aimeat 2.7.0 → 3.1.0

package/dist/src/services/extension-secrets.js

@@ -15,6 +15,9 @@
  *   services/scheduler.ts (decrypt before a scheduled action runs)
  * @version-history
  *   v1.0.0 — 2026-06-24 — Initial: encrypted secret config fields for extensions (Secretary P5 S-C)
+ *   v1.1.0 — 2026-08-10 — stripClientEncryptedValues: a value arriving already wrapped in
+ *                         { encrypted } is dropped at the door. Only this node mints those, and
+ *                         encryptSecretFields passes an already-encrypted value straight through.
  */
 import { encrypt, decrypt } from './encryption.js';
 /** Shown in API responses for a secret that is set — never the ciphertext or plaintext. */
@@ -50,12 +53,46 @@ export function getInstanceSecretKeys(ext) {
         .filter(([, p]) => p && typeof p === 'object' && p.type === 'secret')
         .map(([k]) => k);
 }
+/**
+ * Drop any value a client submitted already wearing the `{ encrypted: … }` shape.
+ *
+ * Only this node produces those, and only from a plaintext value it just encrypted with its own
+ * key. `encryptSecretFields` skips a value that is already encrypted, which is right for the one
+ * legitimate producer (`preserveMaskedSecrets` carrying a stored secret forward) and wrong for
+ * anything arriving from outside: a submitted ciphertext would be stored verbatim and decrypted
+ * with the node key on the way into the sandbox, so a ciphertext lifted from somewhere else would
+ * be handed over in the clear to whoever submitted it.
+ *
+ * Reachability, stated plainly: no API surface returns a secret's ciphertext today. Single-extension
+ * and instance reads mask secrets, and the list route omits config entirely. This closes the door
+ * before a backup, an export or a future field makes the ciphertext obtainable, and it removes an
+ * invariant that only held because of where the callers happened to be.
+ *
+ * Applied at the door, to what the CLIENT sent, before any merge with stored values.
+ */
+export function stripClientEncryptedValues(configObj) {
+    if (!configObj)
+        return { config: configObj, stripped: [] };
+    const stripped = [];
+    const kept = {};
+    for (const [k, v] of Object.entries(configObj)) {
+        if (isEncryptedValue(v)) {
+            stripped.push(k);
+            continue;
+        }
+        kept[k] = v;
+    }
+    return { config: kept, stripped };
+}
 /**
  * Encrypt the secret-typed fields of a config object. Each plaintext string secret becomes
  * `{ encrypted: 'iv:tag:ct' }`. Values that are already encrypted, empty, the mask sentinel,
  * or not strings are passed through unchanged. Returns `null` if a plaintext secret value is
  * present but no encryption key is configured (caller should 503) — secrets are never stored
  * plaintext.
+ *
+ * The already-encrypted pass-through is for `preserveMaskedSecrets` carrying a stored value
+ * forward. Anything arriving from a client goes through stripClientEncryptedValues first.
  */
 export function encryptSecretFields(configObj, secretKeys, key) {
     const out = { ...configObj };

