aimeat 2.6.1 → 3.0.0

package/dist/scripts/check-storage-parity.js

@@ -0,0 +1,121 @@
+/**
+ * @file scripts/check-storage-parity.ts
+ * @description The static half of the storage contract: every table with an owner-scoped column is
+ *   named in the deletion cascade of BOTH providers, or is on a written exemption list. The dynamic
+ *   half is test/unit/storage-conformance.test.ts, which runs the same scenario against both and
+ *   compares the result; this one catches the table nobody thought about, which is how the audit's
+ *   H-30 happened — Postgres cleared five tables where SQLite cleared thirty, and both returned true.
+ *
+ *   Erasure is the reason this is a gate and not a report. The developer decided on 2026-08-10 that a
+ *   deleted username is released rather than reserved, which puts the whole weight on the cascade:
+ *   if nothing owner-scoped survives, there is nothing for the next registrant to inherit.
+ * @structure
+ *   - OWNER_COLUMNS: the column names that make a table owner-scoped
+ *   - main(): read the schema, read both cascades, report tables missing from either
+ * @usage
+ *   cd aimeat && pnpm check:storage-parity            # report
+ *   cd aimeat && pnpm check:storage-parity --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:storage-parity --seed     # rewrite the exemption file
+ * @version-history
+ *   v1.0.0 — 2026-08-10 — Initial (August 2026 audit, step 5c / systemic pattern 5).
+ */
+import { readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const ROOT = process.cwd();
+const PG_SCHEMA = join(ROOT, 'src', 'storage', 'providers', 'postgres-kysely', 'migrations');
+const PG_METHODS = join(ROOT, 'src', 'storage', 'providers', 'postgres-kysely', 'methods');
+const SQLITE_METHODS = join(ROOT, 'src', 'storage', 'providers', 'sqlite', 'methods');
+const EXEMPTIONS = join(ROOT, 'security', 'storage-parity-exemptions.json');
+/** A column of one of these names makes a row belong to somebody. */
+const OWNER_COLUMNS = ['ownerGaii', 'ownerName', 'buyerOwner', 'sellerOwner', 'agentGaii', 'flaggedBy'];
+function readAll(dir) {
+    if (!existsSync(dir))
+        return '';
+    return readdirSync(dir)
+        .filter(f => f.endsWith('.ts') || f.endsWith('.sql'))
+        .map(f => readFileSync(join(dir, f), 'utf-8'))
+        .join('\n');
+}
+/** Tables in the Postgres schema that carry an owner-scoped column. */
+function ownerScopedTables(schema) {
+    const tables = new Map();
+    const re = /CREATE TABLE "(\w+)" \(([\s\S]*?)\n\);/g;
+    let m;
+    while ((m = re.exec(schema))) {
+        const [, table, body] = m;
+        const cols = OWNER_COLUMNS.filter(c => new RegExp(`"${c}"`).test(body));
+        if (cols.length)
+            tables.set(table, cols);
+    }
+    return tables;
+}
+/** The SQLite table name for a Postgres table: PascalCase to snake_case, pluralised loosely. */
+function sqliteCandidates(pgTable) {
+    const snake = pgTable.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+    return [snake, `${snake}s`, `${snake}es`, pgTable.toLowerCase(), `${pgTable.toLowerCase()}s`];
+}
+function main() {
+    const strict = process.argv.includes('--strict');
+    const seed = process.argv.includes('--seed');
+    const schema = readAll(PG_SCHEMA);
+    const pgCascade = readAll(PG_METHODS);
