aimeat 2.0.0 → 2.2.0

package/dist/static/app-catalog/js/settings.js

@@ -2,24 +2,20 @@
  * @file settings.js
  * @description App-catalog settings + chrome that isn't a core feature block: the light/dark THEME
  *   (applyTheme/toggleTheme/getThemePref), the Settings modal (openSettings/saveSettings + config
- *   sync to/from the node), the Help overlay, the JSON export/import of the local catalog, the
- *   duplicate-cleanup, and Clear-all. Uses the shared modules by import; the few main-local fns it
- *   calls are injected via initSettings(deps). Carved from main.js.
- * @usage import { initSettings, applyTheme, openSettings, exportBackup } from './settings.js'; initSettings({...})
+ *   sync to/from the node), and the Help overlay. Uses the shared modules by import.
+ * @usage import { initSettings, applyTheme, openSettings } from './settings.js'; initSettings({...})
  * @version-history
  *   v1.0.0 — 2026-07-10 — Initial extraction (TARGET-021 Aalto 3 modularization, phase 9).
+ *   v2.0.0 — 2026-07-20 — Server-only cutover: drop the local-catalog JSON export/import, the
+ *     duplicate-cleanup, and Clear-all (all local-store features); initSettings is now a no-op.
  */
-import { escapeHtml, sourceLabel } from './util.js';
-import { getAllApps, saveApp, deleteApp, openDB } from './db.js';
 import { showConfirm, closeConfirm, showNotice, dismissNotice } from './ui.js';
 import { loadConfig, saveConfig } from './config.js';
 import { t, getLang } from './i18n.js';
 
-// Injected once at bootstrap by main.js (main-local fns; no shared state).
-let generateId, renderApps, loadPublishedApps;
-export function initSettings(deps) {
-  ({ generateId, renderApps, loadPublishedApps } = deps);
-}
+// Kept for call-site stability (main.js still calls initSettings): server-only settings no longer
+// need any injected main-local fns, so this is now a no-op.
+export function initSettings() {}
 
 // ── Theme ────────────────────────────────────────
 
@@ -179,192 +175,9 @@ function closeHelp() { document.getElementById('help-overlay').hidden = true; }
 // Confirm dialog + toast notices → ui.js (showConfirm/closeConfirm/showNotice/dismissNotice),
 // imported at the top. The OK/Cancel buttons are wired to closeConfirm() in bootstrap below.
 
