aimeat 2.7.0 → 3.0.0

package/dist/src/utils/scope-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-coverage.js","sourceRoot":"","sources":["../../../src/utils/scope-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD;;;;;;;GAOG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,eAAe,GAAG;IACpB,cAAc,EAAa,oDAAoD;IAC/E,6BAA6B,EAAE,oDAAoD;IACnF,mBAAmB,EAAQ,yCAAyC;IACpE,gBAAgB,EAAW,qDAAqD;IAChF,cAAc,EAAa,2EAA2E;IACtG,gBAAgB,EAAW,qCAAqC;CAC1D,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAChC,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,GAAG,eAAe,CAAC,CAAC;AAEvE,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,OAAO,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB,EAAE,KAAa;IACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,MAAyB;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/static/app-catalog/js/favorites.js

@@ -28,7 +28,7 @@ export function loadFavorites() {
   var token = getCortexOwnerToken();
   var b = base();
   if (!token || !b) { favSet = new Set(); return Promise.resolve(); }
-  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY), { headers: { 'Authorization': 'Bearer ' + token } })
+  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY) + '?soft=1', { headers: { 'Authorization': 'Bearer ' + token } })
     .then(function (r) { return r.ok ? r.json() : null; })
     .then(function (j) {
       var refs = (j && j.data && j.data.value && Array.isArray(j.data.value.refs)) ? j.data.value.refs : [];

package/dist/static/app-catalog/js/i18n-data.js

@@ -63,7 +63,7 @@ export const I18N = {
       'view.community': '🌍 Community',
       'view.communityEmpty': 'No community apps on this node yet.',
       'view.communityHint': 'Community apps are apps other people on this node have published. When someone publishes one, it shows up here.',
-      'sec.parked': '🅿️ Parked Apps',
+      'sec.parked': 'Unlisted apps',
       'sec.parkedBlurb': 'Only you can see and use these — they stay usable but are hidden from the public catalogue. Press Publish to move one back to Published Apps.',
       'sec.recent': '🕒 Recently Opened',
       'sec.local': '📚 Your apps',
@@ -134,7 +134,7 @@ export const I18N = {
       'publish.descriptionHint': 'Shown in the catalogue and on the landing wall. Required for a new app.',
       'publish.accessCode': 'Access Code (optional)',
       'publish.accessCodePh': 'Leave empty for public',
-      'publish.accessCodeHint': '4-64 chars. If set, only people with the code can download.',
+      'publish.accessCodeHint': '4-64 chars. If set, the app only opens or downloads with the code. You, the owner, never need it.',
       'publish.submit': 'Publish',
       'publish.loginRequired': 'Sign in to publish to AIMEAT. Anonymous publishing is disabled — use the Sign in button in the top bar.',
       'publish.savedUnlisted': 'Saved — your app is on the server as unlisted. Open it and press List when you want it public.',
@@ -675,7 +675,7 @@ export const I18N = {
       'view.community': '🌍 Yhteisö',
       'view.communityEmpty': 'Tällä nodella ei ole vielä yhteisön sovelluksia.',
       'view.communityHint': 'Yhteisön sovellukset ovat sovelluksia, joita muut tämän noden käyttäjät ovat julkaisseet. Kun joku julkaisee sellaisen, se näkyy täällä.',
-      'sec.parked': '🅿️ Parkissa olevat sovellukset',
+      'sec.parked': 'Listaamattomat sovellukset',
       'sec.parkedBlurb': 'Vain sinä näet ja voit käyttää näitä — ne pysyvät käytettävissä mutta eivät näy julkisessa katalogissa. Paina Julkaise siirtääksesi takaisin julkaistuihin.',
       'sec.recent': '🕒 Viimeksi avatut',
       'sec.local': '📚 Sinun sovelluksesi',
@@ -746,7 +746,7 @@ export const I18N = {
       'publish.descriptionHint': 'Näytetään katalogissa ja aloitusseinällä. Pakollinen uudelle sovellukselle.',
       'publish.accessCode': 'Pääsykoodi (valinnainen)',
       'publish.accessCodePh': 'Jätä tyhjäksi julkiseksi',
-      'publish.accessCodeHint': '4–64 merkkiä. Jos asetettu, vain koodin tietävät voivat ladata.',
+      'publish.accessCodeHint': '4–64 merkkiä. Jos asetettu, sovellus aukeaa ja latautuu vain koodilla. Sinä omistajana et koskaan tarvitse sitä.',
       'publish.submit': 'Julkaise',
       'publish.loginRequired': 'Kirjaudu sisään julkaistaksesi AIMEATiin. Anonyymi julkaisu on poistettu käytöstä — käytä yläpalkin Kirjaudu-painiketta.',
       'publish.savedUnlisted': 'Tallennettu — sovelluksesi on palvelimella ei-listalla. Avaa se ja paina Listaa kun haluat sen julkiseksi.',

