@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/model/marketplace.js

@@ -0,0 +1,929 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Marketplace marketplace v1 (AGL-44): shared types + the server-side
+ * sanitization pass that gates publishing a host component definition as a
+ * public listing. Pure data module — safe to import from API routes.
+ */ // The leaf module, not a barrel: this model is reached from both the browser
+// and API routes, and `@aglyn/aglyn` carries `createContext` (illegal in a
+// Server Component) while `@aglyn/aglyn/server` carries `node:fs` (illegal in
+// the browser). Neither is safe from here; the deep path has no dependencies.
+import { isFirstPartyMediaSrc } from "@aglyn/aglyn/app-utils/media-ref";
+import { marketplaceMinPriceUsd } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { offeredPluginVersion } from "@aglyn/aglyn/app-utils/plugin-manifest";
+// Visibility lives in core (AGL-876), for the same reason the artifact-type
+// union and the verification policy do: the console's listing route asks the
+// question and `scope:app` may not depend on `aglyn:addons`. Imported AND
+// re-exported — `installTargetsFor` and `listingArtifactLabel` below call
+// `listingArtifactType` locally, and a bare `export … from` binds nothing.
+// The write-deny classification (AGL-1361) rides along for the same reason:
+// it is a statement about the fields this policy reads, and the guard that
+// enforces it lives in core beside the rules parser.
+import { isListingBrowsable, isListingDeleted, isPrivateListing, LISTING_CLIENT_WRITABLE_FIELDS, LISTING_UNPERSISTED_FIELDS, listingArtifactType } from "@aglyn/aglyn/app-utils/marketplace-listing-visibility";
+export { isListingBrowsable, isListingDeleted, isPrivateListing, LISTING_CLIENT_WRITABLE_FIELDS, LISTING_UNPERSISTED_FIELDS, listingArtifactType,  };
+/**
+ * Publisher handles share the org-slug shape: 3–30 chars, lowercase
+ * alphanumeric plus internal hyphens. Single source of truth — the two
+ * marketplace pages historically applied two subtly different regexes to the
+ * same field (AGL-653).
+ */ export const PUBLISHER_HANDLE_PATTERN = /^[a-z0-9][a-z0-9-]{1,28}[a-z0-9]$/;
+export function isValidPublisherHandle(handle) {
+    return PUBLISHER_HANDLE_PATTERN.test(handle);
+}
+/**
+ * Human-readable label for each artifact type (AGL-864).
+ *
+ * Shared by browse cards, the listing detail page, and the seller panel so
+ * "what kind of thing is this" reads the same everywhere. Resolve a listing's
+ * label through {@link listingArtifactLabel}, which tolerates the legacy
+ * `type`/`kind` shape the way {@link listingArtifactType} does.
+ */ export const ARTIFACT_TYPE_LABELS = {
+    plugin: 'Plugin',
+    component: 'Component',
+    template: 'Site template',
+    layout: 'Layout',
+    datasetSchema: 'Dataset schema',
+    emailTemplate: 'Email template',
+    emailStarter: 'Email starter',
+    theme: 'Theme'
+};
+/** The friendly artifact-type label for a listing (AGL-864). */ export function listingArtifactLabel(listing) {
+    var _ARTIFACT_TYPE_LABELS_listingArtifactType;
+    return (_ARTIFACT_TYPE_LABELS_listingArtifactType = ARTIFACT_TYPE_LABELS[listingArtifactType(listing)]) != null ? _ARTIFACT_TYPE_LABELS_listingArtifactType : 'Component';
+}
+/**
+ * Install targets each artifact type actually supports (AGL-656).
+ *
+ * This is not a policy choice — it is where the install routes physically
+ * write. Only plugins have an org-scoped pin
+ * (`orgs/{orgId}/installs/{listingId}`, applying to every site, shadowed by
+ * a host pin). Components land in `hosts/{h}/components`, templates and
+ * layouts in `hosts/{h}/templates`: all host-scoped by nature, because a
+ * screen tree belongs to a site.
+ *
+ * Exported so the UI can ask rather than assume — an install picker that
+ * offers "this whole organization" for a template would be lying.
+ */ export const INSTALL_TARGETS = {
+    plugin: [
+        'org',
+        'host'
+    ],
+    component: [
+        'host'
+    ],
+    template: [
+        'host'
+    ],
+    layout: [
+        'host'
+    ],
+    // Dataset schemas are org-shared data (AGL-237), so they install at org
+    // scope — as a new empty dataset, not a pin (AGL-657).
+    datasetSchema: [
+        'org'
+    ],
+    emailTemplate: [
+        'host'
+    ],
+    // A campaign email is a screen, and a screen belongs to a site.
+    emailStarter: [
+        'host'
+    ],
+    // A theme is one site's visual identity, written to `hosts/{h}.theme`
+    // (AGL-1020). Applying one org-wide would repaint every site at once from a
+    // control that says "install".
+    theme: [
+        'host'
+    ]
+};
+/** Targets a listing can be installed to, defaulting to host-only. */ export function installTargetsFor(listing) {
+    var _INSTALL_TARGETS_listingArtifactType;
+    return (_INSTALL_TARGETS_listingArtifactType = INSTALL_TARGETS[listingArtifactType(listing)]) != null ? _INSTALL_TARGETS_listingArtifactType : [
+        'host'
+    ];
+}
+/**
+ * Resolves a plugin listing's install state for a site from its two pins
+ * (AGL-656). The host pin shadows the org pin, mirroring the loader, so the
+ * effective version and update prompt always describe what actually runs here.