+    const sqliteCascade = readAll(SQLITE_METHODS);
+    const tables = ownerScopedTables(schema);
+    const missing = [];
+    for (const [table, cols] of tables) {
+        // "named in the cascade" is deliberately loose: the delete may be a Kysely deleteFrom, a raw
+        // DELETE, or a helper. What matters is that the table name appears in the provider's delete
+        // paths at all — a table nobody mentions is a table nobody clears.
+        const inPg = new RegExp(`deleteFrom\\('${table}'\\)`).test(pgCascade);
+        const inSqlite = sqliteCandidates(table).some(c => new RegExp(`DELETE FROM ${c}\\b`, 'i').test(sqliteCascade));
+        if (inPg && inSqlite)
+            continue;
+        missing.push({
+            table, columns: cols,
+            where: !inPg && !inSqlite ? 'neither provider' : (!inPg ? 'postgres-kysely' : 'sqlite'),
+        });
+    }
+    if (seed) {
+        const exempt = {};
+        for (const t of missing) {
+            exempt[t.table] = `Seeded 2026-08-10. Owner-scoped by ${t.columns.join('/')} and not cleared in ${t.where}. `
+                + 'Decide: add it to the cascade, or record here why the row must outlive its owner '
+                + '(an immutable ledger entry, a counterparty\'s copy, an anonymised aggregate).';
+        }
+        writeFileSync(EXEMPTIONS, JSON.stringify({
+            note: 'Owner-scoped tables not cleared by one or both deletion cascades. Seeded from the state on '
+                + '2026-08-10 so the gate can only ratchet down. A deleted username is released for reuse '
+                + '(decision 2026-08-10), so anything left here is inheritable by the next registrant.',
+            exempt,
+        }, null, 2) + '\n');
+        console.log(`Seeded ${missing.length} exemptions into ${relative(ROOT, EXEMPTIONS)}`);
+        return;
+    }
+    const exempt = existsSync(EXEMPTIONS)
+        ? JSON.parse(readFileSync(EXEMPTIONS, 'utf-8')).exempt
+        : {};
+    const fresh = missing.filter(t => !exempt[t.table]);
+    console.log('');
+    console.log('  Storage parity — owner-scoped tables vs the deletion cascades');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  owner-scoped tables      ${String(tables.size).padStart(4)}`);
+    console.log(`  not cleared somewhere    ${String(missing.length).padStart(4)}`);
+    console.log(`  NEW, not exempt          ${String(fresh.length).padStart(4)}`);
+    console.log('');
+    if (fresh.length) {
+        for (const t of fresh)
+            console.log(`    ${t.table.padEnd(28)} ${t.columns.join('/').padEnd(22)} missing in ${t.where}`);
+        console.log('');
+        console.log('  A deleted username is released for reuse, so a surviving owner-scoped row is');
+        console.log('  inheritable by whoever registers that name next. Add the table to the cascade,');
+        console.log('  or record in security/storage-parity-exemptions.json why it must outlive its owner.');
+        console.log('');
+    }
+    if (strict && fresh.length) {
+        console.error(`✖ ${fresh.length} owner-scoped table(s) newly outside a deletion cascade.`);
+        process.exit(1);
+    }
+    console.log(fresh.length ? '  (report only — pass --strict to gate)' : '  ✓ no new owner-scoped tables outside the cascades');
+}
+main();
+//# sourceMappingURL=check-storage-parity.js.map

