aimeat 3.2.0 → 3.3.0

package/dist/public/llms-index-template.txt

@@ -0,0 +1,60 @@
+---
+description: AIMEAT Protocol Node — index
+version: v2
+downloadedFrom: {{BASE_URL}}/llms.txt
+---
+
+# AIMEAT Protocol Node
+
+> This page is the index. The full builder's manual is at {{BASE_URL}}/llms-full.txt, and that is
+> the document to fetch when you are helping someone build an app or calling this API directly.
+> An AIMEAT node holds persistent memory, identity for humans and their AI agents (GHII/GAII),
+> shared workspaces, skills, tasks and a usage meter, reachable over REST and MCP. The person who
+> owns an account here owns what is stored under it and grants or revokes each agent's reach, one
+> scope at a time.
+
+- Node URL: {{BASE_URL}}
+- Node ID: {{NODE_ID}}
+- Protocol: AIMEAT v1
+
+## Start here
+
+- [You are a person]({{BASE_URL}}/v1/portal): register in the portal, then connect an assistant
+- [You are an assistant helping someone build]({{BASE_URL}}/llms-full.txt): the manual, with SDK libraries, app templates and worked examples
+- [You are an agent joining under your own identity]({{BASE_URL}}/auth.md): RFC 8628 device flow, the owner approves you and picks your scopes
+- [You are a coding agent meeting AIMEAT as a dependency]({{BASE_URL}}/AGENTS.md): short orientation, installation and configuration
+
+## Documentation
+
+- [Full builder's manual]({{BASE_URL}}/llms-full.txt): everything below in one document — SDK libraries, app templates, core concepts, connection flows and the complete endpoint reference
+- [Site map]({{BASE_URL}}/sitemap.md): every page and endpoint on this node, one page
+- [Glossary]({{BASE_URL}}/v1/glossary): GHII, GAII, GEAI, morsels, organisms and the rest, defined
+- [OpenAPI contract]({{BASE_URL}}/v1/spec): the canonical API contract this node is held to
+- [API documentation]({{BASE_URL}}/v1/docs): browsable endpoint reference
+- [Agent registration]({{BASE_URL}}/auth.md): RFC 8628 device flow, owner-approved
+- [App building prompt]({{BASE_URL}}/v1/prompts/build-app): the canonical single-file app spec
+- [App templates]({{BASE_URL}}/v1/app-templates): starter skeletons
+- [App-build pitfalls]({{BASE_URL}}/v1/appdev/pitfalls): what breaks app builds, curated
+
+## Discovery
+
+- [Node descriptor]({{BASE_URL}}/.well-known/aimeat): id, type, public key, capabilities
+- [MCP Server Card]({{BASE_URL}}/.well-known/mcp.json): the MCP server, its transport and auth
+- [Machine-readable bootstrap]({{BASE_URL}}/?format=json): what this node is and what to call next
+- [API catalog]({{BASE_URL}}/.well-known/api-catalog): RFC 9727 linkset
+- [Agent Skills index]({{BASE_URL}}/.well-known/agent-skills/index.json): skill packs published here
+- [Crawl policy]({{BASE_URL}}/robots.txt): the content signals this node sets
+
+## Human pages
+
+{{HUMAN_PAGES}}
+
+## Optional
+
+Secondary reading. Skip these when you need a shorter context.
+
+{{OPTIONAL_PAGES}}
+- [AI transparency]({{BASE_URL}}/v1/ai-transparency): what this node marks as AI-generated, how, and in which posture. Content generated here carries an `aimeat.provenance/v1` record on every surface; ask {{BASE_URL}}/v1/provenance/by-hash/<sha256> about bytes you hold, no account needed
+- [UCP profile]({{BASE_URL}}/.well-known/ucp): commerce transports, checkout capability, payment handlers
+- [ACP profile]({{BASE_URL}}/.well-known/acp.json): agentic-commerce discovery and the product feed
+- [Web Bot Auth directory]({{BASE_URL}}/.well-known/http-message-signatures-directory): the keys this node signs outbound requests with

package/dist/public/robots.node.txt

@@ -23,52 +23,93 @@ User-agent: *
 Content-Signal: search=yes, ai-input=yes, ai-train=no
 Allow: /
 
