@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/publisher-profile-save.js

@@ -0,0 +1,226 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { PUBLISHER_AGREEMENT_BYTES, PUBLISHER_AGREEMENT_SHA256, PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE, PUBLISHER_AGREEMENT_VERSION, publisherAgreementIsPublished } from "@aglyn/aglyn/app-utils/publisher-agreement";
+import { isValidPublisherHandle, validatePublisherProfileContent } from "../model/marketplace.js";
+import { canActAsPublisher, claimPublisherHandle, PublisherHandleTakenError, PUBLISHER_PROFILES } from "./publisher-profile.js";
+/**
+ * Record an org's acceptance of the marketplace publisher agreement
+ * (AGL-1077).
+ *
+ * Server-owned, like the handle and the payout keys: an acceptance a client
+ * could write is not evidence of anything. The rules block the field, and
+ * this is the only path that sets it.
+ *
+ * The submitted version must be the one currently in force. A client that
+ * echoes back some other string is refused rather than recorded — otherwise
+ * "accepted v1 forever" becomes a way to never see a changed agreement, and
+ * the whole point of versioning it is that a change re-asks.
+ *
+ * And the document must exist (AGL-1660). The console hides the control while
+ * it does not, but the console is UI: this route is the only writer, so this
+ * is the only place the refusal is a fact. Recording an acceptance of text we
+ * never served would put a signature in the record with nothing behind it,
+ * which is strictly worse than having no record — it looks like evidence.
+ */ const acceptPublisherAgreement = async (req, res)=>{
+    var _ref, _ref1, _req_headers_authorization;
+    var _req_body, _req_body1;
+    const orgId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.orgId) != null ? _ref : '');
+    const version = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.version) != null ? _ref1 : '');
+    if (!orgId) return res.status(400).json({
+        error: 'Missing orgId'
+    });
+    if (!publisherAgreementIsPublished()) {
+        // 409, the same conflict-with-current-state answer a version mismatch
+        // gets: the request is well-formed, the world is not ready for it.
+        return res.status(409).json({
+            error: PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE,
+            unavailable: true,
+            currentVersion: PUBLISHER_AGREEMENT_VERSION
+        });
+    }
+    if (version !== PUBLISHER_AGREEMENT_VERSION) {
+        return res.status(409).json({
+            error: 'The agreement changed while you were reading it. Reload and read ' + 'the current version before accepting.',
+            currentVersion: PUBLISHER_AGREEMENT_VERSION
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        // The ORG is the party (AGL-652), and only someone who can bind it may
+        // say so — the same gate that owns the profile's public identity.
+        if (!await canActAsPublisher(firestore, decoded.uid, orgId)) {
+            return res.status(403).json({
+                error: 'Only an organization owner or admin can accept the publisher ' + 'agreement on its behalf'
+            });
+        }
+        await firestore.collection(PUBLISHER_PROFILES).doc(orgId).set({
+            publisherAgreement: {
+                version: PUBLISHER_AGREEMENT_VERSION,
+                // The snapshot pin (AGL-1678): the version is a label we control
+                // and can reuse, so the record also carries the sha256 and byte
+                // length of the archived snapshot of the text the publisher was
+                // shown — self-contained evidence of content, same machinery as
+                // the signup clickwrap (AGL-1497).
+                sha256: PUBLISHER_AGREEMENT_SHA256,
+                bytes: PUBLISHER_AGREEMENT_BYTES,
+                // A uid, not the org: "this organization agreed" is not a fact
+                // anybody can be held to. A named person on a date is.
+                acceptedBy: decoded.uid,
+                acceptedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            }
+        }, {
+            merge: true
+        });
+        return res.status(200).json({
+            ok: true,
+            version: PUBLISHER_AGREEMENT_VERSION
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Could not record the acceptance'
+        });
+    }
+};
+/**
+ * Save an org's publisher profile (AGL-652).
+ *
+ * The handle has to be claimed transactionally, and a client can't do that —
+ * a read-then-write uniqueness check lets two orgs racing for the same handle
+ * both succeed, and the loser silently loses its marketplace URL. So the
+ * handle is server-owned here, exactly like the host subdomain (AGL-642), and
+ * the rules freeze it against client writes.
+ *
+ * Manager-only: the profile is the org's public identity and its payout
+ * anchor, so it follows the same gate as the profile rules.
+ */ export const publisherProfileSaveHandler = async (req, res)=>{
+    var _ref, _ref1, _ref2, _req_headers_authorization;
+    var _req_body, _req_body1, _req_body2, _req_body3;
+    if (req.method !== 'POST') {
+        return res.status(405).json({
+            error: 'Method not allowed'
+        });
+    }
+    // Accepting the agreement (AGL-1077) is not a profile edit — it writes a
+    // field the profile save must never touch, so it takes its own branch
+    // rather than riding along with a name change.
+    if (((_req_body = req.body) == null ? void 0 : _req_body.action) === 'accept-agreement') {
+        return acceptPublisherAgreement(req, res);
+    }
+    const orgId = String((_ref = (_req_body1 = req.body) == null ? void 0 : _req_body1.orgId) != null ? _ref : '');
+    const handle = String((_ref1 = (_req_body2 = req.body) == null ? void 0 : _req_body2.handle) != null ? _ref1 : '').trim().toLowerCase();
+    const displayName = String((_ref2 = (_req_body3 = req.body) == null ? void 0 : _req_body3.displayName) != null ? _ref2 : '').trim().slice(0, 80);
+    if (!orgId) return res.status(400).json({
+        error: 'Missing orgId'
+    });
+    if (!displayName) {
+        return res.status(400).json({
+            error: 'A display name is required'
+        });
+    }
+    if (!isValidPublisherHandle(handle)) {
+        return res.status(400).json({
+            error: 'Handles are 3–30 characters: lowercase letters, numbers and ' + 'hyphens, starting and ending alphanumeric.'
