aimeat 1.40.1 → 2.1.0

package/dist/static/app-catalog/js/server-io.js

@@ -1,23 +1,26 @@
 /**
  * @file server-io.js
- * @description Everything that talks to the NODE about apps: import-from-AIMEAT, publish, the
- *   two-view (Library/Community) + operator subdomain mappings, H-2 app-grant consents, the .zip
- *   backup export/restore, and the (never-automatic) server→local import. Owns no state itself — the
- *   shared app-state lives in main and is read via injected getters / written via injected setters;
- *   main-local fns (+ closeModal/addAppFromUrl from apps-io) injected via initServerIo(deps). Carved
- *   from main.js.
- * @usage import { initServerIo, loadPublishedApps, importFromAimeat } from './server-io.js'; initServerIo({...})
+ * @description Everything that talks to the NODE about apps: publish (incl. the create-flow
+ *   publish-then-unlist), the two-view (Library/Community) + operator subdomain mappings, H-2
+ *   app-grant consents, and the .zip backup export/restore. Owns no state itself — the shared
+ *   app-state lives in main and is read via injected getters / written via injected setters;
+ *   main-local fns (+ closeModal from apps-io) injected via initServerIo(deps). Carved from main.js.
+ * @usage import { initServerIo, loadPublishedApps, showPublishModal } from './server-io.js'; initServerIo({...})
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 11).
+ *   v2.0.0 — 2026-07-20 — Server-only cutover: drop "Import from AIMEAT" (offline server→local import);
+ *     the create flow publishes then parks so a new app lands unlisted.
  */
 import { escapeHtml, jsArg, bareOwnerName, sameOwner, filterAttr } from './util.js';
-import { getAllApps, saveApp, getDbName } from './db.js';
+import { getAllApps, saveApp } from './db.js';
 import { showConfirm, showNotice } from './ui.js';
 import { loadConfig } from './config.js';
-import { t } from './i18n.js';
-import { closeModal, addAppFromUrl } from './apps-io.js';
+import { t, getLang } from './i18n.js';
+import { closeModal } from './apps-io.js';
 import { getCortexOwnerToken } from './cortex.js';
 import { fetchAppContentBase64, refreshServerMgmt } from './detail.js';
+import { favStarHtml, isFavorite, loadFavorites } from './favorites.js';
+import { loadPromoted } from './promote.js';
 
 // Injected once at bootstrap by main.js: read getters + write setters for the shared app-state
 // (which stays main-owned), plus a few main-local fns.
@@ -26,170 +29,20 @@ export function initServerIo(deps) {
   ({ getMainApps, getServerState, getServerManifests, setServerManifests, getOwnServerApps, setOwnServerApps, getActiveTag, getSearchQuery, generateId, renderApps, refreshAll } = deps);
 }
 
