@aglyn/plugins-data 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/site-bundle/datasets-site-bundle.server.d.ts

@@ -0,0 +1,87 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { SiteBundleImportRequest, SiteBundleItem, SiteBundleReportRow, SiteBundleRequest, SiteBundleRestoreRequest } from '@aglyn/aglyn/plugin-manager/plugin-site-bundle';
+/**
+ * A site's datasets in its whole-site backup (AGL-163), answered by the plugin
+ * that keeps them (AGL-3080).
+ *
+ * Datasets are ORG-owned (AGL-237) and shared with sites by scope, so a site's
+ * backup carries the datasets that site may see (AGL-1046) — each with its
+ * records — and a restore writes them back into the owning organization,
+ * scoped to the site it restores into.
+ */
+/** The records one dataset carries in a bundle, and the most a restore writes back. */
+export declare const DATASET_BUNDLE_RECORD_LIMIT = 1000;
+/**
+ * The keys a restore writes back on a dataset (AGL-1382): every key a live
+ * dataset carries, because the restore writes with `merge: false` and a key
+ * left off is ERASED. `visibleTo` is never on it — the restore assigns a fresh
+ * scope for the site it restores into, since a bundle is portable and an
+ * embedded `['org']` would publish one organization's data across another's
+ * whole client roster.
+ */
+export declare const DATASET_RESTORE_FIELDS: readonly string[];
+/**
+ * The keys a restore writes back on a record. `order` is what
+ * `sortDatasetRecords` sorts by, so dropping it reorders every repeatable on
+ * the restored site. The integrity index is DERIVED on the way in, never
+ * carried (see {@link importSiteDatasets}).
+ */
+export declare const RECORD_RESTORE_FIELDS: readonly string[];
+/**
+ * The site's share: the datasets the site may see, each with its records.
+ *
+ * A site with no organization genuinely has no datasets — a known-empty
+ * answer. Everything else THROWS: a catch-all would ship a silently empty,
+ * still-successful "backup" that nobody discovers until they restore it. An
+ * export that fails loudly is recoverable; one that lies is not.
+ *
+ * `visibleTo` is stripped on the way out. Its `host:` tokens name sites of
+ * THIS organization, so they are noise at best and a dangling reference once
+ * the bundle is restored elsewhere; the restore assigns a fresh scope.
+ */
+export declare function exportSiteDatasets({ hostId, orgId, limit, }: SiteBundleRequest): Promise<SiteBundleItem[]>;
+/**
+ * Refuse a bundle that would put the workspace over the datasets it may hold
+ * (AGL-1403) — decided before the restore writes anything.
+ *
+ * Datasets are SOLD: the plan includes some and the workspace buys more as
+ * add-ons, so `checkDatasetQuota` decides, never the plan's included number —
+ * a workspace that paid for extra datasets is entitled to them, and refusing
+ * its own backup after taking its money for the room would be wrong.
+ *
+ * A restore is identified by id COLLISION, never by the bundle's own claim of
+ * where it came from (an unsigned string in a file the metered party
+ * uploads). The meter is per organization, so a collision here means the
+ * WORKSPACE already holds the dataset: restoring into a sibling site of the
+ * same workspace rewrites datasets it already pays for and raises nothing,
+ * while a copy into a different workspace collides on nothing and is refused
+ * when it lands that workspace over. What is refused is the RAISE, never the
+ * state of being over — a workspace already over its limit may still restore
+ * its own backup.
+ */
+export declare function siteDatasetsRefusal({ orgId, org, items, }: SiteBundleRestoreRequest): Promise<string | null>;
+/**
+ * Writes the bundle's datasets into the owning organization, scoped to the
+ * site restored into (AGL-237, AGL-1046), each with its records.
+ *
+ * Non-conforming records are restored AND reported (AGL-182): data is never
+ * silently dropped, and the report tells the owner what to fix. A bundle from
+ * before typed models validates through the derived text model, as the live
+ * migration does, so everything in it passes.
