@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/install.js

@@ -0,0 +1,276 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, createResourceUid, decodeStoredNodes, encodeStoredNodes } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { isPrivateListing } from "../model/marketplace.js";
+import { readPublishedProps } from "../model/marketplace-props.js";
+import { canActAsPublisher } from "./publisher-profile.js";
+import { hasDivergedFromBase, recordInstallProvenance } from "./provenance.js";
+import { requirePurchase } from "./purchase-entitlement.js";
+import { recordVersionMove } from "./version-stats.js";
+/**
+ * Installs (or updates) a marketplace listing into a host (AGL-44/46).
+ * Server-side because version snapshots are not client-readable — paid
+ * content would otherwise be free to anyone who read the subcollection.
+ * Access: the listing is free, the caller bought it (webhook-written
+ * purchase record), or the caller published it. Installing copies the
+ * latest version into `hosts/{hostId}/components` with `marketplace` source
+ * metadata; re-installing updates the same component doc in place.
+ */ export const installHandler = async (req, res)=>{
+    var _ref, _ref1, _req_headers_authorization;
+    var _req_body, _req_body1;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const listingId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.listingId) != null ? _ref : '');
+    const hostId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.hostId) != null ? _ref1 : '');
+    if (!listingId || !hostId) {
+        return res.status(400).json({
+            error: 'Missing listingId or hostId'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _listing_priceUsd, _membership_orgId, _version_nodes, _existing_docs__get;
+        var _this;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        // Org-role permission gate (AGL-238).
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.installPlugins) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow installing from the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        // The SAME gate the console's own create path applies to this exact
+        // document (AGL-2072). `/api/hosts/resources` declares
+        // `reusableComponent: { collection: 'components', entitlement:
+        // 'reusableComponents' }` and says why: a reusable component renders on
+        // the LIVE SITE, so the Starter+ gate has to be server-enforced rather
+        // than merely hidden in the console (AGL-473). This route writes a
+        // byte-for-byte equivalent doc into `hosts/{hostId}/components` and asked
+        // nothing — so a free org installed from the marketplace and got the
+        // working feature its own console would have refused.
+        //
+        // The assumption that hid it is written down at
+        // `apps/console/app/api/hosts/import/route.ts:329-331`:
+        // "`reusableComponents` is a BOOLEAN entitlement, true on every plan that
+        // can reach here". True of import, which is Pro+. False here — any plan
+        // reaches the marketplace, and free listings cost nothing to install.
+        //
+        // Ahead of `requirePurchase`, deliberately, and matching
+        // `install-dataset-schema.ts:89`: refusing on plan AFTER taking someone's
+        // money for the listing would be the worse order. The whole org doc is
+        // read (`getOrgDoc` projects nothing), so `resolveEffectivePlan` sees the
+        // subscription status and a LAPSED org is refused exactly as a free one
+        // is — the gate is re-asked per install, never inherited from whatever
+        // plan was in force when an earlier copy was installed.
+        const org = (_this = await getOrgForHost(hostId)) == null ? void 0 : _this.org;
+        if (!checkEntitlement(org, 'reusableComponents')) {
+            return res.status(403).json({
+                error: 'Reusable components require a Starter plan or higher'
+            });
+        }
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listingSnapshot = await listingRef.get();
+        const listing = listingSnapshot.data();
+        if (!listing || listing.deletedAt || // Staff takedown blocks new installs on EVERY artifact type
+        // (AGL-2290). AGL-948 extended takedown past plugins in the browse
+        // predicate and in `resolveMarketplacePluginVersion`, but the gate that
+        // decides whether content is HANDED OVER was only ever added to
+        // `install-plugin.ts`. So a component, theme, template, layout, email
+        // template or dataset schema that staff had taken down stayed
+        // installable by anyone holding its listing id — which makes takedown a
+        // suggestion for six of the seven artifact types.
+        //
+        // No owner exemption, matching `install-plugin.ts`: a takedown is a
+        // moderation decision about the artifact, not about who is asking.