-// ── AIMEAT Import ───────────────────────────────
-
-var aimeatAppsCache = [];
-
-function formatFileSize(bytes) {
-  if (bytes < 1024) return bytes + ' B';
-  if (bytes < 1048576) return (bytes / 1024).toFixed(1) + ' KB';
-  return (bytes / 1048576).toFixed(1) + ' MB';
-}
-
-function importFromAimeat() {
-  var config = loadConfig();
-  if (!config.aimeatUrl) {
-    showNotice('Set AIMEAT server URL in Settings first');
-    return;
-  }
-
-  var aimeatUrl = config.aimeatUrl.replace(/\/+$/, ''); // strip trailing slash
-  closeModal();
-
-  fetch(aimeatUrl + '/v1/apps?include_peers=true')
-    .then(function (resp) {
-      if (!resp.ok) throw new Error('Server returned ' + resp.status);
-      return resp.json();
-    })
-    .then(function (json) {
-      var apps = json.data && json.data.apps ? json.data.apps : [];
-      var peerApps = json.data && json.data.peer_apps ? json.data.peer_apps : [];
-      // Merge local and peer apps; tag peer apps with source info
-      for (var p = 0; p < peerApps.length; p++) {
-        peerApps[p]._from_peer = true;
-      }
-      var allFetched = apps.concat(peerApps);
-      if (allFetched.length === 0) {
-        showNotice('No apps found on the AIMEAT server');
-        return;
-      }
-      aimeatAppsCache = allFetched;
-      showAimeatImportDialog(allFetched, aimeatUrl);
-    })
-    .catch(function (err) {
-      var msg = 'Failed to fetch apps from AIMEAT server.\n\n' + (err.message || err);
-      if (err.message && err.message.indexOf('Failed to fetch') !== -1) {
-        msg += '\n\nIf the launcher is opened via file://, CORS will block the request. Open it from the AIMEAT server instead.';
-      }
-      showNotice(msg);
-    });
-}
-
-function showAimeatImportDialog(apps, aimeatUrl) {
-  var listEl = document.getElementById('aimeat-app-list');
-  var html = '';
-  for (var i = 0; i < apps.length; i++) {
-    var app = apps[i];
-    var displayName = (app.manifest && app.manifest.name) ? app.manifest.name : app.filename;
-    var displayAuthor = (app.manifest && app.manifest.authorDisplay) ? app.manifest.authorDisplay : (app.owner || '');
-    var displayDesc = (app.manifest && app.manifest.description) ? app.manifest.description : '';
-    var displayVer = app.version_number ? 'v' + app.version_number : '';
-    var displayCat = (app.manifest && app.manifest.category) ? app.manifest.category : '';
-    var peerLabel = app._from_peer && app._peer_node ? ' \u00B7 \uD83C\uDF10 ' + escapeHtml(app._peer_node) : '';
-    html +=
-      '<div class="aimeat-app-item">' +
-        '<input type="checkbox" data-index="' + i + '" checked/>' +
-        '<div class="aimeat-app-info">' +
-          '<div class="aimeat-app-name">' + escapeHtml(displayName) + (displayVer ? ' <span style="opacity:.5;font-size:.85em">' + escapeHtml(displayVer) + '</span>' : '') + '</div>' +
-          '<div class="aimeat-app-size">' + formatFileSize(app.size) + (displayAuthor ? ' \u00B7 ' + escapeHtml(displayAuthor) : '') + (displayCat ? ' \u00B7 ' + escapeHtml(displayCat) : '') + peerLabel + '</div>' +
-          (displayDesc ? '<div class="aimeat-app-size" style="opacity:.6">' + escapeHtml(displayDesc.substring(0, 100)) + '</div>' : '') +
-        '</div>' +
-        '<select data-index="' + i + '">' +
-          '<option value="link">Link (online only)</option>' +
-          '<option value="download">Download (offline)</option>' +
-        '</select>' +
-      '</div>';
-  }
-  listEl.innerHTML = html;
-  // Store the aimeatUrl for processing
-  listEl.dataset.aimeatUrl = aimeatUrl;
-  document.getElementById('aimeat-import-overlay').hidden = false;
-}
-
-function processAimeatImport() {
-  var listEl = document.getElementById('aimeat-app-list');
-  var aimeatUrl = listEl.dataset.aimeatUrl;
-  var checkboxes = listEl.querySelectorAll('input[type="checkbox"]');
-  var selects = listEl.querySelectorAll('select');
-  var config = loadConfig();
-  var defaultOpenMode = config.defaultOpenMode || 'tab';
-
-  var toImport = [];
-  for (var i = 0; i < checkboxes.length; i++) {
-    if (checkboxes[i].checked) {
-      var idx = parseInt(checkboxes[i].getAttribute('data-index'), 10);
-      var mode = selects[i].value;
-      toImport.push({ app: aimeatAppsCache[idx], mode: mode });
-    }
-  }
-
-  if (toImport.length === 0) {
-    showNotice('No apps selected');
-    return;
-  }
-
-  var promises = [];
-  for (var j = 0; j < toImport.length; j++) {
-    (function (item) {
-      var app = item.app;
-      var name = (app.manifest && app.manifest.name) ? app.manifest.name : app.filename.replace(/\.html?$/i, '');
-      var importedVersion = app.version_number || 1;
-      // For peer apps, use the peer's URL as the base
-      var baseUrl = (app._from_peer && app._peer_url) ? app._peer_url.replace(/\/+$/, '') : aimeatUrl;
-
-      if (item.mode === 'link') {
-        // Link mode: store URL with ?mode=inline, pinned to latest
-        var inlineUrl = baseUrl + app.download_url + '?mode=inline';
-        promises.push(addAppFromUrl(name, inlineUrl, '\u{1F4E6}', ['aimeat'], defaultOpenMode));
-      } else {
-        // Download mode: fetch content and store blob (pinned to current version)
-        var downloadUrl = baseUrl + app.download_url;
-        promises.push(
-          fetch(downloadUrl)
-            .then(function (resp) {
-              if (!resp.ok) throw new Error('Download failed: ' + resp.status);
-              return resp.text();
-            })
-            .then(function (content) {
-              var encoded = btoa(unescape(encodeURIComponent(content)));
-              var record = {
-                id: generateId(),
-                name: name,
-                description: (app.manifest && app.manifest.description) ? app.manifest.description : '',
-                source: 'aimeat',
-                aimeatOwner: app.owner || null,
-                aimeatFilename: app.filename || null,
-                aimeatVersion: importedVersion,
-                url: null,
-                blob: encoded,
-                tags: ['aimeat'],
-                openMode: defaultOpenMode,
-                icon: '\u{1F4E6}',
-                screenshot: null,
-                favorite: false,
-                addedAt: new Date().toISOString(),
-                lastOpenedAt: null
-              };
-              return saveApp(record);
-            })
-        );
-      }
-    })(toImport[j]);
-  }
-
-  Promise.all(promises).then(function () {
-    document.getElementById('aimeat-import-overlay').hidden = true;
-    renderApps();
-  }).catch(function (err) {
-    showNotice('Import error: ' + (err.message || err));
-  });
-}
+// Cache of the last full server-app list (own + community) + base URL, so a favourite toggle can
+// re-render the ⭐ group + all star states without a network round-trip.
+let lastAllServerApps = [];
+let lastAimeatUrl = '';
 
