aimeat 2.6.1 → 3.0.0

package/dist/src/services/attestation.js

@@ -0,0 +1,142 @@
+/**
+ * @file src/services/attestation.ts
+ * @description Dual-signed attestations (TINKI phase 1): an append-only record two to four
+ *   principals co-sign with their REGISTERED Ed25519 keys — the trade-deed primitive ("both
+ *   agents signed this exact payload"), generic for any co-signed fact (a deed, a contract
+ *   acceptance, a handover receipt). The payload is canonicalized (sorted keys) and hashed
+ *   (sha256); each party signs `aimeat-attest:{id}:{payloadHash}` client-side with the same key
+ *   their auth already uses; the node verifies against the key it has on record. When every party
+ *   has signed, the record completes and nothing can be added or changed.
+ *
+ *   Immutability without a schema change: records live under the reserved `sys:attest` namespace,
+ *   which no principal-writable path can ever reach (resolveIdentity yields `owner@node`,
+ *   `agent#owner@node` or `eco:app#owner@node`; extensions write `ext:{name}` — none collide with
+ *   `sys:`). Only this service writes there, and it refuses everything after completion.
+ * @structure AttestationRecord · canonicalJson · createAttestation · signAttestation ·
+ *   getAttestation · verifyAttestation
+ * @usage import { createAttestation, signAttestation } from '../services/attestation.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-06 — Initial dual-sign service (TINKI phase 1)
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { verify } from '../auth/keypair.js';
+import { parseGAII } from '../utils/gaii.js';
+import { CommerceError } from '../commerce/errors.js';
+/** Reserved server-only namespace — see the header for why no principal can write here. */
+const ATTEST_NAMESPACE = 'sys:attest';
+const attestKey = (id) => `attestation.${id}`;
+/** Deterministic JSON: object keys sorted at every depth, arrays kept in order. */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(',')}}`;
+}
+/** The exact string a party signs. */
+export const attestMessage = (id, payloadHash) => `aimeat-attest:${id}:${payloadHash}`;
+/** The registered verification key for a party identity, or null when the party is unknown. */
+async function publicKeyFor(storage, identity) {
+    if (identity.includes('#')) {
+        const agent = await storage.getAgent(identity);
+        return agent?.publicKey ?? null;
+    }
+    const parsed = parseGAII(identity);
+    const owner = parsed?.owner ?? identity.split('@')[0];
+    if (!owner)
+        return null;
+    const rec = await storage.getOwner(owner);
+    return rec?.publicKey ?? null;
+}
+async function putAttestation(storage, att) {
+    const existing = await storage.getMemory(ATTEST_NAMESPACE, attestKey(att.id));
+    const now = new Date().toISOString();
+    await storage.setMemory({
+        key: attestKey(att.id), ownerGaii: ATTEST_NAMESPACE, value: att,
+        visibility: 'public', tags: ['attestation'], ttlHours: null,
+        version: (existing?.version ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now,
+    });
+}
+export async function createAttestation(storage, _config, args) {
+    const parties = [...new Set(args.parties)];
+    if (parties.length < 2 || parties.length > 4) {
+        throw new CommerceError('INVALID_PARTIES', 422, 'An attestation needs 2-4 distinct parties');
+    }
+    if (!parties.includes(args.creatorIdentity)) {
+        throw new CommerceError('CREATOR_NOT_PARTY', 403, 'The creator must be one of the parties');
+    }
+    const canonical = canonicalJson(args.payload ?? null);
+    if (canonical.length > 64 * 1024) {
+        throw new CommerceError('PAYLOAD_TOO_LARGE', 422, 'Attestation payload over 64 KB — store the bulk elsewhere and attest its hash');
+    }
+    for (const party of parties) {
+        if (!(await publicKeyFor(storage, party))) {
+            throw new CommerceError('PARTY_NOT_FOUND', 404, `No registered signing key for party: ${party}`);
+        }
+    }
+    const att = {
+        id: `att-${randomUUID()}`,
+        state: 'open',
+        payload: args.payload ?? null,
+        payloadHash: createHash('sha256').update(canonical).digest('hex'),
+        parties,
+        signatures: {},
+        reference: args.reference,
+        createdBy: args.creatorIdentity,
+        createdAt: new Date().toISOString(),
+    };
+    await putAttestation(storage, att);
+    return att;
+}
+export async function getAttestation(storage, id) {
+    const rec = await storage.getMemory(ATTEST_NAMESPACE, attestKey(id));
+    if (!rec)
+        throw new CommerceError('ATTESTATION_NOT_FOUND', 404, `No attestation ${id}`);
+    return rec.value;
+}
+export async function signAttestation(storage, _config, args) {
+    const att = await getAttestation(storage, args.id);
+    if (att.state === 'complete') {
+        throw new CommerceError('ATTESTATION_COMPLETE', 409, 'This attestation is complete — nothing can be added');
+    }
+    if (!att.parties.includes(args.signerIdentity)) {
+        throw new CommerceError('NOT_A_PARTY', 403, 'Only a listed party may sign');
+    }
+    if (att.signatures[args.signerIdentity]) {
+        throw new CommerceError('ALREADY_SIGNED', 409, 'This party has already signed');
+    }
+    const publicKey = await publicKeyFor(storage, args.signerIdentity);
+    if (!publicKey) {
+        throw new CommerceError('PARTY_NOT_FOUND', 404, `No registered signing key for ${args.signerIdentity}`);
+    }
+    const ok = await verify(publicKey, attestMessage(att.id, att.payloadHash), args.signature);
+    if (!ok) {
+        throw new CommerceError('BAD_SIGNATURE', 422, `Signature does not verify — sign the exact string "${attestMessage(att.id, att.payloadHash)}" with your registered Ed25519 key`);
+    }
+    att.signatures[args.signerIdentity] = { signature: args.signature, signedAt: new Date().toISOString() };
+    if (att.parties.every((p) => att.signatures[p])) {
+        att.state = 'complete';
+        att.completedAt = new Date().toISOString();
+    }
+    await putAttestation(storage, att);
+    return att;
+}
+/** Recompute the hash and re-verify every signature — the public "is this deed real" answer. */
+export async function verifyAttestation(storage, att) {
+    const canonical = canonicalJson(att.payload ?? null);
+    const hash = createHash('sha256').update(canonical).digest('hex');
+    if (hash !== att.payloadHash)
+        return false;
+    for (const party of att.parties) {
+        const sig = att.signatures[party];
+        if (!sig)
+            return att.state === 'open' ? true : false;
+        const publicKey = await publicKeyFor(storage, party);
+        if (!publicKey || !(await verify(publicKey, attestMessage(att.id, att.payloadHash), sig.signature)))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=attestation.js.map

