aimeat 2.7.0 → 3.1.0

package/dist/static/sdk-libs/auth/pill.js

@@ -10,6 +10,14 @@
  * @structure mountPill(auth, selector, opts) → render() + event wiring.
  * @usage import { mountPill } from './pill.js';  (auth.mountLoginButton delegates here)
  * @version-history
+ *   v1.3.0 — 2026-08-13 — The pill speaks the reader's language on its own. It draws the language
+ *     switch, so it always knows which language was chosen, yet its own labels fell back to English
+ *     literals unless the host passed opts.i18n — which only the SPA did, so a Spanish CADENCE
+ *     showed an English "Logout". Labels now come from pill-strings.js under whatever the caller
+ *     passes, and the pill re-renders on 'aimeat-lang-change' so they follow its own switch.
+ *   v1.2.0 — 2026-08-07 — The host's onLogout fires from the auth lib's 'logout' event (after the
+ *     session is gone) instead of synchronously after the un-awaited logout() — the race that left
+ *     hosts rendering a signed-in header next to a "Sign In" button.
  *   v1.1.0 — 2026-07-25 — The in-pill controls become the platform control cluster (segmented
  *     language switch + segmented ☀|☾ mode switch + palette swatch picker, styled by cluster.js),
  *     with outside-click/Escape closers for the cluster popovers.
@@ -18,7 +26,8 @@
 import { isAppOrigin, restoreSessionFromAppOrigin } from './session.js';
 import { showLoginModal } from './modal.js';
 import { escHtml, modeSwitchHtml, wireModeSwitch, ensureAuthPillStyles, pillInitials } from './theme.js';
-import { readLocales, langSwitchHtml, wireLangSwitch } from './locale.js';
+import { readLocales, langSwitchHtml, wireLangSwitch, aimeatReadLang } from './locale.js';
+import { pillStrings } from './pill-strings.js';
 import { paletteControlHtml, wirePaletteControl } from './palette.js';
 import { ensureClusterStyles, clampPopover } from './cluster.js';
 import { load, remove } from './crypto.js';
@@ -39,14 +48,19 @@ export function mountPill(auth, selector, opts = {}) {
     if (!container) { console.error('AIMEAT: mountLoginButton container not found for selector:', selector, '— pass a CSS selector string, a DOM element, or an options object.'); return; }
   }
 
-  const i = opts.i18n || {};
   // Languages the APP says it has: opts.locales, else <meta name="aimeat-locales" content="en fi">.
   // Empty when the app declares none or only one, and then no language control renders at all.
   const locales = readLocales(opts);
+  // The pill's own labels follow the reader's language. The caller's strings always win, so the SPA
+  // (which passes the node's full dictionary) is unaffected; an app that passes nothing stops
+  // getting an English "Logout" under a Spanish page. Recomputed per render, because the pill's own
+  // switch can change the language while the page is open.
+  let i = Object.assign({}, pillStrings(aimeatReadLang(locales.length ? locales : ['en'])), opts.i18n);
   // Compact pill (account button + popover on ≤600px) is the mobile-safe DEFAULT on app origins.
   const useCompact = opts.compact !== undefined ? !!opts.compact : isAppOrigin();
 
