aimeat 2.0.0 → 2.1.0

package/dist/static/app-catalog/js/db.js

@@ -1,108 +1,38 @@
 /**
  * @file db.js
- * @description Local catalog data layer — IndexedDB, per-mode (Global shared vs Personal
- *   per-account). Encapsulates the DB handle + current mode as module-private state and exposes
- *   the app CRUD + mode get/set/close, so UI actions (switchDbMode) live in the feature layer.
- *   Carved from the former monolithic main.js.
- * @usage import { getAllApps, saveApp, deleteApp, getDbMode, setDbMode, closeDbInstance } from './db.js'
+ * @description Transient in-memory working-set for the catalog. The catalog is SERVER-ONLY —
+ *   there is no browser persistence (no IndexedDB). This module holds a page-session array of
+ *   app records that the detail view materializes on demand for editing (downloaded from the
+ *   server, edited in memory, then published back). The set is empty on every load and rebuilt
+ *   from the server; nothing here survives a reload. Keeps the getAllApps/saveApp/deleteApp
+ *   surface the rest of the catalog imports, so callers are unchanged.
+ * @usage import { getAllApps, saveApp, deleteApp } from './db.js'
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 2).
+ *   v2.0.0 — 2026-07-20 — Server-only catalog: drop IndexedDB + the Shared/Mine DB-mode entirely;
+ *     back the same CRUD surface with a transient in-memory working-set (no browser persistence).
  */
 
-const DB_NAME_GLOBAL = 'AppLauncherDB';
-const DB_VERSION = 2;
-const STORE_NAME = 'apps';
-
-let dbInstance = null;
-let currentDbMode = localStorage.getItem('appCatalogMode') || 'global';
-
-export function getDbMode() { return currentDbMode; }
-
-export function setDbMode(mode) {
-  currentDbMode = mode;
-  try { localStorage.setItem('appCatalogMode', mode); } catch (e) { /* private mode */ }
-}
-
-export function closeDbInstance() {
-  if (dbInstance) { try { dbInstance.close(); } catch (e) {} dbInstance = null; }
-}
-
-/** DB name is per-account in Personal mode (falls back to the shared Global DB otherwise). */
-export function getDbName() {
-  if (currentDbMode === 'personal') {
-    var owner = null;
-    try {
-      if (window.AIMEAT && window.AIMEAT.auth && window.AIMEAT.auth.getSession()) {
-        owner = window.AIMEAT.auth.getSession().owner || null;
-      }
-      if (!owner) {
-        var stored = localStorage.getItem('aimeat_session');
-        if (stored) owner = JSON.parse(stored).owner || null;
-      }
-    } catch (e) {}
-    if (owner) return DB_NAME_GLOBAL + '_' + owner;
-  }
-  return DB_NAME_GLOBAL;
-}
-
-export function openDB() {
-  var name = getDbName();
-  if (dbInstance && dbInstance.name === name) return Promise.resolve(dbInstance);
-  if (dbInstance) { dbInstance.close(); dbInstance = null; }
-  return new Promise(function (resolve, reject) {
-    const request = indexedDB.open(name, DB_VERSION);
-    request.onupgradeneeded = function (event) {
-      const db = event.target.result;
-      var store;
-      if (!db.objectStoreNames.contains(STORE_NAME)) {
-        store = db.createObjectStore(STORE_NAME, { keyPath: 'id' });
-        store.createIndex('tags', 'tags', { multiEntry: true });
-        store.createIndex('source', 'source', { unique: false });
-        store.createIndex('favorite', 'favorite', { unique: false });
-        store.createIndex('sortOrder', 'sortOrder', { unique: false });
-      } else {
-        store = event.target.transaction.objectStore(STORE_NAME);
-        if (!store.indexNames.contains('sortOrder')) {
-          store.createIndex('sortOrder', 'sortOrder', { unique: false });
-        }
-      }
-    };
-    request.onsuccess = function (event) { dbInstance = event.target.result; resolve(dbInstance); };
-    request.onerror = function (event) { reject(event.target.error); };
-  });
-}
+// Page-session working set. Holds only transient records the detail view materialized for editing;
+// empty on load, discarded on unload. NOT a store — the server is the sole source of truth.
+let workingSet = [];
 