+ */
+export declare function importSiteDatasets(request: SiteBundleImportRequest): Promise<SiteBundleReportRow[]>;

package/src/lib/site-bundle/datasets-site-bundle.server.js

@@ -0,0 +1,197 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { datasetIntegrityFields, effectiveDatasetModel, validateDocument } from "@aglyn/aglyn/app-utils/dataset-models";
+import { checkDatasetQuota } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { hostScopeToken, newResourceScopeFields } from "@aglyn/aglyn/app-utils/scope-tokens";
+import { firebaseAdmin, scopedToHost } from "@aglyn/tenant-data-admin";
+/**
+ * A site's datasets in its whole-site backup (AGL-163), answered by the plugin
+ * that keeps them (AGL-3080).
+ *
+ * Datasets are ORG-owned (AGL-237) and shared with sites by scope, so a site's
+ * backup carries the datasets that site may see (AGL-1046) — each with its
+ * records — and a restore writes them back into the owning organization,
+ * scoped to the site it restores into.
+ */ /** The records one dataset carries in a bundle, and the most a restore writes back. */ export const DATASET_BUNDLE_RECORD_LIMIT = 1000;
+/**
+ * The keys a restore writes back on a dataset (AGL-1382): every key a live
+ * dataset carries, because the restore writes with `merge: false` and a key
+ * left off is ERASED. `visibleTo` is never on it — the restore assigns a fresh
+ * scope for the site it restores into, since a bundle is portable and an
+ * embedded `['org']` would publish one organization's data across another's
+ * whole client roster.
+ */ export const DATASET_RESTORE_FIELDS = [
+    'displayName',
+    // Pre-AGL-536 human name, still read as a fallback by site search.
+    'name',
+    'fields',
+    // The typed DatasetModel, and exactly what `effectiveDatasetModel` reads
+    // below. Drop it and every restored dataset silently degrades to the
+    // derived all-text v1 model, losing types, `required`, `validation`,
+    // `default` and every `reference` link (AGL-180).
+    'model',
+    'names',
+    'description',
+    'source',
+    'installedFrom',
+    'detachedFrom'
+];
+/**
+ * The keys a restore writes back on a record. `order` is what
+ * `sortDatasetRecords` sorts by, so dropping it reorders every repeatable on
+ * the restored site. The integrity index is DERIVED on the way in, never
+ * carried (see {@link importSiteDatasets}).
+ */ export const RECORD_RESTORE_FIELDS = [
+    'values',
+    'order'
+];
+/** One of a bundle's documents, reduced to the keys a restore may write. */ function restorable(fields, input) {
+    const allowed = new Set(fields);
+    const out = {};
+    for (const [key, value] of Object.entries(input != null ? input : {})){
+        // Only `undefined` is absence — Firestore rejects it outright.
+        if (allowed.has(key) && value !== undefined) out[key] = value;
+    }
+    return out;
+}
+/** The ids a bundle would write — distinct, since two items sharing one are one document. */ function bundleIds(items) {
+    const ids = new Set();
+    for (const item of items)if (item == null ? void 0 : item.$id) ids.add(String(item.$id));
+    return ids;
+}
+const datasetsOf = (orgId)=>firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('datasets');
+/**
+ * The site's share: the datasets the site may see, each with its records.
+ *
+ * A site with no organization genuinely has no datasets — a known-empty
+ * answer. Everything else THROWS: a catch-all would ship a silently empty,
+ * still-successful "backup" that nobody discovers until they restore it. An
+ * export that fails loudly is recoverable; one that lies is not.
+ *
+ * `visibleTo` is stripped on the way out. Its `host:` tokens name sites of
+ * THIS organization, so they are noise at best and a dangling reference once
+ * the bundle is restored elsewhere; the restore assigns a fresh scope.
+ */ export async function exportSiteDatasets({ hostId, orgId, limit }) {
+    if (!orgId) return [];
+    const snapshot = await scopedToHost(datasetsOf(orgId), hostId).limit(limit).get();
+    const live = snapshot.docs.filter((doc)=>!doc.get('deletedAt'));
+    return Promise.all(live.map(async (doc)=>{
+        const _doc_data = doc.data(), { visibleTo: _visibleTo } = _doc_data, data = _object_without_properties_loose(_doc_data, [
+            "visibleTo"
+        ]);
+        const records = await doc.ref.collection('records').limit(DATASET_BUNDLE_RECORD_LIMIT).get();
+        return _extends({
+            $id: doc.id
+        }, data, {
+            records: records.docs.map((record)=>_extends({
+                    $id: record.id
+                }, record.data()))
+        });
+    }));
+}
+/**
+ * Refuse a bundle that would put the workspace over the datasets it may hold
+ * (AGL-1403) — decided before the restore writes anything.