package/dist/static/app-catalog/js/promote.js

@@ -29,7 +29,7 @@ export function loadPromoted() {
   var token = getCortexOwnerToken();
   var b = base();
   if (!token || !b) { promoted = {}; return Promise.resolve(); }
-  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY), { headers: { 'Authorization': 'Bearer ' + token } })
+  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY) + '?soft=1', { headers: { 'Authorization': 'Bearer ' + token } })
     .then(function (r) { return r.ok ? r.json() : null; })
     .then(function (j) {
       var items = (j && j.data && j.data.value && Array.isArray(j.data.value.items)) ? j.data.value.items : [];

package/dist/static/app-catalog/js/render.js

@@ -123,7 +123,21 @@ function launchInTab(app) {
 // View a published app: open it TOP-LEVEL in a new tab (clean full page, no toolbar/X). The
 // url is the apex ?mode=inline URL; the server serves it inline (session inherited) when the
 // app origin is OFF, or 301s it to the isolated app origin when ON.
+// The viewer's OWN protected app gets its access code appended (a plain navigation carries no
+// Bearer, so without the code the owner would land on the unlock page for their own app).
 function viewPublished(url, name) {
+  try {
+    var u = new URL(url, window.location.origin);
+    var parts = u.pathname.split('/'); // ['', 'v1', 'apps', owner, filename]
+    if (parts[1] === 'v1' && parts[2] === 'apps' && parts[3] && parts[4]) {
+      var key = decodeURIComponent(parts[3]) + '/' + decodeURIComponent(parts[4]);
+      var codeVal = ownAppAccessCodes[key];
+      if (codeVal && !u.searchParams.has('code')) {
+        url += (url.indexOf('?') >= 0 ? '&' : '?') + 'code=' + encodeURIComponent(codeVal);
+      }
+    }
+  // eslint-disable-next-line aimeat/no-silent-catch -- an unparseable url just opens as-is; the server still answers with the unlock page
+  } catch (err) { void err; }
   window.open(url, '_blank', 'noopener');
 }
 
@@ -176,6 +190,10 @@ export let serverStateByFilename = {};
 // filename -> current protection object, populated here as own cards render; the detail module
 // (copy-protection modal) reads it via the injected getOwnProtection() getter.
 export let ownAppProtection = {};
+// "owner/filename" -> the ACCESS CODE of the viewer's OWN protected app. The listing exposes the
+// code only to the app's owner; viewPublished appends it so the owner's own Open never lands on
+// the unlock page (UX-remake v3, P6). Other people's apps are never in this map.
+export let ownAppAccessCodes = {};
 export let serverAppManifests = {}; // moved out of server-io: SSOT for the owner-app manifest cache (detail reads via getServerManifests)
 
 /**
@@ -309,6 +327,7 @@ function buildLibraryEntries(localApps, serverApps) {
         accessCode: !!sa.protected
       };
       ownAppProtection[fn] = prot;
+      if (sa.access_code) ownAppAccessCodes[(sa.owner || '') + '/' + fn] = sa.access_code;
     }
   }
   return entries;

package/dist/static/app-catalog/js/server-io.js

@@ -800,6 +800,10 @@ function loadPublishedApps() {
         currentOwner = JSON.parse(stored).owner || null;
       }
     }
+    // The token is the authority the rest of this file uses. Without one there is no owner,
+    // whatever a leftover localStorage blob says — reading that stale blob kept "Your apps (1)"
+    // on screen after a logout (UX-remake v3, measured).
+    if (!getCortexOwnerToken()) currentOwner = null;
   } catch(e) {}
 
