@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/listing-versions.js

@@ -0,0 +1,378 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isPluginRevoked, newestInstallableVersion } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { isVersionApproved, listingArtifactType } from "../model/marketplace.js";
+import { compareArtifactVersions } from "@aglyn/aglyn/server";
+import { reconcileInstallTallies, versionCollectionFor } from "./version-stats.js";
+import { verifiedLivePins } from "./install-pin-counts.js";
+import { canActAsPublisher } from "./publisher-profile.js";
+import { attestationsForBytes } from "@aglyn/aglyn/app-utils/publisher-attestation";
+/**
+ * One reconciled tally per version id, plus the totals (AGL-1418).
+ *
+ * Built from EVERY version document, never from a filtered subset: the buyer
+ * branch shows approved versions only, and reconciling against that subset
+ * would hand a pending version's installs to an approved one.
+ */ function reconcileFromSnapshot(docs, listing, pins) {
+    var _ref, _ref1;
+    const reconciled = reconcileInstallTallies(docs.map((doc)=>{
+        var _doc_get, _doc_get1, _doc_get2;
+        return {
+            version: String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id),
+            installCount: Number((_doc_get1 = doc.get('installCount')) != null ? _doc_get1 : 0),
+            activeInstalls: Number((_doc_get2 = doc.get('activeInstalls')) != null ? _doc_get2 : 0)
+        };
+    }), {
+        installCount: Number((_ref = listing == null ? void 0 : listing['installCount']) != null ? _ref : 0),
+        activeInstalls: Number((_ref1 = listing == null ? void 0 : listing['activeInstalls']) != null ? _ref1 : 0)
+    }, pins);
+    const byVersion = new Map();
+    reconciled.versions.forEach((entry)=>byVersion.set(entry.version, {
+            installCount: entry.installCount,
+            activeInstalls: entry.activeInstalls
+        }));
+    return _extends({}, reconciled, {
+        byVersion
+    });
+}
+/**
+ * The publisher's own view of their versions (AGL-1079).
+ *
+ * AGL-966 made review per-version and got the mechanics right — a new
+ * version enters `pending`, the previously approved one keeps installing,
+ * nothing ships past a reviewer. The publisher was told none of it: an
+ * email on the outcome, and in between a listing row identical to the one
+ * they had before they published.
+ *
+ * Separate from the buyer projection above on purpose. `reviewState`, the
+ * rejection reason, the sha and what was attested are the publisher's own
+ * business and nobody else's — a buyer has no need to read why a version
+ * they will never be offered was sent back. So this branch demands a token
+ * and org membership rather than widening what the public route returns.
+ */ const publisherVersions = async (req, res)=>{
+    var _ref, _req_headers_authorization, _listing_latestApprovedVersion, _listing_latestVersion, _listing_reviewStatus, _ref1;
+    var _req_query;
+    const listingId = String((_ref = (_req_query = req.query) == null ? void 0 : _req_query.listingId) != null ? _ref : '');
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    const firestore = firebaseAdmin.app().firestore();
+    const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+    const listingSnapshot = await listingRef.get();
+    const listing = listingSnapshot.data();
+    if (!listing || listing.deletedAt) {
+        return res.status(404).json({
+            error: 'Unknown listing'
+        });
+    }
+    // Listings are org-owned (AGL-652), so this is an org-membership question,
+    // not a uid comparison — the same gate the publish and edit paths use.
+    const isPublisher = await canActAsPublisher(firestore, decoded.uid, listing.profileId);
+    if (!isPublisher && decoded['staff'] !== true) {
+        // 404, not 403: whether a listing exists is not a stranger's business.
+        return res.status(404).json({
+            error: 'Unknown listing'
+        });
+    }
+    const artifactType = listingArtifactType(listing);
+    const snapshot = await listingRef.collection(versionCollectionFor(artifactType)).orderBy('publishedAt', 'desc').limit(20).get();
+    /**
+   * The kill switch, on the publisher's own view of their versions
+   * (AGL-2328).
+   *
+   * Staff are REQUIRED to type a reason to revoke a version. It was stored
+   * and nothing read it: every reader in the repo consulted `versions` and
+   * stopped, and this branch did not read the document at all — so a
+   * publisher whose version had been pulled saw the row it had before,
+   * still labelled by its REVIEW state. A version can be approved and
+   * revoked at once, and "Approved" was the only word on it.
+   *
+   * ONE document read for the whole card, not one per version: the switch
+   * is listing-scoped. The predicate is `isPluginRevoked`, shared with the
+   * installer and the loaders (AGL-1085), so what a publisher is told is
+   * disabled and what actually refuses to install cannot drift apart.
+   */ const revocation = (await firestore.collection('revocations').doc(listingId).get()).data();
+    // The counters the page prints, derived from the pins where there are pins
+    // to derive from (AGL-1419) and reconciled against the listing totals
+    // otherwise (AGL-1418), so this card cannot contradict the header above it.
+    const pins = await verifiedLivePins({
+        firestore: firestore,
+        listingRef: listingRef,
+        listingId,
+        listing,
+        artifactType,
+        versionIds: snapshot.docs.map((doc)=>{
+            var _doc_get;
+            return String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id);
+        }),
+        updateTime: listingSnapshot.updateTime
+    });
+    const tallies = reconcileFromSnapshot(snapshot.docs, listing, pins);
+    const versions = snapshot.docs.map((doc)=>{
+        var _doc_get, _doc_get1, _doc_get2, _ref, _doc_get3, _doc_get4, _doc_get5, _ref1, _ref2;
+        var _doc_get_toMillis, _doc_get6, _tallies_byVersion_get, _tallies_byVersion_get1;
+        const sha256 = String((_doc_get = doc.get('sha256')) != null ? _doc_get : '');
+        const versionId = String((_doc_get1 = doc.get('version')) != null ? _doc_get1 : doc.id);
+        return {
+            version: String((_doc_get2 = doc.get('version')) != null ? _doc_get2 : doc.id),
+            publishedAtMs: (_ref = (_doc_get6 = doc.get('publishedAt')) == null ? void 0 : (_doc_get_toMillis = _doc_get6.toMillis) == null ? void 0 : _doc_get_toMillis.call(_doc_get6)) != null ? _ref : null,
+            sha256,
+            // Absent on every version published before AGL-966, which is what
+            // `grandfathered` marks — those were never reviewed and saying
+            // "pending" about them would be a lie in both directions.
+            reviewState: String((_doc_get3 = doc.get('reviewState')) != null ? _doc_get3 : ''),
+            grandfathered: Boolean(doc.get('grandfathered')),
+            signed: Boolean(doc.get('signature')),
+            changelog: String((_doc_get4 = doc.get('changelog')) != null ? _doc_get4 : ''),
+            // Only reached an email before this (AGL-1079), where it got buried
+            // under everything else in an inbox.
+            rejectionReason: String((_doc_get5 = doc.get('reviewRejectionReason')) != null ? _doc_get5 : ''),
+            // Per VERSION, because a listing-wide takedown and a single revoked
+            // version are the same document and only the predicate tells them
+            // apart.