 // ── Publish to AIMEAT ───────────────────────────
 
 var publishAppId = null;
+// When the publish is driven by the "Add app" create flow we park the app straight after publishing
+// so a freshly-created app lands UNLISTED (on the server, not yet public) rather than instantly live.
+var publishUnlisted = false;
 
-function showPublishModal(appId) {
+function showPublishModal(appId, opts) {
+  publishUnlisted = !!(opts && opts.unlisted);
   var app = null;
   for (var i = 0; i < getMainApps().length; i++) {
     if (getMainApps()[i].id === appId) { app = getMainApps()[i]; break; }
@@ -330,6 +183,13 @@ function submitPublish() {
         app.publishedVersionNumber = json.data.version_number || 1;
         app.publishedVersionsUrl = json.data.versions_url || null;
         saveApp(app).then(function() {
+          // Create flow: park it immediately so the new app is UNLISTED (server-only, not public).
+          if (publishUnlisted) {
+            app.parked = true;
+            statusEl.textContent = '\u2714 ' + (t('publish.savedUnlisted') || 'Saved (unlisted)');
+            try { toggleParkApp(filename, true); } catch (e) { /* park is best-effort */ }
+          }
+          publishUnlisted = false;
           loadPublishedApps();
           // Close the modal shortly after showing success \u2014 otherwise it dead-ends with a
           // disabled button and the user isn't sure the publish took.
@@ -942,7 +802,9 @@ function loadPublishedApps() {
     }
   } catch(e) {}
 
-  getAllApps().then(function() {
+  // Load the owner's favourites alongside the app list so the ⭐ group + stars match the current
+  // session (also refreshes them on an auth change, which routes through here via refreshAll).
+  Promise.all([getAllApps(), loadFavorites(), loadPromoted()]).then(function() {
     if (!aimeatUrl) {
       setOwnServerApps([]);
       renderApps();
@@ -974,14 +836,18 @@ function loadPublishedApps() {
           ? serverApps.filter(function(a) { return !sameOwner(a.owner, currentOwner); })
           : serverApps;
 
