@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/publish-email-template.js

@@ -0,0 +1,211 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement, createResourceUid, decodeStoredNodes } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { EMAIL_NODE_ROOT_ID, getTenantEmail, isTenantEmailEditable, TENANT_EMAIL_COLLECTION } from "@aglyn/shared-util-email";
+import { MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST, marketplacePriceRefusal, sanitizeMarketplaceDefinition } from "../model/index.js";
+import { resolvePublisherProfile } from "./publisher-profile.js";
+import { publishPreconditionRefusal } from "./publish-preconditions.js";
+/**
+ * Publishes a site's designed transactional email to the marketplace
+ * (AGL-657).
+ *
+ * An email design is a node tree like any other artifact, but it does NOT live
+ * in the host's screen routing map — which is exactly why `publish-template`
+ * could never capture one (it only sees `hostSnapshot.get('screens')`). The
+ * tree lives at `hosts/{h}/emailTemplates/{key}/versions/{versionId}`, so this
+ * reads it directly.
+ *
+ * `templateKey` is a fixed catalog key ('booking-confirmed', …), not a free
+ * id: a published email means "a design FOR this transactional email", so the
+ * key travels with the listing and the installer lands on the same key.
+ */ export const publishEmailTemplateHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _ref3, _ref4, _ref5, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2, _req_body3, _req_body4, _req_body5;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const templateKey = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.templateKey) != null ? _ref1 : '');
+    const displayName = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.displayName) != null ? _ref2 : '').slice(0, 80);
+    const description = String((_ref3 = (_req_body3 = req.body) == null ? void 0 : _req_body3.description) != null ? _ref3 : '').slice(0, 500);
+    const category = String((_ref4 = (_req_body4 = req.body) == null ? void 0 : _req_body4.category) != null ? _ref4 : '').slice(0, 40);
+    const priceUsd = Math.round(Number((_ref5 = (_req_body5 = req.body) == null ? void 0 : _req_body5.priceUsd) != null ? _ref5 : 0)) || 0;
+    // The price floor and ceiling, from ONE validator (AGL-2343): a paid listing
+    // under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because
+    // marketplace checkout is a destination charge whose Stripe fee is debited
+    // from the platform's balance. Also enforced in `publishPreconditionRefusal`
+    // below, so a door that drops this line is still covered.
+    const priceRefusal = marketplacePriceRefusal(priceUsd);
+    if (priceRefusal) {
+        return res.status(400).json({
+            error: priceRefusal
+        });
+    }
+    if (!hostId || !templateKey || !displayName.trim()) {
+        return res.status(400).json({
+            error: 'Missing hostId, templateKey, or displayName'
+        });
+    }
+    const entry = getTenantEmail(templateKey);
+    if (!entry || !isTenantEmailEditable(entry)) {
+        return res.status(400).json({
+            error: 'Not a designable email template'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _ref6, _versionSnapshot_get, _existing_docs__get, _templateSnapshot_get, _templateSnapshot_get1;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.publishToMarketplace) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow publishing to the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        const orgForHost = await getOrgForHost(hostId);
+        if (!checkEntitlement((_ref6 = orgForHost == null ? void 0 : orgForHost.org) != null ? _ref6 : {}, 'marketplaceSelling')) {
+            return res.status(403).json({
+                error: 'Publishing to the marketplace requires a Pro plan'
+            });
+        }
+        if (!(orgForHost == null ? void 0 : orgForHost.orgId)) {
+            return res.status(409).json({
+                error: 'Site has no owning organization'
+            });
+        }
+        const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId);
+        // Profile, payouts AND the publisher agreement, in one gate
+        // (AGL-2282) — see `publishPreconditionRefusal`.
+        const refusal = publishPreconditionRefusal(publisher, {
+            priceUsd,
+            sells: 'templates'
+        });
+        if (refusal) return res.status(refusal.status).json(refusal.body);
+        const templateRef = hostRef.collection(TENANT_EMAIL_COLLECTION).doc(templateKey);
+        const templateSnapshot = await templateRef.get();
+        const activeVersionId = templateSnapshot.get('versionId');
+        if (!templateSnapshot.exists || !activeVersionId) {
+            return res.status(404).json({
+                error: 'This email has no published design yet — design and save it first'
+            });
+        }
+        const versionSnapshot = await templateRef.collection('versions').doc(String(activeVersionId)).get();
+        // Decoded, like the screen and layout publish paths (AGL-1395): the email
+        // besigner now compresses through a converter as those do, and versions
+        // written before it did are still plain maps, which come back unchanged.
+        //
+        // `sanitizeMarketplaceDefinition` below would refuse an undecoded tree
+        // rather than publish garbage, so this is the difference between the
+        // feature working and a publish that always says the design is invalid.
+        const nodes = decodeStoredNodes(versionSnapshot.get('nodes'));
+        if (!nodes || !Object.keys(nodes).length) {
+            return res.status(404).json({
+                error: 'This email design is empty'
+            });
+        }
+        // Emails are built from `plugins-email` blocks only, so the page allowlist
+        // is REPLACED rather than extended — see MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST
+        // for why `emailHtml` is not on the list.
+        const rootId = (_versionSnapshot_get = versionSnapshot.get('rootId')) != null ? _versionSnapshot_get : EMAIL_NODE_ROOT_ID;
+        const sanitized = sanitizeMarketplaceDefinition({
+            rootId,
+            nodes
+        }, {
+            componentIds: MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST
+        });
+        if (sanitized.ok === false) {
+            return res.status(422).json({
+                error: sanitized.error
+            });
+        }
+        // One listing per (source site, template key).
+        const existing = await firestore.collection('marketplaceListings').where('profileId', '==', publisher.orgId).where('sourceHostId', '==', hostId).where('emailTemplateKey', '==', templateKey).limit(1).get();
+        const listingRef = existing.empty ? firestore.collection('marketplaceListings').doc(createResourceUid()) : existing.docs[0].ref;
+        const version = existing.empty ? 1 : Number((_existing_docs__get = existing.docs[0].get('latestVersion')) != null ? _existing_docs__get : 0) + 1;
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        await listingRef.set(_extends({
+            profileId: publisher.orgId,
+            artifactType: 'emailTemplate',
+            sourceHostId: hostId,
+            emailTemplateKey: templateKey,
+            displayName: displayName.trim()
+        }, description.trim() && {
+            description: description.trim()
+        }, category.trim() && {
+            category: category.trim()
+        }, {
+            priceUsd,
+            latestVersion: version,
+            deletedAt: null
+        }, existing.empty && {
+            createdAt: now
+        }, {
+            updatedAt: now,
+            versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({
+                version,
+                publishedAt: firebaseAdmin.firestore.Timestamp.now()
+            })
+        }), {
+            merge: true
+        });
+        await listingRef.collection('versions').doc(String(version)).set({
+            rootId: sanitized.rootId,
+            nodes: sanitized.nodes,
+            emailTemplateKey: templateKey,
+            // The copy fields are part of the design, not the tree.
