@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/connect.js

@@ -0,0 +1,205 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin, getOrgForUser } from "@aglyn/tenant-data-admin";
+import { resolvePlatformStripeMode } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+import { buildRoute, Route } from "@aglyn/aglyn/server";
+import { canActAsPublisher } from "./publisher-profile.js";
+async function stripe(path, params) {
+    const response = await fetch(`https://api.stripe.com/v1/${path}`, _extends({
+        method: params ? 'POST' : 'GET',
+        headers: _extends({
+            Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`
+        }, params && {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        })
+    }, params && {
+        body: params.toString()
+    }));
+    const payload = await response.json();
+    if (!response.ok) {
+        var _ref;
+        var _payload_error;
+        throw new Error((_ref = payload == null ? void 0 : (_payload_error = payload.error) == null ? void 0 : _payload_error.message) != null ? _ref : `Stripe ${path} failed`);
+    }
+    return payload;
+}
+/**
+ * Stripe Connect onboarding for marketplace publishers (AGL-46): creates an
+ * Express account on first call (id stored on the profile via Admin SDK),
+ * refreshes `stripeChargesEnabled` on every call, and returns an
+ * account-link URL while onboarding is incomplete. 501 without Stripe env.
+ */ export const connectHandler = async (req, res)=>{
+    var _req_headers_authorization;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    if (!process.env.STRIPE_SECRET_KEY) {
+        return res.status(501).json({
+            error: 'Payouts are not configured (STRIPE_SECRET_KEY).'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _ref, _req_headers_origin;
+        var _req_body;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        // Payouts belong to the publishing ORG (AGL-652) — the marketplace pays
+        // the organization that published, not whoever set the account up. Only
+        // a manager may bind a payout destination.
+        //
+        // The acting org comes from the client (AGL-861): the URL is the source of
+        // truth for which workspace the seller is in, and a member can belong to
+        // several. Guessing with `getOrgForUser(uid)` returned the FIRST org from
+        // the reverse index, so the profile check ran against the wrong org and
+        // 412'd even when the acting org's profile was fully set up. Passing the
+        // requested org resolves membership for that specific org; falling back to
+        // the first only when the client omits it keeps older callers working.
+        const requestedOrgId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.orgId) != null ? _ref : '').trim() || undefined;
+        const orgForUser = await getOrgForUser(decoded.uid, requestedOrgId);
+        const orgId = orgForUser == null ? void 0 : orgForUser.orgId;
+        if (!orgId || !await canActAsPublisher(firestore, decoded.uid, orgId)) {
+            return res.status(403).json({
+                error: 'Only an organization owner or admin can set up payouts'
+            });
+        }
+        const profileRef = firestore.collection('publisherProfiles').doc(orgId);
+        const profileSnapshot = await profileRef.get();
+        if (!profileSnapshot.exists) {
+            return res.status(412).json({
+                error: 'Set up your publisher profile first — Marketplace → Profile.'
+            });
+        }
+        let accountId = profileSnapshot.get('stripeAccountId');
+        if (!accountId) {
+            const account = await stripe('accounts', new URLSearchParams(_extends({
+                type: 'express',
+                // Explicit capabilities (AGL-1547): without them the account's
+                // abilities depend on unverified dashboard platform-profile
+                // defaults, and a destination charge (`transfer_data`) requires
+                // the destination to hold `transfers` — an account onboarded
+                // without it takes money that can never pay out.
+                'capabilities[card_payments][requested]': 'true',
+                'capabilities[transfers][requested]': 'true',
+                'metadata[publisherOrgId]': orgId
+            }, decoded.email ? {
+                email: decoded.email
+            } : {})));
+            accountId = account.id;
+            await profileRef.set({
+                stripeAccountId: accountId,
+                stripeChargesEnabled: false
+            }, {
+                merge: true
+            });
+        }
+        const account = await stripe(`accounts/${accountId}`);
+        const chargesEnabled = Boolean(account == null ? void 0 : account.charges_enabled);
+        // Which Stripe world this account lives in (AGL-2471) — two of the three
+        // poisoned production linkages were publisherProfiles, written by this
+        // very route from a localhost session holding the test key. See the
+        // commerce twin and `stripe-account-mode.ts` for why the retrieve above
+        // is the proof and the `acct_…` string is not.
+        const platformMode = await resolvePlatformStripeMode();
+        // Payout readiness rides along (AGL-1547): the gate stays on
+        // charges_enabled, but the profile records whether the money can
+        // actually LEAVE Stripe — the live drill (AGL-1548) reads it, and a
+        // seller panel can warn before the first sale strands funds.
+        const payoutsEnabled = Boolean(account == null ? void 0 : account.payouts_enabled);
+        await profileRef.set({
+            stripeChargesEnabled: chargesEnabled,
+            stripePayoutsEnabled: payoutsEnabled,
+            // ALWAYS written, and `null` when Stripe would not say (AGL-2471).
+            // Writing unconditionally is what makes re-onboarding safe: a fresh
+            // `stripeAccountId` on a document that still carried the PREVIOUS
+            // account's verdict would otherwise inherit it. `null` is not a
+            // boolean, so the gate reads it as `mode-unverified` and refuses —
+            // never a fabricated `true`.
+            stripeAccountLivemode: platformMode ? platformMode === 'live' : null
+        }, {
+            merge: true
+        });
+        const origin = (_req_headers_origin = req.headers.origin) != null ? _req_headers_origin : `https://${req.headers.host}`;
+        const orgSlug = (await firestore.collection('orgs').doc(orgId).get()).get('slug');
+        // Return people to the Marketplace page (AGL-861), not the retired
+        // `/[orgSlug]/marketplace` surface. Stripe bakes these URLs into the
+        // onboarding link, so an extra redirect hop mid-onboarding is avoidable.
+        const payoutsPath = orgSlug ? buildRoute(Route.ORG_MARKETPLACE, {
+            orgSlug
+        }) : Route.ORG_MARKETPLACE;
+        // A CONNECTED PUBLISHER STILL NEEDS A DOOR INTO STRIPE. The
+        // commerce twin carries the full note; the shape and the reasoning are the
+        // same, and the seller panel's "Finish payout setup in Stripe" button was
+        // the surface that named a problem it could not act on.
+        if (chargesEnabled) {
+            if (!payoutsEnabled) {
+                const fix = await stripe('account_links', new URLSearchParams({
+                    account: accountId,
+                    type: 'account_onboarding',
+                    refresh_url: `${origin}${payoutsPath}?connect=refresh`,
+                    return_url: `${origin}${payoutsPath}?connect=done`
+                }));
+                return res.status(200).json({
+                    accountId,
+                    chargesEnabled: true,
+                    payoutsEnabled,
+                    url: fix.url
+                });
+            }
+            // Best-effort, for the same reason as the twin: a missing convenience
+            // link must never turn a working status check into an error.