package/dist/src/services/extension-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension-secrets.js","sourceRoot":"","sources":["../../../src/services/extension-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGnD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAIhD,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,SAAS,KAAK,QAAQ,CAAC;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,cAAmD;IAC3F,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;SACjG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,GAAoC;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,GAAuC;IAC3E,MAAM,KAAK,GAAI,GAAG,CAAC,SAAS,EAAE,YAAqE,EAAE,UAAU,CAAC;IAChH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;SACjG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkC,EAClC,UAAoB,EACpB,GAAkB;IAElB,MAAM,GAAG,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,WAAW;YAAE,SAAS;QAC7E,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS,CAAU,kCAAkC;QAC9E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,CAAQ,gCAAgC;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAuB,mCAAmC;QAChF,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA8C,EAC9C,UAAoB,EACpB,GAAkB;IAElB,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA8C,EAC9C,UAAoB;IAEpB,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAiC,EACjC,QAA6C,EAC7C,GAAkB;IAElB,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3F,OAAO,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiC,EACjC,QAA6C,EAC7C,UAAoB;IAEpB,MAAM,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAC3C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"extension-secrets.js","sourceRoot":"","sources":["../../../src/services/extension-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGnD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC,wGAAwG;AACxG,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAIhD,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,SAAS,KAAK,QAAQ,CAAC;AACtG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,cAAmD;IAC3F,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;SACjG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,GAAoC;IACnE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,GAAuC;IAC3E,MAAM,KAAK,GAAI,GAAG,CAAC,SAAS,EAAE,YAAqE,EAAE,UAAU,CAAC;IAChH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,IAAI,KAAK,QAAQ,CAAC;SACjG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA8C;IAE9C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACxD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAAkC,EAClC,UAAoB,EACpB,GAAkB;IAElB,MAAM,GAAG,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,WAAW;YAAE,SAAS;QAC7E,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS,CAAU,kCAAkC;QAC9E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS,CAAQ,gCAAgC;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAuB,mCAAmC;QAChF,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA8C,EAC9C,UAAoB,EACpB,GAAkB;IAElB,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA8C,EAC9C,UAAoB;IAEpB,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAiC,EACjC,QAA6C,EAC7C,GAAkB;IAElB,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3F,OAAO,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiC,EACjC,QAA6C,EAC7C,UAAoB;IAEpB,MAAM,GAAG,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAC3C,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/services/extension-upsert.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @file src/services/extension-upsert.ts
+ * @description Swapping an installed extension's code in place.
+ *
+ *   An upsert is three things, not one: the field swap, the EXCHANGE re-projection (a price or a
+ *   flag on an action may have changed), and — when the extension is ACTIVE — re-registering its
+ *   schedules from the new manifest and re-running its @activate jobs.
+ *
+ *   The field swap existed on both doors. The other two lived only in PUT /v1/extensions/:name, so
+ *   an agent redeploying an active extension through MCP left the OLD schedules registered against
+ *   the new code, never ran the new @activate work, and left its market listing describing the
+ *   previous price. Nothing failed; the extension simply kept doing what it used to.
+ * @structure
+ *   - upsertExtensionInPlace() — swap, re-project, re-init; returns the stored record or null
+ * @usage
+ *   const out = await upsertExtensionInPlace({ storage, config, scheduler }, name, record,
+ *     { ownerName, actor, wasActive });
+ *   if (!out.record) return refuse('the write did not apply');
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Extracted after the copied-logic check found the pair.
+ */
+import type { AimeatConfig } from '../config.js';
+import type { Storage, ExtensionRecord } from '../storage/interface.js';
+import type { Scheduler } from './scheduler.js';
+export interface UpsertDeps {
+    storage: Storage;
+    config: AimeatConfig;
+    /** Absent on a door with no scheduler wired; then an active extension is not re-initialised. */
+    scheduler?: Scheduler | null;
+}
+export interface UpsertContext {
+    /** The bare owner name, for the EXCHANGE projection. */
+    ownerName: string;
+    /** Who is recorded as having created the re-registered schedule jobs. */
+    actor: string;
+    /** Whether the extension was ACTIVE before the swap. */
+    wasActive: boolean;
+}
+/**
+ * Replace an installed extension's code and metadata, preserving its lifecycle fields and its
+ * `ext:{name}` memory.
+ *
+ * Returns the stored record, or null when the write did not apply — which the caller must report as
+ * a failure rather than echoing the record it wanted to store. Answering with the NEW version while
+ * the database still holds the old code is the most misleading answer available, because it looks
+ * like proof the deploy worked.
+ */
+export declare function upsertExtensionInPlace(deps: UpsertDeps, name: string, record: ExtensionRecord, ctx: UpsertContext): Promise<{
+    record: ExtensionRecord | null;
+    reinitialized: boolean;
+}>;
+//# sourceMappingURL=extension-upsert.d.ts.map

package/dist/src/services/extension-upsert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-upsert.d.ts","sourceRoot":"","sources":["../../../src/services/extension-upsert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAsB,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;IACrB,gGAAgG;IAChG,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC1B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CACxC,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,GAAG,EAAE,aAAa,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAAC,CAoDrE"}

package/dist/src/services/extension-upsert.js

@@ -0,0 +1,61 @@
+import { reconcileAfterExtensionWrite } from './exchange-projection.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Replace an installed extension's code and metadata, preserving its lifecycle fields and its
+ * `ext:{name}` memory.
+ *
+ * Returns the stored record, or null when the write did not apply — which the caller must report as
+ * a failure rather than echoing the record it wanted to store. Answering with the NEW version while
+ * the database still holds the old code is the most misleading answer available, because it looks
+ * like proof the deploy worked.
+ */
+export async function upsertExtensionInPlace(deps, name, record, ctx) {
+    const { storage, config, scheduler } = deps;
+    const updated = await storage.updateExtension(name, {
+        version: record.version,
+        description: record.description,
+        author: record.author,
+        requiredApis: record.requiredApis,
+        actions: record.actions,
+        config: record.config,
+        limits: record.limits,
+        federation: record.federation,
+        instances: record.instances,
+    });
+    if (!updated)
+        return { record: null, reinitialized: false };
+    // The listings this extension's actions declare — a price or a flag may have moved with the code.
+    await reconcileAfterExtensionWrite(storage, ctx.ownerName, config.nodeId, name);
+    // An ACTIVE extension is re-initialised: the schedules come from the manifest, so the new
+    // manifest's schedules replace the old ones, and its @activate jobs run again. New action code
+    // is already live — each call reads scriptContent fresh from storage.
+    if (!(ctx.wasActive && scheduler))
+        return { record: updated, reinitialized: false };
+    const jobs = await storage.listScheduledJobs({ extensionName: name });
+    for (const job of jobs) {
+        scheduler.removeJob(job.id);
+        await storage.deleteScheduledJob(job.id);
+    }
+    const schedules = record.config.__schedules ?? [];
+    for (const sched of schedules) {
+        const now = new Date().toISOString();
+        const jobRecord = {
+            id: `ext:${name}:${sched.id}`,
+            name: sched.description ?? `${name}/${sched.id}`,
+            type: 'extension',
+            extensionName: name,
+            actionId: sched.action,
+            cron: sched.cron,
+            enabled: true,
+            input: sched.input ?? undefined,
+            createdBy: ctx.actor,
+            createdAt: now,
+            updatedAt: now,
+        };
+        await storage.createScheduledJob(jobRecord);
+        scheduler.addJob(jobRecord);
+    }
+    scheduler.runActivateJobs(name).catch(err => logger.error(`Failed to run @activate jobs for ${name}`, { error: String(err) }));
+    return { record: updated, reinitialized: true };
+}
+//# sourceMappingURL=extension-upsert.js.map