   function render() {
+    i = Object.assign({}, pillStrings(aimeatReadLang(locales.length ? locales : ['en'])), opts.i18n);
     // Prefer the live session (carries the H-2 _app/_own grant metadata) over the persisted copy.
     const stored = auth.getSession() || load('session');
     if (stored) {
@@ -98,17 +112,13 @@ export function mountPill(auth, selector, opts = {}) {
       } else {
         container.innerHTML = pillHtml;
       }
-      document.getElementById('aimeat-logout-btn').addEventListener('click', () => {
-        auth.logout();
-        render();
-        if (opts.onLogout) opts.onLogout();
-      });
+      // Just ask for the logout — the render + opts.onLogout notification hang off the auth lib's
+      // 'logout' event (wired once, below), which fires AFTER the session state is actually gone.
+      document.getElementById('aimeat-logout-btn').addEventListener('click', () => { auth.logout(); });
       var gearBtn = document.getElementById('aimeat-grant-gear');
       if (gearBtn) gearBtn.addEventListener('click', () => {
-        auth.manageGrant().then((res) => {
-          render(); // reflect revoke (→ Sign In) or a re-grant
-          if (res && res.revoked && opts.onLogout) opts.onLogout();
-        }).catch(() => {});
+        // A revoke routes through auth.logout() → the 'logout' event handles render + onLogout.
+        auth.manageGrant().then(() => { render(); }).catch(() => {});
       });
       // Compact trigger toggles the popover. The outside-click / Escape closers are registered ONCE
       // per mount (below, after render()) — not here — so re-renders don't stack them.
@@ -150,6 +160,9 @@ export function mountPill(auth, selector, opts = {}) {
   }
   ensureClusterStyles();
   render();
+  // The pill's own switch fires this, and so does an app that sets the language itself. Re-render so
+  // the pill's labels follow the language it just changed rather than staying in the old one.
+  window.addEventListener('aimeat-lang-change', render);
   // Close any open cluster popover (palette / language list) on an outside click or Escape.
   document.addEventListener('click', (ev) => {
     container.querySelectorAll('.aimeat-pop-wrap.aimeat-open').forEach((w) => {
@@ -186,7 +199,13 @@ export function mountPill(auth, selector, opts = {}) {
   // Re-render when the session changes out-of-band (e.g. the H-2 silent SSO logs in async). Only
   // re-render (do NOT call opts.onLogin — the interactive modal path already does).
   auth.on('login', render);
-  auth.on('logout', render);
+  // Logout is the ONE place that also notifies the host: the event fires after the session is
+  // already cleared, so every subscriber that then reads getSession()/hasSession sees the truth.
+  // Calling opts.onLogout from the button handler instead raced the async logout() and left hosts
+  // (the SPA header's bell + "Me" menu) rendering a signed-in state next to a "Sign In" button.
+  // Routing it through the event also covers the paths the button never touches: a grant revoke
+  // via manageGrant(), and the stale-cache drop below.
+  auth.on('logout', () => { render(); if (opts.onLogout) opts.onLogout(); });
   auth.on('session-updated', render); // live display-name (etc.) edits
   // Seamless SSO: on an app origin with no session yet, attempt the silent bridge ourselves. Always
   // re-confirm via the bridge on load (the cached session is only a UI cache); drop a stale cache.

package/dist/static/sdk-libs/auth/pkce.js

@@ -0,0 +1,32 @@
+/**
+ * @file auth/pkce.js
+ * @description PKCE helpers for the H-2 app-grant consent code flow (RFC 7636): base64url encoding
+ *   and the verifier/challenge pair. Pure and stateless — they touch no module state, which is why
+ *   they live outside session.js (that file's rule is that every reassignment of the mutable session
+ *   state stays in ONE module; these do not participate in it).
+ * @structure
+ *   - b64url(buf): ArrayBuffer/TypedArray buffer → base64url string
+ *   - pkce(): { verifier, challenge, method } — S256, or 'plain' where crypto.subtle is unavailable
+ * @usage import { b64url, pkce } from './pkce.js';
+ * @version-history
+ *   v1.0.0 — 2026-08-07 — Extracted from session.js (pure helpers, no session state).
+ */
+
+/** Base64url-encode a buffer (no padding), the encoding PKCE and the state parameter use. */
+export function b64url(buf) {
+  var bytes = new Uint8Array(buf), s = '';
+  for (var i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** A fresh PKCE verifier + challenge. */
+export async function pkce() {
+  var verifier = b64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
+  if (crypto.subtle && crypto.subtle.digest) {
+    var digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return { verifier: verifier, challenge: b64url(digest), method: 'S256' };
+  }
+  // Non-secure context (http on a non-localhost host): crypto.subtle is unavailable. Fall back to
+  // PKCE "plain". Acceptable — such transport is already non-confidential; real app origins are https.
+  return { verifier: verifier, challenge: verifier, method: 'plain' };
+}

