aimeat 2.0.0 → 2.1.0

package/dist/static/sdk-libs/audio/instruments.js

@@ -0,0 +1,369 @@
+/**
+ * @file audio/instruments.js
+ * @description The 6 built-in synthesized instruments for aimeat-audio (SDK-libs migration Phase 2):
+ *   piano (2-op FM), guitar (Karplus-Strong), bass (saw + sub + lowpass), drums (per-hit noise/sine
+ *   bursts: kick/snare/hihat/…/cowbell), flute (sine + breath noise + vibrato LFO), and synth
+ *   (configurable oscillator). Importing this module populates the shared `instruments` registry from
+ *   core.js (side-effect only — no exports). Split out of the merged audio module to keep every file
+ *   under the 800-line cap.
+ * @structure side-effect: instruments.piano/guitar/bass/drums/flute/synth = { play(note, opts) }.
+ * @usage import './instruments.js';  // registers the built-ins onto the shared registry
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from lib-audio.ts + audio-lib-part2.ts (SDK-libs migration Phase 2).
+ */
+import { ctx, noteToFreq, masterNode, registerActive, instruments } from './core.js';
+
+// ── Piano: 2-operator FM synthesis ──
+instruments.piano = {
+  play: function (note, opts) {
+    var freq = noteToFreq(note);
+    if (!freq) return;
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.7;
+    var dur = (opts && opts.duration) || 2.0;
+
+    var mod = ctx().createOscillator(); mod.type = 'sine';
+    mod.frequency.value = freq * 2;
+    var modGain = ctx().createGain();
+    modGain.gain.setValueAtTime(freq * 1.5 * vel, t);
+    modGain.gain.exponentialRampToValueAtTime(freq * 0.01, t + dur * 0.8);
+    mod.connect(modGain);
+
+    var car = ctx().createOscillator(); car.type = 'sine';
+    car.frequency.value = freq;
+    modGain.connect(car.frequency);
+
+    var env = ctx().createGain();
+    env.gain.setValueAtTime(0, t);
+    env.gain.linearRampToValueAtTime(vel * 0.4, t + 0.005);
+    env.gain.exponentialRampToValueAtTime(vel * 0.15, t + 0.1);
+    env.gain.exponentialRampToValueAtTime(0.001, t + dur);
+
+    car.connect(env); env.connect(masterNode());
+    mod.start(t); car.start(t);
+    mod.stop(t + dur + 0.1); car.stop(t + dur + 0.1);
+
+    registerActive('piano', note, [mod, car], function () {
+      try { env.gain.cancelScheduledValues(ctx().currentTime);
+        env.gain.setValueAtTime(env.gain.value, ctx().currentTime);
+        env.gain.linearRampToValueAtTime(0, ctx().currentTime + 0.05);
+        mod.stop(ctx().currentTime + 0.1); car.stop(ctx().currentTime + 0.1); } catch { /* already stopped */ }
+    });
+  },
+};
+
+// ── Guitar: Karplus-Strong plucked string ──
+instruments.guitar = {
+  play: function (note, opts) {
+    var freq = noteToFreq(note);
+    if (!freq) return;
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.7;
+    var dur = (opts && opts.duration) || 1.5;
+
+    var bufSize = Math.round(ctx().sampleRate / freq);
+    var noiseBuffer = ctx().createBuffer(1, bufSize, ctx().sampleRate);
+    var data = noiseBuffer.getChannelData(0);
+    for (var i = 0; i < bufSize; i++) data[i] = (Math.random() * 2 - 1) * vel;
+
+    var noise = ctx().createBufferSource();
+    noise.buffer = noiseBuffer;
+    noise.loop = true;
+
+    var filter = ctx().createBiquadFilter();
+    filter.type = 'lowpass';
+    filter.frequency.value = freq * 4;
+    filter.Q.value = 0.5;
+
+    var env = ctx().createGain();
+    env.gain.setValueAtTime(vel * 0.5, t);
+    env.gain.exponentialRampToValueAtTime(0.001, t + dur);
+
+    noise.connect(filter); filter.connect(env); env.connect(masterNode());
+    noise.start(t); noise.stop(t + dur + 0.05);
+
+    registerActive('guitar', note, [noise], function () {
+      try { env.gain.cancelScheduledValues(ctx().currentTime);
+        env.gain.linearRampToValueAtTime(0, ctx().currentTime + 0.05);