+            revoked: isPluginRevoked(revocation, versionId),
+            activeInstalls: (_ref1 = (_tallies_byVersion_get = tallies.byVersion.get(versionId)) == null ? void 0 : _tallies_byVersion_get.activeInstalls) != null ? _ref1 : 0,
+            installCount: (_ref2 = (_tallies_byVersion_get1 = tallies.byVersion.get(versionId)) == null ? void 0 : _tallies_byVersion_get1.installCount) != null ? _ref2 : 0,
+            // What they claimed about THESE bytes (AGL-969) — so they can see it
+            // before they claim it again on the next version.
+            attestation: attestationsForBytes(doc.get('publisherAttestation'), sha256)
+        };
+    });
+    return res.status(200).json({
+        versions,
+        // The same reconciled totals the buyer branch returns (AGL-1418), so the
+        // Review status card and the listing header cannot disagree about how
+        // many installs there are.
+        installCount: tallies.installCount,
+        activeInstalls: tallies.activeInstalls,
+        untrackedInstallCount: tallies.untrackedInstallCount,
+        untrackedActiveInstalls: tallies.untrackedActiveInstalls,
+        // The version installs actually resolve to (AGL-1016/966). Deliberately
+        // NOT `latestVersion`, which names a version installs may refuse.
+        latestApprovedVersion: String((_listing_latestApprovedVersion = listing.latestApprovedVersion) != null ? _listing_latestApprovedVersion : ''),
+        latestVersion: String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : ''),
+        reviewStatus: String((_listing_reviewStatus = listing.reviewStatus) != null ? _listing_reviewStatus : ''),
+        /**
+     * Listing-scoped, like the document it comes from (AGL-2328) — one
+     * reason covers whatever `versions` names, so two revoked rows show the
+     * same sentence. That is what was recorded; inventing a per-version
+     * reason would be inventing a fact.
+     *
+     * `revokedBy` is deliberately NOT returned. It is a staff uid, and it
+     * belongs in the audit log rather than on a publisher's screen — the
+     * same line the consumer-facing card drew.
+     */ revocationReason: String((_ref1 = revocation == null ? void 0 : revocation.reason) != null ? _ref1 : '').trim(),
+        // The writers store `revokedAt` as a server timestamp; `atMs` is on the
+        // TYPE but nothing writes it. Read both rather than trusting either,
+        // and treat a revocation with no readable date as dateless rather than
+        // printing an epoch.
+        revokedAtMs: revocationTimeMs(revocation)
+    });
+};
+/**
+ * When the revocation was written, in millis, or null (AGL-2328).
+ *
+ * `PluginRevocation` declares `atMs?: number` and every writer in
+ * `plugin-reviews/route.ts` writes `revokedAt: serverTimestamp()` instead.
+ * A reader that trusted the type would print nothing for every revocation
+ * that exists; one that trusted the writer would break if `atMs` is ever
+ * the field that gets written. Both are read, admin `Timestamp` and the
+ * seconds-shaped form a client SDK produces included.
+ */ function revocationTimeMs(revocation) {
+    const at = revocation == null ? void 0 : revocation.revokedAt;
+    if (typeof (at == null ? void 0 : at.toMillis) === 'function') return at.toMillis();
+    if (typeof (at == null ? void 0 : at.seconds) === 'number') return at.seconds * 1000;
+    return typeof (revocation == null ? void 0 : revocation.atMs) === 'number' ? revocation.atMs : null;
+}
+/**
+ * Public version history for a plugin listing (AGL-431). The
+ * `pluginVersions` docs are server-only (they carry publish internals),
+ * but their changelog/trust/compat fields are exactly what a buyer needs
+ * on the detail page — so this handler exposes THAT subset and nothing
+ * else (no objectPath, no signature; sha stays out simply because the
+ * client has no use for it).
+ */ export const listingVersionsHandler = async (req, res)=>{
+    var _ref;
+    var _req_query;
+    if (req.method !== 'GET') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const listingId = String((_ref = (_req_query = req.query) == null ? void 0 : _req_query.listingId) != null ? _ref : '');
+    if (!listingId) return res.status(400).json({
+        error: 'Missing listingId'
+    });
+    try {
+        var _ref1, _listingSnapshot_data;
+        var _req_query1;
+        // The publisher's own view (AGL-1079) — same collection, a different
+        // question, and one that needs a token.
+        if (String((_ref1 = (_req_query1 = req.query) == null ? void 0 : _req_query1.scope) != null ? _ref1 : '') === 'publisher') {
+            return await publisherVersions(req, res);
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        // Every artifact type has a version history now (AGL-1036), not just
+        // plugins: the per-version install counts are worth the same to whoever
+        // publishes a component as to whoever publishes a plugin. The collection
+        // differs — plugins keep publish internals in `pluginVersions`, everything
+        // else keeps content snapshots in `versions` — so the type decides which
+        // to read, and the buyer-safe projection below stays the same either way.
+        const listingSnapshot = await listingRef.get();
+        const artifactType = listingArtifactType((_listingSnapshot_data = listingSnapshot.data()) != null ? _listingSnapshot_data : {});
+        const isPlugin = artifactType === 'plugin';
+        const snapshot = await listingRef.collection(versionCollectionFor(artifactType)).orderBy('publishedAt', 'desc').limit(20).get();
+        // Buyers see APPROVED versions only (AGL-976).
+        //
+        // This handler returned every version, so the listing's Version history
+        // advertised pending and rejected ones — with `Latest` on whichever was
+        // newest. A version rejected for undeclared network access was shown to
+        // buyers, by us, as the current release, changelog and all. Installing it
+        // was already impossible (AGL-966 gates that), which made the card a
+        // promise the product would not keep.
+        //
+        // Plugins only: `reviewState` is a plugin concept, and a copied artifact's
+        // `versions` docs carry none — filtering those would empty every
+        // component and template history.
+        //
+        // Through `isVersionApproved`, whose contract is the one that matters
+        // here: ABSENT STATE IS NOT APPROVAL. That hides versions published
+        // before review existed, which is the safe direction — the alternative is
+        // showing unreviewed code as reviewed.
+        const visibleDocs = isPlugin ? snapshot.docs.filter((doc)=>isVersionApproved({
+                reviewState: doc.get('reviewState')
+            })) : snapshot.docs;
+        // Derived from the live pins (AGL-1419), which are the only ground truth
+        // and the only thing that can bring a count back DOWN — a tenant erase
+        // sweeps `installs` without decrementing anything. Falls back to the
+        // AGL-1418 reconciliation when there is nothing to derive from: a copied
+        // artifact holds no pin, and a missing index must degrade to the previous
+        // release rather than to zeros.
+        //
+        // Built from EVERY version doc rather than `visibleDocs`: the buyer filter
+        // above drops unapproved versions, and reconciling against what survives
+        // it would credit their installs to an approved version.
+        const pins = await verifiedLivePins({
+            firestore: firestore,
+            listingRef: listingRef,
+            listingId,
+            listing: listingSnapshot.data(),
+            artifactType,
+            versionIds: snapshot.docs.map((doc)=>{
+                var _doc_get;
+                return String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id);
+            }),
+            updateTime: listingSnapshot.updateTime
+        });
+        const tallies = reconcileFromSnapshot(snapshot.docs, listingSnapshot.data(), pins);
+        const versions = visibleDocs.map((doc)=>{
+            var _doc_get, _ref, _doc_get1, _ref1, _doc_get2, _ref2;
+            var _tallies_byVersion_get, _tallies_byVersion_get1, _doc_get3, _doc_get_capabilities, _doc_get4, _doc_get_toMillis, _doc_get5;
+            return _extends({
+                version: String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id),
+                // Per-version install counts (AGL-1036). `installCount` is every install
+                // that ever landed on this version; `activeInstalls` is how many are on
+                // it now — the one that answers "who is still on the old version".
