@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/model/artifact-merge.d.ts

@@ -0,0 +1,154 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Three-way diff for COPIED marketplace artifacts (AGL-1018).
+ *
+ * Plugins are pinned: an update moves a pointer at immutable bytes and nothing
+ * can be lost. Everything else — components, layouts, templates, dataset
+ * schemas, email templates — is copied into the workspace and then edited, so
+ * an update is the vendor-branch problem. Re-installing overwrote the copy, and
+ * a customer's edits went with it, silently.
+ *
+ * With AGL-1015's base snapshot every field is classifiable against three
+ * versions, and the classification is the whole design:
+ *
+ * * changed upstream, untouched here → **safe**, take it
+ * * changed here, untouched upstream → **kept**, theirs is already right
+ * * changed on both sides → **conflict**, ask, and default to keeping theirs
+ *
+ * Pure and content-shaped on purpose: it knows nothing about Firestore or
+ * artifact types, so the same function classifies a component tree, a layout
+ * and a dataset schema, and can be tested without a database.
+ */
+/** How a single field changed across base → current → incoming. */
+export type ChangeKind = 
+/** Upstream changed it, the user did not. Applying is lossless. */
+'safe'
+/** The user changed it, upstream did not. Applying would lose their edit. */
+ | 'kept'
+/** Both changed it, to different values. Needs a decision. */
+ | 'conflict';
+export interface ArtifactChange {
+    /** Dotted path into the content, e.g. `nodes.abc123.props.title`. */
+    path: string;
+    kind: ChangeKind;
+    /** The publisher's original value at install. */
+    base: unknown;
+    /** What the workspace has now. */
+    current: unknown;
+    /** What the publisher ships in the new version. */
+    incoming: unknown;
+    /**
+     * True when the change adds or removes the field rather than editing it.
+     * A removal is worth saying out loud separately: for a dataset schema it
+     * means existing records, and for a node tree it means content disappearing
+     * from a page rather than merely looking different.
+     */
+    added?: boolean;
+    removed?: boolean;
+}
+export interface ArtifactUpdatePlan {
+    safe: ArtifactChange[];
+    kept: ArtifactChange[];
+    conflicts: ArtifactChange[];
+    /** Fields identical in all three versions — reported as a count only. */
+    unchanged: number;
+    /** Nothing to take: the incoming content matches what is installed. */
+    identical: boolean;
+}
+/**
+ * Classifies every field of an artifact against its base, the workspace's
+ * current copy, and the version on offer.
+ *
+ * `base` is required and not defaulted: without the snapshot there is no way to
+ * tell the publisher's change from the user's, and guessing at one is how you
+ * produce a confident, wrong merge. Callers with no base offer "install as a
+ * new copy" and nothing else.
+ */
+export declare function planArtifactUpdate(base: unknown, current: unknown, incoming: unknown): ArtifactUpdatePlan;
+export interface ApplyUpdateOptions {
+    /**
+     * Conflicting paths the user chose to take from the publisher. Everything
+     * absent from this list keeps the workspace's value — the default is always
+     * the safe one, so a user who applies without reading loses nothing.
+     */
+    takePaths?: readonly string[];
+}
+export interface AppliedUpdate {
+    content: unknown;
+    /** Paths actually written, for a summary that reports what happened. */
+    applied: string[];
+    /** Conflicting paths left at the workspace's value. */
+    skipped: string[];
+}
+/**
+ * Produces the merged content: the workspace's copy with every safe change
+ * taken and only the explicitly chosen conflicts overwritten.
+ *
+ * Built by patching `current` rather than by patching `incoming`, because the
+ * copy is what the site is running: anything this function fails to consider —
+ * a field the publisher never shipped, a node the user added — survives by
+ * default rather than vanishing.
+ */
+export declare function applyArtifactUpdate(plan: ArtifactUpdatePlan, current: unknown, options?: ApplyUpdateOptions): AppliedUpdate;
+/**
+ * A short human label for a change, so the dialog, the summary snackbar and the
+ * server's response all describe the same edit the same way.
+ *
+ * Values are summarised, never dumped: the interesting thing about a changed
+ * node is which node and what kind of change, and a page of serialised JSON in
+ * a list row is unreadable by the time it matters.
+ */
+export declare function describeChange(change: ArtifactChange): string;
+/** A one-line value preview for a diff row. */
+export declare function summarizeValue(value: unknown): string;
+/**
+ * Dataset schemas, classified by what an update would do to EXISTING RECORDS
+ * (AGL-1018).
+ *
+ * The sharp edge of the whole project: adding a field is inert, but removing or
+ * retyping one reinterprets data that is already there. So the schema plan is
+ * not "safe vs conflict" but "additive vs destructive", and destructive changes
+ * are never taken without a count of the records at stake.
+ */
+export interface SchemaChangeSummary {
+    /** Field ids the new version adds. Applying these cannot harm a record. */
+    added: string[];
+    /** Field ids it removes — the values in existing records become orphaned. */
+    removed: string[];
+    /** Field ids whose TYPE changed — existing values may not survive a re-read. */
+    retyped: string[];
+    /** Anything else (labels, options, ordering). */
+    edited: string[];
+    /** True when nothing removes or retypes a field. */
+    additiveOnly: boolean;
+}
+interface SchemaShape {
+    order?: unknown;
+    fields?: Record<string, {
+        type?: unknown;
+    } | undefined>;
+}
+/**
+ * Compares two dataset schemas field by field.
+ *
+ * Deliberately ignores the base: for a schema the question is not "who edited
+ * this" but "what happens to the rows", and that is answered by the current
+ * schema against the incoming one regardless of who moved which field.
+ */
+export declare function summarizeSchemaChange(current: SchemaShape | null | undefined, incoming: SchemaShape | null | undefined): SchemaChangeSummary;
+export {};

package/src/lib/model/artifact-merge.js

@@ -0,0 +1,228 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { stableStringify } from "@aglyn/aglyn/app-utils/marketplace-provenance";
+/**
+ * Paths whose CHILDREN are compared as a unit rather than walked.
