aimeat 2.5.0 → 2.6.0

package/dist/.env.example

@@ -273,6 +273,16 @@ AIMEAT_PORT=40050
 # AIMEAT_STORAGE_QUOTA_MB=100
 # AIMEAT_STORAGE_MAX_FILE_SIZE_MB=10
 # AIMEAT_STORAGE_MAX_CHUNKED_FILE_SIZE_GB=5
+# ── Speech-to-text (POST /v1/ai/transcribe, voice messages) ──
+# Largest audio file accepted for transcription. 25 MB is the provider-side multipart ceiling, so
+# raising this past it turns a clear local refusal into an opaque upstream one.
+# AIMEAT_STT_MAX_MB=25
+# Duration guideline in seconds. Checked after the call (only the response knows the duration) and
+# logged; a transcription the owner has already paid for is never withheld. 0 disables the warning.
+# AIMEAT_STT_MAX_SECONDS=600
+# Hard cap on one browser voice-message recording, in seconds. Served to the UI so the recorder stops
+# at this node's number. Raise it for long-form dictation; every second still costs the owner money.
+# AIMEAT_VOICE_MSG_MAX_SECONDS=300
 # AIMEAT_MICRO_MEMORY_QUOTA_KB=500
 # AIMEAT_MICRO_MEMORY_MAX_SETS=50
 # AIMEAT_MICRO_MEMORY_MAX_KEYS_PER_SET=100
@@ -469,6 +479,29 @@ AIMEAT_PORT=40050
 # AIMEAT_ENTRA_OAUTH_CLIENT_SECRET=""                          # Client secret value from the app registration
 # AIMEAT_ENTRA_OAUTH_REDIRECT_URI=""                           # default: <baseUrl>/v1/ghii/login/entra/callback
 
+# ── Outbound connections (TARGET-057, aimeat-connect) ────────
+# Lets a principal connect THEIR OWN account at an external service (Mastodon, YouTube, Bluesky) so
+# an app can publish there on their behalf. The opposite direction from the sign-in blocks above,
+# and deliberately its own client: signing IN with Google and PUBLISHING to a Google account are
+# different consent and must be separately revocable.
+#
+# WHICH SECRET GOES WHERE — the distinction that catches everyone:
+#   • The values below identify the APPLICATION. One per node, the SAME for every user. If they were
+#     per-user, every user would have to create their own Google Cloud project.
+#   • The USER's access/refresh token identifies THE ACCOUNT. It is never here: it lives encrypted in
+#     the Connection table, keyed by the principal who connected it.
+#   • Mastodon has nothing here at all. Its client credentials are issued PER INSTANCE and there are
+#     hundreds of instances, so the node registers itself on first contact and remembers the result.
+#
+# Off by default. An unconfigured provider is absent from discovery and refused at start with a
+# reason; nothing here fails open.
+# AIMEAT_CONNECTIONS_ENABLED=false
+# AIMEAT_CONNECT_GOOGLE_CLIENT_ID=""                           # Google Cloud → Clients → Web application
+# AIMEAT_CONNECT_GOOGLE_CLIENT_SECRET=""                       # from the same client; NOT the sign-in client
+# AIMEAT_CONNECT_REDIRECT_URI=""                               # default: <baseUrl>/v1/connections/callback
+#   The redirect URI must match the provider's registration EXACTLY — scheme, port, no trailing
+#   slash. A mismatch surfaces only at the provider's consent screen, as redirect_uri_mismatch.
