@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/install-theme.js

@@ -0,0 +1,313 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { describeTheme } from "@aglyn/aglyn/app-utils/marketplace-theme";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { isPrivateListing, listingArtifactType } from "../model/marketplace.js";
+import { canActAsPublisher } from "./publisher-profile.js";
+import { requirePurchase } from "./purchase-entitlement.js";
+import { hasDivergedFromBase, recordInstallProvenance } from "./provenance.js";
+import { recordVersionMove } from "./version-stats.js";
+/**
+ * Installs a marketplace theme onto a site (AGL-1020).
+ *
+ * Themes are the exception to "installing never changes a running site". A
+ * template or a layout can land inert in a library because it is one thing
+ * among many; a theme IS the site's appearance, and installing one into a
+ * library where it does nothing would be a control that appears to work and
+ * does not. So this writes `hosts/{hostId}.theme` and the site repaints.
+ *
+ * Which makes reversibility the requirement, not a nicety. Two things provide
+ * it, and neither is a confirmation dialog:
+ *
+ * * The theme being replaced is kept verbatim in `themeReplaced`, so `revert`
+ *   restores exactly what was there — including a hand-built theme that was
+ *   never a marketplace artifact and exists nowhere else.
+ * * `reset` clears the theme entirely, which is the "use the default theme"
+ *   the issue asks to keep first-class. It is a distinct action from revert
+ *   because "back to how it was" and "back to stock" are different intents and
+ *   guessing between them is how people lose work.
+ *
+ * `preview` changes nothing and returns what the swap would do, so the
+ * confirmation can name it rather than showing a JSON blob.
+ */ export const installThemeHandler = async (req, res)=>{
+    var _ref, _ref1, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const action = [
+        'revert',
+        'reset',
+        'preview',
+        'clear-overrides'
+    ].includes((_req_body1 = req.body) == null ? void 0 : _req_body1.action) ? req.body.action : 'install';
+    const listingId = String((_ref1 = (_req_body2 = req.body) == null ? void 0 : _req_body2.listingId) != null ? _ref1 : '');
+    if (!hostId || action === 'install' && !listingId) {
+        return res.status(400).json({
+            error: 'Missing listingId or hostId'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _hostSnapshot_get1, _listing_priceUsd, _membership_orgId, _hostSnapshot_get2, _listing_latestVersion;
+        var _req_body3;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.installPlugins) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow installing from the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        const currentTheme = (_hostSnapshot_get1 = hostSnapshot.get('theme')) != null ? _hostSnapshot_get1 : null;
+        // ---- reset: back to the platform default ----
+        if (action === 'reset') {
+            await hostRef.set({
+                // Kept, not dropped: resetting is reversible for the same reason
+                // installing is, and someone who resets by mistake has otherwise
+                // lost a theme that existed in no other document.
+                themeReplaced: {
+                    theme: currentTheme,
+                    replacedAt: now
+                },
+                theme: firebaseAdmin.firestore.FieldValue.delete(),
+                themeInstalledFrom: firebaseAdmin.firestore.FieldValue.delete(),
+                themeOverride: firebaseAdmin.firestore.FieldValue.delete(),
+                updatedAt: now
+            }, {
+                merge: true
+            });
+            return res.status(200).json({
+                reset: true
+            });
+        }
+        // ---- clear-overrides: drop this site's changes, keep the theme ----
+        // The third way back, and the narrowest: "reset to the publisher's
+        // version" is deleting the patch — the whole point of owning the patch
+        // rather than the copy (AGL-1019). The theme itself is untouched.
+        if (action === 'clear-overrides') {
+            await hostRef.set({
+                themeOverride: firebaseAdmin.firestore.FieldValue.delete(),
+                updatedAt: now
+            }, {
+                merge: true
+            });
+            return res.status(200).json({
+                cleared: true
+            });
+        }
+        // ---- revert: back to whatever this site had before the last swap ----
+        if (action === 'revert') {
+            var _replaced_theme;
+            const replaced = hostSnapshot.get('themeReplaced');
+            if (!replaced) {
+                return res.status(409).json({
+                    error: 'There is no previous theme to go back to on this site.'
