aimeat 2.7.0 → 3.0.0

package/dist/static/sdk-libs/auth/session.js

@@ -13,10 +13,13 @@
  * @usage import { auth, api, isAppOrigin, restoreSessionFromAppOrigin } from './session.js';
  * @version-history
  *   v1.0.0 — 2026-07-19 — Merged from src/routes/libs/auth-lib-part1/2/3.ts (SDK-libs migration Phase 3).
+ *   v1.1.0 — 2026-08-07 — logout() clears local state and emits BEFORE the server revoke, so
+ *     "signed out" never depends on a network round-trip; PKCE helpers moved to ./pkce.js.
  */
 import { importEd25519Key, storeKey, loadKey, deleteKey, migrateKeysToIndexedDB, sign, save, load, remove, parseJwt, isExpired } from './crypto.js';
 import { NODE_URL, APEX_URL, NODE_ID, appDeclaredScopes } from './config.js';
 import { emit, on, off } from './events.js';
+import { b64url, pkce } from './pkce.js';
 import { mountPill } from './pill.js';
 import { showLoginModal } from './modal.js';
 
@@ -176,27 +179,12 @@ export function apexLogout() {
   });
 }
 
-// ── App-grant consent popup (H-2, PKCE code flow) ──
-function _b64url(buf) {
-  var bytes = new Uint8Array(buf), s = '';
-  for (var i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
-  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-async function _pkce() {
-  var verifier = _b64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
-  if (crypto.subtle && crypto.subtle.digest) {
-    var digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
-    return { verifier: verifier, challenge: _b64url(digest), method: 'S256' };
-  }
-  // Non-secure context (http on a non-localhost host): crypto.subtle is unavailable. Fall back to
-  // PKCE "plain". Acceptable — such transport is already non-confidential; real app origins are https.
-  return { verifier: verifier, challenge: verifier, method: 'plain' };
-}
+// ── App-grant consent popup (H-2, PKCE code flow; b64url/pkce live in ./pkce.js) ──
 export async function requestConsentPopup(app, scopeStr, manage) {
   var apexOrigin;
   try { apexOrigin = new URL(APEX_URL).origin; } catch { return null; }
-  var p = await _pkce();
-  var state = _b64url(crypto.getRandomValues(new Uint8Array(16)).buffer);
+  var p = await pkce();
+  var state = b64url(crypto.getRandomValues(new Uint8Array(16)).buffer);
   var redirectUri = location.origin + '/'; // app origin; never navigated in web_message mode (origin binding only)
   var scope = scopeStr || appDeclaredScopes();
   // manage=1 → the consent page always shows the management screen (the gear).
@@ -658,30 +646,35 @@ export const auth = {
     emit('session-updated', currentSession);
   },
 
-  /** Logout — clear stored credentials from localStorage and IndexedDB */
+  /**
+   * Logout — clear stored credentials from localStorage and IndexedDB.
+   * ORDER MATTERS: local state is dropped and 'logout' emitted SYNCHRONOUSLY, before the revoke.
+   * "Logged out" must not depend on a network round-trip — with the revoke awaited first, every
+   * subscriber reading getSession() meanwhile still saw the old session, which is how the header
+   * kept the bell and "Me" next to a "Sign In" button (2026-08-07). Revoke + apex logout are
+   * best-effort cleanup that runs after the UI already shows the truth.
+   */
   async logout() {
     if (refreshTimer) { clearTimeout(refreshTimer); refreshTimer = null; }
     ownerRefreshInFlight = null;
-    // Revoke the session and clear the httpOnly refresh cookie server-side.
-    try {
-      await fetch(NODE_URL + '/v1/auth/revoke', {
-        method: 'POST',
-        credentials: 'include',
-        headers: {
-          'Content-Type': 'application/json',
-          ...(currentSession?.jwt ? { 'Authorization': 'Bearer ' + currentSession.jwt } : {}),
-        },
-      });
-    } catch { /* best effort — still clear local state below */ }
-    // On an app origin, end the apex session too so EXIT sticks across the whole family.
-    if (isAppOrigin()) { try { await apexLogout(); } catch { /* best effort */ } }
+    const jwt = currentSession?.jwt;
+    const onAppOrigin = isAppOrigin();
     currentSession = null;
     remove('session');
     remove('owner_key');
+    emit('logout');
     // SECURITY: Delete CryptoKeys from IndexedDB
     await deleteKey('agent_key');
     await deleteKey('owner_key');
-    emit('logout');
+    // Revoke the session and clear the httpOnly refresh cookie server-side.
+    try {
+      await fetch(NODE_URL + '/v1/auth/revoke', {
+        method: 'POST', credentials: 'include',
+        headers: { 'Content-Type': 'application/json', ...(jwt ? { 'Authorization': 'Bearer ' + jwt } : {}) },
+      });
+    } catch { /* best effort — local state is already cleared */ }
+    // On an app origin, end the apex session too so EXIT sticks across the whole family.
+    if (onAppOrigin) { try { await apexLogout(); } catch { /* best effort */ } }
   },
 
