@aglyn/plugins-marketplace 1.0.0-beta.150 → 1.0.0-beta.151

package/src/lib/components/plugin-review-detail.component.js

@@ -0,0 +1,1438 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { PageHeaderHelp, PageHeaderRecord, resolveStaffRoleGate, SUPER_STAFF_ONLY_REASON } from "@aglyn/aglyn";
+import { AppLink, CardDisplay } from "@aglyn/shared-ui-jsx";
+import BlockedControl from "@aglyn/shared-ui-jsx/components/blocked-control.component";
+import { listingPath, orgMarketplacePath, publisherPath } from "../model/marketplace-paths.js";
+import { useSnackbar } from "@aglyn/shared-ui-snackstack";
+import { Alert, Box, Button, Checkbox, Chip, Divider, FormControlLabel, Link as MuiLink, MenuItem, Skeleton, Stack, TextField, ToggleButton, ToggleButtonGroup, Tooltip, Typography } from "@mui/material";
+import { useCallback, useEffect, useState } from "react";
+import { useUser } from "@aglyn/tenant-feature-instance";
+import { MarkdownLiteView } from "@aglyn/aglyn-markdown-editor";
+import { pluginDocsHelp } from "@aglyn/aglyn";
+import { PLUGIN_REVIEW_CHECKLIST } from "../model/plugin-review-checklist.js";
+import { PLUGIN_REJECTION_CATEGORIES, pluginRejectionCategory, rejectionHeadline, rejectionInputError } from "../model/plugin-rejection-categories.js";
+import { PUBLISHER_ATTESTATION } from "@aglyn/aglyn/app-utils/publisher-attestation";
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+import { reviewStatusMeaning } from "../model/plugin-review-status.js";
+/** Verifier findings read as a wall of text otherwise; group by severity. */ const SEVERITY_ORDER = [
+    'error',
+    'warn',
+    'warning',
+    'info'
+];
+/**
+ * One plugin submission or listed plugin, in full (AGL-960).
+ *
+ * The index is for scanning; this is where a reviewer reads the manifest,
+ * weighs the verifier findings and acts. Every consequential action lives
+ * here rather than on the list, so nobody grants realm trust or takes a
+ * plugin down while skimming rows.
+ */ export function PluginReviewDetail({ basePath, segments, staffRole, staffPaths }) {
+    var _ref, _ref1, _ref2, _ref3, _ref4, _ref5, _ref6, _ref7, _ref8, _ref9, _ref10;
+    var _pluginRejectionCategory, _detail_verifier, _detail_verifier1, _reviewCapabilities_network, _reviewCapabilities_events, _reviewVersionEntry_elements, _detail_publisherAgreement, _detail_publisherAgreement1, _detail_verificationRequest, _detail_verificationRequest1;
+    /*
+   * The row this page is: the first segment beneath the queue. The surface
+   * owns its subtree, so it also owns saying "no such thing" — which the
+   * body below already does for a listing that was withdrawn while a link
+   * to it sat in a reviewer's inbox.
+   */ const params = {
+        listingId: String((_ref = segments == null ? void 0 : segments[0]) != null ? _ref : '')
+    };
+    /*
+   * Granting realm trust is super-only on the server (AGL-2131). The claim
+   * is the app's and arrives as a prop; `null` is "still reading the token"
+   * and must never render as a refusal, or every reviewer sees a disabled
+   * button for a beat.
+   */ const superGate = resolveStaffRoleGate(staffRole, [
+        'super'
+    ]);
+    const listingId = String((_ref1 = params == null ? void 0 : params.listingId) != null ? _ref1 : '');
+    const { data: user } = useUser();
+    const { enqueueSnackbar } = useSnackbar();
+    const [detail, setDetail] = useState(null);
+    // Rendered by default (AGL-989) — the reviewer's first question is what a
+    // buyer sees; Source is for auditing exactly what was submitted.
+    const [readmeView, setReadmeView] = useState('rendered');
+    const [loaded, setLoaded] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const [reason, setReason] = useState('');
+    // Structured rejection (AGL-977). The comment stays — it is what tells a
+    // publisher what to fix — but it is no longer the only thing recorded.
+    const [rejectCategory, setRejectCategory] = useState('');
+    // The same predicate the route enforces, so the button and the server
+    // cannot disagree about what a complete rejection looks like.
+    const rejectBlocked = rejectionInputError(rejectCategory, reason);
+    const rejectCategoryNeedsComment = Boolean((_pluginRejectionCategory = pluginRejectionCategory(rejectCategory)) == null ? void 0 : _pluginRejectionCategory.requiresComment);
+    const [takedownReason, setTakedownReason] = useState('');
+    // Which version is being reviewed. Empty = let the server pick the oldest
+    // one still awaiting a verdict, which is the work queue for this listing.
+    const [selectedVersion, setSelectedVersion] = useState('');
+    const refresh = useCallback(async ()=>{
+        if (!listingId) return;
+        const response = await authorizedFetch(user, `/api/marketplace/admin/reviews?listingId=${encodeURIComponent(listingId)}` + (selectedVersion ? `&version=${encodeURIComponent(selectedVersion)}` : ''));
+        if (response.ok) setDetail(await response.json());
+        setLoaded(true);
+    }, [
+        user,
+        listingId,
+        selectedVersion
+    ]);
+    useEffect(()=>{
+        if (user) void refresh();
+    }, [
+        user,
+        refresh
+    ]);
+    const post = useCallback(async (payload, success)=>{
+        setBusy(true);
+        try {
+            const response = await authorizedFetch(user, '/api/marketplace/admin/reviews', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify(_extends({
+                    listingId
+                }, payload))
+            });
+            const result = await response.json().catch(()=>({}));
+            if (response.ok) {
+                enqueueSnackbar(success, {
+                    variant: 'success'
+                });
+                await refresh();
+            } else {
+                var _ref;
+                enqueueSnackbar((_ref = result == null ? void 0 : result.error) != null ? _ref : 'Action failed', {
+                    variant: 'error',
+                    allowDuplicate: true
+                });
+            }
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        user,
+        listingId,
+        enqueueSnackbar,
+        refresh
+    ]);
+    const signRealm = useCallback(async (version, action)=>{
+        setBusy(true);
+        try {
+            const response = await authorizedFetch(user, '/api/admin/sign-plugin', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify(_extends({
+                    listingId,
+                    version
+                }, action === 'revoke' ? {
+                    action: 'revoke'
+                } : {}))
+            });
+            const result = await response.json().catch(()=>({}));
+            if (response.ok) {
+                enqueueSnackbar(action === 'revoke' ? `v${version} returned to the sandbox` : `v${version} signed for the app realm`, {
+                    variant: 'success'
+                });
+                await refresh();
+            } else {
+                var _ref;
+                enqueueSnackbar((_ref = result == null ? void 0 : result.error) != null ? _ref : 'Signing failed', {
+                    variant: 'error',
+                    allowDuplicate: true
+                });
+            }
+        } finally{
+            setBusy(false);
+        }
+    }, [
+        user,
+        listingId,
+        enqueueSnackbar,
+        refresh
+    ]);
+    /**
+   * Per-version kill switch (AGL-1085). Distinct from `takedown`, which
+   * revokes EVERY version and hides the listing: stopping one version's
+   * bytes must not also stop the approved version customers are running.
