@aglyn/plugins-marketplace 1.0.0-beta.149 → 1.0.0-beta.151

package/src/lib/components/listing-detail-editor.component.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/components/listing-detail-editor.component.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport { CardDisplay } from '@aglyn/shared-ui-jsx'\nimport { useSnackbar } from '@aglyn/shared-ui-snackstack'\n// The stored preview may be a `media:` reference (AGL-1424), which is not a\n// URL. Resolved where it is DISPLAYED, never in `values`.\nimport { resolveMediaSrc } from '@aglyn/aglyn/app-utils/media-ref'\nimport { inheritedMediaAlt } from '@aglyn/aglyn/app-utils/media-metadata'\nimport { authorizedFetch } from '@aglyn/shared-util-http/authorized-token'\nimport {\n  Box,\n  Button,\n  Divider,\n  MenuItem,\n  Stack,\n  TextField,\n  Typography,\n} from '@mui/material'\nimport { useEffect, useRef, useState } from 'react'\nimport { LISTING_LOGO_HINT } from '../constants/listing-media'\nimport { formatMediaRef, pluginDocsHelp, useMediaPicker } from '@aglyn/aglyn'\nimport {\n  MarkdownField,\n  type MarkdownFieldHandle,\n} from '@aglyn/aglyn-markdown-editor'\n\n// Mirrors the server's fixed taxonomy (marketplace plugin model), which the\n// console can't import across the aglyn:addons boundary. The server\n// re-validates, so drift fails the save rather than corrupting a listing.\nconst LISTING_CATEGORIES = [\n  'analytics',\n  'automation',\n  'commerce',\n  'communication',\n  'content',\n  'design',\n  'forms',\n  'integrations',\n  'marketing',\n  'productivity',\n  'seo',\n  'security',\n] as const\nconst MAX_SCREENSHOTS = 6\n\n/** Which image field / target the DAM picker is currently filling. */\ntype PickTarget = 'preview' | 'logo' | 'screenshot' | 'body' | null\n\nexport interface ListingDetailEditorProps {\n  orgId: string\n  listingId: string\n  listing: Record<string, any>\n  /** Firebase user, for the ID token on the update requests. */\n  user: unknown\n  /** Leave edit mode (Cancel or after a successful save). */\n  onDone: () => void\n}\n\n/**\n * Full-page listing editor (AGL-869): the owner edits the whole detail page,\n * not a cramped sidebar card. The body uses the same WYSIWYG markdown editor\n * as blog content (`MarkdownVisualEditor`), and every image — preview, logo,\n * screenshots, and inline body images — picks from the shared DAM.\n *\n * Content saves through the marketplace plugin's HTTP API (`update-listing`);\n * the preview image goes through its dedicated endpoint since it isn't a\n * content field. Both are merges, so an unchanged field is left untouched.\n */\nexport function ListingDetailEditor(props: ListingDetailEditorProps) {\n  const { orgId, listingId, listing, user, onDone } = props\n  const { enqueueSnackbar } = useSnackbar()\n  const editorRef = useRef<MarkdownFieldHandle | null>(null)\n  const [busy, setBusy] = useState(false)\n\n  const [values, setValues] = useState({\n    displayName: '',\n    description: '',\n    previewImageUrl: '',\n    logoUrl: '',\n    homepageUrl: '',\n    repositoryUrl: '',\n    license: '',\n    category: '',\n  })\n  const [readme, setReadme] = useState('')\n  const [screenshots, setScreenshots] = useState<string[]>([])\n  const originalPreview = useRef<string>('')\n\n  useEffect(() => {\n    setValues({\n      displayName: listing?.displayName ?? '',\n      description: listing?.description ?? '',\n      previewImageUrl: listing?.previewImageUrl ?? '',\n      logoUrl: listing?.logoUrl ?? '',\n      homepageUrl: listing?.homepageUrl ?? '',\n      repositoryUrl: listing?.repositoryUrl ?? '',\n      license: listing?.license ?? '',\n      category: listing?.categories?.[0] ?? listing?.category ?? '',\n    })\n    setReadme(listing?.readme ?? '')\n    setScreenshots(\n      Array.isArray(listing?.screenshots) ? listing.screenshots : [],\n    )\n    originalPreview.current = listing?.previewImageUrl ?? ''\n  }, [listing?.$id])\n\n  const set = (key: keyof typeof values) => (event: any) =>\n    setValues((current) => ({ ...current, [key]: event.target.value }))\n\n  /*\n   * The console's media library, opened through the picker context rather\n   * than by mounting its dialog (AGL-3080). The library is coupled to the\n   * org and the session, which a plugin has no way to reach, and the console\n   * provides `pickMedia` around every plugin page for exactly this — so the\n   * `pickTarget` state that only existed to keep one dialog open for four\n   * buttons goes with it: the target is now the argument.\n   *\n   * The URL comes back already resolved (CDN path over the raw download URL,\n   * AGL-1215), which is what `mediaSrc` was doing here.\n   */\n  const { pickMedia } = useMediaPicker()\n  const onPickMedia = async (target: Exclude<PickTarget, null>) => {\n    const media = await pickMedia?.({ kind: 'image' })\n    if (!media) return\n    const url = media.url\n    if (!url) return\n    if (target === 'preview') setValues((c) => ({ ...c, previewImageUrl: url }))\n    else if (target === 'logo') setValues((c) => ({ ...c, logoUrl: url }))\n    else if (target === 'body') {\n      // The README BODY takes a reference; the three image FIELDS above keep\n      // `mediaSrc` (AGL-1705). Not an inconsistency — a field is one string\n      // with known readers and its own AGL-1701 validator, while the body is\n      // markdown that AGL-1686 taught every renderer to resolve.\n      //\n      // The absolute form was justified by `mediaSrc`'s own docstring — it\n      // prefixes the origin because the markdown \"renders elsewhere\". That\n      // was checked rather than assumed, and it is not true. The renderer\n      // `MarketplaceListingContent` is registered through\n      // `registerConsoleExtension`; its `marketplaceListing` slot has exactly\n      // one render site, the console's `/[orgSlug]/marketplace/[listingId]`\n      // route; and `apps/tenant` never imports the marketplace plugin at all.\n      // The body reaches no other origin by another door either — the social\n      // card builds `og:image` from `previewImageUrl`/`logoUrl`, never from\n      // the README.