@aglyn/plugins-marketplace 1.0.0-beta.143

package/src/lib/server/version-stats.js

@@ -0,0 +1,305 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * Per-version install counters (AGL-1036).
+ *
+ * The listing already carries `installCount` (cumulative) and `activeInstalls`
+ * (live pins), but neither answers the question a publisher asks before
+ * changing anything: **who is still on the old version?** A listing-level
+ * number cannot, and a re-pin does not even move it — the pin already existed,
+ * so nothing increments while the install quietly changes version underneath.
+ *
+ * This module is the one writer of the per-version pair, deliberately: the
+ * listing-level counters drifted apart precisely because five install routes
+ * each incremented their own, and the per-version pair has twice the surface —
+ * every version change is TWO writes, a decrement of what was left and an
+ * increment of what was taken.
+ */ /**
+ * Where a version's counters live, which differs by artifact type.
+ *
+ * Plugins keep their versions in `pluginVersions` (publish internals, review
+ * state, bundle pointers); everything else keeps content snapshots in
+ * `versions`. Both are server-only, which is why the counters are read back
+ * out through the listing-versions route rather than by the client.
+ */ export function versionCollectionFor(artifactType) {
+    return artifactType === 'plugin' ? 'pluginVersions' : 'versions';
+}
+const asCount = (value)=>{
+    const parsed = Number(value != null ? value : 0);
+    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 0;
+};
+/**
+ * Reconciles one counter across the two levels that both claim to hold it.
+ *
+ * The listing total is not authoritative and neither is the per-version sum —
+ * each has a failure mode the other does not (see `reconcileInstallTallies`).
+ * So the total is the larger of the two, and the shortfall is either
+ * attributed or NAMED, never silently absorbed.
+ */ function reconcileCounter(tracked, stored) {
+    const sum = tracked.reduce((running, value)=>running + value, 0);
+    const total = Math.max(sum, stored);
+    const values = [
+        ...tracked
+    ];
+    let untracked = total - sum;
+    // The ONE case where attribution is provable rather than guessed: with a
+    // single version there is nowhere else an install could be. Every other
+    // shape keeps the remainder as a remainder — a split that reads as fact and
+    // is actually a guess is the defect this function exists to remove.
+    if (untracked > 0 && values.length === 1) {
+        values[0] += untracked;
+        untracked = 0;
+    }
+    return {
+        values,
+        total,
+        untracked
+    };
+}
+/**
+ * Makes the listing-level and per-version counters agree (AGL-1418).
+ *
+ * The marketplace keeps the same two quantities twice: once on the listing and
+ * once per version. They are written by different code under different trigger
+ * conditions, each swallowing its own failures, and nothing ever checked that
+ * they agree — so the listing page printed `7 installs · 2 active` beside
+ * `3 installs · 1 on this version` for a listing with ONE version and two live
+ * pins. Three numbers, one quantity, and a publisher with no way to tell which
+ * to believe.
+ *
+ * Neither level is trustworthy on its own:
+ *
+ * * The per-version pair only exists from AGL-1036 onwards and was never
+ *   backfilled, so it under-counts every listing older than that.
+ * * The listing-level pair is not incremented at all by the copied-artifact
+ *   install routes, so it under-counts every component, theme, layout, email
+ *   template and dataset schema.
+ *
+ * Both fail in the same direction — downwards — which is why the total is the
+ * larger of the two rather than an average or a preference.
+ *
+ * `activeInstalls` is clamped to `installCount` at both levels. That is not a
+ * guess: every writer increments the pair together, so "more live than ever
+ * landed" is unrepresentable in a healthy database and printing it would
+ * advertise the corruption rather than the count.
+ *
+ * Pure, and deliberately: it decides what to SAY, and the caller decides
+ * whether to repair anything.
+ *
+ * ## When the pins are in hand (AGL-1419)
+ *
+ * Pass `pins` and the reasoning above stops applying to `activeInstalls`,
+ * because it only existed to pick between two unreliable readings. The pin
+ * count is the quantity itself, so it is taken exactly — including DOWNWARDS,
+ * which no amount of reconciling between two accumulators could ever do, and
+ * which is the whole reason `z6glT_UDAQ` advertised three active installs
+ * against two live pins.
+ *
+ * The clamp flips direction with it. Without pins, `activeInstalls` is capped
+ * at `installCount`, because "more live than ever landed" means one of the two
+ * is corrupt and the all-time figure is the more believable. With pins it is
+ * `installCount` that gets raised: a pin that exists now is an install that
+ * landed, so an all-time counter below the live one is simply behind.
+ */ export function reconcileInstallTallies(versions, listing, pins) {
+    const trackedInstalls = versions.map((entry)=>asCount(entry.installCount));
+    const trackedActive = versions.map((entry)=>asCount(entry.activeInstalls));
+    const verified = pins ? asCount(pins.activeInstalls) : null;
+    const activeTotalRaw = verified != null ? verified : 0;
+    const active = verified == null ? reconcileCounter(trackedActive, asCount(listing == null ? void 0 : listing.activeInstalls)) : splitVerifiedActive(versions, trackedActive, activeTotalRaw, pins == null ? void 0 : pins.byVersion);
+    // All-time stays an accumulator even with pins in hand: an uninstall deletes
+    // its pin and leaves nothing behind, so the pins cannot say how many
+    // installs there have EVER been. They can only say the floor.
+    const installs = reconcileCounter(trackedInstalls, Math.max(asCount(listing == null ? void 0 : listing.installCount), verified != null ? verified : 0));
+    let installValues = installs.values;
+    let installTotal = installs.total;
+    let activeValues = active.values;
+    let activeTotal = verified != null ? verified : active.total;
+    if (verified == null) {
+        activeValues = active.values.map((value, index)=>{
+            var _installs_values_index;
+            return Math.min(value, (_installs_values_index = installs.values[index]) != null ? _installs_values_index : 0);
+        });
+        activeTotal = Math.min(active.total, installs.total);
+    } else {
+        installValues = installs.values.map((value, index)=>{
+            var _activeValues_index;
+            return Math.max(value, (_activeValues_index = activeValues[index]) != null ? _activeValues_index : 0);
+        });
+        installTotal = Math.max(installs.total, installValues.reduce((running, value)=>running + value, 0));
+    }
+    const activeSum = activeValues.reduce((running, value)=>running + value, 0);
+    const installSum = installValues.reduce((running, value)=>running + value, 0);
+    return {
+        versions: versions.map((entry, index)=>{
+            var _installValues_index, _activeValues_index;
+            return _extends({}, entry, {
+                installCount: (_installValues_index = installValues[index]) != null ? _installValues_index : 0,
+                activeInstalls: (_activeValues_index = activeValues[index]) != null ? _activeValues_index : 0
+            });
+        }),
+        installCount: installTotal,
+        activeInstalls: activeTotal,
+        untrackedInstallCount: Math.max(0, installTotal - installSum),
+        untrackedActiveInstalls: Math.max(0, activeTotal - activeSum)
+    };
+}
+/**
+ * Splits a verified pin count across the versions (AGL-1419).
