aimeat 3.1.0 → 3.3.0

package/dist/src/routes/agent-docs.js

@@ -5,10 +5,10 @@
  *   Both are generated from the same sources as everything else — the public-page registry, the
  *   node config — so a page added in one place appears here without a second edit.
  *
- *   These sit alongside, not instead of, the documents we already serve. `sitemap.xml` addresses a
- *   crawler, `llms.txt` is the full builder's manual, and `sitemap.md` is the one-page answer to
- *   "what is here and where do I start" that neither of those gives: 989 OpenAPI operations and a
- *   145 kB manual are both poor first reads.
+ *   These sit alongside the documents we already serve. `sitemap.xml` addresses a crawler,
+ *   `llms-full.txt` is the full builder's manual with `llms.txt` as its index, and `sitemap.md` is
+ *   the one-page answer to "what is here and where do I start" that none of those gives: 989
+ *   OpenAPI operations and a 124 kB manual are both poor first reads.
  *
  * @structure
  *   - agentDocsRouter(config) — mounts the GET endpoints
@@ -43,152 +43,152 @@ function buildSitemapMarkdown(config) {
         .filter((p) => p.path !== '/')
         .map((p) => `- [${p.title}](${b}${p.path}): ${p.description}`)
         .join('\n');
-    return `# AIMEAT node \`${config.nodeId}\` — site map
-
-> Everything this node serves, on one page: the pages a person reads, the documents an agent
-> reads, and the machine-readable discovery endpoints. Start here, then follow one link.
-
-## Pages
-
-- [Home](${b}/): what this node is
-${pages}
-
-## Agent documentation
-
-- [llms.txt](${b}/llms.txt): the full builder's manual — SDK libraries, app templates, API reference
-- [llms-full.txt](${b}/llms-full.txt): the same manual, at the conventional full-content path
-- [AGENTS.md](${b}/AGENTS.md): short orientation for a coding agent meeting this node
-- [OpenAPI contract](${b}/v1/spec): the canonical API contract this node is held to
-- [API documentation](${b}/v1/docs): browsable endpoint reference
-- [Agent registration](${b}/auth.md): RFC 8628 device flow, owner-approved
-- [App building prompt](${b}/v1/prompts/build-app): the canonical spec for single-file AIMEAT apps
-- [App templates](${b}/v1/app-templates): starter skeletons
-- [App-build pitfalls](${b}/v1/appdev/pitfalls): the curated registry of what breaks app builds
-- [Glossary](${b}/v1/glossary.md): the vocabulary, in markdown
-
-## Machine-readable discovery
-
-- [Node descriptor](${b}/.well-known/aimeat): node id, type, public key, capabilities, federation settings
-- [AI transparency statement](${b}/v1/ai-transparency): what this node marks as AI-generated, how, and in which posture ([markdown](${b}/v1/ai-transparency.md))
-- [MCP Server Card](${b}/.well-known/mcp.json): the MCP server at \`${b}/v1/mcp\`, its transport and auth
-- [API catalog](${b}/.well-known/api-catalog): RFC 9727 linkset over the contract, docs and descriptors
-- [Agent Skills index](${b}/.well-known/agent-skills/index.json): the skill packs published here
-- [UCP profile](${b}/.well-known/ucp): commerce transports, checkout capability, payment handlers
-- [ACP profile](${b}/.well-known/acp.json): agentic-commerce discovery and the product feed
-- [Web Bot Auth directory](${b}/.well-known/http-message-signatures-directory): the keys this node signs outbound requests with
-- [sitemap.xml](${b}/sitemap.xml): the same pages, for crawlers
-- [robots.txt](${b}/robots.txt): crawl policy, including the content signals this node sets
-
-## Where to start
-
-- **You are a person.** [The portal](${b}/v1/portal) — register, then connect an assistant.
-- **You are an assistant helping a person build something.** [llms.txt](${b}/llms.txt).
-- **You are an agent joining this node under your own identity.** [auth.md](${b}/auth.md) — device
-  flow, the owner approves you and picks your scopes.
-- **You are a coding agent meeting AIMEAT as a dependency.** [AGENTS.md](${b}/AGENTS.md).
+    return `# AIMEAT node \`${config.nodeId}\` — site map
+
+> Everything this node serves, on one page: the pages a person reads, the documents an agent
+> reads, and the machine-readable discovery endpoints. Start here, then follow one link.
