aimeat 2.7.0 → 3.1.0

package/dist/static/app-catalog/js/util.js

@@ -3,25 +3,61 @@
  * @description Pure helper functions for the app-catalog — no module state, no side effects
  *   (only params + DOM/window globals). Carved out of the former monolithic main.js as the first
  *   shared module so every feature module reuses ONE copy (no duplicated escaping/labels).
+ * @structure
+ *   - escapeHtml()      → HTML-escape for text AND attribute values (& < > " ')
+ *   - jsArg()           → escape for a single-quoted JS argument inside an on* attribute
+ *   - sourceLabel(), sourceLabelText() → source-kind labels
+ *   - bareOwnerName(), sameOwner()     → owner-identifier comparison
+ *   - filterAttr()      → the data-filter/data-tags pair used by the card search
+ *   - isSameOriginUrl(), currentOwnerName(), generateId(), readFileAsText()
  * @usage import { escapeHtml, jsArg, sameOwner } from './util.js'
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 1).
+ *   v1.1.0 — 2026-08-11 — escapeHtml also escapes " and ' (audit H-25, stored XSS via filterAttr).
  */
 
-/** HTML-escape a string via a detached element's textContent (handles < > &). */
+/**
+ * HTML-escape a string for BOTH text content and a quoted attribute value: & < > " '.
+ *
+ * The quotes are the reason this function exists in this shape. It used to serialize through a
+ * detached element's textContent, which escapes & < > and leaves both quote characters intact —
+ * correct for a text node, wrong for the attribute values most callers here build. filterAttr()
+ * below puts another owner's published app name inside a double-quoted data-filter attribute, so
+ * a name containing " ended the attribute and everything after it was parsed as more attributes,
+ * including an event handler. /app-catalog.html runs on the apex under a script-src that allows
+ * inline script, so that handler ran with the signed-in user's session (audit H-25). The publish
+ * route type-checks the name and the tags without constraining their content, and the community
+ * grid renders every published card through this path, so the escaping is the only thing standing
+ * between one owner's manifest and another owner's page.
+ *
+ * Escaping ' as well is not needed by any current call site (every attribute the catalog builds is
+ * double-quoted), and it costs nothing: an entity inside an attribute value or a text node decodes
+ * back to the same character before anyone sees it. It is here so a single-quoted attribute added
+ * later is safe by default rather than by review.
+ *
+ * The one context where the extra escaping is NOT a no-op is an on* handler whose contents a caller
+ * escapes AGAIN at the JS level, because escapeHtml now consumes the quote that second pass looks
+ * for. Use jsArg() for anything that lands inside a handler; it does the JS-level escaping in the
+ * right order and stays the correct tool for that job.
+ */
 export function escapeHtml(str) {
-  var div = document.createElement('div');
-  div.textContent = str;
-  return div.innerHTML;
+  return String(str == null ? '' : str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
 }
 
 /**
  * Escape a user-controlled string for use as a single-quoted JS argument INSIDE a double-quoted
- * HTML on* attribute (e.g. onclick="window._launcher.foo('<here>')"). escapeHtml only handles
- * < > & — an apostrophe like in "Fatalii's" would otherwise terminate the JS string and throw
- * "missing ) after argument list", breaking the button. JS-escape the backslash + single quote;
- * HTML-escape the attribute/markup delimiters (they decode back to plain chars before the JS
- * engine sees them).
+ * HTML on* attribute (e.g. onclick="window._launcher.foo('<here>')"). escapeHtml is not enough
+ * here even though it now escapes quotes: an attribute value is HTML-decoded before the JS engine
+ * parses it, so &#39; arrives at the parser as a plain apostrophe and an argument like "Fatalii's"
+ * still terminates the JS string and throws "missing ) after argument list", breaking the button.
+ * The escaping has to happen at the JS level to survive that decode. JS-escape the backslash +
+ * single quote; HTML-escape the attribute/markup delimiters (they decode back to plain chars
+ * before the JS engine sees them, which is the point).
  */
 export function jsArg(str) {
   return String(str == null ? '' : str)
@@ -63,7 +99,14 @@ export function sameOwner(appOwner, sessionOwner) {
   return !!a && a === bareOwnerName(sessionOwner);
 }
 