   /**

package/dist/static/sdk-libs/connect/index.js

@@ -18,7 +18,20 @@
  * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-connect.js"></script>
  *   const accounts = await AIMEAT.connect.list();
  *   await AIMEAT.connect.start('mastodon', { instance: 'mastodon.social' });
+ *   await AIMEAT.connect.publish({ connectionId: accounts[0].id, caption: 'hello' });
+ *   const sent = await AIMEAT.connect.history({ limit: 50 });
+ *   await AIMEAT.connect.measure(sent[0].id);   // costs a provider request, and money on X
  * @version-history
+ *   v1.2.0 — 2026-08-08 — attach() and revoke() were the two WRITERS still exempt from that rule:
+ *     both returned a hardcoded success and announced a change on any answer, so a 403 for an app
+ *     holding only `connections:use` read back as `{connected: true}`. Found by an app doing exactly
+ *     that. publish() now reports an empty externalRef as no url, since '' is what LinkedIn returns
+ *     for a successful share and every truthiness check downstream drew it as a link to nothing.
+ *   v1.1.0 — 2026-08-02 — Every reader RAISES the node's refusal instead of resolving with a hollow
+ *     object. authFetch answers with the envelope either way, so a refused publish came back as
+ *     `status: 'unknown'` and an app drew it as "Published" — a post that never went out, reported as
+ *     sent. Errors carry `code` and `permanent`, because "this will never work" and "try again" ask
+ *     an app to draw different things.
  *   v1.0.0 — 2026-08-02 — Initial (TARGET-057 phase 3).
  */
 import { makeSession } from '../_core/session.js';
@@ -28,6 +41,33 @@ import { PROVIDER_NOTES } from './notes.js';
 
 const { authFetch } = makeSession('aimeat-connect.js');
 
+/**
+ * The node's answer, or its refusal as a thrown Error.
+ *
+ * WHY THIS EXISTS. authFetch resolves with the parsed envelope whether or not the call succeeded, so
+ * a refusal arrives as a perfectly ordinary object with no `data` — and every reader that pulled a
+ * field out of it got `undefined` and carried on. On this surface that produced the worst possible
+ * outcome: a publish the provider REFUSED read back as `status: 'unknown'`, which an app then drew
+ * as "Published". A post that never went out, reported as sent.
+ *
+ * `permanent` is carried through because the difference matters to what an app draws. A 409
+ * NOT_MEASURABLE is the platform saying it will never tell an author this number — an app that
+ * offers a retry there is offering a button that can never work, and on a paid provider a retry loop
+ * is a standing bill.
+ */
+function must(res, fallback) {
+  if (res && res.ok === false) {
+    const code = res.error && res.error.code;
+    const err = /** @type {Error & { code?: string, permanent?: boolean, envelope?: unknown }} */ (
+      new Error((res.error && (res.error.message || res.error.code)) || fallback));
+    err.code = code;
+    err.permanent = code === 'NOT_MEASURABLE' || code === 'REJECTED';
+    err.envelope = res;
+    throw err;
+  }
+  return (res && res.data) || {};
+}
+
 /**
  * @typedef {Object} Connection
  * @property {string} id
@@ -52,14 +92,160 @@ function announce() {
 
 /** The caller's own connections. Never anyone else's — the node scopes this, not the caller. */
 async function list() {
-  const res = await authFetch('/v1/connections');
-  return (res?.data?.connections ?? []);
+  return must(await authFetch('/v1/connections'), 'could not read your connections').connections ?? [];
 }
 
