aimeat 2.7.0 → 3.0.0

package/dist/src/services/company/company-service.d.ts

@@ -0,0 +1,30 @@
+import type { AimeatConfig } from '../../config.js';
+import type { Storage } from '../../storage/interface.js';
+import type { CompanyRecord, NewCompanyInput, CompanyFrontPage } from '../../models/company-schemas.js';
+export declare class CompanyError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    constructor(code: string, statusCode: number, message: string);
+}
+/** Trade name → address label. Same shape rules as an app subdomain. */
+export declare function slugify(name: string): string;
+/** The public address a company answers on, or null when the co origin is not configured. */
+export declare function companyAddress(config: AimeatConfig, company: CompanyRecord): string | null;
+/** Fetch + assert ownership. Absent and not-yours answer identically (404). */
+export declare function requireOwnCompany(storage: Storage, ownerGhii: string, id: string): Promise<CompanyRecord>;
+/** Advisory availability check — the insert is what actually arbitrates. */
+export declare function checkSlugAvailable(storage: Storage, slug: string): Promise<{
+    slug: string;
+    available: boolean;
+    reason?: string;
+}>;
+export declare function createCompany(storage: Storage, ownerGhii: string, input: NewCompanyInput): Promise<CompanyRecord>;
+export declare function updateCompany(storage: Storage, ownerGhii: string, id: string, input: Partial<NewCompanyInput>): Promise<CompanyRecord>;
+/**
+ * Sets what the company address serves. An 'app' front page must be an app THIS owner
+ * published — pointing a company address at someone else's app would let it wear that
+ * app as its own.
+ */
+export declare function setFrontPage(storage: Storage, ownerGhii: string, id: string, front: CompanyFrontPage): Promise<CompanyRecord>;
+export declare function deleteCompany(storage: Storage, ownerGhii: string, id: string): Promise<void>;
+//# sourceMappingURL=company-service.d.ts.map

package/dist/src/services/company/company-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-service.d.ts","sourceRoot":"","sources":["../../../../src/services/company/company-service.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxG,qBAAa,YAAa,SAAQ,KAAK;aACT,IAAI,EAAE,MAAM;aAAkB,UAAU,EAAE,MAAM;gBAAhD,IAAI,EAAE,MAAM,EAAkB,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI9F;AAED,wEAAwE;AACxE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ5C;AAUD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAW1F;AAED,+EAA+E;AAC/E,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAI/G;AAED,4EAA4E;AAC5E,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAMvI;AAQD,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAoCvH;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAyB5I;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8CnI;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlG"}

