aimeat 2.0.0 → 2.2.0

package/dist/src/services/metered-entitlements.js

@@ -0,0 +1,268 @@
+/**
+ * @file src/services/metered-entitlements.ts
+ * @description G1 — the durable METERED ENTITLEMENT primitive (EXCHANGE / TARGET-045). Generalises the
+ *   single-use `ext-pay-token` into a lasting, budget-capped, contract-bound right: "consumer C may call
+ *   provider P's capability (ext/action) at price X, under contract K, until budget B is spent." This is
+ *   the object app-grants deliberately do NOT provide — a grant confers scopes (capability *classes*),
+ *   never a priced call-right to a specific provider. An entitlement is server-minted by the
+ *   contract-acceptance flow (a human in an MCP chat, or a closed negotiation agent) and consulted by the
+ *   metered-call gateway (G2) on every call. Memory-backed (no new table — per
+ *   docs/coding-guidelines/memory-contracts.md; keeps the node holding only refined data, EXCHANGE's
+ *   design principle), stored under a system namespace and never client-readable.
+ * @structure MeteredEntitlement · entitlementKey · readEntitlementForCall · listEntitlementsByConsumer /
+ *   ByProvider · createEntitlement · authorizeAndCharge · pauseEntitlement · revokeEntitlement
+ * @usage
+ *   await createEntitlement(storage, { consumerGaii, providerGhii, ext, action, priceMoney, budget, contractRef, ... });
+ *   const gate = await authorizeAndCharge(storage, consumerGaii, ext, action, priceMicros);
+ *   if (!gate.ok) return res.status(402)...;
+ * @version-history
+ *   v1.4.0 — 2026-07-25 — Contracts capture `tollMorsels` at signature: raising the pacing burn later
+ *     governs new contracts, never ones already agreed.
+ *   v1.3.0 — 2026-07-21 — Contract history: archiveEntitlement + listEntitlementHistoryByConsumer/ByProvider
+ *     (superseded contracts survive the live-key overwrite for the "past contracts" view — renegotiation).
+ *   v1.2.0 — 2026-07-21 — Add optional `surface` (AppToolSurface) so a contract can bind an app-tool's pinned
+ *     interface version (Gap 1 cross-app selling); the (ext, action) coordinate stays the shared key.
+ *   v1.1.0 — 2026-07-20 — Add `appId` dimension + listEntitlementsByApp for the per-app cost surface (G3)
+ *   v1.0.0 — 2026-07-20 — Initial G1 entitlement object (EXCHANGE slice-1): create / lookup-by-call /
+ *     authorize+charge (budget decrement) / pause / revoke. Read-modify-write budget counter — see the
+ *     concurrency note on authorizeAndCharge (a dedicated atomic counter is deferred to G5).
+ */
+import { createHash, randomUUID } from 'node:crypto';
+/** System namespace — server-side only, never surfaced to a client (mirrors `ext-pay-token`). */
+const NS = 'metered-entitlement';
+/** History namespace — superseded (renegotiated) contracts are archived here so the record survives the
+ *  live-key overwrite; the consumer/provider "past contracts" views read it. Append-only. */
+const NS_HISTORY = 'metered-entitlement-history';
+/** Deterministic, dot-safe key: a call `(consumer, ext, action)` maps to exactly one entitlement, so the
+ *  gateway does an O(1) `getMemory` lookup (no scan). GAII contains `@`/`#` — hashing sidesteps key-segment
+ *  rules while staying reproducible. The full identifiers live in the value for verification. */
+export function entitlementKey(consumerGaii, ext, action) {
+    const h = createHash('sha256').update(`${consumerGaii}|${ext}|${action}`).digest('hex').slice(0, 32);
+    return `entitlement.${h}`;
+}
+/** Look up the live entitlement authorising this exact call, or null. */
+export async function readEntitlementForCall(storage, consumerGaii, ext, action) {
+    const rec = await storage.getMemory(NS, entitlementKey(consumerGaii, ext, action));
+    return rec ? rec.value : null;
+}
+/** Every entitlement a consumer holds (for the app cost/contract surface, G3). Filtered prefix scan. */
+export async function listEntitlementsByConsumer(storage, consumerGaii) {
+    const { items } = await storage.listAllMemory({ prefix: 'entitlement.', limit: 5000 });
+    return items.map(r => r.value).filter(v => v && v.consumerGaii === consumerGaii);
+}
+/** Every entitlement a provider sells (for the provider/earnings view). Filtered prefix scan. */
+export async function listEntitlementsByProvider(storage, providerGhii) {
+    const { items } = await storage.listAllMemory({ prefix: 'entitlement.', limit: 5000 });
+    return items.map(r => r.value).filter(v => v && v.providerGhii === providerGhii);
+}
+/** Every entitlement a consuming app holds (the per-app cost/contract surface, G3). Filtered prefix scan. */
+export async function listEntitlementsByApp(storage, appId) {
+    const { items } = await storage.listAllMemory({ prefix: 'entitlement.', limit: 5000 });
+    return items.map(r => r.value).filter(v => v && v.appId === appId);
+}
+/** Mint (or overwrite) an entitlement — called by the contract-acceptance flow after both sides agree.
+ *  One `(consumer, ext, action)` triple has one entitlement; re-minting replaces it (e.g. renegotiated price),
+ *  carrying spend forward only when explicitly asked. */
+export async function createEntitlement(storage, input) {
+    const now = new Date().toISOString();
+    const value = {
+        entitlementId: input.carrySpend?.entitlementId || randomUUID(),
