aimeat 2.0.0 → 2.2.0

package/dist/static/app-catalog/js/apps-io.js

@@ -1,13 +1,16 @@
 /**
  * @file apps-io.js
- * @description Getting apps INTO the catalog: creation from a ZIP bundle / a URL / an uploaded HTML
- *   file / pasted source, and the "Add app" modal that drives it (open/close/tabs/file-drop/save,
- *   sign-in-gate). editingAppId (which app the modal is editing) lives here; main sets it via the
- *   exported setEditingAppId(). Shared modules by import; main-local fns + the live app-list getter
- *   injected via initAppsIo(deps). Carved from main.js.
- * @usage import { initAppsIo, showModal, addAppFromUrl, setEditingAppId } from './apps-io.js'; initAppsIo({...})
+ * @description Getting apps INTO the catalog. Server-only: creation from an uploaded HTML file, a
+ *   pasted source, or a ZIP bundle builds a TRANSIENT record and hands it straight to the publish
+ *   flow — it is published to the owner's account (UNLISTED) on the server. There is no browser-local
+ *   catalog anymore, so there is no "add a URL bookmark" and nothing is persisted in the browser.
+ *   Owns the Add-app modal (open/close/tabs/file-drop/save, sign-in gate) + editingAppId. Shared
+ *   modules by import; main-local fns injected via initAppsIo(deps). Carved from main.js.
+ * @usage import { initAppsIo, showModal, setEditingAppId } from './apps-io.js'; initAppsIo({...})
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 10).
+ *   v2.0.0 — 2026-07-20 — Server-only cutover: drop the local writers (URL/file/paste/zip → IndexedDB);
+ *     creation now builds a transient record and publishes it to the server as an unlisted app.
  */
 import { saveApp } from './db.js';
 import { showNotice } from './ui.js';
@@ -15,106 +18,36 @@ import { t } from './i18n.js';
 import { extractZip, bundleZip } from './zip.js';
 import { getCortexOwnerToken } from './cortex.js';   // sign-in gate in requireSignInThen (runtime-only call, no import cycle)
 
-// Injected once at bootstrap by main.js (main-local fns + the live allApps getter).
-let generateId, readFileAsText, renderApps, getMainApps;
+// Injected once at bootstrap by main.js (main-local fns + the live working-set getter + the publish
+// modal opener from server-io, injected to avoid an apps-io ↔ server-io import cycle).
+let generateId, readFileAsText, renderApps, getMainApps, showPublishModal;
 export function initAppsIo(deps) {
-  ({ generateId, readFileAsText, renderApps, getMainApps } = deps);
+  ({ generateId, readFileAsText, renderApps, getMainApps, showPublishModal } = deps);
 }
 