-// ── Export / Import ─────────────────────────────
-
-function exportBackup() {
-  getAllApps().then(function (apps) {
-    var config = loadConfig();
-    var backup = {
-      version: 1,
-      exportedAt: new Date().toISOString(),
-      config: config,
-      apps: apps
-    };
-    var json = JSON.stringify(backup, null, 2);
-    var blob = new Blob([json], { type: 'application/json' });
-    var url = URL.createObjectURL(blob);
-    var a = document.createElement('a');
-    a.href = url;
-    a.download = 'app-catalog-backup-' + new Date().toISOString().slice(0, 10) + '.json';
-    document.body.appendChild(a);
-    a.click();
-    document.body.removeChild(a);
-    URL.revokeObjectURL(url);
-  });
-}
-
-// Identity key for duplicate detection: a published app is the same app
-// regardless of its local id; unpublished ones match by name + content size.
-function localAppKey(a) {
-  if (a.publishedFilename) return 'pf:' + a.publishedFilename;
-  return 'nm:' + (a.name || '') + '|' + (a.blob ? a.blob.length : (a.url || ''));
-}
-
-// Parsed JSON backup awaiting user selection: { backup, rows: [{app, isDup}] }
-var jsonImportState = null;
-
-function handleImportBackup(file) {
-  if (!file) return;
-  var reader = new FileReader();
-  reader.onload = function () {
-    var backup;
-    try {
-      backup = JSON.parse(reader.result);
-    } catch (e) {
-      showNotice('Failed to parse backup file: ' + (e.message || e));
-      return;
-    }
-    if (!backup.apps || !Array.isArray(backup.apps)) {
-      showNotice('Invalid backup file: missing apps array');
-      return;
-    }
-    // Inspect-before-write: compare against the current catalog and let the
-    // user choose. Duplicates default to unchecked — nothing is imported
-    // (and no setting is changed) without an explicit selection.
-    getAllApps().then(function (existing) {
-      var existingKeys = {};
-      existing.forEach(function (a) { existingKeys[localAppKey(a)] = true; });
-      jsonImportState = {
-        backup: backup,
-        rows: backup.apps.map(function (a) {
-          return { app: a, isDup: !!existingKeys[localAppKey(a)] };
-        }),
-      };
-      renderJsonImportModal();
-    });
-  };
-  reader.readAsText(file);
-}
-
-function renderJsonImportModal() {
-  var rows = jsonImportState.rows;
-  var body = document.getElementById('json-import-body');
-  var html = '<p style="font-size:.8rem;color:var(--text-muted);margin:4px 0 8px">' + t('jsonImport.desc') + '</p>' +
-    '<div class="backup-toolbar-row"><div>' +
-      '<button class="backup-link-btn" onclick="window._launcher.jsonImportSelectAll(true)">' + t('backup.selectAll') + '</button> / ' +
-      '<button class="backup-link-btn" onclick="window._launcher.jsonImportSelectAll(false)">' + t('backup.selectNone') + '</button>' +
-    '</div></div>' +
-    '<table class="backup-table"><tbody>';
-  for (var i = 0; i < rows.length; i++) {
-    var a = rows[i].app;
-    html +=
-      '<tr>' +
-        '<td><input type="checkbox" class="json-import-cb" data-i="' + i + '"' + (rows[i].isDup ? '' : ' checked') + '/></td>' +
-        '<td>' + escapeHtml(a.name || a.publishedFilename || 'Untitled') +
-          (a.publishedFilename ? '<div class="mono-cell">' + escapeHtml(a.publishedFilename) + '</div>' : '') + '</td>' +
-        '<td>' + sourceLabel(a.source) + '</td>' +
-        '<td>' + (rows[i].isDup
-          ? '<span class="backup-status-badge backup-status-exists">' + t('jsonImport.statusDup') + '</span>'
-          : '<span class="backup-status-badge backup-status-new">' + t('backup.statusNew') + '</span>') + '</td>' +
-      '</tr>';
-  }
-  html += '</tbody></table>';
-  if (jsonImportState.backup.config && typeof jsonImportState.backup.config === 'object') {
-    html += '<label style="display:flex;align-items:center;gap:8px;margin-top:10px;font-size:.85rem">' +
