@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/install-plugin.js

@@ -0,0 +1,405 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { resolveOrgIdForHost, firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { compareArtifactVersions, isCompatibleHostAbi, isFirstPartyPlugin, isPluginRevoked, newestInstallableVersion, PLUGIN_HOST_ABI_VERSION } from "@aglyn/aglyn/server";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { canActAsPublisher } from "./publisher-profile.js";
+import { requirePurchase } from "./purchase-entitlement.js";
+import { pinnedProvenance } from "./provenance.js";
+import { recordVersionMove } from "./version-stats.js";
+import { isListingBrowsable, isPrivateListing, isVersionApproved, listingArtifactType } from "../model/marketplace.js";
+/**
+ * Installs (or upgrades) a marketplace plugin into a host (AGL-45), pinning a
+ * version per AGL-43 §3.4. Writes `hosts/{hostId}/installs/{listingId}`
+ * with the exact `{version, sha256}` — upgrades are explicit (a new pin),
+ * so a publisher can never swap the code a consumer runs. Access mirrors
+ * component installs: free, purchased (webhook-written), or own listing.
+ * The pin references the immutable artifact; the sandboxed loader fetches
+ * and integrity-checks it at render time.
+ *
+ * Enablement sync (AGL-424): marketplace plugins ride the same
+ * `org.enabledPlugins` switchboard first-party plugins use — but ONLY for
+ * workspaces that have explicitly configured the field. Install appends
+ * the listing id there; uninstall removes it once no pin (org or acting
+ * host) remains. Workspaces that never touched the switchboard stay
+ * default-open (absent field ⇒ installs load), so pre-sync installs keep
+ * working.
+ */ /** Keeps `org.enabledPlugins` in step with install pins (AGL-424). */ async function syncEnabledPlugins(firestore, orgId, hostId, listingId, action) {
+    if (!orgId) return;
+    // `enabledPlugins` is a flat mix of first-party bundle ids and marketplace
+    // listing ids (AGL-777). A listing id is a Firestore doc id, so it can't
+    // normally collide with a bundle name — but guard anyway: an install sync
+    // must NEVER arrayUnion/arrayRemove a bundle id, which would silently
+    // enable or disable a platform plugin as a side effect of a purchase.
+    if (isFirstPartyPlugin(listingId)) return;
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const configured = (await orgRef.get()).get('enabledPlugins');
+    // Absent field = default-open workspace; nothing to sync.
+    if (!Array.isArray(configured)) return;
+    if (action === 'add') {
+        if (configured.includes(listingId)) return;
+        await orgRef.update({
+            enabledPlugins: firebaseAdmin.firestore.FieldValue.arrayUnion(listingId)
+        });
+        return;
+    }
+    const [orgPin, hostPin] = await Promise.all([
+        orgRef.collection('installs').doc(listingId).get(),
+        firestore.collection('hosts').doc(hostId).collection('installs').doc(listingId).get()
+    ]);
+    if (orgPin.exists || hostPin.exists) return;
+    await orgRef.update({
+        enabledPlugins: firebaseAdmin.firestore.FieldValue.arrayRemove(listingId)
+    });
+}
+export const installPluginHandler = async (req, res)=>{
+    var _ref, _ref1, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const listingId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.listingId) != null ? _ref : '');
+    const hostId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.hostId) != null ? _ref1 : '');
+    // Optional explicit version for upgrade/downgrade; defaults to latest.
+    const requestedVersion = ((_req_body2 = req.body) == null ? void 0 : _req_body2.version) ? String(req.body.version) : undefined;
+    if (!listingId || !hostId) {
+        return res.status(400).json({
+            error: 'Missing listingId or hostId'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _listing_profileId, _membership_orgId, _listing_priceUsd, _membership_orgId1;
+        var _req_body3, _req_body4, _versionData_manifest;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.installPlugins) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow installing from the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (![
+            'admin',
+            'editor'
+        ].includes(memberRole)) {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        // Uninstalls (AGL-237/424). Org pins are API-managed (rules deny
+        // client writes); host uninstalls also come through here so the
+        // enablement sync runs. Plugin-owned data is never deleted — only the
+        // pin (and the switchboard entry when no pin remains anywhere).
+        if (((_req_body3 = req.body) == null ? void 0 : _req_body3.action) === 'uninstall') {
+            var _ref2;
+            var _req_body5, _req_body6;
+            const orgId = await resolveOrgIdForHost(hostId);
+            if (((_req_body5 = req.body) == null ? void 0 : _req_body5.scope) === 'org' && !orgId) {
+                return res.status(409).json({
+                    error: 'This site has no organization yet'
+                });
+            }
+            const pinRef = ((_req_body6 = req.body) == null ? void 0 : _req_body6.scope) === 'org' ? orgId ? firestore.collection('orgs').doc(orgId).collection('installs').doc(listingId) : null : firestore.collection('hosts').doc(hostId).collection('installs').doc(listingId);
+            // Active-install accounting (AGL-880): decrement only when a pin actually
+            // existed, so a repeat/no-op uninstall never over-counts. `installCount`
+            // is a cumulative all-time total and is deliberately left untouched.
+            const pinSnapshot = pinRef ? await pinRef.get() : null;
+            const pinExisted = (_ref2 = pinSnapshot == null ? void 0 : pinSnapshot.exists) != null ? _ref2 : false;
+            // Read before the delete: the version being left is what the per-version
+            // tally has to decrement, and it is gone the moment the pin is.
+            const pinnedVersion = pinExisted ? pinSnapshot == null ? void 0 : pinSnapshot.get('version') : null;
+            if (pinRef) await pinRef.delete();
+            if (pinExisted) {
+                const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+                await recordVersionMove({
+                    firestore,
+                    listingRef,
+                    artifactType: 'plugin',
+                    from: pinnedVersion,
+                    to: null
+                });
+                await firestore.runTransaction(async (tx)=>{
+                    var _snapshot_get;
+                    const snapshot = await tx.get(listingRef);
+                    const current = Number((_snapshot_get = snapshot.get('activeInstalls')) != null ? _snapshot_get : 0);
+                    tx.update(listingRef, {
+                        activeInstalls: Math.max(0, current - 1)
+                    });
+                }).catch(()=>undefined);
+            }
+            await syncEnabledPlugins(firestore, orgId, hostId, listingId, 'remove-if-unpinned');
+            return res.status(200).json({
+                ok: true
+            });
+        }
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listingSnapshot = await listingRef.get();
+        const listing = listingSnapshot.data();
+        if (!listing || listing.deletedAt || // Staff takedown blocks new installs too (AGL-948) — the revocation
+        // check below stops a hidden listing anyway, but only while the
+        // revocation stands, and a takedown is not conditional on it.
+        listing.hiddenAt || listingArtifactType(listing) !== 'plugin') {
+            return res.status(404).json({
+                error: 'Unknown plugin listing'
+            });
+        }
+        // The publisher installs their own listing for free, and may install
+        // an unapproved version of it to test. Org-owned now (AGL-652), so this
+        // is a role check — comparing a uid to an org id would never match.