+            subject: String((_templateSnapshot_get = templateSnapshot.get('subject')) != null ? _templateSnapshot_get : ''),
+            preheader: String((_templateSnapshot_get1 = templateSnapshot.get('preheader')) != null ? _templateSnapshot_get1 : ''),
+            publishedAt: now
+        });
+        return res.status(200).json({
+            listingId: listingRef.id,
+            version
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Publish failed'
+        });
+    }
+};
+export default publishEmailTemplateHandler;
+
+//# sourceMappingURL=publish-email-template.js.map

package/src/lib/server/publish-email-template.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publish-email-template.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkEntitlement,\n  createResourceUid,\n  decodeStoredNodes,\n} from '@aglyn/aglyn/server'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  EMAIL_NODE_ROOT_ID,\n  getTenantEmail,\n  isTenantEmailEditable,\n  TENANT_EMAIL_COLLECTION,\n} from '@aglyn/shared-util-email'\nimport {\n  MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST,\n  marketplacePriceRefusal,\n  sanitizeMarketplaceDefinition,\n} from '../model'\nimport { resolvePublisherProfile } from './publisher-profile'\nimport { publishPreconditionRefusal } from './publish-preconditions'\n\n/**\n * Publishes a site's designed transactional email to the marketplace\n * (AGL-657).\n *\n * An email design is a node tree like any other artifact, but it does NOT live\n * in the host's screen routing map — which is exactly why `publish-template`\n * could never capture one (it only sees `hostSnapshot.get('screens')`). The\n * tree lives at `hosts/{h}/emailTemplates/{key}/versions/{versionId}`, so this\n * reads it directly.\n *\n * `templateKey` is a fixed catalog key ('booking-confirmed', …), not a free\n * id: a published email means \"a design FOR this transactional email\", so the\n * key travels with the listing and the installer lands on the same key.\n */\nexport const publishEmailTemplateHandler: PluginApiHandler = async (\n  req,\n  res,\n) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const templateKey = String(req.body?.templateKey ?? '')\n  const displayName = String(req.body?.displayName ?? '').slice(0, 80)\n  const description = String(req.body?.description ?? '').slice(0, 500)\n  const category = String(req.body?.category ?? '').slice(0, 40)\n  const priceUsd = Math.round(Number(req.body?.priceUsd ?? 0)) || 0\n  // The price floor and ceiling, from ONE validator (AGL-2343): a paid listing\n  // under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because\n  // marketplace checkout is a destination charge whose Stripe fee is debited\n  // from the platform's balance. Also enforced in `publishPreconditionRefusal`\n  // below, so a door that drops this line is still covered.\n  const priceRefusal = marketplacePriceRefusal(priceUsd)\n  if (priceRefusal) {\n    return res.status(400).json({ error: priceRefusal })\n  }\n  if (!hostId || !templateKey || !displayName.trim()) {\n    return res\n      .status(400)\n      .json({ error: 'Missing hostId, templateKey, or displayName' })\n  }\n  const entry = getTenantEmail(templateKey)\n  if (!entry || !isTenantEmailEditable(entry)) {\n    return res.status(400).json({ error: 'Not a designable email template' })\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.publishToMarketplace) {\n      return res.status(403).json({\n        error:\n          'Your organization role does not allow publishing to the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n\n    const orgForHost = await getOrgForHost(hostId)\n    if (!checkEntitlement(orgForHost?.org ?? {}, 'marketplaceSelling')) {\n      return res\n        .status(403)\n        .json({ error: 'Publishing to the marketplace requires a Pro plan' })\n    }\n    if (!orgForHost?.orgId) {\n      return res.status(409).json({ error: 'Site has no owning organization' })\n    }\n\n    const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId)\n    // Profile, payouts AND the publisher agreement, in one gate\n    // (AGL-2282) — see `publishPreconditionRefusal`.\n    const refusal = publishPreconditionRefusal(publisher, {\n      priceUsd,\n      sells: 'templates',\n    })\n    if (refusal) return res.status(refusal.status).json(refusal.body)\n\n    const templateRef = hostRef\n      .collection(TENANT_EMAIL_COLLECTION)\n      .doc(templateKey)\n    const templateSnapshot = await templateRef.get()\n    const activeVersionId = templateSnapshot.get('versionId')\n    if (!templateSnapshot.exists || !activeVersionId) {\n      return res.status(404).json({\n        error: 'This email has no published design yet — design and save it first',\n      })\n    }\n    const versionSnapshot = await templateRef\n      .collection('versions')\n      .doc(String(activeVersionId))\n      .get()\n    // Decoded, like the screen and layout publish paths (AGL-1395): the email\n    // besigner now compresses through a converter as those do, and versions\n    // written before it did are still plain maps, which come back unchanged.\n    //\n    // `sanitizeMarketplaceDefinition` below would refuse an undecoded tree\n    // rather than publish garbage, so this is the difference between the\n    // feature working and a publish that always says the design is invalid.\n    const nodes = decodeStoredNodes<Record<string, any>>(\n      versionSnapshot.get('nodes'),\n    )\n    if (!nodes || !Object.keys(nodes).length) {\n      return res.status(404).json({ error: 'This email design is empty' })\n    }\n    // Emails are built from `plugins-email` blocks only, so the page allowlist\n    // is REPLACED rather than extended — see MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST\n    // for why `emailHtml` is not on the list.