+        });
+    }
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return res.status(401).json({
+        error: 'Unauthenticated'
+    });
+    try {
+        var _ref3, _req_body4, _extras_content;
+        var _req_body5, _req_body6;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        const firestore = firebaseAdmin.app().firestore();
+        if (!await canActAsPublisher(firestore, decoded.uid, orgId)) {
+            return res.status(403).json({
+                error: 'Only an organization owner or admin can edit the publisher profile'
+            });
+        }
+        const ref = firestore.collection(PUBLISHER_PROFILES).doc(orgId);
+        const previousHandle = (await ref.get()).get('handle');
+        // Claim first: if the handle is taken there must be no profile write, or
+        // the org would show a handle it doesn't actually hold.
+        try {
+            await claimPublisherHandle(firestore, orgId, handle, previousHandle);
+        } catch (error) {
+            if (error instanceof PublisherHandleTakenError) {
+                return res.status(409).json({
+                    error: 'That handle is already taken'
+                });
+            }
+            throw error;
+        }
+        // PRESENT-AND-EMPTY CLEARS; ABSENT LEAVES ALONE.
+        //
+        // The write below is a merge, and `bio` was spread in only when truthy, so
+        // an empty one was a no-op and the stored bio survived every attempt to
+        // remove it. The publisher could rewrite it but never take it down — while
+        // every URL field in this same write has cleared on empty since AGL-1009.
+        //
+        // Presence is what separates "clear this" from "this request is not about
+        // the bio": `req.body.bio` absent must not delete a bio the caller never
+        // mentioned, which a bare `?? ''` would do to any client that omits it.
+        const bioProvided = ((_req_body5 = req.body) == null ? void 0 : _req_body5.bio) !== undefined;
+        const bio = String((_ref3 = (_req_body6 = req.body) == null ? void 0 : _req_body6.bio) != null ? _ref3 : '').trim().slice(0, 500);
+        // Logo, support contact and social links (AGL-1009): validated here on
+        // the save route — the same server-owned discipline as the handle — and
+        // through `validatePublisherProfileContent`, which shares the listing
+        // validator's https-only rule rather than growing a second URL parser.
+        const extras = validatePublisherProfileContent((_req_body4 = req.body) != null ? _req_body4 : {});
+        if (!extras.ok) {
+            return res.status(400).json({
+                error: extras.error
+            });
+        }
+        const extraWrites = {};
+        for (const [key, value] of Object.entries((_extras_content = extras.content) != null ? _extras_content : {})){
+            // An explicit empty string clears the stored field — otherwise a
+            // publisher could add a link but never take one down.
+            extraWrites[key] = value === '' ? firebaseAdmin.firestore.FieldValue.delete() : value;
+        }
+        await ref.set(_extends({
+            handle,
+            displayName
+        }, bioProvided ? {
+            bio: bio ? bio : firebaseAdmin.firestore.FieldValue.delete()
+        } : {}, extraWrites, {
+            updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+        }), {
+            merge: true
+        });
+        return res.status(200).json({
+            ok: true,
+            handle
+        });
+    } catch (error) {
+        console.error(error);
+        return res.status(500).json({
+            error: 'Could not save the profile'
+        });
+    }
+};
+
+//# sourceMappingURL=publisher-profile-save.js.map

package/src/lib/server/publisher-profile-save.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publisher-profile-save.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { type PluginApiHandler } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  PUBLISHER_AGREEMENT_BYTES,\n  PUBLISHER_AGREEMENT_SHA256,\n  PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE,\n  PUBLISHER_AGREEMENT_VERSION,\n  publisherAgreementIsPublished,\n} from '@aglyn/aglyn/app-utils/publisher-agreement'\nimport {\n  isValidPublisherHandle,\n  validatePublisherProfileContent,\n} from '../model/marketplace'\nimport {\n  canActAsPublisher,\n  claimPublisherHandle,\n  PublisherHandleTakenError,\n  PUBLISHER_PROFILES,\n} from './publisher-profile'\n\n/**\n * Record an org's acceptance of the marketplace publisher agreement\n * (AGL-1077).\n *\n * Server-owned, like the handle and the payout keys: an acceptance a client\n * could write is not evidence of anything. The rules block the field, and\n * this is the only path that sets it.\n *\n * The submitted version must be the one currently in force. A client that\n * echoes back some other string is refused rather than recorded — otherwise\n * \"accepted v1 forever\" becomes a way to never see a changed agreement, and\n * the whole point of versioning it is that a change re-asks.\n *\n * And the document must exist (AGL-1660). The console hides the control while\n * it does not, but the console is UI: this route is the only writer, so this\n * is the only place the refusal is a fact. Recording an acceptance of text we\n * never served would put a signature in the record with nothing behind it,\n * which is strictly worse than having no record — it looks like evidence.\n */\nconst acceptPublisherAgreement: PluginApiHandler = async (req, res) => {\n  const orgId = String(req.body?.orgId ?? '')\n  const version = String(req.body?.version ?? '')\n  if (!orgId) return res.status(400).json({ error: 'Missing orgId' })\n  if (!publisherAgreementIsPublished()) {\n    // 409, the same conflict-with-current-state answer a version mismatch\n    // gets: the request is well-formed, the world is not ready for it.