aimeat 2.7.0 → 3.0.0

package/dist/src/services/moderation-flags.js

@@ -0,0 +1,196 @@
+/**
+ * @file src/services/moderation-flags.ts
+ * @description Raising a moderation flag, once, for every surface that can raise one.
+ *
+ *   WHY THIS FILE EXISTS. `POST /v1/flags` and `aimeat_flag_report` both wrote a FlagRecord, and the
+ *   two copies had drifted apart on four things. Everything below was in the HTTP copy and absent
+ *   from the tool copy, so an agent reporting content got a different capability than a person did:
+ *
+ *     - WHAT CAN BE REPORTED. HTTP takes six target types and six reasons; the tool declared four
+ *       and five. The three it was missing are the AI Act correction procedure (TARGET-058 Phase 8):
+ *       `app`, `ai_provenance` and `undisclosed_ai` are how anyone reports content that should carry
+ *       an AI label and does not. An agent, which is the thing most likely to notice an unlabelled
+ *       generation, could not report one at all. The lists live here now and both doors read them,
+ *       so the next value added reaches both.
+ *     - THE ORGANISM'S OWN SETTING. An organism can turn flagging off for its own memory
+ *       (`moderationConfig.flagsEnabled`), and HTTP refuses with 403 when it has. The tool never
+ *       looked, so the setting held on one door and not the other.
+ *     - THE COUNTER ON THE MEMORY RECORD. Flagging memory increments `flagCount` on the record
+ *       itself, which is what every reader of that memory sees. A flag raised through the tool left
+ *       the counter untouched, so the same memory read as clean.
+ *     - THE SHAPE. `targetId` is 1-256 characters and `description` at most 10 000. The tool took a
+ *       plain `z.string()` for both, and the HTTP door's own manual enum checks sat behind
+ *       validateBody(FlagCreateSchema) where they could never run. One set of bounds, applied on the
+ *       way in, is what both doors were reaching for separately.
+ *
+ *   The auto-hide decision also lives here, because it is part of what raising a flag DID rather
+ *   than part of how an answer is rendered: the weighted count of active flags against the
+ *   threshold, per-organism when the target belongs to one.
+ *
+ *   One capability, one implementation, whatever the interface — CLAUDE.md, Backend.
+ * @structure
+ *   - FLAG_TARGET_TYPES / FLAG_REASONS / FLAG_LIMITS — what a flag may say, shared by both doors
+ *   - resolveOrganismForFlag() — the organism a flagged memory key belongs to, or null
+ *   - createModerationFlag() — validation, duplicate check, organism gate, record, side effects
+ * @usage
+ *   const out = await createModerationFlag({ storage, config }, flaggedBy, input);
+ *   if (!out.ok) return renderRefusal(out);   // each door renders its own way
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial (August 2026 audit step 8): the flag write moves off both surfaces.
+ */
+import { randomBytes } from 'node:crypto';
+import { emitChange } from './event-bus.js';
+import { logger } from '../utils/logger.js';
+/**
+ * `app` and `ai_provenance` exist for the AI Act correction procedure (TARGET-058 Phase 8).
+ *
+ * The Code of Practice (Section 2, Commitment 2) requires a way for a person to report content that
+ * should carry an AI label and does not, and until then this node had none. It is deliberately THIS
+ * queue rather than a new one: flags already have a review surface, an auto-hide threshold, an
+ * appeal path and a set of people who look at them. A fourth inbox would be a queue nobody watches,
+ * which is the same as no correction procedure while looking like one.
+ *
+ * `ai_provenance` takes a record id because that is the identifier a reader actually holds: the
+ * label's own "details" link goes to `/v1/provenance/<id>`, so reporting it is a copy-paste rather
+ * than an investigation.
+ */
+export const FLAG_TARGET_TYPES = ['memory', 'board_post', 'action', 'agent', 'app', 'ai_provenance'];
+export const FLAG_REASONS = ['unreliable', 'inappropriate', 'illegal', 'spam', 'other', 'undisclosed_ai'];
+/** The bounds FlagCreateSchema applies on the HTTP door, named here so both doors share them. */
+export const FLAG_LIMITS = {
+    targetIdMax: 256,
+    descriptionMax: 10_000,
+};
+/**
+ * The organism a flag target belongs to, or null.
+ *
+ * Only memory carries an organism: the target id is `<ownerGaii>::<key>` and an organism's memory
+ * lives under `organism.<id>.`, so the organism is read out of the key rather than passed in by the
+ * caller. Its moderation settings then decide whether flagging is open at all and where the
+ * auto-hide threshold sits.
+ */
+export async function resolveOrganismForFlag(storage, targetType, targetId) {
+    if (targetType !== 'memory' || !targetId.includes('::'))
+        return null;
+    const [, ...keyParts] = targetId.split('::');
+    const memoryKey = keyParts.join('::');
+    const orgMatch = memoryKey.match(/^organism\.([^.]+)\./);
+    if (!orgMatch)
+        return null;
+    return storage.getOrganism(orgMatch[1]);
+}
+/**
+ * Raise one flag. The order is the HTTP route's order, and the tool surface had none of it beyond
+ * the duplicate check.