+   */ const setVersionRevoked = useCallback(async (version, revoke)=>{
+        await post({
+            action: revoke ? 'revoke-version' : 'unrevoke-version',
+            version
+        }, revoke ? `v${version} stopped — running installs render a placeholder on next load` : `v${version} allowed to run again`);
+    }, [
+        post
+    ]);
+    const takedown = useCallback(async ()=>{
+        if (!detail) return;
+        if (!detail.hidden && !takedownReason.trim()) {
+            return void enqueueSnackbar('Taking a plugin down needs a reason', {
+                variant: 'warning',
+                allowDuplicate: true
+            });
+        }
+        await post({
+            action: detail.hidden ? 'unhide' : 'hide',
+            reason: takedownReason
+        }, detail.hidden ? `${detail.displayName} restored` : `${detail.displayName} taken down — running installs stop on next load`);
+        setTakedownReason('');
+    }, [
+        detail,
+        takedownReason,
+        post,
+        enqueueSnackbar
+    ]);
+    const status = reviewStatusMeaning((_ref2 = detail == null ? void 0 : detail.reviewStatus) != null ? _ref2 : '');
+    const blocked = ((_ref3 = detail == null ? void 0 : detail.checklistOutstanding.length) != null ? _ref3 : 0) > 0;
+    /**
+   * The version the approve/reject buttons act on (AGL-1085). Rejecting does
+   * not stop bytes that are already pinned — the runtime resolves a pin by
+   * {version, sha256} and only asks whether it is revoked — so the reviewer
+   * needs this version's live-install count at the moment they decide, not
+   * on some other page.
+   */ const reviewEntry = detail == null ? void 0 : detail.versions.find((entry)=>entry.version === (detail == null ? void 0 : detail.reviewVersion));
+    const liveOnReviewVersion = (_ref4 = reviewEntry == null ? void 0 : reviewEntry.activeInstalls) != null ? _ref4 : 0;
+    /**
+   * Where a reviewer actually goes to check each item (AGL-973).
+   *
+   * Without these, the checklist asks people to "read the bundle source"
+   * with no way to reach it — the bundle lives in a private bucket behind
+   * the plugin origin, and its URL is content-addressed, so nobody could
+   * construct it by hand. An unactionable checklist gets ticked without
+   * being done, which is worse than no checklist.
+   */ const artifactUrl = (version)=>{
+        var _process_env_NEXT_PUBLIC_PLUGIN_ORIGIN;
+        const entry = detail == null ? void 0 : detail.versions.find((item)=>item.version === version);
+        if (!(entry == null ? void 0 : entry.sha256)) return null;
+        const path = `/artifacts/${detail == null ? void 0 : detail.listingId}/${version}/${entry.sha256}.bundle`;
+        const origin = (_process_env_NEXT_PUBLIC_PLUGIN_ORIGIN = process.env.NEXT_PUBLIC_PLUGIN_ORIGIN) != null ? _process_env_NEXT_PUBLIC_PLUGIN_ORIGIN : '';
+        // The plugin origin just edge-rewrites to the console's own artifact
+        // route, so fall back to that directly when the origin is unset — as it
+        // is on every dev machine. Without the fallback the "read the bundle
+        // source" link silently vanished exactly where it matters most, and a
+        // reviewer had no way to reach the code they are certifying.
+        return origin ? `${origin.replace(/\/+$/, '')}${path}` : `/api/plugin-artifacts/${detail == null ? void 0 : detail.listingId}/${version}/${entry.sha256}.bundle`;
+    };
+    /**
+   * The stored object in the Cloud console (AGL-990) — the served bundle is
+   * what a reviewer READS, this is where they see the bytes: size, upload
+   * time, content type, generation. The bucket is not in the Firebase
+   * console, so nobody finds this by hand.
+   */ const bucketUrl = (version)=>{
+        const entry = detail == null ? void 0 : detail.versions.find((item)=>item.version === version);
+        if (!(entry == null ? void 0 : entry.sha256) || !(detail == null ? void 0 : detail.artifactsBucket)) return null;
+        const object = `artifacts/${detail.listingId}/${version}/${entry.sha256}.bundle`;
+        return 'https://console.cloud.google.com/storage/browser/_details/' + `${detail.artifactsBucket}/${object}`;
+    };
+    /**
+   * Every string a publisher wrote on one declared element (AGL-2486).
+   *
+   * Derived by WALKING the entry rather than by reading named fields, so text
+   * added to the manifest later — the way `tags` and `keywords` became
+   * searched after `description` became rendered — shows up here without
+   * anyone remembering this page. The criterion asks a reviewer to check the
+   * publisher's text, so the page has to show all of it, including the search
+   * terms that rank without ever rendering.
+   */ const publisherTextOf = (element)=>{
+        const lines = [];
+        const walk = (value, path)=>{
+            if (lines.length >= 40) return;
+            if (typeof value === 'string') {
+                if (value.trim()) lines.push(`${path}: ${value}`);
+                return;
+            }
+            if (Array.isArray(value)) {
+                value.forEach((entry, index)=>walk(entry, `${path}[${index}]`));
+                return;
+            }
+            if (value && typeof value === 'object') {
+                for (const [key, entry] of Object.entries(value)){
+                    walk(entry, `${path}.${key}`);
+                }
+            }
+        };
+        for (const [key, value] of Object.entries(element != null ? element : {})){
+            // The icon is an mdi NAME looked up in our own set, not publisher prose.
+            if (key === 'id' || key === 'icon') continue;
+            walk(value, key);
+        }
+        return lines;
+    };
+    const checklistLink = (itemId)=>{
+        if (!detail) return null;
+        // The version approved before this one — what a diff should be against.
+        const previousApproved = detail.versions.filter((entry)=>entry.version !== detail.reviewVersion && entry.reviewState === 'approved').at(0);
+        switch(itemId){
+            case 'provenance':
+                return detail.repositoryUrl ? {
+                    href: detail.repositoryUrl,
+                    label: 'Open repository',
+                    external: true
+                } : null;
+            case 'publisher':
+                var _ref;
+                return {
+                    href: (_ref = staffPaths == null ? void 0 : staffPaths.orgDetail(detail.publisherId)) != null ? _ref : '',
+                    label: 'Publisher workspace'
+                };
+            case 'source-read':
+                {
+                    const href = artifactUrl(detail.reviewVersion);
+                    return href ? {
+                        href,
+                        label: `Read v${detail.reviewVersion} bundle`,
+                        external: true
+                    } : null;
+                }
+            case 'diff':
+                {
+                    const href = previousApproved ? artifactUrl(previousApproved.version) : null;
+                    return href ? {
+                        href,
+                        label: `Previous approved: v${previousApproved == null ? void 0 : previousApproved.version}`,
+                        external: true
+                    } : null;
+                }
+            case 'element-metadata':
+                // Where the copy is READ, which is the whole difficulty with this
+                // one: the picker lives in the besigner on whatever site the
+                // reviewer installed it to, so the listing is the closest thing to
+                // a starting point this page can hand them.