package/dist/static/sdk-libs/auth/session.js

@@ -13,10 +13,13 @@
  * @usage import { auth, api, isAppOrigin, restoreSessionFromAppOrigin } from './session.js';
  * @version-history
  *   v1.0.0 — 2026-07-19 — Merged from src/routes/libs/auth-lib-part1/2/3.ts (SDK-libs migration Phase 3).
+ *   v1.1.0 — 2026-08-07 — logout() clears local state and emits BEFORE the server revoke, so
+ *     "signed out" never depends on a network round-trip; PKCE helpers moved to ./pkce.js.
  */
 import { importEd25519Key, storeKey, loadKey, deleteKey, migrateKeysToIndexedDB, sign, save, load, remove, parseJwt, isExpired } from './crypto.js';
 import { NODE_URL, APEX_URL, NODE_ID, appDeclaredScopes } from './config.js';
 import { emit, on, off } from './events.js';
+import { b64url, pkce } from './pkce.js';
 import { mountPill } from './pill.js';
 import { showLoginModal } from './modal.js';
 
@@ -176,27 +179,12 @@ export function apexLogout() {
   });
 }
 
-// ── App-grant consent popup (H-2, PKCE code flow) ──
-function _b64url(buf) {
-  var bytes = new Uint8Array(buf), s = '';
-  for (var i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
-  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-async function _pkce() {
-  var verifier = _b64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
-  if (crypto.subtle && crypto.subtle.digest) {
-    var digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
-    return { verifier: verifier, challenge: _b64url(digest), method: 'S256' };
-  }
-  // Non-secure context (http on a non-localhost host): crypto.subtle is unavailable. Fall back to
-  // PKCE "plain". Acceptable — such transport is already non-confidential; real app origins are https.
-  return { verifier: verifier, challenge: verifier, method: 'plain' };
-}
+// ── App-grant consent popup (H-2, PKCE code flow; b64url/pkce live in ./pkce.js) ──
 export async function requestConsentPopup(app, scopeStr, manage) {
   var apexOrigin;
   try { apexOrigin = new URL(APEX_URL).origin; } catch { return null; }
-  var p = await _pkce();
-  var state = _b64url(crypto.getRandomValues(new Uint8Array(16)).buffer);
+  var p = await pkce();
+  var state = b64url(crypto.getRandomValues(new Uint8Array(16)).buffer);
   var redirectUri = location.origin + '/'; // app origin; never navigated in web_message mode (origin binding only)
   var scope = scopeStr || appDeclaredScopes();
   // manage=1 → the consent page always shows the management screen (the gear).
@@ -658,30 +646,35 @@ export const auth = {
     emit('session-updated', currentSession);
   },
 