package/dist/src/services/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../../../src/services/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC;AAkBtD,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAE,WAAmB,EAAU,EAAE,CAAC,iBAAiB,EAAE,IAAI,WAAW,EAAE,CAAC;AAE/G,+FAA+F;AAC/F,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,QAAgB;IAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAsB;IACpE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAyC;QACrG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI;QAC3D,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG,EAAE,SAAS,EAAE,GAAG;KAC7F,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,OAAqB,EAAE,IAKhF;IACC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,2CAA2C,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,GAAG,EAAE,+EAA+E,CAAC,CAAC;IACrI,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,wCAAwC,KAAK,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAsB;QAC7B,EAAE,EAAE,OAAO,UAAU,EAAE,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;QAC7B,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACjE,OAAO;QACP,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,eAAe;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,EAAU;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC,KAAqC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAqB,EAAE,IAI9E;IACC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,sBAAsB,EAAE,GAAG,EAAE,qDAAqD,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACnE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,GAAG,EAAE,iCAAiC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,GAAG,EAC1C,sDAAsD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IACtI,CAAC;IACD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC;QACvB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAsB;IAC9E,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,GAAG,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACpH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/services/board-post.d.ts

@@ -0,0 +1,79 @@
+import type { AimeatConfig } from '../config.js';
+import type { Storage, BoardPostRecord } from '../storage/interface.js';
+import { provenanceForWrite } from './ai-provenance.js';
+/** The bounds BoardPostSchema applies on the HTTP door, named here so both doors share them. */
+export declare const BOARD_POST_LIMITS: {
+    readonly titleMax: 256;
+    readonly bodyMax: 200000;
+    readonly categoryMax: 64;
+    readonly tagsMax: 20;
+    readonly tagMax: 64;
+};
+export interface BoardPostCaller {
+    /** The resolved identity that authors the post. */
+    gaii: string;
+    roles: string[];
+}
+export interface BoardPostInput {
+    boardId: string;
+    title: string;
+    body: string;
+    category?: string;
+    tags?: string[];
+    ttlHours?: number;
+    declaredProvenanceId?: string;
+    declaredProvenance?: Parameters<typeof provenanceForWrite>[1]['declared'];
+    /** Which road this came down, for the provenance record. */
+    pipeline: string;
+}
+export type BoardPostResult = {
+    ok: true;
+    post: BoardPostRecord;
+    charged: number;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * Write one board post. The order is the route's order, and every step in it is a step the MCP tool
+ * did not have.
+ */
+export declare function createBoardPost(deps: {
+    storage: Storage;
+    config: AimeatConfig;
+}, caller: BoardPostCaller, input: BoardPostInput): Promise<BoardPostResult>;
+export type BoardReplyResult = {
+    ok: true;
+    reply: BoardPostRecord;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * Reply to a post on a board.
+ *
+ * Two things were wrong with this being written out twice. Neither copy applied the board's ACCESS
+ * rule — both checked only that the parent post exists — so a reply could land on a board the
+ * replier may not post to, which the post path has always refused. And the MCP copy stamped the
+ * provenance with `visibility: 'public'` unconditionally, so a reply on a PRIVATE board carried a
+ * public-surface label; the HTTP copy read the board and got it right.
+ *
+ * The hash covers the BODY alone. The "Re: …" title is generated here, and hashing our own prefix
+ * would describe bytes the author never wrote.
+ */
+export declare function createBoardReply(deps: {
+    storage: Storage;
+    config: AimeatConfig;
+}, caller: BoardPostCaller, input: {
+    boardId: string;
+    postId: string;
+    body: string;
+    declaredProvenanceId?: string;
+    declaredProvenance?: Parameters<typeof provenanceForWrite>[1]['declared'];
+    pipeline: string;
+}): Promise<BoardReplyResult>;
+//# sourceMappingURL=board-post.d.ts.map

package/dist/src/services/board-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-post.d.ts","sourceRoot":"","sources":["../../../src/services/board-post.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAe,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC5B,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AA0BnE;;;GAGG;AACH,wBAAsB,eAAe,CACjC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,EAChD,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAiG1B;AAED,MAAM,MAAM,gBAAgB,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAClC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,EAChD,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,QAAQ,EAAE,MAAM,CAAC;CACpB,GACF,OAAO,CAAC,gBAAgB,CAAC,CAiD3B"}

