aimeat 2.7.0 → 3.0.0

package/dist/src/services/message-alias.d.ts

@@ -0,0 +1,105 @@
+/**
+ * @file message-alias.ts
+ * @description Named message addresses that stand for a GROUP of people rather than one person.
+ *
+ *   `support@operators` is the first and, for now, the only one. It exists because the identity
+ *   model is correct and unusable as a support address: a GHII names one person on one node, so
+ *   asking for help means first working out who runs the node and what their identity string is.
+ *   Nobody does that. They give up, or they email a human who happens to have a contact, which is
+ *   how the last external report reached this project six days late.
+ *
+ *   So the address is the capability: write to `support@operators` and every operator gets it, in
+ *   ONE thread, in the same Messages surface where they already answer people. What each operator
+ *   sees is a group conversation (services/conversation-group.ts), not a new inbox and not a
+ *   dashboard tab — that distinction is the whole lesson of the feedback channel it replaces, which
+ *   collected seven genuine reports that nobody ever opened.
+ *
+ *   The alias resolves AT SEND TIME and the thread keeps the alias rather than the resolved list,
+ *   because "who is an operator" changes and "what this person addressed" does not.
+ * @structure
+ *   - SUPPORT_ALIAS / OPERATORS_HOST — the address vocabulary
+ *   - isAliasAddress() — does this `to:` name a group rather than a person
+ *   - openSupportThread() — resolve the operators, open the group thread
+ * @usage
+ *   if (isAliasAddress(to, config.nodeId)) { const t = await openSupportThread(ctx, sender, subject); }
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial: support@operators over group conversations.
+ */
+import type { AimeatConfig } from '../config.js';
+import type { ConversationRecord } from '../storage/interface.js';
+import type { DeliveryCtx } from './message-delivery.js';
+/** The local part. Reserved in utils/gaii.ts so nobody registers an owner by this name. */
+export declare const SUPPORT_LOCAL_PART = "support";
+/**
+ * The host part of the short form: `support@operators`.
+ *
+ * It is deliberately NOT a node id. A node id is `aimeat-{region}-{nnn}-{name}` and nobody memorises
+ * one; "operators" is a word, which is the entire reason the address works. The long form
+ * `support@{nodeId}` is accepted too and is what a sender on another node would use once group
+ * threads cross nodes.
+ */
+export declare const OPERATORS_HOST = "operators";
+/** The canonical address to print in docs, prompts and error messages. One place, so a change to it
+ *  is one edit rather than fourteen. */
+export declare const SUPPORT_ADDRESS = "support@operators";
+/** True when `to` names this node's operators rather than a single principal. */
+export declare function isAliasAddress(to: string, nodeId: string): boolean;
+export type OpenSupportResult = {
+    ok: true;
+    conversation: ConversationRecord;
+    operators: string[];
+} | {
+    ok: false;
+    code: 'NO_OPERATORS';
+    message: string;
+};
+/**
+ * Open a support thread: resolve the operators now, and put them and the sender in one group.
+ *
+ * The sender is a participant, so the thread appears in their own Messages exactly as it does in
+ * every operator's — one conversation, both sides, no ticket portal.
+ *
+ * A node with no operator refuses rather than silently accepting: a message with no recipient that
+ * reports success is worse than an error, because the person believes they asked for help.
+ */
+export declare function openSupportThread(ctx: DeliveryCtx, config: AimeatConfig, senderGhii: string, subject?: string): Promise<OpenSupportResult>;
+export type GroupTarget = {
+    kind: 'none';
+} | {
+    kind: 'group';
+    conversation: ConversationRecord;
+} | {
+    kind: 'refused';
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * Decide whether a send is going to a GROUP thread, and to which one.
+ *
+ * Shared by POST /v1/messages and the MCP send tools, so both doors treat `support@operators` and a
+ * group conversation id the same way — one capability, one implementation, whatever the interface.
+ *
+ * Three outcomes, in the order they are checked:
+ *   1. A `conversation_id` naming a stored conversation → that group. (A pair thread has no record,
+ *      so an unknown id falls through to the ordinary path and behaves exactly as it did before.)
+ *   2. A `to` naming an alias → open a fresh thread. Every aliased send with no conversation id
+ *      starts a new one: a support request is a ticket, and silently gluing an unrelated question
+ *      onto last week's thread is how a support queue becomes unreadable.
+ *   3. Anything else → not a group; the caller carries on with 1:1 delivery.
+ */
+export declare function resolveGroupTarget(ctx: DeliveryCtx, config: AimeatConfig, senderGhii: string, input: {
+    to: string;
+    conversationId?: string;
+    subject?: string;
+}): Promise<GroupTarget>;
+/**
+ * Bring an existing support thread's membership up to date before a message lands in it.
+ *
+ * An operator appointed after the thread opened should see the next message in it; one who lost the
+ * role should not. The membership is therefore the CREATOR plus whoever holds the role right now —
+ * the person who asked for help never stops belonging to their own conversation, and everyone else
+ * in the thread is there by virtue of the role, which is exactly what the alias promised.
+ */
+export declare function refreshSupportParticipants(ctx: DeliveryCtx, config: AimeatConfig, convo: ConversationRecord): Promise<ConversationRecord>;
+//# sourceMappingURL=message-alias.d.ts.map

