@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/publish-preconditions.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ResolvedPublisher } from './publisher-profile';
+/** A ready-to-send refusal: the status and the body, decided together. */
+export interface PublishRefusal {
+    status: number;
+    body: Record<string, unknown>;
+}
+/**
+ * EVERY precondition a marketplace publish shares, in one place (AGL-2282).
+ *
+ * THE DEFECT THIS CLOSES. The publisher agreement (AGL-1077) is the document
+ * that says what Aglyn may do with a listing, what the publisher warrants,
+ * who indemnifies whom, and — §8 — how paid sales, the platform fee, sales
+ * tax and refund clawbacks work. Its gate was written into
+ * `publish-plugin.ts` and **nowhere else**. The other six publish doors —
+ * components (`publish.ts`), themes, layouts, site templates, email templates
+ * and dataset schemas — enforced the profile and the payout binding and then
+ * created a listing, `priceUsd` included, with no acceptance on file.
+ *
+ * So six of the seven ways to put a PAID artifact on the marketplace let an
+ * org sell through Aglyn as merchant of record while under no publisher terms
+ * at all: no warranty that they own what they are selling, no indemnity, and
+ * no consent to the §8.4 clawback the refund path relies on to take a
+ * publisher's share back out of their Connect account. Every one of those
+ * routes reads `priceUsd` from the request body and stamps it on the listing.
+ *
+ * WHY THE THREE CHECKS MOVED TOGETHER rather than a bare `requireAgreement`
+ * being sprinkled beside the existing two. A gate that must be REMEMBERED at
+ * six call sites is exactly what just failed; a gate that arrives bundled
+ * with the profile and payout refusals cannot be dropped without also
+ * dropping those, which no reviewer would miss. The next publish door gets
+ * all three by construction, which is the only version of this fix that
+ * stays fixed.
+ *
+ * WHY IT IS PURE, and lives here rather than beside `resolvePublisherProfile`.
+ * Every publish spec in this directory mocks `./publisher-profile` wholesale,
+ * and a wholesale mock is a CLOSED WORLD: a gate exported from that module
+ * would be `undefined` under those mocks, and — worse — a gate that CALLED
+ * the mocked resolver would never run the real agreement check in any of
+ * them. Taking the already-resolved profile as an argument keeps the decision
+ * live in every existing spec, and makes it directly unit-testable without a
+ * Firestore double.
+ *
+ * THE PRICE FLOOR (AGL-2343) joined the gate for the same reason: a paid
+ * listing under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because
+ * marketplace checkout is a destination charge whose Stripe fee is debited
+ * from the PLATFORM's balance, and two of the seven doors validated the price
+ * not at all. It reads FIRST — see the comment on the check itself.
+ *
+ * ORDER IS DELIBERATE and matches what `publish-plugin.ts` already did:
+ * profile, then payouts, then the agreement. The first two are things a
+ * publisher sets up once; the third can go stale under a publisher who did
+ * everything right, so it reads last and says so specifically.
+ *
+ * THE AGREEMENT IS ASKED FOR FREE LISTINGS TOO, exactly as
+ * `publish-plugin.ts` asked. Sections 2 (the distribution licence), 3 (the
+ * warranties) and 9 (indemnity) are what make a free listing distributable at
+ * all; only §8 is about money. Gating on `priceUsd > 0` would put every free
+ * listing outside the terms that let us serve it.
+ *
+ * @param publisher the org's resolved marketplace profile, or null/undefined
+ *   when it has none.
+ * @param options.sells the plural artifact noun for the payout refusal —
+ *   "components", "themes", "layouts" — so the message keeps naming what the
+ *   publisher was actually trying to sell.
+ * @returns the refusal to send, or `null` when the publish may proceed.
+ */
+export declare function publishPreconditionRefusal(publisher: ResolvedPublisher | null | undefined, options: {
+    priceUsd: number;
+    sells: string;
+}): PublishRefusal | null;

package/src/lib/server/publish-preconditions.js

@@ -0,0 +1,160 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { PUBLISHER_AGREEMENT_VERSION, publisherAgreementRefusal, publisherAgreementState } from "@aglyn/aglyn/app-utils/publisher-agreement";
+import { connectLinkageIsReady } from "@aglyn/tenant-data-admin/server/stripe-account-mode";
+import { marketplacePriceRefusal } from "../model/marketplace.js";
+/**
+ * EVERY precondition a marketplace publish shares, in one place (AGL-2282).
+ *
+ * THE DEFECT THIS CLOSES. The publisher agreement (AGL-1077) is the document
+ * that says what Aglyn may do with a listing, what the publisher warrants,
+ * who indemnifies whom, and — §8 — how paid sales, the platform fee, sales
+ * tax and refund clawbacks work. Its gate was written into
+ * `publish-plugin.ts` and **nowhere else**. The other six publish doors —
+ * components (`publish.ts`), themes, layouts, site templates, email templates
+ * and dataset schemas — enforced the profile and the payout binding and then
+ * created a listing, `priceUsd` included, with no acceptance on file.
+ *
+ * So six of the seven ways to put a PAID artifact on the marketplace let an
+ * org sell through Aglyn as merchant of record while under no publisher terms
+ * at all: no warranty that they own what they are selling, no indemnity, and
+ * no consent to the §8.4 clawback the refund path relies on to take a
+ * publisher's share back out of their Connect account. Every one of those
+ * routes reads `priceUsd` from the request body and stamps it on the listing.
+ *
+ * WHY THE THREE CHECKS MOVED TOGETHER rather than a bare `requireAgreement`
+ * being sprinkled beside the existing two. A gate that must be REMEMBERED at
+ * six call sites is exactly what just failed; a gate that arrives bundled
+ * with the profile and payout refusals cannot be dropped without also
+ * dropping those, which no reviewer would miss. The next publish door gets
+ * all three by construction, which is the only version of this fix that
+ * stays fixed.
+ *
+ * WHY IT IS PURE, and lives here rather than beside `resolvePublisherProfile`.
+ * Every publish spec in this directory mocks `./publisher-profile` wholesale,
+ * and a wholesale mock is a CLOSED WORLD: a gate exported from that module
+ * would be `undefined` under those mocks, and — worse — a gate that CALLED
+ * the mocked resolver would never run the real agreement check in any of
+ * them. Taking the already-resolved profile as an argument keeps the decision
+ * live in every existing spec, and makes it directly unit-testable without a
+ * Firestore double.