-# ── OpenAI ──────────────────────────────────────────────────────────────────
-# OAI-SearchBot: powers ChatGPT search results (allow — we want to show up)
+# ── Search and retrieval ────────────────────────────────────────────────────
+# These are the bots that decide whether an AI assistant can answer a live question about this
+# node correctly. Every one of them is allowed, on every node, and that is not operator-tunable:
+# a node nobody can look up is a node nobody can join.
+#
+# Two kinds are mixed here on purpose, because blocking them has different costs. A SEARCH bot
+# feeds the index an assistant queries; blocking it removes this node from that assistant's
+# answers. A USER bot fetches one page because a human asked for it, and the vendors document
+# that those may ignore robots.txt precisely because a person asked.
+
+# OpenAI — OAI-SearchBot powers ChatGPT search results; blocking it removes this node from them.
 User-agent: OAI-SearchBot
 Allow: /
 
-# GPTBot: training data crawler (blocked — training is a separate decision)
-User-agent: GPTBot
-Disallow: /
+User-agent: ChatGPT-User
+Allow: /
 
-# ── Anthropic / Claude ───────────────────────────────────────────────────────
-# Claude-SearchBot: search indexing
+User-agent: OAI-AdsBot
+Allow: /
+
+# Anthropic — rules apply per subdomain, which is why app origins serve their own robots.txt.
 User-agent: Claude-SearchBot
 Allow: /
 
-# Claude-User: user-initiated fetches (cowork, claude.ai browsing)
 User-agent: Claude-User
 Allow: /
 
-# ClaudeBot: training crawler
-User-agent: ClaudeBot
-Disallow: /
-
-# ── Perplexity ───────────────────────────────────────────────────────────────
-# PerplexityBot: search indexing (respects robots.txt)
+# Perplexity
 User-agent: PerplexityBot
 Allow: /
 
-# Perplexity-User: user-initiated fetches (typically ignores robots.txt anyway)
 User-agent: Perplexity-User
 Allow: /
 
-# ── Google ───────────────────────────────────────────────────────────────────
-# Googlebot: standard search indexing (allow)
+# Google — Googlebot feeds Search, and therefore AI Overviews and AI Mode, which are retrieval
+# over the Search index. Google-Extended is a separate decision and sits in the training block.
 User-agent: Googlebot
 Allow: /
 
-# Google-Extended: Gemini training/grounding — does NOT affect Google Search
+# Microsoft — bingbot feeds both Bing Search and Copilot.
+User-agent: Bingbot
+Allow: /
+
+# Apple — Applebot indexes for Siri and Spotlight. Applebot-Extended does not crawl at all; it is
+# the training opt-out token, so it belongs in the block below.
+User-agent: Applebot
+Allow: /
+
+# Meta — meta-externalfetcher is the user-requested single-link fetch.
+User-agent: meta-externalfetcher
+Allow: /
+
+# xAI / Grok: deliberately absent. No vendor-documented crawler token exists — none appears in
+# x.ai/robots.txt, grok.com/robots.txt or Cloudflare's bot reference — so there is nothing to name
+# here that would not be a guess. The `User-agent: *` rule above covers Grok, and every other
+# undocumented crawler, which is the whole of the available answer.
+
+# ── AI training crawlers ────────────────────────────────────────────────────
+# A separate decision from the block above, and an operator's to make: AIMEAT_AI_TRAINING=allow
+# flips every Disallow between the markers to Allow and pairs the Content-Signal line to
+# ai-train=yes. The default is deny, because a personal node holds one person's data and a safe
+# default has to assume that case.
+#
+# The cost of denying, stated plainly so the choice is an informed one: it keeps this node out of
+# what the models know without being pointed at it, and it is a stated preference rather than an
+# enforceable control. It protects a right; it does not protect bytes.
+#AIMEAT-TRAINING-BEGIN
+User-agent: GPTBot
+Disallow: /
+
+User-agent: ClaudeBot
+Disallow: /
+
+# Google-Extended controls Gemini training and grounding ONLY. Per Google's own documentation it
+# does not affect Google Search, and it does not remove this node from AI Overviews.
 User-agent: Google-Extended
 Disallow: /
 