+            let dashboardUrl;
+            try {
+                const login = await stripe(`accounts/${accountId}/login_links`, new URLSearchParams());
+                dashboardUrl = typeof (login == null ? void 0 : login.url) === 'string' ? login.url : undefined;
+            } catch (error) {
+                console.error('Stripe Express dashboard link failed', error);
+            }
+            return res.status(200).json(_extends({
+                accountId,
+                chargesEnabled: true,
+                payoutsEnabled
+            }, dashboardUrl ? {
+                dashboardUrl
+            } : {}));
+        }
+        const link = await stripe('account_links', new URLSearchParams({
+            account: accountId,
+            type: 'account_onboarding',
+            refresh_url: `${origin}${payoutsPath}?connect=refresh`,
+            return_url: `${origin}${payoutsPath}?connect=done`
+        }));
+        return res.status(200).json({
+            accountId,
+            chargesEnabled: false,
+            url: link.url
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(502).json({
+            error: 'Payout setup failed'
+        });
+    }
+};
+
+//# sourceMappingURL=connect.js.map

package/src/lib/server/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/connect.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin, getOrgForUser } from '@aglyn/tenant-data-admin'\nimport { resolvePlatformStripeMode } from '@aglyn/tenant-data-admin/server/stripe-account-mode'\nimport { buildRoute, Route, type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { canActAsPublisher } from './publisher-profile'\n\nasync function stripe(path: string, params?: URLSearchParams) {\n  const response = await fetch(`https://api.stripe.com/v1/${path}`, {\n    method: params ? 'POST' : 'GET',\n    headers: {\n      Authorization: `Bearer ${process.env.STRIPE_SECRET_KEY}`,\n      ...(params && {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      }),\n    },\n    ...(params && { body: params.toString() }),\n  })\n  const payload = await response.json()\n  if (!response.ok) {\n    throw new Error(payload?.error?.message ?? `Stripe ${path} failed`)\n  }\n  return payload\n}\n\n/**\n * Stripe Connect onboarding for marketplace publishers (AGL-46): creates an\n * Express account on first call (id stored on the profile via Admin SDK),\n * refreshes `stripeChargesEnabled` on every call, and returns an\n * account-link URL while onboarding is incomplete. 501 without Stripe env.\n */\nexport const connectHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  if (!process.env.STRIPE_SECRET_KEY) {\n    return res\n      .status(501)\n      .json({ error: 'Payouts are not configured (STRIPE_SECRET_KEY).' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    // Payouts belong to the publishing ORG (AGL-652) — the marketplace pays\n    // the organization that published, not whoever set the account up. Only\n    // a manager may bind a payout destination.\n    //\n    // The acting org comes from the client (AGL-861): the URL is the source of\n    // truth for which workspace the seller is in, and a member can belong to\n    // several. Guessing with `getOrgForUser(uid)` returned the FIRST org from\n    // the reverse index, so the profile check ran against the wrong org and\n    // 412'd even when the acting org's profile was fully set up. Passing the\n    // requested org resolves membership for that specific org; falling back to\n    // the first only when the client omits it keeps older callers working.\n    const requestedOrgId =\n      String((req.body as { orgId?: string } | undefined)?.orgId ?? '').trim() ||\n      undefined\n    const orgForUser = await getOrgForUser(decoded.uid, requestedOrgId)\n    const orgId = orgForUser?.orgId\n    if (!orgId || !(await canActAsPublisher(firestore, decoded.uid, orgId))) {\n      return res.status(403).json({\n        error: 'Only an organization owner or admin can set up payouts',\n      })\n    }\n    const profileRef = firestore.collection('publisherProfiles').doc(orgId)\n    const profileSnapshot = await profileRef.get()\n    if (!profileSnapshot.exists) {\n      return res.status(412).json({\n        error:\n          'Set up your publisher profile first — Marketplace → Profile.',\n      })\n    }\n\n    let accountId = profileSnapshot.get('stripeAccountId') as\n      | string\n      | undefined\n    if (!accountId) {\n      const account = await stripe(\n        'accounts',\n        new URLSearchParams({\n          type: 'express',\n          // Explicit capabilities (AGL-1547): without them the account's\n          // abilities depend on unverified dashboard platform-profile\n          // defaults, and a destination charge (`transfer_data`) requires\n          // the destination to hold `transfers` — an account onboarded\n          // without it takes money that can never pay out.\n          'capabilities[card_payments][requested]': 'true',\n          'capabilities[transfers][requested]': 'true',\n          'metadata[publisherOrgId]': orgId,\n          ...(decoded.email ? { email: decoded.email } : {}),\n        }),\n      )\n      accountId = account.id\n      await profileRef.set(\n        { stripeAccountId: accountId, stripeChargesEnabled: false },\n        { merge: true },\n      )\n    }\n\n    const account = await stripe(`accounts/${accountId}`)\n    const chargesEnabled = Boolean(account?.charges_enabled)\n    // Which Stripe world this account lives in (AGL-2471) — two of the three\n    // poisoned production linkages were publisherProfiles, written by this\n    // very route from a localhost session holding the test key. See the\n    // commerce twin and `stripe-account-mode.ts` for why the retrieve above\n    // is the proof and the `acct_…` string is not.\n    const platformMode = await resolvePlatformStripeMode()\n    // Payout readiness rides along (AGL-1547): the gate stays on\n    // charges_enabled, but the profile records whether the money can\n    // actually LEAVE Stripe — the live drill (AGL-1548) reads it, and a\n    // seller panel can warn before the first sale strands funds.\n    const payoutsEnabled = Boolean(account?.payouts_enabled)\n    await profileRef.set(\n      {\n        stripeChargesEnabled: chargesEnabled,\n        stripePayoutsEnabled: payoutsEnabled,\n        // ALWAYS written, and `null` when Stripe would not say (AGL-2471).