+                });
+            }
+            await hostRef.set(_extends({
+                theme: (_replaced_theme = replaced.theme) != null ? _replaced_theme : firebaseAdmin.firestore.FieldValue.delete()
+            }, replaced.installedFrom ? {
+                themeInstalledFrom: replaced.installedFrom
+            } : {
+                themeInstalledFrom: firebaseAdmin.firestore.FieldValue.delete()
+            }, replaced.override ? {
+                themeOverride: replaced.override
+            } : {
+                themeOverride: firebaseAdmin.firestore.FieldValue.delete()
+            }, {
+                themeReplaced: firebaseAdmin.firestore.FieldValue.delete(),
+                updatedAt: now
+            }), {
+                merge: true
+            });
+            return res.status(200).json({
+                reverted: true
+            });
+        }
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listingSnapshot = await listingRef.get();
+        const listing = listingSnapshot.data();
+        if (!listing || listing.deletedAt || // Staff takedown blocks new installs on EVERY artifact type
+        // (AGL-2290). AGL-948 extended takedown past plugins in the browse
+        // predicate and in `resolveMarketplacePluginVersion`, but the gate that
+        // decides whether content is HANDED OVER was only ever added to
+        // `install-plugin.ts`. So a component, theme, template, layout, email
+        // template or dataset schema that staff had taken down stayed
+        // installable by anyone holding its listing id — which makes takedown a
+        // suggestion for six of the seven artifact types.
+        //
+        // No owner exemption, matching `install-plugin.ts`: a takedown is a
+        // moderation decision about the artifact, not about who is asking.
+        listing.hiddenAt || listingArtifactType(listing) !== 'theme') {
+            return res.status(404).json({
+                error: 'Unknown theme'
+            });
+        }
+        const priceUsd = Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0);
+        const ownsListing = await canActAsPublisher(firestore, decoded.uid, listing.profileId);
+        // Private listings install ONLY for the owning org (AGL-2290).
+        //
+        // `install-plugin.ts` has carried this since AGL-968; the other six never
+        // did, so a private component, theme, template, layout, email template or
+        // dataset schema was installable by anyone who knew its listing id. Browse
+        // hides them and the detail page 404s, but neither is a control — the
+        // route is.
+        if (isPrivateListing(listing) && !ownsListing) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // A FULLY refunded purchase stops entitling (AGL-1546), and until
+        // AGL-1699 only the component route knew that: this one asked whether a
+        // purchase doc EXISTED, so buy/install/refund kept the artifact. The
+        // predicate lives in one place now so the next route cannot miss it.
+        const unpaid = await requirePurchase({
+            firestore,
+            buyerUid: decoded.uid,
+            // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is
+            // resolved server-side from the caller's own membership by the
+            // permission gate above — never a request-body field — so this is the
+            // workspace the install actually lands in, and the only one a purchase
+            // can entitle here.
+            buyerOrgId: (_membership_orgId = membership.orgId) != null ? _membership_orgId : '',
+            listingId,
+            priceUsd,
+            ownsListing
+        });
+        if (unpaid) return res.status(402).json(unpaid);
+        const versionSnapshot = await listingRef.collection('versions').doc(String(listing.latestVersion)).get();
+        const theme = versionSnapshot.get('theme');
+        if (!theme || !Object.keys(theme).length) {
+            return res.status(500).json({
+                error: 'Theme version missing'
+            });
+        }
+        // ---- preview: say what the swap changes, change nothing ----
+        if (action === 'preview') {
+            var _listing_latestVersion1;
+            return res.status(200).json({
+                incoming: describeTheme(theme),
+                current: describeTheme(currentTheme),
+                // A site with no theme is on the platform default, so there is nothing
+                // to lose and the confirmation should not imply there is.
+                replaces: Boolean(currentTheme && Object.keys(currentTheme).length),
+                version: (_listing_latestVersion1 = listing.latestVersion) != null ? _listing_latestVersion1 : null
+            });
+        }
+        // ---- install ----
+        // Replacing a theme the workspace has edited destroys those edits (AGL-1018).
+        // Unlike a component this is not recoverable by looking in a library — the
+        // theme lives on one field on one document — so the refusal matters more.