+        //
+        // TWO facts, correlated (AGL-2484). `canActAsPublisher` answers a
+        // question about the PUBLISHER org alone; the install TARGET is a
+        // different org, resolved from the host by the permission gate above.
+        // Nothing tied them together, so one flag computed from org P waived
+        // three gates on an install landing in org Q: review, version
+        // resolution, and payment. A user who administers publisher org P and
+        // holds `installPlugins` on a host in org Q could therefore push P's
+        // pending — or rejected — bundle onto Q's live public site, for free.
+        //
+        // Same-org is a NECESSARY condition, never a sufficient one: the role
+        // check still has to pass, so this narrows the waiver and cannot widen
+        // it. `strictNullChecks` is off repo-wide, hence the explicit `!== ''`
+        // rather than a truthiness test — a listing with no `profileId` is
+        // owned by nobody and must waive nothing.
+        const publisherOrgId = String((_listing_profileId = listing.profileId) != null ? _listing_profileId : '');
+        const installTargetOrgId = String((_membership_orgId = membership.orgId) != null ? _membership_orgId : '');
+        const ownsListing = publisherOrgId !== '' && installTargetOrgId === publisherOrgId && await canActAsPublisher(firestore, decoded.uid, listing.profileId);
+        // Private plugins are installable ONLY by the owning org (AGL-968).
+        // This is what makes private mean private; the UI merely hides them.
+        if (isPrivateListing(listing) && !ownsListing) {
+            return res.status(404).json({
+                error: 'Unknown plugin listing'
+            });
+        }
+        // Installs enforce the same review state the marketplace browses by
+        // (AGL-965). `isListingBrowsable` used to be applied ONLY by the browse
+        // UI, so a listing that was never reviewed, was rejected, or has since
+        // been de-listed could still be installed by anyone who knew its id and
+        // posted here directly — which also made "delist" a suggestion rather
+        // than a control. The publisher keeps installing their own listing to
+        // test it before review.
+        if (!isListingBrowsable(listing) && !isPrivateListing(listing) && !ownsListing) {
+            return res.status(409).json({
+                error: 'This plugin is not available for install'
+            });
+        }
+        const priceUsd = Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0);
+        // A FULLY refunded purchase stops entitling (AGL-1546), and until
+        // AGL-1699 only the component route knew that: this one asked whether a
+        // purchase doc EXISTED, so buy/install/refund kept the artifact. The
+        // predicate lives in one place now so the next route cannot miss it.
+        const unpaid = await requirePurchase({
+            firestore,
+            buyerUid: decoded.uid,
+            // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is
+            // resolved server-side from the caller's own membership by the
+            // permission gate above — never a request-body field — so this is the
+            // workspace the install actually lands in, and the only one a purchase
+            // can entitle here.
+            buyerOrgId: (_membership_orgId1 = membership.orgId) != null ? _membership_orgId1 : '',
+            listingId,
+            priceUsd,
+            ownsListing
+        });
+        if (unpaid) return res.status(402).json(unpaid);
+        // Installs resolve the newest APPROVED version, never `latestVersion`
+        // (AGL-966). Before this, publishing v1.0.1 to a verified listing put
+        // unreviewed code in front of every workspace immediately: the listing
+        // kept its status, the queue never surfaced the update, and this line
+        // pinned whatever had just been uploaded. A pending version is now
+        // simply not offered, and the previously approved one keeps installing.
+        //
+        // The publisher may still install their own unapproved version — that
+        // is how you test a plugin before submitting it. It reaches only their
+        // own sites because `ownsListing` now REQUIRES the install to land in
+        // the publishing org (AGL-2484); this sentence used to be an assertion
+        // about code that did not check.
+        // Read the kill switch BEFORE resolving, not after (AGL-2368).
+        //
+        // The order used to be: pick the newest APPROVED version, then 409 if that
+        // one happens to be revoked. Revocation was never an input to the choice,
+        // only a veto on it — so stopping one build stopped the whole listing.
+        // v2.0.0 revoked with v1.0.0 approved and installable resolved to v2.0.0
+        // and answered 409, and `requirePurchase` above has already taken the
+        // buyer's money by then. A per-version revocation is deliberately NOT
+        // listing-wide (`isListingWideRevocation`); that path made it so anyway.
+        const revocation = (await firestore.collection('revocations').doc(listingId).get()).data();
+        let version = requestedVersion != null ? requestedVersion : '';
+        let versionData;
+        if (version) {
+            versionData = (await listingRef.collection('pluginVersions').doc(version).get()).data();
+            if (!isVersionApproved(versionData) && !ownsListing) {
+                var _ref3;
+                return res.status(409).json({
+                    error: 'That version has not passed review yet',
+                    reviewState: (_ref3 = versionData == null ? void 0 : versionData.reviewState) != null ? _ref3 : 'unknown'
+                });
+            }
+        } else {
+            const approvedSnapshot = await listingRef.collection('pluginVersions').orderBy('publishedAt', 'desc').limit(25).get();
+            const candidates = approvedSnapshot.docs.map((doc)=>{
+                var _doc_get;
+                return {
+                    version: String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id),
+                    reviewState: doc.get('reviewState'),
+                    publishedAt: doc.get('publishedAt'),
+                    data: doc.data()
+                };
+            });
+            // The SHARED predicate (AGL-2306/2368): approved AND not revoked, which
+            // is the same function `repairLatestApprovedVersion` writes the listing
+            // mirror from. Two readings of "what is on offer" is how the badge and
+            // the route came to disagree; one function is how they cannot.
+            //
+            // Note this also orders by version rather than by `publishedAt`, which
+            // is what the mirror has always done — so the version this route hands
+            // over is now the version the listing page advertised.
+            const newestVersion = newestInstallableVersion(candidates, revocation, compareArtifactVersions);
+            const newest = newestVersion ? candidates.find((entry)=>entry.version === newestVersion) : undefined;
+            // The publisher testing their own listing falls back to latest.
+            const fallback = ownsListing ? candidates.find((entry)=>{
+                var _listing_latestVersion;
+                return entry.version === String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : '');
+            }) : undefined;
+            const chosen = newest != null ? newest : fallback;
+            if (!chosen) {
+                return res.status(409).json({
+                    error: 'This plugin has no reviewed version available to install'
+                });
+            }
+            version = chosen.version;
+            versionData = chosen.data;
+        }
+        if (!(versionData == null ? void 0 : versionData.sha256) || !(versionData == null ? void 0 : versionData.manifest)) {
+            return res.status(404).json({
+                error: 'Unknown plugin version'
+            });
+        }
+        // Kill switch (AGL-43 §3.5): a revoked version can't be installed.
+        // Shares the predicate with the loaders (AGL-1085) so "installable" and
+        // "runnable" cannot drift apart.