   // Load the owner's favourites alongside the app list so the ⭐ group + stars match the current

package/dist/static/app-catalog/js/settings.js

@@ -132,7 +132,7 @@ function loadConfigFromServer() {
       if (!token) return;
       var gaii = auth.data.gaii || auth.data.sub || '';
       if (!gaii) return;
-      return fetch(url + '/v1/memory/app-launcher%2Fconfig', {
+      return fetch(url + '/v1/memory/app-launcher%2Fconfig?soft=1', {
         headers: { 'Authorization': 'Bearer ' + token }
       }).then(function (r) {
         if (!r.ok) return null;

package/dist/static/app-catalog/js/util.js

@@ -3,25 +3,61 @@
  * @description Pure helper functions for the app-catalog — no module state, no side effects
  *   (only params + DOM/window globals). Carved out of the former monolithic main.js as the first
  *   shared module so every feature module reuses ONE copy (no duplicated escaping/labels).
+ * @structure
+ *   - escapeHtml()      → HTML-escape for text AND attribute values (& < > " ')
+ *   - jsArg()           → escape for a single-quoted JS argument inside an on* attribute
+ *   - sourceLabel(), sourceLabelText() → source-kind labels
+ *   - bareOwnerName(), sameOwner()     → owner-identifier comparison
+ *   - filterAttr()      → the data-filter/data-tags pair used by the card search
+ *   - isSameOriginUrl(), currentOwnerName(), generateId(), readFileAsText()
  * @usage import { escapeHtml, jsArg, sameOwner } from './util.js'
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 1).
+ *   v1.1.0 — 2026-08-11 — escapeHtml also escapes " and ' (audit H-25, stored XSS via filterAttr).
  */
 
-/** HTML-escape a string via a detached element's textContent (handles < > &). */
+/**
+ * HTML-escape a string for BOTH text content and a quoted attribute value: & < > " '.
+ *
+ * The quotes are the reason this function exists in this shape. It used to serialize through a
+ * detached element's textContent, which escapes & < > and leaves both quote characters intact —
+ * correct for a text node, wrong for the attribute values most callers here build. filterAttr()
+ * below puts another owner's published app name inside a double-quoted data-filter attribute, so
+ * a name containing " ended the attribute and everything after it was parsed as more attributes,
+ * including an event handler. /app-catalog.html runs on the apex under a script-src that allows
+ * inline script, so that handler ran with the signed-in user's session (audit H-25). The publish
+ * route type-checks the name and the tags without constraining their content, and the community
+ * grid renders every published card through this path, so the escaping is the only thing standing
+ * between one owner's manifest and another owner's page.
+ *
+ * Escaping ' as well is not needed by any current call site (every attribute the catalog builds is
+ * double-quoted), and it costs nothing: an entity inside an attribute value or a text node decodes
+ * back to the same character before anyone sees it. It is here so a single-quoted attribute added
+ * later is safe by default rather than by review.
+ *
+ * The one context where the extra escaping is NOT a no-op is an on* handler whose contents a caller
+ * escapes AGAIN at the JS level, because escapeHtml now consumes the quote that second pass looks
+ * for. Use jsArg() for anything that lands inside a handler; it does the JS-level escaping in the
+ * right order and stays the correct tool for that job.
+ */
 export function escapeHtml(str) {
-  var div = document.createElement('div');
-  div.textContent = str;
-  return div.innerHTML;
+  return String(str == null ? '' : str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
 }
 
 /**
  * Escape a user-controlled string for use as a single-quoted JS argument INSIDE a double-quoted
- * HTML on* attribute (e.g. onclick="window._launcher.foo('<here>')"). escapeHtml only handles
- * < > & — an apostrophe like in "Fatalii's" would otherwise terminate the JS string and throw
- * "missing ) after argument list", breaking the button. JS-escape the backslash + single quote;
- * HTML-escape the attribute/markup delimiters (they decode back to plain chars before the JS
- * engine sees them).
+ * HTML on* attribute (e.g. onclick="window._launcher.foo('<here>')"). escapeHtml is not enough
+ * here even though it now escapes quotes: an attribute value is HTML-decoded before the JS engine
+ * parses it, so &#39; arrives at the parser as a plain apostrophe and an argument like "Fatalii's"
+ * still terminates the JS string and throws "missing ) after argument list", breaking the button.
+ * The escaping has to happen at the JS level to survive that decode. JS-escape the backslash +
+ * single quote; HTML-escape the attribute/markup delimiters (they decode back to plain chars
+ * before the JS engine sees them, which is the point).
  */
 export function jsArg(str) {
   return String(str == null ? '' : str)
@@ -63,7 +99,14 @@ export function sameOwner(appOwner, sessionOwner) {
   return !!a && a === bareOwnerName(sessionOwner);
 }
 