+ *
+ * A besigner node is `{id, type, props, childIds}`. Walking into it produces
+ * true field-level granularity, which is what the issue asks for; but the
+ * `childIds` array is where structure lives, and comparing arrays element-wise
+ * makes a single insert read as a change to every position after it. Arrays are
+ * therefore atomic everywhere (see {@link isAtomic}), and node maps are walked
+ * by KEY — which is the structural, id-keyed comparison a node tree needs, and
+ * the reason a re-ordered tree does not read as a conflict in every node.
+ */ function isAtomic(value) {
+    return value === null || typeof value !== 'object' || Array.isArray(value) || // Dates, Firestore timestamps and anything else non-plain: comparing their
+    // enumerable members would compare internals, not content.
+    Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null;
+}
+function same(a, b) {
+    return stableStringify(a) === stableStringify(b);
+}
+const ABSENT = Symbol('absent');
+function get(container, key) {
+    if (container === ABSENT || container == null || typeof container !== 'object') {
+        return ABSENT;
+    }
+    const record = container;
+    return key in record ? record[key] : ABSENT;
+}
+function keysOf(...containers) {
+    const keys = [];
+    const seen = new Set();
+    for (const container of containers){
+        if (container === ABSENT || container == null || typeof container !== 'object') {
+            continue;
+        }
+        for (const key of Object.keys(container)){
+            if (!seen.has(key)) {
+                seen.add(key);
+                keys.push(key);
+            }
+        }
+    }
+    return keys;
+}
+/**
+ * Classifies every field of an artifact against its base, the workspace's
+ * current copy, and the version on offer.
+ *
+ * `base` is required and not defaulted: without the snapshot there is no way to
+ * tell the publisher's change from the user's, and guessing at one is how you
+ * produce a confident, wrong merge. Callers with no base offer "install as a
+ * new copy" and nothing else.
+ */ export function planArtifactUpdate(base, current, incoming) {
+    const plan = {
+        safe: [],
+        kept: [],
+        conflicts: [],
+        unchanged: 0,
+        identical: false
+    };
+    const walk = (baseValue, currentValue, incomingValue, path)=>{
+        const userChanged = !same(baseValue, currentValue);
+        const publisherChanged = !same(baseValue, incomingValue);
+        if (!userChanged && !publisherChanged) {
+            plan.unchanged += 1;
+            return;
+        }
+        // Recurse while all three sides still have a walkable object here, so an
+        // edit to one node's text and an upstream edit to a different node are two
+        // independent changes rather than one whole-tree conflict.
+        //
+        // A side that is ABSENT stops the walk: the field was added or removed
+        // wholesale, and reporting that as one change ("this node is gone") is both
+        // truer and more readable than reporting every leaf inside it.
+        const walkable = baseValue !== ABSENT && currentValue !== ABSENT && incomingValue !== ABSENT && !isAtomic(baseValue) && !isAtomic(currentValue) && !isAtomic(incomingValue);
+        if (walkable) {
+            for (const key of keysOf(baseValue, currentValue, incomingValue)){
+                walk(get(baseValue, key), get(currentValue, key), get(incomingValue, key), path ? `${path}.${key}` : key);
+            }
+            return;
+        }
+        const change = _extends({
+            path,
+            kind: userChanged ? publisherChanged ? 'conflict' : 'kept' : 'safe',
+            base: baseValue === ABSENT ? undefined : baseValue,
+            current: currentValue === ABSENT ? undefined : currentValue,
+            incoming: incomingValue === ABSENT ? undefined : incomingValue
+        }, baseValue === ABSENT ? {
+            added: true
+        } : {}, incomingValue === ABSENT && baseValue !== ABSENT ? {
+            removed: true
+        } : {});
+        // A conflict where both sides landed on the SAME value is not a conflict —
+        // two people fixing the same typo agree.
+        if (change.kind === 'conflict' && same(currentValue, incomingValue)) {
+            plan.unchanged += 1;
+            return;
+        }
+        if (change.kind === 'safe') plan.safe.push(change);
+        else if (change.kind === 'kept') plan.kept.push(change);
+        else plan.conflicts.push(change);
+    };
+    walk(base, current, incoming, '');
+    plan.identical = same(current, incoming);
+    return plan;
+}
+function setPath(target, path, value) {
+    if (!path.length) return value === ABSENT ? undefined : value;
+    const [head, ...rest] = path;
+    const container = target != null && typeof target === 'object' && !Array.isArray(target) ? _extends({}, target) : {};
+    if (!rest.length) {
+        if (value === ABSENT) delete container[head];
+        else container[head] = value;
+        return container;
+    }
+    container[head] = setPath(container[head], rest, value);
+    return container;
+}
+/**
+ * Produces the merged content: the workspace's copy with every safe change
+ * taken and only the explicitly chosen conflicts overwritten.
+ *
+ * Built by patching `current` rather than by patching `incoming`, because the
+ * copy is what the site is running: anything this function fails to consider —
+ * a field the publisher never shipped, a node the user added — survives by
+ * default rather than vanishing.
+ */ export function applyArtifactUpdate(plan, current, options) {
+    var _ref;
+    const take = new Set((_ref = options == null ? void 0 : options.takePaths) != null ? _ref : []);
+    const applied = [];
+    const skipped = [];
+    let content = current;
+    const write = (change)=>{
+        const segments = change.path ? change.path.split('.') : [];
+        content = setPath(content, segments, change.removed ? ABSENT : change.incoming);
+        applied.push(change.path);
+    };
+    for (const change of plan.safe)write(change);
+    for (const change of plan.conflicts){
+        if (take.has(change.path)) write(change);
+        else skipped.push(change.path);
+    }
+    return {
+        content,
+        applied,
+        skipped
+    };
+}
+/**
+ * A short human label for a change, so the dialog, the summary snackbar and the
+ * server's response all describe the same edit the same way.
+ *
+ * Values are summarised, never dumped: the interesting thing about a changed
+ * node is which node and what kind of change, and a page of serialised JSON in
+ * a list row is unreadable by the time it matters.