+        noise.stop(ctx().currentTime + 0.1); } catch { /* already stopped */ }
+    });
+  },
+};
+
+// ── Bass: sawtooth + lowpass + sub-oscillator ──
+instruments.bass = {
+  play: function (note, opts) {
+    var freq = noteToFreq(note);
+    if (!freq) return;
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.7;
+    var dur = (opts && opts.duration) || 0.8;
+
+    var osc = ctx().createOscillator(); osc.type = 'sawtooth'; osc.frequency.value = freq;
+    var sub = ctx().createOscillator(); sub.type = 'sine'; sub.frequency.value = freq / 2;
+    var subGain = ctx().createGain(); subGain.gain.value = 0.5;
+    sub.connect(subGain);
+
+    var mix = ctx().createGain();
+    osc.connect(mix); subGain.connect(mix);
+
+    var filter = ctx().createBiquadFilter(); filter.type = 'lowpass';
+    filter.frequency.setValueAtTime(freq * 3, t);
+    filter.frequency.exponentialRampToValueAtTime(freq * 1.2, t + 0.15);
+    filter.Q.value = 2;
+
+    var env = ctx().createGain();
+    env.gain.setValueAtTime(0, t);
+    env.gain.linearRampToValueAtTime(vel * 0.5, t + 0.01);
+    env.gain.setValueAtTime(vel * 0.5, t + dur * 0.7);
+    env.gain.exponentialRampToValueAtTime(0.001, t + dur);
+
+    mix.connect(filter); filter.connect(env); env.connect(masterNode());
+    osc.start(t); sub.start(t);
+    osc.stop(t + dur + 0.05); sub.stop(t + dur + 0.05);
+
+    registerActive('bass', note, [osc, sub], function () {
+      try { env.gain.cancelScheduledValues(ctx().currentTime);
+        env.gain.linearRampToValueAtTime(0, ctx().currentTime + 0.05);
+        osc.stop(ctx().currentTime + 0.1); sub.stop(ctx().currentTime + 0.1); } catch { /* already stopped */ }
+    });
+  },
+};
+
+// ── Drums: noise + sine bursts (per-hit) ──
+instruments.drums = {
+  play: function (hit, opts) {
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.7;
+
+    function makeTom(freq) {
+      var osc = ctx().createOscillator(); osc.type = 'sine';
+      osc.frequency.setValueAtTime(freq, t);
+      osc.frequency.exponentialRampToValueAtTime(freq * 0.6, t + 0.15);
+      var g = ctx().createGain();
+      g.gain.setValueAtTime(vel * 0.5, t);
+      g.gain.exponentialRampToValueAtTime(0.001, t + 0.3);
+      osc.connect(g); g.connect(masterNode());
+      osc.start(t); osc.stop(t + 0.4);
+      return [osc];
+    }
+
+    var synths = {
+      'kick': function () {
+        var osc = ctx().createOscillator(); osc.type = 'sine';
+        osc.frequency.setValueAtTime(150, t);
+        osc.frequency.exponentialRampToValueAtTime(50, t + 0.1);
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 0.4);
+        osc.connect(g); g.connect(masterNode());
+        var click = ctx().createOscillator(); click.type = 'square'; click.frequency.value = 800;
+        var cg = ctx().createGain();
+        cg.gain.setValueAtTime(vel * 0.3, t);
+        cg.gain.exponentialRampToValueAtTime(0.001, t + 0.02);
+        click.connect(cg); cg.connect(masterNode());
+        osc.start(t); osc.stop(t + 0.5);
+        click.start(t); click.stop(t + 0.05);
+        return [osc, click];
+      },
+      'snare': function () {
+        var bufLen = Math.round(ctx().sampleRate * 0.15);
+        var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+        var d = buf.getChannelData(0);
+        for (var i = 0; i < bufLen; i++) d[i] = (Math.random() * 2 - 1);
+        var noise = ctx().createBufferSource(); noise.buffer = buf;
+        var nf = ctx().createBiquadFilter(); nf.type = 'highpass'; nf.frequency.value = 1000;
+        var ng = ctx().createGain();
+        ng.gain.setValueAtTime(vel * 0.6, t);
+        ng.gain.exponentialRampToValueAtTime(0.001, t + 0.15);
+        noise.connect(nf); nf.connect(ng); ng.connect(masterNode());
+        var osc = ctx().createOscillator(); osc.type = 'sine'; osc.frequency.value = 200;