-# ── Bing / Copilot ───────────────────────────────────────────────────────────
-User-agent: Bingbot
-Allow: /
+User-agent: Applebot-Extended
+Disallow: /
+
+User-agent: meta-externalagent
+Disallow: /
+#AIMEAT-TRAINING-END
 
 # ── AI agents: machine-readable docs ────────────────────────────────────────
-# See /llms.txt for structured API documentation
+# /llms.txt is the curated index; /llms-full.txt is the full builder's manual.
 # API entry point for AI agents: GET /?format=json
 
-Sitemap: https://aimeat.io/sitemap.xml
+Sitemap: {{BASE_URL}}/sitemap.xml

package/dist/public/spa.html

@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
-  <!-- AI: To help this user build apps on AIMEAT, fetch /llms.txt for templates and API docs. Ask what they want to build. -->
+  <!-- AI: /llms.txt is the index of this node. To help this user build apps on AIMEAT, fetch
+       /llms-full.txt for templates and API docs, then ask what they want to build. -->
   <meta charset="UTF-8">
   <!-- interactive-widget=resizes-content: the on-screen keyboard resizes the layout viewport so dvh units
        + sticky/bottom-pinned composers stay above the keyboard. viewport-fit=cover exposes env(safe-area-*)
@@ -67,6 +68,7 @@
        checks whether a site points at its own llms.txt finds the pointer. -->
   <link rel="alternate" type="text/plain" href="/llms.txt" title="LLM-friendly description">
   <link rel="alternate" type="text/plain" href="/llms-full.txt" title="Full content for LLMs">
+  <link rel="describedby" type="text/plain" href="/llms.txt">
   <link rel="icon" href="/favicon.svg" type="image/svg+xml">
   <link rel="manifest" href="/manifest.json">
   <!-- WebMCP bridge (TARGET-034 phase C): registers node-level tools (commerce feed, node info)
@@ -116,6 +118,7 @@
   <link rel="stylesheet" href="/css/views/portfolio.css">
   <link rel="stylesheet" href="/css/views/members.css">
   <link rel="stylesheet" href="/css/views/inbox.css">
+  <link rel="stylesheet" href="/css/views/chat.css">
   <link rel="stylesheet" href="/css/views/glossary.css">
   <link rel="stylesheet" href="/css/components/tags.css">
   <link rel="stylesheet" href="/css/components/image-deliverable.css">
@@ -158,6 +161,7 @@
       "/js/use-session.js": "/js/use-session.js",
       "/js/services/boards.js": "/js/services/boards.js",
       "/js/services/catalogue.js": "/js/services/catalogue.js",
+      "/js/services/chat.js": "/js/services/chat.js",
       "/js/services/consent.js": "/js/services/consent.js",
       "/js/services/cortex.js": "/js/services/cortex.js",
       "/js/services/extensions.js": "/js/services/extensions.js",
@@ -430,6 +434,7 @@
       '/v1/glossary':    () => import('/views/glossary.js' + B),
       '/v1/business':    () => import('/views/business.js' + B),
       '/v1/transparency': () => import('/views/transparency.js' + B),
+      '/v1/chat':        () => import('/views/chat.js' + B),
       '/v1/profile':     () => import('/views/profile.js' + B),
       '/v1/home':        () => import('/views/home/index.js' + B),
       '/v1/app-grant':   () => import('/views/app-grant.js' + B),
@@ -810,6 +815,8 @@
                    only existed because the bar was carrying the marketing links at the same
                    time. Those links are anon-only now, so these three fit on the row. -->
               ${session && html`
+                <a href="/v1/chat" class="${currentPath === '/v1/chat' ? 'active' : ''}"
+                  onClick=${(e) => { handleNav(e, '/v1/chat'); setMenuOpen(false); }}>${t('nav.chat') || 'Chat'}</a>
                 <a href="/app-catalog.html" target="_blank" onClick=${() => setMenuOpen(false)}
                   class="${currentPath === '/app-catalog.html' ? 'active' : ''}">${t('nav.apps') || 'Apps'}</a>
                 <a href="/v1/profile" class="profile-link visible ${currentPath === '/v1/profile' ? 'active' : ''}"