package/dist/src/services/board-post.js

@@ -0,0 +1,215 @@
+/**
+ * @file src/services/board-post.ts
+ * @description Posting to a board, once, for every surface that can post.
+ *
+ *   WHY THIS FILE EXISTS. `POST /v1/boards/:boardId/posts` loads the board and rules on the post
+ *   before writing it. `aimeat_board_post` never loaded the board at all, so it had none of it:
+ *
+ *     - ACCESS. A private board takes posts from its owner only; a shared board from its owner, the
+ *       same owner's other principals, and whoever is on `allowedGaiis`; a system board from an
+ *       operator. Over MCP any agent holding `social:write` posted into any of them, including
+ *       another owner's private board.
+ *     - THE COST. A public board charges morsels per post, scaled by length, and refuses with 402
+ *       when the balance does not cover it. Over MCP it was free, so the anti-flood price on the one
+ *       surface everybody reads applied only to the door nobody uses.
+ *     - THE EXTENSION HOOK. `pre_board_post` lets an installed extension refuse a post. It never ran
+ *       over MCP, so a moderation extension was advisory on the agent surface.
+ *     - THE SHAPE. Title 1-256, body 1-200 000, category up to 64, at most 20 tags of 64. The tool
+ *       took `z.string()` for both, so an empty post and an arbitrarily large one both stored.
+ *
+ *   One capability, one implementation, whatever the interface — CLAUDE.md, Backend.
+ * @structure
+ *   - BOARD_POST_LIMITS — the shape bounds, shared with the REST validator
+ *   - createBoardPost() — access, hook, price, provenance, record; a refusal or the post
+ *   - createBoardReply() — the same access rule, which neither door applied to a reply
+ * @usage
+ *   const out = await createBoardPost({ storage, config }, caller, input);
+ *   if (!out.ok) return renderRefusal(out);   // each door renders its own way
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial (August 2026 audit step 3, option B: shared service, gate inside).
+ */
+import { randomBytes, randomUUID } from 'node:crypto';
+import { executeHooks } from './hooks.js';
+import { provenanceForWrite } from './ai-provenance.js';
+import { isSameOwner } from '../utils/gaii.js';
+import { emitChange } from './event-bus.js';
+import { notifyBoardSubscribers } from './board-subscribers.js';
+/** The bounds BoardPostSchema applies on the HTTP door, named here so both doors share them. */
+export const BOARD_POST_LIMITS = {
+    titleMax: 256,
+    bodyMax: 200_000,
+    categoryMax: 64,
+    tagsMax: 20,
+    tagMax: 64,
+};
+/** Default lifetime of a post when the caller names none: seven days, as the route has always used. */
+const DEFAULT_TTL_HOURS = 168;
+/** May this caller put text on this board? A post and a reply ask the same question. */
+function boardPostAccessRefusal(board, caller) {
+    if (board.visibility === 'system' && !caller.roles.includes('operator')) {
+        return { ok: false, status: 403, code: 'ACCESS_DENIED', message: 'Only operators can post to system boards' };
+    }
+    if (board.visibility === 'private' && board.ownerGaii !== caller.gaii) {
+        return { ok: false, status: 403, code: 'ACCESS_DENIED', message: 'Cannot post to this private board' };
+    }
+    if (board.visibility === 'shared'
+        && board.ownerGaii !== caller.gaii
+        && !isSameOwner(board.ownerGaii, caller.gaii)
+        && !board.allowedGaiis.includes(caller.gaii)) {
+        return { ok: false, status: 403, code: 'ACCESS_DENIED', message: 'You are not invited to this board' };
+    }
+    return null;
+}
+/**
+ * Write one board post. The order is the route's order, and every step in it is a step the MCP tool
+ * did not have.
+ */