+        var og = ctx().createGain();
+        og.gain.setValueAtTime(vel * 0.5, t);
+        og.gain.exponentialRampToValueAtTime(0.001, t + 0.08);
+        osc.connect(og); og.connect(masterNode());
+        noise.start(t); osc.start(t); osc.stop(t + 0.2);
+        return [noise, osc];
+      },
+      'hihat': function () {
+        var bufLen = Math.round(ctx().sampleRate * 0.05);
+        var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+        var d = buf.getChannelData(0);
+        for (var i = 0; i < bufLen; i++) d[i] = (Math.random() * 2 - 1);
+        var noise = ctx().createBufferSource(); noise.buffer = buf;
+        var f = ctx().createBiquadFilter(); f.type = 'highpass'; f.frequency.value = 7000;
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel * 0.3, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 0.05);
+        noise.connect(f); f.connect(g); g.connect(masterNode());
+        noise.start(t);
+        return [noise];
+      },
+      'hihat-open': function () {
+        var bufLen = Math.round(ctx().sampleRate * 0.3);
+        var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+        var d = buf.getChannelData(0);
+        for (var i = 0; i < bufLen; i++) d[i] = (Math.random() * 2 - 1);
+        var noise = ctx().createBufferSource(); noise.buffer = buf;
+        var f = ctx().createBiquadFilter(); f.type = 'highpass'; f.frequency.value = 6000;
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel * 0.3, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 0.3);
+        noise.connect(f); f.connect(g); g.connect(masterNode());
+        noise.start(t);
+        return [noise];
+      },
+      'crash': function () {
+        var bufLen = Math.round(ctx().sampleRate * 1.0);
+        var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+        var d = buf.getChannelData(0);
+        for (var i = 0; i < bufLen; i++) d[i] = (Math.random() * 2 - 1);
+        var noise = ctx().createBufferSource(); noise.buffer = buf;
+        var f = ctx().createBiquadFilter(); f.type = 'highpass'; f.frequency.value = 4000;
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel * 0.5, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 1.0);
+        noise.connect(f); f.connect(g); g.connect(masterNode());
+        noise.start(t);
+        return [noise];
+      },
+      'ride': function () {
+        var bufLen = Math.round(ctx().sampleRate * 0.8);
+        var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+        var d = buf.getChannelData(0);
+        for (var i = 0; i < bufLen; i++) d[i] = (Math.random() * 2 - 1);
+        var noise = ctx().createBufferSource(); noise.buffer = buf;
+        var f = ctx().createBiquadFilter(); f.type = 'bandpass'; f.frequency.value = 8000; f.Q.value = 1;
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel * 0.3, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 0.8);
+        noise.connect(f); f.connect(g); g.connect(masterNode());
+        noise.start(t);
+        return [noise];
+      },
+      'tom-high': function () { return makeTom(300); },
+      'tom-mid': function () { return makeTom(220); },
+      'tom-low': function () { return makeTom(150); },
+      'clap': function () {
+        var nodes = [];
+        for (var ci = 0; ci < 3; ci++) {
+          var delay = ci * 0.01;
+          var bufLen = Math.round(ctx().sampleRate * 0.02);
+          var buf = ctx().createBuffer(1, bufLen, ctx().sampleRate);
+          var d = buf.getChannelData(0);
+          for (var j = 0; j < bufLen; j++) d[j] = (Math.random() * 2 - 1);
+          var noise = ctx().createBufferSource(); noise.buffer = buf;
+          var f = ctx().createBiquadFilter(); f.type = 'bandpass'; f.frequency.value = 2500; f.Q.value = 3;
+          var g = ctx().createGain();
