aimeat 2.0.0 → 2.2.0

package/dist/public/js/services/unfurl.js

@@ -0,0 +1,43 @@
+/**
+ * @file public/js/services/unfurl.js
+ * @description Frontend service for link previews (unfurls). `fetchPreview(url)` asks the node for a
+ *   pasted link's OpenGraph/Twitter-card metadata; `fetchPreviewImageUrl(imageUrl)` pulls the preview
+ *   image THROUGH the node (same-origin, auth'd) into a `blob:` object URL — the SPA's CSP forbids remote
+ *   image hosts, so a direct <img src="https://…"> would be blocked. Both back the inbox message cards.
+ * @structure fetchPreview / fetchPreviewImageUrl
+ * @usage import * as unfurl from '/js/services/unfurl.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-21 — Initial link-preview service (inbox message link cards).
+ */
+import { apiGet } from '/js/api.js';
+
+const enc = encodeURIComponent;
+
+/** Fetch OG/Twitter-card metadata for one URL. Returns { url, resolvedUrl, title, description, image,
+ *  siteName } or null if the node couldn't unfurl it (blocked/failed fetch, non-HTML, etc.). */
+export async function fetchPreview(url) {
+  try {
+    const r = await apiGet(`/v1/unfurl?url=${enc(url)}`);
+    return r?.data || null;
+  } catch {
+    return null;   // a preview is best-effort — a link that won't unfurl just shows no card
+  }
+}
+
+/** Fetch a preview image through the node's proxy and return a blob: object URL (CSP-safe, auth'd via
+ *  the session JWT — an <img> tag can't send an Authorization header, so we fetch the bytes ourselves).
+ *  Returns null on any failure. The CALLER owns the returned URL and must URL.revokeObjectURL it. */
+export async function fetchPreviewImageUrl(imageUrl) {
+  try {
+    const headers = /** @type {Record<string, string>} */ ({});
+    const session = window.AIMEAT?.auth?.getSession?.();
+    if (session?.jwt) headers['Authorization'] = 'Bearer ' + session.jwt;
+    const resp = await fetch(`/v1/unfurl/image?url=${enc(imageUrl)}`, { headers });
+    if (!resp.ok) return null;
+    const blob = await resp.blob();
+    if (!blob.type.startsWith('image/')) return null;
+    return URL.createObjectURL(blob);
+  } catch {
+    return null;
+  }
+}

