aimeat 2.7.0 → 3.0.0

package/dist/public/js/services/organisms.js

@@ -38,6 +38,7 @@ import { decodeEntities } from '/js/utils.js';
 import { wsRoot, isMemorySpace, isDocSpace } from './organisms.shared.js';
 import { mlbl } from './organisms.charts.js';
 import { swallowed } from '/js/swallowed.js';
+import { getSession, getStoredGhii } from '/js/services/auth.js';
 
 // ── Re-exports of pieces extracted to sibling modules (pure extraction, max-file-lines) ──
 export { wsRoot, isMemorySpace, isDocSpace, getObjectSchema } from './organisms.shared.js';
@@ -714,18 +715,13 @@ export async function getConfig(orgId) {
 }
 
 /** The current owner's GHII (`owner@node`). ALWAYS returns a string so callers can safely `.split('@')`.
- *  Prefers the synchronous `auth.storedGhii` accessor; falls back to a sync `getSession()` only when it
- *  returns a session object with a string `ghii` (on some builds `getSession()` is async / returns a
- *  Promise — never return that, or `.split` blows up at call sites). Empty string when unknown. */
+ *  Prefers the persisted GHII (readable before the session object exists) and falls back to the active
+ *  session's. Empty string when unknown. */
 export function currentGhii() {
-  const auth = (typeof window !== 'undefined' && window.AIMEAT && window.AIMEAT.auth) || null;
-  if (!auth) return '';
-  if (typeof auth.storedGhii === 'string' && auth.storedGhii) return auth.storedGhii;
-  try {
-    const s = typeof auth.getSession === 'function' ? auth.getSession() : null;
-    if (s && typeof s === 'object' && typeof s.ghii === 'string') return s.ghii;
-  } catch (err) { swallowed('organisms: auth', err); }
-  return '';
+  const stored = getStoredGhii();
+  if (typeof stored === 'string' && stored) return stored;
+  const s = getSession();
+  return (s && typeof s.ghii === 'string') ? s.ghii : '';
 }
 
 /** Section indexes for every document-space, keyed by objectType name. A section is

package/dist/public/js/services/organisms.prompts.js

@@ -6,13 +6,26 @@
  * @usage import { buildAccessPrompt, buildContractAgentPrompt } from './organisms.prompts.js';
  * @version-history
  *   v1.0.0 — 2026-07-13 — Extracted from organisms.js (max-file-lines)
+ *   v1.1.0 — 2026-08-09 — The access prompt teaches the workspace tools instead of raw memory keys,
+ *     and no longer claims there are none. aimeat_workspace_* has existed since v1.1.0; the prompt
+ *     handed out aimeat_memory_read/write against organism.{id}.w.{ws}.… and a raw POST to publish,
+ *     so every reader learned to hand-assemble a key layout the tools own and to skip the
+ *     draft/publish handling that comes with them. The contract-agent variant below was already
+ *     correct — this makes the two halves of one file agree.
  */
 import { isMemorySpace, isDocSpace, getObjectSchema } from './organisms.shared.js';
 import { swallowed } from '/js/swallowed.js';
 
 // ── Access prompt: a copy-paste prompt teaching an AI/agent how to use THIS workspace ──
-// Bridges the MCP gap (no workspace-aware tools yet) by injecting the real structure + the exact
-// conventions. Two variants: 'human' (paste into a chat) and 'agent' (imperative, assumes tools).
+// Injects the real structure + ids so the reader does not have to discover them. Two variants:
+// 'human' (paste into a chat) and 'agent' (imperative, assumes tools).
+//
+// It teaches the WORKSPACE tools (aimeat_workspace_*), which have existed since v1.1.0
+// (src/mcp/catalog/surfaces.ts). It used to claim there were none and hand out raw
+// aimeat_memory_read/write calls against organism.{id}.w.{ws}.… keys — teaching every reader to
+// hand-assemble a key layout the tools own, and to bypass the draft/publish handling that comes
+// with them. The contract-agent prompt further down this same file was already correct; this is
+// the two halves agreeing.
 