+          g.gain.setValueAtTime(vel * 0.4, t + delay);
+          g.gain.exponentialRampToValueAtTime(0.001, t + delay + 0.08);
+          noise.connect(f); f.connect(g); g.connect(masterNode());
+          noise.start(t + delay);
+          nodes.push(noise);
+        }
+        return nodes;
+      },
+      'cowbell': function () {
+        var osc1 = ctx().createOscillator(); osc1.type = 'square'; osc1.frequency.value = 587;
+        var osc2 = ctx().createOscillator(); osc2.type = 'square'; osc2.frequency.value = 845;
+        var g = ctx().createGain();
+        g.gain.setValueAtTime(vel * 0.3, t);
+        g.gain.exponentialRampToValueAtTime(0.001, t + 0.4);
+        var f = ctx().createBiquadFilter(); f.type = 'bandpass'; f.frequency.value = 700; f.Q.value = 3;
+        osc1.connect(g); osc2.connect(g); g.connect(f); f.connect(masterNode());
+        osc1.start(t); osc2.start(t);
+        osc1.stop(t + 0.5); osc2.stop(t + 0.5);
+        return [osc1, osc2];
+      },
+    };
+
+    var fn = synths[hit];
+    if (!fn) { console.warn('[aimeat-audio] Unknown drum hit:', hit); return; }
+    var nodes = fn();
+    registerActive('drums', hit, nodes, function () {
+      nodes.forEach(function (n) { try { n.stop(ctx().currentTime + 0.01); } catch { /* already stopped */ } });
+    });
+  },
+};
+
+// ── Flute: sine + breath noise + vibrato LFO ──
+instruments.flute = {
+  play: function (note, opts) {
+    var freq = noteToFreq(note);
+    if (!freq) return;
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.6;
+    var dur = (opts && opts.duration) || 1.5;
+    var vibDepth = (opts && opts.vibrato !== undefined) ? opts.vibrato : 0.15;
+
+    var osc = ctx().createOscillator(); osc.type = 'sine'; osc.frequency.value = freq;
+
+    var lfo = ctx().createOscillator(); lfo.type = 'sine'; lfo.frequency.value = 5.5;
+    var lfoGain = ctx().createGain(); lfoGain.gain.value = freq * vibDepth * 0.02;
+    lfo.connect(lfoGain); lfoGain.connect(osc.frequency);
+
+    var noiseBufLen = Math.round(ctx().sampleRate * dur);
+    var noiseBuf = ctx().createBuffer(1, noiseBufLen, ctx().sampleRate);
+    var nd = noiseBuf.getChannelData(0);
+    for (var i = 0; i < noiseBufLen; i++) nd[i] = (Math.random() * 2 - 1);
+    var noiseNode = ctx().createBufferSource(); noiseNode.buffer = noiseBuf;
+    var noiseFilt = ctx().createBiquadFilter(); noiseFilt.type = 'bandpass';
+    noiseFilt.frequency.value = freq; noiseFilt.Q.value = 2;
+    var noiseGain = ctx().createGain(); noiseGain.gain.value = vel * 0.06;
+    noiseNode.connect(noiseFilt); noiseFilt.connect(noiseGain);
+
+    var env = ctx().createGain();
+    env.gain.setValueAtTime(0, t);
+    env.gain.linearRampToValueAtTime(vel * 0.3, t + 0.08);
+    env.gain.setValueAtTime(vel * 0.3, t + dur - 0.1);
+    env.gain.linearRampToValueAtTime(0, t + dur);
+
+    osc.connect(env); noiseGain.connect(env); env.connect(masterNode());
+    lfo.start(t); osc.start(t); noiseNode.start(t);
+    lfo.stop(t + dur + 0.1); osc.stop(t + dur + 0.1);
+
+    registerActive('flute', note, [osc, lfo, noiseNode], function () {
+      try { env.gain.cancelScheduledValues(ctx().currentTime);
+        env.gain.linearRampToValueAtTime(0, ctx().currentTime + 0.05);
+        osc.stop(ctx().currentTime + 0.1); lfo.stop(ctx().currentTime + 0.1); } catch { /* already stopped */ }
+    });
+  },
+};
+
+// ── Synth: configurable oscillator ──
+instruments.synth = {
+  play: function (note, opts) {
+    var freq = noteToFreq(note);
+    if (!freq) return;
+    var t = ctx().currentTime;
+    var vel = (opts && opts.velocity !== undefined) ? opts.velocity : 0.7;
+    var dur = (opts && opts.duration) || 1.0;
+    var wave = (opts && opts.wave) || 'sawtooth';
+    var filterFreq = (opts && opts.filter) || 2000;
+
+    var osc = ctx().createOscillator(); osc.type = wave; osc.frequency.value = freq;