-      '<input type="checkbox" id="json-import-config"/> ' + t('jsonImport.config') + '</label>';
-  }
-  body.innerHTML = html;
-  document.getElementById('json-import-status').textContent = '';
-  document.getElementById('json-import-btn').style.display = '';
-  document.getElementById('json-import-overlay').hidden = false;
-}
-
-function jsonImportSelectAll(checked) {
-  document.querySelectorAll('.json-import-cb').forEach(function (b) { b.checked = checked; });
-}
-
-function submitJsonImport() {
-  var statusEl = document.getElementById('json-import-status');
-  var selected = [];
-  document.querySelectorAll('.json-import-cb').forEach(function (b) {
-    if (b.checked) selected.push(jsonImportState.rows[parseInt(b.getAttribute('data-i'), 10)].app);
-  });
-  var configCb = document.getElementById('json-import-config');
-  var importConfig = !!(configCb && configCb.checked);
-  if (selected.length === 0 && !importConfig) {
-    statusEl.style.color = '#ef4444';
-    statusEl.textContent = t('backup.nothingSelected');
-    return;
-  }
-  if (importConfig) {
-    var merged = Object.assign({}, loadConfig(), jsonImportState.backup.config);
-    saveConfig(merged);
-    applyTheme(merged.theme);
-  }
-  Promise.all(selected.map(function (a) {
-    var app = Object.assign({}, a);
-    app.id = generateId(); // new id — the source backup may collide with existing ids
-    return saveApp(app);
-  })).then(function () {
-    statusEl.style.color = '#34d399';
-    statusEl.textContent = '✔ ' + t('jsonImport.done') + ': ' + selected.length;
-    document.getElementById('json-import-btn').style.display = 'none';
-    renderApps();
-    loadPublishedApps();
-  });
-}
-
-// ── Remove duplicate apps (cleanup after legacy blind imports) ──
-
-function removeDuplicateApps() {
-  getAllApps().then(async function (apps) {
-    var groups = {};
-    apps.forEach(function (a) {
-      var k = localAppKey(a);
-      (groups[k] = groups[k] || []).push(a);
-    });
-    var toDelete = [];
-    Object.keys(groups).forEach(function (k) {
-      var g = groups[k];
-      if (g.length < 2) return;
-      // Keep the best copy: favorites first, then the earliest added
-      g.sort(function (x, y) {
-        if (!!y.favorite !== !!x.favorite) return (y.favorite ? 1 : 0) - (x.favorite ? 1 : 0);
-        return (x.addedAt || '') < (y.addedAt || '') ? -1 : 1;
-      });
-      toDelete = toDelete.concat(g.slice(1));
-    });
-    if (toDelete.length === 0) { showNotice(t('dedup.none')); return; }
-    if (!(await showConfirm(t('dedup.confirm') + ' ' + toDelete.length))) return;
-    Promise.all(toDelete.map(function (a) { return deleteApp(a.id); })).then(function () {
-      renderApps();
-      loadPublishedApps();
-      showNotice(t('dedup.done') + ': ' + toDelete.length);
-    });
-  });
-}
-
-// ── Clear All Data ──────────────────────────────
-
-async function clearAllData() {
-  if (!(await showConfirm(t('confirm.clearAll1')))) return;
-  if (!(await showConfirm(t('confirm.clearAll2')))) return;
-
-  openDB().then(function (db) {
-    return new Promise(function (resolve, reject) {
-      var tx = db.transaction(STORE_NAME, 'readwrite');
-      tx.objectStore(STORE_NAME).clear();
-      tx.oncomplete = function () { resolve(); };
-      tx.onerror = function () { reject(tx.error); };
-    });
-  }).then(function () {
-    localStorage.removeItem('appLauncherConfig');
-    applyTheme('dark');
-    renderApps();
-    document.getElementById('settings-overlay').hidden = true;
-    showNotice('All data cleared');
-  });
-}
+// Export / Import of a LOCAL JSON catalog was removed with the server-only cutover — there is no
+// browser-local catalog to back up. Server apps + extensions are exported via the ZIP backup
+// (💾 menu → /v1/apps/backup) in server-io.js, which is unaffected.
 
