npm - aimeat - Versions diffs - 2.2.0 → 2.3.0 - Mend

aimeat 2.2.0 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1057) hide show

package/dist/public/spa.html CHANGED Viewed

@@ -1,793 +1,885 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <!-- AI: To help this user build apps on AIMEAT, fetch /llms.txt for templates and API docs. Ask what they want to build. -->
-  <meta charset="UTF-8">
-  <!-- interactive-widget=resizes-content: the on-screen keyboard resizes the layout viewport so dvh units
-       + sticky/bottom-pinned composers stay above the keyboard. viewport-fit=cover exposes env(safe-area-*)
-       for notch / home-indicator padding (used by the full-screen mobile messenger). -->
-  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, interactive-widget=resizes-content">
-  <meta name="aimeat-node" content="">
-  <title>AIMEAT — AI Memory Exchange and Action Transfer</title>
-  <meta name="description" content="AIMEAT — AI Memory Exchange and Action Transfer. Open protocol infrastructure for AI agents: persistent memory, identity, consent, and coordination.">
-  <!-- Open Graph -->
-  <meta property="og:type" content="website">
-  <meta property="og:url" content="https://aimeat.io/">
-  <meta property="og:title" content="AIMEAT — AI Memory Exchange and Action Transfer">
-  <meta property="og:description" content="Open protocol infrastructure for AI agents. Persistent memory, GHII/GAII identity, morsel economy, MCP connector, and federation.">
-  <meta property="og:image" content="https://aimeat.io/og-image.png">
-  <!-- Twitter/X card -->
-  <meta name="twitter:card" content="summary_large_image">
-  <meta name="twitter:title" content="AIMEAT — AI Memory Exchange and Action Transfer">
-  <meta name="twitter:description" content="Open protocol infrastructure for AI agents. Persistent memory, GHII/GAII identity, morsel economy, MCP connector, and federation.">
-  <meta name="twitter:image" content="https://aimeat.io/og-image.png">
-  <!-- Schema.org JSON-LD -->
-  <script type="application/ld+json">
-  {
-    "@context": "https://schema.org",
-    "@type": "SoftwareApplication",
-    "name": "AIMEAT",
-    "alternateName": "AI Memory Exchange and Action Transfer",
-    "url": "https://aimeat.io",
-    "description": "Open protocol infrastructure for AI agents: persistent memory, GHII/GAII identity, morsel economy, consent management, MCP connector, and federation.",
-    "applicationCategory": "DeveloperApplication",
-    "operatingSystem": "Any",
-    "offers": {
-      "@type": "Offer",
-      "price": "0",
-      "priceCurrency": "USD"
-    },
-    "sameAs": [
-      "https://github.com/miikkij/aimeat-protocol"
-    ]
-  }
-  </script>
-  <link rel="icon" href="/favicon.svg" type="image/svg+xml">
-  <link rel="manifest" href="/manifest.json">
-  <!-- WebMCP bridge (TARGET-034 phase C): registers node-level tools (commerce feed, node info)
-       on document/navigator.modelContext for in-browser agents + readiness scanners. No-op when
-       no agent API is present. -->
-  <script src="/v1/libs/aimeat-webmcp.js?expose=node" defer></script>
-  <meta name="theme-color" content="#FAFAF8">
-  <!-- No-flash theme boot: set data-theme on <html> before first paint.
-       Plain inline JS (NOT a module — modules defer and reintroduce the flash).
-       Unset key = follow OS until the user makes an explicit choice. -->
-  <script>
-    (function () {
-      try {
-        var stored = localStorage.getItem('aimeat-theme'); // 'light' | 'dark' | null
-        var theme = (stored === 'light' || stored === 'dark')
-          ? stored
-          : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
-        document.documentElement.dataset.theme = theme;
-      } catch (e) {
-        document.documentElement.dataset.theme = 'light';
-      }
-    })();
-  </script>
-  <link href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,300;0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;0,9..40,800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="/css/theme.css">
-  <!-- Canonical styles for the shared <Markdown> component — load before views so it styles
-       rendered markdown everywhere the component is used (no per-view re-definition). -->
-  <link rel="stylesheet" href="/css/components/markdown.css">
-  <link rel="stylesheet" href="/css/components/contact-picker.css">
-  <link rel="stylesheet" href="/css/components/app-sandbox.css">
-  <link rel="stylesheet" href="/css/views/app-grant.css">
-  <link rel="stylesheet" href="/css/views/invite-accept.css">
-  <!-- View CSS preloaded so they are ready before any view renders (prevents FOUC) -->
-  <!-- hrefs are stamped with ?v=BUILD_ID at serve time by portal.ts serveSpa() -->
-  <link rel="stylesheet" href="/css/views/portal.css">
-  <link rel="stylesheet" href="/css/views/landing.css">
-  <link rel="stylesheet" href="/css/views/portal-classic.css">
-  <link rel="stylesheet" href="/css/views/portal-dev.css">
-  <link rel="stylesheet" href="/css/views/profile.css">
-  <link rel="stylesheet" href="/css/views/notebook.css">
-  <link rel="stylesheet" href="/css/views/living.css">
-  <link rel="stylesheet" href="/css/views/offers.css">
-  <link rel="stylesheet" href="/css/views/calibrator.css">
-  <link rel="stylesheet" href="/css/views/aimeat-os.css">
-  <link rel="stylesheet" href="/css/views/portfolio.css">
-  <link rel="stylesheet" href="/css/views/members.css">
-  <link rel="stylesheet" href="/css/views/inbox.css">
-  <link rel="stylesheet" href="/css/components/tags.css">
-  <link rel="stylesheet" href="/css/components/image-deliverable.css">
-  <link rel="stylesheet" href="/css/views/help.css">
-  <link rel="stylesheet" href="/css/views/my-company.css">
-  <link rel="stylesheet" href="/css/views/companies.css">
-  <link rel="stylesheet" href="/css/views/capabilities.css">
-  <link rel="stylesheet" href="/css/views/agents-detail.css">
-  <link rel="stylesheet" href="/css/views/scheduler.css">
-  <link rel="stylesheet" href="/css/views/workflows.css">
-  <link rel="stylesheet" href="/css/views/admin.css">
-  <link rel="stylesheet" href="/css/views/admin-agent-integration.css">
-  <link rel="stylesheet" href="/css/views/public-knowledge-viewer.css">
-  <link rel="stylesheet" href="/css/views/public-workspace-viewer.css">
-  <link rel="stylesheet" href="/css/views/start.css">
-  <script type="importmap">
-  {
-    "imports": {
-      "preact": "/lib/preact.mjs",
-      "preact/hooks": "/lib/preact-hooks.mjs",
-      "htm": "/lib/htm.mjs",
-      "/js/i18n.js": "/js/i18n.js",
-      "/js/theme.js": "/js/theme.js",
-      "/js/utils.js": "/js/utils.js",
-      "/js/app-sandbox.js": "/js/app-sandbox.js",
-      "/js/format.js": "/js/format.js",
-      "/js/api.js": "/js/api.js",
-      "/js/hooks.js": "/js/hooks.js",
-      "/js/recents.js": "/js/recents.js",
-      "/js/services/admin.js": "/js/services/admin.js",
-      "/js/services/agents.js": "/js/services/agents.js",
-      "/js/services/ecosystem.js": "/js/services/ecosystem.js",
-      "/js/services/apps.js": "/js/services/apps.js",
-      "/js/services/auth.js": "/js/services/auth.js",
-      "/js/services/boards.js": "/js/services/boards.js",
-      "/js/services/catalogue.js": "/js/services/catalogue.js",
-      "/js/services/consent.js": "/js/services/consent.js",
-      "/js/services/cortex.js": "/js/services/cortex.js",
-      "/js/services/extensions.js": "/js/services/extensions.js",
-      "/js/services/federation.js": "/js/services/federation.js",
-      "/js/services/calibrator.js": "/js/services/calibrator.js",
-      "/views/profile/calibrator-llm-editor.js": "/views/profile/calibrator-llm-editor.js",
-      "/views/profile/calibrator-chart.js": "/views/profile/calibrator-chart.js",
-      "/views/profile/calibrator-batch.js": "/views/profile/calibrator-batch.js",
-      "/js/services/knowledge.js": "/js/services/knowledge.js",
-      "/js/services/living.js": "/js/services/living.js",
-      "/js/services/skills.js": "/js/services/skills.js",
-      "/js/services/memory.js": "/js/services/memory.js",
-      "/js/services/notebook.js": "/js/services/notebook.js",
-      "/js/services/notebook-plan.js": "/js/services/notebook-plan.js",
-      "/js/services/nodes.js": "/js/services/nodes.js",
-      "/js/services/organisms.js": "/js/services/organisms.js",
-      "/js/services/offers.js": "/js/services/offers.js",
-      "/js/services/offers-grouping.js": "/js/services/offers-grouping.js",
-      "/js/services/packages.js": "/js/services/packages.js",
-      "/js/services/security.js": "/js/services/security.js",
-      "/js/services/stats.js": "/js/services/stats.js",
-      "/js/services/appdev.js": "/js/services/appdev.js",
-      "/js/services/wallet.js": "/js/services/wallet.js",
-      "/js/services/work.js": "/js/services/work.js",
-      "/js/services/messages.js": "/js/services/messages.js",
-      "/js/services/messages-ai-prompts.js": "/js/services/messages-ai-prompts.js",
-      "/js/services/unfurl.js": "/js/services/unfurl.js",
-      "/js/services/tracked-responses.js": "/js/services/tracked-responses.js",
-      "/js/services/presence.js": "/js/services/presence.js",
-      "/js/presence-store.js": "/js/presence-store.js",
-      "/js/components/auth-image.js": "/js/components/auth-image.js",
-      "/js/components/tag-cloud.js": "/js/components/tag-cloud.js",
-      "/js/components/tag-editor.js": "/js/components/tag-editor.js",
-      "/components/Modal.js": "/components/Modal.js",
-      "/components/useViewCSS.js": "/components/useViewCSS.js",
-      "/components/Markdown.js": "/components/Markdown.js",
-      "/components/LinkPreview.js": "/components/LinkPreview.js",
-      "/components/InboxLink.js": "/components/InboxLink.js",
-      "/components/JsonView.js": "/components/JsonView.js",
-      "/components/ImageDeliverable.js": "/components/ImageDeliverable.js",
-      "/components/offer-card-view.js": "/components/offer-card-view.js",
-      "/components/Mermaid.js": "/components/Mermaid.js",
-      "/components/NotificationBell.js": "/components/NotificationBell.js",