-/** Providers this node can connect to. An unconfigured one is simply absent. */
+/**
+ * Providers this node can connect to.
+ *
+ * `nodeConfigured: false` means the NODE holds no application credentials for it. That is not the
+ * same as unavailable: a user who registers their own app with setClient() can connect it anyway.
+ * Show those rather than hiding them, or an operator's decision not to register an app silently
+ * removes a choice from every user.
+ */
 async function providers() {
-  const res = await authFetch('/v1/connections/providers');
-  return (res?.data?.providers ?? []);
+  return must(await authFetch('/v1/connections/providers'), 'could not read the providers').providers ?? [];
+}
+
+/**
+ * Publish to an account the CALLER connected.
+ *
+ * The whole point of the capability, from an app's side: one call, one post, and the credential
+ * never comes near the page.
+ *
+ * IDEMPOTENT BY CONTENT. The node keys an attempt on publisher + connection + file + caption and
+ * records it BEFORE anything leaves. Calling twice with the same arguments returns the FIRST
+ * outcome with `replay: true` and posts nothing further, which is why a failed network call is safe
+ * to retry. On a provider that charges per post, that is a billing control and not only a nicety.
+ *
+ * A SEND THAT FAILED IS NOT A REPLAY. The guard prevents a double POST, so an attempt that reached
+ * nobody — refused by the provider, or abandoned when the node stopped — is reopened and sent for
+ * real. Do not build a "you already sent this" state out of `replay` alone without showing the
+ * original `status`: an app that did exactly that told a user their post had gone out when it never
+ * left the node.
+ *
+ * TWO SUCCESSFUL ANSWERS ARE NOT PUBLICATIONS. `status: 'held'` is awaiting moderation and
+ * `status: 'queued'` is a spent provider allowance. Neither is an error, because reporting them as
+ * one teaches a caller to retry, and retrying makes both worse. Read `status`, not the absence of
+ * a throw.
+ *
+ * @param {{connectionId: string, storageKey?: string, caption?: string,
+ *          params?: Record<string, unknown>}} input
+ * @returns {Promise<{url?: string, replay: boolean, status: string, attemptId: string, error?: string}>}
+ */
+async function publish(input) {
+  if (!input?.connectionId) throw new Error('publish needs a connectionId');
+  const res = await authFetch('/v1/connections/publish', {
+    method: 'POST',
+    body: JSON.stringify({
+      connection_id: input.connectionId,
+      storage_key: input.storageKey,
+      caption: input.caption ?? '',
+      params: input.params ?? {},
+    }),
+  });
+  const d = must(res, 'the publish was refused');
+  return {
+    url: d.url,
+    replay: Boolean(d.replay),
+    status: d.attempt?.status ?? 'unknown',
+    attemptId: d.attempt?.id ?? '',
+    error: d.attempt?.error ?? undefined,
+  };
+}
+
+/**
+ * What this caller has published through the node, newest first.
+ *
+ * The same ledger that stops a double post is what makes a history possible at all: every attempt
+ * was written down before anything left, so this is a record of what was TRIED, not a list of
+ * successes. `status` distinguishes them, and an item that was held or queued belongs on the page
+ * as much as one that went out.
+ *
+ * `latest` is the most recent reading of how it is doing, or null when nobody has asked yet. Null
+ * means unmeasured, never zero.
+ *
+ * @param {{limit?: number}} [opts]
+ */
+async function history(opts = {}) {
+  const q = opts.limit ? `?limit=${encodeURIComponent(opts.limit)}` : '';
+  return must(await authFetch(`/v1/connections/attempts${q}`), 'could not read your history').attempts ?? [];
+}
+
+/**
+ * Ask the platform how one published item is doing, right now, and keep the answer.
+ *
+ * THIS HAS EFFECTS AND ONE OF THEM IS MONEY. It spends a request at the provider, and on X it
+ * spends actual credit. Nothing in the node schedules it: a reading happens because a person asked
+ * for one. Do not put this on a timer, and do not call it on render.
+ *
+ * A platform that will not report a number to its author is not a failure to retry: the node
+ * answers 409 with the reason, which is a fact to display rather than an error to hide.
+ */
+async function measure(attemptId) {
+  // A refusal THROWS, carrying `permanent`. Returning undefined here is what made an app unable to
+  // tell "nobody has asked yet" from "this platform will never say", and both drew as "not read".
+  const res = await authFetch(`/v1/connections/attempts/${encodeURIComponent(attemptId)}/metrics`, {
+    method: 'POST',
+  });
+  return must(res, 'the numbers could not be read').sample;
+}
+
+/**
+ * Every reading taken for one item, oldest first.
+ *
+ * A curve rather than a number: 40 likes means something different in an hour than in a month, and
+ * that difference is the part worth acting on.
+ */
+async function series(attemptId) {
+  const res = await authFetch(`/v1/connections/attempts/${encodeURIComponent(attemptId)}/metrics`);
+  return must(res, 'could not read the series').samples ?? [];
+}
+
+/**
+ * The apps the CALLER registered themselves, one per provider at most.
+ *
+ * WHY ANYONE WOULD. Without their own, every user of a node reaches a provider through one
+ * registration: the node's. To the provider they are one application, sharing its rate limit, its
+ * reputation and — where publishing is charged per call — its bill. Their own app spends their own.
+ *
+ * `connectionCount` is how many of their accounts were made with it. It is not decoration: a token
+ * can only be renewed by the client that issued it, so that is also how many would stop renewing if
+ * the app went away, which is why removeClient() refuses while it is above zero.
+ */
+async function clients() {
+  return must(await authFetch('/v1/connections/clients'), 'could not read your apps').clients ?? [];
+}
+
+/**
+ * Register the caller's own app at a provider. Replaces any previous one of theirs.
+ *
+ * The secret is write-only: it is encrypted by the node and no endpoint ever returns it, including
+ * this one.
+ *
+ * EXISTING CONNECTIONS ARE NOT MOVED ONTO IT. Each keeps the app that minted its token, because
+ * that is the only client that can renew it. Reconnect an account to move it.
+ */
+async function setClient(provider, clientId, clientSecret) {
+  const res = await authFetch('/v1/connections/clients', {
+    method: 'PUT',
+    body: JSON.stringify({ provider, client_id: clientId, client_secret: clientSecret }),
+  });
+  announce();
+  return res?.data?.client;
+}
+
+/**
+ * Remove the caller's own app registration.
+ *
+ * Refused while any of their connected accounts still depends on it, with the count in the message.
+ * Those accounts could only be renewed by this client; removing it would leave them working until
+ * their tokens expire and then failing with an error nobody could trace back to this moment.
+ */
+async function removeClient(provider) {
+  await authFetch(`/v1/connections/clients/${encodeURIComponent(provider)}`, { method: 'DELETE' });
+  announce();
+  return { removed: true };
 }
 