+ */ export function resolvePluginInstallState(latestVersion, hostPin, orgPin) {
+    var _ref;
+    const effective = (_ref = hostPin != null ? hostPin : orgPin) != null ? _ref : null;
+    const installedVersion = (effective == null ? void 0 : effective.version) != null ? String(effective.version) : null;
+    return {
+        scope: hostPin ? 'host' : orgPin ? 'org' : null,
+        installedVersion,
+        shadowed: Boolean(hostPin && orgPin),
+        // Any difference is an upgrade prompt, matching the installed-plugins card
+        // — pins only ever move forward, so "different" means "behind".
+        updateAvailable: installedVersion != null && latestVersion != null && String(latestVersion) !== installedVersion
+    };
+}
+export function resolveOrgInstallSummary(hosts, hostPins, orgPin) {
+    const orgWide = Boolean(orgPin);
+    const orgVersion = (orgPin == null ? void 0 : orgPin.version) != null ? String(orgPin.version) : null;
+    const sites = [];
+    const hostPinnedIds = [];
+    const availableHostIds = [];
+    for (const host of hosts){
+        const hostPin = hostPins[host.id];
+        if (hostPin) hostPinnedIds.push(host.id);
+        if (!hostPin && !orgPin) {
+            availableHostIds.push(host.id);
+            continue;
+        }
+        sites.push({
+            hostId: host.id,
+            label: host.label,
+            version: (hostPin == null ? void 0 : hostPin.version) != null ? String(hostPin.version) : orgVersion,
+            pinnedBy: hostPin ? 'host' : 'org',
+            shadowed: Boolean(hostPin && orgPin)
+        });
+    }
+    return {
+        orgWide,
+        orgVersion,
+        sites,
+        hostPinnedIds,
+        availableHostIds,
+        installedAnywhere: orgWide || hostPinnedIds.length > 0
+    };
+}
+/**
+ * Which sites an uninstall actually affects (AGL-1027).
+ *
+ * The shadowing case is the whole reason this is a function rather than a
+ * filter at the call site. A pin is not a boolean per site: an org pin covers
+ * everything, a host pin names one site, and where both exist the host pin
+ * wins. So "remove" means three different things depending on which pointer is
+ * being dropped and what is left underneath — and the one thing the dialog must
+ * never do is tell someone a plugin will stop working when it will not.
+ *
+ * Returns every site the operation touches, including the ones that keep the
+ * plugin, so the dialog can say so explicitly instead of omitting them and
+ * leaving the count unexplained.
+ */ export function resolveUninstallTargets(orgInstall, scope, hostId) {
+    if (scope === 'host') {
+        const site = orgInstall.sites.find((entry)=>entry.hostId === hostId);
+        if (!site) return [];
+        // Its own pin goes; the org pin, if there is one, still covers it.
+        return [
+            {
+                hostId: site.hostId,
+                label: site.label,
+                stillCovered: orgInstall.orgWide
+            }
+        ];
+    }
+    // Dropping the org pin: every site loses it EXCEPT those holding a host pin
+    // of their own, which were already shadowing the org pin anyway.
+    return orgInstall.sites.map((site)=>({
+            hostId: site.hostId,
+            label: site.label,
+            stillCovered: site.pinnedBy === 'host'
+        }));
+}
+/**
+ * Turns a targeting choice into the concrete install operations for a listing
+ * (AGL-773), honoring what each artifact type physically supports (see
+ * {@link INSTALL_TARGETS}).
+ *
+ * The rules aren't uniform, and the picker must not promise what an artifact
+ * can't do:
+ * - **Org-pinnable** (plugin, datasetSchema) + "all sites" → a SINGLE org pin,
+ *   which also covers sites created later.
+ * - **Host-scoped** (component, template, layout, emailTemplate) has no org
+ *   pin, so "all sites" fans out to every CURRENT host — new sites are NOT
+ *   covered automatically. The UI has to say so.
+ * - "Selected sites" is always host pins, even for an org-pinnable artifact:
+ *   the admin named specific sites, so honor that literally — UNLESS the
+ *   artifact can't host-pin at all (datasetSchema), where the per-site choice
+ *   is meaningless and collapses to the org pin.
+ */ export function resolveInstallPlan(listing, targeting, hosts) {
+    const targets = installTargetsFor(listing);
+    const canOrgPin = targets.includes('org');
+    const canHostPin = targets.includes('host');
+    if (targeting === 'all-sites') {
+        if (canOrgPin) return [
+            {
+                scope: 'org'
+            }
+        ];
+        return hosts.allHostIds.map((hostId)=>({
+                scope: 'host',
+                hostId
+            }));
+    }
+    // selected-sites
+    if (!canHostPin) return [
+        {
+            scope: 'org'
+        }
+    ];
+    return hosts.selectedHostIds.map((hostId)=>({
+            scope: 'host',
+            hostId
+        }));
+}
+/**
+ * Verification requests live in core (AGL-1217), for the same reason
+ * `MarketplaceArtifactType` does (AGL-1016): the console's staff review route
+ * needs the policy, and `scope:app` may not depend on `aglyn:addons`.
+ * Re-exported here so publishing code keeps one import site.