+        //
+        // Still checked after resolution, and still load-bearing: the unpinned
+        // branch can no longer choose a revoked version, but an EXPLICIT pin and
+        // the publisher's `latestVersion` fallback both can, and a listing-wide
+        // takedown revokes whatever either of them names.
+        if (isPluginRevoked(revocation, version)) {
+            return res.status(409).json({
+                error: 'This plugin version has been revoked'
+            });
+        }
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        // Install tier (AGL-237): org-extending plugins install once for every
+        // host in the org; host-only plugins stay pinned to the host.
+        const scope = ((_req_body4 = req.body) == null ? void 0 : _req_body4.scope) === 'org' ? 'org' : 'host';
+        let installRef = hostRef.collection('installs').doc(listingId);
+        if (scope === 'org') {
+            const orgId = await resolveOrgIdForHost(hostId);
+            if (!orgId) {
+                return res.status(409).json({
+                    error: 'This site has no organization yet'
+                });
+            }
+            installRef = firestore.collection('orgs').doc(orgId).collection('installs').doc(listingId);
+        }
+        const existing = await installRef.get();
+        await installRef.set(_extends({
+            listingId,
+            profileId: listing.profileId,
+            displayName: listing.displayName,
+            pluginId: versionData.manifest.id,
+            version,
+            sha256: versionData.sha256,
+            objectPath: versionData.objectPath,
+            manifest: versionData.manifest,
+            // The same provenance stamp every other artifact type now carries
+            // (AGL-1015), so one reader answers "where did this come from" for
+            // pinned and copied artifacts alike. The flat pin fields stay: they
+            // are what the loader reads.
+            installedFrom: pinnedProvenance({
+                listingId,
+                listing,
+                version,
+                sha256: versionData.sha256,
+                artifactType: 'plugin'
+            })
+        }, existing.exists ? {} : {
+            installedAt: now
+        }, {
+            updatedAt: now
+        }), {
+            merge: true
+        });
+        if (!existing.exists) {
+            await listingRef.update({
+                // installCount is the cumulative all-time total; activeInstalls
+                // mirrors live pins and is decremented on uninstall (AGL-880).
+                installCount: firebaseAdmin.firestore.FieldValue.increment(1),
+                activeInstalls: firebaseAdmin.firestore.FieldValue.increment(1)
+            }).catch(()=>undefined);
+        }
+        // Per-version tally (AGL-1036). This runs on EVERY pin write, not just the
+        // first: a re-pin is the common case and the one the listing-level counters
+        // above are blind to — the pin already exists, so nothing there moves while
+        // the install changes version underneath.
+        await recordVersionMove({
+            firestore,
+            listingRef,
+            artifactType: 'plugin',
+            from: existing.exists ? existing.get('version') : null,
+            to: version
+        });
+        // Enablement sync (AGL-424): the new install loads on next visit for
+        // workspaces with a configured switchboard.
+        await syncEnabledPlugins(firestore, await resolveOrgIdForHost(hostId), hostId, listingId, 'add');
+        // ABI heads-up (AGL-429): the pin succeeds (explicit choice), but the
+        // loaders will refuse an incompatible bundle — tell the installer now.
+        const manifestHostAbi = Number((_versionData_manifest = versionData.manifest) == null ? void 0 : _versionData_manifest.hostAbi);
+        const hostAbiWarning = Number.isInteger(manifestHostAbi) && manifestHostAbi > 0 && !isCompatibleHostAbi(manifestHostAbi) ? `Built for host ABI ${manifestHostAbi}; this platform runs ` + `${PLUGIN_HOST_ABI_VERSION}. The plugin will not load until the ` + 'publisher ships a compatible version.' : undefined;
+        return res.status(200).json(_extends({
+            installed: true,
+            upgraded: existing.exists,
+            version
+        }, hostAbiWarning ? {
+            hostAbiWarning
+        } : {}));
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Install failed'
+        });
+    }
+};
+
+//# sourceMappingURL=install-plugin.js.map

package/src/lib/server/install-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/install-plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  resolveOrgIdForHost, firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  compareArtifactVersions,\n  isCompatibleHostAbi,\n  isFirstPartyPlugin,\n  isPluginRevoked,\n  newestInstallableVersion,\n  PLUGIN_HOST_ABI_VERSION,\n  type PluginApiHandler,\n  type PluginRevocation,\n} from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { canActAsPublisher } from './publisher-profile'\nimport { requirePurchase } from './purchase-entitlement'\nimport { pinnedProvenance } from './provenance'\nimport { recordVersionMove } from './version-stats'\nimport {\n  isListingBrowsable,\n  isPrivateListing,\n  isVersionApproved,\n  listingArtifactType,\n} from '../model/marketplace'\n\n/**\n * Installs (or upgrades) a marketplace plugin into a host (AGL-45), pinning a\n * version per AGL-43 §3.4. Writes `hosts/{hostId}/installs/{listingId}`\n * with the exact `{version, sha256}` — upgrades are explicit (a new pin),\n * so a publisher can never swap the code a consumer runs. Access mirrors\n * component installs: free, purchased (webhook-written), or own listing.\n * The pin references the immutable artifact; the sandboxed loader fetches\n * and integrity-checks it at render time.