@aglyn/plugins-marketplace 1.0.0-beta.151 → 1.0.0-beta.152

package/src/lib/server/admin-trust.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Staff trust-signing for realm plugins (AGL-420), served at
+ * `/api/marketplace/admin/trust` for this plugin's review queue.
+ *
+ * It was `apps/console/app/api/admin/sign-plugin/route.ts` until AGL-3080.
+ * What moved is everything that is the MARKETPLACE's: `marketplaceListings`
+ * is its collection, "a version must have passed review" is its rule, and
+ * the fields a grant writes are its documents.
+ *
+ * ⛔ WHAT DID NOT MOVE IS THE KEY. `PLUGIN_TRUST_PRIVATE_KEY` is deployed to
+ * the console and nowhere else — never to a tenant runtime — and this
+ * package is published to npm, where a self-hoster generates their own
+ * pair. So the signature comes from the shell through
+ * `signPluginTrust`, and this route refuses the grant outright when it
+ * answers `signed: false`. A `trust: 'realm'` flag written without a
+ * signature beside it is the one state the loaders cannot tell from
+ * tampering.
+ *
+ * Granting writes
+ * `{trust: 'realm', signature}` onto the listing's version doc, where the
+ * signature is the platform Ed25519 key's signature over the version's
+ * sha256 hex — the loaders (client blob-import + env-gated server import)
+ * verify it against `PLUGIN_TRUST_PUBLIC_KEY` before a byte executes.
+ * Super staff only: a realm grant lets marketplace code run in the app
+ * realm of every workspace that installs it, the largest blast radius any
+ * staff action has. Revoking removes the grant (already-loaded realms
+ * pick it up on next load; use `revocations/{listingId}` for the hard
+ * kill switch).
+ *
+ * `PLUGIN_TRUST_PRIVATE_KEY` is the base64 PKCS8 DER Ed25519 private key
+ * (pair generated by `tools/scripts/generate-plugin-trust-key.mjs`) —
+ * deployed ONLY to the console app, never to tenant runtimes.
+ */
+declare function handler(request: Request): Promise<Response>;
+export { handler as marketplaceAdminTrust };

package/src/lib/server/admin-trust.js

@@ -0,0 +1,190 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { signPluginTrust } from "@aglyn/aglyn/plugin-manager/plugin-trust-signing";
+import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession } from "@aglyn/tenant-data-admin";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { FieldValue } from "firebase-admin/firestore";
+/**
+ * Staff trust-signing for realm plugins (AGL-420), served at
+ * `/api/marketplace/admin/trust` for this plugin's review queue.
+ *
+ * It was `apps/console/app/api/admin/sign-plugin/route.ts` until AGL-3080.
+ * What moved is everything that is the MARKETPLACE's: `marketplaceListings`
+ * is its collection, "a version must have passed review" is its rule, and
+ * the fields a grant writes are its documents.
+ *
+ * ⛔ WHAT DID NOT MOVE IS THE KEY. `PLUGIN_TRUST_PRIVATE_KEY` is deployed to
+ * the console and nowhere else — never to a tenant runtime — and this
+ * package is published to npm, where a self-hoster generates their own
+ * pair. So the signature comes from the shell through
+ * `signPluginTrust`, and this route refuses the grant outright when it
+ * answers `signed: false`. A `trust: 'realm'` flag written without a
+ * signature beside it is the one state the loaders cannot tell from
+ * tampering.
+ *
+ * Granting writes
+ * `{trust: 'realm', signature}` onto the listing's version doc, where the
+ * signature is the platform Ed25519 key's signature over the version's
+ * sha256 hex — the loaders (client blob-import + env-gated server import)
+ * verify it against `PLUGIN_TRUST_PUBLIC_KEY` before a byte executes.
+ * Super staff only: a realm grant lets marketplace code run in the app
+ * realm of every workspace that installs it, the largest blast radius any
+ * staff action has. Revoking removes the grant (already-loaded realms
+ * pick it up on next load; use `revocations/{listingId}` for the hard
+ * kill switch).
+ *
+ * `PLUGIN_TRUST_PRIVATE_KEY` is the base64 PKCS8 DER Ed25519 private key
+ * (pair generated by `tools/scripts/generate-plugin-trust-key.mjs`) —
+ * deployed ONLY to the console app, never to tenant runtimes.
