@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/preview-image.js

@@ -0,0 +1,216 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isFirstPartyMediaSrc } from "@aglyn/aglyn/app-utils/media-ref";
+import { isImageUploadContentType, normalizeImageContentType } from "@aglyn/aglyn/app-utils/image-upload-types";
+import { isSvgUploadType, sanitizeSvgBuffer } from "@aglyn/aglyn/app-utils/sanitize-svg";
+import { inspectUploadBytes } from "@aglyn/aglyn/server";
+import { firebaseAdmin, isImpersonationSession } from "@aglyn/tenant-data-admin";
+import { randomUUID } from "crypto";
+import { canActAsPublisher } from "./publisher-profile.js";
+// Base64 JSON payloads: 2MB of image encodes to ~2.7MB of body.
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const PREVIEW_PATH = (listingId)=>`marketplaceListings/${listingId}/preview`;
+/**
+ * Listing preview image (AGL-95): the publisher uploads one screenshot per
+ * listing, shown on browse cards and the detail page. Storage rules deny
+ * client writes, so the mutation runs here — Firebase ID token, listing
+ * ownership, image-only, 2MB cap. POST replaces the image and sets
+ * `previewImageUrl` on the listing; DELETE removes both.
+ *
+ * Lives in the plugin, like every other `marketplace/*` operation. It was the
+ * one that didn't: it sat in the console app and imported this plugin's
+ * `canActAsPublisher` across the `scope:app` → `aglyn:addons` boundary, which
+ * failed lint on main. Registered at the same path, so the URL clients call
+ * is unchanged — `/api/marketplace/preview-image` reaches the plugin catch-all
+ * with exactly the shape it had as a named app route.
+ *
+ * The email-verified gate (AGL-479) is carried over deliberately: the plugin
+ * API dispatcher does NOT apply it centrally, so dropping it here would have
+ * quietly widened who can write listing images.
+ */ export const previewImageHandler = async (req, res)=>{
+    var _ref, _req_headers_authorization;
+    var _req_body;
+    if (req.method !== 'POST' && req.method !== 'DELETE') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const listingId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.listingId) != null ? _ref : '');
+    if (!listingId) return res.status(400).json({
+        error: 'Missing listingId'
+    });
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _ref1, _ref2, _ref3;
+        var _req_body1, _req_body2, _req_body3, _req_body4;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return res.status(403).json({
+                error: 'Verify your email to continue',
+                reason: 'email-unverified'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listingSnapshot = await listingRef.get();
+        if (!listingSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown listing'
+            });
+        }
+        // Listings are org-owned since AGL-652, so `profileId` holds an ORG id.
+        // Comparing it to a uid can never be true — it silently 403'd every
+        // publisher rather than erroring, which is why this survived the sweep.
+        const canEdit = await canActAsPublisher(firestore, decoded.uid, listingSnapshot.get('profileId'));
+        if (!canEdit) {
+            return res.status(403).json({
+                error: 'Not your listing'
+            });
+        }
+        const bucket = firebaseAdmin.app().storage().bucket(process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET);
+        const file = bucket.file(PREVIEW_PATH(listingId));
+        if (req.method === 'DELETE') {
+            await file.delete().catch(()=>undefined);
+            await listingRef.set({
+                previewImageUrl: firebaseAdmin.firestore.FieldValue.delete(),
+                updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+            return res.status(200).json({
+                deleted: true
+            });
+        }
+        // DAM-hosted asset (AGL-863): the publisher picked an existing asset from
+        // the media library instead of uploading raw bytes. It already lives in
+        // our storage/CDN, so point `previewImageUrl` at it directly — no re-upload
+        // and no duplicate blob.
+        //
+        // The comment here used to claim parity with logo/screenshot, "which
+        // already accept any https URL". That was true and was the bug (AGL-1701):
+        // the preview image is the picture on the cross-org BROWSE grid and the
+        // `og:image` an unauthenticated unfurler fetches, so "any https URL" made
+        // a publisher-controlled host the recipient of every browser's IP. Parity
+        // is restored in the other direction — this field now takes what the
+        // sentence always implied it took, an asset that lives in our library.
+        const providedUrl = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.url) != null ? _ref1 : '').trim();
+        if (providedUrl) {
+            if (providedUrl.length > 2000 || !isFirstPartyMediaSrc(providedUrl)) {
+                return res.status(400).json({
+                    error: 'Preview image must come from your media library — pick one with ' + 'Browse, or upload the file here'
+                });
+            }
+            await listingRef.set({
+                previewImageUrl: providedUrl,
+                updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+            return res.status(200).json({
+                url: providedUrl
+            });
+        }
+        const contentType = normalizeImageContentType((_req_body2 = req.body) == null ? void 0 : _req_body2.contentType);
+        const data = String((_ref2 = (_req_body3 = req.body) == null ? void 0 : _req_body3.data) != null ? _ref2 : '');
+        // An ALLOWLIST rather than the `image/` prefix, for the same
+        // reason as the DAM routes: the prefix tested a caller-supplied string,
+        // so an unrecognised `image/…` label reached storage AND skipped the
+        // signature check below, which can only compare bytes against a type it
+        // knows.
+        if (!isImageUploadContentType(contentType)) {
+            return res.status(415).json({
+                error: 'Only image uploads are supported'
+            });
+        }
+        const buffer = Buffer.from(data, 'base64');
+        if (!buffer.length || buffer.length > MAX_FILE_BYTES) {
+            return res.status(413).json({
+                error: 'File is empty or too large (2MB)'
+            });
+        }
+        /**
+     * STRUCTURAL inspection (AGL-1475). The FIFTH byte ingress, and the one
+     * least like the other four.