+ *
+ * `flaggedBy` is the caller's already-resolved identity. The service does not derive it, because the
+ * two doors authenticate differently and each one knows who its caller is: an owner or agent JWT on
+ * HTTP, the session's agent GAII over MCP.
+ */
+export async function createModerationFlag(deps, flaggedBy, input) {
+    const { storage, config } = deps;
+    const targetType = String(input.targetType ?? '');
+    const targetId = String(input.targetId ?? '');
+    const reason = String(input.reason ?? '');
+    if (!targetType || !targetId || !reason) {
+        return {
+            ok: false, status: 400, code: 'VALIDATION_ERROR',
+            message: 'Missing required fields: targetType, targetId, reason',
+        };
+    }
+    if (!FLAG_TARGET_TYPES.includes(targetType)) {
+        return {
+            ok: false, status: 400, code: 'VALIDATION_ERROR',
+            message: `Invalid targetType: "${targetType}". Must be one of: ${FLAG_TARGET_TYPES.join(', ')}`,
+        };
+    }
+    if (!FLAG_REASONS.includes(reason)) {
+        return {
+            ok: false, status: 400, code: 'VALIDATION_ERROR',
+            message: `Invalid reason: "${reason}". Must be one of: ${FLAG_REASONS.join(', ')}`,
+        };
+    }
+    if (targetId.length > FLAG_LIMITS.targetIdMax) {
+        return {
+            ok: false, status: 400, code: 'VALIDATION_ERROR',
+            message: `targetId must be 1-${FLAG_LIMITS.targetIdMax} characters`,
+        };
+    }
+    if (input.description !== undefined && input.description.length > FLAG_LIMITS.descriptionMax) {
+        return {
+            ok: false, status: 400, code: 'VALIDATION_ERROR',
+            message: `description must be at most ${FLAG_LIMITS.descriptionMax} characters`,
+        };
+    }
+    // One principal, one flag per target. A second report from the same reporter would count twice
+    // towards auto-hide, which is what the weighting below exists to prevent.
+    const existing = await storage.getFlagByUser(targetType, targetId, flaggedBy);
+    if (existing) {
+        return { ok: false, status: 409, code: 'ALREADY_FLAGGED', message: 'You have already flagged this target' };
+    }
+    // An organism may turn flagging off for its own content. The tool surface never asked.
+    const organism = await resolveOrganismForFlag(storage, targetType, targetId);
+    if (organism && !organism.moderationConfig.flagsEnabled) {
+        return {
+            ok: false, status: 403, code: 'FLAGS_DISABLED',
+            message: 'Flagging is disabled for this organism\'s content',
+        };
+    }
+    const now = new Date().toISOString();
+    const id = `flag-${randomBytes(8).toString('hex')}`;
+    const flag = await storage.createFlag({
+        id,
+        // FlagRecord still names four target types and five reasons, one list behind what both doors
+        // accept since the AI Act correction procedure added `app`, `ai_provenance` and
+        // `undisclosed_ai`. Widening the stored type is a storage change, which this move does not
+        // make; the value written is one of FLAG_TARGET_TYPES, checked above.
+        targetType: targetType,
+        targetId,
+        flaggedBy,
+        reason: reason,
+        description: input.description ?? undefined,
+        status: 'active',
+        createdAt: now,
+    });
+    // The counter on the memory record itself, which is what every reader of that memory sees. A
+    // flag raised through the tool used to leave it untouched, so the same memory read as clean.
+    // The flag stands even if the counter cannot be bumped: losing the report is worse than a stale
+    // count, which the flag list still corrects.
+    if (targetType === 'memory' && targetId.includes('::')) {
+        try {
+            const [ownerGaii, ...keyParts] = targetId.split('::');
+            await storage.incrementMemoryFlagCount(ownerGaii, keyParts.join('::'));
+        }
+        catch (err) {
+            logger.warn('createModerationFlag: continuing after a suppressed failure', { error: String(err) });
+        }
+    }
+    // Auto-hide, weighted by the reporter's trust score and account age (SECURITY P3-11) so a fresh
+    // throwaway identity cannot hide content on its own. The threshold is the organism's when the
+    // target belongs to one, the node's otherwise.
+    const activeFlags = await storage.getFlagsByTarget(targetType, targetId);
+    let weightedFlagCount = 0;
+    for (const f of activeFlags) {
+        if (f.status !== 'active')
+            continue;
+        const reporter = await storage.getAgent(f.flaggedBy);
+        if (!reporter) {
+            weightedFlagCount += 0.5;
+            continue;
+        }
+        const trustFactor = Math.max(0.1, (reporter.trustScore ?? 50) / 100);
+        const owner = await storage.getOwner(reporter.owner);
+        const ageDays = owner ? Math.floor((Date.now() - new Date(owner.createdAt).getTime()) / 86_400_000) : 0;
+        const ageFactor = Math.min(1, ageDays / 30); // Full weight after 30 days
+        weightedFlagCount += Math.max(0.1, trustFactor * Math.max(0.2, ageFactor));
+    }
+    const autoHideThreshold = organism
+        ? organism.moderationConfig.autoHideThreshold
+        : config.autoHideThreshold;
+    const hidden = weightedFlagCount >= autoHideThreshold;
+    // A moderation queue open in a browser listens on this domain. Without the event a flag raised
+    // by an agent sat unseen until somebody reloaded the page.