package/dist/public/lib/VENDORED.md

@@ -11,7 +11,8 @@ with per-lib AI docs + changelogs) — keep this table and the registry in sync.
 |------|---------|---------|---------|--------|---------|
 | `tailwindcss@4.js` | `@tailwindcss/browser` | 4.3.1 | `styling` | `https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4` | MIT |
 | `daisyui@5.css` | `daisyui` | 5.5.23 | `styling` | `https://cdn.jsdelivr.net/npm/daisyui@5` | MIT |
-| `aimeat-daisyui-bridge.css` | AIMEAT-local (theme bridge) | — | `styling` | this repo | MIT |
+| `aimeat-theme.css` | AIMEAT-local (the theme SYSTEM: 5 palettes × light+dark on the `data-theme` × `data-palette` axes, self-hosted faces, elevation/motion/type tokens; verified by `pnpm check:theme`) | 2.0.0 | `styling` | this repo | MIT |
+| `aimeat-daisyui-bridge.css` | AIMEAT-local (theme bridge; `@import`s the theme) | — | `styling` | this repo | MIT |
 | `chartjs@4.js` | `chart.js` (UMD) | 4.5.1 | `chartjs` | `https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js` | MIT |
 | `mermaid/mermaid.min.js` | `mermaid` (UMD) | 11.15.0 | `mermaid` | `node_modules/mermaid/dist` (see mermaid/README.md) | MIT |
 | `three.min.js` | `three` (r128 UMD) | r128 | `three` | `https://cdn.jsdelivr.net/npm/three@0.128.0/build/three.min.js` | MIT |
@@ -20,10 +21,11 @@ with per-lib AI docs + changelogs) — keep this table and the registry in sync.
 | `pixi-unsafe-eval@8.min.js` | `pixi.js` (unsafe-eval companion — REQUIRED after pixi under the app CSP) | 8.19.0 | `pixi` | `https://cdn.jsdelivr.net/npm/pixi.js@8/dist/packages/unsafe-eval.min.js` | MIT |
 | `phaser@3.min.js` | `phaser` | 3.90.0 | `phaser` | `https://cdn.jsdelivr.net/npm/phaser@3/dist/phaser.min.js` | MIT |
 | `drawflow@0.min.js` + `.min.css` | `drawflow` (engine INSIDE the aimeat-flow cortex — apps use AIMEAT.flow, never Drawflow directly) | 0.0.60 | `aimeat-flow` | `https://cdn.jsdelivr.net/npm/drawflow@0.0.60/dist/` | MIT |
-| `fonts.css` + `fonts/*.woff2` | Baloo 2 (variable 400–800) + Bangers display fonts, latin + latin-ext (ä/ö) | Baloo 2 v23 · Bangers v25 | `fonts` | Google Fonts CDN (see `fonts/LICENSE.md`) | OFL-1.1 |
+| `fonts.css` + `fonts/*.woff2` | Baloo 2 + Bangers display fonts (the `fonts` pack, via `fonts.css`) AND the theme-system faces Inter, Space Grotesk, Fraunces, JetBrains Mono (declared by `aimeat-theme.css`, lazy-loaded per family). All latin + latin-ext (ä/ö); see `fonts/LICENSE.md` | Baloo 2 v23 · Bangers v25 · Inter v20 · Space Grotesk v22 · Fraunces v38 · JetBrains Mono v24 | `fonts` / `styling` | Google Fonts CDN (see `fonts/LICENSE.md`) | OFL-1.1 |
 | `realtime.js` | AIMEAT-local (WS/WebRTC/Yjs client + `SharedClock` synced timeline) | 1 | `realtime` | this repo | MIT |
 | `toastui/toastui-editor-all.min.js` + `.min.css` | TOAST UI Editor | (SPA-internal) | — | `https://uicdn.toast.com` | MIT |
-| `preact.mjs`, `preact-hooks.mjs`, `htm.mjs`, `yaml.mjs`, `minidenticons.min.js` | preact / htm / yaml / minidenticons (ESM) | (SPA-internal, importmap) | — | jsdelivr | MIT |
+| `yaml.mjs` | `yaml` (ESM) | 2.x | `yaml` | jsdelivr | ISC |
+| `preact.mjs`, `preact-hooks.mjs`, `htm.mjs`, `minidenticons.min.js` | preact / htm / minidenticons (ESM) | (SPA-internal, importmap) | — | jsdelivr | MIT |
 | `live-updates.js` | AIMEAT-local (SSE ESM wrapper) | (SPA-internal) | — | this repo | MIT |
 | `samples/` | audio samples for aimeat-audio | — | — | CC | CC |
 