package/dist/scripts/check-storage-parity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-storage-parity.js","sourceRoot":"","sources":["../../scripts/check-storage-parity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;AAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACtF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC;AAE5E,qEAAqE;AACrE,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAIxG,SAAS,OAAO,CAAC,GAAW;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAS,iBAAiB,CAAC,MAAc;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,EAAE,GAAG,yCAAyC,CAAC;IACrD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QACjC,6FAA6F;QAC7F,4FAA4F;QAC5F,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/G,IAAI,IAAI,IAAI,QAAQ;YAAE,SAAS;QAC/B,OAAO,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,OAAO,EAAE,IAAI;YACpB,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;SAC1F,CAAC,CAAC;IACP,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACP,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,sCAAsC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,IAAI;kBACvG,mFAAmF;kBACnF,+EAA+E,CAAC;QAC1F,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,6FAA6F;kBAC7F,yFAAyF;kBACzF,qFAAqF;YAC3F,MAAM;SACQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAmB,CAAC,MAAM;QACzE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,0DAA0D,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;AAClI,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-trusted-keys.d.ts

@@ -0,0 +1,9 @@
+interface Finding {
+    file: string;
+    line: number;
+    key: string;
+    identity: string;
+}
+export declare function collectReads(files: string[]): Finding[];
+export {};
+//# sourceMappingURL=check-trusted-keys.d.ts.map

package/dist/scripts/check-trusted-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-trusted-keys.d.ts","sourceRoot":"","sources":["../../scripts/check-trusted-keys.ts"],"names":[],"mappings":"AAmCA,UAAU,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAkB/E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAkBvD"}

package/dist/scripts/check-trusted-keys.js

@@ -0,0 +1,122 @@
+/**
+ * @file scripts/check-trusted-keys.ts
+ * @description The gate for Rule 10 invariant 2: a memory key the server reads and ACTS ON must be
+ *   unreachable by a scoped app or agent. The reason is the whole H-2 grant model: an app-grant
+ *   token resolves to the owner's GHII, so its writes land in the owner's namespace by design. That
+ *   is fine for the owner's data and fatal for the server's own configuration.
+ *
+ *   Two accepted patterns (security-development-dna.md §2): store it under a synthetic system
+ *   identity no owner-scoped principal can address, or put its prefix on the reserved-key denylist.
+ *   The August 2026 audit found the denylist at three prefixes against sixty-nine trusted keys, and
+ *   two of the unprotected ones were a cross-owner authorization list and a payout address with a
+ *   Stripe secret beside it.
+ *
+ *   Ratchet, not a wall: seeded with today's reads, so the gate fails only on a NEW unprotected key.
+ * @structure
+ *   - collectReads(): every resolvable storage.getMemory / getPublicMemory key in the server code
+ *   - main(): compare against security/trusted-key-exemptions.json; --strict gates; --seed rewrites
+ * @usage
+ *   cd aimeat && pnpm check:trusted-keys            # report
+ *   cd aimeat && pnpm check:trusted-keys --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:trusted-keys --seed     # rewrite the exemption file
+ * @version-history
+ *   v1.0.0 — 2026-08-10 — Initial (August 2026 audit, systemic pattern 3).
+ */
+import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { RESERVED_OWNER_KEY_PREFIXES } from '../src/utils/reserved-keys.js';
+const ROOT = process.cwd();
+const AREAS = ['services', 'routes', 'commerce', 'mcp'].map(d => join(ROOT, 'src', d));
+const EXEMPTIONS = join(ROOT, 'security', 'trusted-key-exemptions.json');
+/** Identities no owner-scoped principal can address, so a key under one is already out of reach. */
+const SYSTEM_IDENTITIES = ['__network_policy__', 'SITE_OWNER_GAII', '__genesis__', 'system@', '__system__'];
+function walk(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory())
