@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/hooks/use-artifact-update.js

@@ -0,0 +1,169 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { lockdownRefusalText, parseLockdownRefusal } from "@aglyn/aglyn";
+import { useLoading } from "@aglyn/shared-ui-jsx";
+import { useSnackbar } from "@aglyn/shared-ui-snackstack";
+import { useCallback, useState } from "react";
+import { useUser } from "@aglyn/tenant-feature-instance";
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+/**
+ * Preview-then-apply for a copied artifact (AGL-1018).
+ *
+ * Deliberately separate from `useMarketplaceActions`: install writes the
+ * publisher's version, and an update reconciles it with a copy that has
+ * diverged. Sharing one call would put the destructive path one forgotten
+ * argument away from the safe one.
+ */ export function useArtifactUpdate(hostId) {
+    const { data: user } = useUser();
+    const { enqueueSnackbar } = useSnackbar();
+    const { queueLoading } = useLoading();
+    const [preview, setPreview] = useState(null);
+    const [loading, setLoading] = useState(false);
+    const post = useCallback(async (listingId, body)=>{
+        const response = await authorizedFetch(user, '/api/marketplace/update-artifact', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(_extends({
+                listingId,
+                hostId
+            }, body))
+        });
+        return {
+            response,
+            payload: await response.json().catch(()=>({}))
+        };
+    }, [
+        user,
+        hostId
+    ]);
+    /** Ask what an update would do. Writes nothing. */ const loadPreview = useCallback(async (listingId)=>{
+        setLoading(true);
+        setPreview(null);
+        try {
+            const { response, payload } = await post(listingId, {
+                action: 'preview'
+            });
+            if (!response.ok) {
+                var _ref;
+                // `update-artifact` is an install by another name, so an installs
+                // lock refuses it (AGL-1510/1532) — say "paused", not "could not
+                // read this update", which reads as a corrupt listing.
+                const locked = parseLockdownRefusal(response.status, payload);
+                if (locked) {
+                    enqueueSnackbar(lockdownRefusalText(locked), {
+                        variant: 'warning',
+                        persist: true
+                    });
+                    return null;
+                }
+                enqueueSnackbar((_ref = payload == null ? void 0 : payload.error) != null ? _ref : 'Could not read this update', {
+                    variant: 'error',
+                    allowDuplicate: true
+                });
+                return null;
+            }
+            setPreview(payload.preview);
+            return payload.preview;
+        } catch (error) {
+            console.error(error);
+            enqueueSnackbar('An error has occurred', {
+                variant: 'error',
+                allowDuplicate: true
+            });
+            return null;
+        } finally{
+            setLoading(false);
+        }
+    }, [
+        post,
+        enqueueSnackbar
+    ]);
+    /**
+   * Write the update. `mode: 'merge'` takes the safe changes plus whatever
+   * conflicts were explicitly picked; `mode: 'copy'` installs the new version
+   * fresh and detaches the customised one.
+   */ const applyUpdate = useCallback(async (listingId, options)=>{
+        const dequeue = queueLoading();
+        try {
+            const { response, payload } = await post(listingId, _extends({
+                action: 'apply'
+            }, options));
+            if (!response.ok) {
+                var _ref;
+                const locked = parseLockdownRefusal(response.status, payload);
+                if (locked) {
+                    enqueueSnackbar(lockdownRefusalText(locked), {
+                        variant: 'warning',
+                        persist: true
+                    });
+                    return false;
+                }
+                enqueueSnackbar((_ref = payload == null ? void 0 : payload.error) != null ? _ref : 'Update failed', {
+                    variant: (payload == null ? void 0 : payload.needsConfirmation) ? 'warning' : 'error',
+                    allowDuplicate: true
+                });
+                return false;
+            }
+            if (options.mode === 'copy') {
+                enqueueSnackbar(`Installed v${payload.version} as a new copy — your customized ` + 'version is kept, no longer linked to the listing.', {
+                    variant: 'success',
+                    persist: false
+                });
+            } else {
+                var _ref1;
+                var _payload_skipped;
+                // The summary is the point of the whole flow: it says what moved and,
+                // just as importantly, what was left alone.