\n        // Writing unconditionally is what makes re-onboarding safe: a fresh\n        // `stripeAccountId` on a document that still carried the PREVIOUS\n        // account's verdict would otherwise inherit it. `null` is not a\n        // boolean, so the gate reads it as `mode-unverified` and refuses —\n        // never a fabricated `true`.\n        stripeAccountLivemode: platformMode ? platformMode === 'live' : null,\n      },\n      { merge: true },\n    )\n    const origin = req.headers.origin ?? `https://${req.headers.host}`\n    const orgSlug = (\n      await firestore.collection('orgs').doc(orgId).get()\n    ).get('slug') as string | undefined\n    // Return people to the Marketplace page (AGL-861), not the retired\n    // `/[orgSlug]/marketplace` surface. Stripe bakes these URLs into the\n    // onboarding link, so an extra redirect hop mid-onboarding is avoidable.\n    const payoutsPath = orgSlug\n      ? buildRoute(Route.ORG_MARKETPLACE, { orgSlug })\n      : Route.ORG_MARKETPLACE\n    // A CONNECTED PUBLISHER STILL NEEDS A DOOR INTO STRIPE. The\n    // commerce twin carries the full note; the shape and the reasoning are the\n    // same, and the seller panel's \"Finish payout setup in Stripe\" button was\n    // the surface that named a problem it could not act on.\n    if (chargesEnabled) {\n      if (!payoutsEnabled) {\n        const fix = await stripe(\n          'account_links',\n          new URLSearchParams({\n            account: accountId as string,\n            type: 'account_onboarding',\n            refresh_url: `${origin}${payoutsPath}?connect=refresh`,\n            return_url: `${origin}${payoutsPath}?connect=done`,\n          }),\n        )\n        return res.status(200).json({\n          accountId,\n          chargesEnabled: true,\n          payoutsEnabled,\n          url: fix.url,\n        })\n      }\n      // Best-effort, for the same reason as the twin: a missing convenience\n      // link must never turn a working status check into an error.\n      let dashboardUrl: string | undefined\n      try {\n        const login = await stripe(\n          `accounts/${accountId}/login_links`,\n          new URLSearchParams(),\n        )\n        dashboardUrl = typeof login?.url === 'string' ? login.url : undefined\n      } catch (error) {\n        console.error('Stripe Express dashboard link failed', error)\n      }\n      return res.status(200).json({\n        accountId,\n        chargesEnabled: true,\n        payoutsEnabled,\n        ...(dashboardUrl ? { dashboardUrl } : {}),\n      })\n    }\n\n    const link = await stripe(\n      'account_links',\n      new URLSearchParams({\n        account: accountId as string,\n        type: 'account_onboarding',\n        refresh_url: `${origin}${payoutsPath}?connect=refresh`,\n        return_url: `${origin}${payoutsPath}?connect=done`,\n      }),\n    )\n    return res\n      .status(200)\n      .json({ accountId, chargesEnabled: false, url: link.url })\n  } catch (error) {\n    console.error(error)\n    return res.status(502).json({ error: 'Payout setup failed' })\n  }\n}\n"],"names":["firebaseAdmin","getOrgForUser","resolvePlatformStripeMode","buildRoute","Route","canActAsPublisher","stripe","path","params","response","fetch","method","headers","Authorization","process","env","STRIPE_SECRET_KEY","body","toString","payload","json","ok","Error","error","message","connectHandler","req","res","status","authorization","String","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","firestore","requestedOrgId","orgId","trim","orgForUser","uid","profileRef","collection","doc","profileSnapshot","get","exists","accountId","account","URLSearchParams","type","email","id","set","stripeAccountId","stripeChargesEnabled","merge","chargesEnabled","Boolean","charges_enabled","platformMode","payoutsEnabled","payouts_enabled","stripePayoutsEnabled","stripeAccountLivemode","origin","host","orgSlug","payoutsPath","ORG_MARKETPLACE","fix","refresh_url","return_url","url","dashboardUrl","login","console","link"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,yBAAyB,QAAQ,sDAAqD;AAC/F,SAASC,UAAU,EAAEC,KAAK,QAA+B,sBAAqB;AAC9E,SAASC,iBAAiB,QAAQ,yBAAqB;AAEvD,eAAeC,OAAOC,IAAY,EAAEC,MAAwB;IAC1D,MAAMC,WAAW,MAAMC,MAAM,CAAC,0BAA0B,EAAEH,MAAM,EAAE;QAChEI,QAAQH,SAAS,SAAS;QAC1BI,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEC,QAAQC,GAAG,CAACC,iBAAiB,EAAE;WACpDR,UAAU;YACZ,gBAAgB;QAClB;OAEEA,UAAU;QAAES,MAAMT,OAAOU,QAAQ;IAAG;IAE1C,MAAMC,UAAU,MAAMV,SAASW,IAAI;IACnC,IAAI,CAACX,SAASY,EAAE,EAAE;;YACAF;QAAhB,MAAM,IAAIG,cAAMH,4BAAAA,iBAAAA,QAASI,KAAK,qBAAdJ,eAAgBK,OAAO,mBAAI,CAAC,OAAO,EAAEjB,KAAK,OAAO,CAAC;IACpE;IACA,OAAOY;AACT;AAEA;;;;;CAKC,GACD,OAAO,MAAMM,iBAAmC,OAAOC,KAAKC;QAS7BD;IAR7B,IAAIA,IAAIf,MAAM,KAAK,QAAQ;QACzB,OAAOgB,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;YAAEG,OAAO;QAAqB;IAC5D;IACA,IAAI,CAACT,QAAQC,GAAG,CAACC,iBAAiB,EAAE;QAClC,OAAOW,IACJC,MAAM,CAAC,KACPR,IAAI,CAAC;YAAEG,OAAO;QAAkD;IACrE;IACA,MAAMM,gBAAgBC,QAAOJ,6BAAAA,IAAId,OAAO,CAACiB,aAAa,YAAzBH,6BAA6B;IAC1D,MAAMK,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOJ,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;QAAEG,OAAO;IAAkB;IAErE,IAAI;kBAsFaG;YAvELA;QAdV,MAAMU,UAAU,MAAMpC,cAAcqC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAMS,YAAYxC,cAAcqC,GAAG,GAAGG,SAAS;QAC/C,wEAAwE;QACxE,wEAAwE;QACxE,2CAA2C;QAC3C,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,MAAMC,iBACJX,gBAAQJ,YAAAA,IAAIT,IAAI,qBAAT,AAACS,UAA6CgB,KAAK,mBAAI,IAAIC,IAAI,MACtER;QACF,MAAMS,aAAa,MAAM3C,cAAcmC,QAAQS,GAAG,EAAEJ;QACpD,MAAMC,QAAQE,8BAAAA,WAAYF,KAAK;QAC/B,IAAI,CAACA,SAAS,CAAE,MAAMrC,kBAAkBmC,WAAWJ,QAAQS,GAAG,EAAEH,QAAS;YACvE,OAAOf,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;gBAC1BG,OAAO;YACT;QACF;QACA,MAAMuB,aAAaN,UAAUO,UAAU,CAAC,qBAAqBC,GAAG,CAACN;QACjE,MAAMO,kBAAkB,MAAMH,WAAWI,GAAG;QAC5C,IAAI,CAACD,gBAAgBE,MAAM,EAAE;YAC3B,OAAOxB,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;gBAC1BG,OACE;YACJ;QACF;QAEA,IAAI6B,YAAYH,gBAAgBC,GAAG,CAAC;QAGpC,IAAI,CAACE,WAAW;YACd,MAAMC,UAAU,MAAM/C,OACpB,YACA,IAAIgD,gBAAgB;gBAClBC,MAAM;gBACN,+DAA+D;gBAC/D,4DAA4D;gBAC5D,gEAAgE;gBAChE,6DAA6D;gBAC7D,iDAAiD;gBACjD,0CAA0C;gBAC1C,sCAAsC;gBACtC,4BAA4Bb;eACxBN,QAAQoB,KAAK,GAAG;gBAAEA,OAAOpB,QAAQoB,KAAK;YAAC,IAAI,CAAC;YAGpDJ,YAAYC,QAAQI,EAAE;YACtB,MAAMX,WAAWY,GAAG,CAClB;gBAAEC,iBAAiBP;gBAAWQ,sBAAsB;YAAM,GAC1D;gBAAEC,OAAO;YAAK;QAElB;QAEA,MAAMR,UAAU,MAAM/C,OAAO,CAAC,SAAS,EAAE8C,WAAW;QACpD,MAAMU,iBAAiBC,QAAQV,2BAAAA,QAASW,eAAe;QACvD,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAMC,eAAe,MAAM/D;QAC3B,6DAA6D;QAC7D,iEAAiE;QACjE,oEAAoE;QACpE,6DAA6D;QAC7D,MAAMgE,iBAAiBH,QAAQV,2BAAAA,QAASc,eAAe;QACvD,MAAMrB,WAAWY,GAAG,CAClB;YACEE,sBAAsBE;YACtBM,sBAAsBF;YACtB,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,gEAAgE;YAChE,mEAAmE;YACnE,6BAA6B;YAC7BG,uBAAuBJ,eAAeA,iBAAiB,SAAS;QAClE,GACA;YAAEJ,OAAO;QAAK;QAEhB,MAAMS,UAAS5C,sBAAAA,IAAId,OAAO,CAAC0D,MAAM,YAAlB5C,sBAAsB,CAAC,QAAQ,EAAEA,IAAId,OAAO,CAAC2D,IAAI,EAAE;QAClE,MAAMC,UAAU,AACd,CAAA,MAAMhC,UAAUO,UAAU,CAAC,QAAQC,GAAG,CAACN,OAAOQ,GAAG,EAAC,EAClDA,GAAG,CAAC;QACN,mEAAmE;QACnE,qEAAqE;QACrE,yEAAyE;QACzE,MAAMuB,cAAcD,UAChBrE,WAAWC,MAAMsE,eAAe,EAAE;YAAEF;QAAQ,KAC5CpE,MAAMsE,eAAe;QACzB,4DAA4D;QAC5D,2EAA2E;QAC3E,0EAA0E;QAC1E,wDAAwD;QACxD,IAAIZ,gBAAgB;YAClB,IAAI,CAACI,gBAAgB;gBACnB,MAAMS,MAAM,MAAMrE,OAChB,iBACA,IAAIgD,gBAAgB;oBAClBD,SAASD;oBACTG,MAAM;oBACNqB,aAAa,GAAGN,SAASG,YAAY,gBAAgB,CAAC;oBACtDI,YAAY,GAAGP,SAASG,YAAY,aAAa,CAAC;gBACpD;gBAEF,OAAO9C,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;oBAC1BgC;oBACAU,gBAAgB;oBAChBI;oBACAY,KAAKH,IAAIG,GAAG;gBACd;YACF;YACA,sEAAsE;YACtE,6DAA6D;YAC7D,IAAIC;YACJ,IAAI;gBACF,MAAMC,QAAQ,MAAM1E,OAClB,CAAC,SAAS,EAAE8C,UAAU,YAAY,CAAC,EACnC,IAAIE;gBAENyB,eAAe,QAAOC,yBAAAA,MAAOF,GAAG,MAAK,WAAWE,MAAMF,GAAG,GAAG3C;YAC9D,EAAE,OAAOZ,OAAO;gBACd0D,QAAQ1D,KAAK,CAAC,wCAAwCA;YACxD;YACA,OAAOI,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;gBAC1BgC;gBACAU,gBAAgB;gBAChBI;eACIa,eAAe;gBAAEA;YAAa,IAAI,CAAC;QAE3C;QAEA,MAAMG,OAAO,MAAM5E,OACjB,iBACA,IAAIgD,gBAAgB;YAClBD,SAASD;YACTG,MAAM;YACNqB,aAAa,GAAGN,SAASG,YAAY,gBAAgB,CAAC;YACtDI,YAAY,GAAGP,SAASG,YAAY,aAAa,CAAC;QACpD;QAEF,OAAO9C,IACJC,MAAM,CAAC,KACPR,IAAI,CAAC;YAAEgC;YAAWU,gBAAgB;YAAOgB,KAAKI,KAAKJ,GAAG;QAAC;IAC5D,EAAE,OAAOvD,OAAO;QACd0D,QAAQ1D,KAAK,CAACA;QACd,OAAOI,IAAIC,MAAM,CAAC,KAAKR,IAAI,CAAC;YAAEG,OAAO;QAAsB;IAC7D;AACF,EAAC"}

package/src/lib/server/install-dataset-schema.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Installs a marketplace dataset schema into an org (AGL-657).
+ *
+ * Creates a NEW, EMPTY dataset from the published model — installing never
+ * merges into an existing dataset, because a schema change on a dataset that
+ * already holds rows would silently reinterpret live data. Re-installing makes
+ * another dataset rather than replacing one, for the same reason.
+ *
+ * Accepts either `orgId` or a `hostId` to derive it, so the shared install
+ * hook (which is host-oriented) works unchanged. The site is ONLY that: a way
+ * to find the org. It is never the site the dataset is created in — see the
+ * scope decision below.
+ */
+export declare const installDatasetSchemaHandler: PluginApiHandler;
+export default installDatasetSchemaHandler;

package/src/lib/server/install-dataset-schema.js

@@ -0,0 +1,255 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkDatasetQuota, checkEntitlement, createResourceUid, defaultScopeForNewResource, newResourceScopeFields, scopeCovers } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { isPrivateListing, resolveInstalledDatasetSchema, listingArtifactType } from "../model/marketplace.js";
+import { canActAsPublisher } from "./publisher-profile.js";
+import { requirePurchase } from "./purchase-entitlement.js";
+import { recordInstallProvenance } from "./provenance.js";
+import { recordVersionMove } from "./version-stats.js";
+/**
+ * Installs a marketplace dataset schema into an org (AGL-657).
+ *
+ * Creates a NEW, EMPTY dataset from the published model — installing never
+ * merges into an existing dataset, because a schema change on a dataset that
+ * already holds rows would silently reinterpret live data. Re-installing makes
+ * another dataset rather than replacing one, for the same reason.
+ *
+ * Accepts either `orgId` or a `hostId` to derive it, so the shared install
+ * hook (which is host-oriented) works unchanged. The site is ONLY that: a way
+ * to find the org. It is never the site the dataset is created in — see the
+ * scope decision below.
+ */ export const installDatasetSchemaHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const listingId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.listingId) != null ? _ref : '');
+    const hostId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.hostId) != null ? _ref1 : '');
+    const bodyOrgId = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.orgId) != null ? _ref2 : '');
+    if (!listingId || !hostId && !bodyOrgId) {
+        return res.status(400).json({
+            error: 'Missing listingId or orgId'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _ref3, _listing_priceUsd, _membership_orgId, _listing_displayName, _listing_latestVersion, _listing_latestVersion1;
+        var _this, _published_order;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const orgId = bodyOrgId || (hostId ? (_ref3 = (_this = await getOrgForHost(hostId)) == null ? void 0 : _this.orgId) != null ? _ref3 : '' : '');
+        if (!orgId) {
+            return res.status(404).json({
+                error: 'Site has no owning organization'
+            });
+        }
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            orgId
+        });
+        if (membership.orgId !== orgId || !membership.permissions.installPlugins) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow installing from the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const orgRef = firestore.collection('orgs').doc(orgId);
+        const orgSnapshot = await orgRef.get();
+        if (!orgSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown organization'
+            });
+        }
+        const org = orgSnapshot.data();
+        if (!checkEntitlement(org, 'dataStore')) {
+            return res.status(403).json({
+                error: 'Datasets require a Starter plan or higher'
+            });
+        }
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listingSnapshot = await listingRef.get();
+        const listing = listingSnapshot.data();
+        if (!listing || listing.deletedAt || // Staff takedown blocks new installs on EVERY artifact type
+        // (AGL-2290). AGL-948 extended takedown past plugins in the browse
+        // predicate and in `resolveMarketplacePluginVersion`, but the gate that
+        // decides whether content is HANDED OVER was only ever added to
+        // `install-plugin.ts`. So a component, theme, template, layout, email
+        // template or dataset schema that staff had taken down stayed
+        // installable by anyone holding its listing id — which makes takedown a
+        // suggestion for six of the seven artifact types.