+ */ async function handler(request) {
+    var _headers_authorization;
+    const { method, body, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'POST') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405
+        });
+    }
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return Response.json({
+        error: 'Unauthenticated'
+    }, {
+        status: 401
+    });
+    try {
+        var _decoded_staffRole, _ref, _ref1;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        if (!decoded['staff']) {
+            return Response.json({
+                error: 'Staff only'
+            }, {
+                status: 403
+            });
+        }
+        if (String((_decoded_staffRole = decoded['staffRole']) != null ? _decoded_staffRole : 'support') !== 'super') {
+            return Response.json({
+                error: 'Requires the super staff role'
+            }, {
+                status: 403
+            });
+        }
+        const listingId = String((_ref = body == null ? void 0 : body.listingId) != null ? _ref : '');
+        const version = String((_ref1 = body == null ? void 0 : body.version) != null ? _ref1 : '');
+        const action = (body == null ? void 0 : body.action) === 'revoke' ? 'revoke' : 'grant';
+        if (!listingId || !version) {
+            return Response.json({
+                error: 'Missing listingId or version'
+            }, {
+                status: 400
+            });
+        }
+        const versionRef = firebaseAdmin.app().firestore().collection('marketplaceListings').doc(listingId).collection('pluginVersions').doc(version);
+        const snapshot = await versionRef.get();
+        const sha256 = snapshot.get('sha256');
+        if (typeof sha256 !== 'string' || !sha256) {
+            return Response.json({
+                error: 'Unknown plugin version'
+            }, {
+                status: 404
+            });
+        }
+        // Realm trust is the strongest grant in the platform — it drops a
+        // bundle into the app realm, where the sandbox iframe and the manifest
+        // CSP no longer stand between it and user data. It cannot be granted to
+        // bytes that have not passed review (AGL-966).
+        if (action === 'grant' && snapshot.get('reviewState') !== 'approved') {
+            var _snapshot_get;
+            return Response.json({
+                error: 'That version has not passed review — approve it before granting realm trust',
+                reviewState: (_snapshot_get = snapshot.get('reviewState')) != null ? _snapshot_get : 'unknown'
+            }, {
+                status: 409
+            });
+        }
+        if (action === 'grant') {
+            /*
+       * The shell signs; this decides what is worth signing. A refusal here
+       * is final — nothing is written, and the 501 is the same answer an
+       * unconfigured deployment has always given, now reached through the
+       * contract rather than by reading the key.
+       */ const { signed, signature, reason } = await signPluginTrust(sha256);
+            if (!signed || !signature) {
+                return Response.json({
+                    error: reason != null ? reason : 'Trust signing is not configured (missing PLUGIN_TRUST_PRIVATE_KEY)'
+                }, {
+                    status: 501
+                });
+            }
+            await versionRef.set({
+                trust: 'realm',
+                signature,
+                trustGrantedBy: decoded.uid,
+                trustGrantedAt: FieldValue.serverTimestamp()
+            }, {
+                merge: true
+            });
+        } else {
+            await versionRef.set({
+                trust: FieldValue.delete(),
+                signature: FieldValue.delete(),
+                trustGrantedBy: FieldValue.delete(),
+                trustGrantedAt: FieldValue.delete()
+            }, {
+                merge: true
+            });
+        }
+        await firebaseAdmin.app().firestore().collection('adminAudit').add({
+            actorUid: decoded.uid,
+            action: `plugins.trust.${action}`,
+            target: `marketplaceListings/${listingId}/pluginVersions/${version}`,
+            after: action === 'grant' ? {
+                trust: 'realm'
+            } : {
+                trust: null
+            },
+            at: FieldValue.serverTimestamp()
+        });
+        return Response.json({
+            ok: true,
+            action,
+            listingId,
+            version
+        }, {
+            status: 200
+        });
+    } catch (error) {
+        // An unverifiable credential is a 401, not a fault of ours
+        // (AGL-1993). Null for anything else, so a real failure keeps its 500.