+        // Cache the FULL list (own + community) so a favourite toggle can re-render the ⭐ group
+        // and the star state in place, without another round-trip.
+        lastAllServerApps = serverApps;
+        lastAimeatUrl = aimeatUrl;
+
         return loadSubdomainSites().then(function () {
-          // Unified Kirjasto grid: cache the owner's server apps (published + parked) so
-          // renderApps() merges them with local apps into ONE card per app (deduped by
-          // filename; buildLibraryEntries handles the parked/published state). Logged out →
-          // no owner server apps (a visitor browses everything under Community).
+          // Kirjasto grid: the owner's server apps (published + parked). Logged out → none
+          // (a visitor browses everything under Community).
           setOwnServerApps(currentOwner ? ownApps : []);
           renderApps();
           renderCommunityApps(communityApps, aimeatUrl, communitySection, communityGrid, communityCountEl, currentOwner);
+          renderFavorites(serverApps, aimeatUrl); // ⭐ group pinned atop the Library
           applyServerFilter(); // re-apply any active search/tag to the community cards
         });
       })
@@ -1024,6 +890,55 @@ function applyServerFilter() {
   if (sectionEl) sectionEl.style.display = (filtering && shown === 0) ? 'none' : '';
 }
 
+// One published-app card (used by BOTH the Community grid and the ⭐ Favourites group). Carries a
+// favourite toggle + a description localized to the current UI language.
+function publishedCardHtml(sa, aimeatUrl) {
+  var owner = sa.owner || '';
+  var fn = sa.filename || '';
+  var ref = owner + '/' + fn;
+  var m = sa.manifest || {};
+  var name = m.name || fn;
+  var version = sa.version_number ? 'v' + sa.version_number : '';
+  var description = (m.descriptions && m.descriptions[getLang()]) || m.description || '';
+  var date = sa.created_at ? new Date(sa.created_at).toLocaleDateString() : '';
+  var author = m.authorDisplay || owner;
+  var viewUrl = aimeatUrl + '/v1/apps/' + encodeURIComponent(owner) + '/' + encodeURIComponent(fn);
+  // Agent-Bundled Apps: this app ships its own agent(s) — badge it and offer the Bundled-agents modal.
+  var shipsAgent = !!(m.cortex && m.cortex.agents && m.cortex.agents.length);
+  return '<div class="published-card"' + filterAttr(name, m.tags || []) + '>' +
+      favStarHtml(ref) +
+      '<div class="published-card-name">' + escapeHtml(name) + '</div>' +
+      (description ? '<div class="published-card-desc">' + escapeHtml(description) + '</div>' : '') +
+      '<div class="published-card-footer">' +
+        '<div class="published-card-metaline">' +
+          '<span class="pcm-main" style="color:var(--accent)">&#x1F464; ' + escapeHtml(author) + '</span>' +
+          (date ? '<span class="pcm-date">' + date + '</span>' : '') +
+        '</div>' +
+        '<div class="published-card-actions">' +
+          '<button onclick="window._launcher.viewPublished(\'' + escapeHtml(viewUrl) + '?mode=inline\', \'' + jsArg(name) + '\')">' + t('card.view') + '</button>' +
+          // Fork is offered on a community app only when its owner marked it forkable.
+          (sa.forkable
+            ? '<button onclick="window._launcher.forkVersion(\'' + escapeHtml(owner) + '\', \'' + escapeHtml(fn) + '\', ' + (sa.version_number || 0) + ')" title="' + escapeHtml(t('card.forkHint')) + '">' + t('card.fork') + '</button>'
+            : '') +
+          (shipsAgent
+            ? '<button onclick="window._launcher.showAppAgentsModal(\'' + jsArg(owner) + '\', \'' + jsArg(fn) + '\')" title="' + escapeHtml(t('card.agentHint')) + '">' + t('card.agent') + '</button>'
+            : '') +
+        '</div>' +
+        ((version || (sa.forks && sa.forks > 0) || shipsAgent)
+          ? '<div class="published-card-badgerow">'
