aimeat 2.0.0 → 2.1.0

package/dist/static/sdk-libs/organism/index.js

@@ -0,0 +1,381 @@
+/**
+ * @file organism/index.js
+ * @description The aimeat-organism library (SDK-libs migration Phase 1). Organism/workspace content
+ *   client for standalone published apps: wraps the workspace read contract (objects[] published +
+ *   drafts[] as a separate map, merged by value.id with _meta handling) that apps otherwise
+ *   re-derive and get wrong, plus organism/workspace CRUD, draft/publish/revert/delete (incl. the
+ *   bulk publishRecords/deleteRecords bridge), readme, search, and a util namespace. Over the
+ *   AIMEAT.auth session. Componentized ESM source esbuild bundles to the IIFE served, unchanged, at
+ *   /v1/libs/aimeat-organism.js. Ported verbatim from lib-organism.ts; getSession/authFetch stay
+ *   inline (authFetch keeps the defensive Response.json() reparse branch _core/session lacks).
+ * @structure imports attach (namespace); field/normalize helpers; the `organism` object + util;
+ *   attach('organism', …).
+ * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-organism.js"></script>
+ *   const ws = await AIMEAT.organism.read(orgId, wsId); ws.spaces[0].items[0].value
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-organism.ts (SDK-libs migration Phase 1).
+ */
+import { attach } from '../_core/namespace.js';
+
+function getSession() {
+  if (!window.AIMEAT || !window.AIMEAT.auth) {
+    throw new Error('AIMEAT.auth is required. Include aimeat-auth.js before aimeat-organism.js');
+  }
+  var s = window.AIMEAT.auth.getSession();
+  if (!s) throw new Error('Not logged in. Call AIMEAT.auth.login() first.');
+  return s;
+}
+async function authFetch(path, opts) {
+  var res = await getSession().fetch(path, opts);
+  if (res && typeof res.json === 'function') res = await res.json();
+  return res;
+}
+function fail(res, fallback) {
+  var e = /** @type {Error & { code?: string, envelope?: unknown }} */ (new Error((res && res.error && (res.error.message || res.error.code)) || fallback));
+  e.code = res && res.error && res.error.code;
+  e.envelope = res;
+  return e;
+}
+
+// ── field conventions (mirror the SPA + AIMEAT Pages) ──
+var TITLE_FIELDS = ['title', 'name', 'subject', 'label'];
+var BODY_FIELDS = ['content', 'body', 'markdown', 'text', 'md', 'description', 'summary'];
+
+function pickField(obj, names) {
+  if (!obj || typeof obj !== 'object') return null;
+  for (var i = 0; i < names.length; i++) if (typeof obj[names[i]] === 'string') return names[i];
+  return null;
+}
+function isMetaField(k) { return typeof k === 'string' && k.charAt(0) === '_'; }
+// Read metadata (_createdAt/_updatedAt/_version) is merged into values by the workspace read;
+// it must never be written back, so every write path strips it.
+function stripMeta(v) {
+  if (!v || typeof v !== 'object' || Array.isArray(v)) return v;
+  var out = {};
+  Object.keys(v).forEach(function (k) { if (!isMetaField(k)) out[k] = v[k]; });
+  return out;
+}
+function slugify(s) {
+  return String(s || 'untitled').toLowerCase().normalize('NFKD').replace(/[̀-ͯ]/g, '')
+    .replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'untitled';
+}
+function titleOf(value, fallbackId) {
+  var v = value || {};
+  var f = pickField(v, TITLE_FIELDS);
+  if (f && v[f]) return v[f];
+  if (typeof v.id === 'string' && v.id) return v.id;
+  var bf = pickField(v, BODY_FIELDS);
+  if (bf && typeof v[bf] === 'string' && v[bf]) return String(v[bf]).replace(/\s+/g, ' ').slice(0, 48);
+  return fallbackId || 'Untitled';
+}
+function bodyFieldOf(value) { return pickField(value, BODY_FIELDS); }
+function isDocLike(value) {
+  var bf = bodyFieldOf(value);
+  if (!bf || !value || typeof value[bf] !== 'string') return false;
+  return bf === 'markdown' || bf === 'content' || value[bf].length > 120 || /\n/.test(value[bf]);
+}
+function valueUpdatedAt(v) {
+  if (v && typeof v === 'object' && (v._updatedAt || v._createdAt)) {
+    var t = new Date(v._updatedAt || v._createdAt).getTime();
+    return isNaN(t) ? 0 : t;
+  }
+  return 0;
+}
+
+// ── key layout: one workspace lives under organism.{orgId}.w.{wsId} ──
+function wsRoot(orgId, wsId) {
+  return 'organism.' + orgId + (wsId ? '.w.' + wsId : '');
+}
+function draftKey(orgId, wsId, namespace, id) {
+  return wsRoot(orgId, wsId) + '.' + namespace + '.' + id + '.draft';
+}
+
+// ── workspace read normalization ──
+// data.objects[type] = published values, data.drafts[type] = draft values (separate map!).