+
+## Pages
+
+- [Home](${b}/): what this node is
+${pages}
+
+## Agent documentation
+
+- [llms.txt](${b}/llms.txt): the curated index over everything below
+- [llms-full.txt](${b}/llms-full.txt): the full builder's manual — SDK libraries, app templates, API reference
+- [AGENTS.md](${b}/AGENTS.md): short orientation for a coding agent meeting this node
+- [OpenAPI contract](${b}/v1/spec): the canonical API contract this node is held to
+- [API documentation](${b}/v1/docs): browsable endpoint reference
+- [Agent registration](${b}/auth.md): RFC 8628 device flow, owner-approved
+- [App building prompt](${b}/v1/prompts/build-app): the canonical spec for single-file AIMEAT apps
+- [App templates](${b}/v1/app-templates): starter skeletons
+- [App-build pitfalls](${b}/v1/appdev/pitfalls): the curated registry of what breaks app builds
+- [Glossary](${b}/v1/glossary.md): the vocabulary, in markdown
+
+## Machine-readable discovery
+
+- [Node descriptor](${b}/.well-known/aimeat): node id, type, public key, capabilities, federation settings
+- [AI transparency statement](${b}/v1/ai-transparency): what this node marks as AI-generated, how, and in which posture ([markdown](${b}/v1/ai-transparency.md))
+- [MCP Server Card](${b}/.well-known/mcp.json): the MCP server at \`${b}/v1/mcp\`, its transport and auth
+- [API catalog](${b}/.well-known/api-catalog): RFC 9727 linkset over the contract, docs and descriptors
+- [Agent Skills index](${b}/.well-known/agent-skills/index.json): the skill packs published here
+- [UCP profile](${b}/.well-known/ucp): commerce transports, checkout capability, payment handlers
+- [ACP profile](${b}/.well-known/acp.json): agentic-commerce discovery and the product feed
+- [Web Bot Auth directory](${b}/.well-known/http-message-signatures-directory): the keys this node signs outbound requests with
+- [sitemap.xml](${b}/sitemap.xml): the same pages, for crawlers
+- [robots.txt](${b}/robots.txt): crawl policy, including the content signals this node sets
+
+## Where to start
+
+- **You are a person.** [The portal](${b}/v1/portal) — register, then connect an assistant.
+- **You are an assistant helping a person build something.** [llms-full.txt](${b}/llms-full.txt).
+- **You are an agent joining this node under your own identity.** [auth.md](${b}/auth.md) — device
+  flow, the owner approves you and picks your scopes.
+- **You are a coding agent meeting AIMEAT as a dependency.** [AGENTS.md](${b}/AGENTS.md).
 `;
 }
 /** The coding-agent orientation document. */
 function buildAgentsMarkdown(config) {
     const b = config.baseUrl;
-    return `# AIMEAT node \`${config.nodeId}\`
-
-> Persistent memory, identity, shared workspaces and a usage meter for AI agents and the humans
-> who own them, over REST and MCP. This document orients a coding agent that has met this node as
-> a dependency or an integration target. It is deliberately short; every section links to the
-> full reference.
-
-## What this is
-
-AIMEAT gives an AI agent three things it does not otherwise have: memory that survives the
-session, an identity its owner can grant and revoke, and a place to work alongside other agents
-and people. A node is a plain HTTP service. Everything below is available over REST, and the same
-surface is exposed over MCP.
-
-It is the right tool when an agent needs state across sessions, when a human must stay in control
-of what an agent can reach, or when several agents and people work on the same material. It is
-the wrong tool for a one-shot script.
-
-## Installation
-
-Nothing to install. Get an identity:
-
-1. \`POST ${b}/v1/agents/device-authorize\` with \`{ "agent_name": "...", "owner": "..." }\`
-2. The owner approves in their portal and picks the scopes
-3. Poll \`POST ${b}/v1/agents/device-token\` for an EdDSA JWT
-
-This is RFC 8628 device authorization. **Agents are never created implicitly** — an owner approves
-every one. Full flow: \`GET ${b}/auth.md\`
-
-For an MCP-capable platform (Claude Desktop, claude.ai, Cursor), point it at \`${b}/v1/mcp\` and
-authenticate with OAuth 2.1. The server card is at \`${b}/.well-known/mcp.json\`.
-
-## Configuration
-
-- **Scopes.** Your token carries the scope set the owner approved. A call outside it answers 403
-  naming the scope, never an empty result — a silent empty answer would read as "no data".
-- **Envelope.** Every response is \`{ success, node_id, data|error, next_actions }\`.
-- **Discovery headers.** Every GET carries \`Link\` headers to the API catalog and the contract.
-
-## Concepts you need before your first call
-
-| Term | Form | What it is |
-|---|---|---|
-| GHII | \`owner@node-id\` | a human. Owns everything: data, balance, trust |
-| GAII | \`agent#owner@node-id\` | an AI agent. Scoped permissions, its own trust score |
-| GEAI | \`eco:app#owner@node-id\` | an ecosystem app, consented like an agent |
-| morsel | integer | the usage meter. The human pays; agent balances are always 0 |
-| organism | | a shared space: workspaces, records, documents, members |
-| scope | \`memory:write\` | what your token may do. Set by the owner at approval |
-
-The three identity forms are not interchangeable, and confusing them is the most common first
-mistake: data written under the wrong one is invisible to the reader who expects it.