+ *
+ * THE PRICE FLOOR (AGL-2343) joined the gate for the same reason: a paid
+ * listing under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because
+ * marketplace checkout is a destination charge whose Stripe fee is debited
+ * from the PLATFORM's balance, and two of the seven doors validated the price
+ * not at all. It reads FIRST — see the comment on the check itself.
+ *
+ * ORDER IS DELIBERATE and matches what `publish-plugin.ts` already did:
+ * profile, then payouts, then the agreement. The first two are things a
+ * publisher sets up once; the third can go stale under a publisher who did
+ * everything right, so it reads last and says so specifically.
+ *
+ * THE AGREEMENT IS ASKED FOR FREE LISTINGS TOO, exactly as
+ * `publish-plugin.ts` asked. Sections 2 (the distribution licence), 3 (the
+ * warranties) and 9 (indemnity) are what make a free listing distributable at
+ * all; only §8 is about money. Gating on `priceUsd > 0` would put every free
+ * listing outside the terms that let us serve it.
+ *
+ * @param publisher the org's resolved marketplace profile, or null/undefined
+ *   when it has none.
+ * @param options.sells the plural artifact noun for the payout refusal —
+ *   "components", "themes", "layouts" — so the message keeps naming what the
+ *   publisher was actually trying to sell.
+ * @returns the refusal to send, or `null` when the publish may proceed.
+ */ export function publishPreconditionRefusal(publisher, options) {
+    // THE PRICE FLOOR (AGL-2343), first, and 400 rather than 412: it is the only
+    // refusal here that is a property of the REQUEST rather than of the org, so
+    // it is the only one the publisher can fix in the form in front of them
+    // without leaving it. Reported before the org-setup refusals so that a
+    // publisher does not go and set up payouts only to be bounced again on the
+    // price they had already typed.
+    //
+    // It rides in the shared gate for the same reason the agreement does: two of
+    // the seven doors (`publish-theme.ts`, `publish-layout.ts`) validated the
+    // price not at all, and a gate that must be REMEMBERED at seven call sites
+    // is exactly what fails. The doors also call `marketplacePriceRefusal`
+    // inline — this is the backstop that makes the eighth door safe on the day
+    // it is written.
+    const priceRefusal = marketplacePriceRefusal(options.priceUsd);
+    if (priceRefusal) {
+        return {
+            status: 400,
+            body: {
+                error: priceRefusal
+            }
+        };
+    }
+    if (!publisher) {
+        return {
+            status: 412,
+            body: {
+                error: 'Set up your publisher profile first — Marketplace → Profile.'
+            }
+        };
+    }
+    // Paid listings require completed Stripe Connect onboarding (AGL-46) —
+    // there is nowhere to send the seller's share otherwise.
+    //
+    // AGL-2471 folded the MODE question in here too, and not only at checkout.
+    // Publishing is where a seller is told they are set up to sell; letting a
+    // paid listing go live behind a linkage no sale will ever be allowed to use
+    // just moves the same lie one step earlier, to the point where the seller
+    // stops checking.
+    if (options.priceUsd > 0 && !connectLinkageIsReady({
+        accountId: publisher.stripeAccountId,
+        chargesEnabled: publisher.stripeChargesEnabled,
+        accountLivemode: publisher.stripeAccountLivemode
+    }, {
+        subject: `publish for org ${publisher.orgId}`
+    })) {
+        return {
+            status: 412,
+            body: {
+                error: `Set up payouts first — Marketplace → Payouts — to sell ${options.sells}.`
+            }
+        };
+    }
+    // The publisher agreement (AGL-1077). A precondition on the ORG, checked
+    // here beside the profile and payout preconditions it belongs with —
+    // deliberately NOT the 428 the attestation uses. "You did not confirm the
+    // checklist for this bundle" and "your organization has never agreed to our
+    // terms" are different problems, fixed in different places, and a shared
+    // status code would send a publisher back to the checklist to tick
+    // something that is already ticked.
+    //
+    // An acceptance of an older version does not count: whoever publishes next
+    // reads the changed agreement and accepts it, or does not publish.
+    const agreementState = publisherAgreementState(publisher.agreement);
+    if (agreementState !== 'current') {
+        var _ref;
+        var _publisher_agreement;
+        return {
+            status: 412,
+            body: {
+                error: publisherAgreementRefusal(agreementState),
+                agreement: {
+                    required: PUBLISHER_AGREEMENT_VERSION,
+                    accepted: (_ref = (_publisher_agreement = publisher.agreement) == null ? void 0 : _publisher_agreement.version) != null ? _ref : null,
+                    state: agreementState
+                }
+            }
+        };
+    }
+    return null;
+}
+
+//# sourceMappingURL=publish-preconditions.js.map

package/src/lib/server/publish-preconditions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publish-preconditions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  PUBLISHER_AGREEMENT_VERSION,\n  publisherAgreementRefusal,\n  publisherAgreementState,\n} from '@aglyn/aglyn/app-utils/publisher-agreement'\nimport { connectLinkageIsReady } from '@aglyn/tenant-data-admin/server/stripe-account-mode'\nimport { marketplacePriceRefusal } from '../model/marketplace'\nimport type { ResolvedPublisher } from './publisher-profile'\n\n/** A ready-to-send refusal: the status and the body, decided together. */\nexport interface PublishRefusal {\n  status: number\n  body: Record<string, unknown>\n}\n\n/**\n * EVERY precondition a marketplace publish shares, in one place (AGL-2282).\n *\n * THE DEFECT THIS CLOSES. The publisher agreement (AGL-1077) is the document\n * that says what Aglyn may do with a listing, what the publisher warrants,\n * who indemnifies whom, and — §8 — how paid sales, the platform fee, sales\n * tax and refund clawbacks work. Its gate was written into\n * `publish-plugin.ts` and **nowhere else**. The other six publish doors —\n * components (`publish.ts`), themes, layouts, site templates, email templates\n * and dataset schemas — enforced the profile and the payout binding and then\n * created a listing, `priceUsd` included, with no acceptance on file.