+     *
+     * `contentType.startsWith('image/')` above is the entire type gate, and
+     * it is taken verbatim from the request body — so `image/png` over a
+     * Windows executable satisfied it. Worse than on the DAM routes: the URL
+     * this mints points straight at `firebasestorage.googleapis.com` rather
+     * than through `serveMediaCdn`, so the stored object never gets that
+     * route's `nosniff` and per-type CSP either. And it is the picture on the
+     * cross-org BROWSE grid and the `og:image` an unauthenticated unfurler
+     * fetches — the same reasoning that hardened the URL branch in AGL-1701,
+     * applied at last to the bytes branch.
+     *
+     * Structure only — not an antivirus scan. See `upload-inspection.ts`.
+     */ const refusal = inspectUploadBytes({
+            bytes: buffer,
+            contentType,
+            fileName: String((_ref3 = (_req_body4 = req.body) == null ? void 0 : _req_body4.fileName) != null ? _ref3 : '') || null
+        });
+        if (refusal) {
+            return res.status(415).json({
+                error: refusal.message,
+                code: refusal.code
+            });
+        }
+        /**
+     * SVG sanitization. Structural inspection cannot do this: an
+     * SVG is text, it has no magic number, and a `<script>` in one is a
+     * perfectly well-formed document.
+     *
+     * It matters more here than on the DAM routes, not less. Those serve
+     * through `serveMediaCdn`, which stamps `nosniff` and a `sandbox` CSP on
+     * every response and so contains a scripted SVG even if it is stored. The
+     * URL this mints points straight at `firebasestorage.googleapis.com` and
+     * gets neither header — and it is the `og:image` an unauthenticated
+     * unfurler fetches and the picture on the cross-org browse grid, so the
+     * audience is every other publisher's browser rather than the uploader's
+     * own.
+     */ const bytes = isSvgUploadType(contentType) ? sanitizeSvgBuffer(buffer).buffer : buffer;
+        const token = randomUUID();
+        await file.save(bytes, {
+            contentType,
+            metadata: {
+                metadata: {
+                    firebaseStorageDownloadTokens: token
+                }
+            }
+        });
+        const url = `https://firebasestorage.googleapis.com/v0/b/${bucket.name}/o/` + `${encodeURIComponent(PREVIEW_PATH(listingId))}` + `?alt=media&token=${token}`;
+        await listingRef.set({
+            previewImageUrl: url,
+            updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+        }, {
+            merge: true
+        });
+        return res.status(200).json({
+            url
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Upload failed'
+        });
+    }
+};
+export default previewImageHandler;
+
+//# sourceMappingURL=preview-image.js.map

package/src/lib/server/preview-image.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/preview-image.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { isFirstPartyMediaSrc } from '@aglyn/aglyn/app-utils/media-ref'\nimport {\n  isImageUploadContentType,\n  normalizeImageContentType,\n} from '@aglyn/aglyn/app-utils/image-upload-types'\nimport {\n  isSvgUploadType,\n  sanitizeSvgBuffer,\n} from '@aglyn/aglyn/app-utils/sanitize-svg'\nimport { inspectUploadBytes, type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, isImpersonationSession } from '@aglyn/tenant-data-admin'\nimport { randomUUID } from 'crypto'\nimport { canActAsPublisher } from './publisher-profile'\n\n// Base64 JSON payloads: 2MB of image encodes to ~2.7MB of body.\nconst MAX_FILE_BYTES = 2 * 1024 * 1024\n\nconst PREVIEW_PATH = (listingId: string) =>\n  `marketplaceListings/${listingId}/preview`\n\n/**\n * Listing preview image (AGL-95): the publisher uploads one screenshot per\n * listing, shown on browse cards and the detail page. Storage rules deny\n * client writes, so the mutation runs here — Firebase ID token, listing\n * ownership, image-only, 2MB cap. POST replaces the image and sets\n * `previewImageUrl` on the listing; DELETE removes both.\n *\n * Lives in the plugin, like every other `marketplace/*` operation. It was the\n * one that didn't: it sat in the console app and imported this plugin's\n * `canActAsPublisher` across the `scope:app` → `aglyn:addons` boundary, which\n * failed lint on main. Registered at the same path, so the URL clients call\n * is unchanged — `/api/marketplace/preview-image` reaches the plugin catch-all\n * with exactly the shape it had as a named app route.\n *\n * The email-verified gate (AGL-479) is carried over deliberately: the plugin\n * API dispatcher does NOT apply it centrally, so dropping it here would have\n * quietly widened who can write listing images.\n */\nexport const previewImageHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST' && req.method !