\n *\n * Enablement sync (AGL-424): marketplace plugins ride the same\n * `org.enabledPlugins` switchboard first-party plugins use — but ONLY for\n * workspaces that have explicitly configured the field. Install appends\n * the listing id there; uninstall removes it once no pin (org or acting\n * host) remains. Workspaces that never touched the switchboard stay\n * default-open (absent field ⇒ installs load), so pre-sync installs keep\n * working.\n */\n\n/** Keeps `org.enabledPlugins` in step with install pins (AGL-424). */\nasync function syncEnabledPlugins(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string | null,\n  hostId: string,\n  listingId: string,\n  action: 'add' | 'remove-if-unpinned',\n): Promise<void> {\n  if (!orgId) return\n  // `enabledPlugins` is a flat mix of first-party bundle ids and marketplace\n  // listing ids (AGL-777). A listing id is a Firestore doc id, so it can't\n  // normally collide with a bundle name — but guard anyway: an install sync\n  // must NEVER arrayUnion/arrayRemove a bundle id, which would silently\n  // enable or disable a platform plugin as a side effect of a purchase.\n  if (isFirstPartyPlugin(listingId)) return\n  const orgRef = firestore.collection('orgs').doc(orgId)\n  const configured = (await orgRef.get()).get('enabledPlugins')\n  // Absent field = default-open workspace; nothing to sync.\n  if (!Array.isArray(configured)) return\n  if (action === 'add') {\n    if (configured.includes(listingId)) return\n    await orgRef.update({\n      enabledPlugins: firebaseAdmin.firestore.FieldValue.arrayUnion(listingId),\n    })\n    return\n  }\n  const [orgPin, hostPin] = await Promise.all([\n    orgRef.collection('installs').doc(listingId).get(),\n    firestore\n      .collection('hosts')\n      .doc(hostId)\n      .collection('installs')\n      .doc(listingId)\n      .get(),\n  ])\n  if (orgPin.exists || hostPin.exists) return\n  await orgRef.update({\n    enabledPlugins: firebaseAdmin.firestore.FieldValue.arrayRemove(listingId),\n  })\n}\nexport const installPluginHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const listingId = String(req.body?.listingId ?? '')\n  const hostId = String(req.body?.hostId ?? '')\n  // Optional explicit version for upgrade/downgrade; defaults to latest.\n  const requestedVersion = req.body?.version\n    ? String(req.body.version)\n    : undefined\n  if (!listingId || !hostId) {\n    return res.status(400).json({ error: 'Missing listingId or hostId' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.installPlugins) {\n      return res.status(403).json({\n        error: 'Your organization role does not allow installing from the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (!['admin', 'editor'].includes(memberRole)) {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n\n    // Uninstalls (AGL-237/424). Org pins are API-managed (rules deny\n    // client writes); host uninstalls also come through here so the\n    // enablement sync runs. Plugin-owned data is never deleted — only the\n    // pin (and the switchboard entry when no pin remains anywhere).\n    if (req.body?.action === 'uninstall') {\n      const orgId = await resolveOrgIdForHost(hostId)\n      if (req.body?.scope === 'org' && !orgId) {\n        return res.status(409).json({ error: 'This site has no organization yet' })\n      }\n      const pinRef =\n        req.body?.scope === 'org'\n          ? orgId\n            ? firestore.collection('orgs').doc(orgId).collection('installs').doc(listingId)\n            : null\n          : firestore.collection('hosts').doc(hostId).collection('installs').doc(listingId)\n      // Active-install accounting (AGL-880): decrement only when a pin actually\n      // existed, so a repeat/no-op uninstall never over-counts. `installCount`\n      // is a cumulative all-time total and is deliberately left untouched.\n      const pinSnapshot = pinRef ? await pinRef.get() : null\n      const pinExisted = pinSnapshot?.exists ?? false\n      // Read before the delete: the version being left is what the per-version\n      // tally has to decrement, and it is gone the moment the pin is.\n      const pinnedVersion = pinExisted ? pinSnapshot?.get('version') : null\n      if (pinRef) await pinRef.delete()\n      if (pinExisted) {\n        const listingRef = firestore\n          .collection('marketplaceListings')\n          .doc(listingId)\n        await recordVersionMove({\n          firestore,\n          listingRef,\n          artifactType: 'plugin',\n          from: pinnedVersion,\n          to: null,\n        })\n        await firestore\n          .runTransaction(async (tx) => {\n            const snapshot = await tx.get(listingRef)\n            const current = Number(snapshot.get('activeInstalls') ?? 0)\n            tx.update(listingRef, { activeInstalls: Math.max(0, current - 1) })\n          })\n          .catch(() => undefined)\n      }\n      await syncEnabledPlugins(\n        firestore,\n        orgId,\n        hostId,\n        listingId,\n        'remove-if-unpinned',\n      )\n      return res.status(200).json({ ok: true })\n    }\n\n    const listingRef = firestore\n      .collection('marketplaceListings')\n      .doc(listingId)\n    const listingSnapshot = await listingRef.get()\n    const listing = listingSnapshot.data() as any\n    if (\n      !listing ||\n      listing.deletedAt ||\n      // Staff takedown blocks new installs too (AGL-948) — the revocation\n      // check below stops a hidden listing anyway, but only while the\n      // revocation stands, and a takedown is not conditional on it.\n      listing.hiddenAt ||\n      listingArtifactType(listing) !== 'plugin'\n    ) {\n      return res.status(404).json({ error: 'Unknown plugin listing' })\n    }\n\n    // The publisher installs their own listing for free, and may install\n    // an unapproved version of it to test. Org-owned now (AGL-652), so this\n    // is a role check — comparing a uid to an org id would never match.