@aglyn/plugins-data 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/site-bundle/datasets-site-bundle.server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/site-bundle/datasets-site-bundle.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  datasetIntegrityFields,\n  effectiveDatasetModel,\n  validateDocument,\n} from '@aglyn/aglyn/app-utils/dataset-models'\nimport { checkDatasetQuota } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { hostScopeToken, newResourceScopeFields } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type {\n  SiteBundleImportRequest,\n  SiteBundleItem,\n  SiteBundleReportRow,\n  SiteBundleRequest,\n  SiteBundleRestoreRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-site-bundle'\nimport { firebaseAdmin, scopedToHost } from '@aglyn/tenant-data-admin'\nimport { loadCustomFieldTypes } from '../server/custom-field-types'\n\n/**\n * A site's datasets in its whole-site backup (AGL-163), answered by the plugin\n * that keeps them (AGL-3080).\n *\n * Datasets are ORG-owned (AGL-237) and shared with sites by scope, so a site's\n * backup carries the datasets that site may see (AGL-1046) — each with its\n * records — and a restore writes them back into the owning organization,\n * scoped to the site it restores into.\n */\n\n/** The records one dataset carries in a bundle, and the most a restore writes back. */\nexport const DATASET_BUNDLE_RECORD_LIMIT = 1000\n\n/**\n * The keys a restore writes back on a dataset (AGL-1382): every key a live\n * dataset carries, because the restore writes with `merge: false` and a key\n * left off is ERASED. `visibleTo` is never on it — the restore assigns a fresh\n * scope for the site it restores into, since a bundle is portable and an\n * embedded `['org']` would publish one organization's data across another's\n * whole client roster.\n */\nexport const DATASET_RESTORE_FIELDS: readonly string[] = [\n  'displayName',\n  // Pre-AGL-536 human name, still read as a fallback by site search.\n  'name',\n  'fields',\n  // The typed DatasetModel, and exactly what `effectiveDatasetModel` reads\n  // below. Drop it and every restored dataset silently degrades to the\n  // derived all-text v1 model, losing types, `required`, `validation`,\n  // `default` and every `reference` link (AGL-180).\n  'model',\n  'names',\n  'description',\n  'source',\n  'installedFrom',\n  'detachedFrom',\n]\n\n/**\n * The keys a restore writes back on a record. `order` is what\n * `sortDatasetRecords` sorts by, so dropping it reorders every repeatable on\n * the restored site. The integrity index is DERIVED on the way in, never\n * carried (see {@link importSiteDatasets}).\n */\nexport const RECORD_RESTORE_FIELDS: readonly string[] = ['values', 'order']\n\n/** One of a bundle's documents, reduced to the keys a restore may write. */\nfunction restorable(fields: readonly string[], input: SiteBundleItem): Record<string, unknown> {\n  const allowed = new Set(fields)\n  const out: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(input ?? {})) {\n    // Only `undefined` is absence — Firestore rejects it outright.\n    if (allowed.has(key) && value !== undefined) out[key] = value\n  }\n  return out\n}\n\n/** The ids a bundle would write — distinct, since two items sharing one are one document. */\nfunction bundleIds(items: readonly SiteBundleItem[]): Set<string> {\n  const ids = new Set<string>()\n  for (const item of items) if (item?.$id) ids.add(String(item.$id))\n  return ids\n}\n\nconst datasetsOf = (orgId: string) =>\n  firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('datasets')\n\n/**\n * The site's share: the datasets the site may see, each with its records.\n *\n * A site with no organization genuinely has no datasets — a known-empty\n * answer. Everything else THROWS: a catch-all would ship a silently empty,\n * still-successful \"backup\" that nobody discovers until they restore it. An\n * export that fails loudly is recoverable; one that lies is not.\n *\n * `visibleTo` is stripped on the way out. Its `host:` tokens name sites of\n * THIS organization, so they are noise at best and a dangling reference once\n * the bundle is restored elsewhere; the restore assigns a fresh scope.\n */\nexport async function exportSiteDatasets({\n  hostId,\n  orgId,\n  limit,\n}: SiteBundleRequest): Promise<SiteBundleItem[]> {\n  if (!orgId) return []\n  const snapshot = await scopedToHost(datasetsOf(orgId), hostId).limit(limit).get()\n  const live = snapshot.docs.filter((doc) => !doc.get('deletedAt'))\n  return Promise.all(\n    live.map(async (doc) => {\n      const { visibleTo: _visibleTo, ...data } = doc.data()\n      const records = await doc.ref.collection('records').limit(DATASET_BUNDLE_RECORD_LIMIT).get()\n      return {\n        $id: doc.id,\n        ...data,\n        records: records.docs.map((record) => ({ $id: record.id, ...record.data() })),\n      }\n    }),\n  )\n}\n\n/**\n * Refuse a bundle that would put the workspace over the datasets it may hold\n * (AGL-1403) — decided before the restore writes anything.