+            walk(full, out);
+        else if (entry.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** True when the key sits under a prefix the reserved-key guard already refuses for app tokens. */
+function isReserved(key) {
+    return RESERVED_OWNER_KEY_PREFIXES.some(p => key.startsWith(p));
+}
+export function collectReads(files) {
+    const findings = [];
+    // getMemory(identity, 'literal.key') or getMemory(identity, `literal.${x}`) — only the resolvable
+    // ones. A key built entirely from variables cannot be judged here and is not reported.
+    const re = /\b(?:getMemory|getPublicMemory)\s*\(\s*([^,]+?)\s*,\s*(['"`])([A-Za-z0-9_.:-]+)/g;
+    for (const file of files) {
+        const source = readFileSync(file, 'utf-8');
+        const rel = relative(ROOT, file).replace(/\\/g, '/');
+        let m;
+        while ((m = re.exec(source))) {
+            const [, identity, , key] = m;
+            if (isReserved(key))
+                continue;
+            if (SYSTEM_IDENTITIES.some(s => identity.includes(s)))
+                continue;
+            const line = source.slice(0, m.index).split('\n').length;
+            findings.push({ file: rel, line, key, identity: identity.trim().slice(0, 40) });
+        }
+    }
+    return findings;
+}
+const softKey = (f) => `${f.file}:${f.key}`;
+function main() {
+    const strict = process.argv.includes('--strict');
+    const seed = process.argv.includes('--seed');
+    const files = AREAS.flatMap(a => walk(a));
+    const findings = collectReads(files);
+    if (seed) {
+        const exempt = {};
+        for (const f of findings) {
+            exempt[softKey(f)] = 'Seeded 2026-08-10 from the August audit. Not yet reviewed: decide whether the '
+                + 'server ACTS on this value (a URL it fetches, a credential, a policy, a budget, a listing flag) '
+                + 'or merely echoes it back as user data. If it acts on it, reserve the prefix or move it under a '
+                + 'system identity.';
+        }
+        writeFileSync(EXEMPTIONS, JSON.stringify({
+            note: 'Memory keys the server reads that are neither reserved nor under a system identity. Seeded '
+                + 'from the state on 2026-08-10 so the gate can only ratchet down. Most are ordinary user data '
+                + 'the server hands back untouched; the dangerous ones are those it acts on.',
+            exempt,
+        }, null, 2) + '\n');
+        console.log(`Seeded ${findings.length} exemptions into ${relative(ROOT, EXEMPTIONS)}`);
+        return;
+    }
+    const exempt = existsSync(EXEMPTIONS)
+        ? JSON.parse(readFileSync(EXEMPTIONS, 'utf-8')).exempt
+        : {};
+    const known = new Set(Object.keys(exempt));
+    const fresh = findings.filter(f => !known.has(softKey(f)));
+    const distinct = new Set(findings.map(f => f.key));
+    console.log('');
+    console.log('  Server-trusted memory keys — Rule 10 invariant 2');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  reads outside the guard   ${String(findings.length).padStart(4)}   (${distinct.size} distinct keys)`);
+    console.log(`  reserved prefixes         ${String(RESERVED_OWNER_KEY_PREFIXES.length).padStart(4)}   ${RESERVED_OWNER_KEY_PREFIXES.join(' ')}`);
+    console.log(`  NEW, not exempt           ${String(fresh.length).padStart(4)}`);
+    console.log('');
+    if (fresh.length) {
+        console.log('  If the server ACTS on this value, an app the owner granted memory:write can poison it.');
+        console.log('  Reserve the prefix (utils/reserved-keys.ts), move it under a system identity, or record');
+        console.log('  in security/trusted-key-exemptions.json why it is user data rather than configuration.');
+        console.log('');
+        for (const f of fresh)
+            console.log(`    ${f.file}:${f.line}  ${f.key}`);
+        console.log('');
+    }
+    if (strict && fresh.length) {
+        console.error(`✖ ${fresh.length} new unguarded server-read key(s).`);
+        process.exit(1);
+    }
+    console.log(fresh.length ? '  (report only — pass --strict to gate)' : '  ✓ no new unguarded server-read keys');
+}
+main();
+//# sourceMappingURL=check-trusted-keys.js.map