-/** data-filter/data-tags attribute pair so a server card can be matched by search/tag without a re-fetch. */
+/**
+ * data-filter/data-tags attribute pair so a server card can be matched by search/tag without a
+ * re-fetch. Both values come from a published manifest that another owner controls and the publish
+ * route does not constrain, so the escapeHtml calls are load-bearing: they are what keeps a quote
+ * in a name or a tag from closing the attribute (audit H-25). Nothing reads these back as markup —
+ * applyServerFilter() uses getAttribute(), which returns the decoded original text — so the
+ * escaping is invisible to the search that consumes them.
+ */
 export function filterAttr(name, tags) {
   tags = (tags || []).map(function (tg) { return String(tg).toLowerCase(); });
   var searchable = escapeHtml((String(name || '') + ' ' + tags.join(' ')).toLowerCase());

package/dist/static/app-catalog/styles/app-catalog.css

@@ -332,7 +332,14 @@
       display: flex;
       align-items: center;
       gap: 8px;
-      flex-shrink: 0;
+      /* Wraps rather than overflowing. The login pill is wide, carries its own inline styles and
+         cannot be shrunk, so a non-wrapping row pushed the create, backup and language buttons
+         past the right edge on a phone, where nothing could reach them. min-width:0 lets the row
+         narrow at all: a flex item defaults to min-width:auto and refuses to go under its
+         content. */
+      flex-wrap: wrap;
+      min-width: 0;
+      flex-shrink: 1;
     }
 
     .icon-btn {
@@ -372,8 +379,9 @@
     }
 
     /* Mount point for the shared golden login pill (/v1/libs/aimeat-auth.js).
-       The pill carries its own inline styles; this just keeps it inline in the bar. */
-    .header-auth-pill { display: inline-flex; align-items: center; }
+       The pill carries its own inline styles; this just keeps it inline in the bar and stops it
+       from setting the row's minimum width. */
+    .header-auth-pill { display: inline-flex; align-items: center; min-width: 0; max-width: 100%; }
 
     #add-btn:hover {
       box-shadow: 0 4px 20px rgba(232, 86, 74, .25);
@@ -1301,6 +1309,18 @@
         flex-basis: 100%;
       }
 
+      /* On a phone the pill takes a row of its own and the buttons sit under it, right-aligned.
+         Side by side there is room for the pill only, and the buttons are what a person came for. */
+      .header-actions {
+        width: 100%;
+        justify-content: flex-end;
+      }
+
+      .header-auth-pill {
+        order: -1;
+        width: 100%;
+      }
+
       #tag-bar {
         padding: 10px 16px;
       }

package/dist/static/app-catalog.html

@@ -340,7 +340,14 @@
       display: flex;
       align-items: center;
       gap: 8px;
-      flex-shrink: 0;
+      /* Wraps rather than overflowing. The login pill is wide, carries its own inline styles and
+         cannot be shrunk, so a non-wrapping row pushed the create, backup and language buttons
+         past the right edge on a phone, where nothing could reach them. min-width:0 lets the row
+         narrow at all: a flex item defaults to min-width:auto and refuses to go under its
+         content. */
+      flex-wrap: wrap;
+      min-width: 0;
+      flex-shrink: 1;
     }
 
     .icon-btn {
@@ -380,8 +387,9 @@
     }
 
     /* Mount point for the shared golden login pill (/v1/libs/aimeat-auth.js).
-       The pill carries its own inline styles; this just keeps it inline in the bar. */
-    .header-auth-pill { display: inline-flex; align-items: center; }
+       The pill carries its own inline styles; this just keeps it inline in the bar and stops it
+       from setting the row's minimum width. */
+    .header-auth-pill { display: inline-flex; align-items: center; min-width: 0; max-width: 100%; }
 
     #add-btn:hover {
       box-shadow: 0 4px 20px rgba(232, 86, 74, .25);
@@ -1309,6 +1317,18 @@
         flex-basis: 100%;
       }
 
