aimeat 2.1.0 → 2.2.0

package/dist/.env.example

@@ -315,10 +315,15 @@ AIMEAT_PORT=40050
 # AIMEAT_VAT_RATE_PERCENT=25.5             # Default ALV/VAT rate for money-sale bookings (Finland standard 25.5%); overridable per company.
 # AIMEAT_PLATFORM_STRIPE_KEY=              # Legacy alias for AIMEAT_STRIPE_SECRET_KEY (only used if the latter is unset).
 
-# ── x402 stablecoin settlement (TARGET-042) — NON-CUSTODIAL USDC on a USD price ──
-# AIMEAT_X402_ENABLED=false               # Register the x402 USDC PaymentHandler (settles money/USD sessions via the exact scheme + facilitator). OFF by default: advertise the exact scheme only when the node can settle it.
-# AIMEAT_X402_NETWORK=base-sepolia        # Network id in the accepts[] exact scheme: base-sepolia (testnet) | base (mainnet). A parameter, not hardcoded — Solana etc. drop in via the network registry (src/commerce/x402-facilitator.ts).
-# AIMEAT_X402_FACILITATOR_URL=https://x402.org/facilitator  # Facilitator /verify + /settle base URL (all calls go through safeFetch). Coinbase CDP facilitator in prod; the public x402.org one covers Base Sepolia.
+# ── x402 stablecoin settlement (TARGET-042) — NON-CUSTODIAL stablecoin on a fiat price ──
+# The token follows the price: a USD session settles in USDC, a EUR session in EURC. One seller payout
+# address receives both. The currencies the node advertises are DERIVED from the assets the configured
+# network has, so a currency is never offered unless it can really settle.
+# AIMEAT_PACING_TOLL_DEFAULT=0           # Morsels burned per METERED call when the capability declares no toll of its own. Morsels replenish daily with a hard ceiling, so a non-zero value puts an absolute RATE floor under every capability - including money-priced ones, whose only other brake is the buyer's total budget. Applies on every metered path (app tools, exchange runs, agent work, raw extension invokes). 0 = off (existing billing unchanged).
+# AIMEAT_X402_ENABLED=false               # Register the x402 PaymentHandler (settles money sessions via the exact scheme + facilitator). OFF by default: advertise the exact scheme only when the node can settle it.
+# AIMEAT_X402_NETWORK=base-sepolia        # Network id in the accepts[] exact scheme: base-sepolia (testnet) | base (mainnet). Both carry USDC + EURC. A parameter, not hardcoded — Solana etc. drop in via the network registry (src/commerce/x402-facilitator.ts).
+# AIMEAT_X402_FACILITATOR_URL=https://x402.org/facilitator  # Facilitator /verify + /settle base URL (all calls go through safeFetch). The public x402.org one covers Base Sepolia (USDC and EURC alike) but NOT Base mainnet — mainnet needs a facilitator that serves it, e.g. Coinbase CDP.
+# AIMEAT_X402_RPC_URL=                    # OPTIONAL read-only JSON-RPC (e.g. https://mainnet.base.org). Used ONLY to check that a seller's payout address is an account, not a contract, before it is saved. Empty = check skipped; a payout setting must not depend on a third party being up.
 # AIMEAT_X402_TEST_FACILITATOR=false      # TEST ONLY: an off-chain facilitator double so the x402 chain is E2E-provable without a testnet wallet. NEVER in prod (real settlement = the real facilitator).
 