+
 # ── Consul (optional fleet management) ───────────────────────
 # Connect to HashiCorp Consul for centralized config management across nodes.
 # Values in Consul KV take precedence over file/.env but below database overrides.

package/dist/build-stamp.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": 1,
+  "version": "2.6.0",
+  "commit": "9cca6f004888be424d1b031da77a2a04693b856f",
+  "dirty": false,
+  "built_at": "2026-08-02T01:53:22.702Z",
+  "newest_source_mtime": 1785635326931.713,
+  "source_dirs": [
+    "src",
+    "bin",
+    "scripts"
+  ]
+}

package/dist/locales/en.json

@@ -2985,7 +2985,27 @@
       "agCapSaved": "Spending limit saved",
       "agCapResetBtn": "Clear counter",
       "agCapReset": "Counter cleared",
-      "agCapFailed": "Could not change the limit"
+      "agCapFailed": "Could not change the limit",
+      "cxTitle": "Connected accounts",
+      "cxIntro": "Accounts you have connected at other services. The credential stays on this node — an app is only ever told which account it may use, never the account itself.",
+      "cxEmpty": "No connected accounts yet.",
+      "cxConnect": "Connect",
+      "cxConnecting": "Connecting…",
+      "cxDisconnect": "Disconnect",
+      "cxReconnect": "Reconnect",
+      "cxNeedsReauth": "needs reconnecting",
+      "cxInstance": "instance address, e.g. mastodon.social",
+      "cxConfirm": "Disconnect {account}? Apps that publish to it will stop being able to.",
+      "cxRevokedTold": "Disconnected, and the service was told.",
+      "cxRevokedLocal": "Disconnected here. The service could not be reached to be told, so check it there too.",
+      "cxRevokeFailed": "Could not disconnect that account",
+      "cxConnectFailed": "Could not start connecting that account",
+      "cxNoteMastodonNeeds": "The address of your instance, for example mastodon.social.",
+      "cxNoteMastodonBefore": "Your account lives at one instance, and the same name at another instance is a different account.",
+      "cxNoteYoutubeBefore": "Sign in with the Google account that owns the channel. A Google account with no YouTube channel will connect and then have nowhere to publish.",
+      "cxNoteBlueskyNeeds": "An app password. This is not your Bluesky password.",
+      "cxNoteBlueskyWhere": "Bluesky → Settings → Privacy and security → App passwords.",
+      "cxNoteBlueskyBefore": "This is the one service that asks you to copy a secret to us instead of approving on their own site. You can revoke it from Bluesky at any time, and it cannot be used to sign in as you."
     },
     "nodes": {
       "title": "Personal Nodes",
@@ -3817,7 +3837,133 @@
       "pinRemove": "Unpin",
       "pinLimit": "Max 5 pinned items"
     },
-    "mcpConnected": "MCP connected"
+    "mcpConnected": "MCP connected",
+    "openrouter": {
+      "title": "AI provider",
+      "statusReady": "Key saved",
+      "statusNoKey": "No key",
+      "section": {
+        "connection": "Connection",
+        "models": "Models",
+        "params": "Model parameters",
+        "budget": "Budget and app spending"
+      },
+      "provider": "Provider",
+      "provider_openrouter": "OpenRouter",
+      "provider_lmstudio": "LM Studio",
+      "provider_custom": "Custom (OpenAI-compatible)",
+      "baseUrl": "API base URL",
+      "baseUrl_hint": "https://…/v1",
+      "apiKey": "API key",
+      "apiKeyPlaceholder": "sk-or-v1-…",
+      "apiKeyMasked": "●●●●●●●●",
+      "saveKey": "Save key",
+      "keySaved": "Key saved.",
+      "providerSaved": "Provider saved.",
+      "saveFailed": "Save failed.",
+      "save": "Save",
+      "cancel": "Cancel",
+      "saveModels": "Save models",
+      "modelsSaved": "Models saved.",
+      "saveParams": "Save parameters",
+      "paramsSaved": "Parameters saved.",
+      "testConnection": "Test",
+      "testOk": "Connection works ({model}, {ms} ms).",
+      "testFail": "Connection failed",
+      "testBudgetSpent": "Daily AI budget is spent — the key itself is fine",
+      "delete": "Remove key",
+      "deleted": "Key and settings removed.",
+      "deleteConfirm": "Remove your API key and AI settings from this node?",
+      "getKeyLink": "Get an API key",
+      "creditsLink": "Check your credit balance",
+      "modelsRefresh": "Refresh models",
+      "modelsHint": "Fetched from the provider after you save the key.",
+      "modelsError": "Could not load models. Check the base URL and key, save, then refresh.",
+      "modelsEmpty": "The provider returned no models. Check the base URL.",
+      "paramDefault": "default",
+      "autoRetry": "Retry automatically on a validation error",
+      "maxRetries": "Max retries",
+      "temperature": "Temperature",
+      "temperature_hint": "0 = deterministic, 1 = default, 2 = most creative",
+      "topP": "Top P",
+      "topP_hint": "Nucleus sampling: 0.1 = focused, 1.0 = full range",
+      "maxTokens": "Max tokens",
+      "maxTokens_hint": "Longest answer. Empty = the model's own default.",
+      "model": {
+        "default": "Default model",
+        "reasoning": "Reasoning model",
+        "reasoning_hint": "Used for planning and analysis when a caller asks for the reasoning role.",
+        "execution": "Execution model",
+        "execution_hint": "Used for code, tests and assembly when a caller asks for the execution role.",
+        "rolesSummary": "Separate models for reasoning and execution",
+        "vision": "Vision model (images)",
+        "vision_hint": "Reads images you attach. Your default model is often text-only.",
+        "visionNone": "Not in use — do not read images",
+        "stt": "Speech-to-text model",
+        "stt_hint": "Turns voice messages into text. Without one, transcription stays off.",
+        "sttNone": "Not in use — no transcription",
+        "none": "Not selected",
+        "clear": "Clear",
+        "notInList": "not in the current list",
+        "searchPlaceholder": "Search {n} models…",
+        "recommended": "Recommended",
+        "showAll": "Show all {n}",
+        "noMatch": "No model matches that search.",
+        "openPage": "Open the model page on OpenRouter",
+        "customIdPlaceholder": "model id, e.g. whisper-1",
+        "customIdUse": "Use",
+        "customIdHint": "A self-hosted endpoint may serve models its catalogue does not list."
