aimeat 2.1.0 → 2.3.0

package/dist/static/sdk-libs/markdown/index.js

@@ -14,6 +14,10 @@
  * @usage <script src="/v1/libs/aimeat-markdown.js"></script>  AIMEAT.md.render(md, '#out')
  * @version-history
  *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-markdown.ts (SDK-libs migration Phase 2).
+ *   v1.1.0 — 2026-07-25 — Added AIMEAT.md.citations(text): pulls `Source:`/`Sources:` lines, inline
+ *     lenticular 【url】 citations and bare URLs out of LLM prose into one source list (host +
+ *     shortener flag). Every app rendering agent output had hand-rolled this, and the hand-rolled
+ *     URL regexes kept including the closing 】 in the href.
  */
 import { NODE_URL } from '../_core/config.js';
 import { attach } from '../_core/namespace.js';
@@ -519,4 +523,48 @@ function injectCss() {
 }
 injectCss();
 
-attach('md', { render: render, renderToString: renderToString, renderRich: renderRich, sanitizeHref: sanitizeHref, sanitizeImgSrc: sanitizeImgSrc });
+// ── citations ───────────────────────────────────────────────────────────────
+// LLM-written prose cites its sources in at least three conventions, often mixed
+// inside ONE document: a trailing `Source:`/`Sources:` line, inline lenticular
+// 【https://…】 brackets (a model artifact no markdown renderer linkifies, so it
+// renders as literal junk), and bare inline URLs. Every app that displays agent
+// output re-invented this parse, and the hand-rolled URL regexes kept forgetting
+// to exclude 】 — which silently puts the bracket inside the href and breaks the
+// link. One implementation, here, next to the renderer that consumes it.
+var CITE_URL_RE = /https?:\/\/[^\s,;)\]}"'【】]+/g;
+
+// Link shorteners hide their destination, so a UI cannot show a trustworthy
+// publisher name for them. Reported separately rather than silently.
+var SHORTENERS = ['lnkd.in', 'bit.ly', 't.co', 'ow.ly', 'tinyurl.com', 'buff.ly', 'goo.gl', 'is.gd', 'rb.gy'];
+
+/**
+ * Split cited sources out of prose.
+ * @param {string} text
+ * @param {{stripInline?: boolean}} [opts] stripInline (default true): remove the
+ *   bracketed/trailing citation noise from `body`. Bare inline URLs are left in place.
+ * @returns {{body: string, sources: Array<{url: string, host: string, shortened: boolean}>}}
+ */
+function citations(text, opts) {
+  var strip = !opts || opts.stripInline !== false;
+  var body = String(text == null ? '' : text);
+  var seen = Object.create(null);
+  var out = [];
+  function push(u) {
+    u = String(u).replace(/[.,;:]+$/, '');
+    if (!u || seen[u]) return;
+    seen[u] = 1;
+    var host;
+    try { host = new URL(u).hostname.replace(/^www\./, ''); } catch { host = ''; }
+    out.push({ url: u, host: host, shortened: SHORTENERS.indexOf(host) >= 0 });
+  }
+  body = body.replace(/【\s*(https?:\/\/[^】\s]+)\s*】/g, function (m, u) { push(u); return strip ? '' : m; });
+  body = body.replace(/^[ \t]*Sources?[ \t]*:[ \t]*(.*)$/gim, function (m, rest) {
+    (String(rest).match(CITE_URL_RE) || []).forEach(push);
+    return strip ? '' : m;
+  });
+  (body.match(CITE_URL_RE) || []).forEach(push);
+  if (strip) body = body.replace(/[ \t]+$/gm, '').replace(/\n{3,}/g, '\n\n').trim();
+  return { body: body, sources: out };
+}
+
+attach('md', { render: render, renderToString: renderToString, renderRich: renderRich, sanitizeHref: sanitizeHref, sanitizeImgSrc: sanitizeImgSrc, citations: citations });

package/dist/static/sdk-libs/webmcp/index.js

@@ -13,6 +13,10 @@
  * @usage <script src="/v1/libs/aimeat-webmcp.js"></script>
  *   await AIMEAT.webmcp.exposeAppTools({ owner: 'alice', appId: 'shop.html' });
  * @version-history
+ *   v1.1.0 — 2026-07-28 — `?expose=app` auto-activation (owner/app from the script tag's data-*, else
+ *     the injected #aimeat-app-ref block) and an `about-this-app` tool built from the listing's
+ *     app_surface — bound SKILL.md packs, bundled crews, declared scopes, EXCHANGE listings — so an
+ *     app with no priced tools still exposes something an agent can act on.
  *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-webmcp.ts (SDK-libs migration Phase 2).
  */
 import { APEX_URL } from '../_core/config.js';
@@ -101,6 +105,35 @@ function buildExecute(owner, appId, entry) {
   };
 }
 