+ *
+ * Datasets are SOLD: the plan includes some and the workspace buys more as
+ * add-ons, so `checkDatasetQuota` decides, never the plan's included number —
+ * a workspace that paid for extra datasets is entitled to them, and refusing
+ * its own backup after taking its money for the room would be wrong.
+ *
+ * A restore is identified by id COLLISION, never by the bundle's own claim of
+ * where it came from (an unsigned string in a file the metered party
+ * uploads). The meter is per organization, so a collision here means the
+ * WORKSPACE already holds the dataset: restoring into a sibling site of the
+ * same workspace rewrites datasets it already pays for and raises nothing,
+ * while a copy into a different workspace collides on nothing and is refused
+ * when it lands that workspace over. What is refused is the RAISE, never the
+ * state of being over — a workspace already over its limit may still restore
+ * its own backup.
+ */ export async function siteDatasetsRefusal({ orgId, org, items }) {
+    const bundled = bundleIds(items);
+    if (!orgId || !bundled.size) return null;
+    if (!Number.isFinite(checkDatasetQuota(org, 0).limit)) return null;
+    // A field mask with no fields projects to the document id alone.
+    const held = await datasetsOf(orgId).select().get();
+    const existing = new Set(held.docs.map((doc)=>doc.id));
+    const next = new Set([
+        ...existing,
+        ...bundled
+    ]).size;
+    // `allowed` asks "may I add one more to N", so the post state N is checked
+    // as `N - 1` — the idiom the dataset routes' own bulk paths use.
+    const quota = checkDatasetQuota(org, next - 1);
+    if (next <= existing.size || quota.allowed) return null;
+    return `This backup holds ${bundled.size} datasets and this workspace ` + `has ${existing.size}, which would put it at ${next} of ${quota.limit} ` + 'datasets. Nothing was imported — ' + (quota.upgradeRequired ? 'upgrade in Billing.' : `add extra datasets for $${quota.addonPriceUsd}/mo each, or ` + 'upgrade in Billing.');
+}
+/**
+ * Writes the bundle's datasets into the owning organization, scoped to the
+ * site restored into (AGL-237, AGL-1046), each with its records.
+ *
+ * Non-conforming records are restored AND reported (AGL-182): data is never
+ * silently dropped, and the report tells the owner what to fix. A bundle from
+ * before typed models validates through the derived text model, as the live
+ * migration does, so everything in it passes.
+ */ export async function importSiteDatasets(request) {
+    const { hostId, orgId, items, write, stamps } = request;
+    if (!orgId) return [];
+    // Through the scoped-create gate (AGL-1478, AGL-1484): a restore CREATES
+    // datasets, and a dataset is born scoped to the site it lands in.
+    const scope = newResourceScopeFields([
+        hostScopeToken(hostId)
+    ]);
+    const report = [];
+    for (const item of items){
+        if (!(item == null ? void 0 : item.$id)) continue;
+        const path = `orgs/${orgId}/datasets/${String(item.$id)}`;
+        await write(path, _extends({}, restorable(DATASET_RESTORE_FIELDS, item), stamps(), scope));
+        const model = effectiveDatasetModel(item);
+        await ensureCustomFieldTypes(model, request);
+        const records = Array.isArray(item['records']) ? item['records'] : [];
+        for (const record of records.slice(0, DATASET_BUNDLE_RECORD_LIMIT)){
+            var _record_values, _record_values1;
+            if (!(record == null ? void 0 : record.$id)) continue;
+            const errors = validateDocument(model, (_record_values = record['values']) != null ? _record_values : {});
+            if (Object.keys(errors).length) {
+                report.push({
+                    datasetId: String(item.$id),
+                    recordId: String(record.$id),
+                    errors
+                });
+            }
+            await write(`${path}/records/${String(record.$id)}`, _extends({}, restorable(RECORD_RESTORE_FIELDS, record), stamps(), datasetIntegrityFields(model, (_record_values1 = record['values']) != null ? _record_values1 : {})));
+        }
+    }
+    return report;
+}
+/**
+ * Loads the plugins that register custom field types before a record is
+ * validated against `model` (AGL-434). A type is registered when its plugin's
+ * server surface loads, and `validateDocument` answers "no error" for a type
+ * nobody registered — right for a plugin that is absent, wrong for one not yet
+ * loaded. Only a model that names a custom type pays for the load.