+    emitChange('flags');
+    return { ok: true, flag, hidden };
+}
+//# sourceMappingURL=moderation-flags.js.map

package/dist/src/services/moderation-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation-flags.js","sourceRoot":"","sources":["../../../src/services/moderation-flags.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAU,CAAC;AAC9G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAKnH,iGAAiG;AACjG,MAAM,CAAC,MAAM,WAAW,GAAG;IACvB,WAAW,EAAE,GAAG;IAChB,cAAc,EAAE,MAAM;CAChB,CAAC;AAaX;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,OAAgB,EAChB,UAAkB,EAClB,QAAgB;IAEhB,IAAI,UAAU,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,IAAgD,EAChD,SAAiB,EACjB,KAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE1C,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB;YAChD,OAAO,EAAE,uDAAuD;SACnE,CAAC;IACN,CAAC;IACD,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB;YAChD,OAAO,EAAE,wBAAwB,UAAU,sBAAsB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClG,CAAC;IACN,CAAC;IACD,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB;YAChD,OAAO,EAAE,oBAAoB,MAAM,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB;YAChD,OAAO,EAAE,sBAAsB,WAAW,CAAC,WAAW,aAAa;SACtE,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC;QAC3F,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB;YAChD,OAAO,EAAE,+BAA+B,WAAW,CAAC,cAAc,aAAa;SAClF,CAAC;IACN,CAAC;IAED,+FAA+F;IAC/F,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAChH,CAAC;IAED,uFAAuF;IACvF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC7E,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB;YAC9C,OAAO,EAAE,mDAAmD;SAC/D,CAAC;IACN,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAEpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAClC,EAAE;QACF,6FAA6F;QAC7F,gFAAgF;QAChF,2FAA2F;QAC3F,sEAAsE;QACtE,UAAU,EAAE,UAAsC;QAClD,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,MAA8B;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;QAC3C,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,GAAG;KACjB,CAAC,CAAC;IAEH,6FAA6F;IAC7F,6FAA6F;IAC7F,gGAAgG;IAChG,6CAA6C;IAC7C,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC;YACD,MAAM,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,OAAO,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,8FAA8F;IAC9F,+CAA+C;IAC/C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,iBAAiB,IAAI,GAAG,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,4BAA4B;QACzE,iBAAiB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,iBAAiB,GAAG,QAAQ;QAC9B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,IAAI,iBAAiB,CAAC;IAEtD,+FAA+F;IAC/F,2DAA2D;IAC3D,UAAU,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/src/services/morsel.d.ts

@@ -42,6 +42,32 @@ export declare function returnEscrow(storage: Storage, work: WorkRecord, amount?
  * Uses atomic creditBalanceCapped to prevent race conditions.
  */
 export declare function applyDailyAllowance(storage: Storage, config: AimeatConfig, gaii: string): Promise<number>;
+export type MintResult = {
+    ok: true;
+    minted: number;
+    newBalance: number;
+    mintedToday: number;
+    dailyCap: number;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
+/**
+ * Mint morsels into an agent's owner balance as the operator (§16.1).
+ *
+ * The daily cap is the reason this is one function and not a line of route code: it is read from
+ * every 'mint' row since the UTC day boundary, and a second door that computed it separately would
+ * have been a second answer to "how much has been minted today".
+ *
+ * The operator check itself belongs to the door (requireRole on HTTP, the runtime role lookup on
+ * MCP), because the two prove the caller differently.
+ */
+export declare function mintMorsels({ storage, config }: {
+    storage: Storage;
+    config: AimeatConfig;
+}, operatorGaii: string, gaii: string, amount: number): Promise<MintResult>;
 /**
  * Calculate in_escrow total for an agent.