-
-Full vocabulary: [the glossary](${b}/v1/glossary), also at \`${b}/v1/glossary.md\`.
-
-## Usage
-
-Write and read memory:
-
-\`\`\`bash
-curl -X POST ${b}/v1/memory -H "Authorization: Bearer $TOKEN" \\
-  -H 'Content-Type: application/json' \\
-  -d '{"key":"notes.today","value":{"text":"..."},"visibility":"private"}'
-
-curl ${b}/v1/memory/notes.today -H "Authorization: Bearer $TOKEN"
-\`\`\`
-
-List what you can see, search across it, read someone's public record:
-
-\`\`\`bash
-curl "${b}/v1/memory?prefix=notes.&limit=50" -H "Authorization: Bearer $TOKEN"
-curl "${b}/v1/discover?q=..."                -H "Authorization: Bearer $TOKEN"
-curl ${b}/v1/memory/public/alice@${config.nodeId}/profile
-\`\`\`
-
-Work with tasks, workflows, organisms and skills through the same pattern. The full endpoint list
-with request and response shapes is in the OpenAPI contract.
-
-## Conventions
-
-- **Every response is enveloped:** \`{ "success": true, "node_id": "...", "data": {...},
-  "next_actions": [...] }\`. Errors carry \`{ "success": false, "error": { "code", "message" } }\`.
-  \`next_actions\` names what to do next, so an agent can follow the API without a map.
-- **Scopes are enforced per call.** A missing scope is a 403 naming the scope, not a silent empty
-  result.
-- **Content negotiation.** Public pages answer \`Accept: text/markdown\` with markdown; API
-  endpoints answer JSON.
-- **Discovery headers.** Every GET response carries \`Link\` headers pointing at the API catalog
-  and the OpenAPI contract, so you can find the contract from any response.
-
-## Where the rest is
-
-- Full builder's manual: \`GET ${b}/llms.txt\`
-- OpenAPI contract: \`GET ${b}/v1/spec\`
-- Site map: \`GET ${b}/sitemap.md\`
-- Glossary: \`GET ${b}/v1/glossary.md\`
-- Registration: \`GET ${b}/auth.md\`
-- Skill packs published here: \`GET ${b}/.well-known/agent-skills/index.json\`
+    return `# AIMEAT node \`${config.nodeId}\`
+
+> Persistent memory, identity, shared workspaces and a usage meter for AI agents and the humans
+> who own them, over REST and MCP. This document orients a coding agent that has met this node as
+> a dependency or an integration target. It is deliberately short; every section links to the
+> full reference.
+
+## What this is
+
+AIMEAT gives an AI agent three things it does not otherwise have: memory that survives the
+session, an identity its owner can grant and revoke, and a place to work alongside other agents
+and people. A node is a plain HTTP service. Everything below is available over REST, and the same
+surface is exposed over MCP.
+
+It is the right tool when an agent needs state across sessions, when a human must stay in control
+of what an agent can reach, or when several agents and people work on the same material. It is
+the wrong tool for a one-shot script.
+
+## Installation
+
+Nothing to install. Get an identity:
+
+1. \`POST ${b}/v1/agents/device-authorize\` with \`{ "agent_name": "...", "owner": "..." }\`
+2. The owner approves in their portal and picks the scopes
+3. Poll \`POST ${b}/v1/agents/device-token\` for an EdDSA JWT
+
+This is RFC 8628 device authorization. **Agents are never created implicitly** — an owner approves
+every one. Full flow: \`GET ${b}/auth.md\`
+
+For an MCP-capable platform (Claude Desktop, claude.ai, Cursor), point it at \`${b}/v1/mcp\` and
+authenticate with OAuth 2.1. The server card is at \`${b}/.well-known/mcp.json\`.
+
+## Configuration
+
+- **Scopes.** Your token carries the scope set the owner approved. A call outside it answers 403
+  naming the scope, never an empty result — a silent empty answer would read as "no data".
+- **Envelope.** Every response is \`{ success, node_id, data|error, next_actions }\`.
+- **Discovery headers.** Every GET carries \`Link\` headers to the API catalog and the contract.
+
+## Concepts you need before your first call
+
+| Term | Form | What it is |
+|---|---|---|
+| GHII | \`owner@node-id\` | a human. Owns everything: data, balance, trust |
+| GAII | \`agent#owner@node-id\` | an AI agent. Scoped permissions, its own trust score |
+| GEAI | \`eco:app#owner@node-id\` | an ecosystem app, consented like an agent |
+| morsel | integer | the usage meter. The human pays; agent balances are always 0 |
+| organism | | a shared space: workspaces, records, documents, members |
+| scope | \`memory:write\` | what your token may do. Set by the owner at approval |
+
+The three identity forms are not interchangeable, and confusing them is the most common first
+mistake: data written under the wrong one is invisible to the reader who expects it.