 # ── Crawlers / Content Signals / Web Bot Auth ──────────────────

package/dist/locales/en.json

@@ -10,6 +10,8 @@
   "inbox.sending": "Sending…",
   "inbox.reply": "Reply",
   "inbox.quoteReply": "Reply to this message",
+  "inbox.copyMessage": "Copy this message to the clipboard",
+  "inbox.copied": "Copied",
   "inbox.quoteJump": "Show the original message",
   "inbox.quoteYou": "You",
   "inbox.replyingTo": "Replying to",
@@ -2538,6 +2540,16 @@
       "pspRemove": "Remove",
       "pspSaved": "Payment key saved",
       "pspRemoved": "Payment key removed",
+      "x402Title": "Stablecoin payouts (x402)",
+      "x402Desc": "A different rail from Stripe: a buyer signs a stablecoin payment and the facilitator settles it on-chain straight to this address. The token follows the price — a dollar price settles in USDC, a euro price in EURC — and the same address receives both. Non-custodial: the node holds no key and no funds. Without an address, a stablecoin sale of yours fails.",
+      "x402Configured": "Payout address set",
+      "x402Missing": "No payout address",
+      "x402Save": "Save address",
+      "x402Remove": "Remove",
+      "x402Saved": "Payout address saved",
+      "x402Removed": "Payout address removed. Card and invoice settlement is unaffected.",
+      "x402Invalid": "An address is 0x followed by 40 hex characters.",
+      "x402Testnet": "test network",
       "moneyTitle": "Money purchases & sales",
       "moneyDesc": "Real-money (EUR/USD) checkout activity — separate from morsels. Funds move through the seller's own payment provider, never the node.",
       "moneyPurchases": "Purchases",
@@ -3035,6 +3047,12 @@
       "agConfirmRevoke": "Revoke access for \"{name}\"? It loses access immediately.",
       "agRevoked": "App access revoked",
       "agRevoke": "Revoke",
+      "agScopesToggle": "Show or hide the granted permissions",
+      "agUnusedNote": "{count} of these have not been used in over {days} days.",
+      "agRevokeUnused": "Revoke {count} unused",
+      "agConfirmRevokeUnused": "Revoke access for {count} apps unused for over {days} days? They lose access immediately.",
+      "agRevokedCount": "{count} app grants revoked",
+      "agRevokedSome": "{done} revoked, {failed} failed",
       "patTitle": "Agent Access Tokens",
       "patDesc": "Create a revocable token an agent can use (as a Bearer header) to log in and test your apps. One token can be shared across all your agents.",
       "patLabelRequired": "Give the token a name",
@@ -3385,6 +3403,11 @@
         "frontier": "Frontier-safe — a version-drift trap for weaker models; they must read its doc",
         "needs-doc": "AIMEAT-authored wrapper — the AI must fetch its doc to use it (no priors)"
       },
+      "tierLabel": {
+        "any": "ANY MODEL",
+        "frontier": "VERSION TRAP",
+        "needs-doc": "READ THE DOC"
+      },
       "heroDesc": "Get more done with less. AI Chat can handle bigger apps when you hand it ready-made cortex building blocks — reusable UI libraries, schemas, and prompts. Use the same cortex across multiple apps.",
       "visibility": {
         "private": "Private",
@@ -4507,6 +4530,11 @@
     "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
     "loggedIn": "logged in",
     "logoutBtn": "Logout",
+    "switchLanguage": "Language",
+    "themeLabel": "Theme",
+    "lightMode": "Light mode",
+    "darkMode": "Dark mode",
+    "chooseLook": "Choose look",
     "usernameLabel": "Username",
     "passwordLabel": "Password",
     "displayNameLabel": "Display Name",