-  /** Logout — clear stored credentials from localStorage and IndexedDB */
+  /**
+   * Logout — clear stored credentials from localStorage and IndexedDB.
+   * ORDER MATTERS: local state is dropped and 'logout' emitted SYNCHRONOUSLY, before the revoke.
+   * "Logged out" must not depend on a network round-trip — with the revoke awaited first, every
+   * subscriber reading getSession() meanwhile still saw the old session, which is how the header
+   * kept the bell and "Me" next to a "Sign In" button (2026-08-07). Revoke + apex logout are
+   * best-effort cleanup that runs after the UI already shows the truth.
+   */
   async logout() {
     if (refreshTimer) { clearTimeout(refreshTimer); refreshTimer = null; }
     ownerRefreshInFlight = null;
-    // Revoke the session and clear the httpOnly refresh cookie server-side.
-    try {
-      await fetch(NODE_URL + '/v1/auth/revoke', {
-        method: 'POST',
-        credentials: 'include',
-        headers: {
-          'Content-Type': 'application/json',
-          ...(currentSession?.jwt ? { 'Authorization': 'Bearer ' + currentSession.jwt } : {}),
-        },
-      });
-    } catch { /* best effort — still clear local state below */ }
-    // On an app origin, end the apex session too so EXIT sticks across the whole family.
-    if (isAppOrigin()) { try { await apexLogout(); } catch { /* best effort */ } }
+    const jwt = currentSession?.jwt;
+    const onAppOrigin = isAppOrigin();
     currentSession = null;
     remove('session');
     remove('owner_key');
+    emit('logout');
     // SECURITY: Delete CryptoKeys from IndexedDB
     await deleteKey('agent_key');
     await deleteKey('owner_key');
-    emit('logout');
+    // Revoke the session and clear the httpOnly refresh cookie server-side.
+    try {
+      await fetch(NODE_URL + '/v1/auth/revoke', {
+        method: 'POST', credentials: 'include',
+        headers: { 'Content-Type': 'application/json', ...(jwt ? { 'Authorization': 'Bearer ' + jwt } : {}) },
+      });
+    } catch { /* best effort — local state is already cleared */ }
+    // On an app origin, end the apex session too so EXIT sticks across the whole family.
+    if (onAppOrigin) { try { await apexLogout(); } catch { /* best effort */ } }
   },
 
   /**

package/dist/static/sdk-libs/connect/index.js

@@ -18,7 +18,20 @@
  * @usage <script src="/v1/libs/aimeat-auth.js"></script><script src="/v1/libs/aimeat-connect.js"></script>
  *   const accounts = await AIMEAT.connect.list();
  *   await AIMEAT.connect.start('mastodon', { instance: 'mastodon.social' });
+ *   await AIMEAT.connect.publish({ connectionId: accounts[0].id, caption: 'hello' });
+ *   const sent = await AIMEAT.connect.history({ limit: 50 });
+ *   await AIMEAT.connect.measure(sent[0].id);   // costs a provider request, and money on X
  * @version-history
+ *   v1.2.0 — 2026-08-08 — attach() and revoke() were the two WRITERS still exempt from that rule:
+ *     both returned a hardcoded success and announced a change on any answer, so a 403 for an app
+ *     holding only `connections:use` read back as `{connected: true}`. Found by an app doing exactly
+ *     that. publish() now reports an empty externalRef as no url, since '' is what LinkedIn returns
+ *     for a successful share and every truthiness check downstream drew it as a link to nothing.
+ *   v1.1.0 — 2026-08-02 — Every reader RAISES the node's refusal instead of resolving with a hollow
+ *     object. authFetch answers with the envelope either way, so a refused publish came back as
+ *     `status: 'unknown'` and an app drew it as "Published" — a post that never went out, reported as
+ *     sent. Errors carry `code` and `permanent`, because "this will never work" and "try again" ask
+ *     an app to draw different things.
  *   v1.0.0 — 2026-08-02 — Initial (TARGET-057 phase 3).
  */
 import { makeSession } from '../_core/session.js';
@@ -28,6 +41,33 @@ import { PROVIDER_NOTES } from './notes.js';
 
 const { authFetch } = makeSession('aimeat-connect.js');
 
+/**
+ * The node's answer, or its refusal as a thrown Error.
+ *
+ * WHY THIS EXISTS. authFetch resolves with the parsed envelope whether or not the call succeeded, so
+ * a refusal arrives as a perfectly ordinary object with no `data` — and every reader that pulled a
+ * field out of it got `undefined` and carried on. On this surface that produced the worst possible
+ * outcome: a publish the provider REFUSED read back as `status: 'unknown'`, which an app then drew
+ * as "Published". A post that never went out, reported as sent.
+ *
+ * `permanent` is carried through because the difference matters to what an app draws. A 409
+ * NOT_MEASURABLE is the platform saying it will never tell an author this number — an app that
+ * offers a retry there is offering a button that can never work, and on a paid provider a retry loop
+ * is a standing bill.
+ */
+function must(res, fallback) {
+  if (res && res.ok === false) {
+    const code = res.error && res.error.code;
+    const err = /** @type {Error & { code?: string, permanent?: boolean, envelope?: unknown }} */ (
+      new Error((res.error && (res.error.message || res.error.code)) || fallback));
+    err.code = code;
+    err.permanent = code === 'NOT_MEASURABLE' || code === 'REJECTED';
+    err.envelope = res;
+    throw err;
+  }
+  return (res && res.data) || {};
+}
+
 /**
  * @typedef {Object} Connection
  * @property {string} id
@@ -52,14 +92,160 @@ function announce() {
 