package/dist/src/services/company/company-service.js

@@ -0,0 +1,217 @@
+/**
+ * @file src/services/company/company-service.ts
+ * @description Company lifecycle: create (slug claim), read, update, set the front page,
+ *   delete. Every legality rule lives here; routes stay thin.
+ *
+ *   Rules encoded:
+ *   - The slug is claimed by the unique index, not by a read-then-write check: two founders
+ *     naming their company the same thing at the same moment cannot both win. A taken name
+ *     answers 409 SLUG_TAKEN, and the availability check is advisory only (it can go stale
+ *     between the check and the claim — the insert is what decides).
+ *   - Reserved labels and the label shape are refused up front (the same set the apps family
+ *     uses, so a company can never shadow an infrastructure host).
+ *   - A front page of kind 'app' must name an app the SAME owner published: a company must
+ *     not be able to point its address at someone else's app and wear it as its own.
+ *   - Deleting a company frees its slug. That is deliberate: an address nobody claims should
+ *     be claimable again, and the registry is not an archive.
+ *
+ * @structure CompanyError · slugify · createCompany · updateCompany · setFrontPage ·
+ *   requireOwnCompany · companyAddress
+ * @usage const company = await createCompany(config, storage, ownerGhii, input);
+ * @version-history
+ *   v1.1.0 — 2026-08-08 — setFrontPage learns kind 'portfolio' and refuses it (409
+ *     NO_PORTFOLIO) until a page exists, so the setting never outruns the document.
+ *   v1.0.0 — 2026-08-07 — Company registry + co origin.
+ */
+import { randomUUID } from 'node:crypto';
+import { RESERVED_SUBDOMAINS, SUBDOMAIN_RE } from '../../routes/subdomains.js';
+export class CompanyError extends Error {
+    code;
+    statusCode;
+    constructor(code, statusCode, message) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.name = 'CompanyError';
+    }
+}
+/** Trade name → address label. Same shape rules as an app subdomain. */
+export function slugify(name) {
+    const base = name.toLowerCase()
+        .replace(/[äå]/g, 'a').replace(/ö/g, 'o').replace(/[éè]/g, 'e')
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 63)
+        .replace(/-+$/g, '');
+    return base;
+}
+function assertSlug(slug) {
+    if (!SUBDOMAIN_RE.test(slug)) {
+        throw new CompanyError('INVALID_SLUG', 400, 'The address must be 2-63 characters: lowercase letters, digits and hyphens, not starting or ending with a hyphen');
+    }
+    if (RESERVED_SUBDOMAINS.has(slug))
+        throw new CompanyError('SLUG_RESERVED', 409, `"${slug}" is reserved`);
+}
+/** The public address a company answers on, or null when the co origin is not configured. */
+export function companyAddress(config, company) {
+    if (!config.coHost)
+        return null;
+    let scheme = 'https';
+    let port = '';
+    try {
+        const base = new URL(config.baseUrl);
+        scheme = base.protocol.replace(':', '');
+        port = base.port ? `:${base.port}` : '';
+        // eslint-disable-next-line aimeat/no-silent-catch -- an unparseable baseUrl just means the https default
+    }
+    catch { /* https, no port */ }
+    return `${scheme}://${company.slug}.${config.coHost}${port}`;
+}
+/** Fetch + assert ownership. Absent and not-yours answer identically (404). */
+export async function requireOwnCompany(storage, ownerGhii, id) {
+    const company = await storage.getCompany(id);
+    if (!company || company.ownerGhii !== ownerGhii)
+        throw new CompanyError('NOT_FOUND', 404, 'Company not found');
+    return company;
+}
+/** Advisory availability check — the insert is what actually arbitrates. */
+export async function checkSlugAvailable(storage, slug) {
+    const clean = slug.trim().toLowerCase();
+    if (!SUBDOMAIN_RE.test(clean))
+        return { slug: clean, available: false, reason: 'INVALID_SLUG' };
+    if (RESERVED_SUBDOMAINS.has(clean))
+        return { slug: clean, available: false, reason: 'SLUG_RESERVED' };
+    const existing = await storage.getCompanyBySlug(clean);
+    return existing ? { slug: clean, available: false, reason: 'SLUG_TAKEN' } : { slug: clean, available: true };
+}
+function trimOrNull(v, max) {
+    if (typeof v !== 'string')
+        return null;
+    const t = v.trim();
+    return t ? t.slice(0, max) : null;
+}
+export async function createCompany(storage, ownerGhii, input) {
+    const name = (input.name ?? '').trim();
+    if (name.length < 2 || name.length > 140)
+        throw new CompanyError('INVALID_NAME', 400, 'name must be 2-140 characters');
+    const slug = (input.slug?.trim().toLowerCase()) || slugify(name);
+    assertSlug(slug);
+    const now = new Date().toISOString();
+    const record = {
+        id: randomUUID(), slug, ownerGhii, name,
+        description: trimOrNull(input.description, 500),
+        organismId: trimOrNull(input.organismId, 80),
+        frontPage: { kind: 'none', target: '' },
+        businessId: trimOrNull(input.businessId, 35),
+        vatId: trimOrNull(input.vatId, 35),
+        streetAddress: trimOrNull(input.streetAddress, 70),
+        postalCode: trimOrNull(input.postalCode, 20),
+        city: trimOrNull(input.city, 70),
+        country: trimOrNull(input.country, 2),
+        email: trimOrNull(input.email, 200),
+        phone: trimOrNull(input.phone, 40),
+        iban: trimOrNull(input.iban, 34),
+        bic: trimOrNull(input.bic, 11),