package/dist/locales/fi.json

@@ -10,6 +10,8 @@
   "inbox.sending": "Lähetetään…",
   "inbox.reply": "Vastaa",
   "inbox.quoteReply": "Vastaa tähän viestiin",
+  "inbox.copyMessage": "Kopioi tämä viesti leikepöydälle",
+  "inbox.copied": "Kopioitu",
   "inbox.quoteJump": "Näytä alkuperäinen viesti",
   "inbox.quoteYou": "Sinä",
   "inbox.replyingTo": "Vastataan:",
@@ -2538,6 +2540,16 @@
       "pspRemove": "Poista",
       "pspSaved": "Maksuavain tallennettu",
       "pspRemoved": "Maksuavain poistettu",
+      "x402Title": "Stablecoin-tilitykset (x402)",
+      "x402Desc": "Eri raide kuin Stripe: ostaja allekirjoittaa stablecoin-maksun ja fasilitaattori tilittää sen ketjussa suoraan tähän osoitteeseen. Rahake määräytyy hinnan mukaan: dollarihinta tilittyy USDC:nä ja eurohinta EURC:nä, ja sama osoite ottaa vastaan molemmat. Ei-säilytyksellinen: noodi ei pidä avainta eikä varoja. Ilman osoitetta stablecoin-myyntisi kaatuu.",
+      "x402Configured": "Tilitysosoite asetettu",
+      "x402Missing": "Ei tilitysosoitetta",
+      "x402Save": "Tallenna osoite",
+      "x402Remove": "Poista",
+      "x402Saved": "Tilitysosoite tallennettu",
+      "x402Removed": "Tilitysosoite poistettu. Kortti- ja laskutilitys ei muutu.",
+      "x402Invalid": "Osoite on 0x ja 40 heksamerkkiä.",
+      "x402Testnet": "testiverkko",
       "moneyTitle": "Rahaostot ja -myynnit",
       "moneyDesc": "Rahamaksut (EUR/USD) — erillään murusista. Varat liikkuvat myyjän oman maksupalvelun kautta, ei koskaan noodin.",
       "moneyPurchases": "Ostot",
@@ -3035,6 +3047,12 @@
       "agConfirmRevoke": "Peruutetaanko sovelluksen \"{name}\" pääsy? Se menettää pääsyn välittömästi.",
       "agRevoked": "Sovelluksen pääsy peruutettu",
       "agRevoke": "Peruuta",
+      "agScopesToggle": "Näytä tai piilota myönnetyt oikeudet",
+      "agUnusedNote": "Näistä {count} on ollut käyttämättä yli {days} päivää.",
+      "agRevokeUnused": "Peruuta {count} käyttämätöntä",
+      "agConfirmRevokeUnused": "Peruutetaanko pääsy {count} sovellukselta, joita ei ole käytetty yli {days} päivään? Ne menettävät pääsyn välittömästi.",
+      "agRevokedCount": "{count} sovelluksen pääsy peruutettu",
+      "agRevokedSome": "{done} peruutettu, {failed} epäonnistui",
       "patTitle": "Agenttien käyttötokenit",
       "patDesc": "Luo peruutettava token, jota agentti voi käyttää (Bearer-headerina) kirjautuakseen ja testatakseen appejasi. Yhtä tokenia voi jakaa kaikille agenteillesi.",
       "patLabelRequired": "Anna tokenille nimi",
@@ -3385,6 +3403,11 @@
         "frontier": "Vahvoille malleille turvallinen — versioansa heikommille; niiden on luettava dokumentaatio",
         "needs-doc": "AIMEAT:n oma wrapper — tekoälyn on haettava dokumentaatio käyttääkseen sitä (ei ennakkotietoa)"
       },
+      "tierLabel": {
+        "any": "KAIKILLE MALLEILLE",
+        "frontier": "VERSIOANSA",
+        "needs-doc": "LUE DOKUMENTTI"
+      },
       "heroDesc": "Cortexeilla saat enemmän aikaiseksi vähemmällä. AI Chat suoriutuu isommista sovelluksista kun annat sille valmiita cortex-rakennuspalikoita — uudelleenkäytettäviä UI-kirjastoja, skeemoja ja prompteja. Voit käyttää samaa cortexia useassa sovelluksessa.",
       "visibility": {
         "private": "Yksityinen",
@@ -4507,6 +4530,11 @@
     "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
     "loggedIn": "kirjautuneena",
     "logoutBtn": "Kirjaudu ulos",
+    "switchLanguage": "Kieli",
+    "themeLabel": "Teema",
+    "lightMode": "Vaalea tila",
+    "darkMode": "Tumma tila",
+    "chooseLook": "Valitse tyyli",
     "usernameLabel": "Käyttäjänimi",
     "passwordLabel": "Salasana",
     "displayNameLabel": "Näyttönimi",