  */

package/dist/src/services/morsel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"morsel.d.ts","sourceRoot":"","sources":["../../../src/services/morsel.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC5B,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,GAAE,MAAM,EAAO,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAgG3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF"}
+{"version":3,"file":"morsel.d.ts","sourceRoot":"","sources":["../../../src/services/morsel.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGnE,MAAM,WAAW,gBAAgB;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;EAIvE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC5B,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,GAAE,MAAM,EAAO,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAgG3B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,MAAM,MAAM,UAAU,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC7B,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,EAC/D,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAmDrB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF"}

package/dist/src/services/morsel.js

@@ -10,11 +10,19 @@
  *   - settlePayment: burn + fee split + pay provider on successful delivery
  *   - applyDailyAllowance: capped daily allowance credit
  *   - calculateEscrow: sum in-escrow amounts across a requester's open work
+ *   - mintMorsels: operator mint against the daily cap, for every door that mints
  *
  * @version-history
+ *   v1.1.0 — 2026-08-11 — mintMorsels() added, and POST /v1/admin/mint and aimeat_admin_mint both
+ *     call it. They were two implementations of the same mint: the same cap arithmetic, the same
+ *     credit and the same ledger row written twice, and they had already drifted — the tool told the
+ *     live wallet stream about the new balance and the HTTP route did not, so a mint made from the
+ *     admin page left an open wallet view showing the old number until something else refreshed it.
+ *     The wallet emit is what both do now. (August 2026 audit step 8.)
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
-import { randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { emitChange } from './event-bus.js';
 /**
  * Calculate morsel costs for a work request.
  */
@@ -175,6 +183,62 @@ export async function applyDailyAllowance(storage, config, gaii) {
     });
     return credited;
 }
+/**
+ * Mint morsels into an agent's owner balance as the operator (§16.1).
+ *
+ * The daily cap is the reason this is one function and not a line of route code: it is read from
+ * every 'mint' row since the UTC day boundary, and a second door that computed it separately would
+ * have been a second answer to "how much has been minted today".
+ *
+ * The operator check itself belongs to the door (requireRole on HTTP, the runtime role lookup on
+ * MCP), because the two prove the caller differently.
+ */
+export async function mintMorsels({ storage, config }, operatorGaii, gaii, amount) {
+    if (!gaii || typeof gaii !== 'string') {
+        return { ok: false, status: 400, code: 'INVALID_INPUT', message: 'gaii is required' };
+    }
+    if (typeof amount !== 'number' || !Number.isInteger(amount) || amount <= 0) {
+        return { ok: false, status: 400, code: 'INVALID_INPUT', message: 'amount must be a positive integer' };
+    }
+    const agent = await storage.getAgent(gaii);
+    if (!agent) {
+        return { ok: false, status: 404, code: 'NOT_FOUND', message: `Agent not found: ${gaii}` };
+    }
+    // Enforce daily mint cap (§16.1: max_operator_mint_per_day default 10,000)
+    const dayStart = new Date();
+    dayStart.setUTCHours(0, 0, 0, 0);
+    const allTx = await storage.listAllTransactions();
+    const mintedToday = allTx
+        .filter(tx => tx.type === 'mint' && new Date(tx.timestamp) >= dayStart)
+        .reduce((sum, tx) => sum + tx.amount, 0);
+    if (mintedToday + amount > config.maxOperatorMintPerDay) {
+        return {
+            ok: false, status: 429, code: 'QUOTA_EXCEEDED',
+            message: `Daily mint cap is ${config.maxOperatorMintPerDay} morsels. Already minted ${mintedToday} today. Requested ${amount} would exceed cap.`,
+        };
+    }
+    await storage.creditBalance(gaii, amount);
+    await storage.addTransaction({
+        id: `tx-${Date.now()}-${randomBytes(4).toString('hex')}`,
+        gaii,
+        type: 'mint',
+        amount,
+        counterpartyGaii: operatorGaii,
+        timestamp: new Date().toISOString(),
+    });
+    // The mint moves a balance and the node's economy figures at once, so both domains hear it.
+    emitChange('config');
+    emitChange('wallet');
+    const mintedAgent = await storage.getAgent(gaii);
+    const mintedGhii = mintedAgent ? await storage.getGHIIByOwner(mintedAgent.owner) : null;
+    return {
+        ok: true,
+        minted: amount,
+        newBalance: mintedGhii?.morselBalance ?? 0,
+        mintedToday: mintedToday + amount,
+        dailyCap: config.maxOperatorMintPerDay,
+    };
+}
 /**
  * Calculate in_escrow total for an agent.