-// ── App Creation from ZIP ─────────────────────────
-
-async function addAppFromZip(name, arrayBuffer, icon, tags, openMode) {
-  var files = await extractZip(arrayBuffer);
-  var bundledHtml = await bundleZip(files);
-  var encoded = btoa(unescape(encodeURIComponent(bundledHtml)));
-  var app = {
-    id: generateId(),
-    name: name,
-    description: '',
-    source: 'zip',
-    url: null,
-    blob: encoded,
-    tags: tags,
-    openMode: openMode,
-    icon: icon || '\u{1F4E6}',
-    screenshot: null,
-    favorite: false,
-    addedAt: new Date().toISOString(),
-    lastOpenedAt: null
-  };
-  await saveApp(app);
-  return app;
-}
-
-// ── App Creation from URL ───────────────────────
-
-function addAppFromUrl(name, url, icon, tags, openMode) {
-  var app = {
-    id: generateId(),
-    name: name,
-    description: '',
-    source: 'url',
-    url: url,
-    blob: null,
-    tags: tags,
-    openMode: openMode,
-    icon: icon || '\u{1F4DD}',
-    screenshot: null,
-    favorite: false,
-    addedAt: new Date().toISOString(),
-    lastOpenedAt: null
-  };
-  return saveApp(app).then(function () {
-    return app;
-  });
-}
-
-// ── App Creation from File ──────────────────────
-
-function addAppFromFile(name, file, icon, tags, openMode) {
-  return readFileAsText(file).then(function (content) {
-    var encoded = btoa(unescape(encodeURIComponent(content)));
-    var app = {
-      id: generateId(),
-      name: name,
-      description: '',
-      source: 'local',
-      url: null,
-      blob: encoded,
-      tags: tags,
-      openMode: openMode,
-      icon: icon || '\u{1F4DD}',
-      screenshot: null,
-      favorite: false,
-      addedAt: new Date().toISOString(),
-      lastOpenedAt: null
-    };
-    return saveApp(app).then(function () {
-      return app;
-    });
-  });
-}
-
-// ── App Creation from Pasted Source ─────────────
-
-function addAppFromSource(name, sourceCode, icon, tags, openMode) {
-  var encoded = btoa(unescape(encodeURIComponent(sourceCode)));
+// ── Create → publish straight to the server (unlisted) ─────────────────────────
+// Build a transient in-memory record from raw HTML and open the publish modal for it. The publish
+// modal collects filename/description/access-code and POSTs to /v1/apps; the create flow parks the
+// result so the new app lands UNLISTED (on the server, not yet public). Nothing is stored locally.
+function createAppFromHtml(name, html, icon, tags, description) {
+  var encoded = btoa(unescape(encodeURIComponent(html)));
   var app = {
     id: generateId(),
     name: name,
-    description: parseAppMeta(sourceCode).description || '',
-    source: 'local',
+    description: description || '',
+    source: 'create',
     url: null,
     blob: encoded,
-    tags: tags,
-    openMode: openMode,
+    tags: tags || [],
     icon: icon || '\u{1F4DD}',
-    screenshot: null,
-    favorite: false,
-    addedAt: new Date().toISOString(),
-    lastOpenedAt: null
+    published: false,
+    addedAt: new Date().toISOString()
   };
   return saveApp(app).then(function () {
+    // showPublishModal resolves the app from the main working-set (getMainApps), so make the
+    // transient record visible there too before opening it (same pattern as openPublishedDetail).
+    try { getMainApps().push(app); } catch (e) { /* getter optional */ }
+    if (typeof showPublishModal === 'function') showPublishModal(app.id, { unlisted: true });
     return app;
   });
 }
@@ -127,8 +60,8 @@ var editingAppId = null;
 function showModal() {
   document.getElementById('modal-overlay').hidden = false;
   document.getElementById('modal-title').textContent = t('addModal.title');
-  // Default to URL tab
-  switchTab('url');
+  // Server-only: there is no URL-bookmark tab — default to pasting source.
+  switchTab('paste');
 }
 
 // Step 0 for not-yet-signed-in users: adding/publishing an app needs an account, so
@@ -173,7 +106,6 @@ function parseAppMeta(html) {
 function closeModal() {
   document.getElementById('modal-overlay').hidden = true;
   // Reset form
-  document.getElementById('app-url').value = '';
   document.getElementById('app-name').value = '';
   document.getElementById('app-icon').value = '';
   document.getElementById('app-tags').value = '';
@@ -233,30 +165,19 @@ function handleSave() {
   var name = document.getElementById('app-name').value.trim();
   var icon = document.getElementById('app-icon').value.trim();
   var tagsRaw = document.getElementById('app-tags').value.trim();
-  // Apps open TOP-LEVEL on a real origin (published) or in the sandbox (local); there is no
-  // user-facing open-mode choice anymore, so new/edited apps default to 'tab'.
-  var openMode = 'tab';
-
   var tags = tagsRaw ? tagsRaw.split(',').map(function (t) { return t.trim(); }).filter(Boolean) : [];
 
-  // ── Edit mode: update existing app ──
+  // ── Edit mode: update a transient record's display metadata in place ──
   if (editingAppId) {
     var app = null;
     for (var i = 0; i < getMainApps().length; i++) {
       if (getMainApps()[i].id === editingAppId) { app = getMainApps()[i]; break; }
     }
-    if (!app) {
-      closeModal();
-      return;
-    }
-    if (!name) {
-      showNotice('Please enter a name');
-      return;
-    }
+    if (!app) { closeModal(); return; }
+    if (!name) { showNotice('Please enter a name'); return; }
     app.name = name;
     app.icon = icon || app.icon;
     app.tags = tags;
-    app.openMode = openMode;
     saveApp(app).then(function () {
       closeModal();
       renderApps();
@@ -264,69 +185,38 @@ function handleSave() {
     return;
   }
 