+            + (shipsAgent
+              ? '<span class="pcb-agent" title="' + escapeHtml(t('card.agentHint')) + '">&#x1F916;</span>'
+              : '')
+            + ((sa.forks && sa.forks > 0)
+              ? '<span class="pcb-forks" title="' + escapeHtml(t('card.forksHint')) + '" onclick="window._launcher.showLineageModal(\'' + escapeHtml(owner) + '\', \'' + escapeHtml(fn) + '\')">⑂ ' + sa.forks + '</span>'
+              : '')
+            + (version ? '<span class="pcb-version">' + escapeHtml(version) + '</span>' : '')
+            + '</div>'
+          : '') +
+      '</div>' +
+    '</div>';
+}
+
 function renderCommunityApps(serverApps, aimeatUrl, section, grid, countEl, currentOwner) {
   if (!section || !grid || !countEl) return;
   if (serverApps.length === 0) {
@@ -1032,51 +947,49 @@ function renderCommunityApps(serverApps, aimeatUrl, section, grid, countEl, curr
     updateCommunityEmpty();
     return;
   }
-
   section.style.display = '';
   countEl.textContent = '(' + serverApps.length + ')';
-
   var html = '';
-  for (var i = 0; i < serverApps.length; i++) {
-    var sa = serverApps[i];
-    var name = (sa.manifest && sa.manifest.name) ? sa.manifest.name : (sa.filename || '');
-    var version = sa.version_number ? 'v' + sa.version_number : '';
-    var description = (sa.manifest && sa.manifest.description) ? sa.manifest.description : '';
-    var date = sa.created_at ? new Date(sa.created_at).toLocaleDateString() : '';
-    var author = (sa.manifest && sa.manifest.authorDisplay) ? sa.manifest.authorDisplay : (sa.owner || '');
-    var viewUrl = aimeatUrl + '/v1/apps/' + encodeURIComponent(sa.owner || '') + '/' + encodeURIComponent(sa.filename || '');
-    html +=
-      '<div class="published-card"' + filterAttr(name, (sa.manifest && sa.manifest.tags) || []) + '>' +
-        '<div class="published-card-name">' + escapeHtml(name) + '</div>' +
-        (description ? '<div class="published-card-desc">' + escapeHtml(description) + '</div>' : '') +
-        '<div class="published-card-footer">' +
-          '<div class="published-card-metaline">' +
-            '<span class="pcm-main" style="color:var(--accent)">&#x1F464; ' + escapeHtml(author) + '</span>' +
-            (date ? '<span class="pcm-date">' + date + '</span>' : '') +
-          '</div>' +
-          '<div class="published-card-actions">' +
-            '<button onclick="window._launcher.viewPublished(\'' + escapeHtml(viewUrl) + '?mode=inline\', \'' + jsArg(name) + '\')">' + t('card.view') + '</button>' +
-            // Fork is offered on a community (someone else's) app only when its owner
-            // marked it forkable; otherwise the server would reject the fork (403).
-            (sa.forkable
-              ? '<button onclick="window._launcher.forkVersion(\'' + escapeHtml(sa.owner || '') + '\', \'' + escapeHtml(sa.filename || '') + '\', ' + (sa.version_number || 0) + ')" title="' + escapeHtml(t('card.forkHint')) + '">' + t('card.fork') + '</button>'
-              : '') +
-          '</div>' +
-          ((version || (sa.forks && sa.forks > 0))
-            ? '<div class="published-card-badgerow">'
-              + ((sa.forks && sa.forks > 0)
-                ? '<span class="pcb-forks" title="' + escapeHtml(t('card.forksHint')) + '" onclick="window._launcher.showLineageModal(\'' + escapeHtml(sa.owner || '') + '\', \'' + escapeHtml(sa.filename || '') + '\')">⑂ ' + sa.forks + '</span>'
-                : '')
-              + (version ? '<span class="pcb-version">' + escapeHtml(version) + '</span>' : '')
-              + '</div>'
-            : '') +
-        '</div>' +
-      '</div>';
-  }
+  for (var i = 0; i < serverApps.length; i++) html += publishedCardHtml(serverApps[i], aimeatUrl);
   grid.innerHTML = html;
   updateCommunityEmpty();
 }
 