+    var osc2 = ctx().createOscillator(); osc2.type = wave; osc2.frequency.value = freq; osc2.detune.value = 7;
+    var osc2Gain = ctx().createGain(); osc2Gain.gain.value = 0.5;
+    osc2.connect(osc2Gain);
+
+    var filter = ctx().createBiquadFilter(); filter.type = 'lowpass';
+    filter.frequency.value = filterFreq; filter.Q.value = 1;
+
+    var env = ctx().createGain();
+    env.gain.setValueAtTime(0, t);
+    env.gain.linearRampToValueAtTime(vel * 0.3, t + 0.02);
+    env.gain.setValueAtTime(vel * 0.3, t + dur * 0.7);
+    env.gain.exponentialRampToValueAtTime(0.001, t + dur);
+
+    osc.connect(filter); osc2Gain.connect(filter);
+    filter.connect(env); env.connect(masterNode());
+    osc.start(t); osc2.start(t);
+    osc.stop(t + dur + 0.05); osc2.stop(t + dur + 0.05);
+
+    registerActive('synth', note, [osc, osc2], function () {
+      try { env.gain.cancelScheduledValues(ctx().currentTime);
+        env.gain.linearRampToValueAtTime(0, ctx().currentTime + 0.05);
+        osc.stop(ctx().currentTime + 0.1); osc2.stop(ctx().currentTime + 0.1); } catch { /* already stopped */ }
+    });
+  },
+};

package/dist/static/sdk-libs/auth/config.js

@@ -0,0 +1,46 @@
+/**
+ * @file auth/config.js
+ * @description aimeat-auth config (SDK-libs migration Phase 3). NODE_URL / APEX_URL / NODE_ID come
+ *   from the shared _core/config (the same `<meta> → location.origin → prelude` resolution the whole
+ *   SDK uses). The app-scope defaults + declaration reader, and the OIDC provider list + button
+ *   glyphs, live here. AUTH_PROVIDERS is server-computed (`listEnabledProviderMeta`) and injected by
+ *   the auth route as an EXTRA prelude line — `window.__AIMEAT_AUTH_CFG__.providers` — since the
+ *   generic config prelude only carries nodeId/baseUrl. Extracted from auth-lib-part1.ts.
+ * @structure re-exports NODE_URL/APEX_URL/NODE_ID · APP_DEFAULT_SCOPES · appDeclaredScopes() ·
+ *   AUTH_PROVIDERS · PROVIDER_ICONS.
+ * @usage import { NODE_URL, APEX_URL, AUTH_PROVIDERS, appDeclaredScopes } from './config.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part1.ts (SDK-libs migration Phase 3).
+ */
+export { NODE_URL, APEX_URL, NODE_ID } from '../_core/config.js';
+
+// Default scopes an app asks for in the H-2 silent SSO / grant flow when it does not declare its own.
+// The common, foundational set: read/write the user's memory AND their stored files. (storage is a
+// SEPARATE scope domain from memory — saving an image goes to /v1/storage, not /v1/memory.)
+export const APP_DEFAULT_SCOPES = 'memory:read memory:write storage:read storage:write';
+
+// An app declares the scopes it needs with <meta name="aimeat-scopes" content="scope scope …">.
+// Only declared apps deviate from the default set — e.g. an AI app adds "ai:use" so its grant
+// can spend the owner's AI budget. Falls back to APP_DEFAULT_SCOPES when undeclared, so existing
+// apps are unaffected. The authorize endpoint still validates every scope against the node's
+// grantable vocabulary, so a bogus meta value can only ever request LESS than the node allows.
+export function appDeclaredScopes() {
+  try {
+    var m = document.querySelector('meta[name="aimeat-scopes"]');
+    var c = m && m.getAttribute('content');
+    if (c && c.trim()) return c.trim().replace(/\s+/g, ' ');
+  } catch { /* no document / detached */ }
+  return APP_DEFAULT_SCOPES;
+}
+
+// Social login providers enabled on this node (server-computed from node config, injected by the
+// auth route as an extra prelude line): each is { id, label, i18nKey } — the sign-in modal renders
+// one button per entry.
+export const AUTH_PROVIDERS = (window.__AIMEAT_AUTH_CFG__ && window.__AIMEAT_AUTH_CFG__.providers) || [];
+
+// Per-provider button glyphs (inline SVG — no external fetch).