+ */ export { VERIFICATION_BLOCK_MESSAGES, VERIFICATION_DECLINE_COOLDOWN_DAYS, timestampMs, verificationRequestBlock } from "@aglyn/aglyn/app-utils/marketplace-verification";
+/** Only approved bytes may be installed. Absent state is NOT approval. */ export function isVersionApproved(version) {
+    return (version == null ? void 0 : version.reviewState) === 'approved';
+}
+/**
+ * Whether an install would hand the viewer UNREVIEWED bytes (AGL-1083).
+ *
+ * `install-plugin` deliberately lets a publisher install their own
+ * unapproved version — you cannot test a version you cannot install, and
+ * the AGL-969 checklist asks them to confirm they tested these exact bytes
+ * on a site they control. The route reaches that case through
+ * `newestApprovedVersion(...) ?? fallback`, where the fallback is
+ * `latestVersion` and applies ONLY when the caller owns the listing and no
+ * approved version exists at all.
+ *
+ * Lives here rather than in the listing component because the UI has to
+ * describe exactly what the route will do. Two independent readings of
+ * "would this be unreviewed?" is how the affordance ends up warning about
+ * the wrong installs, or staying silent on the right ones.
+ *
+ * The route's `newest` is `newestInstallableVersion` since AGL-2368 — a
+ * revoked version is no longer a candidate, so it no longer suppresses the
+ * fallback either. `revocation` is optional because most callers have none;
+ * without it this asks the pre-AGL-2368 question, which is the same answer
+ * whenever the mirror is current.
+ */ export function installsUnreviewedFallback(listing, viewerOrgId, revocation) {
+    var _listing_latestVersion;
+    if (!(listing == null ? void 0 : listing.profileId) || !viewerOrgId) return false;
+    // Only the publishing org gets the fallback; everyone else is refused.
+    if (listing.profileId !== viewerOrgId) return false;
+    // An INSTALLABLE version exists → the route serves THAT, however much newer
+    // the pending one is. Not an unreviewed install. Reading approval alone got
+    // this backwards for a revoked listing: the route would fall back to
+    // `latestVersion` for the owner and hand over unreviewed bytes, while the
+    // page said nothing, because a stopped version still counted as approved.
+    if (offeredPluginVersion(listing, revocation)) return false;
+    return Boolean(String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : ''));
+}
+/**
+ * The version a fresh install should pin: newest APPROVED, never
+ * `latestVersion`. A pending update is simply not offered, so publishing
+ * cannot ship code past review, and the previously approved version keeps
+ * installing while the new one waits.
+ */ export function newestApprovedVersion(versions) {
+    const approved = versions.filter((entry)=>isVersionApproved(entry));
+    if (!approved.length) return null;
+    return approved.reduce((best, entry)=>{
+        var _ref, _ref1;
+        var _entry_publishedAt_toMillis, _entry_publishedAt, _best_publishedAt_toMillis, _best_publishedAt;
+        return ((_ref = (_entry_publishedAt = entry.publishedAt) == null ? void 0 : (_entry_publishedAt_toMillis = _entry_publishedAt.toMillis) == null ? void 0 : _entry_publishedAt_toMillis.call(_entry_publishedAt)) != null ? _ref : 0) > ((_ref1 = (_best_publishedAt = best.publishedAt) == null ? void 0 : (_best_publishedAt_toMillis = _best_publishedAt.toMillis) == null ? void 0 : _best_publishedAt_toMillis.call(_best_publishedAt)) != null ? _ref1 : 0) ? entry : best;
+    });
+}
+/**
+ * What a listing is still missing before it can face the marketplace
+ * (AGL-968/994).
+ *
+ * A private plugin is allowed to be undocumented — its only audience already
+ * knows what it is and why it exists. A public one is not: description,
+ * README and license are what a stranger deciding whether to run your code
+ * has to go on, and they are exactly the fields the review checklist asks
+ * about. So going public is gated on the METADATA, never on a re-review —
+ * approval is a statement about bytes, and the bytes did not change.
+ *
+ * Returns the human field names, so the caller can say what to fix rather
+ * than just refusing.
+ */ export function missingPublicListingContent(listing) {
+    var _listing_description, _listing_readme, _listing_license;
+    const missing = [];
+    if (!((_listing_description = listing.description) == null ? void 0 : _listing_description.trim())) missing.push('a description');
+    if (!((_listing_readme = listing.readme) == null ? void 0 : _listing_readme.trim())) missing.push('a README');
+    if (!((_listing_license = listing.license) == null ? void 0 : _listing_license.trim())) missing.push('a license');
+    return missing;
+}
+/** Fixed category taxonomy for marketplace listings (AGL-430). */ export const LISTING_CATEGORIES = [
+    'analytics',
+    'automation',
+    'commerce',
+    'communication',
+    'content',
+    'design',
+    'forms',
+    'integrations',
+    'marketing',
+    'productivity',
+    'seo',
+    'security'
+];
+export const LISTING_README_MAX_CHARS = 20000;
+export const LISTING_MAX_SCREENSHOTS = 6;
+const HTTPS_URL = /^https:\/\/[^\s]+$/;
+/**
+ * The message every listing IMAGE field returns when it is refused. Names the
+ * remedy, because "must be an https URL" was true of the value the publisher
+ * just typed and told them nothing.