-      "/components/CopyButton.js": "/components/CopyButton.js",
-      "/components/Toast.js": "/components/Toast.js",
-      "/components/ContactCard.js": "/components/ContactCard.js",
-      "/components/Spinner.js": "/components/Spinner.js",
-      "/components/EmptyState.js": "/components/EmptyState.js",
-      "/components/ToggleSwitch.js": "/components/ToggleSwitch.js",
-      "/components/Card.js": "/components/Card.js",
-      "/components/StatusDot.js": "/components/StatusDot.js",
-      "/components/PresenceDot.js": "/components/PresenceDot.js",
-      "/components/TagList.js": "/components/TagList.js",
-      "/components/Pagination.js": "/components/Pagination.js",
-      "/components/KeyValueRow.js": "/components/KeyValueRow.js",
-      "/components/SearchBar.js": "/components/SearchBar.js",
-      "/components/DataTable.js": "/components/DataTable.js",
-      "/components/Collapsible.js": "/components/Collapsible.js",
-      "/components/UsageChart.js": "/components/UsageChart.js",
-      "/lib/live-updates.js": "/lib/live-updates.js",
-      "/lib/minidenticons.min.js": "/lib/minidenticons.min.js",
-      "/lib/yaml.mjs": "/lib/yaml.mjs",
-      "/views/profile/agents-tasks-subtab.js": "/views/profile/agents-tasks-subtab.js",
-      "/js/services/agent-tasks.js": "/js/services/agent-tasks.js",
-      "/js/services/agent-directives.js": "/js/services/agent-directives.js",
-      "/js/services/agent-capabilities.js": "/js/services/agent-capabilities.js",
-      "/views/profile/agents-capabilities-subtab.js": "/views/profile/agents-capabilities-subtab.js",
-      "/js/services/sharing-groups.js": "/js/services/sharing-groups.js",
-      "/js/services/agent-activity.js": "/js/services/agent-activity.js",
-      "/js/services/ledger.js": "/js/services/ledger.js",
-      "/views/profile/agents-activity-subtab.js": "/views/profile/agents-activity-subtab.js",
-      "/views/profile/agents-services-subtab.js": "/views/profile/agents-services-subtab.js",
-      "/views/profile/agents-messages-subtab.js": "/views/profile/agents-messages-subtab.js",
-      "/js/services/agent-services.js": "/js/services/agent-services.js",
-      "/js/services/agent-messages.js": "/js/services/agent-messages.js",
-      "/js/services/agent-integration.js": "/js/services/agent-integration.js",
-      "/js/services/admin-agent-integration.js": "/js/services/admin-agent-integration.js",
-      "/js/services/schedules.js": "/js/services/schedules.js",
-      "/js/services/workflows.js": "/js/services/workflows.js",
-      "/views/portfolio-themes.js": "/views/portfolio-themes.js",
-      "/views/my-company.payments.js": "/views/my-company.payments.js",
-      "/views/profile/shared.js": "/views/profile/shared.js",
-      "/views/profile/openrouter-settings.js": "/views/profile/openrouter-settings.js",
-      "/views/profile/organisms/helpers.js": "/views/profile/organisms/helpers.js",
-      "/views/profile/organisms/widgets.js": "/views/profile/organisms/widgets.js",
-      "/views/profile/organisms/panels.js": "/views/profile/organisms/panels.js",
-      "/views/profile/organisms/agents.js": "/views/profile/organisms/agents.js",
-      "/views/profile/organisms/members.js": "/views/profile/organisms/members.js",
-      "/views/profile/organisms/invite-panel.js": "/views/profile/organisms/invite-panel.js",
-      "/js/services/contacts.js": "/js/services/contacts.js",
-      "/components/ContactPicker.js": "/components/ContactPicker.js",
-      "/views/profile/organisms/home.js": "/views/profile/organisms/home.js",
-      "/views/profile/organisms/workspace-list.js": "/views/profile/organisms/workspace-list.js",
-      "/views/profile/organisms/workspace.js": "/views/profile/organisms/workspace.js",
-      "/views/profile/organisms/activity-panel.js": "/views/profile/organisms/activity-panel.js",
-      "/views/profile/organisms/participants-panel.js": "/views/profile/organisms/participants-panel.js",
-      "/views/profile/organisms/workspace-comments.js": "/views/profile/organisms/workspace-comments.js",
-      "/views/profile/organisms/sources-panel.js": "/views/profile/organisms/sources-panel.js",
-      "/views/profile/organisms/skills-panel.js": "/views/profile/organisms/skills-panel.js",
-      "/views/profile/skills-tab.js": "/views/profile/skills-tab.js",
-      "/views/profile/organisms/workspace-apps.js": "/views/profile/organisms/workspace-apps.js",
-      "/views/profile/organisms/schema-form.js": "/views/profile/organisms/schema-form.js",
-      "/views/profile/organisms/document.js": "/views/profile/organisms/document.js",
-      "/views/command-palette.js": "/views/command-palette.js",
-      "/views/profile/organisms/mindmap.js": "/views/profile/organisms/mindmap.js",
-      "/views/profile/organisms/readme-panel.js": "/views/profile/organisms/readme-panel.js",
-      "/views/profile/organisms/timeline-panel.js": "/views/profile/organisms/timeline-panel.js"
-    }
-  }
-  </script>
-</head>
-<body>
-  <!-- Background -->
-  <div class="bg-canvas" id="bgCanvas"></div>
-  <!-- Static H1 for crawlers — visually hidden, SPA renders the real UI -->
-  <h1 class="visually-hidden">AIMEAT — AI Memory Exchange and Action Transfer. Open protocol for AI agents: persistent memory, identity, app generation, and federated node networks.</h1>
-  <!-- App root (Preact mounts here) -->
-  <div id="app"></div>
-  <!-- SSO handoff: the desktop app already holds an authenticated owner JWT (from its inline
-       sign-in). It opens the portal with #handoff=<base64({owner,jwt})> so the browser is logged
-       in WITHOUT a second sign-in. Runs synchronously before the app reads the session. -->
-  <script>
-    (function () {
-      try {
-        var m = location.hash.match(/[#&]handoff=([^&]+)/);
-        if (!m) return;
-        var s = JSON.parse(atob(decodeURIComponent(m[1])));
-        if (s && s.jwt && s.owner) {
-          var node = '';
-          try { node = (JSON.parse(atob(s.jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))) || {}).node || ''; } catch (e) {}
-          localStorage.setItem('aimeat_session', JSON.stringify({
-            owner: s.owner, jwt: s.jwt, ghii: node ? (s.owner + '@' + node) : null, gaii: null,
-          }));
-        }
-        // Strip the token from the URL so it is not bookmarked or left in history.
-        history.replaceState(null, '', location.pathname + location.search);
-      } catch (e) { /* ignore a malformed handoff */ }
-    })();
-  </script>
-  <script type="module">
-    import { h, render, Component } from 'preact';
-    import { useState, useEffect, useCallback } from 'preact/hooks';
-    import htm from 'htm';
-    import { loadTranslations, t, getLocale, switchLocale, onLocaleChange } from '/js/i18n.js';
-    import { initThemeSystem } from '/js/theme.js';
-    import { NotificationBell, openNotificationLink } from '/components/NotificationBell.js';
-    import { CommandPalette } from '/views/command-palette.js';
-    import { openAppSandboxed, isAppHtmlUrl } from '/js/app-sandbox.js';
-    // generateStars no longer needed for light theme
-    const html = htm.bind(h);
-    // ── Notification cold-open deep link ──
-    // A push-notification click can open '/v1/profile?tab=messages#inbox/<conversationId>' (or
-    // the bell's '#<tab>[/<rest>]' hash form) in a fresh window. Prime the landing page's
-    // sessionStorage contract ({tabId, slot} JSON — landing-page.js openView init) BEFORE the
-    // view mounts, plus the inbox thread key that inbox-tab.js consumes on mount. Overwriting the
-    // saved tab matters: landing-page prefers sessionStorage over ?tab=, so a stale value from
-    // earlier browsing would otherwise beat the deep link in a reused browser tab.
-    (() => {
-      if (location.pathname !== '/v1/profile') return;
-      const m = /^#([a-z]+)(?:\/(.+))?$/i.exec(location.hash || '');
-      const rawTab = new URLSearchParams(location.search).get('tab') || (m ? m[1] : '');
-      if (!rawTab) return;
-      const tabId = rawTab.toLowerCase() === 'inbox' ? 'messages' : rawTab;
-      try {
-        sessionStorage.setItem('aimeat-profile-tab', JSON.stringify({ tabId, slot: 'main' }));
-        if (tabId === 'messages' && m && m[2]) sessionStorage.setItem('aimeat.inbox.open', m[2]);
-      } catch { /* private mode — ?tab= still lands the tab */ }
-    })();
-    // ── Error Boundary ──
-    class ErrorBoundary extends Component {
-      constructor(props) {
-        super(props);
-        this.state = { error: null };
-      }
-      static getDerivedStateFromError(error) {
-        return { error };
-      }
-      componentDidCatch(error, info) {
-        console.error('View render error:', error, info);
-      }
-      render() {
-        if (this.state.error) {
-          const retry = () => {
-            this.setState({ error: null });
-            if (this.props.onRetry) this.props.onRetry();
-          };
-          return html`
-            <div style="text-align:center; padding:3rem 1.5rem; color:var(--text-dim,#888);">
-              <h2 style="color:var(--text-bright,#fff); margin-bottom:0.5rem;">${t('common.somethingWentWrong')}</h2>
-              <p style="margin-bottom:1rem; font-size:0.9rem;">${this.state.error?.message || 'Unknown error'}</p>
-              <button class="btn-primary" onClick=${retry} style="animation:none;">${t('common.retry')}</button>
-            </div>
-          `;
-        }
-        return this.props.children;
-      }
-    }
-    // ── Route definitions ──
-    // window.__B is injected by the server as "?v=BUILD_ID" to bust the browser's
-    // ES module cache on every server restart (HTTP no-cache/ETag alone is
-    // insufficient — modules stay in the module registry for the full session).
-    const B = window.__B || '';
-    const ROUTES = {
-      // Landing/portal split (2026-06-10): the route serves the logged-out landing;
-      // logged-in visitors are forwarded to /v1/profile by the view itself. The old
-      // portal view stays reachable at /v1/classic (prompt boxes / "Build").