+
+Full vocabulary: [the glossary](${b}/v1/glossary), also at \`${b}/v1/glossary.md\`.
+
+## Usage
+
+Write and read memory:
+
+\`\`\`bash
+curl -X POST ${b}/v1/memory -H "Authorization: Bearer $TOKEN" \\
+  -H 'Content-Type: application/json' \\
+  -d '{"key":"notes.today","value":{"text":"..."},"visibility":"private"}'
+
+curl ${b}/v1/memory/notes.today -H "Authorization: Bearer $TOKEN"
+\`\`\`
+
+List what you can see, search across it, read someone's public record:
+
+\`\`\`bash
+curl "${b}/v1/memory?prefix=notes.&limit=50" -H "Authorization: Bearer $TOKEN"
+curl "${b}/v1/discover?q=..."                -H "Authorization: Bearer $TOKEN"
+curl ${b}/v1/memory/public/alice@${config.nodeId}/profile
+\`\`\`
+
+Work with tasks, workflows, organisms and skills through the same pattern. The full endpoint list
+with request and response shapes is in the OpenAPI contract.
+
+## Conventions
+
+- **Every response is enveloped:** \`{ "success": true, "node_id": "...", "data": {...},
+  "next_actions": [...] }\`. Errors carry \`{ "success": false, "error": { "code", "message" } }\`.
+  \`next_actions\` names what to do next, so an agent can follow the API without a map.
+- **Scopes are enforced per call.** A missing scope is a 403 naming the scope, not a silent empty
+  result.
+- **Content negotiation.** Public pages answer \`Accept: text/markdown\` with markdown; API
+  endpoints answer JSON.
+- **Discovery headers.** Every GET response carries \`Link\` headers pointing at the API catalog
+  and the OpenAPI contract, so you can find the contract from any response.
+
+## Where the rest is
+
+- Full builder's manual: \`GET ${b}/llms-full.txt\` (its index: \`GET ${b}/llms.txt\`)
+- OpenAPI contract: \`GET ${b}/v1/spec\`
+- Site map: \`GET ${b}/sitemap.md\`
+- Glossary: \`GET ${b}/v1/glossary.md\`
+- Registration: \`GET ${b}/auth.md\`
+- Skill packs published here: \`GET ${b}/.well-known/agent-skills/index.json\`
 `;
 }
 export function agentDocsRouter(config) {

package/dist/src/routes/agent-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-docs.js","sourceRoot":"","sources":["../../../src/routes/agent-docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACvE,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACrE,IAAI,EAAE,CAAC;AACT,CAAC;AAED,6BAA6B;AAC7B,SAAS,oBAAoB,CAAC,MAAoB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,YAAY,EAAE;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,mBAAmB,MAAM,CAAC,MAAM;;;;;;;WAO9B,CAAC;EACV,KAAK;;;;eAIQ,CAAC;oBACI,CAAC;gBACL,CAAC;uBACM,CAAC;wBACA,CAAC;yBACA,CAAC;0BACA,CAAC;oBACP,CAAC;yBACI,CAAC;eACX,CAAC;;;;sBAIM,CAAC;gCACS,CAAC,qGAAqG,CAAC;sBACjH,CAAC,+CAA+C,CAAC;kBACrD,CAAC;yBACM,CAAC;kBACR,CAAC;kBACD,CAAC;6BACU,CAAC;kBACZ,CAAC;iBACF,CAAC;;;;uCAIqB,CAAC;0EACkC,CAAC;8EACG,CAAC;;2EAEJ,CAAC;CAC3E,CAAC;AACF,CAAC;AAED,6CAA6C;AAC7C,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,OAAO,mBAAmB,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;YAsB7B,CAAC;;iBAEI,CAAC;;;8BAGY,CAAC;;iFAEkD,CAAC;uDAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;kCAuBtB,CAAC,4BAA4B,CAAC;;;;;;;eAOjD,CAAC;;;;OAIT,CAAC;;;;;;QAMA,CAAC;QACD,CAAC;OACF,CAAC,2BAA2B,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;iCAoBf,CAAC;4BACN,CAAC;oBACT,CAAC;oBACD,CAAC;wBACG,CAAC;sCACa,CAAC;CACtC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChD,YAAY,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,6FAA6F;IAC7F,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"agent-docs.js","sourceRoot":"","sources":["../../../src/routes/agent-docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACvE,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACrE,IAAI,EAAE,CAAC;AACT,CAAC;AAED,6BAA6B;AAC7B,SAAS,oBAAoB,CAAC,MAAoB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,YAAY,EAAE;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,mBAAmB,MAAM,CAAC,MAAM;;;;;;;WAO9B,CAAC;EACV,KAAK;;;;eAIQ,CAAC;oBACI,CAAC;gBACL,CAAC;uBACM,CAAC;wBACA,CAAC;yBACA,CAAC;0BACA,CAAC;oBACP,CAAC;yBACI,CAAC;eACX,CAAC;;;;sBAIM,CAAC;gCACS,CAAC,qGAAqG,CAAC;sBACjH,CAAC,+CAA+C,CAAC;kBACrD,CAAC;yBACM,CAAC;kBACR,CAAC;kBACD,CAAC;6BACU,CAAC;kBACZ,CAAC;iBACF,CAAC;;;;uCAIqB,CAAC;+EACuC,CAAC;8EACF,CAAC;;2EAEJ,CAAC;CAC3E,CAAC;AACF,CAAC;AAED,6CAA6C;AAC7C,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,OAAO,mBAAmB,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;YAsB7B,CAAC;;iBAEI,CAAC;;;8BAGY,CAAC;;iFAEkD,CAAC;uDAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;kCAuBtB,CAAC,4BAA4B,CAAC;;;;;;;eAOjD,CAAC;;;;OAIT,CAAC;;;;;;QAMA,CAAC;QACD,CAAC;OACF,CAAC,2BAA2B,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;iCAoBf,CAAC,sCAAsC,CAAC;4BAC7C,CAAC;oBACT,CAAC;oBACD,CAAC;wBACG,CAAC;sCACa,CAAC;CACtC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChD,YAAY,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,6FAA6F;IAC7F,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/D,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/routes/agent-messages.d.ts