package/dist/public/views/chat/parts.js

@@ -0,0 +1,257 @@
+/**
+ * @file public/views/chat/parts.js
+ * @description What the chat page is made of: the conversation list, one turn, the work log, and
+ *   the box a person types into.
+ *
+ *   Two registers share one column. The conversation is what was said; the work log is what was
+ *   actually done, one line per tool call, and it is shown by default rather than folded away. A
+ *   chat that reports "done" without showing the calls asks to be believed; this one can be checked.
+ * @structure
+ *   - ThreadList — the person's conversations
+ *   - Turn — one thing said, with the tools that ran while it was said
+ *   - WorkLine — one tool call, its status, and what it was
+ *   - Composer — the box, Enter to send, Shift+Enter for a newline, and a recorder beside it
+ *   - StatusBar — which agent, what is left to spend, and what is wrong when something is
+ * @usage import { ThreadList, Turn, Composer, StatusBar } from './chat/parts.js';
+ * @version-history
+ *   v1.1.0 — 2026-08-16 — Speech both ways: a recording becomes text in the box, which the person
+ *     reads before sending, and an agent turn can be read aloud.
+ *   v1.0.0 — 2026-08-16 — Initial.
+ */
+import { h } from 'preact';
+import { useRef, useEffect, useState } from 'preact/hooks';
+import htm from 'htm';
+import { t } from '/js/i18n.js';
+import { Markdown } from '/components/Markdown.js';
+import { VoiceRecorder } from '/components/VoiceRecorder.js';
+import { speak, stop as stopSpeaking, isSpeechSupported, textToParagraphs } from '/js/services/speech-reader.js';
+
+const html = htm.bind(h);
+const tr = (key, fallback) => { const v = t(key); return v && v !== key ? v : fallback; };
+
+/** hh:mm in the reader's own locale, which is all a turn needs. */
+function timeShort(iso) {
+    if (!iso) return '';
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? '' : d.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+}
+
+/**
+ * One tool call, as a line in the work log.
+ *
+ * The status is a word rather than a colour alone: a person who cannot see the difference between
+ * two greens still has to be able to tell a call that finished from one that failed.
+ */
+export function WorkLine({ tool }) {
+    const status = String(tool.status || 'pending');
+    const label = tr(`chat.work.${status}`, status);
+    return html`
+        <li class="chat-work-line chat-work-line--${status}">
+            <span class="chat-work-status">${label}</span>
+            <span class="chat-work-title">${tool.title || tr('chat.work.untitled', 'a tool call')}</span>
+        </li>
+    `;
+}
+
+/** The work log for one turn: every tool call it made, in the order it made them. */
+export function WorkLog({ tools }) {
+    if (!tools || tools.length === 0) return null;
+    return html`
+        <div class="chat-work">
+            <div class="chat-work-head">${tr('chat.work.title', 'What was done')}</div>
+            <ul class="chat-work-list">
+                ${tools.map((tool, i) => html`<${WorkLine} key=${i} tool=${tool} />`)}
+            </ul>
+        </div>
+    `;
+}
+
+/**
+ * One turn.
+ *
+ * The agent's words go through the markdown renderer because the agent writes markdown; the
+ * person's do not, because what they typed is what they meant.
+ */
+export function Turn({ turn, id }) {
+    const mine = turn.role === 'user';
+    const [reading, setReading] = useState(false);
+    // A turn that failed before the agent said anything leaves an empty record, and an empty bubble
+    // on screen reads as a message that arrived blank. Nothing was said, so nothing is drawn; the
+    // error above it is what happened.
+    if (!mine && !turn.text && !(turn.tools && turn.tools.length)) return null;
+
+    const listen = () => {
+        if (reading) { stopSpeaking(); setReading(false); return; }
+        setReading(speak(id, textToParagraphs(turn.text || '')));
+    };
+
+    return html`
+        <div class="chat-turn chat-turn--${mine ? 'user' : 'agent'}">
+            <div class="chat-bubble">
+                ${mine