+        listing.hiddenAt) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        const priceUsd = Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0);
+        // The publisher installs their own listing for free. Org-owned now
+        // (AGL-652), so this is a role check — comparing a uid to an org id
+        // would never match and would charge publishers for their own work.
+        const ownsListing = await canActAsPublisher(firestore, decoded.uid, listing.profileId);
+        // Private listings install ONLY for the owning org (AGL-2290).
+        //
+        // `install-plugin.ts` has carried this since AGL-968; the other six never
+        // did, so a private component, theme, template, layout, email template or
+        // dataset schema was installable by anyone who knew its listing id. Browse
+        // hides them and the detail page 404s, but neither is a control — the
+        // route is.
+        if (isPrivateListing(listing) && !ownsListing) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // A FULLY refunded purchase no longer entitles (AGL-1546). The gate this
+        // route once inlined is now shared (AGL-1699): it was the only one of
+        // eight paid-content paths that had learned the refund rule.
+        const unpaid = await requirePurchase({
+            firestore,
+            buyerUid: decoded.uid,
+            // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is
+            // resolved server-side from the caller's own membership by the
+            // permission gate above — never a request-body field — so this is the
+            // workspace the install actually lands in, and the only one a purchase
+            // can entitle here.
+            buyerOrgId: (_membership_orgId = membership.orgId) != null ? _membership_orgId : '',
+            listingId,
+            priceUsd,
+            ownsListing
+        });
+        if (unpaid) return res.status(402).json(unpaid);
+        const versionSnapshot = await listingRef.collection('versions').doc(String(listing.latestVersion)).get();
+        const version = versionSnapshot.data();
+        if (!(version == null ? void 0 : version.nodes) || !(version == null ? void 0 : version.rootId)) {
+            return res.status(500).json({
+                error: 'Listing version missing'
+            });
+        }
+        // The properties the tree binds to (AGL-2933), held to the sanitizer again
+        // on the way in. `undefined` for a version published before they were
+        // carried, which leaves a re-installed copy's own properties in place.
+        const props = readPublishedProps(version.props);
+        const componentsRef = hostRef.collection('components');
+        const existing = await componentsRef.where('marketplace.listingId', '==', listingId).limit(1).get();
+        const componentRef = existing.empty ? componentsRef.doc(createResourceUid()) : existing.docs[0].ref;
+        // Re-installing over a copy the workspace has EDITED is the silent
+        // destructive overwrite AGL-1018 exists to stop. The install still happens
+        // when it is asked for explicitly (`mode: 'replace'`, which the update
+        // dialog sends after showing what goes), but it is never the default.
+        if (!existing.empty) {
+            var _req_body2;
+            const diverged = await hasDivergedFromBase({
+                firestore,
+                sha256: existing.docs[0].get('installedFrom.sha256'),
+                current: {
+                    rootId: existing.docs[0].get('rootId'),
+                    // DECODED, because the comparison is by value: the base snapshot
+                    // recorded at install is a node map and `hasDivergedFromBase`
+                    // hashes a stable stringification of both sides. A stored `Bytes`
+                    // matches no map, so an untouched copy would read as edited and
+                    // every re-install would 409 (AGL-1151).
+                    nodes: decodeStoredNodes(existing.docs[0].get('nodes'))
+                }
+            });
+            if (diverged && ((_req_body2 = req.body) == null ? void 0 : _req_body2.mode) !== 'replace') {
+                return res.status(409).json({
+                    error: 'Your copy of this component has been edited since it was ' + 'installed. Review the update to see what would change.',
+                    diverged: true
+                });
+            }
+        }
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        // Provenance + base snapshot (AGL-1015). The snapshot holds only the
+        // vendored tree — the display name and description come from the listing
+        // and the user may rename their copy, so including them would make every
+        // rename read as a diverged component.