 /** Format one objectType's full schema for the prompt's STRUCTURE block. */
 function describeType(ot, schema) {
@@ -47,19 +60,26 @@ export async function buildAccessPrompt(orgId, orgName, wsId, ws, variant = 'hum
   const structure = described.join('\n') || '(no spaces declared yet)';
 
   const access = [
-    `- Read the manifest:   aimeat_memory_read key="organism.${orgId}.w.${wsId}.meta.manifest"`,
-    `- List everything:     aimeat_memory_list prefix="organism.${orgId}.w.${wsId}." limit=500`,
-    `    (keys end in .draft = working copy, .latest = published, .version.N = history)`,
-    `- Document sections:   aimeat_memory_read key="organism.${orgId}.w.${wsId}.meta.sections.{type}"`,
-    `- Write/refresh a draft: aimeat_memory_write key="organism.${orgId}.w.${wsId}.{namespace}.{id}.draft" value={...}`,
+    `- Overview of this workspace: aimeat_workspace_overview { organism_id:"${orgId}", ws:"${wsId}" }`,
+    `    (the manifest's spaces, sections and what is in them, as readable markdown)`,
+    `- Index of everything:  aimeat_workspace_read { organism_id:"${orgId}", ws:"${wsId}" }`,
+    `    → ids + titles, no bodies. Open the ones you need with the same call plus ids:["a","b"]`,
+    `      (optionally space:"<space name>" to narrow the lookup).`,
+    `- Write/refresh a draft: aimeat_workspace_write { organism_id:"${orgId}", ws:"${wsId}",`,
+    `      space:"<space NAME>", id:"<instance id>", value:{...} }`,
+    `    (records: the record itself; documents: { title, markdown } — id is auto-generated, and`,
+    `     section:"<section>" files it. Writing always lands in the DRAFT.)`,
+    `- Publish a draft:      aimeat_workspace_publish { organism_id:"${orgId}", ws:"${wsId}",`,
+    `      namespace:"<namespace>", id:"<instance id>" }`,
+    `    (snapshots a version + makes it the published copy; refused while the publish gate is on,`,
+    `     which means the owner reviews it instead)`,
     `- Attach a file/screenshot: aimeat_storage_upload key="organism.${orgId}.w.${wsId}.img.{name}"`,
     `    then embed it in a document's markdown as  ![alt](/v1/storage/<returned key>)`,
     `- Live data in documents: a \`\`\`aimeat-memory fenced block (body: key: <memory key>, optional view: table|props|list,`,
     `    fields: a,b and title: ...) renders that key's CURRENT value on every open — write changing data with`,
     `    aimeat_memory_write as an array of objects (consistent field names) and embed the key instead of a static table;`,
     `    re-writing the SAME key updates every document that embeds it. \`\`\`mermaid blocks render as diagrams.`,
-    `- Publish a draft:     POST ${nodeUrl}/v1/organisms/${orgId}/publish   body { "ws":"${wsId}", "namespace":"...", "id":"..." }`,
-    `    (snapshots .version.N + .latest, consumes the draft; may require operator approval if the publish gate is on)`,
+    `    (This one names a memory key on purpose — the block embeds a key, not a workspace object.)`,
   ].join('\n');
 
   const intents = [

package/dist/public/js/services/packages.js

@@ -19,6 +19,7 @@
  *   v1.2.1 — 2026-06-19 — JSDoc type annotations for frontend type-checking
  */
 import { apiGet, apiPost, apiPatch, apiDelete } from '/js/api.js';
+import { authHeaders } from '/js/services/auth.js';
 
 // ── Packages ──
 export const listPackages = (params) => apiGet('/v1/packages' + buildQuery(params));
@@ -54,20 +55,16 @@ export const toggleFeatured = (id, featured) => apiPatch(`/v1/templates/${enc(id
 