-/** data-filter/data-tags attribute pair so a server card can be matched by search/tag without a re-fetch. */
+/**
+ * data-filter/data-tags attribute pair so a server card can be matched by search/tag without a
+ * re-fetch. Both values come from a published manifest that another owner controls and the publish
+ * route does not constrain, so the escapeHtml calls are load-bearing: they are what keeps a quote
+ * in a name or a tag from closing the attribute (audit H-25). Nothing reads these back as markup —
+ * applyServerFilter() uses getAttribute(), which returns the decoded original text — so the
+ * escaping is invisible to the search that consumes them.
+ */
 export function filterAttr(name, tags) {
   tags = (tags || []).map(function (tg) { return String(tg).toLowerCase(); });
   var searchable = escapeHtml((String(name || '') + ' ' + tags.join(' ')).toLowerCase());

package/dist/static/app-catalog/styles/app-catalog.css

@@ -332,7 +332,14 @@
       display: flex;
       align-items: center;
       gap: 8px;
-      flex-shrink: 0;
+      /* Wraps rather than overflowing. The login pill is wide, carries its own inline styles and
+         cannot be shrunk, so a non-wrapping row pushed the create, backup and language buttons
+         past the right edge on a phone, where nothing could reach them. min-width:0 lets the row
+         narrow at all: a flex item defaults to min-width:auto and refuses to go under its
+         content. */
+      flex-wrap: wrap;
+      min-width: 0;
+      flex-shrink: 1;
     }
 
     .icon-btn {
@@ -372,8 +379,9 @@
     }
 
     /* Mount point for the shared golden login pill (/v1/libs/aimeat-auth.js).
-       The pill carries its own inline styles; this just keeps it inline in the bar. */
-    .header-auth-pill { display: inline-flex; align-items: center; }
+       The pill carries its own inline styles; this just keeps it inline in the bar and stops it
+       from setting the row's minimum width. */
+    .header-auth-pill { display: inline-flex; align-items: center; min-width: 0; max-width: 100%; }
 
     #add-btn:hover {
       box-shadow: 0 4px 20px rgba(232, 86, 74, .25);
@@ -1301,6 +1309,18 @@
         flex-basis: 100%;
       }
 
+      /* On a phone the pill takes a row of its own and the buttons sit under it, right-aligned.
+         Side by side there is room for the pill only, and the buttons are what a person came for. */
+      .header-actions {
+        width: 100%;
+        justify-content: flex-end;
+      }
+
+      .header-auth-pill {
+        order: -1;
+        width: 100%;
+      }
+
       #tag-bar {
         padding: 10px 16px;
       }

package/dist/static/app-catalog.html

@@ -340,7 +340,14 @@
       display: flex;
       align-items: center;
       gap: 8px;
-      flex-shrink: 0;
+      /* Wraps rather than overflowing. The login pill is wide, carries its own inline styles and
+         cannot be shrunk, so a non-wrapping row pushed the create, backup and language buttons
+         past the right edge on a phone, where nothing could reach them. min-width:0 lets the row
+         narrow at all: a flex item defaults to min-width:auto and refuses to go under its
+         content. */
+      flex-wrap: wrap;
+      min-width: 0;
+      flex-shrink: 1;
     }
 
     .icon-btn {
@@ -380,8 +387,9 @@
     }
 
     /* Mount point for the shared golden login pill (/v1/libs/aimeat-auth.js).
-       The pill carries its own inline styles; this just keeps it inline in the bar. */
-    .header-auth-pill { display: inline-flex; align-items: center; }
+       The pill carries its own inline styles; this just keeps it inline in the bar and stops it
+       from setting the row's minimum width. */
+    .header-auth-pill { display: inline-flex; align-items: center; min-width: 0; max-width: 100%; }
 