+// Both are bare values; the instance id lives in value.id. Items without one get a synthetic
+// id and hasRealId:false — they cannot be saved or published (the real key id is unknown).
+function normalizeWorkspace(data) {
+  var manifest = (data && data.manifest) || null;
+  var otList = (manifest && (manifest.objectTypes || manifest.object_types || manifest.types)) || [];
+  if (!Array.isArray(otList) && otList && typeof otList === 'object') {
+    otList = Object.keys(otList).map(function (k) {
+      var o = otList[k]; o = (o && typeof o === 'object') ? o : {};
+      if (!o.name) o.name = k;
+      return o;
+    });
+  }
+  var byName = {};
+  otList.forEach(function (ot) { var n = ot.name || ot.id || ot.type; if (n) byName[n] = ot; });
+
+  var objects = (data && data.objects) || {};
+  var draftsMap = (data && data.drafts) || {};
+  var typeNames = [];
+  otList.forEach(function (ot) { var n = ot.name || ot.id || ot.type; if (n && typeNames.indexOf(n) < 0) typeNames.push(n); });
+  Object.keys(objects).forEach(function (n) { if (typeNames.indexOf(n) < 0) typeNames.push(n); });
+  Object.keys(draftsMap).forEach(function (n) { if (typeNames.indexOf(n) < 0) typeNames.push(n); });
+
+  return typeNames.map(function (typeName) {
+    var ot = byName[typeName] || {};
+    var instances = {};
+    var order = [];
+    var seq = 0;
+    function instIdOf(v) {
+      if (v && typeof v === 'object' && typeof v.id === 'string' && v.id) return { id: v.id, real: true };
+      if (v && typeof v === 'object') {
+        var tf = pickField(v, TITLE_FIELDS);
+        if (tf && v[tf]) return { id: 't-' + slugify(v[tf]), real: false };
+      }
+      return { id: 'item-' + (seq++), real: false };
+    }
+    function add(v, slot) {
+      if (v == null) return;
+      var m = instIdOf(v);
+      if (!instances[m.id]) { instances[m.id] = { id: m.id, hasRealId: m.real, draft: null, latest: null }; order.push(m.id); }
+      if (slot === 'draft') instances[m.id].draft = v; else instances[m.id].latest = instances[m.id].latest || v;
+    }
+    var pub = objects[typeName] || []; if (!Array.isArray(pub)) pub = [pub];
+    pub.forEach(function (v) { add(v, 'latest'); });
+    var dr = draftsMap[typeName] || []; if (!Array.isArray(dr)) dr = [dr];
+    dr.forEach(function (v) { add(v, 'draft'); });
+
+    var items = order.map(function (id) {
+      var inst = instances[id];
+      var best = inst.draft || inst.latest;
+      inst.value = best;
+      inst.title = titleOf(best, id);
+      inst.updatedAt = Math.max(valueUpdatedAt(inst.draft), valueUpdatedAt(inst.latest));
+      inst.status = inst.draft && inst.latest ? 'draft+published' : (inst.draft ? 'draft' : 'published');
+      return inst;
+    });
+    return {
+      name: typeName,
+      namespace: ot.namespace || ot.ns || typeName,
+      kind: ot.kind || ot.type || null,
+      schemaRef: ot.schemaRef || null,
+      writeRole: ot.writeRole || null,
+      items: items,
+    };
+  });
+}
+function readmeText(readme) {
+  if (readme == null) return '';
+  if (typeof readme === 'string') return readme;
+  if (typeof readme === 'object') return readme.content || readme.text || readme.markdown || JSON.stringify(readme, null, 2);
+  return String(readme);
+}
+
+var organism = {
+  // List organisms the signed-in owner is a member of.