+ *
+ * Three cases, in descending order of how much is known:
+ *
+ * 1. A per-version pin count was taken too — use it, and let the remainder
+ *    stand for pins on versions this history does not show (deleted, or past
+ *    the 20 the route reads).
+ * 2. One version — everything live is on it. Provable, not guessed.
+ * 3. Neither — keep the stored per-version actives but let no prefix of them
+ *    exceed the verified total, and name whatever is left. Trimming rather
+ *    than scaling because a stored count that fits is still evidence, and a
+ *    fabricated fraction of one is not.
+ */ function splitVerifiedActive(versions, tracked, total, byVersion) {
+    const lookup = byVersion instanceof Map ? byVersion : byVersion ? new Map(Object.entries(byVersion).map(([k, v])=>[
+            k,
+            asCount(v)
+        ])) : null;
+    if (lookup) {
+        const values = versions.map((entry)=>asCount(lookup.get(entry.version)));
+        const sum = values.reduce((running, value)=>running + value, 0);
+        return {
+            values,
+            total,
+            untracked: Math.max(0, total - sum)
+        };
+    }
+    if (versions.length === 1) return {
+        values: [
+            total
+        ],
+        total,
+        untracked: 0
+    };
+    let remaining = total;
+    const values = tracked.map((value)=>{
+        const taken = Math.min(value, remaining);
+        remaining -= taken;
+        return taken;
+    });
+    return {
+        values,
+        total,
+        untracked: remaining
+    };
+}
+const asId = (value)=>value == null || value === '' ? null : String(value);
+/**
+ * Moves one install from one version's tally to another's.
+ *
+ * Rules, all of which exist because a wrong count is worse than no count:
+ *
+ * * `activeInstalls` is clamped at zero, so a repeat uninstall — which the
+ *   plugin route already tolerates at listing level — cannot go negative.
+ * * `installCount` only rises, and only on the version being taken: it records
+ *   that an install once landed there, which stays true after they leave.
+ * * A version whose document is gone is skipped rather than created. Writing
+ *   `increment()` blind would resurrect a deleted version as a counters-only
+ *   stub, and in `pluginVersions` that stub would surface through
+ *   `newestApprovedVersion` as a version with no publish date and no review.
+ * * `from === to` is a no-op. Re-installing the same version is not a new
+ *   install of it, and counting it would inflate every re-install.
+ * * **A move CONSERVES (AGL-1420).** When a `from` version is named, the
+ *   arrival on `to` is recorded only if the departure from `from` actually
+ *   landed. See below — this is the rule that stops a restored install
+ *   minting a real one.
+ *
+ * Never on the critical path: a counter that cannot be written must not fail
+ * an install the user asked for.
+ *
+ * ## Why a move has to conserve
+ *
+ * The two halves used to be independent writes, either of which could
+ * silently no-op while the other landed — and both no-op paths are on the
+ * `from` half, so the error was one-directional: **net +1, every time.**
+ *
+ * * `if (!snapshot.exists) return` skipped a `from` version whose document
+ *   had been deleted, and the `to` increment still landed.
+ * * `Math.max(0, active - 1)` swallowed a decrement against a version whose
+ *   tally was already zero, and the `to` increment still landed.
+ *
+ * A `from` that cannot be decremented is not a bookkeeping inconvenience; it
+ * is evidence that **this copy was never in the tracked population**. The
+ * case that produces it in the wild is a site restore: `IMPORTABLE_FIELDS`
+ * deliberately carries `marketplace` / `installedFrom` / `source` through
+ * `POST /api/hosts/import` (site-export-round-trip.spec.ts asserts it, and it
+ * is what keeps update-available detection working on a legitimate backup),
+ * so a restored component or dataset arrives fully stamped with provenance
+ * having never run an install route. No `installCount` increment, no pin,
+ * nothing counted. The first time the publisher ships an update and someone
+ * presses Update, `update-artifact` reads that stamp and calls this function
+ * with a `from` nothing ever credited.
+ *
+ * That phantom then propagates rather than staying local: `reconcileCounter`
+ * takes `max(versionSum, stored)` — because every accumulator in this system
+ * fails DOWNWARD and the larger is therefore the better estimate — so an
+ * inflated per-version tally raises the listing total the page prints to
+ * buyers. Nothing can pull it back down again except a pin count, and
+ * `verifiedLivePins` returns `null` for everything that is not a plugin,
+ * which is exactly the set the import can restore. Over-counts are permanent;
+ * under-counts are representable (`untracked`) and recoverable.
+ *
+ * So the bias goes the way the rest of the arithmetic already goes. The cost
+ * is a real install whose `from` version document the publisher has since
+ * deleted: its arrival is not credited to `to`. That install is still counted
+ * at listing level, so `max(versionSum, stored)` keeps the total right and
+ * the per-version breakdown reports it as `untracked` — the shape this module
+ * already has for "we know it happened, we cannot say where".
+ *
+ * A first install (`from` null) is unaffected: there is nothing to conserve,
+ * and `to` is credited exactly as before.
+ */ export async function recordVersionMove(input) {
+    const from = asId(input.from);
+    const to = asId(input.to);
+    if (from === to) return;
+    const collection = input.listingRef.collection(versionCollectionFor(input.artifactType));
+    /** Resolves true only if the counter was actually moved. */ const bump = async (versionId, activeDelta)=>{
+        const ref = collection.doc(versionId);
+        return await input.firestore.runTransaction(async (tx)=>{
+            var _snapshot_get, _snapshot_get1;
+            const snapshot = await tx.get(ref);
+            // A version whose document is gone is skipped rather than created:
+            // writing blind would resurrect it as a counters-only stub.
+            if (!snapshot.exists) return false;
+            const active = Number((_snapshot_get = snapshot.get('activeInstalls')) != null ? _snapshot_get : 0);
+            // Nothing to take off this version. Clamping and reporting success
+            // is what let a phantom departure fund a real arrival.
