aimeat 2.0.0 → 2.2.0

package/dist/static/sdk-libs/auth/crypto.js

@@ -0,0 +1,166 @@
+/**
+ * @file auth/crypto.js
+ * @description aimeat-auth crypto + storage core (SDK-libs migration Phase 3). Self-contained, no
+ *   shared auth state: Ed25519 via Web Crypto (generate/import-as-non-extractable/sign), the
+ *   IndexedDB non-extractable CryptoKey store (open/store/load/delete + one-time localStorage→IDB
+ *   migration), the localStorage metadata helpers (save/load/remove — NEVER private keys), and JWT
+ *   helpers (parseJwt/isExpired). Extracted verbatim from auth-lib-part1.ts.
+ * @structure generateKeyPair/importEd25519Key/isCryptoKey/sign · openKeyDB/storeKey/loadKey/deleteKey/
+ *   migrateKeysToIndexedDB · save/load/remove · parseJwt/isExpired.
+ * @usage import { sign, parseJwt, save, load } from './crypto.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part1.ts (SDK-libs migration Phase 3).
+ */
+
+// ── Ed25519 via Web Crypto ──
+
+export async function generateKeyPair() {
+  const key = /** @type {CryptoKeyPair} */ (await crypto.subtle.generateKey('Ed25519', true, ['sign', 'verify']));
+  const privRaw = await crypto.subtle.exportKey('pkcs8', key.privateKey);
+  const pubRaw = await crypto.subtle.exportKey('spki', key.publicKey);
+  // Extract raw 32-byte keys from DER wrappers
+  const privBytes = new Uint8Array(privRaw).slice(-32);
+  const pubBytes = new Uint8Array(pubRaw).slice(-32);
+  return {
+    privateKey: btoa(String.fromCharCode(...privBytes)),
+    publicKey: btoa(String.fromCharCode(...pubBytes)),
+    cryptoKey: key,
+  };
+}
+
+// SECURITY: Import raw Ed25519 private key as non-extractable CryptoKey
+export async function importEd25519Key(privateKeyBase64) {
+  const privBytes = Uint8Array.from(atob(privateKeyBase64), c => c.charCodeAt(0));
+  // Build PKCS8 DER wrapper for Ed25519
+  const pkcs8Prefix = new Uint8Array([48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
+  const pkcs8 = new Uint8Array(pkcs8Prefix.length + privBytes.length);
+  pkcs8.set(pkcs8Prefix);
+  pkcs8.set(privBytes, pkcs8Prefix.length);
+  const cryptoKey = await crypto.subtle.importKey('pkcs8', pkcs8, 'Ed25519', false /* non-extractable */, ['sign']);
+  // Zero raw key bytes
+  privBytes.fill(0);
+  pkcs8.fill(0);
+  return cryptoKey;
+}
+
+export function isCryptoKey(value) {
+  if (!value || typeof value !== 'object') return false;
+  if (typeof CryptoKey !== 'undefined' && value instanceof CryptoKey) return true;
+  return Object.prototype.toString.call(value) === '[object CryptoKey]';
+}
+
+// Sign using CryptoKey (preferred) or base64 key string (fallback)
+export async function sign(keyOrB64, message) {
+  let key = keyOrB64;
+  if (typeof keyOrB64 === 'string') {
+    // Legacy path: raw base64 key → import as CryptoKey
+    key = await importEd25519Key(keyOrB64);
+  }
+  if (!isCryptoKey(key)) {
+    throw new Error('AIMEAT signing key is missing or invalid. Please sign in again.');
+  }
+  const msgBytes = new TextEncoder().encode(message);
+  const sigBytes = await crypto.subtle.sign('Ed25519', key, msgBytes);
+  return btoa(String.fromCharCode(...new Uint8Array(sigBytes)));
+}
+
+// ── IndexedDB Key Store (SECURITY: non-extractable CryptoKeys) ──
+
+const KEY_DB_NAME = 'aimeat_keys';
+const KEY_STORE_NAME = 'cryptokeys';
+
+function openKeyDB() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(KEY_DB_NAME, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(KEY_STORE_NAME);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+
+export async function storeKey(name, cryptoKey) {
+  const db = /** @type {IDBDatabase} */ (await openKeyDB());