== 'DELETE') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const listingId = String(req.body?.listingId ?? '')\n  if (!listingId) return res.status(400).json({ error: 'Missing listingId' })\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return res.status(403).json({\n        error: 'Verify your email to continue',\n        reason: 'email-unverified',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const listingRef = firestore.collection('marketplaceListings').doc(listingId)\n    const listingSnapshot = await listingRef.get()\n    if (!listingSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown listing' })\n    }\n    // Listings are org-owned since AGL-652, so `profileId` holds an ORG id.\n    // Comparing it to a uid can never be true — it silently 403'd every\n    // publisher rather than erroring, which is why this survived the sweep.\n    const canEdit = await canActAsPublisher(\n      firestore,\n      decoded.uid,\n      listingSnapshot.get('profileId') as string | undefined,\n    )\n    if (!canEdit) {\n      return res.status(403).json({ error: 'Not your listing' })\n    }\n    const bucket = firebaseAdmin\n      .app()\n      .storage()\n      .bucket(process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET)\n    const file = bucket.file(PREVIEW_PATH(listingId))\n\n    if (req.method === 'DELETE') {\n      await file.delete().catch(() => undefined)\n      await listingRef.set(\n        {\n          previewImageUrl: firebaseAdmin.firestore.FieldValue.delete(),\n          updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n        },\n        { merge: true },\n      )\n      return res.status(200).json({ deleted: true })\n    }\n\n    // DAM-hosted asset (AGL-863): the publisher picked an existing asset from\n    // the media library instead of uploading raw bytes. It already lives in\n    // our storage/CDN, so point `previewImageUrl` at it directly — no re-upload\n    // and no duplicate blob.\n    //\n    // The comment here used to claim parity with logo/screenshot, \"which\n    // already accept any https URL\". That was true and was the bug (AGL-1701):\n    // the preview image is the picture on the cross-org BROWSE grid and the\n    // `og:image` an unauthenticated unfurler fetches, so \"any https URL\" made\n    // a publisher-controlled host the recipient of every browser's IP. Parity\n    // is restored in the other direction — this field now takes what the\n    // sentence always implied it took, an asset that lives in our library.\n    const providedUrl = String(req.body?.url ?? '').trim()\n    if (providedUrl) {\n      if (providedUrl.length > 2000 || !isFirstPartyMediaSrc(providedUrl)) {\n        return res.status(400).json({\n          error:\n            'Preview image must come from your media library — pick one with ' +\n            'Browse, or upload the file here',\n        })\n      }\n      await listingRef.set(\n        {\n          previewImageUrl: providedUrl,\n          updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n        },\n        { merge: true },\n      )\n      return res.status(200).json({ url: providedUrl })\n    }\n\n    const contentType = normalizeImageContentType(req.body?.contentType)\n    const data = String(req.body?.data ?? '')\n    // An ALLOWLIST rather than the `image/` prefix, for the same\n    // reason as the DAM routes: the prefix tested a caller-supplied string,\n    // so an unrecognised `image/…` label reached storage AND skipped the\n    // signature check below, which can only compare bytes against a type it\n    // knows.\n    if (!isImageUploadContentType(contentType)) {\n      return res\n        .status(415)\n        .json({ error: 'Only image uploads are supported' })\n    }\n    const buffer = Buffer.from(data, 'base64')\n    if (!buffer.length || buffer.length > MAX_FILE_BYTES) {\n      return res\n        .status(413)\n        .json({ error: 'File is empty or too large (2MB)' })\n    }\n\n    /**\n     * STRUCTURAL inspection (AGL-1475). The FIFTH byte ingress, and the one\n     * least like the other four.\n     *\n     * `contentType.startsWith('image/')` above is the entire type gate, and\n     * it is taken verbatim from the request body — so `image/png` over a\n     * Windows executable satisfied it. Worse than on the DAM routes: the URL\n     * this mints points straight at `firebasestorage.googleapis.com` rather\n     * than through `serveMediaCdn`, so the stored object never gets that\n     * route's `nosniff` and per-type CSP either. And it is the picture on the\n     * cross-org BROWSE grid and the `og:image` an unauthenticated unfurler\n     * fetches — the same reasoning that hardened the URL branch in AGL-1701,\n     * applied at last to the bytes branch.\n     *\n     * Structure only — not an antivirus scan. See `upload-inspection.ts`.