+        const provenance = await recordInstallProvenance({
+            firestore,
+            listingId,
+            listing,
+            version: listing.latestVersion,
+            artifactType: 'component',
+            content: {
+                rootId: version.rootId,
+                nodes: version.nodes
+            }
+        });
+        await componentRef.set(_extends({
+            displayName: listing.displayName
+        }, listing.description && {
+            description: listing.description
+        }, {
+            rootId: version.rootId,
+            // Compressed at rest, matching what a promote writes onto this same
+            // document (AGL-1151). The provenance base above keeps the decoded
+            // map: it is compared by value, never rendered.
+            nodes: Buffer.from(encodeStoredNodes((_version_nodes = version.nodes) != null ? _version_nodes : {}))
+        }, props && {
+            props
+        }, {
+            deletedAt: null,
+            marketplace: {
+                listingId,
+                profileId: listing.profileId,
+                version: listing.latestVersion
+            },
+            installedFrom: provenance.installedFrom
+        }, existing.empty && {
+            createdAt: now
+        }, {
+            updatedAt: now
+        }), {
+            merge: true
+        });
+        // Per-version tally (AGL-1036): a re-install moves this copy off whatever
+        // version it was on and onto the latest.
+        await recordVersionMove({
+            firestore,
+            listingRef,
+            artifactType: 'component',
+            from: existing.empty ? null : (_existing_docs__get = existing.docs[0].get('installedFrom.version')) != null ? _existing_docs__get : existing.docs[0].get('marketplace.version'),
+            to: listing.latestVersion
+        });
+        // First installs count toward the browse "Most installed" sort
+        // (AGL-95); updates don't inflate it.
+        if (existing.empty) {
+            await listingRef.update({
+                installCount: firebaseAdmin.firestore.FieldValue.increment(1)
+            }).catch(()=>undefined);
+        }
+        return res.status(200).json({
+            installed: true,
+            updated: !existing.empty,
+            version: listing.latestVersion,
+            baseStored: provenance.baseStored
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Install failed'
+        });
+    }
+};
+
+//# sourceMappingURL=install.js.map

package/src/lib/server/install.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/install.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  createResourceUid,\n  decodeStoredNodes,\n  encodeStoredNodes,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { isPrivateListing } from '../model/marketplace'\nimport { readPublishedProps } from '../model/marketplace-props'\nimport { canActAsPublisher } from './publisher-profile'\nimport { hasDivergedFromBase, recordInstallProvenance } from './provenance'\nimport { requirePurchase } from './purchase-entitlement'\nimport { recordVersionMove } from './version-stats'\n\n/**\n * Installs (or updates) a marketplace listing into a host (AGL-44/46).\n * Server-side because version snapshots are not client-readable — paid\n * content would otherwise be free to anyone who read the subcollection.\n * Access: the listing is free, the caller bought it (webhook-written\n * purchase record), or the caller published it. Installing copies the\n * latest version into `hosts/{hostId}/components` with `marketplace` source\n * metadata; re-installing updates the same component doc in place.