\n *\n * Datasets are SOLD: the plan includes some and the workspace buys more as\n * add-ons, so `checkDatasetQuota` decides, never the plan's included number —\n * a workspace that paid for extra datasets is entitled to them, and refusing\n * its own backup after taking its money for the room would be wrong.\n *\n * A restore is identified by id COLLISION, never by the bundle's own claim of\n * where it came from (an unsigned string in a file the metered party\n * uploads). The meter is per organization, so a collision here means the\n * WORKSPACE already holds the dataset: restoring into a sibling site of the\n * same workspace rewrites datasets it already pays for and raises nothing,\n * while a copy into a different workspace collides on nothing and is refused\n * when it lands that workspace over. What is refused is the RAISE, never the\n * state of being over — a workspace already over its limit may still restore\n * its own backup.\n */\nexport async function siteDatasetsRefusal({\n  orgId,\n  org,\n  items,\n}: SiteBundleRestoreRequest): Promise<string | null> {\n  const bundled = bundleIds(items)\n  if (!orgId || !bundled.size) return null\n  if (!Number.isFinite(checkDatasetQuota(org as any, 0).limit)) return null\n\n  // A field mask with no fields projects to the document id alone.\n  const held = await datasetsOf(orgId).select().get()\n  const existing = new Set(held.docs.map((doc) => doc.id))\n  const next = new Set([...existing, ...bundled]).size\n  // `allowed` asks \"may I add one more to N\", so the post state N is checked\n  // as `N - 1` — the idiom the dataset routes' own bulk paths use.\n  const quota = checkDatasetQuota(org as any, next - 1)\n  if (next <= existing.size || quota.allowed) return null\n\n  return (\n    `This backup holds ${bundled.size} datasets and this workspace ` +\n    `has ${existing.size}, which would put it at ${next} of ${quota.limit} ` +\n    'datasets. Nothing was imported — ' +\n    (quota.upgradeRequired\n      ? 'upgrade in Billing.'\n      : `add extra datasets for $${quota.addonPriceUsd}/mo each, or ` +\n        'upgrade in Billing.')\n  )\n}\n\n/**\n * Writes the bundle's datasets into the owning organization, scoped to the\n * site restored into (AGL-237, AGL-1046), each with its records.\n *\n * Non-conforming records are restored AND reported (AGL-182): data is never\n * silently dropped, and the report tells the owner what to fix. A bundle from\n * before typed models validates through the derived text model, as the live\n * migration does, so everything in it passes.\n */\nexport async function importSiteDatasets(\n  request: SiteBundleImportRequest,\n): Promise<SiteBundleReportRow[]> {\n  const { hostId, orgId, items, write, stamps } = request\n  if (!orgId) return []\n  // Through the scoped-create gate (AGL-1478, AGL-1484): a restore CREATES\n  // datasets, and a dataset is born scoped to the site it lands in.\n  const scope = newResourceScopeFields([hostScopeToken(hostId)])\n  const report: SiteBundleReportRow[] = []\n  for (const item of items) {\n    if (!item?.$id) continue\n    const path = `orgs/${orgId}/datasets/${String(item.$id)}`\n    await write(path, { ...restorable(DATASET_RESTORE_FIELDS, item), ...stamps(), ...scope })\n    const model = effectiveDatasetModel(item)\n    await loadCustomFieldTypes(model, request.loadPluginSurfaces)\n    const records: SiteBundleItem[] = Array.isArray(item['records']) ? item['records'] : []\n    for (const record of records.slice(0, DATASET_BUNDLE_RECORD_LIMIT)) {\n      if (!record?.$id) continue\n      const errors = validateDocument(model, record['values'] ?? {})\n      if (Object.keys(errors).length) {\n        report.push({ datasetId: String(item.$id), recordId: String(record.$id), errors })\n      }\n      await write(`${path}/records/${String(record.$id)}`, {\n        ...restorable(RECORD_RESTORE_FIELDS, record),\n        ...stamps(),\n        // DERIVED here rather than carried in the bundle. The integrity\n        // index the delete check queries must describe the values just\n        // restored, and a bundle written before the field existed carries\n        // none — accepting the bundle's copy would restore records the check\n        // cannot reach. Records keep their original ids, so the ids it holds\n        // still resolve.