\n    const rootId = versionSnapshot.get('rootId') ?? EMAIL_NODE_ROOT_ID\n    const sanitized = sanitizeMarketplaceDefinition(\n      { rootId, nodes },\n      { componentIds: MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST },\n    )\n    if (sanitized.ok === false) {\n      return res.status(422).json({ error: sanitized.error })\n    }\n\n    // One listing per (source site, template key).\n    const existing = await firestore\n      .collection('marketplaceListings')\n      .where('profileId', '==', publisher.orgId)\n      .where('sourceHostId', '==', hostId)\n      .where('emailTemplateKey', '==', templateKey)\n      .limit(1)\n      .get()\n    const listingRef = existing.empty\n      ? firestore.collection('marketplaceListings').doc(createResourceUid())\n      : existing.docs[0].ref\n    const version = existing.empty\n      ? 1\n      : Number(existing.docs[0].get('latestVersion') ?? 0) + 1\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n\n    await listingRef.set(\n      {\n        profileId: publisher.orgId,\n        artifactType: 'emailTemplate',\n        sourceHostId: hostId,\n        emailTemplateKey: templateKey,\n        displayName: displayName.trim(),\n        ...(description.trim() && { description: description.trim() }),\n        ...(category.trim() && { category: category.trim() }),\n        priceUsd,\n        latestVersion: version,\n        deletedAt: null,\n        ...(existing.empty && { createdAt: now }),\n        updatedAt: now,\n        versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({\n          version,\n          publishedAt: firebaseAdmin.firestore.Timestamp.now(),\n        }),\n      },\n      { merge: true },\n    )\n    await listingRef\n      .collection('versions')\n      .doc(String(version))\n      .set({\n        rootId: sanitized.rootId,\n        nodes: sanitized.nodes,\n        emailTemplateKey: templateKey,\n        // The copy fields are part of the design, not the tree.\n        subject: String(templateSnapshot.get('subject') ?? ''),\n        preheader: String(templateSnapshot.get('preheader') ?? ''),\n        publishedAt: now,\n      })\n\n    return res.status(200).json({ listingId: listingRef.id, version })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Publish failed' })\n  }\n}\n\nexport default publishEmailTemplateHandler\n"],"names":["checkEntitlement","createResourceUid","decodeStoredNodes","firebaseAdmin","getOrgForHost","resolveOrgPermissions","EMAIL_NODE_ROOT_ID","getTenantEmail","isTenantEmailEditable","TENANT_EMAIL_COLLECTION","MARKETPLACE_EMAIL_COMPONENT_ID_ALLOWLIST","marketplacePriceRefusal","sanitizeMarketplaceDefinition","resolvePublisherProfile","publishPreconditionRefusal","publishEmailTemplateHandler","req","res","method","status","json","error","hostId","String","body","templateKey","displayName","slice","description","category","priceUsd","Math","round","Number","priceRefusal","trim","entry","authorization","headers","idToken","startsWith","length","undefined","hostSnapshot","versionSnapshot","existing","templateSnapshot","decoded","app","auth","verifyIdToken","membership","uid","permissions","publishToMarketplace","firestore","hostRef","collection","doc","get","exists","memberRole","orgForHost","org","orgId","publisher","refusal","sells","templateRef","activeVersionId","nodes","Object","keys","rootId","sanitized","componentIds","ok","where","limit","listingRef","empty","docs","ref","version","now","FieldValue","serverTimestamp","set","profileId","artifactType","sourceHostId","emailTemplateKey","latestVersion","deletedAt","createdAt","updatedAt","versionHistory","arrayUnion","publishedAt","Timestamp","merge","subject","preheader","listingId","id","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,iBAAiB,EACjBC,iBAAiB,QACZ,sBAAqB;AAE5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,kBAAkB,EAClBC,cAAc,EACdC,qBAAqB,EACrBC,uBAAuB,QAClB,2BAA0B;AACjC,SACEC,wCAAwC,EACxCC,uBAAuB,EACvBC,6BAA6B,QACxB,oBAAU;AACjB,SAASC,uBAAuB,QAAQ,yBAAqB;AAC7D,SAASC,0BAA0B,QAAQ,6BAAyB;AAEpE;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,8BAAgD,OAC3DC,KACAC;iDA8B6BD;QAzBPA,WACKA,YACAA,YACAA,YACHA,YACWA;IARnC,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,cAAcF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,WAAW,oBAAI;IACpD,MAAMC,cAAcH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUU,WAAW,oBAAI,IAAIC,KAAK,CAAC,GAAG;IACjE,MAAMC,cAAcL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,WAAW,oBAAI,IAAID,KAAK,CAAC,GAAG;IACjE,MAAME,WAAWN,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,QAAQ,oBAAI,IAAIF,KAAK,CAAC,GAAG;IAC3D,MAAMG,WAAWC,KAAKC,KAAK,CAACC,iBAAOjB,aAAAA,IAAIQ,IAAI,qBAARR,WAAUc,QAAQ,oBAAI,OAAO;IAChE,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAMI,eAAevB,wBAAwBmB;IAC7C,IAAII,cAAc;QAChB,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOa;QAAa;IACpD;IACA,IAAI,CAACZ,UAAU,CAACG,eAAe,CAACC,YAAYS,IAAI,IAAI;QAClD,OAAOlB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAA8C;IACjE;IACA,MAAMe,QAAQ7B,eAAekB;IAC7B,IAAI,CAACW,SAAS,CAAC5B,sBAAsB4B,QAAQ;QAC3C,OAAOnB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IACzE;IAEA,MAAMgB,gBAAgBd,QAAOP,6BAAAA,IAAIsB,OAAO,CAACD,aAAa,YAAzBrB,6BAA6B;IAC1D,MAAMuB,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcV,KAAK,CAAC,UAAUc,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAOtB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAekBsB,0BAsDLC,sBAsBJC,qBAgCSC,uBACEA;QA3HtB,MAAMC,