 export {
   applyTheme,
@@ -377,11 +190,5 @@ export {
   loadConfigFromServer,
   closeSettings,
   openHelp,
-  closeHelp,
-  exportBackup,
-  handleImportBackup,
-  jsonImportSelectAll,
-  submitJsonImport,
-  removeDuplicateApps,
-  clearAllData
+  closeHelp
 };

package/dist/static/app-catalog/js/workcopy.js

@@ -0,0 +1,198 @@
+/**
+ * @file workcopy.js
+ * @description The working-copy model behind the app-catalog edit loop. ONE persistent working copy
+ *   per app — the server draft slot (PUT /v1/apps/:owner/:file/draft, TARGET-030) — plus a rolling
+ *   history of CHECKPOINTS: the bytes each save replaced, kept as per-owner memory records via the
+ *   generic /v1/memory API. Before this module the catalog's "Save" only overwrote a transient
+ *   in-memory blob (db.js is server-only, no browser persistence): it survived neither a reload nor
+ *   the next save, which is exactly why editing felt like editing the same version forever. Saving
+ *   now (a) checkpoints the previous bytes and (b) persists the new bytes server-side, so nothing is
+ *   lost, the work can be tested on a real origin, and publishing stays the separate, deliberate step.
+ * @structure
+ *   - slugFor(owner, filename)             → memory-key slug for one app
+ *   - loadCheckpoints / getCheckpoints     → the app's checkpoint index (newest first)
+ *   - saveWorkingCopy({...})               → checkpoint the replaced bytes + PUT the server draft
+ *   - readCheckpoint / deleteCheckpoint    → restore or prune one checkpoint
+ *   - discardWorkingCopy                   → drop the server draft slot
+ * @usage import { saveWorkingCopy, loadCheckpoints, getCheckpoints, readCheckpoint } from './workcopy.js'
+ * @version-history
+ *   v1.0.0 — 2026-07-25 — Initial (TARGET-048): persistent working copy + checkpoint history, so
+ *     local edits stop vanishing and "saved" stops meaning "kept only until you reload".
+ */
+import { loadConfig } from './config.js';
+import { getCortexOwnerToken } from './cortex.js';
+
+// How many checkpoints to keep per app. Each checkpoint is a full HTML snapshot in its OWN memory
+// record (the node caps a single memory value at ~1 MB, so they must not share one document), and
+// they count against the owner's memory quota — hence a small rolling window, oldest pruned first.
+const MAX_CHECKPOINTS = 8;
+const PREFIX = 'app-catalog.wc';
+
+// slug -> checkpoint index array (newest first). Mirrors the server doc so the detail view can
+// render synchronously between loads.
+let cache = {};
+
+function base() { return (loadConfig().aimeatUrl || '').replace(/\/+$/, ''); }
+function tok() { return getCortexOwnerToken(); }
+
+/** Stable, key-safe slug for one app's checkpoint records. */
+export function slugFor(owner, filename) {
+  return (String(owner || '') + '-' + String(filename || ''))
+    .replace(/[^a-zA-Z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .toLowerCase()
+    .slice(0, 80);
+}
+function indexKey(slug) { return PREFIX + '.' + slug; }
+function bodyKey(slug, id) { return PREFIX + '.' + slug + '.b' + id; }
+
+function memGet(key) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.resolve(null);
+  return fetch(b + '/v1/memory/' + encodeURIComponent(key), { headers: { 'Authorization': 'Bearer ' + token } })
+    .then(function (r) { return r.ok ? r.json() : null; })
+    .then(function (j) { return (j && j.data && j.data.value) || null; })
+    .catch(function () { return null; });
+}
+
+function memPut(key, value) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.reject(new Error('not signed in'));
+  return fetch(b + '/v1/memory', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
+    body: JSON.stringify({ key: key, value: value, visibility: 'private' }),
+  }).then(function (r) {
+    return r.json().then(function (j) {
+      if (!r.ok || (j && j.ok === false)) throw new Error((j && j.error && j.error.message) || ('HTTP ' + r.status));
+      return j;
+    });
+  });
+}
+
+// Best-effort: a failed prune only leaves an orphan body record the index no longer points at.
+function memDelete(key) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.resolve();
+  return fetch(b + '/v1/memory/' + encodeURIComponent(key), {
+    method: 'DELETE',
+    headers: { 'Authorization': 'Bearer ' + token },
+  }).catch(function () { /* orphan record is harmless */ });
+}
+
+/** The cached checkpoint index for an app (newest first). Empty until loadCheckpoints resolves. */
+export function getCheckpoints(owner, filename) {
+  return cache[slugFor(owner, filename)] || [];
+}
+
+/** Fetch the app's checkpoint index. Logged out / none yet → []. Never rejects. */
+export function loadCheckpoints(owner, filename) {