\n    return res.status(409).json({\n      error: PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE,\n      unavailable: true,\n      currentVersion: PUBLISHER_AGREEMENT_VERSION,\n    })\n  }\n  if (version !== PUBLISHER_AGREEMENT_VERSION) {\n    return res.status(409).json({\n      error:\n        'The agreement changed while you were reading it. Reload and read ' +\n        'the current version before accepting.',\n      currentVersion: PUBLISHER_AGREEMENT_VERSION,\n    })\n  }\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    // The ORG is the party (AGL-652), and only someone who can bind it may\n    // say so — the same gate that owns the profile's public identity.\n    if (!(await canActAsPublisher(firestore, decoded.uid, orgId))) {\n      return res.status(403).json({\n        error:\n          'Only an organization owner or admin can accept the publisher ' +\n          'agreement on its behalf',\n      })\n    }\n    await firestore\n      .collection(PUBLISHER_PROFILES)\n      .doc(orgId)\n      .set(\n        {\n          publisherAgreement: {\n            version: PUBLISHER_AGREEMENT_VERSION,\n            // The snapshot pin (AGL-1678): the version is a label we control\n            // and can reuse, so the record also carries the sha256 and byte\n            // length of the archived snapshot of the text the publisher was\n            // shown — self-contained evidence of content, same machinery as\n            // the signup clickwrap (AGL-1497).\n            sha256: PUBLISHER_AGREEMENT_SHA256,\n            bytes: PUBLISHER_AGREEMENT_BYTES,\n            // A uid, not the org: \"this organization agreed\" is not a fact\n            // anybody can be held to. A named person on a date is.\n            acceptedBy: decoded.uid,\n            acceptedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n          },\n        },\n        { merge: true },\n      )\n    return res\n      .status(200)\n      .json({ ok: true, version: PUBLISHER_AGREEMENT_VERSION })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Could not record the acceptance' })\n  }\n}\n\n/**\n * Save an org's publisher profile (AGL-652).\n *\n * The handle has to be claimed transactionally, and a client can't do that —\n * a read-then-write uniqueness check lets two orgs racing for the same handle\n * both succeed, and the loser silently loses its marketplace URL. So the\n * handle is server-owned here, exactly like the host subdomain (AGL-642), and\n * the rules freeze it against client writes.\n *\n * Manager-only: the profile is the org's public identity and its payout\n * anchor, so it follows the same gate as the profile rules.\n */\nexport const publisherProfileSaveHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    return res.status(405).json({ error: 'Method not allowed' })\n  }\n  // Accepting the agreement (AGL-1077) is not a profile edit — it writes a\n  // field the profile save must never touch, so it takes its own branch\n  // rather than riding along with a name change.\n  if (req.body?.action === 'accept-agreement') {\n    return acceptPublisherAgreement(req, res)\n  }\n  const orgId = String(req.body?.orgId ?? '')\n  const handle = String(req.body?.handle ?? '').trim().toLowerCase()\n  const displayName = String(req.body?.displayName ?? '').trim().slice(0, 80)\n  if (!orgId) return res.status(400).json({ error: 'Missing orgId' })\n  if (!displayName) {\n    return res.status(400).json({ error: 'A display name is required' })\n  }\n  if (!isValidPublisherHandle(handle)) {\n    return res.status(400).json({\n      error:\n        'Handles are 3–30 characters: lowercase letters, numbers and ' +\n        'hyphens, starting and ending alphanumeric.',\n    })\n  }\n\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return res.status(401).json({ error: 'Unauthenticated' })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    const firestore = firebaseAdmin.app().firestore()\n    if (!(await canActAsPublisher(firestore, decoded.uid, orgId))) {\n      return res.status(403).json({\n        error: 'Only an organization owner or admin can edit the publisher profile',\n      })\n    }\n\n    const ref = firestore.collection(PUBLISHER_PROFILES).doc(orgId)\n    const previousHandle = (await ref.get()).get('handle') as string | undefined\n\n    // Claim first: if the handle is taken there must be no profile write, or\n    // the org would show a handle it doesn't actually hold.\n    try {\n      await claimPublisherHandle(firestore, orgId, handle, previousHandle)\n    } catch (error) {\n      if (error instanceof PublisherHandleTakenError) {\n        return res.status(409).json({ error: 'That handle is already taken' })\n      }\n      throw error\n    }\n\n    // PRESENT-AND-EMPTY CLEARS; ABSENT LEAVES ALONE.\n    //\n    // The write below is a merge, and `bio` was spread in only when truthy, so\n    // an empty one was a no-op and the stored bio survived every attempt to\n    // remove it. The publisher could rewrite it but never take it down — while\n    // every URL field in this same write has cleared on empty since AGL-1009.\n    //\n    // Presence is what separates \"clear this\" from \"this request is not about\n    // the bio\": `req.body.bio` absent must not delete a bio the caller never\n    // mentioned, which a bare `?? ''` would do to any client that omits it.\n    const bioProvided = req.body?.bio !