UAAU,MAAM5C,cAAc6C,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACX;QAC/D,MAAMY,aAAa,MAAM9C,sBAAsB0C,QAAQK,GAAG,EAAE;YAAE9B;QAAO;QACrE,IAAI,CAAC6B,WAAWE,WAAW,CAACC,oBAAoB,EAAE;YAChD,OAAOrC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAMkC,YAAYpD,cAAc6C,GAAG,GAAGO,SAAS;QAC/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACpC;QAClD,MAAMqB,eAAe,MAAMa,QAAQG,GAAG;QACtC,IAAI,CAAChB,aAAaiB,MAAM,EAAE;YACxB,OAAO3C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAMwC,aAAa,EAAClB,oBAAAA,aAAagB,GAAG,CAAC,0BAAjBhB,oBAAmC,CAAC,EAAE,CAACI,QAAQK,GAAG,CAAC;QACvE,IAAIS,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAO5C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QAEA,MAAMyC,aAAa,MAAM1D,cAAckB;QACvC,IAAI,CAACtB,0BAAiB8D,8BAAAA,WAAYC,GAAG,oBAAI,CAAC,GAAG,uBAAuB;YAClE,OAAO9C,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAoD;QACvE;QACA,IAAI,EAACyC,8BAAAA,WAAYE,KAAK,GAAE;YACtB,OAAO/C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;QACzE;QAEA,MAAM4C,YAAY,MAAMpD,wBAAwB0C,WAAWO,WAAWE,KAAK;QAC3E,4DAA4D;QAC5D,iDAAiD;QACjD,MAAME,UAAUpD,2BAA2BmD,WAAW;YACpDnC;YACAqC,OAAO;QACT;QACA,IAAID,SAAS,OAAOjD,IAAIE,MAAM,CAAC+C,QAAQ/C,MAAM,EAAEC,IAAI,CAAC8C,QAAQ1C,IAAI;QAEhE,MAAM4C,cAAcZ,QACjBC,UAAU,CAAChD,yBACXiD,GAAG,CAACjC;QACP,MAAMqB,mBAAmB,MAAMsB,YAAYT,GAAG;QAC9C,MAAMU,kBAAkBvB,iBAAiBa,GAAG,CAAC;QAC7C,IAAI,CAACb,iBAAiBc,MAAM,IAAI,CAACS,iBAAiB;YAChD,OAAOpD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,MAAMuB,kBAAkB,MAAMwB,YAC3BX,UAAU,CAAC,YACXC,GAAG,CAACnC,OAAO8C,kBACXV,GAAG;QACN,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,MAAMW,QAAQpE,kBACZ0C,gBAAgBe,GAAG,CAAC;QAEtB,IAAI,CAACW,SAAS,CAACC,OAAOC,IAAI,CAACF,OAAO7B,MAAM,EAAE;YACxC,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QACA,2EAA2E;QAC3E,kFAAkF;QAClF,0CAA0C;QAC1C,MAAMoD,UAAS7B,uBAAAA,gBAAgBe,GAAG,CAAC,qBAApBf,uBAAiCtC;QAChD,MAAMoE,YAAY9D,8BAChB;YAAE6D;YAAQH;QAAM,GAChB;YAAEK,cAAcjE;QAAyC;QAE3D,IAAIgE,UAAUE,EAAE,KAAK,OAAO;YAC1B,OAAO3D,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOqD,UAAUrD,KAAK;YAAC;QACvD;QAEA,+CAA+C;QAC/C,MAAMwB,WAAW,MAAMU,UACpBE,UAAU,CAAC,uBACXoB,KAAK,CAAC,aAAa,MAAMZ,UAAUD,KAAK,EACxCa,KAAK,CAAC,gBAAgB,MAAMvD,QAC5BuD,KAAK,CAAC,oBAAoB,MAAMpD,aAChCqD,KAAK,CAAC,GACNnB,GAAG;QACN,MAAMoB,aAAalC,SAASmC,KAAK,GAC7BzB,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAACzD,uBAChD4C,SAASoC,IAAI,CAAC,EAAE,CAACC,GAAG;QACxB,MAAMC,UAAUtC,SAASmC,KAAK,GAC1B,IACA/C,QAAOY,sBAAAA,SAASoC,IAAI,CAAC,EAAE,CAACtB,GAAG,CAAC,4BAArBd,sBAAyC,KAAK;QACzD,MAAMuC,MAAMjF,cAAcoD,SAAS,CAAC8B,UAAU,CAACC,eAAe;QAE9D,MAAMP,WAAWQ,GAAG,CAClB;YACEC,WAAWvB,UAAUD,KAAK;YAC1ByB,cAAc;YACdC,cAAcpE;YACdqE,kBAAkBlE;YAClBC,aAAaA,YAAYS,IAAI;WACzBP,YAAYO,IAAI,MAAM;YAAEP,aAAaA,YAAYO,IAAI;QAAG,GACxDN,SAASM,IAAI,MAAM;YAAEN,UAAUA,SAASM,IAAI;QAAG;YACnDL;YACA8D,eAAeT;YACfU,WAAW;WACPhD,SAASmC,KAAK,IAAI;YAAEc,WAAWV;QAAI;YACvCW,WAAWX;YACXY,gBAAgB7F,cAAcoD,SAAS,CAAC8B,UAAU,CAACY,UAAU,CAAC;gBAC5Dd;gBACAe,aAAa/F,cAAcoD,SAAS,CAAC4C,SAAS,CAACf,GAAG;YACpD;YAEF;YAAEgB,OAAO;QAAK;QAEhB,MAAMrB,WACHtB,UAAU,CAAC,YACXC,GAAG,CAACnC,OAAO4D,UACXI,GAAG,CAAC;YACHd,QAAQC,UAAUD,MAAM;YACxBH,OAAOI,UAAUJ,KAAK;YACtBqB,kBAAkBlE;YAClB,wDAAwD;YACxD4E,SAAS9E,QAAOuB,wBAAAA,iBAAiBa,GAAG,CAAC,sBAArBb,wBAAmC;YACnDwD,WAAW/E,QAAOuB,yBAAAA,iBAAiBa,GAAG,CAAC,wBAArBb,yBAAqC;YACvDoD,aAAad;QACf;QAEF,OAAOnE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEmF,WAAWxB,WAAWyB,EAAE;YAAErB;QAAQ;IAClE,EAAE,OAAO9D,OAAO;QACdoF,QAAQpF,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAiB;IACxD;AACF,EAAC;AAED,eAAeN,4BAA2B"}

package/src/lib/server/publish-layout.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Publishes a shared layout to the marketplace (AGL-671).
+ *
+ * Layouts were the one design asset that could not be shared at all:
+ * `publish-template` captures screens and theme only, and `layoutSlot` is
+ * excluded from the marketplace allowlist as "layout chrome". Both are
+ * addressed here — the slot is permitted for this artifact type
+ * specifically, since a layout without one is chrome with nowhere to put
+ * the page.
+ *
+ * Gates mirror template publishing exactly: org permission, host role,
+ * `marketplaceSelling`, an org publisher profile, and payouts configured
+ * before anything can be sold.
+ */
+export declare const publishLayoutHandler: PluginApiHandler;
+export default publishLayoutHandler;

package/src/lib/server/publish-layout.js

@@ -0,0 +1,243 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { CANVAS_ROOT_ELEMENT_ID, checkEntitlement, createResourceUid, decodeStoredNodes } from "@aglyn/aglyn/server";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { marketplacePriceRefusal, sanitizeMarketplaceDefinition } from "../model/marketplace.js";
+import { sanitizeMarketplaceProps } from "../model/marketplace-props.js";
+import { resolvePublisherProfile } from "./publisher-profile.js";
+import { publishPreconditionRefusal } from "./publish-preconditions.js";
+/** The node marking where a bound screen's content grafts in. */ const LAYOUT_SLOT_COMPONENT_ID = 'layoutSlot';
+/**
+ * Publishes a shared layout to the marketplace (AGL-671).
+ *
+ * Layouts were the one design asset that could not be shared at all:
+ * `publish-template` captures screens and theme only, and `layoutSlot` is
+ * excluded from the marketplace allowlist as "layout chrome". Both are
+ * addressed here — the slot is permitted for this artifact type
+ * specifically, since a layout without one is chrome with nowhere to put
+ * the page.
+ *
+ * Gates mirror template publishing exactly: org permission, host role,
+ * `marketplaceSelling`, an org publisher profile, and payouts configured
+ * before anything can be sold.