-      '/v1/portal':      () => import('/views/landing.js' + B),
-      '/v1/pricing':     () => import('/views/pricing.js' + B),
-      '/v1/start':       () => import('/views/start.js' + B),
-      '/v1/how-it-works': () => import('/views/how-it-works.js' + B),
-      '/v1/business':    () => import('/views/business.js' + B),
-      '/v1/profile':     () => import('/views/profile.js' + B),
-      '/v1/my-company':  () => import('/views/my-company.js' + B),
-      '/v1/companies':   () => import('/views/companies.js' + B),
-      '/v1/app-grant':   () => import('/views/app-grant.js' + B),
-      '/v1/invite':      () => import('/views/invite-accept.js' + B),
-      '/v1/aimeat-os':   () => import('/views/aimeat-os.js' + B),
-      '/v1/classic':     () => import('/views/portal-classic.js' + B),
-      '/v1/portfolio':   () => import('/views/portfolio.js' + B),
-      '/v1/members':     () => import('/views/members.js' + B),
-      '/v1/admin':       () => import('/views/admin.js' + B),
-      '/v1/help':        () => import('/views/help.js' + B),
-      '/v1/publicknowledgeviewer': () => import('/views/public-knowledge-viewer.js' + B),
-      '/v1/publicworkspaceviewer': () => import('/views/public-workspace-viewer.js' + B),
-    };
-    // Match route, handling query params for special views
-    function matchRoute(pathname, search) {
-      // Dev portal is ?view=dev on /v1/portal
-      if (pathname === '/v1/portal' && search.includes('view=dev')) {
-        return () => import('/views/portal-dev.js' + B);
-      }
-      // Single-agent pop-out window: /v1/profile?solo=<agentName>
-      if (pathname === '/v1/profile' && /[?&]solo=/.test(search)) {
-        return () => import('/views/agent-solo.js' + B);
-      }
-      // Single-document pop-out window: /v1/profile?doc=<org>:<ws>:<type>:<id>
-      if (pathname === '/v1/profile' && /[?&]doc=/.test(search)) {
-        return () => import('/views/doc-solo.js' + B);
-      }
-      // Portfolio public view: /v1/portfolio/<username>
-      if (pathname.startsWith('/v1/portfolio/') && pathname !== '/v1/portfolio/') {
-        return () => import('/views/portfolio.js' + B);
-      }
-      return ROUTES[pathname] || ROUTES['/v1/portal'];
-    }
-    // ── App Component ──
-    function App() {
-      const [View, setView] = useState(null);
-      const [viewError, setViewError] = useState(null);
-      const [locale, setLocale] = useState(getLocale());
-      // Navigate to a route
-      const navigate = useCallback(async (path, replace = false) => {
-        const url = new URL(path, window.location.origin);
-        const loader = matchRoute(url.pathname, url.search);
-        if (replace) {
-          history.replaceState(null, '', path);
-        } else {
-          history.pushState(null, '', path);
-        }
-        try {
-          setViewError(null);
-          const mod = await loader();
-          setView(() => mod.default);
-        } catch (err) {
-          console.error('Failed to load view:', err);
-          setViewError(err);
-          setView(null);
-        }
-      }, []);
-      // Push-notification interactions on an already-open window. The service worker (sw.js) focuses
-      // this window and posts either:
-      //   - 'aimeat-notification-click': the notification's target URL → deep-link it in place.
-      //   - 'aimeat-notification-action': an action button was pressed. A lock screen can't hold the
-      //     JWT, so the SW hands the action here to run with the owner's session. An 'api' action
-      //     (approve/deny/accept/decline) executes directly; 'reply'/'navigate' just deep-link so the
-      //     owner completes it in the SPA (a reply needs text we can't compose from a button).
-      useEffect(() => {
-        if (!('serviceWorker' in navigator)) return undefined;
-        const onSwMessage = async (e) => {
-          const d = e.data;
-          if (!d) return;
-          if (d.type === 'aimeat-notification-click' && d.url) { openNotificationLink(d.url, navigate); return; }
-          if (d.type === 'aimeat-notification-action' && d.action) {
-            const a = d.action;
-            if (a.kind === 'api' && a.endpoint) {
-              try {
-                const jwt = window.AIMEAT?.auth?.getSession?.()?.jwt;
-                if (jwt) {
-                  await fetch(a.endpoint, {
-                    method: a.method || 'POST',
-                    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
-                    body: a.body ? JSON.stringify(a.body) : undefined,
-                  });
-                  window.dispatchEvent(new CustomEvent('aimeat-live-update'));
-                }
-              } catch { /* best-effort; the target view still shows the current state */ }
-            }
-            // Land the owner on the notification's target so the result is visible in context.
-            if (d.url) openNotificationLink(d.url, navigate);
-          }
-        };
-        navigator.serviceWorker.addEventListener('message', onSwMessage);
-        return () => navigator.serviceWorker.removeEventListener('message', onSwMessage);
-      }, [navigate]);
-      // Initial load + popstate
-      useEffect(() => {
-        // Load initial route
-        const path = location.pathname + location.search;
-        navigate(path, true);
-        // Handle back/forward
-        const onPopState = () => {
-          const loader = matchRoute(location.pathname, location.search);
-          loader().then(mod => {
-            setViewError(null);
-            setView(() => mod.default);
-          }).catch(err => {
-            console.error('Popstate view load failed:', err);
-            setViewError(err);
-            setView(null);
-          });
-        };
-        window.addEventListener('popstate', onPopState);
-        // Intercept internal link clicks for SPA navigation
-        const onClick = (e) => {
-          const a = e.target.closest('a[href]');
-          if (!a) return;
-          const href = a.getAttribute('href');
-          // H-2: a published-app HTML link must NEVER open as a top-level document on the
-          // apex origin (same origin as this authenticated SPA) — it could read the
-          // visitor's session. Force it into a sandboxed, opaque-origin iframe instead,
-          // regardless of target=_blank / modifier keys.
-          if (isAppHtmlUrl(href)) {
-            e.preventDefault();
-            const label = (a.textContent || '').trim() || 'App';
-            openAppSandboxed(href, label);
-            return;
-          }
-          // Only intercept internal /v1/ links
-          if (!href || !href.startsWith('/v1/')) return;
-          if (e.ctrlKey || e.metaKey || e.shiftKey) return;
-          // Respect explicit new-tab / new-window targets — without this, an
-          // <a href="/v1/apps/.../launch?mode=inline" target="_blank"> from a
-          // child component would be hijacked, navigated in the same tab via
-          // matchRoute (which doesn't know /v1/apps/...), and dump the user
-          // back on the landing page.
-          const target = a.getAttribute('target');
-          if (target && target !== '_self' && target !== '') return;
-          if (a.hasAttribute('download')) return;
-          e.preventDefault();
-          navigate(href);
-        };
-        document.addEventListener('click', onClick);
-        return () => {
-          window.removeEventListener('popstate', onPopState);
-          document.removeEventListener('click', onClick);
-        };
-      }, [navigate]);
-      // Listen for locale changes
-      useEffect(() => {
-        return onLocaleChange((loc) => setLocale(loc));
-      }, []);
-      const retryView = useCallback(() => {
-        navigate(location.pathname + location.search, true);
-      }, [navigate]);
-      return html`
-        <${Header} navigate=${navigate} locale=${locale} />
-        <${CommandPalette} navigate=${navigate} />
-        <div class="page-content">
-          ${viewError
-            ? html`<div style="text-align:center; padding:3rem 1.5rem; color:var(--text-dim,#888);">
-                <h2 style="color:var(--text-bright,#fff); margin-bottom:0.5rem;">Failed to load page</h2>
-                <p style="margin-bottom:1rem; font-size:0.9rem;">${viewError.message || 'Network error'}</p>
-                <button class="btn-primary" onClick=${retryView} style="animation:none;">Retry</button>
-              </div>`
-            : View
-              ? html`<${ErrorBoundary} onRetry=${retryView}><${View} navigate=${navigate} locale=${locale} /></${ErrorBoundary}>`
-              : html`<div class="empty"><div class="spinner"></div></div>`
-          }
-        </div>
-      `;
-    }
-    // ── Theme Toggle ──
-    // The light/dark switch now lives INSIDE the golden login pill (served by libs.ts →
-    // mountLoginButton) so every app embedding the pill inherits it for free. theme.js still
-    // runs (initThemeSystem) to track OS preference and adopt the pill's theme changes.
-    // ── Header Component ──
-    // Built-in public links. Operators can show/hide and reorder these via the admin
-    // Portal tab (persisted at /v1/site/header-nav). Auth/role-gated links (Apps, Profile,
-    // Admin) are NOT in this list — they stay forced by the session/role checks below.
-    const PUBLIC_NAV_LINKS = [
-      { id: 'try',        path: '/v1/portal',          key: 'nav.try' },
-      { id: 'howItWorks', path: '/v1/how-it-works',    key: 'nav.howItWorks', fallback: 'How it works' },
-      { id: 'business',   path: '/v1/business',        key: 'nav.business',   fallback: 'For your business' },
-      { id: 'companies',  path: '/v1/companies',       key: 'nav.companies',  fallback: 'Companies' },
-      { id: 'members',    path: '/v1/members',         key: 'nav.members',    fallback: 'Members' },
-      { id: 'devView',    path: '/v1/portal?view=dev', key: 'nav.devView',    matchActive: false },
-      { id: 'help',       path: '/v1/help',            key: 'nav.help' },
-    ];
-    function Header({ navigate, locale }) {
-      const [session, setSession] = useState(null);
-      const [morsels, setMorsels] = useState(null);
-      const [menuOpen, setMenuOpen] = useState(false);
-      // Node feature flags from /v1/site/header-nav. Empty until the fetch resolves,
-      // so optional surfaces stay hidden until we positively learn they're enabled (no flash).
-      const [features, setFeatures] = useState({});
-      // Header nav config: { order, hidden }. Defaults to all visible in declared order
-      // until the public /v1/site/header-nav fetch resolves (no flash of empty nav).
-      const [navConfig, setNavConfig] = useState({ order: PUBLIC_NAV_LINKS.map(l => l.id), hidden: [] });
-      // Check auth state
-      useEffect(() => {
-        const checkAuth = () => {
-          if (window.AIMEAT?.auth?.hasSession) {
-            const s = window.AIMEAT.auth.getSession();
-            setSession(s);
-          } else {
-            setSession(null);
-          }
-        };
-        checkAuth();
-        // Re-check when auth lib fires events
-        window.addEventListener('aimeat-auth-change', checkAuth);
-        return () => window.removeEventListener('aimeat-auth-change', checkAuth);
-      }, []);
-      // Load operator-configured header nav (public endpoint, no auth needed).
-      useEffect(() => {
-        let cancelled = false;
-        fetch('/v1/site/header-nav')
-          .then(r => r.json())
-          .then(d => {
-            if (cancelled || !d?.ok || !d.data) return;
-            const order = Array.isArray(d.data.order) ? d.data.order : PUBLIC_NAV_LINKS.map(l => l.id);
-            const hidden = Array.isArray(d.data.hidden) ? d.data.hidden : [];
-            setNavConfig({ order, hidden });
-            setFeatures(d.data.features || {});
-          })
-          .catch(e => console.warn('Header nav fetch failed:', e.message));
-        return () => { cancelled = true; };
-      }, []);
-      // Fetch morsels when session is available
-      useEffect(() => {
-        if (!session) { setMorsels(null); return; }
-        fetch('/v1/wallet', {
-          headers: { 'Authorization': 'Bearer ' + session.jwt }
-        })
-          .then(r => r.json())
-          .then(d => { if (d.ok) setMorsels(d.data?.balance ?? null); })
-          .catch(e => console.warn('Wallet fetch failed:', e.message));
-      }, [session]);
-      const handleLangSwitch = (lang) => {
-        switchLocale(lang);
-      };
-      const handleNav = (e, path) => {
-        e.preventDefault();
-        // Mark in-app navigation: the landing redirects logged-in users to their Home
-        // ONLY on direct arrival (bookmark/external link), never when they deliberately
-        // navigated here from inside the app (e.g. the brand link).
-        try { sessionStorage.setItem('aimeat.in-app', '1'); } catch {}
-        navigate(path);
-      };
-      const currentPath = location.pathname;
-      // Resolve the public links to render: config order, minus hidden, by declared id.