== undefined\n    const bio = String(req.body?.bio ?? '').trim().slice(0, 500)\n    // Logo, support contact and social links (AGL-1009): validated here on\n    // the save route — the same server-owned discipline as the handle — and\n    // through `validatePublisherProfileContent`, which shares the listing\n    // validator's https-only rule rather than growing a second URL parser.\n    const extras = validatePublisherProfileContent(req.body ?? {})\n    if (!extras.ok) {\n      return res.status(400).json({ error: extras.error })\n    }\n    const extraWrites: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(extras.content ?? {})) {\n      // An explicit empty string clears the stored field — otherwise a\n      // publisher could add a link but never take one down.\n      extraWrites[key] =\n        value === '' ? firebaseAdmin.firestore.FieldValue.delete() : value\n    }\n    await ref.set(\n      {\n        handle,\n        displayName,\n        ...(bioProvided\n          ? {\n              bio: bio\n                ? bio\n                : firebaseAdmin.firestore.FieldValue.delete(),\n            }\n          : {}),\n        ...extraWrites,\n        updatedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      },\n      { merge: true },\n    )\n    return res.status(200).json({ ok: true, handle })\n  } catch (error) {\n    console.error(error)\n    return res.status(500).json({ error: 'Could not save the profile' })\n  }\n}\n"],"names":["firebaseAdmin","PUBLISHER_AGREEMENT_BYTES","PUBLISHER_AGREEMENT_SHA256","PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE","PUBLISHER_AGREEMENT_VERSION","publisherAgreementIsPublished","isValidPublisherHandle","validatePublisherProfileContent","canActAsPublisher","claimPublisherHandle","PublisherHandleTakenError","PUBLISHER_PROFILES","acceptPublisherAgreement","req","res","orgId","String","body","version","status","json","error","unavailable","currentVersion","authorization","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","firestore","uid","collection","doc","set","publisherAgreement","sha256","bytes","acceptedBy","acceptedAt","FieldValue","serverTimestamp","merge","ok","console","publisherProfileSaveHandler","method","action","handle","trim","toLowerCase","displayName","extras","ref","previousHandle","get","bioProvided","bio","extraWrites","key","value","Object","entries","content","delete","updatedAt"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SACEC,yBAAyB,EACzBC,0BAA0B,EAC1BC,sCAAsC,EACtCC,2BAA2B,EAC3BC,6BAA6B,QACxB,6CAA4C;AACnD,SACEC,sBAAsB,EACtBC,+BAA+B,QAC1B,0BAAsB;AAC7B,SACEC,iBAAiB,EACjBC,oBAAoB,EACpBC,yBAAyB,EACzBC,kBAAkB,QACb,yBAAqB;AAE5B;;;;;;;;;;;;;;;;;;CAkBC,GACD,MAAMC,2BAA6C,OAAOC,KAAKC;qBAqBhCD;QApBRA,WACEA;IADvB,MAAME,QAAQC,gBAAOH,YAAAA,IAAII,IAAI,qBAARJ,UAAUE,KAAK,mBAAI;IACxC,MAAMG,UAAUF,iBAAOH,aAAAA,IAAII,IAAI,qBAARJ,WAAUK,OAAO,oBAAI;IAC5C,IAAI,CAACH,OAAO,OAAOD,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAgB;IACjE,IAAI,CAAChB,iCAAiC;QACpC,sEAAsE;QACtE,mEAAmE;QACnE,OAAOS,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BC,OAAOlB;YACPmB,aAAa;YACbC,gBAAgBnB;QAClB;IACF;IACA,IAAIc,YAAYd,6BAA6B;QAC3C,OAAOU,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BC,OACE,sEACA;YACFE,gBAAgBnB;QAClB;IACF;IACA,MAAMoB,gBAAgBR,QAAOH,6BAAAA,IAAIY,OAAO,CAACD,aAAa,YAAzBX,6BAA6B;IAC1D,MAAMa,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOZ,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IACrE,IAAI;QACF,MAAMU,UAAU,MAAM/B,cAAcgC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAMS,YAAYnC,cAAcgC,GAAG,GAAGG,SAAS;QAC/C,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,CAAE,MAAM3B,kBAAkB2B,WAAWJ,QAAQK,GAAG,EAAErB,QAAS;YAC7D,OAAOD,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OACE,kEACA;YACJ;QACF;QACA,MAAMc,UACHE,UAAU,CAAC1B,oBACX2B,GAAG,CAACvB,OACJwB,GAAG,CACF;YACEC,oBAAoB;gBAClBtB,SAASd;gBACT,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,gEAAgE;gBAChE,mCAAmC;gBACnCqC,QAAQvC;gBACRwC,OAAOzC;gBACP,+DAA+D;gBAC/D,uDAAuD;gBACvD0C,YAAYZ,QAAQK,GAAG;gBACvBQ,YAAY5C,cAAcmC,SAAS,CAACU,UAAU,CAACC,eAAe;YAChE;QACF,GACA;YAAEC,OAAO;QAAK;QAElB,OAAOjC,IACJK,MAAM,CAAC,KACPC,IAAI,CAAC;YAAE4B,IAAI;YAAM9B,SAASd;QAA4B;IAC3D,EAAE,OAAOiB,OAAO;QACd4B,QAAQ5B,KAAK,CAACA;QACd,OAAOP,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAkC;IACzE;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,MAAM6B,8BAAgD,OAAOrC,KAAKC;4BAyB1CD;QAlBzBA,WAGiBA,YACCA,YACKA;IAX3B,IAAIA,IAAIsC,MAAM,KAAK,QAAQ;QACzB,OAAOrC,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;IAC5D;IACA,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAIR,EAAAA,YAAAA,IAAII,IAAI,qBAARJ,UAAUuC,MAAM,MAAK,oBAAoB;QAC3C,OAAOxC,yBAAyBC,KAAKC;IACvC;IACA,MAAMC,QAAQC,gBAAOH,aAAAA,IAAII,IAAI,qBAARJ,WAAUE,KAAK,mBAAI;IACxC,MAAMsC,SAASrC,iBAAOH,aAAAA,IAAII,IAAI,qBAARJ,WAAUwC,MAAM,oBAAI,IAAIC,IAAI,GAAGC,WAAW;IAChE,MAAMC,cAAcxC,iBAAOH,aAAAA,IAAII,IAAI,qBAARJ,WAAU2C,WAAW,oBAAI,IAAIF,IAAI,GAAG1B,KAAK,CAAC,GAAG;IACxE,IAAI,CAACb,OAAO,OAAOD,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAgB;IACjE,IAAI,CAACmC,aAAa;QAChB,OAAO1C,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;IACA,IAAI,CAACf,uBAAuB+C,SAAS;QACnC,OAAOvC,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAC1BC,OACE,iEACA;QACJ;IACF;IAEA,MAAMG,gBAAgBR,QAAOH,6BAAAA,IAAIY,OAAO,CAACD,aAAa,YAAzBX,6BAA6B;IAC1D,MAAMa,UAAUF,cAAcG,UAAU,CAAC,aACrCH,cAAcI,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOZ,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;QAAEC,OAAO;IAAkB;IAErE,IAAI;mBAuC6CR,YAKL4C;YAXtB5C,YACDA;QAjCnB,MAAMkB,UAAU,MAAM/B,cAAcgC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,MAAMS,YAAYnC,cAAcgC,GAAG,GAAGG,SAAS;QAC/C,IAAI,CAAE,MAAM3B,kBAAkB2B,WAAWJ,QAAQK,GAAG,EAAErB,QAAS;YAC7D,OAAOD,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAC1BC,OAAO;YACT;QACF;QAEA,MAAMqC,MAAMvB,UAAUE,UAAU,CAAC1B,oBAAoB2B,GAAG,CAACvB;QACzD,MAAM4C,iBAAiB,AAAC,CAAA,MAAMD,IAAIE,GAAG,EAAC,EAAGA