\n        ...datasetIntegrityFields(model, record['values'] ?? {}),\n      })\n    }\n  }\n  return report\n}\n"],"names":["datasetIntegrityFields","effectiveDatasetModel","validateDocument","checkDatasetQuota","hostScopeToken","newResourceScopeFields","firebaseAdmin","scopedToHost","loadCustomFieldTypes","DATASET_BUNDLE_RECORD_LIMIT","DATASET_RESTORE_FIELDS","RECORD_RESTORE_FIELDS","restorable","fields","input","allowed","Set","out","key","value","Object","entries","has","undefined","bundleIds","items","ids","item","$id","add","String","datasetsOf","orgId","app","firestore","collection","doc","exportSiteDatasets","hostId","limit","snapshot","get","live","docs","filter","Promise","all","map","data","visibleTo","_visibleTo","records","ref","id","record","siteDatasetsRefusal","org","bundled","size","Number","isFinite","held","select","existing","next","quota","upgradeRequired","addonPriceUsd","importSiteDatasets","request","write","stamps","scope","report","path","model","loadPluginSurfaces","Array","isArray","slice","errors","keys","length","push","datasetId","recordId"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,EACtBC,qBAAqB,EACrBC,gBAAgB,QACX,wCAAuC;AAC9C,SAASC,iBAAiB,QAAQ,2CAA0C;AAC5E,SAASC,cAAc,EAAEC,sBAAsB,QAAQ,sCAAqC;AAQ5F,SAASC,aAAa,EAAEC,YAAY,QAAQ,2BAA0B;AACtE,SAASC,oBAAoB,QAAQ,kCAA8B;AAEnE;;;;;;;;CAQC,GAED,qFAAqF,GACrF,OAAO,MAAMC,8BAA8B,KAAI;AAE/C;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA4C;IACvD;IACA,mEAAmE;IACnE;IACA;IACA,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,kDAAkD;IAClD;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,wBAA2C;IAAC;IAAU;CAAQ,CAAA;AAE3E,0EAA0E,GAC1E,SAASC,WAAWC,MAAyB,EAAEC,KAAqB;IAClE,MAAMC,UAAU,IAAIC,IAAIH;IACxB,MAAMI,MAA+B,CAAC;IACtC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACP,gBAAAA,QAAS,CAAC,GAAI;QACtD,+DAA+D;QAC/D,IAAIC,QAAQO,GAAG,CAACJ,QAAQC,UAAUI,WAAWN,GAAG,CAACC,IAAI,GAAGC;IAC1D;IACA,OAAOF;AACT;AAEA,2FAA2F,GAC3F,SAASO,UAAUC,KAAgC;IACjD,MAAMC,MAAM,IAAIV;IAChB,KAAK,MAAMW,QAAQF,MAAO,IAAIE,wBAAAA,KAAMC,GAAG,EAAEF,IAAIG,GAAG,CAACC,OAAOH,KAAKC,GAAG;IAChE,OAAOF;AACT;AAEA,MAAMK,aAAa,CAACC,QAClB1B,cAAc2B,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,QAAQC,GAAG,CAACJ,OAAOG,UAAU,CAAC;AAE3E;;;;;;;;;;;CAWC,GACD,OAAO,eAAeE,mBAAmB,EACvCC,MAAM,EACNN,KAAK,EACLO,KAAK,EACa;IAClB,IAAI,CAACP,OAAO,OAAO,EAAE;IACrB,MAAMQ,WAAW,MAAMjC,aAAawB,WAAWC,QAAQM,QAAQC,KAAK,CAACA,OAAOE,GAAG;IAC/E,MAAMC,OAAOF,SAASG,IAAI,CAACC,MAAM,CAAC,CAACR,MAAQ,CAACA,IAAIK,GAAG,CAAC;IACpD,OAAOI,QAAQC,GAAG,CAChBJ,KAAKK,GAAG,CAAC,OAAOX;QACd,MAA2CA,YAAAA,IAAIY,IAAI,IAA7C,EAAEC,WAAWC,UAAU,EAAW,GAAGd,WAATY,wCAASZ;;;QAC3C,MAAMe,UAAU,MAAMf,IAAIgB,GAAG,CAACjB,UAAU,CAAC,WAAWI,KAAK,CAAC9B,6BAA6BgC,GAAG;QAC1F,OAAO;YACLb,KAAKQ,IAAIiB,EAAE;WACRL;YACHG,SAASA,QAAQR,IAAI,CAACI,GAAG,CAAC,CAACO,SAAY;oBAAE1B,KAAK0B,OAAOD,EAAE;mBAAKC,OAAON,IAAI;;IAE3E;AAEJ;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeO,oBAAoB,EACxCvB,KAAK,EACLwB,GAAG,EACH/B,KAAK,EACoB;IACzB,MAAMgC,UAAUjC,UAAUC;IAC1B,IAAI,CAACO,SAAS,CAACyB,QAAQC,IAAI,EAAE,OAAO;IACpC,IAAI,CAACC,OAAOC,QAAQ,CAACzD,kBAAkBqD,KAAY,GAAGjB,KAAK,GAAG,OAAO;IAErE,iEAAiE;IACjE,MAAMsB,OAAO,MAAM9B,WAAWC,OAAO8B,MAAM,GAAGrB,GAAG;IACjD,MAAMsB,WAAW,IAAI/C,IAAI6C,KAAKlB,IAAI,CAACI,GAAG,CAAC,CAACX,MAAQA,IAAIiB,EAAE;IACtD,MAAMW,OAAO,IAAIhD,IAAI;WAAI+C;WAAaN;KAAQ,EAAEC,IAAI;IACpD,2EAA2E;IAC3E,iEAAiE;IACjE,MAAMO,QAAQ9D,kBAAkBqD,KAAYQ,OAAO;IACnD,IAAIA,QAAQD,SAASL,IAAI,IAAIO,MAAMlD,OAAO,EAAE,OAAO;IAEnD,OACE,CAAC,kBAAkB,EAAE0C,QAAQC,IAAI,CAAC,6BAA6B,CAAC,GAChE,CAAC,IAAI,EAAEK,SAASL,IAAI,CAAC,wBAAwB,EAAEM,KAAK,IAAI,EAAEC,MAAM1B,KAAK,CAAC,CAAC,CAAC,GACxE,sCACC0B,CAAAA,MAAMC,eAAe,GAClB,wBACA,CAAC,wBAAwB,EAAED,MAAME,aAAa,CAAC,aAAa,CAAC,GAC7D,qBAAoB;AAE5B;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,mBACpBC,OAAgC;IAEhC,MAAM,EAAE/B,MAAM,EAAEN,KAAK,EAAEP,KAAK,EAAE6C,KAAK,EAAEC,MAAM,EAAE,GAAGF;IAChD,IAAI,CAACrC,OAAO,OAAO,EAAE;IACrB,yEAAyE;IACzE,kEAAkE;IAClE,MAAMwC,QAAQnE,uBAAuB;QAACD,eAAekC;KAAQ;IAC7D,MAAMmC,SAAgC,EAAE;IACxC,KAAK,MAAM9C,QAAQF,MAAO;QACxB,IAAI,EAACE,wBAAAA,KAAMC,GAAG,GAAE;QAChB,MAAM8C,OAAO,CAAC,KAAK,EAAE1C,MAAM,UAAU,EAAEF,OAAOH,KAAKC,GAAG,GAAG;QACzD,MAAM0C,MAAMI,MAAM,aAAK9D,WAAWF,wBAAwBiB,OAAU4C,UAAaC;QACjF,MAAMG,QAAQ1E,sBAAsB0B;QACpC,MAAMnB,qBAAqBmE,OAAON,QAAQO,kBAAkB;QAC5D,MAAMzB,UAA4B0B,MAAMC,OAAO,CAACnD,IAAI,CAAC,UAAU,IAAIA,IAAI,CAAC,UAAU,GAAG,EAAE;QACvF,KAAK,MAAM2B,UAAUH,QAAQ4B,KAAK,CAAC,GAAGtE,6BAA8B;gBAE3B6C,gBAaJA;YAdnC,IAAI,EAACA,0BAAAA,OAAQ1B,GAAG,GAAE;YAClB,MAAMoD,SAAS9E,iBAAiByE,QAAOrB,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,CAAC;YAC5D,IAAIlC,OAAO6D,IAAI,CAACD,QAAQE,MAAM,EAAE;gBAC9BT,OAAOU,IAAI,CAAC;oBAAEC,WAAWtD,OAAOH,KAAKC,GAAG;oBAAGyD,UAAUvD,OAAOwB,OAAO1B,GAAG;oBAAGoD;gBAAO;YAClF;YACA,MAAMV,MAAM,GAAGI,KAAK,SAAS,EAAE5C,OAAOwB,OAAO1B,GAAG,GAAG,EAAE,aAChDhB,WAAWD,uBAAuB2C,SAClCiB,UAOAvE,uBAAuB2E,QAAOrB,kBAAAA,MAAM,CAAC,SAAS,YAAhBA,kBAAoB,CAAC;QAE1D;IACF;IACA,OAAOmB;AACT"}