+      },
+      "price": {
+        "perMillionIn": "{usd} / M in",
+        "perMillionOut": "{usd} / M out",
+        "free": "free",
+        "context": "{n} context",
+        "audioReported": "price {value}"
+      },
+      "stt": {
+        "language": "Language",
+        "languageAuto": "Detect automatically",
+        "language_hint": "A hint helps a single known language; leave it automatic for mixed speech.",
+        "lang_fi": "Finnish",
+        "lang_en": "English",
+        "lang_sv": "Swedish",
+        "lang_de": "German",
+        "lang_fr": "French",
+        "lang_es": "Spanish",
+        "lang_et": "Estonian",
+        "listEmpty": "This provider offers no transcription models.",
+        "test": "Test transcription",
+        "testing": "Transcribing…",
+        "testNeedsModel": "Choose a model first.",
+        "testFailed": "Test failed.",
+        "testSilent": "(nothing recognised)",
+        "measured": "Measured: {seconds} s of audio, ${cost}.",
+        "costNotReported": "The provider reported no price."
+      },
+      "budget": {
+        "title": "Daily AI budget",
+        "desc": "Everything that spends your key shares this budget: apps calling AIMEAT.ai.complete(), and transcription. Once it is used up, further calls are refused.",
+        "change": "Change",
+        "budgetSaved": "Budget saved.",
+        "budgetRange": "The budget must be a number between 0 and 1000.",
+        "capRange": "The cap for \"{app}\" must be a number between 0 and 1000.",
+        "capsSaved": "Per-app limits saved.",
+        "saveCaps": "Save per-app limits",
+        "saveFailed": "Save failed.",
+        "perApp": "Per-app limits and spending ({n})",
+        "perAppHint": "Every app may spend up to the daily budget. Set a cap to hold one below it; leave it empty to allow the full budget.",
+        "colApp": "App",
+        "colSpent": "Spent today",
+        "colCap": "Daily cap ($)",
+        "colCalls": "Calls",
+        "chartTitle": "Usage over 30 days",
+        "metricCost": "Cost",
+        "metricTokens": "Tokens",
+        "metricSeconds": "Seconds",
+        "footnote": "Cost is estimated when the provider does not report one (LM Studio, custom). Your provider's own dashboard has the authoritative bill."