\n      //\n      // So a site-relative resolve lands on the console origin, which serves\n      // `/api/media/cdn/[...path]` — the very route the absolute URL pointed\n      // at. Same bytes over the same route, minus a baked-in origin and a\n      // baked-in route shape that cannot be changed without a migration.\n      const src = formatMediaRef(media.mediaScope, media.mediaId) ?? url\n      // The alt was a hardcoded '' (AGL-1896). This surface offers no alt\n      // prompt at all, so the asset's own alt was the only description that\n      // could ever have reached the row — and a markdown-lite image row's\n      // alt cannot be edited after insertion, so '' was permanent. Still ''\n      // for an asset nobody has described; never a fabricated one.\n      editorRef.current?.insertImage(\n        inheritedMediaAlt({ assetAlt: media.alt }) ?? '',\n        src,\n      )\n    } else if (target === 'screenshot')\n      setScreenshots((current) =>\n        current.length >= MAX_SCREENSHOTS || current.includes(url)\n          ? current\n          : [...current, url],\n      )\n  }\n\n  const save = async () => {\n    setBusy(true)\n    try {\n      const headers = { 'Content-Type': 'application/json' }\n      // Preview image isn't a content field, so it has its own endpoint\n      // (AGL-863). Only touch it when it actually changed.\n      if (values.previewImageUrl !== originalPreview.current) {\n        await authorizedFetch(user, '/api/marketplace/preview-image', {\n          method: values.previewImageUrl ? 'POST' : 'DELETE',\n          headers,\n          body: JSON.stringify({\n            listingId,\n            ...(values.previewImageUrl ? { url: values.previewImageUrl } : {}),\n          }),\n        })\n      }\n      const response = await authorizedFetch(\n        user,\n        '/api/marketplace/publish-plugin',\n        {\n          method: 'POST',\n          headers,\n          body: JSON.stringify({\n            action: 'update-listing',\n            listingId,\n            displayName: values.displayName,\n            description: values.description,\n            readme,\n            logoUrl: values.logoUrl,\n            homepageUrl: values.homepageUrl,\n            repositoryUrl: values.repositoryUrl,\n            license: values.license,\n            categories: values.category ? [values.category] : [],\n            screenshots,\n          }),\n        },\n      )\n      const payload = await response.json().catch(() => ({}))\n      if (!response.ok) {\n        return void enqueueSnackbar(payload?.error ?? 'Update failed', {\n          variant: 'error',\n          allowDuplicate: true,\n        })\n      }\n      enqueueSnackbar('Listing updated', { variant: 'success', persist: false })\n      onDone()\n    } catch (error) {\n      console.error(error)\n      enqueueSnackbar('An error has occurred', {\n        variant: 'error',\n        allowDuplicate: true,\n      })\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  return (\n    <CardDisplay\n      header={'Edit listing'}\n      help={pluginDocsHelp('publisherHandbook', {\n        anchor: '#authoring-your-listing',\n        excerpt:\n          'What buyers see on the public listing page — name, summary, ' +\n          'rich-text body, and media.',\n      })}\n      contentGutterX\n      contentGutterY\n    >\n      <Stack spacing={2}>\n        <Typography variant=\"body2\" color=\"text.secondary\">\n          {'Everything here shows on the public listing page. The body is ' +\n            'rich text — use the toolbar, and add images from your media ' +\n            'library.'}\n        </Typography>\n\n        <TextField\n          label=\"Listing name\"\n          value={values.displayName}\n          onChange={set('displayName')}\n          size=\"small\"\n          fullWidth\n        />\n        <TextField\n          label=\"Description\"\n          helperText=\"One line, shown on every browse card\"\n          value={values.description}\n          onChange={set('description')}\n          size=\"small\"\n          multiline\n          minRows={2}\n          fullWidth\n        />\n\n        {/* Preview image — the hero shown on cards and at the top of detail. */}\n        <Stack spacing={1}>\n          <Typography variant=\"subtitle2\">{'Preview image'}</Typography>\n          {/* Resolved for DISPLAY only (AGL-1424). `values.previewImageUrl`\n              stays the stored form — it is what the save POSTs, and writing\n              the resolved URL back would undo the reference. */}\n          {resolveMediaSrc(values.previewImageUrl) ? (\n            <Box\n              component=\"img\"\n              src={resolveMediaSrc(values.previewImageUrl)}\n              alt=\"Preview\"\n              sx={{\n                width: '100%',\n                maxHeight: 220,\n                objectFit: 'cover',\n                borderRadius: 1,\n                border: 1,\n                borderColor: 'divider',\n              }}\n            />\n          ) : null}\n          <Stack direction=\"row\" spacing={1}>\n            <Button size=\"small\" onClick={() => onPickMedia('preview')}>\n              {values.previewImageUrl ? 'Replace' : 'Choose from library'}\n            </Button>\n            {values.previewImageUrl ? (\n              <Button\n                size=\"small\"\n                color=\"error\"\n                onClick={() =>\n                  setValues((c) => ({ ...c, previewImageUrl: '' }))\n                }\n              >\n                {'Remove'}\n              </Button>\n            ) : null}\n          </Stack>\n        </Stack>\n\n        <Divider />\n\n        {/* Body — the WYSIWYG markdown editor, same as blog content, and\n            since AGL-1080 the same component the publish form uses. */}\n        <MarkdownField\n          label=\"About\"\n          value={readme}\n          onChange={setReadme}\n          onPickImageFromMedia={() => onPickMedia('body')}\n          editorRef={(handle) => {\n            editorRef.current = handle\n          }}\n        />\n\n        <Divider />\n\n        {/* Screenshots gallery. */}\n        <Stack spacing={1}>\n          <Typography variant=\"subtitle2\">\n            {`Screenshots (${screenshots.length}/${MAX_SCREENSHOTS})`}\n          </Typography>\n          <Stack direction=\"row\" spacing={1} sx={{ flexWrap: 'wrap' }}>\n            {screenshots.map((url, index) => (\n              <Box key={url} sx={{ position: 'relative' }}>\n                <Box\n                  component=\"img\"\n                  src={url}\n                  alt={`Screenshot ${index + 1}`}\n                  sx={{\n                    height: 72,\n                    borderRadius: 1,\n                    border: 1,\n                    borderColor: 'divider',\n                  }}\n                />\n                <Button\n                  size=\"small\"\n                  color=\"error\"\n                  onClick={() =>\n                    setScreenshots((current) =>\n                      current.filter((entry) => entry !