+ */ export function describeChange(change) {
+    const label = change.path || 'the whole artifact';
+    if (change.added) return `${label} — added by the publisher`;
+    if (change.removed) return `${label} — removed by the publisher`;
+    return label;
+}
+/** A one-line value preview for a diff row. */ export function summarizeValue(value) {
+    if (value === undefined) return '—';
+    if (value === null) return 'null';
+    if (typeof value === 'string') {
+        return value.length > 60 ? `${value.slice(0, 57)}…` : value || '(empty)';
+    }
+    if (typeof value !== 'object') return String(value);
+    if (Array.isArray(value)) {
+        return `${value.length} item${value.length === 1 ? '' : 's'}`;
+    }
+    const keys = Object.keys(value);
+    return `{ ${keys.slice(0, 3).join(', ')}${keys.length > 3 ? ', …' : ''} }`;
+}
+/**
+ * Compares two dataset schemas field by field.
+ *
+ * Deliberately ignores the base: for a schema the question is not "who edited
+ * this" but "what happens to the rows", and that is answered by the current
+ * schema against the incoming one regardless of who moved which field.
+ */ export function summarizeSchemaChange(current, incoming) {
+    var _ref, _ref1;
+    const currentFields = (_ref = current == null ? void 0 : current.fields) != null ? _ref : {};
+    const incomingFields = (_ref1 = incoming == null ? void 0 : incoming.fields) != null ? _ref1 : {};
+    const added = [];
+    const removed = [];
+    const retyped = [];
+    const edited = [];
+    for (const id of Object.keys(incomingFields)){
+        var _currentFields_id, _incomingFields_id;
+        if (!(id in currentFields)) {
+            added.push(id);
+            continue;
+        }
+        if (String((_currentFields_id = currentFields[id]) == null ? void 0 : _currentFields_id.type) !== String((_incomingFields_id = incomingFields[id]) == null ? void 0 : _incomingFields_id.type)) {
+            retyped.push(id);
+        } else if (!same(currentFields[id], incomingFields[id])) {
+            edited.push(id);
+        }
+    }
+    for (const id of Object.keys(currentFields)){
+        if (!(id in incomingFields)) removed.push(id);
+    }
+    return {
+        added,
+        removed,
+        retyped,
+        edited,
+        additiveOnly: !removed.length && !retyped.length
+    };
+}
+
+//# sourceMappingURL=artifact-merge.js.map

package/src/lib/model/artifact-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/model/artifact-merge.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { stableStringify } from '@aglyn/aglyn/app-utils/marketplace-provenance'\n\n/**\n * Three-way diff for COPIED marketplace artifacts (AGL-1018).\n *\n * Plugins are pinned: an update moves a pointer at immutable bytes and nothing\n * can be lost. Everything else — components, layouts, templates, dataset\n * schemas, email templates — is copied into the workspace and then edited, so\n * an update is the vendor-branch problem. Re-installing overwrote the copy, and\n * a customer's edits went with it, silently.\n *\n * With AGL-1015's base snapshot every field is classifiable against three\n * versions, and the classification is the whole design:\n *\n * * changed upstream, untouched here → **safe**, take it\n * * changed here, untouched upstream → **kept**, theirs is already right\n * * changed on both sides → **conflict**, ask, and default to keeping theirs\n *\n * Pure and content-shaped on purpose: it knows nothing about Firestore or\n * artifact types, so the same function classifies a component tree, a layout\n * and a dataset schema, and can be tested without a database.\n */\n\n/** How a single field changed across base → current → incoming. */\nexport type ChangeKind =\n  /** Upstream changed it, the user did not. Applying is lossless. */\n  | 'safe'\n  /** The user changed it, upstream did not. Applying would lose their edit. */\n  | 'kept'\n  /** Both changed it, to different values. Needs a decision. */\n  | 'conflict'\n\nexport interface ArtifactChange {\n  /** Dotted path into the content, e.g. `nodes.abc123.props.title`. */\n  path: string\n  kind: ChangeKind\n  /** The publisher's original value at install. */\n  base: unknown\n  /** What the workspace has now. */\n  current: unknown\n  /** What the publisher ships in the new version. */\n  incoming: unknown\n  /**\n   * True when the change adds or removes the field rather than editing it.\n   * A removal is worth saying out loud separately: for a dataset schema it\n   * means existing records, and for a node tree it means content disappearing\n   * from a page rather than merely looking different.\n   */\n  added?: boolean\n  removed?: boolean\n}\n\nexport interface ArtifactUpdatePlan {\n  safe: ArtifactChange[]\n  kept: ArtifactChange[]\n  conflicts: ArtifactChange[]\n  /** Fields identical in all three versions — reported as a count only. */\n  unchanged: number\n  /** Nothing to take: the incoming content matches what is installed. */\n  identical: boolean\n}\n\n/**\n * Paths whose CHILDREN are compared as a unit rather than walked.