+                installCount: (_ref = (_tallies_byVersion_get = tallies.byVersion.get(String((_doc_get1 = doc.get('version')) != null ? _doc_get1 : doc.id))) == null ? void 0 : _tallies_byVersion_get.installCount) != null ? _ref : 0,
+                activeInstalls: (_ref1 = (_tallies_byVersion_get1 = tallies.byVersion.get(String((_doc_get2 = doc.get('version')) != null ? _doc_get2 : doc.id))) == null ? void 0 : _tallies_byVersion_get1.activeInstalls) != null ? _ref1 : 0
+            }, doc.get('changelog') ? {
+                changelog: String(doc.get('changelog'))
+            } : {}, doc.get('trust') ? {
+                trust: String(doc.get('trust'))
+            } : {}, Number.isInteger((_doc_get3 = doc.get('manifest')) == null ? void 0 : _doc_get3.hostAbi) ? {
+                hostAbi: Number(doc.get('manifest').hostAbi)
+            } : {}, Array.isArray((_doc_get4 = doc.get('manifest')) == null ? void 0 : (_doc_get_capabilities = _doc_get4.capabilities) == null ? void 0 : _doc_get_capabilities.network) ? {
+                network: doc.get('manifest').capabilities.network.map((entry)=>String(entry)).filter((entry)=>/^https:\/\/[^\s/]+$/.test(entry)).slice(0, 20)
+            } : {}, {
+                publishedAtMs: (_ref2 = (_doc_get5 = doc.get('publishedAt')) == null ? void 0 : (_doc_get_toMillis = _doc_get5.toMillis) == null ? void 0 : _doc_get_toMillis.call(_doc_get5)) != null ? _ref2 : null
+            });
+        });
+        // Repair `latestApprovedVersion` when it disagrees with the versions
+        // (AGL-1016, corrected by AGL-2368).
+        //
+        // The field is written by the approval route, so every plugin approved
+        // before it existed carries none — and the console would report those as
+        // "no published version to compare against" forever, which is a worse lie
+        // than the one it replaced. The approved set is already in hand here and
+        // `pluginVersions` is server-only, so this is the one place that can
+        // repair it. Plugins only: `reviewState` and the approved-version
+        // guarantee are a plugin concept, and a copied artifact's `versions` docs
+        // carry neither.
+        //
+        // Two things were wrong with the original, and they compounded. It asked
+        // `newestApprovedVersion` — approval only, blind to the kill switch — and
+        // it "only ever moved the value forward". So it did not merely fail to
+        // step the mirror back off a revoked version; it actively WROTE ONE BACK.
+        // AGL-2306 taught the review route to repair the mirror on revoke, and the
+        // very next hit on this handler undid it: stored v1.0.0 (correct), newest
+        // approved v2.0.0 (revoked), v1.0.0 < v2.0.0, write. This endpoint is a
+        // public unauthenticated GET, so "the next hit" is the next page view.
+        //
+        // Now derived from the whole set through the SHARED predicate the review
+        // route repairs with, and applied whenever it differs — a derivation has
+        // no direction to preserve. The monotonic rule belongs to the APPROVAL
+        // writer, where it means "a reviewer working through a backlog must not
+        // walk the offer backwards"; here it only ever preserved a wrong answer.
+        const revocation = !isPlugin ? undefined : (await firestore.collection('revocations').doc(listingId).get()).data();
+        const newest = !isPlugin ? null : newestInstallableVersion(snapshot.docs.map((doc)=>{
+            var _doc_get;
+            return {
+                version: String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id),
+                reviewState: doc.get('reviewState')
+            };
+        }), revocation, compareArtifactVersions);
+        if (isPlugin) {
+            const stored = listingSnapshot.get('latestApprovedVersion');
+            const storedString = stored == null ? '' : String(stored);
+            if (storedString !== (newest != null ? newest : '')) {
+                await listingRef.set({
+                    // Deleted rather than emptied when nothing qualifies, matching
+                    // `repairLatestApprovedVersion`: an ABSENT mirror reads as "no
+                    // update to offer", an empty string is a value readers have to
+                    // interpret.
+                    latestApprovedVersion: newest != null ? newest : firebaseAdmin.firestore.FieldValue.delete()
+                }, {
+                    merge: true
+                }).catch(()=>undefined);
+            }
+        }
+        // The totals the header prints (AGL-1418). The listing document carries
+        // its own copy of this pair and the client used to read it straight off
+        // Firestore, which is how the header came to say `7 installs · 2 active`
+        // over a version history that added up to `3 · 1`. Served from here so
+        // one arithmetic answers the whole page.
+        return res.status(200).json({
+            versions,
+            installCount: tallies.installCount,
+            activeInstalls: tallies.activeInstalls,
+            untrackedInstallCount: tallies.untrackedInstallCount,
+            untrackedActiveInstalls: tallies.untrackedActiveInstalls
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Version lookup failed'
+        });
+    }
+};
+
+//# sourceMappingURL=listing-versions.js.map