@@ -51,6 +53,7 @@ The same append-only rule applies to the node-bundled cortex wrappers
 
 ```html
 <link href="/lib/daisyui@5.css" rel="stylesheet" type="text/css" />
+<link href="/lib/aimeat-theme.css" rel="stylesheet" type="text/css" />
 <link href="/lib/aimeat-daisyui-bridge.css" rel="stylesheet" type="text/css" />
 <script src="/lib/tailwindcss@4.js"></script>
 <!-- charts: <script src="/lib/chartjs@4.js"></script> before aimeat-charts -->

package/dist/public/lib/aimeat-daisyui-bridge.css

@@ -1,6 +1,10 @@
 /*
  * @file aimeat-daisyui-bridge.css
  * @description Theme-compat layer so the bundled cortex UI libraries cohere with daisyUI.
+ *   (0) Pulls in the AIMEAT daisyUI theme (aimeat-theme.css) so any app already loading this
+ *       bridge gets the house palette — coral primary, the designed dark surface ramp and
+ *       correct `-content` pairs — without editing the app. Before this, `--color-primary` was
+ *       daisyUI's indigo and every branded app hardcoded `#E8564A` by hand.
  *   (1) Maps AIMEAT theme.css variable NAMES to daisyUI 5 theme variables so libs that read
  *       --text / --bg-card / --accent / … follow a daisyUI app's `data-theme` automatically.
  *   (2) Dark-mode polish: a few cortex components hardcode LIGHT colors (no var) — alerts,
@@ -8,12 +12,30 @@
  *       theme-aware tints (`:root .aui-*` wins on specificity). No changes to the libraries.
  *   Load this AFTER the daisyUI stylesheet. Hardcoded fallbacks keep it working if daisyUI
  *   vars are absent.
+ *
+ *   NOTE on daisyUI's OWN components: they are not overridden here. With the theme loaded they
+ *   are already theme-correct, and daisyUI 5 ships the quiet variants an app usually wants —
+ *   `badge-soft`, `alert-soft`, `btn-soft`, `card-border`. Reach for those instead of a solid
+ *   `badge-warning`, which is a loud block of amber on a dark page even when it is legible.
  * @usage  <link href="/lib/daisyui@5.css" rel="stylesheet" />
  *         <link href="/lib/aimeat-daisyui-bridge.css" rel="stylesheet" />
  * @version-history
- *   v1.0.0 — 2026-06-26 — Initial bridge (cortex libs follow daisyUI theme).
+ *   v1.3.0 — 2026-07-25 — FIX the --border collision: the bridge mapped --border to a COLOUR at
+ *     :root for the aui-* cortex components, while daisyUI 5 uses the same name as a border WIDTH
+ *     inside calc() on nearly every component — the invalid calc collapsed badge/input paddings to
+ *     0 and toggles to slivers on every bridge-loading page since v1.0.0. The colour mapping is now
+ *     scoped to aui-* elements, with a --border-w restore for daisyUI components nested inside.
+ *   v1.2.0 — 2026-07-25 — @import the AIMEAT daisyUI theme, so the house palette reaches every
+ *     app that already loads the bridge. Contrast + surface ramp verified by
+ *     `pnpm check:theme` (tools/theme-contrast.ts).
  *   v1.1.0 — 2026-06-26 — Map --bg-surface-dim (table zebra) + theme-aware alert/badge tints.
+ *   v1.0.0 — 2026-06-26 — Initial bridge (cortex libs follow daisyUI theme).
  */
+
+/* MUST be the first rule: @import is only valid ahead of ordinary rules. Same-origin, cached
+   alongside this file, and a no-op duplicate when the app also links the theme directly. */
+@import url('/lib/aimeat-theme.css');
+
 :root {
   --text:           var(--color-base-content, #1A1A2E);
   --text-dim:       color-mix(in oklab, var(--color-base-content, #6B7280) 70%, transparent);
@@ -24,7 +46,6 @@
   --bg-surface-dim: color-mix(in oklab, var(--color-base-content, #111827) 5%, var(--color-base-100, #ffffff));
   --bg-dim:         var(--color-base-200, #f3f4f6);
   --surface:        var(--color-base-200, #f3f4f6);
-  --border:         var(--color-base-300, #e5e7eb);
   --accent:         var(--color-primary, #e8564a);
   --blue:           var(--color-info, #3b82f6);
   --danger:         var(--color-error, #ef4444);
@@ -33,6 +54,22 @@
   --warning:        var(--color-warning, #f59e0b);
 }
 
+/* ── The --border name collision, fixed. The cortex `aui-*` components read `var(--border)` as a
+      border COLOUR; daisyUI 5 reads the same name as a border WIDTH in calc() maths on nearly every
+      component (`padding-inline: calc(var(--size)/2 - var(--border))` on .badge, toggle geometry,
+      input paddings…). Mapping the colour at :root (bridge v1.0.0–v1.2.0) made those calcs invalid
+      at computed-value time, so paddings collapsed to 0 and toggles rendered as slivers on EVERY
+      page that loaded this bridge. The colour is now scoped to elements that actually carry an
+      aui-* class, and daisyUI components nested inside an aui container get the palette's width
+      back via --border-w (declared per theme block in aimeat-theme.css). ── */
+[class^='aui-'], [class*=' aui-'] {
+  --border: var(--color-base-300, #e5e7eb);
+}
+[class^='aui-'] :where(.btn, .badge, .toggle, .checkbox, .radio, .input, .select, .textarea, .file-input, .range, .tab, .tabs, .card, .alert, .table, .kbd, .status, .divider, .menu, .modal-box, .stats, .progress),
+[class*=' aui-'] :where(.btn, .badge, .toggle, .checkbox, .radio, .input, .select, .textarea, .file-input, .range, .tab, .tabs, .card, .alert, .table, .kbd, .status, .divider, .menu, .modal-box, .stats, .progress) {
+  --border: var(--border-w, 1px);
+}
+
 /* ── Dark-mode polish: override the cortex libs' hardcoded light colors with theme-aware
       tints. `:root .aui-*` (specificity 0,1,1) beats the libs' `.aui-*` (0,1,0) regardless
       of stylesheet order. Tint = subtle wash of the semantic colour over the card bg; text