aimeat 2.7.0 → 3.0.0

package/dist/src/services/app-lifecycle.js

@@ -0,0 +1,410 @@
+/**
+ * @file src/services/app-lifecycle.ts
+ * @description The app-catalogue writes that are NOT a publish: the draft slot, the fork, and the
+ *   delete. services/app-publish.ts owns "publish one version" for the same reason and after the same
+ *   kind of drift; this file owns the other three acts.
+ *
+ *   WHY THIS FILE EXISTS. Each of these acts had two implementations, one behind HTTP and one behind
+ *   MCP, and they had drifted in the direction nobody watches. What the route did and the tool did
+ *   not, before this file:
+ *
+ *   - DELETE. The route removes every bucket the owner has for that filename (old publish paths left
+ *     ghost rows under a second ownerGaii), deletes the app's screenshot and writes a change-log
+ *     line. `aimeat_app_delete` deleted one bucket, left the screenshot in storage forever and wrote
+ *     nothing to the log, so an app an agent deleted could reappear in a listing with its thumbnail
+ *     still on disk.
+ *   - FORK. The route re-measures the AI disclosure posture against the copied bytes, strips the
+ *     source owner's private `specCheck` note, copies the screenshot, writes a change-log line and
+ *     fires the public feed. `aimeat_app_fork` did none of those five: a fork made over MCP carried
+ *     one owner's build-spec note into another owner's catalogue and left no trace anywhere.
+ *   - DRAFT SAVE. Two manifest builders that disagreed on the default category — 'utility' over HTTP
+ *     and inside publishApp, 'tool' over MCP — so a draft-first app staged by an agent landed in a
+ *     category no other door can produce.
+ *
+ *   WHAT DELIBERATELY STAYS AT THE DOOR: the authorization gates (the fork's two gates need the
+ *   operator role, which only an HTTP session carries), the payload decode, the 404 wording for a
+ *   missing draft (one door tells the caller to `PUT .../draft`, the other to call
+ *   `aimeat_app_draft_save`), the MCP resource notification, and every response document.
+ * @structure
+ *   - APP_FILENAME_RE / appFilenameRefusal() — the one filename rule for a catalogue entry
+ *   - resolveAppOwnerScope() — principal → { ownerName, ownerGhii }; the MCP-side twin of the
+ *     canonicalOwner closure in routes/apps.ts, so both surfaces address the same bucket
+ *   - stageAppDraft() — validate, inherit the live manifest, write the draft slot
+ *   - discardAppDraft() — clear the draft slot
+ *   - publishAppDraft() — draft manifest → publishApp → clear the slot (the slot survives a refusal)
+ *   - forkApp() — validate, copy manifest + bytes + screenshot, record lineage, log, announce
+ *   - deleteOwnedApp() — sweep every bucket (or one version), drop screenshots, log
+ * @usage
+ *   const out = await forkApp(storage, config, { source, callerOwner, callerGhii, callerGaii, newFilename });
+ *   if ('refusal' in out) { res.status(out.refusal.status).json(error(...)); return; }
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — August 2026 audit step 8, unit "apps". Extracted from routes/apps/drafts.ts,
+ *     routes/apps/fork-manage.ts, mcp/apps.ts and mcp/apps-fork.ts, which held two copies of each of
+ *     these four acts.
+ */
+import { randomBytes } from 'node:crypto';
+import { parseGAII } from '../utils/gaii.js';
+import { resolveGhii } from '../utils/ghii-resolver.js';
+import { logger } from '../utils/logger.js';
+import { emitChange } from './event-bus.js';
+import { recordPublicActivity } from './public-activity.js';
+import { appQuotaRefusal } from './install-quotas.js';
+import { lintAppAiDisclosure } from './app-ai-posture.js';
+import { publishApp } from './app-publish.js';
+/**
+ * What a catalogue filename may look like. One spelling, because four doors used to carry their own
+ * copy of it and a rule that is written four times is a rule that holds until someone widens one.
+ */
+export const APP_FILENAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/;
+/** The refusal for a filename that breaks the rule, or null when it does not. */
+export function appFilenameRefusal(filename) {
+    if (APP_FILENAME_RE.test(filename))
+        return null;
+    return {
+        refusal: {
+            status: 400, code: 'INVALID_INPUT',
+            message: 'Invalid filename. Use alphanumeric, dots, hyphens, underscores. Max 100 chars.',
+        },
+    };
+}
+/**
+ * Resolve an MCP principal to the owner scope its app writes belong to.