+        //
+        // No owner exemption, matching `install-plugin.ts`: a takedown is a
+        // moderation decision about the artifact, not about who is asking.
+        listing.hiddenAt || listingArtifactType(listing) !== 'datasetSchema') {
+            return res.status(404).json({
+                error: 'Unknown dataset schema'
+            });
+        }
+        const priceUsd = Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0);
+        const ownsListing = await canActAsPublisher(firestore, decoded.uid, listing.profileId);
+        // Private listings install ONLY for the owning org (AGL-2290).
+        //
+        // `install-plugin.ts` has carried this since AGL-968; the other six never
+        // did, so a private component, theme, template, layout, email template or
+        // dataset schema was installable by anyone who knew its listing id. Browse
+        // hides them and the detail page 404s, but neither is a control — the
+        // route is.
+        if (isPrivateListing(listing) && !ownsListing) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // A FULLY refunded purchase stops entitling (AGL-1546), and until
+        // AGL-1699 only the component route knew that: this one asked whether a
+        // purchase doc EXISTED, so buy/install/refund kept the artifact. The
+        // predicate lives in one place now so the next route cannot miss it.
+        const unpaid = await requirePurchase({
+            firestore,
+            buyerUid: decoded.uid,
+            // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is
+            // resolved server-side from the caller's own membership by the
+            // permission gate above — never a request-body field — so this is the
+            // workspace the install actually lands in, and the only one a purchase
+            // can entitle here.
+            buyerOrgId: (_membership_orgId = membership.orgId) != null ? _membership_orgId : '',
+            listingId,
+            priceUsd,
+            ownsListing
+        });
+        if (unpaid) return res.status(402).json(unpaid);
+        const versionSnapshot = await listingRef.collection('versions').doc(String(listing.latestVersion)).get();
+        const published = versionSnapshot.get('datasetSchema');
+        if (!(published == null ? void 0 : (_published_order = published.order) == null ? void 0 : _published_order.length)) {
+            return res.status(500).json({
+                error: 'Dataset schema version missing'
+            });
+        }
+        // Creating a dataset consumes org quota exactly like the console's own
+        // create path (AGL-473) — installing must not be a way around it.
+        // Deliberately counts EVERY dataset the org owns, not the visible ones
+        // (AGL-1046). Scoping decides who can see a dataset, never who pays for
+        // it — the org owns all of them. Counting per scope would also make a
+        // collaborator's remaining quota disagree with the admin's.
+        const datasets = await orgRef.collection('datasets').get();
+        const quota = checkDatasetQuota(org, datasets.size);
+        if (!quota.allowed) {
+            return res.status(403).json({
+                error: `Dataset limit reached (${quota.limit}) — see Billing to upgrade.`
+            });
+        }
+        /**
+     * Who the new dataset is shared with. Decided before relinking, because
+     * it also decides what a reference field may point at.
+     *
+     * A dataset schema installs at ORGANIZATION scope and nowhere else
+     * (`INSTALL_TARGETS.datasetSchema`), from the organization Marketplace —
+     * the one surface that installs anything. The `hostId` that surface sends
+     * is the site it acts THROUGH so the org can be resolved: the org's first
+     * site, not a site anyone is working in. So no site is in context, and the
+     * dataset starts where a create on an organization page starts: All
+     * sites, whatever the org's Default sharing says. Honoring the acting site
+     * instead would hide the dataset from every other site, under an install
+     * dialog that says it lands on "the whole organization — every site".
+     */ const visibleTo = defaultScopeForNewResource({
+            defaultResourceScope: org == null ? void 0 : org.defaultResourceScope,
+            hostId: null
+        });
+        // Relink reference fields onto this org's datasets by display name; what
+        // can't be relinked degrades to text and is reported to the installer.
+        // A candidate has to be visible everywhere the new dataset is, which is
+        // the rule every reference answers to (`scopeCovers`, AGL-1044): one
+        // pointing at a dataset some of those sites cannot see resolves to nothing
+        // there, and nothing says why. That is also what keeps an install from
+        // binding its reference fields to an agency's internal dataset of the same
+        // name (AGL-1046) — the display-name collision AGL-1039 fixed on the
+        // render path, arriving here instead.
+        const byLabel = {};
+        for (const entry of datasets.docs){
+            var _entry_get;
+            if (!scopeCovers(entry.get('visibleTo'), visibleTo)) continue;
+            const label = String((_entry_get = entry.get('displayName')) != null ? _entry_get : '').toLowerCase();
+            if (label && !byLabel[label]) byLabel[label] = entry.id;
+        }
+        const { schema, degradedFieldIds } = resolveInstalledDatasetSchema(published, byLabel);
+        const datasetId = createResourceUid();
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        // Provenance + base snapshot (AGL-1015). The RELINKED schema, not the
+        // published one: relinking rewrites reference fields onto this org's
+        // datasets, so a base holding the publisher's ids would report every
+        // relinked field as a user edit the moment anything is diffed.
+        const provenance = await recordInstallProvenance({
+            firestore,
+            listingId,
+            listing,
+            version: listing.latestVersion,
+            artifactType: 'datasetSchema',
+            content: schema
+        });
+        await orgRef.collection('datasets').doc(datasetId).create(_extends({
+            displayName: String((_listing_displayName = listing.displayName) != null ? _listing_displayName : 'Dataset').slice(0, 120)
+        }, listing.description && {
+            description: listing.description
+        }, {
+            // `fields` is the v1 flat list the older editor still reads; keep it in
+            // step with the model so both readers agree (AGL-102).
+            fields: schema.order,
+            model: schema,
+            source: {
+                type: 'marketplace',
+                listingId,
+                version: (_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : null
+            },
+            installedFrom: provenance.installedFrom
+        }, newResourceScopeFields(visibleTo), {
+            createdAt: now
+        }));
+        // Per-version tally (AGL-1036). Installing a schema always CREATES a new
+        // dataset rather than replacing one, so there is never a version to leave.