+            if (activeDelta < 0 && active <= 0) return false;
+            tx.update(ref, _extends({
+                activeInstalls: Math.max(0, active + activeDelta)
+            }, activeDelta > 0 ? {
+                installCount: Number((_snapshot_get1 = snapshot.get('installCount')) != null ? _snapshot_get1 : 0) + 1
+            } : {}));
+            return true;
+        }).catch(()=>false);
+    };
+    if (from) {
+        const departed = await bump(from, -1);
+        // The move did not come from where it claims to have come from, so there
+        // is no install here to move. Crediting `to` would invent one.
+        if (!departed) return;
+    }
+    if (to) await bump(to, 1);
+}
+
+//# sourceMappingURL=version-stats.js.map

package/src/lib/server/version-stats.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/version-stats.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { MarketplaceArtifactType } from '../model/marketplace'\n\n/**\n * Per-version install counters (AGL-1036).\n *\n * The listing already carries `installCount` (cumulative) and `activeInstalls`\n * (live pins), but neither answers the question a publisher asks before\n * changing anything: **who is still on the old version?** A listing-level\n * number cannot, and a re-pin does not even move it — the pin already existed,\n * so nothing increments while the install quietly changes version underneath.\n *\n * This module is the one writer of the per-version pair, deliberately: the\n * listing-level counters drifted apart precisely because five install routes\n * each incremented their own, and the per-version pair has twice the surface —\n * every version change is TWO writes, a decrement of what was left and an\n * increment of what was taken.\n */\n\n/**\n * Where a version's counters live, which differs by artifact type.\n *\n * Plugins keep their versions in `pluginVersions` (publish internals, review\n * state, bundle pointers); everything else keeps content snapshots in\n * `versions`. Both are server-only, which is why the counters are read back\n * out through the listing-versions route rather than by the client.\n */\nexport function versionCollectionFor(\n  artifactType: MarketplaceArtifactType | string | null | undefined,\n): 'pluginVersions' | 'versions' {\n  return artifactType === 'plugin' ? 'pluginVersions' : 'versions'\n}\n\n/** One version's pair of counters, as the version doc stores them. */\nexport interface VersionInstallTally {\n  version: string\n  installCount: number\n  activeInstalls: number\n}\n\n/** The listing-level pair, which counts the same two things (AGL-1418). */\nexport interface ListingInstallTally {\n  installCount?: number | null\n  activeInstalls?: number | null\n}\n\n/**\n * The same quantity counted from the pins, which are ground truth (AGL-1419).\n *\n * Both stored levels are accumulators, and an accumulator cannot come back\n * down: nothing decrements when a tenant erase sweeps `installs` or the\n * console deletes a host pin client-side. The pins can, because they ARE the\n * installs — so when this is present it does not get reconciled against\n * anything, it simply wins.\n */\nexport interface LivePinTally {\n  /** Live pins for the listing. A verified `0` is a count, not a gap. */\n  activeInstalls: number\n  /** Live pins per version id, when the split was derived too. */\n  byVersion?: Map<string, number> | Record<string, number> | null\n}\n\nexport interface ReconciledInstallTallies {\n  /** Per-version counters, reconciled against the listing totals. */\n  versions: VersionInstallTally[]\n  /** The totals the page should print, and that the versions sum to. */\n  installCount: number\n  activeInstalls: number\n  /**\n   * Installs the totals include but no version claims. Non-zero means the\n   * per-version split is INCOMPLETE, and a caller must say so rather than\n   * print a breakdown that does not add up.\n   */\n  untrackedInstallCount: number\n  untrackedActiveInstalls: number\n}\n\nconst asCount = (value: unknown): number => {\n  const parsed = Number(value ?? 0)\n  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 0\n}\n\n/**\n * Reconciles one counter across the two levels that both claim to hold it.\n *\n * The listing total is not authoritative and neither is the per-version sum —\n * each has a failure mode the other does not (see `reconcileInstallTallies`).\n * So the total is the larger of the two, and the shortfall is either\n * attributed or NAMED, never silently absorbed.\n */\nfunction reconcileCounter(\n  tracked: number[],\n  stored: number,\n): { values: number[]; total: number; untracked: number } {\n  const sum = tracked.reduce((running, value) => running + value, 0)\n  const total = Math.max(sum, stored)\n  const values = [...tracked]\n  let untracked = total - sum\n  // The ONE case where attribution is provable rather than guessed: with a\n  // single version there is nowhere else an install could be. Every other\n  // shape keeps the remainder as a remainder — a split that reads as fact and\n  // is actually a guess is the defect this function exists to remove.\n  if (untracked > 0 && values.length === 1) {\n    values[0] += untracked\n    untracked = 0\n  }\n  return { values, total, untracked }\n}\n\n/**\n * Makes the listing-level and per-version counters agree (AGL-1418).\n *\n * The marketplace keeps the same two quantities twice: once on the listing and\n * once per version. They are written by different code under different trigger\n * conditions, each swallowing its own failures, and nothing ever checked that\n * they agree — so the listing page printed `7 installs · 2 active` beside\n * `3 installs · 1 on this version` for a listing with ONE version and two live\n * pins. Three numbers, one quantity, and a publisher with no way to tell which\n * to believe.