\n *\n * So six of the seven ways to put a PAID artifact on the marketplace let an\n * org sell through Aglyn as merchant of record while under no publisher terms\n * at all: no warranty that they own what they are selling, no indemnity, and\n * no consent to the §8.4 clawback the refund path relies on to take a\n * publisher's share back out of their Connect account. Every one of those\n * routes reads `priceUsd` from the request body and stamps it on the listing.\n *\n * WHY THE THREE CHECKS MOVED TOGETHER rather than a bare `requireAgreement`\n * being sprinkled beside the existing two. A gate that must be REMEMBERED at\n * six call sites is exactly what just failed; a gate that arrives bundled\n * with the profile and payout refusals cannot be dropped without also\n * dropping those, which no reviewer would miss. The next publish door gets\n * all three by construction, which is the only version of this fix that\n * stays fixed.\n *\n * WHY IT IS PURE, and lives here rather than beside `resolvePublisherProfile`.\n * Every publish spec in this directory mocks `./publisher-profile` wholesale,\n * and a wholesale mock is a CLOSED WORLD: a gate exported from that module\n * would be `undefined` under those mocks, and — worse — a gate that CALLED\n * the mocked resolver would never run the real agreement check in any of\n * them. Taking the already-resolved profile as an argument keeps the decision\n * live in every existing spec, and makes it directly unit-testable without a\n * Firestore double.\n *\n * THE PRICE FLOOR (AGL-2343) joined the gate for the same reason: a paid\n * listing under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because\n * marketplace checkout is a destination charge whose Stripe fee is debited\n * from the PLATFORM's balance, and two of the seven doors validated the price\n * not at all. It reads FIRST — see the comment on the check itself.\n *\n * ORDER IS DELIBERATE and matches what `publish-plugin.ts` already did:\n * profile, then payouts, then the agreement. The first two are things a\n * publisher sets up once; the third can go stale under a publisher who did\n * everything right, so it reads last and says so specifically.\n *\n * THE AGREEMENT IS ASKED FOR FREE LISTINGS TOO, exactly as\n * `publish-plugin.ts` asked. Sections 2 (the distribution licence), 3 (the\n * warranties) and 9 (indemnity) are what make a free listing distributable at\n * all; only §8 is about money. Gating on `priceUsd > 0` would put every free\n * listing outside the terms that let us serve it.\n *\n * @param publisher the org's resolved marketplace profile, or null/undefined\n *   when it has none.\n * @param options.sells the plural artifact noun for the payout refusal —\n *   \"components\", \"themes\", \"layouts\" — so the message keeps naming what the\n *   publisher was actually trying to sell.\n * @returns the refusal to send, or `null` when the publish may proceed.\n */\nexport function publishPreconditionRefusal(\n  publisher: ResolvedPublisher | null | undefined,\n  options: { priceUsd: number; sells: string },\n): PublishRefusal | null {\n  // THE PRICE FLOOR (AGL-2343), first, and 400 rather than 412: it is the only\n  // refusal here that is a property of the REQUEST rather than of the org, so\n  // it is the only one the publisher can fix in the form in front of them\n  // without leaving it. Reported before the org-setup refusals so that a\n  // publisher does not go and set up payouts only to be bounced again on the\n  // price they had already typed.\n  //\n  // It rides in the shared gate for the same reason the agreement does: two of\n  // the seven doors (`publish-theme.ts`, `publish-layout.ts`) validated the\n  // price not at all, and a gate that must be REMEMBERED at seven call sites\n  // is exactly what fails. The doors also call `marketplacePriceRefusal`\n  // inline — this is the backstop that makes the eighth door safe on the day\n  // it is written.\n  const priceRefusal = marketplacePriceRefusal(options.priceUsd)\n  if (priceRefusal) {\n    return { status: 400, body: { error: priceRefusal } }\n  }\n  if (!publisher) {\n    return {\n      status: 412,\n      body: {\n        error: 'Set up your publisher profile first — Marketplace → Profile.',\n      },\n    }\n  }\n  // Paid listings require completed Stripe Connect onboarding (AGL-46) —\n  // there is nowhere to send the seller's share otherwise.\n  //\n  // AGL-2471 folded the MODE question in here too, and not only at checkout.\n  // Publishing is where a seller is told they are set up to sell; letting a\n  // paid listing go live behind a linkage no sale will ever be allowed to use\n  // just moves the same lie one step earlier, to the point where the seller\n  // stops checking.\n  if (\n    options.priceUsd > 0 &&\n    !connectLinkageIsReady(\n      {\n        accountId: publisher.stripeAccountId,\n        chargesEnabled: publisher.stripeChargesEnabled,\n        accountLivemode: publisher.stripeAccountLivemode,\n      },\n      { subject: `publish for org ${publisher.orgId}` },\n    )\n  ) {\n    return {\n      status: 412,\n      body: {\n        error: `Set up payouts first — Marketplace → Payouts — to sell ${options.sells}.`,\n      },\n    }\n  }\n  // The publisher agreement (AGL-1077). A precondition on the ORG, checked\n  // here beside the profile and payout preconditions it belongs with —\n  // deliberately NOT the 428 the attestation uses. \"You did not confirm the\n  // checklist for this bundle\" and \"your organization has never agreed to our\n  // terms\" are different problems, fixed in different places, and a shared\n  // status code would send a publisher back to the checklist to tick\n  // something that is already ticked.\n  //\n  // An acceptance of an older version does not count: whoever publishes next\n  // reads the changed agreement and accepts it, or does not publish.\n  const agreementState = publisherAgreementState(publisher.agreement)\n  if (agreementState !