+export const PROVIDER_ICONS = {
+  google: '<svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path fill="#4285F4" d="M17.64 9.2c0-.64-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92c1.7-1.57 2.68-3.88 2.68-6.62z"/><path fill="#34A853" d="M9 18c2.43 0 4.47-.8 5.96-2.18l-2.92-2.26c-.8.54-1.84.86-3.04.86-2.34 0-4.32-1.58-5.03-3.7H.96v2.33A9 9 0 0 0 9 18z"/><path fill="#FBBC05" d="M3.97 10.72a5.4 5.4 0 0 1 0-3.44V4.95H.96a9 9 0 0 0 0 8.1l3.01-2.33z"/><path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.44 1.35l2.58-2.58A9 9 0 0 0 .96 4.95l3.01 2.33C4.68 5.16 6.66 3.58 9 3.58z"/></svg>',
+  entra: '<svg width="18" height="18" viewBox="0 0 21 21" aria-hidden="true"><rect x="1" y="1" width="9" height="9" fill="#F25022"/><rect x="11" y="1" width="9" height="9" fill="#7FBA00"/><rect x="1" y="11" width="9" height="9" fill="#00A4EF"/><rect x="11" y="11" width="9" height="9" fill="#FFB900"/></svg>',
+  casdoor: '<svg width="18" height="18" viewBox="0 0 24 24" aria-hidden="true"><rect x="4" y="3" width="16" height="18" rx="2" fill="#4757F6"/><circle cx="14" cy="11" r="1.6" fill="#fff"/><rect x="13.2" y="11.5" width="1.6" height="4" fill="#fff"/></svg>',
+};

package/dist/static/sdk-libs/auth/crypto.js

@@ -0,0 +1,166 @@
+/**
+ * @file auth/crypto.js
+ * @description aimeat-auth crypto + storage core (SDK-libs migration Phase 3). Self-contained, no
+ *   shared auth state: Ed25519 via Web Crypto (generate/import-as-non-extractable/sign), the
+ *   IndexedDB non-extractable CryptoKey store (open/store/load/delete + one-time localStorage→IDB
+ *   migration), the localStorage metadata helpers (save/load/remove — NEVER private keys), and JWT
+ *   helpers (parseJwt/isExpired). Extracted verbatim from auth-lib-part1.ts.
+ * @structure generateKeyPair/importEd25519Key/isCryptoKey/sign · openKeyDB/storeKey/loadKey/deleteKey/
+ *   migrateKeysToIndexedDB · save/load/remove · parseJwt/isExpired.
+ * @usage import { sign, parseJwt, save, load } from './crypto.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part1.ts (SDK-libs migration Phase 3).
+ */
+
+// ── Ed25519 via Web Crypto ──
+
+export async function generateKeyPair() {
+  const key = /** @type {CryptoKeyPair} */ (await crypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']));
+  const privRaw = await crypto.subtle.exportKey('pkcs8', key.privateKey);
+  const pubRaw = await crypto.subtle.exportKey('spki', key.publicKey);
+  // Extract raw 32-byte keys from DER wrappers
+  const privBytes = new Uint8Array(privRaw).slice(-32);
+  const pubBytes = new Uint8Array(pubRaw).slice(-32);
+  return {
+    privateKey: btoa(String.fromCharCode(...privBytes)),
+    publicKey: btoa(String.fromCharCode(...pubBytes)),
+    cryptoKey: key,
+  };
+}
+
+// SECURITY: Import raw Ed25519 private key as non-extractable CryptoKey
+export async function importEd25519Key(privateKeyBase64) {
+  const privBytes = Uint8Array.from(atob(privateKeyBase64), c => c.charCodeAt(0));
+  // Build PKCS8 DER wrapper for Ed25519
+  const pkcs8Prefix = new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+  const pkcs8 = new Uint8Array(pkcs8Prefix.length + privBytes.length);
+  pkcs8.set(pkcs8Prefix);
+  pkcs8.set(privBytes, pkcs8Prefix.length);
+  const cryptoKey = await crypto.subtle.importKey('pkcs8', pkcs8, 'Ed25519', false /* non-extractable */, ['sign']);
+  // Zero raw key bytes
+  privBytes.fill(0);
+  pkcs8.fill(0);
+  return cryptoKey;
+}
+
+export function isCryptoKey(value) {
+  if (!value || typeof value !== 'object') return false;
+  if (typeof CryptoKey !== 'undefined' && value instanceof CryptoKey) return true;
+  return Object.prototype.toString.call(value) === '[object CryptoKey]';
+}
+
+// Sign using CryptoKey (preferred) or base64 key string (fallback)
+export async function sign(keyOrB64, message) {
+  let key = keyOrB64;
+  if (typeof keyOrB64 === 'string') {
+    // Legacy path: raw base64 key → import as CryptoKey
+    key = await importEd25519Key(keyOrB64);
+  }
+  if (!isCryptoKey(key)) {