+/** Resolve the current working set (a copy so callers can't mutate our array by reference). */
 export function getAllApps() {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readonly');
-      const request = tx.objectStore(STORE_NAME).getAll();
-      request.onsuccess = function () { resolve(request.result); };
-      request.onerror = function () { reject(request.error); };
-    });
-  });
+  return Promise.resolve(workingSet.slice());
 }
 
+/** Upsert a transient record by id (in memory only — persistence is publishing to the server). */
 export function saveApp(app) {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).put(app);
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-      tx.onabort = function () { reject(tx.error); };
-    });
-  });
+  if (app && app.id) {
+    var idx = workingSet.findIndex(function (a) { return a.id === app.id; });
+    if (idx >= 0) workingSet[idx] = app; else workingSet.push(app);
+  }
+  return Promise.resolve();
 }
 
+/** Drop a transient record by id (does NOT delete the server app — that is deleteServerApp). */
 export function deleteApp(id) {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).delete(id);
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-      tx.onabort = function () { reject(tx.error); };
-    });
-  });
+  workingSet = workingSet.filter(function (a) { return a.id !== id; });
+  return Promise.resolve();
 }

package/dist/static/app-catalog/js/detail.js

@@ -8,8 +8,12 @@
  *   injected once via initDetail(deps) — so there is no import cycle back through the entry module.
  * @usage import { initDetail, openDetailView, mountLoginPill, ... } from './detail.js'; initDetail({...})
  * @version-history
+ *   v1.4.0 — 2026-07-20 — Server-only cutover: drop the local-only favourite star; the detail view
+ *     always operates on a server app (materialized in memory on demand for editing).
  *   v1.3.0 — 2026-07-16 — Add openStagingPreview(owner, filename): mint a preview token for an
  *     EXISTING staging draft and open it top-level, driving a library card's "Open staging" button.
+ *   v1.3.0 — 2026-07-20 — Cost & Contracts section (EXCHANGE G3 / TARGET-045): own published apps get a
+ *     read-only per-app EXCHANGE entitlement surface (cost.js) after Monetize.
  *   v1.2.0 — 2026-07-14 — Monetize section (TARGET-034 phase B): own published apps get the
  *     apps.{appId}.tools tool editor (monetize.js) between Skills and Manage-on-server.
  *   v1.1.0 — 2026-07-11 — Own-published apps: "Edit Access Code" in serverMgmtInner + "Attach skill"
@@ -18,11 +22,13 @@
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 7).
  */
 import { escapeHtml, jsArg, sourceLabel, sourceLabelText, currentOwnerName } from './util.js';
-import { saveApp, deleteApp, getDbMode, setDbMode, closeDbInstance } from './db.js';
+import { saveApp, deleteApp } from './db.js';
 import { dtlBtn, showConfirm, showNotice } from './ui.js';
 import { loadConfig } from './config.js';
-import { t } from './i18n.js';
+import { t, getLang } from './i18n.js';
+import { getPromotion, setPromotion, loadPromoted } from './promote.js';
 import { monetizeSectionInner, monetizeOnOpen } from './monetize.js';
+import { costSectionInner, costOnOpen } from './cost.js';
 import { appManifestAgents } from './app-agents.js';
 
 // Injected once at bootstrap by main.js. Functions are main-local; the get* return main's LIVE
@@ -163,6 +169,8 @@ function openDetailView(appId) {
   // Monetize (TARGET-034): reset + async-load the apps.{appId}.tools manifest for OWN published
   // apps before the first render so the section shell picks up the loading state.
   monetizeOnOpen(detailServerOwner(app), app.publishedFilename || '', detailIsOwnPublished(app));
+  // Cost & contracts (EXCHANGE G3): async-load this app's EXCHANGE entitlements for OWN published apps.
+  costOnOpen(detailServerOwner(app), app.publishedFilename || '', detailIsOwnPublished(app));
   document.getElementById('detail-view').hidden = false;
   renderDetailView();
   // AI availability + published versions load asynchronously and re-render in place.
@@ -235,15 +243,8 @@ function loadScriptOnce(src) {
 }
 