== 'current') {\n    return {\n      status: 412,\n      body: {\n        error: publisherAgreementRefusal(agreementState),\n        agreement: {\n          required: PUBLISHER_AGREEMENT_VERSION,\n          accepted: publisher.agreement?.version ?? null,\n          state: agreementState,\n        },\n      },\n    }\n  }\n  return null\n}\n"],"names":["PUBLISHER_AGREEMENT_VERSION","publisherAgreementRefusal","publisherAgreementState","connectLinkageIsReady","marketplacePriceRefusal","publishPreconditionRefusal","publisher","options","priceRefusal","priceUsd","status","body","error","accountId","stripeAccountId","chargesEnabled","stripeChargesEnabled","accountLivemode","stripeAccountLivemode","subject","orgId","sells","agreementState","agreement","required","accepted","version","state"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,2BAA2B,EAC3BC,yBAAyB,EACzBC,uBAAuB,QAClB,6CAA4C;AACnD,SAASC,qBAAqB,QAAQ,sDAAqD;AAC3F,SAASC,uBAAuB,QAAQ,0BAAsB;AAS9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DC,GACD,OAAO,SAASC,2BACdC,SAA+C,EAC/CC,OAA4C;IAE5C,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,gCAAgC;IAChC,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,MAAMC,eAAeJ,wBAAwBG,QAAQE,QAAQ;IAC7D,IAAID,cAAc;QAChB,OAAO;YAAEE,QAAQ;YAAKC,MAAM;gBAAEC,OAAOJ;YAAa;QAAE;IACtD;IACA,IAAI,CAACF,WAAW;QACd,OAAO;YACLI,QAAQ;YACRC,MAAM;gBACJC,OAAO;YACT;QACF;IACF;IACA,uEAAuE;IACvE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,kBAAkB;IAClB,IACEL,QAAQE,QAAQ,GAAG,KACnB,CAACN,sBACC;QACEU,WAAWP,UAAUQ,eAAe;QACpCC,gBAAgBT,UAAUU,oBAAoB;QAC9CC,iBAAiBX,UAAUY,qBAAqB;IAClD,GACA;QAAEC,SAAS,CAAC,gBAAgB,EAAEb,UAAUc,KAAK,EAAE;IAAC,IAElD;QACA,OAAO;YACLV,QAAQ;YACRC,MAAM;gBACJC,OAAO,CAAC,uDAAuD,EAAEL,QAAQc,KAAK,CAAC,CAAC,CAAC;YACnF;QACF;IACF;IACA,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,mEAAmE;IACnE,oCAAoC;IACpC,EAAE;IACF,2EAA2E;IAC3E,mEAAmE;IACnE,MAAMC,iBAAiBpB,wBAAwBI,UAAUiB,SAAS;IAClE,IAAID,mBAAmB,WAAW;;YAOhBhB;QANhB,OAAO;YACLI,QAAQ;YACRC,MAAM;gBACJC,OAAOX,0BAA0BqB;gBACjCC,WAAW;oBACTC,UAAUxB;oBACVyB,QAAQ,WAAEnB,uBAAAA,UAAUiB,SAAS,qBAAnBjB,qBAAqBoB,OAAO,mBAAI;oBAC1CC,OAAOL;gBACT;YACF;QACF;IACF;IACA,OAAO;AACT"}

package/src/lib/server/publish-template.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Publishes a host as a site template (AGL-137): captures every published
+ * screen (nodes run through the same marketplace sanitizer as component
+ * publishing — the id allowlist and size caps apply per screen) plus the
+ * theme into a `marketplaceListings` doc with `kind: 'template'`. Same
+ * gates as component publishing: host admin, marketplace profile,
+ * `marketplaceSelling` for plan-gated workspaces, Stripe onboarding for paid
+ * listings. One template per source host; re-publishing bumps the version.
+ */
+export declare const publishTemplateHandler: PluginApiHandler;

package/src/lib/server/publish-template.js

@@ -0,0 +1,215 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { CANVAS_ROOT_ELEMENT_ID, checkEntitlement, createResourceUid, decodeStoredNodes } from "@aglyn/aglyn/server";
+import { marketplacePriceRefusal, sanitizeMarketplaceDefinition } from "../model/index.js";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { resolveOrgPermissions } from "@aglyn/tenant-runtime/org-permissions";
+import { resolvePublisherProfile } from "./publisher-profile.js";
+import { publishPreconditionRefusal } from "./publish-preconditions.js";
+const MAX_TEMPLATE_SCREENS = 25;
+/**
+ * Publishes a host as a site template (AGL-137): captures every published
+ * screen (nodes run through the same marketplace sanitizer as component
+ * publishing — the id allowlist and size caps apply per screen) plus the
+ * theme into a `marketplaceListings` doc with `kind: 'template'`. Same
+ * gates as component publishing: host admin, marketplace profile,
+ * `marketplaceSelling` for plan-gated workspaces, Stripe onboarding for paid
+ * listings. One template per source host; re-publishing bumps the version.
+ */ export const publishTemplateHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _ref3, _ref4, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2, _req_body3, _req_body4;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '');
+    const displayName = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.displayName) != null ? _ref1 : '').slice(0, 80);
+    const description = String((_ref2 = (_req_body2 = req.body) == null ? void 0 : _req_body2.description) != null ? _ref2 : '').slice(0, 500);
+    const category = String((_ref3 = (_req_body3 = req.body) == null ? void 0 : _req_body3.category) != null ? _ref3 : '').slice(0, 40);
+    const priceUsd = Math.round(Number((_ref4 = (_req_body4 = req.body) == null ? void 0 : _req_body4.priceUsd) != null ? _ref4 : 0)) || 0;
+    // The price floor and ceiling, from ONE validator (AGL-2343): a paid listing
+    // under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because
+    // marketplace checkout is a destination charge whose Stripe fee is debited
+    // from the platform's balance. Also enforced in `publishPreconditionRefusal`
+    // below, so a door that drops this line is still covered.
+    const priceRefusal = marketplacePriceRefusal(priceUsd);
+    if (priceRefusal) {
+        return res.status(400).json({
+            error: priceRefusal
+        });
+    }
+    if (!hostId || !displayName.trim()) {
+        return res.status(400).json({
+            error: 'Missing hostId or displayName'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _hostSnapshot_get, _ref5, _hostSnapshot_get1, _existing_docs__get, _hostSnapshot_get2;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const membership = await resolveOrgPermissions(decoded.uid, {
+            hostId
+        });
+        if (!membership.permissions.publishToMarketplace) {
+            return res.status(403).json({
+                error: 'Your organization role does not allow publishing to the marketplace'
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const hostRef = firestore.collection('hosts').doc(hostId);
+        const hostSnapshot = await hostRef.get();
+        if (!hostSnapshot.exists) {
+            return res.status(404).json({
+                error: 'Unknown site'
+            });
+        }
+        const memberRole = ((_hostSnapshot_get = hostSnapshot.get('memberRoles')) != null ? _hostSnapshot_get : {})[decoded.uid];
+        if (memberRole !== 'admin' && memberRole !== 'editor') {
+            return res.status(403).json({
+                error: 'Not a site admin or editor'
+            });
+        }
+        // Plan gate rides the owning org's doc (AGL-238).
+        const orgForHost = await getOrgForHost(hostId);
+        const org = (_ref5 = orgForHost == null ? void 0 : orgForHost.org) != null ? _ref5 : {};
+        if (!checkEntitlement(org, 'marketplaceSelling')) {
+            return res.status(403).json({
+                error: 'Publishing to the marketplace requires a Pro plan'
+            });
+        }
+        if (!(orgForHost == null ? void 0 : orgForHost.orgId)) {
+            return res.status(409).json({
+                error: 'Site has no owning organization'
+            });
+        }
+        // Publishing is ORG-ONLY (AGL-652).