 /**
@@ -164,8 +350,13 @@ async function attachAccount(provider, fields) {
     method: 'POST',
     body: JSON.stringify({ provider, mode: 'personal', fields }),
   });
+  // `must` FIRST, and this line is the whole fix. Without it the two statements below ran on any
+  // answer at all: a refused credential, an expired session, a 403 for an app holding only
+  // `connections:use` — every one of them returned `{connected: true}` and announced a change that
+  // had not happened. Found by an app calling this with the wrong scope and being told it worked.
+  const d = must(res, 'the account could not be attached');
   announce();
-  return { connected: true, connection: res?.data?.connection };
+  return { connected: true, connection: d.connection };
 }
 
 /**
@@ -174,8 +365,12 @@ async function attachAccount(provider, fields) {
  */
 async function revoke(connectionId) {
   const res = await authFetch(`/v1/connections/${encodeURIComponent(connectionId)}`, { method: 'DELETE' });
+  // Same fix as attach(): a refusal used to resolve as `{revoked: true}`, so a panel removed the row
+  // and the account stayed connected. "This always ends with the account disconnected here" was only
+  // true when the call succeeded.
+  const d = must(res, 'the account could not be disconnected');
   announce();
-  return { revoked: true, toldProvider: Boolean(res?.data?.told_provider) };
+  return { revoked: true, toldProvider: Boolean(d.told_provider) };
 }
 