 /** The caller's own connections. Never anyone else's — the node scopes this, not the caller. */
 async function list() {
-  const res = await authFetch('/v1/connections');
-  return (res?.data?.connections ?? []);
+  return must(await authFetch('/v1/connections'), 'could not read your connections').connections ?? [];
 }
 
-/** Providers this node can connect to. An unconfigured one is simply absent. */
+/**
+ * Providers this node can connect to.
+ *
+ * `nodeConfigured: false` means the NODE holds no application credentials for it. That is not the
+ * same as unavailable: a user who registers their own app with setClient() can connect it anyway.
+ * Show those rather than hiding them, or an operator's decision not to register an app silently
+ * removes a choice from every user.
+ */
 async function providers() {
-  const res = await authFetch('/v1/connections/providers');
-  return (res?.data?.providers ?? []);
+  return must(await authFetch('/v1/connections/providers'), 'could not read the providers').providers ?? [];
+}
+
+/**
+ * Publish to an account the CALLER connected.
+ *
+ * The whole point of the capability, from an app's side: one call, one post, and the credential
+ * never comes near the page.
+ *
+ * IDEMPOTENT BY CONTENT. The node keys an attempt on publisher + connection + file + caption and
+ * records it BEFORE anything leaves. Calling twice with the same arguments returns the FIRST
+ * outcome with `replay: true` and posts nothing further, which is why a failed network call is safe
+ * to retry. On a provider that charges per post, that is a billing control and not only a nicety.
+ *
+ * A SEND THAT FAILED IS NOT A REPLAY. The guard prevents a double POST, so an attempt that reached
+ * nobody — refused by the provider, or abandoned when the node stopped — is reopened and sent for
+ * real. Do not build a "you already sent this" state out of `replay` alone without showing the
+ * original `status`: an app that did exactly that told a user their post had gone out when it never
+ * left the node.
+ *
+ * TWO SUCCESSFUL ANSWERS ARE NOT PUBLICATIONS. `status: 'held'` is awaiting moderation and
+ * `status: 'queued'` is a spent provider allowance. Neither is an error, because reporting them as
+ * one teaches a caller to retry, and retrying makes both worse. Read `status`, not the absence of
+ * a throw.
+ *
+ * @param {{connectionId: string, storageKey?: string, caption?: string,
+ *          params?: Record<string, unknown>}} input
+ * @returns {Promise<{url?: string, replay: boolean, status: string, attemptId: string, error?: string}>}
+ */
+async function publish(input) {
+  if (!input?.connectionId) throw new Error('publish needs a connectionId');
+  const res = await authFetch('/v1/connections/publish', {
+    method: 'POST',
+    body: JSON.stringify({
+      connection_id: input.connectionId,
+      storage_key: input.storageKey,
+      caption: input.caption ?? '',
+      params: input.params ?? {},
+    }),
+  });
+  const d = must(res, 'the publish was refused');
+  return {
+    url: d.url,
+    replay: Boolean(d.replay),
+    status: d.attempt?.status ?? 'unknown',
+    attemptId: d.attempt?.id ?? '',
+    error: d.attempt?.error ?? undefined,
+  };
+}
+
+/**
+ * What this caller has published through the node, newest first.
+ *
+ * The same ledger that stops a double post is what makes a history possible at all: every attempt
+ * was written down before anything left, so this is a record of what was TRIED, not a list of
+ * successes. `status` distinguishes them, and an item that was held or queued belongs on the page
+ * as much as one that went out.
+ *
+ * `latest` is the most recent reading of how it is doing, or null when nobody has asked yet. Null