+        const diverged = await hasDivergedFromBase({
+            firestore,
+            sha256: hostSnapshot.get('themeInstalledFrom.sha256'),
+            current: currentTheme
+        });
+        if (diverged && ((_req_body3 = req.body) == null ? void 0 : _req_body3.mode) !== 'replace') {
+            return res.status(409).json({
+                error: 'This site’s theme has been edited since it was installed. Review ' + 'the update to see what would change.',
+                diverged: true
+            });
+        }
+        const provenance = await recordInstallProvenance({
+            firestore,
+            listingId,
+            listing,
+            version: listing.latestVersion,
+            artifactType: 'theme',
+            content: theme
+        });
+        const previousVersion = (_hostSnapshot_get2 = hostSnapshot.get('themeInstalledFrom.version')) != null ? _hostSnapshot_get2 : null;
+        await hostRef.set({
+            theme,
+            themeInstalledFrom: provenance.installedFrom,
+            // Everything needed to put this site back exactly as it was, captured
+            // BEFORE the write that changes it.
+            themeReplaced: _extends({
+                theme: currentTheme
+            }, hostSnapshot.get('themeInstalledFrom') ? {
+                installedFrom: hostSnapshot.get('themeInstalledFrom')
+            } : {}, hostSnapshot.get('themeOverride') ? {
+                override: hostSnapshot.get('themeOverride')
+            } : {}, {
+                replacedAt: now
+            }),
+            // Overrides SURVIVE a theme swap (AGL-1021). A site that set its brand
+            // colour still means it under a new theme, and silently discarding
+            // that on install would be the more surprising of the two options.
+            //
+            // What must not happen is surviving *silently*: the override keeps the
+            // `baseSha256` it was authored against, which no longer matches the
+            // theme now installed, so `isOverrideForCurrentTheme` is false and the
+            // editor says so with an offer to clear them. Rewriting that hash here
+            // would launder a patch written for another theme into one that claims
+            // to belong to this one.
+            updatedAt: now
+        }, {
+            merge: true
+        });
+        await recordVersionMove({
+            firestore,
+            listingRef,
+            artifactType: 'theme',
+            from: previousVersion,
+            to: listing.latestVersion
+        });
+        await listingRef.update({
+            installCount: firebaseAdmin.firestore.FieldValue.increment(1)
+        }).catch(()=>undefined);
+        return res.status(200).json({
+            installed: true,
+            version: (_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : null,
+            baseStored: provenance.baseStored,
+            applied: describeTheme(theme)
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Theme install failed'
+        });
+    }
+};
+export default installThemeHandler;
+
+//# sourceMappingURL=install-theme.js.map

package/src/lib/server/install-theme.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/install-theme.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { describeTheme } from '@aglyn/aglyn/app-utils/marketplace-theme'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  isPrivateListing,\n  listingArtifactType,\n} from '../model/marketplace'\nimport { canActAsPublisher } from './publisher-profile'\nimport { requirePurchase } from './purchase-entitlement'\nimport { hasDivergedFromBase, recordInstallProvenance } from './provenance'\nimport { recordVersionMove } from './version-stats'\n\n/**\n * Installs a marketplace theme onto a site (AGL-1020).