+    throw new Error('AIMEAT signing key is missing or invalid. Please sign in again.');
+  }
+  const msgBytes = new TextEncoder().encode(message);
+  const sigBytes = await crypto.subtle.sign('Ed25519', key, msgBytes);
+  return btoa(String.fromCharCode(...new Uint8Array(sigBytes)));
+}
+
+// ── IndexedDB Key Store (SECURITY: non-extractable CryptoKeys) ──
+
+const KEY_DB_NAME = 'aimeat_keys';
+const KEY_STORE_NAME = 'cryptokeys';
+
+function openKeyDB() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(KEY_DB_NAME, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(KEY_STORE_NAME);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+
+export async function storeKey(name, cryptoKey) {
+  const db = /** @type {IDBDatabase} */ (await openKeyDB());
+  return new Promise((resolve, reject) => {
+    const tx = db.transaction(KEY_STORE_NAME, 'readwrite');
+    tx.objectStore(KEY_STORE_NAME).put(cryptoKey, name);
+    tx.oncomplete = () => { db.close(); resolve(undefined); };
+    tx.onerror = () => { db.close(); reject(tx.error); };
+  });
+}
+
+export async function loadKey(name) {
+  const db = /** @type {IDBDatabase} */ (await openKeyDB());
+  return new Promise((resolve) => {
+    const tx = db.transaction(KEY_STORE_NAME, 'readonly');
+    const req = tx.objectStore(KEY_STORE_NAME).get(name);
+    req.onsuccess = () => { db.close(); resolve(req.result || null); };
+    req.onerror = () => { db.close(); resolve(null); };
+  });
+}
+
+export async function deleteKey(name) {
+  try {
+    const db = /** @type {IDBDatabase} */ (await openKeyDB());
+    return new Promise((resolve) => {
+      const tx = db.transaction(KEY_STORE_NAME, 'readwrite');
+      tx.objectStore(KEY_STORE_NAME).delete(name);
+      tx.oncomplete = () => { db.close(); resolve(undefined); };
+      tx.onerror = () => { db.close(); resolve(undefined); };
+    });
+  } catch { /* IndexedDB may not be available */ }
+}
+
+// Migrate legacy localStorage keys to IndexedDB (one-time)
+export async function migrateKeysToIndexedDB() {
+  try {
+    const session = load('session');
+    if (session && session.privateKey) {
+      const cryptoKey = await importEd25519Key(session.privateKey);
+      await storeKey('agent_key', cryptoKey);
+      // Remove private key from localStorage, keep metadata
+      delete session.privateKey;
+      save('session', session);
+    }
+    const ownerKey = load('owner_key');
+    if (typeof ownerKey === 'string' && ownerKey.length > 0) {
+      const cryptoKey = await importEd25519Key(ownerKey);
+      await storeKey('owner_key', cryptoKey);
+      remove('owner_key');
+    }
+  } catch (e) {
+    console.warn('AIMEAT: Key migration to IndexedDB failed, falling back to localStorage', e);
+  }
+}
+
+// ── Storage helpers (metadata only — NO private keys) ──
+
+const STORAGE_PREFIX = 'aimeat_';
+
+export function save(key, value) {
+  try { localStorage.setItem(STORAGE_PREFIX + key, JSON.stringify(value)); } catch { /* storage blocked */ }
+}
+
+export function load(key) {
+  try { const v = localStorage.getItem(STORAGE_PREFIX + key); return v ? JSON.parse(v) : null; } catch { return null; }
+}
+
+export function remove(key) {
+  try { localStorage.removeItem(STORAGE_PREFIX + key); } catch { /* storage blocked */ }
+}
+
+// ── JWT helpers ──
+
+export function parseJwt(token) {
+  try {
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    return payload;
+  } catch { return null; }
+}
+
+export function isExpired(jwt) {
+  const payload = parseJwt(jwt);
+  if (!payload || !payload.exp) return true;
+  return Date.now() / 1000 > payload.exp - 60; // 60s grace
+}

package/dist/static/sdk-libs/auth/events.js

@@ -0,0 +1,27 @@
+/**
+ * @file auth/events.js
+ * @description aimeat-auth event bus (SDK-libs migration Phase 3). The shared listener registry +
+ *   emit/on/off that the session layer, pill, modal and boot all use to broadcast
+ *   'login'/'logout'/'refreshed'/'expired'/'session-updated'/'scopes-stale'/'popup-blocked' events.