 function onAuthChanged() {
-  // Personal mode is per-account: if the user signed OUT while in it, fall back to Global — it
-  // would otherwise silently show the shared Global DB.
-  if (getDbMode() === 'personal' && !currentOwnerName()) {
-    setDbMode('global');
-  }
-  // The per-account IndexedDB changes with the signed-in owner, so re-open it and re-render the
-  // LOCAL grid + tags too — not just the server sections (the stale-grid-after-login bug).
-  closeDbInstance();
-  updateModeToggle();
+  // Server-only catalog: the grid is rebuilt from the server on every auth change, so a sign-in /
+  // sign-out just re-fetches the owner's apps (their parked/listed apps appear or drop away).
   try { refreshAll(); } catch (e) { try { loadPublishedApps(); } catch (e2) {} }
   var sub = document.getElementById('publish-submit-btn');
   var st = document.getElementById('publish-status');
@@ -339,10 +340,9 @@ function renderDetailView() {
   var tags = (app.tags && app.tags.length) ? app.tags.join(', ') : '—';
   var cortex = (app.usesCortex && app.usesCortex.length) ? app.usesCortex.join(', ') : '—';
   var created = app.addedAt ? new Date(app.addedAt).toLocaleString() : '—';
-  var favBtn = app.blob
-    ? '<button class="dtl-fav-btn" title="' + escapeHtml(t(app.favorite ? 'detail.unfavorite' : 'detail.favorite')) + '"'
-        + ' onclick="window._launcher.detailToggleFavorite()">' + (app.favorite ? '⭐' : '☆') + '</button>'
-    : '';
+  // Favourites are a Phase-2 (server-backed) feature; the old local-only star was dropped with the
+  // server-only cutover so it isn't shown here anymore.
+  var favBtn = '';
   var aboutHeader =
     '<h3 style="display:flex;align-items:center;justify-content:space-between;gap:8px">' +
       '<span>' + t('detail.about') + '</span>' +
@@ -351,13 +351,26 @@ function renderDetailView() {
         ((canEditAbout && !detailEditingAbout) ? dtlBtn(t('detail.editDetails'), 'window._launcher.detailAboutEdit()') : '') +
       '</span>' +
     '</h3>';
+  // Per-locale descriptions: EN + FI (extensible). Seed from the manifest's descriptions map,
+  // falling back to the canonical description for the default language so an app that only ever had
+  // a single description pre-fills English.
+  var descs = app.descriptions || {};
+  var descEnVal = descs.en || (app.description || '');
+  var descFiVal = descs.fi || '';
   var aboutBody;
   if (detailEditingAbout) {
     aboutBody =
       '<label class="dtl-stat-label" for="detail-name-input">' + t('detail.nameLabel') + '</label>' +
       '<input id="detail-name-input" class="modal-input" maxlength="120" value="' + escapeHtml(app.name || '') + '" style="margin:4px 0 10px" />' +
-      '<label class="dtl-stat-label" for="detail-desc-input">' + t('detail.descLabel') + '</label>' +
-      '<textarea id="detail-desc-input" class="modal-input" rows="3" maxlength="2000" style="margin:4px 0 8px;resize:vertical">' + escapeHtml(app.description || '') + '</textarea>' +
+      '<label class="dtl-stat-label" for="detail-desc-en">' + t('detail.descEn') + '</label>' +
+      '<textarea id="detail-desc-en" class="modal-input" rows="3" maxlength="2000" style="margin:4px 0 6px;resize:vertical">' + escapeHtml(descEnVal) + '</textarea>' +
+      '<label class="dtl-stat-label" for="detail-desc-fi">' + t('detail.descFi') + '</label>' +
+      '<textarea id="detail-desc-fi" class="modal-input" rows="3" maxlength="2000" style="margin:4px 0 6px;resize:vertical">' + escapeHtml(descFiVal) + '</textarea>' +
+      '<div class="dtl-btn-row" style="margin:0 0 4px">' +
+        dtlBtn('🌐 ' + t('detail.translateEnFi'), 'window._launcher.detailTranslateDesc(\'en\',\'fi\')', {id:'detail-tr-enfi'}) +
+        dtlBtn('🌐 ' + t('detail.translateFiEn'), 'window._launcher.detailTranslateDesc(\'fi\',\'en\')', {id:'detail-tr-fien'}) +
+      '</div>' +
+      '<div class="dtl-ai-status" id="detail-tr-status" style="margin:0 0 8px"></div>' +
       '<label class="dtl-stat-label" for="detail-icon-input">' + t('detail.iconLabel') + '</label>' +
       '<input id="detail-icon-input" class="modal-input" maxlength="4" value="' + escapeHtml(app.icon || '') + '" style="margin:4px 0 10px;text-align:center;font-size:1.2rem" />' +
       '<label class="dtl-stat-label" for="detail-tags-input">' + t('detail.tagsLabel') + '</label>' +
@@ -368,8 +381,10 @@ function renderDetailView() {
         dtlBtn(t('detail.cancelEdit'), 'window._launcher.detailAboutCancel()') +
       '</div>';
   } else {
+    // Show the description in the current UI language, falling back to the canonical one.
+    var shownDesc = (app.descriptions && app.descriptions[getLang()]) || app.description || '';
     aboutBody =
-      (app.description ? '<p class="dtl-desc">' + escapeHtml(app.description) + '</p>' : '') +
+      (shownDesc ? '<p class="dtl-desc">' + escapeHtml(shownDesc) + '</p>' : '') +
       '<div class="dtl-meta-grid">' +
         metaItem(t('detail.category'), app.category || 'utility') +
         metaItem(t('detail.tags'), tags) +
@@ -479,6 +494,17 @@ function renderDetailView() {
     ? '<div class="dtl-section" id="detail-monetize">' + monetizeSectionInner() + '</div>'
     : '';
 