+        const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId);
+        // Profile, payouts AND the publisher agreement, in one gate
+        // (AGL-2282) — see `publishPreconditionRefusal`.
+        const refusal = publishPreconditionRefusal(publisher, {
+            priceUsd,
+            sells: 'templates'
+        });
+        if (refusal) return res.status(refusal.status).json(refusal.body);
+        // Capture: every screen in the routing map (published) with its
+        // published version, sanitized like any marketplace definition.
+        const routingMap = (_hostSnapshot_get1 = hostSnapshot.get('screens')) != null ? _hostSnapshot_get1 : {};
+        const screenIds = Object.keys(routingMap).slice(0, MAX_TEMPLATE_SCREENS);
+        if (!screenIds.length) {
+            return res.status(422).json({
+                error: 'Publish at least one screen before templating'
+            });
+        }
+        const screens = [];
+        for (const screenId of screenIds){
+            var _screen_displayName;
+            const screenSnapshot = await hostRef.collection('screens').doc(screenId).get();
+            const screen = screenSnapshot.data();
+            if (!screen || screen.deletedAt || !screen.versionId) continue;
+            const versionSnapshot = await hostRef.collection('screens').doc(screenId).collection('versions').doc(String(screen.versionId)).get();
+            // `nodes` is stored in more than one form and the besigner writes the
+            // COMPRESSED one, which the Admin SDK materialises as a Node `Buffer`
+            // (AGL-1395). Read raw, that Buffer is truthy, so the guard below let it
+            // straight through to the sanitizer — which found no `_@_` on it and
+            // told the author their screen had no root node. Every besigner-edited
+            // screen failed here, blaming content that was fine.
+            const nodes = decodeStoredNodes(versionSnapshot.get('nodes'));
+            if (!nodes) continue;
+            const sanitized = sanitizeMarketplaceDefinition({
+                rootId: CANVAS_ROOT_ELEMENT_ID,
+                nodes
+            });
+            if (sanitized.ok === false) {
+                var _screen_displayName1;
+                return res.status(422).json({
+                    error: `Screen "${(_screen_displayName1 = screen.displayName) != null ? _screen_displayName1 : screenId}": ${sanitized.error}`
+                });
+            }
+            screens.push(_extends({
+                displayName: (_screen_displayName = screen.displayName) != null ? _screen_displayName : 'Screen'
+            }, screen.description && {
+                description: screen.description
+            }, screen.seo && {
+                seo: screen.seo
+            }, {
+                slug: routingMap[screenId],
+                nodes: sanitized.nodes
+            }));
+        }
+        if (!screens.length) {
+            return res.status(422).json({
+                error: 'No publishable screens with versions found'
+            });
+        }
+        // One template listing per source host; re-publish bumps the version.
+        const existing = await firestore.collection('marketplaceListings').where('profileId', '==', publisher.orgId).where('sourceHostId', '==', hostId).limit(1).get();
+        const listingRef = existing.empty ? firestore.collection('marketplaceListings').doc(createResourceUid()) : existing.docs[0].ref;
+        const version = existing.empty ? 1 : Number((_existing_docs__get = existing.docs[0].get('latestVersion')) != null ? _existing_docs__get : 0) + 1;
+        const now = firebaseAdmin.firestore.FieldValue.serverTimestamp();
+        await listingRef.set(_extends({
+            // `kind` retained alongside artifactType so listings published by
+            // an older build still resolve (AGL-654).
+            kind: 'template',
+            artifactType: 'template',
+            profileId: publisher.orgId,
+            sourceHostId: hostId,
+            displayName: displayName.trim()
+        }, description.trim() && {
+            description: description.trim()
+        }, category.trim() && {
+            category: category.trim()
+        }, {
+            priceUsd,
+            screenCount: screens.length,
+            latestVersion: version,
+            deletedAt: null
+        }, existing.empty && {
+            createdAt: now
+        }, {
+            updatedAt: now,
+            versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({
+                version,
+                publishedAt: firebaseAdmin.firestore.Timestamp.now()
+            })
+        }), {
+            merge: true
+        });
+        await listingRef.collection('versions').doc(String(version)).set({
+            template: {
+                screens,
+                theme: (_hostSnapshot_get2 = hostSnapshot.get('theme')) != null ? _hostSnapshot_get2 : null
+            },
+            publishedAt: now
+        });
+        return res.status(200).json({
+            listingId: listingRef.id,
+            version
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Template publish failed'
+        });
+    }
+};
+
+//# sourceMappingURL=publish-template.js.map