,GAAG,CAAC;QAE7C,yEAAyE;QACzE,wDAAwD;QACxD,IAAI;YACF,MAAMnD,qBAAqB0B,WAAWpB,OAAOsC,QAAQM;QACvD,EAAE,OAAOtC,OAAO;YACd,IAAIA,iBAAiBX,2BAA2B;gBAC9C,OAAOI,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;oBAAEC,OAAO;gBAA+B;YACtE;YACA,MAAMA;QACR;QAEA,iDAAiD;QACjD,EAAE;QACF,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,MAAMwC,cAAchD,EAAAA,aAAAA,IAAII,IAAI,qBAARJ,WAAUiD,GAAG,MAAKhC;QACtC,MAAMgC,MAAM9C,iBAAOH,aAAAA,IAAII,IAAI,qBAARJ,WAAUiD,GAAG,oBAAI,IAAIR,IAAI,GAAG1B,KAAK,CAAC,GAAG;QACxD,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM6B,SAASlD,iCAAgCM,aAAAA,IAAII,IAAI,YAARJ,aAAY,CAAC;QAC5D,IAAI,CAAC4C,OAAOT,EAAE,EAAE;YACd,OAAOlC,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOoC,OAAOpC,KAAK;YAAC;QACpD;QACA,MAAM0C,cAAuC,CAAC;QAC9C,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,EAACV,kBAAAA,OAAOW,OAAO,YAAdX,kBAAkB,CAAC,GAAI;YAC/D,iEAAiE;YACjE,sDAAsD;YACtDM,WAAW,CAACC,IAAI,GACdC,UAAU,KAAKjE,cAAcmC,SAAS,CAACU,UAAU,CAACwB,MAAM,KAAKJ;QACjE;QACA,MAAMP,IAAInB,GAAG,CACX;YACEc;YACAG;WACIK,cACA;YACEC,KAAKA,MACDA,MACA9D,cAAcmC,SAAS,CAACU,UAAU,CAACwB,MAAM;QAC/C,IACA,CAAC,GACFN;YACHO,WAAWtE,cAAcmC,SAAS,CAACU,UAAU,CAACC,eAAe;YAE/D;YAAEC,OAAO;QAAK;QAEhB,OAAOjC,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAE4B,IAAI;YAAMK;QAAO;IACjD,EAAE,OAAOhC,OAAO;QACd4B,QAAQ5B,KAAK,CAACA;QACd,OAAOP,IAAIK,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA6B;IACpE;AACF,EAAC"}

package/src/lib/server/publisher-profile.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PublisherAgreementAcceptance } from '@aglyn/aglyn/app-utils/publisher-agreement';
+/** `publisherProfiles/{orgId}` — the org's marketplace identity (AGL-652). */
+export declare const PUBLISHER_PROFILES = "publisherProfiles";
+/** `publisherHandles/{handle}` — uniqueness reservations. */
+export declare const PUBLISHER_HANDLES = "publisherHandles";
+export interface ResolvedPublisher {
+    orgId: string;
+    handle: string;
+    displayName?: string;
+    stripeAccountId?: string;
+    stripeChargesEnabled?: boolean;
+    /**
+     * Which Stripe world the payout account belongs to (AGL-2471).
+     *
+     * PROJECTED, and that is the load-bearing part. The sale gate in
+     * `checkout.ts` reads this shape, not the raw document — an API projection
+     * that drops a field its predicate needs turns the predicate into a
+     * constant, and here the constant would be "refuse every marketplace sale".
+     * Left three-valued deliberately: `undefined` means never established and
+     * must stay distinguishable from `false`.
+     */
+    stripeAccountLivemode?: boolean;
+    /**
+     * Which marketplace publisher agreement this ORG has accepted (AGL-1077).
+     * Absent on every profile created before the agreement existed, which is
+     * why publishing refuses rather than assuming consent.
+     */
+    agreement?: PublisherAgreementAcceptance;
+}
+/**
+ * Load the publishing org's marketplace profile (AGL-652).
+ *
+ * Publishing is org-only: the publisher is the ORG, not the person who
+ * happened to click publish. Every publish route resolves through here so
+ * they can't drift on which identity a listing is attributed to.
+ *
+ * Returns `null` when the org has no profile yet — callers turn that into a
+ * 412 telling the user to set one up, matching the previous behaviour when a
+ * personal profile was missing.
+ */
+export declare function resolvePublisherProfile(firestore: FirebaseFirestore.Firestore, orgId: string): Promise<ResolvedPublisher | null>;
+/**
+ * Whether a user may act for a publishing org (AGL-652).
+ *
+ * Ownership checks used to read `listing.profileId === decoded.uid`. With
+ * org-owned listings that comparison can NEVER be true — a uid is not an org
+ * id — so leaving them would lock every publisher out of their own listing
+ * and make every paid listing chargeable to its own publisher. Managers
+ * (owner/admin) act for the org, matching the gate the profile rules apply.
+ */
+export declare function canActAsPublisher(firestore: FirebaseFirestore.Firestore, uid: string, publisherOrgId: string | undefined | null): Promise<boolean>;
+export declare class PublisherHandleTakenError extends Error {
+    readonly handle: string;
+    constructor(handle: string);
+}
+/**
+ * Claim a marketplace handle for an org, transactionally (AGL-652).
+ *
+ * Mirrors the `orgSlugs` reservation: the read and the write share one
+ * transaction, so two orgs racing for the same handle can't both win — which
+ * a read-then-write check permits, and which the marketplace URL space cannot
+ * represent. A handle the org already holds is a no-op, so this is safe to
+ * call on every profile save.
+ *
+ * A renamed handle leaves a `movedTo` tombstone behind so old marketplace
+ * links can still resolve, and re-claiming a tombstone you own is allowed.
+ *
+ * @throws PublisherHandleTakenError when another org holds it.
+ */
+export declare function claimPublisherHandle(firestore: FirebaseFirestore.Firestore, orgId: string, handle: string, previousHandle?: string): Promise<void>;

package/src/lib/server/publisher-profile.js

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { isValidPublisherHandle } from "../model/marketplace.js";
+/** `publisherProfiles/{orgId}` — the org's marketplace identity (AGL-652). */ export const PUBLISHER_PROFILES = 'publisherProfiles';
+/** `publisherHandles/{handle}` — uniqueness reservations. */ export const PUBLISHER_HANDLES = 'publisherHandles';
+/**
+ * Load the publishing org's marketplace profile (AGL-652).
+ *
+ * Publishing is org-only: the publisher is the ORG, not the person who
+ * happened to click publish. Every publish route resolves through here so
+ * they can't drift on which identity a listing is attributed to.