+        consumerGaii: input.consumerGaii,
+        appId: input.appId ?? input.carrySpend?.appId ?? null,
+        providerGhii: input.providerGhii,
+        ext: input.ext,
+        action: input.action,
+        capabilityLabel: input.capabilityLabel || `${input.ext}/${input.action}`,
+        unit: input.unit,
+        pricePerCall: input.pricePerCall,
+        currency: input.unit === 'money' ? (input.currency ?? 'EUR') : null,
+        pricing: input.pricing ?? input.carrySpend?.pricing ?? { model: 'per_call' },
+        surface: input.surface ?? input.carrySpend?.surface ?? null,
+        budget: {
+            capUnits: input.capUnits ?? null,
+            spentUnits: input.carrySpend?.budget.spentUnits ?? 0,
+            calls: input.carrySpend?.budget.calls ?? 0,
+        },
+        rakePercent: input.rakePercent ?? null,
+        // Captured at signature, like the price: a provider raising their pacing later governs NEW contracts.
+        tollMorsels: input.tollMorsels ?? input.carrySpend?.tollMorsels ?? null,
+        contractRef: input.contractRef,
+        escrowParty: input.escrowParty ?? null,
+        state: 'active',
+        createdAt: input.carrySpend?.createdAt || now,
+        createdBy: input.carrySpend?.createdBy || input.createdBy,
+        updatedAt: now,
+    };
+    await persist(storage, value);
+    return value;
+}
+/**
+ * Authorize a single metered call and record its spend against the budget.
+ *
+ * Returns `{ ok: true, entitlement }` when the entitlement is `active` and the (money) price fits under the
+ * remaining cap; the caller (the G2 gateway) then executes and settles. The budget counter is incremented
+ * here so an exhausted entitlement flips to `exhausted` and stops authorising.
+ *
+ * CONCURRENCY: this is a read-modify-write on a memory record — under heavy simultaneous calls on the SAME
+ * entitlement the cap can be marginally overshot. The cap is an *authorization ceiling*, not a fund gate:
+ * every actual payment still moves through the atomic debit/credit settle path per call, so no funds are
+ * lost — only the ceiling can be exceeded by a few in-flight calls. A dedicated atomic counter (or table)
+ * is deferred to G5. The per-call price is read from the entitlement itself (`pricePerCall`, in its `unit`).
+ */
+export async function authorizeAndCharge(storage, consumerGaii, ext, action) {
+    const ent = await readEntitlementForCall(storage, consumerGaii, ext, action);
+    if (!ent)
+        return { ok: false, reason: 'no_entitlement' };
+    if (ent.state !== 'active')
+        return { ok: false, reason: ent.state }; // paused | exhausted | revoked
+    const price = Math.max(0, ent.pricePerCall);
+    const nextSpent = ent.budget.spentUnits + price;
+    if (ent.budget.capUnits !== null && nextSpent > ent.budget.capUnits) {
+        // Freeze it so the surface reflects the exhaustion; this call is denied.
+        if (ent.state === 'active') {
+            ent.state = 'exhausted';
+            ent.updatedAt = new Date().toISOString();
+            await persist(storage, ent);
+        }
+        return { ok: false, reason: 'budget_exhausted' };
+    }
+    ent.budget.spentUnits = nextSpent;
+    ent.budget.calls += 1;
+    if (ent.budget.capUnits !== null && nextSpent >= ent.budget.capUnits)
+        ent.state = 'exhausted';
+    ent.updatedAt = new Date().toISOString();
+    await persist(storage, ent);
+    return { ok: true, entitlement: ent };
+}
+/**
+ * Compute what THIS call costs + the advanced pricing state, per the entitlement's pricing model. Pure —
+ * no mutation, no I/O (`nowMs` is passed in so it stays testable). The gate uses the result to check the
+ * budget, settle `chargeUnits`, and then {@link commitSpend} the advanced `pricing`. `allowed:false` means
+ * the call is refused without charge (a subscription rate-limit window is full).
+ */
+export function computeCharge(ent, nowMs) {
+    const p = ent.pricing ?? { model: 'per_call' };
+    if (p.model === 'bundle') {
+        if (p.callsRemaining > 0) {
+            return { allowed: true, chargeUnits: 0, pricing: { ...p, callsRemaining: p.callsRemaining - 1 } };
+        }
+        // Quota drained → refill: charge one more block and consume a call from it.
+        return { allowed: true, chargeUnits: Math.max(0, p.blockPrice), pricing: { ...p, callsRemaining: Math.max(0, p.blockSize - 1) } };
+    }
+    if (p.model === 'subscription') {
+        const nowIso = new Date(nowMs).toISOString();
+        let validUntil = p.validUntil, windowStart = p.windowStart, windowCount = p.windowCount, charge = 0;
+        if (nowMs >= new Date(validUntil).getTime()) { // period expired → renew (charge the period fee)
+            charge = Math.max(0, p.periodPrice);
+            validUntil = new Date(nowMs + p.periodSeconds * 1000).toISOString();
+            windowStart = nowIso;
+            windowCount = 0;
+        }
+        if (nowMs >= new Date(windowStart).getTime() + p.windowSeconds * 1000) { // rate window rolled over
+            windowStart = nowIso;
+            windowCount = 0;
+        }
+        if (windowCount >= p.callsPerWindow) { // rate limit hit — refuse without charge