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/site-bundle/datasets-site-bundle.server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkDatasetQuota } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport { hostScopeToken, newResourceScopeFields } from '@aglyn/aglyn/app-utils/scope-tokens'\nimport type {\n  SiteBundleImportRequest,\n  SiteBundleItem,\n  SiteBundleReportRow,\n  SiteBundleRequest,\n  SiteBundleRestoreRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-site-bundle'\nimport { firebaseAdmin, scopedToHost } from '@aglyn/tenant-data-admin'\nimport { loadCustomFieldTypes } from '../server/custom-field-types'\nimport { datasetIntegrityFields, effectiveDatasetModel, validateDocument } from '../model/dataset-models'\n\n/**\n * A site's datasets in its whole-site backup (AGL-163), answered by the plugin\n * that keeps them (AGL-3080).\n *\n * Datasets are ORG-owned (AGL-237) and shared with sites by scope, so a site's\n * backup carries the datasets that site may see (AGL-1046) — each with its\n * records — and a restore writes them back into the owning organization,\n * scoped to the site it restores into.\n */\n\n/** The records one dataset carries in a bundle, and the most a restore writes back. */\nexport const DATASET_BUNDLE_RECORD_LIMIT = 1000\n\n/**\n * The keys a restore writes back on a dataset (AGL-1382): every key a live\n * dataset carries, because the restore writes with `merge: false` and a key\n * left off is ERASED. `visibleTo` is never on it — the restore assigns a fresh\n * scope for the site it restores into, since a bundle is portable and an\n * embedded `['org']` would publish one organization's data across another's\n * whole client roster.\n */\nexport const DATASET_RESTORE_FIELDS: readonly string[] = [\n  'displayName',\n  // Pre-AGL-536 human name, still read as a fallback by site search.\n  'name',\n  'fields',\n  // The typed DatasetModel, and exactly what `effectiveDatasetModel` reads\n  // below. Drop it and every restored dataset silently degrades to the\n  // derived all-text v1 model, losing types, `required`, `validation`,\n  // `default` and every `reference` link (AGL-180).\n  'model',\n  'names',\n  'description',\n  'source',\n  'installedFrom',\n  'detachedFrom',\n]\n\n/**\n * The keys a restore writes back on a record. `order` is what\n * `sortDatasetRecords` sorts by, so dropping it reorders every repeatable on\n * the restored site. The integrity index is DERIVED on the way in, never\n * carried (see {@link importSiteDatasets}).\n */\nexport const RECORD_RESTORE_FIELDS: readonly string[] = ['values', 'order']\n\n/** One of a bundle's documents, reduced to the keys a restore may write. */\nfunction restorable(fields: readonly string[], input: SiteBundleItem): Record<string, unknown> {\n  const allowed = new Set(fields)\n  const out: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(input ?? {})) {\n    // Only `undefined` is absence — Firestore rejects it outright.\n    if (allowed.has(key) && value !== undefined) out[key] = value\n  }\n  return out\n}\n\n/** The ids a bundle would write — distinct, since two items sharing one are one document. */\nfunction bundleIds(items: readonly SiteBundleItem[]): Set<string> {\n  const ids = new Set<string>()\n  for (const item of items) if (item?.$id) ids.add(String(item.$id))\n  return ids\n}\n\nconst datasetsOf = (orgId: string) =>\n  firebaseAdmin.app().firestore().collection('orgs').doc(orgId).collection('datasets')\n\n/**\n * The site's share: the datasets the site may see, each with its records.\n *\n * A site with no organization genuinely has no datasets — a known-empty\n * answer. Everything else THROWS: a catch-all would ship a silently empty,\n * still-successful \"backup\" that nobody discovers until they restore it. An\n * export that fails loudly is recoverable; one that lies is not.\n *\n * `visibleTo` is stripped on the way out. Its `host:` tokens name sites of\n * THIS organization, so they are noise at best and a dangling reference once\n * the bundle is restored elsewhere; the restore assigns a fresh scope.\n */\nexport async function exportSiteDatasets({\n  hostId,\n  orgId,\n  limit,\n}: SiteBundleRequest): Promise<SiteBundleItem[]> {\n  if (!orgId) return []\n  const snapshot = await scopedToHost(datasetsOf(orgId), hostId).limit(limit).get()\n  const live = snapshot.docs.filter((doc) => !doc.get('deletedAt'))\n  return Promise.all(\n    live.map(async (doc) => {\n      const { visibleTo: _visibleTo, ...data } = doc.data()\n      const records = await doc.ref.collection('records').limit(DATASET_BUNDLE_RECORD_LIMIT).get()\n      return {\n        $id: doc.id,\n        ...data,\n        records: records.docs.map((record) => ({ $id: record.id, ...record.data() })),\n      }\n    }),\n  )\n}\n\n/**\n * Refuse a bundle that would put the workspace over the datasets it may hold\n * (AGL-1403) — decided before the restore writes anything.\n *\n * Datasets are SOLD: the plan includes some and the workspace buys more as\n * add-ons, so `checkDatasetQuota` decides, never the plan's included number —\n * a workspace that paid for extra datasets is entitled to them, and refusing\n * its own backup after taking its money for the room would be wrong.