package/dist/src/services/message-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-alias.d.ts","sourceRoot":"","sources":["../../../src/services/message-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;wCACwC;AACxC,eAAO,MAAM,eAAe,sBAA4C,CAAC;AAEzE,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,CAAC,CAkB5B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,WAAW,CAAC,CAmBtB;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAU7B"}

package/dist/src/services/message-alias.js

@@ -0,0 +1,102 @@
+import { listOperatorGhiis } from './operators.js';
+import { createGroupConversation, setParticipants } from './conversation-group.js';
+/** The local part. Reserved in utils/gaii.ts so nobody registers an owner by this name. */
+export const SUPPORT_LOCAL_PART = 'support';
+/**
+ * The host part of the short form: `support@operators`.
+ *
+ * It is deliberately NOT a node id. A node id is `aimeat-{region}-{nnn}-{name}` and nobody memorises
+ * one; "operators" is a word, which is the entire reason the address works. The long form
+ * `support@{nodeId}` is accepted too and is what a sender on another node would use once group
+ * threads cross nodes.
+ */
+export const OPERATORS_HOST = 'operators';
+/** The canonical address to print in docs, prompts and error messages. One place, so a change to it
+ *  is one edit rather than fourteen. */
+export const SUPPORT_ADDRESS = `${SUPPORT_LOCAL_PART}@${OPERATORS_HOST}`;
+/** True when `to` names this node's operators rather than a single principal. */
+export function isAliasAddress(to, nodeId) {
+    const trimmed = to.trim().toLowerCase();
+    return trimmed === `${SUPPORT_LOCAL_PART}@${OPERATORS_HOST}`
+        || trimmed === `${SUPPORT_LOCAL_PART}@${nodeId.toLowerCase()}`;
+}
+/**
+ * Open a support thread: resolve the operators now, and put them and the sender in one group.
+ *
+ * The sender is a participant, so the thread appears in their own Messages exactly as it does in
+ * every operator's — one conversation, both sides, no ticket portal.
+ *
+ * A node with no operator refuses rather than silently accepting: a message with no recipient that
+ * reports success is worse than an error, because the person believes they asked for help.
+ */
+export async function openSupportThread(ctx, config, senderGhii, subject) {
+    const operators = await listOperatorGhiis(ctx.storage, config);
+    if (!operators.length) {
+        return { ok: false, code: 'NO_OPERATORS', message: 'This node has no operator to receive support messages' };
+    }
+    const created = await createGroupConversation(ctx, {
+        createdBy: senderGhii,
+        participants: operators,
+        subject: subject?.trim() || 'Support request',
+        alias: SUPPORT_ADDRESS,
+    });
+    // Every refusal createGroupConversation can return is impossible here (the membership is this
+    // node's own operators plus the sender, and the count is bounded by the operator list), so a
+    // failure means the invariant broke rather than the input being bad — surface it as one.
+    if (!created.ok)
+        return { ok: false, code: 'NO_OPERATORS', message: created.message };
+    return { ok: true, conversation: created.conversation, operators };
+}
+/**
+ * Decide whether a send is going to a GROUP thread, and to which one.
+ *
+ * Shared by POST /v1/messages and the MCP send tools, so both doors treat `support@operators` and a
+ * group conversation id the same way — one capability, one implementation, whatever the interface.
+ *
+ * Three outcomes, in the order they are checked:
+ *   1. A `conversation_id` naming a stored conversation → that group. (A pair thread has no record,
+ *      so an unknown id falls through to the ordinary path and behaves exactly as it did before.)
+ *   2. A `to` naming an alias → open a fresh thread. Every aliased send with no conversation id
+ *      starts a new one: a support request is a ticket, and silently gluing an unrelated question
+ *      onto last week's thread is how a support queue becomes unreadable.
+ *   3. Anything else → not a group; the caller carries on with 1:1 delivery.
+ */
+export async function resolveGroupTarget(ctx, config, senderGhii, input) {
+    if (input.conversationId) {
+        const existing = await ctx.storage.getConversation(input.conversationId);
+        if (existing) {
+            const fresh = await refreshSupportParticipants(ctx, config, existing);
+            return { kind: 'group', conversation: fresh };
+        }
+        return { kind: 'none' };
+    }
+    if (isAliasAddress(input.to, config.nodeId)) {
+        const opened = await openSupportThread(ctx, config, senderGhii, input.subject);
+        if (!opened.ok) {
+            return { kind: 'refused', status: 503, code: opened.code, message: opened.message };
+        }
+        return { kind: 'group', conversation: opened.conversation };
+    }
+    return { kind: 'none' };
+}
+/**
+ * Bring an existing support thread's membership up to date before a message lands in it.
+ *
+ * An operator appointed after the thread opened should see the next message in it; one who lost the
+ * role should not. The membership is therefore the CREATOR plus whoever holds the role right now —
+ * the person who asked for help never stops belonging to their own conversation, and everyone else
+ * in the thread is there by virtue of the role, which is exactly what the alias promised.
+ */
+export async function refreshSupportParticipants(ctx, config, convo) {
+    if (convo.alias !== SUPPORT_ADDRESS)
+        return convo;
+    const operators = await listOperatorGhiis(ctx.storage, config);
+    if (!operators.length)
+        return convo;
+    const merged = [...new Set([convo.createdBy, ...operators])];
+    const unchanged = merged.length === convo.participants.length && merged.every(p => convo.participants.includes(p));
+    if (unchanged)
+        return convo;
+    return (await setParticipants(ctx, convo.id, merged)) ?? convo;
+}
+//# sourceMappingURL=message-alias.js.map