+  return new Promise((resolve, reject) => {
+    const tx = db.transaction(KEY_STORE_NAME, 'readwrite');
+    tx.objectStore(KEY_STORE_NAME).put(cryptoKey, name);
+    tx.oncomplete = () => { db.close(); resolve(undefined); };
+    tx.onerror = () => { db.close(); reject(tx.error); };
+  });
+}
+
+export async function loadKey(name) {
+  const db = /** @type {IDBDatabase} */ (await openKeyDB());
+  return new Promise((resolve) => {
+    const tx = db.transaction(KEY_STORE_NAME, 'readonly');
+    const req = tx.objectStore(KEY_STORE_NAME).get(name);
+    req.onsuccess = () => { db.close(); resolve(req.result || null); };
+    req.onerror = () => { db.close(); resolve(null); };
+  });
+}
+
+export async function deleteKey(name) {
+  try {
+    const db = /** @type {IDBDatabase} */ (await openKeyDB());
+    return new Promise((resolve) => {
+      const tx = db.transaction(KEY_STORE_NAME, 'readwrite');
+      tx.objectStore(KEY_STORE_NAME).delete(name);
+      tx.oncomplete = () => { db.close(); resolve(undefined); };
+      tx.onerror = () => { db.close(); resolve(undefined); };
+    });
+  } catch { /* IndexedDB may not be available */ }
+}
+
+// Migrate legacy localStorage keys to IndexedDB (one-time)
+export async function migrateKeysToIndexedDB() {
+  try {
+    const session = load('session');
+    if (session && session.privateKey) {
+      const cryptoKey = await importEd25519Key(session.privateKey);
+      await storeKey('agent_key', cryptoKey);
+      // Remove private key from localStorage, keep metadata
+      delete session.privateKey;
+      save('session', session);
+    }
+    const ownerKey = load('owner_key');
+    if (typeof ownerKey === 'string' && ownerKey.length > 0) {
+      const cryptoKey = await importEd25519Key(ownerKey);
+      await storeKey('owner_key', cryptoKey);
+      remove('owner_key');
+    }
+  } catch (e) {
+    console.warn('AIMEAT: Key migration to IndexedDB failed, falling back to localStorage', e);
+  }
+}
+
+// ── Storage helpers (metadata only — NO private keys) ──
+
+const STORAGE_PREFIX = 'aimeat_';
+
+export function save(key, value) {
+  try { localStorage.setItem(STORAGE_PREFIX + key, JSON.stringify(value)); } catch { /* storage blocked */ }
+}
+
+export function load(key) {
+  try { const v = localStorage.getItem(STORAGE_PREFIX + key); return v ? JSON.parse(v) : null; } catch { return null; }
+}
+
+export function remove(key) {
+  try { localStorage.removeItem(STORAGE_PREFIX + key); } catch { /* storage blocked */ }
+}
+
+// ── JWT helpers ──
+
+export function parseJwt(token) {
+  try {
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    return payload;
+  } catch { return null; }
+}
+
+export function isExpired(jwt) {
+  const payload = parseJwt(jwt);
+  if (!payload || !payload.exp) return true;
+  return Date.now() / 1000 > payload.exp - 60; // 60s grace
+}

package/dist/static/sdk-libs/auth/events.js

@@ -0,0 +1,27 @@
+/**
+ * @file auth/events.js
+ * @description aimeat-auth event bus (SDK-libs migration Phase 3). The shared listener registry +
+ *   emit/on/off that the session layer, pill, modal and boot all use to broadcast
+ *   'login'/'logout'/'refreshed'/'expired'/'session-updated'/'scopes-stale'/'popup-blocked' events.
+ *   `listeners` is only ever mutated in place (never reassigned), so importing it across modules is
+ *   safe. Extracted from auth-lib-part2.ts.
+ * @structure listeners · emit(event, data) · on(event, fn) · off(event, fn).
+ * @usage import { emit, on, off } from './events.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part2.ts (SDK-libs migration Phase 3).