+            return { allowed: false, reason: 'rate_limited', chargeUnits: 0, pricing: { ...p, validUntil, windowStart, windowCount } };
+        }
+        return { allowed: true, chargeUnits: charge, pricing: { ...p, validUntil, windowStart, windowCount: windowCount + 1 } };
+    }
+    return { allowed: true, chargeUnits: Math.max(0, ent.pricePerCall), pricing: { model: 'per_call' } };
+}
+/** Peek: would a charge of `chargeUnits` fit under the cap right now? (No mutation — the G2 gate checks this
+ *  BEFORE moving money, then calls {@link commitSpend} only after settlement succeeds, so a failed debit
+ *  never leaves a phantom spend.) */
+export function budgetAllows(ent, chargeUnits) {
+    if (ent.state !== 'active')
+        return false;
+    return ent.budget.capUnits === null || ent.budget.spentUnits + Math.max(0, chargeUnits) <= ent.budget.capUnits;
+}
+/** Commit one call AFTER settlement succeeded: add `chargeUnits` to spend, bump calls, advance the pricing
+ *  state, flip to `exhausted` at the cap. (Read-modify-write — see the concurrency note on {@link authorizeAndCharge}.) */
+export async function commitSpend(storage, ent, chargeUnits, pricing) {
+    ent.budget.spentUnits += Math.max(0, chargeUnits);
+    ent.budget.calls += 1;
+    if (pricing)
+        ent.pricing = pricing;
+    if (ent.budget.capUnits !== null && ent.budget.spentUnits >= ent.budget.capUnits)
+        ent.state = 'exhausted';
+    ent.updatedAt = new Date().toISOString();
+    await persist(storage, ent);
+    return ent;
+}
+/** Roll back one call's spend by `chargeUnits` (the gate calls this when the sandbox script throws AFTER
+ *  settlement, in lockstep with the money refund). Floors at 0 and un-exhausts if this frees headroom. Does
+ *  NOT rewind the pricing quota/window (a thrown call still consumed its slot — conservative). No-op if gone. */
+export async function refundSpend(storage, consumerGaii, ext, action, chargeUnits) {
+    const e = await readEntitlementForCall(storage, consumerGaii, ext, action);
+    if (!e)
+        return;
+    e.budget.spentUnits = Math.max(0, e.budget.spentUnits - Math.max(0, chargeUnits));
+    e.budget.calls = Math.max(0, e.budget.calls - 1);
+    if (e.state === 'exhausted' && (e.budget.capUnits === null || e.budget.spentUnits < e.budget.capUnits)) {
+        e.state = 'active';
+    }
+    e.updatedAt = new Date().toISOString();
+    await persist(storage, e);
+}
+/** Pause (owner off-switch) — stops authorising without losing the record/spend history. */
+export async function pauseEntitlement(storage, consumerGaii, ext, action) {
+    return flip(storage, consumerGaii, ext, action, 'paused');
+}
+/** Revoke — terminal; the entitlement no longer authorises and must be re-minted to resume. */
+export async function revokeEntitlement(storage, consumerGaii, ext, action) {
+    return flip(storage, consumerGaii, ext, action, 'revoked');
+}
+async function flip(storage, consumerGaii, ext, action, state) {
+    const ent = await readEntitlementForCall(storage, consumerGaii, ext, action);
+    if (!ent)
+        return false;
+    ent.state = state;
+    ent.updatedAt = new Date().toISOString();
+    await persist(storage, ent);
+    return true;
+}
+async function persist(storage, value) {
+    await storage.setMemory({
+        key: entitlementKey(value.consumerGaii, value.ext, value.action),
+        ownerGaii: NS,
+        value,
+        visibility: 'private',
+        tags: ['metered-entitlement'],
+        ttlHours: null,
+        version: 1,
+        createdAt: value.createdAt,
+        updatedAt: value.updatedAt,
+    });
+}
+/**
+ * Archive a copy of an entitlement to history (append-only) before the live record is overwritten by a
+ * renegotiation (supersede) — so the old terms + final spend/period survive for the "past contracts" view.
+ * Does NOT touch the live record. The `from → to` period is `createdAt → archivedAt`.
+ */
+export async function archiveEntitlement(storage, ent, reason, proposalId) {
+    const now = new Date().toISOString();
+    const archivedId = randomUUID();
+    const entry = {
+        ...ent, archivedId, archivedAt: now, archiveReason: reason, supersededByProposal: proposalId ?? null,
+    };
+    await storage.setMemory({
+        key: `me-hist.${archivedId}`, ownerGaii: NS_HISTORY, value: entry,
+        visibility: 'private', tags: ['metered-entitlement-history'], ttlHours: null, version: 1, createdAt: now, updatedAt: now,
+    });
+}
+/** Past (archived) contracts a consumer held — newest first. */
+export async function listEntitlementHistoryByConsumer(storage, consumerGaii) {
+    const { items } = await storage.listAllMemory({ prefix: 'me-hist.', limit: 5000 });
+    return items.map(r => r.value)
+        .filter(v => v && v.archivedId && v.consumerGaii === consumerGaii)
+        .sort((a, b) => (a.archivedAt < b.archivedAt ? 1 : -1));
+}
+/** Past (archived) contracts a provider sold — newest first. */
+export async function listEntitlementHistoryByProvider(storage, providerGhii) {
+    const { items } = await storage.listAllMemory({ prefix: 'me-hist.', limit: 5000 });
+    return items.map(r => r.value)
+        .filter(v => v && v.archivedId && v.providerGhii === providerGhii)
+        .sort((a, b) => (a.archivedAt < b.archivedAt ? 1 : -1));
+}
+//# sourceMappingURL=metered-entitlements.js.map