package/dist/scripts/check-trusted-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-trusted-keys.js","sourceRoot":"","sources":["../../scripts/check-trusted-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACvF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,6BAA6B,CAAC,CAAC;AAEzE,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAK5G,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,GAAW;IAC3B,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAe;IACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,kGAAkG;IAClG,uFAAuF;IACvF,MAAM,EAAE,GAAG,kFAAkF,CAAC;IAC9F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,EAAE,QAAQ,EAAE,AAAD,EAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;AAErD,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,IAAI,EAAE,CAAC;QACP,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,gFAAgF;kBAC/F,iGAAiG;kBACjG,iGAAiG;kBACjG,kBAAkB,CAAC;QAC7B,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,6FAA6F;kBAC7F,8FAA8F;kBAC9F,2EAA2E;YACjF,MAAM;SACQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAmB,CAAC,MAAM;QACzE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACrH,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChJ,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;AACpH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/migrate-group-shares.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrate-group-shares.d.ts.map

package/dist/scripts/migrate-group-shares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-group-shares.d.ts","sourceRoot":"","sources":["../../scripts/migrate-group-shares.ts"],"names":[],"mappings":""}

package/dist/scripts/migrate-group-shares.js

@@ -0,0 +1,89 @@
+/**
+ * @file scripts/migrate-group-shares.ts
+ * @description Turn every `visibility:'group'` memory record into a key-space share.
+ *
+ *   WHY THIS IS A SCRIPT AND NOT A BOOT STEP. It creates access rights, and access rights should not
+ *   appear because a process restarted. Nothing is broken while it has not been run: records bound
+ *   the old way keep being read the old way, so this is a move between two working mechanisms rather
+ *   than a repair. Run it once the production numbers are known (how many group-visible records,
+ *   how many groups), which is the count that decides whether the result is ten shares or ten
+ *   thousand.
+ *
+ *   WHAT IT DOES NOT DO. It never widens anything: one record becomes one share whose pattern is
+ *   that record's EXACT key, for the group the record already named. Nobody who could not read a
+ *   record before can read it after. Widening a per-key share into a `space.**` pattern afterwards
+ *   is an owner's decision, made in the interface, not something a migration should guess.
+ *
+ *   Records whose group no longer exists are reported and skipped: they have been unreadable by
+ *   everyone since the group went, and inventing an audience for them is not a migration.
+ * @usage
+ *   cd aimeat && pnpm exec node --import tsx scripts/migrate-group-shares.ts --db sqlite --db-path ./data/aimeat.db
+ *   cd aimeat && pnpm exec node --import tsx scripts/migrate-group-shares.ts --db postgres-kysely --db-url "$DATABASE_URL"
+ *   Add --apply to write. Without it the script only reports what it would do.
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial, alongside the key-space share table.
+ */
+import { randomUUID } from 'node:crypto';
+import { createStorage } from '../src/storage/storage-factory.js';
+function arg(name) {
+    const hit = process.argv.find(a => a === `--${name}` || a.startsWith(`--${name}=`));
+    if (!hit)
+        return undefined;
+    if (hit.includes('='))
+        return hit.split('=').slice(1).join('=');
+    return process.argv[process.argv.indexOf(hit) + 1];
+}
+async function main() {
+    const apply = process.argv.includes('--apply');
+    const provider = arg('db') ?? 'sqlite';
+    const storage = await createStorage({
+        provider: provider,
+        sqlitePath: arg('db-path'),
+        dbUrl: arg('db-url'),
+    });
+    const all = await storage.listAllMemory({ visibility: 'group', limit: 100_000, offset: 0 });
+    console.log(`Group-visible records: ${all.items.length}`);
+    let created = 0, alreadyCovered = 0, orphaned = 0, unbound = 0;
+    const groupCache = new Map();
+    for (const record of all.items) {
+        const groupId = record.groupId;
+        if (!groupId) {
+            // A record marked `group` that never carried an id. Before 2026-08-11 this was the normal
+            // outcome on SQLite (the column was never written) and on any record shared after creation.
+            unbound++;
+            continue;
+        }
+        if (!groupCache.has(groupId))
+            groupCache.set(groupId, !!(await storage.getSharingGroup(groupId)));
+        if (!groupCache.get(groupId)) {
+            orphaned++;
+            continue;
+        }
+        const existing = await storage.listGroupSharesByGroups([groupId]);
+        if (existing.some(s => s.ownerGaii === record.ownerGaii && s.keyPattern === record.key)) {
+            alreadyCovered++;
+            continue;
+        }
+        const share = {
+            id: randomUUID(),
+            groupId,
+            ownerGaii: record.ownerGaii,
+            keyPattern: record.key, // EXACT key. Never a widened pattern — see the header.
+            note: 'migrated from visibility:group',
+            createdAt: new Date().toISOString(),
+            createdBy: record.ownerGaii,
+        };
+        if (apply)
+            await storage.createGroupShare(share);
+        created++;
+    }
+    console.log(`  shares ${apply ? 'created' : 'that WOULD be created'}: ${created}`);
+    console.log(`  already covered by an identical share: ${alreadyCovered}`);
+    console.log(`  skipped, group no longer exists:       ${orphaned}`);
+    console.log(`  skipped, no group id on the record:    ${unbound}`);
+    if (!apply)
+        console.log('\nDry run. Re-run with --apply to write.');
+    process.exit(0);
+}
+main().catch(err => { console.error(err); process.exit(1); });
+//# sourceMappingURL=migrate-group-shares.js.map

package/dist/scripts/migrate-group-shares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-group-shares.js","sourceRoot":"","sources":["../../scripts/migrate-group-shares.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAGlE,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ,EAAE,QAAwC;QAClD,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC;QAC1B,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC;KACrB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1D,IAAI,OAAO,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,0FAA0F;YAC1F,4FAA4F;YAC5F,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,QAAQ,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAqB;YAC9B,EAAE,EAAE,UAAU,EAAE;YAChB,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,GAAG,EAAW,uDAAuD;YACxF,IAAI,EAAE,gCAAgC;YACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,KAAK;YAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,4CAA4C,cAAc,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/src/auth/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASvD,wBAAgB,iBAAiB,IAAI;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAGnF;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAEd;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B3G;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA6B5E;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqB5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAOD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAA0B;AAEzG;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AASvD,wBAAgB,iBAAiB,IAAI;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAGnF;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnG;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAEd;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgC3G;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA+B5E;AAkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqB5D;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAOD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAA0B;AAEzG;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB/D"}