+        einvoiceAddress: trimOrNull(input.einvoiceAddress, 35),
+        einvoiceOperator: trimOrNull(input.einvoiceOperator, 35),
+        status: 'active',
+        createdAt: now, updatedAt: now,
+    };
+    try {
+        await storage.createCompany(record);
+    }
+    catch (e) {
+        // The unique index is the arbitration; a duplicate surfaces here and only here.
+        const taken = await storage.getCompanyBySlug(slug);
+        if (taken)
+            throw new CompanyError('SLUG_TAKEN', 409, `The address "${slug}" is already taken`);
+        throw e;
+    }
+    return record;
+}
+export async function updateCompany(storage, ownerGhii, id, input) {
+    const company = await requireOwnCompany(storage, ownerGhii, id);
+    const next = {
+        ...company,
+        name: input.name !== undefined ? (input.name ?? '').trim() : company.name,
+        description: input.description !== undefined ? trimOrNull(input.description, 500) : company.description,
+        organismId: input.organismId !== undefined ? trimOrNull(input.organismId, 80) : company.organismId,
+        businessId: input.businessId !== undefined ? trimOrNull(input.businessId, 35) : company.businessId,
+        vatId: input.vatId !== undefined ? trimOrNull(input.vatId, 35) : company.vatId,
+        streetAddress: input.streetAddress !== undefined ? trimOrNull(input.streetAddress, 70) : company.streetAddress,
+        postalCode: input.postalCode !== undefined ? trimOrNull(input.postalCode, 20) : company.postalCode,
+        city: input.city !== undefined ? trimOrNull(input.city, 70) : company.city,
+        country: input.country !== undefined ? trimOrNull(input.country, 2) : company.country,
+        email: input.email !== undefined ? trimOrNull(input.email, 200) : company.email,
+        phone: input.phone !== undefined ? trimOrNull(input.phone, 40) : company.phone,
+        iban: input.iban !== undefined ? trimOrNull(input.iban, 34) : company.iban,
+        bic: input.bic !== undefined ? trimOrNull(input.bic, 11) : company.bic,
+        einvoiceAddress: input.einvoiceAddress !== undefined ? trimOrNull(input.einvoiceAddress, 35) : company.einvoiceAddress,
+        einvoiceOperator: input.einvoiceOperator !== undefined ? trimOrNull(input.einvoiceOperator, 35) : company.einvoiceOperator,
+        updatedAt: new Date().toISOString(),
+    };
+    if (next.name.length < 2 || next.name.length > 140)
+        throw new CompanyError('INVALID_NAME', 400, 'name must be 2-140 characters');
+    // The slug is the published address: renaming the company never silently moves it.
+    await storage.updateCompany(next);
+    return next;
+}
+/**
+ * Sets what the company address serves. An 'app' front page must be an app THIS owner
+ * published — pointing a company address at someone else's app would let it wear that
+ * app as its own.
+ */
+export async function setFrontPage(storage, ownerGhii, id, front) {
+    const company = await requireOwnCompany(storage, ownerGhii, id);
+    const ownerBare = ownerGhii.split('@')[0];
+    if (front.kind === 'app') {
+        const target = (front.target ?? '').trim();
+        const slash = target.indexOf('/');
+        if (slash <= 0 || slash === target.length - 1) {
+            throw new CompanyError('INVALID_FRONT_PAGE', 400, 'An app front page is "owner/file.html"');
+        }
+        const targetOwner = target.slice(0, slash).split('@')[0];
+        const filename = target.slice(slash + 1);
+        if (targetOwner !== ownerBare) {
+            throw new CompanyError('FRONT_PAGE_NOT_YOURS', 403, 'The front page must be an app you published');
+        }
+        const app = await storage.getAppByOwnerName(ownerBare, filename);
+        if (!app)
+            throw new CompanyError('APP_NOT_FOUND', 404, `No published app "${filename}"`);
+        front = { kind: 'app', target: `${ownerBare}/${filename}` };
+    }
+    else if (front.kind === 'redirect') {
+        const target = (front.target ?? '').trim();
+        let url;
+        try {
+            url = new URL(target);
+        }
+        catch {
+            throw new CompanyError('INVALID_FRONT_PAGE', 400, 'A redirect front page must be an absolute URL');
+        }
+        if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+            throw new CompanyError('INVALID_FRONT_PAGE', 400, 'A redirect front page must be http(s)');
+        }
+        front = { kind: 'redirect', target: url.toString() };
+    }
+    else if (front.kind === 'portfolio') {
+        // Pointing the address at a page that was never published would serve a 404 while the
+        // settings claim a page is live — so the selector refuses until there is something to serve.
+        const file = await storage.getStorageFile(ownerGhii, `company/${company.id}/index.html`);
+        if (!file) {
+            throw new CompanyError('NO_PORTFOLIO', 409, 'Publish the page first — there is nothing at this address to serve yet');
+        }
+        front = { kind: 'portfolio', target: '' };
+    }
+    else {
+        front = { kind: 'none', target: '' };
+    }
+    const next = { ...company, frontPage: front, updatedAt: new Date().toISOString() };
+    await storage.updateCompany(next);
+    return next;
+}
+export async function deleteCompany(storage, ownerGhii, id) {
+    const company = await requireOwnCompany(storage, ownerGhii, id);
+    await storage.deleteCompany(company.id);
+}
+//# sourceMappingURL=company-service.js.map