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error(error);
+        return Response.json({
+            error: 'Trust signing failed'
+        }, {
+            status: 500
+        });
+    }
+}
+export { handler as marketplaceAdminTrust };
+
+//# sourceMappingURL=admin-trust.js.map

package/src/lib/server/admin-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/marketplace/src/lib/server/admin-trust.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { pluginRequestFromWeb } from '@aglyn/aglyn/server'\nimport { signPluginTrust } from '@aglyn/aglyn/plugin-manager/plugin-trust-signing'\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n} from '@aglyn/tenant-data-admin'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { FieldValue } from 'firebase-admin/firestore'\n\n/**\n * Staff trust-signing for realm plugins (AGL-420), served at\n * `/api/marketplace/admin/trust` for this plugin's review queue.\n *\n * It was `apps/console/app/api/admin/sign-plugin/route.ts` until AGL-3080.\n * What moved is everything that is the MARKETPLACE's: `marketplaceListings`\n * is its collection, \"a version must have passed review\" is its rule, and\n * the fields a grant writes are its documents.\n *\n * ⛔ WHAT DID NOT MOVE IS THE KEY. `PLUGIN_TRUST_PRIVATE_KEY` is deployed to\n * the console and nowhere else — never to a tenant runtime — and this\n * package is published to npm, where a self-hoster generates their own\n * pair. So the signature comes from the shell through\n * `signPluginTrust`, and this route refuses the grant outright when it\n * answers `signed: false`. A `trust: 'realm'` flag written without a\n * signature beside it is the one state the loaders cannot tell from\n * tampering.\n *\n * Granting writes\n * `{trust: 'realm', signature}` onto the listing's version doc, where the\n * signature is the platform Ed25519 key's signature over the version's\n * sha256 hex — the loaders (client blob-import + env-gated server import)\n * verify it against `PLUGIN_TRUST_PUBLIC_KEY` before a byte executes.\n * Super staff only: a realm grant lets marketplace code run in the app\n * realm of every workspace that installs it, the largest blast radius any\n * staff action has. Revoking removes the grant (already-loaded realms\n * pick it up on next load; use `revocations/{listingId}` for the hard\n * kill switch).\n *\n * `PLUGIN_TRUST_PRIVATE_KEY` is the base64 PKCS8 DER Ed25519 private key\n * (pair generated by `tools/scripts/generate-plugin-trust-key.mjs`) —\n * deployed ONLY to the console app, never to tenant runtimes.\n */\nasync function handler(request: Request): Promise<Response> {\n  const { method, body, headers: rawHeaders } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'POST') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    if (!decoded['staff']) {\n      return Response.json({ error: 'Staff only' }, { status: 403 })\n    }\n    if (String(decoded['staffRole'] ?? 'support') !== 'super') {\n      return Response.json({ error: 'Requires the super staff role' }, { status: 403 })\n    }\n\n    const listingId = String(body?.listingId ?? '')\n    const version = String(body?.version ?? '')\n    const action = body?.action === 'revoke' ? 'revoke' : 'grant'\n    if (!listingId || !version) {\n      return Response.json({ error: 'Missing listingId or version' }, { status: 400 })\n    }\n\n    const versionRef = firebaseAdmin\n      .app()\n      .firestore()\n      .collection('marketplaceListings')\n      .doc(listingId)\n      .collection('pluginVersions')\n      .doc(version)\n    const snapshot = await versionRef.get()\n    const sha256 = snapshot.get('sha256')\n    if (typeof sha256 !