+ */
+
+/** @type {Record<string, Array<(data: any) => void>>} */
+export const listeners = {};
+
+export function emit(event, data) { (listeners[event] || []).forEach(fn => fn(data)); }
+
+export function on(event, fn) {
+  if (!listeners[event]) listeners[event] = [];
+  listeners[event].push(fn);
+}
+
+export function off(event, fn) {
+  if (!listeners[event]) return;
+  listeners[event] = listeners[event].filter(f => f !== fn);
+}

package/dist/static/sdk-libs/auth/i18n.js

@@ -0,0 +1,64 @@
+/**
+ * @file auth/i18n.js
+ * @description aimeat-auth sign-in-modal language helpers (SDK-libs migration Phase 3). The modal can
+ *   be shown standalone (e.g. a custom portal page) where the canonical header + its language switcher
+ *   is absent, so it owns its own EN/FI switch and loads translations itself, using the same
+ *   'aimeat-lang' localStorage key + cookie the header uses so the choice stays in sync with the SPA.
+ *   loadModalI18n fetches en.json (base) + <lang>.json (overrides) from the node and returns just the
+ *   modal.* strings with the 'modal.' prefix stripped. Extracted from auth-lib-part2.ts.
+ * @structure MODAL_LANG_KEY · currentModalLang() · flattenModalI18n() · loadModalI18n(lang).
+ * @usage import { currentModalLang, loadModalI18n } from './i18n.js';
+ * @version-history
+ *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part2.ts (SDK-libs migration Phase 3).
+ */
+import { NODE_URL } from './config.js';
+
+export var MODAL_LANG_KEY = 'aimeat-lang';
+
+export function currentModalLang() {
+  try {
+    var u = new URLSearchParams(location.search).get('lang');
+    if (u === 'en' || u === 'fi') return u;
+    var s = localStorage.getItem(MODAL_LANG_KEY);
+    if (s === 'en' || s === 'fi') return s;
+  } catch { /* storage blocked */ }
+  return (navigator.language || 'en').slice(0, 2).toLowerCase() === 'fi' ? 'fi' : 'en';
+}
+
+export function flattenModalI18n(obj, prefix, out) {
+  out = out || {}; prefix = prefix || '';
+  for (var k in obj) {
+    if (!Object.prototype.hasOwnProperty.call(obj, k)) continue;
+    var key = prefix ? prefix + '.' + k : k;
+    var v = obj[k];
+    if (v && typeof v === 'object' && !Array.isArray(v)) flattenModalI18n(v, key, out);
+    else out[key] = v;
+  }
+  return out;
+}
+
+// Fetch en.json (base) + <lang>.json (overrides) from the node and return just the modal.* strings
+// with the 'modal.' prefix stripped — the shape the modal (and every mountLoginButton caller) expects
+// for opts.i18n.
+export async function loadModalI18n(lang) {
+  var v = Date.now();
+  var t = {};
+  try {
+    var enRes = await fetch(NODE_URL + '/locales/en.json?v=' + v);
+    if (enRes.ok) t = flattenModalI18n(await enRes.json());
+  } catch { /* offline / missing locales — fall through to fallbacks */ }
+  if (lang !== 'en') {
+    try {
+      var locRes = await fetch(NODE_URL + '/locales/' + lang + '.json?v=' + v);
+      if (locRes.ok) {
+        var loc = flattenModalI18n(await locRes.json());
+        for (var lk in loc) if (Object.prototype.hasOwnProperty.call(loc, lk)) t[lk] = loc[lk];
+      }
+    } catch { /* locale missing — English fallback stands */ }
+  }
+  var out = {};
+  for (var k in t) {
+    if (Object.prototype.hasOwnProperty.call(t, k) && k.indexOf('modal.') === 0) out[k.slice(6)] = t[k];
+  }
+  return out;
+}

package/dist/static/sdk-libs/auth/index.js

@@ -0,0 +1,61 @@
+/**
+ * @file auth/index.js
+ * @description Entry for the aimeat-auth library (SDK-libs migration Phase 3). Assembles the auth
+ *   surface from its modules (crypto/config/events/i18n/theme/session/pill/modal/signup), wires boot
+ *   (first-time OIDC signup prompt on load; token refresh on tab focus/visibility), and exposes
+ *   window.AIMEAT.auth + AIMEAT.version. esbuild bundles this + all imports into the classic IIFE
+ *   served, unchanged, at /v1/libs/aimeat-auth.js. Replaces the ~2200-line JS-in-a-string monolith
+ *   (auth-lib.ts + auth-lib-part1/2/3.ts).