== url),\n                    )\n                  }\n                >\n                  {'Remove'}\n                </Button>\n              </Box>\n            ))}\n          </Stack>\n          {screenshots.length < MAX_SCREENSHOTS ? (\n            <Box>\n              <Button size=\"small\" onClick={() => onPickMedia('screenshot')}>\n                {'Add from library'}\n              </Button>\n            </Box>\n          ) : null}\n        </Stack>\n\n        <Divider />\n\n        {/* Logo + metadata. */}\n        <Stack direction=\"row\" spacing={1} sx={{ alignItems: 'flex-start' }}>\n          <TextField\n            label=\"Logo URL (https)\"\n            value={values.logoUrl}\n            onChange={set('logoUrl')}\n            size=\"small\"\n            sx={{ flex: 1 }}\n            helperText={LISTING_LOGO_HINT}\n          />\n          <Button\n            size=\"small\"\n            onClick={() => onPickMedia('logo')}\n            sx={{ mt: 0.5 }}\n          >\n            {'Library'}\n          </Button>\n        </Stack>\n        <TextField\n          label=\"Homepage (https)\"\n          value={values.homepageUrl}\n          onChange={set('homepageUrl')}\n          size=\"small\"\n          fullWidth\n        />\n        <TextField\n          label=\"Repository (https)\"\n          value={values.repositoryUrl}\n          onChange={set('repositoryUrl')}\n          size=\"small\"\n          fullWidth\n        />\n        <Stack direction=\"row\" spacing={1}>\n          <TextField\n            label=\"License\"\n            value={values.license}\n            onChange={set('license')}\n            size=\"small\"\n            sx={{ flex: 1 }}\n          />\n          <TextField\n            select\n            label=\"Category\"\n            value={values.category}\n            onChange={set('category')}\n            size=\"small\"\n            sx={{ flex: 1 }}\n          >\n            <MenuItem value=\"\">{'None'}</MenuItem>\n            {LISTING_CATEGORIES.map((entry) => (\n              <MenuItem key={entry} value={entry}>\n                {entry}\n              </MenuItem>\n            ))}\n          </TextField>\n        </Stack>\n\n        <Stack direction=\"row\" spacing={1} sx={{ pt: 1 }}>\n          <Button\n            variant=\"contained\"\n            color=\"primary\"\n            disabled={busy || !values.displayName.trim()}\n            onClick={() => void save()}\n          >\n            {busy ? 'Saving…' : 'Save listing'}\n          </Button>\n          <Button disabled={busy} onClick={onDone}>\n            {'Cancel'}\n          </Button>\n        </Stack>\n      </Stack>\n\n    </CardDisplay>\n  )\n}\n\nListingDetailEditor.displayName = 'ListingDetailEditor'\n\nexport default ListingDetailEditor\n"],"names":["CardDisplay","useSnackbar","resolveMediaSrc","inheritedMediaAlt","authorizedFetch","Box","Button","Divider","MenuItem","Stack","TextField","Typography","useEffect","useRef","useState","LISTING_LOGO_HINT","formatMediaRef","pluginDocsHelp","useMediaPicker","MarkdownField","LISTING_CATEGORIES","MAX_SCREENSHOTS","ListingDetailEditor","props","orgId","listingId","listing","user","onDone","enqueueSnackbar","editorRef","busy","setBusy","values","setValues","displayName","description","previewImageUrl","logoUrl","homepageUrl","repositoryUrl","license","category","readme","setReadme","screenshots","setScreenshots","originalPreview","categories","Array","isArray","current","$id","set","key","event","target","value","pickMedia","onPickMedia","media","kind","url","c","src","mediaScope","mediaId","insertImage","assetAlt","alt","length","includes","save","headers","method","body","JSON","stringify","response","action","payload","json","catch","ok","error","variant","allowDuplicate","persist","console","header","help","anchor","excerpt","contentGutterX","contentGutterY","spacing","color","label","onChange","size","fullWidth","helperText","multiline","minRows","component","sx","width","maxHeight","objectFit","borderRadius","border","borderColor","direction","onClick","onPickImageFromMedia","handle","flexWrap","map","index","position","height","filter","entry","alignItems","flex","mt","select","pt","disabled","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;;AAEA,SAASA,WAAW,QAAQ,uBAAsB;AAClD,SAASC,WAAW,QAAQ,8BAA6B;AACzD,4EAA4E;AAC5E,0DAA0D;AAC1D,SAASC,eAAe,QAAQ,mCAAkC;AAClE,SAASC,iBAAiB,QAAQ,wCAAuC;AACzE,SAASC,eAAe,QAAQ,2CAA0C;AAC1E,SACEC,GAAG,EACHC,MAAM,EACNC,OAAO,EACPC,QAAQ,EACRC,KAAK,EACLC,SAAS,EACTC,UAAU,QACL,gBAAe;AACtB,SAASC,SAAS,EAAEC,MAAM,EAAEC,QAAQ,QAAQ,QAAO;AACnD,SAASC,iBAAiB,QAAQ,gCAA4B;AAC9D,SAASC,cAAc,EAAEC,cAAc,EAAEC,cAAc,QAAQ,eAAc;AAC7E,SACEC,aAAa,QAER,+BAA8B;AAErC,4EAA4E;AAC5E,oEAAoE;AACpE,0EAA0E;AAC1E,MAAMC,qBAAqB;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AACD,MAAMC,kBAAkB;AAexB;;;;;;;;;CASC,GACD,OAAO,SAASC,oBAAoBC,KAA+B;IACjE,MAAM,EAAEC,KAAK,EAAEC,SAAS,EAAEC,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAE,GAAGL;IACpD,MAAM,EAAEM,eAAe,EAAE,GAAG5B;IAC5B,MAAM6B,YAAYjB,OAAmC;IACrD,MAAM,CAACkB,MAAMC,QAAQ,GAAGlB,SAAS;IAEjC,MAAM,CAACmB,QAAQC,UAAU,GAAGpB,SAAS;QACnCqB,aAAa;QACbC,aAAa;QACbC,iBAAiB;QACjBC,SAAS;QACTC,aAAa;QACbC,eAAe;QACfC,SAAS;QACTC,UAAU;IACZ;IACA,MAAM,CAACC,QAAQC,UAAU,GAAG9B,SAAS;IACrC,MAAM,CAAC+B,aAAaC,eAAe,GAAGhC,SAAmB,EAAE;IAC3D,MAAMiC,kBAAkBlC,OAAe;IAEvCD,UAAU;4DASIc;YAAAA;QARZQ,UAAU;YACRC,WAAW,UAAET,2BAAAA,QAASS,WAAW,mBAAI;YACrCC,WAAW,WAAEV,2BAAAA,QAASU,WAAW,oBAAI;YACrCC,eAAe,WAAEX,2BAAAA,QAASW,eAAe,oBAAI;YAC7CC,OAAO,WAAEZ,2BAAAA,QAASY,OAAO,oBAAI;YAC7BC,WAAW,WAAEb,2BAAAA,QAASa,WAAW,oBAAI;YACrCC,aAAa,WAAEd,2BAAAA,QAASc,aAAa,oBAAI;YACzCC,OAAO,WAAEf,2BAAAA,QAASe,OAAO,oBAAI;YAC7BC,QAAQ,GAAEhB,iBAAAA,4BAAAA,sBAAAA,QAASsB,UAAU,qBAAnBtB,mBAAqB,CAAC,EAAE,oBAAIA,2BAAAA,QAASgB,QAAQ,YAA7ChB,QAAiD;QAC7D;QACAkB,mBAAUlB,2BAAAA,QAASiB,MAAM,oBAAI;QAC7BG,eACEG,MAAMC,OAAO,CAACxB,2BAAAA,QAASmB,WAAW,IAAInB,QAAQmB,WAAW,GAAG,EAAE;QAEhEE,gBAAgBI,OAAO,aAAGzB,2BAAAA,QAASW,eAAe,qBAAI;IACxD,GAAG;QAACX,2BAAAA,QAAS0B,GAAG;KAAC;IAEjB,MAAMC,MAAM,CAACC,MAA6B,CAACC,QACzCrB,UAAU,CAACiB,UAAa,aAAKA;oBAAS,CAACG,IAAI,EAAEC,MAAMC,MAAM,CAACC,KAAK;;IAEjE;;;;;;;;;;GAUC,GACD,MAAM,EAAEC,SAAS,EAAE,GAAGxC;IACtB,MAAMyC,cAAc,OAAOH;QACzB,MAAMI,QAAQ,OAAMF,6BAAAA,UAAY;YAAEG,MAAM;QAAQ;QAChD,IAAI,CAACD,OAAO;QACZ,MAAME,MAAMF,MAAME,GAAG;QACrB,IAAI,CAACA,KAAK;QACV,IAAIN,WAAW,WAAWtB,UAAU,CAAC6B,IAAO,aAAKA;gBAAG1B,iBAAiByB;;aAChE,IAAIN,WAAW,QAAQtB,UAAU,CAAC6B,IAAO,aAAKA;gBAAGzB,SAASwB;;aAC1D,IAAIN,WAAW,QAAQ;gBAqBdxC,iBAOVb;gBANF,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,6DAA6D;YAC7D2B;YA1BA,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,2DAA2D;YAC3D,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,oDAAoD;YACpD,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,cAAc;YACd,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,MAAMkC,OAAMhD,kBAAAA,eAAe4C,MAAMK,UAAU,EAAEL,MAAMM,OAAO,aAA9ClD,kBAAmD8C;aAM/DhC,qBAAAA,UAAUqB,OAAO,qBAAjBrB,mBAAmBqC,WAAW,EAC5BhE,qBAAAA,kBAAkB;gBAAEiE,UAAUR,MAAMS,GAAG;YAAC,cAAxClE,qBAA8C,IAC9C6D;QAEJ,OAAO,IAAIR,WAAW,cACpBV,eAAe,CAACK,UACdA,QAAQmB,MAAM,IAAIjD,mBAAmB8B,QAAQoB,QAAQ,CAACT,OAClDX,UACA;mBAAIA;gBAASW;aAAI;IAE3B;IAEA,MAAMU,OAAO;QACXxC,QAAQ;QACR,IAAI;YACF,MAAMyC,UAAU;gBAAE,gBAAgB;YAAmB;YACrD,kEAAkE;YAClE,qDAAqD;YACrD,IAAIxC,OAAOI,eAAe,KAAKU,gBAAgBI,OAAO,EAAE;gBACtD,MAAM/C,gBAAgBuB,MAAM,kCAAkC;oBAC5D+C,QAAQzC,OAAOI,eAAe,GAAG,SAAS;oBAC1CoC;oBACAE,MAAMC,KAAKC,SAAS,CAAC;wBACnBpD;uBACIQ,OAAOI,eAAe,GAAG;wBAAEyB,KAAK7B,OAAOI,eAAe;oBAAC,IAAI,CAAC;gBAEpE;YACF;YACA,MAAMyC,WAAW,MAAM1E,gBACrBuB,MACA,mCACA;gBACE+C,QAAQ;gBACRD;gBACAE,MAAMC,KAAKC,SAAS,CAAC;oBACnBE,QAAQ;oBACRtD;oBACAU,aAAaF,OAAOE,WAAW;oBAC/BC,aAAaH,OAAOG,WAAW;oBAC/BO;oBACAL,SAASL,OAAOK,OAAO;oBACvBC,aAAaN,OAAOM,WAAW;oBAC/BC,eAAeP,OAAOO,aAAa;oBACnCC,SAASR,OAAOQ,OAAO;oBACvBO,YAAYf,OAAOS,QAAQ,GAAG;wBAACT,OAAOS,QAAQ;qBAAC,GAAG,EAAE;oBACpDG;gBACF;YACF;YAEF,MAAMmC,UAAU,MAAMF,SAASG,IAAI,GAAGC,KAAK,CAAC,IAAO,CAAA,CAAC,CAAA;YACpD,IAAI,CAACJ,SAASK,EAAE,EAAE;;gBAChB,OAAO,KAAKtD,wBAAgBmD,2BAAAA,QAASI,KAAK,mBAAI,iBAAiB;oBAC7DC,SAAS;oBACTC,gBAAgB;gBAClB;YACF;YACAzD,gBAAgB,mBAAmB;gBAAEwD,SAAS;gBAAWE,SAAS;YAAM;YACxE3D;QACF,EAAE,OAAOwD,OAAO;YACdI,QAAQJ,KAAK,CAACA;YACdvD,gBAAgB,yBAAyB;gBACvCwD,SAAS;gBACTC,gBAAgB;YAClB;QACF,SAAU;YACRtD,QAAQ;QACV;IACF;IAEA,qBACE,KAAChC;QACCyF,QAAQ;QACRC,MAAMzE,eAAe,qBAAqB;YACxC0E,QAAQ;YACRC,SACE,iEACA;QACJ;QACAC,cAAc;QACdC,cAAc;kBAEd,cAAA,MAACrF;YAAMsF,SAAS;;8BACd,KAACpF;oBAAW0E,SAAQ;oBAAQW,OAAM;8BAC/B,mEACC,iEACA;;8BAGJ,KAACtF;oBACCuF,OAAM;oBACNxC,OAAOxB,OAAOE,WAAW;oBACzB+D,UAAU7C,IAAI;oBACd8C,MAAK;oBACLC,SAAS;;8BAEX,KAAC1F;oBACCuF,OAAM;oBACNI,YAAW;oBACX5C,OAAOxB,OAAOG,WAAW;oBACzB8D,UAAU7C,IAAI;oBACd8C,MAAK;oBACLG,SAAS;oBACTC,SAAS;oBACTH,SAAS;;8BAIX,MAAC3F;oBAAMsF,SAAS;;sCACd,KAACpF;4BAAW0E,SAAQ;sCAAa;;wBAIhCnF,gBAAgB+B,OAAOI,eAAe,kBACrC,KAAChC;4BACCmG,WAAU;4BACVxC,KAAK9D,gBAAgB+B,OAAOI,eAAe;4BAC3CgC,KAAI;4BACJoC,IAAI;gCACFC,OAAO;gCACPC,WAAW;gCACXC,WAAW;gCACXC,cAAc;gCACdC,QAAQ;gCACRC,aAAa;4BACf;6BAEA;sCACJ,MAACtG;4BAAMuG,WAAU;4BAAMjB,SAAS;;8CAC9B,KAACzF;oCAAO6F,MAAK;oCAAQc,SAAS,IAAMtD,YAAY;8CAC7C1B,OAAOI,eAAe,GAAG,YAAY;;gCAEvCJ,OAAOI,eAAe,iBACrB,KAAC/B;oCACC6F,MAAK;oCACLH,OAAM;oCACNiB,SAAS,IACP/E,UAAU,CAAC6B,IAAO,aAAKA;gDAAG1B,iBAAiB;;8CAG5C;qCAED;;;;;8BAIR,KAAC9B;8BAID,KAACY;oBACC8E,OAAM;oBACNxC,OAAOd;oBACPuD,UAAUtD;oBACVsE,sBAAsB,IAAMvD,YAAY;oBACxC7B,WAAW,CAACqF;wBACVrF,UAAUqB,OAAO,GAAGgE;oBACtB;;8BAGF,KAAC5G;8BAGD,MAACE;oBAAMsF,SAAS;;sCACd,KAACpF;4BAAW0E,SAAQ;sCACjB,CAAC,aAAa,EAAExC,YAAYyB,MAAM,CAAC,CAAC,EAAEjD,gBAAgB,CAAC,CAAC;;sCAE3D,KAACZ;4BAAMuG,WAAU;4BAAMjB,SAAS;4BAAGU,IAAI;gCAAEW,UAAU;4BAAO;sCACvDvE,YAAYwE,GAAG,CAAC,CAACvD,KAAKwD,sBACrB,MAACjH;oCAAcoG,IAAI;wCAAEc,UAAU;oCAAW;;sDACxC,KAAClH;4CACCmG,WAAU;4CACVxC,KAAKF;4CACLO,KAAK,CAAC,WAAW,EAAEiD,QAAQ,GAAG;4CAC9Bb,IAAI;gDACFe,QAAQ;gDACRX,cAAc;gDACdC,QAAQ;gDACRC,aAAa;4CACf;;sDAEF,KAACzG;4CACC6F,MAAK;4CACLH,OAAM;4CACNiB,SAAS,IACPnE,eAAe,CAACK,UACdA,QAAQsE,MAAM,CAAC,CAACC,QAAUA,UAAU5D;sDAIvC;;;mCArBKA;;wBA0BbjB,YAAYyB,MAAM,GAAGjD,gCACpB,KAAChB;sCACC,cAAA,KAACC;gCAAO6F,MAAK;gCAAQc,SAAS,IAAMtD,YAAY;0CAC7C;;6BAGH;;;8BAGN,KAACpD;8BAGD,MAACE;oBAAMuG,WAAU;oBAAMjB,SAAS;oBAAGU,IAAI;wBAAEkB,YAAY;oBAAa;;sCAChE,KAACjH;4BACCuF,OAAM;4BACNxC,OAAOxB,OAAOK,OAAO;4BACrB4D,UAAU7C,IAAI;4BACd8C,MAAK;4BACLM,IAAI;gCAAEmB,MAAM;4BAAE;4BACdvB,YAAYtF;;sCAEd,KAACT;4BACC6F,MAAK;4BACLc,SAAS,IAAMtD,YAAY;4BAC3B8C,IAAI;gCAAEoB,IAAI;4BAAI;sCAEb;;;;8BAGL,KAACnH;oBACCuF,OAAM;oBACNxC,OAAOxB,OAAOM,WAAW;oBACzB2D,UAAU7C,IAAI;oBACd8C,MAAK;oBACLC,SAAS;;8BAEX,KAAC1F;oBACCuF,OAAM;oBACNxC,OAAOxB,OAAOO,aAAa;oBAC3B0D,UAAU7C,IAAI;oBACd8C,MAAK;oBACLC,SAAS;;8BAEX,MAAC3F;oBAAMuG,WAAU;oBAAMjB,SAAS;;sCAC9B,KAACrF;4BACCuF,OAAM;4BACNxC,OAAOxB,OAAOQ,OAAO;4BACrByD,UAAU7C,IAAI;4BACd8C,MAAK;4BACLM,IAAI;gCAAEmB,MAAM;4BAAE;;sCAEhB,MAAClH;4BACCoH,MAAM;4BACN7B,OAAM;4BACNxC,OAAOxB,OAAOS,QAAQ;4BACtBwD,UAAU7C,IAAI;4BACd8C,MAAK;4BACLM,IAAI;gCAAEmB,MAAM;4BAAE;;8CAEd,KAACpH;oCAASiD,OAAM;8CAAI;;gCACnBrC,mBAAmBiG,GAAG,CAAC,CAACK,sBACvB,KAAClH;wCAAqBiD,OAAOiE;kDAC1BA;uCADYA;;;;;8BAOrB,MAACjH;oBAAMuG,WAAU;oBAAMjB,SAAS;oBAAGU,IAAI;wBAAEsB,IAAI;oBAAE;;sCAC7C,KAACzH;4BACC+E,SAAQ;4BACRW,OAAM;4BACNgC,UAAUjG,QAAQ,CAACE,OAAOE,WAAW,CAAC8F,IAAI;4BAC1ChB,SAAS,IAAM,KAAKzC;sCAEnBzC,OAAO,YAAY;;sCAEtB,KAACzB;4BAAO0H,UAAUjG;4BAAMkF,SAASrF;sCAC9B;;;;;;;AAOb;AAEAN,oBAAoBa,WAAW,GAAG;AAElC,eAAeb,oBAAmB"}

package/src/lib/components/listing-detail-page.component.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Org marketplace listing detail (AGL-772), at `{marketplace}/{listingId}`.
+ *
+ * It was a console route until AGL-3080, which is why it used to reach the
+ * body through the `marketplaceListing` zone: an app page could not import
+ * this plugin. This page IS the plugin now, so it renders the content
+ * directly — the zone stays registered for the surfaces that still need it.
+ *
+ * Install pins validate against a site, so the detail acts through the org's
+ * first site until targeting lands (AGL-773).