package/dist/public/cortex-bundled/aimeat-charts.js

@@ -11,6 +11,30 @@
  * Usage:
  *   AIMEAT.charts.ChartBuilder({ elementId: 'my-chart', type: 'bar', data: {...} })
  *   AIMEAT.charts.ChartPanel({ elementId: 'my-chart', chartKey: 'chart:sales-2024', nodeUrl: '...' })
+ *
+ * @version-history
+ *   v1.1.2 — 2026-07-25 — One observer, not two. This lib attached its own ResizeObserver that
+ *     called `chart.resize()` with no arguments; Chart.js already watches the same container and
+ *     already resizes from the observer entry's contentRect. The two disagree wherever an
+ *     ancestor carries `transform: scale(k)` — the no-argument call measures with
+ *     getBoundingClientRect(), which is k times the layout size. Measured while dragging a frame
+ *     on a zoomable board: 30 canvas style writes for 15 pointer moves, alternating between the
+ *     right height and exactly k x it (k = 0.31, 0.99, 1.87 all reproduce); a chart left holding
+ *     the scaled answer stayed at 31% of its box for good. Now the observer exists only for
+ *     non-responsive charts, and it passes layout pixels instead of re-measuring.
+ *   v1.1.1 — 2026-07-25 — Give the canvas size back to Chart.js. The injected
+ *     `.aimeat-chart-container canvas { width:100%!important; height:auto!important }` overrode the
+ *     inline height Chart.js writes and then watches, so in any height-constrained container the
+ *     two fought: measured 14 distinct canvas sizes in 3 seconds, visible as a fast flicker between
+ *     two renderings. Only display:block and max-width remain.
+ *   v1.1.0 — 2026-07-25 — Charts follow the theme. The palette is resolved from the theme tokens
+ *     when a chart is drawn, and every chart this lib owns is repainted when the palette or the
+ *     light/dark mode changes. The old list called itself "the AIMEAT brand palette" and was
+ *     Tailwind's indigo/violet default: it was neither the house coral nor aware of the five
+ *     palettes the theme system ships, so every chart in every app was off-brand and stayed that
+ *     way when the reader switched look. A canvas cannot inherit a CSS variable the way a div can,
+ *     which is why this needs resolving at draw time plus a repaint, not a stylesheet rule.
+ *     Datasets that carry their own colours are still left alone.
  */
 (function (AIMEAT) {
   'use strict';
@@ -22,13 +46,48 @@
   /** Supported Chart.js chart types. */
   var TYPES = ['bar', 'line', 'pie', 'doughnut', 'radar', 'scatter', 'bubble'];
 
-  /** AIMEAT brand palette — used as default colours when datasets omit backgroundColor. */
-  var PALETTE = [
+  /**
+   * Used when the page has no AIMEAT theme loaded, so a bare Chart.js page still gets a chart
+   * with distinguishable series rather than ten black bars.
+   */
+  var FALLBACK_PALETTE = [
     '#6366f1', '#8b5cf6', '#a78bfa', '#c4b5fd',
     '#f59e0b', '#10b981', '#ef4444', '#3b82f6',
     '#ec4899', '#14b8a6'
   ];
 
+  /** The theme tokens a chart draws from, in the order a reader should see them. */
+  var PALETTE_TOKENS = [
+    '--color-primary', '--color-secondary', '--color-accent', '--color-info',
+    '--color-success', '--color-warning', '--color-error'
+  ];
+
+  /**
+   * The palette in effect right now, read from the theme.
+   *
+   * Resolved per draw rather than once at load: the theme has two axes (light/dark and five
+   * palettes) and both can change while the page is open.
+   *
+   * @param {Element=} host element to resolve against — the tokens live on :root, but resolving
+   *   against the chart's own container lets a scoped override win.
+   * @returns {string[]} colours, or FALLBACK_PALETTE when no theme is present.
+   */
+  function themePalette(host) {
+    try {
+      var cs = window.getComputedStyle(host || document.documentElement);
+      var out = [];
+      PALETTE_TOKENS.forEach(function (name) {
+        var v = String(cs.getPropertyValue(name) || '').trim();
+        if (v && out.indexOf(v) === -1) out.push(v);
+      });
+      /* Two colours cannot carry a multi-series chart, so a half-defined theme falls back whole
+         rather than mixing house colours with Tailwind defaults. */
+      return out.length >= 3 ? out : FALLBACK_PALETTE;
+    } catch (_e) {
+      return FALLBACK_PALETTE;
+    }
+  }
+
   /** Chart types where each data-point gets its own colour slice. */
   var SLICE_TYPES = ['pie', 'doughnut'];
 