@@ -8,6 +8,12 @@
  *   - GET    /v1/agents/:name/messages         -- List message history
  *   - PATCH  /v1/agents/:name/messages/:id     -- Update message status
  * @version-history
+ *   v1.6.0 -- 2026-08-15 -- PATCH /:name/messages/:id authorizes against the MESSAGE, not just the
+ *     agent name in the path. canAccessAgent() answers "may you act as this agent", built against
+ *     the caller's own owner, and the message id was a second, unchecked coordinate — so any agent
+ *     could flip the status of any message on the node by id, and the response returns the whole
+ *     updated row, which made the write a read of somebody else's message too. E2E test-quality
+ *     audit finding A11.
  *   v1.5.0 -- 2026-08-11 -- The send is one implementation again: validation, the record build, the
  *     provenance stamp, the message.inbound webhook, the MCP resource notification and the live-update
  *     emit moved to services/agent-message-send.ts, which aimeat_message_send now calls as well. The

package/dist/src/routes/agent-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-messages.d.ts","sourceRoot":"","sources":["../../../src/routes/agent-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAsB,MAAM,yBAAyB,CAAC;AAU3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGjF,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAyNzH"}
+{"version":3,"file":"agent-messages.d.ts","sourceRoot":"","sources":["../../../src/routes/agent-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAsB,MAAM,yBAAyB,CAAC;AAU3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAGjF,KAAK,iBAAiB,GAAG,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,MAAM,CA0OzH"}

package/dist/src/routes/agent-messages.js

@@ -8,6 +8,12 @@
  *   - GET    /v1/agents/:name/messages         -- List message history
  *   - PATCH  /v1/agents/:name/messages/:id     -- Update message status
  * @version-history
+ *   v1.6.0 -- 2026-08-15 -- PATCH /:name/messages/:id authorizes against the MESSAGE, not just the
+ *     agent name in the path. canAccessAgent() answers "may you act as this agent", built against
+ *     the caller's own owner, and the message id was a second, unchecked coordinate — so any agent
+ *     could flip the status of any message on the node by id, and the response returns the whole
+ *     updated row, which made the write a read of somebody else's message too. E2E test-quality
+ *     audit finding A11.
  *   v1.5.0 -- 2026-08-11 -- The send is one implementation again: validation, the record build, the
  *     provenance stamp, the message.inbound webhook, the MCP resource notification and the live-update
  *     emit moved to services/agent-message-send.ts, which aimeat_message_send now calls as well. The
@@ -29,7 +35,7 @@
 import { Router } from 'express';
 import { requireAuth } from '../auth/middleware.js';
 import { success, error } from '../middleware/envelope.js';
-import { resolveIdentity, buildGAII } from '../utils/gaii.js';
+import { resolveIdentity, buildGAII, isSameOwner } from '../utils/gaii.js';
 import { emitChange } from '../services/event-bus.js';
 import { emitResourceUpdated } from '../mcp/index.js';
 import { AgentMessageStatusSchema } from '../models/agent-message-schemas.js';
@@ -210,6 +216,22 @@ export function agentMessagesRouter(config, storage, webhookDispatcher) {
         const processedAt = status === 'delivered' || status === 'error'
             ? new Date().toISOString()
             : undefined;
+        // canAccessAgent() above answers "may you act as the agent NAMED IN THE PATH", and it builds
+        // that name against the caller's OWN owner — so it is a real check and it is not this one. The
+        // message id is a separate, client-supplied coordinate, and updateMessageStatus took it on its
+        // own: any agent could flip the status of any message on the node by id, and the response hands
+        // back the whole updated row, so the write doubled as a read of somebody else's message. The
+        // record decides now, which is the rule the identity model states — authorize against the
+        // resolved identity, never against a name in the request.