\n     */\n    const refusal = inspectUploadBytes({\n      bytes: buffer,\n      contentType,\n      fileName: String(req.body?.fileName ?? '') || null,\n    })\n    if (refusal) {\n      return res.status(415).json({ error: refusal.message, code: refusal.code })\n    }\n\n    /**\n     * SVG sanitization. Structural inspection cannot do this: an\n     * SVG is text, it has no magic number, and a `<script>` in one is a\n     * perfectly well-formed document.\n     *\n     * It matters more here than on the DAM routes, not less. Those serve\n     * through `serveMediaCdn`, which stamps `nosniff` and a `sandbox` CSP on\n     * every response and so contains a scripted SVG even if it is stored. The\n     * URL this mints points straight at `firebasestorage.googleapis.com` and\n     * gets neither header — and it is the `og:image` an unauthenticated\n     * unfurler fetches and the picture on the cross-org browse grid, so the\n     * audience is every other publisher's browser rather than the uploader's\n     * own.\n     */\n    const bytes = isSvgUploadType(contentType)\n      ? sanitizeSvgBuffer(buffer).buffer\n      : buffer\n\n    const token = randomUUID()\n    await file.save(bytes, {\n      contentType,\n      metadata: { metadata: { firebaseStorageDownloadTokens: token } },\n    })\n    const url =\n      `https://firebasestorage.googleapis.com/v0/b/${bucket.name}/o/` +\n      `${encodeURIComponent(PREVIEW_PATH(listingId))}` +\n      `?alt=media&token=${token}`\n\n    await listingRef.set(\n      {\n        previewImageUrl: url,\n        updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n    return res.status(200).json({ url })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Upload failed' })\n  }\n}\n\nexport default previewImageHandler\n"],"names":["isFirstPartyMediaSrc","isImageUploadContentType","normalizeImageContentType","isSvgUploadType","sanitizeSvgBuffer","inspectUploadBytes","firebaseAdmin","isImpersonationSession","randomUUID","canActAsPublisher","MAX_FILE_BYTES","PREVIEW_PATH","listingId","previewImageHandler","req","res","method","status","json","error","String","body","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","email_verified","reason","firestore","listingRef","collection","doc","listingSnapshot","get","exists","canEdit","uid","bucket","storage","process","env","NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET","file","delete","catch","set","previewImageUrl","FieldValue","updatedAt","serverTimestamp","merge","deleted","providedUrl","url","trim","contentType","data","buffer","Buffer","from","refusal","bytes","fileName","message","code","token","save","metadata","firebaseStorageDownloadTokens","name","encodeURIComponent","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,mCAAkC;AACvE,SACEC,wBAAwB,EACxBC,yBAAyB,QACpB,4CAA2C;AAClD,SACEC,eAAe,EACfC,iBAAiB,QACZ,sCAAqC;AAC5C,SAASC,kBAAkB,QAA+B,sBAAqB;AAC/E,SAASC,aAAa,EAAEC,sBAAsB,QAAQ,2BAA0B;AAChF,SAASC,UAAU,QAAQ,SAAQ;AACnC,SAASC,iBAAiB,QAAQ,yBAAqB;AAEvD,gEAAgE;AAChE,MAAMC,iBAAiB,IAAI,OAAO;AAElC,MAAMC,eAAe,CAACC,YACpB,CAAC,oBAAoB,EAAEA,UAAU,QAAQ,CAAC;AAE5C;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMC,sBAAwC,OAAOC,KAAKC;cAOlCD;QAHJA;IAHzB,IAAIA,IAAIE,MAAM,KAAK,UAAUF,IAAIE,MAAM,KAAK,UAAU;QACpD,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMP,YAAYQ,gBAAON,YAAAA,IAAIO,IAAI,qBAARP,UAAUF,SAAS,mBAAI;IAChD,IAAI,CAACA,WAAW,OAAOG,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAoB;IAEzE,MAAMG,gBAAgBF,QAAON,6BAAAA,IAAIS,OAAO,CAACD,aAAa,YAAzBR,6BAA6B;IAC1D,MAAMU,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOT,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;;YAuDyBL,YAmBmBA,YAC1BA,YAqCDA;QA/GnB,MAAMe,UAAU,MAAMvB,cAAcwB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,IAAI,CAACK,QAAQI,cAAc,IAAI,CAAC1B,uBAAuBsB,UAAU;YAC/D,OAAOd,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;gBACPe,QAAQ;YACV;QACF;QACA,MAAMC,YAAY7B,cAAcwB,GAAG,GAAGK,SAAS;QAC/C,MAAMC,aAAaD,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAAC1B;QACnE,MAAM2B,kBAAkB,MAAMH,WAAWI,GAAG;QAC5C,IAAI,CAACD,gBAAgBE,MAAM,EAAE;YAC3B,OAAO1B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkB;QACzD;QACA,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,MAAMuB,UAAU,MAAMjC,kBACpB0B,WACAN,QAAQc,GAAG,EACXJ,gBAAgBC,GAAG,CAAC;QAEtB,IAAI,CAACE,SAAS;YACZ,OAAO3B,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAmB;QAC1D;QACA,MAAMyB,SAAStC,cACZwB,GAAG,GACHe,OAAO,GACPD,MAAM,CAACE,QAAQC,GAAG,CAACC,mCAAmC;QACzD,MAAMC,OAAOL,OAAOK,IAAI,CAACtC,aAAaC;QAEtC,IAAIE,IAAIE,MAAM,KAAK,UAAU;YAC3B,MAAMiC,KAAKC,MAAM,GAAGC,KAAK,CAAC,IAAMvB;YAChC,MAAMQ,WAAWgB,GAAG,CAClB;gBACEC,iBAAiB/C,cAAc6B,SAAS,CAACmB,UAAU,CAACJ,MAAM;gBAC1DK,WAAWjD,cAAc6B,SAAS,CAACmB,UAAU,CAACE,eAAe;YAC/D,GACA;gBAAEC,OAAO;YAAK;YAEhB,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEwC,SAAS;YAAK;QAC9C;QAEA,0EAA0E;QAC1E,wEAAwE;QACxE,4EAA4E;QAC5E,yBAAyB;QACzB,EAAE;QACF,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,MAAMC,cAAcvC,iBAAON,aAAAA,IAAIO,IAAI,qBAARP,WAAU8C,GAAG,oBAAI,IAAIC,IAAI;QACpD,IAAIF,aAAa;YACf,IAAIA,YAAYhC,MAAM,GAAG,QAAQ,CAAC3B,qBAAqB2D,cAAc;gBACnE,OAAO5C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OACE,qEACA;gBACJ;YACF;YACA,MAAMiB,WAAWgB,GAAG,CAClB;gBACEC,iBAAiBM;gBACjBJ,WAAWjD,cAAc6B,SAAS,CAACmB,UAAU,CAACE,eAAe;YAC/D,GACA;gBAAEC,OAAO;YAAK;YAEhB,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAE0C,KAAKD;YAAY;QACjD;QAEA,MAAMG,cAAc5D,2BAA0BY,aAAAA,IAAIO,IAAI,qBAARP,WAAUgD,WAAW;QACnE,MAAMC,OAAO3C,iBAAON,aAAAA,IAAIO,IAAI,qBAARP,WAAUiD,IAAI,oBAAI;QACtC,6DAA6D;QAC7D,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,SAAS;QACT,IAAI,CAAC9D,yBAAyB6D,cAAc;YAC1C,OAAO/C,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAmC;QACtD;QACA,MAAM6C,SAASC,OAAOC,IAAI,CAACH,MAAM;QACjC,IAAI,CAACC,OAAOrC,MAAM,IAAIqC,OAAOrC,MAAM,GAAGjB,gBAAgB;YACpD,OAAOK,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAmC;QACtD;QAEA;;;;;;;;;;;;;;;KAeC,GACD,MAAMgD,UAAU9D,mBAAmB;YACjC+D,OAAOJ;YACPF;YACAO,UAAUjD,iBAAON,aAAAA,IAAIO,IAAI,qBAARP,WAAUuD,QAAQ,oBAAI,OAAO;QAChD;QACA,IAAIF,SAAS;YACX,OAAOpD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOgD,QAAQG,OAAO;gBAAEC,MAAMJ,QAAQI,IAAI;YAAC;QAC3E;QAEA;;;;;;;;;;;;;KAaC,GACD,MAAMH,QAAQjE,gBAAgB2D,eAC1B1D,kBAAkB4D,QAAQA,MAAM,GAChCA;QAEJ,MAAMQ,QAAQhE;QACd,MAAMyC,KAAKwB,IAAI,CAACL,OAAO;YACrBN;YACAY,UAAU;gBAAEA,UAAU;oBAAEC,+BAA+BH;gBAAM;YAAE;QACjE;QACA,MAAMZ,MACJ,CAAC,4CAA4C,EAAEhB,OAAOgC,IAAI,CAAC,GAAG,CAAC,GAC/D,GAAGC,mBAAmBlE,aAAaC,aAAa,GAChD,CAAC,iBAAiB,EAAE4D,OAAO;QAE7B,MAAMpC,WAAWgB,GAAG,CAClB;YACEC,iBAAiBO;YACjBL,WAAWjD,cAAc6B,SAAS,CAACmB,UAAU,CAACE,eAAe;QAC/D,GACA;YAAEC,OAAO;QAAK;QAEhB,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE0C;QAAI;IACpC,EAAE,OAAOzC,OAAO;QACd2D,QAAQ3D,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgB;IACvD;AACF,EAAC;AAED,eAAeN,oBAAmB"}

package/src/lib/server/provenance.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { MarketplaceArtifactType } from '../model/marketplace';
+import { type InstalledFrom } from '@aglyn/aglyn/server';
+/**
+ * The one writer every install route uses to stamp provenance (AGL-1015).
+ *
+ * Shared deliberately: each route stamping its own shape is how the marketplace
+ * ended up with four different provenance fields and no snapshot, and how
+ * AGL-1006 came to depend on a mirror nobody wrote. There is one shape because
+ * there is one function producing it.
+ */
+/** Content hash of an artifact, stable across field ordering. */
+export declare function artifactContentHash(content: unknown): string;
+/**
+ * The same stamp for an artifact that is already content-addressed elsewhere —
+ * today only plugins, whose bundle bytes live immutably in the artifact bucket
+ * and are integrity-checked at load.
+ *
+ * Copying those bytes into a Firestore base would be a second, weaker copy of
+ * something that already cannot change, so the stamp records the hash and
+ * points at the bundle. It goes through this module anyway so there is exactly
+ * one place the shape is defined.
+ */
+export declare function pinnedProvenance(input: {
+    listingId: string;
+    listing: {
+        profileId?: string;
+    };
+    version: string;
+    sha256: string;
+    artifactType: MarketplaceArtifactType;
+}): InstalledFrom;
+/**
+ * Has this copy been edited since it was installed? (AGL-1018)
+ *
+ * The one question an install route must ask before it overwrites: a copy that
+ * still matches its base can be replaced freely, and one that does not holds
+ * work that replacing would destroy. `false` when there is no base — an install
+ * route cannot refuse everything installed before AGL-1015, and the update
+ * route is where that case is handled honestly.
+ */
+export declare function hasDivergedFromBase(input: {
+    firestore: FirebaseFirestore.Firestore;
+    sha256: unknown;
+    /** The copy's content, in the same shape `recordInstallProvenance` was given. */
+    current: unknown;
+}): Promise<boolean>;
+export interface RecordProvenanceInput {
+    firestore: FirebaseFirestore.Firestore;
+    listingId: string;
+    /** The listing document, for the version and publishing org. */
+    listing: {
+        profileId?: string;
+        latestVersion?: unknown;
+    };
+    /** The version actually installed — not always `listing.latestVersion`. */
+    version: string | number | null | undefined;
+    artifactType: MarketplaceArtifactType;
+    /**
+     * The content as installed, exactly as written to the user's document. What
+     * goes in here is what "reset to the publisher's version" will restore, so it
+     * must be the vendored content and nothing else — no ids, timestamps or
+     * quota-derived fields, which differ per install and would read as user edits.
+     */
+    content: unknown;
+}
+export interface RecordedProvenance {
+    /** Write this onto the installed document. */
+    installedFrom: InstalledFrom;
+    sha256: string;
+    /** False when the content was too large to snapshot; the install still proceeds. */
+    baseStored: boolean;
+}
+/**
+ * Hashes the installed content, stores an immutable base snapshot keyed by that
+ * hash, and returns the stamp to write on the installed document.