+export async function createBoardPost(deps, caller, input) {
+    const { storage, config } = deps;
+    const board = await storage.getBoard(input.boardId);
+    if (!board) {
+        return { ok: false, status: 404, code: 'NOT_FOUND', message: `Board not found: ${input.boardId}` };
+    }
+    // Shape, before anything is charged or written.
+    const title = String(input.title ?? '').trim();
+    const body = String(input.body ?? '');
+    if (!title || title.length > BOARD_POST_LIMITS.titleMax) {
+        return { ok: false, status: 400, code: 'VALIDATION_ERROR', message: `title must be 1-${BOARD_POST_LIMITS.titleMax} characters` };
+    }
+    if (!body || body.length > BOARD_POST_LIMITS.bodyMax) {
+        return { ok: false, status: 400, code: 'VALIDATION_ERROR', message: `body must be 1-${BOARD_POST_LIMITS.bodyMax} characters` };
+    }
+    if (input.category && input.category.length > BOARD_POST_LIMITS.categoryMax) {
+        return { ok: false, status: 400, code: 'VALIDATION_ERROR', message: `category must be at most ${BOARD_POST_LIMITS.categoryMax} characters` };
+    }
+    const tags = Array.isArray(input.tags) ? input.tags : [];
+    if (tags.length > BOARD_POST_LIMITS.tagsMax || tags.some(t => String(t).length > BOARD_POST_LIMITS.tagMax)) {
+        return { ok: false, status: 400, code: 'VALIDATION_ERROR', message: `at most ${BOARD_POST_LIMITS.tagsMax} tags of ${BOARD_POST_LIMITS.tagMax} characters` };
+    }
+    // An installed extension may refuse the post. Advisory on one surface is not a moderation rule.
+    const hook = await executeHooks(config, storage, 'pre_board_post', { board_id: input.boardId, author_gaii: caller.gaii });
+    if (!hook.allowed) {
+        return { ok: false, status: 403, code: 'HOOK_REJECTED', message: hook.reason ?? 'Post denied by extension hook' };
+    }
+    // Who may post here — the same question a REPLY asks, which is why it is its own function.
+    const denied = boardPostAccessRefusal(board, caller);
+    if (denied)
+        return denied;
+    // A public board costs, scaled by length. This is the anti-flood price on the one surface
+    // everybody reads, and it applied only to the HTTP door.
+    let charged = 0;
+    if (board.visibility === 'public') {
+        charged = config.boardPostBaseCost + Math.ceil((body.length / 1000) * config.boardPostCostPerKb);
+        const debited = await storage.debitBalance(caller.gaii, charged);
+        if (!debited) {
+            return { ok: false, status: 402, code: 'INSUFFICIENT_MORSELS', message: `Posting costs ${charged} morsels` };
+        }
+        await storage.addTransaction({
+            id: `tx-${randomUUID()}`,
+            gaii: caller.gaii,
+            type: 'spent',
+            amount: -charged,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    // The hash covers title + body together, which is the unit a reader sees.
+    const aiProvenanceId = await provenanceForWrite(storage, {
+        principal: caller.gaii,
+        content: `${title}\n\n${body}`,
+        declaredId: input.declaredProvenanceId,
+        declared: input.declaredProvenance,
+        pipeline: input.pipeline,
+        surface: { visibility: board.visibility === 'public' ? 'public' : 'private', humanAudience: true },
+        labelPolicy: config.aiLabelPublic,
+        nodeId: config.nodeId,
+        baseUrl: config.baseUrl,
+        enabled: config.aiProvenance,
+    });
+    const hours = input.ttlHours ?? DEFAULT_TTL_HOURS;
+    const post = await storage.createPost({
+        id: `post-${randomBytes(8).toString('hex')}`,
+        boardId: input.boardId,
+        authorGaii: caller.gaii,
+        title,
+        body,
+        category: input.category,
+        tags,
