@aglyn/plugins-marketplace 1.0.0-beta.149 → 1.0.0-beta.151

package/src/lib/server/admin-reviews.js

@@ -0,0 +1,1341 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { REVOKED_VERSION_REVIEW_STATE, revocationWithdrawsReviewedClaim, shouldStripVerifiedOnTakedown, VERIFIED_STRIPPED_STATUS } from "../model/plugin-review-status.js";
+import { checkPluginBundle, isPluginRevoked, newestInstallableVersion, isStoredVerdictCurrent, nextRevocationState, PLUGIN_HOST_ABI_VERSION, PLUGIN_VERIFIER_VERSION, pluginArtifactPath, pluginRequestFromWeb, readPluginContributions } from "@aglyn/aglyn/server";
+import { emailUnverifiedResponse, findUserByUidAcrossPools, firebaseAdmin, isImpersonationSession, updateExisting } from "@aglyn/tenant-data-admin";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { buildRoute, compareArtifactVersions, Route } from "@aglyn/aglyn/server";
+import { outstandingChecklistItems, PLUGIN_REVIEW_CHECKLIST } from "../model/plugin-review-checklist.js";
+import { pluginRejectionCategory, rejectionHeadline, rejectionInputError } from "../model/plugin-rejection-categories.js";
+import { attestationsForBytes } from "@aglyn/aglyn/app-utils/publisher-attestation";
+import { VERIFICATION_DECLINE_COOLDOWN_DAYS } from "@aglyn/aglyn/app-utils/marketplace-verification";
+import { PUBLISHER_AGREEMENT_VERSION, publisherAgreementState } from "@aglyn/aglyn/app-utils/publisher-agreement";
+import { FieldValue } from "firebase-admin/firestore";
+import { notifyOrgAdmins } from "@aglyn/tenant-data-admin";
+/*
+ * The publisher fan-out lives beside the usage-alert one in `_lib` rather
+ * than here. Both are multi-recipient platform sends that have to read the
+ * platform suppression list before addressing anybody, and that list has to
+ * be reachable by a spec that does not drag the admin SDK in behind a route.
+ */ import { emailPublisher } from "./publisher-review-email.js";
+import { dropCachesForListing } from "./revoke-cache-drop.js";
+/**
+ * Marketplace review queue (AGL-432) — Strapi Market's two-phase review
+ * as staff tooling. GET returns plugin listings awaiting review
+ * (submitted/in_review) with the static-verifier verdict re-run against
+ * the stored artifact (the same AGL-426 checks the publish API enforced —
+ * re-run here so a reviewer sees them without trusting the publish-time
+ * result). POST moves a listing through the lifecycle:
+ *
+ *   start-review → in_review        list → listed (publicly browsable)
+ *   verify → verified (✅ badge)     reject → rejected (+ reason,
+ *                                    notification to the publisher)
+ *
+ * Realm trust stays a SEPARATE, super-staff grant (sign-plugin route) —
+ * listing/verifying here never signs anything. Every action lands in
+ * adminAudit.
+ */ /** Every id the checklist route will accept (AGL-963). */ const REQUIRED_OR_OPTIONAL = new Set(PLUGIN_REVIEW_CHECKLIST.map((item)=>item.id));
+const ACTIONS = {
+    'start-review': 'in_review',
+    list: 'listed',
+    verify: 'verified',
+    reject: 'rejected',
+    // Moves BACK down the ladder (AGL-965). Review used to be a one-way
+    // ratchet: the only retreats were `reject`, which reads as a verdict on
+    // the whole listing and notifies the publisher as such, and takedown,
+    // which is the kill switch and stops the plugin in every workspace that
+    // already installed it. Neither expresses "pull it from the marketplace
+    // while we look again, without breaking the sites already using it".
+    delist: 'in_review',
+    unverify: 'listed'
+};
+/**
+ * One listing in full, for the detail page (AGL-959). The index deals in
+ * rows; everything a reviewer needs to actually decide — manifest,
+ * capabilities, ABI, verifier findings, per-version trust, takedown state —
+ * is assembled here rather than smeared across the list payload.
+ */ async function listingDetail(firestore, listingId, requestedVersion) {
+    var _listing_profileId, _listing_latestVersion, _ref, _ref1, _ref2, _ref3, _listing_displayName, _listing_description, _listing_verificationRequest_state, _ref4, _listing_verificationRequest_declineReason, _listing_readme, _listing_license, _listing_categories, _listing_homepageUrl, _ref5, _ref6, _listing_reviewStatus, _listing_rejectionReason, _listing_rejectionCategory, _listing_priceUsd, _listing_latestVersion1, _listing_activeInstalls, _listing_hiddenReason, _ref7, _ref8, _ref9, _ref10;
+    var _versions_find, _attestationEntries_find, _attestationEntries_find_at_toDate, _attestationEntries_find_at_toDate1, _attestationEntries_find_at, _attestationEntries_find1, _listing_verificationRequest_requestedAt_toDate, _listing_verificationRequest_requestedAt_toDate1, _listing_verificationRequest_requestedAt, _acceptance_acceptedAt_toDate, _acceptance_acceptedAt_toDate1, _acceptance_acceptedAt;
+    const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+    const snapshot = await listingRef.get();
+    const listing = snapshot.data();
+    if (!listing) {
+        return Response.json({
+            error: 'Unknown listing'
+        }, {
+            status: 404
+        });
+    }
+    const versionsSnapshot = await listingRef.collection('pluginVersions').orderBy('publishedAt', 'desc').limit(25).get();
+    const versions = versionsSnapshot.docs.map((doc)=>{
+        var _doc_get, _doc_get1, _doc_get2, _doc_get3, _readPluginContributions, _doc_get4, _ref, _doc_get5, _doc_get6, _doc_get7, _doc_get8, _doc_get9, _doc_get10, _doc_get11;
+        var _publishedAt_toDate, _publishedAt_toDate1;
+        const publishedAt = doc.get('publishedAt');
+        return {
+            version: String((_doc_get = doc.get('version')) != null ? _doc_get : doc.id),
+            trust: (_doc_get1 = doc.get('trust')) != null ? _doc_get1 : null,
+            sha256: String((_doc_get2 = doc.get('sha256')) != null ? _doc_get2 : ''),
+            hostAbi: Number(doc.get('manifest.hostAbi')) || null,
+            capabilities: (_doc_get3 = doc.get('manifest.capabilities')) != null ? _doc_get3 : {},
+            // What these bytes declare they contribute (AGL-3116); `null` when the
+            // version predates the contract and loads under its default.
+            contributes: (_readPluginContributions = readPluginContributions(doc.get('manifest.contributes'))) != null ? _readPluginContributions : null,
+            // Declared canvas elements (AGL-1031), for THESE bytes. Publisher copy
+            // that renders in the customer's element picker and nowhere on the
+            // listing page — so without it here, the `element-metadata` criterion
+            // asks a reviewer to check text this page never shows (AGL-2486).
+            elements: (_doc_get4 = doc.get('manifest.elements')) != null ? _doc_get4 : [],
+            publishedAt: (_ref = publishedAt == null ? void 0 : (_publishedAt_toDate1 = publishedAt.toDate) == null ? void 0 : (_publishedAt_toDate = _publishedAt_toDate1.call(publishedAt)) == null ? void 0 : _publishedAt_toDate.toISOString()) != null ? _ref : null,
+            // Per-version installs (AGL-1036). "How many workspaces would a revoke
+            // actually hit" is a per-version question, and the listing total shown
+            // elsewhere on this page answers a different one.
+            installCount: Number((_doc_get5 = doc.get('installCount')) != null ? _doc_get5 : 0),
+            activeInstalls: Number((_doc_get6 = doc.get('activeInstalls')) != null ? _doc_get6 : 0),
+            signed: Boolean(doc.get('signature')),
+            // The repo as declared for THESE bytes (AGL-1076); absent on versions
+            // published before it was collected.
+            repositoryUrl: String((_doc_get7 = doc.get('repositoryUrl')) != null ? _doc_get7 : ''),
+            reviewState: String((_doc_get8 = doc.get('reviewState')) != null ? _doc_get8 : 'pending'),
+            grandfathered: Boolean(doc.get('grandfathered')),
+            // Server-side only — used to decide whether the verdict below needs
+            // recomputing; stripped before the payload goes out.
+            verification: (_doc_get9 = doc.get('verification')) != null ? _doc_get9 : null,
+            reviewChecklist: (_doc_get10 = doc.get('reviewChecklist')) != null ? _doc_get10 : null,
+            publisherAttestation: (_doc_get11 = doc.get('publisherAttestation')) != null ? _doc_get11 : null
+        };
+    });
+    // Publisher is an ORG since AGL-652 — show the name, not the raw id.