package/src/lib/server/listing-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/listing-versions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isPluginRevoked,\n  newestInstallableVersion,\n  type PluginApiHandler,\n  type PluginRevocation,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  isVersionApproved,\n  listingArtifactType,\n} from '../model/marketplace'\nimport { compareArtifactVersions } from '@aglyn/aglyn/server'\nimport {\n  reconcileInstallTallies,\n  versionCollectionFor,\n  type LivePinTally,\n  type ReconciledInstallTallies,\n} from './version-stats'\nimport { verifiedLivePins } from './install-pin-counts'\nimport { canActAsPublisher } from './publisher-profile'\nimport { attestationsForBytes } from '@aglyn/aglyn/app-utils/publisher-attestation'\n\n/**\n * One reconciled tally per version id, plus the totals (AGL-1418).\n *\n * Built from EVERY version document, never from a filtered subset: the buyer\n * branch shows approved versions only, and reconciling against that subset\n * would hand a pending version's installs to an approved one.\n */\nfunction reconcileFromSnapshot(\n  docs: Array<{ id: string; get: (field: string) => unknown }>,\n  listing: Record<string, unknown> | undefined,\n  pins?: LivePinTally | null,\n): { byVersion: Map<string, { installCount: number; activeInstalls: number }> } & ReconciledInstallTallies {\n  const reconciled = reconcileInstallTallies(\n    docs.map((doc) => ({\n      version: String(doc.get('version') ?? doc.id),\n      installCount: Number(doc.get('installCount') ?? 0),\n      activeInstalls: Number(doc.get('activeInstalls') ?? 0),\n    })),\n    {\n      installCount: Number(listing?.['installCount'] ?? 0),\n      activeInstalls: Number(listing?.['activeInstalls'] ?? 0),\n    },\n    pins,\n  )\n  const byVersion = new Map<string, { installCount: number; activeInstalls: number }>()\n  reconciled.versions.forEach((entry) =>\n    byVersion.set(entry.version, {\n      installCount: entry.installCount,\n      activeInstalls: entry.activeInstalls,\n    }),\n  )\n  return { ...reconciled, byVersion }\n}\n\n/**\n * The publisher's own view of their versions (AGL-1079).\n *\n * AGL-966 made review per-version and got the mechanics right — a new\n * version enters `pending`, the previously approved one keeps installing,\n * nothing ships past a reviewer. The publisher was told none of it: an\n * email on the outcome, and in between a listing row identical to the one\n * they had before they published.\n *\n * Separate from the buyer projection above on purpose. `reviewState`, the\n * rejection reason, the sha and what was attested are the publisher's own\n * business and nobody else's — a buyer has no need to read why a version\n * they will never be offered was sent back. So this branch demands a token\n * and org membership rather than widening what the public route returns.\n */\nconst publisherVersions: PluginApiHandler = async (req, res) => {\n  const listingId = String(req.query?.listingId ?? '')\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  const firestore = firebaseAdmin.app().firestore()\n  const listingRef = firestore.collection('marketplaceListings').doc(listingId)\n  const listingSnapshot = await listingRef.get()\n  const listing = listingSnapshot.data()\n  if (!listing || listing.deletedAt) {\n    return res.status(404).json({ error: 'Unknown listing' })\n  }\n  // Listings are org-owned (AGL-652), so this is an org-membership question,\n  // not a uid comparison — the same gate the publish and edit paths use.\n  const isPublisher = await canActAsPublisher(\n    firestore,\n    decoded.uid,\n    listing.profileId,\n  )\n  if (!isPublisher && decoded['staff'] !== true) {\n    // 404, not 403: whether a listing exists is not a stranger's business.\n    return res.status(404).json({ error: 'Unknown listing' })\n  }\n  const artifactType = listingArtifactType(listing)\n  const snapshot = await listingRef\n    .collection(versionCollectionFor(artifactType))\n    .orderBy('publishedAt', 'desc')\n    .limit(20)\n    .get()\n  /**\n   * The kill switch, on the publisher's own view of their versions\n   * (AGL-2328).\n   *\n   * Staff are REQUIRED to type a reason to revoke a version. It was stored\n   * and nothing read it: every reader in the repo consulted `versions` and\n   * stopped, and this branch did not read the document at all — so a\n   * publisher whose version had been pulled saw the row it had before,\n   * still labelled by its REVIEW state. A version can be approved and\n   * revoked at once, and \"Approved\" was the only word on it.\n   *\n   * ONE document read for the whole card, not one per version: the switch\n   * is listing-scoped. The predicate is `isPluginRevoked`, shared with the\n   * installer and the loaders (AGL-1085), so what a publisher is told is\n   * disabled and what actually refuses to install cannot drift apart.\n   */\n  const revocation = (\n    await firestore.collection('revocations').doc(listingId).get()\n  ).data() as PluginRevocation | undefined\n  // The counters the page prints, derived from the pins where there are pins\n  // to derive from (AGL-1419) and reconciled against the listing totals\n  // otherwise (AGL-1418), so this card cannot contradict the header above it.\n  const pins = await verifiedLivePins({\n    firestore: firestore as never,\n    listingRef: listingRef as never,\n    listingId,\n    listing,\n    artifactType,\n    versionIds: snapshot.docs.map((doc) => String(doc.get('version') ?? doc.id)),\n    updateTime: listingSnapshot.updateTime,\n  })\n  const tallies = reconcileFromSnapshot(snapshot.docs as never, listing, pins)\n  const versions = snapshot.docs.map((doc) => {\n    const sha256 = String(doc.get('sha256') ?? '')\n    const versionId = String(doc.get('version') ?? doc.id)\n    return {\n      version: String(doc.get('version') ?? doc.id),\n      publishedAtMs: doc.get('publishedAt')?.toMillis?.() ?? null,\n      sha256,\n      // Absent on every version published before AGL-966, which is what\n      // `grandfathered` marks — those were never reviewed and saying\n      // \"pending\" about them would be a lie in both directions.\n      reviewState: String(doc.get('reviewState') ?? ''),\n      grandfathered: Boolean(doc.get('grandfathered')),\n      signed: Boolean(doc.get('signature')),\n      changelog: String(doc.get('changelog') ?? ''),\n      // Only reached an email before this (AGL-1079), where it got buried\n      // under everything else in an inbox.