\n *\n * A restore is identified by id COLLISION, never by the bundle's own claim of\n * where it came from (an unsigned string in a file the metered party\n * uploads). The meter is per organization, so a collision here means the\n * WORKSPACE already holds the dataset: restoring into a sibling site of the\n * same workspace rewrites datasets it already pays for and raises nothing,\n * while a copy into a different workspace collides on nothing and is refused\n * when it lands that workspace over. What is refused is the RAISE, never the\n * state of being over — a workspace already over its limit may still restore\n * its own backup.\n */\nexport async function siteDatasetsRefusal({\n  orgId,\n  org,\n  items,\n}: SiteBundleRestoreRequest): Promise<string | null> {\n  const bundled = bundleIds(items)\n  if (!orgId || !bundled.size) return null\n  if (!Number.isFinite(checkDatasetQuota(org as any, 0).limit)) return null\n\n  // A field mask with no fields projects to the document id alone.\n  const held = await datasetsOf(orgId).select().get()\n  const existing = new Set(held.docs.map((doc) => doc.id))\n  const next = new Set([...existing, ...bundled]).size\n  // `allowed` asks \"may I add one more to N\", so the post state N is checked\n  // as `N - 1` — the idiom the dataset routes' own bulk paths use.\n  const quota = checkDatasetQuota(org as any, next - 1)\n  if (next <= existing.size || quota.allowed) return null\n\n  return (\n    `This backup holds ${bundled.size} datasets and this workspace ` +\n    `has ${existing.size}, which would put it at ${next} of ${quota.limit} ` +\n    'datasets. Nothing was imported — ' +\n    (quota.upgradeRequired\n      ? 'upgrade in Billing.'\n      : `add extra datasets for $${quota.addonPriceUsd}/mo each, or ` +\n        'upgrade in Billing.')\n  )\n}\n\n/**\n * Writes the bundle's datasets into the owning organization, scoped to the\n * site restored into (AGL-237, AGL-1046), each with its records.\n *\n * Non-conforming records are restored AND reported (AGL-182): data is never\n * silently dropped, and the report tells the owner what to fix. A bundle from\n * before typed models validates through the derived text model, as the live\n * migration does, so everything in it passes.\n */\nexport async function importSiteDatasets(\n  request: SiteBundleImportRequest,\n): Promise<SiteBundleReportRow[]> {\n  const { hostId, orgId, items, write, stamps } = request\n  if (!orgId) return []\n  // Through the scoped-create gate (AGL-1478, AGL-1484): a restore CREATES\n  // datasets, and a dataset is born scoped to the site it lands in.\n  const scope = newResourceScopeFields([hostScopeToken(hostId)])\n  const report: SiteBundleReportRow[] = []\n  for (const item of items) {\n    if (!item?.$id) continue\n    const path = `orgs/${orgId}/datasets/${String(item.$id)}`\n    await write(path, { ...restorable(DATASET_RESTORE_FIELDS, item), ...stamps(), ...scope })\n    const model = effectiveDatasetModel(item)\n    await loadCustomFieldTypes(model, request.loadPluginSurfaces)\n    const records: SiteBundleItem[] = Array.isArray(item['records']) ? item['records'] : []\n    for (const record of records.slice(0, DATASET_BUNDLE_RECORD_LIMIT)) {\n      if (!record?.$id) continue\n      const errors = validateDocument(model, record['values'] ?? {})\n      if (Object.keys(errors).length) {\n        report.push({ datasetId: String(item.$id), recordId: String(record.$id), errors })\n      }\n      await write(`${path}/records/${String(record.$id)}`, {\n        ...restorable(RECORD_RESTORE_FIELDS, record),\n        ...stamps(),\n        // DERIVED here rather than carried in the bundle. The integrity\n        // index the delete check queries must describe the values just\n        // restored, and a bundle written before the field existed carries\n        // none — accepting the bundle's copy would restore records the check\n        // cannot reach. Records keep their original ids, so the ids it holds\n        // still resolve.\n        ...datasetIntegrityFields(model, record['values'] ?? {}),\n      })\n    }\n  }\n  return report\n}\n"],"names":["checkDatasetQuota","hostScopeToken","newResourceScopeFields","firebaseAdmin","scopedToHost","loadCustomFieldTypes","datasetIntegrityFields","effectiveDatasetModel","validateDocument","DATASET_BUNDLE_RECORD_LIMIT","DATASET_RESTORE_FIELDS","RECORD_RESTORE_FIELDS","restorable","fields","input","allowed","Set","out","key","value","Object","entries","has","undefined","bundleIds","items","ids","item","$id","add","String","datasetsOf","orgId","app","firestore","collection","doc","exportSiteDatasets","hostId","limit","snapshot","get","live","docs","filter","Promise","all","map","data","visibleTo","_visibleTo","records","ref","id","record","siteDatasetsRefusal","org","bundled","size","Number","isFinite","held","select","existing","next","quota","upgradeRequired","addonPriceUsd","importSiteDatasets","request","write","stamps","scope","report","path","model","loadPluginSurfaces","Array","isArray","slice","errors","keys","length","push","datasetId","recordId"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,iBAAiB,QAAQ,2CAA0C;AAC5E,SAASC,cAAc,EAAEC,sBAAsB,QAAQ,sCAAqC;AAQ5