\n *\n * Themes are the exception to \"installing never changes a running site\". A\n * template or a layout can land inert in a library because it is one thing\n * among many; a theme IS the site's appearance, and installing one into a\n * library where it does nothing would be a control that appears to work and\n * does not. So this writes `hosts/{hostId}.theme` and the site repaints.\n *\n * Which makes reversibility the requirement, not a nicety. Two things provide\n * it, and neither is a confirmation dialog:\n *\n * * The theme being replaced is kept verbatim in `themeReplaced`, so `revert`\n *   restores exactly what was there — including a hand-built theme that was\n *   never a marketplace artifact and exists nowhere else.\n * * `reset` clears the theme entirely, which is the \"use the default theme\"\n *   the issue asks to keep first-class. It is a distinct action from revert\n *   because \"back to how it was\" and \"back to stock\" are different intents and\n *   guessing between them is how people lose work.\n *\n * `preview` changes nothing and returns what the swap would do, so the\n * confirmation can name it rather than showing a JSON blob.\n */\nexport const installThemeHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const action = ['revert', 'reset', 'preview', 'clear-overrides'].includes(\n    req.body?.action,\n  )\n    ? (req.body.action as\n        | 'revert'\n        | 'reset'\n        | 'preview'\n        | 'clear-overrides')\n    : 'install'\n  const listingId = String(req.body?.listingId ?? '')\n  if (!hostId || (action === 'install' && !listingId)) {\n    return res.status(400).json({ error: 'Missing listingId or hostId' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.installPlugins) {\n      return res.status(403).json({\n        error:\n          'Your organization role does not allow installing from the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n    const currentTheme = hostSnapshot.get('theme') ?? null\n\n    // ---- reset: back to the platform default ----\n    if (action === 'reset') {\n      await hostRef.set(\n        {\n          // Kept, not dropped: resetting is reversible for the same reason\n          // installing is, and someone who resets by mistake has otherwise\n          // lost a theme that existed in no other document.\n          themeReplaced: { theme: currentTheme, replacedAt: now },\n          theme: firebaseAdmin.firestore.FieldValue.delete(),\n          themeInstalledFrom: firebaseAdmin.firestore.FieldValue.delete(),\n          themeOverride: firebaseAdmin.firestore.FieldValue.delete(),\n          updatedAt: now,\n        },\n        { merge: true },\n      )\n      return res.status(200).json({ reset: true })\n    }\n\n    // ---- clear-overrides: drop this site's changes, keep the theme ----\n    // The third way back, and the narrowest: \"reset to the publisher's\n    // version\" is deleting the patch — the whole point of owning the patch\n    // rather than the copy (AGL-1019). The theme itself is untouched.\n    if (action === 'clear-overrides') {\n      await hostRef.set(\n        {\n          themeOverride: firebaseAdmin.firestore.FieldValue.delete(),\n          updatedAt: now,\n        },\n        { merge: true },\n      )\n      return res.status(200).json({ cleared: true })\n    }\n\n    // ---- revert: back to whatever this site had before the last swap ----\n    if (action === 'revert') {\n      const replaced = hostSnapshot.get('themeReplaced')\n      if (!replaced) {\n        return res.status(409).json({\n          error: 'There is no previous theme to go back to on this site.',\n        })\n      }\n      await hostRef.set(\n        {\n          theme: replaced.theme ?? firebaseAdmin.firestore.FieldValue.delete(),\n          ...