+    const publisherId = String((_listing_profileId = listing.profileId) != null ? _listing_profileId : '');
+    const publisher = publisherId ? await firestore.collection('orgs').doc(publisherId).get() : null;
+    // Which terms this publisher is actually under (AGL-1077). A reviewer
+    // weighing a takedown, a delist, or a revocation is deciding what we are
+    // entitled to do — and that is answered by the agreement the ORG accepted,
+    // not by the per-version attestation beside it.
+    const publisherProfile = publisherId ? await firestore.collection('publisherProfiles').doc(publisherId).get() : null;
+    const acceptance = publisherProfile == null ? void 0 : publisherProfile.get('publisherAgreement');
+    // Kill switch, so the page can say whether the plugin is actually stopped
+    // rather than only de-listed (AGL-948).
+    const revocation = (await firestore.collection('revocations').doc(listingId).get()).data();
+    // The verifier verdict for the version under review (AGL-426), served
+    // from the version doc when it is current (AGL-962).
+    //
+    // `checkPluginBundle` is pure and the artifact is immutable and
+    // content-addressed, so a verdict pinned to {sha256, verifierVersion} is
+    // exactly as trustworthy as re-running it — and re-running meant
+    // downloading up to a megabyte from Storage on EVERY page view. A stored
+    // verdict from an older checker, or for different bytes, is ignored.
+    // Which version this page is reviewing (AGL-966). Defaults to the oldest
+    // version still awaiting a verdict — that is the work — falling back to
+    // the latest when everything is decided. A reviewer can pin any version
+    // explicitly; the checklist and verifier verdict follow the selection,
+    // because both are statements about specific bytes.
+    const pendingFirst = [
+        ...versions
+    ].reverse().find((entry)=>entry.reviewState !== 'approved');
+    const reviewVersion = requestedVersion && ((_versions_find = versions.find((entry)=>entry.version === requestedVersion)) == null ? void 0 : _versions_find.version) || (pendingFirst == null ? void 0 : pendingFirst.version) || String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : '');
+    const artifactsBucket = process.env.PLUGIN_ARTIFACTS_BUCKET;
+    const reviewEntry = versions.find((entry)=>entry.version === reviewVersion);
+    const reviewSha = reviewEntry == null ? void 0 : reviewEntry.sha256;
+    const stored = reviewEntry == null ? void 0 : reviewEntry.verification;
+    const storedIsCurrent = isStoredVerdictCurrent(stored, reviewSha != null ? reviewSha : '');
+    let verifier = storedIsCurrent ? {
+        ok: stored == null ? void 0 : stored.ok,
+        problems: (_ref = stored == null ? void 0 : stored.problems) != null ? _ref : [],
+        // The per-check summary rides along in the stored verdict (AGL-1087)
+        // so the page can show what was checked without re-downloading a
+        // megabyte of artifact on every view.
+        checks: (_ref1 = stored == null ? void 0 : stored.checks) != null ? _ref1 : []
+    } : null;
+    let verifierCached = storedIsCurrent;
+    if (!storedIsCurrent && artifactsBucket && reviewSha) {
+        try {
+            var _ref11;
+            var _reviewEntry_capabilities;
+            const [bytes] = await firebaseAdmin.app().storage().bucket(artifactsBucket).file(pluginArtifactPath(listingId, reviewVersion, reviewSha)).download();
+            // The manifest for THESE bytes, so an undeclared network call is a
+            // finding rather than a warning (AGL-964). Read from the version doc,
+            // never from the listing — capabilities change between versions.
+            const result = checkPluginBundle(bytes.toString('utf8'), {
+                declaredNetwork: Array.isArray(reviewEntry == null ? void 0 : (_reviewEntry_capabilities = reviewEntry.capabilities) == null ? void 0 : _reviewEntry_capabilities.network) ? reviewEntry.capabilities.network.map((origin)=>String(origin)) : [],
+                // Compared, never required: a version published before the contract
+                // loads under its default, and review must not refuse it for a rule
+                // it was never held to.
+                declaredContributions: (_ref11 = reviewEntry == null ? void 0 : reviewEntry.contributes) != null ? _ref11 : null
+            });
+            verifier = result;
+            // Write it back so this sha is verified at most once platform-wide —
+            // covers every listing published before the verdict was persisted at
+            // publish time, and any version whose checker has since moved on.
+            // Best effort: a failed write costs the next reader a re-run, nothing
+            // more, so it must never fail the page.
+            await listingRef.collection('pluginVersions').doc(reviewVersion).set({
+                verification: {
+                    ok: result.ok,
+                    problems: result.problems,
+                    checks: result.checks,
+                    sha256: reviewSha,
+                    verifierVersion: PLUGIN_VERIFIER_VERSION,
+                    checkedAt: FieldValue.serverTimestamp()
+                }
+            }, {
+                merge: true
+            }).catch(()=>undefined);
+        } catch (unused) {
+            verifier = {
+                error: 'artifact unavailable'
+            };
+            verifierCached = false;
+        }
+    }
+    // Who attested, by name (AGL-969). "A named publisher said this on a date"
+    // is the half that makes a false attestation actionable, and a raw uid
+    // names nobody. Best effort — a deleted account must not blank the page.
+    const attestationEntries = Object.values((_ref2 = reviewEntry == null ? void 0 : reviewEntry.publisherAttestation) != null ? _ref2 : {}).filter((entry)=>(entry == null ? void 0 : entry.sha256) === reviewSha);
+    const attesterUid = (_attestationEntries_find = attestationEntries.find((entry)=>entry.by)) == null ? void 0 : _attestationEntries_find.by;
+    const attestedAt = (_ref3 = (_attestationEntries_find1 = attestationEntries.find((entry)=>entry.at)) == null ? void 0 : (_attestationEntries_find_at = _attestationEntries_find1.at) == null ? void 0 : (_attestationEntries_find_at_toDate1 = _attestationEntries_find_at.toDate) == null ? void 0 : (_attestationEntries_find_at_toDate = _attestationEntries_find_at_toDate1.call(_attestationEntries_find_at)) == null ? void 0 : _attestationEntries_find_at_toDate.toISOString()) != null ? _ref3 : null;
+    let attestedBy = attesterUid != null ? attesterUid : null;
+    if (attesterUid) {
+        try {
+            // Across pools (AGL-1122): an SSO attester is invisible to project-level
+            // `getUser`, so this fell through to the catch and the review page named
+            // the attester by raw uid — indistinguishable from "account deleted".
+            const found = await findUserByUidAcrossPools(attesterUid);
+            if (found) {
+                var _ref12, _found_record_email;
+                attestedBy = (_ref12 = (_found_record_email = found.record.email) != null ? _found_record_email : found.record.displayName) != null ? _ref12 : attesterUid;
+            }
+        } catch (unused) {
+        // Account gone — the uid still identifies the statement.
+        }
+    }
+    return Response.json({
+        listingId,
+        displayName: (_listing_displayName = listing.displayName) != null ? _listing_displayName : listingId,
+        description: (_listing_description = listing.description) != null ? _listing_description : '',
+        // The publisher's ask, so the page can offer Decline beside Verify
+        // (AGL-1217). Serialized: `decidedAt`/`requestedAt` are Timestamps and
+        // this payload crosses JSON.
+        verificationRequest: listing.verificationRequest ? {
+            state: String((_listing_verificationRequest_state = listing.verificationRequest.state) != null ? _listing_verificationRequest_state : ''),
+            requestedAt: (_ref4 = (_listing_verificationRequest_requestedAt = listing.verificationRequest.requestedAt) == null ? void 0 : (_listing_verificationRequest_requestedAt_toDate1 = _listing_verificationRequest_requestedAt.toDate) == null ? void 0 : (_listing_verificationRequest_requestedAt_toDate = _listing_verificationRequest_requestedAt_toDate1.call(_listing_verificationRequest_requestedAt)) == null ? void 0 : _listing_verificationRequest_requestedAt_toDate.toISOString()) != null ? _ref4 : null,
+            declineReason: (_listing_verificationRequest_declineReason = listing.verificationRequest.declineReason) != null ? _listing_verificationRequest_declineReason : null
+        } : null,
+        readme: (_listing_readme = listing.readme) != null ? _listing_readme : '',
+        license: (_listing_license = listing.license) != null ? _listing_license : '',
+        categories: (_listing_categories = listing.categories) != null ? _listing_categories : [],
+        homepageUrl: (_listing_homepageUrl = listing.homepageUrl) != null ? _listing_homepageUrl : '',
+        // Prefer what the version under review declared (AGL-1076). The
+        // listing carries whatever the most recent publish said, and a repo
+        // can move between versions — the link a reviewer opens should be the
+        // one attested against the bytes in front of them. Falls back to the
+        // listing for versions published before this was collected.