+  async list() {
+    var s = getSession();
+    var owner = s.owner || (s.user && s.user.owner) || '';
+    var res;
+    try { res = await authFetch('/v1/organisms?member=' + encodeURIComponent(owner) + '&per_page=100'); }
+    catch { res = null; }
+    if (!res || res.ok === false) res = await authFetch('/v1/organisms');
+    if (res.ok === false) throw fail(res, 'Failed to list organisms');
+    var d = res.data !== undefined ? res.data : res;
+    return (d && (d.organisms || d.items)) || (Array.isArray(d) ? d : []);
+  },
+
+  async get(orgId) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId));
+    if (res.ok === false) throw fail(res, 'Failed to load organism');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // Create a NEW organism (the signed-in owner becomes creator/member). Needs the organism:write app
+  // scope (declare it in <meta name="aimeat-scopes">). Returns { id, name, ... }. Use this + createWorkspace
+  // to let a multi-tenant app provision its own data space for each user on first use.
+  async create(name, opts) {
+    opts = opts || {};
+    var res = await authFetch('/v1/organisms', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: name, type: opts.type || 'project', visibility: opts.visibility || 'private',
+        join_policy: opts.join_policy || 'invite_only', description: opts.description }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to create organism');
+    // The route envelope is { organism: record } — unwrap so this returns { id, name, ... }
+    // as documented (found by the PIPELINE flagship app: createWorkspace got orgId=undefined).
+    var d = res.data !== undefined ? res.data : res;
+    return (d && d.organism) ? d.organism : d;
+  },
+
+  // Create a NEW schema-locked workspace inside an organism from a manifest + per-namespace JSON schemas.
+  // manifest = { manifestVersion:'1', name, kind, objectTypes:[{ name, namespace, mode:'records',
+  // backing:'memory', writeRole:'member', schemaRef? }] }; schemas = { '<namespace>': <JSON Schema> }.
+  // Needs organism:write. Returns { ws, types, schemas_locked }.
+  async createWorkspace(orgId, name, manifest, schemas, readme) {
+    // The manifest meta-schema REQUIRES a schemaRef on every objectType, but this signature has
+    // always documented schemaRef as optional. Honour the documented contract: fill a schemaRef
+    // for any objectType missing one, and register a permissive schema for its namespace when the
+    // caller supplied none — so a records space provisions even without hand-authored schemas.
+    // (Both the PIPELINE flagship and the AEB A/B builders hit the required-schemaRef server rule.)
+    var m = manifest && typeof manifest === 'object' ? JSON.parse(JSON.stringify(manifest)) : manifest;
+    var sc = schemas && typeof schemas === 'object' ? Object.assign({}, schemas) : {};
+    if (m && Array.isArray(m.objectTypes)) {
+      for (var oi = 0; oi < m.objectTypes.length; oi++) {
+        var ot = m.objectTypes[oi];
+        if (ot && !ot.schemaRef) {
+          var slug = String(ot.name || ('type' + oi)).replace(/[^a-zA-Z0-9_-]/g, '-');
+          ot.schemaRef = 'schema:' + name + '-' + slug + '@1';
+        }
+        if (ot && ot.namespace && sc[ot.namespace] === undefined && (ot.mode || 'records') === 'records') {
+          sc[ot.namespace] = { type: 'object', additionalProperties: true };
+        }
+      }
+    }
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspaces', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: name, manifest: m, schemas: sc, readme: readme }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to create workspace');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // List workspaces (access + enrichment counts included).