(replaced.installedFrom\n            ? { themeInstalledFrom: replaced.installedFrom }\n            : { themeInstalledFrom: firebaseAdmin.firestore.FieldValue.delete() }),\n          // The overrides that were live alongside that theme come back with\n          // it. Reverting the base and keeping a patch authored against the\n          // theme being reverted FROM is the one combination nobody asked for.\n          ...(replaced.override\n            ? { themeOverride: replaced.override }\n            : { themeOverride: firebaseAdmin.firestore.FieldValue.delete() }),\n          themeReplaced: firebaseAdmin.firestore.FieldValue.delete(),\n          updatedAt: now,\n        },\n        { merge: true },\n      )\n      return res.status(200).json({ reverted: true })\n    }\n\n    const listingRef = firestore.collection('marketplaceListings').doc(listingId)\n    const listingSnapshot = await listingRef.get()\n    const listing = listingSnapshot.data() as any\n    if (\n      !listing ||\n      listing.deletedAt ||\n      // Staff takedown blocks new installs on EVERY artifact type\n      // (AGL-2290). AGL-948 extended takedown past plugins in the browse\n      // predicate and in `resolveMarketplacePluginVersion`, but the gate that\n      // decides whether content is HANDED OVER was only ever added to\n      // `install-plugin.ts`. So a component, theme, template, layout, email\n      // template or dataset schema that staff had taken down stayed\n      // installable by anyone holding its listing id — which makes takedown a\n      // suggestion for six of the seven artifact types.\n      //\n      // No owner exemption, matching `install-plugin.ts`: a takedown is a\n      // moderation decision about the artifact, not about who is asking.\n      listing.hiddenAt ||\n      listingArtifactType(listing) !== 'theme'\n    ) {\n      return res.status(404).json({ error: 'Unknown theme' })\n    }\n\n    const priceUsd = Number(listing.priceUsd ?? 0)\n    const ownsListing = await canActAsPublisher(\n      firestore,\n      decoded.uid,\n      listing.profileId,\n    )\n    // Private listings install ONLY for the owning org (AGL-2290).\n    //\n    // `install-plugin.ts` has carried this since AGL-968; the other six never\n    // did, so a private component, theme, template, layout, email template or\n    // dataset schema was installable by anyone who knew its listing id. Browse\n    // hides them and the detail page 404s, but neither is a control — the\n    // route is.\n    if (isPrivateListing(listing) && !ownsListing) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // A FULLY refunded purchase stops entitling (AGL-1546), and until\n    // AGL-1699 only the component route knew that: this one asked whether a\n    // purchase doc EXISTED, so buy/install/refund kept the artifact. The\n    // predicate lives in one place now so the next route cannot miss it.\n    const unpaid = await requirePurchase({\n      firestore,\n      buyerUid: decoded.uid,\n      // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is\n      // resolved server-side from the caller's own membership by the\n      // permission gate above — never a request-body field — so this is the\n      // workspace the install actually lands in, and the only one a purchase\n      // can entitle here.\n      buyerOrgId: membership.orgId ?? '',\n      listingId,\n      priceUsd,\n      ownsListing,\n    })\n    if (unpaid) return res.status(402).json(unpaid)\n\n    const versionSnapshot = await listingRef\n      .collection('versions')\n      .doc(String(listing.latestVersion))\n      .get()\n    const theme = versionSnapshot.get('theme')\n    if (!theme || !Object.keys(theme).length) {\n      return res.status(500).json({ error: 'Theme version missing' })\n    }\n\n    // ---- preview: say what the swap changes, change nothing ----\n    if (action === 'preview') {\n      return res.status(200).json({\n        incoming: describeTheme(theme),\n        current: describeTheme(currentTheme),\n        // A site with no theme is on the platform default, so there is nothing\n        // to lose and the confirmation should not imply there is.