  */

package/dist/src/services/morsel.js.map

@@ -1 +1 @@
-{"version":3,"file":"morsel.js","sourceRoot":"","sources":["../../../src/services/morsel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,SAAiB;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;IACvC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,OAAgB,EAChB,aAAqB,EACrB,YAAoB,EACpB,YAAoB,EACpB,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,OAAO,CAAC,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;QACxB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,CAAC,KAAK;QACd,gBAAgB,EAAE,YAAY;QAC9B,YAAY;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,OAAgB,EAChB,MAAoB,EACpB,IAAgB,EAChB,YAAsB,EAAE;IAExB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAE5C,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAEzC,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,YAAY,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,UAAU,CAAC,CAAC,yBAAyB;IAEnH,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,IAAI,CAAC,aAAa;YACpC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,CAAC,MAAM;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,kBAAkB;IAClB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,CAAC,UAAU;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,+DAA+D;IAC/D,IAAI,UAAU,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,cAAc,CAAC;oBACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,aAAa;oBACxB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,CAAC,QAAQ;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,gBAAgB,EAAE,WAAW;oBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACtC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;SAAM,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,CAAC,UAAU;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,CAAC,aAAa;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;QAC/C,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa;QAChE,UAAU,EAAE,SAAS;KACxB,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,OAAgB,EAChB,IAAgB,EAChB,MAAe;IAEf,MAAM,YAAY,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/E,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,YAAY;YACpB,gBAAgB,EAAE,IAAI,CAAC,YAAY;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAAgB,EAChB,MAAoB,EACpB,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1G,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAE5B,MAAM,OAAO,CAAC,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;QACxB,IAAI;QACJ,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAY;IAChE,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}
+{"version":3,"file":"morsel.js","sourceRoot":"","sources":["../../../src/services/morsel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAa5C;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,SAAiB;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;IACvC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,OAAgB,EAChB,aAAqB,EACrB,YAAoB,EACpB,YAAoB,EACpB,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,OAAO,CAAC,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;QACxB,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,CAAC,KAAK;QACd,gBAAgB,EAAE,YAAY;QAC9B,YAAY;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,OAAgB,EAChB,MAAoB,EACpB,IAAgB,EAChB,YAAsB,EAAE;IAExB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAE5C,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;IAEzC,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,YAAY,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,UAAU,CAAC,CAAC,yBAAyB;IAEnH,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,IAAI,CAAC,aAAa;YACpC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,CAAC,MAAM;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,kBAAkB;IAClB,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,CAAC,UAAU;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,+DAA+D;IAC/D,IAAI,UAAU,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;YAClC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,cAAc,CAAC;oBACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,aAAa;oBACxB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,CAAC,QAAQ;oBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,gBAAgB,EAAE,WAAW;oBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACtC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;SAAM,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,CAAC,UAAU;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,CAAC,aAAa;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;QAC/C,iBAAiB,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa;QAChE,UAAU,EAAE,SAAS;KACxB,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,OAAgB,EAChB,IAAgB,EAChB,MAAe;IAEf,MAAM,YAAY,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/E,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,cAAc,CAAC;YACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,YAAY;YACpB,gBAAgB,EAAE,IAAI,CAAC,YAAY;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAAgB,EAChB,MAAoB,EACpB,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1G,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAE5B,MAAM,OAAO,CAAC,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,UAAU,EAAE,EAAE;QACxB,IAAI;QACJ,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AACpB,CAAC;AAMD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,EAAE,OAAO,EAAE,MAAM,EAA8C,EAC/D,YAAoB,EACpB,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,KAAK;SACpB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC;SACtE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE7C,IAAI,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO;YACH,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB;YAC9C,OAAO,EAAE,qBAAqB,MAAM,CAAC,qBAAqB,4BAA4B,WAAW,qBAAqB,MAAM,oBAAoB;SACnJ,CAAC;IACN,CAAC;IAED,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,CAAC,cAAc,CAAC;QACzB,EAAE,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACxD,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,MAAM;QACN,gBAAgB,EAAE,YAAY;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,UAAU,CAAC,QAAQ,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,OAAO;QACH,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,UAAU,EAAE,aAAa,IAAI,CAAC;QAC1C,WAAW,EAAE,WAAW,GAAG,MAAM;QACjC,QAAQ,EAAE,MAAM,CAAC,qBAAqB;KACzC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAY;IAChE,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/src/services/onboarding-funnel.d.ts

@@ -0,0 +1,240 @@
+/**
+ * @file src/services/onboarding-funnel.ts
+ * @description The MCP onboarding funnel made observable (UX-remake v3, P3). The connector step
+ *   happens inside the user's AI tool where this node cannot see it, so the node records the two
+ *   ends it CAN see — the hello page being opened, and the first MCP session actually arriving —
+ *   and runs one rescue: an account that is a day old with no MCP call yet gets a single email
+ *   with the direct link and the tier checklist (the page itself names tier limits as the most
+ *   common failure). Markers are memory records in the owner's GHII namespace (memory-contracts:
+ *   extend the memory system, not the schema), so the funnel is queryable without a new table
+ *   and visible to the owner in their own Memory tab.
+ * @structure
+ *   - FIRST_MCP_CALL_KEY / HELLO_PAGE_OPENED_KEY / ACTIVATED_KEY / MCP_RESCUE_SENT_KEY: marker keys
+ *   - ONBOARDING_KEYS: every remake event key, in ONE place (05-mittaus.md) — nothing that writes
+ *     a funnel marker spells a key literal of its own
+ *   - recordFirstMcpCall() / recordHelloPageOpened() / recordActivation(): write-once markers
+ *   - recordTrack() / recordTrackSwitch(): which path the account was created on, and how many
+ *     times it flipped. The switch NEVER rewrites `track` — see the note on recordTrackSwitch.