package/dist/src/services/message-alias.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-alias.js","sourceRoot":"","sources":["../../../src/services/message-alias.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAEnF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;wCACwC;AACxC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,kBAAkB,IAAI,cAAc,EAAE,CAAC;AAEzE,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAc;IACvD,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,OAAO,KAAK,GAAG,kBAAkB,IAAI,cAAc,EAAE;WACvD,OAAO,KAAK,GAAG,kBAAkB,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AACnE,CAAC;AAMD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAgB,EAChB,MAAoB,EACpB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC;IAC/G,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE;QACjD,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,iBAAiB;QAC7C,KAAK,EAAE,eAAe;KACvB,CAAC,CAAC;IACH,8FAA8F;IAC9F,6FAA6F;IAC7F,yFAAyF;IACzF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAEtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC;AACrE,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAgB,EAChB,MAAoB,EACpB,UAAkB,EAClB,KAAgE;IAEhE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAgB,EAChB,MAAoB,EACpB,KAAyB;IAEzB,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAE5B,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC;AACjE,CAAC"}

package/dist/src/services/message-provenance.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @file message-provenance.ts
+ * @description Which model wrote a message, resolved for a page of messages in one query.
+ *
+ *   Every message already carries `aiProvenanceId` (TARGET-058), and the record behind it holds the
+ *   generator — but the messaging surfaces returned only the id, so reading a thread told you an AI
+ *   had written something and never which AI. That is the fact a person actually wants when an agent
+ *   answers them, and the one an operator wants when triaging a support thread: a report from a
+ *   capable model and a report from a weak one need different amounts of trust, and until now
+ *   nothing on the screen distinguished them.
+ *
+ *   `getAiProvenanceMany` means a thread costs ONE extra query rather than one per message.
+ * @structure withMessageProvenance(storage, messages) → the same messages, each with `ai` attached
+ * @usage const enriched = await withMessageProvenance(storage, thread.messages);
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial: surface the writing model on messaging reads.
+ */
+import type { Storage, DirectMessageRecord } from '../storage/interface.js';
+/**
+ * What a reader is told about how a message was written.
+ *
+ * `model` is SELF-REPORTED by the agent (identify_platform) unless the write declared its own, and
+ * `observed` says which: false means the node inferred "an AI wrote this" from who was holding the
+ * pen and took the model's name on trust. Rendering it without that distinction would turn a claim
+ * into a measurement.
+ */
+export interface MessageAiSummary {
+    level: string;
+    model?: string;
+    provider?: string;
+    observed: boolean;
+}
+type WithAi<T> = T & {
+    ai?: MessageAiSummary;
+};
+/**
+ * Attach the provenance summary to each message that has one. Messages without an id come back
+ * untouched: absent provenance is UNSTATED, never "a human wrote it", so inventing a summary for
+ * them would be the one false statement this whole subsystem exists to prevent.
+ *
+ * Best-effort by design — a provenance read that fails must not fail the inbox.
+ */
+export declare function withMessageProvenance<T extends Pick<DirectMessageRecord, 'aiProvenanceId'>>(storage: Storage, messages: T[]): Promise<WithAi<T>[]>;
+export {};
+//# sourceMappingURL=message-provenance.d.ts.map

package/dist/src/services/message-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-provenance.d.ts","sourceRoot":"","sources":["../../../src/services/message-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG5E;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EAC/F,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,EAAE,GACZ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CA0BtB"}