\n *\n * A besigner node is `{id, type, props, childIds}`. Walking into it produces\n * true field-level granularity, which is what the issue asks for; but the\n * `childIds` array is where structure lives, and comparing arrays element-wise\n * makes a single insert read as a change to every position after it. Arrays are\n * therefore atomic everywhere (see {@link isAtomic}), and node maps are walked\n * by KEY — which is the structural, id-keyed comparison a node tree needs, and\n * the reason a re-ordered tree does not read as a conflict in every node.\n */\nfunction isAtomic(value: unknown): boolean {\n  return (\n    value === null ||\n    typeof value !== 'object' ||\n    Array.isArray(value) ||\n    // Dates, Firestore timestamps and anything else non-plain: comparing their\n    // enumerable members would compare internals, not content.\n    (Object.getPrototypeOf(value) !== Object.prototype &&\n      Object.getPrototypeOf(value) !== null)\n  )\n}\n\nfunction same(a: unknown, b: unknown): boolean {\n  return stableStringify(a) === stableStringify(b)\n}\n\nconst ABSENT = Symbol('absent')\n\nfunction get(container: unknown, key: string): unknown | typeof ABSENT {\n  if (container === ABSENT || container == null || typeof container !== 'object') {\n    return ABSENT\n  }\n  const record = container as Record<string, unknown>\n  return key in record ? record[key] : ABSENT\n}\n\nfunction keysOf(...containers: unknown[]): string[] {\n  const keys: string[] = []\n  const seen = new Set<string>()\n  for (const container of containers) {\n    if (container === ABSENT || container == null || typeof container !== 'object') {\n      continue\n    }\n    for (const key of Object.keys(container as Record<string, unknown>)) {\n      if (!seen.has(key)) {\n        seen.add(key)\n        keys.push(key)\n      }\n    }\n  }\n  return keys\n}\n\n/**\n * Classifies every field of an artifact against its base, the workspace's\n * current copy, and the version on offer.\n *\n * `base` is required and not defaulted: without the snapshot there is no way to\n * tell the publisher's change from the user's, and guessing at one is how you\n * produce a confident, wrong merge. Callers with no base offer \"install as a\n * new copy\" and nothing else.\n */\nexport function planArtifactUpdate(\n  base: unknown,\n  current: unknown,\n  incoming: unknown,\n): ArtifactUpdatePlan {\n  const plan: ArtifactUpdatePlan = {\n    safe: [],\n    kept: [],\n    conflicts: [],\n    unchanged: 0,\n    identical: false,\n  }\n\n  const walk = (\n    baseValue: unknown,\n    currentValue: unknown,\n    incomingValue: unknown,\n    path: string,\n  ): void => {\n    const userChanged = !same(baseValue, currentValue)\n    const publisherChanged = !same(baseValue, incomingValue)\n\n    if (!userChanged && !publisherChanged) {\n      plan.unchanged += 1\n      return\n    }\n\n    // Recurse while all three sides still have a walkable object here, so an\n    // edit to one node's text and an upstream edit to a different node are two\n    // independent changes rather than one whole-tree conflict.\n    //\n    // A side that is ABSENT stops the walk: the field was added or removed\n    // wholesale, and reporting that as one change (\"this node is gone\") is both\n    // truer and more readable than reporting every leaf inside it.\n    const walkable =\n      baseValue !== ABSENT &&\n      currentValue !== ABSENT &&\n      incomingValue !== ABSENT &&\n      !isAtomic(baseValue) &&\n      !isAtomic(currentValue) &&\n      !isAtomic(incomingValue)\n    if (walkable) {\n      for (const key of keysOf(baseValue, currentValue, incomingValue)) {\n        walk(\n          get(baseValue, key),\n          get(currentValue, key),\n          get(incomingValue, key),\n          path ? `${path}.${key}` : key,\n        )\n      }\n      return\n    }\n\n    const change: ArtifactChange = {\n      path,\n      kind: userChanged\n        ? publisherChanged\n          ? 'conflict'\n          : 'kept'\n        : 'safe',\n      base: baseValue === ABSENT ? undefined : baseValue,\n      current: currentValue === ABSENT ? undefined : currentValue,\n      incoming: incomingValue === ABSENT ? undefined : incomingValue,\n      ...(baseValue === ABSENT ? { added: true } : {}),\n      ...(incomingValue === ABSENT && baseValue !== ABSENT\n        ? { removed: true }\n        : {}),\n    }\n    // A conflict where both sides landed on the SAME value is not a conflict —\n    // two people fixing the same typo agree.\n    if (change.kind === 'conflict' && same(currentValue, incomingValue)) {\n      plan.unchanged += 1\n      return\n    }\n    if (change.kind === 'safe') plan.safe.push(change)\n    else if (change.kind === 'kept') plan.kept.push(change)\n    else plan.conflicts.push(change)\n  }\n\n  walk(base, current, incoming, '')\n  plan.identical = same(current, incoming)\n  return plan\n}\n\nfunction setPath(target: unknown, path: string[], value: unknown | typeof ABSENT): unknown {\n  if (!path.length) return value === ABSENT ? undefined : value\n  const [head, ...rest] = path\n  const container: Record<string, unknown> =\n    target != null && typeof target === 'object' && !Array.isArray(target)\n      ? { ...