package/dist/src/services/metered-entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metered-entitlements.js","sourceRoot":"","sources":["../../../src/services/metered-entitlements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,iGAAiG;AACjG,MAAM,EAAE,GAAG,qBAAqB,CAAC;AACjC;6FAC6F;AAC7F,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAmHjD;;iGAEiG;AACjG,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,GAAW,EAAE,MAAc;IAC9E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,YAAY,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrG,OAAO,eAAe,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc;IAEnE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,cAAc,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,KAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAgB,EAAE,YAAoB;IACrF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAA2B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;AACzG,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAgB,EAAE,YAAoB;IACrF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAA2B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;AACzG,CAAC;AAED,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,KAAa;IACzE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAA2B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;yDAEyD;AACzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAChB,KAMC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAuB;QAChC,aAAa,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa,IAAI,UAAU,EAAE;QAC9D,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,IAAI;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE;QACxE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACnE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE;QAC5E,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI;QAC3D,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YACpD,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;SAC3C;QACD,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,sGAAsG;QACtG,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,EAAE,WAAW,IAAI,IAAI;QACvE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,GAAG;QAC7C,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS;QACzD,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc;IAEnE,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACzD,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,+BAA+B;IACpG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpE,yEAAyE;QACzE,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3B,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;YACxB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;IAC9F,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAuB,EAAE,KAAa;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,GAAG,CAAC,EAAE,EAAE,CAAC;QACpG,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;QACpG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAW,iDAAiD;YACxG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;YACpC,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACpE,WAAW,GAAG,MAAM,CAAC;YAAC,WAAW,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC,CAAC,0BAA0B;YACjG,WAAW,GAAG,MAAM,CAAC;YAAC,WAAW,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAmB,yCAAyC;YAChG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;QAC7H,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,GAAG,CAAC,EAAE,EAAE,CAAC;IAC1H,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;AACvG,CAAC;AAED;;qCAEqC;AACrC,MAAM,UAAU,YAAY,CAAC,GAAuB,EAAE,WAAmB;IACvE,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;AACjH,CAAC;AAED;2HAC2H;AAC3H,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAuB,EAAE,WAAmB,EAAE,OAAqB;IACrH,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACtB,IAAI,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;IAC1G,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;iHAEiH;AACjH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc,EAAE,WAAmB;IACxH,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvG,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;IACrB,CAAC;IACD,CAAC,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc;IACxG,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc;IACzG,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,OAAgB,EAAE,YAAoB,EAAE,GAAW,EAAE,MAAc,EAAE,KAAkC;IAEvG,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAClB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,KAAyB;IAChE,MAAM,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;QAChE,SAAS,EAAE,EAAE;QACb,KAAK;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,CAAC,qBAAqB,CAAC;QAC7B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAAE,GAAuB,EAAE,MAAgC,EAAE,UAA0B;IAEvG,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,KAAK,GAA4B;QACrC,GAAG,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,IAAI,IAAI;KACrG,CAAC;IACF,MAAM,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,EAAE,WAAW,UAAU,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK;QACjE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG;KACzH,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAAgB,EAAE,YAAoB;IAC3F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAgC,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC;SACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAAgB,EAAE,YAAoB;IAC3F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAgC,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC;SACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/src/services/notify.d.ts