package/dist/src/services/message-provenance.js

@@ -0,0 +1,38 @@
+import { logger } from '../utils/logger.js';
+/**
+ * Attach the provenance summary to each message that has one. Messages without an id come back
+ * untouched: absent provenance is UNSTATED, never "a human wrote it", so inventing a summary for
+ * them would be the one false statement this whole subsystem exists to prevent.
+ *
+ * Best-effort by design — a provenance read that fails must not fail the inbox.
+ */
+export async function withMessageProvenance(storage, messages) {
+    const ids = [...new Set(messages.map(m => m.aiProvenanceId).filter((id) => !!id))];
+    if (!ids.length)
+        return messages;
+    let byId = new Map();
+    try {
+        const rows = await storage.getAiProvenanceMany(ids);
+        byId = new Map(rows.map(row => {
+            const record = row.record;
+            const summary = {
+                level: record.level ?? 'ai-generated',
+                observed: record.attestation?.observed === true,
+            };
+            if (record.generator?.model)
+                summary.model = record.generator.model;
+            if (record.generator?.provider)
+                summary.provider = record.generator.provider;
+            return [row.id, summary];
+        }));
+    }
+    catch (err) {
+        logger.warn('withMessageProvenance: continuing without provenance', { error: String(err) });
+        return messages;
+    }
+    return messages.map(m => {
+        const summary = m.aiProvenanceId ? byId.get(m.aiProvenanceId) : undefined;
+        return summary ? { ...m, ai: summary } : m;
+    });
+}
+//# sourceMappingURL=message-provenance.js.map

package/dist/src/services/message-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-provenance.js","sourceRoot":"","sources":["../../../src/services/message-provenance.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAmB5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,QAAa;IAEb,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAEjC,IAAI,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAqH,CAAC;YACzI,MAAM,OAAO,GAAqB;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,cAAc;gBACrC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,KAAK,IAAI;aAChD,CAAC;YACF,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK;gBAAE,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;YACpE,IAAI,MAAM,CAAC,SAAS,EAAE,QAAQ;gBAAE,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAU,CAAC;QACpC,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/services/metered-access.d.ts

@@ -122,6 +122,27 @@ export type MeteredOutcome =
  * `agentwork:alice/bot` both name their seller; a bare extension name does not, so that door supplies it.
  */
 export declare function providerOwnerOfCoordinate(coordExt: string): string | null;
+/**
+ * May this session spend its owner's money — and is it under its ceiling? Returns the refusal, or
+ * null when spending is allowed. Exported because the permission has to be checked at EVERY place
+ * that actually charges, not only in the entitlement chokepoint: the uncontracted per-call channel
+ * in paywall.ts settles on its own and would otherwise be a way around the permission.
+ *
+ * Call it ONLY where a charge is about to happen. Asking it of a free call is what locked hosted
+ * apps out of their own free capabilities.
+ */
+export declare function appSpendRefusal(storage: Storage, session?: {
+    roles: string[];
+    scopes: string[];
+    appGrantId?: string | null;
+} | null): Promise<{
+    kind: 'scope_required';
+    scope: string;
+} | {
+    kind: 'app_cap_reached';
+    capMorsels: number;
+    spentMorsels: number;
+} | null>;
 /**
  * Decide, and settle, one metered call. The whole sequence, in the one place every door shares:
  *

package/dist/src/services/metered-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metered-access.d.ts","sourceRoot":"","sources":["../../../src/services/metered-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEkB,KAAK,kBAAkB,EAC/C,MAAM,yBAAyB,CAAC;AAEjC,qFAAqF;AACrF,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc;AACxB,uFAAuF;AACrF;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE;AACxB,4GAA4G;GAC1G;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,gFAAgF;GAC9E;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC3C,2EAA2E;GACzE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACvE,kDAAkD;GAChD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE;AAC7D,6EAA6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE;AAChE,8DAA8D;GAC5D;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACpG,8DAA8D;GAC5D;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAChF;;;;;GAKG;GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;CACzD,CAAC;AAEN;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzE;AA0BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACpF,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B"}
+{"version":3,"file":"metered-access.d.ts","sourceRoot":"","sources":["../../../src/services/metered-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEkB,KAAK,kBAAkB,EAC/C,MAAM,yBAAyB,CAAC;AAEjC,qFAAqF;AACrF,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAE5C,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,wGAAwG;IACxG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc;AACxB,uFAAuF;AACrF;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE;AACxB,4GAA4G;GAC1G;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,gFAAgF;GAC9E;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC3C,2EAA2E;GACzE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACvE,kDAAkD;GAChD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE;AAC7D,6EAA6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE;AAChE,8DAA8D;GAC5D;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACpG,8DAA8D;GAC5D;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAChF;;;;;GAKG;GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;CACzD,CAAC;AAEN;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzE;AA0BD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GACjF,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAgBnI;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,qFAAqF;IACrF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACpF,GAAG,OAAO,CAAC,cAAc,CAAC,CAuE1B"}