\n    //\n    // TWO facts, correlated (AGL-2484). `canActAsPublisher` answers a\n    // question about the PUBLISHER org alone; the install TARGET is a\n    // different org, resolved from the host by the permission gate above.\n    // Nothing tied them together, so one flag computed from org P waived\n    // three gates on an install landing in org Q: review, version\n    // resolution, and payment. A user who administers publisher org P and\n    // holds `installPlugins` on a host in org Q could therefore push P's\n    // pending — or rejected — bundle onto Q's live public site, for free.\n    //\n    // Same-org is a NECESSARY condition, never a sufficient one: the role\n    // check still has to pass, so this narrows the waiver and cannot widen\n    // it. `strictNullChecks` is off repo-wide, hence the explicit `!== ''`\n    // rather than a truthiness test — a listing with no `profileId` is\n    // owned by nobody and must waive nothing.\n    const publisherOrgId = String(listing.profileId ?? '')\n    const installTargetOrgId = String(membership.orgId ?? '')\n    const ownsListing =\n      publisherOrgId !== '' &&\n      installTargetOrgId === publisherOrgId &&\n      (await canActAsPublisher(firestore, decoded.uid, listing.profileId))\n\n    // Private plugins are installable ONLY by the owning org (AGL-968).\n    // This is what makes private mean private; the UI merely hides them.\n    if (isPrivateListing(listing) && !ownsListing) {\n      return res.status(404).json({ error: 'Unknown plugin listing' })\n    }\n\n    // Installs enforce the same review state the marketplace browses by\n    // (AGL-965). `isListingBrowsable` used to be applied ONLY by the browse\n    // UI, so a listing that was never reviewed, was rejected, or has since\n    // been de-listed could still be installed by anyone who knew its id and\n    // posted here directly — which also made \"delist\" a suggestion rather\n    // than a control. The publisher keeps installing their own listing to\n    // test it before review.\n    if (!isListingBrowsable(listing) && !isPrivateListing(listing) && !ownsListing) {\n      return res\n        .status(409)\n        .json({ error: 'This plugin is not available for install' })\n    }\n\n    const priceUsd = Number(listing.priceUsd ?? 0)\n    // A FULLY refunded purchase stops entitling (AGL-1546), and until\n    // AGL-1699 only the component route knew that: this one asked whether a\n    // purchase doc EXISTED, so buy/install/refund kept the artifact. The\n    // predicate lives in one place now so the next route cannot miss it.\n    const unpaid = await requirePurchase({\n      firestore,\n      buyerUid: decoded.uid,\n      // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is\n      // resolved server-side from the caller's own membership by the\n      // permission gate above — never a request-body field — so this is the\n      // workspace the install actually lands in, and the only one a purchase\n      // can entitle here.\n      buyerOrgId: membership.orgId ?? '',\n      listingId,\n      priceUsd,\n      ownsListing,\n    })\n    if (unpaid) return res.status(402).json(unpaid)\n\n    // Installs resolve the newest APPROVED version, never `latestVersion`\n    // (AGL-966). Before this, publishing v1.0.1 to a verified listing put\n    // unreviewed code in front of every workspace immediately: the listing\n    // kept its status, the queue never surfaced the update, and this line\n    // pinned whatever had just been uploaded. A pending version is now\n    // simply not offered, and the previously approved one keeps installing.\n    //\n    // The publisher may still install their own unapproved version — that\n    // is how you test a plugin before submitting it. It reaches only their\n    // own sites because `ownsListing` now REQUIRES the install to land in\n    // the publishing org (AGL-2484); this sentence used to be an assertion\n    // about code that did not check.\n    // Read the kill switch BEFORE resolving, not after (AGL-2368).\n    //\n    // The order used to be: pick the newest APPROVED version, then 409 if that\n    // one happens to be revoked. Revocation was never an input to the choice,\n    // only a veto on it — so stopping one build stopped the whole listing.\n    // v2.0.0 revoked with v1.0.0 approved and installable resolved to v2.0.0\n    // and answered 409, and `requirePurchase` above has already taken the\n    // buyer's money by then. A per-version revocation is deliberately NOT\n    // listing-wide (`isListingWideRevocation`); that path made it so anyway.\n    const revocation = (\n      await firestore.collection('revocations').doc(listingId).get()\n    ).data() as PluginRevocation | undefined\n\n    let version = requestedVersion ?? ''\n    let versionData: any\n    if (version) {\n      versionData = (\n        await listingRef.collection('pluginVersions').doc(version).get()\n      ).data()\n      if (!isVersionApproved(versionData) && !ownsListing) {\n        return res.status(409).json({\n          error: 'That version has not passed review yet',\n          reviewState: versionData?.reviewState ?? 'unknown',\n        })\n      }\n    } else {\n      const approvedSnapshot = await listingRef\n        .collection('pluginVersions')\n        .orderBy('publishedAt', 'desc')\n        .limit(25)\n        .get()\n      const candidates = approvedSnapshot.docs.map((doc) => ({\n        version: String(doc.get('version') ?? doc.id),\n        reviewState: doc.get('reviewState'),\n        publishedAt: doc.get('publishedAt'),\n        data: doc.data(),\n      }))\n      // The SHARED predicate (AGL-2306/2368): approved AND not revoked, which\n      // is the same function `repairLatestApprovedVersion` writes the listing\n      // mirror from. Two readings of \"what is on offer\" is how the badge and\n      // the route came to disagree; one function is how they cannot.