@@ -41,6 +41,13 @@ export type NotifAction = {
 /** Same-node path guard for an action endpoint/link ('/...' only — never '//host' or a full URL). */
 export declare function isSafeNotifActionEndpoint(path: unknown): path is string;
 export declare function setNotifyPushService(push: PushService | null): void;
+/**
+ * Delete the recipient's bell notifications that deep-link to a given conversation — called when they
+ * open/read that thread, so a message they've now seen stops nagging from the header bell. Matches both
+ * the delivered-message link (#inbox/<id>) and the "wants to message you" request link (#inbox/req:<id>).
+ * Best-effort: never throws into the caller. Returns the number removed (0 if none / on any error).
+ */
+export declare function dismissConversationNotifications(storage: Storage, recipientGhii: string, conversationId: string): Promise<number>;
 export interface NotifyInput {
     /** Machine type, e.g. 'workspace_access_request' | 'workspace_access_approved'. */
     type: string;

package/dist/src/services/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../../src/services/notify.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC/I;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnL,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAEvE;AAID,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEnE;AAED,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCvG"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../../src/services/notify.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC/I;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEnL,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAEvE;AAID,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEnE;AAED;;;;;GAKG;AACH,wBAAsB,gCAAgC,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBvI;AAED,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCvG"}

package/dist/src/services/notify.js

@@ -9,6 +9,8 @@
  *   browser push (best-effort) whose click deep-links to the same target as the bell entry.
  * @structure
  *   - notify(storage, recipientGhii, { type, title, body?, link?, actions? })
+ *   - dismissConversationNotifications(storage, recipientGhii, conversationId) — delete the bell
+ *     notifications deep-linking to a conversation once its owner has read that thread
  *   - setNotifyPushService(push) — wired once at boot so notify() can bridge to web push
  *   - notifLinkToUrl(link) — bell link vocabulary ('/v1/profile#inbox/<id>') → openable URL
  *   - NotifAction — an inline action a notification carries (reply | api | navigate), rendered as a
@@ -23,6 +25,9 @@
  *   v1.1.0 -- 2026-07-02 -- Bridge bell notifications to web push with deep-link URL translation.
  *   v1.2.0 -- 2026-07-18 -- Inline notification actions (reply/api/navigate); mirror up to two into
  *     the web-push payload so the SW can offer OS-level action buttons.
+ *   v1.3.0 -- 2026-07-21 -- dismissConversationNotifications(): reading a DM thread deletes its bell
+ *     notifications (delivered #inbox/<id> + request #inbox/req:<id> links) so a seen message stops
+ *     lingering in the header bell. Called from POST /v1/messages/conversations/:id/read.
  */
 import { randomUUID } from 'node:crypto';
 export const NOTIF_PREFIX = 'notif.';
@@ -38,6 +43,36 @@ let pushService = null;
 export function setNotifyPushService(push) {
     pushService = push;
 }
+/**
+ * Delete the recipient's bell notifications that deep-link to a given conversation — called when they
+ * open/read that thread, so a message they've now seen stops nagging from the header bell. Matches both
+ * the delivered-message link (#inbox/<id>) and the "wants to message you" request link (#inbox/req:<id>).
+ * Best-effort: never throws into the caller. Returns the number removed (0 if none / on any error).
+ */
+export async function dismissConversationNotifications(storage, recipientGhii, conversationId) {
+    if (!conversationId)
+        return 0;
+    try {
+        const links = new Set([`/v1/profile#inbox/${conversationId}`, `/v1/profile#inbox/req:${conversationId}`]);
+        const mine = await storage.listMemory(recipientGhii, { prefix: NOTIF_PREFIX });
+        const refs = mine
+            .filter(r => { const v = r.value; return !!v && typeof v.link === 'string' && links.has(v.link); })
+            .map(r => ({ ownerGaii: recipientGhii, key: r.key }));
+        if (!refs.length)
+            return 0;
+        if (storage.bulkDeleteMemory)
+            return await storage.bulkDeleteMemory(refs);
+        let removed = 0;
+        for (const ref of refs) {
+            if (await storage.deleteMemory(ref.ownerGaii, ref.key))
+                removed++;
+        }
+        return removed;
+    }
+    catch {
+        return 0;
+    }
+}
 /**
  * Translate a bell-vocabulary link into a URL that opens correctly from a cold start (push
  * notification click, new window). The bell's '/v1/profile#<tab>[/<rest>]' hash form only works

package/dist/src/services/notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../../src/services/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,CAAC,CAAG,UAAU;AAC7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAkBnC,qGAAqG;AACrG,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1G,CAAC;AAED,0FAA0F;AAC1F,IAAI,WAAW,GAAuB,IAAI,CAAC;AAC3C,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAChC,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,aAAqB,EAAE,KAAkB;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,+EAA+E;QAC/E,MAAM,OAAO,CAAC,SAAS,CAAC;YACtB,GAAG,EAAE,GAAG,YAAY,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YAC9C,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE;YACzI,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,2FAA2F;YAC3F,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,wFAAwF;YACxF,KAAK,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;gBACtB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,GAAG,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE;aAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA6B,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;IACvF,CAAC;AACH,CAAC"}
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../../src/services/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,CAAC,CAAG,UAAU;AAC7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAkBnC,qGAAqG;AACrG,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1G,CAAC;AAED,0FAA0F;AAC1F,IAAI,WAAW,GAAuB,IAAI,CAAC;AAC3C,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAAgB,EAAE,aAAqB,EAAE,cAAsB;IACpH,IAAI,CAAC,cAAc;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,cAAc,EAAE,EAAE,yBAAyB,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI;aACd,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAiC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aAC9H,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,gBAAgB;YAAE,OAAO,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAAC,IAAI,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAC9F,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAChC,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,aAAqB,EAAE,KAAkB;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,+EAA+E;QAC/E,MAAM,OAAO,CAAC,SAAS,CAAC;YACtB,GAAG,EAAE,GAAG,YAAY,GAAG,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YAC9C,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE;YACzI,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QACH,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;YACzB,2FAA2F;YAC3F,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,wFAAwF;YACxF,KAAK,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;gBACtB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,GAAG,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE;aAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA6B,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;IACvF,CAAC;AACH,CAAC"}