package/dist/src/auth/jwt.js

@@ -7,6 +7,9 @@
  * @structure initNodeKeys / issueJWT / verifyJWT / generateSessionId / revokeToken / isRevoked
  * @usage import { issueJWT, verifyJWT } from '../auth/jwt.js';
  * @version-history
+ *   v1.2.0 — 2026-08-10 — Fails closed at both ends: issueJWT writes [] rather than ['*'] when the
+ *     caller omits scopes, and verifyJWT reads a missing claim the same way. issueJWT has always
+ *     written the claim, so no token in circulation lacks it.
  *   v1.1.0 — 2026-06-14 — Add optional `eco_app` claim for GEAI (ecosystem app) sessions.
  */
 import { SignJWT, jwtVerify } from 'jose';
@@ -50,7 +53,12 @@ export async function issueJWT(payload, ttlSeconds, sessionId) {
         owner: payload.owner,
         node: payload.node,
         roles: payload.roles,
-        scopes: payload.scopes ?? ['*'],
+        // Fail closed. This was `?? ['*']`, so forgetting the field minted a credential over the whole
+        // account — which is how proving control of a mailbox returned a wildcard token, and how every
+        // MCP OAuth session came back as one. An owner or operator session is unaffected either way,
+        // because requireScope lets those through on the role; an AGENT token with no scopes can do
+        // nothing, which is the right answer to "the caller did not say what this is for".
+        scopes: payload.scopes ?? [],
         ...(payload.mcp_client ? { mcp_client: payload.mcp_client } : {}),
         ...(payload.federated ? { federated: true } : {}),
         ...(payload.homeNode ? { homeNode: payload.homeNode } : {}),
@@ -82,7 +90,9 @@ export async function verifyJWT(token) {
             node: payload.node,
             roles: payload.roles,
             exp: payload.exp,
-            scopes: payload.scopes ?? ['*'],
+            // The other end of the same door. issueJWT has always written this claim, so a token
+            // without one is not an old token — it is not one of ours.
+            scopes: payload.scopes ?? [],
             sessionId: payload.jti,
             mcp_client: payload.mcp_client,
             federated: payload.federated ?? false,