package/dist/src/services/metered-access.js

@@ -41,6 +41,33 @@ function grandfathered(grant) {
     const created = Date.parse(grant.createdAt);
     return Number.isFinite(created) && created < SPEND_SCOPE_INTRODUCED;
 }
+/**
+ * May this session spend its owner's money — and is it under its ceiling? Returns the refusal, or
+ * null when spending is allowed. Exported because the permission has to be checked at EVERY place
+ * that actually charges, not only in the entitlement chokepoint: the uncontracted per-call channel
+ * in paywall.ts settles on its own and would otherwise be a way around the permission.
+ *
+ * Call it ONLY where a charge is about to happen. Asking it of a free call is what locked hosted
+ * apps out of their own free capabilities.
+ */
+export async function appSpendRefusal(storage, session) {
+    if (!session?.roles.includes('app'))
+        return null;
+    const appGrant = session.appGrantId ? await storage.getAppGrant(session.appGrantId) : null;
+    if (!session.scopes.includes('*')
+        && !session.scopes.includes(SPEND_SCOPE)
+        && !session.scopes.includes('contract:*')
+        && !grandfathered(appGrant)) {
+        return { kind: 'scope_required', scope: SPEND_SCOPE };
+    }
+    // The permission answers WHETHER; the ceiling answers HOW MUCH. Read before the call rather than
+    // after, so an app is stopped at its limit instead of discovering it by exceeding it.
+    if (appGrant && appGrant.spendCapMorsels !== null && appGrant.spendCapMorsels !== undefined
+        && (appGrant.spentMorsels ?? 0) >= appGrant.spendCapMorsels) {
+        return { kind: 'app_cap_reached', capMorsels: appGrant.spendCapMorsels, spentMorsels: appGrant.spentMorsels ?? 0 };
+    }
+    return null;
+}
 /**
  * Decide, and settle, one metered call. The whole sequence, in the one place every door shares:
  *
@@ -63,28 +90,27 @@ export async function authoriseMeteredCall(args) {
     const callerOwner = ownerGhiiOf(caller).split('@')[0];
     if (providerOwner && callerOwner === providerOwner)
         return { kind: 'free_owner' };
-    // 1b. A hosted app spends its OWNER's money. Reading their memory and buying on their behalf are
-    //     different favours, and an app grant presents the owner's own GHII, so without this the
-    //     narrowest grant there is reached any contract they held. Checked after owner-free, because
-    //     an app calling its own owner's capability costs nobody anything.
-    const appGrant = session?.appGrantId ? await storage.getAppGrant(session.appGrantId) : null;
-    if (session?.roles.includes('app')
-        && !session.scopes.includes('*')
-        && !session.scopes.includes(SPEND_SCOPE)
-        && !session.scopes.includes('contract:*')
-        && !grandfathered(appGrant)) {
-        return { kind: 'scope_required', scope: SPEND_SCOPE };
-    }
-    // 1c. The permission answers WHETHER; the ceiling answers HOW MUCH. Read before the call rather
-    //     than after, so an app is stopped at its limit instead of discovering it by exceeding it.
-    if (appGrant && appGrant.spendCapMorsels !== null && appGrant.spendCapMorsels !== undefined
-        && (appGrant.spentMorsels ?? 0) >= appGrant.spendCapMorsels) {
-        return { kind: 'app_cap_reached', capMorsels: appGrant.spendCapMorsels, spentMorsels: appGrant.spentMorsels ?? 0 };
-    }
     // 2. Whatever authorises this call — a grant wins over a contract while it is active.
+    //
+    //    BEFORE the app-spend checks below, deliberately. Those checks are about SPENDING, and nothing
+    //    is spent when nothing authorises a charge: an app asked for permission to spend before we
+    //    knew whether this call costs anything, so a hosted app could not call its own free capability
+    //    without holding a money permission it had no use for. (That is how TINKI's own app was locked
+    //    out of its own extension — the door answered SCOPE_DENIED for a call that was free.)
+    //    `no_right` means no charge is authorised here; the caller's door decides what to offer, and
+    //    every path that actually charges re-checks the permission (see below and paywall.ts step 3.9).
     const ent = await readEntitlementForCall(storage, caller, product.ext, product.action);
     if (!ent)
         return { kind: 'no_right' };
+    // 2b. A hosted app spends its OWNER's money. Reading their memory and buying on their behalf are
+    //     different favours, and an app grant presents the owner's own GHII, so without this the
+    //     narrowest grant there is reached any contract they held. Checked after owner-free (an app
+    //     calling its own owner's capability costs nobody anything) and after the entitlement lookup
+    //     (a free call spends nothing).
+    const refusal = await appSpendRefusal(storage, session);
+    if (refusal)
+        return refusal;
+    const appGrant = session?.appGrantId ? await storage.getAppGrant(session.appGrantId) : null;
     // 3. Pacing, first and always. The one brake that bounds RATE rather than total spend, which is the
     //    property a money budget does not have.
     const toll = resolvePacingToll(config, ent.tollMorsels);