+        repositoryUrl: (reviewEntry == null ? void 0 : reviewEntry.repositoryUrl) || listing.repositoryUrl || '',
+        publisherId,
+        publisherName: (_ref5 = publisher == null ? void 0 : publisher.get('name')) != null ? _ref5 : publisherId,
+        publisherSlug: (_ref6 = publisher == null ? void 0 : publisher.get('slug')) != null ? _ref6 : null,
+        reviewStatus: (_listing_reviewStatus = listing.reviewStatus) != null ? _listing_reviewStatus : 'submitted',
+        rejectionReason: (_listing_rejectionReason = listing.rejectionReason) != null ? _listing_rejectionReason : '',
+        rejectionCategory: (_listing_rejectionCategory = listing.rejectionCategory) != null ? _listing_rejectionCategory : '',
+        priceUsd: Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0),
+        latestVersion: String((_listing_latestVersion1 = listing.latestVersion) != null ? _listing_latestVersion1 : ''),
+        // The version the checklist, verifier verdict and approve/reject
+        // actions on this payload refer to.
+        reviewVersion,
+        activeInstalls: Number((_listing_activeInstalls = listing.activeInstalls) != null ? _listing_activeInstalls : 0),
+        hidden: Boolean(listing.hiddenAt),
+        hiddenReason: String((_listing_hiddenReason = listing.hiddenReason) != null ? _listing_hiddenReason : ''),
+        revoked: Boolean(revocation),
+        revokedVersions: (_ref7 = revocation == null ? void 0 : revocation.versions) != null ? _ref7 : null,
+        unpublished: Boolean(listing.deletedAt),
+        private: listing.visibility === 'private',
+        platformHostAbi: PLUGIN_HOST_ABI_VERSION,
+        // Where the bundle bytes actually live (AGL-990). Staff-only payload,
+        // and a bucket NAME is not a credential — reaching the object still
+        // needs a Google account with access. Without it the page cannot build
+        // a Cloud console link, and this bucket does not appear in the Firebase
+        // console at all, so a reviewer has no way to find it by hand.
+        artifactsBucket: artifactsBucket != null ? artifactsBucket : null,
+        versions: versions.map(// The rest-strip is the point: `verification`, `reviewChecklist` and
+        // `publisherAttestation` are named only so they DO NOT reach the
+        // client payload, which is what the disable below is for. The
+        // duplicate directive that used to sit above `versions.map(` covered
+        // a line with nothing unused on it, and this config treats an
+        // unused disable as a failure.
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (_0)=>{
+            let { verification, reviewChecklist, publisherAttestation } = _0, entry = _object_without_properties_loose(_0, [
+                "verification",
+                "reviewChecklist",
+                "publisherAttestation"
+            ]);
+            return _extends({}, entry, {
+                // Per-version kill-switch state (AGL-1085), read through the same
+                // helper the loaders use so the page cannot disagree with the
+                // runtime about whether these bytes are stopped.
+                revoked: isPluginRevoked(revocation, entry.version)
+            });
+        }),
+        // Review checklist for the version under review (AGL-963). Ticks made
+        // against different bytes do not count, so a republish starts clean.
+        checklist: Object.fromEntries(Object.entries((_ref8 = reviewEntry == null ? void 0 : reviewEntry.reviewChecklist) != null ? _ref8 : {}).filter(([, entry])=>(entry == null ? void 0 : entry.sha256) === reviewSha).map(([id, entry])=>{
+            var _entry_by;
+            return [
+                id,
+                {
+                    by: (_entry_by = entry.by) != null ? _entry_by : null
+                }
+            ];
+        })),
+        checklistOutstanding: outstandingChecklistItems(reviewEntry == null ? void 0 : reviewEntry.reviewChecklist, reviewSha != null ? reviewSha : ''),
+        // What the publisher stated about THESE bytes (AGL-969). Not a review
+        // input — a reviewer still checks everything themselves — but it says
+        // what was claimed, so a discrepancy is a documented false statement
+        // rather than a difference of opinion. Attestations recorded against
+        // other bytes are dropped, exactly like staff ticks.
+        attestation: attestationsForBytes(reviewEntry == null ? void 0 : reviewEntry.publisherAttestation, reviewSha != null ? reviewSha : ''),
+        attestedBy,
+        attestedAt,
+        // The publisher agreement this ORG is under (AGL-1077). `current` is
+        // computed here rather than shipped as a boolean so the page can say
+        // "on an older version" — which is a different thing from never
+        // having accepted, and matters differently to a takedown decision.
+        publisherAgreement: {
+            version: (_ref9 = acceptance == null ? void 0 : acceptance.version) != null ? _ref9 : null,
+            acceptedAt: (_ref10 = acceptance == null ? void 0 : (_acceptance_acceptedAt = acceptance.acceptedAt) == null ? void 0 : (_acceptance_acceptedAt_toDate1 = _acceptance_acceptedAt.toDate) == null ? void 0 : (_acceptance_acceptedAt_toDate = _acceptance_acceptedAt_toDate1.call(_acceptance_acceptedAt)) == null ? void 0 : _acceptance_acceptedAt_toDate.toISOString()) != null ? _ref10 : null,
+            required: PUBLISHER_AGREEMENT_VERSION,
+            state: publisherAgreementState(acceptance)
+        },
+        verifier,
+        verifierCached,
+        verifierVersion: PLUGIN_VERIFIER_VERSION
+    }, {
+        status: 200
+    });
+}
+/**
+ * Re-derive `latestApprovedVersion` from the versions themselves (AGL-2306).
+ *
+ * The mirror was written on approval only, with a comment saying it "only ever
+ * moves forward" — true of approvals, and the reason it is there. What nothing
+ * did was move it BACK. A version approved and later rejected on re-review, or
+ * killed with the per-version switch, left the listing still advertising it:
+ * `host-plugins-card` and `marketplace-update-state` read this field to offer
+ * "Update to vX", and `install-plugin` would then refuse those exact bytes.
+ *
+ * Contained, because `install-plugin` recomputes approval live and never
+ * trusts this field — no unreviewed or revoked bytes could ship — but it is
+ * the AGL-1016 guarantee leaking back out through a badge, which is where
+ * AGL-966 came in.
+ *
+ * Recomputed rather than decremented: "the newest version that is approved AND
+ * not revoked" is a property of the whole set, and stepping it back one at a
+ * time is how a mirror drifts in the other direction.
+ *
+ * Revoked versions are excluded because the offer has to be installable, and
+ * `install-plugin` 409s on a revoked pin. That also makes un-revoking restore
+ * the offer, which is why this runs on both revoke and unrevoke.
+ *
+ * Deletes the field when nothing qualifies: an absent mirror reads as "no
+ * update to offer", while a stale string reads as an update that does not
+ * exist.
+ */ async function repairLatestApprovedVersion(listingRef, revocation) {
+    const versions = await listingRef.collection('pluginVersions').orderBy('publishedAt', 'desc').limit(50).get();
+    // The DECISION lives in core (`newestInstallableVersion`), where it is
+    // testable without a Firestore double and shared with anything else that
+    // has to answer "what is on offer". This function is only the query.
+    const newest = newestInstallableVersion(versions.docs.map((doc)=>({
+            version: doc.id,
+            reviewState: doc.get('reviewState')
+        })), revocation, compareArtifactVersions);
+    await updateExisting(listingRef, {
+        latestApprovedVersion: newest != null ? newest : FieldValue.delete(),
+        updatedAt: FieldValue.serverTimestamp()
+    });
+}
+async function handler(request) {
+    var _headers_authorization;
+    const { method, body, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return Response.json({
+        error: 'Unauthenticated'
+    }, {
+        status: 401
+    });
+    try {
+        var _ref, _ref1, _ref2, _ref3;
+        var _listing_verificationRequest;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        if (!decoded['staff']) {
+            return Response.json({
+                error: 'Staff only'
+            }, {
+                status: 403
+            });
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        if (method === 'GET') {
+            var _query_listingId;
+            const detailId = String((_query_listingId = query['listingId']) != null ? _query_listingId : '');
+            if (detailId) {
+                var _query_version;
+                return listingDetail(firestore, detailId, String((_query_version = query['version']) != null ? _query_version : ''));
+            }
+            // Every plugin listing, bucketed by whether its newest bytes are
+            // waiting on a reviewer (AGL-966). The queue used to ask only for
+            // `reviewStatus in ['submitted','in_review']`, which meant an UPDATE
+            // to an already-listed plugin appeared nowhere: the listing kept its
+            // status, so nobody was ever shown the new version. Reading each
+            // listing's latest version doc costs one read per listing and needs
+            // no new composite index.
+            const snapshot = await firestore.collection('marketplaceListings').where('type', '==', 'plugin').limit(100).get();
+            // Rows only (AGL-961). This used to DOWNLOAD every queued bundle to
+            // re-run the verifier, so the index paid a Storage round trip per
+            // submission before it could paint. The verifier now runs on the
+            // detail page, for the one listing being read.