+        await recordVersionMove({
+            firestore,
+            listingRef,
+            artifactType: 'datasetSchema',
+            to: listing.latestVersion
+        });
+        await listingRef.update({
+            installCount: firebaseAdmin.firestore.FieldValue.increment(1)
+        }).catch(()=>undefined);
+        return res.status(200).json({
+            installed: true,
+            datasetId,
+            fields: schema.order.length,
+            degradedFieldIds,
+            version: (_listing_latestVersion1 = listing.latestVersion) != null ? _listing_latestVersion1 : null,
+            baseStored: provenance.baseStored
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Dataset schema install failed'
+        });
+    }
+};
+export default installDatasetSchemaHandler;
+
+//# sourceMappingURL=install-dataset-schema.js.map

package/src/lib/server/install-dataset-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/install-dataset-schema.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkDatasetQuota,\n  checkEntitlement,\n  createResourceUid,\n  defaultScopeForNewResource,\n  newResourceScopeFields,\n  scopeCovers,\n} from '@aglyn/aglyn/server'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  isPrivateListing,\n  resolveInstalledDatasetSchema,\nlistingArtifactType,\n} from '../model/marketplace'\nimport { canActAsPublisher } from './publisher-profile'\nimport { requirePurchase } from './purchase-entitlement'\nimport { recordInstallProvenance } from './provenance'\nimport { recordVersionMove } from './version-stats'\n\n/**\n * Installs a marketplace dataset schema into an org (AGL-657).\n *\n * Creates a NEW, EMPTY dataset from the published model — installing never\n * merges into an existing dataset, because a schema change on a dataset that\n * already holds rows would silently reinterpret live data. Re-installing makes\n * another dataset rather than replacing one, for the same reason.\n *\n * Accepts either `orgId` or a `hostId` to derive it, so the shared install\n * hook (which is host-oriented) works unchanged. The site is ONLY that: a way\n * to find the org. It is never the site the dataset is created in — see the\n * scope decision below.\n */\nexport const installDatasetSchemaHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const listingId = String(req.body?.listingId ?? '')\n  const hostId = String(req.body?.hostId ?? '')\n  const bodyOrgId = String(req.body?.orgId ?? '')\n  if (!listingId || (!hostId && !bodyOrgId)) {\n    return res.status(400).json({ error: 'Missing listingId or orgId' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const orgId =\n      bodyOrgId || (hostId ? ((await getOrgForHost(hostId))?.orgId ?? '') : '')\n    if (!orgId) {\n      return res.status(404).json({ error: 'Site has no owning organization' })\n    }\n    const membership = await resolveOrgPermissions(decoded.uid, { orgId })\n    if (membership.orgId !== orgId || !membership.permissions.installPlugins) {\n      return res.status(403).json({\n        error:\n          'Your organization role does not allow installing from the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const orgSnapshot = await orgRef.get()\n    if (!orgSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown organization' })\n    }\n    const org = orgSnapshot.data() as any\n    if (!checkEntitlement(org, 'dataStore')) {\n      return res\n        .status(403)\n        .json({ error: 'Datasets require a Starter plan or higher' })\n    }\n\n    const listingRef = firestore.collection('marketplaceListings').doc(listingId)\n    const listingSnapshot = await listingRef.get()\n    const listing = listingSnapshot.data() as any\n    if (\n      !listing ||\n      listing.deletedAt ||\n      // Staff takedown blocks new installs on EVERY artifact type\n      // (AGL-2290). AGL-948 extended takedown past plugins in the browse\n      // predicate and in `resolveMarketplacePluginVersion`, but the gate that\n      // decides whether content is HANDED OVER was only ever added to\n      // `install-plugin.ts`. So a component, theme, template, layout, email\n      // template or dataset schema that staff had taken down stayed\n      // installable by anyone holding its listing id — which makes takedown a\n      // suggestion for six of the seven artifact types.\n      //\n      // No owner exemption, matching `install-plugin.ts`: a takedown is a\n      // moderation decision about the artifact, not about who is asking.\n      listing.hiddenAt ||\n      listingArtifactType(listing) !== 'datasetSchema'\n    ) {\n      return res.status(404).json({ error: 'Unknown dataset schema' })\n    }\n\n    const priceUsd = Number(listing.priceUsd ?? 0)\n    const ownsListing = await canActAsPublisher(\n      firestore,\n      decoded.uid,\n      listing.profileId,\n    )\n    // Private listings install ONLY for the owning org (AGL-2290).\n    //\n    // `install-plugin.ts` has carried this since AGL-968; the other six never\n    // did, so a private component, theme, template, layout, email template or\n    // dataset schema was installable by anyone who knew its listing id. Browse\n    // hides them and the detail page 404s, but neither is a control — the\n    // route is.\n    if (isPrivateListing(listing) && !ownsListing) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // A FULLY refunded purchase stops entitling (AGL-1546), and until\n    // AGL-1699 only the component route knew that: this one asked whether a\n    // purchase doc EXISTED, so buy/install/refund kept the artifact. The\n    // predicate lives in one place now so the next route cannot miss it.\n    const unpaid = await requirePurchase({\n      firestore,\n      buyerUid: decoded.uid,\n      // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is\n      // resolved server-side from the caller's own membership by the\n      // permission gate above — never a request-body field — so this is the\n      // workspace the install actually lands in, and the only one a purchase\n      // can entitle here.\n      buyerOrgId: membership.orgId ?? '',\n      listingId,\n      priceUsd,\n      ownsListing,\n    })\n    if (unpaid) return res.status(402).json(unpaid)\n\n    const versionSnapshot = await listingRef\n      .collection('versions')\n      .doc(String(listing.latestVersion))\n      .get()\n    const published = versionSnapshot.get('datasetSchema') as any\n    if (!published?.order?.length) {\n      return res.status(500).json({ error: 'Dataset schema version missing' })\n    }\n\n    // Creating a dataset consumes org quota exactly like the console's own\n    // create path (AGL-473) — installing must not be a way around it.\n    // Deliberately counts EVERY dataset the org owns, not the visible ones\n    // (AGL-1046). Scoping decides who can see a dataset, never who pays for\n    // it — the org owns all of them. Counting per scope would also make a\n    // collaborator's remaining quota disagree with the admin's.\n    const datasets = await orgRef.collection('datasets').get()\n    const quota = checkDatasetQuota(org, datasets.size)\n    if (!quota.allowed) {\n      return res.status(403).json({\n        error: `Dataset limit reached (${quota.limit}) — see Billing to upgrade.