package/dist/src/services/company/company-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-service.js","sourceRoot":"","sources":["../../../../src/services/company/company-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/E,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA8B;IAA1D,YAA4B,IAAY,EAAkB,UAAkB,EAAE,OAAe;QAC3F,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAAkB,eAAU,GAAV,UAAU,CAAQ;QAE1E,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;SAC5B,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SAC9D,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EACxC,kHAAkH,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,IAAI,eAAe,CAAC,CAAC;AAC3G,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,OAAsB;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,GAAG,OAAO,CAAC;IACrB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,yGAAyG;IAC3G,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChC,OAAO,GAAG,MAAM,MAAM,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,SAAiB,EAAE,EAAU;IACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/G,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAChG,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,UAAU,CAAC,CAA4B,EAAE,GAAW;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,SAAiB,EAAE,KAAsB;IAC7F,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAkB;QAC5B,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;QACvC,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;QAC/C,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QACvC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAClD,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;QACnC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9B,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC;QACtD,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACxD,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG;KAC/B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,gFAAgF;QAChF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,GAAG,EAAE,gBAAgB,IAAI,oBAAoB,CAAC,CAAC;QAC/F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,SAAiB,EAAE,EAAU,EAAE,KAA+B;IAClH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAkB;QAC1B,GAAG,OAAO;QACV,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QACzE,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW;QACvG,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;QAClG,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;QAClG,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC9E,aAAa,EAAE,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;QAC9G,UAAU,EAAE,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;QAClG,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC1E,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;QACrF,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC/E,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QAC9E,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC1E,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACtE,eAAe,EAAE,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe;QACtH,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB;QAC1H,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IACjI,mFAAmF;IACnF,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,SAAiB,EAAE,EAAU,EAAE,KAAuB;IACzG,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,GAAG,EAAE,6CAA6C,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,qBAAqB,QAAQ,GAAG,CAAC,CAAC;QACzF,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,IAAI,QAAQ,EAAE,EAAE,CAAC;IAC9D,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,+CAA+C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC1D,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvD,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACtC,sFAAsF;QACtF,6FAA6F;QAC7F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EACxC,wEAAwE,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAkB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAClG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,SAAiB,EAAE,EAAU;IACjF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/services/company/company-smtp.d.ts