+      /* On a phone the pill takes a row of its own and the buttons sit under it, right-aligned.
+         Side by side there is room for the pill only, and the buttons are what a person came for. */
+      .header-actions {
+        width: 100%;
+        justify-content: flex-end;
+      }
+
+      .header-auth-pill {
+        order: -1;
+        width: 100%;
+      }
+
       #tag-bar {
         padding: 10px 16px;
       }
@@ -2842,7 +2862,7 @@
       "view.community": "🌍 Community",
       "view.communityEmpty": "No community apps on this node yet.",
       "view.communityHint": "Community apps are apps other people on this node have published. When someone publishes one, it shows up here.",
-      "sec.parked": "🅿️ Parked Apps",
+      "sec.parked": "Unlisted apps",
       "sec.parkedBlurb": "Only you can see and use these — they stay usable but are hidden from the public catalogue. Press Publish to move one back to Published Apps.",
       "sec.recent": "🕒 Recently Opened",
       "sec.local": "📚 Your apps",
@@ -2913,7 +2933,7 @@
       "publish.descriptionHint": "Shown in the catalogue and on the landing wall. Required for a new app.",
       "publish.accessCode": "Access Code (optional)",
       "publish.accessCodePh": "Leave empty for public",
-      "publish.accessCodeHint": "4-64 chars. If set, only people with the code can download.",
+      "publish.accessCodeHint": "4-64 chars. If set, the app only opens or downloads with the code. You, the owner, never need it.",
       "publish.submit": "Publish",
       "publish.loginRequired": "Sign in to publish to AIMEAT. Anonymous publishing is disabled — use the Sign in button in the top bar.",
       "publish.savedUnlisted": "Saved — your app is on the server as unlisted. Open it and press List when you want it public.",
@@ -3454,7 +3474,7 @@
       "view.community": "🌍 Yhteisö",
       "view.communityEmpty": "Tällä nodella ei ole vielä yhteisön sovelluksia.",
       "view.communityHint": "Yhteisön sovellukset ovat sovelluksia, joita muut tämän noden käyttäjät ovat julkaisseet. Kun joku julkaisee sellaisen, se näkyy täällä.",
-      "sec.parked": "🅿️ Parkissa olevat sovellukset",
+      "sec.parked": "Listaamattomat sovellukset",
       "sec.parkedBlurb": "Vain sinä näet ja voit käyttää näitä — ne pysyvät käytettävissä mutta eivät näy julkisessa katalogissa. Paina Julkaise siirtääksesi takaisin julkaistuihin.",
       "sec.recent": "🕒 Viimeksi avatut",
       "sec.local": "📚 Sinun sovelluksesi",
@@ -3525,7 +3545,7 @@
       "publish.descriptionHint": "Näytetään katalogissa ja aloitusseinällä. Pakollinen uudelle sovellukselle.",
       "publish.accessCode": "Pääsykoodi (valinnainen)",
       "publish.accessCodePh": "Jätä tyhjäksi julkiseksi",
-      "publish.accessCodeHint": "4–64 merkkiä. Jos asetettu, vain koodin tietävät voivat ladata.",
+      "publish.accessCodeHint": "4–64 merkkiä. Jos asetettu, sovellus aukeaa ja latautuu vain koodilla. Sinä omistajana et koskaan tarvitse sitä.",
       "publish.submit": "Julkaise",
       "publish.loginRequired": "Kirjaudu sisään julkaistaksesi AIMEATiin. Anonyymi julkaisu on poistettu käytöstä — käytä yläpalkin Kirjaudu-painiketta.",
       "publish.savedUnlisted": "Tallennettu — sovelluksesi on palvelimella ei-listalla. Avaa se ja paina Listaa kun haluat sen julkiseksi.",
@@ -4046,9 +4066,7 @@
 