+ *   - recordOnboardingEvent(): the generic write-once marker every remake phase writes through
+ *   - recordWelcomeMatPasted(): the ONE deliberately non-write-once marker (attempts accumulate)
+ *   - readOnboardingFunnel(): the operator view's rows (activation, TTFV, rescue, remake events)
+ *   - runMcpOnboardingRescueJob(): the scheduled rescue pass (core handler 'mcp-onboarding-rescue')
+ * @usage
+ *   import { recordFirstMcpCall } from '../services/onboarding-funnel.js';
+ *   void recordFirstMcpCall(storage, config, owner, platform);   // fire-and-forget at MCP init
+ * @version-history
+ *   v1.2.0 — 2026-08-07 — REMAKE phase 0: onboarding.track (legacy|remake + switched) written at
+ *     account creation, the six remake event keys + the agent-door pair collected into
+ *     ONBOARDING_KEYS, generic write-once + attempts-accumulating writers, and readOnboardingFunnel
+ *     rewritten onto ONE listMemoryForOwners query (was 4 getMemory per account) now that it reads
+ *     eleven markers instead of four.
+ *   v1.1.0 — 2026-08-07 — Activation marker + readOnboardingFunnel(): the account's first durable
+ *     own output (app / workspace / agent write) as ONE event with a kind, so an activation rate
+ *     and TTFV are computable (05-mittaus.md).
+ *   v1.0.0 — 2026-08-07 — Initial (UX-remake v3, block 1.6).
+ */
+import type { AimeatConfig } from '../config.js';
+import type { Storage } from '../storage/interface.js';
+/** Written once, when the owner's first authenticated MCP session initializes. */
+export declare const FIRST_MCP_CALL_KEY = "onboarding.first_mcp_call";
+/** Written once, when a signed-in owner first opens the Hello MCP guidance. */
+export declare const HELLO_PAGE_OPENED_KEY = "onboarding.hello_page_opened";
+/** Written once, when the rescue email for a silent account has been sent (or attempted). */
+export declare const MCP_RESCUE_SENT_KEY = "onboarding.mcp_rescue_sent";
+/**
+ * The ACTIVATION marker (05-mittaus.md): the first time this account produced a durable thing of
+ * its own — a published app, a published workspace item, or an agent's first write. One event with
+ * a `kind` dimension rather than three, so one activation rate is comparable across the personas.
+ * Written once; the value records which of the three came first and when.
+ */
+export declare const ACTIVATED_KEY = "onboarding.activated";
+export type ActivationKind = 'app' | 'workspace' | 'agent';
+/**
+ * EVERY remake funnel key, in one place (05-mittaus.md). Nothing outside this module spells one of
+ * these strings: a key typed twice is a marker that silently stops being counted the day one of
+ * the two is edited, and a funnel that undercounts reads as a product that does not work.
+ */
+export declare const ONBOARDING_KEYS: {
+    /** Which path the account was created on. Written ONCE at account creation. */
+    readonly track: "onboarding.track";
+    /** The welcome mat paste. The ONE non-write-once marker: attempts accumulate. */
+    readonly welcomeMatPasted: "onboarding.welcome_mat_pasted";
+    /** What the model claimed about itself, or what the person answered when asked. */
+    readonly aiModelDetected: "onboarding.ai_model_detected";
+    /** A = MCP-capable client, B = needs a better one first, agent = the front-page agent door. */
+    readonly branchTaken: "onboarding.branch_taken";
+    readonly firstAgentConnected: "onboarding.first_agent_connected";
+    readonly homeInitialized: "onboarding.home_initialized";
+    /** The FIRST of the four rooms entered. Later ones do not overwrite it. */
+    readonly roomEntered: "onboarding.room_entered";
+    /** Agent door (12-ai-rekisteroi.md): the POST landed and the mail went out. */
+    readonly inviteSentByAgent: "onboarding.invite_sent_by_agent";
+    readonly inviteCompleted: "onboarding.invite_completed";
+    /** Durable mark on the account: an agent started this, with which model. */
+    readonly startedByAgent: "onboarding.started_by_agent";
+    readonly agentDoorStarted: "onboarding.agent_door_started";
+    readonly agentDoorResult: "onboarding.agent_door_result";
+    /**
+     * The friendly nudge to an account nobody has seen for a fortnight. Accumulating, not
+     * write-once: someone can go quiet more than once in a lifetime, and a write-once marker would
+     * mean the second silence is never noticed. `sentAt` carries the last send, which is what the
+     * cooldown is measured from.
+     */
+    readonly inactivityNudge: "onboarding.inactivity_nudge";
+};
+/** Which onboarding path an account was created on. Cohorts are meaningless without it. */
+export type OnboardingTrack = 'legacy' | 'remake';
+export type OnboardingBranch = 'A' | 'B' | 'agent';
+export type OnboardingRoom = 'create' | 'organise' | 'monetise' | 'company' | 'messages';
+/** K3: new accounts land on the remake; existing ones stay legacy until they switch themselves. */
+export declare const DEFAULT_TRACK: OnboardingTrack;
+/**
+ * Accounts created before this feature existed are never rescued — a months-old account
+ * suddenly getting "you have not connected your AI yet" would read as a data leak, not help.
+ */
+export declare const RESCUE_FEATURE_EPOCH = "2026-08-07T00:00:00Z";
+/**
+ * Write a marker key once; returns false when it already existed.
+ *
+ * Exported so a sibling job (the inactivity nudge) uses THIS implementation rather than a
+ * second copy: the ttlHours:null matters — a marker with a TTL is swept by the memory cleanup
+ * job, and an idempotency marker that expires turns a one-off email into a recurring one.
+ */
+export declare function writeMarkerOnce(storage: Storage, ownerGaii: string, key: string, value: Record<string, unknown>): Promise<boolean>;
+/**
+ * Record the owner's FIRST authenticated MCP session. Called from the MCP initialize path;
+ * failures are logged, never thrown — funnel bookkeeping must not break a working connection.
+ */
+export declare function recordFirstMcpCall(storage: Storage, config: AimeatConfig, owner: string, client?: string): Promise<void>;
+/** Record that a signed-in owner opened the Hello MCP guidance. Same never-throw contract. */
+export declare function recordHelloPageOpened(storage: Storage, config: AimeatConfig, owner: string): Promise<void>;
+/**
+ * Record the account's ACTIVATION — its first durable own output. Fire-and-forget from whichever
+ * path produced the thing (app publish, workspace publish, agent write); the marker is write-once,
+ * so the first caller wins and later ones are a no-op. Never throws: an activation marker must
+ * never be able to fail the publish it is measuring.
+ */
+export declare function recordActivation(storage: Storage, config: AimeatConfig, owner: string, kind: ActivationKind): Promise<void>;
+/**
+ * Record which path this account was created on. Called from BOTH account-creation routes
+ * (POST /v1/ghii and POST /v1/owners) so no door leaves an account without a track — an untracked
+ * account is invisible to one half of the funnel and inflates neither, which is worse than either.
+ * Write-once: re-registration in dev/test mode must not relabel an existing cohort.
+ */
+export declare function recordTrack(storage: Storage, config: AimeatConfig, owner: string, track?: OnboardingTrack): Promise<void>;
+/**
+ * The switch between the new home and the old profile. Increments `switched` and leaves `track`
+ * exactly as it was: rewriting it would move the account between cohorts every time the person
+ * flipped, and a cohort whose membership changes under you measures nothing. The counter is
+ * itself a result — remake-created accounts switching away is the signal the remake failed.
+ */
+export declare function recordTrackSwitch(storage: Storage, config: AimeatConfig, owner: string): Promise<number>;
+/** Read an account's track (and switch count). Absent marker = an account older than the feature. */
+export declare function readTrack(storage: Storage, config: AimeatConfig, owner: string): Promise<{
+    track: OnboardingTrack;
+    switched: number;
+}>;
+/**
+ * The generic write-once remake marker. Every phase writes through this rather than reaching for
+ * storage directly, so all of them share the same never-throw contract: funnel bookkeeping must
+ * never be able to fail the thing it is measuring. Returns whether this call was the one that wrote.
+ */
+export declare function recordOnboardingEvent(storage: Storage, config: AimeatConfig, owner: string, key: typeof ONBOARDING_KEYS[keyof typeof ONBOARDING_KEYS], value: Record<string, unknown>): Promise<boolean>;
+/** What we know about the person's AI, and how we came to know it. */
+export interface AiDetection {
+    model: string | null;
+    vendor: string | null;
+    client: string | null;
+    mcp: 'yes' | 'no' | 'unknown';
+    /** 'meta' = read off the pasted page; 'asked' = the person answered. */
+    source: 'meta' | 'asked';
+    /** An app name that matched nothing — the list the alias map grows from. */
+    unknownClient?: string | null;
+    resolvedClient?: string | null;
+    /**
+     * The person's answer to the paid-tier question, when their app needs one. Kept because the
+     * live "are they still blocked?" question has to be RECOMPUTED from what is known, and without
+     * this the recomputation would re-ask a question they already answered.
+     */
+    hasPaidPlan?: boolean | null;
+    /**
+     * A FRESH welcome mat, which replaces the record outright rather than deferring to whatever
+     * was there. See the ordering note on recordAiModelDetected.
+     */
+    supersedes?: boolean;
+}
+/**
+ * Record what the person's AI is. One record, not an append log — but NOT plain write-once,
+ * because the two sources are not equal evidence.
+ *
+ * A model's claim about its own app is unreliable by nature (04-mcp-kyvykkyys.md); the person's
+ * own answer is not. So an `asked` reading replaces a `meta` one, and nothing replaces an `asked`
+ * one. Under strict write-once the `source` field would be decoration: the page's guess would be
+ * frozen in the funnel even after the person corrected it, and every later read would be of the
+ * less reliable of the two answers we had.
+ */
+export declare function recordAiModelDetected(storage: Storage, config: AimeatConfig, owner: string, detection: AiDetection): Promise<void>;
+/**
+ * The welcome-mat paste — the one marker that is NOT write-once. `attempts` accumulates because
+ * how many tries the mat took is the direct measure of the prompt's quality (03-welcome-mat.md),
+ * and a write-once marker would report every account as a first-try success. `result` holds the
+ * LATEST outcome, so ok-after-three-failures reads as ok with attempts=4.
+ * There is no `skipped` value and no caller that could produce one: the mat cannot be skipped.
+ */
+export declare function recordWelcomeMatPasted(storage: Storage, config: AimeatConfig, owner: string, result: 'ok' | 'failed'): Promise<{
+    attempts: number;
+}>;
+/** One account's funnel state, as the operator view reads it. */
+export interface FunnelRow {
+    owner: string;
+    ghii: string;
+    createdAt: string;
+    locale: string;
+    helloOpenedAt: string | null;
+    firstMcpCallAt: string | null;
+    mcpClient: string | null;
+    activatedAt: string | null;
+    activationKind: ActivationKind | null;
+    /** Signup → activation, in minutes. Null until activated. */
+    ttfvMinutes: number | null;
+    rescueSentAt: string | null;
+    /** Which path the account was created on. `legacy` also covers pre-feature accounts. */
+    track: OnboardingTrack;
+    /** How many times the person flipped between the two. Never changes `track`. */
+    switched: number;
+    matResult: 'ok' | 'failed' | null;
+    matAttempts: number;
+    /** The model's own claim about itself — unreliable by nature, kept for exactly that reason. */
+    aiModel: string | null;
+    /** The deciding field: MCP is a property of the CLIENT APP, not the model. */
+    aiClient: string | null;
+    aiMcp: 'yes' | 'no' | 'unknown' | null;
+    /** 'meta' = read off the page; 'asked' = the person answered. 'asked' is the trustworthy one. */
+    aiSource: 'meta' | 'asked' | null;
+    branch: OnboardingBranch | null;
+    firstAgentConnectedAt: string | null;
+    homeInitializedAt: string | null;
+    /** The FIRST room entered — which of the four the person wanted, not where they ended up. */
+    room: OnboardingRoom | null;
+}
+/**
+ * The whole funnel as rows, newest account first — the operator surface (05-mittaus.md) and the
+ * only place these markers are read together. Test accounts (uxtest-*) are excluded here rather
+ * than at write time, so a re-run measures itself but never pollutes the operator's numbers.
+ */
+export declare function readOnboardingFunnel(storage: Storage, opts?: {
+    since?: string;
+    limit?: number;
+}): Promise<FunnelRow[]>;
+/**
+ * The rescue pass. For each account created after the feature epoch, older than a day and
+ * younger than a week, with a VERIFIED email, no MCP session seen and no rescue sent: send one
+ * email and mark it sent. Runs as core handler 'mcp-onboarding-rescue'.
+ */
+export declare function runMcpOnboardingRescueJob(config: AimeatConfig, storage: Storage, 
+/** Test seam: freeze the clock and the epoch. Production callers pass nothing. */
+opts?: {
+    now?: number;
+    epoch?: number;
+}): Promise<void>;
+//# sourceMappingURL=onboarding-funnel.d.ts.map

package/dist/src/services/onboarding-funnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-funnel.d.ts","sourceRoot":"","sources":["../../../src/services/onboarding-funnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAKvD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAC9D,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AACpE,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAChE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,yBAAyB,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,eAAe;IACxB,+EAA+E;;IAE/E,iFAAiF;;IAEjF,mFAAmF;;IAEnF,+FAA+F;;;;IAI/F,2EAA2E;;IAE3E,+EAA+E;;;IAG/E,4EAA4E;;;;IAI5E;;;;;OAKG;;CAEG,CAAC;AAEX,2FAA2F;AAC3F,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC;AAGnD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;AACzF,mGAAmG;AACnG,eAAO,MAAM,aAAa,EAAE,eAA0B,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAM3D;;;;;;GAMG;AACH,wBAAsB,eAAe,CACjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjF,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAMD;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GACvE,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,8FAA8F;AAC9F,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GACtD,OAAO,CAAC,IAAI,CAAC,CAWf;AAKD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAC5E,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,eAA+B,GAC9F,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACnC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GACtD,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,qGAAqG;AACrG,wBAAsB,SAAS,CAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GACtD,OAAO,CAAC;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAIvD;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EACrD,GAAG,EAAE,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,EACzD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9B,wEAAwE;IACxE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAC9E,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,QAAQ,GAC/E,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB/B;AAED,iEAAiE;AACjE,MAAM,WAAW,SAAS;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,wFAAwF;IACxF,KAAK,EAAE,eAAe,CAAC;IACvB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;IACvC,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,6FAA6F;IAC7F,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACtC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,OAAO,CAAC,SAAS,EAAE,CAAC,CAkEtB;AA0GD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC3C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO;AAChB,kFAAkF;AAClF,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5C,OAAO,CAAC,IAAI,CAAC,CA+Df"}