     #add-btn:hover {
       box-shadow: 0 4px 20px rgba(232, 86, 74, .25);
@@ -1309,6 +1317,18 @@
         flex-basis: 100%;
       }
 
+      /* On a phone the pill takes a row of its own and the buttons sit under it, right-aligned.
+         Side by side there is room for the pill only, and the buttons are what a person came for. */
+      .header-actions {
+        width: 100%;
+        justify-content: flex-end;
+      }
+
+      .header-auth-pill {
+        order: -1;
+        width: 100%;
+      }
+
       #tag-bar {
         padding: 10px 16px;
       }
@@ -2842,7 +2862,7 @@
       "view.community": "🌍 Community",
       "view.communityEmpty": "No community apps on this node yet.",
       "view.communityHint": "Community apps are apps other people on this node have published. When someone publishes one, it shows up here.",
-      "sec.parked": "🅿️ Parked Apps",
+      "sec.parked": "Unlisted apps",
       "sec.parkedBlurb": "Only you can see and use these — they stay usable but are hidden from the public catalogue. Press Publish to move one back to Published Apps.",
       "sec.recent": "🕒 Recently Opened",
       "sec.local": "📚 Your apps",
@@ -2913,7 +2933,7 @@
       "publish.descriptionHint": "Shown in the catalogue and on the landing wall. Required for a new app.",
       "publish.accessCode": "Access Code (optional)",
       "publish.accessCodePh": "Leave empty for public",
-      "publish.accessCodeHint": "4-64 chars. If set, only people with the code can download.",
+      "publish.accessCodeHint": "4-64 chars. If set, the app only opens or downloads with the code. You, the owner, never need it.",
       "publish.submit": "Publish",
       "publish.loginRequired": "Sign in to publish to AIMEAT. Anonymous publishing is disabled — use the Sign in button in the top bar.",
       "publish.savedUnlisted": "Saved — your app is on the server as unlisted. Open it and press List when you want it public.",
@@ -3454,7 +3474,7 @@
       "view.community": "🌍 Yhteisö",
       "view.communityEmpty": "Tällä nodella ei ole vielä yhteisön sovelluksia.",
       "view.communityHint": "Yhteisön sovellukset ovat sovelluksia, joita muut tämän noden käyttäjät ovat julkaisseet. Kun joku julkaisee sellaisen, se näkyy täällä.",
-      "sec.parked": "🅿️ Parkissa olevat sovellukset",
+      "sec.parked": "Listaamattomat sovellukset",
       "sec.parkedBlurb": "Vain sinä näet ja voit käyttää näitä — ne pysyvät käytettävissä mutta eivät näy julkisessa katalogissa. Paina Julkaise siirtääksesi takaisin julkaistuihin.",
       "sec.recent": "🕒 Viimeksi avatut",
       "sec.local": "📚 Sinun sovelluksesi",
@@ -3525,7 +3545,7 @@
       "publish.descriptionHint": "Näytetään katalogissa ja aloitusseinällä. Pakollinen uudelle sovellukselle.",
       "publish.accessCode": "Pääsykoodi (valinnainen)",
       "publish.accessCodePh": "Jätä tyhjäksi julkiseksi",
-      "publish.accessCodeHint": "4–64 merkkiä. Jos asetettu, vain koodin tietävät voivat ladata.",
+      "publish.accessCodeHint": "4–64 merkkiä. Jos asetettu, sovellus aukeaa ja latautuu vain koodilla. Sinä omistajana et koskaan tarvitse sitä.",
       "publish.submit": "Julkaise",
       "publish.loginRequired": "Kirjaudu sisään julkaistaksesi AIMEATiin. Anonyymi julkaisu on poistettu käytöstä — käytä yläpalkin Kirjaudu-painiketta.",
       "publish.savedUnlisted": "Tallennettu — sovelluksesi on palvelimella ei-listalla. Avaa se ja paina Listaa kun haluat sen julkiseksi.",
@@ -4046,9 +4066,7 @@
 