+                return detail.publisherSlug ? {
+                    href: listingPath(orgMarketplacePath(detail.publisherSlug), detail.listingId),
+                    label: 'Install, then open the element picker'
+                } : null;
+            case 'behaviour':
+                return detail.publisherSlug ? {
+                    href: listingPath(orgMarketplacePath(detail.publisherSlug), detail.listingId),
+                    label: 'Marketplace listing'
+                } : null;
+            case 'license':
+            case 'support':
+                return detail.homepageUrl ? {
+                    href: detail.homepageUrl,
+                    label: 'Homepage',
+                    external: true
+                } : detail.repositoryUrl ? {
+                    href: detail.repositoryUrl,
+                    label: 'Repository',
+                    external: true
+                } : null;
+            default:
+                return null;
+        }
+    };
+    // Everything in the Security card is a statement about the version under
+    // review, whose capabilities are what the verifier checked against.
+    const reviewVersionEntry = detail == null ? void 0 : detail.versions.find((entry)=>entry.version === (detail == null ? void 0 : detail.reviewVersion));
+    const reviewCapabilities = reviewVersionEntry == null ? void 0 : reviewVersionEntry.capabilities;
+    const findings = ((_ref5 = detail == null ? void 0 : (_detail_verifier = detail.verifier) == null ? void 0 : _detail_verifier.problems) != null ? _ref5 : []).slice().sort((a, b)=>SEVERITY_ORDER.indexOf(a.level) - SEVERITY_ORDER.indexOf(b.level));
+    // The per-check summary (AGL-1087). Findings hang off the check that
+    // produced them, so a reviewer reads "why" beside "what", and the counts
+    // below say in one line whether this verdict is mostly green or mostly
+    // questions. Findings from a checker that did not tag them fall through to
+    // their own list rather than disappearing.
+    const checks = (_ref6 = detail == null ? void 0 : (_detail_verifier1 = detail.verifier) == null ? void 0 : _detail_verifier1.checks) != null ? _ref6 : [];
+    const findingsByCheck = new Map();
+    const untaggedFindings = [];
+    for (const finding of findings){
+        var _findingsByCheck_get;
+        const id = finding.check;
+        if (!id || !checks.some((check)=>check.id === id)) {
+            untaggedFindings.push(finding);
+            continue;
+        }
+        findingsByCheck.set(id, [
+            ...(_findingsByCheck_get = findingsByCheck.get(id)) != null ? _findingsByCheck_get : [],
+            finding
+        ]);
+    }
+    const countBy = (status)=>checks.filter((check)=>check.status === status).length;
+    return /*#__PURE__*/ _jsxs(_Fragment, {
+        children: [
+            /*#__PURE__*/ _jsx(PageHeaderRecord, {
+                title: (_ref7 = detail == null ? void 0 : detail.displayName) != null ? _ref7 : ''
+            }),
+            /*#__PURE__*/ _jsx(PageHeaderHelp, {
+                topic: "publisherHandbook",
+                anchor: "#review-what-happens-after-you-publish"
+            }),
+            !loaded ? /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 2,
+                children: [
+                    /*#__PURE__*/ _jsx(Skeleton, {
+                        variant: "rounded",
+                        height: 120
+                    }),
+                    /*#__PURE__*/ _jsx(Skeleton, {
+                        variant: "rounded",
+                        height: 220
+                    })
+                ]
+            }) : !detail ? /*#__PURE__*/ _jsx(Alert, {
+                severity: "warning",
+                children: 'That listing no longer exists.'
+            }) : /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 3,
+                children: [
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Status",
+                        help: pluginDocsHelp('publisherHandbook', {
+                            anchor: '#review-what-happens-after-you-publish',
+                            excerpt: 'Where this version stands: submitted, listed, verified, or ' + 'rejected — and what each state lets a customer do.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1.5,
+                            children: [
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    direction: "row",
+                                    spacing: 1,
+                                    sx: {
+                                        alignItems: 'center',
+                                        flexWrap: 'wrap'
+                                    },
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            color: status.color,
+                                            label: status.label
+                                        }),
+                                        /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            variant: "outlined",
+                                            label: `v${detail.latestVersion || '—'}`
+                                        }),
+                                        /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            variant: "outlined",
+                                            label: detail.priceUsd > 0 ? `$${detail.priceUsd}` : 'Free'
+                                        }),
+                                        /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            variant: "outlined",
+                                            label: `${detail.activeInstalls} install${detail.activeInstalls === 1 ? '' : 's'}`
+                                        }),
+                                        detail.hidden ? /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            color: "error",
+                                            label: "Taken down — revoked"
+                                        }) : null,
+                                        detail.unpublished ? /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            color: "warning",
+                                            label: "Unpublished by the publisher"
+                                        }) : null
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "caption",
+                                    color: "text.secondary",
+                                    children: status.meaning
+                                }),
+                                /*#__PURE__*/ _jsxs(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: [
+                                        'Publisher: ',
+                                        detail.publisherSlug ? /*#__PURE__*/ _jsx(AppLink, {
+                                            // The storefront route takes a handle now
+                                            // (AGL-1001). This payload carries the org's slug
+                                            // and name, not the publisher profile's handle, so
+                                            // it passes the id — which that page still
+                                            // resolves, the same fallback that keeps existing
+                                            // links working.
+                                            href: publisherPath(orgMarketplacePath(detail.publisherSlug), detail.publisherId),
+                                            children: detail.publisherName
+                                        }) : detail.publisherName,
+                                        ` · ${detail.listingId}`
+                                    ]
+                                }),
+                                [
+                                    'listed',
+                                    'verified'
+                                ].includes(detail.reviewStatus) && detail.checklistOutstanding.length ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "warning",
+                                    children: `Live in the marketplace with no recorded review for these bytes (${detail.checklistOutstanding.length} required item(s) outstanding). Work through the checklist, or delist while you do.`
+                                }) : null,
+                                detail.rejectionReason ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "error",
+                                    children: `Rejected: ${rejectionHeadline(detail.rejectionCategory, detail.rejectionReason)}${detail.rejectionReason && pluginRejectionCategory(detail.rejectionCategory) ? ` — ${detail.rejectionReason}` : ''}`
+                                }) : null,
+                                detail.hidden ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "error",
+                                    children: detail.hiddenReason ? `Taken down: ${detail.hiddenReason}` : 'Taken down (no reason recorded)'
+                                }) : null
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Overview",
+                        help: pluginDocsHelp('publisherHandbook', {
+                            excerpt: 'The listing as a customer sees it — name, description, media and ' + 'links, all publisher-supplied.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1.5,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    children: detail.description || 'No description.'