package/dist/src/services/metered-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"metered-access.js","sourceRoot":"","sources":["../../../src/services/metered-access.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,sBAAsB,EAAE,YAAY,EAAE,aAAa,GAEpD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,mBAAmB,EAAE,iBAAiB,GAEvC,MAAM,yBAAyB,CAAC;AAEjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAmD5C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAoC;IACzD,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,sBAAsB,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAY1C;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE3D,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,aAAa,IAAI,WAAW,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAElF,iGAAiG;IACjG,6FAA6F;IAC7F,iGAAiG;IACjG,uEAAuE;IACvE,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;WAC3B,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;WAC7B,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;WACrC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;WACtC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACxD,CAAC;IAED,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,QAAQ,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;WACpF,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;IACrH,CAAC;IAED,sFAAsF;IACtF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAEtC,oGAAoG;IACpG,4CAA4C;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI;QACnD,mEAAmE;QACnE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAElG,aAAa;IACb,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAEzE,kGAAkG;IAClG,mGAAmG;IACnG,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;WAC5C,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAElG,wCAAwC;IACxC,MAAM,OAAO,GAAqB,MAAM,mBAAmB,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO;KAClG,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/H,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9G,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,IAAI,QAAQ,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QAC3D,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"metered-access.js","sourceRoot":"","sources":["../../../src/services/metered-access.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,sBAAsB,EAAE,YAAY,EAAE,aAAa,GAEpD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,mBAAmB,EAAE,iBAAiB,GAEvC,MAAM,yBAAyB,CAAC;AAEjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAmD5C;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAElE;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,KAAoC;IACzD,IAAI,CAAC,KAAK,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,sBAAsB,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,OAAkF;IAElF,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;WAC1B,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;WACrC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;WACtC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACxD,CAAC;IACD,iGAAiG;IACjG,sFAAsF;IACtF,IAAI,QAAQ,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;WACpF,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;IACrH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAY1C;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE3D,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,aAAa,IAAI,WAAW,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAElF,sFAAsF;IACtF,EAAE;IACF,mGAAmG;IACnG,+FAA+F;IAC/F,mGAAmG;IACnG,mGAAmG;IACnG,0FAA0F;IAC1F,iGAAiG;IACjG,oGAAoG;IACpG,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAEtC,iGAAiG;IACjG,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,oCAAoC;IACpC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5F,oGAAoG;IACpG,4CAA4C;IAC5C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI;QACnD,mEAAmE;QACnE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAElG,aAAa;IACb,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAEzE,kGAAkG;IAClG,mGAAmG;IACnG,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;WAC5C,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAElG,wCAAwC;IACxC,MAAM,OAAO,GAAqB,MAAM,mBAAmB,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO;KAClG,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/H,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9G,iGAAiG;IACjG,mGAAmG;IACnG,mGAAmG;IACnG,IAAI,QAAQ,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QAC3D,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;KAC/C,CAAC;AACJ,CAAC"}

package/dist/src/services/metered-settlement.js

@@ -104,22 +104,36 @@ async function settleMorsels(args) {
     const providerCut = price - fee;
     const track = `exchange:${product.ext}:${product.action}:${ent.contractRef}`;
     const ts = new Date().toISOString();
-    if (price > 0) {
-        if (!await storage.debitBalance(caller, price))
-            return { kind: 'insufficient', needed: price };
-        if (providerCut > 0) {
-            if (!await storage.creditBalance(ent.providerGhii, providerCut)) {
-                await storage.creditBalance(caller, price);
-                logger.error('[metered-settlement] provider credit failed; refunded caller', { label: product.label, provider: ent.providerGhii });
-                return { kind: 'failed', reason: 'provider_credit_failed' };
+    // The whole settlement is ONE transaction: debit, provider credit, both ledger rows, the
+    // marketplace fee and the spend commit land together or not at all. Before this a crash between
+    // them could leave a caller debited with no provider credit and no ledger row to find it by.
+    // The hand-written refund below is kept deliberately: it handles a provider credit that REPORTS
+    // failure (a business outcome the transaction cannot see), and with the rollback around it the two
+    // agree rather than conflict.
+    let earlyExit = null;
+    await storage.transaction(async () => {
+        if (price > 0) {
+            if (!await storage.debitBalance(caller, price)) {
+                earlyExit = { kind: 'insufficient', needed: price };
+                return;
+            }
+            if (providerCut > 0) {
+                if (!await storage.creditBalance(ent.providerGhii, providerCut)) {
+                    await storage.creditBalance(caller, price);
+                    logger.error('[metered-settlement] provider credit failed; refunded caller', { label: product.label, provider: ent.providerGhii });
+                    earlyExit = { kind: 'failed', reason: 'provider_credit_failed' };
+                    return;
+                }
+                await storage.addTransaction({ id: `xchg-earn-${randomUUID()}`, gaii: ent.providerGhii, type: 'extension_earn', amount: providerCut, counterpartyGaii: caller, trackingCode: track, initiatorGaii: caller, timestamp: ts });
             }
-            await storage.addTransaction({ id: `xchg-earn-${randomUUID()}`, gaii: ent.providerGhii, type: 'extension_earn', amount: providerCut, counterpartyGaii: caller, trackingCode: track, initiatorGaii: caller, timestamp: ts });
+            // Filed under the human whose balance moved; the caller is named beside it.
+            await storage.addTransaction({ id: `xchg-pay-${randomUUID()}`, gaii: ownerGhiiOf(caller), type: 'extension_pay', amount: -price, counterpartyGaii: ent.providerGhii, trackingCode: track, initiatorGaii: caller, timestamp: ts });
+            await settleMarketplaceFee(storage, config, { fee, payerGhii: ownerGhiiOf(caller), trackingCode: track, source: 'exchange' });
         }
-        // Filed under the human whose balance moved; the caller is named beside it.
-        await storage.addTransaction({ id: `xchg-pay-${randomUUID()}`, gaii: ownerGhiiOf(caller), type: 'extension_pay', amount: -price, counterpartyGaii: ent.providerGhii, trackingCode: track, initiatorGaii: caller, timestamp: ts });
-        await settleMarketplaceFee(storage, config, { fee, payerGhii: ownerGhiiOf(caller), trackingCode: track, source: 'exchange' });
-    }
-    await commitSpend(storage, ent, price, newPricing, caller);
+        await commitSpend(storage, ent, price, newPricing, caller);
+    });
+    if (earlyExit)
+        return earlyExit;
     return {
         kind: 'settled', charged: price,
         // MORSELS ARE NEVER SHARED. They are the node's pacing meter: they bound how often a capability