package/dist/src/services/owner-memory.d.ts

@@ -9,6 +9,8 @@
  * @structure
  *   - listOwnerScopeMemory(storage, nodeId, ownerName, opts) — aggregated list (deduped, GHII-first)
  *   - getOwnerScopeMemory(storage, nodeId, ownerName, key) — one key across owner+agents (GHII-first)
+ *   - getOwnerScopePublicMemory(storage, nodeId, ownerName, key) — first PUBLIC record for a key across
+ *       owner+agents (GHII-first); a non-public record never shadows a public one (anonymous serve paths)
  * @usage import { listOwnerScopeMemory, getOwnerScopeMemory } from '../services/owner-memory.js';
  * @version-history
  *   v1.0.0 — 2026-06-13 — Extracted from routes/memory.ts owner-scope branch; reused by the workflow
@@ -16,9 +18,25 @@
  *   v1.1.0 — 2026-06-14 — Fold the owner's ecosystem apps (GEAIs) into the owner-scope union
  *     (ecosystem-apps foundation, chunk 1).
  *   v1.2.0 — 2026-07-14 — Add listOwnerScopeMemoryMeta (value-free owner-scope listing) for ?include=meta.
+ *   v1.4.0 — 2026-07-26 — Collisions are visible: a shadowed same-key copy under another same-owner
+ *     identity is reported as `alsoUnder` on the survivor instead of vanishing from the result (that
+ *     silent drop is why an agent's newer write looked like it had never happened). The local
+ *     GHII-first loop was also a SECOND copy of MemoryRepository.dedupByKey — now delegated, so the
+ *     ranking rule exists once.
+ *   v1.3.0 — 2026-07-21 — Add getOwnerScopePublicMemory so anonymous public-serve paths (agent face) can
+ *     resolve a record an owner's AGENT published under its own GAII — a non-public record never shadows
+ *     a public one on the same key.
  */
 import type { Storage, MemoryRecord } from '../storage/interface.js';
 import type { MemoryMetaRow } from '../storage/repositories/memory.repository.js';
+/**
+ * A record from an owner-scope listing. `alsoUnder` names every OTHER same-owner identity holding
+ * the same key: those copies lost the GHII-first dedup and are absent from the result, so this is
+ * the only signal that a collision exists at all.
+ */
+export type OwnerScopeRecord = MemoryRecord & {
+    alsoUnder?: string[];
+};
 export interface OwnerScopeListOpts {
     prefix?: string;
     visibility?: string;
@@ -31,7 +49,7 @@ export interface OwnerScopeListOpts {
  * agents in storage order). The owner sees all their own data regardless of visibility — exactly the
  * set `aimeat_memory_list { owner_scope: true }` returns.
  */
-export declare function listOwnerScopeMemory(storage: Storage, nodeId: string, ownerName: string, opts?: OwnerScopeListOpts): Promise<MemoryRecord[]>;
+export declare function listOwnerScopeMemory(storage: Storage, nodeId: string, ownerName: string, opts?: OwnerScopeListOpts): Promise<OwnerScopeRecord[]>;
 /**
  * Owner-scope META listing — the same union + key-dedup as {@link listOwnerScopeMemory}, but each
  * identity is read with `listMemoryMeta` so NO value is ever loaded (backs `?include=meta`). Returns
@@ -41,4 +59,15 @@ export declare function listOwnerScopeMemory(storage: Storage, nodeId: string, o
 export declare function listOwnerScopeMemoryMeta(storage: Storage, nodeId: string, ownerName: string, opts?: OwnerScopeListOpts): Promise<MemoryMetaRow[]>;
 /** Read ONE key across the owner's GHII + all the owner's agents (GHII first). null if found nowhere. */
 export declare function getOwnerScopeMemory(storage: Storage, nodeId: string, ownerName: string, key: string): Promise<MemoryRecord | null>;
+/**
+ * Read the first PUBLIC record for an exact key across the owner's GHII + all the owner's agents + eco
+ * apps, GHII-first. Unlike {@link getOwnerScopeMemory}, a NON-public record on the same key never
+ * shadows a public one — so this must NOT short-circuit on the GHII copy (a private GHII record must not
+ * hide a public agent record). One query across the whole union, then filter to `visibility === 'public'`
+ * and pick the highest-priority (GHII-first) survivor. null if no public copy exists anywhere.
+ *
+ * Used by anonymous public-serve paths (the Agent Face) where only `visibility:'public'` is servable and
+ * an owner's agent may have written the record under its own GAII (memory is keyed by the writer).
+ */
+export declare function getOwnerScopePublicMemory(storage: Storage, nodeId: string, ownerName: string, key: string): Promise<MemoryRecord | null>;
 //# sourceMappingURL=owner-memory.d.ts.map