@@ -53,10 +112,15 @@
       '  max-width: 100%;' +
       '  box-sizing: border-box;' +
       '}' +
+      /* Chart.js owns the canvas size in responsive mode: it writes style.width/height inline
+         and watches the result. These two !important rules overrode that inline height, so the
+         canvas rendered at the backing store's own ratio instead, Chart.js's ResizeObserver saw a
+         different size and wrote the height again — a two-state oscillation, several times a
+         second, whenever the container height was constrained. Two authorities for one value.
+         display:block stays (it removes the inline-element baseline gap); the sizing is Chart.js's. */
       '.aimeat-chart-container canvas {' +
       '  display: block;' +
-      '  width: 100% !important;' +
-      '  height: auto !important;' +
+      '  max-width: 100%;' +
       '}' +
       '.aimeat-chart-error {' +
       '  padding: 20px;' +
@@ -132,11 +196,13 @@
    *
    * @param {object} data  Chart.js data object ({ labels, datasets }).
    * @param {string} type  Chart type string (e.g. 'bar', 'pie').
+   * @param {Element=} host container to resolve the theme against.
    * @returns {object} Cloned data with palette applied.
    */
-  function applyPalette(data, type) {
+  function applyPalette(data, type, host) {
     var d = JSON.parse(JSON.stringify(data));
     var isSlice = SLICE_TYPES.indexOf(type) !== -1;
+    var PALETTE = themePalette(host);
 
     d.datasets.forEach(function (ds, i) {
       if (!ds.backgroundColor) {
@@ -160,6 +226,65 @@
     return d;
   }
 
+  // ---------------------------------------------------------------------------
+  // Following the theme
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Every chart this lib currently owns, with the data the CALLER passed.
+   *
+   * The caller's data is what gets kept, not the drawn data: applyPalette fills in a colour where
+   * one was missing, so re-applying it to already-drawn data would find every dataset "already
+   * coloured" and change nothing. Recolouring has to start from the original each time, which
+   * also keeps the promise that a dataset with its own colour is never overridden.
+   */
+  var live = [];
+  var watching = false;
+
+  /** Drop charts whose canvas has left the document, so a long-lived page does not accumulate. */
+  function pruneLive() {
+    live = live.filter(function (rec) {
+      var c = rec.chart;
+      return c && c.canvas && c.canvas.isConnected;
+    });
+  }
+
+  /** Repaint every live chart against the theme as it is now. */
+  function repaintAll() {
+    pruneLive();
+    live.forEach(function (rec) {
+      try {
+        var next = applyPalette(rec.data, rec.type, rec.el);
+        rec.chart.data.datasets.forEach(function (ds, i) {
+          var src = next.datasets[i];
+          if (!src) return;
+          ds.backgroundColor = src.backgroundColor;
+          ds.borderColor = src.borderColor;
+        });
+        /* A plain update(), not update('none'): the 'none' mode skips the element style cache
+           as well as the animation, so a bar chart kept its old fill while its own legend showed
+           the new one. Measured on canvas pixels, not inferred. The colour transition it animates
+           instead is the right feel for a palette change. */
+        rec.chart.update();
+      } catch (_e) { /* one bad chart must not stop the rest */ }
+    });
+  }
+
+  /**
+   * Watch the theme. A MutationObserver on the two attributes rather than the
+   * 'aimeat-palette-change' event, because light/dark has no event of its own and an app is free
+   * to set either attribute directly — the attribute is the thing that is actually true.
+   */
+  function watchTheme() {
+    if (watching || typeof MutationObserver === 'undefined') return;
+    watching = true;
+    try {
+      new MutationObserver(repaintAll).observe(document.documentElement, {
+        attributes: true, attributeFilter: ['data-theme', 'data-palette']
+      });
+    } catch (_e) { watching = false; }
+  }
+
   /**
    * Create a <canvas> inside the given container, wrapped in the standard
    * .aimeat-chart-container div.
@@ -178,18 +303,35 @@
   }
 