\n      rejectionReason: String(doc.get('reviewRejectionReason') ?? ''),\n      // Per VERSION, because a listing-wide takedown and a single revoked\n      // version are the same document and only the predicate tells them\n      // apart.\n      revoked: isPluginRevoked(revocation, versionId),\n      activeInstalls: tallies.byVersion.get(versionId)?.activeInstalls ?? 0,\n      installCount: tallies.byVersion.get(versionId)?.installCount ?? 0,\n      // What they claimed about THESE bytes (AGL-969) — so they can see it\n      // before they claim it again on the next version.\n      attestation: attestationsForBytes(\n        doc.get('publisherAttestation') as never,\n        sha256,\n      ),\n    }\n  })\n  return res.status(200).json({\n    versions,\n    // The same reconciled totals the buyer branch returns (AGL-1418), so the\n    // Review status card and the listing header cannot disagree about how\n    // many installs there are.\n    installCount: tallies.installCount,\n    activeInstalls: tallies.activeInstalls,\n    untrackedInstallCount: tallies.untrackedInstallCount,\n    untrackedActiveInstalls: tallies.untrackedActiveInstalls,\n    // The version installs actually resolve to (AGL-1016/966). Deliberately\n    // NOT `latestVersion`, which names a version installs may refuse.\n    latestApprovedVersion: String(listing.latestApprovedVersion ?? ''),\n    latestVersion: String(listing.latestVersion ?? ''),\n    reviewStatus: String(listing.reviewStatus ?? ''),\n    /**\n     * Listing-scoped, like the document it comes from (AGL-2328) — one\n     * reason covers whatever `versions` names, so two revoked rows show the\n     * same sentence. That is what was recorded; inventing a per-version\n     * reason would be inventing a fact.\n     *\n     * `revokedBy` is deliberately NOT returned. It is a staff uid, and it\n     * belongs in the audit log rather than on a publisher's screen — the\n     * same line the consumer-facing card drew.\n     */\n    revocationReason: String(revocation?.reason ?? '').trim(),\n    // The writers store `revokedAt` as a server timestamp; `atMs` is on the\n    // TYPE but nothing writes it. Read both rather than trusting either,\n    // and treat a revocation with no readable date as dateless rather than\n    // printing an epoch.\n    revokedAtMs: revocationTimeMs(revocation),\n  })\n}\n\n/**\n * When the revocation was written, in millis, or null (AGL-2328).\n *\n * `PluginRevocation` declares `atMs?: number` and every writer in\n * `plugin-reviews/route.ts` writes `revokedAt: serverTimestamp()` instead.\n * A reader that trusted the type would print nothing for every revocation\n * that exists; one that trusted the writer would break if `atMs` is ever\n * the field that gets written. Both are read, admin `Timestamp` and the\n * seconds-shaped form a client SDK produces included.\n */\nfunction revocationTimeMs(\n  revocation: (PluginRevocation & { revokedAt?: unknown }) | undefined,\n): number | null {\n  const at = revocation?.revokedAt as\n    | { toMillis?: () => number; seconds?: number }\n    | undefined\n  if (typeof at?.toMillis === 'function') return at.toMillis()\n  if (typeof at?.seconds === 'number') return at.seconds * 1000\n  return typeof revocation?.atMs === 'number' ? revocation.atMs : null\n}\n\n/**\n * Public version history for a plugin listing (AGL-431). The\n * `pluginVersions` docs are server-only (they carry publish internals),\n * but their changelog/trust/compat fields are exactly what a buyer needs\n * on the detail page — so this handler exposes THAT subset and nothing\n * else (no objectPath, no signature; sha stays out simply because the\n * client has no use for it).\n */\nexport const listingVersionsHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'GET') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const listingId = String(req.query?.listingId ?? '')\n  if (!listingId) return res.status(400).json({ error: 'Missing listingId' })\n  try {\n    // The publisher's own view (AGL-1079) — same collection, a different\n    // question, and one that needs a token.\n    if (String(req.query?.scope ?? '') === 'publisher') {\n      return await publisherVersions(req, res)\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const listingRef = firestore.collection('marketplaceListings').doc(listingId)\n    // Every artifact type has a version history now (AGL-1036), not just\n    // plugins: the per-version install counts are worth the same to whoever\n    // publishes a component as to whoever publishes a plugin. The collection\n    // differs — plugins keep publish internals in `pluginVersions`, everything\n    // else keeps content snapshots in `versions` — so the type decides which\n    // to read, and the buyer-safe projection below stays the same either way.\n    const listingSnapshot = await listingRef.get()\n    const artifactType = listingArtifactType(listingSnapshot.data() ?? {})\n    const isPlugin = artifactType === 'plugin'\n    const snapshot = await listingRef\n      .collection(versionCollectionFor(artifactType))\n      .orderBy('publishedAt', 'desc')\n      .limit(20)\n      .get()\n    // Buyers see APPROVED versions only (AGL-976).\n    //\n    // This handler returned every version, so the listing's Version history\n    // advertised pending and rejected ones — with `Latest` on whichever was\n    // newest. A version rejected for undeclared network access was shown to\n    // buyers, by us, as the current release, changelog and all. Installing it\n    // was already impossible (AGL-966 gates that), which made the card a\n    // promise the product would not keep.\n    //\n    // Plugins only: `reviewState` is a plugin concept, and a copied artifact's\n    // `versions` docs carry none — filtering those would empty every\n    // component and template history.\n    //\n    // Through `isVersionApproved`, whose contract is the one that matters\n    // here: ABSENT STATE IS NOT APPROVAL. That hides versions published\n    // before review existed, which is the safe direction — the alternative is\n    // showing unreviewed code as reviewed.