package/dist/src/services/metered-settlement.js.map

@@ -1 +1 @@
-{"version":3,"file":"metered-settlement.js","sourceRoot":"","sources":["../../../src/services/metered-settlement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,WAAW,EAA6C,MAAM,2BAA2B,CAAC;AAChH,OAAO,EAAE,SAAS,EAAE,YAAY,EAA6C,MAAM,kCAAkC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAiB5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAEvC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,EAAE,EAAE,UAAU,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,IAAI;QAC5F,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE;QACrE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAIzC;IACC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAID;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAQ,EACvC,IAAwF;IAExF,OAAO,KAAK,EAAE,YAAY,GAAG,EAAE,EAAE,EAAE;QACjC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,qBAAqB,CAAC,OAAO,EAAE;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY;gBAChF,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;aACnF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,CAAC,KAAK,CAAC,iGAAiG,EAAE;gBAC9G,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACtG,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,aAAa,CAAC,IAAU;IACrC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAU,oDAAoD;IACrG,MAAM,WAAW,GAAG,KAAK,GAAG,GAAG,CAAC;IAChC,MAAM,KAAK,GAAG,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7E,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC/F,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;gBAChE,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC3C,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;gBACnI,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,aAAa,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9N,CAAC;QACD,4EAA4E;QAC5E,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,YAAY,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAClO,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK;QAC/B,gGAAgG;QAChG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,WAAW,GAAG,CAAC;oBAAE,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC/E,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,qFAAqF;YACrF,MAAM,CAAC,IAAI,CAAC,iCAAiC,KAAK,0CAA0C,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,WAAW,CAAC,IAAU;IACnC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAG,cAAc;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE;YAC5D,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;SAC5H,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACpC,8FAA8F;QAC9F,4DAA4D;QAC5D,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK;QAC/B,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE;YAClC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;SAC5D,CAAC;QACF,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,KAAK,GAAG,CAAC;gBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YAChL,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,wFAAwF;YACxF,4CAA4C;YAC5C,IAAI,YAAY;gBAAE,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClI,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"metered-settlement.js","sourceRoot":"","sources":["../../../src/services/metered-settlement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,WAAW,EAA6C,MAAM,2BAA2B,CAAC;AAChH,OAAO,EAAE,SAAS,EAAE,YAAY,EAA6C,MAAM,kCAAkC,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAiB5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAEvC;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACrD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,OAAO,CAAC,cAAc,CAAC;QAC3B,EAAE,EAAE,UAAU,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,IAAI;QAC5F,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE;QACrE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAIzC;IACC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAID;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAQ,EACvC,IAAwF;IAExF,OAAO,KAAK,EAAE,YAAY,GAAG,EAAE,EAAE,EAAE;QACjC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,qBAAqB,CAAC,OAAO,EAAE;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY;gBAChF,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;aACnF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+FAA+F;YAC/F,8FAA8F;YAC9F,MAAM,CAAC,KAAK,CAAC,iGAAiG,EAAE;gBAC9G,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACtG,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,aAAa,CAAC,IAAU;IACrC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAU,oDAAoD;IACrG,MAAM,WAAW,GAAG,KAAK,GAAG,GAAG,CAAC;IAChC,MAAM,KAAK,GAAG,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7E,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpC,yFAAyF;IACzF,gGAAgG;IAChG,6FAA6F;IAC7F,gGAAgG;IAChG,mGAAmG;IACnG,8BAA8B;IAC9B,IAAI,SAAS,GAA4B,IAAI,CAAC;IAC9C,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAChH,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;oBAChE,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;oBACnI,SAAS,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,aAAa,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9N,CAAC;YACD,4EAA4E;YAC5E,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,YAAY,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAClO,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK;QAC/B,gGAAgG;QAChG,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACxB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,WAAW,GAAG,CAAC;oBAAE,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC/E,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,qFAAqF;YACrF,MAAM,CAAC,IAAI,CAAC,iCAAiC,KAAK,0CAA0C,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1H,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,WAAW,CAAC,IAAU;IACnC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAG,cAAc;IACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE;YAC5D,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;SAC5H,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACpC,8FAA8F;QAC9F,4DAA4D;QAC5D,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK;QAC/B,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE;YAClC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS;SAC5D,CAAC;QACF,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,IAAI,KAAK,GAAG,CAAC;gBAAE,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YAChL,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/E,2FAA2F;YAC3F,+FAA+F;YAC/F,+FAA+F;YAC/F,wFAAwF;YACxF,4CAA4C;YAC5C,IAAI,YAAY;gBAAE,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/services/moderation-flags.d.ts