@@ -0,0 +1,42 @@
+import type { AimeatConfig } from '../../config.js';
+import type { Storage } from '../../storage/interface.js';
+import type { CompanySmtpRecord, CompanySmtpPublic } from '../../models/company-smtp-schemas.js';
+import type { EmailAttachment } from '../email.js';
+export interface CompanySmtpInput {
+    host: string;
+    port?: number;
+    secure?: boolean;
+    username?: string | null;
+    /** Plaintext on the way in only; stored encrypted. Omit on an update to keep the stored one. */
+    password?: string | null;
+    fromAddress: string;
+    fromName?: string | null;
+    replyTo?: string | null;
+}
+/** Stores (or replaces) a company's sending identity. Refuses a password it cannot encrypt. */
+export declare function setCompanySmtp(config: AimeatConfig, storage: Storage, ownerGhii: string, companyId: string, input: CompanySmtpInput): Promise<CompanySmtpPublic>;
+/** The sending identity as any read returns it: no password, only whether one is set. */
+export declare function getCompanySmtpPublic(storage: Storage, ownerGhii: string, companyId: string): Promise<CompanySmtpPublic | null>;
+export declare function deleteCompanySmtp(storage: Storage, ownerGhii: string, companyId: string): Promise<void>;
+export interface CompanySender {
+    smtp: CompanySmtpRecord;
+    password: string | null;
+}
+/**
+ * Resolves the company's sending identity for a send. Returns null when the company has
+ * none — the caller then falls back to the node's shared sender, which is the honest
+ * default rather than a failure.
+ */
+export declare function resolveCompanySender(config: AimeatConfig, storage: Storage, ownerGhii: string, companyId: string): Promise<CompanySender | null>;
+/**
+ * Sends one message through the company's own SMTP server. Never throws on a delivery
+ * failure — the outbound door records the outcome in its log, and an exception here would
+ * lose that record.
+ */
+export declare function sendAsCompany(sender: CompanySender, to: string, subject: string, html: string, text: string, attachments?: EmailAttachment[]): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=company-smtp.d.ts.map