== 'string' || !sha256) {\n      return Response.json({ error: 'Unknown plugin version' }, { status: 404 })\n    }\n\n    // Realm trust is the strongest grant in the platform — it drops a\n    // bundle into the app realm, where the sandbox iframe and the manifest\n    // CSP no longer stand between it and user data. It cannot be granted to\n    // bytes that have not passed review (AGL-966).\n    if (action === 'grant' && snapshot.get('reviewState') !== 'approved') {\n      return Response.json(\n        {\n          error:\n            'That version has not passed review — approve it before granting realm trust',\n          reviewState: snapshot.get('reviewState') ?? 'unknown',\n        },\n        { status: 409 },\n      )\n    }\n\n    if (action === 'grant') {\n      /*\n       * The shell signs; this decides what is worth signing. A refusal here\n       * is final — nothing is written, and the 501 is the same answer an\n       * unconfigured deployment has always given, now reached through the\n       * contract rather than by reading the key.\n       */\n      const { signed, signature, reason } = await signPluginTrust(sha256)\n      if (!signed || !signature) {\n        return Response.json(\n          {\n            error:\n              reason ??\n              'Trust signing is not configured (missing PLUGIN_TRUST_PRIVATE_KEY)',\n          },\n          { status: 501 },\n        )\n      }\n      await versionRef.set(\n        {\n          trust: 'realm',\n          signature,\n          trustGrantedBy: decoded.uid,\n          trustGrantedAt: FieldValue.serverTimestamp(),\n        },\n        { merge: true },\n      )\n    } else {\n      await versionRef.set(\n        {\n          trust: FieldValue.delete(),\n          signature: FieldValue.delete(),\n          trustGrantedBy: FieldValue.delete(),\n          trustGrantedAt: FieldValue.delete(),\n        },\n        { merge: true },\n      )\n    }\n\n    await firebaseAdmin\n      .app()\n      .firestore()\n      .collection('adminAudit')\n      .add({\n        actorUid: decoded.uid,\n        action: `plugins.trust.${action}`,\n        target: `marketplaceListings/${listingId}/pluginVersions/${version}`,\n        after: action === 'grant' ? { trust: 'realm' } : { trust: null },\n        at: FieldValue.serverTimestamp(),\n      })\n\n    return Response.json({ ok: true, action, listingId, version }, { status: 200 })\n  } catch (error) {\n    // An unverifiable credential is a 401, not a fault of ours\n    // (AGL-1993). Null for anything else, so a real failure keeps its 500.\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    console.error(error)\n    return Response.json({ error: 'Trust signing failed' }, { status: 500 })\n  }\n}\n\nexport { handler as marketplaceAdminTrust }\n"],"names":["pluginRequestFromWeb","signPluginTrust","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","invalidIdTokenResponse","FieldValue","handler","request","headers","method","body","rawHeaders","Response","json","error","status","authorization","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","email_verified","String","listingId","version","action","versionRef","firestore","collection","doc","snapshot","get","sha256","reviewState","signed","signature","reason","set","trust","trustGrantedBy","uid","trustGrantedAt","serverTimestamp","merge","delete","add","actorUid","target","after","at","ok","unauthenticated","console","marketplaceAdminTrust"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,sBAAqB;AAC1D,SAASC,eAAe,QAAQ,mDAAkD;AAClF,SACEC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SAASC,UAAU,QAAQ,2BAA0B;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GACD,eAAeC,QAAQC,OAAgB;QAMfC;IALtB,MAAM,EAAEC,MAAM,EAAEC,IAAI,EAAEF,SAASG,UAAU,EAAE,GAAG,MAAMZ,qBAAqBQ;IACzE,MAAMC,UAAUG;IAChB,IAAIF,WAAW,QAAQ;QACrB,OAAOG,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,MAAMC,iBAAgBR,yBAAAA,QAAQQ,aAAa,YAArBR,yBAAyB;IAC/C,MAAMS,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcG,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOL,SAASC,IAAI,CAAC;QAAEC,OAAO;IAAkB,GAAG;QAAEC,QAAQ;IAAI;IAE/E,IAAI;YAQSO;QAPX,MAAMA,UAAU,MAAMpB,cAAcqB,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;QAC/D,IAAI,CAACK,QAAQI,cAAc,IAAI,CAACvB,uBAAuBmB,UAAU;YAC/D,OAAOrB;QACT;QACA,IAAI,CAACqB,OAAO,CAAC,QAAQ,EAAE;YACrB,OAAOV,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAa,GAAG;gBAAEC,QAAQ;YAAI;QAC9D;QACA,IAAIY,QAAOL,qBAAAA,OAAO,CAAC,YAAY,YAApBA,qBAAwB,eAAe,SAAS;YACzD,OAAOV,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAgC,GAAG;gBAAEC,QAAQ;YAAI;QACjF;QAEA,MAAMa,YAAYD,eAAOjB,wBAAAA,KAAMkB,SAAS,mBAAI;QAC5C,MAAMC,UAAUF,gBAAOjB,wBAAAA,KAAMmB,OAAO,oBAAI;QACxC,MAAMC,SAASpB,CAAAA,wBAAAA,KAAMoB,MAAM,MAAK,WAAW,WAAW;QACtD,IAAI,CAACF,aAAa,CAACC,SAAS;YAC1B,OAAOjB,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAA+B,GAAG;gBAAEC,QAAQ;YAAI;QAChF;QAEA,MAAMgB,aAAa7B,cAChBqB,GAAG,GACHS,SAAS,GACTC,UAAU,CAAC,uBACXC,GAAG,CAACN,WACJK,UAAU,CAAC,kBACXC,GAAG,CAACL;QACP,MAAMM,WAAW,MAAMJ,WAAWK,GAAG;QACrC,MAAMC,SAASF,SAASC,GAAG,CAAC;QAC5B,IAAI,OAAOC,WAAW,YAAY,CAACA,QAAQ;YACzC,OAAOzB,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAyB,GAAG;gBAAEC,QAAQ;YAAI;QAC1E;QAEA,kEAAkE;QAClE,uEAAuE;QACvE,wEAAwE;QACxE,+CAA+C;QAC/C,IAAIe,WAAW,WAAWK,SAASC,GAAG,CAAC,mBAAmB,YAAY;gBAKnDD;YAJjB,OAAOvB,SAASC,IAAI,CAClB;gBACEC,OACE;gBACFwB,WAAW,GAAEH,gBAAAA,SAASC,GAAG,CAAC,0BAAbD,gBAA+B;YAC9C,GACA;gBAAEpB,QAAQ;YAAI;QAElB;QAEA,IAAIe,WAAW,SAAS;YACtB;;;;;OAKC,GACD,MAAM,EAAES,MAAM,EAAEC,SAAS,EAAEC,MAAM,EAAE,GAAG,MAAMzC,gBAAgBqC;YAC5D,IAAI,CAACE,UAAU,CAACC,WAAW;gBACzB,OAAO5B,SAASC,IAAI,CAClB;oBACEC,KAAK,EACH2B,iBAAAA,SACA;gBACJ,GACA;oBAAE1B,QAAQ;gBAAI;YAElB;YACA,MAAMgB,WAAWW,GAAG,CAClB;gBACEC,OAAO;gBACPH;gBACAI,gBAAgBtB,QAAQuB,GAAG;gBAC3BC,gBAAgBzC,WAAW0C,eAAe;YAC5C,GACA;gBAAEC,OAAO;YAAK;QAElB,OAAO;YACL,MAAMjB,WAAWW,GAAG,CAClB;gBACEC,OAAOtC,WAAW4C,MAAM;gBACxBT,WAAWnC,WAAW4C,MAAM;gBAC5BL,gBAAgBvC,WAAW4C,MAAM;gBACjCH,gBAAgBzC,WAAW4C,MAAM;YACnC,GACA;gBAAED,OAAO;YAAK;QAElB;QAEA,MAAM9C,cACHqB,GAAG,GACHS,SAAS,GACTC,UAAU,CAAC,cACXiB,GAAG,CAAC;YACHC,UAAU7B,QAAQuB,GAAG;YACrBf,QAAQ,CAAC,cAAc,EAAEA,QAAQ;YACjCsB,QAAQ,CAAC,oBAAoB,EAAExB,UAAU,gBAAgB,EAAEC,SAAS;YACpEwB,OAAOvB,WAAW,UAAU;gBAAEa,OAAO;YAAQ,IAAI;gBAAEA,OAAO;YAAK;YAC/DW,IAAIjD,WAAW0C,eAAe;QAChC;QAEF,OAAOnC,SAASC,IAAI,CAAC;YAAE0C,IAAI;YAAMzB;YAAQF;YAAWC;QAAQ,GAAG;YAAEd,QAAQ;QAAI;IAC/E,EAAE,OAAOD,OAAO;QACd,2DAA2D;QAC3D,uEAAuE;QACvE,MAAM0C,kBAAkBpD,uBAAuBU;QAC/C,IAAI0C,iBAAiB,OAAOA;QAC5BC,QAAQ3C,KAAK,CAACA;QACd,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAuB,GAAG;YAAEC,QAAQ;QAAI;IACxE;AACF;AAEA,SAAST,WAAWoD,qBAAqB,GAAE"}

package/src/lib/server.js

@@ -37,6 +37,7 @@ import { previewImageHandler } from "./server/preview-image.js";
 import { publishHandler } from "./server/publish.js";
 import { marketplaceAdminReports } from "./server/admin-reports.js";
 import { marketplaceAdminReviews } from "./server/admin-reviews.js";
+import { marketplaceAdminTrust } from "./server/admin-trust.js";
 import { reportHandler } from "./server/report.js";
 import { reviewsHandler } from "./server/reviews.js";
 import { publisherProfileSaveHandler } from "./server/publisher-profile-save.js";
@@ -124,6 +125,12 @@ import { updateArtifactHandler } from "./server/update-artifact.js";
     registerPluginApiRoute('marketplace/admin/reviews', {
         web: marketplaceAdminReviews
     });
+    // Realm trust (AGL-420, moved by AGL-3080). Super-staff only, and the
+    // SIGNATURE comes from the shell — the key is the console's and stays
+    // there. See `server/admin-trust.ts`.