 // ── ZIP Import/Export ──
 export async function exportPackageZip(groupId) {
-  const session = window.AIMEAT?.auth?.getSession?.();
-  const headers = /** @type {Record<string,string>} */ ({});
-  if (session?.jwt) headers['Authorization'] = `Bearer ${session.jwt}`;
+  const headers = /** @type {Record<string,string>} */ ({ ...authHeaders() });
   const res = await fetch(`/v1/packages/${enc(groupId)}/export`, { headers });
   if (!res.ok) throw new Error(`Export failed: ${res.status}`);
   return res.blob();
 }
 
 export async function importPackageZip(file) {
-  const session = window.AIMEAT?.auth?.getSession?.();
   const formData = new FormData();
   formData.append('file', file);
-  const headers = /** @type {Record<string,string>} */ ({});
-  if (session?.jwt) headers['Authorization'] = `Bearer ${session.jwt}`;
+  const headers = /** @type {Record<string,string>} */ ({ ...authHeaders() });
   const res = await fetch('/v1/packages/import', {
     method: 'POST',
     headers,

package/dist/public/js/services/shares.js

@@ -0,0 +1,70 @@
+/**
+ * @file shares.js
+ * @description Frontend API service for key-space shares — letting a sharing group read a
+ *   pattern of the owner's memory. The group says who; a share says what they reach.
+ * @structure
+ *   - listOutgoing()        -- GET    /v1/shares            (what I have shared)
+ *   - listIncoming()        -- GET    /v1/shares/incoming   (what has been shared with me)
+ *   - listForGroup(groupId) -- GET    /v1/groups/:id/shares
+ *   - createShare(groupId)  -- POST   /v1/groups/:id/shares
+ *   - revokeShare(shareId)  -- DELETE /v1/shares/:id
+ * @usage
+ *   import { listIncoming, createShare } from '/js/services/shares.js';
+ * @version-history
+ *   v1.0.0 -- 2026-08-11 -- Initial, alongside the key-space share table.
+ */
+import { apiGet, apiPost, apiDelete } from '/js/api.js';
+
+export async function listOutgoing() {
+  return apiGet('/v1/shares');
+}
+
+export async function listIncoming() {
+  return apiGet('/v1/shares/incoming');
+}
+
+export async function listForGroup(groupId) {
+  return apiGet(`/v1/groups/${encodeURIComponent(groupId)}/shares`);
+}
+
+export async function createShare(groupId, data) {
+  return apiPost(`/v1/groups/${encodeURIComponent(groupId)}/shares`, data);
+}
+
+export async function revokeShare(shareId) {
+  return apiDelete(`/v1/shares/${encodeURIComponent(shareId)}`);
+}
+
+/**
+ * The pattern to offer for a key the user picked, as a prefix glob one level up.
+ *
+ * `news.daily.2026-08-11` suggests `news.daily.**`, because the thing a person means by "share
+ * this" is almost always the run of keys it belongs to rather than that one record — and a share
+ * covering only today's key would go stale tomorrow, silently, which is the failure this whole
+ * feature exists to remove. A key with no dot has no space to widen into, so it is offered exactly.
+ */
+export function suggestPattern(key) {
+  const lastDot = String(key || '').lastIndexOf('.');
+  if (lastDot < 1) return String(key || '');
+  return `${key.slice(0, lastDot)}.**`;
+}
+
+/**
+ * Does this pattern cover this key? Mirrors the server's consentMatchPattern: `*` is one segment,
+ * `**` is the rest, and every other character is a literal. Kept in step with
+ * `src/storage/pattern-utils.ts` — this one only decides what the UI SHOWS as shared; the server
+ * decides what is actually readable, and it is the one that counts.
+ */
+export function patternCoversKey(pattern, key) {
+  const regex = String(pattern)
+    .split(/([./])/)
+    .map(tok => {
+      if (tok === '**') return '.*';
+      if (tok === '*') return '[^./]+';
+      if (tok === '.') return '\\.';
+      if (tok === '/') return '/';
+      return tok.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    })
+    .join('');
+  return new RegExp(`^${regex}$`).test(String(key));
+}

package/dist/public/js/services/skills.js

@@ -10,6 +10,7 @@
  *   v1.0.0 -- 2026-07-05 -- Initial creation (Skills feature Phase 2b)
  */
 import { apiGet, apiPost, apiDelete } from '/js/api.js';
+import { authHeaders } from '/js/services/auth.js';
 