@@ -0,0 +1,62 @@
+import type { AimeatConfig } from '../config.js';
+import type { Storage, FlagRecord, OrganismRecord } from '../storage/interface.js';
+/**
+ * `app` and `ai_provenance` exist for the AI Act correction procedure (TARGET-058 Phase 8).
+ *
+ * The Code of Practice (Section 2, Commitment 2) requires a way for a person to report content that
+ * should carry an AI label and does not, and until then this node had none. It is deliberately THIS
+ * queue rather than a new one: flags already have a review surface, an auto-hide threshold, an
+ * appeal path and a set of people who look at them. A fourth inbox would be a queue nobody watches,
+ * which is the same as no correction procedure while looking like one.
+ *
+ * `ai_provenance` takes a record id because that is the identifier a reader actually holds: the
+ * label's own "details" link goes to `/v1/provenance/<id>`, so reporting it is a copy-paste rather
+ * than an investigation.
+ */
+export declare const FLAG_TARGET_TYPES: readonly ["memory", "board_post", "action", "agent", "app", "ai_provenance"];
+export declare const FLAG_REASONS: readonly ["unreliable", "inappropriate", "illegal", "spam", "other", "undisclosed_ai"];
+export type FlagTargetType = typeof FLAG_TARGET_TYPES[number];
+export type FlagReason = typeof FLAG_REASONS[number];
+/** The bounds FlagCreateSchema applies on the HTTP door, named here so both doors share them. */
+export declare const FLAG_LIMITS: {
+    readonly targetIdMax: 256;
+    readonly descriptionMax: 10000;
+};
+export interface FlagCreateInput {
+    targetType: string;
+    targetId: string;
+    reason: string;
+    description?: string;
+}
+export type FlagCreateResult = {
+    ok: true;
+    flag: FlagRecord;
+    hidden: boolean;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * The organism a flag target belongs to, or null.
+ *
+ * Only memory carries an organism: the target id is `<ownerGaii>::<key>` and an organism's memory
+ * lives under `organism.<id>.`, so the organism is read out of the key rather than passed in by the
+ * caller. Its moderation settings then decide whether flagging is open at all and where the
+ * auto-hide threshold sits.
+ */
+export declare function resolveOrganismForFlag(storage: Storage, targetType: string, targetId: string): Promise<OrganismRecord | null>;
+/**
+ * Raise one flag. The order is the HTTP route's order, and the tool surface had none of it beyond
+ * the duplicate check.
+ *
+ * `flaggedBy` is the caller's already-resolved identity. The service does not derive it, because the
+ * two doors authenticate differently and each one knows who its caller is: an owner or agent JWT on
+ * HTTP, the session's agent GAII over MCP.
+ */
+export declare function createModerationFlag(deps: {
+    storage: Storage;
+    config: AimeatConfig;
+}, flaggedBy: string, input: FlagCreateInput): Promise<FlagCreateResult>;
+//# sourceMappingURL=moderation-flags.d.ts.map

package/dist/src/services/moderation-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation-flags.d.ts","sourceRoot":"","sources":["../../../src/services/moderation-flags.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAInF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,8EAA+E,CAAC;AAC9G,eAAO,MAAM,YAAY,wFAAyF,CAAC;AAEnH,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAErD,iGAAiG;AACjG,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,MAAM,WAAW,eAAe;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,gBAAgB,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACtC,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,EAChD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,GACvB,OAAO,CAAC,gBAAgB,CAAC,CA8G3B"}