+            const rows = await Promise.all(snapshot.docs.filter((doc)=>!doc.get('deletedAt')).map(async (doc)=>{
+                var _listing_latestVersion, _listing_displayName, _listing_description, _listing_license, _listing_categories, _listing_reviewStatus, _listing_priceUsd, _ref, _listing_verificationRequest;
+                const listing = doc.data();
+                const version = String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : '');
+                const latest = version ? await doc.ref.collection('pluginVersions').doc(version).get() : null;
+                return {
+                    listingId: doc.id,
+                    displayName: (_listing_displayName = listing.displayName) != null ? _listing_displayName : doc.id,
+                    description: (_listing_description = listing.description) != null ? _listing_description : '',
+                    license: (_listing_license = listing.license) != null ? _listing_license : '',
+                    categories: (_listing_categories = listing.categories) != null ? _listing_categories : [],
+                    profileId: listing.profileId,
+                    reviewStatus: (_listing_reviewStatus = listing.reviewStatus) != null ? _listing_reviewStatus : 'submitted',
+                    priceUsd: Number((_listing_priceUsd = listing.priceUsd) != null ? _listing_priceUsd : 0),
+                    version,
+                    hidden: Boolean(listing.hiddenAt),
+                    private: listing.visibility === 'private',
+                    latestReviewState: String((_ref = latest == null ? void 0 : latest.get('reviewState')) != null ? _ref : 'pending'),
+                    grandfathered: Boolean(latest == null ? void 0 : latest.get('grandfathered')),
+                    // The publisher's standing ask for the badge (AGL-1217).
+                    verificationRequest: (_listing_verificationRequest = listing.verificationRequest) != null ? _listing_verificationRequest : null
+                };
+            }));
+            // Awaiting review = the newest bytes have no approval, whatever the
+            // listing says. That is what puts an update in front of staff.
+            const queue = rows.filter((row)=>row.latestReviewState !== 'approved');
+            // A THIRD bucket, deliberately not folded into `queue` (AGL-1217).
+            // `queue` means "these bytes have not been read"; a verification request
+            // means "this publisher asked us to vouch for who they are". They are
+            // different questions with different work attached, and a listing can
+            // sit in both at once — an update pending review from a publisher who
+            // has also asked for the badge. Merging them would hide one behind the
+            // other and make the count meaningless.
+            const verificationRequests = rows.filter((row)=>{
+                var _row_verificationRequest;
+                return ((_row_verificationRequest = row.verificationRequest) == null ? void 0 : _row_verificationRequest.state) === 'pending';
+            });
+            // Listed/verified plugins with per-version trust (AGL-885): once a
+            // listing leaves the queue the Grant/Revoke realm-trust actions used
+            // to leave with it — revoking a live plugin's trust required a
+            // hand-crafted API call. This block keeps every listed plugin's
+            // version trust state administrable.
+            const listedSnapshot = {
+                docs: snapshot.docs.filter((doc)=>{
+                    var _doc_get;
+                    return [
+                        'listed',
+                        'verified'
+                    ].includes(String((_doc_get = doc.get('reviewStatus')) != null ? _doc_get : ''));
+                })
+            };
+            const listed = await Promise.all(listedSnapshot.docs.map(async (doc)=>{
+                var _listing_displayName, _listing_latestVersion, _listing_hiddenReason;
+                const listing = doc.data();
+                const versionsSnapshot = await doc.ref.collection('pluginVersions').orderBy('publishedAt', 'desc').limit(10).get();
+                const versions = versionsSnapshot.docs.map((versionDoc)=>{
+                    var _versionDoc_get, _versionDoc_get1, _versionDoc_get2;
+                    return {
+                        version: String((_versionDoc_get = versionDoc.get('version')) != null ? _versionDoc_get : versionDoc.id),
+                        trust: (_versionDoc_get1 = versionDoc.get('trust')) != null ? _versionDoc_get1 : null,
+                        reviewState: String((_versionDoc_get2 = versionDoc.get('reviewState')) != null ? _versionDoc_get2 : 'pending')
+                    };
+                });
+                return {
+                    listingId: doc.id,
+                    displayName: (_listing_displayName = listing.displayName) != null ? _listing_displayName : doc.id,
+                    reviewStatus: listing.reviewStatus,
+                    profileId: listing.profileId,
+                    latestVersion: String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : ''),
+                    // Takedown state (AGL-952), so a row shows the current verdict
+                    // rather than sending a reviewer into the detail page to find
+                    // out whether the plugin is stopped.
+                    hidden: Boolean(listing.hiddenAt),
+                    hiddenReason: String((_listing_hiddenReason = listing.hiddenReason) != null ? _listing_hiddenReason : ''),
+                    private: listing.visibility === 'private',
+                    pendingVersions: versions.filter((entry)=>entry.reviewState !== 'approved').length,
+                    // Summarised for the row; the per-version controls live on the
+                    // detail page (AGL-960).
+                    realmVersions: versions.filter((entry)=>entry.trust === 'realm').length,
+                    versionCount: versions.length,
+                    versions
+                };
+            }));
+            // Publisher names for scanning (AGL-961) — a listing id tells a
+            // reviewer nothing. One batched read for both sections.
+            const publisherIds = [
+                ...new Set([
+                    ...queue,
+                    ...listed
+                ].map((entry)=>{
+                    var _entry_profileId;
+                    return String((_entry_profileId = entry.profileId) != null ? _entry_profileId : '');
+                }).filter(Boolean))
+            ];
+            const publishers = {};
+            if (publisherIds.length) {
+                const docs = await firestore.getAll(...publisherIds.map((id)=>firestore.collection('orgs').doc(id)));
+                for (const doc of docs){
+                    var _doc_get;
+                    if (doc.exists) publishers[doc.id] = String((_doc_get = doc.get('name')) != null ? _doc_get : doc.id);
+                }
+            }
+            return Response.json({
+                queue,
+                listed,
+                publishers,
+                verificationRequests
+            }, {
+                status: 200
+            });
+        }
+        if (method !== 'POST') {
+            return Response.json({
+                error: 'Method not allowed'
+            }, {
+                status: 405
+            });
+        }
+        const listingId = String((_ref = body == null ? void 0 : body.listingId) != null ? _ref : '');
+        const action = String((_ref1 = body == null ? void 0 : body.action) != null ? _ref1 : '');
+        // Takedown (AGL-658) is separate from the review verdict: it applies to
+        // EVERY artifact type, not just plugins, and it must not overwrite a
+        // plugin's `reviewStatus` — a hidden plugin that later gets un-hidden
+        // should return to the verdict it had, not to square one.
+        if (action === 'hide' || action === 'unhide') {
+            var _ref4, _ref5;
+            if (!listingId) {
+                return Response.json({
+                    error: 'Missing listingId'
+                }, {
+                    status: 400
+                });
+            }
+            const hideReason = String((_ref4 = body == null ? void 0 : body.reason) != null ? _ref4 : '').slice(0, 500);
+            if (action === 'hide' && !hideReason.trim()) {
+                return Response.json({
+                    error: 'Hiding needs a reason'
+                }, {
+                    status: 400
+                });
+            }
+            const reviewUid = String((_ref5 = body == null ? void 0 : body.reviewUid) != null ? _ref5 : '');
+            const target = reviewUid ? firestore.collection('marketplaceListings').doc(listingId).collection('reviews').doc(reviewUid) : firestore.collection('marketplaceListings').doc(listingId);
+            const targetSnapshot = await target.get();
+            if (!targetSnapshot.exists) {
+                return Response.json({
+                    error: 'Unknown target'
+                }, {
+                    status: 404
+                });
+            }
+            // A takedown strips the Verified badge (AGL-1121, decided 2026-08-03).
+            //
+            // Verified is OUR claim that a human vouched for this publisher. Taking
+            // the listing down is us saying the opposite out loud, so the two cannot
+            // both stand — a badge surviving a takedown would still be asserting the
+            // vouch on the listing page the moment it was restored.
+            //
+            // Demoted to `listed`, not to `rejected` or `submitted`: the takedown
+            // itself is what makes it non-browsable (`hiddenAt`), and rewriting the
+            // review verdict would destroy the record of a review that did happen.
+            //
+            // Restoring deliberately does NOT put the badge back. Re-granting is
+            // `verify`, which re-checks the review checklist server-side; an automatic
+            // regrant would hand back the badge without anyone re-forming the opinion
+            // behind it. Losing it to a takedown is meant to cost a re-review.