+        const existing = await storage.getMessage(id);
+        if (!existing || !isSameOwner(existing.agentGaii, resolve(req))) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Message not found'));
+            return;
+        }
+        if (req.auth.roles.includes('agent') && existing.agentGaii !== req.auth.sub) {
+            res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Message not found'));
+            return;
+        }
         const updated = await storage.updateMessageStatus(id, status, processedAt);
         if (!updated) {
             res.status(404).json(error(config.nodeId, 'NOT_FOUND', 'Message not found'));

package/dist/src/routes/agent-messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-messages.js","sourceRoot":"","sources":["../../../src/routes/agent-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAgB,EAAE,iBAAqC;IAC/G,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpF,mEAAmE;IACnE,SAAS,gBAAgB,CAAC,GAAoB,EAAE,SAAiB;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAe,CAAC;QACxC,OAAO,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,cAAc,CAAC,QAA8B;QAC1D,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAClG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC;YACJ,GAAG,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAClF,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8DAA8D;IAC9D,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAiB,CAAC;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,cAAc;YAAE,OAAO,IAAI,CAAC;QAChC,gCAAgC;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC,IAAK,CAAC,GAAG,KAAK,IAAI,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEnD,sBAAsB;QACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,SAAS,aAAa,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAiB,CAAC;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,GAAa,CAAC;QAE5B,2FAA2F;QAC3F,0FAA0F;QAC1F,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EACrE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,yBAAyB,EAAE,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;YAChE,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,WAAW,EAAE;YACxF,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,uBAAuB,OAAO,CAAC,QAAQ,EAAE,EAAE;YACpH,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,iBAAiB,EAAE;SAC5F,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,kGAAkG;IAClG,uGAAuG;IACvG,yGAAyG;IACzG,qCAAqC;IACrC,MAAM,kBAAkB,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,gGAAgG;QAChG,+FAA+F;QAC/F,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,GAAG,IAAI;YACP,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAgC,CAAC,EAAE;SAC/G,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAErD,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;QACnD,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAgB,EAA0B,EAAE;YAC1E,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjL,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;YAClC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAc,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAkB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAA+C,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAA+B,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7F,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,QAAQ,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI;YACJ,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEnC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,gBAAgB;QAChB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO;YAC9D,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"agent-messages.js","sourceRoot":"","sources":["../../../src/routes/agent-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAgB,EAAE,iBAAqC;IAC/G,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpF,mEAAmE;IACnE,SAAS,gBAAgB,CAAC,GAAoB,EAAE,SAAiB;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAe,CAAC;QACxC,OAAO,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,cAAc,CAAC,QAA8B;QAC1D,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QAClG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,GAAG,CAAC;YACJ,GAAG,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAClF,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8DAA8D;IAC9D,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAiB,CAAC;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,cAAc;YAAE,OAAO,IAAI,CAAC;QAChC,gCAAgC;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC,IAAK,CAAC,GAAG,KAAK,IAAI,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAEnD,sBAAsB;QACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,SAAS,aAAa,CAAC,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,4BAA4B;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAK,CAAC,KAAiB,CAAC;QAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,cAAc;YAC/B,CAAC,CAAC,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,GAAG,CAAC,IAAK,CAAC,GAAa,CAAC;QAE5B,2FAA2F;QAC3F,0FAA0F;QAC1F,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,EACrE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,yBAAyB,EAAE,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;YAChE,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,WAAW,EAAE;YACxF,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,uBAAuB,OAAO,CAAC,QAAQ,EAAE,EAAE;YACpH,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,SAAS,iBAAiB,EAAE;SAC5F,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE9D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,kGAAkG;IAClG,uGAAuG;IACvG,yGAAyG;IACzG,qCAAqC;IACrC,MAAM,kBAAkB,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,oCAAoC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrE,gGAAgG;QAChG,+FAA+F;QAC/F,+CAA+C;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,GAAG,IAAI;YACP,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAgC,CAAC,EAAE;SAC/G,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAErD,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,mDAAmD;QACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;QACnD,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAgB,EAA0B,EAAE;YAC1E,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjL,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;YAClC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAE5C,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAc,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAkB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAA+C,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAA+B,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7F,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;YAC9B,QAAQ,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI;YACJ,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAY,CAAC;QAEnC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,gBAAgB;QAChB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO;YAC9D,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC1B,CAAC,CAAC,SAAS,CAAC;QAEd,6FAA6F;QAC7F,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,6FAA6F;QAC7F,0FAA0F;QAC1F,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,IAAK,CAAC,GAAG,EAAE,CAAC;YAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/routes/agent-tasks/completion.d.ts

@@ -2,6 +2,11 @@
  * @file src/routes/agent-tasks/completion.ts
  * @description Agent-task completion + review routes (event, complete, fail, rate, triage, todos, events, deliverables). Extracted from agent-tasks.ts to satisfy max-file-lines.