+ */ export const LISTING_IMAGE_ERROR = 'must be an image from your media library — paste a link and the people ' + 'browsing your listing would be loading it from a server you control';
+/** Length cap shared by every listing URL field. */ const LISTING_URL_MAX_CHARS = 500;
+/**
+ * Whether a listing image field is one we will store (AGL-1701).
+ *
+ * Listing artwork is the one publisher-supplied value that OTHER orgs' users
+ * load. It is also, established while fixing this, gated by nothing: review
+ * is a statement about a version's bytes (AGL-966), the staff review route
+ * never projects `logoUrl`/`screenshots` so a reviewer cannot see them even
+ * if the checklist asked, and `update-listing` writes them at any time
+ * without touching `reviewStatus` — so a listing can pass review with benign
+ * artwork and swap it afterwards while still reading `verified`.
+ *
+ * Constraining the INPUT rather than sanitizing the output is the whole
+ * point: the render sites are three components and an `og:image`, and the
+ * next one added would not know to sanitize.
+ */ function isListingImageValue(value) {
+    return typeof value === 'string' && value.length <= LISTING_URL_MAX_CHARS && isFirstPartyMediaSrc(value);
+}
+/**
+ * Validates publisher-editable listing content (AGL-430). Returns the
+ * normalized subset to persist, or an error. Shared by publish and the
+ * update-listing action so both paths accept exactly the same shapes.
+ *
+ * IMAGE fields and LINK fields are validated differently (AGL-1701).
+ * `homepageUrl` and `repositoryUrl` stay any-https: they are anchors a reader
+ * chooses to follow, and a publisher's homepage living on the publisher's
+ * domain is the entire point of the field. `logoUrl` and `screenshots` are
+ * `<img src>`, which fetches with no such choice, so those are held to
+ * first-party media.
+ */ export function validateListingContent(input) {
+    const content = {};
+    for (const key of [
+        'homepageUrl',
+        'repositoryUrl'
+    ]){
+        const value = input[key];
+        if (value === undefined || value === '') continue;
+        if (typeof value !== 'string' || !HTTPS_URL.test(value) || value.length > LISTING_URL_MAX_CHARS) {
+            return {
+                ok: false,
+                error: `${key} must be an https URL`
+            };
+        }
+        content[key] = value;
+    }
+    const logoUrl = input['logoUrl'];
+    if (logoUrl !== undefined && logoUrl !== '') {
+        if (!isListingImageValue(logoUrl)) {
+            return {
+                ok: false,
+                error: `logoUrl ${LISTING_IMAGE_ERROR}`
+            };
+        }
+        content.logoUrl = logoUrl;
+    }
+    const screenshots = input['screenshots'];
+    if (screenshots !== undefined) {
+        if (!Array.isArray(screenshots) || screenshots.length > LISTING_MAX_SCREENSHOTS || screenshots.some((url)=>!isListingImageValue(url))) {
+            return {
+                ok: false,
+                error: `screenshots must be up to ${LISTING_MAX_SCREENSHOTS} images, and ` + `each ${LISTING_IMAGE_ERROR}`
+            };
+        }
+        content.screenshots = screenshots;
+    }
+    const readme = input['readme'];
+    if (readme !== undefined) {
+        if (typeof readme !== 'string' || readme.length > LISTING_README_MAX_CHARS) {
+            return {
+                ok: false,
+                error: `readme must be markdown up to ${LISTING_README_MAX_CHARS} chars`
+            };
+        }
+        if (readme.trim()) content.readme = readme;
+    }
+    const license = input['license'];
+    if (license !== undefined && license !== '') {
+        if (typeof license !== 'string' || license.length > 40) {
+            return {
+                ok: false,
+                error: 'license must be a short label (max 40)'
+            };
+        }
+        content.license = license;
+    }
+    const categories = input['categories'];
+    if (categories !== undefined) {
+        if (!Array.isArray(categories) || categories.length > 3 || categories.some((entry)=>!LISTING_CATEGORIES.includes(String(entry)))) {
+            return {
+                ok: false,
+                error: 'categories must be up to 3 entries from the fixed taxonomy'
+            };
+        }
+        content.categories = categories.map(String);
+    }
+    return {
+        ok: true,
+        content
+    };
+}
+/** Social keys whose URL must live on the network's own host. */ const PUBLISHER_SOCIAL_HOSTS = {
+    githubUrl: [
+        'github.com'
+    ],
+    xUrl: [
+        'x.com',
+        'twitter.com'
+    ],
+    linkedinUrl: [
+        'linkedin.com'
+    ]
+};
+const SUPPORT_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Validates the publisher-profile extras (AGL-1009), sharing
+ * `validateListingContent`'s URL discipline: https only, length capped,
+ * validated on the save route (server-owned like the handle — no client
+ * write path carries these). An explicit empty string comes back as `''` so
+ * the save route can distinguish "clear this field" from "left untouched".
+ */ export function validatePublisherProfileContent(input) {
+    const content = {};
+    const urlKeys = [
+        'avatarUrl',
+        'website',
+        'supportUrl',
+        'githubUrl',
+        'xUrl',
+        'linkedinUrl'
+    ];
+    for (const key of urlKeys){
+        const value = input[key];
+        if (value === undefined) continue;
+        if (value === '') {
+            content[key] = '';
+            continue;
+        }
+        // The same https-or-nothing rule as listing URLs: `javascript:`, `data:`
+        // and plain http all fail the one test.