 /** The library: everything the caller can load, grouped by scope { node, user }. */
 export async function getLibrary() {
@@ -83,15 +84,11 @@ export async function downloadSkillZip(name, { scope, owner, organism, ws } = {}
   if (organism) params.set('organism', organism);
   if (ws) params.set('ws', ws);
   const qs = params.toString();
-  // Binary response — api() always JSON-parses, so fetch directly with the session token.
-  let jwt = '';
-  try {
-    jwt = (window.AIMEAT?.auth?.getSession()?.jwt)
-      || JSON.parse(localStorage.getItem('aimeat_session') || '{}').jwt || '';
-  // eslint-disable-next-line aimeat/no-silent-catch -- anonymous
-  } catch { /* anonymous */ }
+  // Binary response — api() always JSON-parses, so fetch directly with the session token. The
+  // localStorage read this used to fall back to was the same store the session service reads,
+  // one hop earlier and without the lib's validity checks — dropped rather than kept in sync.
   const res = await fetch(`/v1/skills/${encodeURIComponent(name)}/zip${qs ? `?${qs}` : ''}`, {
-    headers: jwt ? { Authorization: `Bearer ${jwt}` } : {},
+    headers: authHeaders(),
   });
   if (!res.ok) throw new Error(`Download failed (HTTP ${res.status})`);
   const blob = await res.blob();

package/dist/public/js/services/unfurl.js

@@ -11,6 +11,7 @@
  */
 import { apiGet } from '/js/api.js';
 import { swallowed } from '/js/swallowed.js';
+import { authHeaders } from '/js/services/auth.js';
 
 const enc = encodeURIComponent;
 
@@ -31,9 +32,7 @@ export async function fetchPreview(url) {
  *  Returns null on any failure. The CALLER owns the returned URL and must URL.revokeObjectURL it. */
 export async function fetchPreviewImageUrl(imageUrl) {
   try {
-    const headers = /** @type {Record<string, string>} */ ({});
-    const session = window.AIMEAT?.auth?.getSession?.();
-    if (session?.jwt) headers['Authorization'] = 'Bearer ' + session.jwt;
+    const headers = /** @type {Record<string, string>} */ ({ ...authHeaders() });
     const resp = await fetch(`/v1/unfurl/image?url=${enc(imageUrl)}`, { headers });
     if (!resp.ok) return null;
     const blob = await resp.blob();

package/dist/public/js/style-testbed.js

@@ -8,7 +8,13 @@
  * @version-history
  *   v1.0.0 — 2026-06-02 — Initial testbed behavior
  *   v1.0.1 — 2026-06-19 — JSDoc type annotations for frontend type-checking
+ *   v1.1.0 — 2026-08-08 — Loaded as a module (style-testbed.html) so the copy button can use the
+ *     shared copyToClipboard helper instead of its own navigator.clipboard + execCommand ladder,
+ *     and the shared `copied` class instead of the bespoke .stb-copied. Deferred module execution
+ *     is safe here: init() already handles a readyState that is no longer 'loading'.
  */
+import { copyToClipboard } from '/js/utils.js';
+
 (function () {
   'use strict';
 
@@ -129,24 +135,16 @@
   }
 
   // ── Copy ──
-  function copyOut() {
+  async function copyOut() {
     const out = document.getElementById('stb-output');
     const btn = document.getElementById('stb-copy');
     if (!out) return;
-    const done = () => {
-      if (!btn) return;
-      btn.classList.add('stb-copied');
-      const prev = btn.textContent;
-      btn.textContent = '✓ Copied';
-      setTimeout(() => { btn.classList.remove('stb-copied'); btn.textContent = prev; }, 1500);
-    };
-    if (navigator.clipboard && navigator.clipboard.writeText) {
-      navigator.clipboard.writeText(/** @type {HTMLInputElement} */ (out).value).then(done, () => { /** @type {HTMLInputElement} */ (out).select(); document.execCommand('copy'); done(); });
-    } else {
-      /** @type {HTMLInputElement} */ (out).select();
-      document.execCommand('copy');
-      done();
-    }
+    await copyToClipboard(/** @type {HTMLInputElement} */ (out).value);
+    if (!btn) return;
+    btn.classList.add('copied');
+    const prev = btn.textContent;
+    btn.textContent = '✓ Copied';
+    setTimeout(() => { btn.classList.remove('copied'); btn.textContent = prev; }, 1500);
   }
 