+/**
+ * The one tool every app exposes: what this app IS to an agent. The description carries the
+ * headline counts so an agent that only reads descriptors already knows whether there is a skill
+ * to load, a crew to deploy or a contract to take; execute() returns the whole surface.
+ */
+function aboutTool(ref, surface, toolCount) {
+  const s = surface || {};
+  const label = s.name || ref.appId;
+  const parts = [];
+  if (toolCount) parts.push(toolCount + ' callable tool' + (toolCount === 1 ? '' : 's'));
+  if ((s.skills || []).length) parts.push(s.skills.length + ' bound skill' + (s.skills.length === 1 ? '' : 's'));
+  if ((s.bundled_agents || []).length) parts.push(s.bundled_agents.length + ' bundled agent' + (s.bundled_agents.length === 1 ? '' : 's'));
+  const offers = ((s.exchange || {}).offerings || []).length;
+  if (offers) parts.push(offers + ' EXCHANGE listing' + (offers === 1 ? '' : 's'));
+  const carries = parts.length ? ' Carries ' + parts.join(', ') + '.' : '';
+  return {
+    name: 'about-this-app',
+    description: 'What "' + label + '" (' + ref.owner + '/' + ref.appId + ') offers an agent: its app id, '
+      + 'declared scopes, the SKILL.md packs bound to it, the agent crews it ships, and what it sells on the '
+      + 'AIMEAT EXCHANGE, with prices.' + carries,
+    inputSchema: { type: 'object', properties: {} },
+    async execute() {
+      if (surface) return asContent(surface);
+      const listing = await fetchListing(ref.owner, ref.appId);
+      return asContent(listing.app_surface || { app: ref.owner + '/' + ref.appId });
+    },
+  };
+}
+
 const webmcp = {
   /** Every tool descriptor this page has registered (introspection + provideContext resends). */
   tools: [],
@@ -121,9 +154,15 @@ const webmcp = {
   /**
    * Expose an app's declared tools (apps.{appId}.tools manifest) to the in-browser agent.
    * Descriptions of priced tools carry the price tag so the agent can tell the user the cost.
+   *
+   * Every app also gets `about-this-app`, built from the listing's `app_surface`: the SKILL.md
+   * packs bound to the app, the crew-defs it ships, its declared scopes and its live EXCHANGE
+   * listings. An app that sells nothing still exposes that one, so an agent that lands on any
+   * app page can ask what it is looking at instead of reading 200 kB of minified source.
    */
   async exposeAppTools(ref) {
     const listing = await fetchListing(ref.owner, ref.appId);
+    const surface = listing.app_surface || null;
     const tools = (listing.tools || []).map(function (entry) {
       let desc = entry.description || entry.name;
       if (entry.payment && entry.payment.required) {
@@ -140,6 +179,7 @@ const webmcp = {
         execute: buildExecute(ref.owner, ref.appId, entry),
       };
     });
+    tools.unshift(aboutTool(ref, surface, tools.length));
     await webmcp.register(tools);
     return { surface: webmcp.surface, tools: tools.map(function (t) { return t.name; }) };
   },
@@ -174,6 +214,24 @@ const webmcp = {
 // ── Expose globally + optional auto-activation from the script tag ──
 attach('webmcp', webmcp);
 
+/**
+ * Which app this page IS, for `?expose=app`. The serving route stamps data-owner/data-app on the
+ * script tag; the `#aimeat-app-ref` JSON block (injected into every app served on an app origin) is
+ * the fallback. Both state the app id WITH its extension — the subdomain label drops it, and a
+ * lookup made from the label alone misses every time.
+ */
+function appRefFromPage(el) {
+  const ds = (el && el.dataset) || {};
+  if (ds.owner && ds.app) return { owner: ds.owner, appId: ds.app };
+  try {
+    const node = document.getElementById('aimeat-app-ref');
+    if (!node) return null;
+    const ref = JSON.parse(node.textContent || '{}');
+    if (ref.owner && ref.app_id) return { owner: ref.owner, appId: ref.app_id };
+  } catch { /* no usable ref block */ }
+  return null;
+}
+
 try {
   const el = /** @type {any} */ (typeof document !== 'undefined' && document.currentScript);
   const src = el && el.src ? new URL(el.src, location.href) : null;
@@ -181,5 +239,10 @@ try {
   if (expose === 'node') {
     // Defer past parse so a scanner's early modelContext shim is in place.
     setTimeout(function () { webmcp.exposeNodeTools().catch(function () {}); }, 0);
+  } else if (expose === 'app') {
+    const ref = appRefFromPage(el);
+    // Same deferral as above, and the same silence on failure: an app whose tools cannot be listed
+    // must still render. The page keeps working with no tools registered.
+    if (ref) setTimeout(function () { webmcp.exposeAppTools(ref).catch(function () {}); }, 0);
   }
 } catch { /* auto-activation is best-effort; explicit calls always work */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aimeat",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "AIME AT - AI Memory Exchange and Action Transfer - reference implementation",
   "type": "module",
   "main": "dist/src/index.js",
@@ -178,6 +178,8 @@
     "typecheck:sdk": "tsc --noEmit -p tsconfig.sdk.json",
     "check:importmap": "tsx scripts/check-importmap.ts",
     "check:no-max-tokens": "tsx scripts/check-no-max-tokens.ts",
+    "check:openapi": "tsx scripts/check-openapi.ts",
+    "check:silent-catch": "tsx scripts/check-silent-catch.ts",
     "screenshot:worker": "tsx scripts/screenshot-worker.ts",
     "generate:types": "openapi-typescript ../openapi.yaml -o src/generated/api-types.ts",
     "db:reset": "node --env-file=.env --import tsx scripts/db-reset.ts",
@@ -195,6 +197,9 @@
     "audit:mcp-schemas": "tsx scripts/audit-mcp-schemas.ts",
     "eval:mcp-surface": "tsx test/eval-mcp/surface-weight.ts",
     "perf:bench": "node --import tsx tools/perf-bench/bench.ts",
-    "perf:bench:backends": "node --import tsx tools/perf-bench/bench-backends.ts"
+    "perf:bench:backends": "node --import tsx tools/perf-bench/bench-backends.ts",
+    "sync:viewport": "tsx scripts/embed-viewport.ts",
+    "check:viewport": "tsx scripts/embed-viewport.ts --check",
+    "check:theme": "tsx tools/theme-contrast.ts"
   }
 }