+                                }),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    direction: "row",
+                                    spacing: 1,
+                                    sx: {
+                                        alignItems: 'center',
+                                        flexWrap: 'wrap'
+                                    },
+                                    children: [
+                                        detail.license ? /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            variant: "outlined",
+                                            label: detail.license
+                                        }) : /*#__PURE__*/ _jsx(Chip, {
+                                            size: "small",
+                                            color: "warning",
+                                            label: "No license"
+                                        }),
+                                        detail.categories.map((category)=>/*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                label: category
+                                            }, category))
+                                    ]
+                                }),
+                                detail.homepageUrl || detail.repositoryUrl ? /*#__PURE__*/ _jsxs(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: [
+                                        detail.homepageUrl ? `Homepage: ${detail.homepageUrl}` : '',
+                                        detail.homepageUrl && detail.repositoryUrl ? ' · ' : '',
+                                        detail.repositoryUrl ? `Repository: ${detail.repositoryUrl}` : ''
+                                    ]
+                                }) : null,
+                                /*#__PURE__*/ _jsx(Divider, {}),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    direction: "row",
+                                    sx: {
+                                        alignItems: 'center',
+                                        justifyContent: 'space-between',
+                                        gap: 1
+                                    },
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "subtitle2",
+                                            children: 'README'
+                                        }),
+                                        /*#__PURE__*/ _jsxs(ToggleButtonGroup, {
+                                            exclusive: true,
+                                            size: "small",
+                                            value: readmeView,
+                                            onChange: (_event, next)=>{
+                                                if (next) setReadmeView(next);
+                                            },
+                                            children: [
+                                                /*#__PURE__*/ _jsx(ToggleButton, {
+                                                    value: "rendered",
+                                                    children: /*#__PURE__*/ _jsx(Typography, {
+                                                        variant: "caption",
+                                                        children: 'Rendered'
+                                                    })
+                                                }),
+                                                /*#__PURE__*/ _jsx(ToggleButton, {
+                                                    value: "source",
+                                                    children: /*#__PURE__*/ _jsx(Typography, {
+                                                        variant: "caption",
+                                                        children: 'Source'
+                                                    })
+                                                })
+                                            ]
+                                        })
+                                    ]
+                                }),
+                                detail.readme ? // Framed (AGL-991): everything inside this border is
+                                // publisher-submitted content, not our page. On a review
+                                // screen that boundary is the whole job.
+                                /*#__PURE__*/ _jsx(Box, {
+                                    sx: {
+                                        maxHeight: 480,
+                                        overflowY: 'auto',
+                                        border: 1,
+                                        borderColor: 'divider',
+                                        borderRadius: 1,
+                                        p: 2,
+                                        bgcolor: 'action.hover'
+                                    },
+                                    children: readmeView === 'rendered' ? /*#__PURE__*/ _jsx(MarkdownLiteView, {
+                                        source: detail.readme
+                                    }) : /*#__PURE__*/ _jsx(Typography, {
+                                        variant: "body2",
+                                        component: "pre",
+                                        sx: {
+                                            whiteSpace: 'pre-wrap',
+                                            fontFamily: 'monospace',
+                                            fontSize: 12,
+                                            m: 0
+                                        },
+                                        children: detail.readme
+                                    })
+                                }) : /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "warning",
+                                    children: 'No README — publishers are expected to ship one.'
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Security",
+                        help: pluginDocsHelp('sandboxSecurity', {
+                            excerpt: 'What the bundle asked for, against what the sandbox enforces ' + 'regardless of what it asked for.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1.5,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: `Declared network: ${(reviewCapabilities == null ? void 0 : (_reviewCapabilities_network = reviewCapabilities.network) == null ? void 0 : _reviewCapabilities_network.join(', ')) || 'none'} · events: ${(reviewCapabilities == null ? void 0 : (_reviewCapabilities_events = reviewCapabilities.events) == null ? void 0 : _reviewCapabilities_events.join(', ')) || 'none'}`
+                                }),
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: `Host ABI: declared ${(_ref8 = reviewVersionEntry == null ? void 0 : reviewVersionEntry.hostAbi) != null ? _ref8 : 'none (legacy)'}, platform runs ${detail.platformHostAbi}`
+                                }),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 0.5,
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "body2",
+                                            color: "text.secondary",
+                                            children: `Declared elements: ${(_ref9 = reviewVersionEntry == null ? void 0 : (_reviewVersionEntry_elements = reviewVersionEntry.elements) == null ? void 0 : _reviewVersionEntry_elements.length) != null ? _ref9 : 0} — publisher text the picker renders and ranks its search on, none of it on the listing page.`
+                                        }),
+                                        ((_ref10 = reviewVersionEntry == null ? void 0 : reviewVersionEntry.elements) != null ? _ref10 : []).map((element)=>/*#__PURE__*/ _jsxs(Stack, {
+                                                sx: {
+                                                    pl: 1
+                                                },
+                                                children: [
+                                                    /*#__PURE__*/ _jsx(Typography, {
+                                                        variant: "caption",
+                                                        color: "text.secondary",
+                                                        children: `${String(element['displayName'] || element['id'])}${element['category'] ? ` · ${String(element['category'])}` : ''}`
+                                                    }),
+                                                    publisherTextOf(element).map((line)=>/*#__PURE__*/ _jsx(Typography, {
+                                                            variant: "caption",
+                                                            color: "text.secondary",
+                                                            sx: {
+                                                                pl: 1,
+                                                                fontFamily: 'monospace',
+                                                                fontSize: 11,
+                                                                wordBreak: 'break-word'
+                                                            },
+                                                            children: line
+                                                        }, line))
+                                                ]
+                                            }, String(element['id'])))
+                                    ]
+                                }),
+                                !detail.verifier ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "warning",
+                                    children: 'The static verifier has not run for this version — ' + 'no artifact was reachable. Treat this as unchecked, ' + 'not as clean.'
+                                }) : detail.verifier.error ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "warning",
+                                    children: `Verifier could not run: ${detail.verifier.error}`
+                                }) : /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 1,
+                                    children: [
+                                        /*#__PURE__*/ _jsxs(Typography, {
+                                            variant: "body2",
+                                            color: "text.secondary",
+                                            children: [
+                                                checks.length ? [
+                                                    `${countBy('pass')} passed`,
+                                                    countBy('fail') ? `${countBy('fail')} failed` : '',
+                                                    countBy('question') ? `${countBy('question')} to question` : '',
+                                                    countBy('unknown') ? `${countBy('unknown')} could not run` : ''
+                                                ].filter(Boolean).join(' · ') : detail.verifier.ok ? 'Static verifier found nothing.' : 'Static verifier found problems.',
+                                                detail.verifierCached ? ' · stored verdict for these exact bytes' : ''
+                                            ]
+                                        }),
+                                        checks.map((check)=>{
+                                            var _findingsByCheck_get;
+                                            // The state has to survive being read aloud and being
+                                            // read by someone who cannot separate the red from the
+                                            // green (AGL-1089), so it is named in text as well as
+                                            // drawn — this is a page people skim to decide whether
+                                            // code runs in other people's workspaces.