\n        replaces: Boolean(currentTheme && Object.keys(currentTheme).length),\n        version: listing.latestVersion ?? null,\n      })\n    }\n\n    // ---- install ----\n    // Replacing a theme the workspace has edited destroys those edits (AGL-1018).\n    // Unlike a component this is not recoverable by looking in a library — the\n    // theme lives on one field on one document — so the refusal matters more.\n    const diverged = await hasDivergedFromBase({\n      firestore,\n      sha256: hostSnapshot.get('themeInstalledFrom.sha256'),\n      current: currentTheme,\n    })\n    if (diverged && req.body?.mode !== 'replace') {\n      return res.status(409).json({\n        error:\n          'This site’s theme has been edited since it was installed. Review ' +\n          'the update to see what would change.',\n        diverged: true,\n      })\n    }\n\n    const provenance = await recordInstallProvenance({\n      firestore,\n      listingId,\n      listing,\n      version: listing.latestVersion,\n      artifactType: 'theme',\n      content: theme,\n    })\n    const previousVersion =\n      hostSnapshot.get('themeInstalledFrom.version') ?? null\n\n    await hostRef.set(\n      {\n        theme,\n        themeInstalledFrom: provenance.installedFrom,\n        // Everything needed to put this site back exactly as it was, captured\n        // BEFORE the write that changes it.\n        themeReplaced: {\n          theme: currentTheme,\n          ...(hostSnapshot.get('themeInstalledFrom')\n            ? { installedFrom: hostSnapshot.get('themeInstalledFrom') }\n            : {}),\n          ...(hostSnapshot.get('themeOverride')\n            ? { override: hostSnapshot.get('themeOverride') }\n            : {}),\n          replacedAt: now,\n        },\n        // Overrides SURVIVE a theme swap (AGL-1021). A site that set its brand\n        // colour still means it under a new theme, and silently discarding\n        // that on install would be the more surprising of the two options.\n        //\n        // What must not happen is surviving *silently*: the override keeps the\n        // `baseSha256` it was authored against, which no longer matches the\n        // theme now installed, so `isOverrideForCurrentTheme` is false and the\n        // editor says so with an offer to clear them. Rewriting that hash here\n        // would launder a patch written for another theme into one that claims\n        // to belong to this one.\n        updatedAt: now,\n      },\n      { merge: true },\n    )\n\n    await recordVersionMove({\n      firestore,\n      listingRef,\n      artifactType: 'theme',\n      from: previousVersion,\n      to: listing.latestVersion,\n    })\n    await listingRef\n      .update({\n        installCount: firebaseAdmin.firestore.FieldValue.increment(1),\n      })\n      .catch(() => undefined)\n\n    return res.status(200).json({\n      installed: true,\n      version: listing.latestVersion ?? null,\n      baseStored: provenance.baseStored,\n      applied: describeTheme(theme),\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Theme install failed' })\n  }\n}\n\nexport default installThemeHandler\n"],"names":["describeTheme","firebaseAdmin","resolveOrgPermissions","isPrivateListing","listingArtifactType","canActAsPublisher","requirePurchase","hasDivergedFromBase","recordInstallProvenance","recordVersionMove","installThemeHandler","req","res","method","status","json","error","hostId","String","body","action","includes","listingId","authorization","headers","idToken","startsWith","slice","length","undefined","hostSnapshot","listing","membership","decoded","app","auth","verifyIdToken","uid","permissions","installPlugins","firestore","hostRef","collection","doc","get","exists