+ *
+ * The snapshot is written with `create` and a swallowed failure: the collection
+ * is content-addressed, so a document that already exists holds byte-identical
+ * content and re-installing the same version must reuse it rather than rewrite
+ * it. Nothing here is on the install's critical path — a snapshot that cannot be
+ * written leaves `baseStored: false` and an artifact that reports itself as not
+ * updatable, which is the honest outcome and better than failing the install.
+ */
+export declare function recordInstallProvenance(input: RecordProvenanceInput): Promise<RecordedProvenance>;

package/src/lib/server/provenance.js

@@ -0,0 +1,118 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createHash } from "node:crypto";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { ARTIFACT_BASE_COLLECTION, ARTIFACT_BASE_MAX_BYTES, stableStringify } from "@aglyn/aglyn/server";
+/**
+ * The one writer every install route uses to stamp provenance (AGL-1015).
+ *
+ * Shared deliberately: each route stamping its own shape is how the marketplace
+ * ended up with four different provenance fields and no snapshot, and how
+ * AGL-1006 came to depend on a mirror nobody wrote. There is one shape because
+ * there is one function producing it.
+ */ /** Content hash of an artifact, stable across field ordering. */ export function artifactContentHash(content) {
+    return createHash('sha256').update(stableStringify(content), 'utf8').digest('hex');
+}
+/**
+ * The same stamp for an artifact that is already content-addressed elsewhere —
+ * today only plugins, whose bundle bytes live immutably in the artifact bucket
+ * and are integrity-checked at load.
+ *
+ * Copying those bytes into a Firestore base would be a second, weaker copy of
+ * something that already cannot change, so the stamp records the hash and
+ * points at the bundle. It goes through this module anyway so there is exactly
+ * one place the shape is defined.
+ */ export function pinnedProvenance(input) {
+    var _input_listing_profileId;
+    return {
+        listingId: input.listingId,
+        version: input.version,
+        sha256: input.sha256,
+        artifactType: input.artifactType,
+        installedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),
+        publisherOrgId: (_input_listing_profileId = input.listing.profileId) != null ? _input_listing_profileId : null
+    };
+}
+/**
+ * Has this copy been edited since it was installed? (AGL-1018)
+ *
+ * The one question an install route must ask before it overwrites: a copy that
+ * still matches its base can be replaced freely, and one that does not holds
+ * work that replacing would destroy. `false` when there is no base — an install
+ * route cannot refuse everything installed before AGL-1015, and the update
+ * route is where that case is handled honestly.
+ */ export async function hasDivergedFromBase(input) {
+    const sha256 = typeof input.sha256 === 'string' ? input.sha256 : '';
+    if (!sha256) return false;
+    const snapshot = await input.firestore.collection(ARTIFACT_BASE_COLLECTION).doc(sha256).get().catch(()=>null);
+    if (!(snapshot == null ? void 0 : snapshot.exists)) return false;
+    return stableStringify(snapshot.get('content')) !== stableStringify(input.current);
+}
+/**
+ * Hashes the installed content, stores an immutable base snapshot keyed by that
+ * hash, and returns the stamp to write on the installed document.
+ *
+ * The snapshot is written with `create` and a swallowed failure: the collection
+ * is content-addressed, so a document that already exists holds byte-identical
+ * content and re-installing the same version must reuse it rather than rewrite
+ * it. Nothing here is on the install's critical path — a snapshot that cannot be
+ * written leaves `baseStored: false` and an artifact that reports itself as not
+ * updatable, which is the honest outcome and better than failing the install.
+ */ export async function recordInstallProvenance(input) {
+    var _listing_profileId;
+    const { firestore, listingId, listing, artifactType, content } = input;
+    const version = input.version == null || input.version === '' ? listing.latestVersion == null ? null : String(listing.latestVersion) : String(input.version);
+    const serialized = stableStringify(content);
+    const sha256 = createHash('sha256').update(serialized, 'utf8').digest('hex');
+    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+    let baseStored = false;
+    if (Buffer.byteLength(serialized, 'utf8') <= ARTIFACT_BASE_MAX_BYTES) {
+        const baseRef = firestore.collection(ARTIFACT_BASE_COLLECTION).doc(sha256);
+        try {
+            var _listing_profileId1;
+            await baseRef.create({
+                sha256,
+                artifactType,
+                listingId,
+                version,
+                publisherOrgId: (_listing_profileId1 = listing.profileId) != null ? _listing_profileId1 : null,
+                content,
+                createdAt: now
+            });
+            baseStored = true;
+        } catch (unused) {
+            var _ref;
+            var _this;
+            // Already present (the common case on re-install), or unwritable. Either
+            // way the base is only usable if it is really there, so confirm.