+ */ export const publishLayoutHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _ref3, _ref4, _ref5, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2, _req_body3, _req_body4, _req_body5;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const layoutId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.layoutId) != null ? _ref1 : '');
+    const displayName = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.displayName) != null ? _ref2 : '');
+    const description = String((_ref3 = (_req_body3 = req.body) == null ? void 0 : _req_body3.description) != null ? _ref3 : '');
+    const category = String((_ref4 = (_req_body4 = req.body) == null ? void 0 : _req_body4.category) != null ? _ref4 : '');
+    const priceUsd = Math.max(0, Math.round(Number((_ref5 = (_req_body5 = req.body) == null ? void 0 : _req_body5.priceUsd) != null ? _ref5 : 0)));
+    if (!hostId || !layoutId || !displayName.trim()) {
+        return res.status(400).json({
+            error: 'Missing hostId, layoutId or displayName'
+        });
+    }
+    // The price floor and ceiling, from ONE validator (AGL-2343). This door had
+    // NO price validation at all: it clamped to zero and stored whatever came in,
+    // so both a $1 listing that loses money on every sale and a $250,000 one were
+    // publishable here. Also enforced in `publishPreconditionRefusal` below.
+    const priceRefusal = marketplacePriceRefusal(priceUsd);
+    if (priceRefusal) {
+        return res.status(400).json({
+            error: priceRefusal
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _ref6, _existing_docs__get;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.publishToMarketplace) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow publishing to the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        const orgForHost = await getOrgForHost(hostId);
+        const org = (_ref6 = orgForHost == null ? void 0 : orgForHost.org) != null ? _ref6 : {};
+        if (!checkEntitlement(org, 'marketplaceSelling')) {
+            return res.status(403).json({
+                error: 'Publishing to the marketplace requires a Pro plan'
+            });
+        }
+        if (!(orgForHost == null ? void 0 : orgForHost.orgId)) {
+            return res.status(409).json({
+                error: 'Site has no owning organization'
+            });
+        }
+        const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId);
+        // Profile, payouts AND the publisher agreement, in one gate
+        // (AGL-2282) — see `publishPreconditionRefusal`.
+        const refusal = publishPreconditionRefusal(publisher, {
+            priceUsd,
+            sells: 'layouts'
+        });
+        if (refusal) return res.status(refusal.status).json(refusal.body);
+        const layoutRef = hostRef.collection('layouts').doc(layoutId);
+        const layoutSnapshot = await layoutRef.get();
+        if (!layoutSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown layout'
+            });
+        }
+        const versionId = layoutSnapshot.get('versionId');
+        if (!versionId) {
+            return res.status(422).json({
+                error: 'Publish this layout on your site first — there is no ' + 'published version to share'
+            });
+        }
+        const versionSnapshot = await layoutRef.collection('versions').doc(String(versionId)).get();
+        // `nodes` is stored in more than one form and the besigner writes the
+        // COMPRESSED one, which the Admin SDK materialises as a Node `Buffer`
+        // (AGL-1395). Read raw, this was worse than the template path: the length
+        // check passed on the BYTE COUNT, and the root search below walked byte
+        // INDICES — byte 0 is a number, a number has no `parentId`, so `rootId`
+        // resolved to `'0'` and the sanitizer built a wrapper around nothing.
+        // Every besigner-edited layout was refused as empty or slotless.
+        const nodes = decodeStoredNodes(versionSnapshot.get('nodes'));
+        if (!nodes || !Object.keys(nodes).length) {
+            return res.status(422).json({
+                error: 'Layout version has no content'
+            });
+        }
+        // The layout properties its tree binds to (AGL-2933), from the same
+        // version. A default the sanitizer refuses is cleared and its property
+        // kept — see `sanitizeMarketplaceProps`.
+        const props = sanitizeMarketplaceProps(versionSnapshot.get('props'));
+        if (props.ok === false) {
+            return res.status(422).json({
+                error: props.error
+            });
+        }
+        // Layout versions have no explicit rootId. The besigner canvas roots them
+        // at the same wrapper screens use, so prefer it outright; the parentless
+        // search stays as the fallback for anything authored before that, and
+        // matches how the renderer walks them. Preferring the wrapper also means a
+        // top-level node that relies on child arrays alone — legal, see
+        // `compose-layout-nodes` — can no longer win the search over the real root.
+        const rootId = nodes[CANVAS_ROOT_ELEMENT_ID] && CANVAS_ROOT_ELEMENT_ID || Object.keys(nodes).find((id)=>{
+            var _nodes_id;
+            return !((_nodes_id = nodes[id]) == null ? void 0 : _nodes_id.parentId);
+        }) || Object.keys(nodes)[0] || '';
+        const sanitized = sanitizeMarketplaceDefinition({
+            rootId,
+            nodes
+        }, {
+            extraComponentIds: [
+                LAYOUT_SLOT_COMPONENT_ID
+            ],
+            // A link or image bound whole to a Link or Image property travels
+            // bound (AGL-2933).
+            declaredProps: props.props
+        });
+        // `=== false` rather than `!sanitized.ok`: the compiler does not narrow
+        // the union on the negated form here, and publish-template hit the same
+        // thing first.
+        if (sanitized.ok === false) {
+            return res.status(400).json({
+                error: sanitized.error
+            });
+        }
+        // A layout whose slot did not survive would render as chrome with the
+        // page content missing — better to refuse than to publish that.
+        const hasSlot = Object.values(sanitized.nodes).some((node)=>node.componentId === LAYOUT_SLOT_COMPONENT_ID);
+        if (!hasSlot) {
+            return res.status(422).json({
+                error: 'This layout has no content slot, so pages using it would have ' + 'nowhere to render'
+            });
+        }
+        // One listing per source layout; re-publish bumps the version.
+        const existing = await firestore.collection('marketplaceListings').where('profileId', '==', publisher.orgId).where('sourceLayoutId', '==', layoutId).limit(1).get();
+        const listingRef = existing.empty ? firestore.collection('marketplaceListings').doc(createResourceUid()) : existing.docs[0].ref;
+        const version = existing.empty ? 1 : Number((_existing_docs__get = existing.docs[0].get('latestVersion')) != null ? _existing_docs__get : 0) + 1;
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        await listingRef.set(_extends({
+            artifactType: 'layout',
+            profileId: publisher.orgId,
+            sourceHostId: hostId,
+            sourceLayoutId: layoutId,
+            displayName: displayName.trim()
+        }, description.trim() && {
+            description: description.trim()
+        }, category.trim() && {
+            category: category.trim()
+        }, {
+            priceUsd,
+            latestVersion: version,
+            deletedAt: null
+        }, existing.empty && {
+            createdAt: now
+        }, {
+            updatedAt: now,
+            versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({
+                version,
+                publishedAt: firebaseAdmin.firestore.Timestamp.now()
+            })
+        }), {
+            merge: true
+        });
+        await listingRef.collection('versions').doc(String(version)).set({
+            // `props` is always a list, even an empty one: install and update read a
+            // version with none as one published before properties were carried.