+                const skipped = (_ref1 = (_payload_skipped = payload.skipped) == null ? void 0 : _payload_skipped.length) != null ? _ref1 : 0;
+                enqueueSnackbar(// A version bump carrying no content change (AGL-1035). "0 changes
+                // applied" would read as a failure; what happened is that the
+                // version moved, which is the whole point of taking it.
+                !payload.applied && !payload.keptLocal && !skipped ? `Now on v${payload.version} — this version changes nothing in your copy.` : `Updated to v${payload.version} — ${payload.applied} change(s) ` + `applied, ${payload.keptLocal} of yours kept` + (skipped ? `, ${skipped} conflict(s) left as yours` : '') + '.', {
+                    variant: 'success',
+                    persist: false
+                });
+            }
+            return true;
+        } catch (error) {
+            console.error(error);
+            enqueueSnackbar('An error has occurred', {
+                variant: 'error',
+                allowDuplicate: true
+            });
+            return false;
+        } finally{
+            dequeue();
+        }
+    }, [
+        post,
+        queueLoading,
+        enqueueSnackbar
+    ]);
+    return {
+        preview,
+        loading,
+        loadPreview,
+        applyUpdate,
+        setPreview
+    };
+}
+export default useArtifactUpdate;
+
+//# sourceMappingURL=use-artifact-update.js.map

package/src/lib/hooks/use-artifact-update.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/hooks/use-artifact-update.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { lockdownRefusalText, parseLockdownRefusal } from '@aglyn/aglyn'\nimport { useLoading } from '@aglyn/shared-ui-jsx'\nimport { useSnackbar } from '@aglyn/shared-ui-snackstack'\nimport { useCallback, useState } from 'react'\nimport { useUser } from '@aglyn/tenant-feature-instance'\nimport { authorizedFetch } from '@aglyn/shared-util-http/authorized-token'\nimport type { ArtifactChange } from '../model'\n\n/** The server's answer to \"what would this update do to my copy?\" (AGL-1018). */\nexport interface ArtifactUpdatePreview {\n  artifactType: string\n  installedVersion: string | null\n  availableVersion: string | null\n  mergeable: boolean\n  reason?: string\n  safe: ArtifactChange[]\n  kept: ArtifactChange[]\n  conflicts: ArtifactChange[]\n  unchanged: number\n  identical: boolean\n  schema?: {\n    added: string[]\n    removed: string[]\n    retyped: string[]\n    additiveOnly: boolean\n    recordCount: number\n  }\n}\n\n/**\n * Preview-then-apply for a copied artifact (AGL-1018).\n *\n * Deliberately separate from `useMarketplaceActions`: install writes the\n * publisher's version, and an update reconciles it with a copy that has\n * diverged. Sharing one call would put the destructive path one forgotten\n * argument away from the safe one.