+            baseStored = (_ref = (_this = await baseRef.get().catch(()=>null)) == null ? void 0 : _this.exists) != null ? _ref : false;
+        }
+    }
+    return {
+        sha256,
+        baseStored,
+        installedFrom: {
+            listingId,
+            version,
+            sha256: baseStored ? sha256 : null,
+            artifactType,
+            installedAt: now,
+            publisherOrgId: (_listing_profileId = listing.profileId) != null ? _listing_profileId : null
+        }
+    };
+}
+
+//# sourceMappingURL=provenance.js.map

package/src/lib/server/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/provenance.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createHash } from 'node:crypto'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport type { MarketplaceArtifactType } from '../model/marketplace'\nimport {\n  ARTIFACT_BASE_COLLECTION,\n  ARTIFACT_BASE_MAX_BYTES,\n  type InstalledFrom,\n  stableStringify,\n} from '@aglyn/aglyn/server'\n\n/**\n * The one writer every install route uses to stamp provenance (AGL-1015).\n *\n * Shared deliberately: each route stamping its own shape is how the marketplace\n * ended up with four different provenance fields and no snapshot, and how\n * AGL-1006 came to depend on a mirror nobody wrote. There is one shape because\n * there is one function producing it.\n */\n\n/** Content hash of an artifact, stable across field ordering. */\nexport function artifactContentHash(content: unknown): string {\n  return createHash('sha256').update(stableStringify(content), 'utf8').digest('hex')\n}\n\n/**\n * The same stamp for an artifact that is already content-addressed elsewhere —\n * today only plugins, whose bundle bytes live immutably in the artifact bucket\n * and are integrity-checked at load.\n *\n * Copying those bytes into a Firestore base would be a second, weaker copy of\n * something that already cannot change, so the stamp records the hash and\n * points at the bundle. It goes through this module anyway so there is exactly\n * one place the shape is defined.\n */\nexport function pinnedProvenance(input: {\n  listingId: string\n  listing: { profileId?: string }\n  version: string\n  sha256: string\n  artifactType: MarketplaceArtifactType\n}): InstalledFrom {\n  return {\n    listingId: input.listingId,\n    version: input.version,\n    sha256: input.sha256,\n    artifactType: input.artifactType,\n    installedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n    publisherOrgId: input.listing.profileId ?? null,\n  }\n}\n\n/**\n * Has this copy been edited since it was installed? (AGL-1018)\n *\n * The one question an install route must ask before it overwrites: a copy that\n * still matches its base can be replaced freely, and one that does not holds\n * work that replacing would destroy. `false` when there is no base — an install\n * route cannot refuse everything installed before AGL-1015, and the update\n * route is where that case is handled honestly.\n */\nexport async function hasDivergedFromBase(input: {\n  firestore: FirebaseFirestore.Firestore\n  sha256: unknown\n  /** The copy's content, in the same shape `recordInstallProvenance` was given. */\n  current: unknown\n}): Promise<boolean> {\n  const sha256 = typeof input.sha256 === 'string' ? input.sha256 : ''\n  if (!sha256) return false\n  const snapshot = await input.firestore\n    .collection(ARTIFACT_BASE_COLLECTION)\n    .doc(sha256)\n    .get()\n    .catch(() => null)\n  if (!snapshot?.exists) return false\n  return stableStringify(snapshot.get('content')) !== stableStringify(input.current)\n}\n\nexport interface RecordProvenanceInput {\n  firestore: FirebaseFirestore.Firestore\n  listingId: string\n  /** The listing document, for the version and publishing org. */\n  listing: { profileId?: string; latestVersion?: unknown }\n  /** The version actually installed — not always `listing.latestVersion`. */\n  version: string | number | null | undefined\n  artifactType: MarketplaceArtifactType\n  /**\n   * The content as installed, exactly as written to the user's document. What\n   * goes in here is what \"reset to the publisher's version\" will restore, so it\n   * must be the vendored content and nothing else — no ids, timestamps or\n   * quota-derived fields, which differ per install and would read as user edits.\n   */\n  content: unknown\n}\n\nexport interface RecordedProvenance {\n  /** Write this onto the installed document. */\n  installedFrom: InstalledFrom\n  sha256: string\n  /** False when the content was too large to snapshot; the install still proceeds. */\n  baseStored: boolean\n}\n\n/**\n * Hashes the installed content, stores an immutable base snapshot keyed by that\n * hash, and returns the stamp to write on the installed document.\n *\n * The snapshot is written with `create` and a swallowed failure: the collection\n * is content-addressed, so a document that already exists holds byte-identical\n * content and re-installing the same version must reuse it rather than rewrite\n * it. Nothing here is on the install's critical path — a snapshot that cannot be\n * written leaves `baseStored: false` and an artifact that reports itself as not\n * updatable, which is the honest outcome and better than failing the install.