+ * @structure imports auth + refreshOnFocus (session) + maybeShowGoogleSignup (signup) + attach; boot
+ *   listeners; attach('auth', auth) + version.
+ * @usage <script src="/v1/libs/aimeat-auth.js"></script>  const s = await AIMEAT.auth.login();
+ * @version-history
+ *   v1.2.0 — 2026-07-26 — An embedded app inherits the embedder's look: aimeatRestoreMode() joins
+ *     aimeatRestorePalette() at parse time, so ?mode= / ?palette= in the frame URL win over an
+ *     origin's own storage without overwriting it.
+ *   v1.1.0 — 2026-07-25 — Palette surface: AIMEAT.auth.getPalette/setPalette/getPalettes + the
+ *     stored palette applied at parse time (theme system v2).
+ *   v1.0.0 — 2026-07-19 — Componentized rewrite of src/routes/libs/auth-lib*.ts (SDK-libs migration Phase 3).
+ */
+import { auth, refreshOnFocus } from './session.js';
+import { maybeShowGoogleSignup } from './signup.js';
+import { attach } from '../_core/namespace.js';
+import { readLocales, aimeatReadLang, aimeatApplyLang } from './locale.js';
+import { PALETTES, aimeatReadPalette, aimeatApplyPalette, aimeatRestorePalette } from './palette.js';
+import { aimeatRestoreMode } from './theme.js';
+
+// ── Boot: first-time OIDC signup prompt (after the callback bounced back with ?aimeat_signup=1) ──
+if (typeof document !== 'undefined' && document.addEventListener) {
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', maybeShowGoogleSignup);
+  else maybeShowGoogleSignup();
+}
+
+// ── Boot: refresh on focus / visibility (timers don't fire while asleep/frozen) ──
+if (typeof document !== 'undefined' && document.addEventListener) {
+  document.addEventListener('visibilitychange', () => {
+    if (document.visibilityState === 'visible') refreshOnFocus();
+  });
+}
+if (typeof window !== 'undefined' && window.addEventListener) {
+  window.addEventListener('focus', refreshOnFocus);
+}
+
+// ── Expose globally ──
+// Locale, resolved the ONE way this platform resolves it ('aimeat-lang': ?lang= -> localStorage
+// -> cookie -> navigator). The pill renders the control; these let an app read and set the same
+// value without re-implementing the lookup and drifting from it. They hang off `auth` (NOT the
+// return of attach(), which is the whole window.AIMEAT namespace) so they land on AIMEAT.auth.
+auth.getLang = function (locales) { return aimeatReadLang(readLocales({ locales: locales })); };
+auth.setLang = function (lang) { aimeatApplyLang(String(lang).toLowerCase()); };
+// Palette (the designed look, orthogonal to light/dark — 'aimeat-palette' + <html data-palette>).
+// The pill renders the picker; these let an app read/set/enumerate the same value.
+auth.getPalette = function () { return aimeatReadPalette(); };
+auth.setPalette = function (id) { aimeatApplyPalette(String(id).toLowerCase()); };
+auth.getPalettes = function () { return PALETTES.map(function (p) { return { id: p.id, label: p.label, swatch: p.swatch }; }); };
+
+// Apply the stored palette at parse time (before any UI mounts), so a published app follows the
+// user's chosen look with zero app code — the same free ride the mode snippet gives light/dark.
+if (typeof document !== 'undefined') { aimeatRestorePalette(); aimeatRestoreMode(); }
+
+const ns = attach('auth', auth);
+ns.version = '2026-07-25-002';

package/dist/static/sdk-libs/auth/locale.js

@@ -0,0 +1,151 @@
+/**
+ * @file auth/locale.js
+ * @description The LANGUAGE switch that travels inside the login pill, exactly as the light/dark
+ *   toggle does — so every embedding app inherits one identical control instead of hand-rolling its
+ *   own. Before this, each app invented its own switcher (a text button, a select, a pair of links),
+ *   and three different storage keys were in play: the SPA's 'aimeat-lang', the aimeat-i18n cortex's
+ *   'aimeat-i18n-locale', and a URL parameter read by nobody in particular.