","memberRole","now","FieldValue","serverTimestamp","currentTheme","set","themeReplaced","theme","replacedAt","delete","themeInstalledFrom","themeOverride","updatedAt","merge","reset","cleared","replaced","installedFrom","override","reverted","listingRef","listingSnapshot","data","deletedAt","hiddenAt","priceUsd","Number","ownsListing","profileId","unpaid","buyerUid","buyerOrgId","orgId","versionSnapshot","latestVersion","Object","keys","incoming","current","replaces","Boolean","version","diverged","sha256","mode","provenance","artifactType","content","previousVersion","from","to","update","installCount","increment","catch","installed","baseStored","applied","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,aAAa,QAAQ,2CAA0C;AACxE,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,gBAAgB,EAChBC,mBAAmB,QACd,0BAAsB;AAC7B,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,mBAAmB,EAAEC,uBAAuB,QAAQ,kBAAc;AAC3E,SAASC,iBAAiB,QAAQ,qBAAiB;AAEnD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,MAAMC,sBAAwC,OAAOC,KAAKC;qBAkBlCD;QAdPA,WAEpBA,YAQuBA;IAbzB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,SAAS;QAAC;QAAU;QAAS;QAAW;KAAkB,CAACC,QAAQ,EACvEV,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,MAAM,IAEbT,IAAIQ,IAAI,CAACC,MAAM,GAKhB;IACJ,MAAME,YAAYJ,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUW,SAAS,oBAAI;IAChD,IAAI,CAACL,UAAWG,WAAW,aAAa,CAACE,WAAY;QACnD,OAAOV,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,MAAMO,gBAAgBL,QAAOP,6BAAAA,IAAIa,OAAO,CAACD,aAAa,YAAzBZ,6BAA6B;IAC1D,MAAMc,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOb,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAekBc,mBAKCA,oBAsFGC,mBA4BVC,mBAuDZF,oBAgDSC;YAlEKpB;QA1KhB,MAAMsB,UAAU,MAAMhC,cAAciC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;QAC/D,MAAMO,aAAa,MAAM9B,sBAAsB+B,QAAQI,GAAG,EAAE;YAAEpB;QAAO;QACrE,IAAI,CAACe,WAAWM,WAAW,CAACC,cAAc,EAAE;YAC1C,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAMwB,YAAYvC,cAAciC,GAAG,GAAGM,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAC1B;QAClD,MAAMa,eAAe,MAAMW,QAAQG,GAAG;QACtC,IAAI,CAACd,aAAae,MAAM,EAAE;YACxB,OAAOjC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAM8B,aAAa,EAAChB,oBAAAA,aAAac,GAAG,CAAC,0BAAjBd,oBAAmC,CAAC,EAAE,CAACG,QAAQI,GAAG,CAAC;QACvE,IAAIS,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QACA,MAAM+B,MAAM9C,cAAcuC,SAAS,CAACQ,UAAU,CAACC,eAAe;QAC9D,MAAMC,gBAAepB,qBAAAA,aAAac,GAAG,CAAC,oBAAjBd,qBAA6B;QAElD,gDAAgD;QAChD,IAAIV,WAAW,SAAS;YACtB,MAAMqB,QAAQU,GAAG,CACf;gBACE,iEAAiE;gBACjE,iEAAiE;gBACjE,kDAAkD;gBAClDC,eAAe;oBAAEC,OAAOH;oBAAcI,YAAYP;gBAAI;gBACtDM,OAAOpD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;gBAChDC,oBAAoBvD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;gBAC7DE,eAAexD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;gBACxDG,WAAWX;YACb,GACA;gBAAEY,OAAO;YAAK;YAEhB,OAAO/C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE6C,OAAO;YAAK;QAC5C;QAEA,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,IAAIxC,WAAW,mBAAmB;YAChC,MAAMqB,QAAQU,GAAG,CACf;gBACEM,eAAexD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;gBACxDG,WAAWX;YACb,GACA;gBAAEY,OAAO;YAAK;YAEhB,OAAO/C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE8C,SAAS;YAAK;QAC9C;QAEA,wEAAwE;QACxE,IAAIzC,WAAW,UAAU;gBASZ0C;YARX,MAAMA,WAAWhC,aAAac,GAAG,CAAC;YAClC,IAAI,CAACkB,UAAU;gBACb,OAAOlD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO;gBACT;YACF;YACA,MAAMyB,QAAQU,GAAG,CACf;gBACEE,KAAK,GAAES,kBAAAA,SAAST,KAAK,YAAdS,kBAAkB7D,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;eAC9DO,SAASC,aAAa,GACtB;gBAAEP,oBAAoBM,SAASC,aAAa;YAAC,IAC7C;gBAAEP,oBAAoBvD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;YAAG,GAIlEO,SAASE,QAAQ,GACjB;gBAAEP,eAAeK,SAASE,QAAQ;YAAC,IACnC;gBAAEP,eAAexD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;YAAG;gBACjEH,eAAenD,cAAcuC,SAAS,CAACQ,UAAU,CAACO,MAAM;gBACxDG,WAAWX;gBAEb;gBAAEY,OAAO;YAAK;YAEhB,OAAO/C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEkD,UAAU;YAAK;QAC/C;QAEA,MAAMC,aAAa1B,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAACrB;QACnE,MAAM6C,kBAAkB,MAAMD,WAAWtB,GAAG;QAC5C,MAAMb,UAAUoC,gBAAgBC,IAAI;QACpC,IACE,CAACrC,WACDA,QAAQsC,SAAS,IACjB,4DAA4D;QAC5D,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,sEAAsE;QACtE,8DAA8D;QAC9D,wEAAwE;QACxE,kDAAkD;QAClD,EAAE;QACF,oEAAoE;QACpE,mEAAmE;QACnEtC,QAAQuC,QAAQ,IAChBlE,oBAAoB2B,aAAa,SACjC;YACA,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgB;QACvD;QAEA,MAAMuD,WAAWC,QAAOzC,oBAAAA,QAAQwC,QAAQ,YAAhBxC,oBAAoB;QAC5C,MAAM0C,cAAc,MAAMpE,kBACxBmC,WACAP,QAAQI,GAAG,EACXN,QAAQ2C,SAAS;QAEnB,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,YAAY;QACZ,IAAIvE,iBAAiB4B,YAAY,CAAC0C,aAAa;YAC7C,OAAO7D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,kEAAkE;QAClE,wEAAwE;QACxE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM2D,SAAS,MAAMrE,gBAAgB;YACnCkC;YACAoC,UAAU3C,QAAQI,GAAG;YACrB,qEAAqE;YACrE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,oBAAoB;YACpBwC,UAAU,GAAE7C,oBAAAA,WAAW8C,KAAK,YAAhB9C,oBAAoB;YAChCV;YACAiD;YACAE;QACF;QACA,IAAIE,QAAQ,OAAO/D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC4D;QAExC,MAAMI,kBAAkB,MAAMb,WAC3BxB,UAAU,CAAC,YACXC,GAAG,CAACzB,OAAOa,QAAQiD,aAAa,GAChCpC,GAAG;QACN,MAAMS,QAAQ0B,gBAAgBnC,GAAG,CAAC;QAClC,IAAI,CAACS,SAAS,CAAC4B,OAAOC,IAAI,CAAC7B,OAAOzB,MAAM,EAAE;YACxC,OAAOhB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAwB;QAC/D;QAEA,+DAA+D;QAC/D,IAAII,WAAW,WAAW;gBAObW;YANX,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BoE,UAAUnF,cAAcqD;gBACxB+B,SAASpF,cAAckD;gBACvB,uEAAuE;gBACvE,0DAA0D;gBAC1DmC,UAAUC,QAAQpC,gBAAgB+B,OAAOC,IAAI,CAAChC,cAActB,MAAM;gBAClE2D,OAAO,GAAExD,0BAAAA,QAAQiD,aAAa,YAArBjD,0BAAyB;YACpC;QACF;QAEA,oBAAoB;QACpB,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAMyD,WAAW,MAAMjF,oBAAoB;YACzCiC;YACAiD,QAAQ3D,aAAac,GAAG,CAAC;YACzBwC,SAASlC;QACX;QACA,IAAIsC,YAAY7E,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAU+E,IAAI,MAAK,WAAW;YAC5C,OAAO9E,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,sEACA;gBACFwE,UAAU;YACZ;QACF;QAEA,MAAMG,aAAa,MAAMnF,wBAAwB;YAC/CgC;YACAlB;YACAS;YACAwD,SAASxD,QAAQiD,aAAa;YAC9BY,cAAc;YACdC,SAASxC;QACX;QACA,MAAMyC,mBACJhE,qBAAAA,aAAac,GAAG,CAAC,yCAAjBd,qBAAkD;QAEpD,MAAMW,QAAQU,GAAG,CACf;YACEE;YACAG,oBAAoBmC,WAAW5B,aAAa;YAC5C,sEAAsE;YACtE,oCAAoC;YACpCX,eAAe;gBACbC,OAAOH;eACHpB,aAAac,GAAG,CAAC,wBACjB;gBAAEmB,eAAejC,aAAac,GAAG,CAAC;YAAsB,IACxD,CAAC,GACDd,aAAac,GAAG,CAAC,mBACjB;gBAAEoB,UAAUlC,aAAac,GAAG,CAAC;YAAiB,IAC9C,CAAC;gBACLU,YAAYP;;YAEd,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,EAAE;YACF,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,yBAAyB;YACzBW,WAAWX;QACb,GACA;YAAEY,OAAO;QAAK;QAGhB,MAAMlD,kBAAkB;YACtB+B;YACA0B;YACA0B,cAAc;YACdG,MAAMD;YACNE,IAAIjE,QAAQiD,aAAa;QAC3B;QACA,MAAMd,WACH+B,MAAM,CAAC;YACNC,cAAcjG,cAAcuC,SAAS,CAACQ,UAAU,CAACmD,SAAS,CAAC;QAC7D,GACCC,KAAK,CAAC,IAAMvE;QAEf,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BsF,WAAW;YACXd,OAAO,GAAExD,yBAAAA,QAAQiD,aAAa,YAArBjD,yBAAyB;YAClCuE,YAAYX,WAAWW,UAAU;YACjCC,SAASvG,cAAcqD;QACzB;IACF,EAAE,OAAOrC,OAAO;QACdwF,QAAQxF,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAuB;IAC9D;AACF,EAAC;AAED,eAAeN,oBAAmB"}

package/src/lib/server/install.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Installs (or updates) a marketplace listing into a host (AGL-44/46).
+ * Server-side because version snapshots are not client-readable — paid
+ * content would otherwise be free to anyone who read the subcollection.
+ * Access: the listing is free, the caller bought it (webhook-written
+ * purchase record), or the caller published it. Installing copies the
+ * latest version into `hosts/{hostId}/components` with `marketplace` source
+ * metadata; re-installing updates the same component doc in place.
+ */
+export declare const installHandler: PluginApiHandler;