(target as Record<string, unknown>) }\n      : {}\n  if (!rest.length) {\n    if (value === ABSENT) delete container[head]\n    else container[head] = value\n    return container\n  }\n  container[head] = setPath(container[head], rest, value)\n  return container\n}\n\nexport interface ApplyUpdateOptions {\n  /**\n   * Conflicting paths the user chose to take from the publisher. Everything\n   * absent from this list keeps the workspace's value — the default is always\n   * the safe one, so a user who applies without reading loses nothing.\n   */\n  takePaths?: readonly string[]\n}\n\nexport interface AppliedUpdate {\n  content: unknown\n  /** Paths actually written, for a summary that reports what happened. */\n  applied: string[]\n  /** Conflicting paths left at the workspace's value. */\n  skipped: string[]\n}\n\n/**\n * Produces the merged content: the workspace's copy with every safe change\n * taken and only the explicitly chosen conflicts overwritten.\n *\n * Built by patching `current` rather than by patching `incoming`, because the\n * copy is what the site is running: anything this function fails to consider —\n * a field the publisher never shipped, a node the user added — survives by\n * default rather than vanishing.\n */\nexport function applyArtifactUpdate(\n  plan: ArtifactUpdatePlan,\n  current: unknown,\n  options?: ApplyUpdateOptions,\n): AppliedUpdate {\n  const take = new Set(options?.takePaths ?? [])\n  const applied: string[] = []\n  const skipped: string[] = []\n  let content = current\n  const write = (change: ArtifactChange) => {\n    const segments = change.path ? change.path.split('.') : []\n    content = setPath(\n      content,\n      segments,\n      change.removed ? ABSENT : change.incoming,\n    )\n    applied.push(change.path)\n  }\n  for (const change of plan.safe) write(change)\n  for (const change of plan.conflicts) {\n    if (take.has(change.path)) write(change)\n    else skipped.push(change.path)\n  }\n  return { content, applied, skipped }\n}\n\n/**\n * A short human label for a change, so the dialog, the summary snackbar and the\n * server's response all describe the same edit the same way.\n *\n * Values are summarised, never dumped: the interesting thing about a changed\n * node is which node and what kind of change, and a page of serialised JSON in\n * a list row is unreadable by the time it matters.\n */\nexport function describeChange(change: ArtifactChange): string {\n  const label = change.path || 'the whole artifact'\n  if (change.added) return `${label} — added by the publisher`\n  if (change.removed) return `${label} — removed by the publisher`\n  return label\n}\n\n/** A one-line value preview for a diff row. */\nexport function summarizeValue(value: unknown): string {\n  if (value === undefined) return '—'\n  if (value === null) return 'null'\n  if (typeof value === 'string') {\n    return value.length > 60 ? `${value.slice(0, 57)}…` : value || '(empty)'\n  }\n  if (typeof value !== 'object') return String(value)\n  if (Array.isArray(value)) {\n    return `${value.length} item${value.length === 1 ? '' : 's'}`\n  }\n  const keys = Object.keys(value as Record<string, unknown>)\n  return `{ ${keys.slice(0, 3).join(', ')}${keys.length > 3 ? ', …' : ''} }`\n}\n\n/**\n * Dataset schemas, classified by what an update would do to EXISTING RECORDS\n * (AGL-1018).\n *\n * The sharp edge of the whole project: adding a field is inert, but removing or\n * retyping one reinterprets data that is already there. So the schema plan is\n * not \"safe vs conflict\" but \"additive vs destructive\", and destructive changes\n * are never taken without a count of the records at stake.\n */\nexport interface SchemaChangeSummary {\n  /** Field ids the new version adds. Applying these cannot harm a record. */\n  added: string[]\n  /** Field ids it removes — the values in existing records become orphaned. */\n  removed: string[]\n  /** Field ids whose TYPE changed — existing values may not survive a re-read. */\n  retyped: string[]\n  /** Anything else (labels, options, ordering). */\n  edited: string[]\n  /** True when nothing removes or retypes a field. */\n  additiveOnly: boolean\n}\n\ninterface SchemaShape {\n  order?: unknown\n  fields?: Record<string, { type?: unknown } | undefined>\n}\n\n/**\n * Compares two dataset schemas field by field.\n *\n * Deliberately ignores the base: for a schema the question is not \"who edited\n * this\" but \"what happens to the rows\", and that is answered by the current\n * schema against the incoming one regardless of who moved which field.\n */\nexport function summarizeSchemaChange(\n  current: SchemaShape | null | undefined,\n  incoming: SchemaShape | null | undefined,\n): SchemaChangeSummary {\n  const currentFields = (current?.fields ?? {}) as Record<string, { type?: unknown }>\n  const incomingFields = (incoming?.fields ?? {}) as Record<string, { type?: unknown }>\n  const added: string[] = []\n  const removed: string[] = []\n  const retyped: string[] = []\n  const edited: string[] = []\n  for (const id of Object.keys(incomingFields)) {\n    if (!