+ * means unmeasured, never zero.
+ *
+ * @param {{limit?: number}} [opts]
+ */
+async function history(opts = {}) {
+  const q = opts.limit ? `?limit=${encodeURIComponent(opts.limit)}` : '';
+  return must(await authFetch(`/v1/connections/attempts${q}`), 'could not read your history').attempts ?? [];
+}
+
+/**
+ * Ask the platform how one published item is doing, right now, and keep the answer.
+ *
+ * THIS HAS EFFECTS AND ONE OF THEM IS MONEY. It spends a request at the provider, and on X it
+ * spends actual credit. Nothing in the node schedules it: a reading happens because a person asked
+ * for one. Do not put this on a timer, and do not call it on render.
+ *
+ * A platform that will not report a number to its author is not a failure to retry: the node
+ * answers 409 with the reason, which is a fact to display rather than an error to hide.
+ */
+async function measure(attemptId) {
+  // A refusal THROWS, carrying `permanent`. Returning undefined here is what made an app unable to
+  // tell "nobody has asked yet" from "this platform will never say", and both drew as "not read".
+  const res = await authFetch(`/v1/connections/attempts/${encodeURIComponent(attemptId)}/metrics`, {
+    method: 'POST',
+  });
+  return must(res, 'the numbers could not be read').sample;
+}
+
+/**
+ * Every reading taken for one item, oldest first.
+ *
+ * A curve rather than a number: 40 likes means something different in an hour than in a month, and
+ * that difference is the part worth acting on.
+ */
+async function series(attemptId) {
+  const res = await authFetch(`/v1/connections/attempts/${encodeURIComponent(attemptId)}/metrics`);
+  return must(res, 'could not read the series').samples ?? [];
+}
+
+/**
+ * The apps the CALLER registered themselves, one per provider at most.
+ *
+ * WHY ANYONE WOULD. Without their own, every user of a node reaches a provider through one
+ * registration: the node's. To the provider they are one application, sharing its rate limit, its
+ * reputation and — where publishing is charged per call — its bill. Their own app spends their own.
+ *
+ * `connectionCount` is how many of their accounts were made with it. It is not decoration: a token
+ * can only be renewed by the client that issued it, so that is also how many would stop renewing if
+ * the app went away, which is why removeClient() refuses while it is above zero.
+ */
+async function clients() {
+  return must(await authFetch('/v1/connections/clients'), 'could not read your apps').clients ?? [];
+}
+
+/**
+ * Register the caller's own app at a provider. Replaces any previous one of theirs.
+ *
+ * The secret is write-only: it is encrypted by the node and no endpoint ever returns it, including
+ * this one.
+ *
+ * EXISTING CONNECTIONS ARE NOT MOVED ONTO IT. Each keeps the app that minted its token, because
+ * that is the only client that can renew it. Reconnect an account to move it.
+ */
+async function setClient(provider, clientId, clientSecret) {
+  const res = await authFetch('/v1/connections/clients', {
+    method: 'PUT',
+    body: JSON.stringify({ provider, client_id: clientId, client_secret: clientSecret }),
+  });
+  announce();
+  return res?.data?.client;
+}
+
+/**
+ * Remove the caller's own app registration.
+ *
+ * Refused while any of their connected accounts still depends on it, with the count in the message.
+ * Those accounts could only be renewed by this client; removing it would leave them working until
+ * their tokens expire and then failing with an error nobody could trace back to this moment.
+ */
+async function removeClient(provider) {
+  await authFetch(`/v1/connections/clients/${encodeURIComponent(provider)}`, { method: 'DELETE' });
+  announce();
+  return { removed: true };
 }
 