+        if (typeof value !== 'string' || !HTTPS_URL.test(value) || value.length > 500) {
+            return {
+                ok: false,
+                error: `${key} must be an https URL`
+            };
+        }
+        const hosts = PUBLISHER_SOCIAL_HOSTS[key];
+        if (hosts) {
+            let host = '';
+            try {
+                host = new URL(value).hostname.toLowerCase();
+            } catch (unused) {
+                return {
+                    ok: false,
+                    error: `${key} must be an https URL`
+                };
+            }
+            if (!hosts.some((allowed)=>host === allowed || host.endsWith(`.${allowed}`))) {
+                return {
+                    ok: false,
+                    error: `${key} must link to ${hosts[0]}`
+                };
+            }
+        }
+        content[key] = value;
+    }
+    const supportEmail = input['supportEmail'];
+    if (supportEmail !== undefined) {
+        if (supportEmail === '') {
+            content.supportEmail = '';
+        } else if (typeof supportEmail !== 'string' || supportEmail.length > 200 || !SUPPORT_EMAIL.test(supportEmail)) {
+            return {
+                ok: false,
+                error: 'supportEmail must be an email address'
+            };
+        } else {
+            content.supportEmail = supportEmail;
+        }
+    }
+    return {
+        ok: true,
+        content
+    };
+}
+/**
+ * Render-time guard for publisher links (AGL-1009): only an `https://` URL
+ * is ever emitted as an href. The save route already refuses anything else,
+ * but the doc is client-updatable on its cosmetic fields historically, so
+ * the renderer must not trust stored data it did not write.
+ */ export function safePublisherHref(url) {
+    return typeof url === 'string' && /^https:\/\//i.test(url) && url.length <= 500 ? url : undefined;
+}
+/**
+ * Platform revenue share on paid listings (AGL-46) — UI COPY ONLY. The
+ * checkout route prices from the `marketplaceFeePct` ENTITLEMENT
+ * (`resolveMarketplaceFeePct`, AGL-1543), which resolves the effective
+ * plan and per-org overrides; these constants exist for seller-facing
+ * copy and must be kept in step with the plan table.
+ */ export const MARKETPLACE_PLATFORM_FEE_PERCENT = 20;
+/** Free-plan publishers pay a higher share. See AGL-1543 note above. */ export const MARKETPLACE_PLATFORM_FEE_PERCENT_FREE_PLAN = 30;
+/** One-time listing price ceiling (whole USD). */ export const MARKETPLACE_MAX_PRICE_USD = 1000;
+/**
+ * One-time listing price FLOOR for a PAID listing (whole USD, AGL-2343).
+ *
+ * Marketplace checkout is a destination charge with no `application_fee_amount`
+ * — deliberately, so the sales tax stays with the platform that owes it
+ * (AGL-1544) — which means Stripe debits its fee from the PLATFORM's balance.
+ * Stripe's fixed 30¢ dominates at low prices, so under this figure the
+ * platform's cut is smaller than the cost of collecting it and every sale is a
+ * loss. The floor is the cheapest listing price that still clears the cost of
+ * processing it.
+ *
+ * NOT A CHOSEN NUMBER. `marketplaceMinPriceUsd` derives it from the plan
+ * table's lowest take rate and the dearest enabled payment method; this is a
+ * re-export so that the routes and the console forms cannot quote different
+ * minimums at the same publisher. Zero stays legal — a free listing takes no
+ * payment and costs nothing to process.
+ */ export const MARKETPLACE_MIN_PRICE_USD = marketplaceMinPriceUsd();
+/**
+ * The refusal message for a listing price, or `undefined` when the price may
+ * be published (AGL-2343).
+ *
+ * ONE VALIDATOR FOR SEVEN DOORS. Each publish route used to inline its own
+ * range check against the maximum — and `publish-theme.ts` and
+ * `publish-layout.ts` had none at all, so a $250,000 theme was publishable.
+ * The doors call this, and `publishPreconditionRefusal` calls it too, so a
+ * route that forgets is still covered.
+ *
+ * Takes the price the route already rounded: a listing price is whole dollars
+ * everywhere, and a validator that accepted $2.99 would be validating a number
+ * that is never stored.
+ */ export function marketplacePriceRefusal(priceUsd) {
+    if (!Number.isFinite(priceUsd) || priceUsd < 0) {
+        return `Price must be 0 (free) or $${MARKETPLACE_MIN_PRICE_USD}–$${MARKETPLACE_MAX_PRICE_USD} USD`;
+    }
+    if (priceUsd > MARKETPLACE_MAX_PRICE_USD) {
+        return `Price must be 0 (free) or $${MARKETPLACE_MIN_PRICE_USD}–$${MARKETPLACE_MAX_PRICE_USD} USD`;
+    }
+    // Zero is not "below the floor" — it is the free listing, which takes no
+    // payment at all and so costs nothing to process.
+    if (priceUsd > 0 && priceUsd < MARKETPLACE_MIN_PRICE_USD) {
+        return `A paid listing must be at least $${MARKETPLACE_MIN_PRICE_USD} USD — ` + `below that, processing the payment costs more than the platform fee ` + `on the sale. Use 0 for a free listing.`;
+    }
+    return undefined;
+}
+/**
+ * The allowlists and the sanitizer live in core since AGL-2939 — see
+ * `@aglyn/aglyn/app-utils/node-definition-sanitizer` — and keep their
+ * marketplace names here for the publishers that import them.