+ *
+ * Apps are OWNER-scoped whoever publishes them, and the bucket key is the owner's canonical GHII
+ * from the identity table — the same key routes/apps.ts resolves through its `canonicalOwner`
+ * closure and the same key the startup `mergeForkedAppBuckets()` migration consolidates onto. The
+ * MCP tools composed `owner@nodeId` by hand instead, which agrees for a locally registered owner and
+ * addresses a different bucket for anyone whose GHII record says otherwise. Two doors that disagree
+ * about where an app lives is how the same owner ends up with two version counters.
+ *
+ * Returns null when the principal is not a GAII, which is the tools' existing "Failed to parse" case.
+ */
+export async function resolveAppOwnerScope(storage, config, principal) {
+    const parsed = parseGAII(principal);
+    if (!parsed)
+        return null;
+    const ownerName = parsed.owner;
+    return { ownerName, ownerGhii: await resolveGhii(storage, ownerName, `${ownerName}@${config.nodeId}`) };
+}
+/**
+ * Save (upsert) the app's draft. The live published versions are untouched: this writes the staging
+ * slot and nothing else, which is why there is no change log, no feed and no provenance stamp here.
+ * All three belong to the promotion, which is publishAppDraft below.
+ */
+export async function stageAppDraft(storage, config, input) {
+    const { ownerName, ownerGhii, filename, data, requested } = input;
+    const badName = appFilenameRefusal(filename);
+    if (badName)
+        return badName;
+    const maxBytes = config.appMaxSizeMb * 1024 * 1024;
+    if (data.length > maxBytes) {
+        return {
+            refusal: {
+                status: 413, code: 'TOO_LARGE',
+                message: `Draft exceeds ${config.appMaxSizeMb}MB limit (${data.length} bytes)`,
+            },
+        };
+    }
+    // The live app's manifest is the base, so a draft that only changes the HTML keeps its name,
+    // description, category and icon.
+    const live = await storage.getApp(ownerGhii, filename);
+    const base = live?.manifest;
+    const manifest = {
+        name: requested.name ?? base?.name ?? filename.replace(/\.html?$/i, ''),
+        description: requested.description ?? base?.description ?? '',
+        version: base?.version ?? '1.0.0',
+        // 'utility' is what publishApp and the HTTP door both default to. The MCP door said 'tool', so
+        // an app first staged by an agent was filed under a category the catalogue's own filters do not
+        // offer, and the difference survived every later publish because category carries forward.
+        category: requested.category ?? base?.category ?? 'utility',
+        tags: requested.tags ?? base?.tags ?? [],
+        authorDisplay: ownerName,
+        usesCortex: requested.usesCortex ?? base?.usesCortex ?? [],
+    };
+    const icon = requested.icon ?? base?.icon;
+    if (icon)
+        manifest.icon = icon;
+    const protection = requested.protection ?? base?.protection;
+    if (protection && Object.values(protection).some(Boolean))
+        manifest.protection = protection;
+    // A draft that only changes HTML keeps the live app's bundled crew-defs; the promotion then
+    // carries them into the new version unchanged.
+    if (base?.cortex?.agents?.length)
+        manifest.cortex = base.cortex;
+    const mimeType = requested.mimeType ?? live?.mimeType ?? 'text/html';
+    const updatedAt = new Date().toISOString();
+    await storage.saveAppDraft({
+        ownerGaii: ownerGhii, ownerName, filename, manifest,
+        mimeType, size: data.length, data, updatedAt,
+    });
+    return {
+        filename, manifest, mimeType,
+        size: data.length,
+        updatedAt,
+        hasLiveVersion: !!live,
+        liveVersionNumber: live?.versionNumber ?? 0,
+    };
+}
+/**
+ * Throw the draft away. The live app is untouched; `false` means there was nothing to discard.
+ *
+ * A one-line wrapper on purpose: the draft slot has one owner in code, so the next thing a discard
+ * has to do — a change-log line, a cache drop, a notification — lands on both doors at once instead
+ * of on whichever one the author had open.
+ */
+export async function discardAppDraft(storage, ownerGhii, filename) {
+    return storage.deleteAppDraft(ownerGhii, filename);
+}
+/**
+ * Promote the draft to a new live version, then clear the slot.