package/dist/src/services/company/company-smtp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-smtp.d.ts","sourceRoot":"","sources":["../../../../src/services/company/company-smtp.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAEjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKnD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID,+FAA+F;AAC/F,wBAAsB,cAAc,CAClC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GACpG,OAAO,CAAC,iBAAiB,CAAC,CAuC5B;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAIpI;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7G;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAC3E,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAc/B;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAC9E,WAAW,GAAE,eAAe,EAAO,GAClC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBtD"}

package/dist/src/services/company/company-smtp.js

@@ -0,0 +1,127 @@
+/**
+ * @file src/services/company/company-smtp.ts
+ * @description A company's own sending identity: store it, read it back without the
+ *   password, and build a nodemailer transport from it at send time.
+ *
+ *   Two rules that are the whole point of this file:
+ *   1. The password is stored as AES-256-GCM ciphertext and NEVER returned by any read.
+ *      Without an encryption key the node REFUSES to store one rather than writing it in
+ *      the clear — a credential that cannot be protected is not accepted.
+ *   2. The transport is built per send and closed after: a company's SMTP server is its
+ *      own, and holding a long-lived pooled connection per company would leak both file
+ *      descriptors and the fact of who sent when.
+ *
+ * @structure setCompanySmtp · getCompanySmtpPublic · resolveCompanySender · sendAsCompany
+ * @usage const sender = await resolveCompanySender(config, storage, ownerGhii, companyId);
+ * @version-history
+ *   v1.0.0 — 2026-08-07 — Per-company sending identity for the outbound door.
+ */
+import { createTransport } from 'nodemailer';
+import { toPublicSmtp } from '../../models/company-smtp-schemas.js';
+import { encrypt, decrypt, getEncryptionKey } from '../encryption.js';
+import { logger } from '../../utils/logger.js';
+import { CompanyError, requireOwnCompany } from './company-service.js';
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Stores (or replaces) a company's sending identity. Refuses a password it cannot encrypt. */
+export async function setCompanySmtp(config, storage, ownerGhii, companyId, input) {
+    await requireOwnCompany(storage, ownerGhii, companyId);
+    const host = (input.host ?? '').trim();
+    if (!host || host.length > 253)
+        throw new CompanyError('INVALID_SMTP', 400, 'host is required');
+    const fromAddress = (input.fromAddress ?? '').trim().toLowerCase();
+    if (!EMAIL_RE.test(fromAddress))
+        throw new CompanyError('INVALID_SMTP', 400, 'fromAddress must be an email address');
+    const port = input.port ?? 587;
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new CompanyError('INVALID_SMTP', 400, 'port must be 1-65535');
+    if (input.replyTo && !EMAIL_RE.test(input.replyTo.trim())) {
+        throw new CompanyError('INVALID_SMTP', 400, 'replyTo must be an email address');
+    }
+    const existing = await storage.getCompanySmtp(companyId);
+    let passwordEnc = existing?.passwordEnc ?? null;
+    if (input.password !== undefined && input.password !== null && input.password !== '') {
+        const key = getEncryptionKey(config);
+        if (!key) {
+            // Refusing beats storing a credential in the clear, and saying so beats a silent downgrade.
+            throw new CompanyError('NO_ENCRYPTION_KEY', 503, 'This node cannot store an SMTP password: AIMEAT_ENCRYPTION_KEY is unset');
+        }
+        passwordEnc = encrypt(input.password, key);
+    }
+    const now = new Date().toISOString();
+    const row = {
+        companyId, ownerGhii, host, port,
+        secure: input.secure ?? (port === 465),
+        username: input.username?.trim() || null,
+        passwordEnc,
+        fromAddress,
+        fromName: input.fromName?.trim() || null,
+        replyTo: input.replyTo?.trim().toLowerCase() || null,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+    };
+    await storage.setCompanySmtp(row);
+    return toPublicSmtp(row);
+}
+/** The sending identity as any read returns it: no password, only whether one is set. */
+export async function getCompanySmtpPublic(storage, ownerGhii, companyId) {
+    await requireOwnCompany(storage, ownerGhii, companyId);
+    const row = await storage.getCompanySmtp(companyId);
+    return row ? toPublicSmtp(row) : null;
+}
+export async function deleteCompanySmtp(storage, ownerGhii, companyId) {
+    await requireOwnCompany(storage, ownerGhii, companyId);
+    await storage.deleteCompanySmtp(companyId);
+}
+/**
+ * Resolves the company's sending identity for a send. Returns null when the company has
+ * none — the caller then falls back to the node's shared sender, which is the honest
+ * default rather than a failure.
+ */
+export async function resolveCompanySender(config, storage, ownerGhii, companyId) {
+    const company = await requireOwnCompany(storage, ownerGhii, companyId);
+    const smtp = await storage.getCompanySmtp(company.id);
+    if (!smtp)
+        return null;
+    let password = null;
+    if (smtp.passwordEnc) {
+        const key = getEncryptionKey(config);
+        if (!key) {
+            throw new CompanyError('NO_ENCRYPTION_KEY', 503, 'The stored SMTP password cannot be read: AIMEAT_ENCRYPTION_KEY is unset');
+        }
+        password = decrypt(smtp.passwordEnc, key);
+    }
+    return { smtp, password };
+}
+/**
+ * Sends one message through the company's own SMTP server. Never throws on a delivery
+ * failure — the outbound door records the outcome in its log, and an exception here would
+ * lose that record.
+ */
+export async function sendAsCompany(sender, to, subject, html, text, attachments = []) {
+    const { smtp, password } = sender;
+    const transporter = createTransport({
+        host: smtp.host,
+        port: smtp.port,
+        secure: smtp.secure,
+        auth: smtp.username ? { user: smtp.username, pass: password ?? '' } : undefined,
+    });
+    try {
+        const from = smtp.fromName ? `"${smtp.fromName.replaceAll('"', "'")}" <${smtp.fromAddress}>` : smtp.fromAddress;
+        await transporter.sendMail({
+            from, to, subject, html, text,
+            replyTo: smtp.replyTo ?? undefined,
+            attachments: attachments.map((a) => ({ filename: a.filename, content: a.content, contentType: a.contentType })),
+        });
+        // Never log the recipient address (the same privacy rule the shared service keeps).
+        logger.info(`Company SMTP send ok: ${subject}`);
+        return { ok: true };
+    }
+    catch (err) {
+        logger.error(`Company SMTP send failed: ${subject}`, { error: err.message });
+        return { ok: false, error: err.message.slice(0, 200) };
+    }
+    finally {
+        transporter.close();
+    }
+}
+//# sourceMappingURL=company-smtp.js.map

package/dist/src/services/company/company-smtp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-smtp.js","sourceRoot":"","sources":["../../../../src/services/company/company-smtp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAcvE,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoB,EAAE,OAAgB,EAAE,SAAiB,EAAE,SAAiB,EAAE,KAAuB;IAErG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChG,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC7H,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,4FAA4F;YAC5F,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,GAAG,EAC7C,yEAAyE,CAAC,CAAC;QAC/E,CAAC;QACD,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAsB;QAC7B,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI;QACxC,WAAW;QACX,WAAW;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI;QACxC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI;QACpD,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;QACrC,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAgB,EAAE,SAAiB,EAAE,SAAiB;IAC/F,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,SAAiB,EAAE,SAAiB;IAC5F,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EAAE,OAAgB,EAAE,SAAiB,EAAE,SAAiB;IAE5E,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,GAAG,EAC7C,yEAAyE,CAAC,CAAC;QAC/E,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EAAE,EAAU,EAAE,OAAe,EAAE,IAAY,EAAE,IAAY,EAC9E,cAAiC,EAAE;IAEnC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,WAAW,GAAG,eAAe,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;KAChF,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAChH,MAAM,WAAW,CAAC,QAAQ,CAAC;YACzB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;SAChH,CAAC,CAAC;QACH,oFAAoF;QACpF,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/src/services/component-registrar.d.ts