\n */\nexport function useArtifactUpdate(hostId: string) {\n  const { data: user } = useUser()\n  const { enqueueSnackbar } = useSnackbar()\n  const { queueLoading } = useLoading()\n  const [preview, setPreview] = useState<ArtifactUpdatePreview | null>(null)\n  const [loading, setLoading] = useState(false)\n\n  const post = useCallback(\n    async (listingId: string, body: Record<string, unknown>) => {\n      const response = await authorizedFetch(\n        user,\n        '/api/marketplace/update-artifact',\n        {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ listingId, hostId, ...body }),\n        },\n      )\n      return { response, payload: await response.json().catch(() => ({})) }\n    },\n    [user, hostId],\n  )\n\n  /** Ask what an update would do. Writes nothing. */\n  const loadPreview = useCallback(\n    async (listingId: string) => {\n      setLoading(true)\n      setPreview(null)\n      try {\n        const { response, payload } = await post(listingId, {\n          action: 'preview',\n        })\n        if (!response.ok) {\n          // `update-artifact` is an install by another name, so an installs\n          // lock refuses it (AGL-1510/1532) — say \"paused\", not \"could not\n          // read this update\", which reads as a corrupt listing.\n          const locked = parseLockdownRefusal(response.status, payload)\n          if (locked) {\n            enqueueSnackbar(lockdownRefusalText(locked), {\n              variant: 'warning',\n              persist: true,\n            })\n            return null\n          }\n          enqueueSnackbar(payload?.error ?? 'Could not read this update', {\n            variant: 'error',\n            allowDuplicate: true,\n          })\n          return null\n        }\n        setPreview(payload.preview)\n        return payload.preview as ArtifactUpdatePreview\n      } catch (error) {\n        console.error(error)\n        enqueueSnackbar('An error has occurred', {\n          variant: 'error',\n          allowDuplicate: true,\n        })\n        return null\n      } finally {\n        setLoading(false)\n      }\n    },\n    [post, enqueueSnackbar],\n  )\n\n  /**\n   * Write the update. `mode: 'merge'` takes the safe changes plus whatever\n   * conflicts were explicitly picked; `mode: 'copy'` installs the new version\n   * fresh and detaches the customised one.\n   */\n  const applyUpdate = useCallback(\n    async (\n      listingId: string,\n      options: {\n        mode: 'merge' | 'copy'\n        takePaths?: string[]\n        confirmDestructive?: boolean\n      },\n    ): Promise<boolean> => {\n      const dequeue = queueLoading()\n      try {\n        const { response, payload } = await post(listingId, {\n          action: 'apply',\n          ...options,\n        })\n        if (!response.ok) {\n          const locked = parseLockdownRefusal(response.status, payload)\n          if (locked) {\n            enqueueSnackbar(lockdownRefusalText(locked), {\n              variant: 'warning',\n              persist: true,\n            })\n            return false\n          }\n          enqueueSnackbar(payload?.error ?? 'Update failed', {\n            variant: payload?.needsConfirmation ? 'warning' : 'error',\n            allowDuplicate: true,\n          })\n          return false\n        }\n        if (options.mode === 'copy') {\n          enqueueSnackbar(\n            `Installed v${payload.version} as a new copy — your customized ` +\n              'version is kept, no longer linked to the listing.',\n            { variant: 'success', persist: false },\n          )\n        } else {\n          // The summary is the point of the whole flow: it says what moved and,\n          // just as importantly, what was left alone.