   // src/static/app-catalog/js/util.js
   function escapeHtml(str) {
-    var div = document.createElement("div");
-    div.textContent = str;
-    return div.innerHTML;
+    return String(str == null ? "" : str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
   }
   function jsArg(str) {
     return String(str == null ? "" : str).replace(/&/g, "&amp;").replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[\r\n]+/g, " ");
@@ -5114,7 +5132,7 @@
       promoted = {};
       return Promise.resolve();
     }
-    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY), { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
+    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY) + "?soft=1", { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
       return r.ok ? r.json() : null;
     }).then(function(j) {
       var items = j && j.data && j.data.value && Array.isArray(j.data.value.items) ? j.data.value.items : [];
@@ -8241,7 +8259,7 @@
       if (!token) return;
       var gaii = auth.data.gaii || auth.data.sub || "";
       if (!gaii) return;
-      return fetch(url + "/v1/memory/app-launcher%2Fconfig", {
+      return fetch(url + "/v1/memory/app-launcher%2Fconfig?soft=1", {
         headers: { "Authorization": "Bearer " + token }
       }).then(function(r) {
         if (!r.ok) return null;
@@ -8542,7 +8560,7 @@
       favSet = /* @__PURE__ */ new Set();
       return Promise.resolve();
     }
-    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY2), { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
+    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY2) + "?soft=1", { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
       return r.ok ? r.json() : null;
     }).then(function(j) {
       var refs = j && j.data && j.data.value && Array.isArray(j.data.value.refs) ? j.data.value.refs : [];
@@ -9251,6 +9269,7 @@
           currentOwner = JSON.parse(stored).owner || null;
         }
       }
+      if (!getCortexOwnerToken()) currentOwner = null;
     } catch (e) {
     }
     Promise.all([getAllApps(), loadFavorites(), loadPromoted()]).then(function() {
@@ -9586,6 +9605,19 @@
     }
   }
   function viewPublished2(url, name) {
+    try {
+      var u = new URL(url, window.location.origin);
+      var parts = u.pathname.split("/");
+      if (parts[1] === "v1" && parts[2] === "apps" && parts[3] && parts[4]) {
+        var key = decodeURIComponent(parts[3]) + "/" + decodeURIComponent(parts[4]);
+        var codeVal = ownAppAccessCodes[key];
+        if (codeVal && !u.searchParams.has("code")) {
+          url += (url.indexOf("?") >= 0 ? "&" : "?") + "code=" + encodeURIComponent(codeVal);
+        }
+      }
+    } catch (err) {
+      void err;
+    }
     window.open(url, "_blank", "noopener");
   }
   function updateOpenExternalBtn() {
@@ -9614,6 +9646,7 @@
   var ownServerApps = [];
   var serverStateByFilename = {};
   var ownAppProtection = {};
+  var ownAppAccessCodes = {};
   var serverAppManifests = {};
   function aiPostureMarkers(e) {
     var p = e.aiPosture;
@@ -9750,6 +9783,7 @@
           accessCode: !!sa.protected
         };
         ownAppProtection[fn] = prot;
+        if (sa.access_code) ownAppAccessCodes[(sa.owner || "") + "/" + fn] = sa.access_code;
       }
     }
     return entries;

package/dist/static/sdk-libs/_core/sdk-globals.d.ts

@@ -21,8 +21,12 @@ interface Window {
   AIMEATAgentFace?: Record<string, any>;
   /** Serve-time config prelude prepended to each bundle (see _core/config.js + libs/sdk-serve.ts). */
   __AIMEAT_SDK_CFG__?: { nodeId: string; baseUrl: string; heartbeatMs?: number };
-  /** aimeat-auth's extra serve-time prelude: the OIDC providers enabled on the node (server-computed). */
-  __AIMEAT_AUTH_CFG__?: { providers: Array<{ id: string; label: string; i18nKey: string }> };
+  /** aimeat-auth's extra serve-time prelude (server-computed, see routes/libs.ts): the OIDC providers
+   *  enabled on the node, and whether the node's registration gate demands an email. */
+  __AIMEAT_AUTH_CFG__?: {
+    providers: Array<{ id: string; label: string; i18nKey: string }>;
+    emailRequired?: boolean;
+  };
   /** aimeat-header's idempotency guard (mounts the canonical nav at most once). */
   __AIMEAT_HEADER_MOUNTED__?: boolean;
   /** aimeat-auth version marker exposed globally. */