\n *\n * Neither level is trustworthy on its own:\n *\n * * The per-version pair only exists from AGL-1036 onwards and was never\n *   backfilled, so it under-counts every listing older than that.\n * * The listing-level pair is not incremented at all by the copied-artifact\n *   install routes, so it under-counts every component, theme, layout, email\n *   template and dataset schema.\n *\n * Both fail in the same direction — downwards — which is why the total is the\n * larger of the two rather than an average or a preference.\n *\n * `activeInstalls` is clamped to `installCount` at both levels. That is not a\n * guess: every writer increments the pair together, so \"more live than ever\n * landed\" is unrepresentable in a healthy database and printing it would\n * advertise the corruption rather than the count.\n *\n * Pure, and deliberately: it decides what to SAY, and the caller decides\n * whether to repair anything.\n *\n * ## When the pins are in hand (AGL-1419)\n *\n * Pass `pins` and the reasoning above stops applying to `activeInstalls`,\n * because it only existed to pick between two unreliable readings. The pin\n * count is the quantity itself, so it is taken exactly — including DOWNWARDS,\n * which no amount of reconciling between two accumulators could ever do, and\n * which is the whole reason `z6glT_UDAQ` advertised three active installs\n * against two live pins.\n *\n * The clamp flips direction with it. Without pins, `activeInstalls` is capped\n * at `installCount`, because \"more live than ever landed\" means one of the two\n * is corrupt and the all-time figure is the more believable. With pins it is\n * `installCount` that gets raised: a pin that exists now is an install that\n * landed, so an all-time counter below the live one is simply behind.\n */\nexport function reconcileInstallTallies(\n  versions: VersionInstallTally[],\n  listing: ListingInstallTally,\n  pins?: LivePinTally | null,\n): ReconciledInstallTallies {\n  const trackedInstalls = versions.map((entry) => asCount(entry.installCount))\n  const trackedActive = versions.map((entry) => asCount(entry.activeInstalls))\n\n  const verified = pins ? asCount(pins.activeInstalls) : null\n  const activeTotalRaw = verified ?? 0\n  const active =\n    verified == null\n      ? reconcileCounter(trackedActive, asCount(listing?.activeInstalls))\n      : splitVerifiedActive(versions, trackedActive, activeTotalRaw, pins?.byVersion)\n\n  // All-time stays an accumulator even with pins in hand: an uninstall deletes\n  // its pin and leaves nothing behind, so the pins cannot say how many\n  // installs there have EVER been. They can only say the floor.\n  const installs = reconcileCounter(\n    trackedInstalls,\n    Math.max(asCount(listing?.installCount), verified ?? 0),\n  )\n\n  let installValues = installs.values\n  let installTotal = installs.total\n  let activeValues = active.values\n  let activeTotal = verified ?? active.total\n  if (verified == null) {\n    activeValues = active.values.map((value, index) =>\n      Math.min(value, installs.values[index] ?? 0),\n    )\n    activeTotal = Math.min(active.total, installs.total)\n  } else {\n    installValues = installs.values.map((value, index) =>\n      Math.max(value, activeValues[index] ?? 0),\n    )\n    installTotal = Math.max(\n      installs.total,\n      installValues.reduce((running, value) => running + value, 0),\n    )\n  }\n  const activeSum = activeValues.reduce((running, value) => running + value, 0)\n  const installSum = installValues.reduce((running, value) => running + value, 0)\n  return {\n    versions: versions.map((entry, index) => ({\n      ...entry,\n      installCount: installValues[index] ?? 0,\n      activeInstalls: activeValues[index] ?? 0,\n    })),\n    installCount: installTotal,\n    activeInstalls: activeTotal,\n    untrackedInstallCount: Math.max(0, installTotal - installSum),\n    untrackedActiveInstalls: Math.max(0, activeTotal - activeSum),\n  }\n}\n\n/**\n * Splits a verified pin count across the versions (AGL-1419).\n *\n * Three cases, in descending order of how much is known:\n *\n * 1. A per-version pin count was taken too — use it, and let the remainder\n *    stand for pins on versions this history does not show (deleted, or past\n *    the 20 the route reads).\n * 2. One version — everything live is on it. Provable, not guessed.\n * 3. Neither — keep the stored per-version actives but let no prefix of them\n *    exceed the verified total, and name whatever is left. Trimming rather\n *    than scaling because a stored count that fits is still evidence, and a\n *    fabricated fraction of one is not.\n */\nfunction splitVerifiedActive(\n  versions: VersionInstallTally[],\n  tracked: number[],\n  total: number,\n  byVersion: LivePinTally['byVersion'],\n): { values: number[]; total: number; untracked: number } {\n  const lookup =\n    byVersion instanceof Map\n      ? byVersion\n      : byVersion\n        ? new Map(Object.entries(byVersion).map(([k, v]) => [k, asCount(v)]))\n        : null\n  if (lookup) {\n    const values = versions.map((entry) => asCount(lookup.get(entry.version)))\n    const sum = values.reduce((running, value) => running + value, 0)\n    return { values, total, untracked: Math.max(0, total - sum) }\n  }\n  if (versions.length === 1) return { values: [total], total, untracked: 0 }\n  let remaining = total\n  const values = tracked.map((value) => {\n    const taken = Math.min(value, remaining)\n    remaining -= taken\n    return taken\n  })\n  return { values, total, untracked: remaining }\n}\n\nexport interface VersionMoveInput {\n  firestore: FirebaseFirestore.Firestore\n  listingRef: FirebaseFirestore.DocumentReference\n  artifactType: MarketplaceArtifactType | string | null | undefined\n  /** The version this install was on, if any. Null for a first install. */\n  from?: string | number | null\n  /** The version it is on now. Null for an uninstall. */\n  to?: string | number | null\n}\n\nconst asId = (value: string | number | null | undefined): string | null =>\n  value == null || value === '' ? null : String(value)\n\n/**\n * Moves one install from one version's tally to another's.