`,\n      })\n    }\n\n    /**\n     * Who the new dataset is shared with. Decided before relinking, because\n     * it also decides what a reference field may point at.\n     *\n     * A dataset schema installs at ORGANIZATION scope and nowhere else\n     * (`INSTALL_TARGETS.datasetSchema`), from the organization Marketplace —\n     * the one surface that installs anything. The `hostId` that surface sends\n     * is the site it acts THROUGH so the org can be resolved: the org's first\n     * site, not a site anyone is working in. So no site is in context, and the\n     * dataset starts where a create on an organization page starts: All\n     * sites, whatever the org's Default sharing says. Honoring the acting site\n     * instead would hide the dataset from every other site, under an install\n     * dialog that says it lands on \"the whole organization — every site\".\n     */\n    const visibleTo = defaultScopeForNewResource({\n      defaultResourceScope: org?.defaultResourceScope,\n      hostId: null,\n    })\n\n    // Relink reference fields onto this org's datasets by display name; what\n    // can't be relinked degrades to text and is reported to the installer.\n    // A candidate has to be visible everywhere the new dataset is, which is\n    // the rule every reference answers to (`scopeCovers`, AGL-1044): one\n    // pointing at a dataset some of those sites cannot see resolves to nothing\n    // there, and nothing says why. That is also what keeps an install from\n    // binding its reference fields to an agency's internal dataset of the same\n    // name (AGL-1046) — the display-name collision AGL-1039 fixed on the\n    // render path, arriving here instead.\n    const byLabel: Record<string, string> = {}\n    for (const entry of datasets.docs) {\n      if (!scopeCovers(entry.get('visibleTo'), visibleTo)) continue\n      const label = String(entry.get('displayName') ?? '').toLowerCase()\n      if (label && !byLabel[label]) byLabel[label] = entry.id\n    }\n    const { schema, degradedFieldIds } = resolveInstalledDatasetSchema(\n      published,\n      byLabel,\n    )\n\n    const datasetId = createResourceUid()\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n    // Provenance + base snapshot (AGL-1015). The RELINKED schema, not the\n    // published one: relinking rewrites reference fields onto this org's\n    // datasets, so a base holding the publisher's ids would report every\n    // relinked field as a user edit the moment anything is diffed.\n    const provenance = await recordInstallProvenance({\n      firestore,\n      listingId,\n      listing,\n      version: listing.latestVersion,\n      artifactType: 'datasetSchema',\n      content: schema,\n    })\n    await orgRef\n      .collection('datasets')\n      .doc(datasetId)\n      .create({\n        displayName: String(listing.displayName ?? 'Dataset').slice(0, 120),\n        ...(listing.description && { description: listing.description }),\n        // `fields` is the v1 flat list the older editor still reads; keep it in\n        // step with the model so both readers agree (AGL-102).\n        fields: schema.order,\n        model: schema,\n        source: {\n          type: 'marketplace' as const,\n          listingId,\n          version: listing.latestVersion ?? null,\n        },\n        installedFrom: provenance.installedFrom,\n        // The scope decided above. Stamping it is not optional — a dataset\n        // with no `visibleTo` matches no scoped read and would render on no\n        // site at all.\n        //\n        // Through the AGL-1478 gate since AGL-1484, so \"every other dataset\n        // creator\" is a fact about the type rather than about four object\n        // literals that happen to agree today.\n        ...newResourceScopeFields(visibleTo),\n        createdAt: now,\n      })\n\n    // Per-version tally (AGL-1036). Installing a schema always CREATES a new\n    // dataset rather than replacing one, so there is never a version to leave.\n    await recordVersionMove({\n      firestore,\n      listingRef,\n      artifactType: 'datasetSchema',\n      to: listing.latestVersion,\n    })\n    await listingRef\n      .update({\n        installCount: firebaseAdmin.firestore.FieldValue.increment(1),\n      })\n      .catch(() => undefined)\n\n    return res.status(200).json({\n      installed: true,\n      datasetId,\n      fields: schema.order.length,\n      degradedFieldIds,\n      version: listing.latestVersion ?? null,\n      baseStored: provenance.baseStored,\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Dataset schema install failed' })\n  }\n}\n\nexport default installDatasetSchemaHandler\n"],"names":["checkDatasetQuota","checkEntitlement","createResourceUid","defaultScopeForNewResource","newResourceScopeFields","scopeCovers","firebaseAdmin","getOrgForHost","resolveOrgPermissions","isPrivateListing","resolveInstalledDatasetSchema","listingArtifactType","canActAsPublisher","requirePurchase","recordInstallProvenance","recordVersionMove","installDatasetSchemaHandler","req","res","method","status","json","error","listingId","String","body","hostId","bodyOrgId","orgId","authorization","headers","idToken","startsWith","slice","length","undefined","listing","membership","published","decoded","app","auth","verifyIdToken","uid","permissions","installPlugins","firestore","orgRef","collection","doc","orgSnapshot","get","exists","org","data","listingRef","listingSnapshot","deletedAt","hiddenAt","priceUsd","Number","ownsListing","profileId","unpaid","buyerUid","buyerOrgId","versionSnapshot","latestVersion","order","datasets","quota","size","allowed","limit","visibleTo","defaultResourceScope","byLabel","entry","docs","label","toLowerCase","id","schema","degradedFieldIds","datasetId","now","FieldValue","serverTimestamp","provenance","version","artifactType","content","create","displayName","description","fields","model","source","type","installedFrom","createdAt","to","update","installCount","increment","catch","installed","baseStored","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,iBAAiB,EACjBC,gBAAgB,EAChBC,iBAAiB,EACjBC,0BAA0B,EAC1BC,sBAAsB,EACtBC,WAAW,QACN,sBAAqB;AAE5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,gBAAgB,EAChBC,6BAA6B,EAC/BC,mBAAmB,QACZ,0BAAsB;AAC7B,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,uBAAuB,QAAQ,kBAAc;AACtD,SAASC,iBAAiB,QAAQ,qBAAiB;AAEnD;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,8BAAgD,OAC3DC,KACAC;4BAW6BD;QANJA,WACHA,YACGA;IALzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,SAAS,mBAAI;IAChD,MAAMG,SAASF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,MAAM,oBAAI;IAC1C,MAAMC,YAAYH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUW,KAAK,oBAAI;IAC5C,IAAI,CAACL,aAAc,CAACG,UAAU,CAACC,WAAY;QACzC,OAAOT,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;IACA,MAAMO,gBAAgBL,QAAOP,6BAAAA,IAAIa,OAAO,CAACD,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMc,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOb,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