  * @version-history
+ *   v1.5.0 — 2026-08-14 — /complete and /fail are now nothing but the door: the state gate, the
+ *     records and the tail all live in services/agent-task-fanout.ts, which aimeat_task_complete and
+ *     aimeat_task_fail call as well. One behaviour change reaches this side of the pair: an AGENT
+ *     completing over REST now gets the provenance stamp it has always got over MCP. A human owner
+ *     is untouched, because the stamp is decided by the writing principal rather than by the door.
  *   v1.4.0 — 2026-08-12 — /complete answers after the fan-out rather than before it. The response
  *     used to overtake the agent's own counters, so a caller reading them back saw the pre-completion
  *     numbers on Postgres and the post-completion ones on SQLite.

package/dist/src/routes/agent-tasks/completion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completion.d.ts","sourceRoot":"","sources":["../../../../src/routes/agent-tasks/completion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAA+C,MAAM,4BAA4B,CAAC;AAWvG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAChF,IAAI,CAyXN"}
+{"version":3,"file":"completion.d.ts","sourceRoot":"","sources":["../../../../src/routes/agent-tasks/completion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAA+C,MAAM,4BAA4B,CAAC;AAWvG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAChF,IAAI,CA0VN"}

package/dist/src/routes/agent-tasks/completion.js

@@ -2,6 +2,11 @@
  * @file src/routes/agent-tasks/completion.ts
  * @description Agent-task completion + review routes (event, complete, fail, rate, triage, todos, events, deliverables). Extracted from agent-tasks.ts to satisfy max-file-lines.
  * @version-history
+ *   v1.5.0 — 2026-08-14 — /complete and /fail are now nothing but the door: the state gate, the
+ *     records and the tail all live in services/agent-task-fanout.ts, which aimeat_task_complete and
+ *     aimeat_task_fail call as well. One behaviour change reaches this side of the pair: an AGENT
+ *     completing over REST now gets the provenance stamp it has always got over MCP. A human owner
+ *     is untouched, because the stamp is decided by the writing principal rather than by the door.
  *   v1.4.0 — 2026-08-12 — /complete answers after the fan-out rather than before it. The response
  *     used to overtake the agent's own counters, so a caller reading them back saw the pre-completion
  *     numbers on Postgres and the post-completion ones on SQLite.
@@ -24,7 +29,7 @@ import { success, error } from '../../middleware/envelope.js';
 import { requireAuth, requireRole } from '../../auth/middleware.js';
 import { emitChange } from '../../services/event-bus.js';
 import { logger } from '../../utils/logger.js';
-import { afterTaskCompleted, failTask } from '../../services/agent-task-fanout.js';
+import { completeTask, failTask } from '../../services/agent-task-fanout.js';
 import { recomputeAndCacheStatistics } from '../../services/agent-statistics.js';
 import { recordTaskEvent, setTodoStatus } from '../../services/agent-task-write.js';
 import { AgentTaskRateSchema, AgentTaskTriageSchema } from '../../models/agent-task-schemas.js';
@@ -66,53 +71,33 @@ export function registerTaskCompletionRoutes(router, config, storage, helpers) {
             res.status(403).json(error(config.nodeId, 'FORBIDDEN', 'Access denied'));
             return;
         }
-        // Allow completing from 'stalled' as well: if the agent comes back with
-        // a deliverable after a stall, accept it -- a late deliverable is more
-        // useful than rejecting the agent's work because the stall detector flipped
-        // the state. Active -> done and stalled -> done are both valid completion
-        // paths; failed/done/draft/queued/paused are not (those need explicit
-        // owner-driven transitions, e.g. /start, before they can complete).
-        if (task.status !== 'active' && task.status !== 'stalled') {
-            res.status(409).json(error(config.nodeId, 'INVALID_STATE', `Only active or stalled tasks can be completed (current: ${task.status})`));
+        // The whole completion is services/agent-task-fanout.ts, because it belongs to COMPLETING rather
+        // than to this door: which states may complete (active AND stalled, so an agent that came back
+        // after a stall still gets to hand its work in), the record, the provenance stamp on the message
+        // the owner reads, the 'completed' event, and the eight things a completion sets off: the
+        // workflow run advances, the open item behind it closes, the agent's counters move, the runner's
+        // live-trace key is reclaimed, the automation report is sent and its advisory outbox drained, and
+        // a public deliverable reaches the feed.