+    registerPluginApiRoute('marketplace/admin/trust', {
+        web: marketplaceAdminTrust
+    });
     registerPluginApiRoute('marketplace/reviews', reviewsHandler);
     registerPluginApiRoute('marketplace/publisher-profile', publisherProfileSaveHandler);
     registerPluginApiRoute('marketplace/verification-request', verificationRequestHandler);

package/src/lib/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/marketplace/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerPluginApiRoute,\n  registerCustomFieldType,\n} from '@aglyn/aglyn/server'\n// Its own subpath, never the plugin-manager barrel: what a published page\n// does not need, it must not import.\nimport { registerPluginRouteMetadata } from '@aglyn/aglyn/plugin-manager/plugin-route-metadata'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { marketplaceBillingWebhookHandler } from './server/billing-webhook'\nimport { publishPluginHandler } from './server/publish-plugin'\nimport { verificationRequestHandler } from './server/verification-request'\nimport { checkoutHandler } from './server/checkout'\nimport { connectHandler } from './server/connect'\nimport { installHandler } from './server/install'\nimport { installPluginHandler } from './server/install-plugin'\nimport { listingVersionsHandler } from './server/listing-versions'\nimport { RATING_FIELD } from './model/rating-field'\nimport { installDatasetSchemaHandler } from './server/install-dataset-schema'\nimport { installEmailStarterHandler } from './server/install-email-starter'\nimport { installEmailTemplateHandler } from './server/install-email-template'\nimport { installLayoutHandler } from './server/install-layout'\nimport { installTemplateHandler } from './server/install-template'\nimport { installThemeHandler } from './server/install-theme'\nimport { previewImageHandler } from './server/preview-image'\nimport { publishHandler } from './server/publish'\nimport { marketplaceAdminReports } from './server/admin-reports'\nimport { marketplaceAdminReviews } from './server/admin-reviews'\nimport { reportHandler } from './server/report'\nimport { reviewsHandler } from './server/reviews'\nimport { publisherProfileSaveHandler } from './server/publisher-profile-save'\nimport { publishDatasetSchemaHandler } from './server/publish-dataset-schema'\nimport { publishEmailStarterHandler } from './server/publish-email-starter'\nimport { publishEmailTemplateHandler } from './server/publish-email-template'\nimport { publishLayoutHandler } from './server/publish-layout'\nimport { publishTemplateHandler } from './server/publish-template'\nimport { publishThemeHandler } from './server/publish-theme'\nimport { updateArtifactHandler } from './server/update-artifact'\n\n/**\n * Registers the marketplace plugin's console-side API routes (AGL-396):\n * marketplace publish/install of templates and plugins, and the Stripe\n * Connect + checkout flows for paid listings.\n *\n * Upload-bodied routes register here too. The note that used to sit here —\n * that they had to stay as named console routes because the dispatcher\n * \"can't grant per-route bodyParser limits\" — was a Pages Router leftover:\n * `runLegacyHandler` reads the request through the same\n * `pluginRequestFromWeb` a named App Router route would, and imposes no\n * limit of its own. publish-plugin's 8 MB bundle has been going through the\n * dispatcher the whole time.\n */\nexport function registerMarketplaceConsoleApi(): void {\n  // Server side of the rating custom field (AGL-434): validators run\n  // on import/write paths even when no client loaded the plugin.\n  registerCustomFieldType(RATING_FIELD)\n  /*\n   * What a listing link unfurls as (AGL-876, handed to the platform by\n   * AGL-3080).\n   *\n   * The card used to be built by a hand-written console route with a server\n   * layout of its own, which is what kept that route out of the generic\n   * plugin route — moving it would have dropped every listing's card with\n   * nothing red. The shell asks this instead, so the card survives the move\n   * and no console file reads `marketplaceListings` to build a head.\n   *\n   * One segment and one only: `/{org}/marketplace/{listingId}`. The hub, the\n   * publish page and every other address under this route answer `null`,\n   * which leaves the shell's own title exactly as it was.\n   */\n  registerPluginRouteMetadata(\n    {\n      route: 'marketplace',\n      resolve: async (segments) => {\n        if (segments.length !