+                    ? html`<p class="chat-said">${turn.text}</p>`
+                    : html`<${Markdown} text=${turn.text || ''} />`}
+                <${WorkLog} tools=${turn.tools} />
+            </div>
+            <div class="chat-meta">
+                <span>${timeShort(turn.at)}</span>
+                ${turn.model ? html`<span class="chat-model" title=${tr('chat.modelTitle', 'The model that answered this turn')}>${turn.model}</span>` : ''}
+                ${!mine && turn.text && isSpeechSupported() ? html`
+                    <button type="button" class="btn-ghost chat-listen" onClick=${listen}>
+                        ${reading ? tr('chat.stopListening', 'Stop') : tr('chat.listen', 'Listen')}
+                    </button>` : ''}
+            </div>
+        </div>
+    `;
+}
+
+/**
+ * What the agent is doing right now, before the turn is over.
+ *
+ * A person watching a spinner for four minutes cannot tell work from a hang, so the live turn shows
+ * the words as they are written and each tool call as it starts.
+ */
+export function LiveTurn({ text, thought, tools, busy }) {
+    if (!busy && !text && (!tools || tools.length === 0)) return null;
+    return html`
+        <div class="chat-turn chat-turn--agent chat-turn--live">
+            <div class="chat-bubble">
+                ${text ? html`<${Markdown} text=${text} />` : ''}
+                ${!text && thought ? html`<p class="chat-thinking">${thought}</p>` : ''}
+                ${!text && !thought && busy ? html`<p class="chat-thinking">${tr('chat.working', 'Working…')}</p>` : ''}
+                <${WorkLog} tools=${tools} />
+            </div>
+        </div>
+    `;
+}
+
+/** A turn that could not run, with the reason and a way to try again. */
+export function TurnError({ message, onRetry }) {
+    if (!message) return null;
+    return html`
+        <div class="chat-error" role="alert">
+            <p class="chat-error-msg">${message}</p>
+            ${onRetry && html`
+                <button type="button" class="btn-outline chat-error-retry" onClick=${onRetry}>
+                    ${tr('chat.retry', 'Try again')}
+                </button>`}
+        </div>
+    `;
+}
+
+/**
+ * The person's conversations.
+ *
+ * `onClose` is the way back on a phone, where this list covers the conversation and the header that
+ * would otherwise carry the control is hidden. Without it, opening the list is a room with no door:
+ * the only exit is picking a different conversation than the one you were reading.
+ */
+export function ThreadList({ threads, activeId, onOpen, onNew, onDelete, onClose }) {
+    return html`
+        <aside class="chat-threads">
+            <button type="button" class="btn-ghost chat-threads-close" onClick=${onClose}>
+                ↩ ${tr('chat.backToChat', 'Back to the conversation')}
+            </button>
+            <button type="button" class="btn-primary chat-new" onClick=${onNew}>
+                ${tr('chat.new', 'New conversation')}
+            </button>
+            ${threads.length === 0
+                ? html`<p class="chat-threads-empty">${tr('chat.noThreads', 'Nothing here yet. Say something and this is where it will be.')}</p>`
+                : html`
+                    <ul class="chat-thread-list">
+                        ${threads.map((thread) => html`
+                            <li key=${thread.id} class="chat-thread ${thread.id === activeId ? 'chat-thread--active' : ''}">
+                                <button type="button" class="chat-thread-open" onClick=${() => onOpen(thread.id)}>
+                                    <span class="chat-thread-title">${thread.title}</span>
+                                    <span class="chat-thread-sub">${tr('chat.turnCount', '{n} messages').replace('{n}', String(thread.turns ?? 0))}</span>
+                                </button>
+                                <button type="button" class="btn-ghost chat-thread-del"
+                                    aria-label=${tr('chat.delete', 'Delete conversation')}
+                                    onClick=${() => onDelete(thread.id)}>✗</button>