   /**
-   * Attach a ResizeObserver to the chart's parent so Chart.js can re-draw when
-   * the container size changes (e.g. responsive layout, collapsible panels).
+   * Keep a chart sized to its container.
+   *
+   * A responsive chart is already watched by Chart.js itself, and Chart.js measures the right
+   * thing: its own ResizeObserver hands `resize()` the entry's contentRect, which is layout
+   * pixels. `chart.resize()` with no arguments measures the container with
+   * getBoundingClientRect() instead — and inside an ancestor carrying `transform: scale(k)`, as
+   * every zoomable board has, that rect is k times the layout size. Two observers, two answers,
+   * one canvas: measured on ORIGAMI while dragging a frame's resize grip, the canvas got two
+   * style writes per pointer move, one correct and one exactly k x correct — 30 writes for 15
+   * moves at k=0.31, k=0.99 and k=1.87 alike. Without this second observer: 15 writes, one size.
+   * A chart left holding the scaled answer stayed at 31% of its box and never recovered.
+   *
+   * So the observer is only for the non-responsive case, where Chart.js watches nothing — and
+   * even there it passes layout pixels explicitly rather than asking for a fresh measurement.
    *
    * @param {object}      chart Chart.js instance.
    * @param {HTMLElement}  el    The outer container element.
    */
   function observeResize(chart, el) {
     if (typeof ResizeObserver === 'undefined') return;
+    if (!chart.options || chart.options.responsive !== false) return;
 
     var observer = new ResizeObserver(function () {
       try {
-        chart.resize();
+        /* clientWidth/clientHeight, never the no-argument resize(): these are layout pixels and
+           stay true inside a scaled ancestor. The box is the canvas's own parent, which is what
+           Chart.js measures. */
+        var box = chart.canvas && chart.canvas.parentElement;
+        if (box) chart.resize(box.clientWidth, box.clientHeight);
       } catch (_e) {
         // Chart may have been destroyed — silently ignore.
       }
@@ -293,7 +435,7 @@
 
     try {
       var canvas = createCanvas(el);
-      var chartData = applyPalette(opts.data, opts.type);
+      var chartData = applyPalette(opts.data, opts.type, el);
       var chartOptions = buildOptions(opts.title, opts.options);
 
       var chart = new window.Chart(canvas, {
@@ -303,6 +445,9 @@
       });
 
       observeResize(chart, el);
+      pruneLive();
+      live.push({ chart: chart, el: el, data: opts.data, type: opts.type });
+      watchTheme();
       return chart;
     } catch (err) {
       showError(el, 'Failed to render chart: ' + (err.message || String(err)));
@@ -441,7 +586,10 @@
   var exports = {
     ChartPanel: ChartPanel,
     ChartBuilder: ChartBuilder,
-    TYPES: TYPES
+    TYPES: TYPES,
+    VERSION: '1.1.2',
+    /** The palette a chart would draw with right now, for legends and non-canvas visuals. */
+    palette: themePalette
   };
 
   AIMEAT.register('aimeat-charts', exports);

package/dist/public/cortex-bundled/aimeat-charts.yaml

@@ -10,7 +10,7 @@ metadata:
     domain: visualization
 
 spec:
-  version: "1.0.2"
+  version: "1.1.2"
   license: MIT
   components:
     - type: schema