\n    const visibleDocs = isPlugin\n      ? snapshot.docs.filter((doc) => isVersionApproved({\n          reviewState: doc.get('reviewState'),\n        }))\n      : snapshot.docs\n    // Derived from the live pins (AGL-1419), which are the only ground truth\n    // and the only thing that can bring a count back DOWN — a tenant erase\n    // sweeps `installs` without decrementing anything. Falls back to the\n    // AGL-1418 reconciliation when there is nothing to derive from: a copied\n    // artifact holds no pin, and a missing index must degrade to the previous\n    // release rather than to zeros.\n    //\n    // Built from EVERY version doc rather than `visibleDocs`: the buyer filter\n    // above drops unapproved versions, and reconciling against what survives\n    // it would credit their installs to an approved version.\n    const pins = await verifiedLivePins({\n      firestore: firestore as never,\n      listingRef: listingRef as never,\n      listingId,\n      listing: listingSnapshot.data(),\n      artifactType,\n      versionIds: snapshot.docs.map((doc) =>\n        String(doc.get('version') ?? doc.id),\n      ),\n      updateTime: listingSnapshot.updateTime,\n    })\n    const tallies = reconcileFromSnapshot(\n      snapshot.docs as never,\n      listingSnapshot.data(),\n      pins,\n    )\n    const versions = visibleDocs.map((doc) => ({\n      version: String(doc.get('version') ?? doc.id),\n      // Per-version install counts (AGL-1036). `installCount` is every install\n      // that ever landed on this version; `activeInstalls` is how many are on\n      // it now — the one that answers \"who is still on the old version\".\n      installCount:\n        tallies.byVersion.get(String(doc.get('version') ?? doc.id))\n          ?.installCount ?? 0,\n      activeInstalls:\n        tallies.byVersion.get(String(doc.get('version') ?? doc.id))\n          ?.activeInstalls ?? 0,\n      ...(doc.get('changelog') ? { changelog: String(doc.get('changelog')) } : {}),\n      ...(doc.get('trust') ? { trust: String(doc.get('trust')) } : {}),\n      ...(Number.isInteger(doc.get('manifest')?.hostAbi)\n        ? { hostAbi: Number(doc.get('manifest').hostAbi) }\n        : {}),\n      // Declared network allowlist (AGL-879 follow-up): the plugin origin\n      // builds the /load CSP `connect-src` from this, so the sandbox only\n      // reaches origins the manifest declared. Already buyer-visible in\n      // review (\"Capabilities: network N\"), so exposing the origins here\n      // leaks nothing new.\n      ...(Array.isArray(doc.get('manifest')?.capabilities?.network)\n        ? {\n            network: (doc.get('manifest').capabilities.network as unknown[])\n              .map((entry) => String(entry))\n              .filter((entry) => /^https:\\/\\/[^\\s/]+$/.test(entry))\n              .slice(0, 20),\n          }\n        : {}),\n      publishedAtMs: doc.get('publishedAt')?.toMillis?.() ?? null,\n    }))\n\n    // Repair `latestApprovedVersion` when it disagrees with the versions\n    // (AGL-1016, corrected by AGL-2368).\n    //\n    // The field is written by the approval route, so every plugin approved\n    // before it existed carries none — and the console would report those as\n    // \"no published version to compare against\" forever, which is a worse lie\n    // than the one it replaced. The approved set is already in hand here and\n    // `pluginVersions` is server-only, so this is the one place that can\n    // repair it. Plugins only: `reviewState` and the approved-version\n    // guarantee are a plugin concept, and a copied artifact's `versions` docs\n    // carry neither.\n    //\n    // Two things were wrong with the original, and they compounded. It asked\n    // `newestApprovedVersion` — approval only, blind to the kill switch — and\n    // it \"only ever moved the value forward\". So it did not merely fail to\n    // step the mirror back off a revoked version; it actively WROTE ONE BACK.\n    // AGL-2306 taught the review route to repair the mirror on revoke, and the\n    // very next hit on this handler undid it: stored v1.0.0 (correct), newest\n    // approved v2.0.0 (revoked), v1.0.0 < v2.0.0, write. This endpoint is a\n    // public unauthenticated GET, so \"the next hit\" is the next page view.\n    //\n    // Now derived from the whole set through the SHARED predicate the review\n    // route repairs with, and applied whenever it differs — a derivation has\n    // no direction to preserve. The monotonic rule belongs to the APPROVAL\n    // writer, where it means \"a reviewer working through a backlog must not\n    // walk the offer backwards\"; here it only ever preserved a wrong answer.\n    const revocation = !isPlugin\n      ? undefined\n      : ((\n          await firestore.collection('revocations').doc(listingId).get()\n        ).data() as PluginRevocation | undefined)\n    const newest = !isPlugin\n      ? null\n      : newestInstallableVersion(\n          snapshot.docs.map((doc) => ({\n            version: String(doc.get('version') ?? doc.id),\n            reviewState: doc.get('reviewState'),\n          })),\n          revocation,\n          compareArtifactVersions,\n        )\n    if (isPlugin) {\n      const stored = listingSnapshot.get('latestApprovedVersion')\n      const storedString = stored == null ? '' : String(stored)\n      if (storedString !== (newest ?? '')) {\n        await listingRef\n          .set(\n            {\n              // Deleted rather than emptied when nothing qualifies, matching\n              // `repairLatestApprovedVersion`: an ABSENT mirror reads as \"no\n              // update to offer\", an empty string is a value readers have to\n              // interpret.