   // ── Wire up ──

package/dist/public/js/use-session.js

@@ -0,0 +1,38 @@
+/**
+ * @file public/js/use-session.js
+ * @description The one Preact hook for "who is signed in". Wraps the session service
+ *   (/js/services/auth.js) so a view never keeps its own copy of the session, and never writes its
+ *   own subscribe/unsubscribe effect — the two habits that let stale sessions render (a header
+ *   showing the notification bell and the "Me" menu next to a "Sign In" button, 2026-08-07).
+ *
+ *   It lives apart from the service because the service is framework-free and is imported by
+ *   non-Preact code (js/api.js, the plain-JS service layer); only this file pulls in preact/hooks.
+ *
+ * @structure
+ *   - useSession(): the active session object, or null when signed out. Re-renders on real changes.
+ * @usage
+ *   import { useSession } from '/js/use-session.js';
+ *   const session = useSession();
+ *   return html`${session ? html`<${Bell} />` : null}`;
+ * @version-history
+ *   v1.0.0 — 2026-08-07 — Initial: single session hook for every view.
+ */
+import { useState, useEffect } from 'preact/hooks';
+import { getSession, onAuthChange } from '/js/services/auth.js';
+
+/**
+ * The active session, or null when signed out. Updates on sign-in, sign-out, token refresh and
+ * profile-metadata edits.
+ * @returns {any}
+ */
+export function useSession() {
+  const [session, setSession] = useState(() => getSession());
+  useEffect(() => {
+    // The auth lib is injected during boot and may have finished (or restored a session) between
+    // this component's first render and this effect — re-read before subscribing so a session that
+    // arrived in that gap is not missed.
+    setSession(getSession());
+    return onAuthChange(setSession);
+  }, []);
+  return session;
+}

package/dist/public/lib/VENDORED.md

@@ -16,6 +16,7 @@ with per-lib AI docs + changelogs) — keep this table and the registry in sync.
 | `chartjs@4.js` | `chart.js` (UMD) | 4.5.1 | `chartjs` | `https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js` | MIT |
 | `mermaid/mermaid.min.js` | `mermaid` (UMD) | 11.15.0 | `mermaid` | `node_modules/mermaid/dist` (see mermaid/README.md) | MIT |
 | `three.min.js` | `three` (r128 UMD) | r128 | `three` | `https://cdn.jsdelivr.net/npm/three@0.128.0/build/three.min.js` | MIT |
+| `three-world@1.min.js` | `three` + addons OrbitControls, Sky, RGBELoader (esbuild IIFE — `window.THREE`, addons on `THREE.Addons`; never load together with `three.min.js`) | 0.185.1 (r185), bundle v1 | `three-world` | built by `aimeat/scripts/vendor-three-world.mjs` from `registry.npmjs.org/three/-/three-0.185.1.tgz` | MIT |
 | `p5@1.min.js` | `p5` | 1.11.13 | `p5` | `https://cdn.jsdelivr.net/npm/p5@1/lib/p5.min.js` | LGPL-2.1 (owner-approved 2026-07-16) |
 | `pixi@8.min.js` | `pixi.js` | 8.19.0 | `pixi` | `https://cdn.jsdelivr.net/npm/pixi.js@8/dist/pixi.min.js` | MIT |
 | `pixi-unsafe-eval@8.min.js` | `pixi.js` (unsafe-eval companion — REQUIRED after pixi under the app CSP) | 8.19.0 | `pixi` | `https://cdn.jsdelivr.net/npm/pixi.js@8/dist/packages/unsafe-eval.min.js` | MIT |