+        ttlExpiresAt: new Date(Date.now() + hours * 3600_000).toISOString(),
+        reactions: {},
+        createdAt: new Date().toISOString(),
+        ...(aiProvenanceId ? { aiProvenanceId } : {}),
+    });
+    // The two things that happen BESIDES the write, and both lived in the HTTP route so the tool
+    // surface had neither. A board open in a browser listens on the 'boards' domain, so without the
+    // event an agent's post did not appear until somebody reloaded; and a subscriber is an agent
+    // that asked to be told precisely so it need not poll, so a post made through a tool call was
+    // invisible to every one of them. Both belong to POSTING, not to the door it came through.
+    emitChange('boards');
+    notifyBoardSubscribers(storage, input.boardId, {
+        id: post.id,
+        authorGaii: caller.gaii,
+        title: post.title,
+        category: post.category,
+        tags: post.tags ?? [],
+    });
+    return { ok: true, post, charged };
+}
+/**
+ * Reply to a post on a board.
+ *
+ * Two things were wrong with this being written out twice. Neither copy applied the board's ACCESS
+ * rule — both checked only that the parent post exists — so a reply could land on a board the
+ * replier may not post to, which the post path has always refused. And the MCP copy stamped the
+ * provenance with `visibility: 'public'` unconditionally, so a reply on a PRIVATE board carried a
+ * public-surface label; the HTTP copy read the board and got it right.
+ *
+ * The hash covers the BODY alone. The "Re: …" title is generated here, and hashing our own prefix
+ * would describe bytes the author never wrote.
+ */
+export async function createBoardReply(deps, caller, input) {
+    const { storage, config } = deps;
+    const parent = await storage.getPost(input.boardId, input.postId);
+    if (!parent)
+        return { ok: false, status: 404, code: 'NOT_FOUND', message: 'Post not found' };
+    const board = await storage.getBoard(input.boardId);
+    if (!board)
+        return { ok: false, status: 404, code: 'NOT_FOUND', message: `Board not found: ${input.boardId}` };
+    // A reply is a post. Who may post here is the same question, and neither door was asking it.
+    const denied = boardPostAccessRefusal(board, caller);
+    if (denied)
+        return denied;
+    const body = String(input.body ?? '');
+    if (!body || body.length > BOARD_POST_LIMITS.bodyMax) {
+        return { ok: false, status: 400, code: 'VALIDATION_ERROR', message: `body must be 1-${BOARD_POST_LIMITS.bodyMax} characters` };
+    }
+    const aiProvenanceId = await provenanceForWrite(storage, {
+        principal: caller.gaii,
+        content: body,
+        declaredId: input.declaredProvenanceId,
+        declared: input.declaredProvenance,
+        pipeline: input.pipeline,
+        surface: { visibility: board.visibility === 'public' ? 'public' : 'private', humanAudience: true },
+        labelPolicy: config.aiLabelPublic,
+        nodeId: config.nodeId,
+        baseUrl: config.baseUrl,
+        enabled: config.aiProvenance,
+    });
+    const reply = await storage.createPost({
+        id: `reply-${randomBytes(8).toString('hex')}`,
+        boardId: input.boardId,
+        authorGaii: caller.gaii,
+        title: `Re: ${parent.title}`,
+        body,
+        tags: [],
+        reactions: {},
+        replyTo: input.postId,
+        createdAt: new Date().toISOString(),
+        ...(aiProvenanceId ? { aiProvenanceId } : {}),
+    });
+    emitChange('boards');
+    notifyBoardSubscribers(storage, input.boardId, {
+        id: reply.id, authorGaii: caller.gaii, title: reply.title, tags: [],
+    });
+    return { ok: true, reply };
+}
+//# sourceMappingURL=board-post.js.map