+      }
+    }
   },
   "dev": {
     "title": "Connect your AI to this node",
@@ -8445,5 +8591,22 @@
   "biz.transTitle": "AI transparency your compliance officer can read",
   "biz.trans1": "Article 50 of the EU AI Act has applied since 2 August 2026. What you get here is an EU-built, self-hostable platform where AI provenance is a primitive of the layer every app sits on: content a model produced carries a record of how it was made, a person reading it on the node’s own surfaces sees a label, and the operator’s legal identity and supervisory authority sit at a fixed machine-readable address your compliance officer can fetch without asking us. Content the node served can be checked by anyone, byte for byte, with no account.",
   "biz.trans2": "What stays yours: the obligations that come with what you publish. Running on AIMEAT does not discharge them, and we would rather say so here than have you discover it later. What the platform does is make marking, labelling and the record the default path instead of a project.",
-  "biz.transCta": "How this node marks AI content →"
+  "biz.transCta": "How this node marks AI content →",
+  "voice.record": "Record a voice message",
+  "voice.recording": "Recording",
+  "voice.stop": "Stop",
+  "voice.cancel": "Discard recording",
+  "voice.capped": "Reached the {n} second limit",
+  "voice.errDenied": "Microphone access was denied. Allow it in your browser's site settings.",
+  "voice.errNoMic": "No microphone found.",
+  "voice.errUnsupported": "This browser cannot record audio.",
+  "voice.errFailed": "Recording failed.",
+  "inbox.transcript": "Transcript",
+  "inbox.transcriptBySender": "written by the sender",
+  "inbox.transcriptByYou": "transcribed by you ({model})",
+  "inbox.transcribe": "Transcribe",
+  "inbox.transcribing": "Transcribing…",
+  "inbox.transcribeFailed": "Transcription failed.",
+  "inbox.transcribeNoModel": "Choose a transcription model in Settings to turn speech into text.",
+  "inbox.voiceMessage": "Voice message"
 }

package/dist/locales/fi.json

@@ -2985,7 +2985,27 @@
       "agCapSaved": "Kulutusraja tallennettu",
       "agCapResetBtn": "Nollaa laskuri",
       "agCapReset": "Laskuri nollattu",
-      "agCapFailed": "Rajan muuttaminen ei onnistunut"
+      "agCapFailed": "Rajan muuttaminen ei onnistunut",
+      "cxTitle": "Liitetyt tilit",
+      "cxIntro": "Tilit jotka olet liittänyt muihin palveluihin. Tunnus pysyy tällä nodella — appi saa tietää vain minkä tilin se saa käyttöönsä, ei itse tiliä.",
+      "cxEmpty": "Et ole vielä liittänyt yhtään tiliä.",
+      "cxConnect": "Liitä",
+      "cxConnecting": "Liitetään…",
+      "cxDisconnect": "Katkaise",
+      "cxReconnect": "Valtuuta uudelleen",
+      "cxNeedsReauth": "vaatii uuden valtuutuksen",
+      "cxInstance": "instanssin osoite, esim. mastodon.social",
+      "cxConfirm": "Katkaistaanko {account}? Sinne julkaisevat apit eivät enää pysty siihen.",
+      "cxRevokedTold": "Katkaistu, ja palvelulle kerrottiin.",
+      "cxRevokedLocal": "Katkaistu täällä. Palveluun ei saatu yhteyttä, joten tarkista tilanne myös sieltä.",
+      "cxRevokeFailed": "Tilin katkaisu ei onnistunut",
+      "cxConnectFailed": "Tilin liittämistä ei saatu käyntiin",
+      "cxNoteMastodonNeeds": "Instanssisi osoite, esimerkiksi mastodon.social.",
+      "cxNoteMastodonBefore": "Tilisi asuu yhdellä instanssilla, ja sama nimi toisella instanssilla on eri tili.",
+      "cxNoteYoutubeBefore": "Kirjaudu sillä Google-tilillä joka omistaa kanavan. Tili jolla ei ole YouTube-kanavaa liittyy kyllä, mutta sillä ei ole mihin julkaista.",
+      "cxNoteBlueskyNeeds": "App password. Se ei ole Bluesky-salasanasi.",
+      "cxNoteBlueskyWhere": "Bluesky → Settings → Privacy and security → App passwords.",
+      "cxNoteBlueskyBefore": "Tämä on ainoa palvelu joka pyytää kopioimaan salaisuuden meille sen sijaan että hyväksyisit sen heidän omalla sivullaan. Voit perua sen Blueskyssä milloin tahansa, eikä sillä voi kirjautua sinuna."