+ *
+ * The draft manifest IS the caller's statement, so every field it can express is passed as stated;
+ * what it cannot express — pricing, licence, per-locale descriptions — is left unmentioned and
+ * publishApp carries it from the live app. Both doors wrote that mapping out by hand, nine fields
+ * each, which is how the two of them can disagree about whether promoting a draft keeps an app paid.
+ */
+export async function publishAppDraft(storage, config, input) {
+    const { ownerName, ownerGhii, callerGaii, filename, draft } = input;
+    const out = await publishApp(storage, config, {
+        ownerName,
+        ownerGhii,
+        callerGaii,
+        filename,
+        data: draft.data,
+        mimeType: draft.mimeType,
+        requested: {
+            name: draft.manifest.name,
+            description: draft.manifest.description,
+            version: draft.manifest.version || undefined,
+            category: draft.manifest.category,
+            tags: draft.manifest.tags,
+            icon: draft.manifest.icon,
+            usesCortex: draft.manifest.usesCortex,
+            cortexAgents: draft.manifest.cortex?.agents,
+            protection: draft.manifest.protection,
+        },
+        accessCode: { mode: 'carry' },
+        source: 'draft',
+        declaredProvenanceId: input.declaredProvenanceId,
+        declaredProvenance: input.declaredProvenance,
+        specToken: input.specToken,
+        specAck: input.specAck,
+    });
+    // The draft SURVIVES a refusal. A broken artifact is work to fix and publish again, and clearing
+    // the staging slot would delete the only copy of it.
+    if ('refusal' in out)
+        return out;
+    await storage.deleteAppDraft(ownerGhii, filename);
+    return out;
+}
+/**
+ * Copy an app into the caller's catalogue as a new app at version 1.
+ *
+ * The gates are the door's: derivative permission and the paid-app paywall both need to know whether
+ * the caller is an operator, and only an HTTP session carries that role. What happens after them is
+ * one act, and it is this: the manifest is copied with the source's paid terms and private notes
+ * removed, the bytes and the screenshot come across unchanged, and the fork is written into the
+ * append-only lineage log, the change log and the public feed.
+ */
+export async function forkApp(storage, config, input) {
+    const { source, callerOwner, callerGhii, callerGaii, newFilename } = input;
+    const sourceFilename = source.filename;
+    if (!newFilename || !APP_FILENAME_RE.test(newFilename)) {
+        return {
+            refusal: {
+                status: 400, code: 'INVALID_INPUT',
+                message: 'new_filename is required (alphanumeric, dots, hyphens, underscores; max 100 chars)',
+            },
+        };
+    }
+    // A fork is a NEW app in the caller's catalogue — refuse to shadow an app they already own by that
+    // filename. To update one, publish; do not fork.
+    const existingVersion = await storage.getLatestVersionNumber(callerGhii, newFilename);
+    if (existingVersion > 0) {
+        return {
+            refusal: {
+                status: 409, code: 'ALREADY_EXISTS',
+                message: `You already have an app named "${newFilename}". Choose a different new_filename.`,
+            },
+        };
+    }
+    // The per-owner app quota, from the one place that holds it (services/install-quotas.ts).
+    const overQuota = await appQuotaRefusal({ storage, config }, callerGhii);
+    if (overQuota)
+        return { refusal: overQuota };
+    const now = new Date().toISOString();
+    const forkedManifest = {
+        ...source.manifest,
+        name: `${source.manifest.name || sourceFilename.replace(/\.html?$/i, '')} (fork)`,
+        authorDisplay: callerOwner,
+        // A fork starts as its own independent, free app — drop the source's paid terms; the forker can
+        // price their own copy later. Record its origin.
+        forkedFrom: { owner: source.ownerName, filename: sourceFilename, version: source.versionNumber, node: config.nodeId },
+    };
+    delete forkedManifest.priceMorsels;
+    delete forkedManifest.licenseType;
+    // The build-spec state describes how the SOURCE's last publish was made. It says nothing about this
+    // fork, and it is owner-only besides — copying it hands one owner's note about their own working
+    // habits to whoever forked them, which is what the MCP fork did.
+    delete forkedManifest.specCheck;
+    // A FORK OF A GENERATIVE APP IS STILL A GENERATIVE APP. The manifest spread above brings the
+    // posture across, and this re-measures the observed half against the bytes actually being stored
+    // while keeping what the source DECLARED — so the statement neither resets to silence nor becomes
+    // a claim about code that moved on.