F,SAASC,aAAa,EAAEC,YAAY,QAAQ,2BAA0B;AACtE,SAASC,oBAAoB,QAAQ,kCAA8B;AACnE,SAASC,sBAAsB,EAAEC,qBAAqB,EAAEC,gBAAgB,QAAQ,6BAAyB;AAEzG;;;;;;;;CAQC,GAED,qFAAqF,GACrF,OAAO,MAAMC,8BAA8B,KAAI;AAE/C;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA4C;IACvD;IACA,mEAAmE;IACnE;IACA;IACA,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,kDAAkD;IAClD;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,wBAA2C;IAAC;IAAU;CAAQ,CAAA;AAE3E,0EAA0E,GAC1E,SAASC,WAAWC,MAAyB,EAAEC,KAAqB;IAClE,MAAMC,UAAU,IAAIC,IAAIH;IACxB,MAAMI,MAA+B,CAAC;IACtC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACP,gBAAAA,QAAS,CAAC,GAAI;QACtD,+DAA+D;QAC/D,IAAIC,QAAQO,GAAG,CAACJ,QAAQC,UAAUI,WAAWN,GAAG,CAACC,IAAI,GAAGC;IAC1D;IACA,OAAOF;AACT;AAEA,2FAA2F,GAC3F,SAASO,UAAUC,KAAgC;IACjD,MAAMC,MAAM,IAAIV;IAChB,KAAK,MAAMW,QAAQF,MAAO,IAAIE,wBAAAA,KAAMC,GAAG,EAAEF,IAAIG,GAAG,CAACC,OAAOH,KAAKC,GAAG;IAChE,OAAOF;AACT;AAEA,MAAMK,aAAa,CAACC,QAClB7B,cAAc8B,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,QAAQC,GAAG,CAACJ,OAAOG,UAAU,CAAC;AAE3E;;;;;;;;;;;CAWC,GACD,OAAO,eAAeE,mBAAmB,EACvCC,MAAM,EACNN,KAAK,EACLO,KAAK,EACa;IAClB,IAAI,CAACP,OAAO,OAAO,EAAE;IACrB,MAAMQ,WAAW,MAAMpC,aAAa2B,WAAWC,QAAQM,QAAQC,KAAK,CAACA,OAAOE,GAAG;IAC/E,MAAMC,OAAOF,SAASG,IAAI,CAACC,MAAM,CAAC,CAACR,MAAQ,CAACA,IAAIK,GAAG,CAAC;IACpD,OAAOI,QAAQC,GAAG,CAChBJ,KAAKK,GAAG,CAAC,OAAOX;QACd,MAA2CA,YAAAA,IAAIY,IAAI,IAA7C,EAAEC,WAAWC,UAAU,EAAW,GAAGd,WAATY,wCAASZ;;;QAC3C,MAAMe,UAAU,MAAMf,IAAIgB,GAAG,CAACjB,UAAU,CAAC,WAAWI,KAAK,CAAC9B,6BAA6BgC,GAAG;QAC1F,OAAO;YACLb,KAAKQ,IAAIiB,EAAE;WACRL;YACHG,SAASA,QAAQR,IAAI,CAACI,GAAG,CAAC,CAACO,SAAY;oBAAE1B,KAAK0B,OAAOD,EAAE;mBAAKC,OAAON,IAAI;;IAE3E;AAEJ;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,eAAeO,oBAAoB,EACxCvB,KAAK,EACLwB,GAAG,EACH/B,KAAK,EACoB;IACzB,MAAMgC,UAAUjC,UAAUC;IAC1B,IAAI,CAACO,SAAS,CAACyB,QAAQC,IAAI,EAAE,OAAO;IACpC,IAAI,CAACC,OAAOC,QAAQ,CAAC5D,kBAAkBwD,KAAY,GAAGjB,KAAK,GAAG,OAAO;IAErE,iEAAiE;IACjE,MAAMsB,OAAO,MAAM9B,WAAWC,OAAO8B,MAAM,GAAGrB,GAAG;IACjD,MAAMsB,WAAW,IAAI/C,IAAI6C,KAAKlB,IAAI,CAACI,GAAG,CAAC,CAACX,MAAQA,IAAIiB,EAAE;IACtD,MAAMW,OAAO,IAAIhD,IAAI;WAAI+C;WAAaN;KAAQ,EAAEC,IAAI;IACpD,2EAA2E;IAC3E,iEAAiE;IACjE,MAAMO,QAAQjE,kBAAkBwD,KAAYQ,OAAO;IACnD,IAAIA,QAAQD,SAASL,IAAI,IAAIO,MAAMlD,OAAO,EAAE,OAAO;IAEnD,OACE,CAAC,kBAAkB,EAAE0C,QAAQC,IAAI,CAAC,6BAA6B,CAAC,GAChE,CAAC,IAAI,EAAEK,SAASL,IAAI,CAAC,wBAAwB,EAAEM,KAAK,IAAI,EAAEC,MAAM1B,KAAK,CAAC,CAAC,CAAC,GACxE,sCACC0B,CAAAA,MAAMC,eAAe,GAClB,wBACA,CAAC,wBAAwB,EAAED,MAAME,aAAa,CAAC,aAAa,CAAC,GAC7D,qBAAoB;AAE5B;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeC,mBACpBC,OAAgC;IAEhC,MAAM,EAAE/B,MAAM,EAAEN,KAAK,EAAEP,KAAK,EAAE6C,KAAK,EAAEC,MAAM,EAAE,GAAGF;IAChD,IAAI,CAACrC,OAAO,OAAO,EAAE;IACrB,yEAAyE;IACzE,kEAAkE;IAClE,MAAMwC,QAAQtE,uBAAuB;QAACD,eAAeqC;KAAQ;IAC7D,MAAMmC,SAAgC,EAAE;IACxC,KAAK,MAAM9C,QAAQF,MAAO;QACxB,IAAI,EAACE,wBAAAA,KAAMC,GAAG,GAAE;QAChB,MAAM8C,OAAO,CAAC,KAAK,EAAE1C,MAAM,UAAU,EAAEF,OAAOH,KAAKC,GAAG,GAAG;QACzD,MAAM0C,MAAMI,MAAM,aAAK9D,WAAWF,wBAAwBiB,OAAU4C,UAAaC;QACjF,MAAMG,QAAQpE,sBAAsBoB;QACpC,MAAMtB,qBAAqBsE,OAAON,QAAQO,kBAAkB;QAC5D,MAAMzB,UAA4B0B,MAAMC,OAAO,CAACnD,IAAI,CAAC,UAAU,IAAIA,IAAI,CAAC,UAAU,GAAG,EAAE;QACvF,KAAK,MAAM2B,UAAUH,QAAQ4B,KAAK,CAAC,GAAGtE,6BAA8B;gBAE3B6C,gBAaJA;YAdnC,IAAI,EAACA,0BAAAA,OAAQ1B,GAAG,GAAE;YAClB,MAAMoD,SAASxE,iBAAiBmE,QAAOrB,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,CAAC;YAC5D,IAAIlC,OAAO6D,IAAI,CAACD,QAAQE,MAAM,EAAE;gBAC9BT,OAAOU,IAAI,CAAC;oBAAEC,WAAWtD,OAAOH,KAAKC,GAAG;oBAAGyD,UAAUvD,OAAOwB,OAAO1B,GAAG;oBAAGoD;gBAAO;YAClF;YACA,MAAMV,MAAM,GAAGI,KAAK,SAAS,EAAE5C,OAAOwB,OAAO1B,GAAG,GAAG,EAAE,aAChDhB,WAAWD,uBAAuB2C,SAClCiB,UAOAjE,uBAAuBqE,QAAOrB,kBAAAA,MAAM,CAAC,SAAS,YAAhBA,kBAAoB,CAAC;QAE1D;IACF;IACA,OAAOmB;AACT"}

package/src/lib/{model/index.js → tenant-api.d.ts}

@@ -13,10 +13,15 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ /**
- * Dataset io model (AGL-413): CSV serialize/parse for dataset records relocated from core app-utils.
- * Context-free — importable by client components, /server handlers, and
- * other plugins/apps via `@aglyn/plugins-data/model`.
- */ export * from "./dataset-io.js";
-
-//# sourceMappingURL=index.js.map
+ */
+/**
+ * The data plugin's published-site surface (AGL-3475): record pages, served
+ * through the platform's site page resolver seam.
+ *
+ * Its own module (`modules.tenantApi` in `plugins.config.json`) rather than
+ * the package's `/server` entry, which carries the console's datasets
+ * handlers: the tenant loads this on every page render, and what it loads
+ * here is one registration. The resolver itself, and the Admin SDK reads
+ * behind it, load on the first request no published page claims.
+ */
+export declare function registerDataTenantApi(): void;

package/src/lib/tenant-api.js

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerSitePageResolver } from "@aglyn/aglyn/server";
+/**
+ * The data plugin's published-site surface (AGL-3475): record pages, served
+ * through the platform's site page resolver seam.