package/dist/src/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,uDAAuD;AACvD,wEAAwE;AAExE,IAAI,cAAc,GAAqB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAqB,IAAI,CAAC;AAE3C,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,eAAuB,EAAE,gBAAwB;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEhE,wDAAwD;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AAkBD,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAkB,EAAE,SAAkB;IACxF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE;YACxD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAc;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAiB;YAChC,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,MAAM,EAAG,OAAO,CAAC,MAAmB,IAAI,CAAC,GAAG,CAAC;YAC7C,SAAS,EAAE,OAAO,CAAC,GAAyB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAgC;YACpD,SAAS,EAAG,OAAO,CAAC,SAAqB,IAAI,KAAK;YAClD,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,SAAS,EAAE,OAAO,CAAC,SAA+B;YAClD,GAAG,EAAE,OAAO,CAAC,GAAyB;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,+FAA+F;QAC/F,yFAAyF;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,qEAAqE;AACrE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,8DAA8D;AAC9D,sDAAsD;AACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,mEAAmE;AACnE,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,QAAQ,GAAG,OAAO,CAAC;IAEnB,gEAAgE;IAChE,IAAI,gBAAgB;QAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,2EAA2E;YAC3E,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;gBACxC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,qBAAqB;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;IACf,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEnE,oGAAoG;IACpG,mGAAmG;IACnG,0FAA0F;IAC1F,IAAI,CAAC;QACH,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gGAAgG;QAChG,8EAA8E;QAC9E,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqC,IAAI,CAAC;AAC7D,MAAM,UAAU,mBAAmB,CAAC,EAAoC,IAAU,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,uDAAuD;AACvD,wEAAwE;AAExE,IAAI,cAAc,GAAqB,IAAI,CAAC;AAC5C,IAAI,aAAa,GAAqB,IAAI,CAAC;AAE3C,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACpF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,eAAuB,EAAE,gBAAwB;IAClF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAEhE,wDAAwD;IACxD,MAAM,YAAY,GAAG;QACnB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACtD,CAAC;IAEF,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5G,CAAC;AAkBD,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAmB,EAAE,UAAkB,EAAE,SAAkB;IACxF,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,4FAA4F;QAC5F,mFAAmF;QACnF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAChD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IAEvC,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE;YACxD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAc;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAiB;YAChC,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,qFAAqF;YACrF,2DAA2D;YAC3D,MAAM,EAAG,OAAO,CAAC,MAAmB,IAAI,EAAE;YAC1C,SAAS,EAAE,OAAO,CAAC,GAAyB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAgC;YACpD,SAAS,EAAG,OAAO,CAAC,SAAqB,IAAI,KAAK;YAClD,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,OAAO,EAAE,OAAO,CAAC,OAA6B;YAC9C,SAAS,EAAE,OAAO,CAAC,SAA+B;YAClD,GAAG,EAAE,OAAO,CAAC,GAAyB;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,+FAA+F;QAC/F,yFAAyF;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAE1E,qEAAqE;AACrE,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,8DAA8D;AAC9D,sDAAsD;AACtD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAClF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,mEAAmE;AACnE,IAAI,QAAQ,GAAmB,IAAI,CAAC;AACpC,IAAI,gBAAgB,GAA0C,IAAI,CAAC;AAEnE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,QAAQ,GAAG,OAAO,CAAC;IAEnB,gEAAgE;IAChE,IAAI,gBAAgB;QAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACtD,gBAAgB,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0FAA0F;YAC1F,2EAA2E;YAC3E,MAAM,CAAC,IAAI,CAAC,wEAAwE,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,YAAY,EAAE,CAAC;gBACxC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,qBAAqB;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe;IACf,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEnE,oGAAoG;IACpG,mGAAmG;IACnG,0FAA0F;IAC1F,IAAI,CAAC;QACH,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gGAAgG;QAChG,8EAA8E;QAC9E,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqC,IAAI,CAAC;AAC7D,MAAM,UAAU,mBAAmB,CAAC,EAAoC,IAAU,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC;AAEzG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE9B,4BAA4B;IAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,oBAAoB;IACpB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/auth/middleware.d.ts