+    if (/html/i.test(source.mimeType)) {
+        forkedManifest.aiPosture = lintAppAiDisclosure(Buffer.from(source.data).toString('utf8'), source.manifest.aiPosture).posture;
+    }
+    await storage.createApp({
+        ownerGaii: callerGhii,
+        ownerName: callerOwner,
+        filename: newFilename,
+        versionNumber: 1,
+        manifest: forkedManifest,
+        mimeType: source.mimeType,
+        size: source.size,
+        data: source.data,
+        parked: false,
+        forkable: false, // the forker decides their own copy's forkability later
+        createdAt: now,
+        // The record describes how these BYTES were made, and a fork copies the bytes exactly, so the
+        // statement travels with them. A fresh mint here would claim the forker's agent produced content
+        // it merely copied; a dropped one would read as unstated content that is known to be model-written.
+        ...(source.aiProvenanceId ? { aiProvenanceId: source.aiProvenanceId } : {}),
+    });
+    // Copy the source screenshot into the fork's bucket so the fork renders with the same catalogue
+    // thumbnail. Best-effort: a missing thumbnail is not worth failing a fork over.
+    try {
+        const srcShot = await storage.getStorageFile(source.ownerGaii, `apps/screenshots/${sourceFilename}`);
+        if (srcShot) {
+            await storage.createStorageFile({
+                key: `apps/screenshots/${newFilename}`,
+                ownerGaii: callerGhii,
+                visibility: 'public',
+                mimeType: srcShot.mimeType,
+                size: srcShot.size,
+                data: srcShot.data,
+                createdAt: now,
+            });
+        }
+    }
+    catch (err) {
+        logger.warn('forkApp: screenshot copy is non-critical', { error: String(err) });
+    }
+    // The append-only fork event — the source of truth for fork stats + lineage.
+    await storage.recordAppFork({
+        id: `fork-${Date.now()}-${randomBytes(4).toString('hex')}`,
+        sourceOwnerGaii: source.ownerGaii,
+        sourceOwnerName: source.ownerName,
+        sourceFilename,
+        sourceVersion: source.versionNumber,
+        childOwnerGaii: callerGhii,
+        childOwnerName: callerOwner,
+        childFilename: newFilename,
+        forkedByGaii: callerGaii,
+        forkedAt: now,
+    });
+    const downloadUrl = `/v1/apps/${encodeURIComponent(callerOwner)}/${encodeURIComponent(newFilename)}`;
+    await storage.addSiteChangeLog({
+        id: `site-${Date.now()}-${randomBytes(4).toString('hex')}`,
+        action: 'app_publish',
+        summary: `Forked "${sourceFilename}" (by ${source.ownerName}) into "${newFilename}"`,
+        changedBy: callerOwner,
+        changedAt: now,
+    });
+    emitChange('apps');
+    void recordPublicActivity(storage, config, {
+        category: 'apps',
+        actor: callerGaii,
+        summary: `App ${forkedManifest.name} forked from ${source.ownerName}/${sourceFilename}`,
+        detail: forkedManifest.description || '',
+        link: `${downloadUrl}?mode=inline`,
+    }).catch(err => { logger.warn('forkApp: feed is best-effort', { error: String(err) }); });
+    return {
+        filename: newFilename,
+        versionNumber: 1,
+        manifest: forkedManifest,
+        downloadUrl,
+        forkedFrom: { owner: source.ownerName, filename: sourceFilename, version: source.versionNumber },
+    };
+}
+/**
+ * Remove an app the caller owns, with or without a version.
+ *
+ * The no-version case sweeps EVERY bucket this owner has for the filename. Old publish paths wrote
+ * the same owner+filename under different ownerGaii keys, and a delete that only looked in the
+ * canonical bucket left those ghost rows listed and downloadable — which is what `aimeat_app_delete`
+ * did, along with leaving the screenshot in storage. A single-version delete still targets one
+ * bucket, because keeping versions in one bucket while removing a stray from another is a real thing
+ * to want.
+ */
+export async function deleteOwnedApp(storage, input) {
+    const { ownerName, ownerGhii, callerGaii, filename, version } = input;
+    if (!version) {
+        let sweepCount = 0;
+        for (;;) {
+            const app = await storage.getAppByOwnerName(ownerName, filename);
+            if (!app)
+                break;
+            // Authorization sanity check: ownerName MUST match the caller's owner. (It always will,
+            // because getAppByOwnerName takes ownerName as the key — but defense in depth.)
+            if (app.ownerName !== ownerName)
+                break;
+            await storage.deleteApp(app.ownerGaii, filename);
+            await storage.deleteStorageFile(app.ownerGaii, `apps/screenshots/${filename}`)
+                .catch(err => { logger.warn('deleteOwnedApp: continuing after a suppressed failure', { error: String(err) }); });
+            sweepCount++;
+            if (sweepCount > 10)
+                break; // safety cap, no real owner has >10 buckets
+        }
+        if (sweepCount === 0) {
+            return {
+                refusal: {
+                    status: 404, code: 'NOT_FOUND',
+                    message: `App "${filename}" not found in your uploads`,
+                },
+            };
+        }
+    }
+    else {
+        // Single-version case: try the buckets in order, delete from the one that has it.
+        let app = await storage.getApp(ownerGhii, filename, version);
+        let effectiveGaii = ownerGhii;
+        if (!app) {
+            app = await storage.getApp(callerGaii, filename, version);
+            if (app)
+                effectiveGaii = callerGaii;
+        }
+        if (!app) {
+            app = await storage.getApp(ownerName, filename, version);
+            if (app)
+                effectiveGaii = ownerName;
+        }
+        if (!app) {
+            // Last resort: find the row by ownerName across all buckets.
+            const found = await storage.getAppByOwnerName(ownerName, filename, version);
+            if (found && found.ownerName === ownerName) {
+                app = found;
+                effectiveGaii = found.ownerGaii;
+            }
+        }
+        if (!app) {
+            return {
+                refusal: {
+                    status: 404, code: 'NOT_FOUND',
+                    message: `App "${filename}" not found in your uploads (version ${version})`,
+                },
+            };
+        }
+        await storage.deleteApp(effectiveGaii, filename, version);
+    }
+    await storage.addSiteChangeLog({
+        id: `site-${Date.now()}-${randomBytes(4).toString('hex')}`,
+        action: 'app_delete',
+        summary: version ? `Deleted version ${version} of app "${filename}"` : `Deleted app "${filename}" (all versions)`,
+        changedBy: ownerName,
+        changedAt: new Date().toISOString(),
+    });
+    emitChange('apps');
+    return { filename, versionDeleted: version ?? 'all' };
+}
+//# sourceMappingURL=app-lifecycle.js.map

package/dist/src/services/app-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-lifecycle.js","sourceRoot":"","sources":["../../../src/services/app-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAK1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAC;AAG7F;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAEnE,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO;QACL,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe;YAClC,OAAO,EAAE,gFAAgF;SAC1F;KACF,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAoB,EAAE,SAAiB;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;IAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC;AAuCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAAE,MAAoB,EAAE,KAAyB;IAEjE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAElE,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,GAAG,IAAI,GAAG,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW;gBAC9B,OAAO,EAAE,iBAAiB,MAAM,CAAC,YAAY,aAAa,IAAI,CAAC,MAAM,SAAS;aAC/E;SACF,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,EAAE,QAAQ,CAAC;IAC5B,MAAM,QAAQ,GAAgB;QAC5B,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACvE,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI,EAAE,WAAW,IAAI,EAAE;QAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,OAAO;QACjC,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,SAAS;QAC3D,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE;QACxC,aAAa,EAAE,SAAS;QACxB,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,IAAI,EAAE;KAC3D,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,CAAC;IAC1C,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;IAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,CAAC;IAC5D,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5F,4FAA4F;IAC5F,+CAA+C;IAC/C,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;QAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAEhE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,WAAW,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,CAAC,YAAY,CAAC;QACzB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;QACnD,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,SAAS;QACT,cAAc,EAAE,CAAC,CAAC,IAAI;QACtB,iBAAiB,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAAE,SAAiB,EAAE,QAAgB;IAErD,OAAO,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAAE,MAAoB,EAAE,KAA2B;IAEnE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAEpE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;QAC5C,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE;YACT,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;YACvC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,SAAS;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACjC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YACzB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;YACrC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;YAC3C,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;SACtC;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QAC7B,MAAM,EAAE,OAAO;QACf,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,iGAAiG;IACjG,qDAAqD;IACrD,IAAI,SAAS,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEjC,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAgB,EAAE,MAAoB,EAAE,KAAmB;IAE3D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEvC,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe;gBAClC,OAAO,EAAE,oFAAoF;aAC9F;SACF,CAAC;IACJ,CAAC;IAED,mGAAmG;IACnG,iDAAiD;IACjD,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACtF,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB;gBACnC,OAAO,EAAE,kCAAkC,WAAW,qCAAqC;aAC5F;SACF,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAgB;QAClC,GAAG,MAAM,CAAC,QAAQ;QAClB,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS;QACjF,aAAa,EAAE,WAAW;QAC1B,gGAAgG;QAChG,iDAAiD;QACjD,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;KACtH,CAAC;IACF,OAAO,cAAc,CAAC,YAAY,CAAC;IACnC,OAAO,cAAc,CAAC,WAAW,CAAC;IAClC,oGAAoG;IACpG,iGAAiG;IACjG,iEAAiE;IACjE,OAAO,cAAc,CAAC,SAAS,CAAC;IAChC,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,cAAc,CAAC,SAAS,GAAG,mBAAmB,CAC5C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CACrE,CAAC,OAAO,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,CAAC,SAAS,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,SAAS,EAAE,WAAW;QACtB,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK,EAAI,wDAAwD;QAC3E,SAAS,EAAE,GAAG;QACd,8FAA8F;QAC9F,iGAAiG;QACjG,oGAAoG;QACpG,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC;IAEH,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,cAAc,EAAE,CAAC,CAAC;QACrG,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,iBAAiB,CAAC;gBAC9B,GAAG,EAAE,oBAAoB,WAAW,EAAE;gBACtC,SAAS,EAAE,UAAU;gBACrB,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAElG,6EAA6E;IAC7E,MAAM,OAAO,CAAC,aAAa,CAAC;QAC1B,EAAE,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC1D,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,cAAc;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,UAAU;QAC1B,cAAc,EAAE,WAAW;QAC3B,aAAa,EAAE,WAAW;QAC1B,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,YAAY,kBAAkB,CAAC,WAAW,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAErG,MAAM,OAAO,CAAC,gBAAgB,CAAC;QAC7B,EAAE,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC1D,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,WAAW,cAAc,SAAS,MAAM,CAAC,SAAS,WAAW,WAAW,GAAG;QACpF,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,KAAK,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE;QACzC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,OAAO,cAAc,CAAC,IAAI,gBAAgB,MAAM,CAAC,SAAS,IAAI,cAAc,EAAE;QACvF,MAAM,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE;QACxC,IAAI,EAAE,GAAG,WAAW,cAAc;KACnC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO;QACL,QAAQ,EAAE,WAAW;QACrB,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW;QACX,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;KACjG,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAAE,KAA0B;IAE5C,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,wFAAwF;YACxF,gFAAgF;YAChF,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM;YACvC,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC;iBAC3E,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnH,UAAU,EAAE,CAAC;YACb,IAAI,UAAU,GAAG,EAAE;gBAAE,MAAM,CAAC,4CAA4C;QAC1E,CAAC;QACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW;oBAC9B,OAAO,EAAE,QAAQ,QAAQ,6BAA6B;iBACvD;aACF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,kFAAkF;QAClF,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,aAAa,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,GAAG;gBAAE,aAAa,GAAG,UAAU,CAAC;QAAC,CAAC;QAC7G,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,GAAG;gBAAE,aAAa,GAAG,SAAS,CAAC;QAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,6DAA6D;YAC7D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5E,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAAC,GAAG,GAAG,KAAK,CAAC;gBAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC;YAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW;oBAC9B,OAAO,EAAE,QAAQ,QAAQ,wCAAwC,OAAO,GAAG;iBAC5E;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,CAAC,gBAAgB,CAAC;QAC7B,EAAE,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC1D,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,OAAO,YAAY,QAAQ,GAAG,CAAC,CAAC,CAAC,gBAAgB,QAAQ,kBAAkB;QACjH,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/src/services/app-publish-next-steps.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @file src/services/app-publish-next-steps.ts
+ * @description What is still missing from a freshly published app, told in the one place the
+ *   publisher is guaranteed to read: the publish response.
+ *
+ *   WHY IT LIVES HERE RATHER THAN IN THE MCP TOOL. It was written inside mcp/apps.ts, so the two
+ *   things every app on this node needs — an agent face and a bound skill — were mentioned only to
+ *   agents publishing INLINE over MCP. That excludes the presigned upload, which is the door the
+ *   guidance tells everyone to use above ~1 KB, and both REST doors. The skill says all this too;
+ *   the response is the surface that gets read.