+            layout: {
+                rootId: sanitized.rootId,
+                nodes: sanitized.nodes,
+                props: props.props
+            },
+            publishedAt: now
+        });
+        return res.status(200).json({
+            listingId: listingRef.id,
+            version
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Layout publish failed'
+        });
+    }
+};
+export default publishLayoutHandler;
+
+//# sourceMappingURL=publish-layout.js.map

package/src/lib/server/publish-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publish-layout.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CANVAS_ROOT_ELEMENT_ID,\n  checkEntitlement,\n  createResourceUid,\n  decodeStoredNodes,\n} from '@aglyn/aglyn/server'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport {\n  marketplacePriceRefusal,\n  sanitizeMarketplaceDefinition,\n} from '../model/marketplace'\nimport { sanitizeMarketplaceProps } from '../model/marketplace-props'\nimport { resolvePublisherProfile } from './publisher-profile'\nimport { publishPreconditionRefusal } from './publish-preconditions'\n\n/** The node marking where a bound screen's content grafts in. */\nconst LAYOUT_SLOT_COMPONENT_ID = 'layoutSlot'\n\n/**\n * Publishes a shared layout to the marketplace (AGL-671).\n *\n * Layouts were the one design asset that could not be shared at all:\n * `publish-template` captures screens and theme only, and `layoutSlot` is\n * excluded from the marketplace allowlist as \"layout chrome\". Both are\n * addressed here — the slot is permitted for this artifact type\n * specifically, since a layout without one is chrome with nowhere to put\n * the page.\n *\n * Gates mirror template publishing exactly: org permission, host role,\n * `marketplaceSelling`, an org publisher profile, and payouts configured\n * before anything can be sold.\n */\nexport const publishLayoutHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const layoutId = String(req.body?.layoutId ?? '')\n  const displayName = String(req.body?.displayName ?? '')\n  const description = String(req.body?.description ?? '')\n  const category = String(req.body?.category ?? '')\n  const priceUsd = Math.max(0, Math.round(Number(req.body?.priceUsd ?? 0)))\n  if (!hostId || !layoutId || !displayName.trim()) {\n    return res\n      .status(400)\n      .json({ error: 'Missing hostId, layoutId or displayName' })\n  }\n  // The price floor and ceiling, from ONE validator (AGL-2343). This door had\n  // NO price validation at all: it clamped to zero and stored whatever came in,\n  // so both a $1 listing that loses money on every sale and a $250,000 one were\n  // publishable here. Also enforced in `publishPreconditionRefusal` below.\n  const priceRefusal = marketplacePriceRefusal(priceUsd)\n  if (priceRefusal) {\n    return res.status(400).json({ error: priceRefusal })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.publishToMarketplace) {\n      return res.status(403).json({\n        error:\n          'Your organization role does not allow publishing to the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n\n    const orgForHost = await getOrgForHost(hostId)\n    const org = orgForHost?.org ?? {}\n    if (!checkEntitlement(org as any, 'marketplaceSelling')) {\n      return res.status(403).json({\n        error: 'Publishing to the marketplace requires a Pro plan',\n      })\n    }\n    if (!orgForHost?.orgId) {\n      return res.status(409).json({ error: 'Site has no owning organization' })\n    }\n\n    const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId)\n    // Profile, payouts AND the publisher agreement, in one gate\n    // (AGL-2282) — see `publishPreconditionRefusal`.\n    const refusal = publishPreconditionRefusal(publisher, {\n      priceUsd,\n      sells: 'layouts',\n    })\n    if (refusal) return res.status(refusal.status).json(refusal.body)\n\n    const layoutRef = hostRef.collection('layouts').doc(layoutId)\n    const layoutSnapshot = await layoutRef.get()\n    if (!layoutSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown layout' })\n    }\n    const versionId = layoutSnapshot.get('versionId')\n    if (!versionId) {\n      return res.status(422).json({\n        error: 'Publish this layout on your site first — there is no ' +\n          'published version to share',\n      })\n    }\n    const versionSnapshot = await layoutRef\n      .collection('versions')\n      .doc(String(versionId))\n      .get()\n    // `nodes` is stored in more than one form and the besigner writes the\n    // COMPRESSED one, which the Admin SDK materialises as a Node `Buffer`\n    // (AGL-1395). Read raw, this was worse than the template path: the length\n    // check passed on the BYTE COUNT, and the root search below walked byte\n    // INDICES — byte 0 is a number, a number has no `parentId`, so `rootId`\n    // resolved to `'0'` and the sanitizer built a wrapper around nothing.\n    // Every besigner-edited layout was refused as empty or slotless.\n    const nodes = decodeStoredNodes<Record<string, any>>(\n      versionSnapshot.get('nodes'),\n    )\n    if (!nodes || !Object.keys(nodes).length) {\n      return res.status(422).json({ error: 'Layout version has no content' })\n    }\n\n    // The layout properties its tree binds to (AGL-2933), from the same\n    // version. A default the sanitizer refuses is cleared and its property\n    // kept — see `sanitizeMarketplaceProps`.