package/dist/src/services/owner-memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-memory.d.ts","sourceRoot":"","sources":["../../../src/services/owner-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,yBAAyB,EAAE,aAAa,CAAC;CAC5D;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAC7E,OAAO,CAAC,YAAY,EAAE,CAAC,CAWzB;AAcD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAC7E,OAAO,CAAC,aAAa,EAAE,CAAC,CAQ1B;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAC/D,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B"}
+{"version":3,"file":"owner-memory.d.ts","sourceRoot":"","sources":["../../../src/services/owner-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAGlF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,yBAAyB,EAAE,aAAa,CAAC;CAC5D;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAC7E,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAW7B;AAcD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAC7E,OAAO,CAAC,aAAa,EAAE,CAAC,CAQ1B;AAED,yGAAyG;AACzG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAC/D,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAiB9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAC/D,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW9B"}

package/dist/src/services/owner-memory.js

@@ -1,3 +1,4 @@
+import { MemoryRepository } from '../storage/repositories-impl/memory-repository.js';
 /**
  * List memory across the owner's GHII + all the owner's agents, deduped by key (GHII first, then
  * agents in storage order). The owner sees all their own data regardless of visibility — exactly the
@@ -15,21 +16,14 @@ export async function listOwnerScopeMemory(storage, nodeId, ownerName, opts) {
     const rows = await storage.listMemoryForOwners(identities, opts);
     return dedupGhiiFirst(rows, identities);
 }
-/** Order rows by identity priority (GHII first, then agents, then eco apps — the `identities` order)
- *  and keep the first occurrence of each key, so the GHII copy wins when a key exists under several
- *  identities. Mirrors the old per-identity loop's GHII-first dedup. */
+/**
+ * GHII-first key dedup. Delegates to {@link MemoryRepository.dedupByKey} — this module used to
+ * carry a second, independent copy of the same loop even though the repository's version says it
+ * was moved there "so every owner-scope read shares one implementation". Two copies of a ranking
+ * rule is exactly where behaviour drifts, so there is now one.
+ */
 function dedupGhiiFirst(rows, identities) {
-    const priority = new Map(identities.map((id, i) => [id, i]));
-    const ranked = [...rows].sort((a, b) => (priority.get(a.ownerGaii) ?? identities.length) - (priority.get(b.ownerGaii) ?? identities.length));
-    const seen = new Set();
-    const out = [];
-    for (const r of ranked) {
-        if (!seen.has(r.key)) {
-            seen.add(r.key);
-            out.push(r);
-        }
-    }
-    return out;
+    return MemoryRepository.dedupByKey(rows, identities);
 }
 /**
  * Owner-scope META listing — the same union + key-dedup as {@link listOwnerScopeMemory}, but each
@@ -68,4 +62,27 @@ export async function getOwnerScopeMemory(storage, nodeId, ownerName, key) {
     rows.sort((a, b) => (priority.get(a.ownerGaii) ?? others.length) - (priority.get(b.ownerGaii) ?? others.length));
     return rows[0];
 }
+/**
+ * Read the first PUBLIC record for an exact key across the owner's GHII + all the owner's agents + eco
+ * apps, GHII-first. Unlike {@link getOwnerScopeMemory}, a NON-public record on the same key never
+ * shadows a public one — so this must NOT short-circuit on the GHII copy (a private GHII record must not
+ * hide a public agent record). One query across the whole union, then filter to `visibility === 'public'`
+ * and pick the highest-priority (GHII-first) survivor. null if no public copy exists anywhere.
+ *
+ * Used by anonymous public-serve paths (the Agent Face) where only `visibility:'public'` is servable and
+ * an owner's agent may have written the record under its own GAII (memory is keyed by the writer).
+ */
+export async function getOwnerScopePublicMemory(storage, nodeId, ownerName, key) {
+    const ownerGhii = `${ownerName}@${nodeId}`;
+    const agents = await storage.getAgentsByOwner(ownerName);
+    const ecoApps = await storage.getEcosystemAppsByOwner(ownerName);
+    const identities = [ownerGhii, ...agents.map(a => a.gaii), ...ecoApps.map(e => e.geai)];
+    const rows = (await storage.listMemoryForOwners(identities, { prefix: key, visibility: 'public' }))
+        .filter(r => r.key === key);
+    if (!rows.length)
+        return null;
+    const priority = new Map(identities.map((id, i) => [id, i]));
+    rows.sort((a, b) => (priority.get(a.ownerGaii) ?? identities.length) - (priority.get(b.ownerGaii) ?? identities.length));
+    return rows[0];
+}
 //# sourceMappingURL=owner-memory.js.map