-  // ── Create mode ──
+  // ── Create mode → publish to the server (unlisted) ──
   var activeTab = document.querySelector('.modal-tab.active');
-  var tabName = activeTab ? activeTab.getAttribute('data-tab') : 'url';
+  var tabName = activeTab ? activeTab.getAttribute('data-tab') : 'paste';
 
-  if (tabName === 'url') {
-    var url = document.getElementById('app-url').value.trim();
-    if (!url) {
-      showNotice('Please enter a URL');
-      return;
-    }
-    if (!name) {
-      // Derive name from URL
-      try {
-        name = new URL(url).hostname;
-      } catch (e) {
-        name = url;
-      }
-    }
-    addAppFromUrl(name, url, icon, tags, openMode).then(function () {
-      closeModal();
-      renderApps();
-    });
-  } else if (tabName === 'paste') {
+  if (tabName === 'paste') {
     var pastedCode = document.getElementById('app-paste-code').value.trim();
     if (!pastedCode) {
       showNotice('Please paste your HTML source code');
       return;
     }
-    if (!name) {
-      // Try to extract title from HTML
-      var titleMatch = pastedCode.match(/<title[^>]*>([^<]+)<\/title>/i);
-      name = titleMatch ? titleMatch[1].trim() : 'Pasted App';
-    }
-    addAppFromSource(name, pastedCode, icon, tags, openMode).then(function () {
-      closeModal();
-      renderApps();
-    });
+    var meta = parseAppMeta(pastedCode);
+    if (!name) name = meta.name || 'Pasted App';
+    closeModal();
+    createAppFromHtml(name, pastedCode, icon, tags, meta.description);
   } else if (tabName === 'file') {
     if (!selectedFile) {
       showNotice('Please select a file');
       return;
     }
-    if (selectedFile.name.toLowerCase().endsWith('.zip')) {
-      // ZIP file — extract and bundle
-      if (!name) {
-        name = selectedFile.name.replace(/\.zip$/i, '');
-      }
-      selectedFile.arrayBuffer().then(function (arrayBuffer) {
-        return addAppFromZip(name, arrayBuffer, icon, tags, openMode);
-      }).then(function () {
-        closeModal();
-        renderApps();
-      }).catch(function (err) {
-        showNotice('ZIP import failed: ' + (err.message || err));
-      });
+    var file = selectedFile;
+    if (file.name.toLowerCase().endsWith('.zip')) {
+      if (!name) name = file.name.replace(/\.zip$/i, '');
+      file.arrayBuffer()
+        .then(function (arrayBuffer) { return extractZip(arrayBuffer); })
+        .then(function (files) { return bundleZip(files); })
+        .then(function (html) { closeModal(); return createAppFromHtml(name, html, icon, tags, parseAppMeta(html).description); })
+        .catch(function (err) { showNotice('ZIP import failed: ' + (err.message || err)); });
     } else {
-      // HTML file
-      if (!name) {
-        name = selectedFile.name.replace(/\.html?$/i, '');
-      }
-      addAppFromFile(name, selectedFile, icon, tags, openMode).then(function () {
+      if (!name) name = file.name.replace(/\.html?$/i, '');
+      readFileAsText(file).then(function (html) {
         closeModal();
-        renderApps();
+        createAppFromHtml(name, html, icon, tags, parseAppMeta(html).description);
       });
     }
   }
@@ -336,10 +226,6 @@ function handleSave() {
 export function setEditingAppId(v) { editingAppId = v; }
 
 export {
-  addAppFromZip,
-  addAppFromUrl,
-  addAppFromFile,
-  addAppFromSource,
   showModal,
   requireSignInThen,
   parseAppMeta,