+            const stripVerified = shouldStripVerifiedOnTakedown({
+                action,
+                reviewStatus: targetSnapshot.get('reviewStatus'),
+                isListingTarget: !reviewUid
+            });
+            await target.set(reviewUid ? {
+                hidden: action === 'hide'
+            } : action === 'hide' ? _extends({
+                hiddenAt: FieldValue.serverTimestamp(),
+                hiddenBy: decoded.uid,
+                hiddenReason: hideReason
+            }, stripVerified ? {
+                reviewStatus: VERIFIED_STRIPPED_STATUS
+            } : {}) : {
+                hiddenAt: FieldValue.delete(),
+                hiddenBy: FieldValue.delete(),
+                hiddenReason: FieldValue.delete()
+            }, {
+                merge: true
+            });
+            // Takedown means takedown (AGL-948). Hiding a PLUGIN listing also
+            // writes the kill switch, so one staff action has one outcome
+            // instead of leaving the bundle executing in every workspace that
+            // already installed it. The realm join blocks on `hiddenAt` too, but
+            // the revocation is what the client-side loaders and the public
+            // listing-versions endpoint already understand — belt and braces on
+            // the one action where a gap means running attacker code.
+            const isPlugin = !reviewUid && (targetSnapshot.get('artifactType') === 'plugin' || targetSnapshot.get('type') === 'plugin');
+            /**
+       * An email starter earns the same treatment for the same reason.
+       *
+       * It is copied on install, so `hiddenAt` alone reaches only the
+       * storefront: every tenant who already installed it goes on MAILING it,
+       * from the sending domain every other tenant shares. The revocation is
+       * what `emailStarterSendBlock` reads at the send, which is the only
+       * chokepoint that can still refuse.
+       *
+       * The five other copied types are deliberately not here. Their content
+       * is rendered on the tenant's own site, where `hiddenAt` blocking the
+       * next install is the whole of what a takedown can honestly promise —
+       * stopping a page from rendering is a different decision, and one nobody
+       * has made.
+       */ const killsInstalledCopies = isPlugin || !reviewUid && targetSnapshot.get('artifactType') === 'emailStarter';
+            if (killsInstalledCopies) {
+                const revocationRef = firestore.collection('revocations').doc(listingId);
+                const current = (await revocationRef.get()).data();
+                // Both transitions go through the shared helper (AGL-1085) so a
+                // takedown and a per-version review revocation can coexist. Restoring
+                // used to DELETE the doc whenever it was takedown-owned, which also
+                // un-revoked any version a reviewer had stopped for an unrelated
+                // reason — `reviewVersions` is what survives the round trip.
+                const next = nextRevocationState(current, {
+                    type: action === 'hide' ? 'takedown' : 'restore'
+                });
+                if (next) {
+                    await revocationRef.set(_extends({}, next, action === 'hide' ? {
+                        reason: hideReason
+                    } : {}, {
+                        revokedBy: decoded.uid,
+                        revokedAt: FieldValue.serverTimestamp()
+                    }, action === 'hide' ? {} : {
+                        source: FieldValue.delete()
+                    }), {
+                        merge: true
+                    });
+                } else if (current) {
+                    await revocationRef.delete();
+                }
+                // Make the kill switch reach ALREADY-CACHED pages (AGL-1152). The
+                // tenant stamps each plugin node with its revocation state at compose
+                // time, so without this the bundle we just killed keeps executing on
+                // every cached page until it happens to re-render. Best effort: the
+                // tenant refuses a revoked plugin at render time regardless.
+                //
+                // Plugin-only: it walks the plugin INSTALL PINS, which an email
+                // starter has none of, and an email is never part of a cached page —
+                // its kill is felt at the send, where nothing is cached.
+                if (isPlugin) await dropCachesForListing(firestore, listingId);
+                // The offer follows the kill switch here too (AGL-2368). AGL-2306
+                // taught the per-version revoke and the reject path to repair the
+                // mirror and left this one out, so a takedown flattened `versions` to
+                // `'all'` — revoking every build — while `latestApprovedVersion` went
+                // on naming one. `hiddenAt` hides the listing from browse and blocks
+                // the install route, so nothing was installable through it; but a
+                // restore clears `hiddenAt` first and the mirror is what the update
+                // badges read, and `nextRevocationState` can return a document that
+                // still holds a reviewer's per-version revocations. Recomputed from
+                // the versions in both directions rather than reasoned about.
+                //
+                // Named explicitly rather than reusing `target`: `isPlugin` is only
+                // true when `reviewUid` is empty, so they are the same document — but
+                // that is a fact two conditions apart, and a repair pointed at a
+                // review subdocument would write a `latestApprovedVersion` onto it.
+                //
+                // Plugin-only, unlike the revocation write above: the mirror is
+                // recomputed from `pluginVersions`, a collection no other artifact
+                // type has, so running it for an email starter would derive "nothing
+                // approved" from an empty read and write that over the listing.
+                if (isPlugin) {
+                    await repairLatestApprovedVersion(firestore.collection('marketplaceListings').doc(listingId), next);
+                }
+            }
+            await firestore.collection('adminAudit').add(_extends({
+                actorUid: decoded.uid,
+                action: `plugins.takedown.${action}`,
+                target: reviewUid ? `marketplaceListings/${listingId}/reviews/${reviewUid}` : `marketplaceListings/${listingId}`
+            }, reviewUid ? {
+                subjectUid: reviewUid
+            } : {}, {
+                after: _extends({
+                    hidden: action === 'hide'
+                }, hideReason ? {
+                    reason: hideReason
+                } : {}, killsInstalledCopies ? {
+                    revoked: action === 'hide'
+                } : {}, stripVerified ? {
+                    unverified: true
+                } : {}),
+                at: FieldValue.serverTimestamp()
+            }));
+            return Response.json({
+                ok: true,
+                hidden: action === 'hide',
+                revoked: killsInstalledCopies && action === 'hide',
+                // The caller shows this — a badge silently disappearing would be
+                // worse than one that never existed.
+                unverified: stripVerified
+            }, {
+                status: 200
+            });
+        }
+        // Review checklist (AGL-963). Ticks are per {version, sha256} and carry
+        // who + when, so "verified" is a recorded act rather than a click.
+        if (action === 'checklist') {
+            var _ref6, _ref7, _versionSnapshot_get, _versionSnapshot_get1;
+            const version = String((_ref6 = body == null ? void 0 : body.version) != null ? _ref6 : '');
+            const itemId = String((_ref7 = body == null ? void 0 : body.itemId) != null ? _ref7 : '');
+            const checked = (body == null ? void 0 : body.checked) !== false;
+            if (!listingId || !version || !REQUIRED_OR_OPTIONAL.has(itemId)) {
+                return Response.json({
+                    error: 'Unknown checklist item'
+                }, {
+                    status: 400
+                });
+            }
+            const versionRef = firestore.collection('marketplaceListings').doc(listingId).collection('pluginVersions').doc(version);
+            const versionSnapshot = await versionRef.get();
+            if (!versionSnapshot.exists) {
+                return Response.json({
+                    error: 'Unknown version'
+                }, {
+                    status: 404
+                });
+            }
+            await versionRef.set({
+                reviewChecklist: {
+                    [itemId]: checked ? {
+                        by: decoded.uid,
+                        at: FieldValue.serverTimestamp(),
+                        // Pins the tick to the bytes it was made against.
+                        sha256: String((_versionSnapshot_get = versionSnapshot.get('sha256')) != null ? _versionSnapshot_get : '')
+                    } : FieldValue.delete()
+                }
+            }, {
+                merge: true
+            });
+            // Audited (AGL-971): a checklist tick is the record that a human
+            // looked, so it needs the same trail as the verdict it unlocks —
+            // including WHICH bytes were looked at.
+            await firestore.collection('adminAudit').add({
+                actorUid: decoded.uid,
+                action: `plugins.review.checklist.${checked ? 'check' : 'uncheck'}`,
+                target: `marketplaceListings/${listingId}/pluginVersions/${version}`,
+                after: {
+                    itemId,
+                    checked,
+                    sha256: String((_versionSnapshot_get1 = versionSnapshot.get('sha256')) != null ? _versionSnapshot_get1 : '')
+                },
+                at: FieldValue.serverTimestamp()
+            });
+            return Response.json({
+                ok: true,
+                itemId,
+                checked
+            }, {
+                status: 200
+            });
+        }
+        // Per-version verdicts (AGL-966). Approval is a statement about bytes,
+        // so it lives on the version doc and installs resolve the newest
+        // approved one. Listing-level list/verify still exist, but they can no
+        // longer ship code past review on their own.
+        if (action === 'approve-version' || action === 'reject-version') {
+            var _ref8, _versionSnapshot_get2, _ref9, _ref10, _listing_latestVersion, _listing_reviewStatus, _listing_latestApprovedVersion, _versionSnapshot_get3;
+            const version = String((_ref8 = body == null ? void 0 : body.version) != null ? _ref8 : '');
+            const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+            const versionRef = listingRef.collection('pluginVersions').doc(version);
+            const versionSnapshot = await versionRef.get();
+            if (!versionSnapshot.exists) {
+                return Response.json({
+                    error: 'Unknown version'
+                }, {
+                    status: 404
+                });
+            }
+            // The LISTING has to exist too, and the check belongs up here rather
+            // than beside the writes that need it (AGL-1766). A version outliving
+            // its listing is not hypothetical — Firestore deletes are not
+            // recursive, so `pluginVersions` survives whatever removed the parent.