+  // ── COST & CONTRACTS (EXCHANGE G3 / TARGET-045) — what this app SOURCES (own published apps only) ──
+  // Stable container: cost.js re-renders #detail-cost in place after the async load.
+  var costHtml = (app.published && detailIsOwnPublished(app))
+    ? '<div class="dtl-section" id="detail-cost">' + costSectionInner() + '</div>'
+    : '';
+
+  // ── PROMOTE (Phase 2c) — showcase this app on your public profile with EN/FI pitch copy.
+  //    Own published apps only; persists to the PUBLIC app-catalog.promoted memory doc.
+  var promoteHtml = (app.published && detailIsOwnPublished(app))
+    ? buildPromoteSection(app) : '';
+
   // ── BUNDLED AGENTS (Agent-Bundled Apps) — crew-defs this app ships. The section lists the
   // agent names and opens the shared Bundled-agents modal (inspector + hosted instances with
   // prices + deploy-your-own). Manifest read from the server-manifest cache.
@@ -502,7 +528,56 @@ function renderDetailView() {
   }
 
   document.getElementById('detail-body').innerHTML =
-    statusHtml + aboutHtml + aiHtml + versionsHtml + skillsHtml + agentsHtml + monetizeHtml + mgmtHtml + actionsHtml;
+    statusHtml + aboutHtml + aiHtml + versionsHtml + skillsHtml + agentsHtml + monetizeHtml + costHtml + promoteHtml + mgmtHtml + actionsHtml;
+}
+
+// The Promote section: a short EN/FI pitch that surfaces this app on the owner's public profile.
+// Saving writes the PUBLIC app-catalog.promoted doc; clearing both fields un-promotes the app.
+function promoteRef(app) { return detailServerOwner(app) + '/' + (app.publishedFilename || ''); }
+function buildPromoteSection(app) {
+  var ref = promoteRef(app);
+  var cur = getPromotion(ref) || {};
+  var on = !!(cur.en || cur.fi);
+  return '<div class="dtl-section" id="detail-promote">' +
+      '<h3 style="display:flex;align-items:center;gap:8px">📣 ' + t('promote.title') +
+        (on ? ' <span class="dtl-badge-on">' + t('promote.on') + '</span>' : '') + '</h3>' +
+      '<p class="dtl-desc">' + t('promote.hint') + '</p>' +
+      '<label class="dtl-stat-label" for="detail-promo-en">' + t('promote.en') + '</label>' +
+      '<textarea id="detail-promo-en" class="modal-input" rows="2" maxlength="500" style="margin:4px 0 6px;resize:vertical">' + escapeHtml(cur.en || '') + '</textarea>' +
+      '<label class="dtl-stat-label" for="detail-promo-fi">' + t('promote.fi') + '</label>' +
+      '<textarea id="detail-promo-fi" class="modal-input" rows="2" maxlength="500" style="margin:4px 0 6px;resize:vertical">' + escapeHtml(cur.fi || '') + '</textarea>' +
+      '<div class="dtl-btn-row" style="margin:0 0 4px">' +
+        dtlBtn('🌐 ' + t('detail.translateEnFi'), 'window._launcher.detailTranslateDesc(\'en\',\'fi\',\'detail-promo-\',\'detail-promo-tr-status\')') +
+        dtlBtn('🌐 ' + t('detail.translateFiEn'), 'window._launcher.detailTranslateDesc(\'fi\',\'en\',\'detail-promo-\',\'detail-promo-tr-status\')') +
+      '</div>' +
+      '<div class="dtl-ai-status" id="detail-promo-tr-status" style="margin:0 0 8px"></div>' +
+      '<div class="dtl-btn-row">' +
+        dtlBtn(t('promote.save'), 'window._launcher.detailPromoteSave()', {variant:'primary'}) +
+        (on ? dtlBtn(t('promote.remove'), 'window._launcher.detailPromoteClear()') : '') +
+      '</div>' +
+      '<div class="dtl-ai-status" id="detail-promo-status"></div>' +
+    '</div>';
+}
+
+function detailPromoteSave() {
+  var app = detailGetApp();
+  if (!app || !detailIsOwnPublished(app)) return;
+  var en = (document.getElementById('detail-promo-en') || {}).value || '';
+  var fi = (document.getElementById('detail-promo-fi') || {}).value || '';
+  var statusEl = document.getElementById('detail-promo-status');
+  if (statusEl) { statusEl.style.color = 'var(--text-muted)'; statusEl.textContent = t('promote.saving'); }
+  setPromotion(promoteRef(app), { en: en, fi: fi }).then(function (nowOn) {
+    renderApps();
+    renderDetailView();
+    var s2 = document.getElementById('detail-promo-status');
+    if (s2) { s2.style.color = '#34d399'; s2.textContent = nowOn ? '✔ ' + t('promote.saved') : '✔ ' + t('promote.removed'); }
+  });
+}
+
+function detailPromoteClear() {
+  var en = document.getElementById('detail-promo-en'); if (en) en.value = '';
+  var fi = document.getElementById('detail-promo-fi'); if (fi) fi.value = '';
+  detailPromoteSave();
 }
 
 // Bound skills (skills registry): skills whose frontmatter metadata.binding names this app.
@@ -808,22 +883,31 @@ function detailAboutSave() {
   var app = detailGetApp();
   if (!app) return;
   var nameEl = document.getElementById('detail-name-input');
-  var descEl = document.getElementById('detail-desc-input');
+  var enEl = document.getElementById('detail-desc-en');
+  var fiEl = document.getElementById('detail-desc-fi');
   var iconEl = document.getElementById('detail-icon-input');
   var tagsEl = document.getElementById('detail-tags-input');
   var newName = nameEl ? nameEl.value.trim() : '';
-  var newDesc = descEl ? descEl.value.trim() : '';
+  var enDesc = enEl ? enEl.value.trim() : '';
+  var fiDesc = fiEl ? fiEl.value.trim() : '';
+  // Per-locale map (drop blanks); the canonical description is the English one, or Finnish when
+  // English is blank, so an app always has a non-empty fallback description.
+  var newDescriptions = {};
+  if (enDesc) newDescriptions.en = enDesc;
+  if (fiDesc) newDescriptions.fi = fiDesc;
+  var newDesc = enDesc || fiDesc || '';
   // icon + tags are LOCAL metadata (same as the context-menu Edit modal) — no server round-trip.
   var newIcon = iconEl ? iconEl.value.trim() : (app.icon || '');
   var newTags = tagsEl
     ? tagsEl.value.split(',').map(function (s) { return s.trim(); }).filter(Boolean)
     : (app.tags || []);
   if (!newName) { showNotice(t('detail.nameRequired') || 'Name cannot be empty.'); if (nameEl) nameEl.focus(); return; }
-  if (app.published && !newDesc) { showNotice(t('detail.descRequired') || 'Description cannot be empty.'); if (descEl) descEl.focus(); return; }
+  if (app.published && !newDesc) { showNotice(t('detail.descRequired') || 'Description cannot be empty.'); if (enEl) enEl.focus(); return; }
 
   function finishLocal() {
     app.name = newName;
     app.description = newDesc;
+    app.descriptions = newDescriptions;
     app.icon = newIcon;
     app.tags = newTags;
     saveApp(app).then(function() {
@@ -846,16 +930,17 @@ function detailAboutSave() {
   fetch(aimeatUrl + '/v1/apps/' + encodeURIComponent(filename), {
     method: 'PATCH',
     headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ name: newName, description: newDesc })
+    body: JSON.stringify({ name: newName, description: newDesc, descriptions: newDescriptions })
   })
     .then(function(resp) { return resp.json().then(function(j) { return { ok: resp.ok, j: j }; }); })
     .then(function(res) {
       if (res.ok && res.j && res.j.ok !== false) {
-        // Keep the cached server manifest in sync so a re-render shows the new name.
+        // Keep the cached server manifest in sync so a re-render shows the new name + descriptions.
         var key = owner + '\n' + filename;
         getServerManifests()[key] = getServerManifests()[key] || {};
         getServerManifests()[key].name = newName;
         getServerManifests()[key].description = newDesc;
+        getServerManifests()[key].descriptions = newDescriptions;
         finishLocal();
       } else {
         showNotice('Failed: ' + ((res.j && res.j.error && res.j.error.message) || 'Unknown error'));
@@ -864,6 +949,50 @@ function detailAboutSave() {
     .catch(function(err) { showNotice('Error: ' + (err.message || err)); });
 }
 
+// Translate one language field to another via the owner's OpenRouter key (/v1/ai/complete).
+// srcLang/dstLang are 'en'|'fi'; fills the destination textarea in place. `prefix` picks the field
+// pair ('detail-desc-' for the description editor, 'detail-promo-' for the promotion editor);
+// `statusId` picks the status line. Reused by both the description and promotion editors.
+function detailTranslateDesc(srcLang, dstLang, prefix, statusId) {
+  prefix = prefix || 'detail-desc-';
+  var srcEl = document.getElementById(prefix + srcLang);
+  var dstEl = document.getElementById(prefix + dstLang);
+  var statusEl = document.getElementById(statusId || 'detail-tr-status');
+  if (!srcEl || !dstEl) return;
+  var text = (srcEl.value || '').trim();
+  if (!text) { if (statusEl) statusEl.textContent = t('detail.trNeedSource'); return; }
+  var token = getCortexOwnerToken();
+  if (!token) { if (statusEl) statusEl.textContent = t('detail.aiLoginNeeded'); return; }
+  var config = loadConfig();
+  var aimeatUrl = (config.aimeatUrl || '').replace(/\/+$/, '');
+  if (!aimeatUrl) { if (statusEl) statusEl.textContent = t('detail.aiUnavailable'); return; }
+  var langName = { en: 'English', fi: 'Finnish' };
+  if (statusEl) { statusEl.style.color = 'var(--text-muted)'; statusEl.textContent = t('detail.translating'); }
+  var systemPrompt = 'You are a professional translator for short app-store copy. '
+    + 'Translate the text from ' + (langName[srcLang] || srcLang) + ' to ' + (langName[dstLang] || dstLang) + '. '
+    + 'Return ONLY the translated text — no quotes, no notes, no explanation. Keep it concise and natural.';
+  fetch(aimeatUrl + '/v1/ai/complete', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
+    body: JSON.stringify({ prompt: text, systemPrompt: systemPrompt, app_id: 'app-catalog' })
+  })
+    .then(function(resp) { return resp.json(); })
+    .then(function(json) {
+      if (!json || !json.ok) {
+        var msg = (json && json.error && json.error.message) || 'Translation failed';
+        if (statusEl) { statusEl.style.color = 'var(--accent)'; statusEl.textContent = '✘ ' + msg; }
+        return;
+      }
+      var out = (json.data && json.data.content ? json.data.content : '').trim();
+      if (!out) { if (statusEl) { statusEl.style.color = 'var(--accent)'; statusEl.textContent = '✘ ' + t('detail.trEmpty'); } return; }
+      dstEl.value = out;
+      if (statusEl) { statusEl.style.color = '#34d399'; statusEl.textContent = '✔ ' + t('detail.trDone'); }
+    })
+    .catch(function(err) {
+      if (statusEl) { statusEl.style.color = 'var(--accent)'; statusEl.textContent = '✘ ' + (err.message || 'Translation failed'); }
+    });
+}
+
 // Manual override: upload a custom image as this published app's thumbnail. (Bulk auto-capture is
 // the server-side `aimeat screenshot-worker`; the browser can't grab the cross-origin sandboxed app
 // itself, so this is a file picker, not an in-page capture.)
@@ -1326,6 +1455,7 @@ function openPublishedDetail(owner, filename, localId, versionNumber) {
         id: generateId(),
         name: meta.name || filename.replace(/\.html?$/i, ''),
         description: meta.description || '',
+        descriptions: meta.descriptions || null,
         category: meta.category || 'utility',
         tags: meta.tags || [],
         usesCortex: meta.usesCortex || [],
@@ -1560,6 +1690,7 @@ async function restoreVersion(owner, filename, version) {
         mime_type: 'text/html',
         name: meta.name || filename.replace(/\.html?$/i, ''),
         description: meta.description || '',
+        descriptions: meta.descriptions || null,
         category: meta.category || 'utility',
         tags: meta.tags || [],
         uses_cortex: meta.usesCortex || []
@@ -1647,6 +1778,9 @@ export {
   detailAboutEdit,
   detailAboutCancel,
   detailAboutSave,
+  detailTranslateDesc,
+  detailPromoteSave,
+  detailPromoteClear,
   detailToggleFavorite,
   detailAccessCodeEdit,
   detailAccessCodeCancel,