   // src/static/app-catalog/js/util.js
   function escapeHtml(str) {
-    var div = document.createElement("div");
-    div.textContent = str;
-    return div.innerHTML;
+    return String(str == null ? "" : str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
   }
   function jsArg(str) {
     return String(str == null ? "" : str).replace(/&/g, "&amp;").replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[\r\n]+/g, " ");
@@ -5114,7 +5132,7 @@
       promoted = {};
       return Promise.resolve();
     }
-    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY), { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
+    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY) + "?soft=1", { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
       return r.ok ? r.json() : null;
     }).then(function(j) {
       var items = j && j.data && j.data.value && Array.isArray(j.data.value.items) ? j.data.value.items : [];
@@ -8241,7 +8259,7 @@
       if (!token) return;
       var gaii = auth.data.gaii || auth.data.sub || "";
       if (!gaii) return;
-      return fetch(url + "/v1/memory/app-launcher%2Fconfig", {
+      return fetch(url + "/v1/memory/app-launcher%2Fconfig?soft=1", {
         headers: { "Authorization": "Bearer " + token }
       }).then(function(r) {
         if (!r.ok) return null;
@@ -8542,7 +8560,7 @@
       favSet = /* @__PURE__ */ new Set();
       return Promise.resolve();
     }
-    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY2), { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
+    return fetch(b + "/v1/memory/" + encodeURIComponent(KEY2) + "?soft=1", { headers: { "Authorization": "Bearer " + token } }).then(function(r) {
       return r.ok ? r.json() : null;
     }).then(function(j) {
       var refs = j && j.data && j.data.value && Array.isArray(j.data.value.refs) ? j.data.value.refs : [];
@@ -9251,6 +9269,7 @@
           currentOwner = JSON.parse(stored).owner || null;
         }
       }
+      if (!getCortexOwnerToken()) currentOwner = null;
     } catch (e) {
     }
     Promise.all([getAllApps(), loadFavorites(), loadPromoted()]).then(function() {
@@ -9586,6 +9605,19 @@
     }
   }
   function viewPublished2(url, name) {
+    try {
+      var u = new URL(url, window.location.origin);
+      var parts = u.pathname.split("/");
+      if (parts[1] === "v1" && parts[2] === "apps" && parts[3] && parts[4]) {
+        var key = decodeURIComponent(parts[3]) + "/" + decodeURIComponent(parts[4]);
+        var codeVal = ownAppAccessCodes[key];
+        if (codeVal && !u.searchParams.has("code")) {
+          url += (url.indexOf("?") >= 0 ? "&" : "?") + "code=" + encodeURIComponent(codeVal);
+        }
+      }
+    } catch (err) {
+      void err;
+    }
     window.open(url, "_blank", "noopener");
   }
   function updateOpenExternalBtn() {
@@ -9614,6 +9646,7 @@
   var ownServerApps = [];
   var serverStateByFilename = {};
   var ownAppProtection = {};
+  var ownAppAccessCodes = {};
   var serverAppManifests = {};
   function aiPostureMarkers(e) {
     var p = e.aiPosture;
@@ -9750,6 +9783,7 @@
           accessCode: !!sa.protected
         };
         ownAppProtection[fn] = prot;
+        if (sa.access_code) ownAppAccessCodes[(sa.owner || "") + "/" + fn] = sa.access_code;
       }
     }
     return entries;

package/dist/static/sdk-libs/_core/sdk-globals.d.ts

@@ -21,8 +21,12 @@ interface Window {
   AIMEATAgentFace?: Record<string, any>;
   /** Serve-time config prelude prepended to each bundle (see _core/config.js + libs/sdk-serve.ts). */
   __AIMEAT_SDK_CFG__?: { nodeId: string; baseUrl: string; heartbeatMs?: number };
-  /** aimeat-auth's extra serve-time prelude: the OIDC providers enabled on the node (server-computed). */
-  __AIMEAT_AUTH_CFG__?: { providers: Array<{ id: string; label: string; i18nKey: string }> };
+  /** aimeat-auth's extra serve-time prelude (server-computed, see routes/libs.ts): the OIDC providers
+   *  enabled on the node, and whether the node's registration gate demands an email. */
+  __AIMEAT_AUTH_CFG__?: {
+    providers: Array<{ id: string; label: string; i18nKey: string }>;
+    emailRequired?: boolean;
+  };
   /** aimeat-header's idempotency guard (mounts the canonical nav at most once). */
   __AIMEAT_HEADER_MOUNTED__?: boolean;
   /** aimeat-auth version marker exposed globally. */