+                                            const marker = check.status === 'pass' ? {
+                                                glyph: '✓',
+                                                color: 'success.main',
+                                                name: 'Passed'
+                                            } : check.status === 'fail' ? {
+                                                glyph: '✕',
+                                                color: 'error.main',
+                                                name: 'Failed'
+                                            } : check.status === 'question' ? {
+                                                glyph: '?',
+                                                color: 'warning.main',
+                                                name: 'Worth questioning'
+                                            } : {
+                                                glyph: '—',
+                                                color: 'text.disabled',
+                                                name: 'Not checked'
+                                            };
+                                            return /*#__PURE__*/ _jsxs(Stack, {
+                                                spacing: 0.5,
+                                                children: [
+                                                    /*#__PURE__*/ _jsxs(Stack, {
+                                                        direction: "row",
+                                                        spacing: 1,
+                                                        sx: {
+                                                            alignItems: 'baseline'
+                                                        },
+                                                        children: [
+                                                            /*#__PURE__*/ _jsx(Typography, {
+                                                                variant: "body2",
+                                                                "aria-label": `${marker.name}:`,
+                                                                sx: {
+                                                                    color: marker.color,
+                                                                    width: 16
+                                                                },
+                                                                children: marker.glyph
+                                                            }),
+                                                            /*#__PURE__*/ _jsxs(Typography, {
+                                                                variant: "body2",
+                                                                color: check.status === 'unknown' ? 'text.secondary' : undefined,
+                                                                children: [
+                                                                    check.label,
+                                                                    check.status === 'unknown' ? ' — not checked' : ''
+                                                                ]
+                                                            }),
+                                                            check.detail ? /*#__PURE__*/ _jsx(Typography, {
+                                                                variant: "caption",
+                                                                color: "text.secondary",
+                                                                children: check.detail
+                                                            }) : null
+                                                        ]
+                                                    }),
+                                                    ((_findingsByCheck_get = findingsByCheck.get(check.id)) != null ? _findingsByCheck_get : []).map((problem, index)=>/*#__PURE__*/ _jsx(Alert, {
+                                                            severity: problem.level === 'error' ? 'error' : 'warning',
+                                                            sx: {
+                                                                ml: 3
+                                                            },
+                                                            children: problem.message
+                                                        }, `${check.id}-${index}`))
+                                                ]
+                                            }, check.id);
+                                        }),
+                                        untaggedFindings.map((problem, index)=>/*#__PURE__*/ _jsx(Alert, {
+                                                severity: problem.level === 'error' ? 'error' : 'warning',
+                                                children: problem.message
+                                            }, `untagged-${index}`)),
+                                        checks.length ? /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: 'A full column of ticks means these shapes were ' + 'not found in code the parser could read. It is ' + 'not a statement that the plugin is safe — that ' + 'is the checklist below.'
+                                        }) : null
+                                    ]
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: `Publisher attestation — v${detail.reviewVersion} (${detail.attestation.length}/${PUBLISHER_ATTESTATION.length})`,
+                        help: pluginDocsHelp('publisherHandbook', {
+                            anchor: '#the-two-badges-and-what-each-one-promises',
+                            excerpt: 'What the publisher asserted about THIS version. Their claim, not ' + 'our finding — the checklist below is ours.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: detail.attestedBy ? `Stated by ${detail.attestedBy}${detail.attestedAt ? ` on ${new Date(detail.attestedAt).toLocaleDateString()}` : ''}, against this version's exact bytes.` : 'Nothing recorded for these bytes.'
+                                }),
+                                detail.attestation.length ? null : /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "info",
+                                    children: 'Published before publishers were asked to attest, or ' + 'republished since. Check everything yourself — the ' + 'absence of a claim is not a claim.'
+                                }),
+                                PUBLISHER_ATTESTATION.map((item)=>{
+                                    const claimed = detail.attestation.includes(item.id);
+                                    return /*#__PURE__*/ _jsx(Stack, {
+                                        spacing: 0.25,
+                                        children: /*#__PURE__*/ _jsxs(Stack, {
+                                            direction: "row",
+                                            spacing: 1,
+                                            sx: {
+                                                alignItems: 'center',
+                                                flexWrap: 'wrap'
+                                            },
+                                            children: [
+                                                /*#__PURE__*/ _jsxs(Typography, {
+                                                    variant: "body2",
+                                                    color: claimed ? undefined : 'text.secondary',
+                                                    children: [
+                                                        claimed ? '✓' : '—',
+                                                        " ",
+                                                        item.label
+                                                    ]
+                                                }),
+                                                item.updateOnly ? /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    variant: "outlined",
+                                                    label: "Updates only"
+                                                }) : null
+                                            ]
+                                        })
+                                    }, item.id);
+                                }),
+                                /*#__PURE__*/ _jsx(Divider, {
+                                    sx: {
+                                        my: 1
+                                    }
+                                }),
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: ((_detail_publisherAgreement = detail.publisherAgreement) == null ? void 0 : _detail_publisherAgreement.state) === 'current' ? `Publisher agreement v${detail.publisherAgreement.version} accepted` + (detail.publisherAgreement.acceptedAt ? ` on ${new Date(detail.publisherAgreement.acceptedAt).toLocaleDateString()}` : '') + '.' : ((_detail_publisherAgreement1 = detail.publisherAgreement) == null ? void 0 : _detail_publisherAgreement1.state) === 'outdated' ? `Publisher agreement: on v${detail.publisherAgreement.version}, ` + `current is v${detail.publisherAgreement.required}. This ` + 'version was published under the older terms.' : 'No publisher agreement on record — this org ' + 'published before one existed. Weigh a takedown ' + 'against the Terms of Service, not against terms ' + 'nobody accepted.'
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: `Review checklist — v${detail.reviewVersion} (${PLUGIN_REVIEW_CHECKLIST.filter((item)=>{
+                            var _detail_checklist;
+                            return (_detail_checklist = detail.checklist) == null ? void 0 : _detail_checklist[item.id];
+                        }).length}/${PLUGIN_REVIEW_CHECKLIST.length})`,
+                        help: pluginDocsHelp('publisherHandbook', {
+                            anchor: '#review-what-happens-after-you-publish',
+                            excerpt: 'The checklist a reviewer works through. Re-earned per version — a ' + 'new release starts with none of it ticked.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: 'The static verifier is a lint, not a boundary — it ' + 'parses the bundle and reports shapes (computed access ' + 'on a global, undeclared network calls), but it cannot ' + 'judge what the code is for, and code it cannot see ' + 'through it says nothing about. These are the checks ' + 'only a person can make. Ticks are recorded against ' + "this version's exact bytes and reset if it is " + 'republished.'
+                                }),
+                                detail.checklistOutstanding.length ? /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "info",
+                                    children: `${detail.checklistOutstanding.length} required item(s) outstanding — List and Verify stay blocked until they are done. Rejecting never needs the checklist.`
+                                }) : /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "success",
+                                    children: 'Every required item is recorded for these bytes.'