@@ -8,9 +8,14 @@
  *   - initSessionAuth / enableAnonymousAuth / isAnonymousMode / getAnonymousCredentials: startup wiring
  *   - optionalAuth / requireAuth / requireAuthOrAnonymous: presence-level gates
  *   - requireRole / requireScope / requireExternalPrincipal / requireLocalSession: authorization gates
+ *   - requireOwnerPrincipal: the account-security gate (password, recovery address, 2FA, deletion)
  *   - resolvePatToken / maybeSetPatBrowserSession: Personal Access Token handling
  *
  * @version-history
+ *   v1.2.0 — 2026-08-11 — Security audit H-1/H-7: requireOwnerPrincipal(), the gate for the doors
+ *     that decide who can get back INTO the account. Not one authenticated route under /v1/ghii
+ *     carried a role gate, and every one of them keys off req.auth.owner — which holds the HUMAN's
+ *     account name on agent, ecosystem and app-grant tokens alike.
  *   v1.1.0 — 2026-07-28 — Every AUTH_REQUIRED 401 goes through deny401(), which stamps the RFC 9728
  *     `WWW-Authenticate: Bearer resource_metadata="…"` hint for the origin the client reached.
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
@@ -58,6 +63,38 @@ export declare function requireAuthOrAnonymous(): (req: Request, res: Response,
  * Federated sessions are blocked from operator role access.
  */
 export declare function requireRole(role: string): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Require a principal that IS the account holder, rather than something acting on the account
+ * holder's behalf. For the doors that decide who can get back INTO the account: the password, the
+ * recovery address, the second factor, the identity proof, and deleting or exporting everything.
+ *
+ * WHY NOT requireRole('owner'). The `owner` role does not say which principal is calling. The agent
+ * branch of POST /v1/auth/token used to mint an agent session carrying the human's owner (and
+ * operator) roles — the August 2026 audit removed that in the same run — and the two unauthenticated
+ * mints in routes/ghii/web-verify.ts still do it today, so requireRole('owner') admits an agent JWT.
+ * The exclusions below are what makes this gate hold regardless of who else stops copying roles onto
+ * whom, and that is the reason to spell the test out here instead of leaning on a role name.
+ *
+ * WHY NOT "does the token carry a session id". A Personal Access Token the human minted for their
+ * own browser produces owner tokens with NO session id (the PAT branch of POST /v1/auth/refresh),
+ * so that test would sign real people out of their own account settings. An owner-level PAT passes
+ * here, and that is correct: it is a credential the human created behind requireRole('owner').
+ *
+ * WHAT IS EXCLUDED. `agent` and `ecosystem` are external principals with their own identity; `app`
+ * is a published app holding a scoped grant. All three carry the HUMAN's account name in
+ * `req.auth.owner`, which is what every handler under /v1/ghii keys off, so without this gate all
+ * three land on the human's record: set a password on an account that has none and then sign in as
+ * them, point the recovery address at a mailbox they control and mail themselves a reset code, or
+ * arm a second factor with a secret the human never sees.
+ *
+ * The one way in for an external principal is ACCOUNT_SECURITY_SCOPE, granted per agent by the
+ * owner in the agent permission editor. It is tested as the EXACT string: no wildcard carries it
+ * (utils/scope-coverage.ts), and no existing agent was grandfathered onto it, so an agent is here
+ * only because the owner ticked that one box. An `app` is refused whatever it holds — an app grant
+ * is consent to use the account, never consent to take it over — and the word is deliberately
+ * absent from APP_GRANTABLE_SCOPES so an app cannot ask for it either.
+ */
+export declare function requireOwnerPrincipal(): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Require a scoped EXTERNAL principal — an agent (GAII) OR an ecosystem app (GEAI). Owner/operator
  * also pass (they act for their own external principals, exactly as with requireRole('agent')).
@@ -115,4 +152,17 @@ export declare function requireLocalSession(): (req: Request, res: Response, nex
  */
 export declare function requireRoleOrScope(role: string, ...scopes: string[]): (req: Request, res: Response, next: NextFunction) => void;
 export declare function requireScope(...requiredScopes: string[]): (req: Request, res: Response, next: NextFunction) => void;
+/**
+ * Like requireScope, but ANY of the listed scopes is enough.
+ *
+ * requireScope is an AND, which is the right default: a route that needs two permissions needs
+ * both. This is for the case where two DIFFERENT principals legitimately reach the same route by
+ * different routes of trust — an owner reading their own connections with `connections:read`, and a
+ * granted app reading the same list with `connections:use` because it may publish to one and
+ * therefore has to be able to name one.
+ *
+ * A named guard rather than an inline check in the route: the owner bypass and the domain wildcard
+ * are security logic, and security logic copied into a handler is security logic that drifts.
+ */
+export declare function requireAnyScope(...acceptableScopes: string[]): (req: Request, res: Response, next: NextFunction) => void;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/src/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAGpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAQvD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAG7E;AA0ED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,yCAAyC;AACzC,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEzE;AAGD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,aAAa,CAAC;SACtB;KACF;CACF;AAED;;;GAGG;AACH,wBAAgB,YAAY,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAgC9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkF9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAiCxD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,KAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAsBxD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAkBnD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,KACzB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAOxD;AAOD;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAC1D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED,wBAAgB,YAAY,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAqCxD"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAIpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAQvD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,IAAI,CAG7E;AA0ED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,yCAAyC;AACzC,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEzE;AAGD,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,aAAa,CAAC;SACtB;KACF;CACF;AAED;;;GAGG;AACH,wBAAgB,YAAY,KACZ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAgC9D;AAED;;;GAGG;AACH,wBAAgB,WAAW,KACX,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAkF9D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAQxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,IAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAiCxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,qBAAqB,KAC3B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAwBxD;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,KAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAsBxD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAkBnD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,KACzB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAOxD;AAOD;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAC1D,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED,wBAAgB,YAAY,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,IAC9C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAqCxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,gBAAgB,EAAE,MAAM,EAAE,IACnD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UA2BxD"}