+ */ async function ensureCustomFieldTypes(model, request) {
+    var _ref;
+    const usesCustomType = ((_ref = model == null ? void 0 : model.order) != null ? _ref : []).some((fieldId)=>{
+        var _model_fields_fieldId, _model_fields;
+        return Boolean(model == null ? void 0 : (_model_fields = model.fields) == null ? void 0 : (_model_fields_fieldId = _model_fields[fieldId]) == null ? void 0 : _model_fields_fieldId.customType);
+    });
+    if (usesCustomType) await request.loadPluginSurfaces();
+}
+
+//# sourceMappingURL=datasets-site-bundle.server.js.map

package/src/lib/site-bundle/datasets-site-bundle.server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/site-bundle/datasets-site-bundle.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  datasetIntegrityFields,\n  effectiveDatasetModel,\n  validateDocument,\n} from '@aglyn/aglyn/app-utils/dataset-models'\nimport { checkDatasetQuota } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { hostScopeToken, newResourceScopeFields } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type {\n  SiteBundleImportRequest,\n  SiteBundleItem,\n  SiteBundleReportRow,\n  SiteBundleRequest,\n  SiteBundleRestoreRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-site-bundle'\nimport { firebaseAdmin, scopedToHost } from '@aglyn/tenant-data-admin'\n\n/**\n * A site's datasets in its whole-site backup (AGL-163), answered by the plugin\n * that keeps them (AGL-3080).\n *\n * Datasets are ORG-owned (AGL-237) and shared with sites by scope, so a site's\n * backup carries the datasets that site may see (AGL-1046) — each with its\n * records — and a restore writes them back into the owning organization,\n * scoped to the site it restores into.\n */\n\n/** The records one dataset carries in a bundle, and the most a restore writes back. */\nexport const DATASET_BUNDLE_RECORD_LIMIT = 1000\n\n/**\n * The keys a restore writes back on a dataset (AGL-1382): every key a live\n * dataset carries, because the restore writes with `merge: false` and a key\n * left off is ERASED. `visibleTo` is never on it — the restore assigns a fresh\n * scope for the site it restores into, since a bundle is portable and an\n * embedded `['org']` would publish one organization's data across another's\n * whole client roster.\n */\nexport const DATASET_RESTORE_FIELDS: readonly string[] = [\n  'displayName',\n  // Pre-AGL-536 human name, still read as a fallback by site search.\n  'name',\n  'fields',\n  // The typed DatasetModel, and exactly what `effectiveDatasetModel` reads\n  // below. Drop it and every restored dataset silently degrades to the\n  // derived all-text v1 model, losing types, `required`, `validation`,\n  // `default` and every `reference` link (AGL-180).\n  'model',\n  'names',\n  'description',\n  'source',\n  'installedFrom',\n  'detachedFrom',\n]\n\n/**\n * The keys a restore writes back on a record. `order` is what\n * `sortDatasetRecords` sorts by, so dropping it reorders every repeatable on\n * the restored site. The integrity index is DERIVED on the way in, never\n * carried (see {@link importSiteDatasets}).