+ *
+ *   BEST-EFFORT, ALWAYS. Enrichment must never be able to fail a publish that has already happened,
+ *   so every lookup here swallows its own failure and the whole thing returns undefined rather than
+ *   throwing.
+ * @structure buildPublishNextSteps(storage, config, ownerName, filename) -> record | undefined
+ * @usage import { buildPublishNextSteps } from './app-publish-next-steps.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted from mcp/apps.ts (buildNextSteps, 2026-07-19) into the shared
+ *     publish path so every door returns it, and the agent-face / bound-skill reminder is stated
+ *     rather than folded into a hint about template proposals.
+ */
+import type { AimeatConfig } from '../config.js';
+import type { Storage } from '../storage/interface.js';
+/**
+ * The post-publish reflection: does this app have its agent face and its bound skill yet, and what
+ * to do about each. Returns undefined when the lookups fail — a publish response missing this field
+ * is fine, a publish that failed because of it is not.
+ */
+export declare function buildPublishNextSteps(storage: Storage, config: AimeatConfig, ownerName: string, filename: string): Promise<Record<string, unknown> | undefined>;
+//# sourceMappingURL=app-publish-next-steps.d.ts.map

package/dist/src/services/app-publish-next-steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish-next-steps.d.ts","sourceRoot":"","sources":["../../../src/services/app-publish-next-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAMvD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAC1E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CA6B9C"}

package/dist/src/services/app-publish-next-steps.js

@@ -0,0 +1,40 @@
+import { agentFaceKey } from './agent-face.js';
+import { getOwnerScopePublicMemory } from './owner-memory.js';
+import { listSkillsByBinding } from './skills.js';
+import { logger } from '../utils/logger.js';
+/**
+ * The post-publish reflection: does this app have its agent face and its bound skill yet, and what
+ * to do about each. Returns undefined when the lookups fail — a publish response missing this field
+ * is fine, a publish that failed because of it is not.
+ */
+export async function buildPublishNextSteps(storage, config, ownerName, filename) {
+    try {
+        // Resolve the face across the owner's whole keyspace (GHII + the owner's agents), matching what
+        // the anonymous serve path serves — so an agent that published the face under its own GAII still
+        // reports agent_face_present:true here.
+        const [faceRec, boundSkills] = await Promise.all([
+            getOwnerScopePublicMemory(storage, config.nodeId, ownerName, agentFaceKey(filename))
+                .catch(err => { logger.warn('buildPublishNextSteps: continuing after a suppressed failure', { error: String(err) }); return null; }),
+            listSkillsByBinding(storage, config, `app:${ownerName}/${filename}`, { ownerName })
+                .catch(err => { logger.warn('buildPublishNextSteps: continuing after a suppressed failure', { error: String(err) }); return []; }),
+        ]);
+        return {
+            agent_face_present: !!faceRec,
+            bound_skills_count: boundSkills.length,
+            // Stated every time, present or not. An app without a face is a page agents have to scrape,
+            // and an app without a bound skill teaches nobody how to operate it.