+ */
+export declare function ListingDetailPage(props: {
+    listingId: string;
+    orgId: string | null;
+    basePath: string;
+    /** The site an install acts through, and every site for the target picker. */
+    actingHost: string;
+    hosts: ReadonlyArray<{
+        id: string;
+        label: string;
+    }>;
+    permissions?: Record<string, boolean | undefined>;
+    orgSlug: string;
+}): import("react").JSX.Element;
+export declare namespace ListingDetailPage {
+    var displayName: string;
+}
+export default ListingDetailPage;

package/src/lib/components/listing-detail-page.component.js

@@ -0,0 +1,151 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { PageHeaderActions, PageHeaderHelp, PageHeaderRecord } from "@aglyn/aglyn";
+import { AppLink } from "@aglyn/shared-ui-jsx";
+import { useFirestore, useFirestoreDoc, useUser } from "@aglyn/tenant-feature-instance";
+import { Alert, Button, Stack } from "@mui/material";
+import { doc } from "firebase/firestore";
+import { useMemo, useState } from "react";
+import ListingDetailEditor from "./listing-detail-editor.component.js";
+import ListingReviewStatus from "./listing-review-status.component.js";
+import ListingVerificationRequest from "./listing-verification-request.component.js";
+import { MarketplaceListingContent } from "./listing-content.component.js";
+import { publishPluginPath } from "../model/marketplace-paths.js";
+/**
+ * Org marketplace listing detail (AGL-772), at `{marketplace}/{listingId}`.
+ *
+ * It was a console route until AGL-3080, which is why it used to reach the
+ * body through the `marketplaceListing` zone: an app page could not import
+ * this plugin. This page IS the plugin now, so it renders the content
+ * directly — the zone stays registered for the surfaces that still need it.
+ *
+ * Install pins validate against a site, so the detail acts through the org's
+ * first site until targeting lands (AGL-773).
+ */ export function ListingDetailPage(props) {
+    var _ref, _ref1;
+    const { listingId, orgId, basePath, actingHost, hosts, permissions, orgSlug } = props;
+    const firestore = useFirestore();
+    const { data: user } = useUser();
+    // The listing itself, so the owner can edit the whole page in place
+    // (AGL-869) rather than through a cramped sidebar card.
+    const { data: listing } = useFirestoreDoc(()=>doc(firestore, 'marketplaceListings', listingId || '-missing-'), [
+        firestore,
+        listingId
+    ], {
+        idField: '$id'
+    });
+    // Listings are org-owned (AGL-652): ownership is an org comparison.
+    const isOwner = Boolean(orgId && (listing == null ? void 0 : listing.profileId) === orgId);
+    const [editing, setEditing] = useState(false);
+    // Name the thing you are looking at (AGL-1000). The page used to announce
+    // itself as "Marketplace listing" over a breadcrumb ending in "Listing",
+    // which made the largest text on the page the one part identical on every
+    // listing. This page already reads the doc for the in-place editor, so the
+    // name costs nothing; the surface's declared title stays as the fallback
+    // for the beat before it resolves and for a listing that does not exist.
+    const listingName = String((_ref = listing == null ? void 0 : listing.displayName) != null ? _ref : '').trim();
+    const isPlugin = ((_ref1 = listing == null ? void 0 : listing.artifactType) != null ? _ref1 : listing == null ? void 0 : listing.type) === 'plugin';
+    /*
+   * The hero's owner actions, memoized (AGL-1005). `PageHeaderActions`
+   * publishes upward through an effect keyed on what it is handed, so a node
+   * rebuilt every render would republish every render. The dependencies are
+   * exactly the four facts the buttons read.
+   */ const ownerActions = useMemo(()=>isOwner && !editing ? /*#__PURE__*/ _jsxs(Stack, {
+            direction: "row",
+            spacing: 1,
+            children: [
+                isPlugin ? /*#__PURE__*/ _jsx(AppLink, {
+                    href: publishPluginPath(basePath, listingId),
+                    children: /*#__PURE__*/ _jsx(Button, {
+                        variant: "contained",
+                        color: "primary",
+                        component: "span",
+                        children: 'Publish new version'
+                    })
+                }) : null,
+                /*#__PURE__*/ _jsx(Button, {
+                    variant: "outlined",
+                    color: "primary",
+                    onClick: ()=>setEditing(true),
+                    children: 'Edit listing'
+                })
+            ]
+        }) : null, [
+        isOwner,
+        editing,
+        isPlugin,
+        basePath,
+        listingId
+    ]);
+    return /*#__PURE__*/ _jsxs(_Fragment, {
+        children: [
+            /*#__PURE__*/ _jsx(PageHeaderRecord, {
+                title: listingName
+            }),
+            /*#__PURE__*/ _jsx(PageHeaderHelp, {
+                topic: "plugins",
+                anchor: "#what-the-badges-on-a-listing-mean"
+            }),
+            /*#__PURE__*/ _jsx(PageHeaderActions, {
+                children: ownerActions
+            }),
+            editing && isOwner && orgId && listing ? /*#__PURE__*/ _jsx(ListingDetailEditor, {
+                orgId: orgId,
+                listingId: listingId,
+                listing: listing,
+                user: user,
+                onDone: ()=>setEditing(false)
+            }) : /*#__PURE__*/ _jsxs(_Fragment, {
+                children: [
+                    isOwner ? /*#__PURE__*/ _jsxs(_Fragment, {
+                        children: [
+                            /*#__PURE__*/ _jsx(ListingReviewStatus, {
+                                listingId: listingId,
+                                isPlugin: isPlugin
+                            }),
+                            /*#__PURE__*/ _jsx(ListingVerificationRequest, {
+                                listingId: listingId,
+                                listing: listing,
+                                viewerOrgId: orgId != null ? orgId : undefined,
+                                user: user,
+                                isPlugin: isPlugin
+                            })
+                        ]
+                    }) : null,
+                    !actingHost ? // Owners can still edit their listing with no site of their own —
+                    // through the hero's Edit listing action (AGL-1005).
+                    /*#__PURE__*/ _jsx(Alert, {
+                        severity: "info",
+                        children: isOwner ? 'Add a site to your organization to install marketplace ' + 'items. You can still edit this listing above.' : 'Add a site to your organization to view and install ' + 'marketplace items.'