\n */\nexport const RECORD_RESTORE_FIELDS: readonly string[] = ['values', 'order']\n\n/** One of a bundle's documents, reduced to the keys a restore may write. */\nfunction restorable(fields: readonly string[], input: SiteBundleItem): Record<string, unknown> {\n  const allowed = new Set(fields)\n  const out: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(input ?? {})) {\n    // Only `undefined` is absence — Firestore rejects it outright.\n    if (allowed.has(key) && value !== undefined) out[key] = value\n  }\n  return out\n}\n\n/** The ids a bundle would write — distinct, since two items sharing one are one document. */\nfunction bundleIds(items: readonly SiteBundleItem[]): Set<string> {\n  const ids = new Set<string>()\n  for (const item of items) if (item?.$id) ids.add(String(item.$id))\n  return ids\n}\n\nconst datasetsOf = (orgId: string) =>\n  firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('datasets')\n\n/**\n * The site's share: the datasets the site may see, each with its records.\n *\n * A site with no organization genuinely has no datasets — a known-empty\n * answer. Everything else THROWS: a catch-all would ship a silently empty,\n * still-successful \"backup\" that nobody discovers until they restore it. An\n * export that fails loudly is recoverable; one that lies is not.\n *\n * `visibleTo` is stripped on the way out. Its `host:` tokens name sites of\n * THIS organization, so they are noise at best and a dangling reference once\n * the bundle is restored elsewhere; the restore assigns a fresh scope.\n */\nexport async function exportSiteDatasets({\n  hostId,\n  orgId,\n  limit,\n}: SiteBundleRequest): Promise<SiteBundleItem[]> {\n  if (!orgId) return []\n  const snapshot = await scopedToHost(datasetsOf(orgId), hostId).limit(limit).get()\n  const live = snapshot.docs.filter((doc) => !doc.get('deletedAt'))\n  return Promise.all(\n    live.map(async (doc) => {\n      const { visibleTo: _visibleTo, ...data } = doc.data()\n      const records = await doc.ref.collection('records').limit(DATASET_BUNDLE_RECORD_LIMIT).get()\n      return {\n        $id: doc.id,\n        ...data,\n        records: records.docs.map((record) => ({ $id: record.id, ...record.data() })),\n      }\n    }),\n  )\n}\n\n/**\n * Refuse a bundle that would put the workspace over the datasets it may hold\n * (AGL-1403) — decided before the restore writes anything.\n *\n * Datasets are SOLD: the plan includes some and the workspace buys more as\n * add-ons, so `checkDatasetQuota` decides, never the plan's included number —\n * a workspace that paid for extra datasets is entitled to them, and refusing\n * its own backup after taking its money for the room would be wrong.\n *\n * A restore is identified by id COLLISION, never by the bundle's own claim of\n * where it came from (an unsigned string in a file the metered party\n * uploads). The meter is per organization, so a collision here means the\n * WORKSPACE already holds the dataset: restoring into a sibling site of the\n * same workspace rewrites datasets it already pays for and raises nothing,\n * while a copy into a different workspace collides on nothing and is refused\n * when it lands that workspace over. What is refused is the RAISE, never the\n * state of being over — a workspace already over its limit may still restore\n * its own backup.