+  async workspaces(orgId) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspaces?include=enrichment');
+    if (res.ok === false) throw fail(res, 'Failed to list workspaces');
+    var d = res.data !== undefined ? res.data : res;
+    return (d && (d.workspaces || d.items)) || (Array.isArray(d) ? d : []);
+  },
+
+  // Read one workspace, normalized: { manifest, readme, readmeText, spaces, raw }.
+  // spaces[].items[]: { id, hasRealId, draft, latest, value, title, updatedAt, status }.
+  async read(orgId, wsId) {
+    var q = wsId ? ('?ws=' + encodeURIComponent(wsId)) : '';
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspace' + q);
+    if (res.ok === false) throw fail(res, 'Failed to read workspace');
+    var d = res.data !== undefined ? res.data : res;
+    return {
+      manifest: (d && d.manifest) || null,
+      readme: (d && d.readme) || null,
+      readmeText: readmeText(d && d.readme),
+      spaces: normalizeWorkspace(d),
+      raw: d,
+    };
+  },
+
+  // Write/overwrite an object's draft. Embeds the instance id into the value (SPA convention)
+  // unless opts.embedId === false (needed for locked schemas that reject an id property).
+  async writeDraft(orgId, wsId, namespace, id, value, opts) {
+    opts = opts || {};
+    var v = stripMeta(value);
+    if (opts.embedId !== false && v && typeof v === 'object' && !Array.isArray(v)) {
+      v = Object.assign({}, v, { id: id });
+    }
+    var body = /** @type {Record<string, any>} */ ({ key: draftKey(orgId, wsId, namespace, id), value: v, visibility: opts.visibility || 'private' });
+    if (opts.group_id) body.group_id = opts.group_id;
+    if (Array.isArray(opts.tags) && opts.tags.length) body.tags = opts.tags;
+    var res = await authFetch('/v1/memory', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+    if (res.ok === false) throw fail(res, 'Failed to save draft');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // Publish a draft -> new .version.N + .latest (or a pending approval when the workspace gates publishes).
+  async publish(orgId, wsId, namespace, id) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/publish', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ws: wsId || undefined, namespace: namespace, id: id }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to publish');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // BULK publish MANY records in ONE request (data-access redesign). Two shapes:
+  //   • ids: ['id', ...]                → publish each record's existing DRAFT (the edit → publish flow)
+  //   • records: [{ id, value }, ...]   → DRAFT-LESS: publish the supplied values directly (imports —
+  //     one request for a whole CSV migration, no per-record draft write). optional expectedVersions.
+  // Replaces a loop of publish() (each a server-side scan + 2 writes + draft delete). Returns
+  // { published, skipped, failed, results }. create_only 409s; a publish review gate refuses the batch.
+  async publishRecords(orgId, wsId, namespace, idsOrRecords, expectedVersions) {
+    var body = /** @type {Record<string, any>} */ ({ ws: wsId || undefined, namespace: namespace });
+    var arr = idsOrRecords || [];
+    if (arr.length && typeof arr[0] === 'object') body.records = arr; else body.instances = arr;
+    if (expectedVersions && typeof expectedVersions === 'object') body.expected_versions = expectedVersions;
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspace/records/publish', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to publish records');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // BULK delete MANY record families in ONE request (data-access redesign) — ids: [id,...]. Removes each
+  // record's bare/.draft/.latest/.version.N owned by the caller's own identity in one batched call
+  // (needs memory:delete scope). Replaces a loop of deleteObject() (a scan + per-key delete each).
+  // Returns { deleted:[{id,keys}], failed:[{id,reason}], rows_removed }.
+  async deleteRecords(orgId, wsId, namespace, ids) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspace/records/delete', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ws: wsId || undefined, namespace: namespace, ids: ids || [] }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to delete records');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // Reopen a published record for editing (server copies .latest -> .draft; 409 if a draft exists).
+  async revertToDraft(orgId, wsId, namespace, id) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/revert', {
+      method: 'POST', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ws: wsId || undefined, namespace: namespace, id: id }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to revert to draft');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // Delete one object: bare key + .draft + .latest + all .version.N history (re-run for huge
+  // histories). NOTE: needs the memory:delete scope — app-grant tokens don't get it by default,
+  // declare it via <meta name="aimeat-scopes" content="memory:read memory:write memory:delete">.