package/dist/src/services/extension-upsert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-upsert.js","sourceRoot":"","sources":["../../../src/services/extension-upsert.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAkB5C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,IAAgB,EAChB,IAAY,EACZ,MAAuB,EACvB,GAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAE5D,kGAAkG;IAClG,MAAM,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEhF,0FAA0F;IAC1F,+FAA+F;IAC/F,sEAAsE;IACtE,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAEpF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,CAAC,WAA0D,IAAI,EAAE,CAAC;IAClG,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAuB;YAClC,EAAE,EAAE,OAAO,IAAI,IAAI,KAAK,CAAC,EAAY,EAAE;YACvC,IAAI,EAAG,KAAK,CAAC,WAAsB,IAAI,GAAG,IAAI,IAAI,KAAK,CAAC,EAAY,EAAE;YACtE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,KAAK,CAAC,MAAgB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAc;YAC1B,OAAO,EAAE,IAAI;YACb,KAAK,EAAG,KAAK,CAAC,KAAiC,IAAI,SAAS;YAC5D,SAAS,EAAE,GAAG,CAAC,KAAK;YACpB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACjB,CAAC;QACF,MAAM,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC5C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACxC,MAAM,CAAC,KAAK,CAAC,oCAAoC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC"}

package/dist/src/services/federation.d.ts

@@ -9,11 +9,22 @@
  *   - gaiiCache/peerFailures: in-memory resolution cache and consecutive-failure counters
  *
  * @version-history
+ *   v1.1.0 — 2026-08-10 — Security audit H-13/H-14: LIVENESS_RECOVERABLE and OPERATOR_PARKED, the peer
+ *     statuses a liveness signal may lift and the ones only an operator may leave.
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
 import type { AimeatConfig } from '../config.js';
 import type { Storage } from '../storage/interface.js';
 import type { ServiceSummary } from '../utils/service-summary.js';
+/** Peer statuses a liveness signal (ping/heartbeat) may lift back to active. A peer parked by an
+ * operator decision (depeering, suspended) or still in admission (pending, approved) is NOT here:
+ * proving you are up is not the same as being welcome. Audit H-14.
+ */
+/** Peer statuses that only an operator action may leave. A key exchange, a heartbeat or any other
+ * peer-driven request must not lift a peer out of these. Audit H-13.
+ */
+export declare const OPERATOR_PARKED: Set<string>;
+export declare const LIVENESS_RECOVERABLE: Set<string>;
 export interface PeerInfo {
     nodeId: string;
     url: string;

package/dist/src/services/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../../src/services/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAKvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAUlE,MAAM,WAAW,QAAQ;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IACnC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,2GAA2G;IAC3G,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,yGAAyG;IACzG,YAAY,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;IACrD,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmDrE;AAcD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAEpE;AAoBD,wBAAgB,iBAAiB,CAC7B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAC/C,UAAU,CAAC,OAAO,WAAW,CAAC,CA+LhC"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../../src/services/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAKvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAUlE;;;GAGG;AACH;;GAEG;AACH,eAAO,MAAM,eAAe,aAAsC,CAAC;AAEnE,eAAO,MAAM,oBAAoB,aAA4D,CAAC;AAE9F,MAAM,WAAW,QAAQ;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;IACnC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,2GAA2G;IAC3G,IAAI,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,yGAAyG;IACzG,YAAY,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;IACrD,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GAC7B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmDrE;AAcD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAEpE;AAoBD,wBAAgB,iBAAiB,CAC7B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAC/C,UAAU,CAAC,OAAO,WAAW,CAAC,CA+LhC"}