\n      //\n      // Note this also orders by version rather than by `publishedAt`, which\n      // is what the mirror has always done — so the version this route hands\n      // over is now the version the listing page advertised.\n      const newestVersion = newestInstallableVersion(\n        candidates,\n        revocation,\n        compareArtifactVersions,\n      )\n      const newest = newestVersion\n        ? (candidates.find((entry) => entry.version === newestVersion) as\n            | { version: string; data: any }\n            | undefined)\n        : undefined\n      // The publisher testing their own listing falls back to latest.\n      const fallback = ownsListing\n        ? candidates.find(\n            (entry) => entry.version === String(listing.latestVersion ?? ''),\n          )\n        : undefined\n      const chosen = newest ?? fallback\n      if (!chosen) {\n        return res.status(409).json({\n          error: 'This plugin has no reviewed version available to install',\n        })\n      }\n      version = chosen.version\n      versionData = (chosen as { data?: unknown }).data\n    }\n    if (!versionData?.sha256 || !versionData?.manifest) {\n      return res.status(404).json({ error: 'Unknown plugin version' })\n    }\n\n    // Kill switch (AGL-43 §3.5): a revoked version can't be installed.\n    // Shares the predicate with the loaders (AGL-1085) so \"installable\" and\n    // \"runnable\" cannot drift apart.\n    //\n    // Still checked after resolution, and still load-bearing: the unpinned\n    // branch can no longer choose a revoked version, but an EXPLICIT pin and\n    // the publisher's `latestVersion` fallback both can, and a listing-wide\n    // takedown revokes whatever either of them names.\n    if (isPluginRevoked(revocation, version)) {\n      return res\n        .status(409)\n        .json({ error: 'This plugin version has been revoked' })\n    }\n\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n    // Install tier (AGL-237): org-extending plugins install once for every\n    // host in the org; host-only plugins stay pinned to the host.\n    const scope = req.body?.scope === 'org' ? 'org' : 'host'\n    let installRef = hostRef.collection('installs').doc(listingId)\n    if (scope === 'org') {\n      const orgId = await resolveOrgIdForHost(hostId)\n      if (!orgId) {\n        return res.status(409).json({ error: 'This site has no organization yet' })\n      }\n      installRef = firestore\n        .collection('orgs')\n        .doc(orgId)\n        .collection('installs')\n        .doc(listingId)\n    }\n    const existing = await installRef.get()\n    await installRef.set(\n      {\n        listingId,\n        profileId: listing.profileId,\n        displayName: listing.displayName,\n        pluginId: versionData.manifest.id,\n        version,\n        sha256: versionData.sha256,\n        objectPath: versionData.objectPath,\n        manifest: versionData.manifest,\n        // The same provenance stamp every other artifact type now carries\n        // (AGL-1015), so one reader answers \"where did this come from\" for\n        // pinned and copied artifacts alike. The flat pin fields stay: they\n        // are what the loader reads.\n        installedFrom: pinnedProvenance({\n          listingId,\n          listing,\n          version,\n          sha256: versionData.sha256,\n          artifactType: 'plugin',\n        }),\n        ...(existing.exists ? {} : { installedAt: now }),\n        updatedAt: now,\n      },\n      { merge: true },\n    )\n    if (!existing.exists) {\n      await listingRef\n        .update({\n          // installCount is the cumulative all-time total; activeInstalls\n          // mirrors live pins and is decremented on uninstall (AGL-880).\n          installCount: firebaseAdmin.firestore.FieldValue.increment(1),\n          activeInstalls: firebaseAdmin.firestore.FieldValue.increment(1),\n        })\n        .catch(() => undefined)\n    }\n    // Per-version tally (AGL-1036). This runs on EVERY pin write, not just the\n    // first: a re-pin is the common case and the one the listing-level counters\n    // above are blind to — the pin already exists, so nothing there moves while\n    // the install changes version underneath.\n    await recordVersionMove({\n      firestore,\n      listingRef,\n      artifactType: 'plugin',\n      from: existing.exists ? existing.get('version') : null,\n      to: version,\n    })\n\n    // Enablement sync (AGL-424): the new install loads on next visit for\n    // workspaces with a configured switchboard.\n    await syncEnabledPlugins(\n      firestore,\n      await resolveOrgIdForHost(hostId),\n      hostId,\n      listingId,\n      'add',\n    )\n\n    // ABI heads-up (AGL-429): the pin succeeds (explicit choice), but the\n    // loaders will refuse an incompatible bundle — tell the installer now.\n    const manifestHostAbi = Number(versionData.manifest?.hostAbi)\n    const hostAbiWarning =\n      Number.isInteger(manifestHostAbi) &&\n      manifestHostAbi > 0 &&\n      !isCompatibleHostAbi(manifestHostAbi)\n        ? `Built for host ABI ${manifestHostAbi}; this platform runs ` +\n          `${PLUGIN_HOST_ABI_VERSION}. The plugin will not load until the ` +\n          'publisher ships a compatible version.'\n        : undefined\n\n    return res.status(200).json({\n      installed: true,\n      upgraded: existing.exists,\n      version,\n      ...