aimeat 2.7.0 → 3.1.0

package/dist/.env.example

@@ -23,6 +23,13 @@ AIMEAT_PORT=40050
 # AIMEAT_PORTFOLIO_HOST="portfolio.your-domain.com"  # default: portfolio.<AIMEAT_BASE_URL host>, empty for localhost/IP
 # AIMEAT_PORTFOLIO_ORIGIN_ENABLED=false              # true → standalone portfolio URLs advertised + served
 
+# ── Company Origin (company-in-a-box) ─────────────────────────
+# A registered company's front page served at <slug>.co.<host> — the co family is to
+# companies what the apps family is to apps (same isolation model + infra: wildcard DNS +
+# TLS + an nginx block that sets X-Co-Origin and X-Subdomain).
+# AIMEAT_CO_HOST="co.your-domain.com"      # default: co.<AIMEAT_BASE_URL host>, empty for localhost/IP
+# AIMEAT_CO_ORIGIN_ENABLED=false           # true → company addresses advertised + served
+
 # ── Storage Backend ───────────────────────────────────────────
 # Choose storage: memory (default, data lost on restart), sqlite (file-based, zero-config),
 # or postgres-kysely (production PostgreSQL; schema migrates on boot).
@@ -146,6 +153,7 @@ AIMEAT_PORT=40050
 # AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
 # AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
 # AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
+# AIMEAT_EXT_MAX_PAY_MORSELS=10000            # Ceiling on commercial.payMorsels in a manifest
 # AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
 # AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
 
@@ -220,6 +228,21 @@ AIMEAT_PORT=40050
 # AIMEAT_AI_SUPERVISORY_NAME="Liikenne- ja viestintävirasto Traficom"
 # AIMEAT_AI_SUPERVISORY_URL="https://www.traficom.fi"
 #
+# AIMEAT_AI_COP_SECTIONS / _SIGNED_ON — which sections of the EU Code of Practice on Transparency of
+#   AI-generated Content YOUR ORGANISATION has signed, and when. Empty is the default and the only
+#   value that ships, because the signature belongs to the operator and not to this software: a
+#   value written into the source would make every node running it claim somebody else's signature,
+#   in the one document a regulator reads first. Set it only after the AI Office has confirmed your
+#   signature, and set only the sections you actually signed — GET /v1/ai-transparency then reports
+#   `code_of_practice.signatory: true` with those sections, the date, and the sections you did NOT
+#   sign together with the reason. Leave it empty and the statement says you are not a signatory.
+#   Section 1 is the provider commitment (machine-readable marking of model output), Section 2 the
+#   deployer commitment (labelling deep fakes and AI-generated or manipulated published text).
+#   Note: using the EU AI Office label icons says nothing about being a signatory, and this node
+#   never presents it as if it did.
+# AIMEAT_AI_COP_SECTIONS="2"
+# AIMEAT_AI_COP_SIGNED_ON="2026-08-01"
+#
 # Startup self-check: when the resolved profile is `public`, the node warns loudly (or refuses
 # to start) on an unsafe combination — AIMEAT_ANONYMOUS=true, AIMEAT_ALLOW_PRIVATE_EGRESS=true,
 # AIMEAT_FEDERATION_OPEN_JOIN=true, missing AIMEAT_ENCRYPTION_KEY, AIMEAT_CORS_ALLOWED_ORIGINS=*,
@@ -290,6 +313,11 @@ AIMEAT_PORT=40050
 # AIMEAT_MAX_ACTIONS_PER_AGENT=20
 # AIMEAT_MIN_TRUST_PAID_ACTIONS=10
 # AIMEAT_APP_MAX_SIZE_MB=5
+# Publish-time asset check: ask this node over loopback whether the script/stylesheet URLs a
+# published app loads actually resolve. A 404 refuses the publish, which is what stops an app
+# whose <script src> is wrong from going live broken. Safe everywhere (the request only ever goes
+# to 127.0.0.1 on this node's own port); set to false only if the node cannot reach itself.
+# AIMEAT_APP_ASSET_PROBE=true
 # AIMEAT_AGENT_PORTING_FEE=50
 # AIMEAT_MEMORY_OVERAGE_MORSELS=10
 # AIMEAT_STORAGE_OVERAGE_MORSELS=100
@@ -326,6 +354,33 @@ AIMEAT_PORT=40050
 # AIMEAT_RL_CATALOGUE=300
 # AIMEAT_RL_AUTH_CHALLENGE=300
 