package/dist/src/services/federation.js

@@ -9,6 +9,8 @@
  *   - gaiiCache/peerFailures: in-memory resolution cache and consecutive-failure counters
  *
  * @version-history
+ *   v1.1.0 — 2026-08-10 — Security audit H-13/H-14: LIVENESS_RECOVERABLE and OPERATOR_PARKED, the peer
+ *     statuses a liveness signal may lift and the ones only an operator may leave.
  *   v1.0.0 — 2026-07-13 — Header added; file pre-dates header standard
  */
 /**
@@ -26,6 +28,15 @@ const gaiiCache = new Map();
 const CACHE_TTL_MS = 5 * 60_000;
 /** Consecutive failure counter per peer (for health tracking). */
 const peerFailures = new Map();
+/** Peer statuses a liveness signal (ping/heartbeat) may lift back to active. A peer parked by an
+ * operator decision (depeering, suspended) or still in admission (pending, approved) is NOT here:
+ * proving you are up is not the same as being welcome. Audit H-14.
+ */
+/** Peer statuses that only an operator action may leave. A key exchange, a heartbeat or any other
+ * peer-driven request must not lift a peer out of these. Audit H-13.
+ */
+export const OPERATOR_PARKED = new Set(['depeering', 'suspended']);
+export const LIVENESS_RECOVERABLE = new Set(['active', 'degraded', 'offline', 'unreachable']);
 /**
  * Resolve which node hosts a GAII. Checks local cache first, then local storage,
  * then falls back to asking peers.