== 1) return null\n        const { readListingForSocialCard } = await import(\n          './server/listing-social-card.server'\n        )\n        const { listingSocialCard } = await import('./model/listing-social-card')\n        return listingSocialCard(await readListingForSocialCard(segments[0]))\n      },\n    },\n    // Named, because this registrar is called directly by the app's server\n    // loader rather than from inside a plugin `register` fn, where the\n    // loader's owner marker would be set.\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginApiRoute('marketplace/checkout', checkoutHandler)\n  registerPluginApiRoute('marketplace/connect', connectHandler)\n  registerPluginApiRoute('marketplace/install', installHandler)\n  registerPluginApiRoute('marketplace/install-plugin', installPluginHandler)\n  registerPluginApiRoute('marketplace/install-layout', installLayoutHandler)\n  registerPluginApiRoute('marketplace/install-template', installTemplateHandler)\n  // A theme install DOES change the running site (AGL-1020) — it is the site's\n  // appearance — so this route also owns the ways back: `revert` and `reset`.\n  registerPluginApiRoute('marketplace/install-theme', installThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/install-dataset-schema',\n    installDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-starter',\n    installEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-template',\n    installEmailTemplateHandler,\n  )\n  // Updating a copied artifact is its own route (AGL-1018), not a flag on\n  // install: install writes the publisher's version, this one reconciles it\n  // with a copy that has diverged and refuses to overwrite silently.\n  registerPluginApiRoute('marketplace/update-artifact', updateArtifactHandler)\n  registerPluginApiRoute('marketplace/listing-versions', listingVersionsHandler)\n  registerPluginApiRoute('marketplace/preview-image', previewImageHandler)\n  registerPluginApiRoute('marketplace/publish', publishHandler)\n  registerPluginApiRoute('marketplace/report', reportHandler)\n  /*\n   * The staff end of that button (AGL-2310), moved out of\n   * `apps/console/app/api/admin/` by AGL-3080. `web:` because it is a plain\n   * fetch from this plugin's own staff page, not a plugin-request handler —\n   * the same shape the AI plugin's `ai/admin/*` routes use, and for the same\n   * reason: a staff route names no host, so there is no subject to resolve.\n   */\n  registerPluginApiRoute('marketplace/admin/reports', {\n    web: marketplaceAdminReports,\n  })\n  // The review queue (AGL-432, moved by AGL-3080). Same shape and the same\n  // reason: a staff route names no host, so there is no subject to resolve.\n  registerPluginApiRoute('marketplace/admin/reviews', {\n    web: marketplaceAdminReviews,\n  })\n  registerPluginApiRoute('marketplace/reviews', reviewsHandler)\n  registerPluginApiRoute(\n    'marketplace/publisher-profile',\n    publisherProfileSaveHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/verification-request',\n    verificationRequestHandler,\n  )\n  registerPluginApiRoute('marketplace/publish-layout', publishLayoutHandler)\n  registerPluginApiRoute('marketplace/publish-template', publishTemplateHandler)\n  registerPluginApiRoute('marketplace/publish-theme', publishThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/publish-dataset-schema',\n    publishDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-starter',\n    publishEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-template',\n    publishEmailTemplateHandler,\n  )\n  // Relocated console routes (AGL-418): URLs preserved via the dispatcher.\n  registerPluginApiRoute('marketplace/publish-plugin', publishPluginHandler)\n  // Marketplace purchases ride the platform Stripe webhook (AGL-418).