+// The ⭐ Favourites group (Library view): apps the owner favourited, drawn from the FULL server-app
+// list (own + community). Pinned above "Your apps"; hidden when there are none.
+function renderFavorites(allServerApps, aimeatUrl) {
+  var section = document.getElementById('favorites-section');
+  var grid = document.getElementById('favorites-grid');
+  var countEl = document.getElementById('favorites-count');
+  if (!section || !grid) return;
+  var favs = (allServerApps || []).filter(function (sa) { return isFavorite((sa.owner || '') + '/' + (sa.filename || '')); });
+  if (favs.length === 0) { section.style.display = 'none'; grid.innerHTML = ''; return; }
+  section.style.display = '';
+  if (countEl) countEl.textContent = '(' + favs.length + ')';
+  var html = '';
+  for (var i = 0; i < favs.length; i++) html += publishedCardHtml(favs[i], aimeatUrl);
+  grid.innerHTML = html;
+}
+
+// Re-render everything that shows a star (own grid, community grid, ⭐ group) from the cached list
+// after a favourite toggle — no re-fetch. Called by the _launcher.toggleFavorite handler.
+function refreshFavoritesUI() {
+  renderFavorites(lastAllServerApps, lastAimeatUrl);
+  var currentOwner = null;
+  try {
+    var s = (window.AIMEAT && window.AIMEAT.auth && window.AIMEAT.auth.getSession());
+    currentOwner = (s && s.owner) || (JSON.parse(localStorage.getItem('aimeat_session') || '{}').owner) || null;
+  } catch (e) { /* anonymous */ }
+  var communityApps = currentOwner
+    ? lastAllServerApps.filter(function (a) { return !sameOwner(a.owner, currentOwner); })
+    : lastAllServerApps;
+  renderCommunityApps(communityApps, lastAimeatUrl,
+    document.getElementById('community-section'), document.getElementById('community-grid'),
+    document.getElementById('community-count'), currentOwner);
+  applyServerFilter();
+  renderApps(); // own-grid stars
+}
+
 // Render the owner's PARKED apps in their own section. A parked app is hidden from
 // the public catalogue but stays fully usable by the owner; the primary action here
 // is Publish (unpark), which moves it back into Published Apps.
@@ -1195,8 +1108,6 @@ async function deleteServerApp(filename) {
 
 export {
   isOperatorSession,
-  importFromAimeat,
-  processAimeatImport,
   showPublishModal,
   submitPublish,
   toggleCommunity,
@@ -1218,6 +1129,7 @@ export {
   backupSelectAll,
   submitBackupRestore,
   loadPublishedApps,
+  refreshFavoritesUI,
   applyServerFilter,
   unpublishApp,
   toggleParkApp,

package/dist/static/app-catalog/js/settings.js

@@ -2,24 +2,20 @@
  * @file settings.js
  * @description App-catalog settings + chrome that isn't a core feature block: the light/dark THEME
  *   (applyTheme/toggleTheme/getThemePref), the Settings modal (openSettings/saveSettings + config
- *   sync to/from the node), the Help overlay, the JSON export/import of the local catalog, the
- *   duplicate-cleanup, and Clear-all. Uses the shared modules by import; the few main-local fns it
- *   calls are injected via initSettings(deps). Carved from main.js.
- * @usage import { initSettings, applyTheme, openSettings, exportBackup } from './settings.js'; initSettings({...})
+ *   sync to/from the node), and the Help overlay. Uses the shared modules by import.
+ * @usage import { initSettings, applyTheme, openSettings } from './settings.js'; initSettings({...})
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 9).
+ *   v2.0.0 — 2026-07-20 — Server-only cutover: drop the local-catalog JSON export/import, the
+ *     duplicate-cleanup, and Clear-all (all local-store features); initSettings is now a no-op.
  */
-import { escapeHtml, sourceLabel } from './util.js';
-import { getAllApps, saveApp, deleteApp, openDB } from './db.js';
 import { showConfirm, closeConfirm, showNotice, dismissNotice } from './ui.js';
 import { loadConfig, saveConfig } from './config.js';
 import { t, getLang } from './i18n.js';
 
-// Injected once at bootstrap by main.js (main-local fns; no shared state).
-let generateId, renderApps, loadPublishedApps;
-export function initSettings(deps) {
-  ({ generateId, renderApps, loadPublishedApps } = deps);
-}
+// Kept for call-site stability (main.js still calls initSettings): server-only settings no longer
+// need any injected main-local fns, so this is now a no-op.
+export function initSettings() {}
 
 // ── Theme ────────────────────────────────────────
 
@@ -179,192 +175,9 @@ function closeHelp() { document.getElementById('help-overlay').hidden = true; }
 // Confirm dialog + toast notices → ui.js (showConfirm/closeConfirm/showNotice/dismissNotice),
 // imported at the top. The OK/Cancel buttons are wired to closeConfirm() in bootstrap below.
 