 /**
@@ -164,8 +350,13 @@ async function attachAccount(provider, fields) {
     method: 'POST',
     body: JSON.stringify({ provider, mode: 'personal', fields }),
   });
+  // `must` FIRST, and this line is the whole fix. Without it the two statements below ran on any
+  // answer at all: a refused credential, an expired session, a 403 for an app holding only
+  // `connections:use` — every one of them returned `{connected: true}` and announced a change that
+  // had not happened. Found by an app calling this with the wrong scope and being told it worked.
+  const d = must(res, 'the account could not be attached');
   announce();
-  return { connected: true, connection: res?.data?.connection };
+  return { connected: true, connection: d.connection };
 }
 
 /**
@@ -174,8 +365,12 @@ async function attachAccount(provider, fields) {
  */
 async function revoke(connectionId) {
   const res = await authFetch(`/v1/connections/${encodeURIComponent(connectionId)}`, { method: 'DELETE' });
+  // Same fix as attach(): a refusal used to resolve as `{revoked: true}`, so a panel removed the row
+  // and the account stayed connected. "This always ends with the account disconnected here" was only
+  // true when the call succeeded.
+  const d = must(res, 'the account could not be disconnected');
   announce();
-  return { revoked: true, toldProvider: Boolean(res?.data?.told_provider) };
+  return { revoked: true, toldProvider: Boolean(d.told_provider) };
 }
 
 /** Subscribe to "the set of connections changed". Returns an unsubscribe function. */
@@ -187,7 +382,9 @@ function on(fn) {
 function off(fn) { listeners.delete(fn); }
 
 const connect = {
-  list, providers, start, attach: attachAccount, revoke, on, off,
+  list, providers, start, attach: attachAccount, revoke, publish, on, off,
+  clients, setClient, removeClient,
+  history, measure, series,
   /** Per-provider things a user must be told BEFORE they try. See notes.js. */
   notes: PROVIDER_NOTES,
   /** Mount the ready-made panel. See panel.js. */

package/dist/static/sdk-libs/connect/notes.js

@@ -14,6 +14,8 @@
  * @usage import { PROVIDER_NOTES } from './notes.js';  PROVIDER_NOTES.bluesky.before
  * @version-history
  *   v1.0.0 — 2026-08-02 — Initial (TARGET-057 phase 3).
+ *   v1.1.0 — 2026-08-02 — LinkedIn: says up front that the connection expires, because a token
+ *     that silently dies in two months is the least readable failure in the set.
  */
 
 /**
@@ -32,6 +34,12 @@ export const PROVIDER_NOTES = {
   youtube: {
     before: 'Sign in with the Google account that owns the channel. A Google account with no YouTube channel will connect and then have nowhere to publish.',
   },
+  x: {
+    before: 'Posting to X costs the node operator a small amount per post, charged against prepaid credits at X. When those credits run out, publishing stops until they are topped up.',
+  },
+  linkedin: {
+    before: 'A LinkedIn connection stops working after about two months and asks to be reconnected. That is LinkedIn: renewing a token in the background is a partner-only feature, so this is the one provider you will have to come back to a few times a year.',
+  },
   bluesky: {
     needs: 'An app password. This is NOT your Bluesky password.',
     where: 'Bluesky → Settings → Privacy and security → App passwords.',