 /** Subscribe to "the set of connections changed". Returns an unsubscribe function. */
@@ -187,7 +382,9 @@ function on(fn) {
 function off(fn) { listeners.delete(fn); }
 
 const connect = {
-  list, providers, start, attach: attachAccount, revoke, on, off,
+  list, providers, start, attach: attachAccount, revoke, publish, on, off,
+  clients, setClient, removeClient,
+  history, measure, series,
   /** Per-provider things a user must be told BEFORE they try. See notes.js. */
   notes: PROVIDER_NOTES,
   /** Mount the ready-made panel. See panel.js. */

package/dist/static/sdk-libs/connect/notes.js

@@ -14,6 +14,8 @@
  * @usage import { PROVIDER_NOTES } from './notes.js';  PROVIDER_NOTES.bluesky.before
  * @version-history
  *   v1.0.0 — 2026-08-02 — Initial (TARGET-057 phase 3).
+ *   v1.1.0 — 2026-08-02 — LinkedIn: says up front that the connection expires, because a token
+ *     that silently dies in two months is the least readable failure in the set.
  */
 
 /**
@@ -32,6 +34,12 @@ export const PROVIDER_NOTES = {
   youtube: {
     before: 'Sign in with the Google account that owns the channel. A Google account with no YouTube channel will connect and then have nowhere to publish.',
   },
+  x: {
+    before: 'Posting to X costs the node operator a small amount per post, charged against prepaid credits at X. When those credits run out, publishing stops until they are topped up.',
+  },
+  linkedin: {
+    before: 'A LinkedIn connection stops working after about two months and asks to be reconnected. That is LinkedIn: renewing a token in the background is a partner-only feature, so this is the one provider you will have to come back to a few times a year.',
+  },
   bluesky: {
     needs: 'An app password. This is NOT your Bluesky password.',
     where: 'Bluesky → Settings → Privacy and security → App passwords.',

package/dist/static/sdk-libs/dist/aimeat-agentface.js

@@ -57,6 +57,36 @@
     },
     /** The markdown composer (exposed so an app can preview what publish() will write). */
     compose,
+    /**
+     * Copy text to the clipboard the way every "Copy prompt" button should: async clipboard API
+     * first, hidden-offscreen-textarea execCommand fallback — never a visible selection painted
+     * over the page. Resolves to true/false; never throws. This is THE shared implementation for
+     * the platform's copy-a-prompt-to-your-AI pattern — stop hand-rolling it per app.
+     */
+    async copyText(text) {
+      const value = String(text == null ? "" : text);
+      if (typeof navigator !== "undefined" && navigator.clipboard && navigator.clipboard.writeText) {
+        try {
+          await navigator.clipboard.writeText(value);
+          return true;
+        } catch {
+        }
+      }
+      try {
+        const ta = document.createElement("textarea");
+        ta.value = value;
+        ta.setAttribute("readonly", "");
+        ta.style.position = "fixed";
+        ta.style.left = "-9999px";
+        document.body.appendChild(ta);
+        ta.select();
+        const ok = document.execCommand("copy");
+        document.body.removeChild(ta);
+        return !!ok;
+      } catch {
+        return false;
+      }
+    },
     /**
      * Publish this app's agent face: a markdown string, or { title, sections: [{ heading, body }] }.
      * opts.app names the app filename explicitly (e.g. 'my-app.html') and overrides inference —

package/dist/static/sdk-libs/dist/aimeat-ai.js

@@ -466,6 +466,7 @@
     draftTitle: "This draft was written by AI",
     draftBody: "Read it before you send it. You are responsible for what goes out under your name.",
     regionLabel: "AI transparency",
+    expand: "Show AI disclosure",
     iconAlt: {
       aiGenerated: "Content generated by AI",
       aiModified: "Content partially modified by AI",
@@ -494,6 +495,7 @@
     draftTitle: "Tämän luonnoksen on kirjoittanut tekoäly",
     draftBody: "Lue se ennen lähettämistä. Vastaat itse siitä, mitä nimissäsi lähtee.",
     regionLabel: "Tekoälyn läpinäkyvyystiedot",
+    expand: "Näytä tekoälymerkintä",
     iconAlt: {
       aiGenerated: "Tekoälyn tuottamaa sisältöä",
       aiModified: "Sisältöä on osittain muokattu tekoälyllä",