+                            </li>
+                        `)}
+                    </ul>`}
+        </aside>
+    `;
+}
+
+/**
+ * The box.
+ *
+ * Enter sends and Shift+Enter opens a line, which is what every chat does and therefore what a
+ * person's hands already expect. The field grows with what is in it up to a ceiling, so a long ask
+ * is readable while being written without the composer eating the conversation.
+ */
+export function Composer({ value, onInput, onSend, onStop, onSpeak, busy, disabled, note, listening, voiceMaxSeconds = 300 }) {
+    const ref = useRef(null);
+
+    // Re-measured on a resize as well as on every keystroke. Height depends on WIDTH: a line that
+    // fits on a desktop wraps on a phone, and a height measured before the turn left the field
+    // scrolling by two pixels behind a scrollbar nobody wanted.
+    useEffect(() => {
+        const fit = () => {
+            const el = ref.current;
+            if (!el) return;
+            el.style.height = 'auto';
+            el.style.height = `${Math.min(el.scrollHeight, 200)}px`;
+        };
+        fit();
+        window.addEventListener('resize', fit);
+        return () => window.removeEventListener('resize', fit);
+    }, [value]);
+
+    const keydown = (e) => {
+        if (e.key === 'Enter' && !e.shiftKey) {
+            e.preventDefault();
+            if (!busy && !disabled && value.trim()) onSend();
+        }
+    };
+
+    return html`
+        <div class="chat-composer">
+            ${note ? html`<p class="chat-composer-note">${note}</p>` : ''}
+            ${listening ? html`<p class="chat-composer-note">${tr('chat.hearing', 'Working out what you said…')}</p>` : ''}
+            <div class="chat-composer-row">
+                <textarea ref=${ref} class="chat-input" rows="1"
+                    value=${value}
+                    disabled=${disabled}
+                    placeholder=${disabled
+                        ? tr('chat.disabledPlaceholder', 'This node has no chat agent yet.')
+                        : tr('chat.placeholder', 'Ask for something, or describe what you want built.')}
+                    onInput=${(e) => onInput(e.target.value)}
+                    onKeyDown=${keydown}></textarea>
+                ${onSpeak && !busy ? html`
+                    <${VoiceRecorder} maxSeconds=${voiceMaxSeconds} disabled=${disabled || listening}
+                        className="btn-outline chat-voice" onRecorded=${(file) => onSpeak(file)} />` : ''}
+                ${busy
+                    ? html`<button type="button" class="btn-outline chat-send" onClick=${onStop}>${tr('chat.stop', 'Stop')}</button>`
+                    : html`<button type="button" class="btn-primary chat-send"
+                        disabled=${disabled || !value.trim()}
+                        onClick=${onSend}>${tr('chat.send', 'Send')}</button>`}
+            </div>
+        </div>
+    `;
+}
+
+/**
+ * Who is answering, and what it costs.
+ *
+ * The allowance is shown because a person about to fall back to a free model deserves to have seen
+ * it coming. It is a line of text, not a gauge: this is not the thing they came here to look at.
+ */
+export function StatusBar({ status, onReset }) {
+    if (!status) return null;
+    const remaining = Number(status.allowance_remaining_usd ?? 0);
+    return html`
+        <div class="chat-status">
+            <span class="chat-status-agent">${status.agent_name}</span>
+            ${status.has_own_key
+                ? html`<span class="chat-status-key">${tr('chat.ownKey', 'Running on your own OpenRouter key.')}</span>`
+                : html`<span class="chat-status-key">${tr('chat.allowance', '{n} USD left of your allowance.').replace('{n}', remaining.toFixed(2))}</span>`}
+            ${onReset && html`
+                <button type="button" class="btn-ghost chat-status-reset"
+                    title=${tr('chat.resetTitle', 'Start a fresh agent session for this conversation. Needed after changing what the agent may do.')}
+                    onClick=${onReset}>${tr('chat.reset', 'Reset session')}</button>`}
+        </div>
+    `;
+}