package/dist/src/services/board-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-post.js","sourceRoot":"","sources":["../../../src/services/board-post.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,gGAAgG;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,EAAE;IACf,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;CACJ,CAAC;AAyBX,uGAAuG;AACvG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAG9B,wFAAwF;AACxF,SAAS,sBAAsB,CAC3B,KAAqE,EACrE,MAAuB;IAEvB,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;WAC1B,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI;WAC/B,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;WAC1C,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,IAAgD,EAChD,MAAuB,EACvB,KAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACvG,CAAC;IAED,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,iBAAiB,CAAC,QAAQ,aAAa,EAAE,CAAC;IACrI,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,iBAAiB,CAAC,OAAO,aAAa,EAAE,CAAC;IACnI,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,iBAAiB,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,iBAAiB,CAAC,WAAW,aAAa,EAAE,CAAC;IACjJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,iBAAiB,CAAC,OAAO,YAAY,iBAAiB,CAAC,MAAM,aAAa,EAAE,CAAC;IAChK,CAAC;IAED,gGAAgG;IAChG,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAAC;IACtH,CAAC;IAED,2FAA2F;IAC3F,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,iBAAiB,OAAO,UAAU,EAAE,CAAC;QACjH,CAAC;QACD,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,OAAO;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QACrD,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,OAAO,EAAE,GAAG,KAAK,OAAO,IAAI,EAAE;QAC9B,UAAU,EAAE,KAAK,CAAC,oBAAoB;QACtC,QAAQ,EAAE,KAAK,CAAC,kBAAkB;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE;QAClG,WAAW,EAAE,MAAM,CAAC,aAAa;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAClC,EAAE,EAAE,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,KAAK;QACL,IAAI;QACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI;QACJ,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;QACnE,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,6FAA6F;IAC7F,gGAAgG;IAChG,6FAA6F;IAC7F,8FAA8F;IAC9F,2FAA2F;IAC3F,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACxB,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,IAAgD,EAChD,MAAuB,EACvB,KAOC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAE7F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAE/G,6FAA6F;IAC7F,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,iBAAiB,CAAC,OAAO,aAAa,EAAE,CAAC;IACnI,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QACrD,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,KAAK,CAAC,oBAAoB;QACtC,QAAQ,EAAE,KAAK,CAAC,kBAAkB;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE;QAClG,WAAW,EAAE,MAAM,CAAC,aAAa;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACnC,EAAE,EAAE,SAAS,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,EAAE;QAC5B,IAAI;QACJ,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IAEH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;QAC3C,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;KACtE,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/src/services/board-read-access.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @file src/services/board-read-access.ts
+ * @description Who may READ a board's posts, once, for every surface that serves them.
+ *
+ *   The sweep that produced this file asked what a WRITE owes. This is the other half: what a READ
+ *   owes, which nobody had asked, and it turned out to hide a cross-owner read.
+ *
+ *   `aimeat_board_read` called storage.listPosts(board_id) and nothing else — it never loaded the
+ *   board, so it never had a visibility to rule on. Any MCP session could read another owner's
+ *   PRIVATE board, and no consent-denial row existed to show that it happened. The tool's own scope
+ *   entry justified leaving it ungated with "the REST GET route is public", which is true of public
+ *   and system boards and of no others.
+ *
+ *   Two doors to the same board also disagreed with each other: the MCP RESOURCE template
+ *   (aimeat://boards/{id}) filtered on visibility, and the TOOL beside it did not.
+ *
+ *   The rule here is the HTTP route's rule, in the same order: public and system are open; the owner
+ *   always; a shared board also to that owner's other principals and to anyone on allowedGaiis; and
+ *   failing all of those, the consent layer, whose refusal is audited because a denied read is
+ *   exactly the event a person asks about afterwards.
+ * @structure
+ *   - boardReadRefusal() — a refusal, or null when the read is allowed
+ * @usage
+ *   const refusal = await boardReadRefusal({ storage, config }, gaii, board);
+ *   if (refusal) return fail(refusal.message);
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted from routes/boards.ts (August 2026 audit, the side-effect sweep's
+ *     read-path half) after aimeat_board_read was found reading private boards.
+ */
+import type { AimeatConfig } from '../config.js';
+import type { Storage, BoardRecord } from '../storage/interface.js';
+export interface BoardReadRefusal {
+    status: number;
+    code: 'AUTH_REQUIRED' | 'CONSENT_REQUIRED' | 'ACCESS_DENIED';
+    message: string;
+}
+/**
+ * May `gaii` read this board's posts? Returns null when the read is allowed.
+ *
+ * `gaii` is undefined for an unauthenticated caller, which only a public or system board serves.
+ */
+export declare function boardReadRefusal(deps: {
+    storage: Storage;
+    config: AimeatConfig;
+}, gaii: string | undefined, board: Pick<BoardRecord, 'id' | 'visibility' | 'ownerGaii' | 'allowedGaiis'>): Promise<BoardReadRefusal | null>;
+//# sourceMappingURL=board-read-access.d.ts.map