\n *\n * Rules, all of which exist because a wrong count is worse than no count:\n *\n * * `activeInstalls` is clamped at zero, so a repeat uninstall — which the\n *   plugin route already tolerates at listing level — cannot go negative.\n * * `installCount` only rises, and only on the version being taken: it records\n *   that an install once landed there, which stays true after they leave.\n * * A version whose document is gone is skipped rather than created. Writing\n *   `increment()` blind would resurrect a deleted version as a counters-only\n *   stub, and in `pluginVersions` that stub would surface through\n *   `newestApprovedVersion` as a version with no publish date and no review.\n * * `from === to` is a no-op. Re-installing the same version is not a new\n *   install of it, and counting it would inflate every re-install.\n * * **A move CONSERVES (AGL-1420).** When a `from` version is named, the\n *   arrival on `to` is recorded only if the departure from `from` actually\n *   landed. See below — this is the rule that stops a restored install\n *   minting a real one.\n *\n * Never on the critical path: a counter that cannot be written must not fail\n * an install the user asked for.\n *\n * ## Why a move has to conserve\n *\n * The two halves used to be independent writes, either of which could\n * silently no-op while the other landed — and both no-op paths are on the\n * `from` half, so the error was one-directional: **net +1, every time.**\n *\n * * `if (!snapshot.exists) return` skipped a `from` version whose document\n *   had been deleted, and the `to` increment still landed.\n * * `Math.max(0, active - 1)` swallowed a decrement against a version whose\n *   tally was already zero, and the `to` increment still landed.\n *\n * A `from` that cannot be decremented is not a bookkeeping inconvenience; it\n * is evidence that **this copy was never in the tracked population**. The\n * case that produces it in the wild is a site restore: `IMPORTABLE_FIELDS`\n * deliberately carries `marketplace` / `installedFrom` / `source` through\n * `POST /api/hosts/import` (site-export-round-trip.spec.ts asserts it, and it\n * is what keeps update-available detection working on a legitimate backup),\n * so a restored component or dataset arrives fully stamped with provenance\n * having never run an install route. No `installCount` increment, no pin,\n * nothing counted. The first time the publisher ships an update and someone\n * presses Update, `update-artifact` reads that stamp and calls this function\n * with a `from` nothing ever credited.\n *\n * That phantom then propagates rather than staying local: `reconcileCounter`\n * takes `max(versionSum, stored)` — because every accumulator in this system\n * fails DOWNWARD and the larger is therefore the better estimate — so an\n * inflated per-version tally raises the listing total the page prints to\n * buyers. Nothing can pull it back down again except a pin count, and\n * `verifiedLivePins` returns `null` for everything that is not a plugin,\n * which is exactly the set the import can restore. Over-counts are permanent;\n * under-counts are representable (`untracked`) and recoverable.\n *\n * So the bias goes the way the rest of the arithmetic already goes. The cost\n * is a real install whose `from` version document the publisher has since\n * deleted: its arrival is not credited to `to`. That install is still counted\n * at listing level, so `max(versionSum, stored)` keeps the total right and\n * the per-version breakdown reports it as `untracked` — the shape this module\n * already has for \"we know it happened, we cannot say where\".\n *\n * A first install (`from` null) is unaffected: there is nothing to conserve,\n * and `to` is credited exactly as before.\n */\nexport async function recordVersionMove(input: VersionMoveInput): Promise<void> {\n  const from = asId(input.from)\n  const to = asId(input.to)\n  if (from === to) return\n  const collection = input.listingRef.collection(\n    versionCollectionFor(input.artifactType),\n  )\n  /** Resolves true only if the counter was actually moved. */\n  const bump = async (\n    versionId: string,\n    activeDelta: 1 | -1,\n  ): Promise<boolean> => {\n    const ref = collection.doc(versionId)\n    return await input.firestore\n      .runTransaction(async (tx) => {\n        const snapshot = await tx.get(ref)\n        // A version whose document is gone is skipped rather than created:\n        // writing blind would resurrect it as a counters-only stub.\n        if (!snapshot.exists) return false\n        const active = Number(snapshot.get('activeInstalls') ?? 0)\n        // Nothing to take off this version. Clamping and reporting success\n        // is what let a phantom departure fund a real arrival.\n        if (activeDelta < 0 && active <= 0) return false\n        tx.update(ref, {\n          activeInstalls: Math.max(0, active + activeDelta),\n          ...(activeDelta > 0\n            ? { installCount: Number(snapshot.get('installCount') ?? 0) + 1 }\n            : {}),\n        })\n        return true\n      })\n      .catch(() => false)\n  }\n  if (from) {\n    const departed = await bump(from, -1)\n    // The move did not come from where it claims to have come from, so there\n    // is no install here to move. Crediting `to` would invent one.\n    if (!departed) return\n  }\n  if (to) await bump(to, 1)\n}\n"],"names":["versionCollectionFor","artifactType","asCount","value","parsed","Number","isFinite","Math","floor","reconcileCounter","tracked","stored","sum","reduce","running","total","max","values","untracked","length","reconcileInstallTallies","versions","listing","pins","trackedInstalls","map","entry","installCount","trackedActive","activeInstalls","verified","activeTotalRaw","active","splitVerifiedActive","byVersion","installs","installValues","installTotal","activeValues","activeTotal","index","min","activeSum","installSum","untrackedInstallCount","untrackedActiveInstalls","lookup","Map","Object","entries","k","v","get","version","remaining","taken","asId","String","recordVersionMove","input","from","to","collection","listingRef","bump","versionId","activeDelta","ref","doc","firestore","runTransaction","tx","snapshot","exists","update","catch","departed"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAID;;;;;;;;;;;;;;CAcC,GAED;;;;;;;CAOC,GACD,OAAO,SAASA,qBACdC,YAAiE;IAEjE,OAAOA,iBAAiB,WAAW,mBAAmB;AACxD;AA8CA,MAAMC,UAAU,CAACC;IACf,MAAMC,SAASC,OAAOF,gBAAAA,QAAS;IAC/B,OAAOE,OAAOC,QAAQ,CAACF,WAAWA,SAAS,IAAIG,KAAKC,KAAK,CAACJ,UAAU;AACtE;AAEA;;;;;;;CAOC,GACD,SAASK,iBACPC,OAAiB,EACjBC,MAAc;IAEd,MAAMC,MAAMF,QAAQG,MAAM,CAAC,CAACC,SAASX,QAAUW,UAAUX,OAAO;IAChE,MAAMY,QAAQR,KAAKS,GAAG,CAACJ,KAAKD;IAC5B,MAAMM,SAAS;WAAIP;KAAQ;IAC3B,IAAIQ,YAAYH,QAAQH;IACxB,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,oEAAoE;IACpE,IAAIM,YAAY,KAAKD,OAAOE,MAAM,KAAK,GAAG;QACxCF,MAAM,CAAC,EAAE,IAAIC;QACbA,YAAY;IACd;IACA,OAAO;QAAED;QAAQF;QAAOG;IAAU;AACpC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GACD,OAAO,SAASE,wBACdC,QAA+B,EAC/BC,OAA4B,EAC5BC,IAA0B;IAE1B,MAAMC,kBAAkBH,SAASI,GAAG,CAAC,CAACC,QAAUxB,QAAQwB,MAAMC,YAAY;IAC1E,MAAMC,gBAAgBP,SAASI,GAAG,CAAC,CAACC,QAAUxB,QAAQwB,MAAMG,cAAc;IAE1E,MAAMC,WAAWP,OAAOrB,QAAQqB,KAAKM,cAAc,IAAI;IACvD,MAAME,iBAAiBD,mBAAAA,WAAY;IACnC,MAAME,SACJF,YAAY,OACRrB,iBAAiBmB,eAAe1B,QAAQoB,2BAAAA,QAASO,cAAc,KAC/DI,oBAAoBZ,UAAUO,eAAeG,gBAAgBR,wBAAAA,KAAMW,SAAS;IAElF,6EAA6E;IAC7E,qEAAqE;IACrE,8DAA8D;IAC9D,MAAMC,WAAW1B,iBACfe,iBACAjB,KAAKS,GAAG,CAACd,QAAQoB,2BAAAA,QAASK,YAAY,GAAGG,mBAAAA,WAAY;IAGvD,IAAIM,gBAAgBD,SAASlB,MAAM;IACnC,IAAIoB,eAAeF,SAASpB,KAAK;IACjC,IAAIuB,eAAeN,OAAOf,MAAM;IAChC,IAAIsB,cAAcT,mBAAAA,WAAYE,OAAOjB,KAAK;IAC1C,IAAIe,YAAY,MAAM;QACpBQ,eAAeN,OAAOf,MAAM,CAACQ,GAAG,CAAC,CAACtB,OAAOqC;gBACvBL;mBAAhB5B,KAAKkC,GAAG,CAACtC,QAAOgC,yBAAAA,SAASlB,MAAM,CAACuB,MAAM,YAAtBL,yBAA0B;;QAE5CI,cAAchC,KAAKkC,GAAG,CAACT,OAAOjB,KAAK,EAAEoB,SAASpB,KAAK;IACrD,OAAO;QACLqB,gBAAgBD,SAASlB,MAAM,CAACQ,GAAG,CAAC,CAACtB,OAAOqC;gBAC1BF;mBAAhB/B,KAAKS,GAAG,CAACb,QAAOmC,sBAAAA,YAAY,CAACE,MAAM,YAAnBF,sBAAuB;;QAEzCD,eAAe9B,KAAKS,GAAG,CACrBmB,SAASpB,KAAK,EACdqB,cAAcvB,MAAM,CAAC,CAACC,SAASX,QAAUW,UAAUX,OAAO;IAE9D;IACA,MAAMuC,YAAYJ,aAAazB,MAAM,CAAC,CAACC,SAASX,QAAUW,UAAUX,OAAO;IAC3E,MAAMwC,aAAaP,cAAcvB,MAAM,CAAC,CAACC,SAASX,QAAUW,UAAUX,OAAO;IAC7E,OAAO;QACLkB,UAAUA,SAASI,GAAG,CAAC,CAACC,OAAOc;gBAEfJ,sBACEE;mBAHwB,aACrCZ;gBACHC,YAAY,GAAES,uBAAAA,aAAa,CAACI,MAAM,YAApBJ,uBAAwB;gBACtCP,cAAc,GAAES,sBAAAA,YAAY,CAACE,MAAM,YAAnBF,sBAAuB;;;QAEzCX,cAAcU;QACdR,gBAAgBU;QAChBK,uBAAuBrC,KAAKS,GAAG,CAAC,GAAGqB,eAAeM;QAClDE,yBAAyBtC,KAAKS,GAAG,CAAC,GAAGuB,cAAcG;IACrD;AACF;AAEA;;;;;;;;;;;;;CAaC,GACD,SAAST,oBACPZ,QAA+B,EAC/BX,OAAiB,EACjBK,KAAa,EACbmB,SAAoC;IAEpC,MAAMY,SACJZ,qBAAqBa,MACjBb,YACAA,YACE,IAAIa,IAAIC,OAAOC,OAAO,CAACf,WAAWT,GAAG,CAAC,CAAC,CAACyB,GAAGC,EAAE,GAAK;YAACD;YAAGhD,QAAQiD;SAAG,KACjE;IACR,IAAIL,QAAQ;QACV,MAAM7B,SAASI,SAASI,GAAG,CAAC,CAACC,QAAUxB,QAAQ4C,OAAOM,GAAG,CAAC1B,MAAM2B,OAAO;QACvE,MAAMzC,MAAMK,OAAOJ,MAAM,CAAC,CAACC,SAASX,QAAUW,UAAUX,OAAO;QAC/D,OAAO;YAAEc;YAAQF;YAAOG,WAAWX,KAAKS,GAAG,CAAC,GAAGD,QAAQH;QAAK;IAC9D;IACA,IAAIS,SAASF,MAAM,KAAK,GAAG,OAAO;QAAEF,QAAQ;YAACF;SAAM;QAAEA;QAAOG,WAAW;IAAE;IACzE,IAAIoC,YAAYvC;IAChB,MAAME,SAASP,QAAQe,GAAG,CAAC,CAACtB;QAC1B,MAAMoD,QAAQhD,KAAKkC,GAAG,CAACtC,OAAOmD;QAC9BA,aAAaC;QACb,OAAOA;IACT;IACA,OAAO;QAAEtC;QAAQF;QAAOG,WAAWoC;IAAU;AAC/C;AAYA,MAAME,OAAO,CAACrD,QACZA,SAAS,QAAQA,UAAU,KAAK,OAAOsD,OAAOtD;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEC,GACD,OAAO,eAAeuD,kBAAkBC,KAAuB;IAC7D,MAAMC,OAAOJ,KAAKG,MAAMC,IAAI;IAC5B,MAAMC,KAAKL,KAAKG,MAAME,EAAE;IACxB,IAAID,SAASC,IAAI;IACjB,MAAMC,aAAaH,MAAMI,UAAU,CAACD,UAAU,CAC5C9D,qBAAqB2D,MAAM1D,YAAY;IAEzC,0DAA0D,GAC1D,MAAM+D,OAAO,OACXC,WACAC;QAEA,MAAMC,MAAML,WAAWM,GAAG,CAACH;QAC3B,OAAO,MAAMN,MAAMU,SAAS,CACzBC,cAAc,CAAC,OAAOC;gBAKCC,eAOOA;YAX7B,MAAMA,WAAW,MAAMD,GAAGnB,GAAG,CAACe;YAC9B,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAACK,SAASC,MAAM,EAAE,OAAO;YAC7B,MAAMzC,SAAS3B,QAAOmE,gBAAAA,SAASpB,GAAG,CAAC,6BAAboB,gBAAkC;YACxD,mEAAmE;YACnE,uDAAuD;YACvD,IAAIN,cAAc,KAAKlC,UAAU,GAAG,OAAO;YAC3CuC,GAAGG,MAAM,CAACP,KAAK;gBACbtC,gBAAgBtB,KAAKS,GAAG,CAAC,GAAGgB,SAASkC;eACjCA,cAAc,IACd;gBAAEvC,cAActB,QAAOmE,iBAAAA,SAASpB,GAAG,CAAC,2BAAboB,iBAAgC,KAAK;YAAE,IAC9D,CAAC;YAEP,OAAO;QACT,GACCG,KAAK,CAAC,IAAM;IACjB;IACA,IAAIf,MAAM;QACR,MAAMgB,WAAW,MAAMZ,KAAKJ,MAAM,CAAC;QACnC,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,CAACgB,UAAU;IACjB;IACA,IAAIf,IAAI,MAAMG,KAAKH,IAAI;AACzB"}

package/src/lib/server.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Registers the marketplace plugin's console-side API routes (AGL-396):
+ * marketplace publish/install of templates and plugins, and the Stripe
+ * Connect + checkout flows for paid listings.
+ *
+ * Upload-bodied routes register here too. The note that used to sit here —
+ * that they had to stay as named console routes because the dispatcher
+ * "can't grant per-route bodyParser limits" — was a Pages Router leftover:
+ * `runLegacyHandler` reads the request through the same
+ * `pluginRequestFromWeb` a named App Router route would, and imposes no
+ * limit of its own. publish-plugin's 8 MB bundle has been going through the
+ * dispatcher the whole time.
+ */
+export declare function registerMarketplaceConsoleApi(): void;

package/src/lib/server.js

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerBillingWebhookHandler, registerPluginApiRoute, registerCustomFieldType } from "@aglyn/aglyn/server";
+import { marketplaceBillingWebhookHandler } from "./server/billing-webhook.js";
+import { publishPluginHandler } from "./server/publish-plugin.js";
+import { verificationRequestHandler } from "./server/verification-request.js";
+import { checkoutHandler } from "./server/checkout.js";
+import { connectHandler } from "./server/connect.js";
+import { installHandler } from "./server/install.js";
+import { installPluginHandler } from "./server/install-plugin.js";
+import { listingVersionsHandler } from "./server/listing-versions.js";
+import { RATING_FIELD } from "./model/rating-field.js";
+import { installDatasetSchemaHandler } from "./server/install-dataset-schema.js";
+import { installEmailStarterHandler } from "./server/install-email-starter.js";
+import { installEmailTemplateHandler } from "./server/install-email-template.js";
+import { installLayoutHandler } from "./server/install-layout.js";
+import { installTemplateHandler } from "./server/install-template.js";
+import { installThemeHandler } from "./server/install-theme.js";
+import { previewImageHandler } from "./server/preview-image.js";
+import { publishHandler } from "./server/publish.js";
+import { reportHandler } from "./server/report.js";
+import { reviewsHandler } from "./server/reviews.js";
+import { publisherProfileSaveHandler } from "./server/publisher-profile-save.js";
+import { publishDatasetSchemaHandler } from "./server/publish-dataset-schema.js";
+import { publishEmailStarterHandler } from "./server/publish-email-starter.js";
+import { publishEmailTemplateHandler } from "./server/publish-email-template.js";
+import { publishLayoutHandler } from "./server/publish-layout.js";
+import { publishTemplateHandler } from "./server/publish-template.js";
+import { publishThemeHandler } from "./server/publish-theme.js";
+import { updateArtifactHandler } from "./server/update-artifact.js";
+/**
+ * Registers the marketplace plugin's console-side API routes (AGL-396):
+ * marketplace publish/install of templates and plugins, and the Stripe
+ * Connect + checkout flows for paid listings.
+ *
+ * Upload-bodied routes register here too. The note that used to sit here —
+ * that they had to stay as named console routes because the dispatcher
+ * "can't grant per-route bodyParser limits" — was a Pages Router leftover:
+ * `runLegacyHandler` reads the request through the same
+ * `pluginRequestFromWeb` a named App Router route would, and imposes no
+ * limit of its own. publish-plugin's 8 MB bundle has been going through the
+ * dispatcher the whole time.
+ */ export function registerMarketplaceConsoleApi() {
+    // Server side of the rating custom field (AGL-434): validators run
+    // on import/write paths even when no client loaded the plugin.
+    registerCustomFieldType(RATING_FIELD);
+    registerPluginApiRoute('marketplace/checkout', checkoutHandler);
+    registerPluginApiRoute('marketplace/connect', connectHandler);
+    registerPluginApiRoute('marketplace/install', installHandler);
+    registerPluginApiRoute('marketplace/install-plugin', installPluginHandler);
+    registerPluginApiRoute('marketplace/install-layout', installLayoutHandler);
+    registerPluginApiRoute('marketplace/install-template', installTemplateHandler);
+    // A theme install DOES change the running site (AGL-1020) — it is the site's
+    // appearance — so this route also owns the ways back: `revert` and `reset`.
+    registerPluginApiRoute('marketplace/install-theme', installThemeHandler);
+    registerPluginApiRoute('marketplace/install-dataset-schema', installDatasetSchemaHandler);
+    registerPluginApiRoute('marketplace/install-email-starter', installEmailStarterHandler);
+    registerPluginApiRoute('marketplace/install-email-template', installEmailTemplateHandler);
+    // Updating a copied artifact is its own route (AGL-1018), not a flag on
+    // install: install writes the publisher's version, this one reconciles it
+    // with a copy that has diverged and refuses to overwrite silently.
+    registerPluginApiRoute('marketplace/update-artifact', updateArtifactHandler);
+    registerPluginApiRoute('marketplace/listing-versions', listingVersionsHandler);
+    registerPluginApiRoute('marketplace/preview-image', previewImageHandler);
+    registerPluginApiRoute('marketplace/publish', publishHandler);
+    registerPluginApiRoute('marketplace/report', reportHandler);
+    registerPluginApiRoute('marketplace/reviews', reviewsHandler);
+    registerPluginApiRoute('marketplace/publisher-profile', publisherProfileSaveHandler);
+    registerPluginApiRoute('marketplace/verification-request', verificationRequestHandler);
+    registerPluginApiRoute('marketplace/publish-layout', publishLayoutHandler);
+    registerPluginApiRoute('marketplace/publish-template', publishTemplateHandler);
+    registerPluginApiRoute('marketplace/publish-theme', publishThemeHandler);
+    registerPluginApiRoute('marketplace/publish-dataset-schema', publishDatasetSchemaHandler);
+    registerPluginApiRoute('marketplace/publish-email-starter', publishEmailStarterHandler);
+    registerPluginApiRoute('marketplace/publish-email-template', publishEmailTemplateHandler);
+    // Relocated console routes (AGL-418): URLs preserved via the dispatcher.
+    registerPluginApiRoute('marketplace/publish-plugin', publishPluginHandler);
+    // Marketplace purchases ride the platform Stripe webhook (AGL-418).