+  var slug = slugFor(owner, filename);
+  return memGet(indexKey(slug)).then(function (v) {
+    var items = (v && Array.isArray(v.items)) ? v.items : [];
+    cache[slug] = items;
+    return items;
+  });
+}
+
+// Store `b64` as a new checkpoint, newest first, pruning past MAX_CHECKPOINTS. The body goes in its
+// own record so one snapshot never blows the per-value size cap.
+function pushCheckpoint(slug, b64, note) {
+  var id = String(Date.now());
+  return memPut(bodyKey(slug, id), { html: b64 }).then(function () {
+    var entry = {
+      id: id,
+      at: new Date().toISOString(),
+      note: String(note || '').slice(0, 160),
+      size: Math.round(b64.length * 0.75),
+    };
+    var all = [entry].concat(cache[slug] || []);
+    var keep = all.slice(0, MAX_CHECKPOINTS);
+    var prune = all.slice(MAX_CHECKPOINTS);
+    cache[slug] = keep;
+    return memPut(indexKey(slug), { version: 1, updatedAt: entry.at, items: keep })
+      .then(function () {
+        return Promise.all(prune.map(function (p) { return memDelete(bodyKey(slug, p.id)); }));
+      })
+      .then(function () { return entry; });
+  });
+}
+
+/**
+ * Read the saved working copy back (base64), or null when there is none. Essential after a reload:
+ * without it the catalog can only re-fetch the LIVE bytes, and would then show the published app
+ * while calling it your working copy — and overwrite the real one on the next save.
+ */
+export function getDraft(owner, filename) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.resolve(null);
+  return fetch(b + '/v1/apps/' + encodeURIComponent(owner) + '/' + encodeURIComponent(filename) + '/draft', {
+    headers: { 'Authorization': 'Bearer ' + token },
+  })
+    .then(function (r) { return r.ok ? r.json() : null; })
+    .then(function (j) { return (j && j.data && typeof j.data.content === 'string') ? j.data : null; })
+    .catch(function () { return null; });
+}
+
+/** PUT the bytes into the app's server draft slot (the persistent working copy). */
+export function putDraft(owner, filename, b64) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.reject(new Error('not signed in'));
+  return fetch(b + '/v1/apps/' + encodeURIComponent(owner) + '/' + encodeURIComponent(filename) + '/draft', {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
+    body: JSON.stringify({ content: b64 }),
+  }).then(function (r) {
+    return r.json().then(function (j) {
+      if (!j.ok) throw new Error((j.error && (j.error.message || j.error.code)) || ('HTTP ' + r.status));
+      return j.data;
+    });
+  });
+}
+
+/** Discard the server draft slot (the live app is untouched). Idempotent. */
+export function discardWorkingCopy(owner, filename) {
+  var b = base(), token = tok();
+  if (!b || !token) return Promise.resolve();
+  return fetch(b + '/v1/apps/' + encodeURIComponent(owner) + '/' + encodeURIComponent(filename) + '/draft', {
+    method: 'DELETE',
+    headers: { 'Authorization': 'Bearer ' + token },
+  }).catch(function () { /* nothing to discard */ });
+}
+
+/**
+ * Save new bytes as the app's working copy.
+ * opts = { owner, filename, previousB64, nextB64, note }
+ * The bytes being REPLACED (previousB64) become a checkpoint first — so the state you are leaving
+ * is always recoverable — then the new bytes are persisted to the server draft slot.
+ * Resolves to { checkpointed: bool, draft }.
+ */
+export function saveWorkingCopy(opts) {
+  var owner = opts.owner, filename = opts.filename;
+  var slug = slugFor(owner, filename);
+  var shouldCheckpoint = !!opts.previousB64 && opts.previousB64 !== opts.nextB64;
+  var chain = shouldCheckpoint
+    ? pushCheckpoint(slug, opts.previousB64, opts.note).catch(function () { return null; })
+    : Promise.resolve(null);
+  return chain.then(function (entry) {
+    return putDraft(owner, filename, opts.nextB64).then(function (draft) {
+      return { checkpointed: !!entry, draft: draft };
+    });
+  });
+}
+
+/** Read one checkpoint's stored HTML (base64). Missing/expired → null. */
+export function readCheckpoint(owner, filename, id) {
+  return memGet(bodyKey(slugFor(owner, filename), id)).then(function (v) {
+    return (v && typeof v.html === 'string') ? v.html : null;
+  });
+}
+
+/** Remove one checkpoint from the index and delete its body record. */
+export function deleteCheckpoint(owner, filename, id) {
+  var slug = slugFor(owner, filename);
+  var items = (cache[slug] || []).filter(function (c) { return c.id !== id; });
+  cache[slug] = items;
+  return memPut(indexKey(slug), { version: 1, updatedAt: new Date().toISOString(), items: items })
+    .then(function () { return memDelete(bodyKey(slug, id)); });
+}