+ *
+ * Returns `null` when the org has no profile yet — callers turn that into a
+ * 412 telling the user to set one up, matching the previous behaviour when a
+ * personal profile was missing.
+ */ export async function resolvePublisherProfile(firestore, orgId) {
+    const snapshot = await firestore.collection(PUBLISHER_PROFILES).doc(orgId).get();
+    const handle = snapshot.get('handle');
+    if (!snapshot.exists || !handle) return null;
+    return {
+        orgId,
+        handle,
+        displayName: snapshot.get('displayName'),
+        stripeAccountId: snapshot.get('stripeAccountId'),
+        stripeChargesEnabled: snapshot.get('stripeChargesEnabled') === true,
+        // NOT coerced with `=== true` like the flag above: `false` (a test-mode
+        // account) and absent (never checked) are different answers, and
+        // flattening them would hide which of the two a publisher is in.
+        stripeAccountLivemode: snapshot.get('stripeAccountLivemode'),
+        agreement: snapshot.get('publisherAgreement')
+    };
+}
+/**
+ * Whether a user may act for a publishing org (AGL-652).
+ *
+ * Ownership checks used to read `listing.profileId === decoded.uid`. With
+ * org-owned listings that comparison can NEVER be true — a uid is not an org
+ * id — so leaving them would lock every publisher out of their own listing
+ * and make every paid listing chargeable to its own publisher. Managers
+ * (owner/admin) act for the org, matching the gate the profile rules apply.
+ */ export async function canActAsPublisher(firestore, uid, publisherOrgId) {
+    if (!uid || !publisherOrgId) return false;
+    const member = await firestore.collection('orgs').doc(publisherOrgId).collection('members').doc(uid).get();
+    const role = member.get('role');
+    return role === 'owner' || role === 'admin';
+}
+export class PublisherHandleTakenError extends Error {
+    constructor(handle){
+        super(`Handle "${handle}" is already taken`), this.handle = handle;
+        this.name = 'PublisherHandleTakenError';
+    }
+}
+/**
+ * Claim a marketplace handle for an org, transactionally (AGL-652).
+ *
+ * Mirrors the `orgSlugs` reservation: the read and the write share one
+ * transaction, so two orgs racing for the same handle can't both win — which
+ * a read-then-write check permits, and which the marketplace URL space cannot
+ * represent. A handle the org already holds is a no-op, so this is safe to
+ * call on every profile save.
+ *
+ * A renamed handle leaves a `movedTo` tombstone behind so old marketplace
+ * links can still resolve, and re-claiming a tombstone you own is allowed.
+ *
+ * @throws PublisherHandleTakenError when another org holds it.
+ */ export async function claimPublisherHandle(firestore, orgId, handle, previousHandle) {
+    if (!isValidPublisherHandle(handle)) {
+        throw new Error(`Invalid publisher handle: ${handle}`);
+    }
+    await firestore.runTransaction(async (tx)=>{
+        const ref = firestore.collection(PUBLISHER_HANDLES).doc(handle);
+        const existing = await tx.get(ref);
+        if (existing.exists && existing.get('orgId') !== orgId) {
+            throw new PublisherHandleTakenError(handle);
+        }
+        // A full set (not merge) clears any `movedTo` tombstone left by an
+        // earlier rename — the same reason the org-slug claim replaces wholesale.
+        //
+        // "A PREVIOUS OWNER'S rename" is what this comment used to say, and it
+        // cannot happen: a tombstone carries `orgId`, so the already-taken guard
+        // above refuses every org but the one that renamed away. A renamed handle
+        // is PARKED, not released, and only its original org can take it back.
+        //
+        // That was incidental until AGL-2312 and is load-bearing now: `movedTo`
+        // is a live redirect target on the publisher page, so if a stranger could
+        // claim the old handle, every link ever published to the original
+        // publisher would resolve to whoever grabbed it. Pinned in
+        // `publisher-handle-rename-tombstone.spec.ts`.
+        tx.set(ref, {
+            orgId
+        });
+        if (previousHandle && previousHandle !== handle) {
+            tx.set(firestore.collection(PUBLISHER_HANDLES).doc(previousHandle), {
+                orgId,
+                movedTo: handle,
+                renamedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp()
+            });
+        }
+    });
+}
+
+//# sourceMappingURL=publisher-profile.js.map

package/src/lib/server/publisher-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/publisher-profile.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { type PublisherAgreementAcceptance } from '@aglyn/aglyn/app-utils/publisher-agreement'\nimport { isValidPublisherHandle } from '../model/marketplace'\n\n/** `publisherProfiles/{orgId}` — the org's marketplace identity (AGL-652). */\nexport const PUBLISHER_PROFILES = 'publisherProfiles'\n/** `publisherHandles/{handle}` — uniqueness reservations. */\nexport const PUBLISHER_HANDLES = 'publisherHandles'\n\nexport interface ResolvedPublisher {\n  orgId: string\n  handle: string\n  displayName?: string\n  stripeAccountId?: string\n  stripeChargesEnabled?: boolean\n  /**\n   * Which Stripe world the payout account belongs to (AGL-2471).\n   *\n   * PROJECTED, and that is the load-bearing part. The sale gate in\n   * `checkout.ts` reads this shape, not the raw document — an API projection\n   * that drops a field its predicate needs turns the predicate into a\n   * constant, and here the constant would be \"refuse every marketplace sale\".