+# ── The agent door: POST /v1/registration-invites ──
+# Requests per HOUR per IP (every other AIMEAT_RL_* value is per second). This endpoint is open by
+# design — an AI calling it has no identity yet — and it sends email to an address it was handed,
+# so the thing being protected is a stranger's inbox rather than the node's CPU.
+#
+# The safe PUBLIC default is 5/hour and needs no override: a person registers once. Raise it only
+# where something legitimately makes more calls than a human would (the E2E suites set 1000).
+# A second, independent cap lives in the service: one LIVE invitation per address at a time,
+# which holds even against a caller rotating IPs.
+# AIMEAT_RL_REGISTRATION_INVITES=5
+
+# ── The home's four rooms ──
+# Room 3 (monetising). OFF by default, and it stays off until someone has actually walked into it
+# on THIS node. "The app is published here" is not the same as "a person who clicks the card finds
+# something": an app served from the isolated app origin has no session for a cold arrival, so it
+# can render a permanent loading state while every automated check reports it present. A door into
+# an empty room breaks the product's own rule about empty states at the exact moment the person has
+# finally got interested, so this is a judgement an operator makes once, not an inference.
+# AIMEAT_HOME_ROOM_MONETISE=false
+
+# One friendly email to somebody nobody has been seen on for a fortnight, carrying a prompt they
+# can run straight from the message. OFF by default, and the default is the point: this is
+# unsolicited mail to real people, so turning it on is a decision somebody makes rather than
+# something a deploy does. Needs the email service enabled; honours the notification setting the
+# profile already writes, and never mails the same person twice within 60 days.
+# AIMEAT_INACTIVITY_NUDGE=false
+
 # ── Personal Nodes ───────────────────────────────────────────
 # AIMEAT_PERSONAL_NODES_ENABLED=true
 # AIMEAT_PERSONAL_NODE_MAX_SLOTS=100
@@ -353,6 +408,20 @@ AIMEAT_PORT=40050
 # AIMEAT_SMTP_REJECT_UNAUTHORIZED=false  # Set to false for STARTTLS with self-signed certs
 # AIMEAT_EMAIL_CONFIRMATION_REQUIRED=false
 