\n    const props = sanitizeMarketplaceProps(versionSnapshot.get('props'))\n    if (props.ok === false) {\n      return res.status(422).json({ error: props.error })\n    }\n\n    // Layout versions have no explicit rootId. The besigner canvas roots them\n    // at the same wrapper screens use, so prefer it outright; the parentless\n    // search stays as the fallback for anything authored before that, and\n    // matches how the renderer walks them. Preferring the wrapper also means a\n    // top-level node that relies on child arrays alone — legal, see\n    // `compose-layout-nodes` — can no longer win the search over the real root.\n    const rootId: string =\n      (nodes[CANVAS_ROOT_ELEMENT_ID] && CANVAS_ROOT_ELEMENT_ID) ||\n      Object.keys(nodes).find((id) => !nodes[id]?.parentId) ||\n      Object.keys(nodes)[0] ||\n      ''\n    const sanitized = sanitizeMarketplaceDefinition(\n      { rootId, nodes },\n      {\n        extraComponentIds: [LAYOUT_SLOT_COMPONENT_ID],\n        // A link or image bound whole to a Link or Image property travels\n        // bound (AGL-2933).\n        declaredProps: props.props,\n      },\n    )\n    // `=== false` rather than `!sanitized.ok`: the compiler does not narrow\n    // the union on the negated form here, and publish-template hit the same\n    // thing first.\n    if (sanitized.ok === false) {\n      return res.status(400).json({ error: sanitized.error })\n    }\n    // A layout whose slot did not survive would render as chrome with the\n    // page content missing — better to refuse than to publish that.\n    const hasSlot = Object.values(sanitized.nodes).some(\n      (node: any) => node.componentId === LAYOUT_SLOT_COMPONENT_ID,\n    )\n    if (!hasSlot) {\n      return res.status(422).json({\n        error:\n          'This layout has no content slot, so pages using it would have ' +\n          'nowhere to render',\n      })\n    }\n\n    // One listing per source layout; re-publish bumps the version.\n    const existing = await firestore\n      .collection('marketplaceListings')\n      .where('profileId', '==', publisher.orgId)\n      .where('sourceLayoutId', '==', layoutId)\n      .limit(1)\n      .get()\n    const listingRef = existing.empty\n      ? firestore.collection('marketplaceListings').doc(createResourceUid())\n      : existing.docs[0].ref\n    const version = existing.empty\n      ? 1\n      : Number(existing.docs[0].get('latestVersion') ?? 0) + 1\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n\n    await listingRef.set(\n      {\n        artifactType: 'layout',\n        profileId: publisher.orgId,\n        sourceHostId: hostId,\n        sourceLayoutId: layoutId,\n        displayName: displayName.trim(),\n        ...(description.trim() && { description: description.trim() }),\n        ...(category.trim() && { category: category.trim() }),\n        priceUsd,\n        latestVersion: version,\n        deletedAt: null,\n        ...(existing.empty && { createdAt: now }),\n        updatedAt: now,\n        versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({\n          version,\n          publishedAt: firebaseAdmin.firestore.Timestamp.now(),\n        }),\n      },\n      { merge: true },\n    )\n    await listingRef.collection('versions').doc(String(version)).set({\n      // `props` is always a list, even an empty one: install and update read a\n      // version with none as one published before properties were carried.\n      layout: {\n        rootId: sanitized.rootId,\n        nodes: sanitized.nodes,\n        props: props.props,\n      },\n      publishedAt: now,\n    })\n\n    return res.status(200).json({ listingId: listingRef.id, version })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Layout publish failed' })\n  }\n}\n\nexport default publishLayoutHandler\n"],"names":["CANVAS_ROOT_ELEMENT_ID","checkEntitlement","createResourceUid","decodeStoredNodes","firebaseAdmin","getOrgForHost","resolveOrgPermissions","marketplacePriceRefusal","sanitizeMarketplaceDefinition","sanitizeMarketplaceProps","resolvePublisherProfile","publishPreconditionRefusal","LAYOUT_SLOT_COMPONENT_ID","publishLayoutHandler","req","res","method","status","json","error","hostId","String","body","layoutId","displayName","description","category","priceUsd","Math","max","round","Number","trim","priceRefusal","authorization","headers","idToken","startsWith","slice","length","undefined","hostSnapshot","existing","decoded","app","auth","verifyIdToken","membership","uid","permissions","publishToMarketplace","firestore","hostRef","collection","doc","get","exists","memberRole","orgForHost","org","orgId","publisher","refusal","sells","layoutRef","layoutSnapshot","versionId","versionSnapshot","nodes","Object","keys","props","ok","rootId","find","id","parentId","sanitized","extraComponentIds","declaredProps","hasSlot","values","some","node","componentId","where","limit","listingRef","empty","docs","ref","version","now","FieldValue","serverTimestamp","set","artifactType","profileId","sourceHostId","sourceLayoutId","latestVersion","deletedAt","createdAt","updatedAt","versionHistory","arrayUnion","publishedAt","Timestamp","merge","layout","listingId","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,EACtBC,gBAAgB,EAChBC,iBAAiB,EACjBC,iBAAiB,QACZ,sBAAqB;AAE5B,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AACvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SACEC,uBAAuB,EACvBC,6BAA6B,QACxB,0BAAsB;AAC7B,SAASC,wBAAwB,QAAQ,gCAA4B;AACrE,SAASC,uBAAuB,QAAQ,yBAAqB;AAC7D,SAASC,0BAA0B,QAAQ,6BAAyB;AAEpE,+DAA+D,GAC/D,MAAMC,2BAA2B;AAEjC;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