\n */\nexport const installHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const listingId = String(req.body?.listingId ?? '')\n  const hostId = String(req.body?.hostId ?? '')\n  if (!listingId || !hostId) {\n    return res.status(400).json({ error: 'Missing listingId or hostId' })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    // Org-role permission gate (AGL-238).\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.installPlugins) {\n      return res.status(403).json({\n        error: 'Your organization role does not allow installing from the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n\n    // The SAME gate the console's own create path applies to this exact\n    // document (AGL-2072). `/api/hosts/resources` declares\n    // `reusableComponent: { collection: 'components', entitlement:\n    // 'reusableComponents' }` and says why: a reusable component renders on\n    // the LIVE SITE, so the Starter+ gate has to be server-enforced rather\n    // than merely hidden in the console (AGL-473). This route writes a\n    // byte-for-byte equivalent doc into `hosts/{hostId}/components` and asked\n    // nothing — so a free org installed from the marketplace and got the\n    // working feature its own console would have refused.\n    //\n    // The assumption that hid it is written down at\n    // `apps/console/app/api/hosts/import/route.ts:329-331`:\n    // \"`reusableComponents` is a BOOLEAN entitlement, true on every plan that\n    // can reach here\". True of import, which is Pro+. False here — any plan\n    // reaches the marketplace, and free listings cost nothing to install.\n    //\n    // Ahead of `requirePurchase`, deliberately, and matching\n    // `install-dataset-schema.ts:89`: refusing on plan AFTER taking someone's\n    // money for the listing would be the worse order. The whole org doc is\n    // read (`getOrgDoc` projects nothing), so `resolveEffectivePlan` sees the\n    // subscription status and a LAPSED org is refused exactly as a free one\n    // is — the gate is re-asked per install, never inherited from whatever\n    // plan was in force when an earlier copy was installed.\n    const org = (await getOrgForHost(hostId))?.org\n    if (!checkEntitlement(org as any, 'reusableComponents')) {\n      return res.status(403).json({\n        error: 'Reusable components require a Starter plan or higher',\n      })\n    }\n\n    const listingRef = firestore\n      .collection('marketplaceListings')\n      .doc(listingId)\n    const listingSnapshot = await listingRef.get()\n    const listing = listingSnapshot.data() as any\n    if (\n      !listing ||\n      listing.deletedAt ||\n      // Staff takedown blocks new installs on EVERY artifact type\n      // (AGL-2290). AGL-948 extended takedown past plugins in the browse\n      // predicate and in `resolveMarketplacePluginVersion`, but the gate that\n      // decides whether content is HANDED OVER was only ever added to\n      // `install-plugin.ts`. So a component, theme, template, layout, email\n      // template or dataset schema that staff had taken down stayed\n      // installable by anyone holding its listing id — which makes takedown a\n      // suggestion for six of the seven artifact types.\n      //\n      // No owner exemption, matching `install-plugin.ts`: a takedown is a\n      // moderation decision about the artifact, not about who is asking.