+ *
+ *   ONE key: 'aimeat-lang' — the same one the SPA and the sign-in modal already use. Reading order is
+ *   ?lang= → localStorage → cookie → navigator, matching public/js/utils.js detectLocale() so an app
+ *   and the SPA agree on the same origin. Writing sets localStorage AND the cookie and fires an
+ *   'aimeat-lang-change' window event; an app re-renders on that event and never manages the control.
+ *
+ *   The app declares which languages it HAS — the pill cannot guess. Either
+ *   `<meta name="aimeat-locales" content="en fi">` (preferred: declarative, like aimeat-scopes) or
+ *   `mountLoginButton('#login', { locales: ['en','fi'] })`. Declare nothing and no switch renders,
+ *   so a single-language app is unaffected.
+ * @structure AIMEAT_LANG_KEY · readLocales · aimeatReadLang/aimeatApplyLang · langName ·
+ *   langSwitchHtml/wireLangSwitch
+ * @usage import { langSwitchHtml, wireLangSwitch } from './locale.js';
+ *   In the app: window.addEventListener('aimeat-lang-change', e => render(e.detail.lang));
+ * @version-history
+ *   v2.0.0 — 2026-07-25 — Segmented control (every option visible, one click to any) up to three
+ *     languages; a popover list beyond that. Replaces the cycling button, which with three or more
+ *     languages was a blind carousel.
+ *   v1.0.0 — 2026-07-25 — Initial. Born from "the language switcher is different in EVERY app".
+ */
+import { escHtml } from './theme.js';
+import { clampPopover } from './cluster.js';
+
+/** The one locale key on this platform. Same as public/js/utils.js and auth/i18n.js. */
+export var AIMEAT_LANG_KEY = 'aimeat-lang';
+
+/** Two-letter codes the APP says it supports. Order matters: it is the cycle order. */
+export function readLocales(opts) {
+  var list = (opts && Array.isArray(opts.locales)) ? opts.locales : null;
+  if (!list) {
+    try {
+      var m = /** @type {HTMLMetaElement|null} */ (document.querySelector('meta[name="aimeat-locales"]'));
+      if (m && m.content) list = m.content.split(/[\s,]+/);
+    } catch { /* no document */ }
+  }
+  if (!list) return [];
+  var seen = {}, out = [];
+  for (var i = 0; i < list.length; i++) {
+    var c = String(list[i] || '').trim().toLowerCase();
+    if (/^[a-z]{2}$/.test(c) && !seen[c]) { seen[c] = 1; out.push(c); }
+  }
+  return out.length > 1 ? out : [];   // one language needs no switch
+}
+
+/** Current locale, resolved the same way the SPA resolves it. */
+export function aimeatReadLang(locales) {
+  var ok = function (v) { return v && locales.indexOf(v) >= 0 ? v : null; };
+  try {
+    var u = ok(new URLSearchParams(location.search).get('lang'));
+    if (u) return u;
+    var s = ok(localStorage.getItem(AIMEAT_LANG_KEY));
+    if (s) return s;
+    var c = document.cookie.match(/(?:^|;\s*)aimeat-lang=([a-z]{2})(?:;|$)/);
+    if (c && ok(c[1])) return c[1];
+  } catch { /* storage blocked */ }
+  var nav = ok((navigator.language || '').slice(0, 2).toLowerCase());
+  return nav || locales[0];
+}
+
+export function aimeatApplyLang(lang) {
+  try {
+    localStorage.setItem(AIMEAT_LANG_KEY, lang);
+    document.cookie = 'aimeat-lang=' + lang + ';path=/;max-age=31536000;SameSite=Lax';
+  } catch { /* storage blocked */ }
+  try { document.documentElement.setAttribute('lang', lang); } catch { /* no document */ }
+  try { window.dispatchEvent(new CustomEvent('aimeat-lang-change', { detail: { lang: lang } })); } catch { /* no window */ }
+}
+
+/** The language's own name for the picker list ("suomi", not "Finnish"), code as the fallback. */
+function langName(code) {
+  try {
+    var dn = new Intl.DisplayNames([code], { type: 'language' });
+    var n = dn.of(code);
+    if (n && n !== code) return n.charAt(0).toUpperCase() + n.slice(1);
+  } catch { /* Intl.DisplayNames unavailable */ }
+  return code.toUpperCase();
+}
+
+/** How many languages still fit as a segmented control before the picker becomes a popover list. */
+var SEGMENT_MAX = 3;
+
+/**
+ * The control: every declared language VISIBLE, the active one marked, one click to any — never a
+ * blind cycle. Up to three languages render as a segmented group (FI | EN); four or more become a
+ * popover list (current code as the trigger) so eight languages cost the header no more width than
+ * two. Cluster classes come from cluster.js (ensureClusterStyles).