\n */\nexport async function recordInstallProvenance(\n  input: RecordProvenanceInput,\n): Promise<RecordedProvenance> {\n  const { firestore, listingId, listing, artifactType, content } = input\n  const version =\n    input.version == null || input.version === ''\n      ? (listing.latestVersion == null ? null : String(listing.latestVersion))\n      : String(input.version)\n  const serialized = stableStringify(content)\n  const sha256 = createHash('sha256').update(serialized, 'utf8').digest('hex')\n  const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n\n  let baseStored = false\n  if (Buffer.byteLength(serialized, 'utf8') <= ARTIFACT_BASE_MAX_BYTES) {\n    const baseRef = firestore.collection(ARTIFACT_BASE_COLLECTION).doc(sha256)\n    try {\n      await baseRef.create({\n        sha256,\n        artifactType,\n        listingId,\n        version,\n        publisherOrgId: listing.profileId ?? null,\n        content,\n        createdAt: now,\n      })\n      baseStored = true\n    } catch {\n      // Already present (the common case on re-install), or unwritable. Either\n      // way the base is only usable if it is really there, so confirm.\n      baseStored = (await baseRef.get().catch(() => null))?.exists ?? false\n    }\n  }\n\n  return {\n    sha256,\n    baseStored,\n    installedFrom: {\n      listingId,\n      version,\n      sha256: baseStored ? sha256 : null,\n      artifactType,\n      installedAt: now,\n      publisherOrgId: listing.profileId ?? null,\n    },\n  }\n}\n"],"names":["createHash","firebaseAdmin","ARTIFACT_BASE_COLLECTION","ARTIFACT_BASE_MAX_BYTES","stableStringify","artifactContentHash","content","update","digest","pinnedProvenance","input","listingId","version","sha256","artifactType","installedAt","firestore","FieldValue","serverTimestamp","publisherOrgId","listing","profileId","hasDivergedFromBase","snapshot","collection","doc","get","catch","exists","current","recordInstallProvenance","latestVersion","String","serialized","now","baseStored","Buffer","byteLength","baseRef","create","createdAt","installedFrom"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,cAAa;AACxC,SAASC,aAAa,QAAQ,2BAA0B;AAExD,SACEC,wBAAwB,EACxBC,uBAAuB,EAEvBC,eAAe,QACV,sBAAqB;AAE5B;;;;;;;CAOC,GAED,+DAA+D,GAC/D,OAAO,SAASC,oBAAoBC,OAAgB;IAClD,OAAON,WAAW,UAAUO,MAAM,CAACH,gBAAgBE,UAAU,QAAQE,MAAM,CAAC;AAC9E;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASC,iBAAiBC,KAMhC;QAOmBA;IANlB,OAAO;QACLC,WAAWD,MAAMC,SAAS;QAC1BC,SAASF,MAAME,OAAO;QACtBC,QAAQH,MAAMG,MAAM;QACpBC,cAAcJ,MAAMI,YAAY;QAChCC,aAAad,cAAce,SAAS,CAACC,UAAU,CAACC,eAAe;QAC/DC,cAAc,GAAET,2BAAAA,MAAMU,OAAO,CAACC,SAAS,YAAvBX,2BAA2B;IAC7C;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeY,oBAAoBZ,KAKzC;IACC,MAAMG,SAAS,OAAOH,MAAMG,MAAM,KAAK,WAAWH,MAAMG,MAAM,GAAG;IACjE,IAAI,CAACA,QAAQ,OAAO;IACpB,MAAMU,WAAW,MAAMb,MAAMM,SAAS,CACnCQ,UAAU,CAACtB,0BACXuB,GAAG,CAACZ,QACJa,GAAG,GACHC,KAAK,CAAC,IAAM;IACf,IAAI,EAACJ,4BAAAA,SAAUK,MAAM,GAAE,OAAO;IAC9B,OAAOxB,gBAAgBmB,SAASG,GAAG,CAAC,gBAAgBtB,gBAAgBM,MAAMmB,OAAO;AACnF;AA2BA;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,wBACpBpB,KAA4B;QAyCRU;IAvCpB,MAAM,EAAEJ,SAAS,EAAEL,SAAS,EAAES,OAAO,EAAEN,YAAY,EAAER,OAAO,EAAE,GAAGI;IACjE,MAAME,UACJF,MAAME,OAAO,IAAI,QAAQF,MAAME,OAAO,KAAK,KACtCQ,QAAQW,aAAa,IAAI,OAAO,OAAOC,OAAOZ,QAAQW,aAAa,IACpEC,OAAOtB,MAAME,OAAO;IAC1B,MAAMqB,aAAa7B,gBAAgBE;IACnC,MAAMO,SAASb,WAAW,UAAUO,MAAM,CAAC0B,YAAY,QAAQzB,MAAM,CAAC;IACtE,MAAM0B,MAAMjC,cAAce,SAAS,CAACC,UAAU,CAACC,eAAe;IAE9D,IAAIiB,aAAa;IACjB,IAAIC,OAAOC,UAAU,CAACJ,YAAY,WAAW9B,yBAAyB;QACpE,MAAMmC,UAAUtB,UAAUQ,UAAU,CAACtB,0BAA0BuB,GAAG,CAACZ;QACnE,IAAI;gBAMgBO;YALlB,MAAMkB,QAAQC,MAAM,CAAC;gBACnB1B;gBACAC;gBACAH;gBACAC;gBACAO,cAAc,GAAEC,sBAAAA,QAAQC,SAAS,YAAjBD,sBAAqB;gBACrCd;gBACAkC,WAAWN;YACb;YACAC,aAAa;QACf,EAAE,eAAM;;gBAGQ;YAFd,yEAAyE;YACzE,iEAAiE;YACjEA,sBAAc,QAAA,MAAMG,QAAQZ,GAAG,GAAGC,KAAK,CAAC,IAAM,0BAAjC,AAAC,MAAwCC,MAAM,mBAAI;QAClE;IACF;IAEA,OAAO;QACLf;QACAsB;QACAM,eAAe;YACb9B;YACAC;YACAC,QAAQsB,aAAatB,SAAS;YAC9BC;YACAC,aAAamB;YACbf,cAAc,GAAEC,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqB;QACvC;IACF;AACF"}

package/src/lib/server/publish-dataset-schema.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Publishes an org dataset's SCHEMA to the marketplace (AGL-657).
+ *
+ * Unlike every other publish route this one takes an `orgId` rather than a
+ * `hostId`: datasets live at `orgs/{orgId}/datasets/{id}` and are org-shared
+ * (AGL-237), so there is no source site to derive the org from. The role gate
+ * goes through `resolveOrgPermissions` directly for the same reason.
+ *
+ * Records NEVER travel — `sanitizeDatasetSchema` reads the model and this
+ * handler never touches the `records` subcollection. A dataset's rows are the
+ * org's customer data; only the shape is publishable.
+ */
+export declare const publishDatasetSchemaHandler: PluginApiHandler;
+export default publishDatasetSchemaHandler;