+ */ import { MARKETPLACE_COMPONENT_ID_ALLOWLIST, MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST, MARKETPLACE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST, MARKETPLACE_DEFINITION_MAX_BYTES, sanitizeMarketplaceDefinition, marketplaceDefinitionToNested, MARKETPLACE_DATASET_FIELD_TYPES } from "@aglyn/aglyn/app-utils/node-definition-sanitizer";
+export { MARKETPLACE_COMPONENT_ID_ALLOWLIST, MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST, MARKETPLACE_EMAIL_STARTER_COMPONENT_ID_ALLOWLIST, MARKETPLACE_DEFINITION_MAX_BYTES, sanitizeMarketplaceDefinition, marketplaceDefinitionToNested, MARKETPLACE_DATASET_FIELD_TYPES,  };
+export { MARKETPLACE_SAFE_HREF, MARKETPLACE_SAFE_SRC } from "@aglyn/aglyn/app-utils/node-definition-sanitizer";
+/** Field cap on a published schema — mirrors the console's create limit. */ export const MARKETPLACE_DATASET_MAX_FIELDS = 100;
+const KEPT_VALIDATION_KEYS = [
+    'required',
+    'regex',
+    'min',
+    'max',
+    'options'
+];
+/**
+ * Validates and strips a `DatasetModel` for publishing as a marketplace
+ * dataset schema (AGL-657).
+ *
+ * Publishes STRUCTURE ONLY — records never travel. That is the whole safety
+ * story for this artifact type: a dataset's rows are the org's customer data,
+ * so the publish path reads the model and nothing else, and there is no code
+ * path here that can reach the `records` subcollection.
+ *
+ * Two cross-org hazards the issue called out, handled by carrying enough
+ * context for the INSTALLER to decide rather than by rejecting at publish:
+ * - `reference` FKs point at a dataset id that only exists in the publisher's
+ *   org. The id is kept alongside the referenced dataset's label so the
+ *   installer can relink by name and degrade the field when it can't (see
+ *   `resolveInstalledDatasetSchema`).
+ * - `customType` names a plugin-declared field type (AGL-434) whose plugin the
+ *   installing org may not have. Unknown custom types already degrade to their
+ *   base type at render, so the name rides along untouched.
+ */ export function sanitizeDatasetSchema(model) {
+    const fields = model == null ? void 0 : model.fields;
+    if (!fields || typeof fields !== 'object') {
+        return {
+            ok: false,
+            error: 'Dataset has no field model to publish'
+        };
+    }
+    // Order is the display contract; fall back to key order for models written
+    // before `order` was required so older datasets stay publishable.
+    const order = Array.isArray(model.order) ? model.order.map(String) : Object.keys(fields);
+    const kept = order.filter((id)=>fields[id]);
+    if (!kept.length) {
+        return {
+            ok: false,
+            error: 'Dataset has no fields to publish'
+        };
+    }
+    if (kept.length > MARKETPLACE_DATASET_MAX_FIELDS) {
+        return {
+            ok: false,
+            error: `Dataset schemas are limited to ${MARKETPLACE_DATASET_MAX_FIELDS} fields`
+        };
+    }
+    const schema = {
+        fields: {},
+        order: kept
+    };
+    for (const id of kept){
+        var _fields_id, _field_type, _field_name;
+        const field = (_fields_id = fields[id]) != null ? _fields_id : {};
+        const type = String((_field_type = field.type) != null ? _field_type : 'text');
+        if (!MARKETPLACE_DATASET_FIELD_TYPES.includes(type)) {
+            return {
+                ok: false,
+                error: `Field "${id}" has an unsupported type`
+            };
+        }
+        const safe = {
+            name: String((_field_name = field.name) != null ? _field_name : id).slice(0, 120),
+            type
+        };
+        if (field.customType) safe.customType = String(field.customType).slice(0, 60);
+        if (field.description) {
+            safe.description = String(field.description).slice(0, 500);
+        }
+        if (field.required === true) safe.required = true;
+        // Defaults are publisher-authored values, not data — keep only primitives
+        // so a default can't smuggle a nested object into the installing org.
+        if (field.default !== undefined && (typeof field.default === 'string' || typeof field.default === 'number' || typeof field.default === 'boolean')) {
+            safe.default = field.default;
+        }
+        if (field.validation && typeof field.validation === 'object') {
+            const validation = {};
+            for (const key of KEPT_VALIDATION_KEYS){
+                if (field.validation[key] !== undefined) {
+                    validation[key] = field.validation[key];
+                }
+            }
+            if (Object.keys(validation).length) safe.validation = validation;
+        }
+        if (field.reference && typeof field.reference === 'object') {
+            safe.reference = _extends({}, field.reference.datasetId && {
+                datasetId: String(field.reference.datasetId)
+            }, field.reference.datasetLabel && {
+                datasetLabel: String(field.reference.datasetLabel).slice(0, 120)
+            }, field.reference.displayFieldId && {
+                displayFieldId: String(field.reference.displayFieldId)
+            }, field.reference.multiple === true && {
+                multiple: true
+            }, field.reference.onDelete && {
+                onDelete: String(field.reference.onDelete)
+            });
+        }
+        schema.fields[id] = safe;
+    }
+    const serialized = JSON.stringify(schema);
+    if (serialized.length > MARKETPLACE_DEFINITION_MAX_BYTES) {
+        return {
+            ok: false,
+            error: 'Dataset schema is too large to publish'
+        };
+    }
+    return {
+        ok: true,
+        schema
+    };
+}
+/**
+ * Rewrites a published schema for the installing org (AGL-657).