package/src/lib/server/publish-template.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publish-template.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  CANVAS_ROOT_ELEMENT_ID,\n  checkEntitlement,\n  createResourceUid,\n  decodeStoredNodes,\n} from '@aglyn/aglyn/server'\nimport {\n  marketplacePriceRefusal,\n  sanitizeMarketplaceDefinition,\n} from '../model'\nimport { firebaseAdmin, getOrgForHost } from '@aglyn/tenant-data-admin'\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { resolveOrgPermissions } from '@aglyn/tenant-runtime/org-permissions'\nimport { resolvePublisherProfile } from './publisher-profile'\nimport { publishPreconditionRefusal } from './publish-preconditions'\n\nconst MAX_TEMPLATE_SCREENS = 25\n\n/**\n * Publishes a host as a site template (AGL-137): captures every published\n * screen (nodes run through the same marketplace sanitizer as component\n * publishing — the id allowlist and size caps apply per screen) plus the\n * theme into a `marketplaceListings` doc with `kind: 'template'`. Same\n * gates as component publishing: host admin, marketplace profile,\n * `marketplaceSelling` for plan-gated workspaces, Stripe onboarding for paid\n * listings. One template per source host; re-publishing bumps the version.\n */\nexport const publishTemplateHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  const hostId = String(req.body?.hostId ?? '')\n  const displayName = String(req.body?.displayName ?? '').slice(0, 80)\n  const description = String(req.body?.description ?? '').slice(0, 500)\n  const category = String(req.body?.category ?? '').slice(0, 40)\n  const priceUsd = Math.round(Number(req.body?.priceUsd ?? 0)) || 0\n  // The price floor and ceiling, from ONE validator (AGL-2343): a paid listing\n  // under `MARKETPLACE_MIN_PRICE_USD` loses money on every sale, because\n  // marketplace checkout is a destination charge whose Stripe fee is debited\n  // from the platform's balance. Also enforced in `publishPreconditionRefusal`\n  // below, so a door that drops this line is still covered.\n  const priceRefusal = marketplacePriceRefusal(priceUsd)\n  if (priceRefusal) {\n    return res.status(400).json({ error: priceRefusal })\n  }\n  if (!hostId || !displayName.trim()) {\n    return res.status(400).json({ error: 'Missing hostId or displayName' })\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const membership = await resolveOrgPermissions(decoded.uid, { hostId })\n    if (!membership.permissions.publishToMarketplace) {\n      return res.status(403).json({\n        error: 'Your organization role does not allow publishing to the marketplace',\n      })\n    }\n    const firestore = firebaseAdmin.app().firestore()\n\n    const hostRef = firestore.collection('hosts').doc(hostId)\n    const hostSnapshot = await hostRef.get()\n    if (!hostSnapshot.exists) {\n      return res.status(404).json({ error: 'Unknown site' })\n    }\n    const memberRole = (hostSnapshot.get('memberRoles') ?? {})[decoded.uid]\n    if (memberRole !== 'admin' && memberRole !== 'editor') {\n      return res.status(403).json({ error: 'Not a site admin or editor' })\n    }\n\n    // Plan gate rides the owning org's doc (AGL-238).\n    const orgForHost = await getOrgForHost(hostId)\n    const org = orgForHost?.org ?? {}\n    if (!checkEntitlement(org as any, 'marketplaceSelling')) {\n      return res.status(403).json({\n        error: 'Publishing to the marketplace requires a Pro plan',\n      })\n    }\n    if (!orgForHost?.orgId) {\n      return res.status(409).json({ error: 'Site has no owning organization' })\n    }\n\n    // Publishing is ORG-ONLY (AGL-652).\n    const publisher = await resolvePublisherProfile(firestore, orgForHost.orgId)\n    // Profile, payouts AND the publisher agreement, in one gate\n    // (AGL-2282) — see `publishPreconditionRefusal`.\n    const refusal = publishPreconditionRefusal(publisher, {\n      priceUsd,\n      sells: 'templates',\n    })\n    if (refusal) return res.status(refusal.status).json(refusal.body)\n\n    // Capture: every screen in the routing map (published) with its\n    // published version, sanitized like any marketplace definition.\n    const routingMap = (hostSnapshot.get('screens') ?? {}) as Record<\n      string,\n      string\n    >\n    const screenIds = Object.keys(routingMap).slice(0, MAX_TEMPLATE_SCREENS)\n    if (!screenIds.length) {\n      return res\n        .status(422)\n        .json({ error: 'Publish at least one screen before templating' })\n    }\n    const screens: any[] = []\n    for (const screenId of screenIds) {\n      const screenSnapshot = await hostRef\n        .collection('screens')\n        .doc(screenId)\n        .get()\n      const screen = screenSnapshot.data() as any\n      if (!screen || screen.deletedAt || !screen.versionId) continue\n      const versionSnapshot = await hostRef\n        .collection('screens')\n        .doc(screenId)\n        .collection('versions')\n        .doc(String(screen.versionId))\n        .get()\n      // `nodes` is stored in more than one form and the besigner writes the\n      // COMPRESSED one, which the Admin SDK materialises as a Node `Buffer`\n      // (AGL-1395). Read raw, that Buffer is truthy, so the guard below let it\n      // straight through to the sanitizer — which found no `_@_` on it and\n      // told the author their screen had no root node. Every besigner-edited\n      // screen failed here, blaming content that was fine.