+                    }) : /*#__PURE__*/ _jsx(MarketplaceListingContent, {
+                        hostId: actingHost,
+                        listingId: listingId,
+                        permissions: permissions,
+                        orgScoped: true,
+                        orgSlug: orgSlug,
+                        hosts: hosts
+                    })
+                ]
+            })
+        ]
+    });
+}
+ListingDetailPage.displayName = 'ListingDetailPage';
+export default ListingDetailPage;
+
+//# sourceMappingURL=listing-detail-page.component.js.map

package/src/lib/components/listing-detail-page.component.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/components/listing-detail-page.component.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n'use client'\n\nimport {\n  PageHeaderActions,\n  PageHeaderHelp,\n  PageHeaderRecord,\n} from '@aglyn/aglyn'\nimport { AppLink } from '@aglyn/shared-ui-jsx'\nimport { useFirestore, useFirestoreDoc, useUser } from '@aglyn/tenant-feature-instance'\nimport { Alert, Button, Stack } from '@mui/material'\nimport { doc } from 'firebase/firestore'\nimport { useMemo, useState } from 'react'\nimport ListingDetailEditor from './listing-detail-editor.component'\nimport ListingReviewStatus from './listing-review-status.component'\nimport ListingVerificationRequest from './listing-verification-request.component'\nimport { MarketplaceListingContent } from './listing-content.component'\nimport { publishPluginPath } from '../model/marketplace-paths'\n\n/**\n * Org marketplace listing detail (AGL-772), at `{marketplace}/{listingId}`.\n *\n * It was a console route until AGL-3080, which is why it used to reach the\n * body through the `marketplaceListing` zone: an app page could not import\n * this plugin. This page IS the plugin now, so it renders the content\n * directly — the zone stays registered for the surfaces that still need it.\n *\n * Install pins validate against a site, so the detail acts through the org's\n * first site until targeting lands (AGL-773).\n */\nexport function ListingDetailPage(props: {\n  listingId: string\n  orgId: string | null\n  basePath: string\n  /** The site an install acts through, and every site for the target picker. */\n  actingHost: string\n  hosts: ReadonlyArray<{ id: string; label: string }>\n  permissions?: Record<string, boolean | undefined>\n  orgSlug: string\n}) {\n  const { listingId, orgId, basePath, actingHost, hosts, permissions, orgSlug } =\n    props\n  const firestore = useFirestore()\n  const { data: user } = useUser()\n\n  // The listing itself, so the owner can edit the whole page in place\n  // (AGL-869) rather than through a cramped sidebar card.\n  const { data: listing } = useFirestoreDoc<any>(\n    () => doc(firestore, 'marketplaceListings', listingId || '-missing-'),\n    [firestore, listingId],\n    { idField: '$id' },\n  )\n  // Listings are org-owned (AGL-652): ownership is an org comparison.\n  const isOwner = Boolean(orgId && listing?.profileId === orgId)\n  const [editing, setEditing] = useState(false)\n\n  // Name the thing you are looking at (AGL-1000). The page used to announce\n  // itself as \"Marketplace listing\" over a breadcrumb ending in \"Listing\",\n  // which made the largest text on the page the one part identical on every\n  // listing. This page already reads the doc for the in-place editor, so the\n  // name costs nothing; the surface's declared title stays as the fallback\n  // for the beat before it resolves and for a listing that does not exist.\n  const listingName = String(listing?.displayName ?? '').trim()\n  const isPlugin = (listing?.artifactType ?? listing?.type) === 'plugin'\n\n  /*\n   * The hero's owner actions, memoized (AGL-1005). `PageHeaderActions`\n   * publishes upward through an effect keyed on what it is handed, so a node\n   * rebuilt every render would republish every render. The dependencies are\n   * exactly the four facts the buttons read.\n   */\n  const ownerActions = useMemo(\n    () =>\n      isOwner && !editing ? (\n        <Stack direction=\"row\" spacing={1}>\n          {/* Shipping a new version had no door on the listing itself\n              (AGL-1008) — Edit changes metadata and View changes nothing,\n              so the only reading left was \"make a second listing\". Same\n              publish form, pre-bound to this listing. Plugins only: a\n              bundle is the thing a new version ships. */}\n          {isPlugin ? (\n            <AppLink href={publishPluginPath(basePath, listingId)}>\n              <Button variant=\"contained\" color=\"primary\" component=\"span\">\n                {'Publish new version'}\n              </Button>\n            </AppLink>\n          ) : null}\n          <Button\n            variant=\"outlined\"\n            color=\"primary\"\n            onClick={() => setEditing(true)}\n          >\n            {'Edit listing'}\n          </Button>\n        </Stack>\n      ) : null,\n    [isOwner, editing, isPlugin, basePath, listingId],\n  )\n\n  return (\n    <>\n      <PageHeaderRecord title={listingName} />\n      <PageHeaderHelp\n        topic=\"plugins\"\n        anchor=\"#what-the-badges-on-a-listing-mean\"\n      />\n      {/* Owner action in the hero (AGL-1005), where the chrome already has a\n          slot for it. It used to float in a bare right-aligned box above the\n          content — unanchored to anything, and it moved depending on whether\n          the org had a site yet. */}\n      <PageHeaderActions>{ownerActions}</PageHeaderActions>\n      {editing && isOwner && orgId && listing ? (\n        <ListingDetailEditor\n          orgId={orgId}\n          listingId={listingId}\n          listing={listing}\n          user={user}\n          onDone={() => setEditing(false)}\n        />\n      ) : (\n        <>\n          {/* The publisher's own view of the queue (AGL-1079). Owner-only:\n              review state, rejection reasons and what was attested are the\n              publisher's business, and a buyer is never offered a version\n              this card exists to explain. Above the buyer-facing body,\n              because \"what is happening to my submission\" is why an owner\n              opened their own listing. */}\n          {isOwner ? (\n            <>\n              <ListingReviewStatus listingId={listingId} isPlugin={isPlugin} />\n              {/* The door to the Verified badge (AGL-1217). Below the review\n                  card on purpose: \"where is my submission\" is the more urgent\n                  question, and asking for a badge only makes sense once the\n                  listing is live. */}\n              <ListingVerificationRequest\n                listingId={listingId}\n                listing={listing}\n                viewerOrgId={orgId ?? undefined}\n                user={user}\n                isPlugin={isPlugin}\n              />\n            </>\n          ) : null}\n          {!actingHost ? (\n            // Owners can still edit their listing with no site of their own —\n            // through the hero's Edit listing action (AGL-1005).\n            <Alert severity=\"info\">\n              {isOwner\n                ? 'Add a site to your organization to install marketplace ' +\n                  'items. You can still edit this listing above.'\n                : 'Add a site to your organization to view and install ' +\n                  'marketplace items.'}\n            </Alert>\n          ) : (\n            <MarketplaceListingContent\n              hostId={actingHost}\n              listingId={listingId}\n              permissions={permissions}\n              orgScoped\n              orgSlug={orgSlug}\n              hosts={hosts}\n            />\n          )}\n        </>\n      )}\n    </>\n  )\n}\n\nListingDetailPage.displayName = 'ListingDetailPage'\n\nexport default ListingDetailPage\n"],"names":["PageHeaderActions","PageHeaderHelp","PageHeaderRecord","AppLink","useFirestore","useFirestoreDoc","useUser","Alert","Button","Stack","doc","useMemo","useState","ListingDetailEditor","ListingReviewStatus","ListingVerificationRequest","MarketplaceListingContent","publishPluginPath","ListingDetailPage","props","listingId","orgId","basePath","actingHost","hosts","permissions","orgSlug","firestore","data","user","listing","idField","isOwner","Boolean","profileId","editing","setEditing","listingName","String","displayName","trim","isPlugin","artifactType","type","ownerActions","direction","spacing","href","variant","color","component","onClick","title","topic","anchor","onDone","viewerOrgId","undefined","severity","hostId","orgScoped"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GACD;;AAEA,SACEA,iBAAiB,EACjBC,cAAc,EACdC,gBAAgB,QACX,eAAc;AACrB,SAASC,OAAO,QAAQ,uBAAsB;AAC9C,SAASC,YAAY,EAAEC,eAAe,EAAEC,OAAO,QAAQ,iCAAgC;AACvF,SAASC,KAAK,EAAEC,MAAM,EAAEC,KAAK,QAAQ,gBAAe;AACpD,SAASC,GAAG,QAAQ,qBAAoB;AACxC,SAASC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AACzC,OAAOC,yBAAyB,uCAAmC;AACnE,OAAOC,yBAAyB,uCAAmC;AACnE,OAAOC,gCAAgC,8CAA0C;AACjF,SAASC,yBAAyB,QAAQ,iCAA6B;AACvE,SAASC,iBAAiB,QAAQ,gCAA4B;AAE9D;;;;;;;;;;CAUC,GACD,OAAO,SAASC,kBAAkBC,KASjC;;IACC,MAAM,EAAEC,SAAS,EAAEC,KAAK,EAAEC,QAAQ,EAAEC,UAAU,EAAEC,KAAK,EAAEC,WAAW,EAAEC,OAAO,EAAE,GAC3EP;IACF,MAAMQ,YAAYvB;IAClB,MAAM,EAAEwB,MAAMC,IAAI,EAAE,GAAGvB;IAEvB,oEAAoE;IACpE,wDAAwD;IACxD,MAAM,EAAEsB,MAAME,OAAO,EAAE,GAAGzB,gBACxB,IAAMK,IAAIiB,WAAW,uBAAuBP,aAAa,cACzD;QAACO;QAAWP;KAAU,EACtB;QAAEW,SAAS;IAAM;IAEnB,oEAAoE;IACpE,MAAMC,UAAUC,QAAQZ,SAASS,CAAAA,2BAAAA,QAASI,SAAS,MAAKb;IACxD,MAAM,CAACc,SAASC,WAAW,GAAGxB,SAAS;IAEvC,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,MAAMyB,cAAcC,eAAOR,2BAAAA,QAASS,WAAW,mBAAI,IAAIC,IAAI;IAC3D,MAAMC,WAAW,UAACX,2BAAAA,QAASY,YAAY,oBAAIZ,2BAAAA,QAASa,IAAI,MAAM;IAE9D;;;;;GAKC,GACD,MAAMC,eAAejC,QACnB,IACEqB,WAAW,CAACG,wBACV,MAAC1B;YAAMoC,WAAU;YAAMC,SAAS;;gBAM7BL,yBACC,KAACtC;oBAAQ4C,MAAM9B,kBAAkBK,UAAUF;8BACzC,cAAA,KAACZ;wBAAOwC,SAAQ;wBAAYC,OAAM;wBAAUC,WAAU;kCACnD;;qBAGH;8BACJ,KAAC1C;oBACCwC,SAAQ;oBACRC,OAAM;oBACNE,SAAS,IAAMf,WAAW;8BAEzB;;;aAGH,MACN;QAACJ;QAASG;QAASM;QAAUnB;QAAUF;KAAU;IAGnD,qBACE;;0BACE,KAAClB;gBAAiBkD,OAAOf;;0BACzB,KAACpC;gBACCoD,OAAM;gBACNC,QAAO;;0BAMT,KAACtD;0BAAmB4C;;YACnBT,WAAWH,WAAWX,SAASS,wBAC9B,KAACjB;gBACCQ,OAAOA;gBACPD,WAAWA;gBACXU,SAASA;gBACTD,MAAMA;gBACN0B,QAAQ,IAAMnB,WAAW;+BAG3B;;oBAOGJ,wBACC;;0CACE,KAAClB;gCAAoBM,WAAWA;gCAAWqB,UAAUA;;0CAKrD,KAAC1B;gCACCK,WAAWA;gCACXU,SAASA;gCACT0B,WAAW,EAAEnC,gBAAAA,QAASoC;gCACtB5B,MAAMA;gCACNY,UAAUA;;;yBAGZ;oBACH,CAAClB,aACA,kEAAkE;oBAClE,qDAAqD;kCACrD,KAAChB;wBAAMmD,UAAS;kCACb1B,UACG,4DACA,kDACA,yDACA;uCAGN,KAAChB;wBACC2C,QAAQpC;wBACRH,WAAWA;wBACXK,aAAaA;wBACbmC,SAAS;wBACTlC,SAASA;wBACTF,OAAOA;;;;;;AAOrB;AAEAN,kBAAkBqB,WAAW,GAAG;AAEhC,eAAerB,kBAAiB"}

package/src/lib/components/listing-review-status.component.d.ts

@@ -0,0 +1,67 @@
+import { PUBLISHER_ATTESTATION } from '@aglyn/aglyn/app-utils/publisher-attestation';
+export interface PublisherVersion {
+    version: string;
+    publishedAtMs: number | null;
+    sha256: string;
+    reviewState: string;
+    grandfathered: boolean;
+    signed: boolean;
+    changelog: string;
+    rejectionReason: string;
+    /**
+     * The platform kill switch, per version (AGL-2328). Independent of
+     * `reviewState` and NOT a substitute for it: a version is normally
+     * approved first and revoked afterwards, so both are true at once and the
+     * card has to say both.