(id in currentFields)) {\n      added.push(id)\n      continue\n    }\n    if (String(currentFields[id]?.type) !== String(incomingFields[id]?.type)) {\n      retyped.push(id)\n    } else if (!same(currentFields[id], incomingFields[id])) {\n      edited.push(id)\n    }\n  }\n  for (const id of Object.keys(currentFields)) {\n    if (!(id in incomingFields)) removed.push(id)\n  }\n  return {\n    added,\n    removed,\n    retyped,\n    edited,\n    additiveOnly: !removed.length && !retyped.length,\n  }\n}\n"],"names":["stableStringify","isAtomic","value","Array","isArray","Object","getPrototypeOf","prototype","same","a","b","ABSENT","Symbol","get","container","key","record","keysOf","containers","keys","seen","Set","has","add","push","planArtifactUpdate","base","current","incoming","plan","safe","kept","conflicts","unchanged","identical","walk","baseValue","currentValue","incomingValue","path","userChanged","publisherChanged","walkable","change","kind","undefined","added","removed","setPath","target","length","head","rest","applyArtifactUpdate","options","take","takePaths","applied","skipped","content","write","segments","split","describeChange","label","summarizeValue","slice","String","join","summarizeSchemaChange","currentFields","fields","incomingFields","retyped","edited","id","type","additiveOnly"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,eAAe,QAAQ,gDAA+C;AA8D/E;;;;;;;;;;CAUC,GACD,SAASC,SAASC,KAAc;IAC9B,OACEA,UAAU,QACV,OAAOA,UAAU,YACjBC,MAAMC,OAAO,CAACF,UACd,2EAA2E;IAC3E,2DAA2D;IAC1DG,OAAOC,cAAc,CAACJ,WAAWG,OAAOE,SAAS,IAChDF,OAAOC,cAAc,CAACJ,WAAW;AAEvC;AAEA,SAASM,KAAKC,CAAU,EAAEC,CAAU;IAClC,OAAOV,gBAAgBS,OAAOT,gBAAgBU;AAChD;AAEA,MAAMC,SAASC,OAAO;AAEtB,SAASC,IAAIC,SAAkB,EAAEC,GAAW;IAC1C,IAAID,cAAcH,UAAUG,aAAa,QAAQ,OAAOA,cAAc,UAAU;QAC9E,OAAOH;IACT;IACA,MAAMK,SAASF;IACf,OAAOC,OAAOC,SAASA,MAAM,CAACD,IAAI,GAAGJ;AACvC;AAEA,SAASM,OAAO,GAAGC,UAAqB;IACtC,MAAMC,OAAiB,EAAE;IACzB,MAAMC,OAAO,IAAIC;IACjB,KAAK,MAAMP,aAAaI,WAAY;QAClC,IAAIJ,cAAcH,UAAUG,aAAa,QAAQ,OAAOA,cAAc,UAAU;YAC9E;QACF;QACA,KAAK,MAAMC,OAAOV,OAAOc,IAAI,CAACL,WAAuC;YACnE,IAAI,CAACM,KAAKE,GAAG,CAACP,MAAM;gBAClBK,KAAKG,GAAG,CAACR;gBACTI,KAAKK,IAAI,CAACT;YACZ;QACF;IACF;IACA,OAAOI;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASM,mBACdC,IAAa,EACbC,OAAgB,EAChBC,QAAiB;IAEjB,MAAMC,OAA2B;QAC/BC,MAAM,EAAE;QACRC,MAAM,EAAE;QACRC,WAAW,EAAE;QACbC,WAAW;QACXC,WAAW;IACb;IAEA,MAAMC,OAAO,CACXC,WACAC,cACAC,eACAC;QAEA,MAAMC,cAAc,CAAChC,KAAK4B,WAAWC;QACrC,MAAMI,mBAAmB,CAACjC,KAAK4B,WAAWE;QAE1C,IAAI,CAACE,eAAe,CAACC,kBAAkB;YACrCZ,KAAKI,SAAS,IAAI;YAClB;QACF;QAEA,yEAAyE;QACzE,2EAA2E;QAC3E,2DAA2D;QAC3D,EAAE;QACF,uEAAuE;QACvE,4EAA4E;QAC5E,+DAA+D;QAC/D,MAAMS,WACJN,cAAczB,UACd0B,iBAAiB1B,UACjB2B,kBAAkB3B,UAClB,CAACV,SAASmC,cACV,CAACnC,SAASoC,iBACV,CAACpC,SAASqC;QACZ,IAAII,UAAU;YACZ,KAAK,MAAM3B,OAAOE,OAAOmB,WAAWC,cAAcC,eAAgB;gBAChEH,KACEtB,IAAIuB,WAAWrB,MACfF,IAAIwB,cAActB,MAClBF,IAAIyB,eAAevB,MACnBwB,OAAO,GAAGA,KAAK,CAAC,EAAExB,KAAK,GAAGA;YAE9B;YACA;QACF;QAEA,MAAM4B,SAAyB;YAC7BJ;YACAK,MAAMJ,cACFC,mBACE,aACA,SACF;YACJf,MAAMU,cAAczB,SAASkC,YAAYT;YACzCT,SAASU,iBAAiB1B,SAASkC,YAAYR;YAC/CT,UAAUU,kBAAkB3B,SAASkC,YAAYP;WAC7CF,cAAczB,SAAS;YAAEmC,OAAO;QAAK,IAAI,CAAC,GAC1CR,kBAAkB3B,UAAUyB,cAAczB,SAC1C;YAAEoC,SAAS;QAAK,IAChB,CAAC;QAEP,2EAA2E;QAC3E,yCAAyC;QACzC,IAAIJ,OAAOC,IAAI,KAAK,cAAcpC,KAAK6B,cAAcC,gBAAgB;YACnET,KAAKI,SAAS,IAAI;YAClB;QACF;QACA,IAAIU,OAAOC,IAAI,KAAK,QAAQf,KAAKC,IAAI,CAACN,IAAI,CAACmB;aACtC,IAAIA,OAAOC,IAAI,KAAK,QAAQf,KAAKE,IAAI,CAACP,IAAI,CAACmB;aAC3Cd,KAAKG,SAAS,CAACR,IAAI,CAACmB;IAC3B;IAEAR,KAAKT,MAAMC,SAASC,UAAU;IAC9BC,KAAKK,SAAS,GAAG1B,KAAKmB,SAASC;IAC/B,OAAOC;AACT;AAEA,SAASmB,QAAQC,MAAe,EAAEV,IAAc,EAAErC,KAA8B;IAC9E,IAAI,CAACqC,KAAKW,MAAM,EAAE,OAAOhD,UAAUS,SAASkC,YAAY3C;IACxD,MAAM,CAACiD,MAAM,GAAGC,KAAK,GAAGb;IACxB,MAAMzB,YACJmC,UAAU,QAAQ,OAAOA,WAAW,YAAY,CAAC9C,MAAMC,OAAO,CAAC6C,UAC3D,aAAMA,UACN,CAAC;IACP,IAAI,CAACG,KAAKF,MAAM,EAAE;QAChB,IAAIhD,UAAUS,QAAQ,OAAOG,SAAS,CAACqC,KAAK;aACvCrC,SAAS,CAACqC,KAAK,GAAGjD;QACvB,OAAOY;IACT;IACAA,SAAS,CAACqC,KAAK,GAAGH,QAAQlC,SAAS,CAACqC,KAAK,EAAEC,MAAMlD;IACjD,OAAOY;AACT;AAmBA;;;;;;;;CAQC,GACD,OAAO,SAASuC,oBACdxB,IAAwB,EACxBF,OAAgB,EAChB2B,OAA4B;;IAE5B,MAAMC,OAAO,IAAIlC,YAAIiC,2BAAAA,QAASE,SAAS,mBAAI,EAAE;IAC7C,MAAMC,UAAoB,EAAE;IAC5B,MAAMC,UAAoB,EAAE;IAC5B,IAAIC,UAAUhC;IACd,MAAMiC,QAAQ,CAACjB;QACb,MAAMkB,WAAWlB,OAAOJ,IAAI,GAAGI,OAAOJ,IAAI,CAACuB,KAAK,CAAC,OAAO,EAAE;QAC1DH,UAAUX,QACRW,SACAE,UACAlB,OAAOI,OAAO,GAAGpC,SAASgC,OAAOf,QAAQ;QAE3C6B,QAAQjC,IAAI,CAACmB,OAAOJ,IAAI;IAC1B;IACA,KAAK,MAAMI,UAAUd,KAAKC,IAAI,CAAE8B,MAAMjB;IACtC,KAAK,MAAMA,UAAUd,KAAKG,SAAS,CAAE;QACnC,IAAIuB,KAAKjC,GAAG,CAACqB,OAAOJ,IAAI,GAAGqB,MAAMjB;aAC5Be,QAAQlC,IAAI,CAACmB,OAAOJ,IAAI;IAC/B;IACA,OAAO;QAAEoB;QAASF;QAASC;IAAQ;AACrC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASK,eAAepB,MAAsB;IACnD,MAAMqB,QAAQrB,OAAOJ,IAAI,IAAI;IAC7B,IAAII,OAAOG,KAAK,EAAE,OAAO,GAAGkB,MAAM,yBAAyB,CAAC;IAC5D,IAAIrB,OAAOI,OAAO,EAAE,OAAO,GAAGiB,MAAM,2BAA2B,CAAC;IAChE,OAAOA;AACT;AAEA,6CAA6C,GAC7C,OAAO,SAASC,eAAe/D,KAAc;IAC3C,IAAIA,UAAU2C,WAAW,OAAO;IAChC,IAAI3C,UAAU,MAAM,OAAO;IAC3B,IAAI,OAAOA,UAAU,UAAU;QAC7B,OAAOA,MAAMgD,MAAM,GAAG,KAAK,GAAGhD,MAAMgE,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,GAAGhE,SAAS;IACjE;IACA,IAAI,OAAOA,UAAU,UAAU,OAAOiE,OAAOjE;IAC7C,IAAIC,MAAMC,OAAO,CAACF,QAAQ;QACxB,OAAO,GAAGA,MAAMgD,MAAM,CAAC,KAAK,EAAEhD,MAAMgD,MAAM,KAAK,IAAI,KAAK,KAAK;IAC/D;IACA,MAAM/B,OAAOd,OAAOc,IAAI,CAACjB;IACzB,OAAO,CAAC,EAAE,EAAEiB,KAAK+C,KAAK,CAAC,GAAG,GAAGE,IAAI,CAAC,QAAQjD,KAAK+B,MAAM,GAAG,IAAI,QAAQ,GAAG,EAAE,CAAC;AAC5E;AA6BA;;;;;;CAMC,GACD,OAAO,SAASmB,sBACd1C,OAAuC,EACvCC,QAAwC;;IAExC,MAAM0C,wBAAiB3C,2BAAAA,QAAS4C,MAAM,mBAAI,CAAC;IAC3C,MAAMC,0BAAkB5C,4BAAAA,SAAU2C,MAAM,oBAAI,CAAC;IAC7C,MAAMzB,QAAkB,EAAE;IAC1B,MAAMC,UAAoB,EAAE;IAC5B,MAAM0B,UAAoB,EAAE;IAC5B,MAAMC,SAAmB,EAAE;IAC3B,KAAK,MAAMC,MAAMtE,OAAOc,IAAI,CAACqD,gBAAiB;YAKjCF,mBAAoCE;QAJ/C,IAAI,CAAEG,CAAAA,MAAML,aAAY,GAAI;YAC1BxB,MAAMtB,IAAI,CAACmD;YACX;QACF;QACA,IAAIR,QAAOG,oBAAAA,aAAa,CAACK,GAAG,qBAAjBL,kBAAmBM,IAAI,MAAMT,QAAOK,qBAAAA,cAAc,CAACG,GAAG,qBAAlBH,mBAAoBI,IAAI,GAAG;YACxEH,QAAQjD,IAAI,CAACmD;QACf,OAAO,IAAI,CAACnE,KAAK8D,aAAa,CAACK,GAAG,EAAEH,cAAc,CAACG,GAAG,GAAG;YACvDD,OAAOlD,IAAI,CAACmD;QACd;IACF;IACA,KAAK,MAAMA,MAAMtE,OAAOc,IAAI,CAACmD,eAAgB;QAC3C,IAAI,CAAEK,CAAAA,MAAMH,cAAa,GAAIzB,QAAQvB,IAAI,CAACmD;IAC5C;IACA,OAAO;QACL7B;QACAC;QACA0B;QACAC;QACAG,cAAc,CAAC9B,QAAQG,MAAM,IAAI,CAACuB,QAAQvB,MAAM;IAClD;AACF"}

package/src/lib/model/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Marketplace marketplace model (AGL-413): listing/profile shapes + publish sanitization relocated from core app-utils.
+ * Context-free — importable by client components, /server handlers, and
+ * other plugins/apps via `@aglyn/plugins-marketplace/model`.
+ */
+export * from './marketplace';
+/**
+ * Provenance and update state live in core (AGL-1015/1016) so the console can
+ * read them too, but they are marketplace vocabulary — re-exported here so a
+ * publishing or install route still imports the whole model from one place.
+ * Named rather than star-exported: `MarketplaceArtifactType` is re-exported by
+ * `./marketplace` already, and two barrels claiming it is an ambiguity.
+ *
+ * Deep paths rather than a core barrel, for the same reason `./marketplace`
+ * uses one: this module is in the browser bundle AND in API routes, so
+ * `@aglyn/aglyn` (createContext) and `@aglyn/aglyn/server` (node:fs) are both
+ * unusable from here.
+ */
+export { ARTIFACT_BASE_COLLECTION, ARTIFACT_BASE_MAX_BYTES, resolveProvenance, stableStringify, type InstalledFrom, type ProvenanceState, type ResolvedProvenance, } from '@aglyn/aglyn/app-utils/marketplace-provenance';
+export { applyArtifactUpdate, describeChange, planArtifactUpdate, summarizeSchemaChange, summarizeValue, type ArtifactChange, type ArtifactUpdatePlan, type ChangeKind, } from './artifact-merge';
+export { compareArtifactVersions, resolveUpdateState, updateStateLabel, type UpdateComparableInstall, type UpdateComparableListing, type UpdateState, type UpdateStatus, } from '@aglyn/aglyn/app-utils/marketplace-update-state';
+/**
+ * The email-starter policy, re-exported for the same reason the provenance and
+ * visibility policies are: it lives in core because `scope:app` may not depend
+ * on this lib, and publishing and install code should keep one import site.
+ */
+export { emailStarterAssuranceLabel, emailStarterRefusal, emailStarterSendBlock, inspectEmailStarter, resolveEmailStarterAssurance, type EmailStarterAssurance, type EmailStarterInspection, type EmailStarterSendBlock, type EmailStarterViolation, type EmailStarterViolationCode, } from '@aglyn/aglyn/app-utils/email-starter-policy';

package/src/lib/model/index.js

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Marketplace marketplace model (AGL-413): listing/profile shapes + publish sanitization relocated from core app-utils.
+ * Context-free — importable by client components, /server handlers, and
+ * other plugins/apps via `@aglyn/plugins-marketplace/model`.
+ */ export * from "./marketplace.js";
+/**
+ * Provenance and update state live in core (AGL-1015/1016) so the console can
+ * read them too, but they are marketplace vocabulary — re-exported here so a
+ * publishing or install route still imports the whole model from one place.
+ * Named rather than star-exported: `MarketplaceArtifactType` is re-exported by
+ * `./marketplace` already, and two barrels claiming it is an ambiguity.
+ *
+ * Deep paths rather than a core barrel, for the same reason `./marketplace`
+ * uses one: this module is in the browser bundle AND in API routes, so
+ * `@aglyn/aglyn` (createContext) and `@aglyn/aglyn/server` (node:fs) are both
+ * unusable from here.
+ */ export { ARTIFACT_BASE_COLLECTION, ARTIFACT_BASE_MAX_BYTES, resolveProvenance, stableStringify } from "@aglyn/aglyn/app-utils/marketplace-provenance";
+export { applyArtifactUpdate, describeChange, planArtifactUpdate, summarizeSchemaChange, summarizeValue } from "./artifact-merge.js";
+export { compareArtifactVersions, resolveUpdateState, updateStateLabel } from "@aglyn/aglyn/app-utils/marketplace-update-state";
+/**
+ * The email-starter policy, re-exported for the same reason the provenance and
+ * visibility policies are: it lives in core because `scope:app` may not depend
+ * on this lib, and publishing and install code should keep one import site.