     },
     "nodes": {
       "title": "Henkilökohtaiset solmut",
@@ -3817,7 +3837,133 @@
       "pinRemove": "Irrota",
       "pinLimit": "Enintään 5 kiinnitettyä"
     },
-    "mcpConnected": "MCP kytketty"
+    "mcpConnected": "MCP kytketty",
+    "openrouter": {
+      "title": "Tekoälypalvelu",
+      "statusReady": "Avain tallennettu",
+      "statusNoKey": "Ei avainta",
+      "section": {
+        "connection": "Yhteys",
+        "models": "Mallit",
+        "params": "Mallin parametrit",
+        "budget": "Budjetti ja sovellusten kulutus"
+      },
+      "provider": "Palvelu",
+      "provider_openrouter": "OpenRouter",
+      "provider_lmstudio": "LM Studio",
+      "provider_custom": "Oma (OpenAI-yhteensopiva)",
+      "baseUrl": "API-osoite",
+      "baseUrl_hint": "https://…/v1",
+      "apiKey": "API-avain",
+      "apiKeyPlaceholder": "sk-or-v1-…",
+      "apiKeyMasked": "●●●●●●●●",
+      "saveKey": "Tallenna avain",
+      "keySaved": "Avain tallennettu.",
+      "providerSaved": "Palvelu tallennettu.",
+      "saveFailed": "Tallennus epäonnistui.",
+      "save": "Tallenna",
+      "cancel": "Peruuta",
+      "saveModels": "Tallenna mallit",
+      "modelsSaved": "Mallit tallennettu.",
+      "saveParams": "Tallenna parametrit",
+      "paramsSaved": "Parametrit tallennettu.",
+      "testConnection": "Testaa",
+      "testOk": "Yhteys toimii ({model}, {ms} ms).",
+      "testFail": "Yhteys ei toimi",
+      "testBudgetSpent": "Päivän tekoälybudjetti on käytetty — avaimessa ei ole vikaa",
+      "delete": "Poista avain",
+      "deleted": "Avain ja asetukset poistettu.",
+      "deleteConfirm": "Poistetaanko API-avain ja tekoälyasetukset tältä solmulta?",
+      "getKeyLink": "Hanki API-avain",
+      "creditsLink": "Tarkista saldo",
+      "modelsRefresh": "Päivitä mallit",
+      "modelsHint": "Haetaan palvelusta, kun avain on tallennettu.",
+      "modelsError": "Malleja ei saatu. Tarkista osoite ja avain, tallenna ja päivitä.",
+      "modelsEmpty": "Palvelu ei palauttanut yhtään mallia. Tarkista osoite.",
+      "paramDefault": "oletus",
+      "autoRetry": "Yritä automaattisesti uudelleen validointivirheessä",
+      "maxRetries": "Yritysten enimmäismäärä",
+      "temperature": "Lämpötila",
+      "temperature_hint": "0 = toistettava, 1 = oletus, 2 = luovin",
+      "topP": "Top P",
+      "topP_hint": "Nucleus-otanta: 0,1 = kapea, 1,0 = koko kirjo",
+      "maxTokens": "Enimmäistokenit",
+      "maxTokens_hint": "Vastauksen enimmäispituus. Tyhjä = mallin oma oletus.",
+      "model": {
+        "default": "Oletusmalli",
+        "reasoning": "Päättelymalli",
+        "reasoning_hint": "Käytetään suunnitteluun ja analyysiin, kun kutsuja pyytää päättelyroolia.",
+        "execution": "Suoritusmalli",
+        "execution_hint": "Käytetään koodiin, testeihin ja kokoamiseen, kun kutsuja pyytää suoritusroolia.",
+        "rolesSummary": "Erilliset mallit päättelylle ja suoritukselle",
+        "vision": "Kuvamalli",
+        "vision_hint": "Lukee liittämäsi kuvat. Oletusmalli on usein pelkkä tekstimalli.",
+        "visionNone": "Ei käytössä — älä lue kuvia",
+        "stt": "Puheentunnistusmalli",
+        "stt_hint": "Muuttaa ääniviestit tekstiksi. Ilman mallia litterointi on pois käytöstä.",
+        "sttNone": "Ei käytössä — ei litterointia",
+        "none": "Ei valittu",
+        "clear": "Tyhjennä",
+        "notInList": "ei nykyisessä listassa",
+        "searchPlaceholder": "Hae {n} mallista…",
+        "recommended": "Suositellut",
+        "showAll": "Näytä kaikki {n}",
+        "noMatch": "Haku ei osunut yhteenkään malliin.",
+        "openPage": "Avaa mallin sivu OpenRouterissa",
+        "customIdPlaceholder": "mallin tunnus, esim. whisper-1",
+        "customIdUse": "Käytä",
+        "customIdHint": "Oma palvelin voi tarjota malleja, joita sen katalogi ei listaa."