package/dist/src/services/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../../src/services/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,yEAAyE;AACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkE,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;AAEhC,kEAAkE;AAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAgC/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,IAAY,EACZ,MAAoB,EACpB,OAAgB,EAChB,KAA4B;IAE5B,iBAAiB;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACtG,CAAC;IAED,iBAAiB;IACjB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,qDAAqD;IACrD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC3F,IAAI,IAAI,EAAE,CAAC;YACP,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC3E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,cAAc,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC1E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACrC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACV,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;gBACtG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACpE,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wBAAwB;YAC1B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD,uCAAuC;AACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B;;;GAGG;AACH,IAAI,cAAc,GAAsC,IAAI,CAAC;AAE7D,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,EAA4B;IAC1D,cAAc,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,UAAkB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACjD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,MAAM,UAAU,iBAAiB,CAC7B,MAAoB,EACpB,OAAgB,EAChB,KAA4B,EAC5B,gBAA8C;IAE9C,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAE9C,KAAK,UAAU,cAAc;QACzB,4CAA4C;QAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAI,IAA+C,CAAC,cAAc,CAAC;YACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5I,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,+CAA+C,CAAC,CAAC;YACpF,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QAC7G,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,MAAM,SAAS,GAAG;YACd,UAAU,EAAE,MAAM,CAAC,gCAAgC;YACnD,kBAAkB,EAAE,MAAM,CAAC,wCAAwC;YACnE,UAAU,EAAE,MAAM,CAAC,gCAAgC;SACtD,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACpC,kDAAkD;YAClD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,gBAAgB,GAAG,GAAG;gBAAE,SAAS;YAEtE,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG;oBACZ,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,IAAI;oBACb,gBAAgB,EAAE,kBAAkB,EAAE;oBACtC,KAAK,EAAE;wBACH,aAAa,EAAE,MAAM,CAAC,MAAM;wBAC5B,iBAAiB,EAAE,OAAO,CAAC,MAAM;wBACjC,YAAY,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS;wBAClD,cAAc,EAAE,aAAa;qBAChC;iBACJ,CAAC;gBAEF,+CAA+C;gBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,OAAO;oBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBAEhB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,qBAAqB,EAAE;oBACvD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;oBAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;iBAC1C,CAAC,CAAC;gBAEH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;oBACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACvB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACzB,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;oBAC1D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE/I,qDAAqD;oBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,UAAU,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;wBAC7C,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,MAAM,sBAAsB,CAAC,CAAC;oBACtF,CAAC;oBACD,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;oBAE5C,+DAA+D;oBAC/D,IAAI,gBAAgB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACzE,IAAI,CAAC;4BACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAE/B,CAAC;4BACF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAC;4BAE/D,IAAI,iBAAiB,EAAE,CAAC;gCACpB,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gCAErD,IAAI,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;oCAC1C,mDAAmD;oCACnD,MAAM,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC;oCACtF,IAAI,CAAC;wCACD,MAAM,WAAW,GAAG,MAAM,KAAK,CAC3B,GAAG,IAAI,CAAC,GAAG,gCAAgC,EAC3C;4CACI,OAAO,EAAE;gDACL,QAAQ,EAAE,kBAAkB;gDAC5B,eAAe,EAAE,MAAM,CAAC,MAAM;6CACjC;4CACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;yCAC1C,CACJ,CAAC;wCAEF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;4CACjB,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,EAEzC,CAAC;4CAEF,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;gDACpB,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gDAC5C,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gDAC9C,MAAM,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,MAAM,EAAE,EAAE;oDAC7D,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;oDAC9C,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;oDAC5C,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;oDAC5C,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;iDAC3C,CAAC,CAAC;4CACP,CAAC;wCACL,CAAC;oCACL,CAAC;oCAAC,OAAO,UAAU,EAAE,CAAC;wCAClB,MAAM,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,MAAM,EAAE,EAAE;4CACpE,KAAK,EAAE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;yCAC/E,CAAC,CAAC;oCACP,CAAC;gCACL,CAAC;4BACL,CAAC;wBACL,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACX,2DAA2D;4BAC7D,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC7F,CAAC;oBACL,CAAC;oBAED,4DAA4D;oBAC5D,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,aAAa,CAAC,IAAI,cAAc,EAAE,CAAC;wBACvF,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,cAAc,sBAAsB,CAAC,CAAC;wBACxF,cAAc,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBAClD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAChC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;wBACjB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;wBACxB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,kBAAkB,QAAQ,uBAAuB,CAAC,CAAC;oBACtF,CAAC;yBAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;wBACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,QAAQ,uBAAuB,CAAC,CAAC;oBACvF,CAAC;oBACD,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;oBAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/I,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;oBACxB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,kBAAkB,QAAQ,uBAAuB,CAAC,CAAC;gBACtF,CAAC;qBAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC7B,CAAC;gBACD,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/I,CAAC;QACL,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,SAAS,YAAY;QACjB,MAAM,MAAM,GAAG,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAAC,CAAC;QAC3D,UAAU,CAAC,GAAG,EAAE;YACZ,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,YAAY,EAAE,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,CAAC;IACf,CAAC;IAED,YAAY,EAAE,CAAC;IAEf,0FAA0F;IAC1F,OAAO,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../../src/services/federation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,yEAAyE;AACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkE,CAAC;AAC5F,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;AAEhC,kEAAkE;AAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;GAGG;AACH;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAgC9F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,IAAY,EACZ,MAAoB,EACpB,OAAgB,EAChB,KAA4B;IAE5B,iBAAiB;IACjB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACtG,CAAC;IAED,iBAAiB;IACjB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,qDAAqD;IACrD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;YAC1G,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC3F,IAAI,IAAI,EAAE,CAAC;YACP,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC3E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,cAAc,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC1E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACrC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACV,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;gBACtG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACpE,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,wBAAwB;YAC1B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD,uCAAuC;AACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B;;;GAGG;AACH,IAAI,cAAc,GAAsC,IAAI,CAAC;AAE7D,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,EAA4B;IAC1D,cAAc,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,UAAkB,EAAE,UAAkB;IAC9E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACjD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEpD,MAAM,UAAU,iBAAiB,CAC7B,MAAoB,EACpB,OAAgB,EAChB,KAA4B,EAC5B,gBAA8C;IAE9C,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAE9C,KAAK,UAAU,cAAc;QACzB,4CAA4C;QAC5C,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAI,IAA+C,CAAC,cAAc,CAAC;YACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5I,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,+CAA+C,CAAC,CAAC;YACpF,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QAC7G,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,MAAM,SAAS,GAAG;YACd,UAAU,EAAE,MAAM,CAAC,gCAAgC;YACnD,kBAAkB,EAAE,MAAM,CAAC,wCAAwC;YACnE,UAAU,EAAE,MAAM,CAAC,gCAAgC;SACtD,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACpC,kDAAkD;YAClD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;YACjD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,gBAAgB,GAAG,GAAG;gBAAE,SAAS;YAEtE,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG;oBACZ,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,IAAI;oBACb,gBAAgB,EAAE,kBAAkB,EAAE;oBACtC,KAAK,EAAE;wBACH,aAAa,EAAE,MAAM,CAAC,MAAM;wBAC5B,iBAAiB,EAAE,OAAO,CAAC,MAAM;wBACjC,YAAY,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS;wBAClD,cAAc,EAAE,aAAa;qBAChC;iBACJ,CAAC;gBAEF,+CAA+C;gBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,OAAO;oBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBAEhB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,qBAAqB,EAAE;oBACvD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;oBAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;iBAC1C,CAAC,CAAC;gBAEH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;oBACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;oBACvB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACzB,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;oBAC1D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAE/I,qDAAqD;oBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,UAAU,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;wBAC7C,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,MAAM,sBAAsB,CAAC,CAAC;oBACtF,CAAC;oBACD,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;oBAE5C,+DAA+D;oBAC/D,IAAI,gBAAgB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;wBACzE,IAAI,CAAC;4BACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAE/B,CAAC;4BACF,MAAM,iBAAiB,GAAG,QAAQ,EAAE,IAAI,EAAE,oBAAoB,CAAC;4BAE/D,IAAI,iBAAiB,EAAE,CAAC;gCACpB,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gCAErD,IAAI,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;oCAC1C,mDAAmD;oCACnD,MAAM,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC;oCACtF,IAAI,CAAC;wCACD,MAAM,WAAW,GAAG,MAAM,KAAK,CAC3B,GAAG,IAAI,CAAC,GAAG,gCAAgC,EAC3C;4CACI,OAAO,EAAE;gDACL,QAAQ,EAAE,kBAAkB;gDAC5B,eAAe,EAAE,MAAM,CAAC,MAAM;6CACjC;4CACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;yCAC1C,CACJ,CAAC;wCAEF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;4CACjB,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,IAAI,EAEzC,CAAC;4CAEF,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;gDACpB,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gDAC5C,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gDAC9C,MAAM,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,MAAM,EAAE,EAAE;oDAC7D,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;oDAC9C,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;oDAC5C,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;oDAC5C,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;iDAC3C,CAAC,CAAC;4CACP,CAAC;wCACL,CAAC;oCACL,CAAC;oCAAC,OAAO,UAAU,EAAE,CAAC;wCAClB,MAAM,CAAC,IAAI,CAAC,6CAA6C,IAAI,CAAC,MAAM,EAAE,EAAE;4CACpE,KAAK,EAAE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;yCAC/E,CAAC,CAAC;oCACP,CAAC;gCACL,CAAC;4BACL,CAAC;wBACL,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACX,2DAA2D;4BAC7D,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC7F,CAAC;oBACL,CAAC;oBAED,4DAA4D;oBAC5D,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,aAAa,CAAC,IAAI,cAAc,EAAE,CAAC;wBACvF,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,cAAc,sBAAsB,CAAC,CAAC;wBACxF,cAAc,CAAC,GAAG,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBAClD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAChC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;wBACjB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;wBACxB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,kBAAkB,QAAQ,uBAAuB,CAAC,CAAC;oBACtF,CAAC;yBAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;wBACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,QAAQ,uBAAuB,CAAC,CAAC;oBACvF,CAAC;oBACD,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;oBAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/I,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAClD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAChC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;oBACxB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC9B,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,kBAAkB,QAAQ,uBAAuB,CAAC,CAAC;gBACtF,CAAC;qBAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;gBAC7B,CAAC;gBACD,sBAAsB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/I,CAAC;QACL,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,SAAS,YAAY;QACjB,MAAM,MAAM,GAAG,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAAC,CAAC;QAC3D,UAAU,CAAC,GAAG,EAAE;YACZ,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACzB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,YAAY,EAAE,CAAC;QACnB,CAAC,EAAE,MAAM,CAAC,CAAC;IACf,CAAC;IAED,YAAY,EAAE,CAAC;IAEf,0FAA0F;IAC1F,OAAO,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC"}