+            //
+            // The read below used to be `(await listingRef.get()).data() ?? {}`,
+            // and that default was not a convenience: it is what made the two
+            // mirrors fire. Both of their conditions are TRUE on `{}` —
+            // `!['listed','verified'].includes('')` and `previous == null` — so an
+            // absent listing was resurrected as `{ reviewStatus: 'listed' }`, i.e.
+            // browsable in the marketplace, from a merge-set. (The third mirror,
+            // `latestVersionReviewState`, compares `String(latestVersion ?? '')`
+            // against a non-empty `version` and is false on `{}` — it could not
+            // fire. The pattern is not uniform even inside one block, which is
+            // exactly why AGL-1763 could not express this as a lint rule.)
+            //
+            // Read BEFORE the verdict write, not after it. Refusing must not
+            // discard work that already happened (AGL-1760); refusing here happens
+            // before anything has, so the reviewer simply retries against a
+            // listing that exists. `?? {}` is gone with it — kept, it would have
+            // traded a resurrection for an `update()` rejection served as a 500.
+            const listingSnapshot = await listingRef.get();
+            if (!listingSnapshot.exists) {
+                return Response.json({
+                    error: 'Unknown listing'
+                }, {
+                    status: 404
+                });
+            }
+            const listing = listingSnapshot.data();
+            const sha256 = String((_versionSnapshot_get2 = versionSnapshot.get('sha256')) != null ? _versionSnapshot_get2 : '');
+            const approving = action === 'approve-version';
+            if (approving) {
+                const outstanding = outstandingChecklistItems(versionSnapshot.get('reviewChecklist'), sha256);
+                if (outstanding.length) {
+                    return Response.json({
+                        error: `Review checklist incomplete — ${outstanding.length} required item(s) outstanding for these bytes`,
+                        outstanding
+                    }, {
+                        status: 409
+                    });
+                }
+            }
+            const reason = String((_ref9 = body == null ? void 0 : body.reason) != null ? _ref9 : '').slice(0, 500);
+            // Structured rejection (AGL-977). The category is what makes rejections
+            // comparable across reviewers and queryable afterwards; the comment is
+            // what makes one actionable. Requiring only free text gave neither.
+            const category = String((_ref10 = body == null ? void 0 : body.category) != null ? _ref10 : '');
+            if (!approving) {
+                const invalid = rejectionInputError(category, reason);
+                if (invalid) return Response.json({
+                    error: invalid
+                }, {
+                    status: 400
+                });
+            }
+            await versionRef.set(_extends({
+                reviewState: approving ? 'approved' : 'rejected',
+                reviewedBy: decoded.uid,
+                reviewedAt: FieldValue.serverTimestamp(),
+                // Records WHICH bytes were approved, so a later republish under
+                // the same version string can never inherit this verdict.
+                reviewedSha256: sha256,
+                grandfathered: FieldValue.delete()
+            }, approving ? {
+                // Clear a previous rejection's fields on approval, or a
+                // version that was rejected and then approved keeps
+                // explaining why it was turned down.
+                reviewRejectionReason: FieldValue.delete(),
+                reviewRejectionCategory: FieldValue.delete()
+            } : {
+                reviewRejectionReason: reason,
+                reviewRejectionCategory: category,
+                // REALM TRUST IS WITHDRAWN WITH THE APPROVAL (AGL-2306).
+                //
+                // `sign-plugin` refuses to grant `trust: 'realm'` unless the
+                // version is approved — approval gates the grant. Nothing
+                // ungated it: the realm load path checks `hiddenAt`, the sha,
+                // the signature and the revocation, and never re-reads
+                // `reviewState`. So approve → sign → re-review → reject left
+                // the version loading IN THE APP REALM, where neither the
+                // sandbox iframe nor the plugin-origin CSP is between it and
+                // user data, until staff separately reached for the kill
+                // switch.
+                //
+                // The same four fields `sign-plugin`'s own revoke branch
+                // clears, so there is one shape of "untrusted" rather than
+                // two. This does NOT stop the bundle running as a sandboxed
+                // plugin — that is what the per-version revocation beside
+                // this decision is for, and it is deliberately a separate
+                // choice (a thin README is the usual rejection, and an
+                // unannounced site outage is worse). It withdraws only the
+                // privilege that approval was the precondition for.
+                trust: FieldValue.delete(),
+                signature: FieldValue.delete(),
+                trustGrantedBy: FieldValue.delete(),
+                trustGrantedAt: FieldValue.delete()
+            }), {
+                merge: true
+            });
+            // A plugin with its first approved version becomes browsable. Later
+            // approvals never change listing status — that is the point: an
+            // update is reviewed without disturbing what customers already have.
+            //
+            // The three mirrors below write through `updateExisting` as the second
+            // line for the window the check above cannot close — a listing deleted
+            // mid-handler. Every payload here is FLAT with no delete sentinel, so
+            // the switch is semantically identical to the merge-set it replaces;
+            // the `false` return needs no branch, because a listing that is gone by
+            // now wants nothing mirrored onto it.
+            // Mirror this verdict onto the listing for the marketplace (AGL-1121),
+            // but ONLY when it is the newest version. Approving an old version
+            // must not let the listing claim its newest bytes were reviewed —
+            // which is the exact shape of the bug this mirror exists to fix.
+            if (String((_listing_latestVersion = listing.latestVersion) != null ? _listing_latestVersion : '') === version) {
+                await updateExisting(listingRef, {
+                    latestVersionReviewState: approving ? 'approved' : 'rejected'
+                });
+            }
+            if (approving && ![
+                'listed',
+                'verified'
+            ].includes(String((_listing_reviewStatus = listing.reviewStatus) != null ? _listing_reviewStatus : ''))) {
+                await updateExisting(listingRef, {
+                    reviewStatus: 'listed',
+                    updatedAt: FieldValue.serverTimestamp()
+                });
+            }
+            // Denormalise the newest approved version onto the listing (AGL-1016).
+            // `pluginVersions` is server-only, so a console showing "update
+            // available" has nothing else to read — and reading `latestVersion`
+            // instead would advertise a version the install route refuses, leaking
+            // AGL-966's guarantee back out through a badge.
+            //
+            // Only ever moves forward: approving an older version after a newer one
+            // is a real sequence (a reviewer working through a backlog) and must not
+            // walk the offer backwards.
+            if (approving) {
+                var _compareArtifactVersions;
+                const previous = listing.latestApprovedVersion;
+                if (previous == null || ((_compareArtifactVersions = compareArtifactVersions(String(previous), version)) != null ? _compareArtifactVersions : 0) < 0) {
+                    await updateExisting(listingRef, {
+                        latestApprovedVersion: version,
+                        updatedAt: FieldValue.serverTimestamp()
+                    });
+                }
+            } else if (String((_listing_latestApprovedVersion = listing.latestApprovedVersion) != null ? _listing_latestApprovedVersion : '') === version) {
+                // …and BACK when the version being offered is the one just rejected
+                // (AGL-2306). Nothing did this, so a re-review that turned a live
+                // version down left the listing advertising it — an "Update to vX"
+                // for bytes `install-plugin` answers 409 to.
+                const revocation = (await firestore.collection('revocations').doc(listingId).get()).data();
+                await repairLatestApprovedVersion(listingRef, revocation);
+            }
+            await firestore.collection('adminAudit').add({
+                actorUid: decoded.uid,
+                action: `plugins.review.version.${approving ? 'approve' : 'reject'}`,
+                target: `marketplaceListings/${listingId}/pluginVersions/${version}`,
+                after: _extends({
+                    sha256
+                }, reason ? {
+                    reason
+                } : {}, category ? {
+                    category
+                } : {}),
+                at: FieldValue.serverTimestamp()
+            });
+            // Pins sitting on these exact bytes right now (AGL-1085). Rejecting a
+            // version does NOT stop it — the runtime resolves a pin by
+            // {version, sha256} and only asks whether it is revoked — so both
+            // sides have to be told, and the reviewer needs the number before
+            // deciding whether to reach for the kill switch.