package/dist/src/services/owner-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-memory.js","sourceRoot":"","sources":["../../../src/services/owner-memory.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,IAAyB;IAE9E,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,iGAAiG;IACjG,mGAAmG;IACnG,gDAAgD;IAChD,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,mGAAmG;IACnG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;wEAEwE;AACxE,SAAS,cAAc,CAA+C,IAAS,EAAE,UAAoB;IACnG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7I,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,IAAyB;IAE9E,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,GAAW;IAEhE,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,qGAAqG;IACrG,qGAAqG;IACrG,uGAAuG;IACvG,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACjH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"file":"owner-memory.js","sourceRoot":"","sources":["../../../src/services/owner-memory.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AAiBrF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,IAAyB;IAE9E,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,iGAAiG;IACjG,mGAAmG;IACnG,gDAAgD;IAChD,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,mGAAmG;IACnG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,IAAS,EAAE,UAAoB;IAE/B,OAAO,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,IAAyB;IAE9E,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrE,OAAO,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,GAAW;IAEhE,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,qGAAqG;IACrG,qGAAqG;IACrG,uGAAuG;IACvG,sEAAsE;IACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACjH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAAE,MAAc,EAAE,SAAiB,EAAE,GAAW;IAEhE,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;SAChG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC"}

package/dist/src/services/owner-provisioning.d.ts

@@ -1,5 +1,10 @@
 import type { AimeatConfig } from '../config.js';
 import type { Storage, GHIIRecord, OwnerRecord } from '../storage/interface.js';
+/** Thrown by provisionOwner when the requested verified email is already bound to another account.
+ *  Callers map it to a 409 EMAIL_TAKEN. */
+export declare class ProvisionEmailTakenError extends Error {
+    constructor(message: string);
+}
 export interface ProvisionOwnerOpts {
     /** Bare owner name (already validated + confirmed free by the caller). */
     username: string;

package/dist/src/services/owner-provisioning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-provisioning.d.ts","sourceRoot":"","sources":["../../../src/services/owner-provisioning.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAQhF,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kGAAkG;IAClG,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAyD3B"}
+{"version":3,"file":"owner-provisioning.d.ts","sourceRoot":"","sources":["../../../src/services/owner-provisioning.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAQhF;2CAC2C;AAC3C,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kGAAkG;IAClG,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAqE3B"}

package/dist/src/services/owner-provisioning.js

@@ -5,9 +5,12 @@
  *   profile (optionally with a password hash, a verified email, and/or a linked external identity),
  *   and records the welcome-bonus transaction. Used by the OIDC signup finalize path and the email
  *   invitation accept path so account creation stays identical across entry points.
- * @structure ProvisionOwnerOpts / ProvisionedOwner; provisionOwner(storage, config, opts).
+ * @structure ProvisionEmailTakenError; ProvisionOwnerOpts / ProvisionedOwner; provisionOwner(storage, config, opts).
  * @usage const { owner, ghii } = await provisionOwner(storage, config, { username, displayName, passwordHash });
  * @version-history
+ *   v1.1.0 — 2026-07-19 — Enforce one-verified-email-per-account-per-node: reject a verifiedEmail already
+ *     bound elsewhere BEFORE creating any rows (ProvisionEmailTakenError), so the DB-unique emailHash can
+ *     never leave a dangling owner.
  *   v1.0.0 — 2026-07-04 — Extracted from oauth-login.createOwnerForProvider + /v1/ghii register, for
  *     reuse by the email-invitation accept flow.
  */
@@ -17,6 +20,11 @@ import { generateKeyPair } from '../auth/keypair.js';
 function emailHashOf(email) {
     return createHash('sha256').update(email.toLowerCase().trim()).digest('hex');
 }
+/** Thrown by provisionOwner when the requested verified email is already bound to another account.
+ *  Callers map it to a 409 EMAIL_TAKEN. */
+export class ProvisionEmailTakenError extends Error {
+    constructor(message) { super(message); this.name = 'ProvisionEmailTakenError'; }
+}
 /**
  * Create a fresh owner + GHII with the welcome bonus. The caller MUST have already validated that
  * `username` is a valid, free owner name. Promotes the account to operator when it is the first real
@@ -25,6 +33,16 @@ function emailHashOf(email) {
 export async function provisionOwner(storage, config, opts) {
     const { username, displayName } = opts;
     const now = new Date().toISOString();
+    // One-email-per-account-per-node: refuse to provision a verified email already bound elsewhere BEFORE
+    // creating any rows (the GHII's emailHash is DB-unique — creating the owner first would leave a
+    // dangling owner when createGHII hit the constraint). Callers surface this as a clean 4xx.
+    const verifiedEmail = opts.verifiedEmail ? opts.verifiedEmail.toLowerCase().trim() : null;
+    if (verifiedEmail) {
+        const taken = await storage.getGHIIByEmailHash(emailHashOf(verifiedEmail));
+        if (taken) {
+            throw new ProvisionEmailTakenError(`Email already registered to ${taken.ghii}`);
+        }
+    }
     const keyPair = await generateKeyPair();
     // First real owner becomes operator (self-heal: also promote if no operator exists anywhere).
     const allOwners = await storage.listOwners();
@@ -40,7 +58,7 @@ export async function provisionOwner(storage, config, opts) {
         roles,
         createdAt: now,
     });
-    const verified = opts.verifiedEmail ? opts.verifiedEmail.toLowerCase().trim() : null;
+    const verified = verifiedEmail;
     const ghii = `${username}@${config.nodeId}`;
     const ghiiRecord = await storage.createGHII({
         username,