(hostAbiWarning ? { hostAbiWarning } : {}),\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Install failed' })\n  }\n}\n"],"names":["resolveOrgIdForHost","firebaseAdmin","compareArtifactVersions","isCompatibleHostAbi","isFirstPartyPlugin","isPluginRevoked","newestInstallableVersion","PLUGIN_HOST_ABI_VERSION","resolveOrgPermissions","canActAsPublisher","requirePurchase","pinnedProvenance","recordVersionMove","isListingBrowsable","isPrivateListing","isVersionApproved","listingArtifactType","syncEnabledPlugins","firestore","orgId","hostId","listingId","action","orgRef","collection","doc","configured","get","Array","isArray","includes","update","enabledPlugins","FieldValue","arrayUnion","orgPin","hostPin","Promise","all","exists","arrayRemove","installPluginHandler","req","res","method","status","json","error","String","body","requestedVersion","version","undefined","authorization","headers","idToken","startsWith","slice","length","hostSnapshot","listing","membership","versionData","decoded","app","auth","verifyIdToken","uid","permissions","installPlugins","hostRef","memberRole","scope","pinRef","pinSnapshot","pinExisted","pinnedVersion","delete","listingRef","artifactType","from","to","runTransaction","tx","snapshot","current","Number","activeInstalls","Math","max","catch","ok","listingSnapshot","data","deletedAt","hiddenAt","publisherOrgId","profileId","installTargetOrgId","ownsListing","priceUsd","unpaid","buyerUid","buyerOrgId","revocation","reviewState","approvedSnapshot","orderBy","limit","candidates","docs","map","id","publishedAt","newestVersion","newest","find","entry","fallback","latestVersion","chosen","sha256","manifest","now","serverTimestamp","installRef","existing","set","displayName","pluginId","objectPath","installedFrom","installedAt","updatedAt","merge","installCount","increment","manifestHostAbi","hostAbi","hostAbiWarning","isInteger","installed","upgraded","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,mBAAmB,EAAEC,aAAa,QAAQ,2BAA0B;AACtE,SACEC,uBAAuB,EACvBC,mBAAmB,EACnBC,kBAAkB,EAClBC,eAAe,EACfC,wBAAwB,EACxBC,uBAAuB,QAGlB,sBAAqB;AAC5B,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,gBAAgB,QAAQ,kBAAc;AAC/C,SAASC,iBAAiB,QAAQ,qBAAiB;AACnD,SACEC,kBAAkB,EAClBC,gBAAgB,EAChBC,iBAAiB,EACjBC,mBAAmB,QACd,0BAAsB;AAE7B;;;;;;;;;;;;;;;;CAgBC,GAED,oEAAoE,GACpE,eAAeC,mBACbC,SAAsC,EACtCC,KAAoB,EACpBC,MAAc,EACdC,SAAiB,EACjBC,MAAoC;IAEpC,IAAI,CAACH,OAAO;IACZ,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,sEAAsE;IACtE,IAAIf,mBAAmBiB,YAAY;IACnC,MAAME,SAASL,UAAUM,UAAU,CAAC,QAAQC,GAAG,CAACN;IAChD,MAAMO,aAAa,AAAC,CAAA,MAAMH,OAAOI,GAAG,EAAC,EAAGA,GAAG,CAAC;IAC5C,0DAA0D;IAC1D,IAAI,CAACC,MAAMC,OAAO,CAACH,aAAa;IAChC,IAAIJ,WAAW,OAAO;QACpB,IAAII,WAAWI,QAAQ,CAACT,YAAY;QACpC,MAAME,OAAOQ,MAAM,CAAC;YAClBC,gBAAgB/B,cAAciB,SAAS,CAACe,UAAU,CAACC,UAAU,CAACb;QAChE;QACA;IACF;IACA,MAAM,CAACc,QAAQC,QAAQ,GAAG,MAAMC,QAAQC,GAAG,CAAC;QAC1Cf,OAAOC,UAAU,CAAC,YAAYC,GAAG,CAACJ,WAAWM,GAAG;QAChDT,UACGM,UAAU,CAAC,SACXC,GAAG,CAACL,QACJI,UAAU,CAAC,YACXC,GAAG,CAACJ,WACJM,GAAG;KACP;IACD,IAAIQ,OAAOI,MAAM,IAAIH,QAAQG,MAAM,EAAE;IACrC,MAAMhB,OAAOQ,MAAM,CAAC;QAClBC,gBAAgB/B,cAAciB,SAAS,CAACe,UAAU,CAACO,WAAW,CAACnB;IACjE;AACF;AACA,OAAO,MAAMoB,uBAAyC,OAAOC,KAAKC;qBAanCD;QATJA,WACHA,YAEGA;IANzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAM1B,YAAY2B,gBAAON,YAAAA,IAAIO,IAAI,qBAARP,UAAUrB,SAAS,mBAAI;IAChD,MAAMD,SAAS4B,iBAAON,aAAAA,IAAIO,IAAI,qBAARP,WAAUtB,MAAM,oBAAI;IAC1C,uEAAuE;IACvE,MAAM8B,mBAAmBR,EAAAA,aAAAA,IAAIO,IAAI,qBAARP,WAAUS,OAAO,IACtCH,OAAON,IAAIO,IAAI,CAACE,OAAO,IACvBC;IACJ,IAAI,CAAC/B,aAAa,CAACD,QAAQ;QACzB,OAAOuB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,MAAMM,gBAAgBL,QAAON,6BAAAA,IAAIY,OAAO,CAACD,aAAa,YAAzBX,6BAA6B;IAC1D,MAAMa,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCN;IACJ,IAAI,CAACG,SAAS,OAAOZ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAekBY,mBA6FUC,oBACIC,mBAyBVD,mBAaVC;YA3HVnB,YAyOUA,YA0EiBoB;QA1U/B,MAAMC,UAAU,MAAM9D,cAAc+D,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;QAC/D,MAAMM,aAAa,MAAMrD,sBAAsBuD,QAAQI,GAAG,EAAE;YAAE/C;QAAO;QACrE,IAAI,CAACyC,WAAWO,WAAW,CAACC,cAAc,EAAE;YAC1C,OAAO1B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,MAAM7B,YAAYjB,cAAc+D,GAAG,GAAG9C,SAAS;QAE/C,MAAMoD,UAAUpD,UAAUM,UAAU,CAAC,SAASC,GAAG,CAACL;QAClD,MAAMuC,eAAe,MAAMW,QAAQ3C,GAAG;QACtC,IAAI,CAACgC,aAAapB,MAAM,EAAE;YACxB,OAAOI,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAMwB,aAAa,EAACZ,oBAAAA,aAAahC,GAAG,CAAC,0BAAjBgC,oBAAmC,CAAC,EAAE,CAACI,QAAQI,GAAG,CAAC;QACvE,IAAI,CAAC;YAAC;YAAS;SAAS,CAACrC,QAAQ,CAACyC,aAAa;YAC7C,OAAO5B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QAEA,iEAAiE;QACjE,gEAAgE;QAChE,sEAAsE;QACtE,gEAAgE;QAChE,IAAIL,EAAAA,aAAAA,IAAIO,IAAI,qBAARP,WAAUpB,MAAM,MAAK,aAAa;;gBAEhCoB,YAIFA;YALF,MAAMvB,QAAQ,MAAMnB,oBAAoBoB;YACxC,IAAIsB,EAAAA,aAAAA,IAAIO,IAAI,qBAARP,WAAU8B,KAAK,MAAK,SAAS,CAACrD,OAAO;gBACvC,OAAOwB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAoC;YAC3E;YACA,MAAM0B,SACJ/B,EAAAA,aAAAA,IAAIO,IAAI,qBAARP,WAAU8B,KAAK,MAAK,QAChBrD,QACED,UAAUM,UAAU,CAAC,QAAQC,GAAG,CAACN,OAAOK,UAAU,CAAC,YAAYC,GAAG,CAACJ,aACnE,OACFH,UAAUM,UAAU,CAAC,SAASC,GAAG,CAACL,QAAQI,UAAU,CAAC,YAAYC,GAAG,CAACJ;YAC3E,0EAA0E;YAC1E,yEAAyE;YACzE,qEAAqE;YACrE,MAAMqD,cAAcD,SAAS,MAAMA,OAAO9C,GAAG,KAAK;YAClD,MAAMgD,sBAAaD,+BAAAA,YAAanC,MAAM,oBAAI;YAC1C,yEAAyE;YACzE,gEAAgE;YAChE,MAAMqC,gBAAgBD,aAAaD,+BAAAA,YAAa/C,GAAG,CAAC,aAAa;YACjE,IAAI8C,QAAQ,MAAMA,OAAOI,MAAM;YAC/B,IAAIF,YAAY;gBACd,MAAMG,aAAa5D,UAChBM,UAAU,CAAC,uBACXC,GAAG,CAACJ;gBACP,MAAMT,kBAAkB;oBACtBM;oBACA4D;oBACAC,cAAc;oBACdC,MAAMJ;oBACNK,IAAI;gBACN;gBACA,MAAM/D,UACHgE,cAAc,CAAC,OAAOC;wBAEEC;oBADvB,MAAMA,WAAW,MAAMD,GAAGxD,GAAG,CAACmD;oBAC9B,MAAMO,UAAUC,QAAOF,gBAAAA,SAASzD,GAAG,CAAC,6BAAbyD,gBAAkC;oBACzDD,GAAGpD,MAAM,CAAC+C,YAAY;wBAAES,gBAAgBC,KAAKC,GAAG,CAAC,GAAGJ,UAAU;oBAAG;gBACnE,GACCK,KAAK,CAAC,IAAMtC;YACjB;YACA,MAAMnC,mBACJC,WACAC,OACAC,QACAC,WACA;YAEF,OAAOsB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE6C,IAAI;YAAK;QACzC;QAEA,MAAMb,aAAa5D,UAChBM,UAAU,CAAC,uBACXC,GAAG,CAACJ;QACP,MAAMuE,kBAAkB,MAAMd,WAAWnD,GAAG;QAC5C,MAAMiC,UAAUgC,gBAAgBC,IAAI;QACpC,IACE,CAACjC,WACDA,QAAQkC,SAAS,IACjB,oEAAoE;QACpE,gEAAgE;QAChE,8DAA8D;QAC9DlC,QAAQmC,QAAQ,IAChB/E,oBAAoB4C,aAAa,UACjC;YACA,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,EAAE;QACF,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,qEAAqE;QACrE,