+ */ export { emailStarterAssuranceLabel, emailStarterRefusal, emailStarterSendBlock, inspectEmailStarter, resolveEmailStarterAssurance } from "@aglyn/aglyn/app-utils/email-starter-policy";
+
+//# sourceMappingURL=index.js.map

package/src/lib/model/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/model/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Marketplace marketplace model (AGL-413): listing/profile shapes + publish sanitization relocated from core app-utils.\n * Context-free — importable by client components, /server handlers, and\n * other plugins/apps via `@aglyn/plugins-marketplace/model`.\n */\nexport * from './marketplace'\n/**\n * Provenance and update state live in core (AGL-1015/1016) so the console can\n * read them too, but they are marketplace vocabulary — re-exported here so a\n * publishing or install route still imports the whole model from one place.\n * Named rather than star-exported: `MarketplaceArtifactType` is re-exported by\n * `./marketplace` already, and two barrels claiming it is an ambiguity.\n *\n * Deep paths rather than a core barrel, for the same reason `./marketplace`\n * uses one: this module is in the browser bundle AND in API routes, so\n * `@aglyn/aglyn` (createContext) and `@aglyn/aglyn/server` (node:fs) are both\n * unusable from here.\n */\nexport {\n  ARTIFACT_BASE_COLLECTION,\n  ARTIFACT_BASE_MAX_BYTES,\n  resolveProvenance,\n  stableStringify,\n  type InstalledFrom,\n  type ProvenanceState,\n  type ResolvedProvenance,\n} from '@aglyn/aglyn/app-utils/marketplace-provenance'\nexport {\n  applyArtifactUpdate,\n  describeChange,\n  planArtifactUpdate,\n  summarizeSchemaChange,\n  summarizeValue,\n  type ArtifactChange,\n  type ArtifactUpdatePlan,\n  type ChangeKind,\n} from './artifact-merge'\nexport {\n  compareArtifactVersions,\n  resolveUpdateState,\n  updateStateLabel,\n  type UpdateComparableInstall,\n  type UpdateComparableListing,\n  type UpdateState,\n  type UpdateStatus,\n} from '@aglyn/aglyn/app-utils/marketplace-update-state'\n/**\n * The email-starter policy, re-exported for the same reason the provenance and\n * visibility policies are: it lives in core because `scope:app` may not depend\n * on this lib, and publishing and install code should keep one import site.\n */\nexport {\n  emailStarterAssuranceLabel,\n  emailStarterRefusal,\n  emailStarterSendBlock,\n  inspectEmailStarter,\n  resolveEmailStarterAssurance,\n  type EmailStarterAssurance,\n  type EmailStarterInspection,\n  type EmailStarterSendBlock,\n  type EmailStarterViolation,\n  type EmailStarterViolationCode,\n} from '@aglyn/aglyn/app-utils/email-starter-policy'\n"],"names":["ARTIFACT_BASE_COLLECTION","ARTIFACT_BASE_MAX_BYTES","resolveProvenance","stableStringify","applyArtifactUpdate","describeChange","planArtifactUpdate","summarizeSchemaChange","summarizeValue","compareArtifactVersions","resolveUpdateState","updateStateLabel","emailStarterAssuranceLabel","emailStarterRefusal","emailStarterSendBlock","inspectEmailStarter","resolveEmailStarterAssurance"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;CAIC,GACD,cAAc,mBAAe;AAC7B;;;;;;;;;;;CAWC,GACD,SACEA,wBAAwB,EACxBC,uBAAuB,EACvBC,iBAAiB,EACjBC,eAAe,QAIV,gDAA+C;AACtD,SACEC,mBAAmB,EACnBC,cAAc,EACdC,kBAAkB,EAClBC,qBAAqB,EACrBC,cAAc,QAIT,sBAAkB;AACzB,SACEC,uBAAuB,EACvBC,kBAAkB,EAClBC,gBAAgB,QAKX,kDAAiD;AACxD;;;;CAIC,GACD,SACEC,0BAA0B,EAC1BC,mBAAmB,EACnBC,qBAAqB,EACrBC,mBAAmB,EACnBC,4BAA4B,QAMvB,8CAA6C"}

package/src/lib/model/marketplace-props.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ReusableComponentProp } from '@aglyn/aglyn/foundation/definitions/platform.types';
+/** The most properties one published component or layout may declare. */
+export declare const MARKETPLACE_PROPS_MAX_COUNT = 200;
+/** The sanitized declarations, or why the list was refused outright. */
+export type MarketplacePropsResult = {
+    ok: true;
+    props: ReusableComponentProp[];
+    /** Names of the properties whose default was refused and cleared. */
+    clearedDefaults: string[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Holds a published component's or layout's declared properties to the
+ * marketplace sanitizer.
+ *
+ * Every property with a usable name is kept, in order, with only the keys a
+ * declaration has. What each default, label, help text and option label must
+ * satisfy is the rule the published tree's own values meet — see the module
+ * comment — and whatever fails it is cleared rather than taken as grounds to
+ * lose the property. An entry with no usable name is skipped: nothing can
+ * bind to it, so it is not a property. A second entry with a name already
+ * taken is skipped for the same reason — bindings resolve to the first.
+ *
+ * Refuses outright only a declaration list too large to publish, which is
+ * the same answer the tree gets.
+ *
+ * Idempotent, so install and update run it again over what publish stored.
+ */
+export declare function sanitizeMarketplaceProps(raw: unknown): MarketplacePropsResult;
+/**
+ * The properties a stored listing version carries, re-held to the sanitizer,
+ * or `undefined` for a version published before properties were carried.
+ *
+ * The distinction is what install and update act on: a version with a list —
+ * even an empty one — says what the component declares, so it replaces what
+ * the installed copy has; a version with none says nothing, so the installed
+ * copy keeps its own.
+ */
+export declare function readPublishedProps(raw: unknown): ReusableComponentProp[] | undefined;