package/dist/static/app-catalog/js/cortex.js

@@ -492,7 +492,9 @@ function loadPbPacks() {
         if (p.modelTier) {
           var badge = document.createElement('span');
           badge.className = 'pb-pack-tier pb-tier-' + p.modelTier;
-          badge.textContent = p.modelTier;
+          // The label is the INSTRUCTION, not the raw key: `needs-doc` reads as
+          // "documentation missing" when it means "no priors — the AI must read the doc".
+          badge.textContent = t('pb.tier.' + p.modelTier) || p.modelTier;
           var proven = (p.proofs || []).map(function (pr) { return pr.model + '→' + pr.verdict; }).join(', ');
           badge.title = 'AEB reliability tier: ' + p.modelTier
             + (proven ? ' · proven on ' + proven : ' · not yet AEB-run')

package/dist/static/app-catalog/js/cost.js

@@ -0,0 +1,100 @@
+/**
+ * @file cost.js
+ * @description The Cost & Contracts section of the App Detail view (EXCHANGE G3 / TARGET-045): a
+ *   read-only per-app surface of the EXCHANGE contracts (metered entitlements) an app sources, with
+ *   live spend against each budget and the platform rake. Data comes from GET /v1/apps/cost?app_id=,
+ *   which returns only entitlements whose consumer is the signed-in owner (strictly cross-owner).
+ *   Rendering mirrors monetize.js: detail.js renders the shell for OWN published apps and calls
+ *   costOnOpen; this module async-loads and re-renders #detail-cost in place.
+ * @structure costOnOpen · costSectionInner
+ * @usage import { costSectionInner, costOnOpen } from './cost.js'
+ * @version-history
+ *   v1.0.0 — 2026-07-20 — Initial per-app cost & contracts surface (EXCHANGE G3).
+ */
+import { escapeHtml } from './util.js';
+import { loadConfig } from './config.js';
+import { t } from './i18n.js';
+import { getCortexOwnerToken } from './cortex.js';
+
+var cState = 'off';   // 'off' | 'loading' | 'ready' | 'error'
+var cData = null;     // the /v1/apps/cost data payload, or null
+var cAppId = '';      // full app id "owner/filename"
+
+function apiBase() {
+  var cfg = loadConfig();
+  return (cfg.aimeatUrl || '').replace(/\/+$/, '');
+}
+
+function rerender() {
+  var el = document.getElementById('detail-cost');
+  if (el) el.innerHTML = costSectionInner();
+}
+
+/** Reset + async-load the cost surface when a detail view opens. No-op for non-own / unpublished apps. */
+export function costOnOpen(owner, appId, isOwn) {
+  cData = null;
+  if (!isOwn || !owner || !appId) { cState = 'off'; cAppId = ''; return; }
+  cAppId = owner + '/' + appId;
+  cState = 'loading';
+  var token = getCortexOwnerToken();
+  if (!token) { cState = 'error'; cData = { _needLogin: true }; return; }
+  fetch(apiBase() + '/v1/apps/cost?app_id=' + encodeURIComponent(cAppId), {
+    headers: { 'Authorization': 'Bearer ' + token },
+  })
+    .then(function (r) { return r.json(); })
+    .then(function (res) {
+      if (!res || !res.ok || !res.data) throw new Error('bad response');
+      cData = res.data;
+      cState = 'ready';
+      rerender();
+    })
+    .catch(function () { cState = 'error'; cData = null; rerender(); });
+}
+
+function stateBadge(state) {
+  // Reuse the sync-chip colours: ok (active), diff (paused), none (revoked/exhausted).
+  var cls = state === 'active' ? 'ok' : (state === 'paused' ? 'diff' : 'none');
+  return '<span class="dtl-sync ' + cls + '" style="margin:0">' + escapeHtml(state) + '</span>';
+}
+
+function contractRow(c) {
+  var b = c.budget || {};
+  var cap = (b.cap_units === null || b.cap_units === undefined) ? t('cost.uncapped') : (b.spent_units + ' / ' + b.cap_units);
+  var remaining = (b.remaining_units === null || b.remaining_units === undefined) ? ''
+    : ' <span class="dtl-stat-label">(' + t('cost.remaining').replace('{n}', b.remaining_units) + ')</span>';
+  var providerShort = String(c.provider || '').split('@')[0];
+  return '<div class="dtl-status-row" style="align-items:center;gap:10px;flex-wrap:wrap">' +
+      '<div class="dtl-stat" style="flex:1;min-width:150px">' +
+        '<span class="dtl-stat-val">' + escapeHtml(c.capability || '') + '</span>' +
+        '<span class="dtl-stat-label">' + escapeHtml(t('cost.providerCol')) + ': ' + escapeHtml(providerShort) + '</span>' +
+      '</div>' +
+      '<div class="dtl-stat"><span class="dtl-stat-label">' + t('cost.priceCol') + '</span><span class="dtl-stat-val">' + escapeHtml(String(c.price_per_call)) + ' morsels</span></div>' +
+      '<div class="dtl-stat"><span class="dtl-stat-label">' + t('cost.rakeCol') + '</span><span class="dtl-stat-val">' + escapeHtml(String(c.rake_per_call)) + ' morsels (' + escapeHtml(String(c.rake_percent)) + '%)</span></div>' +
+      '<div class="dtl-stat"><span class="dtl-stat-label">' + t('cost.budgetCol') + '</span><span class="dtl-stat-val">' + escapeHtml(cap) + remaining + '</span></div>' +
+      '<div class="dtl-stat">' + stateBadge(c.state) + '</div>' +
+    '</div>';
+}
+
+/** Inner HTML of the section — detail.js wraps it in <div class="dtl-section" id="detail-cost">. */
+export function costSectionInner() {
+  if (cState === 'off') return '';
+  var html = '<h3>' + t('cost.title') + '</h3>' +
+    '<p class="dtl-desc">' + t('cost.hint') + '</p>';
+  if (cState === 'loading') {
+    return html + '<span style="color:var(--text-muted);font-size:.85rem">…</span>';
+  }
+  if (cState === 'error') {
+    var msg = (cData && cData._needLogin) ? t('cost.needLogin') : t('cost.loadFailed');
+    return html + '<span class="dtl-sync none">' + escapeHtml(msg) + '</span>';
+  }
+  var contracts = (cData && cData.contracts) || [];
+  if (!contracts.length) {
+    return html + '<span class="dtl-sync none">' + t('cost.empty') + '</span>';
+  }
+  var m = (cData.totals && cData.totals.morsels) || { spent_units: 0, calls: 0 };
+  html += '<div class="dtl-sync ok" style="margin:0 0 10px">' +
+    t('cost.summary').replace('{n}', cData.total_contracts).replace('{spent}', m.spent_units).replace('{calls}', m.calls) +
+    '</div>';
+  for (var i = 0; i < contracts.length; i++) html += contractRow(contracts[i]);
+  return html;
+}