@@ -13,6 +13,11 @@
  * @usage
  *   import { registerComponent, deleteComponent, fetchComponentContent, computeHash } from '../services/component-registrar.js';
  * @version-history
+ *   v1.3.0 — 2026-08-10 — An extension component goes through buildExtensionRecordFromManifest, the
+ *     same builder POST /v1/extensions uses. This file had its own, lenient one, so a component
+ *     registered here skipped every gate the front door applies — and the content is not always a
+ *     published package's: apply-migration takes it from the request body. Adds
+ *     validateComponentContent() so a caller can refuse bad content BEFORE deleting the old.
  *   v1.0.0 — 2026-03-15 — initial implementation
  *   v1.1.0 — 2026-03-16 — fix memory component key management: use manifest key
  *     instead of prefix-based lookup for delete/fetch; store keys as-is without
@@ -20,6 +25,7 @@
  *   v1.2.0 — 2026-05-05 — preserve lib component fields (filename, exports,
  *     api_surface) in cortex registration; pass package metadata to app manifests
  */
+import type { AimeatConfig } from '../config.js';
 import type { Storage, PackageComponentType } from '../storage/interface.js';
 export interface ComponentRegistrationResult {
     success: boolean;
@@ -30,6 +36,8 @@ export interface ComponentRegistrationResult {
     originalShortName?: string;
 }
 export interface ComponentRegistrationInput {
+    /** Node config: the extension builder needs it for limit ceilings and currency validation. */
+    config: AimeatConfig;
     componentId: string;
     type: PackageComponentType;
     registeredAs: string;
@@ -59,6 +67,24 @@ export interface ComponentRegistrationInput {
 }
 /** Compute SHA-256 hash of content string */
 export declare function computeHash(content: string): string;
+/**
+ * Can this content be registered as this component type? Answers WITHOUT touching storage.
+ *
+ * The migration flow deletes the existing component and then registers the new one, which was safe
+ * only while registration accepted anything. It does not any more: an extension component now goes
+ * through the same manifest builder as POST /v1/extensions, so a caller-supplied `content` that the
+ * builder refuses would leave the old component deleted and nothing in its place. Callers check
+ * this first, before they delete.
+ *
+ * Only `extension` has anything to check today. Every other type returns ok, so a caller can run
+ * this unconditionally.
+ */
+export declare function validateComponentContent(type: PackageComponentType, content: string, registeredAs: string, config: AimeatConfig, owner: string): {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
 /** Register a single component in its native storage repository */
 export declare function registerComponent(storage: Storage, input: ComponentRegistrationInput): Promise<ComponentRegistrationResult>;
 /** Delete a previously registered component from its native storage */

package/dist/src/services/component-registrar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component-registrar.d.ts","sourceRoot":"","sources":["../../../src/services/component-registrar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAmB,MAAM,yBAAyB,CAAC;AAK9F,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE;QACZ,kEAAkE;QAClE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,qEAAqE;QACrE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;CACH;AAID,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AA6DD,mEAAmE;AACnE,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA4TtC;AAID,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAkDlB;AAID,yEAAyE;AACzE,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0DxB"}
+{"version":3,"file":"component-registrar.d.ts","sourceRoot":"","sources":["../../../src/services/component-registrar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAmB,MAAM,yBAAyB,CAAC;AAK9F,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,8FAA8F;IAC9F,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE;QACZ,kEAAkE;QAClE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,qEAAqE;QACrE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;CACH;AAID,6CAA6C;AAC7C,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AA6DD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAgB7C;AAID,mEAAmE;AACnE,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAgUtC;AAID,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAkDlB;AAID,yEAAyE;AACzE,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0DxB"}