\n   * Left three-valued deliberately: `undefined` means never established and\n   * must stay distinguishable from `false`.\n   */\n  stripeAccountLivemode?: boolean\n  /**\n   * Which marketplace publisher agreement this ORG has accepted (AGL-1077).\n   * Absent on every profile created before the agreement existed, which is\n   * why publishing refuses rather than assuming consent.\n   */\n  agreement?: PublisherAgreementAcceptance\n}\n\n/**\n * Load the publishing org's marketplace profile (AGL-652).\n *\n * Publishing is org-only: the publisher is the ORG, not the person who\n * happened to click publish. Every publish route resolves through here so\n * they can't drift on which identity a listing is attributed to.\n *\n * Returns `null` when the org has no profile yet — callers turn that into a\n * 412 telling the user to set one up, matching the previous behaviour when a\n * personal profile was missing.\n */\nexport async function resolvePublisherProfile(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<ResolvedPublisher | null> {\n  const snapshot = await firestore.collection(PUBLISHER_PROFILES).doc(orgId).get()\n  const handle = snapshot.get('handle') as string | undefined\n  if (!snapshot.exists || !handle) return null\n  return {\n    orgId,\n    handle,\n    displayName: snapshot.get('displayName') as string | undefined,\n    stripeAccountId: snapshot.get('stripeAccountId') as string | undefined,\n    stripeChargesEnabled: snapshot.get('stripeChargesEnabled') === true,\n    // NOT coerced with `=== true` like the flag above: `false` (a test-mode\n    // account) and absent (never checked) are different answers, and\n    // flattening them would hide which of the two a publisher is in.\n    stripeAccountLivemode: snapshot.get('stripeAccountLivemode') as\n      | boolean\n      | undefined,\n    agreement: snapshot.get('publisherAgreement') as\n      | PublisherAgreementAcceptance\n      | undefined,\n  }\n}\n\n/**\n * Whether a user may act for a publishing org (AGL-652).\n *\n * Ownership checks used to read `listing.profileId === decoded.uid`. With\n * org-owned listings that comparison can NEVER be true — a uid is not an org\n * id — so leaving them would lock every publisher out of their own listing\n * and make every paid listing chargeable to its own publisher. Managers\n * (owner/admin) act for the org, matching the gate the profile rules apply.\n */\nexport async function canActAsPublisher(\n  firestore: FirebaseFirestore.Firestore,\n  uid: string,\n  publisherOrgId: string | undefined | null,\n): Promise<boolean> {\n  if (!uid || !publisherOrgId) return false\n  const member = await firestore\n    .collection('orgs')\n    .doc(publisherOrgId)\n    .collection('members')\n    .doc(uid)\n    .get()\n  const role = member.get('role')\n  return role === 'owner' || role === 'admin'\n}\n\nexport class PublisherHandleTakenError extends Error {\n  constructor(public readonly handle: string) {\n    super(`Handle \"${handle}\" is already taken`)\n    this.name = 'PublisherHandleTakenError'\n  }\n}\n\n/**\n * Claim a marketplace handle for an org, transactionally (AGL-652).\n *\n * Mirrors the `orgSlugs` reservation: the read and the write share one\n * transaction, so two orgs racing for the same handle can't both win — which\n * a read-then-write check permits, and which the marketplace URL space cannot\n * represent. A handle the org already holds is a no-op, so this is safe to\n * call on every profile save.\n *\n * A renamed handle leaves a `movedTo` tombstone behind so old marketplace\n * links can still resolve, and re-claiming a tombstone you own is allowed.\n *\n * @throws PublisherHandleTakenError when another org holds it.\n */\nexport async function claimPublisherHandle(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  handle: string,\n  previousHandle?: string,\n): Promise<void> {\n  if (!isValidPublisherHandle(handle)) {\n    throw new Error(`Invalid publisher handle: ${handle}`)\n  }\n  await firestore.runTransaction(async (tx) => {\n    const ref = firestore.collection(PUBLISHER_HANDLES).doc(handle)\n    const existing = await tx.get(ref)\n    if (existing.exists && existing.get('orgId') !== orgId) {\n      throw new PublisherHandleTakenError(handle)\n    }\n    // A full set (not merge) clears any `movedTo` tombstone left by an\n    // earlier rename — the same reason the org-slug claim replaces wholesale.\n    //\n    // \"A PREVIOUS OWNER'S rename\" is what this comment used to say, and it\n    // cannot happen: a tombstone carries `orgId`, so the already-taken guard\n    // above refuses every org but the one that renamed away. A renamed handle\n    // is PARKED, not released, and only its original org can take it back.\n    //\n    // That was incidental until AGL-2312 and is load-bearing now: `movedTo`\n    // is a live redirect target on the publisher page, so if a stranger could\n    // claim the old handle, every link ever published to the original\n    // publisher would resolve to whoever grabbed it. Pinned in\n    // `publisher-handle-rename-tombstone.spec.ts`.\n    tx.set(ref, { orgId })\n    if (previousHandle && previousHandle !