package/dist/src/services/finance/accountant-access.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @file src/services/finance/accountant-access.ts
+ * @description The accountant role: an owner grants another LOCAL owner read-only access
+ *   to their finance area (invoices, vouchers, VAT reports, exports) — nothing else, and
+ *   never write. Storage is a two-sided memory-record pair, same discipline as the
+ *   commerce hold books: `finance.accountants` under the GRANTING owner is authoritative;
+ *   `finance.clients` under the accountant is a mirror for the multi-client listing and
+ *   is always re-verified against the authority before being believed.
+ *
+ *   Read routes accept `?owner={name}`: resolveFinanceOwner() returns the caller's own
+ *   bucket without the param, and the client's bucket only when the authoritative list
+ *   names the caller — otherwise an explicit 403 ACCOUNTANT_ACCESS_DENIED (the grant is
+ *   a named relationship, not a secret; hiding it behind 404 would only confuse the
+ *   accountant whose grant was revoked). Mutation routes never take the param.
+ *
+ * @structure grantAccountant · revokeAccountant · listAccountants · listClients ·
+ *   resolveFinanceOwner
+ * @usage const owner = await resolveFinanceOwner(config, storage, req);
+ * @version-history
+ *   v1.0.0 — 2026-08-06 — Company-in-a-box phase 6.
+ */
+import type { Request } from 'express';
+import type { AimeatConfig } from '../../config.js';
+import type { Storage } from '../../storage/interface.js';
+/** Grants the accountant role to a local owner. Both sides of the pair are written. */
+export declare function grantAccountant(config: AimeatConfig, storage: Storage, granterGhii: string, accountantName: string): Promise<string[]>;
+/** Revokes the role; the authoritative list is what enforces, the mirror just follows. */
+export declare function revokeAccountant(config: AimeatConfig, storage: Storage, granterGhii: string, accountantName: string): Promise<string[]>;
+export declare function listAccountants(storage: Storage, granterGhii: string): Promise<string[]>;
+/**
+ * The accountant's client list — the mirror, RE-VERIFIED against each client's
+ * authoritative list so a stale mirror can never claim access that was revoked.
+ */
+export declare function listClients(storage: Storage, accountantGhii: string): Promise<string[]>;
+/**
+ * Resolves which owner's finance bucket a READ request targets. Without ?owner= it is
+ * the caller's own; with it, the authoritative grant list decides — 403 otherwise.
+ */
+export declare function resolveFinanceOwner(config: AimeatConfig, storage: Storage, req: Request): Promise<string>;
+//# sourceMappingURL=accountant-access.d.ts.map