+            const liveInstalls = Number((_versionSnapshot_get3 = versionSnapshot.get('activeInstalls')) != null ? _versionSnapshot_get3 : 0);
+            const stranded = !approving && liveInstalls > 0;
+            if (listing.profileId) {
+                await notifyOrgAdmins(String(listing.profileId), {
+                    type: 'marketplace.review',
+                    title: approving ? `"${listing.displayName}" v${version} approved` : `"${listing.displayName}" v${version} was not approved`,
+                    body: approving ? 'It is now the version new installs receive.' : stranded ? `${reason}\n\nThis version is still installed on ` + `${liveInstalls} site${liveInstalls === 1 ? '' : 's'}. ` + 'Rejecting it does not remove it — uninstall or roll back.' : reason,
+                    orgId: String(listing.profileId),
+                    link: '/'
+                }).catch(()=>undefined);
+                await emailPublisher(String(listing.profileId), approving ? `${listing.displayName} v${version} passed review` : `${listing.displayName} v${version} was not approved`, approving ? `Your plugin version ${version} has been approved and is now ` + 'the version new installs receive. Existing installs stay on ' + 'the version they pinned until their site owners upgrade.' : `Your plugin version ${version} was not approved.\n\n` + `Reason: ${reason}\n\nPublishing a new version puts it back ` + 'in the review queue. The previously approved version, if any, ' + 'keeps installing in the meantime.' + (stranded ? `\n\nNote: v${version} is still installed on ` + `${liveInstalls} site${liveInstalls === 1 ? '' : 's'}. ` + 'A rejection stops new installs, it does not remove an ' + 'existing one — uninstall it or roll back to an approved ' + 'version.' : ''));
+            }
+            return Response.json({
+                ok: true,
+                version,
+                reviewState: approving ? 'approved' : 'rejected',
+                // Lets the reviewer's confirmation say what it actually did, and
+                // offer the kill switch when the bytes are live somewhere.
+                liveInstalls,
+                stranded
+            }, {
+                status: 200
+            });
+        }
+        // Per-version kill switch (AGL-1085). Until now a reviewer's only way to
+        // stop live bytes was a listing-wide takedown, which also revokes the
+        // approved version customers are happily running and hides the listing.
+        // Rejection deliberately stays a verdict rather than a kill: most
+        // rejections are a thin README, and an unannounced site outage is worse
+        // than the gap. This is the deliberate, adjacent action.
+        //
+        // This does NOT strip the Verified badge, unlike a takedown (AGL-1121).
+        // The two claims are scoped differently and the split is the whole point:
+        // Verified says a human vouched for the PUBLISHER and survives version
+        // bumps, while the separate "Reviewed" chip speaks for THESE bytes and is
+        // re-earned per version. Stripping the publisher claim for one bad release
+        // would punish an honest mistake, and is not reversible without a full
+        // re-review. A takedown is the action that contradicts the publisher claim,
+        // and that one does strip it.
+        //
+        // That reasoning only holds because the BYTES claim is withdrawn instead —
+        // which it now is, below. It was not before, and the gap is what made
+        // keeping the badge unsafe rather than merely debatable.
+        if (action === 'revoke-version' || action === 'unrevoke-version') {
+            var _ref11, _data, _listing_latestVersion1, _ref12;
+            const version = String((_ref11 = body == null ? void 0 : body.version) != null ? _ref11 : '');
+            if (!listingId || !version) {
+                return Response.json({
+                    error: 'Listing and version required'
+                }, {
+                    status: 400
+                });
+            }
+            const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+            const listing = (_data = (await listingRef.get()).data()) != null ? _data : {};
+            const revocationRef = firestore.collection('revocations').doc(listingId);
+            const current = (await revocationRef.get()).data();
+            const revoking = action === 'revoke-version';
+            const next = nextRevocationState(current, {
+                type: revoking ? 'revoke-version' : 'unrevoke-version',
+                version
+            });
+            if (next) {
+                var _ref13, _ref14;
+                await revocationRef.set(_extends({}, next, {
+                    reason: String((_ref13 = (_ref14 = body == null ? void 0 : body.reason) != null ? _ref14 : current == null ? void 0 : current.reason) != null ? _ref13 : '').slice(0, 500),
+                    revokedBy: decoded.uid,
+                    revokedAt: FieldValue.serverTimestamp()
+                }), {
+                    merge: true
+                });
+            } else {
+                await revocationRef.delete();
+            }
+            // Same reach as the takedown path above (AGL-1152): a per-version
+            // revocation changes what every cached page renders, and nothing else
+            // drops that HTML.
+            await dropCachesForListing(firestore, listingId);
+            // Withdraw the "Reviewed" chip when the bytes we just killed are the ones
+            // customers are being offered (AGL-1121).
+            //
+            // This was ASSUMED to happen already and did not. `latestVersionReviewState`
+            // is written only by approve/reject and on publish, so a version approved
+            // and later revoked kept `'approved'` — and since a per-version revocation
+            // deliberately does NOT hide the listing (that is the whole difference from
+            // a takedown), the marketplace went on showing "A human at Aglyn read these
+            // exact bytes" about bytes we had just stopped from executing. Revocation
+            // is not surfaced anywhere else in the browse or listing UI either, so
+            // nothing contradicted it.
+            //
+            // `revoked` rather than `rejected`: it was not turned down in review, it
+            // was killed afterwards, and the audit trail should not blur those. Both
+            // consumers test against `'approved'`, so this correctly drops the chip and
+            // raises the caution alert.
+            //
+            // Only when it is the LATEST version, because that is what both consumers
+            // describe. Revoking an old version says nothing about what is on offer.
+            const isLatest = revocationWithdrawsReviewedClaim({
+                revokedVersion: version,
+                latestVersion: String((_listing_latestVersion1 = listing['latestVersion']) != null ? _listing_latestVersion1 : '')
+            });
+            if (isLatest) {
+                var _versionSnapshot_get4;
+                const versionSnapshot = await listingRef.collection('pluginVersions').doc(version).get();
+                await listingRef.set({
+                    latestVersionReviewState: revoking ? REVOKED_VERSION_REVIEW_STATE : // says, rather than assuming `approved` — un-revoking a version
+                    // that was never approved must not promote it.
+                    String((_versionSnapshot_get4 = versionSnapshot.get('reviewState')) != null ? _versionSnapshot_get4 : 'pending')
+                }, {
+                    merge: true
+                });
+            }
+            // The offer follows the kill switch (AGL-2306). A revoked version is
+            // refused by `install-plugin`, so leaving it as `latestApprovedVersion`
+            // advertises an update that cannot be taken; un-revoking restores it.
+            // Both directions, because both change what is installable.
+            await repairLatestApprovedVersion(listingRef, next);
+            await firestore.collection('adminAudit').add({
+                actorUid: decoded.uid,
+                action: `plugins.revocation.${revoking ? 'revoke' : 'restore'}`,
+                target: `marketplaceListings/${listingId}/pluginVersions/${version}`,
+                after: _extends({
+                    versions: (_ref12 = next == null ? void 0 : next.versions) != null ? _ref12 : null
+                }, isLatest ? {
+                    latestVersionReviewStateChanged: true
+                } : {}),
+                at: FieldValue.serverTimestamp()
+            });
+            if (listing.profileId) {
+                await notifyOrgAdmins(String(listing.profileId), {
+                    type: 'marketplace.review',
+                    title: revoking ? `"${listing.displayName}" v${version} was stopped` : `"${listing.displayName}" v${version} was allowed to run again`,
+                    body: revoking ? 'It has been disabled on every site running it. Sites showing ' + 'this plugin now render a placeholder.' : 'Sites running it are no longer blocked.',
+                    orgId: String(listing.profileId),
+                    link: '/'
+                }).catch(()=>undefined);
+            }
+            return Response.json({
+                ok: true,
+                version,
+                revoked: revoking
+            }, {
+                status: 200
+            });
+        }
+        // Declining a verification request (AGL-1217). Handled before the ACTIONS
+        // lookup because it deliberately has NO `reviewStatus` to move to: the
+        // listing stays exactly as live as it was. Refusing a badge is not a
+        // verdict on the code, and routing it through the status ladder would
+        // make it one.
+        if (action === 'decline-verification') {
+            var _ref15, _listing_profileId;
+            var _listing_verificationRequest1;
+            const declineReason = String((_ref15 = body == null ? void 0 : body.reason) != null ? _ref15 : '').trim().slice(0, 500);
+            if (!listingId) {
+                return Response.json({
+                    error: 'Unknown action'
+                }, {
+                    status: 400
+                });
+            }
+            // Required, unlike most fields here. The publisher is notified of this
+            // and then has to wait out a cooldown before asking again; "no, and we
+            // will not say why, try in a month" is not a usable answer.
+            if (!declineReason) {
+                return Response.json({
+                    error: 'A reason is required — the publisher is told it'
+                }, {
+                    status: 400
+                });
+            }
+            const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+            const listing = (await listingRef.get()).data();
+            if (!listing) {
+                return Response.json({
+                    error: 'Unknown listing'
+                }, {
+                    status: 404
+                });
+            }
+            if (((_listing_verificationRequest1 = listing.verificationRequest) == null ? void 0 : _listing_verificationRequest1.state) !== 'pending') {
+                return Response.json({
+                    error: 'No verification request is waiting'
+                }, {
+                    status: 409
+                });
+            }
+            await listingRef.set({
+                verificationRequest: _extends({}, listing.verificationRequest, {
+                    state: 'declined',
+                    decidedAt: FieldValue.serverTimestamp(),
+                    decidedBy: decoded.uid,
+                    declineReason
+                })
+            }, {
+                merge: true
+            });
+            /*
+       * THE AUDIT ROW THIS BRANCH NEVER WROTE (AGL-2328).