\n      const nodes = decodeStoredNodes(versionSnapshot.get('nodes'))\n      if (!nodes) continue\n      const sanitized = sanitizeMarketplaceDefinition({\n        rootId: CANVAS_ROOT_ELEMENT_ID,\n        nodes,\n      })\n      if (sanitized.ok === false) {\n        return res.status(422).json({\n          error: `Screen \"${screen.displayName ?? screenId}\": ${sanitized.error}`,\n        })\n      }\n      screens.push({\n        displayName: screen.displayName ?? 'Screen',\n        ...(screen.description && { description: screen.description }),\n        ...(screen.seo && { seo: screen.seo }),\n        slug: routingMap[screenId],\n        nodes: sanitized.nodes,\n      })\n    }\n    if (!screens.length) {\n      return res\n        .status(422)\n        .json({ error: 'No publishable screens with versions found' })\n    }\n\n    // One template listing per source host; re-publish bumps the version.\n    const existing = await firestore\n      .collection('marketplaceListings')\n      .where('profileId', '==', publisher.orgId)\n      .where('sourceHostId', '==', hostId)\n      .limit(1)\n      .get()\n    const listingRef = existing.empty\n      ? firestore.collection('marketplaceListings').doc(createResourceUid())\n      : existing.docs[0].ref\n    const version = existing.empty\n      ? 1\n      : Number(existing.docs[0].get('latestVersion') ?? 0) + 1\n    const now = firebaseAdmin.firestore.FieldValue.serverTimestamp()\n\n    await listingRef.set(\n      {\n        // `kind` retained alongside artifactType so listings published by\n        // an older build still resolve (AGL-654).\n        kind: 'template',\n        artifactType: 'template',\n        profileId: publisher.orgId,\n        sourceHostId: hostId,\n        displayName: displayName.trim(),\n        ...(description.trim() && { description: description.trim() }),\n        ...(category.trim() && { category: category.trim() }),\n        priceUsd,\n        screenCount: screens.length,\n        latestVersion: version,\n        deletedAt: null,\n        ...(existing.empty && { createdAt: now }),\n        updatedAt: now,\n        versionHistory: firebaseAdmin.firestore.FieldValue.arrayUnion({\n          version,\n          publishedAt: firebaseAdmin.firestore.Timestamp.now(),\n        }),\n      },\n      { merge: true },\n    )\n    await listingRef.collection('versions').doc(String(version)).set({\n      template: {\n        screens,\n        theme: hostSnapshot.get('theme') ?? null,\n      },\n      publishedAt: now,\n    })\n\n    return res.status(200).json({ listingId: listingRef.id, version })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Template publish failed' })\n  }\n}\n"],"names":["CANVAS_ROOT_ELEMENT_ID","checkEntitlement","createResourceUid","decodeStoredNodes","marketplacePriceRefusal","sanitizeMarketplaceDefinition","firebaseAdmin","getOrgForHost","resolveOrgPermissions","resolvePublisherProfile","publishPreconditionRefusal","MAX_TEMPLATE_SCREENS","publishTemplateHandler","req","res","method","status","json","error","hostId","String","body","displayName","slice","description","category","priceUsd","Math","round","Number","priceRefusal","trim","authorization","headers","idToken","startsWith","length","undefined","hostSnapshot","existing","decoded","app","auth","verifyIdToken","membership","uid","permissions","publishToMarketplace","firestore","hostRef","collection","doc","get","exists","memberRole","orgForHost","org","orgId","publisher","refusal","sells","routingMap","screenIds","Object","keys","screens","screenId","screen","screenSnapshot","data","deletedAt","versionId","versionSnapshot","nodes","sanitized","rootId","ok","push","seo","slug","where","limit","listingRef","empty","docs","ref","version","now","FieldValue","serverTimestamp","set","kind","artifactType","profileId","sourceHostId","screenCount","latestVersion","createdAt","updatedAt","versionHistory","arrayUnion","publishedAt","Timestamp","merge","template","theme","listingId","id","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,sBAAsB,EACtBC,gBAAgB,EAChBC,iBAAiB,EACjBC,iBAAiB,QACZ,sBAAqB;AAC5B,SACEC,uBAAuB,EACvBC,6BAA6B,QACxB,oBAAU;AACjB,SAASC,aAAa,EAAEC,aAAa,QAAQ,2BAA0B;AAEvE,SAASC,qBAAqB,QAAQ,wCAAuC;AAC7E,SAASC,uBAAuB,QAAQ,yBAAqB;AAC7D,SAASC,0BAA0B,QAAQ,6BAAyB;AAEpE,MAAMC,uBAAuB;AAE7B;;;;;;;;CAQC,GACD,OAAO,MAAMC,yBAA2C,OAAOC,KAAKC;0CAsBrCD;QAlBPA,WACKA,YACAA,YACHA,YACWA;IAPnC,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzB,OAAOD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,MAAMC,SAASC,gBAAOP,YAAAA,IAAIQ,IAAI,qBAARR,UAAUM,MAAM,mBAAI;IAC1C,MAAMG,cAAcF,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUS,WAAW,oBAAI,IAAIC,KAAK,CAAC,GAAG;IACjE,MAAMC,cAAcJ,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUW,WAAW,oBAAI,IAAID,KAAK,CAAC,GAAG;IACjE,MAAME,WAAWL,iBAAOP,aAAAA,IAAIQ,IAAI,qBAARR,WAAUY,QAAQ,oBAAI,IAAIF,KAAK,CAAC,GAAG;IAC3D,MAAMG,WAAWC,KAAKC,KAAK,CAACC,iBAAOhB,aAAAA,IAAIQ,IAAI,qBAARR,WAAUa,QAAQ,oBAAI,OAAO;IAChE,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAMI,eAAe1B,wBAAwBsB;IAC7C,IAAII,cAAc;QAChB,OAAOhB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAOY;QAAa;IACpD;IACA,IAAI,CAACX,UAAU,CAACG,YAAYS,IAAI,IAAI;QAClC,OAAOjB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAgC;IACvE;IAEA,MAAMc,gBAAgBZ,QAAOP,6BAAAA,IAAIoB,OAAO,CAACD,aAAa,YAAzBnB,6BAA6B;IAC1D,MAAMqB,