-      const linkById = Object.fromEntries(PUBLIC_NAV_LINKS.map(l => [l.id, l]));
-      const hiddenSet = new Set(navConfig.hidden);
-      const visibleLinks = navConfig.order
-        .map(id => linkById[id])
-        .filter(l => l && !hiddenSet.has(l.id));
-      return html`
-        <nav class="topnav">
-          <div style="display:flex;align-items:center;gap:20px">
-            <a href="/v1/portal" class="topnav-brand" onClick=${(e) => handleNav(e, '/v1/portal')}>
-              AIME<span class="heart">\u2665</span><span class="brand-at">AT</span>
-            </a>
-            ${morsels !== null && html`<span class="brand-morsels" style="display:inline-flex">${morsels}</span>`}
-          </div>
-          <div class="topnav-right">
-            <button class="topnav-burger" aria-label="Menu" aria-expanded=${menuOpen ? 'true' : 'false'}
-              onClick=${() => setMenuOpen(o => !o)}>☰</button>
-            <div class="topnav-menu ${menuOpen ? 'open' : ''}">
-              <!-- Public links are operator-configurable (visibility + order) via the admin
-                   Portal tab. "Try it" leads to the landing's path cards + app gallery.
-                   Classic stays reachable deeper (landing card B "Start building"). -->
-              ${visibleLinks.map(link => html`
-                <a href="${link.path}" key=${link.id}
-                  onClick=${(e) => { handleNav(e, link.path); setMenuOpen(false); }}
-                  class="${link.matchActive !== false && currentPath === link.path ? 'active' : ''}">${t(link.key) || link.fallback || link.key}</a>
-              `)}
-              ${session && html`
-                <a href="/app-catalog.html" target="_blank" onClick=${() => setMenuOpen(false)} class="${currentPath === '/app-catalog.html' ? 'active' : ''}">${t('nav.apps') || 'Apps'}</a>
-                <a href="/v1/profile" class="profile-link visible ${currentPath === '/v1/profile' ? 'active' : ''}" onClick=${(e) => { handleNav(e, '/v1/profile'); setMenuOpen(false); }}>
-                  ${t('nav.profile')}
-                </a>
-                <a href="/v1/my-company" class="${currentPath === '/v1/my-company' ? 'active' : ''}" onClick=${(e) => { handleNav(e, '/v1/my-company'); setMenuOpen(false); }}>
-                  ${t('nav.myCompany')}
-                </a>
-                ${session.roles && session.roles.includes('operator') && html`
-                  <a href="/v1/admin" class="${currentPath === '/v1/admin' ? 'active' : ''}" onClick=${(e) => { handleNav(e, '/v1/admin'); setMenuOpen(false); }}>
-                    ${t('nav.admin')}
-                  </a>
-                `}
-              `}
-              <div class="topnav-center">
-                <button class="lang-btn ${locale === 'en' ? 'active' : ''}" onClick=${() => handleLangSwitch('en')}>EN</button>
-                <button class="lang-btn ${locale === 'fi' ? 'active' : ''}" onClick=${() => handleLangSwitch('fi')}>FI</button>
-              </div>
-            </div>
-            ${session && html`<${NotificationBell} t=${t} onNavigate=${(p) => navigate(p)} />`}
-            <span class="header-auth-slot" id="headerAuth"></span>
-          </div>
-        </nav>
-      `;
-    }
-    // ── Bootstrap ──
-    async function boot() {
-      // Load translations
-      await loadTranslations();
-      // Initialize theme system (head snippet already set the initial theme;
-      // this keeps meta in sync and tracks OS preference until an explicit choice).
-      initThemeSystem();
-      // Load auth library (served from /v1/libs/aimeat-auth.js)
-      await new Promise((resolve) => {
-        const script = document.createElement('script');
-        script.src = '/v1/libs/aimeat-auth.js';
-        script.onload = resolve;
-        script.onerror = resolve; // Continue even if auth fails
-        document.head.appendChild(script);
-      });
-      // Restore session from localStorage (critical for Ctrl+F5 / page reload)
-      if (window.AIMEAT?.auth?.login) {
-        try { await window.AIMEAT.auth.login(); } catch (_) {}
-      }
-      // Listen for session expiry — show notification and trigger re-login
-      if (window.AIMEAT?.auth?.on) {
-        window.AIMEAT.auth.on('expired', () => {
-          console.warn('[aimeat] Session expired — attempting re-login');
-          window.dispatchEvent(new Event('aimeat-auth-change'));
-          // Try silent re-login from stored credentials
-          if (window.AIMEAT.auth.login) {
-            window.AIMEAT.auth.login().then(session => {
-              if (session) {
-                window.dispatchEvent(new Event('aimeat-auth-change'));
-              } else {
-                // Show login UI if silent re-login fails
-                window.dispatchEvent(new CustomEvent('aimeat-session-expired'));
-              }
-            }).catch(() => {
-              window.dispatchEvent(new CustomEvent('aimeat-session-expired'));
-            });
-          }
-        });
-      }
-      // Mount Preact app
-      render(html`<${App} />`, document.getElementById('app'));
-      // Build i18n object for auth widget from modal.* translations
-      function authI18n() {
-        const keys = [
-          'descNew', 'descReturning', 'usernameLabel', 'usernamePlaceholder',
-          'passwordLabel', 'passwordPlaceholder', 'displayNameLabel', 'displayNameHint',
-          'displayNamePlaceholder', 'signInBtn', 'cancelBtn', 'orLabel', 'googleSignIn', 'working',
-          'errUserShort', 'errPassShort', 'errWrongPass', 'loggedIn', 'logoutBtn',
-          'forgotPassword', 'forgotUsername', 'resetPasswordTitle', 'resetPasswordDesc',
-          'sendResetCode', 'backToLogin', 'resetCodeSent', 'enterNewPasswordTitle',
-          'codeLabel', 'newPasswordLabel', 'newPasswordPlaceholder', 'errPassWeak',
-          'resetPassword', 'resetSuccess', 'recoverUsernameTitle', 'recoverUsernameDesc',
-          'emailLabel', 'sendUsername', 'usernameSent',
-          'completeAccountTitle', 'completeAccountDesc', 'completeAccountDescResend',
-          'sendVerificationCode', 'enterCodeTitle', 'enterCodeDesc', 'confirmAndSignIn',
-          'emailVerifiedSigningIn', 'errEmailInvalid', 'errCodeRequired',
-          'whyTitle', 'whyGhii', 'whyPrivacy', 'whyAgents', 'whyMorsels',
-        ];
-        const obj = {};
-        for (const k of keys) {
-          const v = t('modal.' + k);
-          if (v !== 'modal.' + k) obj[k] = v;
-        }
-        // Labels for the theme toggle that now lives inside the login pill.
-        obj.themeToDark = t('nav.themeToDark');
-        obj.themeToLight = t('nav.themeToLight');
-        return obj;
-      }
-      function mountAuth() {
-        try {
-          if (document.getElementById('headerAuth') && window.AIMEAT?.auth?.mountLoginButton) {
-            window.AIMEAT.auth.mountLoginButton('#headerAuth', {
-              onLogin: () => window.dispatchEvent(new Event('aimeat-auth-change')),
-              onLogout: () => window.dispatchEvent(new Event('aimeat-auth-change')),
-              i18n: authI18n(),
-            });
-          }
-        } catch (err) {
-          console.error('Auth mount failed:', err);
-        }
-      }
-      // Mount auth button after Preact renders
-      requestAnimationFrame(() => mountAuth());
-      // Re-mount auth button when locale changes
-      window.addEventListener('lang-change', () => requestAnimationFrame(() => mountAuth()));
-    }
-    boot().catch(err => {
-      console.error('Boot failed:', err);
-      const app = document.getElementById('app');
-      const wrap = document.createElement('div');
-      wrap.style.cssText = 'text-align:center;padding:3rem;color:#6B7280;font-family:DM Sans,system-ui';
-      const h = document.createElement('h2');
-      h.textContent = 'AIMEAT failed to start';
-      const p = document.createElement('p');
-      p.textContent = err.message || 'Unknown error';
-      const btn = document.createElement('button');
-      btn.textContent = 'Reload';
-      btn.style.cssText = 'margin-top:1rem;padding:0.6rem 1.5rem;background:linear-gradient(135deg,#E8564A,#FF6B6B);color:#fff;border:none;border-radius:10px;cursor:pointer;font-weight:700';
-      btn.onclick = () => location.reload();
-      wrap.appendChild(h);
-      wrap.appendChild(p);
-      wrap.appendChild(btn);
-      app.textContent = '';
-      app.appendChild(wrap);
-    });
-  </script>
-</body>
-</html>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <!-- AI: To help this user build apps on AIMEAT, fetch /llms.txt for templates and API docs. Ask what they want to build. -->
+  <meta charset="UTF-8">
+  <!-- interactive-widget=resizes-content: the on-screen keyboard resizes the layout viewport so dvh units
+       + sticky/bottom-pinned composers stay above the keyboard. viewport-fit=cover exposes env(safe-area-*)
+       for notch / home-indicator padding (used by the full-screen mobile messenger). -->
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover, interactive-widget=resizes-content">
+  <meta name="aimeat-node" content="">
+  <title>AIMEAT — AI Memory Exchange and Action Transfer</title>
+  <meta name="description" content="AIMEAT — AI Memory Exchange and Action Transfer. Open protocol infrastructure for AI agents: persistent memory, identity, consent, and coordination.">
+  <!-- Open Graph -->
+  <meta property="og:type" content="website">
+  <meta property="og:url" content="https://aimeat.io/">
+  <meta property="og:title" content="AIMEAT — AI Memory Exchange and Action Transfer">
+  <meta property="og:description" content="Open protocol infrastructure for AI agents. Persistent memory, GHII/GAII identity, morsel economy, MCP connector, and federation.">
+  <meta property="og:image" content="https://aimeat.io/og-image.png">
+  <!-- Twitter/X card -->
+  <meta name="twitter:card" content="summary_large_image">
+  <meta name="twitter:title" content="AIMEAT — AI Memory Exchange and Action Transfer">
+  <meta name="twitter:description" content="Open protocol infrastructure for AI agents. Persistent memory, GHII/GAII identity, morsel economy, MCP connector, and federation.">
+  <meta name="twitter:image" content="https://aimeat.io/og-image.png">
+  <!-- Schema.org JSON-LD -->
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "SoftwareApplication",
+    "name": "AIMEAT",
+    "alternateName": "AI Memory Exchange and Action Transfer",
+    "url": "https://aimeat.io",
+    "description": "Open protocol infrastructure for AI agents: persistent memory, GHII/GAII identity, morsel economy, consent management, MCP connector, and federation.",
+    "applicationCategory": "DeveloperApplication",
+    "operatingSystem": "Any",
+    "offers": {
+      "@type": "Offer",
+      "price": "0",
+      "priceCurrency": "USD"
+    },
+    "sameAs": [
+      "https://github.com/miikkij/aimeat-protocol"
+    ]
+  }
+  </script>
+  <link rel="icon" href="/favicon.svg" type="image/svg+xml">
+  <link rel="manifest" href="/manifest.json">
+  <!-- WebMCP bridge (TARGET-034 phase C): registers node-level tools (commerce feed, node info)
+       on document/navigator.modelContext for in-browser agents + readiness scanners. No-op when
+       no agent API is present. -->
+  <script src="/v1/libs/aimeat-webmcp.js?expose=node" defer></script>
+  <meta name="theme-color" content="#FAFAF8">
+  <!-- No-flash theme boot: set data-theme on <html> before first paint.