+      },
+      "price": {
+        "perMillionIn": "{usd} / M sisään",
+        "perMillionOut": "{usd} / M ulos",
+        "free": "ilmainen",
+        "context": "konteksti {n}",
+        "audioReported": "hinta {value}"
+      },
+      "stt": {
+        "language": "Kieli",
+        "languageAuto": "Tunnista automaattisesti",
+        "language_hint": "Vihje auttaa yhdessä tunnetussa kielessä; jätä automaattiseksi sekakieliselle puheelle.",
+        "lang_fi": "suomi",
+        "lang_en": "englanti",
+        "lang_sv": "ruotsi",
+        "lang_de": "saksa",
+        "lang_fr": "ranska",
+        "lang_es": "espanja",
+        "lang_et": "viro",
+        "listEmpty": "Tämä palvelu ei tarjoa litterointimalleja.",
+        "test": "Testaa litterointi",
+        "testing": "Litteroidaan…",
+        "testNeedsModel": "Valitse ensin malli.",
+        "testFailed": "Testi epäonnistui.",
+        "testSilent": "(ei tunnistettu mitään)",
+        "measured": "Mitattu: {seconds} s ääntä, {cost} $.",
+        "costNotReported": "Palvelu ei ilmoittanut hintaa."
+      },
+      "budget": {
+        "title": "Päivittäinen tekoälybudjetti",
+        "desc": "Kaikki avaintasi kuluttava jakaa tämän budjetin: AIMEAT.ai.complete() -kutsut sovelluksista ja litterointi. Kun budjetti on käytetty, seuraavat kutsut hylätään.",
+        "change": "Muuta",
+        "budgetSaved": "Budjetti tallennettu.",
+        "budgetRange": "Budjetin on oltava luku väliltä 0–1000.",
+        "capRange": "Sovelluksen \"{app}\" katon on oltava luku väliltä 0–1000.",
+        "capsSaved": "Sovelluskohtaiset rajat tallennettu.",
+        "saveCaps": "Tallenna sovelluskohtaiset rajat",
+        "saveFailed": "Tallennus epäonnistui.",
+        "perApp": "Sovelluskohtaiset rajat ja kulutus ({n})",
+        "perAppHint": "Jokainen sovellus saa kuluttaa koko päiväbudjetin. Aseta katto pitääksesi yhden sen alla; tyhjä = koko budjetti.",
+        "colApp": "Sovellus",
+        "colSpent": "Kulutettu tänään",
+        "colCap": "Päiväkatto ($)",
+        "colCalls": "Kutsuja",
+        "chartTitle": "Käyttö 30 päivän ajalta",
+        "metricCost": "Kulu",
+        "metricTokens": "Tokenit",
+        "metricSeconds": "Sekunnit",
+        "footnote": "Hinta on arvio, kun palvelu ei ilmoita sitä (LM Studio, oma palvelin). Palveluntarjoajan oma näkymä on lasku, joka pätee."
+      }
+    }
   },
   "dev": {
     "title": "Yhdistä tekoälysi tähän nodeen",
@@ -8445,5 +8591,22 @@
   "biz.transTitle": "Tekoälyn läpinäkyvyys, jonka vastuuhenkilösi voi lukea",
   "biz.trans1": "EU:n tekoälyasetuksen 50 artiklaa on sovellettu 2.8.2026 alkaen. Täällä saat eurooppalaisen, itse ylläpidettävän alustan, jossa tekoälyn alkuperätieto kuuluu siihen kerrokseen jonka päällä jokainen appi toimii: mallin tuottama sisältö kantaa mukanaan tiedon siitä miten se syntyi, noden omilla pinnoilla lukija näkee merkinnän, ja ylläpitäjän oikeushenkilö sekä valvova viranomainen ovat kiinteässä koneluettavassa osoitteessa, jonka vastuuhenkilösi voi hakea kysymättä meiltä. Noden lähettämän sisällön voi kuka tahansa tarkistaa tavu tavulta ilman tiliä.",
   "biz.trans2": "Sinulle jää vastuu siitä mitä itse julkaiset. AIMEATin päällä ajaminen ei poista sitä, ja sanomme sen mieluummin tässä kuin annamme sinun huomata sen myöhemmin. Alusta tekee sen, että merkitseminen, tallentaminen ja näyttäminen on oletustie eikä projekti.",
-  "biz.transCta": "Näin tämä node merkitsee tekoälysisällön →"
+  "biz.transCta": "Näin tämä node merkitsee tekoälysisällön →",
+  "voice.record": "Nauhoita ääniviesti",
+  "voice.recording": "Nauhoitetaan",
+  "voice.stop": "Lopeta",
+  "voice.cancel": "Hylkää nauhoitus",
+  "voice.capped": "Saavutti {n} sekunnin rajan",
+  "voice.errDenied": "Mikrofonin käyttö estettiin. Salli se selaimen sivustoasetuksista.",
+  "voice.errNoMic": "Mikrofonia ei löytynyt.",
+  "voice.errUnsupported": "Tämä selain ei osaa nauhoittaa ääntä.",
+  "voice.errFailed": "Nauhoitus epäonnistui.",
+  "inbox.transcript": "Tekstitys",
+  "inbox.transcriptBySender": "lähettäjän kirjoittama",
+  "inbox.transcriptByYou": "sinun litteroimasi ({model})",
+  "inbox.transcribe": "Litteroi",
+  "inbox.transcribing": "Litteroidaan…",
+  "inbox.transcribeFailed": "Litterointi epäonnistui.",
+  "inbox.transcribeNoModel": "Valitse asetuksista puheentunnistusmalli, niin saat puheen tekstiksi.",
+  "inbox.voiceMessage": "Ääniviesti"
 }

package/dist/public/components/VoiceRecorder.js

@@ -0,0 +1,116 @@
+/**
+ * @file VoiceRecorder.js
+ * @description Record-a-voice-clip control, shared by the inbox composer and the OpenRouter
+ *   settings' transcription test. Wraps /js/services/audio-recorder.js in a Preact button that
+ *   shows what is happening: elapsed time, a live input level so a dead microphone is obvious
+ *   immediately, and separate stop-and-keep versus cancel-and-discard actions.