package/dist/static/app-catalog/styles/app-catalog.css

@@ -591,6 +591,53 @@
       opacity: 1;
     }
 
+    /* ── Server-backed favourite toggle (⭐ on any app / published card) ─── */
+    .fav-toggle {
+      position: absolute;
+      top: 6px;
+      left: 8px;
+      background: none;
+      border: none;
+      cursor: pointer;
+      font-size: 1rem;
+      line-height: 1;
+      padding: 2px;
+      opacity: .5;
+      transition: opacity var(--transition), transform var(--transition);
+      z-index: 2;
+    }
+    .fav-toggle:hover { opacity: 1; transform: scale(1.15); }
+    .fav-toggle.on { opacity: 1; }
+    .published-card { position: relative; }
+    .published-card .fav-toggle { left: auto; right: 8px; top: 8px; }
+    /* Library/community cards already own the top-LEFT corner with the Listed/Unlisted badge, so
+       the star sits top-RIGHT instead of on top of it. Keep clear of the ⋮ menu button, which only
+       local cards render: :has() pulls the star back to the edge when there is no menu. Where
+       :has() is unsupported that selector is simply dropped and the star keeps the wider offset —
+       a little gap, never an overlap. */
+    .app-card .fav-toggle { left: auto; right: 40px; top: 6px; }
+    .app-card:not(:has(.card-menu-btn)) .fav-toggle { right: 8px; }
+    .fav-section-title {
+      font-size: 1rem;
+      font-weight: 700;
+      color: var(--text);
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      margin: 0 0 .6rem;
+    }
+    .fav-section-count { opacity: .6; font-weight: 400; }
+
+    /* "Promoted" badge in the detail Promote section */
+    .dtl-badge-on {
+      font-size: .7rem;
+      font-weight: 600;
+      color: #34d399;
+      border: 1px solid #34d399;
+      border-radius: 10px;
+      padding: 1px 8px;
+    }
+
     /* ── Card Menu Button ─────────────────────────────── */
 
     .card-menu-btn {
@@ -1104,6 +1151,33 @@
     .dtl-sync.diff { background: rgba(245,158,11,.14); color: #f59e0b; }
     .dtl-sync.none { background: var(--bg-subtle); color: var(--text-muted); }
 