+            agent_face: faceRec
+                ? `This app has an agent face (${agentFaceKey(filename)}). Update it on the SAME writes that update the visible view, or agents and humans drift apart.`
+                : `No agent face yet. Publish one — AIMEATAgentFace.publish({ title, sections }, { app: "${filename}" }) — so an agent can read this app's state as markdown instead of scraping the DOM. One public memory record: ${agentFaceKey(filename)}.`,
+            bound_skill: boundSkills.length > 0
+                ? `${boundSkills.length} skill(s) bound to this app. Keep them current with what the app does.`
+                : `No skill bound yet. Write the operating guide as a skill with metadata.binding "app:${ownerName}/${filename}" (aimeat_skill_publish) — that is how anyone's AI learns to USE this app rather than guess at it.`,
+            template_proposal_hint: 'If anything here generalizes, record it: aimeat_app_template_propose (with your model id). Learnings that would bite the next builder go to aimeat_appdev_pitfall_report.',
+        };
+    }
+    catch (err) {
+        logger.warn('buildPublishNextSteps: continuing after a suppressed failure', { error: String(err) });
+        return undefined;
+    }
+}
+//# sourceMappingURL=app-publish-next-steps.js.map

package/dist/src/services/app-publish-next-steps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-publish-next-steps.js","sourceRoot":"","sources":["../../../src/services/app-publish-next-steps.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAAE,MAAoB,EAAE,SAAiB,EAAE,QAAgB;IAE3E,IAAI,CAAC;QACH,gGAAgG;QAChG,iGAAiG;QACjG,wCAAwC;QACxC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;iBACjF,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;YACtI,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAS,IAAI,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;iBAChF,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;SACrI,CAAC,CAAC;QAEH,OAAO;YACL,kBAAkB,EAAE,CAAC,CAAC,OAAO;YAC7B,kBAAkB,EAAE,WAAW,CAAC,MAAM;YACtC,4FAA4F;YAC5F,qEAAqE;YACrE,UAAU,EAAE,OAAO;gBACjB,CAAC,CAAC,+BAA+B,YAAY,CAAC,QAAQ,CAAC,iGAAiG;gBACxJ,CAAC,CAAC,yFAAyF,QAAQ,mHAAmH,YAAY,CAAC,QAAQ,CAAC,GAAG;YACjP,WAAW,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,wEAAwE;gBAC/F,CAAC,CAAC,uFAAuF,SAAS,IAAI,QAAQ,oGAAoG;YACpN,sBAAsB,EAAE,2KAA2K;SACpM,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/services/app-publish.d.ts

@@ -2,6 +2,8 @@ import type { AimeatConfig } from '../config.js';
 import type { Storage, AppManifest, AppProtection } from '../storage/interface.js';
 import { type DeclaredProvenance } from './ai-provenance.js';
 import { type AppAiLintResult } from './app-ai-posture.js';
+import { type AppArtifactFinding } from './app-artifact-lint.js';
+import { type AppSpecCheck } from './app-spec-gate.js';
 /**
  * The manifest fields a caller may state. **`undefined` means "not mentioned"** and is filled from
  * the live app; it never means "clear". Every door maps its own payload onto this one shape, so the
@@ -54,6 +56,10 @@ export interface PublishAppInput {
     declaredProvenanceId?: string;
     /** What the caller said about how the bytes were made. Absent + non-human principal → MINT-3. */
     declaredProvenance?: DeclaredProvenance;
+    /** The build-spec digest the caller says they built against (services/app-spec-gate.ts). */
+    specToken?: string;
+    /** `skipped-by-owner` when the owner decided to publish without the spec. Recorded, not silent. */
+    specAck?: string;
     /** A NEW app counts against the per-owner quota. Always on; the parameter exists for tests. */
     enforceQuota?: boolean;
 }
@@ -63,6 +69,8 @@ export interface PublishAppRefusal {
         status: number;
         code: string;
         message: string;
+        /** Machine-readable reasons, for a refusal whose remedy is per-finding rather than per-message. */
+        details?: Record<string, unknown>;
     };
 }
 export interface PublishAppResult {
@@ -81,6 +89,12 @@ export interface PublishAppResult {
     /** The AI transparency check, or null for a non-HTML bundle. */
     aiLint: AppAiLintResult | null;
     aiProvenanceId?: string;
+    /** Did the publisher carry the current build spec? Warns; never refuses. */
+    specCheck: AppSpecCheck;
+    /** Non-blocking artifact findings (HTML only) — the blocking ones became a refusal. */
+    artifactWarnings: AppArtifactFinding[];
+    /** Agent face + bound skill, and what to do about each. Best-effort, so it can be undefined. */
+    nextSteps?: Record<string, unknown>;
 }
 /**
  * Publish or update one app version.

package/dist/src/services/app-publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-publish.d.ts","sourceRoot":"","sources":["../../../src/services/app-publish.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAqB,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMhF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACzC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,UAAU,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IACrE,qGAAqG;IACrG,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACzC,0FAA0F;IAC1F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAC7D,OAAO,CAAC,gBAAgB,GAAG,iBAAiB,CAAC,CAsM/C"}
+{"version":3,"file":"app-publish.d.ts","sourceRoot":"","sources":["../../../src/services/app-publish.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAqB,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGtG,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAO1E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACzC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,aAAa,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,UAAU,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IACrE,qGAAqG;IACrG,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IACzC,0FAA0F;IAC1F,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAC9C,mGAAmG;QACnG,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,SAAS,EAAE,YAAY,CAAC;IACxB,uFAAuF;IACvF,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAC7D,OAAO,CAAC,gBAAgB,GAAG,iBAAiB,CAAC,CA4P/C"}