,uBAAyC,OAAOC,KAAKC;iDAuBnCD;QAnBPA,WACEA,YACGA,YACAA,YACHA,YACuBA;IAR/C,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,WAAWF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,QAAQ,oBAAI;IAC9C,MAAMC,cAAcH,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUU,WAAW,oBAAI;IACpD,MAAMC,cAAcJ,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUW,WAAW,oBAAI;IACpD,MAAMC,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI;IAC9C,MAAMC,WAAWC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,KAAK,CAACC,iBAAOjB,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,QAAQ,oBAAI;IACrE,IAAI,CAACP,UAAU,CAACG,YAAY,CAACC,YAAYQ,IAAI,IAAI;QAC/C,OAAOjB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;YAAEC,OAAO;QAA0C;IAC7D;IACA,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAMc,eAAe1B,wBAAwBoB;IAC7C,IAAIM,cAAc;QAChB,OAAOlB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOc;QAAa;IACpD;IACA,MAAMC,gBAAgBb,QAAOP,6BAAAA,IAAIqB,OAAO,CAACD,aAAa,YAAzBpB,6BAA6B;IAC1D,MAAMsB,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOrB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAgBkBsB,0BAkHTC;QAjIX,MAAMC,UAAU,MAAMvC,cAAcwC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/D,MAAMW,aAAa,MAAMzC,sBAAsBqC,QAAQK,GAAG,EAAE;YAAE5B;QAAO;QACrE,IAAI,CAAC2B,WAAWE,WAAW,CAACC,oBAAoB,EAAE;YAChD,OAAOnC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE;YACJ;QACF;QACA,MAAMgC,YAAY/C,cAAcwC,GAAG,GAAGO,SAAS;QAE/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAClC;QAClD,MAAMqB,eAAe,MAAMW,QAAQG,GAAG;QACtC,IAAI,CAACd,aAAae,MAAM,EAAE;YACxB,OAAOzC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAMsC,aAAa,EAAChB,oBAAAA,aAAac,GAAG,CAAC,0BAAjBd,oBAAmC,CAAC,EAAE,CAACE,QAAQK,GAAG,CAAC;QACvE,IAAIS,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QAEA,MAAMuC,aAAa,MAAMrD,cAAce;QACvC,MAAMuC,eAAMD,8BAAAA,WAAYC,GAAG,oBAAI,CAAC;QAChC,IAAI,CAAC1D,iBAAiB0D,KAAY,uBAAuB;YACvD,OAAO5C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,IAAI,EAACuC,8BAAAA,WAAYE,KAAK,GAAE;YACtB,OAAO7C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;QACzE;QAEA,MAAM0C,YAAY,MAAMnD,wBAAwByC,WAAWO,WAAWE,KAAK;QAC3E,4DAA4D;QAC5D,iDAAiD;QACjD,MAAME,UAAUnD,2BAA2BkD,WAAW;YACpDlC;YACAoC,OAAO;QACT;QACA,IAAID,SAAS,OAAO/C,IAAIE,MAAM,CAAC6C,QAAQ7C,MAAM,EAAEC,IAAI,CAAC4C,QAAQxC,IAAI;QAEhE,MAAM0C,YAAYZ,QAAQC,UAAU,CAAC,WAAWC,GAAG,CAAC/B;QACpD,MAAM0C,iBAAiB,MAAMD,UAAUT,GAAG;QAC1C,IAAI,CAACU,eAAeT,MAAM,EAAE;YAC1B,OAAOzC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiB;QACxD;QACA,MAAM+C,YAAYD,eAAeV,GAAG,CAAC;QACrC,IAAI,CAACW,WAAW;YACd,OAAOnD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO,0DACL;YACJ;QACF;QACA,MAAMgD,kBAAkB,MAAMH,UAC3BX,UAAU,CAAC,YACXC,GAAG,CAACjC,OAAO6C,YACXX,GAAG;QACN,sEAAsE;QACtE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,iEAAiE;QACjE,MAAMa,QAAQjE,kBACZgE,gBAAgBZ,GAAG,CAAC;QAEtB,IAAI,CAACa,SAAS,CAACC,OAAOC,IAAI,CAACF,OAAO7B,MAAM,EAAE;YACxC,OAAOxB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAgC;QACvE;QAEA,oEAAoE;QACpE,uEAAuE;QACvE,yCAAyC;QACzC,MAAMoD,QAAQ9D,yBAAyB0D,gBAAgBZ,GAAG,CAAC;QAC3D,IAAIgB,MAAMC,EAAE,KAAK,OAAO;YACtB,OAAOzD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOoD,MAAMpD,KAAK;YAAC;QACnD;QAEA,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,2EAA2E;QAC3E,gEAAgE;QAChE,4EAA4E;QAC5E,MAAMsD,SACJ,AAACL,KAAK,CAACpE,uBAAuB,IAAIA,0BAClCqE,OAAOC,IAAI,CAACF,OAAOM,IAAI,CAAC,CAACC;gBAAQP;mBAAD,GAACA,YAAAA,KAAK,CAACO,GAAG,qBAATP,UAAWQ,QAAQ;cACpDP,OAAOC,IAAI,CAACF,MAAM,CAAC,EAAE,IACrB;QACF,MAAMS,YAAYrE,8BAChB;YAAEiE;YAAQL;QAAM,GAChB;YACEU,mBAAmB;gBAAClE;aAAyB;YAC7C,kEAAkE;YAClE,oBAAoB;YACpBmE,eAAeR,MAAMA,KAAK;QAC5B;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,eAAe;QACf,IAAIM,UAAUL,EAAE,KAAK,OAAO;YAC1B,OAAOzD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO0D,UAAU1D,KAAK;YAAC;QACvD;QACA,sEAAsE;QACtE,gEAAgE;QAChE,MAAM6D,UAAUX,OAAOY,MAAM,CAACJ,UAAUT,KAAK,EAAEc,IAAI,CACjD,CAACC,OAAcA,KAAKC,WAAW,KAAKxE;QAEtC,IAAI,CAACoE,SAAS;YACZ,OAAOjE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,mEACA;YACJ;QACF;QAEA,+DAA+D;QAC/D,MAAMuB,WAAW,MAAMS,UACpBE,UAAU,CAAC,uBACXgC,KAAK,CAAC,aAAa,MAAMxB,UAAUD,KAAK,EACxCyB,KAAK,CAAC,kBAAkB,MAAM9D,UAC9B+D,KAAK,CAAC,GACN/B,GAAG;QACN,MAAMgC,aAAa7C,SAAS8C,KAAK,GAC7BrC,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAACpD,uBAChDwC,SAAS+C,IAAI,CAAC,EAAE,CAACC,GAAG;QACxB,MAAMC,UAAUjD,SAAS8C,KAAK,GAC1B,IACAzD,QAAOW,sBAAAA,SAAS+C,IAAI,CAAC,EAAE,CAAClC,GAAG,CAAC,4BAArBb,sBAAyC,KAAK;QACzD,MAAMkD,MAAMxF,cAAc+C,SAAS,CAAC0C,UAAU,CAACC,eAAe;QAE9D,MAAMP,WAAWQ,GAAG,CAClB;YACEC,cAAc;YACdC,WAAWpC,UAAUD,KAAK;YAC1BsC,cAAc9E;YACd+E,gBAAgB5E;YAChBC,aAAaA,YAAYQ,IAAI;WACzBP,YAAYO,IAAI,MAAM;YAAEP,aAAaA,YAAYO,IAAI;QAAG,GACxDN,SAASM,IAAI,MAAM;YAAEN,UAAUA,SAASM,IAAI;QAAG;YACnDL;YACAyE,eAAeT;YACfU,WAAW;WACP3D,SAAS8C,KAAK,IAAI;YAAEc,WAAWV;QAAI;YACvCW,WAAWX;YACXY,gBAAgBpG,cAAc+C,SAAS,CAAC0C,UAAU,CAACY,UAAU,CAAC;gBAC5Dd;gBACAe,aAAatG,cAAc+C,SAAS,CAACwD,SAAS,CAACf,GAAG;YACpD;YAEF;YAAEgB,OAAO;QAAK;QAEhB,MAAMrB,WAAWlC,UAAU,CAAC,YAAYC,GAAG,CAACjC,OAAOsE,UAAUI,GAAG,CAAC;YAC/D,yEAAyE;YACzE,qEAAqE;YACrEc,QAAQ;gBACNpC,QAAQI,UAAUJ,MAAM;gBACxBL,OAAOS,UAAUT,KAAK;gBACtBG,OAAOA,MAAMA,KAAK;YACpB;YACAmC,aAAad;QACf;QAEA,OAAO7E,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE4F,WAAWvB,WAAWZ,EAAE;YAAEgB;QAAQ;IAClE,EAAE,OAAOxE,OAAO;QACd4F,QAAQ5F,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAwB;IAC/D;AACF,EAAC;AAED,eAAeN,qBAAoB"}

package/src/lib/server/publish-plugin.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+export declare const publishPluginHandler: PluginApiHandler;