-// ── Export / Import ─────────────────────────────
-
-function exportBackup() {
-  getAllApps().then(function (apps) {
-    var config = loadConfig();
-    var backup = {
-      version: 1,
-      exportedAt: new Date().toISOString(),
-      config: config,
-      apps: apps
-    };
-    var json = JSON.stringify(backup, null, 2);
-    var blob = new Blob([json], { type: 'application/json' });
-    var url = URL.createObjectURL(blob);
-    var a = document.createElement('a');
-    a.href = url;
-    a.download = 'app-catalog-backup-' + new Date().toISOString().slice(0, 10) + '.json';
-    document.body.appendChild(a);
-    a.click();
-    document.body.removeChild(a);
-    URL.revokeObjectURL(url);
-  });
-}
-
-// Identity key for duplicate detection: a published app is the same app
-// regardless of its local id; unpublished ones match by name + content size.
-function localAppKey(a) {
-  if (a.publishedFilename) return 'pf:' + a.publishedFilename;
-  return 'nm:' + (a.name || '') + '|' + (a.blob ? a.blob.length : (a.url || ''));
-}
-
-// Parsed JSON backup awaiting user selection: { backup, rows: [{app, isDup}] }
-var jsonImportState = null;
-
-function handleImportBackup(file) {
-  if (!file) return;
-  var reader = new FileReader();
-  reader.onload = function () {
-    var backup;
-    try {
-      backup = JSON.parse(reader.result);
-    } catch (e) {
-      showNotice('Failed to parse backup file: ' + (e.message || e));
-      return;
-    }
-    if (!backup.apps || !Array.isArray(backup.apps)) {
-      showNotice('Invalid backup file: missing apps array');
-      return;
-    }
-    // Inspect-before-write: compare against the current catalog and let the
-    // user choose. Duplicates default to unchecked — nothing is imported
-    // (and no setting is changed) without an explicit selection.
-    getAllApps().then(function (existing) {
-      var existingKeys = {};
-      existing.forEach(function (a) { existingKeys[localAppKey(a)] = true; });
-      jsonImportState = {
-        backup: backup,
-        rows: backup.apps.map(function (a) {
-          return { app: a, isDup: !!existingKeys[localAppKey(a)] };
-        }),
-      };
-      renderJsonImportModal();
-    });
-  };
-  reader.readAsText(file);
-}
-
-function renderJsonImportModal() {
-  var rows = jsonImportState.rows;
-  var body = document.getElementById('json-import-body');
-  var html = '<p style="font-size:.8rem;color:var(--text-muted);margin:4px 0 8px">' + t('jsonImport.desc') + '</p>' +
-    '<div class="backup-toolbar-row"><div>' +
-      '<button class="backup-link-btn" onclick="window._launcher.jsonImportSelectAll(true)">' + t('backup.selectAll') + '</button> / ' +
-      '<button class="backup-link-btn" onclick="window._launcher.jsonImportSelectAll(false)">' + t('backup.selectNone') + '</button>' +
-    '</div></div>' +
-    '<table class="backup-table"><tbody>';
-  for (var i = 0; i < rows.length; i++) {
-    var a = rows[i].app;
-    html +=
-      '<tr>' +
-        '<td><input type="checkbox" class="json-import-cb" data-i="' + i + '"' + (rows[i].isDup ? '' : ' checked') + '/></td>' +
-        '<td>' + escapeHtml(a.name || a.publishedFilename || 'Untitled') +
-          (a.publishedFilename ? '<div class="mono-cell">' + escapeHtml(a.publishedFilename) + '</div>' : '') + '</td>' +
-        '<td>' + sourceLabel(a.source) + '</td>' +
-        '<td>' + (rows[i].isDup
-          ? '<span class="backup-status-badge backup-status-exists">' + t('jsonImport.statusDup') + '</span>'
-          : '<span class="backup-status-badge backup-status-new">' + t('backup.statusNew') + '</span>') + '</td>' +
-      '</tr>';
-  }
-  html += '</tbody></table>';
-  if (jsonImportState.backup.config && typeof jsonImportState.backup.config === 'object') {
-    html += '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;font-size:.85rem">' +
-      '<input type="checkbox" id="json-import-config"/> ' + t('jsonImport.config') + '</label>';