+ *
+ *   Press to start, press again to stop. Not press-and-hold: on a touch screen that loses the
+ *   recording to any accidental lift, and it makes a long message physically tiring.
+ * @structure VoiceRecorder (control) · useRecorder (state machine)
+ * @usage <${VoiceRecorder} maxSeconds=${300} onRecorded=${(file, seconds) => …} />
+ * @version-history
+ *   v1.0.0 — 2026-08-01 — Initial version (voice messages + STT settings test).
+ */
+import { h } from 'preact';
+import { useState, useRef, useEffect } from 'preact/hooks';
+import htm from 'htm';
+const html = htm.bind(h);
+import { t } from '/js/i18n.js';
+import { startRecording, isRecordingSupported, fmtDuration } from '/js/services/audio-recorder.js';
+
+/**
+ * @param {object} props
+ * @param {(file: File, durationSeconds: number) => void} props.onRecorded
+ * @param {number} [props.maxSeconds]   hard stop (the node's AIMEAT_VOICE_MSG_MAX_SECONDS)
+ * @param {boolean} [props.disabled]
+ * @param {string} [props.label]        text next to the icon; omitted = icon only
+ * @param {string} [props.className]    extra class on the idle button (host styling)
+ */
+export function VoiceRecorder({ onRecorded, maxSeconds = 300, disabled = false, label, className = '' }) {
+  const [state, setState] = useState('idle');   // idle | starting | recording | finishing
+  const [seconds, setSeconds] = useState(0);
+  const [level, setLevel] = useState(0);
+  const [error, setError] = useState(null);
+  const [capped, setCapped] = useState(false);
+  const recRef = useRef(null);
+
+  // Leaving the view mid-recording must release the microphone. Without this the browser's recording
+  // indicator stays lit after the user has navigated away, which reads as an app still listening.
+  useEffect(() => () => { try { recRef.current?.cancel(); } catch { /* gone already */ } }, []);   // eslint-disable-line aimeat/no-silent-catch -- teardown of an already-torn-down recorder
+
+  if (!isRecordingSupported()) return null;
+
+  async function begin() {
+    setError(null); setCapped(false); setSeconds(0); setLevel(0); setState('starting');
+    try {
+      recRef.current = await startRecording({
+        maxSeconds,
+        onTick: setSeconds,
+        onLevel: setLevel,
+        onAutoStop: () => { setCapped(true); finish(); },
+      });
+      setState('recording');
+    } catch (e) {
+      setState('idle');
+      // Say which of the three it was: a denied permission, no microphone, or a browser that cannot.