\n          const skipped = payload.skipped?.length ?? 0\n          enqueueSnackbar(\n            // A version bump carrying no content change (AGL-1035). \"0 changes\n            // applied\" would read as a failure; what happened is that the\n            // version moved, which is the whole point of taking it.\n            !payload.applied && !payload.keptLocal && !skipped\n              ? `Now on v${payload.version} — this version changes nothing in your copy.`\n              : `Updated to v${payload.version} — ${payload.applied} change(s) ` +\n                `applied, ${payload.keptLocal} of yours kept` +\n                (skipped ? `, ${skipped} conflict(s) left as yours` : '') +\n                '.',\n            { variant: 'success', persist: false },\n          )\n        }\n        return true\n      } catch (error) {\n        console.error(error)\n        enqueueSnackbar('An error has occurred', {\n          variant: 'error',\n          allowDuplicate: true,\n        })\n        return false\n      } finally {\n        dequeue()\n      }\n    },\n    [post, queueLoading, enqueueSnackbar],\n  )\n\n  return { preview, loading, loadPreview, applyUpdate, setPreview }\n}\n\nexport default useArtifactUpdate\n"],"names":["lockdownRefusalText","parseLockdownRefusal","useLoading","useSnackbar","useCallback","useState","useUser","authorizedFetch","useArtifactUpdate","hostId","data","user","enqueueSnackbar","queueLoading","preview","setPreview","loading","setLoading","post","listingId","body","response","method","headers","JSON","stringify","payload","json","catch","loadPreview","action","ok","locked","status","variant","persist","error","allowDuplicate","console","applyUpdate","options","dequeue","needsConfirmation","mode","version","skipped","length","applied","keptLocal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;AAEA,SAASA,mBAAmB,EAAEC,oBAAoB,QAAQ,eAAc;AACxE,SAASC,UAAU,QAAQ,uBAAsB;AACjD,SAASC,WAAW,QAAQ,8BAA6B;AACzD,SAASC,WAAW,EAAEC,QAAQ,QAAQ,QAAO;AAC7C,SAASC,OAAO,QAAQ,iCAAgC;AACxD,SAASC,eAAe,QAAQ,2CAA0C;AAwB1E;;;;;;;CAOC,GACD,OAAO,SAASC,kBAAkBC,MAAc;IAC9C,MAAM,EAAEC,MAAMC,IAAI,EAAE,GAAGL;IACvB,MAAM,EAAEM,eAAe,EAAE,GAAGT;IAC5B,MAAM,EAAEU,YAAY,EAAE,GAAGX;IACzB,MAAM,CAACY,SAASC,WAAW,GAAGV,SAAuC;IACrE,MAAM,CAACW,SAASC,WAAW,GAAGZ,SAAS;IAEvC,MAAMa,OAAOd,YACX,OAAOe,WAAmBC;QACxB,MAAMC,WAAW,MAAMd,gBACrBI,MACA,oCACA;YACEW,QAAQ;YACRC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CH,MAAMI,KAAKC,SAAS,CAAC;gBAAEN;gBAAWV;eAAWW;QAC/C;QAEF,OAAO;YAAEC;YAAUK,SAAS,MAAML,SAASM,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;QAAI;IACtE,GACA;QAACjB;QAAMF;KAAO;IAGhB,iDAAiD,GACjD,MAAMoB,cAAczB,YAClB,OAAOe;QACLF,WAAW;QACXF,WAAW;QACX,IAAI;YACF,MAAM,EAAEM,QAAQ,EAAEK,OAAO,EAAE,GAAG,MAAMR,KAAKC,WAAW;gBAClDW,QAAQ;YACV;YACA,IAAI,CAACT,SAASU,EAAE,EAAE;;gBAChB,kEAAkE;gBAClE,iEAAiE;gBACjE,uDAAuD;gBACvD,MAAMC,SAAS/B,qBAAqBoB,SAASY,MAAM,EAAEP;gBACrD,IAAIM,QAAQ;oBACVpB,gBAAgBZ,oBAAoBgC,SAAS;wBAC3CE,SAAS;wBACTC,SAAS;oBACX;oBACA,OAAO;gBACT;gBACAvB,wBAAgBc,2BAAAA,QAASU,KAAK,mBAAI,8BAA8B;oBAC9DF,SAAS;oBACTG,gBAAgB;gBAClB;gBACA,OAAO;YACT;YACAtB,WAAWW,QAAQZ,OAAO;YAC1B,OAAOY,QAAQZ,OAAO;QACxB,EAAE,OAAOsB,OAAO;YACdE,QAAQF,KAAK,CAACA;YACdxB,gBAAgB,yBAAyB;gBACvCsB,SAAS;gBACTG,gBAAgB;YAClB;YACA,OAAO;QACT,SAAU;YACRpB,WAAW;QACb;IACF,GACA;QAACC;QAAMN;KAAgB;IAGzB;;;;GAIC,GACD,MAAM