+       Plain inline JS (NOT a module — modules defer and reintroduce the flash).
+       Unset key = follow OS until the user makes an explicit choice. -->
+  <script>
+    (function () {
+      try {
+        var stored = localStorage.getItem('aimeat-theme'); // 'light' | 'dark' | null
+        var theme = (stored === 'light' || stored === 'dark')
+          ? stored
+          : (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
+        document.documentElement.dataset.theme = theme;
+      } catch (e) {
+        document.documentElement.dataset.theme = 'light';
+      }
+    })();
+  </script>
+  <link href="https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,300;0,9..40,400;0,9..40,500;0,9..40,600;0,9..40,700;0,9..40,800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/css/theme.css">
+  <!-- Canonical styles for the shared <Markdown> component — load before views so it styles
+       rendered markdown everywhere the component is used (no per-view re-definition). -->
+  <link rel="stylesheet" href="/css/components/markdown.css">
+  <link rel="stylesheet" href="/css/components/contact-picker.css">
+  <link rel="stylesheet" href="/css/components/app-sandbox.css">
+  <link rel="stylesheet" href="/css/views/app-grant.css">
+  <link rel="stylesheet" href="/css/views/invite-accept.css">
+  <!-- View CSS preloaded so they are ready before any view renders (prevents FOUC) -->
+  <!-- hrefs are stamped with ?v=BUILD_ID at serve time by portal.ts serveSpa() -->
+  <link rel="stylesheet" href="/css/views/portal.css">
+  <link rel="stylesheet" href="/css/views/landing.css">
+  <link rel="stylesheet" href="/css/views/portal-classic.css">
+  <link rel="stylesheet" href="/css/views/portal-dev.css">
+  <link rel="stylesheet" href="/css/views/profile.css">
+  <link rel="stylesheet" href="/css/views/notebook.css">
+  <link rel="stylesheet" href="/css/views/living.css">
+  <link rel="stylesheet" href="/css/views/offers.css">
+  <link rel="stylesheet" href="/css/views/calibrator.css">
+  <link rel="stylesheet" href="/css/views/aimeat-os.css">
+  <link rel="stylesheet" href="/css/views/portfolio.css">
+  <link rel="stylesheet" href="/css/views/members.css">
+  <link rel="stylesheet" href="/css/views/inbox.css">
+  <link rel="stylesheet" href="/css/components/tags.css">
+  <link rel="stylesheet" href="/css/components/image-deliverable.css">
+  <link rel="stylesheet" href="/css/views/help.css">
+  <link rel="stylesheet" href="/css/views/capabilities.css">
+  <link rel="stylesheet" href="/css/views/agents-detail.css">
+  <link rel="stylesheet" href="/css/views/scheduler.css">
+  <link rel="stylesheet" href="/css/views/workflows.css">
+  <link rel="stylesheet" href="/css/views/admin.css">
+  <link rel="stylesheet" href="/css/views/admin-agent-integration.css">
+  <link rel="stylesheet" href="/css/views/public-knowledge-viewer.css">
+  <link rel="stylesheet" href="/css/views/public-workspace-viewer.css">
+  <link rel="stylesheet" href="/css/views/start.css">
+  <script type="importmap">
+  {
+    "imports": {
+      "preact": "/lib/preact.mjs",
+      "preact/hooks": "/lib/preact-hooks.mjs",
+      "htm": "/lib/htm.mjs",
+      "/js/i18n.js": "/js/i18n.js",
+      "/js/swallowed.js": "/js/swallowed.js",
+      "/js/site.js": "/js/site.js",
+      "/js/theme.js": "/js/theme.js",
+      "/js/utils.js": "/js/utils.js",
+      "/js/app-sandbox.js": "/js/app-sandbox.js",
+      "/js/format.js": "/js/format.js",
+      "/js/api.js": "/js/api.js",
+      "/js/hooks.js": "/js/hooks.js",
+      "/js/recents.js": "/js/recents.js",
+      "/js/services/admin.js": "/js/services/admin.js",
+      "/js/services/agents.js": "/js/services/agents.js",
+      "/js/services/ecosystem.js": "/js/services/ecosystem.js",
+      "/js/services/apps.js": "/js/services/apps.js",
+      "/js/services/auth.js": "/js/services/auth.js",
+      "/js/services/boards.js": "/js/services/boards.js",
+      "/js/services/catalogue.js": "/js/services/catalogue.js",
+      "/js/services/consent.js": "/js/services/consent.js",
+      "/js/services/cortex.js": "/js/services/cortex.js",
+      "/js/services/extensions.js": "/js/services/extensions.js",
+      "/js/services/federation.js": "/js/services/federation.js",
+      "/js/services/calibrator.js": "/js/services/calibrator.js",
+      "/views/profile/calibrator-llm-editor.js": "/views/profile/calibrator-llm-editor.js",
+      "/views/profile/calibrator-chart.js": "/views/profile/calibrator-chart.js",
+      "/views/profile/calibrator-batch.js": "/views/profile/calibrator-batch.js",
+      "/js/services/knowledge.js": "/js/services/knowledge.js",
+      "/js/services/living.js": "/js/services/living.js",
+      "/js/services/skills.js": "/js/services/skills.js",
+      "/js/services/memory.js": "/js/services/memory.js",
+      "/js/services/notebook.js": "/js/services/notebook.js",
+      "/js/services/notebook-plan.js": "/js/services/notebook-plan.js",
+      "/js/services/nodes.js": "/js/services/nodes.js",
+      "/js/services/organisms.js": "/js/services/organisms.js",
+      "/js/services/offers.js": "/js/services/offers.js",
+      "/js/services/offers-grouping.js": "/js/services/offers-grouping.js",
+      "/js/services/packages.js": "/js/services/packages.js",
+      "/js/services/security.js": "/js/services/security.js",
+      "/js/services/stats.js": "/js/services/stats.js",
+      "/js/services/appdev.js": "/js/services/appdev.js",
+      "/js/services/wallet.js": "/js/services/wallet.js",
+      "/js/services/work.js": "/js/services/work.js",
+      "/js/services/messages.js": "/js/services/messages.js",
+      "/js/services/messages-ai-prompts.js": "/js/services/messages-ai-prompts.js",
+      "/js/services/unfurl.js": "/js/services/unfurl.js",
+      "/js/services/tracked-responses.js": "/js/services/tracked-responses.js",
+      "/js/services/presence.js": "/js/services/presence.js",
+      "/js/presence-store.js": "/js/presence-store.js",
+      "/js/components/auth-image.js": "/js/components/auth-image.js",
+      "/js/components/tag-cloud.js": "/js/components/tag-cloud.js",
+      "/js/components/tag-editor.js": "/js/components/tag-editor.js",
+      "/components/Modal.js": "/components/Modal.js",
+      "/components/useViewCSS.js": "/components/useViewCSS.js",
+      "/components/Markdown.js": "/components/Markdown.js",
+      "/components/LinkPreview.js": "/components/LinkPreview.js",
+      "/components/InboxLink.js": "/components/InboxLink.js",
+      "/components/JsonView.js": "/components/JsonView.js",
+      "/components/ImageDeliverable.js": "/components/ImageDeliverable.js",
+      "/components/offer-card-view.js": "/components/offer-card-view.js",
+      "/components/Mermaid.js": "/components/Mermaid.js",
+      "/components/NotificationBell.js": "/components/NotificationBell.js",
+      "/components/CopyButton.js": "/components/CopyButton.js",
+      "/components/Toast.js": "/components/Toast.js",
+      "/components/ContactCard.js": "/components/ContactCard.js",
+      "/components/Spinner.js": "/components/Spinner.js",
+      "/components/EmptyState.js": "/components/EmptyState.js",
+      "/components/ToggleSwitch.js": "/components/ToggleSwitch.js",
+      "/components/Card.js": "/components/Card.js",
+      "/components/StatusDot.js": "/components/StatusDot.js",
+      "/components/PresenceDot.js": "/components/PresenceDot.js",
+      "/components/TagList.js": "/components/TagList.js",
+      "/components/Pagination.js": "/components/Pagination.js",
+      "/components/KeyValueRow.js": "/components/KeyValueRow.js",
+      "/components/SearchBar.js": "/components/SearchBar.js",
+      "/components/DataTable.js": "/components/DataTable.js",
+      "/components/Collapsible.js": "/components/Collapsible.js",
+      "/components/UsageChart.js": "/components/UsageChart.js",
+      "/lib/live-updates.js": "/lib/live-updates.js",
+      "/lib/minidenticons.min.js": "/lib/minidenticons.min.js",
+      "/lib/yaml.mjs": "/lib/yaml.mjs",
+      "/views/profile/agents-tasks-subtab.js": "/views/profile/agents-tasks-subtab.js",
+      "/js/services/agent-tasks.js": "/js/services/agent-tasks.js",
+      "/js/services/agent-directives.js": "/js/services/agent-directives.js",
+      "/js/services/agent-capabilities.js": "/js/services/agent-capabilities.js",
+      "/views/profile/agents-capabilities-subtab.js": "/views/profile/agents-capabilities-subtab.js",
+      "/js/services/sharing-groups.js": "/js/services/sharing-groups.js",
+      "/js/services/agent-activity.js": "/js/services/agent-activity.js",
+      "/js/services/ledger.js": "/js/services/ledger.js",
+      "/views/profile/agents-activity-subtab.js": "/views/profile/agents-activity-subtab.js",
+      "/views/profile/agents-services-subtab.js": "/views/profile/agents-services-subtab.js",
+      "/views/profile/agents-messages-subtab.js": "/views/profile/agents-messages-subtab.js",
+      "/js/services/agent-services.js": "/js/services/agent-services.js",
+      "/js/services/agent-messages.js": "/js/services/agent-messages.js",
+      "/js/services/agent-integration.js": "/js/services/agent-integration.js",
+      "/js/services/admin-agent-integration.js": "/js/services/admin-agent-integration.js",
+      "/js/services/schedules.js": "/js/services/schedules.js",
+      "/js/services/workflows.js": "/js/services/workflows.js",
+      "/views/profile/shared.js": "/views/profile/shared.js",
+      "/views/profile/openrouter-settings.js": "/views/profile/openrouter-settings.js",
+      "/views/profile/organisms/helpers.js": "/views/profile/organisms/helpers.js",
+      "/views/profile/organisms/widgets.js": "/views/profile/organisms/widgets.js",
+      "/views/profile/organisms/panels.js": "/views/profile/organisms/panels.js",
+      "/views/profile/organisms/agents.js": "/views/profile/organisms/agents.js",
+      "/views/profile/organisms/members.js": "/views/profile/organisms/members.js",
+      "/views/profile/organisms/invite-panel.js": "/views/profile/organisms/invite-panel.js",
+      "/js/services/contacts.js": "/js/services/contacts.js",
+      "/components/ContactPicker.js": "/components/ContactPicker.js",
+      "/views/profile/organisms/home.js": "/views/profile/organisms/home.js",