+  async deleteObject(orgId, wsId, namespace, id) {
+    var base = wsRoot(orgId, wsId) + '.' + namespace + '.' + id;
+    var res = await authFetch('/v1/memory?prefix=' + encodeURIComponent(base) + '&limit=200');
+    if (res.ok === false) throw fail(res, 'Failed to list object keys');
+    var items = (res.data && res.data.items) || [];
+    var deleted = 0, attempted = 0, lastErr = null;
+    for (var i = 0; i < items.length; i++) {
+      var key = items[i].key;
+      // prefix match catches sibling ids (…my-doc2); keep only the exact instance's keys
+      if (key !== base && key.indexOf(base + '.') !== 0) continue;
+      attempted++;
+      var dres = await authFetch('/v1/memory/' + encodeURIComponent(key), { method: 'DELETE' });
+      if (dres.ok !== false) deleted++; else lastErr = dres;
+    }
+    if (attempted > 0 && deleted === 0 && lastErr) throw fail(lastErr, 'Failed to delete object keys');
+    return { deleted: deleted, attempted: attempted };
+  },
+
+  // Save the workspace README (creator/org-admin only — the server enforces it).
+  async saveReadme(orgId, wsId, readme) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/workspace?ws=' + encodeURIComponent(wsId), {
+      method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ readme: readme }),
+    });
+    if (res.ok === false) throw fail(res, 'Failed to save README');
+    return res.data !== undefined ? res.data : res;
+  },
+
+  // Organism-wide server-side search.
+  async search(orgId, q) {
+    var res = await authFetch('/v1/organisms/' + encodeURIComponent(orgId) + '/search?q=' + encodeURIComponent(q));
+    if (res.ok === false) throw fail(res, 'Search failed');
+    var d = res.data !== undefined ? res.data : res;
+    return (d && (d.results || d.hits || d.items)) || (Array.isArray(d) ? d : []);
+  },
+
+  util: {
+    stripMeta: stripMeta,
+    isMetaField: isMetaField,
+    titleOf: titleOf,
+    bodyFieldOf: bodyFieldOf,
+    isDocLike: isDocLike,
+    updatedAt: valueUpdatedAt,
+    wsRoot: wsRoot,
+    draftKey: draftKey,
+    normalizeWorkspace: normalizeWorkspace,
+    readmeText: readmeText,
+    TITLE_FIELDS: TITLE_FIELDS.slice(),
+    BODY_FIELDS: BODY_FIELDS.slice(),
+  },
+};
+
+attach('organism', organism);

package/dist/static/sdk-libs/portfolio-standalone/index.js

@@ -0,0 +1,78 @@
+/**
+ * @file portfolio-standalone/index.js
+ * @description The portfolio-standalone bridge shim (SDK-libs migration Phase 1) — injected into
+ *   portfolios served standalone on the portfolio origin (<username>.portfolio.<apex>). Recreates the
+ *   viewer's postMessage bridge locally so the exact same portfolio HTML works at top level (where
+ *   window.parent === window, so the portfolio's own parent.postMessage lands back here and this shim
+ *   answers it). Auth comes from the aimeat-auth SDK's H-2 silent SSO (an app-grant token bound to
+ *   THIS origin, scope memory:read). Componentized ESM source esbuild bundles to the IIFE served,
+ *   unchanged, at /v1/libs/portfolio-standalone.js (note: NOT aimeat-prefixed, and does NOT attach to
+ *   window.AIMEAT). Ported verbatim from lib-portfolio-standalone.ts; the baked ${config.baseUrl} apex
+ *   is now APEX_URL from _core/config.
+ * @structure imports APEX_URL (config); post()/announce(); the message listener (aimeat-portfolio-fetch);
+ *   boot() silent-SSO announce. No namespace attach — this is a standalone bridge, not an AIMEAT.* surface.
+ * @usage Served at GET /v1/libs/portfolio-standalone.js; injected (with aimeat-auth.js + a memory:read
+ *   scopes meta) by the portfolio-origin serve route in subdomains.ts.