\n */\nexport async function siteDatasetsRefusal({\n  orgId,\n  org,\n  items,\n}: SiteBundleRestoreRequest): Promise<string | null> {\n  const bundled = bundleIds(items)\n  if (!orgId || !bundled.size) return null\n  if (!Number.isFinite(checkDatasetQuota(org as any, 0).limit)) return null\n\n  // A field mask with no fields projects to the document id alone.\n  const held = await datasetsOf(orgId).select().get()\n  const existing = new Set(held.docs.map((doc) => doc.id))\n  const next = new Set([...existing, ...bundled]).size\n  // `allowed` asks \"may I add one more to N\", so the post state N is checked\n  // as `N - 1` — the idiom the dataset routes' own bulk paths use.\n  const quota = checkDatasetQuota(org as any, next - 1)\n  if (next <= existing.size || quota.allowed) return null\n\n  return (\n    `This backup holds ${bundled.size} datasets and this workspace ` +\n    `has ${existing.size}, which would put it at ${next} of ${quota.limit} ` +\n    'datasets. Nothing was imported — ' +\n    (quota.upgradeRequired\n      ? 'upgrade in Billing.'\n      : `add extra datasets for $${quota.addonPriceUsd}/mo each, or ` +\n        'upgrade in Billing.')\n  )\n}\n\n/**\n * Writes the bundle's datasets into the owning organization, scoped to the\n * site restored into (AGL-237, AGL-1046), each with its records.\n *\n * Non-conforming records are restored AND reported (AGL-182): data is never\n * silently dropped, and the report tells the owner what to fix. A bundle from\n * before typed models validates through the derived text model, as the live\n * migration does, so everything in it passes.\n */\nexport async function importSiteDatasets(\n  request: SiteBundleImportRequest,\n): Promise<SiteBundleReportRow[]> {\n  const { hostId, orgId, items, write, stamps } = request\n  if (!orgId) return []\n  // Through the scoped-create gate (AGL-1478, AGL-1484): a restore CREATES\n  // datasets, and a dataset is born scoped to the site it lands in.\n  const scope = newResourceScopeFields([hostScopeToken(hostId)])\n  const report: SiteBundleReportRow[] = []\n  for (const item of items) {\n    if (!item?.$id) continue\n    const path = `orgs/${orgId}/datasets/${String(item.$id)}`\n    await write(path, { ...restorable(DATASET_RESTORE_FIELDS, item), ...stamps(), ...scope })\n    const model = effectiveDatasetModel(item)\n    await ensureCustomFieldTypes(model, request)\n    const records: SiteBundleItem[] = Array.isArray(item['records']) ? item['records'] : []\n    for (const record of records.slice(0, DATASET_BUNDLE_RECORD_LIMIT)) {\n      if (!record?.$id) continue\n      const errors = validateDocument(model, record['values'] ?? {})\n      if (Object.keys(errors).length) {\n        report.push({ datasetId: String(item.$id), recordId: String(record.$id), errors })\n      }\n      await write(`${path}/records/${String(record.