package/dist/static/app-catalog/js/db.js

@@ -1,108 +1,38 @@
 /**
  * @file db.js
- * @description Local catalog data layer — IndexedDB, per-mode (Global shared vs Personal
- *   per-account). Encapsulates the DB handle + current mode as module-private state and exposes
- *   the app CRUD + mode get/set/close, so UI actions (switchDbMode) live in the feature layer.
- *   Carved from the former monolithic main.js.
- * @usage import { getAllApps, saveApp, deleteApp, getDbMode, setDbMode, closeDbInstance } from './db.js'
+ * @description Transient in-memory working-set for the catalog. The catalog is SERVER-ONLY —
+ *   there is no browser persistence (no IndexedDB). This module holds a page-session array of
+ *   app records that the detail view materializes on demand for editing (downloaded from the
+ *   server, edited in memory, then published back). The set is empty on every load and rebuilt
+ *   from the server; nothing here survives a reload. Keeps the getAllApps/saveApp/deleteApp
+ *   surface the rest of the catalog imports, so callers are unchanged.
+ * @usage import { getAllApps, saveApp, deleteApp } from './db.js'
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 2).
+ *   v2.0.0 — 2026-07-20 — Server-only catalog: drop IndexedDB + the Shared/Mine DB-mode entirely;
+ *     back the same CRUD surface with a transient in-memory working-set (no browser persistence).
  */
 