+                                }),
+                                PLUGIN_REVIEW_CHECKLIST.map((item)=>{
+                                    var _detail_checklist;
+                                    return /*#__PURE__*/ _jsxs(Stack, {
+                                        spacing: 0.25,
+                                        sx: {
+                                            pl: 0.5
+                                        },
+                                        children: [
+                                            /*#__PURE__*/ _jsx(FormControlLabel, {
+                                                control: /*#__PURE__*/ _jsx(Checkbox, {
+                                                    size: "small",
+                                                    checked: Boolean((_detail_checklist = detail.checklist) == null ? void 0 : _detail_checklist[item.id]),
+                                                    disabled: busy,
+                                                    onChange: (event)=>void post({
+                                                            action: 'checklist',
+                                                            version: detail.reviewVersion,
+                                                            itemId: item.id,
+                                                            checked: event.target.checked
+                                                        }, event.target.checked ? 'Recorded' : 'Cleared')
+                                                }),
+                                                label: /*#__PURE__*/ _jsxs(Stack, {
+                                                    direction: "row",
+                                                    spacing: 1,
+                                                    sx: {
+                                                        alignItems: 'center',
+                                                        flexWrap: 'wrap'
+                                                    },
+                                                    children: [
+                                                        /*#__PURE__*/ _jsx(Typography, {
+                                                            variant: "body2",
+                                                            children: item.label
+                                                        }),
+                                                        item.required ? /*#__PURE__*/ _jsx(Chip, {
+                                                            size: "small",
+                                                            label: "Required"
+                                                        }) : null,
+                                                        item.realmOnly ? /*#__PURE__*/ _jsx(Chip, {
+                                                            size: "small",
+                                                            variant: "outlined",
+                                                            label: "Realm trust"
+                                                        }) : null
+                                                    ]
+                                                })
+                                            }),
+                                            /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "caption",
+                                                color: "text.secondary",
+                                                sx: {
+                                                    pl: 4
+                                                },
+                                                children: item.detail
+                                            }),
+                                            (()=>{
+                                                const link = checklistLink(item.id);
+                                                // The stored object sits beside what it serves
+                                                // (AGL-990) — read the code, then inspect the bytes.
+                                                const bucket = item.id === 'source-read' && detail ? bucketUrl(detail.reviewVersion) : null;
+                                                if (!link && !bucket) return null;
+                                                // External targets (the raw bundle, the publisher's
+                                                // repo) are plain anchors on purpose; internal ones
+                                                // go through AppLink so the SPA does not full-reload.
+                                                return /*#__PURE__*/ _jsxs(Stack, {
+                                                    direction: "row",
+                                                    spacing: 2,
+                                                    sx: {
+                                                        pl: 4,
+                                                        flexWrap: 'wrap'
+                                                    },
+                                                    children: [
+                                                        link ? /*#__PURE__*/ _jsx(Typography, {
+                                                            variant: "caption",
+                                                            children: link.external ? /*#__PURE__*/ _jsx(MuiLink, {
+                                                                href: link.href,
+                                                                target: "_blank",
+                                                                rel: "noopener noreferrer",
+                                                                children: `${link.label} ↗`
+                                                            }) : /*#__PURE__*/ _jsx(AppLink, {
+                                                                href: link.href,
+                                                                children: link.label
+                                                            })
+                                                        }) : null,
+                                                        bucket ? /*#__PURE__*/ _jsx(Typography, {
+                                                            variant: "caption",
+                                                            children: /*#__PURE__*/ _jsx(MuiLink, {
+                                                                href: bucket,
+                                                                target: "_blank",
+                                                                rel: "noopener noreferrer",
+                                                                children: 'Object in Cloud Storage ↗'
+                                                            })
+                                                        }) : null
+                                                    ]
+                                                });
+                                            })()
+                                        ]
+                                    }, item.id);
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Review verdict",
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        help: pluginDocsHelp('manifestAndEnvs', {
+                            anchor: '#review--trust-lifecycle',
+                            excerpt: 'Move this submission through the review lifecycle — list, verify, or reject with a reason.'
+                        }),
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 2,
+                            children: [
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 0.5,
+                                    children: [
+                                        /*#__PURE__*/ _jsxs(Stack, {
+                                            direction: "row",
+                                            spacing: 1,
+                                            sx: {
+                                                alignItems: 'center',
+                                                flexWrap: 'wrap'
+                                            },
+                                            children: [
+                                                /*#__PURE__*/ _jsx(Typography, {
+                                                    variant: "body2",
+                                                    children: 'Currently:'
+                                                }),
+                                                /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    color: status.color,
+                                                    label: status.label
+                                                }),
+                                                status.live ? /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    color: "warning",
+                                                    label: "Live to customers"
+                                                }) : /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    variant: "outlined",
+                                                    label: "Not installable"
+                                                })
+                                            ]
+                                        }),
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: status.meaning
+                                        })
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Divider, {}),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 0.5,
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "subtitle2",
+                                            children: `Verdict on v${detail.reviewVersion}`
+                                        }),
+                                        /*#__PURE__*/ _jsxs(Stack, {
+                                            direction: "row",
+                                            spacing: 1,
+                                            sx: {
+                                                alignItems: 'center',
+                                                flexWrap: 'wrap'
+                                            },
+                                            children: [
+                                                /*#__PURE__*/ _jsx(TextField, {
+                                                    size: "small",
+                                                    select: true,
+                                                    value: detail.reviewVersion,
+                                                    onChange: (event)=>setSelectedVersion(event.target.value),
+                                                    sx: {
+                                                        minWidth: 160
+                                                    },
+                                                    children: detail.versions.map((entry)=>/*#__PURE__*/ _jsx(MenuItem, {
+                                                            value: entry.version,
+                                                            children: `v${entry.version} · ${entry.reviewState}`
+                                                        }, entry.version))
+                                                }),
+                                                /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    variant: "contained",
+                                                    color: "success",
+                                                    disabled: busy || blocked,
+                                                    onClick: ()=>void post({
+                                                            action: 'approve-version',
+                                                            version: detail.reviewVersion
+                                                        }, `v${detail.reviewVersion} approved`),
+                                                    children: 'Approve version'
+                                                }),
+                                                /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    color: "error",
+                                                    disabled: busy,
+                                                    onClick: ()=>void post({
+                                                            action: 'reject-version',
+                                                            version: detail.reviewVersion,
+                                                            reason
+                                                        }, `v${detail.reviewVersion} rejected`),
+                                                    children: 'Reject version'
+                                                })
+                                            ]
+                                        }),
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: 'Approving makes these bytes the version new ' + 'installs receive. Existing installs are pinned and ' + 'do not move. A pending version is never installed ' + 'by anyone but its publisher, so an update cannot ' + 'ship past review.'
+                                        }),
+                                        blocked ? /*#__PURE__*/ _jsx(Alert, {
+                                            severity: "info",
+                                            sx: {
+                                                mt: 0.5
+                                            },
+                                            children: `Blocked: ${detail.checklistOutstanding.length} required checklist item(s) outstanding for these bytes.`
+                                        }) : null,
+                                        liveOnReviewVersion > 0 ? /*#__PURE__*/ _jsx(Alert, {
+                                            severity: (reviewEntry == null ? void 0 : reviewEntry.revoked) ? 'success' : 'warning',
+                                            sx: {
+                                                mt: 0.5
+                                            },
+                                            action: /*#__PURE__*/ _jsx(Button, {
+                                                size: "small",
+                                                color: "inherit",
+                                                disabled: busy,
+                                                onClick: ()=>void setVersionRevoked(detail.reviewVersion, !(reviewEntry == null ? void 0 : reviewEntry.revoked)),
+                                                children: (reviewEntry == null ? void 0 : reviewEntry.revoked) ? 'Allow again' : 'Stop these bytes'
+                                            }),
+                                            children: (reviewEntry == null ? void 0 : reviewEntry.revoked) ? `v${detail.reviewVersion} is stopped. The ` + `${liveOnReviewVersion} site${liveOnReviewVersion === 1 ? ' pinned to it renders' : 's pinned to it render'} a placeholder instead.` : `${liveOnReviewVersion} site${liveOnReviewVersion === 1 ? ' is' : 's are'} running v${detail.reviewVersion} right now. ` + 'Rejecting it stops new installs but leaves ' + 'those running — stop the bytes if they should ' + 'not be executing.'