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcT,KAAK,CAAC,UAAUa,MAAM,IACpCC;IACJ,IAAI,CAACH,SAAS,OAAOpB,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;YAekBoB,0BA6BAA,oBAmETC,qBA8BAD;QA5IX,MAAME,UAAU,MAAMlC,cAAcmC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACT;QAC/D,MAAMU,aAAa,MAAMpC,sBAAsBgC,QAAQK,GAAG,EAAE;YAAE1B;QAAO;QACrE,IAAI,CAACyB,WAAWE,WAAW,CAACC,oBAAoB,EAAE;YAChD,OAAOjC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,MAAM8B,YAAY1C,cAAcmC,GAAG,GAAGO,SAAS;QAE/C,MAAMC,UAAUD,UAAUE,UAAU,CAAC,SAASC,GAAG,CAAChC;QAClD,MAAMmB,eAAe,MAAMW,QAAQG,GAAG;QACtC,IAAI,CAACd,aAAae,MAAM,EAAE;YACxB,OAAOvC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAe;QACtD;QACA,MAAMoC,aAAa,EAAChB,oBAAAA,aAAac,GAAG,CAAC,0BAAjBd,oBAAmC,CAAC,EAAE,CAACE,QAAQK,GAAG,CAAC;QACvE,IAAIS,eAAe,WAAWA,eAAe,UAAU;YACrD,OAAOxC,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAA6B;QACpE;QAEA,kDAAkD;QAClD,MAAMqC,aAAa,MAAMhD,cAAcY;QACvC,MAAMqC,eAAMD,8BAAAA,WAAYC,GAAG,oBAAI,CAAC;QAChC,IAAI,CAACvD,iBAAiBuD,KAAY,uBAAuB;YACvD,OAAO1C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QACA,IAAI,EAACqC,8BAAAA,WAAYE,KAAK,GAAE;YACtB,OAAO3C,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAkC;QACzE;QAEA,oCAAoC;QACpC,MAAMwC,YAAY,MAAMjD,wBAAwBuC,WAAWO,WAAWE,KAAK;QAC3E,4DAA4D;QAC5D,iDAAiD;QACjD,MAAME,UAAUjD,2BAA2BgD,WAAW;YACpDhC;YACAkC,OAAO;QACT;QACA,IAAID,SAAS,OAAO7C,IAAIE,MAAM,CAAC2C,QAAQ3C,MAAM,EAAEC,IAAI,CAAC0C,QAAQtC,IAAI;QAEhE,gEAAgE;QAChE,gEAAgE;QAChE,MAAMwC,cAAcvB,qBAAAA,aAAac,GAAG,CAAC,sBAAjBd,qBAA+B,CAAC;QAIpD,MAAMwB,YAAYC,OAAOC,IAAI,CAACH,YAAYtC,KAAK,CAAC,GAAGZ;QACnD,IAAI,CAACmD,UAAU1B,MAAM,EAAE;YACrB,OAAOtB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAAgD;QACnE;QACA,MAAM+C,UAAiB,EAAE;QACzB,KAAK,MAAMC,YAAYJ,UAAW;gBA+BjBK;YA9Bf,MAAMC,iBAAiB,MAAMnB,QAC1BC,UAAU,CAAC,WACXC,GAAG,CAACe,UACJd,GAAG;YACN,MAAMe,SAASC,eAAeC,IAAI;YAClC,IAAI,CAACF,UAAUA,OAAOG,SAAS,IAAI,CAACH,OAAOI,SAAS,EAAE;YACtD,MAAMC,kBAAkB,MAAMvB,QAC3BC,UAAU,CAAC,WACXC,GAAG,CAACe,UACJhB,UAAU,CAAC,YACXC,GAAG,CAAC/B,OAAO+C,OAAOI,SAAS,GAC3BnB,GAAG;YACN,sEAAsE;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,qEAAqE;YACrE,uEAAuE;YACvE,qDAAqD;YACrD,MAAMqB,QAAQtE,kBAAkBqE,gBAAgBpB,GAAG,CAAC;YACpD,IAAI,CAACqB,OAAO;YACZ,MAAMC,YAAYrE,8BAA8B;gBAC9CsE,QAAQ3E;gBACRyE;YACF;YACA,IAAIC,UAAUE,EAAE,KAAK,OAAO;oBAENT;gBADpB,OAAOrD,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAC1BC,OAAO,CAAC,QAAQ,GAAEiD,uBAAAA,OAAO7C,WAAW,YAAlB6C,uBAAsBD,SAAS,GAAG,EAAEQ,UAAUxD,KAAK,EAAE;gBACzE;YACF;YACA+C,QAAQY,IAAI,CAAC;gBACXvD,WAAW,GAAE6C,sBAAAA,OAAO7C,WAAW,YAAlB6C,sBAAsB;eAC/BA,OAAO3C,WAAW,IAAI;gBAAEA,aAAa2C,OAAO3C,WAAW;YAAC,GACxD2C,OAAOW,GAAG,IAAI;gBAAEA,KAAKX,OAAOW,GAAG;YAAC;gBACpCC,MAAMlB,UAAU,CAACK,SAAS;gBAC1BO,OAAOC,UAAUD,KAAK;;QAE1B;QACA,IAAI,CAACR,QAAQ7B,MAAM,EAAE;YACnB,OAAOtB,IACJE,MAAM,CAAC,KACPC,IAAI,CAAC;gBAAEC,OAAO;YAA6C;QAChE;QAEA,sEAAsE;QACtE,MAAMqB,WAAW,MAAMS,UACpBE,UAAU,CAAC,uBACX8B,KAAK,CAAC,aAAa,MAAMtB,UAAUD,KAAK,EACxCuB,KAAK,CAAC,gBAAgB,MAAM7D,QAC5B8D,KAAK,CAAC,GACN7B,GAAG;QACN,MAAM8B,aAAa3C,SAAS4C,KAAK,GAC7BnC,UAAUE,UAAU,CAAC,uBAAuBC,GAAG,CAACjD,uBAChDqC,SAAS6C,IAAI,CAAC,EAAE,CAACC,GAAG;QACxB,MAAMC,UAAU/C,SAAS4C,KAAK,GAC1B,IACAtD,QAAOU,sBAAAA,SAAS6C,IAAI,CAAC,EAAE,CAAChC,GAAG,CAAC,4BAArBb,sBAAyC,KAAK;QACzD,MAAMgD,MAAMjF,cAAc0C,SAAS,CAACwC,UAAU,CAACC,eAAe;QAE9D,MAAMP,WAAWQ,GAAG,CAClB;YACE,kEAAkE;YAClE,0CAA0C;YAC1CC,MAAM;YACNC,cAAc;YACdC,WAAWnC,UAAUD,KAAK;YAC1BqC,cAAc3E;YACdG,aAAaA,YAAYS,IAAI;WACzBP,YAAYO,IAAI,MAAM;YAAEP,aAAaA,YAAYO,IAAI;QAAG,GACxDN,SAASM,IAAI,MAAM;YAAEN,UAAUA,SAASM,IAAI;QAAG;YACnDL;YACAqE,aAAa9B,QAAQ7B,MAAM;YAC3B4D,eAAeV;YACfhB,WAAW;WACP/B,SAAS4C,KAAK,IAAI;YAAEc,WAAWV;QAAI;YACvCW,WAAWX;YACXY,gBAAgB7F,cAAc0C,SAAS,CAACwC,UAAU,CAACY,UAAU,CAAC;gBAC5Dd;gBACAe,aAAa/F,cAAc0C,SAAS,CAACsD,SAAS,CAACf,GAAG;YACpD;YAEF;YAAEgB,OAAO;QAAK;QAEhB,MAAMrB,WAAWhC,UAAU,CAAC,YAAYC,GAAG,CAAC/B,OAAOkE,UAAUI,GAAG,CAAC;YAC/Dc,UAAU;gBACRvC;gBACAwC,KAAK,GAAEnE,qBAAAA,aAAac,GAAG,CAAC,oBAAjBd,qBAA6B;YACtC;YACA+D,aAAad;QACf;QAEA,OAAOzE,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEyF,WAAWxB,WAAWyB,EAAE;YAAErB;QAAQ;IAClE,EAAE,OAAOpE,OAAO;QACd0F,QAAQ1F,KAAK,CAACA;QACd,OAAOJ,IAAIE,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA0B;IACjE;AACF,EAAC"}

package/src/lib/server/publish-theme.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/**
+ * Publishes a site's theme to the marketplace (AGL-1020).
+ *
+ * A theme is the one artifact that is pure data — no nodes, no code, no
+ * bundle — so it needs no sanitizer allowlist the way a component tree does.
+ * What it needs instead is validation of the two things that make an installed
+ * theme unusable, and both are refused here rather than caught in review:
+ * a missing colour scheme, and text nobody can read. See
+ * `validateThemeForPublish` for why those two and not others.
+ *
+ * The theme is stored as a field on the host document, not as its own
+ * collection, so unlike every other publish route there is no artifact id to
+ * pick — the site IS the selection. That also makes the listing key
+ * `sourceThemeHostId`, so re-publishing the same site's theme bumps its version
+ * rather than opening a second listing.
+ *
+ * Gates mirror `publish-layout` exactly: org permission, host role,
+ * `marketplaceSelling`, a publisher profile, and payouts before anything sells.
+ */
+export declare const publishThemeHandler: PluginApiHandler;
+export default publishThemeHandler;