+ *   `listeners` is only ever mutated in place (never reassigned), so importing it across modules is
+ *   safe. Extracted from auth-lib-part2.ts.
+ * @structure listeners · emit(event, data) · on(event, fn) · off(event, fn).
+ * @usage import { emit, on, off } from './events.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part2.ts (SDK-libs migration Phase 3).
+ */
+
+/** @type {Record<string, Array<(data: any) => void>>} */
+export const listeners = {};
+
+export function emit(event, data) { (listeners[event] || []).forEach(fn => fn(data)); }
+
+export function on(event, fn) {
+  if (!listeners[event]) listeners[event] = [];
+  listeners[event].push(fn);
+}
+
+export function off(event, fn) {
+  if (!listeners[event]) return;
+  listeners[event] = listeners[event].filter(f => f !== fn);
+}

package/dist/static/sdk-libs/auth/i18n.js

@@ -0,0 +1,64 @@
+/**
+ * @file auth/i18n.js
+ * @description aimeat-auth sign-in-modal language helpers (SDK-libs migration Phase 3). The modal can
+ *   be shown standalone (e.g. a custom portal page) where the canonical header + its language switcher
+ *   is absent, so it owns its own EN/FI switch and loads translations itself, using the same
+ *   'aimeat-lang' localStorage key + cookie the header uses so the choice stays in sync with the SPA.
+ *   loadModalI18n fetches en.json (base) + <lang>.json (overrides) from the node and returns just the
+ *   modal.* strings with the 'modal.' prefix stripped. Extracted from auth-lib-part2.ts.
+ * @structure MODAL_LANG_KEY · currentModalLang() · flattenModalI18n() · loadModalI18n(lang).
+ * @usage import { currentModalLang, loadModalI18n } from './i18n.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part2.ts (SDK-libs migration Phase 3).
+ */
+import { NODE_URL } from './config.js';
+
+export var MODAL_LANG_KEY = 'aimeat-lang';
+
+export function currentModalLang() {
+  try {
+    var u = new URLSearchParams(location.search).get('lang');
+    if (u === 'en' || u === 'fi') return u;
+    var s = localStorage.getItem(MODAL_LANG_KEY);
+    if (s === 'en' || s === 'fi') return s;
+  } catch { /* storage blocked */ }
+  return (navigator.language || 'en').slice(0, 2).toLowerCase() === 'fi' ? 'fi' : 'en';
+}
+
+export function flattenModalI18n(obj, prefix, out) {
+  out = out || {}; prefix = prefix || '';
+  for (var k in obj) {
+    if (!Object.prototype.hasOwnProperty.call(obj, k)) continue;
+    var key = prefix ? prefix + '.' + k : k;
+    var v = obj[k];
+    if (v && typeof v === 'object' && !Array.isArray(v)) flattenModalI18n(v, key, out);
+    else out[key] = v;
+  }
+  return out;
+}
+
+// Fetch en.json (base) + <lang>.json (overrides) from the node and return just the modal.* strings
+// with the 'modal.' prefix stripped — the shape the modal (and every mountLoginButton caller) expects
+// for opts.i18n.
+export async function loadModalI18n(lang) {
+  var v = Date.now();
+  var t = {};
+  try {
+    var enRes = await fetch(NODE_URL + '/locales/en.json?v=' + v);
+    if (enRes.ok) t = flattenModalI18n(await enRes.json());
+  } catch { /* offline / missing locales — fall through to fallbacks */ }
+  if (lang !== 'en') {
+    try {
+      var locRes = await fetch(NODE_URL + '/locales/' + lang + '.json?v=' + v);
+      if (locRes.ok) {
+        var loc = flattenModalI18n(await locRes.json());
+        for (var lk in loc) if (Object.prototype.hasOwnProperty.call(loc, lk)) t[lk] = loc[lk];
+      }
+    } catch { /* locale missing — English fallback stands */ }
+  }
+  var out = {};
+  for (var k in t) {
+    if (Object.prototype.hasOwnProperty.call(t, k) && k.indexOf('modal.') === 0) out[k.slice(6)] = t[k];
+  }
+  return out;
+}