8DAA8D;QAC9D,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,EAAE;QACF,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,0CAA0C;QAC1C,MAAMiD,iBAAiBhD,QAAOY,qBAAAA,QAAQqC,SAAS,YAAjBrC,qBAAqB;QACnD,MAAMsC,qBAAqBlD,QAAOa,oBAAAA,WAAW1C,KAAK,YAAhB0C,oBAAoB;QACtD,MAAMsC,cACJH,mBAAmB,MACnBE,uBAAuBF,kBACtB,MAAMvF,kBAAkBS,WAAW6C,QAAQI,GAAG,EAAEP,QAAQqC,SAAS;QAEpE,oEAAoE;QACpE,qEAAqE;QACrE,IAAInF,iBAAiB8C,YAAY,CAACuC,aAAa;YAC7C,OAAOxD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,yBAAyB;QACzB,IAAI,CAAClC,mBAAmB+C,YAAY,CAAC9C,iBAAiB8C,YAAY,CAACuC,aAAa;YAC9E,OAAOxD,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAA2C;QAC9D;QAEA,MAAMqD,WAAWd,QAAO1B,oBAAAA,QAAQwC,QAAQ,YAAhBxC,oBAAoB;QAC5C,kEAAkE;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,MAAMyC,SAAS,MAAM3F,gBAAgB;YACnCQ;YACAoF,UAAUvC,QAAQI,GAAG;YACrB,qEAAqE;YACrE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,oBAAoB;YACpBoC,UAAU,GAAE1C,qBAAAA,WAAW1C,KAAK,YAAhB0C,qBAAoB;YAChCxC;YACA+E;YACAD;QACF;QACA,IAAIE,QAAQ,OAAO1D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAACuD;QAExC,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,wEAAwE;QACxE,EAAE;QACF,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,iCAAiC;QACjC,+DAA+D;QAC/D,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,MAAMG,aAAa,AACjB,CAAA,MAAMtF,UAAUM,UAAU,CAAC,eAAeC,GAAG,CAACJ,WAAWM,GAAG,EAAC,EAC7DkE,IAAI;QAEN,IAAI1C,UAAUD,2BAAAA,mBAAoB;QAClC,IAAIY;QACJ,IAAIX,SAAS;YACXW,cAAc,AACZ,CAAA,MAAMgB,WAAWtD,UAAU,CAAC,kBAAkBC,GAAG,CAAC0B,SAASxB,GAAG,EAAC,EAC/DkE,IAAI;YACN,IAAI,CAAC9E,kBAAkB+C,gBAAgB,CAACqC,aAAa;;gBACnD,OAAOxD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO;oBACP0D,WAAW,WAAE3C,+BAAAA,YAAa2C,WAAW,oBAAI;gBAC3C;YACF;QACF,OAAO;YACL,MAAMC,mBAAmB,MAAM5B,WAC5BtD,UAAU,CAAC,kBACXmF,OAAO,CAAC,eAAe,QACvBC,KAAK,CAAC,IACNjF,GAAG;YACN,MAAMkF,aAAaH,iBAAiBI,IAAI,CAACC,GAAG,CAAC,CAACtF;oBAC5BA;uBADqC;oBACrD0B,SAASH,QAAOvB,WAAAA,IAAIE,GAAG,CAAC,sBAARF,WAAsBA,IAAIuF,EAAE;oBAC5CP,aAAahF,IAAIE,GAAG,CAAC;oBACrBsF,aAAaxF,IAAIE,GAAG,CAAC;oBACrBkE,MAAMpE,IAAIoE,IAAI;gBAChB;;YACA,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,uDAAuD;YACvD,MAAMqB,gBAAgB5G,yBACpBuG,YACAL,YACAtG;YAEF,MAAMiH,SAASD,gBACVL,WAAWO,IAAI,CAAC,CAACC,QAAUA,MAAMlE,OAAO,KAAK+D,iBAG9C9D;YACJ,gEAAgE;YAChE,MAAMkE,WAAWnB,cACbU,WAAWO,IAAI,CACb,CAACC;oBAAmCzD;uBAAzByD,MAAMlE,OAAO,KAAKH,QAAOY,yBAAAA,QAAQ2D,aAAa,YAArB3D,yBAAyB;iBAE/DR;YACJ,MAAMoE,SAASL,iBAAAA,SAAUG;YACzB,IAAI,CAACE,QAAQ;gBACX,OAAO7E,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO;gBACT;YACF;YACAI,UAAUqE,OAAOrE,OAAO;YACxBW,cAAc,AAAC0D,OAA8B3B,IAAI;QACnD;QACA,IAAI,EAAC/B,+BAAAA,YAAa2D,MAAM,KAAI,EAAC3D,+BAAAA,YAAa4D,QAAQ,GAAE;YAClD,OAAO/E,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAyB;QAChE;QAEA,mEAAmE;QACnE,wEAAwE;QACxE,iCAAiC;QACjC,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,IAAI1C,gBAAgBmG,YAAYrD,UAAU;YACxC,OAAOR,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAuC;QAC1D;QAEA,MAAM4E,MAAM1H,cAAciB,SAAS,CAACe,UAAU,CAAC2F,eAAe;QAC9D,uEAAuE;QACvE,8DAA8D;QAC9D,MAAMpD,QAAQ9B,EAAAA,aAAAA,IAAIO,IAAI,qBAARP,WAAU8B,KAAK,MAAK,QAAQ,QAAQ;QAClD,IAAIqD,aAAavD,QAAQ9C,UAAU,CAAC,YAAYC,GAAG,CAACJ;QACpD,IAAImD,UAAU,OAAO;YACnB,MAAMrD,QAAQ,MAAMnB,oBAAoBoB;YACxC,IAAI,CAACD,OAAO;gBACV,OAAOwB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAAoC;YAC3E;YACA8E,aAAa3G,UACVM,UAAU,CAAC,QACXC,GAAG,CAACN,OACJK,UAAU,CAAC,YACXC,GAAG,CAACJ;QACT;QACA,MAAMyG,WAAW,MAAMD,WAAWlG,GAAG;QACrC,MAAMkG,WAAWE,GAAG,CAClB;YACE1G;YACA4E,WAAWrC,QAAQqC,SAAS;YAC5B+B,aAAapE,QAAQoE,WAAW;YAChCC,UAAUnE,YAAY4D,QAAQ,CAACV,EAAE;YACjC7D;YACAsE,QAAQ3D,YAAY2D,MAAM;YAC1BS,YAAYpE,YAAYoE,UAAU;YAClCR,UAAU5D,YAAY4D,QAAQ;YAC9B,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,6BAA6B;YAC7BS,eAAexH,iBAAiB;gBAC9BU;gBACAuC;gBACAT;gBACAsE,QAAQ3D,YAAY2D,MAAM;gBAC1B1C,cAAc;YAChB;WACI+C,SAASvF,MAAM,GAAG,CAAC,IAAI;YAAE6F,aAAaT;QAAI;YAC9CU,WAAWV;YAEb;YAAEW,OAAO;QAAK;QAEhB,IAAI,CAACR,SAASvF,MAAM,EAAE;YACpB,MAAMuC,WACH/C,MAAM,CAAC;gBACN,gEAAgE;gBAChE,+DAA+D;gBAC/DwG,cAActI,cAAciB,SAAS,CAACe,UAAU,CAACuG,SAAS,CAAC;gBAC3DjD,gBAAgBtF,cAAciB,SAAS,CAACe,UAAU,CAACuG,SAAS,CAAC;YAC/D,GACC9C,KAAK,CAAC,IAAMtC;QACjB;QACA,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,0CAA0C;QAC1C,MAAMxC,kBAAkB;YACtBM;YACA4D;YACAC,cAAc;YACdC,MAAM8C,SAASvF,MAAM,GAAGuF,SAASnG,GAAG,CAAC,aAAa;YAClDsD,IAAI9B;QACN;QAEA,qEAAqE;QACrE,4CAA4C;QAC5C,MAAMlC,mBACJC,WACA,MAAMlB,oBAAoBoB,SAC1BA,QACAC,WACA;QAGF,sEAAsE;QACtE,uEAAuE;QACvE,MAAMoH,kBAAkBnD,QAAOxB,wBAAAA,YAAY4D,QAAQ,qBAApB5D,sBAAsB4E,OAAO;QAC5D,MAAMC,iBACJrD,OAAOsD,SAAS,CAACH,oBACjBA,kBAAkB,KAClB,CAACtI,oBAAoBsI,mBACjB,CAAC,mBAAmB,EAAEA,gBAAgB,qBAAqB,CAAC,GAC5D,GAAGlI,wBAAwB,qCAAqC,CAAC,GACjE,0CACA6C;QAEN,OAAOT,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1B+F,WAAW;YACXC,UAAUhB,SAASvF,MAAM;YACzBY;WACIwF,iBAAiB;YAAEA;QAAe,IAAI,CAAC;IAE/C,EAAE,OAAO5F,OAAO;QACdgG,QAAQhG,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/install-template.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Installs a site template into a host's TEMPLATE LIBRARY (AGL-137,
+ * reworked by AGL-669).
+ *
+ * This used to instantiate screens and write routing-map entries in the
+ * same call, which made installed pages public the instant you clicked
+ * install — browsing the marketplace could publish to a production site by
+ * mis-click. Now it only writes to `hosts/{hostId}/templates`; creating
+ * pages is a separate, deliberate step (AGL-670).
+ *
+ * The snapshot's screens become one page template each, sharing a
+ * `source.listingId` so the library can group them and the user can pick
+ * which ones to use. The theme is carried on the templates rather than
+ * applied — a theme change is site-wide and instant, the same class of
+ * surprise this removed.
+ *
+ * Access is unchanged: free, purchased, or your own listing. Still
+ * server-side because version snapshots are not client-readable.
+ */
+export declare const installTemplateHandler: PluginApiHandler;