\n      listing.hiddenAt\n    ) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n\n    const priceUsd = Number(listing.priceUsd ?? 0)\n    // The publisher installs their own listing for free. Org-owned now\n    // (AGL-652), so this is a role check — comparing a uid to an org id\n    // would never match and would charge publishers for their own work.\n    const ownsListing = await canActAsPublisher(\n      firestore,\n      decoded.uid,\n      listing.profileId,\n    )\n    // Private listings install ONLY for the owning org (AGL-2290).\n    //\n    // `install-plugin.ts` has carried this since AGL-968; the other six never\n    // did, so a private component, theme, template, layout, email template or\n    // dataset schema was installable by anyone who knew its listing id. Browse\n    // hides them and the detail page 404s, but neither is a control — the\n    // route is.\n    if (isPrivateListing(listing) && !ownsListing) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // A FULLY refunded purchase no longer entitles (AGL-1546). The gate this\n    // route once inlined is now shared (AGL-1699): it was the only one of\n    // eight paid-content paths that had learned the refund rule.\n    const unpaid = await requirePurchase({\n      firestore,\n      buyerUid: decoded.uid,\n      // THE ORG THE LICENCE HAS TO COVER (AGL-2331). `membership.orgId` is\n      // resolved server-side from the caller's own membership by the\n      // permission gate above — never a request-body field — so this is the\n      // workspace the install actually lands in, and the only one a purchase\n      // can entitle here.\n      buyerOrgId: membership.orgId ?? '',\n      listingId,\n      priceUsd,\n      ownsListing,\n    })\n    if (unpaid) return res.status(402).json(unpaid)\n\n    const versionSnapshot = await listingRef\n      .collection('versions')\n      .doc(String(listing.latestVersion))\n      .get()\n    const version = versionSnapshot.data() as any\n    if (!version?.nodes || !version?.rootId) {\n      return res.status(500).json({ error: 'Listing version missing' })\n    }\n\n    // The properties the tree binds to (AGL-2933), held to the sanitizer again\n    // on the way in. `undefined` for a version published before they were\n    // carried, which leaves a re-installed copy's own properties in place.\n    const props = readPublishedProps(version.props)\n\n    const componentsRef = hostRef.collection('components')\n    const existing = await componentsRef\n      .where('marketplace.listingId', '==', listingId)\n      .limit(1)\n      .get()\n    const componentRef = existing.empty\n      ? componentsRef.doc(createResourceUid())\n      : existing.docs[0].ref\n    // Re-installing over a copy the workspace has EDITED is the silent\n    // destructive overwrite AGL-1018 exists to stop. The install still happens\n    // when it is asked for explicitly (`mode: 'replace'`, which the update\n    // dialog sends after showing what goes), but it is never the default.\n    if (!existing.empty) {\n      const diverged = await hasDivergedFromBase({\n        firestore,\n        sha256: existing.docs[0].get('installedFrom.sha256'),\n        current: {\n          rootId: existing.docs[0].get('rootId'),\n          // DECODED, because the comparison is by value: the base snapshot\n          // recorded at install is a node map and `hasDivergedFromBase`\n          // hashes a stable stringification of both sides. A stored `Bytes`\n          // matches no map, so an untouched copy would read as edited and\n          // every re-install would 409 (AGL-1151).