package/dist/static/sdk-libs/agentface/index.js

@@ -10,11 +10,15 @@
  *   verbatim from lib-agentface.ts — the bespoke auth-guard messages are preserved (they teach the
  *   app-owner-only serving rule), so getSession stays inline rather than using _core/session.
  * @structure imports attach (namespace); getSession/compose/inferFilename; the `agentface` object
- *   (key/compose/publish); attach('agentface', …) + window.AIMEATAgentFace.
+ *   (key/compose/copyText/publish); attach('agentface', …) + window.AIMEATAgentFace.
  * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-agentface.js"></script>
  *   await AIMEATAgentFace.publish('# My app\n\n…', { app: 'my-app.html' });
+ *   await AIMEAT.agentface.copyText(promptText);  // the shared "Copy prompt" implementation
  * @version-history
  *   v1.0.0 — 2026-07-19 — Migrated from src/routes/lib-agentface.ts (SDK-libs migration Phase 1).
+ *   v1.1.0 — 2026-08-05 — copyText(): the ONE shared clipboard implementation for the platform's
+ *     copy-a-prompt-to-your-AI pattern (async API + hidden-textarea fallback, no visible
+ *     selection) — every app was hand-rolling its own, several of them badly.
  */
 import { attach } from '../_core/namespace.js';
 
@@ -67,6 +71,36 @@ const agentface = {
   /** The markdown composer (exposed so an app can preview what publish() will write). */
   compose: compose,
 
+  /**
+   * Copy text to the clipboard the way every "Copy prompt" button should: async clipboard API
+   * first, hidden-offscreen-textarea execCommand fallback — never a visible selection painted
+   * over the page. Resolves to true/false; never throws. This is THE shared implementation for
+   * the platform's copy-a-prompt-to-your-AI pattern — stop hand-rolling it per app.
+   */
+  async copyText(text) {
+    const value = String(text == null ? '' : text);
+    if (typeof navigator !== 'undefined' && navigator.clipboard && navigator.clipboard.writeText) {
+      try {
+        await navigator.clipboard.writeText(value);
+        return true;
+      } catch { /* fall through to the textarea fallback */ }
+    }
+    try {
+      const ta = document.createElement('textarea');
+      ta.value = value;
+      ta.setAttribute('readonly', '');
+      ta.style.position = 'fixed';
+      ta.style.left = '-9999px';
+      document.body.appendChild(ta);
+      ta.select();
+      const ok = document.execCommand('copy');
+      document.body.removeChild(ta);
+      return !!ok;
+    } catch {
+      return false;
+    }
+  },
+
   /**
    * Publish this app's agent face: a markdown string, or { title, sections: [{ heading, body }] }.
    * opts.app names the app filename explicitly (e.g. 'my-app.html') and overrides inference —

package/dist/static/sdk-libs/ai/strings.js

@@ -12,16 +12,19 @@
  *
  *   The strings come from the platform's own locales/*.json — one source, tree-shaken to this block
  *   at bundle time — so an app's label and the apex SPA's label say the same words.
- * @structure STRINGS — { en, fi } · pick(key, loc) — full dotted key → string
+ * @structure STRINGS — { en, fi, es } · pick(key, loc) — full dotted key → string
  * @usage import { pick } from './strings.js';  pick('aiLabel.short', 'fi')
  * @version-history
+ *   v1.1.0 — 2026-08-12 — Spanish (es) added. The disclosure the EU AI Act asks for is now carried
+ *     in every language the node declares at /v1/ai-transparency, not two of the three.
  *   v1.0.0 — 2026-08-01 — TARGET-058 Phase 5, after a browser showed raw keys on the chip.
  */
 import { aiLabel as EN } from '../../../../locales/en.json';
 import { aiLabel as FI } from '../../../../locales/fi.json';
+import { aiLabel as ES } from '../../../../locales/es.json';
 