$id)}`, {\n        ...restorable(RECORD_RESTORE_FIELDS, record),\n        ...stamps(),\n        // DERIVED here rather than carried in the bundle. The integrity\n        // index the delete check queries must describe the values just\n        // restored, and a bundle written before the field existed carries\n        // none — accepting the bundle's copy would restore records the check\n        // cannot reach. Records keep their original ids, so the ids it holds\n        // still resolve.\n        ...datasetIntegrityFields(model, record['values'] ?? {}),\n      })\n    }\n  }\n  return report\n}\n\n/**\n * Loads the plugins that register custom field types before a record is\n * validated against `model` (AGL-434). A type is registered when its plugin's\n * server surface loads, and `validateDocument` answers \"no error\" for a type\n * nobody registered — right for a plugin that is absent, wrong for one not yet\n * loaded. Only a model that names a custom type pays for the load.\n */\nasync function ensureCustomFieldTypes(\n  model: ReturnType<typeof effectiveDatasetModel>,\n  request: Pick<SiteBundleImportRequest, 'loadPluginSurfaces'>,\n): Promise<void> {\n  const usesCustomType = (model?.order ?? []).some((fieldId) =>\n    Boolean(model?.fields?.[fieldId]?.customType),\n  )\n  if (usesCustomType) await request.loadPluginSurfaces()\n}\n"],"names":["datasetIntegrityFields","effectiveDatasetModel","validateDocument","checkDatasetQuota","hostScopeToken","newResourceScopeFields","firebaseAdmin","scopedToHost","DATASET_BUNDLE_RECORD_LIMIT","DATASET_RESTORE_FIELDS","RECORD_RESTORE_FIELDS","restorable","fields","input","allowed","Set","out","key","value","Object","entries","has","undefined","bundleIds","items","ids","item","$id","add","String","datasetsOf","orgId","app","firestore","collection","doc","exportSiteDatasets","hostId","limit","snapshot","get","live","docs","filter","Promise","all","map","data","visibleTo","_visibleTo","records","ref","id","record","siteDatasetsRefusal","org","bundled","size","Number","isFinite","held","select","existing","next","quota","upgradeRequired","addonPriceUsd","importSiteDatasets","request","write","stamps","scope","report","path","model","ensureCustomFieldTypes","Array","isArray","slice","errors","keys","length","push","datasetId","recordId","usesCustomType","order","some","fieldId","Boolean","customType","loadPluginSurfaces"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,EACtBC,qBAAqB,EACrBC,gBAAgB,QACX,wCAAuC;AAC9C,SAASC,iBAAiB,QAAQ,2CAA0C;AAC5E,SAASC,cAAc,EAAEC,sBAAsB,QAAQ,sCAAqC;AAQ5F,SAASC,aAAa,EAAEC,YAAY,QAAQ,2BAA0B;AAEtE;;;;;;;;CAQC,GAED,qFAAqF,GACrF,OAAO,MAAMC,8BAA8B,KAAI;AAE/C;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA4C;IACvD;IACA,mEAAmE;IACnE;IACA;IACA,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,kDAAkD;IAClD;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,wBAA2C;IAAC;IAAU;CAAQ,CAAA;AAE3E,0EAA0E,GAC1E,SAASC,WAAWC,MAAyB,EAAEC,KAAqB;IAClE,MAAMC,UAAU,IAAIC,IAAIH;IACxB,MAAMI,MAA+B,CAAC;IACtC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACP,gBAAAA,QAAS,CAAC,GAAI;QACtD,+DAA+D;QAC/D,IAAIC,QAAQO,GAAG,CAACJ,QAAQC,UAAUI,WAAWN,GAAG,CAACC,IAAI,GAAGC;IAC1D;IACA,OAAOF;AACT;AAEA,2FAA2F,GAC3F,SAASO,UAAUC,KAAgC;IACjD,MAAMC,MAAM,IAAIV;IAChB,KAAK,MAAMW,QAAQF,MAAO,IAAIE,wBAAAA,KAAMC,GAAG,EAAEF,IAAIG,GAAG,CAACC,OAAOH,KAAKC,GAAG;IAChE,OAAOF;AACT;AAEA,MAAMK,aAAa,CAACC,QAClBzB,cAAc0B,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,QAAQC,GAAG,CAACJ,OAAOG,UAAU,CAAC;AAE3E;;;;;;;;;;;CAWC,GACD,OAAO,eAAeE,mBAAmB,EACvCC,MAAM,EACNN,KAAK,EACLO,KAAK,EACa;IAClB,IAAI,CAACP,OAAO,OAAO,EAAE;IACrB,MAAMQ,WAAW,MAAMhC,aAAauB,WAAWC,QAAQM,QAAQC,KAAK,CAACA,OAAOE,GAAG;IAC/E,MAAMC,OAAOF,SAASG,IAAI,CAACC,MAAM,CAAC,CAACR,MAAQ,CAACA,IAAIK,GAAG,CAAC;IACpD,OAAOI,QAAQC,GAAG,CAChBJ,KAAKK,GAAG,CAAC,OAAOX;QACd,MAA2CA,YAAAA,IAAIY,IAAI,IAA7C,EAAEC,WAAWC,UAAU,EAAW,GAAGd,WAATY,wCAASZ;;;QAC3C,MAAMe,UAAU,MAAMf,IAAIgB,GAAG,CAACjB,UAAU,CAAC,WAAWI,KAAK,CAAC9B,6BAA6BgC,GAAG;QAC1F,OAAO;YACLb,KAAKQ,IAAIiB,EAAE;WACRL;YACHG,SAASA,QAAQR,IAAI,CAACI,GAAG,CAAC,CAACO,SAAY;oBAAE1B,KAAK0B,OAAOD,EAAE;mBAAKC,OAAON,IAAI;;IAE3E;AAEJ;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeO,oBAAoB,EACxCvB,KAAK,EACLwB,GAAG,EACH/B,KAAK,EACoB;IACzB,MAAMgC,UAAUjC,UAAUC;IAC1B,IAAI,CAACO,SAAS,CAACyB,QAAQC,IAAI,EAAE,OAAO;IACpC,IAAI,CAACC,OAAOC,QAAQ,CAACxD,kBAAkBoD,KAAY,GAAGjB,KAAK,GAAG,OAAO;IAErE,iEAAiE;IACjE,MAAMsB,OAAO,MAAM9B,WAAWC,OAAO8B,MAAM,GAAGrB,GAAG;IACjD,MAAMsB,WAAW,IAAI/C,IAAI6C,KAAKlB,IAAI,CAACI,GAAG,CAAC,CAACX,MAAQA,IAAIiB,EAAE;IACtD,MAAMW,OAAO,IAAIhD,IAAI;WAAI+C;WAAaN;KAAQ,EAAEC,IAAI;IACpD,2EAA2E;IAC3E,iEAAiE;IACjE,MAAMO,QAAQ7D,kBAAkBoD,KAAYQ,OAAO;IACnD,IAAIA,QAAQD,SAASL,IAAI,IAAIO,MAAMlD,OAAO,EAAE,OAAO;IAEnD,OACE,CAAC,kBAAkB,EAAE0C,QAAQC,IAAI,CAAC,6BAA6B,CAAC,GAChE,CAAC,IAAI,EAAEK,SAASL,IAAI,CAAC,wBAAwB,EAAEM,KAAK,IAAI,EAAEC,MAAM1B,KAAK,CAAC,CAAC,CAAC,GACxE,sCACC0B,CAAAA,MAAMC,eAAe,GAClB,wBACA,CAAC,wBAAwB,EAAED,MAAME,aAAa,CAAC,aAAa,CAAC,GAC7D,qBAAoB;AAE5B;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,mBACpBC,OAAgC;IAEhC,MAAM,EAAE/B,MAAM,EAAEN,KAAK,EAAEP,KAAK,EAAE6C,KAAK,EAAEC,MAAM,EAAE,GAAGF;IAChD,IAAI,CAACrC,OAAO,OAAO,EAAE;IACrB,yEAAyE;IACzE,kEAAkE;IAClE,MAAMwC,QAAQlE,uBAAuB;QAACD,eAAeiC;KAAQ;IAC7D,MAAMmC,SAAgC,EAAE;IACxC,KAAK,MAAM9C,QAAQF,MAAO;QACxB,IAAI,EAACE,wBAAAA,KAAMC,GAAG,GAAE;QAChB,MAAM8C,OAAO,CAAC,KAAK,EAAE1C,MAAM,UAAU,EAAEF,OAAOH,KAAKC,GAAG,GAAG;QACzD,MAAM0C,MAAMI,MAAM,aAAK9D,WAAWF,wBAAwBiB,OAAU4C,UAAaC;QACjF,MAAMG,QAAQzE,sBAAsByB;QACpC,MAAMiD,uBAAuBD,OAAON;QACpC,MAAMlB,UAA4B0B,MAAMC,OAAO,CAACnD,IAAI,CAAC,UAAU,IAAIA,IAAI,CAAC,UAAU,GAAG,EAAE;QACvF,KAAK,MAAM2B,UAAUH,QAAQ4B,KAAK,CAAC,GAAGtE,6BAA8B;gBAE3B6C,gBAaJA;YAdnC,IAAI,EAACA,0BAAAA,OAAQ1B,GAAG,GAAE;YAClB,MAAMoD,SAAS7E,iBAAiBwE,QAAOrB,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,CAAC;YAC5D,IAAIlC,OAAO6D,IAAI,CAACD,QAAQE,MAAM,EAAE;gBAC9BT,OAAOU,IAAI,CAAC;oBAAEC,WAAWtD,OAAOH,KAAKC,GAAG;oBAAGyD,UAAUvD,OAAOwB,OAAO1B,GAAG;oBAAGoD;gBAAO;YAClF;YACA,MAAMV,MAAM,GAAGI,KAAK,SAAS,EAAE5C,OAAOwB,OAAO1B,GAAG,GAAG,EAAE,aAChDhB,WAAWD,uBAAuB2C,SAClCiB,UAOAtE,uBAAuB0E,QAAOrB,kBAAAA,MAAM,CAAC,SAAS,YAAhBA,kBAAoB,CAAC;QAE1D;IACF;IACA,OAAOmB;AACT;AAEA;;;;;;CAMC,GACD,eAAeG,uBACbD,KAA+C,EAC/CN,OAA4D;;IAE5D,MAAMiB,iBAAiB,SAACX,yBAAAA,MAAOY,KAAK,mBAAI,EAAE,EAAEC,IAAI,CAAC,CAACC;YACxCd,uBAAAA;eAARe,QAAQf,0BAAAA,gBAAAA,MAAO9D,MAAM,sBAAb8D,wBAAAA,aAAe,CAACc,QAAQ,qBAAxBd,sBAA0BgB,UAAU;;IAE9C,IAAIL,gBAAgB,MAAMjB,QAAQuB,kBAAkB;AACtD"}