+    registerBillingWebhookHandler(marketplaceBillingWebhookHandler);
+}
+
+//# sourceMappingURL=server.js.map

package/src/lib/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/marketplace/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerPluginApiRoute,\n  registerCustomFieldType,\n} from '@aglyn/aglyn/server'\nimport { marketplaceBillingWebhookHandler } from './server/billing-webhook'\nimport { publishPluginHandler } from './server/publish-plugin'\nimport { verificationRequestHandler } from './server/verification-request'\nimport { checkoutHandler } from './server/checkout'\nimport { connectHandler } from './server/connect'\nimport { installHandler } from './server/install'\nimport { installPluginHandler } from './server/install-plugin'\nimport { listingVersionsHandler } from './server/listing-versions'\nimport { RATING_FIELD } from './model/rating-field'\nimport { installDatasetSchemaHandler } from './server/install-dataset-schema'\nimport { installEmailStarterHandler } from './server/install-email-starter'\nimport { installEmailTemplateHandler } from './server/install-email-template'\nimport { installLayoutHandler } from './server/install-layout'\nimport { installTemplateHandler } from './server/install-template'\nimport { installThemeHandler } from './server/install-theme'\nimport { previewImageHandler } from './server/preview-image'\nimport { publishHandler } from './server/publish'\nimport { reportHandler } from './server/report'\nimport { reviewsHandler } from './server/reviews'\nimport { publisherProfileSaveHandler } from './server/publisher-profile-save'\nimport { publishDatasetSchemaHandler } from './server/publish-dataset-schema'\nimport { publishEmailStarterHandler } from './server/publish-email-starter'\nimport { publishEmailTemplateHandler } from './server/publish-email-template'\nimport { publishLayoutHandler } from './server/publish-layout'\nimport { publishTemplateHandler } from './server/publish-template'\nimport { publishThemeHandler } from './server/publish-theme'\nimport { updateArtifactHandler } from './server/update-artifact'\n\n/**\n * Registers the marketplace plugin's console-side API routes (AGL-396):\n * marketplace publish/install of templates and plugins, and the Stripe\n * Connect + checkout flows for paid listings.\n *\n * Upload-bodied routes register here too. The note that used to sit here —\n * that they had to stay as named console routes because the dispatcher\n * \"can't grant per-route bodyParser limits\" — was a Pages Router leftover:\n * `runLegacyHandler` reads the request through the same\n * `pluginRequestFromWeb` a named App Router route would, and imposes no\n * limit of its own. publish-plugin's 8 MB bundle has been going through the\n * dispatcher the whole time.\n */\nexport function registerMarketplaceConsoleApi(): void {\n  // Server side of the rating custom field (AGL-434): validators run\n  // on import/write paths even when no client loaded the plugin.\n  registerCustomFieldType(RATING_FIELD)\n  registerPluginApiRoute('marketplace/checkout', checkoutHandler)\n  registerPluginApiRoute('marketplace/connect', connectHandler)\n  registerPluginApiRoute('marketplace/install', installHandler)\n  registerPluginApiRoute('marketplace/install-plugin', installPluginHandler)\n  registerPluginApiRoute('marketplace/install-layout', installLayoutHandler)\n  registerPluginApiRoute('marketplace/install-template', installTemplateHandler)\n  // A theme install DOES change the running site (AGL-1020) — it is the site's\n  // appearance — so this route also owns the ways back: `revert` and `reset`.\n  registerPluginApiRoute('marketplace/install-theme', installThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/install-dataset-schema',\n    installDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-starter',\n    installEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-template',\n    installEmailTemplateHandler,\n  )\n  // Updating a copied artifact is its own route (AGL-1018), not a flag on\n  // install: install writes the publisher's version, this one reconciles it\n  // with a copy that has diverged and refuses to overwrite silently.\n  registerPluginApiRoute('marketplace/update-artifact', updateArtifactHandler)\n  registerPluginApiRoute('marketplace/listing-versions', listingVersionsHandler)\n  registerPluginApiRoute('marketplace/preview-image', previewImageHandler)\n  registerPluginApiRoute('marketplace/publish', publishHandler)\n  registerPluginApiRoute('marketplace/report', reportHandler)\n  registerPluginApiRoute('marketplace/reviews', reviewsHandler)\n  registerPluginApiRoute(\n    'marketplace/publisher-profile',\n    publisherProfileSaveHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/verification-request',\n    verificationRequestHandler,\n  )\n  registerPluginApiRoute('marketplace/publish-layout', publishLayoutHandler)\n  registerPluginApiRoute('marketplace/publish-template', publishTemplateHandler)\n  registerPluginApiRoute('marketplace/publish-theme', publishThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/publish-dataset-schema',\n    publishDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-starter',\n    publishEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-template',\n    publishEmailTemplateHandler,\n  )\n  // Relocated console routes (AGL-418): URLs preserved via the dispatcher.\n  registerPluginApiRoute('marketplace/publish-plugin', publishPluginHandler)\n  // Marketplace purchases ride the platform Stripe webhook (AGL-418).\n  registerBillingWebhookHandler(marketplaceBillingWebhookHandler)\n}\n"],"names":["registerBillingWebhookHandler","registerPluginApiRoute","registerCustomFieldType","marketplaceBillingWebhookHandler","publishPluginHandler","verificationRequestHandler","checkoutHandler","connectHandler","installHandler","installPluginHandler","listingVersionsHandler","RATING_FIELD","installDatasetSchemaHandler","installEmailStarterHandler","installEmailTemplateHandler","installLayoutHandler","installTemplateHandler","installThemeHandler","previewImageHandler","publishHandler","reportHandler","reviewsHandler","publisherProfileSaveHandler","publishDatasetSchemaHandler","publishEmailStarterHandler","publishEmailTemplateHandler","publishLayoutHandler","publishTemplateHandler","publishThemeHandler","updateArtifactHandler","registerMarketplaceConsoleApi"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,6BAA6B,EAC7BC,sBAAsB,EACtBC,uBAAuB,QAClB,sBAAqB;AAC5B,SAASC,gCAAgC,QAAQ,8BAA0B;AAC3E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,0BAA0B,QAAQ,mCAA+B;AAC1E,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,YAAY,QAAQ,0BAAsB;AACnD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC;IACd,mEAAmE;IACnE,+DAA+D;IAC/D5B,wBAAwBS;IACxBV,uBAAuB,wBAAwBK;IAC/CL,uBAAuB,uBAAuBM;IAC9CN,uBAAuB,uBAAuBO;IAC9CP,uBAAuB,8BAA8BQ;IACrDR,uBAAuB,8BAA8Bc;IACrDd,uBAAuB,gCAAgCe;IACvD,6EAA6E;IAC7E,4EAA4E;IAC5Ef,uBAAuB,6BAA6BgB;IACpDhB,uBACE,sCACAW;IAEFX,uBACE,qCACAY;IAEFZ,uBACE,sCACAa;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnEb,uBAAuB,+BAA+B4B;IACtD5B,uBAAuB,gCAAgCS;IACvDT,uBAAuB,6BAA6BiB;IACpDjB,uBAAuB,uBAAuBkB;IAC9ClB,uBAAuB,sBAAsBmB;IAC7CnB,uBAAuB,uBAAuBoB;IAC9CpB,uBACE,iCACAqB;IAEFrB,uBACE,oCACAI;IAEFJ,uBAAuB,8BAA8ByB;IACrDzB,uBAAuB,gCAAgC0B;IACvD1B,uBAAuB,6BAA6B2B;IACpD3B,uBACE,sCACAsB;IAEFtB,uBACE,qCACAuB;IAEFvB,uBACE,sCACAwB;IAEF,yEAAyE;IACzExB,uBAAuB,8BAA8BG;IACrD,oEAAoE;IACpEJ,8BAA8BG;AAChC"}