+      "/views/profile/organisms/workspace-list.js": "/views/profile/organisms/workspace-list.js",
+      "/views/profile/organisms/workspace.js": "/views/profile/organisms/workspace.js",
+      "/views/profile/organisms/activity-panel.js": "/views/profile/organisms/activity-panel.js",
+      "/views/profile/organisms/participants-panel.js": "/views/profile/organisms/participants-panel.js",
+      "/views/profile/organisms/workspace-comments.js": "/views/profile/organisms/workspace-comments.js",
+      "/views/profile/organisms/sources-panel.js": "/views/profile/organisms/sources-panel.js",
+      "/views/profile/organisms/skills-panel.js": "/views/profile/organisms/skills-panel.js",
+      "/views/profile/skills-tab.js": "/views/profile/skills-tab.js",
+      "/views/profile/organisms/workspace-apps.js": "/views/profile/organisms/workspace-apps.js",
+      "/views/profile/organisms/schema-form.js": "/views/profile/organisms/schema-form.js",
+      "/views/profile/organisms/document.js": "/views/profile/organisms/document.js",
+      "/views/command-palette.js": "/views/command-palette.js",
+      "/views/profile/organisms/mindmap.js": "/views/profile/organisms/mindmap.js",
+      "/views/profile/organisms/readme-panel.js": "/views/profile/organisms/readme-panel.js",
+      "/views/profile/organisms/timeline-panel.js": "/views/profile/organisms/timeline-panel.js"
+    }
+  }
+  </script>
+</head>
+<body>
+  <!-- Background -->
+  <div class="bg-canvas" id="bgCanvas"></div>
+  <!-- Static H1 for crawlers — visually hidden, SPA renders the real UI -->
+  <h1 class="visually-hidden">AIMEAT — AI Memory Exchange and Action Transfer. Open protocol for AI agents: persistent memory, identity, app generation, and federated node networks.</h1>
+  <!-- App root (Preact mounts here) -->
+  <div id="app"></div>
+  <!-- SSO handoff: the desktop app already holds an authenticated owner JWT (from its inline
+       sign-in). It opens the portal with #handoff=<base64({owner,jwt})> so the browser is logged
+       in WITHOUT a second sign-in. Runs synchronously before the app reads the session. -->
+  <script>
+    (function () {
+      try {
+        var m = location.hash.match(/[#&]handoff=([^&]+)/);
+        if (!m) return;
+        var s = JSON.parse(atob(decodeURIComponent(m[1])));
+        if (s && s.jwt && s.owner) {
+          var node = '';
+          try { node = (JSON.parse(atob(s.jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))) || {}).node || ''; } catch (e) {}
+          localStorage.setItem('aimeat_session', JSON.stringify({
+            owner: s.owner, jwt: s.jwt, ghii: node ? (s.owner + '@' + node) : null, gaii: null,
+          }));
+        }
+        // Strip the token from the URL so it is not bookmarked or left in history.
+        history.replaceState(null, '', location.pathname + location.search);
+      } catch (e) { /* ignore a malformed handoff */ }
+    })();
+  </script>
+  <script type="module">
+    import { h, render, Component } from 'preact';
+    import { useState, useEffect, useCallback, useRef } from 'preact/hooks';
+    import htm from 'htm';
+    import { loadTranslations, t, getLocale, switchLocale, onLocaleChange } from '/js/i18n.js';
+    import { initThemeSystem } from '/js/theme.js';
+    import { siteLink } from '/js/site.js';
+    import { NotificationBell, openNotificationLink } from '/components/NotificationBell.js';
+    import { CommandPalette } from '/views/command-palette.js';
+    import { openAppSandboxed, isAppHtmlUrl } from '/js/app-sandbox.js';
+    // generateStars no longer needed for light theme
+    const html = htm.bind(h);
+    // ── Notification cold-open deep link ──
+    // A push-notification click can open '/v1/profile?tab=messages#inbox/<conversationId>' (or
+    // the bell's '#<tab>[/<rest>]' hash form) in a fresh window. Prime the landing page's
+    // sessionStorage contract ({tabId, slot} JSON — landing-page.js openView init) BEFORE the
+    // view mounts, plus the inbox thread key that inbox-tab.js consumes on mount. Overwriting the
+    // saved tab matters: landing-page prefers sessionStorage over ?tab=, so a stale value from
+    // earlier browsing would otherwise beat the deep link in a reused browser tab.
+    (() => {
+      if (location.pathname !== '/v1/profile') return;
+      const m = /^#([a-z]+)(?:\/(.+))?$/i.exec(location.hash || '');
+      const rawTab = new URLSearchParams(location.search).get('tab') || (m ? m[1] : '');
+      if (!rawTab) return;
+      const tabId = rawTab.toLowerCase() === 'inbox' ? 'messages' : rawTab;
+      try {
+        sessionStorage.setItem('aimeat-profile-tab', JSON.stringify({ tabId, slot: 'main' }));
+        if (tabId === 'messages' && m && m[2]) sessionStorage.setItem('aimeat.inbox.open', m[2]);
+      } catch { /* private mode — ?tab= still lands the tab */ }
+    })();
+    // ── Error Boundary ──
+    class ErrorBoundary extends Component {
+      constructor(props) {
+        super(props);
+        this.state = { error: null };
+      }
+      static getDerivedStateFromError(error) {
+        return { error };
+      }
+      componentDidCatch(error, info) {
+        console.error('View render error:', error, info);
+      }
+      render() {
+        if (this.state.error) {
+          const retry = () => {
+            this.setState({ error: null });
+            if (this.props.onRetry) this.props.onRetry();
+          };
+          return html`
+            <div style="text-align:center; padding:3rem 1.5rem; color:var(--text-dim,#888);">
+              <h2 style="color:var(--text-bright,#fff); margin-bottom:0.5rem;">${t('common.somethingWentWrong')}</h2>
+              <p style="margin-bottom:1rem; font-size:0.9rem;">${this.state.error?.message || 'Unknown error'}</p>
+              <button class="btn-primary" onClick=${retry} style="animation:none;">${t('common.retry')}</button>
+            </div>
+          `;
+        }
+        return this.props.children;
+      }
+    }
+    // ── Route definitions ──
+    // window.__B is injected by the server as "?v=BUILD_ID" to bust the browser's
+    // ES module cache on every server restart (HTTP no-cache/ETag alone is
+    // insufficient — modules stay in the module registry for the full session).
+    const B = window.__B || '';
+    const ROUTES = {
+      // Landing/portal split (2026-06-10): the route serves the logged-out landing;
+      // logged-in visitors are forwarded to /v1/profile by the view itself. The old
+      // portal view stays reachable at /v1/classic (prompt boxes / "Build").
+      '/v1/portal':      () => import('/views/landing.js' + B),
+      '/v1/pricing':     () => import('/views/pricing.js' + B),
+      '/v1/start':       () => import('/views/start.js' + B),
+      '/v1/how-it-works': () => import('/views/how-it-works.js' + B),
+      '/v1/business':    () => import('/views/business.js' + B),
+      '/v1/profile':     () => import('/views/profile.js' + B),
+      '/v1/app-grant':   () => import('/views/app-grant.js' + B),
+      '/v1/invite':      () => import('/views/invite-accept.js' + B),
+      '/v1/aimeat-os':   () => import('/views/aimeat-os.js' + B),
+      '/v1/classic':     () => import('/views/portal-classic.js' + B),
+      '/v1/portfolio':   () => import('/views/portfolio.js' + B),
+      '/v1/members':     () => import('/views/members.js' + B),
+      '/v1/admin':       () => import('/views/admin.js' + B),
+      '/v1/help':        () => import('/views/help.js' + B),
+      '/v1/publicknowledgeviewer': () => import('/views/public-knowledge-viewer.js' + B),
+      '/v1/publicworkspaceviewer': () => import('/views/public-workspace-viewer.js' + B),
+    };
+    // Match route, handling query params for special views
+    function matchRoute(pathname, search) {
+      // Dev portal is ?view=dev on /v1/portal
+      if (pathname === '/v1/portal' && search.includes('view=dev')) {
+        return () => import('/views/portal-dev.js' + B);
+      }
+      // Single-agent pop-out window: /v1/profile?solo=<agentName>
+      if (pathname === '/v1/profile' && /[?&]solo=/.test(search)) {
+        return () => import('/views/agent-solo.js' + B);
+      }
+      // Single-document pop-out window: /v1/profile?doc=<org>:<ws>:<type>:<id>
+      if (pathname === '/v1/profile' && /[?&]doc=/.test(search)) {
+        return () => import('/views/doc-solo.js' + B);
+      }
+      // Portfolio public view: /v1/portfolio/<username>
+      if (pathname.startsWith('/v1/portfolio/') && pathname !== '/v1/portfolio/') {
+        return () => import('/views/portfolio.js' + B);
+      }
+      return ROUTES[pathname] || ROUTES['/v1/portal'];
+    }
+    // ── App Component ──
+    function App() {
+      const [View, setView] = useState(null);
+      const [viewError, setViewError] = useState(null);
+      const [locale, setLocale] = useState(getLocale());
+      // Navigate to a route
+      const navigate = useCallback(async (path, replace = false) => {
+        const url = new URL(path, window.location.origin);
+        const loader = matchRoute(url.pathname, url.search);
+        if (replace) {
+          history.replaceState(null, '', path);
+        } else {
+          history.pushState(null, '', path);
+        }
+        try {
+          setViewError(null);
+          const mod = await loader();
+          setView(() => mod.default);
+        } catch (err) {
+          console.error('Failed to load view:', err);
+          setViewError(err);
+          setView(null);
+        }
+      }, []);
+      // Push-notification interactions on an already-open window. The service worker (sw.js) focuses
+      // this window and posts either:
+      //   - 'aimeat-notification-click': the notification's target URL → deep-link it in place.
+      //   - 'aimeat-notification-action': an action button was pressed. A lock screen can't hold the
+      //     JWT, so the SW hands the action here to run with the owner's session. An 'api' action
+      //     (approve/deny/accept/decline) executes directly; 'reply'/'navigate' just deep-link so the
+      //     owner completes it in the SPA (a reply needs text we can't compose from a button).
+      useEffect(() => {
+        if (!('serviceWorker' in navigator)) return undefined;
+        const onSwMessage = async (e) => {
+          const d = e.data;
+          if (!d) return;
+          if (d.type === 'aimeat-notification-click' && d.url) { openNotificationLink(d.url, navigate); return; }
+          if (d.type === 'aimeat-notification-action' && d.action) {
+            const a = d.action;
+            if (a.kind === 'api' && a.endpoint) {
+              try {
+                const jwt = window.AIMEAT?.auth?.getSession?.()?.jwt;
+                if (jwt) {
+                  await fetch(a.endpoint, {
+                    method: a.method || 'POST',
+                    headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + jwt },
+                    body: a.body ? JSON.stringify(a.body) : undefined,
+                  });
+                  window.dispatchEvent(new CustomEvent('aimeat-live-update'));
+                }
+              } catch { /* best-effort; the target view still shows the current state */ }
+            }
+            // Land the owner on the notification's target so the result is visible in context.
+            if (d.url) openNotificationLink(d.url, navigate);
+          }
+        };
+        navigator.serviceWorker.addEventListener('message', onSwMessage);
+        return () => navigator.serviceWorker.removeEventListener('message', onSwMessage);
+      }, [navigate]);
+      // Initial load + popstate
+      useEffect(() => {
+        // Load initial route
+        const path = location.pathname + location.search;
+        navigate(path, true);
+        // Handle back/forward
+        const onPopState = () => {
+          const loader = matchRoute(location.pathname, location.search);
+          loader().then(mod => {
+            setViewError(null);
+            setView(() => mod.default);
+          }).catch(err => {
+            console.error('Popstate view load failed:', err);
+            setViewError(err);
+            setView(null);
+          });
+        };
+        window.addEventListener('popstate', onPopState);
+        // Intercept internal link clicks for SPA navigation
+        const onClick = (e) => {
+          const a = e.target.closest('a[href]');
+          if (!a) return;
+          const href = a.getAttribute('href');
+          // H-2: a published-app HTML link must NEVER open as a top-level document on the
+          // apex origin (same origin as this authenticated SPA) — it could read the
+          // visitor's session. Force it into a sandboxed, opaque-origin iframe instead,
+          // regardless of target=_blank / modifier keys.
+          if (isAppHtmlUrl(href)) {
+            e.preventDefault();
+            const label = (a.textContent || '').trim() || 'App';
+            openAppSandboxed(href, label);
+            return;
+          }
+          // Only intercept internal /v1/ links
+          if (!href || !href.startsWith('/v1/')) return;
+          if (e.ctrlKey || e.metaKey || e.shiftKey) return;
+          // Respect explicit new-tab / new-window targets — without this, an
+          // <a href="/v1/apps/.../launch?mode=inline" target="_blank"> from a
+          // child component would be hijacked, navigated in the same tab via
+          // matchRoute (which doesn't know /v1/apps/...), and dump the user
+          // back on the landing page.
+          const target = a.getAttribute('target');
+          if (target && target !== '_self' && target !== '') return;
+          if (a.hasAttribute('download')) return;
+          e.preventDefault();
+          navigate(href);
+        };
+        document.addEventListener('click', onClick);
+        return () => {
+          window.removeEventListener('popstate', onPopState);
+          document.removeEventListener('click', onClick);
+        };
+      }, [navigate]);
+      // Listen for locale changes
+      useEffect(() => {
+        return onLocaleChange((loc) => setLocale(loc));
+      }, []);
+      const retryView = useCallback(() => {
+        navigate(location.pathname + location.search, true);
+      }, [navigate]);
+      return html`
+        <${Header} navigate=${navigate} locale=${locale} />
+        <${CommandPalette} navigate=${navigate} />
+        <div class="page-content">
+          ${viewError
+            ? html`<div style="text-align:center; padding:3rem 1.5rem; color:var(--text-dim,#888);">
+                <h2 style="color:var(--text-bright,#fff); margin-bottom:0.5rem;">Failed to load page</h2>
+                <p style="margin-bottom:1rem; font-size:0.9rem;">${viewError.message || 'Network error'}</p>
+                <button class="btn-primary" onClick=${retryView} style="animation:none;">Retry</button>
+              </div>`
+            : View
+              ? html`<${ErrorBoundary} onRetry=${retryView}><${View} navigate=${navigate} locale=${locale} /></${ErrorBoundary}>`
+              : html`<div class="empty"><div class="spinner"></div></div>`
+          }
+        </div>
+      `;
+    }
+    // ── Theme Toggle ──
+    // The light/dark switch now lives INSIDE the golden login pill (served by libs.ts →
+    // mountLoginButton) so every app embedding the pill inherits it for free. theme.js still
+    // runs (initThemeSystem) to track OS preference and adopt the pill's theme changes.
+    // ── Header Component ──
+    // Built-in public links. Operators can show/hide and reorder these via the admin
+    // Portal tab (persisted at /v1/site/header-nav). Auth/role-gated links (Apps, Profile,
+    // Admin) are NOT in this list — they stay forced by the session/role checks below.
+    // There is no Companies or My Company link because there is no company object any more
+    // (removed 2026-07-28). Doing business on AIMEAT means standing up a node and running the
+    // company on it: one concept instead of two, and it works the same for every shape of
+    // organisation. A profile, an organism and the node's own operator identity carry what the
+    // separate object used to.
+    //
+    // `siteKey` entries are apps that belong to THIS node's operator, not protocol surfaces.
+    // They render only when the node configured a URL for them (AIMEAT_SITE_* → window.__SITE),
+    // so a fresh clone gets a nav without them instead of links into somebody else's apps.
+    const PUBLIC_NAV_LINKS = [
+      { id: 'try',        path: '/v1/portal',          key: 'nav.try' },
+      { id: 'howItWorks', path: '/v1/how-it-works',    key: 'nav.howItWorks', fallback: 'How it works' },
+      { id: 'learn',      siteKey: 'learn',            key: 'nav.learn',      fallback: 'Learn', external: true },
+      { id: 'exchange',   siteKey: 'exchange',         key: 'nav.exchange',   fallback: 'EXCHANGE', external: true },
+      { id: 'business',   path: '/v1/business',        key: 'nav.business',   fallback: 'For your business' },
+      { id: 'members',    path: '/v1/members',         key: 'nav.members',    fallback: 'Members' },
+      { id: 'devView',    path: '/v1/portal?view=dev', key: 'nav.devView',    matchActive: false },
+      { id: 'help',       path: '/v1/help',            key: 'nav.help' },
+    ];
+    /**
+     * Reconcile the operator's saved nav order with the links this build declares.
+     *
+     * A saved order predates every link added since the operator last touched the Portal tab,
+     * so shipping a nav item would otherwise be invisible on every node that has ever saved
+     * one. Keep the operator's arrangement for the ids they know about, and slot each newcomer
+     * next to the neighbour it is declared beside — appending them all to the end would bury
+     * "Learn" and "EXCHANGE" behind "Help".
+     */
+    function mergeNavOrder(stored) {
+      const known = new Set(stored);
+      const order = stored.slice();
+      let anchor = -1; // index in `order` of the last declared link we have placed
+      for (const link of PUBLIC_NAV_LINKS) {
+        const at = order.indexOf(link.id);
+        if (at !== -1) { anchor = at; continue; }
+        if (known.has(link.id)) continue;
+        anchor = anchor === -1 ? 0 : anchor + 1;
+        order.splice(anchor, 0, link.id);
+        known.add(link.id);
+      }
+      return order;
+    }
+    function Header({ navigate, locale }) {
+      const [session, setSession] = useState(null);
+      const [morsels, setMorsels] = useState(null);
+      const [menuOpen, setMenuOpen] = useState(false);
+      const [meOpen, setMeOpen] = useState(false);
+      const navRef = useRef(null);
+      const meRef = useRef(null);
+      // Node feature flags from /v1/site/header-nav. Empty until the fetch resolves,
+      // so optional surfaces stay hidden until we positively learn they're enabled (no flash).
+      const [features, setFeatures] = useState({});
+      // Header nav config: { order, hidden }. Defaults to all visible in declared order
+      // until the public /v1/site/header-nav fetch resolves (no flash of empty nav).
+      const [navConfig, setNavConfig] = useState({ order: PUBLIC_NAV_LINKS.map(l => l.id), hidden: [] });
+      // Check auth state
+      useEffect(() => {
+        const checkAuth = () => {
+          if (window.AIMEAT?.auth?.hasSession) {
+            const s = window.AIMEAT.auth.getSession();
+            setSession(s);
+          } else {
+            setSession(null);
+          }
+        };
+        checkAuth();
+        // Re-check when auth lib fires events
+        window.addEventListener('aimeat-auth-change', checkAuth);
+        return () => window.removeEventListener('aimeat-auth-change', checkAuth);
+      }, []);
+      // Collapse to the hamburger by MEASUREMENT, not by a guessed pixel width.
+      //
+      // How much room the bar needs depends on state, not just on the screen: signing in adds
+      // the Me button, a notification bell and a wide gold pill, and an operator adds Admin
+      // inside Me. A fixed breakpoint cannot know any of that, which is how a 2000px window
+      // ended up with the nav hanging out underneath a 56px-tall bar.
+      //
+      // The test has to run with the bar EXPANDED (a collapsed bar always "fits"), so it drops
+      // the class, measures, and puts it back in the same frame — no paint happens in between.
+      useEffect(() => {
+        const nav = navRef.current;
+        if (!nav || typeof ResizeObserver === 'undefined') return undefined;
+        let raf = 0;
+        const measure = () => {
+          raf = 0;
+          const wasCompact = nav.classList.contains('topnav--compact');
+          if (wasCompact) nav.classList.remove('topnav--compact');
+          const overflows = nav.scrollWidth > nav.clientWidth + 1;
+          nav.classList.toggle('topnav--compact', overflows);
+          if (overflows !== wasCompact && !overflows) setMenuOpen(false);
+        };
+        const schedule = () => { if (!raf) raf = requestAnimationFrame(measure); };
+        const ro = new ResizeObserver(schedule);
+        ro.observe(nav);
+        schedule();
+        window.addEventListener('resize', schedule);
+        return () => { ro.disconnect(); window.removeEventListener('resize', schedule); if (raf) cancelAnimationFrame(raf); };
+        // Re-measures whenever the bar's contents change: signing in, the operator's Admin
+        // link appearing, a different nav config arriving, or the language switching.
+      }, [session, locale, navConfig, morsels]);
+      // Close the Me dropdown on an outside click, the way every other menu on the page behaves.
+      useEffect(() => {
+        if (!meOpen) return undefined;
+        const onDown = (e) => { if (meRef.current && !meRef.current.contains(e.target)) setMeOpen(false); };
+        const onKey = (e) => { if (e.key === 'Escape') setMeOpen(false); };
+        document.addEventListener('pointerdown', onDown);
+        document.addEventListener('keydown', onKey);
+        return () => { document.removeEventListener('pointerdown', onDown); document.removeEventListener('keydown', onKey); };
+      }, [meOpen]);
+      // Load operator-configured header nav (public endpoint, no auth needed).