package/dist/static/sdk-libs/dist/aimeat-agentface.js

@@ -57,6 +57,36 @@
     },
     /** The markdown composer (exposed so an app can preview what publish() will write). */
     compose,
+    /**
+     * Copy text to the clipboard the way every "Copy prompt" button should: async clipboard API
+     * first, hidden-offscreen-textarea execCommand fallback — never a visible selection painted
+     * over the page. Resolves to true/false; never throws. This is THE shared implementation for
+     * the platform's copy-a-prompt-to-your-AI pattern — stop hand-rolling it per app.
+     */
+    async copyText(text) {
+      const value = String(text == null ? "" : text);
+      if (typeof navigator !== "undefined" && navigator.clipboard && navigator.clipboard.writeText) {
+        try {
+          await navigator.clipboard.writeText(value);
+          return true;
+        } catch {
+        }
+      }
+      try {
+        const ta = document.createElement("textarea");
+        ta.value = value;
+        ta.setAttribute("readonly", "");
+        ta.style.position = "fixed";
+        ta.style.left = "-9999px";
+        document.body.appendChild(ta);
+        ta.select();
+        const ok = document.execCommand("copy");
+        document.body.removeChild(ta);
+        return !!ok;
+      } catch {
+        return false;
+      }
+    },
     /**
      * Publish this app's agent face: a markdown string, or { title, sections: [{ heading, body }] }.
      * opts.app names the app filename explicitly (e.g. 'my-app.html') and overrides inference —

package/dist/static/sdk-libs/dist/aimeat-ai.js

@@ -466,6 +466,7 @@
     draftTitle: "This draft was written by AI",
     draftBody: "Read it before you send it. You are responsible for what goes out under your name.",
     regionLabel: "AI transparency",
+    expand: "Show AI disclosure",
     iconAlt: {
       aiGenerated: "Content generated by AI",
       aiModified: "Content partially modified by AI",
@@ -494,6 +495,7 @@
     draftTitle: "Tämän luonnoksen on kirjoittanut tekoäly",
     draftBody: "Lue se ennen lähettämistä. Vastaat itse siitä, mitä nimissäsi lähtee.",
     regionLabel: "Tekoälyn läpinäkyvyystiedot",
+    expand: "Näytä tekoälymerkintä",
     iconAlt: {
       aiGenerated: "Tekoälyn tuottamaa sisältöä",
       aiModified: "Sisältöä on osittain muokattu tekoälyllä",
@@ -502,8 +504,37 @@
     }
   };
 
+  // locales/es.json
+  var aiLabel3 = {
+    short: "Generado por IA",
+    assisted: "Con ayuda de IA",
+    original: "Escrito por una persona",
+    unstated: "Origen sin declarar",
+    chat: "Estás hablando con un asistente de IA.",
+    publicText: "Este texto lo escribió una IA sin que ninguna persona lo revisara.",
+    assistedLong: "Lo escribió una persona. La IA ayudó a editarlo o a pulirlo.",
+    reviewedGeneric: "La IA escribió el borrador y una persona revisó el contenido.",
+    originalLong: "Lo escribió una persona. No intervino ninguna IA.",
+    unstatedLong: "No sabemos si intervino una IA en esto.",
+    reviewed: "Borrador de IA, revisado por {{name}}.",
+    detailsLink: "Cómo se hizo esto",
+    policyLong: "Un modelo intervino en esto. Este nodo lo declara incluso donde la ley no lo exige.",
+    interactionTitle: "Estás hablando con un asistente de IA",
+    interactionBody: "Puede equivocarse, así que comprueba todo lo que te importe. Tus mensajes van a un modelo de lenguaje con tu propia clave de API.",
+    draftTitle: "Este borrador lo escribió una IA",
+    draftBody: "Léelo antes de enviarlo. Lo que salga con tu nombre es responsabilidad tuya.",
+    regionLabel: "Transparencia sobre la IA",
+    expand: "Ver la declaración sobre la IA",
+    iconAlt: {
+      aiGenerated: "Contenido generado por IA",
+      aiModified: "Contenido modificado en parte por IA",
+      aiBasic: "Una IA intervino en la creación de este contenido",
+      unstated: "Intervención de la IA sin declarar"
+    }
+  };
+
   // src/static/sdk-libs/ai/strings.js
-  var STRINGS2 = { en: aiLabel, fi: aiLabel2 };
+  var STRINGS2 = { en: aiLabel, fi: aiLabel2, es: aiLabel3 };
   function pick(key, loc) {
     const path = (key.startsWith("aiLabel.") ? key.slice("aiLabel.".length) : key).split(".");
     for (const bundle of [STRINGS2[loc], STRINGS2.en]) {