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-portfolio-standalone.ts (SDK-libs migration Phase 1).
+ */
+import { APEX_URL } from '../_core/config.js';
+
+var APEX = APEX_URL;
+var jwt = null;
+
+function post(msg) {
+  try { window.postMessage(msg, window.location.origin); } catch { /* opaque origin — cannot happen here */ }
+}
+function announce(loggedIn) {
+  post({ type: 'aimeat-portfolio-auth', loggedIn: !!loggedIn });
+}
+
+// Answer the portfolio's bridge fetches with the visitor's grant token. At top
+// level window.parent === window, so parent.postMessage lands on this window.
+window.addEventListener('message', function (e) {
+  if (e.source !== window) return;
+  var d = e.data;
+  if (!d || d.type !== 'aimeat-portfolio-fetch') return;
+  var reply = function (ok, value) {
+    post({
+      type: 'aimeat-portfolio-fetch-result',
+      id: d.id == null ? null : d.id,
+      ok: !!ok,
+      gaii: typeof d.gaii === 'string' ? d.gaii : null,
+      key: typeof d.key === 'string' ? d.key : null,
+      value: value == null ? null : value,
+    });
+  };
+  if (typeof d.gaii !== 'string' || typeof d.key !== 'string') { reply(false, null); return; }
+  fetch(APEX + '/v1/memory/' + encodeURIComponent(d.gaii) + '/' + encodeURIComponent(d.key),
+    jwt ? { headers: { Authorization: 'Bearer ' + jwt } } : undefined)
+    .then(function (r) { return r.json().then(function (j) { return { r: r, j: j }; }); })
+    .then(function (x) {
+      var ok = !!(x.r.ok && x.j && x.j.ok !== false);
+      reply(ok, ok && x.j.data ? x.j.data.value : null);
+    })
+    .catch(function () { reply(false, null); });
+});
+
+// Silent SSO via the aimeat-auth SDK: on this foreign origin auth.login()
+// resolves an H-2 app-grant (scope from the injected aimeat-scopes meta) when
+// the visitor has an apex session AND has consented this origin; otherwise null.
+function boot() {
+  var auth = window.AIMEAT && window.AIMEAT.auth;
+  if (!auth || typeof auth.login !== 'function') { announce(false); return; }
+  Promise.resolve(auth.login()).then(function (session) {
+    jwt = session && session.jwt ? session.jwt : null;
+    announce(!!jwt);
+  }).catch(function () { announce(false); });
+  if (typeof auth.on === 'function') {
+    auth.on('login', function () {
+      var s = typeof auth.getSession === 'function' ? auth.getSession() : null;
+      jwt = (s && s.jwt) || null;
+      announce(!!jwt);
+    });
+    auth.on('logout', function () { jwt = null; announce(false); });
+  }
+}
+if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', boot);
+else boot();

package/dist/static/sdk-libs/social/index.js

@@ -0,0 +1,140 @@
+/**
+ * @file social/index.js
+ * @description The aimeat-social library (SDK-libs migration Phase 2). Exposes AIMEAT.social — the
+ *   boards & social feed client: createBoard/boards, post/posts/getPost, react/reply, subscribe/
+ *   unsubscribe/subscriptions, and the public catalogue. Authenticated calls go through the
+ *   AIMEAT.auth session; public reads go direct to NODE_URL. Componentized ESM source esbuild
+ *   bundles to the IIFE served, unchanged, at /v1/libs/aimeat-social.js. Ported verbatim from
+ *   lib-social.ts; NODE_URL now comes from _core/config.
+ * @structure imports NODE_URL (config) + authFetch (session) + attach (namespace); publicFetch();
+ *   the `social` object; attach('social', …).
+ * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-social.js"></script>
+ *   await AIMEAT.social.post('general', { title: 'Hi', body: 'Hello!' });
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-social.ts (SDK-libs migration Phase 2).