package/dist/src/services/board-read-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-read-access.d.ts","sourceRoot":"","sources":["../../../src/services/board-read-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAIpE,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,eAAe,GAAG,kBAAkB,GAAG,eAAe,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAClC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,EAChD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC,GAC7E,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA2BlC"}

package/dist/src/services/board-read-access.js

@@ -0,0 +1,30 @@
+import { isSameOwner } from '../utils/gaii.js';
+import { checkConsentForRead, auditDataAccess } from './consent.js';
+/**
+ * May `gaii` read this board's posts? Returns null when the read is allowed.
+ *
+ * `gaii` is undefined for an unauthenticated caller, which only a public or system board serves.
+ */
+export async function boardReadRefusal(deps, gaii, board) {
+    const { storage, config } = deps;
+    if (board.visibility === 'public' || board.visibility === 'system')
+        return null;
+    if (!gaii) {
+        return { status: 401, code: 'AUTH_REQUIRED', message: 'Authentication required for non-public boards' };
+    }
+    // isSameOwner only grants access on shared boards — a private board is strictly owner-only.
+    const sameOwnerAccess = board.visibility === 'shared' && isSameOwner(board.ownerGaii, gaii);
+    if (board.ownerGaii === gaii || sameOwnerAccess || board.allowedGaiis.includes(gaii))
+        return null;
+    if (!config.consentEnabled) {
+        return { status: 403, code: 'ACCESS_DENIED', message: 'You do not have access to this board' };
+    }
+    const consentResult = await checkConsentForRead(storage, `board:${board.id}`, board.ownerGaii, gaii, board.visibility);
+    if (consentResult.allowed)
+        return null;
+    // Denials only — an allowed read is not logged (see consent-audit-buffer). A denial is the event
+    // somebody asks about later, so it is the one that has to exist.
+    await auditDataAccess(storage, consentResult.consentId ?? null, board.ownerGaii, gaii, `board:${board.id}`, 'read', false);
+    return { status: 403, code: 'CONSENT_REQUIRED', message: 'You do not have consent to access this board' };
+}
+//# sourceMappingURL=board-read-access.js.map