+ *
+ * `reference` fields are the only part of a schema that can't cross an org
+ * boundary as-is: they name a dataset id in the PUBLISHER's org. Relink by the
+ * referenced dataset's label when the installing org has one by that name;
+ * otherwise degrade the field to plain `text` and report it, because a
+ * reference field pointing at a dataset that doesn't exist renders as a broken
+ * picker — silently keeping the dead id would install something visibly
+ * broken and blame the installer for it.
+ *
+ * `existingDatasets` maps lowercased display name → dataset id in the target.
+ */ export function resolveInstalledDatasetSchema(schema, existingDatasets) {
+    const degradedFieldIds = [];
+    const fields = {};
+    for (const id of schema.order){
+        var _ref;
+        var _field_reference;
+        const field = schema.fields[id];
+        if (!field) continue;
+        if (field.type !== 'reference' && !field.reference) {
+            fields[id] = field;
+            continue;
+        }
+        const label = String((_ref = (_field_reference = field.reference) == null ? void 0 : _field_reference.datasetLabel) != null ? _ref : '').toLowerCase();
+        const relinked = label ? existingDatasets[label] : undefined;
+        if (relinked) {
+            fields[id] = _extends({}, field, {
+                reference: _extends({}, field.reference, {
+                    datasetId: relinked
+                })
+            });
+            continue;
+        }
+        const { reference: _dropped } = field, rest = _object_without_properties_loose(field, [
+            "reference"
+        ]);
+        fields[id] = _extends({}, rest, {
+            type: 'text'
+        });
+        degradedFieldIds.push(id);
+    }
+    return {
+        schema: {
+            fields,
+            order: schema.order
+        },
+        degradedFieldIds
+    };
+}
+/** What each artifact type drops into the org when it installs. */ const ARTIFACT_INSTALL_RESULT = {
+    plugin: 'A plugin, sandboxed on its own origin with a per-plugin CSP',
+    component: 'An editable component you can place on any screen',
+    template: 'Editable screens you can rework in Besigner',
+    layout: 'An editable layout you can apply to any screen',
+    datasetSchema: 'A new empty dataset with its fields already defined',
+    emailTemplate: 'An editable email design you can send campaigns from',
+    emailStarter: 'A new email in your Email templates list, ready to edit and send',
+    theme: 'A theme applied to the site you choose'
+};
+/**
+ * The `WHAT'S INCLUDED` checklist the marketplace listing mockup shows
+ * (AGL-2173), derived entirely from facts the listing already carries.
+ *
+ * The mockup's own bullets — `12 responsive screens`, `Blog & work
+ * layouts` — are publisher-authored prose, and nothing collects them:
+ * there is no content manifest on a listing or a version, so counting
+ * screens would mean inventing a number. What IS knowable is what the
+ * install physically does, where it lands, whether it has been reviewed,
+ * and under what licence — which is the question a shopper is asking when
+ * they read that box.
+ *
+ * Ordered decision-first: what you get, then where it goes, then the two
+ * facts that most often stop an install.
+ */ export function listingInclusions(listing, options = {}) {
+    var _ARTIFACT_INSTALL_RESULT_type, _listing_priceUsd;
+    const type = listingArtifactType(listing);
+    const rows = [
+        {
+            label: (_ARTIFACT_INSTALL_RESULT_type = ARTIFACT_INSTALL_RESULT[type]) != null ? _ARTIFACT_INSTALL_RESULT_type : 'An installable artifact',
+            tone: 'included'
+        }
+    ];
+    const targets = installTargetsFor(listing);
+    rows.push({
+        label: targets.includes('org') ? 'Installs org-wide, covering sites you add later' : 'Installs per site — new sites are not covered automatically',
+        // The host-only case is a real limit and the picker already has to say
+        // so; softening it here would put the caveat only where nobody reads.
+        tone: targets.includes('org') ? 'included' : 'note'
+    });
+    if (options.reviewedVersion) {
+        rows.push({
+            label: 'This version passed marketplace review',
+            tone: 'included'
+        });
+    }
+    if (listing.license) {
+        rows.push({
+            label: `Licensed ${listing.license}`,
+            tone: 'included'
+        });
+    }
+    rows.push({
+        label: Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0) > 0 ? 'A one-time purchase — updates to this listing are included' : 'Free, including every future update',
+        tone: 'included'
+    });
+    return rows;
+}
+/**
+ * True when this purchase document still entitles.
+ *
+ * Deliberately a truthiness test and not `!= null`: `refundedAt` is a
+ * Firestore Timestamp on the server, a client Timestamp in the browser and a
+ * sentinel in the webhook's own tests, and every one of those is truthy while
+ * a missing field (every purchase written before AGL-1546) is not.
+ */ export function isLivePurchase(purchase) {
+    return Boolean(purchase) && !(purchase == null ? void 0 : purchase.refundedAt);
+}
+/**
+ * True when this buyer's purchase documents include a live one for `listingId`.
+ *
+ * Both callers pass everything they read — the server's query is already
+ * narrowed to the listing, the client's is narrowed only to the buyer — so the
+ * listing filter belongs inside the shared predicate too, not beside it.