package/dist/src/services/finance/accountant-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountant-access.d.ts","sourceRoot":"","sources":["../../../../src/services/finance/accountant-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAsB1D,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkB5I;AAED,0FAA0F;AAC1F,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAO7I;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE9F;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ7F;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAW/G"}

package/dist/src/services/finance/accountant-access.js

@@ -0,0 +1,84 @@
+import { FinanceError } from './errors.js';
+const ACCOUNTANTS_KEY = 'finance.accountants';
+const CLIENTS_KEY = 'finance.clients';
+const NAME_RE = /^[a-z0-9_-]{1,60}$/i;
+async function readList(storage, ownerGhii, key) {
+    const rec = await storage.getMemory(ownerGhii, key);
+    const value = rec?.value;
+    return Array.isArray(value?.list) ? value.list.filter((s) => typeof s === 'string') : [];
+}
+async function writeList(storage, ownerGhii, key, list) {
+    const existing = await storage.getMemory(ownerGhii, key);
+    const now = new Date().toISOString();
+    await storage.setMemory({
+        key, ownerGaii: ownerGhii, value: { list }, visibility: 'private', tags: ['finance'], ttlHours: null,
+        version: (existing?.version ?? 0) + 1, createdAt: existing?.createdAt ?? now, updatedAt: now,
+    });
+}
+/** Grants the accountant role to a local owner. Both sides of the pair are written. */
+export async function grantAccountant(config, storage, granterGhii, accountantName) {
+    if (!NAME_RE.test(accountantName))
+        throw new FinanceError('INVALID_ACCOUNTANT', 400, 'accountant must be a local owner name');
+    const target = await storage.getOwner(accountantName);
+    if (!target)
+        throw new FinanceError('NOT_FOUND', 404, `Owner "${accountantName}" not found on this node`);
+    const accountantGhii = `${accountantName}@${config.nodeId}`;
+    if (accountantGhii === granterGhii)
+        throw new FinanceError('INVALID_ACCOUNTANT', 422, 'You already read your own books');
+    const accountants = await readList(storage, granterGhii, ACCOUNTANTS_KEY);
+    if (!accountants.includes(accountantGhii)) {
+        accountants.push(accountantGhii);
+        await writeList(storage, granterGhii, ACCOUNTANTS_KEY, accountants);
+    }
+    const clients = await readList(storage, accountantGhii, CLIENTS_KEY);
+    if (!clients.includes(granterGhii)) {
+        clients.push(granterGhii);
+        await writeList(storage, accountantGhii, CLIENTS_KEY, clients);
+    }
+    return accountants;
+}
+/** Revokes the role; the authoritative list is what enforces, the mirror just follows. */
+export async function revokeAccountant(config, storage, granterGhii, accountantName) {
+    const accountantGhii = `${accountantName}@${config.nodeId}`;
+    const accountants = (await readList(storage, granterGhii, ACCOUNTANTS_KEY)).filter((g) => g !== accountantGhii);
+    await writeList(storage, granterGhii, ACCOUNTANTS_KEY, accountants);
+    const clients = (await readList(storage, accountantGhii, CLIENTS_KEY)).filter((g) => g !== granterGhii);
+    await writeList(storage, accountantGhii, CLIENTS_KEY, clients);
+    return accountants;
+}
+export async function listAccountants(storage, granterGhii) {
+    return readList(storage, granterGhii, ACCOUNTANTS_KEY);
+}
+/**
+ * The accountant's client list — the mirror, RE-VERIFIED against each client's
+ * authoritative list so a stale mirror can never claim access that was revoked.
+ */
+export async function listClients(storage, accountantGhii) {
+    const mirror = await readList(storage, accountantGhii, CLIENTS_KEY);
+    const verified = [];
+    for (const clientGhii of mirror) {
+        const authority = await readList(storage, clientGhii, ACCOUNTANTS_KEY);
+        if (authority.includes(accountantGhii))
+            verified.push(clientGhii);
+    }
+    return verified;
+}
+/**
+ * Resolves which owner's finance bucket a READ request targets. Without ?owner= it is
+ * the caller's own; with it, the authoritative grant list decides — 403 otherwise.
+ */
+export async function resolveFinanceOwner(config, storage, req) {
+    const callerGhii = `${req.auth.owner}@${config.nodeId}`;
+    const ownerParam = typeof req.query.owner === 'string' ? req.query.owner.trim() : '';
+    if (!ownerParam || `${ownerParam}@${config.nodeId}` === callerGhii)
+        return callerGhii;
+    if (!NAME_RE.test(ownerParam))
+        throw new FinanceError('INVALID_OWNER', 400, 'owner must be a local owner name');
+    const targetGhii = `${ownerParam}@${config.nodeId}`;
+    const accountants = await readList(storage, targetGhii, ACCOUNTANTS_KEY);
+    if (!accountants.includes(callerGhii)) {
+        throw new FinanceError('ACCOUNTANT_ACCESS_DENIED', 403, `No accountant grant from "${ownerParam}"`);
+    }
+    return targetGhii;
+}
+//# sourceMappingURL=accountant-access.js.map