+     */
+    revoked?: boolean;
+    /**
+     * Reconciled against the listing totals server-side (AGL-1418), so this
+     * card and the listing's own Version history print the same number for the
+     * same version instead of two answers to one question.
+     */
+    activeInstalls: number;
+    installCount?: number;
+    attestation: string[];
+}
+/**
+ * A review state said in words (AGL-1079).
+ *
+ * `grandfathered` is checked FIRST and deliberately: those versions were
+ * published before review was per-version (AGL-966), so they carry no
+ * verdict at all. Calling them "pending" would promise a reviewer who is
+ * never coming, and calling them "approved" would claim a judgement nobody
+ * made.
+ */
+declare function reviewLabel(entry: PublisherVersion): {
+    label: string;
+    color: 'default' | 'success' | 'warning' | 'error' | 'info';
+    detail: string;
+};
+export interface ListingReviewStatusProps {
+    listingId: string;
+    /** Only a plugin listing has a review-per-version story to tell. */
+    isPlugin: boolean;
+}
+/**
+ * What review is doing with a publisher's versions (AGL-1079).
+ *
+ * AGL-966's guarantee — a new version waits in the queue while the
+ * previously approved one keeps installing — has been true and invisible
+ * since the day it shipped. A publisher got an email on the outcome and,
+ * in between, a listing row identical to the one they had before they
+ * published. This is the page that answers what they submitted, what state
+ * it is in, which version their customers are actually on, and why one was
+ * sent back.
+ *
+ * Reads through the publisher-scoped versions endpoint rather than
+ * Firestore: `pluginVersions` is server-only, because the docs carry
+ * publish internals a client has no business holding.
+ */
+export declare function ListingReviewStatus(props: ListingReviewStatusProps): import("react").JSX.Element;
+export declare namespace ListingReviewStatus {
+    var displayName: string;
+}
+export default ListingReviewStatus;
+/** Exported for the spec: the words each state is said in. */
+export { reviewLabel, PUBLISHER_ATTESTATION };

package/src/lib/components/listing-review-status.component.js

@@ -0,0 +1,301 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { CardDisplay } from "@aglyn/shared-ui-jsx";
+import { Alert, Chip, Divider, Stack, Typography } from "@mui/material";
+import { useEffect, useState } from "react";
+import { useUser } from "@aglyn/tenant-feature-instance";
+import { attestationLabels, PUBLISHER_ATTESTATION, requiredAttestationIds } from "@aglyn/aglyn/app-utils/publisher-attestation";
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+import { pluginDocsHelp } from "@aglyn/aglyn";
+/**
+ * A review state said in words (AGL-1079).
+ *
+ * `grandfathered` is checked FIRST and deliberately: those versions were
+ * published before review was per-version (AGL-966), so they carry no
+ * verdict at all. Calling them "pending" would promise a reviewer who is
+ * never coming, and calling them "approved" would claim a judgement nobody
+ * made.
+ */ function reviewLabel(entry) {
+    if (entry.grandfathered) {
+        return {
+            label: 'Published before review',
+            color: 'default',
+            detail: 'Published before versions were reviewed individually. It installs, ' + 'but no reviewer ever signed off on these bytes.'
+        };
+    }
+    switch(entry.reviewState){
+        case 'approved':
+            return {
+                label: 'Approved',
+                color: 'success',
+                detail: 'A reviewer approved these exact bytes.'
+            };
+        case 'rejected':
+            return {
+                label: 'Rejected',
+                color: 'error',
+                detail: 'Not installable. Fix what the reason says and publish a new ' + 'version — these bytes cannot be edited.'
+            };
+        case 'pending':
+            return {
+                label: 'In review',
+                color: 'warning',
+                detail: 'Waiting for a reviewer. Nobody else can install it — but you ' + 'can, on your own sites, which is how you test a version before ' + 'it is approved.'
+            };
+        default:
+            return {
+                label: 'Unknown',
+                color: 'default',
+                detail: 'No review state was recorded for this version.'
+            };
+    }
+}
+/**
+ * What review is doing with a publisher's versions (AGL-1079).
+ *
+ * AGL-966's guarantee — a new version waits in the queue while the
+ * previously approved one keeps installing — has been true and invisible
+ * since the day it shipped. A publisher got an email on the outcome and,
+ * in between, a listing row identical to the one they had before they
+ * published. This is the page that answers what they submitted, what state
+ * it is in, which version their customers are actually on, and why one was
+ * sent back.
+ *
+ * Reads through the publisher-scoped versions endpoint rather than
+ * Firestore: `pluginVersions` is server-only, because the docs carry
+ * publish internals a client has no business holding.
+ */ export function ListingReviewStatus(props) {
+    var _payload_revocationReason, _payload_revokedAtMs;
+    const { listingId, isPlugin } = props;
+    const { data: user } = useUser();
+    const [payload, setPayload] = useState(null);
+    const [failed, setFailed] = useState(false);
+    useEffect(()=>{
+        let cancelled = false;
+        if (!listingId || !isPlugin) return undefined;
+        void (async ()=>{
+            try {
+                const response = await authorizedFetch(user, `/api/marketplace/listing-versions?scope=publisher&listingId=${encodeURIComponent(listingId)}`);
+                if (!response.ok) {
+                    if (!cancelled) setFailed(true);
+                    return;
+                }
+                const data = await response.json();
+                if (!cancelled) setPayload(data);
+            } catch (unused) {
+                if (!cancelled) setFailed(true);
+            }
+        })();
+        return ()=>{
+            cancelled = true;
+        };
+    }, [
+        listingId,
+        isPlugin,
+        user
+    ]);
+    if (!isPlugin) return null;
+    if (failed) return null;
+    // Nothing rather than an empty shell: this card is only worth space once
+    // it has something to say, and a skeleton that never fills is worse than
+    // a card that appears.