+ */
+import { NODE_URL } from '../_core/config.js';
+import { makeSession } from '../_core/session.js';
+const { authFetch } = makeSession('aimeat-social.js');
+import { attach } from '../_core/namespace.js';
+
+async function publicFetch(path) {
+  const r = await fetch(NODE_URL + path);
+  return r.json();
+}
+
+const social = {
+  // ── Boards ──
+
+  // Create a new board
+  async createBoard(name, opts) {
+    const body = { name, visibility: 'public', ...opts };
+    const res = await authFetch('/v1/boards', { method: 'POST', body: JSON.stringify(body) });
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to create board');
+    return res.data;
+  },
+
+  // List all visible boards (no auth needed for public boards)
+  async boards() {
+    const res = await publicFetch('/v1/boards');
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to list boards');
+    return res.data;
+  },
+
+  // ── Posts ──
+
+  // Post to a board
+  async post(boardId, content) {
+    const body = typeof content === 'string' ? { body: content } : content;
+    const res = await authFetch('/v1/boards/' + encodeURIComponent(boardId) + '/posts', {
+      method: 'POST', body: JSON.stringify(body),
+    });
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to post');
+    return res.data;
+  },
+
+  // List posts in a board (public, no auth needed)
+  async posts(boardId, opts) {
+    const params = new URLSearchParams();
+    if (opts?.category) params.set('category', opts.category);
+    if (opts?.cursor) params.set('cursor', opts.cursor);
+    if (opts?.limit) params.set('limit', String(opts.limit));
+    const qs = params.toString();
+    const res = await publicFetch('/v1/boards/' + encodeURIComponent(boardId) + '/posts' + (qs ? '?' + qs : ''));
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to list posts');
+    return res.data;
+  },
+
+  // Get a single post
+  async getPost(boardId, postId) {
+    const res = await publicFetch('/v1/boards/' + encodeURIComponent(boardId) + '/posts/' + encodeURIComponent(postId));
+    if (!res.ok) {
+      if (res.error?.code === 'NOT_FOUND') return null;
+      throw new Error(res.error?.message || 'Failed to get post');
+    }
+    return res.data;
+  },
+
+  // ── Reactions & Replies ──
+
+  // React to a post
+  async react(boardId, postId, reaction) {
+    const res = await authFetch(
+      '/v1/boards/' + encodeURIComponent(boardId) + '/posts/' + encodeURIComponent(postId) + '/react',
+      { method: 'POST', body: JSON.stringify({ reaction }) },
+    );
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to react');
+    return res.data;
+  },
+
+  // Reply to a post
+  async reply(boardId, postId, body) {
+    const content = typeof body === 'string' ? { body } : body;
+    const res = await authFetch(
+      '/v1/boards/' + encodeURIComponent(boardId) + '/posts/' + encodeURIComponent(postId) + '/replies',
+      { method: 'POST', body: JSON.stringify(content) },
+    );
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to reply');
+    return res.data;
+  },
+
+  // ── Subscriptions ──
+
+  // Subscribe to a board
+  async subscribe(boardId, opts) {
+    const body = { callback_url: opts?.callback_url, filters: opts?.filters };
+    const res = await authFetch('/v1/boards/' + encodeURIComponent(boardId) + '/subscribe', {
+      method: 'POST', body: JSON.stringify(body),
+    });
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to subscribe');
+    return res.data;
+  },
+
+  // Unsubscribe from a board
+  async unsubscribe(boardId) {
+    const res = await authFetch('/v1/boards/' + encodeURIComponent(boardId) + '/subscribe', {
+      method: 'DELETE',
+    });
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to unsubscribe');
+    return res.data;
+  },
+
+  // List own subscriptions
+  async subscriptions() {
+    const res = await authFetch('/v1/boards/subscriptions');
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to list subscriptions');
+    return res.data;
+  },
+
+  // ── Catalogue (public, no auth) ──
+
+  // Browse public boards from catalogue
+  async catalogue() {
+    const res = await publicFetch('/v1/catalogue/boards');
+    if (!res.ok) throw new Error(res.error?.message || 'Failed to browse catalogue boards');
+    return res.data;
+  },
+};
+
+// ── Expose globally ──
+attach('social', social);