2B,cAAcnC,YAClB,OACEe,WACAqB;QAMA,MAAMC,UAAU5B;QAChB,IAAI;YACF,MAAM,EAAEQ,QAAQ,EAAEK,OAAO,EAAE,GAAG,MAAMR,KAAKC,WAAW;gBAClDW,QAAQ;eACLU;YAEL,IAAI,CAACnB,SAASU,EAAE,EAAE;;gBAChB,MAAMC,SAAS/B,qBAAqBoB,SAASY,MAAM,EAAEP;gBACrD,IAAIM,QAAQ;oBACVpB,gBAAgBZ,oBAAoBgC,SAAS;wBAC3CE,SAAS;wBACTC,SAAS;oBACX;oBACA,OAAO;gBACT;gBACAvB,wBAAgBc,2BAAAA,QAASU,KAAK,mBAAI,iBAAiB;oBACjDF,SAASR,CAAAA,2BAAAA,QAASgB,iBAAiB,IAAG,YAAY;oBAClDL,gBAAgB;gBAClB;gBACA,OAAO;YACT;YACA,IAAIG,QAAQG,IAAI,KAAK,QAAQ;gBAC3B/B,gBACE,CAAC,WAAW,EAAEc,QAAQkB,OAAO,CAAC,iCAAiC,CAAC,GAC9D,qDACF;oBAAEV,SAAS;oBAAWC,SAAS;gBAAM;YAEzC,OAAO;;oBAGWT;gBAFhB,sEAAsE;gBACtE,4CAA4C;gBAC5C,MAAMmB,oBAAUnB,mBAAAA,QAAQmB,OAAO,qBAAfnB,iBAAiBoB,MAAM,oBAAI;gBAC3ClC,gBACE,mEAAmE;gBACnE,8DAA8D;gBAC9D,wDAAwD;gBACxD,CAACc,QAAQqB,OAAO,IAAI,CAACrB,QAAQsB,SAAS,IAAI,CAACH,UACvC,CAAC,QAAQ,EAAEnB,QAAQkB,OAAO,CAAC,6CAA6C,CAAC,GACzE,CAAC,YAAY,EAAElB,QAAQkB,OAAO,CAAC,GAAG,EAAElB,QAAQqB,OAAO,CAAC,WAAW,CAAC,GAChE,CAAC,SAAS,EAAErB,QAAQsB,SAAS,CAAC,cAAc,CAAC,GAC5CH,CAAAA,UAAU,CAAC,EAAE,EAAEA,QAAQ,0BAA0B,CAAC,GAAG,EAAC,IACvD,KACJ;oBAAEX,SAAS;oBAAWC,SAAS;gBAAM;YAEzC;YACA,OAAO;QACT,EAAE,OAAOC,OAAO;YACdE,QAAQF,KAAK,CAACA;YACdxB,gBAAgB,yBAAyB;gBACvCsB,SAAS;gBACTG,gBAAgB;YAClB;YACA,OAAO;QACT,SAAU;YACRI;QACF;IACF,GACA;QAACvB;QAAML;QAAcD;KAAgB;IAGvC,OAAO;QAAEE;QAASE;QAASa;QAAaU;QAAaxB;IAAW;AAClE;AAEA,eAAeP,kBAAiB"}

package/src/lib/hooks/use-marketplace-actions.d.ts

@@ -0,0 +1,37 @@
+import { type InstallPlanStep } from '../model/marketplace';
+/**
+ * Shared install/buy handlers for marketplace listings (AGL-95): used by the
+ * browse grid and the listing detail page. Install copies the pinned
+ * version snapshot server-side (/api/marketplace/install); buy opens a
+ * Stripe checkout (/api/marketplace/checkout) when configured.
+ */
+export declare function useMarketplaceActions(hostId: string, orgId?: string | null): {
+    install: (listing: any, scope?: "org" | "host", options?: {
+        /**
+         * Called instead of an error toast when the install route refuses
+         * because the workspace's copy has been EDITED since it was installed
+         * (AGL-1018's 409, AGL-1034).
+         *
+         * The refusal is correct — that install would have destroyed their
+         * work — but "review the update" is only useful advice if something
+         * offers the review. Handling it here rather than at each call site
+         * means every surface that installs a copied artifact gets the
+         * recovery, including ones written later.
+         */
+        onDiverged?: () => void;
+    }) => Promise<any>;
+    installPlan: (listing: any, steps: readonly InstallPlanStep[], options?: {
+        /**
+         * Re-pinning something already installed (AGL-1017). Only the wording
+         * changes — the route is the same, because moving a pin forward IS
+         * installing — but "Installed on 1 site" is the wrong sentence to read
+         * after pressing Update.
+         */
+        intent?: "install" | "update";
+        /** The version being moved to, for the update summary. */
+        version?: string | number | null;
+    }) => Promise<void>;
+    buy: (listing: any) => Promise<any>;
+    uninstall: (listing: any, scope?: "org" | "host", targetHostId?: string) => Promise<any>;
+};
+export default useMarketplaceActions;