+ *
+ * Its own module (`modules.tenantApi` in `plugins.config.json`) rather than
+ * the package's `/server` entry, which carries the console's datasets
+ * handlers: the tenant loads this on every page render, and what it loads
+ * here is one registration. The resolver itself, and the Admin SDK reads
+ * behind it, load on the first request no published page claims.
+ */ export function registerDataTenantApi() {
+    registerSitePageResolver(async (context)=>(await import("./record-pages/record-page-resolver.server.js")).recordPageResolver(context));
+}
+
+//# sourceMappingURL=tenant-api.js.map

package/src/lib/tenant-api.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/data/src/lib/tenant-api.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { registerSitePageResolver } from '@aglyn/aglyn/server'\n\n/**\n * The data plugin's published-site surface (AGL-3475): record pages, served\n * through the platform's site page resolver seam.\n *\n * Its own module (`modules.tenantApi` in `plugins.config.json`) rather than\n * the package's `/server` entry, which carries the console's datasets\n * handlers: the tenant loads this on every page render, and what it loads\n * here is one registration. The resolver itself, and the Admin SDK reads\n * behind it, load on the first request no published page claims.\n */\nexport function registerDataTenantApi(): void {\n  registerSitePageResolver(async (context) =>\n    (await import('./record-pages/record-page-resolver.server')).recordPageResolver(\n      context,\n    ),\n  )\n}\n"],"names":["registerSitePageResolver","registerDataTenantApi","context","recordPageResolver"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,wBAAwB,QAAQ,sBAAqB;AAE9D;;;;;;;;;CASC,GACD,OAAO,SAASC;IACdD,yBAAyB,OAAOE,UAC9B,AAAC,CAAA,MAAM,MAAM,CAAC,gDAA4C,EAAGC,kBAAkB,CAC7ED;AAGN"}

package/src/lib/transfer/dataset-transfer-key.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The transfer resource a dataset's records move as (AGL-3530): declared once
+ * in `plugins.config.json` as `data.dataset` with `instances`, and reached
+ * per dataset as `data.dataset:<datasetId>` — so a job, a person's remembered
+ * export fields and the one-running-import rule each belong to one dataset.
+ *
+ * Its own module so the Data card can name a dataset's resource without
+ * loading the transfer core: the key is the core's instance key
+ * (`transferResourceInstanceKey` in `@aglyn/aglyn/data-transfer`), spelled out
+ * here, and `dataset-transfer-key.spec.ts` holds the two to the same answer.
+ */
+export declare const DATASET_TRANSFER_RESOURCE = "data.dataset";
+/** The resource key a dataset's records are imported and exported under. */
+export declare function datasetTransferResourceKey(datasetId: string): string;

package/src/lib/transfer/dataset-transfer-key.js

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The transfer resource a dataset's records move as (AGL-3530): declared once
+ * in `plugins.config.json` as `data.dataset` with `instances`, and reached
+ * per dataset as `data.dataset:<datasetId>` — so a job, a person's remembered
+ * export fields and the one-running-import rule each belong to one dataset.
+ *
+ * Its own module so the Data card can name a dataset's resource without
+ * loading the transfer core: the key is the core's instance key
+ * (`transferResourceInstanceKey` in `@aglyn/aglyn/data-transfer`), spelled out
+ * here, and `dataset-transfer-key.spec.ts` holds the two to the same answer.
+ */ export const DATASET_TRANSFER_RESOURCE = 'data.dataset';
+/** The resource key a dataset's records are imported and exported under. */ export function datasetTransferResourceKey(datasetId) {
+    return `${DATASET_TRANSFER_RESOURCE}:${datasetId}`;
+}
+
+//# sourceMappingURL=dataset-transfer-key.js.map

package/src/lib/transfer/dataset-transfer-key.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/data/src/lib/transfer/dataset-transfer-key.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The transfer resource a dataset's records move as (AGL-3530): declared once\n * in `plugins.config.json` as `data.dataset` with `instances`, and reached\n * per dataset as `data.dataset:<datasetId>` — so a job, a person's remembered\n * export fields and the one-running-import rule each belong to one dataset.\n *\n * Its own module so the Data card can name a dataset's resource without\n * loading the transfer core: the key is the core's instance key\n * (`transferResourceInstanceKey` in `@aglyn/aglyn/data-transfer`), spelled out\n * here, and `dataset-transfer-key.spec.ts` holds the two to the same answer.\n */\nexport const DATASET_TRANSFER_RESOURCE = 'data.dataset'\n\n/** The resource key a dataset's records are imported and exported under. */\nexport function datasetTransferResourceKey(datasetId: string): string {\n  return `${DATASET_TRANSFER_RESOURCE}:${datasetId}`\n}\n"],"names":["DATASET_TRANSFER_RESOURCE","datasetTransferResourceKey","datasetId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMA,4BAA4B,eAAc;AAEvD,0EAA0E,GAC1E,OAAO,SAASC,2BAA2BC,SAAiB;IAC1D,OAAO,GAAGF,0BAA0B,CAAC,EAAEE,WAAW;AACpD"}

package/src/lib/transfer/dataset-transfer-model.d.ts

@@ -0,0 +1,146 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type MatchKeySpec, type PlannedTransferRow, type TransferCatalogInput, type TransferField, type TransferFieldType, type TransferPlan } from '@aglyn/aglyn/data-transfer';
+import type { PicklistSpec, PicklistValueSet } from '@aglyn/aglyn/app-utils/picklists';
+import type { TransferMatchKeyOffer } from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources';
+import { type DatasetFieldDefinition, type DatasetModel } from '../model/dataset-models';
+/** The group a dataset's own fields are listed under. */
+export declare const DATASET_TRANSFER_FIELDS_GROUP = "fields";
+/** The record's created time, exported and never written. */
+export declare const DATASET_TRANSFER_CREATED_FIELD = "record:createdAt";
+/** The record's last-updated time, exported and never written. */
+export declare const DATASET_TRANSFER_UPDATED_FIELD = "record:updatedAt";
+/** A dataset field's id in the catalog. */
+export declare function datasetTransferFieldId(fieldId: string): string;
+/** The dataset field a catalog id names, or `null` for the Aglyn ID and the record's times. */
+export declare function datasetFieldIdOf(transferFieldId: string): string | null;
+/** The picklist a text field with a fixed list of options is matched against. */
+export declare function datasetOptionsPicklistId(fieldId: string): string;
+/** The field a picklist id from {@link datasetOptionsPicklistId} belongs to, or `null`. */
+export declare function datasetFieldOfPicklist(picklistId: string): string | null;
+/** A text field whose values must be one of its options. */
+export declare function isOptionsField(field: DatasetFieldDefinition | undefined): boolean;
+/** A field a file may write: everything but the bytes and null placeholders, which hold nothing a cell can say. */
+export declare function isWritableDatasetField(field: DatasetFieldDefinition | undefined): boolean;
+/** What a dataset field means to the wizard. */
+export declare function datasetTransferType(field: DatasetFieldDefinition): TransferFieldType;
+/**
+ * What the person may do with a reference's target dataset, as the server
+ * read it for them: a reference to a dataset they cannot see is exported by
+ * ID and never imported, since nothing in it could be looked up.