+      const name = e?.name || '';
+      setError(
+        name === 'NotAllowedError' || name === 'SecurityError' ? t('voice.errDenied')
+          : name === 'NotFoundError' ? t('voice.errNoMic')
+          : e?.message === 'unsupported' ? t('voice.errUnsupported')
+          : (e?.message || t('voice.errFailed')),
+      );
+    }
+  }
+
+  async function finish() {
+    const rec = recRef.current;
+    if (!rec) return;
+    setState('finishing');
+    try {
+      const { file, durationSeconds } = await rec.stop();
+      recRef.current = null;
+      setState('idle'); setSeconds(0); setLevel(0);
+      onRecorded(file, durationSeconds);
+    } catch (e) {
+      recRef.current = null;
+      setState('idle');
+      setError(e?.message || t('voice.errFailed'));
+    }
+  }
+
+  function discard() {
+    try { recRef.current?.cancel(); } catch { /* already stopped */ }   // eslint-disable-line aimeat/no-silent-catch -- cancel is best-effort; the state reset below is what matters
+    recRef.current = null;
+    setState('idle'); setSeconds(0); setLevel(0); setCapped(false);
+  }
+
+  if (state === 'recording' || state === 'finishing') {
+    const near = maxSeconds > 0 && seconds >= maxSeconds - 10;
+    return html`
+      <span class="vr-active" role="group" aria-label=${t('voice.recording')}>
+        <span class="vr-dot" aria-hidden="true"></span>
+        <span class=${`vr-time${near ? ' vr-time--near' : ''}`}>${fmtDuration(seconds)}</span>
+        <span class="vr-meter" aria-hidden="true">
+          <span class="vr-meter-fill" style=${`width:${Math.round(Math.min(1, level * 1.6) * 100)}%`}></span>
+        </span>
+        <button type="button" class="btn-primary btn-sm vr-stop" disabled=${state === 'finishing'}
+                onClick=${finish} title=${t('voice.stop')} aria-label=${t('voice.stop')}>
+          ${state === 'finishing' ? '…' : t('voice.stop')}
+        </button>
+        <button type="button" class="btn-ghost btn-sm vr-cancel" disabled=${state === 'finishing'}
+                onClick=${discard} title=${t('voice.cancel')} aria-label=${t('voice.cancel')}>✕</button>
+        ${capped ? html`<span class="vr-note">${t('voice.capped', { n: maxSeconds })}</span>` : null}
+      </span>`;
+  }
+
+  return html`
+    <span class="vr-wrap">
+      <button type="button" class=${`vr-btn ${className}`} disabled=${disabled || state === 'starting'}
+              onClick=${begin} title=${t('voice.record')} aria-label=${t('voice.record')}>
+        <span class="vr-ico" aria-hidden="true">🎤</span>${label ? html`<span class="vr-label">${label}</span>` : null}
+      </button>
+      ${error ? html`<span class="vr-error">${error}</span>` : null}
+    </span>`;
+}

package/dist/public/connection-done.html

@@ -0,0 +1,53 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Account connected</title>
+  <!--
+    Where the provider's redirect lands after a connection is finished (TARGET-057).
+
+    It is a STATIC file rather than something the node renders, because the backend is protocol-only
+    and does not build pages.
+
+    IT ANNOUNCES OVER BroadcastChannel, not window.opener. This node sets a Cross-Origin-Opener-Policy,
+    which severs the opener relationship the moment the pop-up navigates to the provider — so
+    window.opener is null here and the page that opened this one cannot read window.closed either.
+    The first version relied on exactly that and produced ten "COOP would block the window.closed
+    call" errors per connection while appearing to work.
+
+    BroadcastChannel is same-origin and unaffected by COOP, so this reaches the opener directly. The
+    opener also polls the server as a fallback, because a user who closes the pop-up early never
+    reaches this page at all.
+  -->
+  <style>
+    html { color-scheme: light dark; }
+    body {
+      margin: 0; min-height: 100vh; display: grid; place-items: center;
+      font: 1rem/1.5 system-ui, sans-serif; padding: 1.5rem; text-align: center;
+    }
+    p { max-width: 28rem; margin: 0; }
+  </style>
+</head>
+<body>
+  <p id="msg">Account connected. You can close this window.</p>
+  <script>
+    try {
+      const ch = new BroadcastChannel('aimeat-connect');
+      ch.postMessage({ type: 'connected' });
+      ch.close();
+    } catch (err) {
+      // Reported rather than swallowed: without this message the opener falls back to polling, which
+      // is slower but still correct, and an operator should be able to tell the two paths apart.
+      console.warn('[aimeat-connect] could not announce over BroadcastChannel', err);
+    }
+    // Attempted, not assumed. A window the script did not open cannot close itself in most
+    // browsers, which is what happens when someone reaches this URL directly — and a blank page
+    // would then read as a failure when the connection has in fact already succeeded.
+    try { window.close(); } catch (err) {
+      document.getElementById('msg').textContent =
+        'Account connected. You can close this window. (' + err.message + ')';
+    }
+  </script>
+</body>
+</html>