+# ── Outbound door (company-in-a-box) ─────────────────────────
+# Max sent outbound messages per owner per rolling 24 h. Safe public default; raise on a
+# private/local node if a legitimate campaign needs it.
+# AIMEAT_OUTBOUND_DAILY_LIMIT=200
+
+# ── E-invoice operator (Finvoice delivery) ───────────────────
+# '' (default) = Finvoice delivery disabled (email door still works).
+# 'mock' = in-process test double (local dev / e2e). 'rest' = generic gateway bridge:
+# POST {url}/invoices with the Finvoice XML, bearer-keyed; status from {url}/invoices/{id}.
+# The operator-specific adapter (Maventa/Apix) lands after the operator contract is chosen.
+# AIMEAT_FINVOICE_OPERATOR=
+# AIMEAT_FINVOICE_OPERATOR_URL=
+# AIMEAT_FINVOICE_OPERATOR_KEY=
+
 # ── Consent Layer (Phase 0.3) ────────────────────────────────
 # AIMEAT_CONSENT_EXPIRY_CHECK_INTERVAL_MS=60000  # How often to check for expired consents (default: 1 min)
 # AIMEAT_CONSENT_DEFAULT_SCOPE="federation"       # Default consent scope: private | dmz | federation
@@ -498,6 +567,21 @@ AIMEAT_PORT=40050
 # AIMEAT_CONNECTIONS_ENABLED=false
 # AIMEAT_CONNECT_GOOGLE_CLIENT_ID=""                           # Google Cloud → Clients → Web application
 # AIMEAT_CONNECT_GOOGLE_CLIENT_SECRET=""                       # from the same client; NOT the sign-in client
+
+# LinkedIn, for publishing to a member's own feed. Consumer tier, self-serve: create an app at
+# https://www.linkedin.com/developers/apps , add the products "Sign In with LinkedIn using OpenID
+# Connect" and "Share on LinkedIn", and set the redirect URL to AIMEAT_CONNECT_REDIRECT_URI.
+# There is no review to wait for. Empty means the provider is simply not offered.
+AIMEAT_CONNECT_LINKEDIN_CLIENT_ID=
+AIMEAT_CONNECT_LINKEDIN_CLIENT_SECRET=
+
+# X, for posting to an account's own timeline. There is no free tier for new developers since
+# 2026-02-06; it is pay-per-use with NO monthly minimum, prepaid credits and a spend cap you set
+# in the X developer console. Roughly $0.015 per post created. Create an app at
+# https://console.x.com , enable OAuth 2.0 with a CONFIDENTIAL client ("Web App, Automated App or Bot"),
+# AIMEAT_CONNECT_REDIRECT_URI. Empty means the provider is simply not offered.
+AIMEAT_CONNECT_X_CLIENT_ID=
+AIMEAT_CONNECT_X_CLIENT_SECRET=
 # AIMEAT_CONNECT_REDIRECT_URI=""                               # default: <baseUrl>/v1/connections/callback
 #   The redirect URI must match the provider's registration EXACTLY — scheme, port, no trailing
 #   slash. A mismatch surfaces only at the provider's consent screen, as redirect_uri_mismatch.
@@ -593,7 +677,7 @@ AIMEAT_STATS_ACCESS=public          # public | authenticated | operator
 # ── Ecosystem Applications (GEAI) ──────────────────────────────
 # Scope bounds for ecosystem-app (GEAI) connections, parallel to the agent knobs above.
 # Defaults lean read + deposit (ecosystem apps mostly deposit refined data into owner areas).
-# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,knowledge:contribute,organism:read"
+# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,organism:read"
 # AIMEAT_MAX_ECO_SCOPES="*"
 # GEAI credential lifetime in seconds (default 90 days, same class as agent JWTs).
 # AIMEAT_ECO_JWT_TTL=7776000
@@ -607,7 +691,7 @@ AIMEAT_METRICS_ACCESS=operator      # public | authenticated | operator
 # AIMEAT_EXTENSIONS_ENABLED=true       # Extension system (default: true)
 # AIMEAT_EXT_MAX_MEMORY_MB=64          # V8 isolate memory limit per action
 # AIMEAT_EXT_TIMEOUT_MS=5000           # V8 isolate CPU timeout per action
-# AIMEAT_EXT_MAX_API_CALLS=50          # Max AIMEAT API calls per action invocation
+# AIMEAT_EXT_MAX_API_CALLS=500         # Max AIMEAT API calls per action invocation (1-10000)
 # AIMEAT_EXT_MAX_CODE_SIZE_KB=256      # Max JS source size per action
 # AIMEAT_EXT_MAX_INSTALLED=20          # Max extensions installed on this node
 # AIMEAT_EXT_INSTALL_ROLE=operator     # Role required to install extensions: operator | owner (default: operator)

package/dist/build-stamp.json

@@ -1,10 +1,10 @@
 {
   "schema_version": 1,
-  "version": "2.7.0",
-  "commit": "c16f054a02c9198474fd62c9985ca0dcdb5419f0",
+  "version": "3.1.0",
+  "commit": "35ae25faecb61625b9c41d9502920e3f12d981cd",
   "dirty": false,
-  "built_at": "2026-08-02T02:40:18.003Z",
-  "newest_source_mtime": 1785638212648.5315,
+  "built_at": "2026-08-14T04:40:18.095Z",
+  "newest_source_mtime": 1786642352443.2114,
   "source_dirs": [
     "src",
     "bin",