+ */
+export interface DatasetReferenceTarget {
+    readable: boolean;
+    /** The target's model, when it is readable: whether the import may create a record in it by name. */
+    model?: DatasetModel;
+}
+/**
+ * Whether the target's model accepts a record holding nothing but a name in
+ * `displayFieldId` (its page addresses filled in from it): the display field
+ * is plain text and no other field is required. Each name is still held to
+ * the model when the import creates it.
+ */
+export declare function datasetAcceptsNamedRecord(model: DatasetModel, displayFieldId: string | undefined): boolean;
+/**
+ * One dataset field as the catalog lists it. `target` is what the server read
+ * of a reference's target dataset; without it a reference is a lookup that
+ * creates nothing.
+ */
+export declare function datasetTransferField(fieldId: string, field: DatasetFieldDefinition, target?: DatasetReferenceTarget): TransferField;
+/**
+ * The dataset's catalog: its fields in the dataset's order under one group
+ * (named after the dataset when `label` is given), then the record's Aglyn ID (added by the core) and its created and updated
+ * times. `targets` is what the server read of each referenced dataset, by id.
+ */
+export declare function datasetTransferCatalog(model: DatasetModel, label?: string, targets?: Readonly<Record<string, DatasetReferenceTarget>>): TransferCatalogInput;
+/** An options field's values as a picklist the values step can match against. */
+export declare function datasetOptionsPicklist(field: DatasetFieldDefinition): {
+    spec: PicklistSpec;
+    set: PicklistValueSet;
+};
+/**
+ * A stored record as transfer values, by catalog id: every field the model
+ * lists that the record holds, its Aglyn ID, and its created and updated
+ * times when it carries them. A field the record does not hold is absent,
+ * which the plan reads as blank.
+ */
+export declare function datasetRecordTransferValues(model: DatasetModel, record: {
+    id?: string;
+    values?: Readonly<Record<string, unknown>> | null;
+    createdAt?: unknown;
+    updatedAt?: unknown;
+}): Record<string, unknown>;
+/**
+ * Transfer values in storage form, through `coerceDocumentValues` — the
+ * coercion every record write runs. `values` holds what is written and
+ * `cleared` the fields a blank value empties. The Aglyn ID, the record's
+ * times, unknown ids and fields a file never writes are ignored.
+ */
+export declare function datasetStorageValues(model: DatasetModel, transfer: Readonly<Record<string, unknown>>): {
+    values: Record<string, unknown>;
+    cleared: string[];
+};
+/** How a dataset field compares as a match key, or `null` for one no query can find a record by. */
+export declare function datasetMatchKeyFor(fieldId: string, field: DatasetFieldDefinition | undefined): MatchKeySpec | null;
+/**
+ * The keys a row may find its record by: the Aglyn ID, then every text and
+ * number field the records' filter values can be asked by, in the dataset's
+ * order. A person starts with the Aglyn ID and the dataset's page address —
+ * the one field a dataset holds unique — and may add any other.
+ */
+export declare function datasetMatchKeyOffer(model: DatasetModel): TransferMatchKeyOffer;
+/**
+ * The `filterValues` equality that finds the records holding a normalized
+ * key value: the path, and the value as the records store it. Plain text is
+ * stored as its lower-cased key clipped to 64 characters, so two long values
+ * can share it; the caller compares what it found against the whole value.
+ */
+export declare function datasetMatchKeyQuery(model: DatasetModel, key: MatchKeySpec, normalized: string): {
+    path: string;
+    value: string | number;
+} | null;
+/** Whether a record's transfer values hold a normalized key value — the check a clipped query answer is held to. */
+export declare function datasetHoldsKey(view: Readonly<Record<string, unknown>>, key: MatchKeySpec, normalized: string): boolean;
+/** Field id → message, for the fields a write of these values would refuse. */
+export declare function datasetWriteErrors(model: DatasetModel, values: Record<string, unknown>, only?: ReadonlySet<string>): Record<string, string>;
+/**
+ * The values a planned row leaves a record holding, in storage form: a new
+ * record's from the row alone, an existing one's from what it holds now
+ * (`before`, transfer values) with the row's changes over it. Page addresses
+ * are filled in as every record write fills them. `changed` names the dataset
+ * fields the row writes.
+ */
+export declare function datasetPlannedValues(model: DatasetModel, row: Pick<PlannedTransferRow, 'verdict' | 'diff'>, before: Readonly<Record<string, unknown>> | null | undefined): {
+    values: Record<string, unknown>;
+    changed: Set<string>;
+};
+/**
+ * The plan with every row the model would refuse failed, naming the fields
+ * (`missing`, read with the reason "A value refuses the row"): a value outside
+ * a field's options, past its bounds, not matching its pattern, or refused by
+ * a custom field type's validator. An update is held only on the fields it
+ * writes, so a record stored before a rule existed is not refused for a value
+ * the file never touched.
+ */
+export declare function refuseInvalidDatasetRows(model: DatasetModel, plan: TransferPlan, existing: ReadonlyMap<string, Readonly<Record<string, unknown>>>): TransferPlan;
+/**
+ * The plan with every new record past `maxCreates` failed as past what the
+ * plan allows, under the `planLimit` warning the person acknowledges. Run
+ * after {@link refuseInvalidDatasetRows}, so a row the model refuses never
+ * takes the room a valid row could have had.
+ */
+export declare function limitDatasetCreates(plan: TransferPlan, maxCreates: number | undefined): TransferPlan;