+    if (!payload) return null;
+    const { versions, latestApprovedVersion, latestVersion } = payload;
+    const revocationReason = String((_payload_revocationReason = payload.revocationReason) != null ? _payload_revocationReason : '').trim();
+    const revokedAtMs = (_payload_revokedAtMs = payload.revokedAtMs) != null ? _payload_revokedAtMs : null;
+    const inReview = versions.filter((entry)=>entry.reviewState === 'pending' && !entry.grandfathered);
+    /**
+   * The version the card names as installing today, revoked (AGL-2328).
+   *
+   * `latestApprovedVersion` is a REVIEW verdict and the kill switch is not
+   * — nothing about revoking a version clears it — so the headline below
+   * went on saying "is approved and is what installs today" about a version
+   * the installer refuses with a 409. That is the sentence a publisher
+   * reads before opening a support ticket about installs that stopped
+   * working, so it is checked before any of the review arms.
+   */ const installsTodayRevoked = Boolean(latestApprovedVersion && versions.some((entry)=>entry.version === latestApprovedVersion && entry.revoked));
+    const behind = latestApprovedVersion && latestVersion && latestApprovedVersion !== latestVersion;
+    return /*#__PURE__*/ _jsx(CardDisplay, {
+        header: 'Review status',
+        help: pluginDocsHelp('publisherHandbook', {
+            anchor: '#review-what-happens-after-you-publish',
+            excerpt: 'What state each version is in, which one installs today, and why ' + 'anything was sent back.'
+        }),
+        contentGutterX: true,
+        contentGutterY: true,
+        children: /*#__PURE__*/ _jsxs(Stack, {
+            spacing: 2,
+            children: [
+                installsTodayRevoked ? /*#__PURE__*/ _jsx(Alert, {
+                    severity: "error",
+                    children: `v${latestApprovedVersion} was disabled by the platform. It is ` + 'still your latest approved version, but nobody can install ' + 'it and sites already running it render a placeholder. ' + 'Publishing a new version is what clears this — these bytes ' + 'cannot be re-enabled by editing them.'
+                }) : behind && inReview.length ? /*#__PURE__*/ _jsx(Alert, {
+                    severity: "info",
+                    children: `v${latestVersion} is in review. New installs get ` + `v${latestApprovedVersion} until it is approved, and anyone ` + 'already running it stays where they are.'
+                }) : behind ? /*#__PURE__*/ _jsx(Alert, {
+                    severity: "warning",
+                    children: `v${latestVersion} is not approved, so new installs get ` + `v${latestApprovedVersion}.`
+                }) : latestApprovedVersion ? /*#__PURE__*/ _jsx(Alert, {
+                    severity: "success",
+                    children: `v${latestApprovedVersion} is approved and is what installs today.`
+                }) : /*#__PURE__*/ _jsx(Alert, {
+                    severity: "info",
+                    children: 'Nothing is approved yet, so nobody else can install this. A ' + 'reviewer sees your submission in the queue. You can still ' + 'install it on your own sites to test it — that is the only ' + 'way these bytes run today.'
+                }),
+                /*#__PURE__*/ _jsx(Typography, {
+                    variant: "caption",
+                    color: "text.secondary",
+                    children: 'While a version is in review you can still edit this listing — ' + 'name, description, README, screenshots and links — and it will ' + 'not send anything back to the queue, because approval is about ' + 'the bundle’s bytes. The bytes themselves are never edited: ' + 'changing them means publishing a new version.'
+                }),
+                /*#__PURE__*/ _jsx(Divider, {}),
+                /*#__PURE__*/ _jsxs(Stack, {
+                    spacing: 2,
+                    children: [
+                        versions.map((entry)=>{
+                            var _versions_;
+                            const state = reviewLabel(entry);
+                            const claimed = entry.attestation.length;
+                            // Which set applied to THIS version: the first one published is
+                            // not asked for a changelog, so measuring every version against
+                            // the update set would report the first as permanently short.
+                            const expected = requiredAttestationIds(entry.version !== ((_versions_ = versions[versions.length - 1]) == null ? void 0 : _versions_.version)).length;
+                            return /*#__PURE__*/ _jsxs(Stack, {
+                                spacing: 0.5,
+                                children: [
+                                    /*#__PURE__*/ _jsxs(Stack, {
+                                        direction: "row",
+                                        spacing: 1,
+                                        sx: {
+                                            alignItems: 'center',
+                                            flexWrap: 'wrap'
+                                        },
+                                        children: [
+                                            /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "subtitle2",
+                                                children: `v${entry.version}`
+                                            }),
+                                            /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: state.color,
+                                                label: state.label
+                                            }),
+                                            entry.revoked ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: "error",
+                                                label: "Disabled"
+                                            }) : null,
+                                            entry.version === latestApprovedVersion && !entry.revoked ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                variant: "outlined",
+                                                label: "Installs today"
+                                            }) : null,
+                                            entry.signed ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                variant: "outlined",
+                                                label: "Realm-trusted"
+                                            }) : null,
+                                            entry.activeInstalls ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                variant: "outlined",
+                                                color: state.label === 'Approved' ? undefined : 'warning',
+                                                label: `${entry.activeInstalls} on this version`
+                                            }) : null
+                                        ]
+                                    }),
+                                    /*#__PURE__*/ _jsxs(Typography, {
+                                        variant: "caption",
+                                        color: "text.secondary",
+                                        children: [
+                                            state.detail,
+                                            entry.publishedAtMs ? ` Published ${new Date(entry.publishedAtMs).toLocaleDateString()}.` : ''
+                                        ]
+                                    }),
+                                    entry.activeInstalls && entry.reviewState !== 'approved' && !entry.grandfathered ? /*#__PURE__*/ _jsx(Alert, {
+                                        severity: "warning",
+                                        sx: {
+                                            mt: 0.5
+                                        },
+                                        children: `${entry.activeInstalls} of your installs ${entry.activeInstalls === 1 ? 'is' : 'are'} running this version, which no reviewer has approved. ` + 'Only your own organization can install it — but an ' + 'org-wide install covers every site in it, so if any ' + 'of them is live, unreviewed code is serving real ' + 'visitors.'
+                                    }) : null,
+                                    entry.rejectionReason ? /*#__PURE__*/ _jsx(Alert, {
+                                        severity: "error",
+                                        sx: {
+                                            mt: 0.5
+                                        },
+                                        children: entry.rejectionReason
+                                    }) : null,
+                                    entry.revoked ? /*#__PURE__*/ _jsxs(Alert, {
+                                        severity: "error",
+                                        sx: {
+                                            mt: 0.5
+                                        },
+                                        children: [
+                                            'The platform disabled this version. Nobody can install ' + 'it, and sites already running it render a placeholder.',
+                                            revocationReason ? /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "body2",
+                                                sx: {
+                                                    mt: 1
+                                                },
+                                                children: `Reason: ${revocationReason}`
+                                            }) : null,
+                                            revokedAtMs ? /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "caption",
+                                                sx: {
+                                                    display: 'block',
+                                                    mt: 0.5
+                                                },
+                                                children: `Disabled ${new Date(revokedAtMs).toLocaleDateString()}`
+                                            }) : null
+                                        ]
+                                    }) : null,
+                                    entry.changelog ? /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "caption",
+                                        children: entry.changelog
+                                    }) : null,
+                                    /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "caption",
+                                        color: "text.secondary",
+                                        children: claimed ? `You confirmed ${claimed}/${expected}: ` + attestationLabels(entry.attestation).map((label)=>label.replace(/\s+/g, ' ')).join('; ') : `Nothing was confirmed for these bytes — published ` + 'before the pre-publish checklist existed, or ' + 'republished since.'
+                                    }),
+                                    entry.sha256 ? /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "caption",
+                                        color: "text.secondary",
+                                        sx: {
+                                            fontFamily: 'monospace'
+                                        },
+                                        children: `sha256 ${entry.sha256.slice(0, 12)}…`
+                                    }) : null
+                                ]
+                            }, entry.version);
+                        }),
+                        versions.length ? null : /*#__PURE__*/ _jsx(Typography, {
+                            variant: "caption",
+                            color: "text.secondary",
+                            children: 'No versions published yet.'
+                        })
+                    ]
+                })
+            ]
+        })
+    });
+}
+ListingReviewStatus.displayName = 'ListingReviewStatus';
+export default ListingReviewStatus;
+/** Exported for the spec: the words each state is said in. */ export { reviewLabel, PUBLISHER_ATTESTATION };
+
+//# sourceMappingURL=listing-review-status.component.js.map