+ */ export function hasLivePurchaseOf(purchases, listingId) {
+    if (!listingId) return false;
+    return (purchases != null ? purchases : []).some((purchase)=>(purchase == null ? void 0 : purchase.listingId) === listingId && isLivePurchase(purchase));
+}
+/**
+ * WHO A PURCHASE LICENSES (AGL-2331).
+ *
+ * ## The model
+ *
+ * **A marketplace purchase licenses an ORGANIZATION, not a person.** That is
+ * not a new decision — it is the one already published. The Marketplace
+ * Publisher Agreement §8.1 says a paid Artifact is licensed "to the installing
+ * organization", and §2 grants the right to sublicense "to organizations that
+ * install it". Until now the code enforced a per-PERSON licence instead, and
+ * the mismatch cut both ways: an agency developer who is an owner across five
+ * client workspaces bought once and installed into all five, and — because the
+ * duplicate-purchase guard shares this predicate — could not buy a second
+ * licence even when they wanted to. Conforming the code to the published terms
+ * is the smaller of the two changes; the alternative amends a version-pinned
+ * legal document and stops every publisher until they re-accept it.
+ *
+ * Three consequences follow, and all three are the point:
+ *
+ * 1. A licence held by org A does not install into org B. The agency buys per
+ *    client workspace, which is what the agreement says they are buying.
+ * 2. Buying a second licence is a real second sale, not a `409`.
+ * 3. Any member of the owning org with `installPlugins` may install what the
+ *    ORG bought — including colleagues who were not the buyer, and including
+ *    the buyer's replacement after they leave. A licence that evaporates when
+ *    one employee's account is deleted is not an organizational licence.
+ *
+ * ## The legacy grant, and why it never expires
+ *
+ * A purchase written before this change carries NO `buyerOrgId` — there was
+ * no buyer org anywhere in the pipeline to record. Those are real purchases by
+ * real customers, and reinterpreting one as "licensed to no organization"
+ * would revoke access somebody paid for. So a purchase with no `buyerOrgId` at
+ * all keeps its ORIGINAL, person-scoped meaning, forever: it entitles the uid
+ * that bought it, in every org that uid can install into. Nothing is
+ * migrated, nothing is claimed by the first org to use it, and nothing is
+ * revoked — the ambiguity resolves in the customer's favour by construction,
+ * with no backfill to get right and no window during which a paying customer
+ * is locked out.
+ *
+ * The grandfather is bounded by time rather than policed: it can only ever
+ * apply to purchases already written, because from AGL-2331 onward checkout
+ * refuses to open a session that does not name a validated buyer org. It is
+ * therefore a shrinking set that never grows, not a hole left open.
+ *
+ * `orgId` may be empty (a site with no owning org). That is not a licence to
+ * anything, so only the legacy uid grant can hold — never a `buyerOrgId ===
+ * ''` match, which is why the org branch tests for a non-empty string on the
+ * document itself rather than comparing the two values directly.
+ */ export function purchaseEntitlesOrg(purchase, actor) {
+    if (!isLivePurchase(purchase)) return false;
+    const purchaseOrgId = purchase == null ? void 0 : purchase.buyerOrgId;
+    if (typeof purchaseOrgId === 'string' && purchaseOrgId) {
+        return Boolean(actor.orgId) && purchaseOrgId === actor.orgId;
+    }
+    // Legacy: no buyer org was ever recorded, so it means what it meant when it
+    // was sold. Never revoked, never migrated.
+    return Boolean(actor.uid) && (purchase == null ? void 0 : purchase.buyerUid) === actor.uid;
+}
+/**
+ * True when these purchase documents include one that licenses `orgId` for
+ * `listingId` — the org-scoped counterpart of `hasLivePurchaseOf`.
+ *
+ * Same shape and same home as the liveness predicate, and for the same reason
+ * (AGL-2158): the install routes, the checkout duplicate guard and the listing
+ * page all have to answer "does this workspace hold a licence" identically, and
+ * the way they came apart last time was four characters of predicate copied
+ * into a component.
+ */ export function hasOrgLicenceOf(purchases, listingId, actor) {
+    if (!listingId) return false;
+    return (purchases != null ? purchases : []).some((purchase)=>(purchase == null ? void 0 : purchase.listingId) === listingId && purchaseEntitlesOrg(purchase, actor));
+}
+/**
+ * Every org id these purchases license for `listingId`, in document order.
+ *
+ * What the console renders so a buyer can see WHICH workspace a licence they
+ * paid for belongs to (AGL-2331) — the question that has no answer at all
+ * while entitlement is person-scoped, and the one an agency has to answer
+ * before deciding whether it needs another.
+ *
+ * Legacy person-scoped purchases contribute no org id, because they name
+ * none; a caller rendering this list has to say so rather than invent one.
+ */ export function licensedOrgIdsFor(purchases, listingId) {
+    const seen = [];
+    for (const purchase of purchases != null ? purchases : []){
+        if ((purchase == null ? void 0 : purchase.listingId) !== listingId || !isLivePurchase(purchase)) continue;
+        const orgId = purchase == null ? void 0 : purchase.buyerOrgId;
+        if (typeof orgId === 'string' && orgId && !seen.includes(orgId)) {
+            seen.push(orgId);
+        }
+    }
+    return seen;
+}
+
+//# sourceMappingURL=marketplace.js.map