package/dist/static/sdk-libs/agentface/index.js

@@ -10,11 +10,15 @@
  *   verbatim from lib-agentface.ts — the bespoke auth-guard messages are preserved (they teach the
  *   app-owner-only serving rule), so getSession stays inline rather than using _core/session.
  * @structure imports attach (namespace); getSession/compose/inferFilename; the `agentface` object
- *   (key/compose/publish); attach('agentface', …) + window.AIMEATAgentFace.
+ *   (key/compose/copyText/publish); attach('agentface', …) + window.AIMEATAgentFace.
  * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-agentface.js"></script>
  *   await AIMEATAgentFace.publish('# My app\n\n…', { app: 'my-app.html' });
+ *   await AIMEAT.agentface.copyText(promptText);  // the shared "Copy prompt" implementation
  * @version-history
  *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-agentface.ts (SDK-libs migration Phase 1).
+ *   v1.1.0 — 2026-08-05 — copyText(): the ONE shared clipboard implementation for the platform's
+ *     copy-a-prompt-to-your-AI pattern (async API + hidden-textarea fallback, no visible
+ *     selection) — every app was hand-rolling its own, several of them badly.
  */
 import { attach } from '../_core/namespace.js';
 
@@ -67,6 +71,36 @@ const agentface = {
   /** The markdown composer (exposed so an app can preview what publish() will write). */
   compose: compose,
 
+  /**
+   * Copy text to the clipboard the way every "Copy prompt" button should: async clipboard API
+   * first, hidden-offscreen-textarea execCommand fallback — never a visible selection painted
+   * over the page. Resolves to true/false; never throws. This is THE shared implementation for
+   * the platform's copy-a-prompt-to-your-AI pattern — stop hand-rolling it per app.
+   */
+  async copyText(text) {
+    const value = String(text == null ? '' : text);
+    if (typeof navigator !== 'undefined' && navigator.clipboard && navigator.clipboard.writeText) {
+      try {
+        await navigator.clipboard.writeText(value);
+        return true;
+      } catch { /* fall through to the textarea fallback */ }
+    }
+    try {
+      const ta = document.createElement('textarea');
+      ta.value = value;
+      ta.setAttribute('readonly', '');
+      ta.style.position = 'fixed';
+      ta.style.left = '-9999px';
+      document.body.appendChild(ta);
+      ta.select();
+      const ok = document.execCommand('copy');
+      document.body.removeChild(ta);
+      return !!ok;
+    } catch {
+      return false;
+    }
+  },
+
   /**
    * Publish this app's agent face: a markdown string, or { title, sections: [{ heading, body }] }.
    * opts.app names the app filename explicitly (e.g. 'my-app.html') and overrides inference —

package/dist/static/sdk-libs/auth/config.js

@@ -38,6 +38,11 @@ export function appDeclaredScopes() {
 // one button per entry.
 export const AUTH_PROVIDERS = (window.__AIMEAT_AUTH_CFG__ && window.__AIMEAT_AUTH_CFG__.providers) || [];
 
+// Does this node's registration gate require an email (AIMEAT_EMAIL_CONFIRMATION_REQUIRED)? Same
+// prelude, same injection point as the provider list. The Register tab asks for the email up front
+// when this is true, so the person types it once instead of meeting the demand after a failed create.
+export const EMAIL_REQUIRED = !!(window.__AIMEAT_AUTH_CFG__ && window.__AIMEAT_AUTH_CFG__.emailRequired);
+
 // Per-provider button glyphs (inline SVG — no external fetch).
 export const PROVIDER_ICONS = {
   google: '<svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path fill="#4285F4" d="M17.64 9.2c0-.64-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92c1.7-1.57 2.68-3.88 2.68-6.62z"/><path fill="#34A853" d="M9 18c2.43 0 4.47-.8 5.96-2.18l-2.92-2.26c-.8.54-1.84.86-3.04.86-2.34 0-4.32-1.58-5.03-3.7H.96v2.33A9 9 0 0 0 9 18z"/><path fill="#FBBC05" d="M3.97 10.72a5.4 5.4 0 0 1 0-3.44V4.95H.96a9 9 0 0 0 0 8.1l3.01-2.33z"/><path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.44 1.35l2.58-2.58A9 9 0 0 0 .96 4.95l3.01 2.33C4.68 5.16 6.66 3.58 9 3.58z"/></svg>',