package/dist/src/services/finance/accountant-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountant-access.js","sourceRoot":"","sources":["../../../../src/services/finance/accountant-access.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,SAAiB,EAAE,GAAW;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,EAAE,KAAuC,CAAC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,KAAM,CAAC,IAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,SAAiB,EAAE,GAAW,EAAE,IAAc;IACvF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,CAAC,SAAS,CAAC;QACtB,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI;QACpG,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG,EAAE,SAAS,EAAE,GAAG;KAC7F,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAoB,EAAE,OAAgB,EAAE,WAAmB,EAAE,cAAsB;IACvH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,GAAG,EAAE,UAAU,cAAc,0BAA0B,CAAC,CAAC;IAC1G,MAAM,cAAc,GAAG,GAAG,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,IAAI,cAAc,KAAK,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAEzH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC1E,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjC,MAAM,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,MAAM,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB,EAAE,OAAgB,EAAE,WAAmB,EAAE,cAAsB;IACxH,MAAM,cAAc,GAAG,GAAG,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IAChH,MAAM,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;IACxG,MAAM,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,WAAmB;IACzE,OAAO,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,cAAsB;IACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAgB,EAAE,GAAY;IAC5F,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,CAAC,UAAU,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACtF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;IAChH,MAAM,UAAU,GAAG,GAAG,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,GAAG,EAAE,6BAA6B,UAAU,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/src/services/finance/errors.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file src/services/finance/errors.ts
+ * @description Typed error for the finance domain, mapped to HTTP by the routes
+ *   (same shape as CommerceError / ContactsError so route error handling stays uniform).
+ * @usage throw new FinanceError('FISCAL_YEAR_LOCKED', 409, 'Fiscal year 2025 is locked');
+ * @version-history
+ *   v1.0.0 — 2026-08-06 — Company-in-a-box phase 1.
+ */
+export declare class FinanceError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    constructor(code: string, statusCode: number, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/services/finance/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/services/finance/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,qBAAa,YAAa,SAAQ,KAAK;aAEnB,IAAI,EAAE,MAAM;aACZ,UAAU,EAAE,MAAM;gBADlB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClC,OAAO,EAAE,MAAM;CAKlB"}

package/dist/src/services/finance/errors.js

@@ -0,0 +1,19 @@
+/**
+ * @file src/services/finance/errors.ts
+ * @description Typed error for the finance domain, mapped to HTTP by the routes
+ *   (same shape as CommerceError / ContactsError so route error handling stays uniform).
+ * @usage throw new FinanceError('FISCAL_YEAR_LOCKED', 409, 'Fiscal year 2025 is locked');
+ * @version-history
+ *   v1.0.0 — 2026-08-06 — Company-in-a-box phase 1.
+ */
+export class FinanceError extends Error {
+    code;
+    statusCode;
+    constructor(code, statusCode, message) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.name = 'FinanceError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/services/finance/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/services/finance/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,IAAY,EACZ,UAAkB,EAClC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;QAIlC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF"}

package/dist/src/services/finance/export.d.ts

@@ -0,0 +1,16 @@
+import type { VoucherRecord, InvoiceRecord } from '../../models/finance-schemas.js';
+/** Voucher journal CSV: one row per voucher, VAT itemized per code in packed columns. */
+export declare function vouchersCsv(vouchers: VoucherRecord[]): string;
+/** Invoice ledger CSV: one row per invoice. */
+export declare function invoicesCsv(invoices: InvoiceRecord[]): string;
+export interface ZipEntry {
+    /** Entry filename (forward slashes, UTF-8). */
+    name: string;
+    data: Buffer;
+}
+/**
+ * Store-only ZIP writer (PKZIP 2.0 layout, UTF-8 filename flag). Enough for a bundle of
+ * XML files; every unzip tool reads it. DOS timestamps are fixed to the build moment.
+ */
+export declare function buildZip(entries: ZipEntry[]): Buffer;
+//# sourceMappingURL=export.d.ts.map

package/dist/src/services/finance/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../../src/services/finance/export.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAmBpF,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAe7D;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAe7D;AAED,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAuDpD"}