== handle) {\n      tx.set(firestore.collection(PUBLISHER_HANDLES).doc(previousHandle), {\n        orgId,\n        movedTo: handle,\n        renamedAt: firebaseAdmin.firestore.FieldValue.serverTimestamp(),\n      })\n    }\n  })\n}\n"],"names":["firebaseAdmin","isValidPublisherHandle","PUBLISHER_PROFILES","PUBLISHER_HANDLES","resolvePublisherProfile","firestore","orgId","snapshot","collection","doc","get","handle","exists","displayName","stripeAccountId","stripeChargesEnabled","stripeAccountLivemode","agreement","canActAsPublisher","uid","publisherOrgId","member","role","PublisherHandleTakenError","Error","name","claimPublisherHandle","previousHandle","runTransaction","tx","ref","existing","set","movedTo","renamedAt","FieldValue","serverTimestamp"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,SAASC,sBAAsB,QAAQ,0BAAsB;AAE7D,4EAA4E,GAC5E,OAAO,MAAMC,qBAAqB,oBAAmB;AACrD,2DAA2D,GAC3D,OAAO,MAAMC,oBAAoB,mBAAkB;AA2BnD;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,wBACpBC,SAAsC,EACtCC,KAAa;IAEb,MAAMC,WAAW,MAAMF,UAAUG,UAAU,CAACN,oBAAoBO,GAAG,CAACH,OAAOI,GAAG;IAC9E,MAAMC,SAASJ,SAASG,GAAG,CAAC;IAC5B,IAAI,CAACH,SAASK,MAAM,IAAI,CAACD,QAAQ,OAAO;IACxC,OAAO;QACLL;QACAK;QACAE,aAAaN,SAASG,GAAG,CAAC;QAC1BI,iBAAiBP,SAASG,GAAG,CAAC;QAC9BK,sBAAsBR,SAASG,GAAG,CAAC,4BAA4B;QAC/D,wEAAwE;QACxE,iEAAiE;QACjE,iEAAiE;QACjEM,uBAAuBT,SAASG,GAAG,CAAC;QAGpCO,WAAWV,SAASG,GAAG,CAAC;IAG1B;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeQ,kBACpBb,SAAsC,EACtCc,GAAW,EACXC,cAAyC;IAEzC,IAAI,CAACD,OAAO,CAACC,gBAAgB,OAAO;IACpC,MAAMC,SAAS,MAAMhB,UAClBG,UAAU,CAAC,QACXC,GAAG,CAACW,gBACJZ,UAAU,CAAC,WACXC,GAAG,CAACU,KACJT,GAAG;IACN,MAAMY,OAAOD,OAAOX,GAAG,CAAC;IACxB,OAAOY,SAAS,WAAWA,SAAS;AACtC;AAEA,OAAO,MAAMC,kCAAkCC;IAC7C,YAAY,AAAgBb,MAAc,CAAE;QAC1C,KAAK,CAAC,CAAC,QAAQ,EAAEA,OAAO,kBAAkB,CAAC,QADjBA,SAAAA;QAE1B,IAAI,CAACc,IAAI,GAAG;IACd;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeC,qBACpBrB,SAAsC,EACtCC,KAAa,EACbK,MAAc,EACdgB,cAAuB;IAEvB,IAAI,CAAC1B,uBAAuBU,SAAS;QACnC,MAAM,IAAIa,MAAM,CAAC,0BAA0B,EAAEb,QAAQ;IACvD;IACA,MAAMN,UAAUuB,cAAc,CAAC,OAAOC;QACpC,MAAMC,MAAMzB,UAAUG,UAAU,CAACL,mBAAmBM,GAAG,CAACE;QACxD,MAAMoB,WAAW,MAAMF,GAAGnB,GAAG,CAACoB;QAC9B,IAAIC,SAASnB,MAAM,IAAImB,SAASrB,GAAG,CAAC,aAAaJ,OAAO;YACtD,MAAM,IAAIiB,0BAA0BZ;QACtC;QACA,mEAAmE;QACnE,0EAA0E;QAC1E,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,kEAAkE;QAClE,2DAA2D;QAC3D,+CAA+C;QAC/CkB,GAAGG,GAAG,CAACF,KAAK;YAAExB;QAAM;QACpB,IAAIqB,kBAAkBA,mBAAmBhB,QAAQ;YAC/CkB,GAAGG,GAAG,CAAC3B,UAAUG,UAAU,CAACL,mBAAmBM,GAAG,CAACkB,iBAAiB;gBAClErB;gBACA2B,SAAStB;gBACTuB,WAAWlC,cAAcK,SAAS,CAAC8B,UAAU,CAACC,eAAe;YAC/D;QACF;IACF;AACF"}

package/src/lib/server/purchase-entitlement.d.ts

@@ -0,0 +1,83 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+interface LivePurchaseQuery {
+    firestore: FirebaseFirestore.Firestore;
+    /** The authenticated caller's uid — never a value from the request body. */
+    buyerUid: string;
+    /**
+     * THE ORGANIZATION BEING INSTALLED INTO (AGL-2331) — required, because a
+     * licence belongs to an org and asking this question without one can only be
+     * answered by the legacy grant.
+     *
+     * Every caller resolves it SERVER-SIDE from an authenticated membership
+     * (`resolveOrgPermissions`), never from a request body field. It is
+     * deliberately not optional: the gate that decides who gets paid content
+     * must not be satisfiable by forgetting an argument, and a required property
+     * makes every one of the nine doors a compile error until it is wired.
+     *
+     * The empty string is legal and means "this site has no owning org" — see
+     * `purchaseEntitlesOrg`, which never matches a document against it.
+     */
+    buyerOrgId: string;
+    listingId: string;
+}
+/**
+ * True when this ORGANIZATION holds a live licence for this listing
+ * (AGL-2331); see `purchaseEntitlesOrg` in the model for the licensing model
+ * and the legacy grant, which is where the reasoning lives.
+ *
+ * A FULLY refunded purchase (`refundedAt`, stamped by the `charge.refunded`
+ * branch of the marketplace billing webhook) reads as absent. Re-buying after a
+ * refund writes a fresh session-keyed doc, so a legitimate second purchase
+ * still installs and a refunded one sitting beside it does not veto it.
+ *
+ * TWO queries, not one, and not an `in` filter over both fields — Firestore
+ * has no disjunction across different fields that also keeps the `listingId`
+ * equality, and the honest question genuinely is a union of two populations:
+ * the org's licences, and this person's pre-AGL-2331 purchases. Both are
+ * equality-only conjunctions, so both are served by the automatic single-field
+ * indexes exactly as the original query was — no composite index, nothing to
+ * deploy.
+ *
+ * The org query is skipped entirely when there is no org, and the legacy query
+ * when there is no uid, so the common path (an org-stamped licence for a
+ * signed-in member) still costs the two reads it always did plus one for the
+ * grandfather — and the grandfather query is against a set that can only
+ * shrink.
+ *
+ * Callers gate on this only when `priceUsd > 0` and the caller is not the
+ * publisher — a free listing and a publisher installing their own work never
+ * had a purchase doc to find.
+ */
+export declare function hasLivePurchase({ firestore, buyerUid, buyerOrgId, listingId, }: LivePurchaseQuery): Promise<boolean>;
+/**
+ * The whole gate: resolves to `null` when the caller may proceed, or to the
+ * 402 payload to return when they may not.
+ *
+ * Returning the payload rather than writing the response keeps this usable
+ * from `update-artifact`, whose preview and apply branches answer differently,
+ * while still giving the seven install routes a single-line gate.
+ */
+export declare function requirePurchase({ firestore, buyerUid, buyerOrgId, listingId, priceUsd, ownsListing, }: LivePurchaseQuery & {
+    priceUsd: number;
+    /** The publisher installs their own listing for free (AGL-652). */
+    ownsListing: boolean;
+}): Promise<{
+    error: string;
+    priceUsd: number;
+} | null>;
+export {};