-const DB_NAME_GLOBAL = 'AppLauncherDB';
-const DB_VERSION = 2;
-const STORE_NAME = 'apps';
-
-let dbInstance = null;
-let currentDbMode = localStorage.getItem('appCatalogMode') || 'global';
-
-export function getDbMode() { return currentDbMode; }
-
-export function setDbMode(mode) {
-  currentDbMode = mode;
-  try { localStorage.setItem('appCatalogMode', mode); } catch (e) { /* private mode */ }
-}
-
-export function closeDbInstance() {
-  if (dbInstance) { try { dbInstance.close(); } catch (e) {} dbInstance = null; }
-}
-
-/** DB name is per-account in Personal mode (falls back to the shared Global DB otherwise). */
-export function getDbName() {
-  if (currentDbMode === 'personal') {
-    var owner = null;
-    try {
-      if (window.AIMEAT && window.AIMEAT.auth && window.AIMEAT.auth.getSession()) {
-        owner = window.AIMEAT.auth.getSession().owner || null;
-      }
-      if (!owner) {
-        var stored = localStorage.getItem('aimeat_session');
-        if (stored) owner = JSON.parse(stored).owner || null;
-      }
-    } catch (e) {}
-    if (owner) return DB_NAME_GLOBAL + '_' + owner;
-  }
-  return DB_NAME_GLOBAL;
-}
-
-export function openDB() {
-  var name = getDbName();
-  if (dbInstance && dbInstance.name === name) return Promise.resolve(dbInstance);
-  if (dbInstance) { dbInstance.close(); dbInstance = null; }
-  return new Promise(function (resolve, reject) {
-    const request = indexedDB.open(name, DB_VERSION);
-    request.onupgradeneeded = function (event) {
-      const db = event.target.result;
-      var store;
-      if (!db.objectStoreNames.contains(STORE_NAME)) {
-        store = db.createObjectStore(STORE_NAME, { keyPath: 'id' });
-        store.createIndex('tags', 'tags', { multiEntry: true });
-        store.createIndex('source', 'source', { unique: false });
-        store.createIndex('favorite', 'favorite', { unique: false });
-        store.createIndex('sortOrder', 'sortOrder', { unique: false });
-      } else {
-        store = event.target.transaction.objectStore(STORE_NAME);
-        if (!store.indexNames.contains('sortOrder')) {
-          store.createIndex('sortOrder', 'sortOrder', { unique: false });
-        }
-      }
-    };
-    request.onsuccess = function (event) { dbInstance = event.target.result; resolve(dbInstance); };
-    request.onerror = function (event) { reject(event.target.error); };
-  });
-}
+// Page-session working set. Holds only transient records the detail view materialized for editing;
+// empty on load, discarded on unload. NOT a store — the server is the sole source of truth.
+let workingSet = [];
 
+/** Resolve the current working set (a copy so callers can't mutate our array by reference). */
 export function getAllApps() {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readonly');
-      const request = tx.objectStore(STORE_NAME).getAll();
-      request.onsuccess = function () { resolve(request.result); };
-      request.onerror = function () { reject(request.error); };
-    });
-  });
+  return Promise.resolve(workingSet.slice());
 }
 
+/** Upsert a transient record by id (in memory only — persistence is publishing to the server). */
 export function saveApp(app) {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).put(app);
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-      tx.onabort = function () { reject(tx.error); };
-    });
-  });
+  if (app && app.id) {
+    var idx = workingSet.findIndex(function (a) { return a.id === app.id; });
+    if (idx >= 0) workingSet[idx] = app; else workingSet.push(app);
+  }
+  return Promise.resolve();
 }
 
+/** Drop a transient record by id (does NOT delete the server app — that is deleteServerApp). */
 export function deleteApp(id) {
-  return openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      const tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).delete(id);
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-      tx.onabort = function () { reject(tx.error); };
-    });
-  });
+  workingSet = workingSet.filter(function (a) { return a.id !== id; });
+  return Promise.resolve();
 }