\n              latestApprovedVersion:\n                newest ?? firebaseAdmin.firestore.FieldValue.delete(),\n            },\n            { merge: true },\n          )\n          .catch(() => undefined)\n      }\n    }\n\n    // The totals the header prints (AGL-1418). The listing document carries\n    // its own copy of this pair and the client used to read it straight off\n    // Firestore, which is how the header came to say `7 installs · 2 active`\n    // over a version history that added up to `3 · 1`. Served from here so\n    // one arithmetic answers the whole page.\n    return res.status(200).json({\n      versions,\n      installCount: tallies.installCount,\n      activeInstalls: tallies.activeInstalls,\n      untrackedInstallCount: tallies.untrackedInstallCount,\n      untrackedActiveInstalls: tallies.untrackedActiveInstalls,\n    })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Version lookup failed' })\n  }\n}\n"],"names":["isPluginRevoked","newestInstallableVersion","firebaseAdmin","isVersionApproved","listingArtifactType","compareArtifactVersions","reconcileInstallTallies","versionCollectionFor","verifiedLivePins","canActAsPublisher","attestationsForBytes","reconcileFromSnapshot","docs","listing","pins","reconciled","map","doc","version","String","get","id","installCount","Number","activeInstalls","byVersion","Map","versions","forEach","entry","set","publisherVersions","req","res","listingId","query","authorization","headers","idToken","startsWith","slice","length","undefined","status","json","error","decoded","app","auth","verifyIdToken","firestore","listingRef","collection","listingSnapshot","data","deletedAt","isPublisher","uid","profileId","artifactType","snapshot","orderBy","limit","revocation","versionIds","updateTime","tallies","sha256","versionId","publishedAtMs","toMillis","reviewState","grandfathered","Boolean","signed","changelog","rejectionReason","revoked","attestation","untrackedInstallCount","untrackedActiveInstalls","latestApprovedVersion","latestVersion","reviewStatus","revocationReason","reason","trim","revokedAtMs","revocationTimeMs","at","revokedAt","seconds","atMs","listingVersionsHandler","method","scope","isPlugin","visibleDocs","filter","trust","isInteger","hostAbi","Array","isArray","capabilities","network","test","newest","stored","storedString","FieldValue","delete","merge","catch","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,eAAe,EACfC,wBAAwB,QAGnB,sBAAqB;AAC5B,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SACEC,iBAAiB,EACjBC,mBAAmB,QACd,0BAAsB;AAC7B,SAASC,uBAAuB,QAAQ,sBAAqB;AAC7D,SACEC,uBAAuB,EACvBC,oBAAoB,QAGf,qBAAiB;AACxB,SAASC,gBAAgB,QAAQ,0BAAsB;AACvD,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,oBAAoB,QAAQ,+CAA8C;AAEnF;;;;;;CAMC,GACD,SAASC,sBACPC,IAA4D,EAC5DC,OAA4C,EAC5CC,IAA0B;;IAE1B,MAAMC,aAAaT,wBACjBM,KAAKI,GAAG,CAAC,CAACC;YACQA,UACKA,WACEA;eAHN;YACjBC,SAASC,QAAOF,WAAAA,IAAIG,GAAG,CAAC,sBAARH,WAAsBA,IAAII,EAAE;YAC5CC,cAAcC,QAAON,YAAAA,IAAIG,GAAG,CAAC,2BAARH,YAA2B;YAChDO,gBAAgBD,QAAON,YAAAA,IAAIG,GAAG,CAAC,6BAARH,YAA6B;QACtD;QACA;QACEK,cAAcC,eAAOV,2BAAAA,OAAS,CAAC,eAAe,mBAAI;QAClDW,gBAAgBD,gBAAOV,2BAAAA,OAAS,CAAC,iBAAiB,oBAAI;IACxD,GACAC;IAEF,MAAMW,YAAY,IAAIC;IACtBX,WAAWY,QAAQ,CAACC,OAAO,CAAC,CAACC,QAC3BJ,UAAUK,GAAG,CAACD,MAAMX,OAAO,EAAE;YAC3BI,cAAcO,MAAMP,YAAY;YAChCE,gBAAgBK,MAAML,cAAc;QACtC;IAEF,OAAO,aAAKT;QAAYU;;AAC1B;AAEA;;;;;;;;;;;;;;CAcC,GACD,MAAMM,oBAAsC,OAAOC,KAAKC;cAEzBD,4BAwGGnB,gCACRA,wBACDA;QA3GEmB;IAAzB,MAAME,YAAYf,gBAAOa,aAAAA,IAAIG,KAAK,qBAATH,WAAWE,SAAS,mBAAI;IACjD,MAAME,gBAAgBjB,QAAOa,6BAAAA,IAAIK,OAAO,CAACD,aAAa,YAAzBJ,6BAA6B;IAC1D,MAAMM,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOL,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,MAAMC,UAAU,MAAM5C,cAAc6C,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;IAC/D,MAAMY,YAAYhD,cAAc6C,GAAG,GAAGG,SAAS;IAC/C,MAAMC,aAAaD,UAAUE,UAAU,CAAC,uBAAuBnC,GAAG,CAACiB;IACnE,MAAMmB,kBAAkB,MAAMF,WAAW/B,GAAG;IAC5C,MAAMP,UAAUwC,gBAAgBC,IAAI;IACpC,IAAI,CAACzC,WAAWA,QAAQ0C,SAAS,EAAE;QACjC,OAAOtB,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,2EAA2E;IAC3E,uEAAuE;IACvE,MAAMW,cAAc,MAAM/C,kBACxByC,WACAJ,QAAQW,GAAG,EACX5C,QAAQ6C,SAAS;IAEnB,IAAI,CAACF,eAAeV,OAAO,CAAC,QAAQ,KAAK,MAAM;QAC7C,uEAAuE;QACvE,OAAOb,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkB;IACzD;IACA,MAAMc,eAAevD,oBAAoBS;IACzC,MAAM+C,WAAW,MAAMT,WACpBC,UAAU,CAAC7C,qBAAqBoD,eAChCE,OAAO,CAAC,eAAe,QACvBC,KAAK,CAAC,IACN1C,GAAG;IACN;;;;;;;;;;;;;;;GAeC,GACD,MAAM2C,aAAa,AACjB,CAAA,MAAMb,UAAUE,UAAU,CAAC,eAAenC,GAAG,CAACiB,WAAWd,GAAG,EAAC,EAC7DkC,IAAI;IACN,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAMxC,OAAO,MAAMN,iBAAiB;QAClC0C,WAAWA;QACXC,YAAYA;QACZjB;QACArB;QACA8C;QACAK,YAAYJ,SAAShD,IAAI,CAACI,GAAG,CAAC,CAACC;gBAAeA;mBAAPE,QAAOF,WAAAA,IAAIG,GAAG,CAAC,sBAARH,WAAsBA,IAAII,EAAE;;QAC1E4C,YAAYZ,gBAAgBY,UAAU;IACxC;IACA,MAAMC,UAAUvD,sBAAsBiD,SAAShD,IAAI,EAAWC,SAASC;IACvE,MAAMa,WAAWiC,SAAShD,IAAI,CAACI,GAAG,CAAC,CAACC;YACZA,UACGA,WAEPA,iBAMIA,WAGFA,WAGMA;YAXTA,mBAAAA,WAgBCiD,wBACFA;QArBhB,MAAMC,SAAShD,QAAOF,WAAAA,IAAIG,GAAG,CAAC,qBAARH,WAAqB;QAC3C,MAAMmD,YAAYjD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,sBAARH,YAAsBA,IAAII,EAAE;QACrD,OAAO;YACLH,SAASC,QAAOF,YAAAA,IAAIG,GAAG,CAAC,sBAARH,YAAsBA,IAAII,EAAE;YAC5CgD,aAAa,WAAEpD,YAAAA,IAAIG,GAAG,CAAC,oCAARH,oBAAAA,UAAwBqD,QAAQ,qBAAhCrD,uBAAAA,6BAAwC;YACvDkD;YACA,kEAAkE;YAClE,+DAA+D;YAC/D,0DAA0D;YAC1DI,aAAapD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,0BAARH,YAA0B;YAC9CuD,eAAeC,QAAQxD,IAAIG,GAAG,CAAC;YAC/BsD,QAAQD,QAAQxD,IAAIG,GAAG,CAAC;YACxBuD,WAAWxD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,wBAARH,YAAwB;YAC1C,oEAAoE;YACpE,qCAAqC;YACrC2D,iBAAiBzD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,oCAARH,YAAoC;YAC5D,oEAAoE;YACpE,kEAAkE;YAClE,SAAS;YACT4D,SAAS7E,gBAAgB+D,YAAYK;YACrC5C,cAAc,YAAE0C,yBAAAA,QAAQzC,SAAS,CAACL,GAAG,CAACgD,+BAAtBF,uBAAkC1C,cAAc,oBAAI;YACpEF,YAAY,YAAE4C,0BAAAA,QAAQzC,SAAS,CAACL,GAAG,CAACgD,+BAAtBF,wBAAkC5C,YAAY,oBAAI;YAChE,qEAAqE;YACrE,kDAAkD;YAClDwD,aAAapE,qBACXO,IAAIG,GAAG,CAAC,yBACR+C;QAEJ;IACF;IACA,OAAOlC,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAC1BjB;QACA,yEAAyE;QACzE,sEAAsE;QACtE,2BAA2B;QAC3BL,cAAc4C,QAAQ5C,YAAY;QAClCE,gBAAgB0C,QAAQ1C,cAAc;QACtCuD,uBAAuBb,QAAQa,qBAAqB;QACpDC,yBAAyBd,QAAQc,uBAAuB;QACxD,wEAAwE;QACxE,kEAAkE;QAClEC,uBAAuB9D,QAAON,iCAAAA,QAAQoE,qBAAqB,YAA7BpE,iCAAiC;QAC/DqE,eAAe/D,QAAON,yBAAAA,QAAQqE,aAAa,YAArBrE,yBAAyB;QAC/CsE,cAAchE,QAAON,wBAAAA,QAAQsE,YAAY,YAApBtE,wBAAwB;QAC7C;;;;;;;;;KASC,GACDuE,kBAAkBjE,gBAAO4C,8BAAAA,WAAYsB,MAAM,oBAAI,IAAIC,IAAI;QACvD,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,qBAAqB;QACrBC,aAAaC,iBAAiBzB;IAChC;AACF;AAEA;;;;;;;;;CASC,GACD,SAASyB,iBACPzB,UAAoE;IAEpE,MAAM0B,KAAK1B,8BAAAA,WAAY2B,SAAS;IAGhC,IAAI,QAAOD,sBAAAA,GAAInB,QAAQ,MAAK,YAAY,OAAOmB,GAAGnB,QAAQ;IAC1D,IAAI,QAAOmB,sBAAAA,GAAIE,OAAO,MAAK,UAAU,OAAOF,GAAGE,OAAO,GAAG;IACzD,OAAO,QAAO5B,8BAAAA,WAAY6B,IAAI,MAAK,WAAW7B,WAAW6B,IAAI,GAAG;AAClE;AAEA;;;;;;;CAOC,GACD,OAAO,MAAMC,yBAA2C,OAAO7D,KAAKC;;QAIzCD;IAHzB,IAAIA,IAAI8D,MAAM,KAAK,OAAO;QACxB,OAAO7D,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMX,YAAYf,gBAAOa,aAAAA,IAAIG,KAAK,qBAATH,WAAWE,SAAS,mBAAI;IACjD,IAAI,CAACA,WAAW,OAAOD,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAoB;IACzE,IAAI;mBAeuCQ;YAZ9BrB;QAFX,qEAAqE;QACrE,wCAAwC;QACxC,IAAIb,iBAAOa,cAAAA,IAAIG,KAAK,qBAATH,YAAW+D,KAAK,oBAAI,QAAQ,aAAa;YAClD,OAAO,MAAMhE,kBAAkBC,KAAKC;QACtC;QACA,MAAMiB,YAAYhD,cAAc6C,GAAG,GAAGG,SAAS;QAC/C,MAAMC,aAAaD,UAAUE,UAAU,CAAC,uBAAuBnC,GAAG,CAACiB;QACnE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAMmB,kBAAkB,MAAMF,WAAW/B,GAAG;QAC5C,MAAMuC,eAAevD,qBAAoBiD,wBAAAA,gBAAgBC,IAAI,cAApBD,wBAA0B,CAAC;QACpE,MAAM2C,WAAWrC,iBAAiB;QAClC,MAAMC,WAAW,MAAMT,WACpBC,UAAU,CAAC7C,qBAAqBoD,eAChCE,OAAO,CAAC,eAAe,QACvBC,KAAK,CAAC,IACN1C,GAAG;QACN,+CAA+C;QAC/C,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,sCAAsC;QACtC,EAAE;QACF,2EAA2E;QAC3E,iEAAiE;QACjE,kCAAkC;QAClC,EAAE;QACF,sEAAsE;QACtE,oEAAoE;QACpE,0EAA0E;QAC1E,uCAAuC;QACvC,MAAM6E,cAAcD,WAChBpC,SAAShD,IAAI,CAACsF,MAAM,CAAC,CAACjF,MAAQd,kBAAkB;gBAC9CoE,aAAatD,IAAIG,GAAG,CAAC;YACvB,MACAwC,SAAShD,IAAI;QACjB,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,0EAA0E;QAC1E,gCAAgC;QAChC,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,yDAAyD;QACzD,MAAME,OAAO,MAAMN,iBAAiB;YAClC0C,WAAWA;YACXC,YAAYA;YACZjB;YACArB,SAASwC,gBAAgBC,IAAI;YAC7BK;YACAK,YAAYJ,SAAShD,IAAI,CAACI,GAAG,CAAC,CAACC;oBACtBA;uBAAPE,QAAOF,WAAAA,IAAIG,GAAG,CAAC,sBAARH,WAAsBA,IAAII,EAAE;;YAErC4C,YAAYZ,gBAAgBY,UAAU;QACxC;QACA,MAAMC,UAAUvD,sBACdiD,SAAShD,IAAI,EACbyC,gBAAgBC,IAAI,IACpBxC;QAEF,MAAMa,WAAWsE,YAAYjF,GAAG,CAAC,CAACC;gBAChBA,gBAKeA,kBAGAA;gBAH7BiD,wBAGAA,yBAImBjD,WAQHA,uBAAAA,WAQHA,mBAAAA;mBA7B0B;gBACzCC,SAASC,QAAOF,WAAAA,IAAIG,GAAG,CAAC,sBAARH,WAAsBA,IAAII,EAAE;gBAC5C,yEAAyE;gBACzE,wEAAwE;gBACxE,mEAAmE;gBACnEC,YAAY,WACV4C,yBAAAA,QAAQzC,SAAS,CAACL,GAAG,CAACD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,sBAARH,YAAsBA,IAAII,EAAE,uBAAzD6C,uBACI5C,YAAY,mBAAI;gBACtBE,cAAc,YACZ0C,0BAAAA,QAAQzC,SAAS,CAACL,GAAG,CAACD,QAAOF,YAAAA,IAAIG,GAAG,CAAC,sBAARH,YAAsBA,IAAII,EAAE,uBAAzD6C,wBACI1C,cAAc,oBAAI;eACpBP,IAAIG,GAAG,CAAC,eAAe;gBAAEuD,WAAWxD,OAAOF,IAAIG,GAAG,CAAC;YAAc,IAAI,CAAC,GACtEH,IAAIG,GAAG,CAAC,WAAW;gBAAE+E,OAAOhF,OAAOF,IAAIG,GAAG,CAAC;YAAU,IAAI,CAAC,GAC1DG,OAAO6E,SAAS,EAACnF,YAAAA,IAAIG,GAAG,CAAC,gCAARH,UAAqBoF,OAAO,IAC7C;gBAAEA,SAAS9E,OAAON,IAAIG,GAAG,CAAC,YAAYiF,OAAO;YAAE,IAC/C,CAAC,GAMDC,MAAMC,OAAO,EAACtF,YAAAA,IAAIG,GAAG,CAAC,iCAARH,wBAAAA,UAAqBuF,YAAY,qBAAjCvF,sBAAmCwF,OAAO,IACxD;gBACEA,SAAS,AAACxF,IAAIG,GAAG,CAAC,YAAYoF,YAAY,CAACC,OAAO,CAC/CzF,GAAG,CAAC,CAACa,QAAUV,OAAOU,QACtBqE,MAAM,CAAC,CAACrE,QAAU,sBAAsB6E,IAAI,CAAC7E,QAC7CW,KAAK,CAAC,GAAG;YACd,IACA,CAAC;gBACL6B,aAAa,YAAEpD,YAAAA,IAAIG,GAAG,CAAC,oCAARH,oBAAAA,UAAwBqD,QAAQ,qBAAhCrD,uBAAAA,8BAAwC;;;QAGzD,qEAAqE;QACrE,qCAAqC;QACrC,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,kEAAkE;QAClE,0EAA0E;QAC1E,iBAAiB;QACjB,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM8C,aAAa,CAACiC,WAChBtD,YACC,AACC,CAAA,MAAMQ,UAAUE,UAAU,CAAC,eAAenC,GAAG,CAACiB,WAAWd,GAAG,EAAC,EAC7DkC,IAAI;QACV,MAAMqD,SAAS,CAACX,WACZ,OACA/F,yBACE2D,SAAShD,IAAI,CAACI,GAAG,CAAC,CAACC;gBACDA;mBADU;gBAC1BC,SAASC,QAAOF,WAAAA,IAAIG,GAAG,CAAC,sBAARH,WAAsBA,IAAII,EAAE;gBAC5CkD,aAAatD,IAAIG,GAAG,CAAC;YACvB;YACA2C,YACA1D;QAEN,IAAI2F,UAAU;YACZ,MAAMY,SAASvD,gBAAgBjC,GAAG,CAAC;YACnC,MAAMyF,eAAeD,UAAU,OAAO,KAAKzF,OAAOyF;YAClD,IAAIC,kBAAkBF,iBAAAA,SAAU,KAAK;gBACnC,MAAMxD,WACHrB,GAAG,CACF;oBACE,+DAA+D;oBAC/D,+DAA+D;oBAC/D,+DAA+D;oBAC/D,aAAa;oBACbmD,qBAAqB,EACnB0B,iBAAAA,SAAUzG,cAAcgD,SAAS,CAAC4D,UAAU,CAACC,MAAM;gBACvD,GACA;oBAAEC,OAAO;gBAAK,GAEfC,KAAK,CAAC,IAAMvE;YACjB;QACF;QAEA,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,yCAAyC;QACzC,OAAOT,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BjB;YACAL,cAAc4C,QAAQ5C,YAAY;YAClCE,gBAAgB0C,QAAQ1C,cAAc;YACtCuD,uBAAuBb,QAAQa,qBAAqB;YACpDC,yBAAyBd,QAAQc,uBAAuB;QAC1D;IACF,EAAE,OAAOnC,OAAO;QACdqE,QAAQrE,KAAK,CAACA;QACd,OAAOZ,IAAIU,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAwB;IAC/D;AACF,EAAC"}

package/src/lib/server/preview-image.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Listing preview image (AGL-95): the publisher uploads one screenshot per
+ * listing, shown on browse cards and the detail page. Storage rules deny
+ * client writes, so the mutation runs here — Firebase ID token, listing
+ * ownership, image-only, 2MB cap. POST replaces the image and sets
+ * `previewImageUrl` on the listing; DELETE removes both.
+ *
+ * Lives in the plugin, like every other `marketplace/*` operation. It was the
+ * one that didn't: it sat in the console app and imported this plugin's
+ * `canActAsPublisher` across the `scope:app` → `aglyn:addons` boundary, which
+ * failed lint on main. Registered at the same path, so the URL clients call
+ * is unchanged — `/api/marketplace/preview-image` reaches the plugin catch-all
+ * with exactly the shape it had as a named app route.
+ *
+ * The email-verified gate (AGL-479) is carried over deliberately: the plugin
+ * API dispatcher does NOT apply it centrally, so dropping it here would have
+ * quietly widened who can write listing images.
+ */
+export declare const previewImageHandler: PluginApiHandler;
+export default previewImageHandler;