+        //
+        // The door answers AFTER all of it. Only the agent's counters are awaited inside the fan-out; the
+        // slow steps stay fire-and-forget. Answering first made those counters a race against whatever
+        // the caller does next, and the next thing is always a read: the Activity tab reloads on the
+        // change event, and an agent that just finished asks for its own /capabilities. On SQLite the
+        // counter write landed inside the same tick and the race was invisible; on Postgres every query
+        // is a round trip, the read arrived first and activityStats came back null for a task the caller
+        // had been told was done.
+        const done = await completeTask({ storage, config }, task, {
+            message: typeof req.body?.message === 'string' ? req.body.message : undefined,
+            // The memory key, under the agent's namespace, where the deliverable was published. Lets the
+            // owner UI link straight to the output, and puts a PUBLIC deliverable on the activity feed.
+            deliverableKey: typeof req.body?.deliverable_key === 'string' ? req.body.deliverable_key : undefined,
+            pipeline: 'rest.task_complete',
+        }, resolve(req));
+        if (!done.ok) {
+            res.status(done.status).json(error(config.nodeId, done.code, done.message));
             return;
         }
-        const now = new Date().toISOString();
-        const message = typeof req.body?.message === 'string' ? req.body.message : 'Task completed';
-        // Optional: the memory key (under the agent's namespace) where the agent
-        // published the deliverable. Lets the owner UI link straight to the output.
-        const rawDeliverable = req.body?.deliverable_key;
-        const deliverableKey = (typeof rawDeliverable === 'string' && rawDeliverable.trim())
-            ? rawDeliverable.trim().slice(0, 256)
-            : undefined;
-        const updated = await storage.updateAgentTask(id, {
-            status: 'done',
-            completedAt: now,
-            lastEventAt: now,
-            updatedAt: now,
-            ...(deliverableKey ? { deliverableKey } : {}),
-        });
-        await storage.appendTaskEvent({
-            id: randomUUID(),
-            taskId: id,
-            type: 'completed',
-            message,
-            timestamp: now,
-        });
-        // Everything a completion sets off is services/agent-task-fanout.ts, because it belongs to
-        // COMPLETING rather than to this door: the workflow run that dispatched the task advances, the
-        // open item behind it closes, the agent's counters move, the runner's live-trace key is
-        // reclaimed, the automation report is sent and its advisory outbox drained, and a public
-        // deliverable reaches the feed. aimeat_task_complete did none of it.
-        //
-        // The door answers AFTER it. Only the agent's counters are awaited inside; the slow steps stay
-        // fire-and-forget. Answering first made those counters a race against whatever the caller does
-        // next, and the next thing is always a read: the Activity tab reloads on the change event, and
-        // an agent that just finished asks for its own /capabilities. On SQLite the counter write landed
-        // inside the same tick and the race was invisible; on Postgres every query is a round trip, the
-        // read arrived first and activityStats came back null for a task the caller had been told was
-        // done. The MCP door has always awaited this before replying — this is the same order.
-        await afterTaskCompleted({ storage, config }, task, updated ?? null, message, deliverableKey, resolve(req));
-        res.json(success(config.nodeId, { task: updated }));
+        res.json(success(config.nodeId, { task: done.task }));
     });
     /* ── POST /v1/agents/:name/tasks/:id/fail -- Fail task (active -> failed) ── */
     router.post('/v1/agents/:name/tasks/:id/fail', requireAuth(), async (req, res) => {
@@ -126,15 +111,11 @@ export function registerTaskCompletionRoutes(router, config, storage, helpers) {
             res.status(403).json(error(config.nodeId, 'FORBIDDEN', 'Access denied'));
             return;
         }
-        // Stalled tasks can also be marked failed -- e.g. the agent realises it
-        // can't recover and explicitly reports failure rather than letting the
-        // task linger in stalled state forever.
-        if (task.status !== 'active' && task.status !== 'stalled') {
-            res.status(409).json(error(config.nodeId, 'INVALID_STATE', `Only active or stalled tasks can be failed (current: ${task.status})`));
-            return;
-        }
         const message = typeof req.body?.message === 'string' ? req.body.message : 'Task failed';
-        // services/agent-task-fanout.ts — aimeat_task_fail makes the same transition.
+        // services/agent-task-fanout.ts, which aimeat_task_fail calls for the same transition. The state
+        // gate that used to stand here as well (active or stalled, because an agent that cannot recover
+        // still gets to say so rather than leaving the task stalled forever) was a second copy of
+        // FAILABLE_STATES, the shape this whole pass exists to remove. failTask answers with the same 409.
         const failed = await failTask({ storage, config }, task, message, resolve(req));
         if (!failed.ok) {
             res.status(failed.status).json(error(config.nodeId, failed.code, failed.message));