+      useEffect(() => {
+        let cancelled = false;
+        fetch('/v1/site/header-nav')
+          .then(r => r.json())
+          .then(d => {
+            if (cancelled || !d?.ok || !d.data) return;
+            const stored = Array.isArray(d.data.order) ? d.data.order : PUBLIC_NAV_LINKS.map(l => l.id);
+            const hidden = Array.isArray(d.data.hidden) ? d.data.hidden : [];
+            setNavConfig({ order: mergeNavOrder(stored), hidden });
+            setFeatures(d.data.features || {});
+          })
+          .catch(e => console.warn('Header nav fetch failed:', e.message));
+        return () => { cancelled = true; };
+      }, []);
+      // Fetch morsels when session is available
+      useEffect(() => {
+        if (!session) { setMorsels(null); return; }
+        fetch('/v1/wallet', {
+          headers: { 'Authorization': 'Bearer ' + session.jwt }
+        })
+          .then(r => r.json())
+          .then(d => { if (d.ok) setMorsels(d.data?.balance ?? null); })
+          .catch(e => console.warn('Wallet fetch failed:', e.message));
+      }, [session]);
+      const handleLangSwitch = (lang) => {
+        switchLocale(lang);
+      };
+      const handleNav = (e, path) => {
+        e.preventDefault();
+        // Mark in-app navigation: the landing redirects logged-in users to their Home
+        // ONLY on direct arrival (bookmark/external link), never when they deliberately
+        // navigated here from inside the app (e.g. the brand link).
+        try { sessionStorage.setItem('aimeat.in-app', '1'); } catch {}
+        navigate(path);
+      };
+      const currentPath = location.pathname;
+      // Resolve the public links to render: config order, minus hidden, by declared id.
+      const linkById = Object.fromEntries(PUBLIC_NAV_LINKS.map(l => [l.id, l]));
+      const hiddenSet = new Set(navConfig.hidden);
+      // Operator-owned apps (siteKey) resolve their href from window.__SITE and drop out of
+      // the nav entirely when this node has not configured one.
+      const visibleLinks = navConfig.order
+        .map(id => linkById[id])
+        .filter(l => l && !hiddenSet.has(l.id))
+        .map(l => (l.siteKey ? { ...l, path: siteLink(l.siteKey) } : l))
+        .filter(l => l.path);
+      return html`
+        <nav class="topnav" ref=${navRef}>
+          <div style="display:flex;align-items:center;gap:20px">
+            <a href="/v1/portal" class="topnav-brand" onClick=${(e) => handleNav(e, '/v1/portal')}>
+              AIME<span class="heart">\u2665</span><span class="brand-at">AT</span>
+            </a>
+            ${morsels !== null && html`<span class="brand-morsels" style="display:inline-flex">${morsels}</span>`}
+          </div>
+          <div class="topnav-right">
+            <button class="topnav-burger" aria-label="Menu" aria-expanded=${menuOpen ? 'true' : 'false'}
+              onClick=${() => setMenuOpen(o => !o)}>☰</button>
+            <div class="topnav-menu ${menuOpen ? 'open' : ''}">
+              <!-- Public links are operator-configurable (visibility + order) via the admin
+                   Portal tab. "Try it" leads to the landing's path cards + app gallery.
+                   Classic stays reachable deeper (landing card B "Start building"). -->
+              ${visibleLinks.map(link => (link.external
+                ? html`
+                  <a href="${link.path}" key=${link.id} target="_blank" rel="noopener"
+                    onClick=${() => setMenuOpen(false)}>${t(link.key) || link.fallback || link.key}</a>
+                `
+                : html`
+                  <a href="${link.path}" key=${link.id}
+                    onClick=${(e) => { handleNav(e, link.path); setMenuOpen(false); }}
+                    class="${link.matchActive !== false && currentPath === link.path ? 'active' : ''}">${t(link.key) || link.fallback || link.key}</a>
+                `))}
+              <!-- Signing in used to append four more top-level links (Apps, Profile, My
+                   Company, Admin) next to a bell and a wide gold pill, which is what pushed
+                   the bar past its width even on a 2000px screen. They live behind one "Me"
+                   button now; inside the burger sheet the button disappears and the links
+                   simply join the list. -->
+              ${session && html`
+                <div class="topnav-me" ref=${meRef}>
+                  <button type="button" class="topnav-me-btn" aria-haspopup="true" aria-expanded=${meOpen ? 'true' : 'false'}
+                    onClick=${() => setMeOpen(o => !o)}>${t('nav.me') || 'Me'}<span class="chev">▾</span></button>
+                  <div class="topnav-me-menu ${meOpen ? 'open' : ''}">
+                    <a href="/app-catalog.html" target="_blank" onClick=${() => { setMeOpen(false); setMenuOpen(false); }} class="${currentPath === '/app-catalog.html' ? 'active' : ''}">${t('nav.apps') || 'Apps'}</a>
+                    <a href="/v1/profile" class="profile-link visible ${currentPath === '/v1/profile' ? 'active' : ''}" onClick=${(e) => { handleNav(e, '/v1/profile'); setMeOpen(false); setMenuOpen(false); }}>
+                      ${t('nav.profile')}
+                    </a>
+                    ${session.roles && session.roles.includes('operator') && html`
+                      <a href="/v1/admin" class="${currentPath === '/v1/admin' ? 'active' : ''}" onClick=${(e) => { handleNav(e, '/v1/admin'); setMeOpen(false); setMenuOpen(false); }}>
+                        ${t('nav.admin')}
+                      </a>
+                    `}
+                  </div>
+                </div>
+              `}
+              <div class="topnav-center">
+                <button class="lang-btn ${locale === 'en' ? 'active' : ''}" onClick=${() => handleLangSwitch('en')}>EN</button>
+                <button class="lang-btn ${locale === 'fi' ? 'active' : ''}" onClick=${() => handleLangSwitch('fi')}>FI</button>
+              </div>
+            </div>
+            ${session && html`<${NotificationBell} t=${t} onNavigate=${(p) => navigate(p)} />`}
+            <span class="header-auth-slot" id="headerAuth"></span>
+          </div>
+        </nav>
+      `;
+    }
+    // ── Bootstrap ──
+    async function boot() {
+      // Load translations
+      await loadTranslations();
+      // Initialize theme system (head snippet already set the initial theme;
+      // this keeps meta in sync and tracks OS preference until an explicit choice).
+      initThemeSystem();
+      // Load auth library (served from /v1/libs/aimeat-auth.js)
+      await new Promise((resolve) => {
+        const script = document.createElement('script');
+        script.src = '/v1/libs/aimeat-auth.js';
+        script.onload = resolve;
+        script.onerror = resolve; // Continue even if auth fails
+        document.head.appendChild(script);
+      });
+      // Restore session from localStorage (critical for Ctrl+F5 / page reload)
+      if (window.AIMEAT?.auth?.login) {
+        try { await window.AIMEAT.auth.login(); } catch (_) {}
+      }
+      // Listen for session expiry — show notification and trigger re-login
+      if (window.AIMEAT?.auth?.on) {
+        window.AIMEAT.auth.on('expired', () => {
+          console.warn('[aimeat] Session expired — attempting re-login');
+          window.dispatchEvent(new Event('aimeat-auth-change'));
+          // Try silent re-login from stored credentials
+          if (window.AIMEAT.auth.login) {
+            window.AIMEAT.auth.login().then(session => {
+              if (session) {
+                window.dispatchEvent(new Event('aimeat-auth-change'));
+              } else {
+                // Show login UI if silent re-login fails
+                window.dispatchEvent(new CustomEvent('aimeat-session-expired'));
+              }
+            }).catch(() => {
+              window.dispatchEvent(new CustomEvent('aimeat-session-expired'));
+            });
+          }
+        });
+      }
+      // Mount Preact app
+      render(html`<${App} />`, document.getElementById('app'));
+      // Build i18n object for auth widget from modal.* translations
+      function authI18n() {
+        const keys = [
+          'descNew', 'descReturning', 'usernameLabel', 'usernamePlaceholder',
+          'passwordLabel', 'passwordPlaceholder', 'displayNameLabel', 'displayNameHint',
+          'displayNamePlaceholder', 'signInBtn', 'cancelBtn', 'orLabel', 'googleSignIn', 'working',
+          'errUserShort', 'errPassShort', 'errWrongPass', 'loggedIn', 'logoutBtn',
+          'forgotPassword', 'forgotUsername', 'resetPasswordTitle', 'resetPasswordDesc',
+          'sendResetCode', 'backToLogin', 'resetCodeSent', 'enterNewPasswordTitle',
+          'codeLabel', 'newPasswordLabel', 'newPasswordPlaceholder', 'errPassWeak',
+          'resetPassword', 'resetSuccess', 'recoverUsernameTitle', 'recoverUsernameDesc',
+          'emailLabel', 'sendUsername', 'usernameSent',
+          'completeAccountTitle', 'completeAccountDesc', 'completeAccountDescResend',
+          'sendVerificationCode', 'enterCodeTitle', 'enterCodeDesc', 'confirmAndSignIn',
+          'emailVerifiedSigningIn', 'errEmailInvalid', 'errCodeRequired',
+          'whyTitle', 'whyGhii', 'whyPrivacy', 'whyAgents', 'whyMorsels',
+        ];
+        const obj = {};
+        for (const k of keys) {
+          const v = t('modal.' + k);
+          if (v !== 'modal.' + k) obj[k] = v;
+        }
+        // Labels for the theme toggle that now lives inside the login pill.
+        obj.themeToDark = t('nav.themeToDark');
+        obj.themeToLight = t('nav.themeToLight');
+        return obj;
+      }
+      function mountAuth() {
+        try {
+          if (document.getElementById('headerAuth') && window.AIMEAT?.auth?.mountLoginButton) {
+            window.AIMEAT.auth.mountLoginButton('#headerAuth', {
+              onLogin: () => window.dispatchEvent(new Event('aimeat-auth-change')),
+              onLogout: () => window.dispatchEvent(new Event('aimeat-auth-change')),
+              i18n: authI18n(),
+            });
+          }
+        } catch (err) {
+          console.error('Auth mount failed:', err);
+        }
+      }
+      // Mount auth button after Preact renders
+      requestAnimationFrame(() => mountAuth());
+      // Re-mount auth button when locale changes
+      window.addEventListener('lang-change', () => requestAnimationFrame(() => mountAuth()));
+    }
+    boot().catch(err => {
+      console.error('Boot failed:', err);
+      const app = document.getElementById('app');
+      const wrap = document.createElement('div');
+      wrap.style.cssText = 'text-align:center;padding:3rem;color:#6B7280;font-family:DM Sans,system-ui';
+      const h = document.createElement('h2');
+      h.textContent = 'AIMEAT failed to start';
+      const p = document.createElement('p');
+      p.textContent = err.message || 'Unknown error';
+      const btn = document.createElement('button');
+      btn.textContent = 'Reload';
+      btn.style.cssText = 'margin-top:1rem;padding:0.6rem 1.5rem;background:linear-gradient(135deg,#E8564A,#FF6B6B);color:#fff;border:none;border-radius:10px;cursor:pointer;font-weight:700';
+      btn.onclick = () => location.reload();
+      wrap.appendChild(h);
+      wrap.appendChild(p);
+      wrap.appendChild(btn);
+      app.textContent = '';
+      app.appendChild(wrap);
+    });
+  </script>
+</body>
+</html>