 /** The label strings, per language the node ships. */
-export const STRINGS = { en: EN, fi: FI };
+export const STRINGS = { en: EN, fi: FI, es: ES };
 
 /**
  * A platform string by its FULL dotted key, in `loc`, falling back to English and finally to the key

package/dist/static/sdk-libs/auth/config.js

@@ -38,6 +38,11 @@ export function appDeclaredScopes() {
 // one button per entry.
 export const AUTH_PROVIDERS = (window.__AIMEAT_AUTH_CFG__ && window.__AIMEAT_AUTH_CFG__.providers) || [];
 
+// Does this node's registration gate require an email (AIMEAT_EMAIL_CONFIRMATION_REQUIRED)? Same
+// prelude, same injection point as the provider list. The Register tab asks for the email up front
+// when this is true, so the person types it once instead of meeting the demand after a failed create.
+export const EMAIL_REQUIRED = !!(window.__AIMEAT_AUTH_CFG__ && window.__AIMEAT_AUTH_CFG__.emailRequired);
+
 // Per-provider button glyphs (inline SVG — no external fetch).
 export const PROVIDER_ICONS = {
   google: '<svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path fill="#4285F4" d="M17.64 9.2c0-.64-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92c1.7-1.57 2.68-3.88 2.68-6.62z"/><path fill="#34A853" d="M9 18c2.43 0 4.47-.8 5.96-2.18l-2.92-2.26c-.8.54-1.84.86-3.04.86-2.34 0-4.32-1.58-5.03-3.7H.96v2.33A9 9 0 0 0 9 18z"/><path fill="#FBBC05" d="M3.97 10.72a5.4 5.4 0 0 1 0-3.44V4.95H.96a9 9 0 0 0 0 8.1l3.01-2.33z"/><path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.44 1.35l2.58-2.58A9 9 0 0 0 .96 4.95l3.01 2.33C4.68 5.16 6.66 3.58 9 3.58z"/></svg>',

package/dist/static/sdk-libs/auth/i18n.js

@@ -6,23 +6,28 @@
  *   'aimeat-lang' localStorage key + cookie the header uses so the choice stays in sync with the SPA.
  *   loadModalI18n fetches en.json (base) + <lang>.json (overrides) from the node and returns just the
  *   modal.* strings with the 'modal.' prefix stripped. Extracted from auth-lib-part2.ts.
- * @structure MODAL_LANG_KEY · currentModalLang() · flattenModalI18n() · loadModalI18n(lang).
+ * @structure MODAL_LANG_KEY · MODAL_LANGS · currentModalLang() · flattenModalI18n() · loadModalI18n(lang).
  * @usage import { currentModalLang, loadModalI18n } from './i18n.js';
  * @version-history
+ *   v1.1.0 — 2026-08-12 — Spanish added; the language list is one array rather than four comparisons.
  *   v1.0.0 — 2026-07-19 — Extracted from src/routes/libs/auth-lib-part2.ts (SDK-libs migration Phase 3).
  */
 import { NODE_URL } from './config.js';
 
 export var MODAL_LANG_KEY = 'aimeat-lang';
 
+/** The languages the node ships modal text in. Mirrors LOCALES in src/i18n.ts. */
+export var MODAL_LANGS = ['en', 'fi', 'es'];
+
 export function currentModalLang() {
   try {
     var u = new URLSearchParams(location.search).get('lang');
-    if (u === 'en' || u === 'fi') return u;
+    if (MODAL_LANGS.indexOf(u) !== -1) return u;
     var s = localStorage.getItem(MODAL_LANG_KEY);
-    if (s === 'en' || s === 'fi') return s;
+    if (MODAL_LANGS.indexOf(s) !== -1) return s;
   } catch { /* storage blocked */ }
-  return (navigator.language || 'en').slice(0, 2).toLowerCase() === 'fi' ? 'fi' : 'en';
+  var nav = (navigator.language || 'en').slice(0, 2).toLowerCase();
+  return MODAL_LANGS.indexOf(nav) !== -1 ? nav : 'en';
 }
 
 export function flattenModalI18n(obj, prefix, out) {