;mBAkDsBc,mBA4BVC,mBAuFUD,sBASTA,wBAiCJA;YA5MgB,OAuFtBE;QAzFL,MAAMC,UAAU,MAAMjC,cAAckC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;QAC/D,MAAMH,QACJD,aAAcD,CAAAA,mBAAW,QAAA,MAAMnB,cAAcmB,4BAArB,AAAC,MAA8BE,KAAK,oBAAI,KAAM,EAAC;QACzE,IAAI,CAACA,OAAO;YACV,OAAOV,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;QACzE;QACA,MAAMe,aAAa,MAAM7B,sBAAsB+B,QAAQI,GAAG,EAAE;YAAEf;QAAM;QACpE,IAAIS,WAAWT,KAAK,KAAKA,SAAS,CAACS,WAAWO,WAAW,CAACC,cAAc,EAAE;YACxE,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAMwB,YAAYxC,cAAckC,GAAG,GAAGM,SAAS;QAC/C,MAAMC,SAASD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACrB;QAChD,MAAMsB,cAAc,MAAMH,OAAOI,GAAG;QACpC,IAAI,CAACD,YAAYE,MAAM,EAAE;YACvB,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAuB;QAC9D;QACA,MAAM+B,MAAMH,YAAYI,IAAI;QAC5B,IAAI,CAACrD,iBAAiBoD,KAAK,cAAc;YACvC,OAAOnC,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAA4C;QAC/D;QAEA,MAAMiC,aAAaT,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAAC1B;QACnE,MAAMiC,kBAAkB,MAAMD,WAAWJ,GAAG;QAC5C,MAAMf,UAAUoB,gBAAgBF,IAAI;QACpC,IACE,CAAClB,WACDA,QAAQqB,SAAS,IACjB,4DAA4D;QAC5D,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,sEAAsE;QACtE,8DAA8D;QAC9D,wEAAwE;QACxE,kDAAkD;QAClD,EAAE;QACF,oEAAoE;QACpE,mEAAmE;QACnErB,QAAQsB,QAAQ,IAChB/C,oBAAoByB,aAAa,iBACjC;YACA,OAAOlB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,MAAMqC,WAAWC,QAAOxB,oBAAAA,QAAQuB,QAAQ,YAAhBvB,oBAAoB;QAC5C,MAAMyB,cAAc,MAAMjD,kBACxBkC,WACAP,QAAQI,GAAG,EACXP,QAAQ0B,SAAS;QAEnB,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,YAAY;QACZ,IAAIrD,iBAAiB2B,YAAY,CAACyB,aAAa;YAC7C,OAAO3C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,kEAAkE;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,MAAMyC,SAAS,MAAMlD,gBAAgB;YACnCiC;YACAkB,UAAUzB,QAAQI,GAAG;YACrB,qEAAqE;YACrE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,oBAAoB;YACpBsB,UAAU,GAAE5B,oBAAAA,WAAWT,KAAK,YAAhBS,oBAAoB;YAChCd;YACAoC;YACAE;QACF;QACA,IAAIE,QAAQ,OAAO7C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC0C;QAExC,MAAMG,kBAAkB,MAAMX,WAC3BP,UAAU,CAAC,YACXC,GAAG,CAACzB,OAAOY,QAAQ+B,aAAa,GAChChB,GAAG;QACN,MAAMb,YAAY4B,gBAAgBf,GAAG,CAAC;QACtC,IAAI,EAACb,8BAAAA,mBAAAA,UAAW8B,KAAK,qBAAhB9B,iBAAkBJ,MAAM,GAAE;YAC7B,OAAOhB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;QACxE;QAEA,uEAAuE;QACvE,kEAAkE;QAClE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM+C,WAAW,MAAMtB,OAAOC,UAAU,CAAC,YAAYG,GAAG;QACxD,MAAMmB,QAAQtE,kBAAkBqD,KAAKgB,SAASE,IAAI;QAClD,IAAI,CAACD,MAAME,OAAO,EAAE;YAClB,OAAOtD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO,CAAC,uBAAuB,EAAEgD,MAAMG,KAAK,CAAC,2BAA2B,CAAC;YAC3E;QACF;QAEA;;;;;;;;;;;;;KAaC,GACD,MAAMC,YAAYvE,2BAA2B;YAC3CwE,oBAAoB,EAAEtB,uBAAAA,IAAKsB,oBAAoB;YAC/CjD,QAAQ;QACV;QAEA,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,qEAAqE;QACrE,sCAAsC;QACtC,MAAMkD,UAAkC,CAAC;QACzC,KAAK,MAAMC,SAASR,SAASS,IAAI,CAAE;gBAEZD;YADrB,IAAI,CAACxE,YAAYwE,MAAM1B,GAAG,CAAC,cAAcuB,YAAY;YACrD,MAAMK,QAAQvD,QAAOqD,aAAAA,MAAM1B,GAAG,CAAC,0BAAV0B,aAA4B,IAAIG,WAAW;YAChE,IAAID,SAAS,CAACH,OAAO,CAACG,MAAM,EAAEH,OAAO,CAACG,MAAM,GAAGF,MAAMI,EAAE;QACzD;QACA,MAAM,EAAEC,MAAM,EAAEC,gBAAgB,EAAE,GAAGzE,8BACnC4B,WACAsC;QAGF,MAAMQ,YAAYlF;QAClB,MAAMmF,MAAM/E,cAAcwC,SAAS,CAACwC,UAAU,CAACC,eAAe;QAC9D,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAMC,aAAa,MAAM1E,wBAAwB;YAC/CgC;YACAvB;YACAa;YACAqD,SAASrD,QAAQ+B,aAAa;YAC9BuB,cAAc;YACdC,SAAST;QACX;QACA,MAAMnC,OACHC,UAAU,CAAC,YACXC,GAAG,CAACmC,WACJQ,MAAM,CAAC;YACNC,aAAarE,QAAOY,uBAAAA,QAAQyD,WAAW,YAAnBzD,uBAAuB,WAAWH,KAAK,CAAC,GAAG;WAC3DG,QAAQ0D,WAAW,IAAI;YAAEA,aAAa1D,QAAQ0D,WAAW;QAAC;YAC9D,wEAAwE;YACxE,uDAAuD;YACvDC,QAAQb,OAAOd,KAAK;YACpB4B,OAAOd;YACPe,QAAQ;gBACNC,MAAM;gBACN3E;gBACAkE,OAAO,GAAErD,yBAAAA,QAAQ+B,aAAa,YAArB/B,yBAAyB;YACpC;YACA+D,eAAeX,WAAWW,aAAa;WAQpC/F,uBAAuBsE;YAC1B0B,WAAWf;;QAGf,yEAAyE;QACzE,2EAA2E;QAC3E,MAAMtE,kBAAkB;YACtB+B;YACAS;YACAmC,cAAc;YACdW,IAAIjE,QAAQ+B,aAAa;QAC3B;QACA,MAAMZ,WACH+C,MAAM,CAAC;YACNC,cAAcjG,cAAcwC,SAAS,CAACwC,UAAU,CAACkB,SAAS,CAAC;QAC7D,GACCC,KAAK,CAAC,IAAMtE;QAEf,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BqF,WAAW;YACXtB;YACAW,QAAQb,OAAOd,KAAK,CAAClC,MAAM;YAC3BiD;YACAM,OAAO,GAAErD,0BAAAA,QAAQ+B,aAAa,YAArB/B,0BAAyB;YAClCuE,YAAYnB,WAAWmB,UAAU;QACnC;IACF,EAAE,OAAOrF,OAAO;QACdsF,QAAQtF,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgC;IACvE;AACF,EAAC;AAED,eAAeN,4BAA2B"}

package/src/lib/server/install-email-starter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Installs a marketplace email starter as a new email on a site.
+ *
+ * ## The install is a COPY, and that is the versioning answer
+ *
+ * The published tree is written into a screen document of the tenant's own —
+ * `hosts/{h}/screens/{newId}` with `kind: 'email'`, plus its first version —
+ * in exactly the shape `createEmailScreen` writes, so it appears in the site's
+ * Email templates list beside every email they designed themselves and opens
+ * in the same besigner. From that write on, nothing reads the listing again.
+ *
+ * That is deliberate, and it is the property a live reference could not have:
+ * a publisher pushing version 4 must not rewrite the email a tenant is
+ * mailing from this afternoon. A newer version surfaces as an offer — the
+ * shared `resolveUpdateState` comparison every other artifact type uses — and
+ * is taken through `update-artifact`, which three-way-merges against the base
+ * snapshot recorded here so the tenant's own edits survive it.
+ *
+ * The one thing a copy does NOT sever is a `media:` reference, which still
+ * resolves against the publisher's media. Reported by the inspection rather
+ * than refused: our own CDN serves it, so no third party learns who opened the
+ * mail, but the bytes behind it can still change.
+ *
+ * ## Three refusals that are not in the other install routes
+ *
+ * **The kill switch, at install.** Every other copied artifact treats
+ * `revocations` as a plugin concern. An installed email is mailed from the
+ * shared sending domain, so a stopped version must not be handed out — and,
+ * separately, must stop being sent by tenants who already have it, which is
+ * `emailStarterSendBlock` on the send path.
+ *
+ * **A rejected version, for everybody including its publisher.** Review is not
+ * a precondition for installing an email starter — they are auto-listed like
+ * every other copied artifact — so most versions are honestly `unreviewed` and
+ * install fine. A verdict of `rejected` is different: somebody looked and said
+ * no, and the publisher's own site is on the same sending domain as everyone
+ * else's.
+ *
+ * **The policy, re-run over the listing's own bytes.** The publish route
+ * already refused a violating design. Re-running it here is not belt and
+ * braces about that route — it is the gate for content that never went through
+ * it: a version published before this policy existed, a document written by a
+ * staff tool, an import. A tracking pixel is only refused if the refusal sits
+ * where the content is HANDED OVER, which is the lesson `install-email-template`
+ * records about takedown.
+ */
+export declare const installEmailStarterHandler: PluginApiHandler;
+export default installEmailStarterHandler;