+    /* ── Working copy → published lifecycle band (TARGET-048) ──────────────────
+       Replaces the old two-number STATUS card: two labelled stops that say, in plain words, who
+       can see what. The active stop is highlighted so "where is my work" is answerable at a glance. */
+    .wc-row { display: flex; gap: 16px; align-items: flex-start; flex-wrap: wrap; }
+    .wc-band { flex: 1; min-width: 240px; display: flex; align-items: stretch; gap: 10px; flex-wrap: wrap; }
+    .wc-stop {
+      display: flex; flex-direction: column; gap: 2px;
+      padding: 10px 12px; border-radius: 10px;
+      border: 1px solid var(--border-subtle); background: var(--bg-subtle);
+      min-width: 150px; flex: 1;
+    }
+    .wc-stop.is-active { border-color: rgba(245, 158, 11, .55); background: rgba(245, 158, 11, .10); }
+    .wc-stop.is-live { border-color: rgba(52, 211, 153, .45); background: rgba(52, 211, 153, .10); }
+    .wc-stop-label { font-size: .7rem; text-transform: uppercase; letter-spacing: .04em; color: var(--text-muted); }
+    .wc-stop-val { font-size: .95rem; font-weight: 700; color: var(--text); }
+    .wc-stop-note { font-size: .75rem; color: var(--text-muted); }
+    .wc-arrow { align-self: center; color: var(--text-muted); font-size: 1.1rem; }
+    .wc-explain { font-size: .88rem; color: var(--text); line-height: 1.5; margin: 12px 0 10px; }
+    .wc-size { font-size: .75rem; color: var(--text-muted); margin: 8px 0 0; }
+    .wc-muted { color: var(--text-muted); font-size: .85rem; }
+    /* One-line reminder of what the three verbs do — shown under both button rows so the source
+       editor and the AI loop explain themselves identically. */
+    .wc-verbs-hint { font-size: .78rem; color: var(--text-muted); line-height: 1.45; margin: 10px 0 0; }
+    .wc-proposal-head { margin: 0 0 8px; }
+    .wc-ckpt-when { display: block; font-size: .85rem; font-weight: 600; color: var(--text); }
+    .wc-ckpt-note { display: block; font-size: .78rem; color: var(--text-muted); }
+
     .dtl-meta-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); gap: 12px; }
     .dtl-meta-item .dtl-meta-label { font-size: .7rem; text-transform: uppercase; letter-spacing: .04em; color: var(--text-muted); }
     .dtl-meta-item .dtl-meta-val { font-size: .9rem; color: var(--text); word-break: break-word; }
@@ -2146,3 +2220,29 @@
 .aga-deploy-btn { white-space: nowrap; }
 .aga-btn-sm { padding: 2px 10px; font-size: .75rem; margin-left: auto; }
 .published-card-badgerow .pcb-agent { cursor: default; }
+
+/* ── EXCHANGE & ODPS (app detail) ──────────────────────────────────────────────
+   The app-level marketplace status plus the ODPS authoring forms (app defaults and the per-tool
+   descriptor). Themed through the same variables as the rest of the detail view; the attestation
+   block is set apart on purpose, because those fields are legal promises rather than marketing copy. */
+.od-status { font-size: .86rem; font-weight: 600; padding: 6px 10px; border-radius: 8px; display: inline-block; }
+.od-status-on { background: rgba(52,211,153,.12); color: #34d399; }
+.od-status-none { background: var(--bg-subtle); color: var(--text-muted); }
+.od-note { margin: 6px 0 8px; }
+.od-muted { color: var(--text-muted); font-size: .85rem; }
+.od-actions { margin-top: 10px; }
+.od-form { margin-top: 10px; }
+.od-input { margin: 4px 0 8px; }
+.od-grid { display: flex; gap: 10px; flex-wrap: wrap; }
+.od-col { flex: 1; min-width: 150px; }
+.od-col-narrow { flex: 0 0 110px; min-width: 90px; }
+.od-attest { border: 1px solid var(--border); border-radius: 8px; padding: 8px 10px; margin: 8px 0; background: var(--bg-subtle); }
+.od-attest-head { font-weight: 600; margin-bottom: 2px; }
+.od-tool-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin: 8px 0 4px; }
+.od-link { font-size: .8rem; color: var(--accent); text-decoration: none; }
+.od-link:hover { text-decoration: underline; }
+.od-blocked { flex-basis: 100%; font-size: .8rem; color: #f59e0b; margin-top: 4px; }
+.od-ok { color: #34d399; }
+.od-err { color: var(--accent); }
+/* Measured delivery time offered as the basis for a commitment (never as the commitment itself). */
+.od-measured { font-size: 12px; color: var(--text-muted); margin: 4px 0 8px; display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }