with no change-guard, so a
+ *   contract agent that re-published the same draft each poll cycle piled up dozens of byte-identical
+ *   versions per record (concentrated in request queues: mail/research/moodboard/image_requests). The
+ *   publish path is now guarded (see mcp/workspaces.ts + routes/organisms.ts), so this stops GROWING;
+ *   this script cleans up what already accrued.
+ *
+ *   It does NOT delete: it flags redundant version rows `archived = 1` (the same reversible soft-archive
+ *   the organism archive uses) under a shared `archivedRoot` so the whole batch can be restored with
+ *   --unarchive. A version row is redundant when it is byte-identical to the version immediately before
+ *   it (by N) — a pure republish that recorded no real change. Every genuine state transition, the
+ *   first version, and the highest-numbered version (so publish's next-version scan is unaffected) are
+ *   ALWAYS kept. Document/record spaces that version legitimately have no consecutive duplicates, so
+ *   nothing there is touched.
+ *
+ *   Read-only by default. `--from-export=<json>` analyses an exported memory dump with no DB at all.
+ *   Detects the storage provider from .env for the live scan / apply.
+ * @usage
+ *   pnpm versions:stats                              # live dry-run: what WOULD be archived (per namespace)
+ *   pnpm versions:stats -- --from-export=dump.json   # analyse an export JSON, no DB touched
+ *   pnpm versions:archive                            # apply the archive (asks to confirm)
+ *   pnpm versions:archive -- --force                 # apply without the prompt
+ *   pnpm versions:stats -- --unarchive               # preview restore; add --apply to restore
+ *   pnpm versions:archive -- --unarchive --force     # restore the whole archived batch
+ * @version-history
+ *   v1.0.0 -- 2026-07-01 -- Initial: reversible consecutive-identical version dedupe (sqlite + mongodb),
+ *     plus a DB-free --from-export analyser.
+ */
+export {};
+//# sourceMappingURL=archive-stale-versions.d.ts.map

package/dist/scripts/archive-stale-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-stale-versions.d.ts","sourceRoot":"","sources":["../../scripts/archive-stale-versions.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/scripts/archive-stale-versions.js

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+/**
+ * @file archive-stale-versions.ts
+ * @description One-time, REVERSIBLE cleanup of accumulated workspace-record version bloat. Publishing a
+ *   workspace record used to append a new `.version.N` on every publish with no change-guard, so a
+ *   contract agent that re-published the same draft each poll cycle piled up dozens of byte-identical
+ *   versions per record (concentrated in request queues: mail/research/moodboard/image_requests). The
+ *   publish path is now guarded (see mcp/workspaces.ts + routes/organisms.ts), so this stops GROWING;
+ *   this script cleans up what already accrued.
+ *
+ *   It does NOT delete: it flags redundant version rows `archived = 1` (the same reversible soft-archive
+ *   the organism archive uses) under a shared `archivedRoot` so the whole batch can be restored with
+ *   --unarchive. A version row is redundant when it is byte-identical to the version immediately before
+ *   it (by N) — a pure republish that recorded no real change. Every genuine state transition, the
+ *   first version, and the highest-numbered version (so publish's next-version scan is unaffected) are
+ *   ALWAYS kept. Document/record spaces that version legitimately have no consecutive duplicates, so
+ *   nothing there is touched.
+ *
+ *   Read-only by default. `--from-export=<json>` analyses an exported memory dump with no DB at all.
+ *   Detects the storage provider from .env for the live scan / apply.
+ * @usage
+ *   pnpm versions:stats                              # live dry-run: what WOULD be archived (per namespace)
+ *   pnpm versions:stats -- --from-export=dump.json   # analyse an export JSON, no DB touched
+ *   pnpm versions:archive                            # apply the archive (asks to confirm)
+ *   pnpm versions:archive -- --force                 # apply without the prompt
+ *   pnpm versions:stats -- --unarchive               # preview restore; add --apply to restore
+ *   pnpm versions:archive -- --unarchive --force     # restore the whole archived batch
+ * @version-history
+ *   v1.0.0 -- 2026-07-01 -- Initial: reversible consecutive-identical version dedupe (sqlite + mongodb),
+ *     plus a DB-free --from-export analyser.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(__dirname, '..');
+const ARCHIVE_ROOT = 'stale-version-dedupe';
+const ARCHIVED_BY = 'archive-stale-versions-script';
+function loadEnv() {
+    const envPath = resolve(ROOT, '.env');
+    const vars = {};
+    if (existsSync(envPath)) {
+        for (const line of readFileSync(envPath, 'utf8').split('\n')) {
+            const m = line.match(/^([A-Z_]+)\s*=\s*"?([^"\n]*)"?/);
+            if (m)
+                vars[m[1]] = m[2];
+        }
+    }
+    return vars;
+}
+const env = { ...loadEnv(), ...process.env };
+const provider = env.AIMEAT_STORAGE ?? 'memory';
+const argv = process.argv.slice(2);
+const force = argv.includes('--force') || argv.includes('-f');
+const apply = argv.includes('--apply');
+const unarchive = argv.includes('--unarchive');
+const fromExportArg = argv.find(a => a.startsWith('--from-export='));
+const fromExport = fromExportArg ? fromExportArg.split('=').slice(1).join('=') : null;
+function fmtBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 ** 2)
+        return `${(n / 1024).toFixed(1)} KB`;
+    if (n < 1024 ** 3)
+        return `${(n / 1024 ** 2).toFixed(1)} MB`;
+    return `${(n / 1024 ** 3).toFixed(2)} GB`;
+}
+function bytesOf(v) { return Buffer.byteLength(JSON.stringify(v ?? null), 'utf8'); }
+async function confirm(message) {
+    if (force)
+        return true;
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise(r => rl.question(message, r));
+    rl.close();
+    return answer.trim().toLowerCase() === 'y';
+}
+/** Namespace label for a workspace record key: the objectType namespace segment, else '(other)'. */
+function nsOf(key) {
+    const m = key.match(/\.shared\.([^.]+)\./) || key.match(/\.w\.[^.]+\.([^.]+)\./) || key.match(/^([^.]+)\./);
+    return m ? m[1] : '(other)';
+}
+/** Redundant version rows = byte-identical to the version immediately before them (by N), excluding the
+ *  highest-numbered version of each record (kept so a future publish's maxN scan is unaffected). */
+function planRedundant(rows) {
+    const groups = new Map();
+    for (const r of rows) {
+        const m = r.key.match(/^(.*)\.version\.(\d+)$/);
+        if (!m)
+            continue;
+        const arr = groups.get(m[1]) ?? [];
+        arr.push({ n: parseInt(m[2], 10), row: r });
+        groups.set(m[1], arr);
+    }
+    const out = [];
+    for (const arr of groups.values()) {
+        arr.sort((a, b) => a.n - b.n);
+        const maxN = arr[arr.length - 1].n;
+        for (let i = 1; i < arr.length; i++) {
+            if (arr[i].n === maxN)
+                continue; // always keep the top version
+            if (JSON.stringify(arr[i].row.value) === JSON.stringify(arr[i - 1].row.value)) {
+                out.push({ ...arr[i].row, bytes: bytesOf(arr[i].row.value) }); // identical to its predecessor
+            }
+        }
+    }
+    return out;
+}
+function report(redundant, totalVersionRows) {
+    const byNs = new Map();
+    let bytes = 0;
+    for (const r of redundant) {
+        const s = byNs.get(nsOf(r.key)) ?? { count: 0, bytes: 0 };
+        s.count++;
+        s.bytes += r.bytes;
+        byNs.set(nsOf(r.key), s);
+        bytes += r.bytes;
+    }
+    console.log(`  Version rows scanned:      ${totalVersionRows.toLocaleString()}`);
+    console.log(`  Redundant (archivable):    ${redundant.length.toLocaleString()}  (${fmtBytes(bytes)})`);
+    if (byNs.size) {
+        console.log('  By namespace:');
+        for (const [ns, s] of [...byNs.entries()].sort((a, b) => b[1].bytes - a[1].bytes)) {
+            console.log(`    ${ns.padEnd(22)} ${String(s.count).padStart(5)} rows  ${fmtBytes(s.bytes).padStart(10)}`);
+        }
+    }
+    console.log('');
+}
+// ─── Export-file analysis (no DB) ────────────────────────────
+function runFromExport(path) {
+    const p = resolve(process.cwd(), path);
+    if (!existsSync(p)) {
+        console.error(`  x No export file at ${p}`);
+        process.exit(1);
+    }
+    const doc = JSON.parse(readFileSync(p, 'utf8'));
+    const entries = doc.entries ?? [];
+    const versionRows = entries.filter(e => /\.version\.\d+$/.test(e.key));
+    console.log(`  Source:         export file (${path}) — read-only, no DB touched`);
+    console.log(`  Entries:        ${entries.length.toLocaleString()}`);
+    console.log('');
+    report(planRedundant(versionRows), versionRows.length);
+    console.log('  This is analysis only. Point the script at the live node (drop --from-export) to apply.');
+}
+// ─── SQLite ──────────────────────────────────────────────────
+async function runSqlite() {
+    const dbPath = resolve(ROOT, env.AIMEAT_SQLITE_PATH ?? './data/aimeat.db');
+    if (!existsSync(dbPath)) {
+        console.log(`  No database file at ${dbPath} — nothing to do.`);
+        return;
+    }
+    const Database = (await import('better-sqlite3')).default;
+    const db = new Database(dbPath);
+    try {
+        console.log(`  Storage:        sqlite (${dbPath})`);
+        console.log(`  DB file size:   ${fmtBytes(statSync(dbPath).size)}`);
+        console.log('');
+        if (unarchive) {
+            const n = db.prepare('SELECT COUNT(*) AS c FROM memory WHERE archivedRoot = ?').get(ARCHIVE_ROOT).c;
+            console.log(`  Archived batch "${ARCHIVE_ROOT}": ${n.toLocaleString()} row(s).`);
+            if (!apply) {
+                console.log('  Read-only. Add --apply to restore them.');
+                return;
+            }
+            if (!await confirm(`  Restore ${n.toLocaleString()} archived version row(s)? [y/N] `)) {
+                console.log('  Aborted.');
+                return;
+            }
+            const res = db.prepare('UPDATE memory SET archived=0, archivedAt=NULL, archivedBy=NULL, archivedRoot=NULL WHERE archivedRoot = ?').run(ARCHIVE_ROOT);
+            console.log(`  Restored ${res.changes.toLocaleString()} row(s).`);
+            return;
+        }
+        const rows = db.prepare("SELECT key, ownerGaii, value FROM memory WHERE key LIKE '%.version.%' AND archived = 0").all();
+        const redundant = planRedundant(rows.map(r => ({ key: r.key, ownerGaii: r.ownerGaii, value: JSON.parse(r.value) })));
+        report(redundant, rows.length);
+        if (!apply) {
+            console.log('  Read-only. Re-run with --apply (pnpm versions:archive) to soft-archive them.');
+            return;
+        }
+        if (redundant.length === 0) {
+            console.log('  Nothing to archive.');
+            return;
+        }
+        if (!await confirm(`  Soft-archive ${redundant.length.toLocaleString()} redundant version row(s)? Reversible via --unarchive. [y/N] `)) {
+            console.log('  Aborted.');
+            return;
+        }
+        const at = new Date().toISOString();
+        const stmt = db.prepare('UPDATE memory SET archived=1, archivedAt=?, archivedBy=?, archivedRoot=? WHERE ownerGaii=? AND key=? AND archived=0');
+        const tx = db.transaction((items) => {
+            let done = 0;
+            for (const r of items)
+                done += stmt.run(at, ARCHIVED_BY, ARCHIVE_ROOT, r.ownerGaii, r.key).changes;
+            return done;
+        });
+        console.log(`  Archived ${tx(redundant).toLocaleString()} row(s) under archivedRoot="${ARCHIVE_ROOT}". Restore with: pnpm versions:archive -- --unarchive --force`);
+    }
+    finally {
+        db.close();
+    }
+}
+// ─── MongoDB ─────────────────────────────────────────────────
+async function runMongodb() {
+    const dbUrl = env.DATABASE_URL;
+    if (!dbUrl) {
+        console.error('  x No DATABASE_URL in .env');
+        process.exit(1);
+    }
+    const { PrismaClient } = await import('@prisma/client');
+    const prisma = new PrismaClient({ datasourceUrl: dbUrl });
+    await prisma.$connect();
+    try {
+        console.log('  Storage:        mongodb');
+        console.log('');
+        if (unarchive) {
+            const n = await prisma.memory.count({ where: { archivedRoot: ARCHIVE_ROOT } });
+            console.log(`  Archived batch "${ARCHIVE_ROOT}": ${n.toLocaleString()} row(s).`);
+            if (!apply) {
+                console.log('  Read-only. Add --apply to restore them.');
+                return;
+            }
+            if (!await confirm(`  Restore ${n.toLocaleString()} archived version row(s)? [y/N] `)) {
+                console.log('  Aborted.');
+                return;
+            }
+            const res = await prisma.memory.updateMany({ where: { archivedRoot: ARCHIVE_ROOT }, data: { archived: false, archivedAt: null, archivedBy: null, archivedRoot: null } });
+            console.log(`  Restored ${res.count.toLocaleString()} row(s).`);
+            return;
+        }
+        const rows = await prisma.memory.findMany({ where: { key: { contains: '.version.' }, archived: false }, select: { key: true, ownerGaii: true, value: true } });
+        const redundant = planRedundant(rows.map(r => ({ key: r.key, ownerGaii: r.ownerGaii, value: r.value })));
+        report(redundant, rows.length);
+        if (!apply) {
+            console.log('  Read-only. Re-run with --apply (pnpm versions:archive) to soft-archive them.');
+            return;
+        }
+        if (redundant.length === 0) {
+            console.log('  Nothing to archive.');
+            return;
+        }
+        if (!await confirm(`  Soft-archive ${redundant.length.toLocaleString()} redundant version row(s)? Reversible via --unarchive. [y/N] `)) {
+            console.log('  Aborted.');
+            return;
+        }
+        const at = new Date();
+        let done = 0;
+        for (const r of redundant) {
+            await prisma.memory.update({ where: { ownerGaii_key: { ownerGaii: r.ownerGaii, key: r.key } }, data: { archived: true, archivedAt: at, archivedBy: ARCHIVED_BY, archivedRoot: ARCHIVE_ROOT } });
+            done++;
+        }
+        console.log(`  Archived ${done.toLocaleString()} row(s) under archivedRoot="${ARCHIVE_ROOT}". Restore with: pnpm versions:archive -- --unarchive --force`);
+    }
+    finally {
+        await prisma.$disconnect();
+    }
+}
+// ─── Main ────────────────────────────────────────────────────
+console.log('');
+console.log('  AIMEAT Stale-Version Archive (reversible)');
+console.log('  ══════════════════════════════════════════');
+if (fromExport) {
+    runFromExport(fromExport);
+}
+else {
+    switch (provider) {
+        case 'sqlite':
+            await runSqlite();
+            break;
+        case 'mongodb':
+            await runMongodb();
+            break;
+        default:
+            console.log('  Storage: memory (in-memory) — nothing persisted. Use --from-export=<json> to analyse a dump.');
+            break;
+    }
+}
+console.log('');
+//# sourceMappingURL=archive-stale-versions.js.map

package/dist/scripts/archive-stale-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-stale-versions.js","sourceRoot":"","sources":["../../scripts/archive-stale-versions.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAEtC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACvD,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC;AAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACvC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACrE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEtF,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5C,CAAC;AACD,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAErG,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC;AAC7C,CAAC;AAED,oGAAoG;AACpG,SAAS,IAAI,CAAC,GAAW;IACvB,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAID;oGACoG;AACpG,SAAS,aAAa,CAAC,IAAW;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0C,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,SAAS,CAAmC,8BAA8B;YACjG,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAG,+BAA+B;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,SAAyC,EAAE,gBAAwB;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4C,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1D,CAAC,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,gCAAgC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,8BAA8B,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;AAC3G,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,MAAM,mBAAmB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,GAAG,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAI,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAmB,CAAC,CAAC,CAAC;YACvH,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,MAAM,CAAC,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACjF,IAAI,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE,kCAAkC,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7H,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,0GAA0G,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrJ,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,wFAAwF,CAAC,CAAC,GAAG,EAA8D,CAAC;QACpL,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,+DAA+D,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9K,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,qHAAqH,CAAC,CAAC;QAC/I,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,KAAqC,EAAE,EAAE;YAClE,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,+BAA+B,YAAY,+DAA+D,CAAC,CAAC;IACtK,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,UAAU;IACvB,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,MAAM,CAAC,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACjF,IAAI,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,cAAc,EAAE,kCAAkC,CAAC,EAAE,CAAC;gBAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7H,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACzK,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/J,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,OAAO,CAAC,kBAAkB,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,+DAA+D,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9K,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACjM,IAAI,EAAE,CAAC;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,+BAA+B,YAAY,+DAA+D,CAAC,CAAC;IAC7J,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAChB,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAC3D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;AAE5D,IAAI,UAAU,EAAE,CAAC;IACf,aAAa,CAAC,UAAU,CAAC,CAAC;AAC5B,CAAC;KAAM,CAAC;IACN,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YAAE,MAAM,SAAS,EAAE,CAAC;YAAC,MAAM;QACxC,KAAK,SAAS;YAAE,MAAM,UAAU,EAAE,CAAC;YAAC,MAAM;QAC1C;YAAS,OAAO,CAAC,GAAG,CAAC,gGAAgG,CAAC,CAAC;YAAC,MAAM;IAChI,CAAC;AACH,CAAC;AACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC"}

package/dist/src/cli/connect/mcp/tools/agent-management.d.ts

@@ -5,13 +5,16 @@
  *   - PATCH /tags is same-owner gated -- an agent may set tags on itself or a
  *     same-owner sibling (parity with agent-caps self-report). The crew scaffold
  *     self-tags on every start via this path.
- *   - PATCH /mode requires an owner role; an agent session gets a 403.
+ *   - PATCH /mode is same-owner gated too (since v1.3.0) -- an agent may set its own /
+ *     a same-owner sibling's mode, so a device-authed crew self-sets task-runner at startup.
  *
  * @version-history
  *   v1.0.0 -- 2026-05-29 -- Initial creation: tags_set + mode_set
  *   v1.1.0 -- 2026-05-30 -- MCP audit Phase 1: tool descriptions sourced from canonical catalog via descriptionFor().
  *   v1.2.0 -- 2026-06-24 -- tags_set is now agent-callable on its own/same-owner record
  *     (REST PATCH /tags relaxed from owner-role to same-owner). mode_set stays owner-only.
+ *   v1.3.0 -- 2026-07-02 -- mode_set relaxed from owner-role to same-owner too (parity with tags_set),
+ *     so a device-authed crew can self-set task-runner mode at startup.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { AgentRegistry } from '../../agent-registry.js';

package/dist/src/cli/connect/mcp/tools/agent-management.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-management.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/connect/mcp/tools/agent-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,CA+B1F"}
+{"version":3,"file":"agent-management.d.ts","sourceRoot":"","sources":["../../../../../../src/cli/connect/mcp/tools/agent-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,CA+B1F"}

package/dist/src/cli/connect/mcp/tools/agent-management.js

@@ -13,7 +13,7 @@ export function registerAgentManagementTools(mcp, registry) {
     });
     mcp.tool('aimeat_agent_mode_set', descriptionFor('aimeat_agent_mode_set'), {
         agent_name: agentNameSchema,
-        target_agent_name: z.string().describe('Agent whose mode to update (must be owned by the calling owner).'),
+        target_agent_name: z.string().describe('Agent whose mode to update (same owner as the calling agent; pass the caller\'s own name to self-set).'),
         mode: z.enum(['autonomous', 'interactive', 'task-runner', 'coordinator', 'workstation']).describe('New mode.'),
     }, async ({ agent_name, target_agent_name, mode }) => {
         const { client } = pickAgent(registry, agent_name);

package/dist/src/cli/connect/mcp/tools/agent-management.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-management.js","sourceRoot":"","sources":["../../../../../../src/cli/connect/mcp/tools/agent-management.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAElE,MAAM,UAAU,4BAA4B,CAAC,GAAc,EAAE,QAAuB;IAElF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,cAAc,CAAC,uBAAuB,CAAC,EACvC;QACE,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;QAChJ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;KACzF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,cAAc,CAAC,uBAAuB,CAAC,EACvC;QACE,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;QAC1G,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/G,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agent-management.js","sourceRoot":"","sources":["../../../../../../src/cli/connect/mcp/tools/agent-management.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAElE,MAAM,UAAU,4BAA4B,CAAC,GAAc,EAAE,QAAuB;IAElF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,cAAc,CAAC,uBAAuB,CAAC,EACvC;QACE,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;QAChJ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;KACzF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB,cAAc,CAAC,uBAAuB,CAAC,EACvC;QACE,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wGAAwG,CAAC;QAChJ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC/G,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/src/config.d.ts

@@ -262,6 +262,16 @@ export interface AimeatConfig {
     googleOAuthClientId: string;
     googleOAuthClientSecret: string;
     googleOAuthRedirectUri: string;
+    casdoorOAuthEnabled: boolean;
+    casdoorOAuthEndpoint: string;
+    casdoorOAuthClientId: string;
+    casdoorOAuthClientSecret: string;
+    casdoorOAuthRedirectUri: string;
+    entraOAuthEnabled: boolean;
+    entraOAuthTenant: string;
+    entraOAuthClientId: string;
+    entraOAuthClientSecret: string;
+    entraOAuthRedirectUri: string;
     crossFederationEnabled: boolean;
     maxGenesisPeers: number;
     genesisSyncIntervalHours: number;
@@ -319,6 +329,7 @@ export interface AimeatConfig {
     extensionMaxInstalled: number;
     maxExtensionsPerOwner: number;
     generatorEnabled: boolean;
+    secretaryEnabled: boolean;
     foundryEnabled: boolean;
     calibratorEnabled: boolean;
     cortexEnabled: boolean;