+                                        }) : null
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Divider, {}),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 0.5,
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "subtitle2",
+                                            children: 'Marketplace listing'
+                                        }),
+                                        /*#__PURE__*/ _jsxs(Stack, {
+                                            direction: "row",
+                                            spacing: 1,
+                                            sx: {
+                                                alignItems: 'center',
+                                                flexWrap: 'wrap'
+                                            },
+                                            children: [
+                                                ![
+                                                    'listed',
+                                                    'verified'
+                                                ].includes(detail.reviewStatus) ? /*#__PURE__*/ _jsx(Tooltip, {
+                                                    title: blocked ? `Complete the review checklist first — ` + `${detail.checklistOutstanding.length} required ` + `item(s) outstanding for this version's bytes` : 'Makes this plugin browsable in the ' + 'marketplace and installable by every ' + 'workspace. This is the step that puts the ' + 'code in front of customers.',
+                                                    children: /*#__PURE__*/ _jsx("span", {
+                                                        children: /*#__PURE__*/ _jsx(Button, {
+                                                            size: "small",
+                                                            color: "warning",
+                                                            variant: "outlined",
+                                                            disabled: busy || blocked,
+                                                            onClick: ()=>void post({
+                                                                    action: 'list'
+                                                                }, 'Listed — installable by every workspace'),
+                                                            children: 'List in marketplace'
+                                                        })
+                                                    })
+                                                }) : null,
+                                                detail.reviewStatus === 'submitted' ? /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    variant: "outlined",
+                                                    disabled: busy,
+                                                    onClick: ()=>void post({
+                                                            action: 'start-review'
+                                                        }, 'Marked in review'),
+                                                    children: 'Start review'
+                                                }) : null,
+                                                detail.reviewStatus !== 'verified' ? // Say WHY it is disabled, at the button (AGL-1121).
+                                                // The checklist alert lives elsewhere on the page, so
+                                                // a reviewer met a greyed-out control with no stated
+                                                // cause and reasonably read it as broken. The tooltip
+                                                // names the count and where to clear it; a disabled
+                                                // MUI Button swallows pointer events, so the wrapper
+                                                // is what the tooltip can attach to.
+                                                /*#__PURE__*/ _jsx(Tooltip, {
+                                                    title: blocked ? `Complete the review checklist first — ` + `${detail.checklistOutstanding.length} required ` + `item(s) outstanding for this version's bytes` : '',
+                                                    children: /*#__PURE__*/ _jsx("span", {
+                                                        children: /*#__PURE__*/ _jsx(Button, {
+                                                            size: "small",
+                                                            color: "success",
+                                                            variant: "outlined",
+                                                            disabled: busy || blocked,
+                                                            onClick: ()=>void post({
+                                                                    action: 'verify'
+                                                                }, 'Verified'),
+                                                            children: 'Verify ✓ (badge)'
+                                                        })
+                                                    })
+                                                }) : null,
+                                                ((_detail_verificationRequest = detail.verificationRequest) == null ? void 0 : _detail_verificationRequest.declineReason) ? /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    color: "warning",
+                                                    variant: "outlined",
+                                                    sx: {
+                                                        maxWidth: 420
+                                                    },
+                                                    label: `Previously declined: ${detail.verificationRequest.declineReason}`
+                                                }) : null,
+                                                ((_detail_verificationRequest1 = detail.verificationRequest) == null ? void 0 : _detail_verificationRequest1.state) === 'pending' ? /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    color: "warning",
+                                                    variant: "outlined",
+                                                    disabled: busy,
+                                                    onClick: ()=>{
+                                                        const reason = window.prompt('Why is verification declined? The publisher is ' + 'told this, and cannot ask again for 30 days.');
+                                                        // `prompt` returns null on cancel and '' on an
+                                                        // empty submit. Neither is a decline — the server
+                                                        // requires a reason, and sending one anyway would
+                                                        // surface as an error the reviewer did not cause.
+                                                        if (!(reason == null ? void 0 : reason.trim())) return;
+                                                        void post({
+                                                            action: 'decline-verification',
+                                                            reason
+                                                        }, 'Verification declined');
+                                                    },
+                                                    children: 'Decline verification'
+                                                }) : null,
+                                                detail.private ? /*#__PURE__*/ _jsx(Chip, {
+                                                    size: "small",
+                                                    label: "Private — never listed"
+                                                }) : null
+                                            ]
+                                        })
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Divider, {}),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    spacing: 0.5,
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "subtitle2",
+                                            children: 'Step back'
+                                        }),
+                                        /*#__PURE__*/ _jsxs(Stack, {
+                                            direction: "row",
+                                            spacing: 1,
+                                            sx: {
+                                                alignItems: 'center',
+                                                flexWrap: 'wrap'
+                                            },
+                                            children: [
+                                                /*#__PURE__*/ _jsxs(TextField, {
+                                                    select: true,
+                                                    size: "small",
+                                                    label: "Rejection reason",
+                                                    value: rejectCategory,
+                                                    onChange: (event)=>setRejectCategory(event.target.value),
+                                                    // `displayEmpty` is not enough on a MUI Select: an
+                                                    // empty value renders NOTHING without a rendered
+                                                    // option, so the field reads as broken.
+                                                    slotProps: {
+                                                        select: {
+                                                            displayEmpty: true
+                                                        },
+                                                        inputLabel: {
+                                                            shrink: true
+                                                        }
+                                                    },
+                                                    sx: {
+                                                        minWidth: 260
+                                                    },
+                                                    children: [
+                                                        /*#__PURE__*/ _jsx(MenuItem, {
+                                                            value: "",
+                                                            children: 'Select a reason…'
+                                                        }),
+                                                        PLUGIN_REJECTION_CATEGORIES.map((entry)=>/*#__PURE__*/ _jsx(MenuItem, {
+                                                                value: entry.id,
+                                                                children: entry.label
+                                                            }, entry.id))
+                                                    ]
+                                                }),
+                                                /*#__PURE__*/ _jsx(TextField, {
+                                                    size: "small",
+                                                    placeholder: rejectCategoryNeedsComment ? 'Comment (required for “Other”)' : 'Comment (optional)',
+                                                    value: reason,
+                                                    onChange: (event)=>setReason(event.target.value),
+                                                    sx: {
+                                                        minWidth: 260
+                                                    }
+                                                }),
+                                                status.live ? /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    color: "warning",
+                                                    disabled: busy,
+                                                    onClick: ()=>void post({
+                                                            action: 'delist',
+                                                            reason
+                                                        }, 'Delisted — back in review'),
+                                                    children: 'Delist'
+                                                }) : null,
+                                                detail.reviewStatus === 'verified' ? /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    disabled: busy,
+                                                    onClick: ()=>void post({
+                                                            action: 'unverify'
+                                                        }, 'Badge removed'),
+                                                    children: 'Unverify'
+                                                }) : null,
+                                                /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    color: "error",
+                                                    // Disabled rather than left to fail server-side: the
+                                                    // route validates too, but a reviewer should not have
+                                                    // to press a button to learn the form is incomplete.
+                                                    disabled: busy || Boolean(rejectBlocked),
+                                                    onClick: ()=>void post({
+                                                            action: 'reject',
+                                                            reason,
+                                                            category: rejectCategory
+                                                        }, 'Rejected'),
+                                                    children: 'Reject'
+                                                })
+                                            ]
+                                        }),
+                                        rejectBlocked ? /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: rejectBlocked
+                                        }) : null,
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: 'Delist pulls it from the marketplace and blocks new ' + 'installs; existing installs keep working. Unverify ' + 'only drops the badge. Reject notifies the publisher. ' + 'None of these stop code already running — that is ' + 'the danger zone.'
+                                        })
+                                    ]
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Versions",
+                        help: pluginDocsHelp('publisherHandbook', {
+                            anchor: '#versioning--updates',
+                            excerpt: 'Every version this publisher has submitted. Review lives on the ' + 'VERSION, so each one is judged on its own.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: 'Granting realm trust signs a version to run inside ' + 'the app realm instead of the sandbox iframe. ' + 'Super-staff only, audited.'
+                                }),
+                                /*#__PURE__*/ _jsx(Alert, {
+                                    severity: "info",
+                                    children: 'This is a different axis from the review verdict above. ' + 'Listing and verifying apply to the whole listing and ' + 'decide who may install it. Trust applies to ONE ' + 'version and decides where its code runs: sandboxed in ' + 'a cross-origin iframe capped by the manifest CSP, or ' + 'inside the app realm with neither of those between it ' + 'and user data. A verified plugin can be sandboxed, and ' + 'a sandboxed version of a verified plugin is the normal ' + 'case — realm trust is the exception that needs a ' + 'reason.'
+                                }),
+                                detail.versions.map((entry)=>{
+                                    var _superGate_reason;
+                                    return /*#__PURE__*/ _jsxs(Stack, {
+                                        direction: "row",
+                                        spacing: 1,
+                                        sx: {
+                                            alignItems: 'center',
+                                            flexWrap: 'wrap'
+                                        },
+                                        children: [
+                                            /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "body2",
+                                                sx: {
+                                                    minWidth: 64
+                                                },
+                                                children: `v${entry.version}`
+                                            }),
+                                            entry.version === detail.latestVersion ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                label: "Latest"
+                                            }) : null,
+                                            /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: entry.reviewState === 'approved' ? 'success' : entry.reviewState === 'rejected' ? 'error' : 'warning',
+                                                variant: "outlined",
+                                                label: entry.grandfathered ? 'approved (grandfathered)' : entry.reviewState
+                                            }),
+                                            /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: entry.trust === 'realm' ? 'success' : 'default',
+                                                variant: entry.trust === 'realm' ? 'filled' : 'outlined',
+                                                label: entry.trust === 'realm' ? 'Realm-trusted' : 'Sandboxed'
+                                            }),
+                                            entry.revoked ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: "error",
+                                                label: "Stopped"
+                                            }) : entry.reviewState === 'rejected' && entry.activeInstalls > 0 ? /*#__PURE__*/ _jsx(Chip, {
+                                                size: "small",
+                                                color: "error",
+                                                variant: "outlined",
+                                                label: "Rejected but still running"
+                                            }) : null,
+                                            /*#__PURE__*/ _jsxs(Typography, {
+                                                variant: "caption",
+                                                color: "text.secondary",
+                                                children: [
+                                                    entry.publishedAt ? new Date(entry.publishedAt).toLocaleDateString() : '—',
+                                                    ` · ${entry.sha256.slice(0, 12)}`,
+                                                    entry.activeInstalls ? ` · ${entry.activeInstalls} pinned here` : ''
+                                                ]
+                                            }),
+                                            /*#__PURE__*/ _jsx(BlockedControl, {
+                                                blocked: superGate.blocked,
+                                                reason: (_superGate_reason = superGate.reason) != null ? _superGate_reason : SUPER_STAFF_ONLY_REASON,
+                                                children: /*#__PURE__*/ _jsx(Button, {
+                                                    size: "small",
+                                                    color: entry.trust === 'realm' ? 'error' : 'success',
+                                                    disabled: busy,
+                                                    onClick: ()=>void signRealm(entry.version, entry.trust === 'realm' ? 'revoke' : 'grant'),
+                                                    children: entry.trust === 'realm' ? 'Revoke realm trust' : 'Grant realm trust'
+                                                })
+                                            }),
+                                            /*#__PURE__*/ _jsx(Button, {
+                                                size: "small",
+                                                color: entry.revoked ? 'success' : 'error',
+                                                disabled: busy,
+                                                onClick: ()=>void setVersionRevoked(entry.version, !entry.revoked),
+                                                children: entry.revoked ? 'Allow again' : 'Stop this version'
+                                            })
+                                        ]
+                                    }, entry.version);
+                                })
+                            ]
+                        })
+                    }),
+                    /*#__PURE__*/ _jsx(CardDisplay, {
+                        header: "Danger zone",
+                        help: pluginDocsHelp('publisherHandbook', {
+                            anchor: '#review-what-happens-after-you-publish',
+                            excerpt: 'Rejecting a version is not a kill switch — it stops new installs ' + 'and leaves existing ones running.'
+                        }),
+                        contentGutterX: true,
+                        contentGutterY: true,
+                        children: /*#__PURE__*/ _jsxs(Stack, {
+                            spacing: 1.5,
+                            children: [
+                                /*#__PURE__*/ _jsx(Typography, {
+                                    variant: "body2",
+                                    color: "text.secondary",
+                                    children: 'Taking a plugin down de-lists it AND writes the kill ' + 'switch: every workspace that already installed it ' + 'stops loading it on the next render, and new ' + 'installs are refused. Restoring clears both.'
+                                }),
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    direction: "row",
+                                    spacing: 1,
+                                    sx: {
+                                        alignItems: 'center',
+                                        flexWrap: 'wrap'
+                                    },
+                                    children: [
+                                        detail.hidden ? null : /*#__PURE__*/ _jsx(TextField, {
+                                            size: "small",
+                                            placeholder: "Takedown reason",
+                                            value: takedownReason,
+                                            onChange: (event)=>setTakedownReason(event.target.value),
+                                            sx: {
+                                                minWidth: 260
+                                            }
+                                        }),
+                                        /*#__PURE__*/ _jsx(Button, {
+                                            size: "small",
+                                            variant: detail.hidden ? 'text' : 'outlined',
+                                            color: detail.hidden ? 'success' : 'error',
+                                            disabled: busy,
+                                            onClick: ()=>void takedown(),
+                                            children: detail.hidden ? 'Restore listing' : 'Take down'
+                                        })
+                                    ]
+                                })
+                            ]
+                        })
+                    })
+                ]
+            })
+        ]
+    });
+}
+export default PluginReviewDetail;
+
+//# sourceMappingURL=plugin-review-detail.component.js.map