package/dist/src/services/board-read-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-read-access.js","sourceRoot":"","sources":["../../../src/services/board-read-access.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,IAAgD,EAChD,IAAwB,EACxB,KAA4E;IAE5E,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEhF,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAC5G,CAAC;IAED,4FAA4F;IAC5F,MAAM,eAAe,GAAG,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC3C,OAAO,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CACxE,CAAC;IACF,IAAI,aAAa,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEvC,iGAAiG;IACjG,iEAAiE;IACjE,MAAM,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,IAAI,IAAI,EAC1D,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;AAC9G,CAAC"}

package/dist/src/services/board-subscribers.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @file src/services/board-subscribers.ts
+ * @description Telling a board's subscribers that a post landed.
+ *
+ *   It moved out of routes/boards.ts because the MCP door could not reach it there: the function was
+ *   a closure inside workBoardRouter, so `aimeat_board_post` wrote the post and nobody heard about
+ *   it. A subscriber is an agent that asked to be told — the whole point is that it does not poll —
+ *   so a post made through a tool call was invisible to every one of them until they looked.
+ *
+ *   Fire-and-forget by design: a subscriber whose callback is down must not fail the post. The
+ *   outbound call goes through safeFetch, which validates the URL and re-validates redirects, because
+ *   the callback URL is supplied by the subscriber and a redirect bounce is otherwise an SSRF.
+ * @structure
+ *   - notifyBoardSubscribers() — one call per post, returns immediately
+ * @usage notifyBoardSubscribers(storage, boardId, { id, authorGaii, title, category, tags });
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted from routes/boards.ts so both doors notify (August 2026 audit,
+ *     the side-effect sweep).
+ */
+import type { Storage } from '../storage/interface.js';
+export declare function notifyBoardSubscribers(storage: Storage, boardId: string, post: {
+    id: string;
+    authorGaii: string;
+    title: string;
+    category?: string;
+    tags: string[];
+}): void;
+//# sourceMappingURL=board-subscribers.d.ts.map

package/dist/src/services/board-subscribers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-subscribers.d.ts","sourceRoot":"","sources":["../../../src/services/board-subscribers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAOvD,wBAAgB,sBAAsB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3F,IAAI,CA2BN"}

package/dist/src/services/board-subscribers.js

@@ -0,0 +1,37 @@
+import { safeFetch } from '../utils/url-validator.js';
+import { logger } from '../utils/logger.js';
+/** How long a subscriber's callback has to answer before the delivery is abandoned. */
+const CALLBACK_TIMEOUT_MS = 10_000;
+export function notifyBoardSubscribers(storage, boardId, post) {
+    storage.listBoardSubscriptions(boardId).then(subs => {
+        for (const sub of subs) {
+            // Don't notify the author of their own post
+            if (sub.gaii === post.authorGaii)
+                continue;
+            // Apply category/tag filters if subscriber set them
+            if (sub.filters?.categories?.length && post.category && !sub.filters.categories.includes(post.category))
+                continue;
+            if (sub.filters?.tags?.length && !sub.filters.tags.some(t => post.tags.includes(t)))
+                continue;
+            if (!sub.callbackUrl)
+                continue;
+            safeFetch(sub.callbackUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    event: 'board.new_post',
+                    board_id: boardId,
+                    post_id: post.id,
+                    author_gaii: post.authorGaii,
+                    title: post.title,
+                    category: post.category,
+                    timestamp: new Date().toISOString(),
+                }),
+                signal: AbortSignal.timeout(CALLBACK_TIMEOUT_MS),
+            }).catch(err => {
+                logger.warn('Board subscription notification failed', { boardId, gaii: sub.gaii, error: String(err) });
+            });
+        }
+    }).catch(err => { logger.warn('notifyBoardSubscribers: ignore', { error: String(err) }); });
+}
+//# sourceMappingURL=board-subscribers.js.map

package/dist/src/services/board-subscribers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"board-subscribers.js","sourceRoot":"","sources":["../../../src/services/board-subscribers.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,UAAU,sBAAsB,CAClC,OAAgB,EAChB,OAAe,EACf,IAA0F;IAE1F,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,4CAA4C;YAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC3C,oDAAoD;YACpD,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClH,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9F,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,SAAS;YAC/B,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE;gBACvB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACjB,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,WAAW,EAAE,IAAI,CAAC,UAAU;oBAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACtC,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACnD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACX,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC"}