\n          nodes: decodeStoredNodes(existing.docs[0].get('nodes')),\n        },\n      })\n      if (diverged && req.body?.mode !== 'replace') {\n        return res.status(409).json({\n          error:\n            'Your copy of this component has been edited since it was ' +\n            'installed. Review the update to see what would change.',\n          diverged: true,\n        })\n      }\n    }\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n    // Provenance + base snapshot (AGL-1015). The snapshot holds only the\n    // vendored tree — the display name and description come from the listing\n    // and the user may rename their copy, so including them would make every\n    // rename read as a diverged component.\n    const provenance = await recordInstallProvenance({\n      firestore,\n      listingId,\n      listing,\n      version: listing.latestVersion,\n      artifactType: 'component',\n      content: { rootId: version.rootId, nodes: version.nodes },\n    })\n    await componentRef.set(\n      {\n        displayName: listing.displayName,\n        ...(listing.description && { description: listing.description }),\n        rootId: version.rootId,\n        // Compressed at rest, matching what a promote writes onto this same\n        // document (AGL-1151). The provenance base above keeps the decoded\n        // map: it is compared by value, never rendered.\n        nodes: Buffer.from(encodeStoredNodes(version.nodes ?? {})!),\n        // Beside the tree, as a publish writes them onto this document. The\n        // first version the console mints for this component copies them\n        // from here (AGL-2932).\n        ...(props && { props }),\n        deletedAt: null,\n        marketplace: {\n          listingId,\n          profileId: listing.profileId,\n          version: listing.latestVersion,\n        },\n        installedFrom: provenance.installedFrom,\n        ...(existing.empty && { createdAt: now }),\n        updatedAt: now,\n      },\n      { merge: true },\n    )\n    // Per-version tally (AGL-1036): a re-install moves this copy off whatever\n    // version it was on and onto the latest.\n    await recordVersionMove({\n      firestore,\n      listingRef,\n      artifactType: 'component',\n      from: existing.empty\n        ? null\n        : (existing.docs[0].get('installedFrom.version') ??\n          existing.docs[0].get('marketplace.version')),\n      to: listing.latestVersion,\n    })\n    // First installs count toward the browse \"Most installed\" sort\n    // (AGL-95); updates don't inflate it.\n    if (existing.empty) {\n      await listingRef\n        .update({\n          installCount: firebaseAdmin.firestore.FieldValue.increment(1),\n        })\n        .catch(() => undefined)\n    }\n    return res.status(200).json({\n      installed: true,\n      updated: !existing.empty,\n      version: listing.latestVersion,\n      baseStored: provenance.baseStored,\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Install failed' })\n  }\n}\n"],"names":["checkEntitlement","createResourceUid","decodeStoredNodes","encodeStoredNodes","firebaseAdmin","getOrgForHost","resolveOrgPermissions","isPrivateListing","readPublishedProps","canActAsPublisher","hasDivergedFromBase","recordInstallProvenance","requirePurchase","recordVersionMove","installHandler","req","res","method","status","json","error","listingId","String","body","hostId","authorization","headers","idToken","startsWith","slice","length","undefined","hostSnapshot","listing","membership","version","existing","decoded","app","auth","verifyIdToken","uid","permissions","installPlugins","firestore","hostRef","collection","doc","get","exists","memberRole","org","listingRef","listingSnapshot","data","deletedAt","hiddenAt","priceUsd","Number","ownsListing","profileId","unpaid","buyerUid","buyerOrgId","orgId","versionSnapshot","latestVersion","nodes","rootId","props","componentsRef","where","limit","componentRef","empty","docs","ref","diverged","sha256","current","mode","now","FieldValue","serverTimestamp","provenance","artifactType","content","set","displayName","description","Buffer","from","marketplace","installedFrom","createdAt","updatedAt","merge","to","update","installCount","increment","catch","installed","updated","baseStored","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,QACZ,sBAAqB;AAC5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AAEvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,gBAAgB,QAAQ,0BAAsB;AACvD,SAASC,kBAAkB,QAAQ,gCAA4B;AAC/D,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,mBAAmB,EAAEC,uBAAuB,QAAQ,kBAAc;AAC3E,SAASC,eAAe,QAAQ,4BAAwB;AACxD,SAASC,iBAAiB,QAAQ,qBAAiB;AAEnD;;;;;;;;CAQC,GACD,OAAO,MAAMC,iBAAmC,OAAOC,KAAKC;qBAS7BD;QALJA,WACHA;IAJtB,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,YAAYC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,SAAS,mBAAI;IAChD,MAAMG,SAASF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,MAAM,oBAAI;IAC1C,IAAI,CAACH,aAAa,CAACG,QAAQ;QACzB,OAAOR,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;IACrE;IACA,MAAMK,gBAAgBH,QAAOP,6BAAAA,IAAIW,OAAO,CAACD,aAAa,YAAzBV,6BAA6B;IAC1D,MAAMY,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOX,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAgBkBY,mBA2DIC,mBA8BVC,mBA6E2BC,gBAyBlCC;YAnKM;QA3Cb,MAAMC,UAAU,MAAMjC,cAAckC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACb;QAC/D,sCAAsC;QACtC,MAAMO,aAAa,MAAM5B,sBAAsB+B,QAAQI,GAAG,EAAE;YAAEjB;QAAO;QACrE,IAAI,CAACU,WAAWQ,WAAW,CAACC,cAAc,EAAE;YAC1C,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,MAAMwB,YAAYxC,cAAckC,GAAG,GAAGM,SAAS;QAE/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACvB;QAClD,MAAMQ,eAAe,MAAMa,QAAQG,GAAG;QACtC,IAAI,CAAChB,aAAaiB,MAAM,EAAE;YACxB,OAAOjC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAM8B,aAAa,EAAClB,oBAAAA,aAAagB,GAAG,CAAC,0BAAjBhB,oBAAmC,CAAC,EAAE,CAACK,QAAQI,GAAG,CAAC;QACvE,IAAIS,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAOlC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QAEA,oEAAoE;QACpE,uDAAuD;QACvD,+DAA+D;QAC/D,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,0EAA0E;QAC1E,qEAAqE;QACrE,sDAAsD;QACtD,EAAE;QACF,gDAAgD;QAChD,wDAAwD;QACxD,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,EAAE;QACF,yDAAyD;QACzD,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM+B,OAAO,QAAA,MAAM9C,cAAcmB,4BAArB,AAAC,MAA8B2B,GAAG;QAC9C,IAAI,CAACnD,iBAAiBmD,KAAY,uBAAuB;YACvD,OAAOnC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QAEA,MAAMgC,aAAaR,UAChBE,UAAU,CAAC,uBACXC,GAAG,CAAC1B;QACP,MAAMgC,kBAAkB,MAAMD,WAAWJ,GAAG;QAC5C,MAAMf,UAAUoB,gBAAgBC,IAAI;QACpC,IACE,CAACrB,WACDA,QAAQsB,SAAS,IACjB,4DAA4D;QAC5D,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,sEAAsE;QACtE,8DAA8D;QAC9D,wEAAwE;QACxE,kDAAkD;QAClD,EAAE;QACF,oEAAoE;QACpE,mEAAmE;QACnEtB,QAAQuB,QAAQ,EAChB;YACA,OAAOxC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QAEA,MAAMqC,WAAWC,QAAOzB,oBAAAA,QAAQwB,QAAQ,YAAhBxB,oBAAoB;QAC5C,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM0B,cAAc,MAAMlD,kBACxBmC,WACAP,QAAQI,GAAG,EACXR,QAAQ2B,SAAS;QAEnB,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,YAAY;QACZ,IAAIrD,iBAAiB0B,YAAY,CAAC0B,aAAa;YAC7C,OAAO3C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,yEAAyE;QACzE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAMyC,SAAS,MAAMjD,gBAAgB;YACnCgC;YACAkB,UAAUzB,QAAQI,GAAG;YACrB,qEAAqE;YACrE,+DAA+D;YAC/D,sEAAsE;YACtE,uEAAuE;YACvE,oBAAoB;YACpBsB,UAAU,GAAE7B,oBAAAA,WAAW8B,KAAK,YAAhB9B,oBAAoB;YAChCb;YACAoC;YACAE;QACF;QACA,IAAIE,QAAQ,OAAO7C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC0C;QAExC,MAAMI,kBAAkB,MAAMb,WAC3BN,UAAU,CAAC,YACXC,GAAG,CAACzB,OAAOW,QAAQiC,aAAa,GAChClB,GAAG;QACN,MAAMb,UAAU8B,gBAAgBX,IAAI;QACpC,IAAI,EAACnB,2BAAAA,QAASgC,KAAK,KAAI,EAAChC,2BAAAA,QAASiC,MAAM,GAAE;YACvC,OAAOpD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA0B;QACjE;QAEA,2EAA2E;QAC3E,sEAAsE;QACtE,uEAAuE;QACvE,MAAMiD,QAAQ7D,mBAAmB2B,QAAQkC,KAAK;QAE9C,MAAMC,gBAAgBzB,QAAQC,UAAU,CAAC;QACzC,MAAMV,WAAW,MAAMkC,cACpBC,KAAK,CAAC,yBAAyB,MAAMlD,WACrCmD,KAAK,CAAC,GACNxB,GAAG;QACN,MAAMyB,eAAerC,SAASsC,KAAK,GAC/BJ,cAAcvB,GAAG,CAAC9C,uBAClBmC,SAASuC,IAAI,CAAC,EAAE,CAACC,GAAG;QACxB,mEAAmE;QACnE,2EAA2E;QAC3E,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,CAACxC,SAASsC,KAAK,EAAE;gBAcH3D;YAbhB,MAAM8D,WAAW,MAAMnE,oBAAoB;gBACzCkC;gBACAkC,QAAQ1C,SAASuC,IAAI,CAAC,EAAE,CAAC3B,GAAG,CAAC;gBAC7B+B,SAAS;oBACPX,QAAQhC,SAASuC,IAAI,CAAC,EAAE,CAAC3B,GAAG,CAAC;oBAC7B,iEAAiE;oBACjE,8DAA8D;oBAC9D,kEAAkE;oBAClE,gEAAgE;oBAChE,yCAAyC;oBACzCmB,OAAOjE,kBAAkBkC,SAASuC,IAAI,CAAC,EAAE,CAAC3B,GAAG,CAAC;gBAChD;YACF;YACA,IAAI6B,YAAY9D,EAAAA,aAAAA,IAAIQ,IAAI,qBAARR,WAAUiE,IAAI,MAAK,WAAW;gBAC5C,OAAOhE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OACE,8DACA;oBACFyD,UAAU;gBACZ;YACF;QACF;QACA,MAAMI,MAAM7E,cAAcwC,SAAS,CAACsC,UAAU,CAACC,eAAe;QAC9D,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,uCAAuC;QACvC,MAAMC,aAAa,MAAMzE,wBAAwB;YAC/CiC;YACAvB;YACAY;YACAE,SAASF,QAAQiC,aAAa;YAC9BmB,cAAc;YACdC,SAAS;gBAAElB,QAAQjC,QAAQiC,MAAM;gBAAED,OAAOhC,QAAQgC,KAAK;YAAC;QAC1D;QACA,MAAMM,aAAac,GAAG,CACpB;YACEC,aAAavD,QAAQuD,WAAW;WAC5BvD,QAAQwD,WAAW,IAAI;YAAEA,aAAaxD,QAAQwD,WAAW;QAAC;YAC9DrB,QAAQjC,QAAQiC,MAAM;YACtB,oEAAoE;YACpE,mEAAmE;YACnE,gDAAgD;YAChDD,OAAOuB,OAAOC,IAAI,CAACxF,mBAAkBgC,iBAAAA,QAAQgC,KAAK,YAAbhC,iBAAiB,CAAC;WAInDkC,SAAS;YAAEA;QAAM;YACrBd,WAAW;YACXqC,aAAa;gBACXvE;gBACAuC,WAAW3B,QAAQ2B,SAAS;gBAC5BzB,SAASF,QAAQiC,aAAa;YAChC;YACA2B,eAAeT,WAAWS,aAAa;WACnCzD,SAASsC,KAAK,IAAI;YAAEoB,WAAWb;QAAI;YACvCc,WAAWd;YAEb;YAAEe,OAAO;QAAK;QAEhB,0EAA0E;QAC1E,yCAAyC;QACzC,MAAMnF,kBAAkB;YACtB+B;YACAQ;YACAiC,cAAc;YACdM,MAAMvD,SAASsC,KAAK,GAChB,QACCtC,sBAAAA,SAASuC,IAAI,CAAC,EAAE,CAAC3B,GAAG,CAAC,oCAArBZ,sBACDA,SAASuC,IAAI,CAAC,EAAE,CAAC3B,GAAG,CAAC;YACzBiD,IAAIhE,QAAQiC,aAAa;QAC3B;QACA,+DAA+D;QAC/D,sCAAsC;QACtC,IAAI9B,SAASsC,KAAK,EAAE;YAClB,MAAMtB,WACH8C,MAAM,CAAC;gBACNC,cAAc/F,cAAcwC,SAAS,CAACsC,UAAU,CAACkB,SAAS,CAAC;YAC7D,GACCC,KAAK,CAAC,IAAMtE;QACjB;QACA,OAAOf,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BmF,WAAW;YACXC,SAAS,CAACnE,SAASsC,KAAK;YACxBvC,SAASF,QAAQiC,aAAa;YAC9BsC,YAAYpB,WAAWoB,UAAU;QACnC;IACF,EAAE,OAAOpF,OAAO;QACdqF,QAAQrF,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC"}

package/src/lib/server/listing-versions.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Public version history for a plugin listing (AGL-431). The
+ * `pluginVersions` docs are server-only (they carry publish internals),
+ * but their changelog/trust/compat fields are exactly what a buyer needs
+ * on the detail page — so this handler exposes THAT subset and nothing
+ * else (no objectPath, no signature; sha stays out simply because the
+ * client has no use for it).
+ */
+export declare const listingVersionsHandler: PluginApiHandler;