-  }
-  body.innerHTML = html;
-  document.getElementById('json-import-status').textContent = '';
-  document.getElementById('json-import-btn').style.display = '';
-  document.getElementById('json-import-overlay').hidden = false;
-}
-
-function jsonImportSelectAll(checked) {
-  document.querySelectorAll('.json-import-cb').forEach(function (b) { b.checked = checked; });
-}
-
-function submitJsonImport() {
-  var statusEl = document.getElementById('json-import-status');
-  var selected = [];
-  document.querySelectorAll('.json-import-cb').forEach(function (b) {
-    if (b.checked) selected.push(jsonImportState.rows[parseInt(b.getAttribute('data-i'), 10)].app);
-  });
-  var configCb = document.getElementById('json-import-config');
-  var importConfig = !!(configCb && configCb.checked);
-  if (selected.length === 0 && !importConfig) {
-    statusEl.style.color = '#ef4444';
-    statusEl.textContent = t('backup.nothingSelected');
-    return;
-  }
-  if (importConfig) {
-    var merged = Object.assign({}, loadConfig(), jsonImportState.backup.config);
-    saveConfig(merged);
-    applyTheme(merged.theme);
-  }
-  Promise.all(selected.map(function (a) {
-    var app = Object.assign({}, a);
-    app.id = generateId(); // new id — the source backup may collide with existing ids
-    return saveApp(app);
-  })).then(function () {
-    statusEl.style.color = '#34d399';
-    statusEl.textContent = '✔ ' + t('jsonImport.done') + ': ' + selected.length;
-    document.getElementById('json-import-btn').style.display = 'none';
-    renderApps();
-    loadPublishedApps();
-  });
-}
-
-// ── Remove duplicate apps (cleanup after legacy blind imports) ──
-
-function removeDuplicateApps() {
-  getAllApps().then(async function (apps) {
-    var groups = {};
-    apps.forEach(function (a) {
-      var k = localAppKey(a);
-      (groups[k] = groups[k] || []).push(a);
-    });
-    var toDelete = [];
-    Object.keys(groups).forEach(function (k) {
-      var g = groups[k];
-      if (g.length < 2) return;
-      // Keep the best copy: favorites first, then the earliest added
-      g.sort(function (x, y) {
-        if (!!y.favorite !== !!x.favorite) return (y.favorite ? 1 : 0) - (x.favorite ? 1 : 0);
-        return (x.addedAt || '') < (y.addedAt || '') ? -1 : 1;
-      });
-      toDelete = toDelete.concat(g.slice(1));
-    });
-    if (toDelete.length === 0) { showNotice(t('dedup.none')); return; }
-    if (!(await showConfirm(t('dedup.confirm') + ' ' + toDelete.length))) return;
-    Promise.all(toDelete.map(function (a) { return deleteApp(a.id); })).then(function () {
-      renderApps();
-      loadPublishedApps();
-      showNotice(t('dedup.done') + ': ' + toDelete.length);
-    });
-  });
-}
-
-// ── Clear All Data ──────────────────────────────
-
-async function clearAllData() {
-  if (!(await showConfirm(t('confirm.clearAll1')))) return;
-  if (!(await showConfirm(t('confirm.clearAll2')))) return;
-
-  openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      var tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).clear();
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-    });
-  }).then(function () {
-    localStorage.removeItem('appLauncherConfig');
-    applyTheme('dark');
-    renderApps();
-    document.getElementById('settings-overlay').hidden = true;
-    showNotice('All data cleared');
-  });
-}
+// Export / Import of a LOCAL JSON catalog was removed with the server-only cutover — there is no
+// browser-local catalog to back up. Server apps + extensions are exported via the ZIP backup
+// (💾 menu → /v1/apps/backup) in server-io.js, which is unaffected.
 
 export {
   applyTheme,
@@ -377,11 +190,5 @@ export {
   loadConfigFromServer,
   closeSettings,
   openHelp,
-  closeHelp,
-  exportBackup,
-  handleImportBackup,
-  jsonImportSelectAll,
-  submitJsonImport,
-  removeDuplicateApps,
-  clearAllData
+  closeHelp
 };