+ */
+export function langSwitchHtml(i, locales) {
+  if (!locales.length) return '';
+  var cur = aimeatReadLang(locales);
+  var group = (i && i.switchLanguage ? i.switchLanguage : 'Language');
+  if (locales.length <= SEGMENT_MAX) {
+    return '<span id="aimeat-lang-switch" class="aimeat-seg" role="group" aria-label="' + escHtml(group) + '">'
+      + locales.map(function (c) {
+        return '<button type="button" data-lang="' + escHtml(c) + '" aria-pressed="' + (c === cur) + '" '
+          + 'title="' + escHtml(langName(c)) + '" aria-label="' + escHtml(langName(c)) + '">'
+          + escHtml(c.toUpperCase()) + '</button>';
+      }).join('')
+      + '</span>';
+  }
+  return '<span id="aimeat-lang-switch" class="aimeat-pop-wrap">'
+    + '<button type="button" class="aimeat-pop-btn" aria-haspopup="listbox" aria-expanded="false" '
+    + 'title="' + escHtml(group) + '" aria-label="' + escHtml(group) + '">'
+    + escHtml(cur.toUpperCase()) + ' <span aria-hidden="true">▾</span></button>'
+    + '<span class="aimeat-pop aimeat-pop-list" role="listbox">'
+    + locales.map(function (c) {
+      return '<button type="button" role="option" data-lang="' + escHtml(c) + '" aria-pressed="' + (c === cur) + '">'
+        + escHtml(c.toUpperCase()) + ' · ' + escHtml(langName(c)) + '</button>';
+    }).join('')
+    + '</span></span>';
+}
+
+export function wireLangSwitch(container, i, locales) {
+  var root = container.querySelector('#aimeat-lang-switch');
+  if (!root || !locales.length) return;
+  var trigger = root.querySelector('.aimeat-pop-btn');
+  function sync(cur) {
+    root.querySelectorAll('button[data-lang]').forEach(function (b) {
+      b.setAttribute('aria-pressed', String(b.getAttribute('data-lang') === cur));
+    });
+    if (trigger) trigger.childNodes[0].textContent = cur.toUpperCase() + ' ';
+  }
+  root.querySelectorAll('button[data-lang]').forEach(function (b) {
+    b.addEventListener('click', function () {
+      aimeatApplyLang(b.getAttribute('data-lang'));
+      sync(b.getAttribute('data-lang'));
+      root.classList.remove('aimeat-open');
+      if (trigger) trigger.setAttribute('aria-expanded', 'false');
+    });
+  });
+  if (trigger) trigger.addEventListener('click', function (ev) {
+    ev.stopPropagation();
+    var open = root.classList.toggle('aimeat-open');
+    trigger.setAttribute('aria-expanded', String(open));
+    if (open) clampPopover(root.querySelector('.aimeat-pop'));
+  });
+  // Stay truthful when the APP sets the language itself (AIMEAT.auth.setLang, a deep link, the
+  // i18n cortex): a control showing the wrong language is worse than no control.
+  window.addEventListener('aimeat-lang-change', function (ev) {
+    var e = /** @type {CustomEvent} */ (ev);
+    var lang = e && e.detail && e.detail.lang;
+    if (lang && locales.indexOf(lang) >= 0) sync(lang);
+  });
+}