+       *
+       * Every sibling branch in this file audits, and the file header at the
+       * top claims the route is audited. This one mutated
+       * `verificationRequest.state`, notified the publisher and started a
+       * cooldown, and left no record — so a decline was the one staff
+       * decision here that could not be reviewed afterwards, on the action
+       * whose reason staff are REQUIRED to type.
+       *
+       * `reason` uses the audit log's own reason column rather than being
+       * buried in `after`, because the audit page renders and exports that
+       * column and searches it (AGL-1652) — a why nobody can filter on is a
+       * why nobody reads.
+       */ await firestore.collection('adminAudit').add({
+                actorUid: decoded.uid,
+                actorEmail: decoded.email ? String(decoded.email) : null,
+                action: 'plugins.verification.decline',
+                scope: 'marketplace',
+                target: `marketplaceListings/${listingId}`,
+                before: {
+                    verificationState: 'pending'
+                },
+                after: {
+                    verificationState: 'declined',
+                    cooldownDays: VERIFICATION_DECLINE_COOLDOWN_DAYS
+                },
+                reason: declineReason,
+                at: FieldValue.serverTimestamp()
+            });
+            const publisherOrgId = String((_listing_profileId = listing.profileId) != null ? _listing_profileId : '');
+            if (publisherOrgId) {
+                await notifyOrgAdmins(publisherOrgId, {
+                    type: 'marketplace.review',
+                    title: `Verification declined for "${listing.displayName}"`,
+                    // Says plainly that nothing about the listing changed. Without it a
+                    // publisher reads "declined" as a takedown of the plugin itself.
+                    body: `${declineReason}\n\nYour plugin is unaffected and stays listed. ` + `You can request verification again in ` + `${VERIFICATION_DECLINE_COOLDOWN_DAYS} days.`,
+                    orgId: publisherOrgId,
+                    link: '/'
+                }).catch(()=>undefined);
+            }
+            return Response.json({
+                ok: true,
+                state: 'declined'
+            }, {
+                status: 200
+            });
+        }
+        const nextStatus = ACTIONS[action];
+        if (!listingId || !nextStatus) {
+            return Response.json({
+                error: 'Unknown action'
+            }, {
+                status: 400
+            });
+        }
+        const reason = String((_ref2 = body == null ? void 0 : body.reason) != null ? _ref2 : '').slice(0, 500);
+        const category = String((_ref3 = body == null ? void 0 : body.category) != null ? _ref3 : '');
+        if (action === 'reject') {
+            const invalid = rejectionInputError(category, reason);
+            if (invalid) return Response.json({
+                error: invalid
+            }, {
+                status: 400
+            });
+        }
+        const listingRef = firestore.collection('marketplaceListings').doc(listingId);
+        const listing = (await listingRef.get()).data();
+        if (!listing) return Response.json({
+            error: 'Unknown listing'
+        }, {
+            status: 404
+        });
+        // Both gates that expose a plugin to customers require a completed
+        // checklist (AGL-963).
+        //
+        // `list` matters MORE than `verify`, which is easy to get backwards:
+        // listing is what makes `isListingBrowsable` true, so it is the moment
+        // executable third-party code becomes installable by every workspace.
+        // `verify` only adds the badge on top. Gating the badge while leaving
+        // listing open would put the ceremony on the weaker action.
+        //
+        // `start-review` and `reject` stay ungated on purpose: a reviewer must
+        // be able to throw something out without first ticking eight boxes
+        // about a bundle they have already decided against.
+        if (action === 'verify' || action === 'list') {
+            var _listing_latestVersion2, _versionSnapshot_get5;
+            const version = String((_listing_latestVersion2 = listing.latestVersion) != null ? _listing_latestVersion2 : '');
+            const versionSnapshot = await listingRef.collection('pluginVersions').doc(version).get();
+            const outstanding = outstandingChecklistItems(versionSnapshot.get('reviewChecklist'), String((_versionSnapshot_get5 = versionSnapshot.get('sha256')) != null ? _versionSnapshot_get5 : ''));
+            if (outstanding.length) {
+                return Response.json({
+                    error: `Review checklist incomplete — ${outstanding.length} required item(s) outstanding`,
+                    outstanding
+                }, {
+                    status: 409
+                });
+            }
+        }
+        await listingRef.set(_extends({
+            reviewStatus: nextStatus,
+            reviewedBy: decoded.uid,
+            reviewedAt: FieldValue.serverTimestamp()
+        }, action === 'verify' && ((_listing_verificationRequest = listing.verificationRequest) == null ? void 0 : _listing_verificationRequest.state) === 'pending' ? {
+            verificationRequest: _extends({}, listing.verificationRequest, {
+                state: 'granted',
+                decidedAt: FieldValue.serverTimestamp(),
+                decidedBy: decoded.uid
+            })
+        } : {}, action === 'reject' ? {
+            rejectionReason: reason,
+            rejectionCategory: category
+        } : {
+            rejectionReason: FieldValue.delete(),
+            rejectionCategory: FieldValue.delete()
+        }), {
+            merge: true
+        });
+        // Tell the publisher their listing moved (rejections especially).
+        if (listing.profileId && [
+            'reject',
+            'list',
+            'verify',
+            'delist'
+        ].includes(action)) {
+            var _listing_profileId1;
+            // Publishers are ORGS now (AGL-652), so `profileId` is an org id —
+            // writing to users/{profileId}/notifications silently dropped every
+            // verdict into a user document nobody reads. Notify the org's managers.
+            const publisherOrgId = String((_listing_profileId1 = listing.profileId) != null ? _listing_profileId1 : '');
+            const publisherSlug = publisherOrgId ? (await firestore.collection('orgs').doc(publisherOrgId).get()).get('slug') : undefined;
+            if (publisherOrgId) {
+                var _pluginRejectionCategory, _pluginRejectionCategory1;
+                await notifyOrgAdmins(publisherOrgId, {
+                    type: 'marketplace.review',
+                    title: action === 'reject' ? `"${listing.displayName}" was rejected` : action === 'delist' ? `"${listing.displayName}" is back in review` : `"${listing.displayName}" is now ${nextStatus}`,
+                    body: action === 'reject' ? // words (AGL-977). The publisher's first question is "what do
+                    // I fix" — a bare comment answered that only as well as the
+                    // reviewer happened to write it.
+                    [
+                        (_pluginRejectionCategory = pluginRejectionCategory(category)) == null ? void 0 : _pluginRejectionCategory.label,
+                        (_pluginRejectionCategory1 = pluginRejectionCategory(category)) == null ? void 0 : _pluginRejectionCategory1.guidance,
+                        reason
+                    ].filter(Boolean).join('\n\n') : action === 'delist' ? reason || 'It has been removed from the marketplace while we take ' + 'another look. Existing installs keep working.' : 'Your plugin passed review.',
+                    orgId: publisherOrgId,
+                    link: publisherSlug ? buildRoute(Route.ORG_MARKETPLACE, {
+                        orgSlug: publisherSlug
+                    }) : '/'
+                }).catch(()=>undefined);
+                await emailPublisher(publisherOrgId, action === 'reject' ? `${listing.displayName} was rejected — ${rejectionHeadline(category, reason)}` : action === 'delist' ? `${listing.displayName} was removed from the marketplace` : `${listing.displayName} is now ${nextStatus}`, action === 'reject' || action === 'delist' ? reason || 'It has been removed from the marketplace while we take ' + 'another look. Existing installs keep working.' : 'Your plugin passed review and is live in the marketplace.');
+            }
+        }
+        await firestore.collection('adminAudit').add({
+            actorUid: decoded.uid,
+            action: `plugins.review.${action}`,
+            target: `marketplaceListings/${listingId}`,
+            after: _extends({
+                reviewStatus: nextStatus
+            }, reason ? {
+                reason
+            } : {}),
+            at: FieldValue.serverTimestamp()
+        });
+        return Response.json({
+            ok: true,
+            reviewStatus: nextStatus
+        }, {
+            status: 200
+        });
+    } catch (error) {
+        // An unverifiable credential is a 401, not a fault of ours
+        // (AGL-1993). Null for anything else, so a real failure keeps its 500.
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error(error);
+        return Response.json({
+            error: 'Review action failed'
+        }, {
+            status: 500
+        });
+    }
+}
+export { handler as marketplaceAdminReviews };
+
+//# sourceMappingURL=admin-reviews.js.map