package/dist/static/app-catalog/js/favorites.js

@@ -0,0 +1,71 @@
+/**
+ * @file favorites.js
+ * @description Server-backed favourites for the catalog. A per-owner PRIVATE memory doc
+ *   (`app-catalog.favorites` = { version, updatedAt, refs: ["owner/filename", …] }) read/written
+ *   via /v1/memory with the owner token, so favourites follow the account across devices. Any app
+ *   (own or community) can be favourited; the Library pins a "⭐ Favourites" group on top. Holds the
+ *   in-memory Set + the star-button HTML helper; the grid/group rendering lives in render/server-io.
+ * @usage import { loadFavorites, toggleFavorite, isFavorite, getFavoriteRefs, favStarHtml } from './favorites.js'
+ * @version-history
+ *   v1.0.0 — 2026-07-20 — initial (Phase 2b server-backed favourites).
+ */
+import { loadConfig } from './config.js';
+import { getCortexOwnerToken } from './cortex.js';
+import { t } from './i18n.js';
+
+const KEY = 'app-catalog.favorites';
+let favSet = new Set();
+
+function base() { return (loadConfig().aimeatUrl || '').replace(/\/+$/, ''); }
+
+export function isFavorite(ref) { return favSet.has(ref); }
+export function getFavoriteRefs() { return Array.from(favSet); }
+export function hasFavorites() { return favSet.size > 0; }
+
+// Load the owner's favourites doc. Requires a signed-in owner (favourites are per-account); logged
+// out → empty set. Never throws — a missing doc (404) just means no favourites yet.
+export function loadFavorites() {
+  var token = getCortexOwnerToken();
+  var b = base();
+  if (!token || !b) { favSet = new Set(); return Promise.resolve(); }
+  return fetch(b + '/v1/memory/' + encodeURIComponent(KEY), { headers: { 'Authorization': 'Bearer ' + token } })
+    .then(function (r) { return r.ok ? r.json() : null; })
+    .then(function (j) {
+      var refs = (j && j.data && j.data.value && Array.isArray(j.data.value.refs)) ? j.data.value.refs : [];
+      favSet = new Set(refs.filter(function (x) { return typeof x === 'string'; }));
+    })
+    .catch(function () { /* leave the set as-is on a transient error */ });
+}
+
+function persist() {
+  var token = getCortexOwnerToken();
+  var b = base();
+  if (!token || !b) return Promise.resolve();
+  return fetch(b + '/v1/memory', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
+    body: JSON.stringify({
+      key: KEY,
+      value: { version: 1, updatedAt: new Date().toISOString(), refs: Array.from(favSet) },
+      visibility: 'private',
+    }),
+  }).catch(function () { /* best-effort persist */ });
+}
+
+// Toggle a favourite (ref = "owner/filename"). Updates the set optimistically, persists, and
+// resolves so the caller can re-render. Returns the new state (true = now a favourite).
+export function toggleFavorite(ref) {
+  var now;
+  if (favSet.has(ref)) { favSet.delete(ref); now = false; } else { favSet.add(ref); now = true; }
+  return persist().then(function () { return now; });
+}
+
+// The ⭐/☆ toggle button for a card. `ref` is "owner/filename". Stops propagation so a click on the
+// star never opens the card's detail view.
+export function favStarHtml(ref) {
+  var on = favSet.has(ref);
+  var title = on ? (t('fav.remove') || 'Remove from favourites') : (t('fav.add') || 'Add to favourites');
+  return '<button class="fav-toggle' + (on ? ' on' : '') + '"'
+    + ' onclick="event.stopPropagation(); window._launcher.toggleFavorite(\'' + String(ref).replace(/'/g, "\\'") + '\')"'
+    + ' title="' + title + '">' + (on ? '⭐' : '☆') + '</button>';
+}