\n  registerBillingWebhookHandler(marketplaceBillingWebhookHandler)\n}\n"],"names":["registerBillingWebhookHandler","registerPluginApiRoute","registerCustomFieldType","registerPluginRouteMetadata","BUNDLE_ID","marketplaceBillingWebhookHandler","publishPluginHandler","verificationRequestHandler","checkoutHandler","connectHandler","installHandler","installPluginHandler","listingVersionsHandler","RATING_FIELD","installDatasetSchemaHandler","installEmailStarterHandler","installEmailTemplateHandler","installLayoutHandler","installTemplateHandler","installThemeHandler","previewImageHandler","publishHandler","marketplaceAdminReports","marketplaceAdminReviews","reportHandler","reviewsHandler","publisherProfileSaveHandler","publishDatasetSchemaHandler","publishEmailStarterHandler","publishEmailTemplateHandler","publishLayoutHandler","publishTemplateHandler","publishThemeHandler","updateArtifactHandler","registerMarketplaceConsoleApi","route","resolve","segments","length","readListingForSocialCard","listingSocialCard","pluginId","web"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,6BAA6B,EAC7BC,sBAAsB,EACtBC,uBAAuB,QAClB,sBAAqB;AAC5B,0EAA0E;AAC1E,qCAAqC;AACrC,SAASC,2BAA2B,QAAQ,oDAAmD;AAC/F,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,gCAAgC,QAAQ,8BAA0B;AAC3E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,0BAA0B,QAAQ,mCAA+B;AAC1E,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,YAAY,QAAQ,0BAAsB;AACnD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,uBAAuB,QAAQ,4BAAwB;AAChE,SAASC,uBAAuB,QAAQ,4BAAwB;AAChE,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC;IACd,mEAAmE;IACnE,+DAA+D;IAC/DhC,wBAAwBW;IACxB;;;;;;;;;;;;;GAaC,GACDV,4BACE;QACEgC,OAAO;QACPC,SAAS,OAAOC;YACd,IAAIA,SAASC,MAAM,KAAK,GAAG,OAAO;YAClC,MAAM,EAAEC,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAC/C;YAEF,MAAM,EAAEC,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC;YAC3C,OAAOA,kBAAkB,MAAMD,yBAAyBF,QAAQ,CAAC,EAAE;QACrE;IACF,GACA,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC;QAAEI,UAAUrC;IAAU;IAExBH,uBAAuB,wBAAwBO;IAC/CP,uBAAuB,uBAAuBQ;IAC9CR,uBAAuB,uBAAuBS;IAC9CT,uBAAuB,8BAA8BU;IACrDV,uBAAuB,8BAA8BgB;IACrDhB,uBAAuB,gCAAgCiB;IACvD,6EAA6E;IAC7E,4EAA4E;IAC5EjB,uBAAuB,6BAA6BkB;IACpDlB,uBACE,sCACAa;IAEFb,uBACE,qCACAc;IAEFd,uBACE,sCACAe;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnEf,uBAAuB,+BAA+BgC;IACtDhC,uBAAuB,gCAAgCW;IACvDX,uBAAuB,6BAA6BmB;IACpDnB,uBAAuB,uBAAuBoB;IAC9CpB,uBAAuB,sBAAsBuB;IAC7C;;;;;;GAMC,GACDvB,uBAAuB,6BAA6B;QAClDyC,KAAKpB;IACP;IACA,yEAAyE;IACzE,0EAA0E;IAC1ErB,uBAAuB,6BAA6B;QAClDyC,KAAKnB;IACP;IACAtB,uBAAuB,uBAAuBwB;IAC9CxB,uBACE,iCACAyB;IAEFzB,uBACE,oCACAM;IAEFN,uBAAuB,8BAA8B6B;IACrD7B,uBAAuB,gCAAgC8B;IACvD9B,uBAAuB,6BAA6B+B;IACpD/B,uBACE,sCACA0B;IAEF1B,uBACE,qCACA2B;IAEF3B,uBACE,sCACA4B;IAEF,yEAAyE;IACzE5B,uBAAuB,8BAA8BK;IACrD,oEAAoE;IACpEN,8BAA8BK;AAChC"}
+{"version":3,"sources":["../../../../../../libs/plugins/marketplace/src/lib/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerBillingWebhookHandler,\n  registerPluginApiRoute,\n  registerCustomFieldType,\n} from '@aglyn/aglyn/server'\n// Its own subpath, never the plugin-manager barrel: what a published page\n// does not need, it must not import.\nimport { registerPluginRouteMetadata } from '@aglyn/aglyn/plugin-manager/plugin-route-metadata'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { marketplaceBillingWebhookHandler } from './server/billing-webhook'\nimport { publishPluginHandler } from './server/publish-plugin'\nimport { verificationRequestHandler } from './server/verification-request'\nimport { checkoutHandler } from './server/checkout'\nimport { connectHandler } from './server/connect'\nimport { installHandler } from './server/install'\nimport { installPluginHandler } from './server/install-plugin'\nimport { listingVersionsHandler } from './server/listing-versions'\nimport { RATING_FIELD } from './model/rating-field'\nimport { installDatasetSchemaHandler } from './server/install-dataset-schema'\nimport { installEmailStarterHandler } from './server/install-email-starter'\nimport { installEmailTemplateHandler } from './server/install-email-template'\nimport { installLayoutHandler } from './server/install-layout'\nimport { installTemplateHandler } from './server/install-template'\nimport { installThemeHandler } from './server/install-theme'\nimport { previewImageHandler } from './server/preview-image'\nimport { publishHandler } from './server/publish'\nimport { marketplaceAdminReports } from './server/admin-reports'\nimport { marketplaceAdminReviews } from './server/admin-reviews'\nimport { marketplaceAdminTrust } from './server/admin-trust'\nimport { reportHandler } from './server/report'\nimport { reviewsHandler } from './server/reviews'\nimport { publisherProfileSaveHandler } from './server/publisher-profile-save'\nimport { publishDatasetSchemaHandler } from './server/publish-dataset-schema'\nimport { publishEmailStarterHandler } from './server/publish-email-starter'\nimport { publishEmailTemplateHandler } from './server/publish-email-template'\nimport { publishLayoutHandler } from './server/publish-layout'\nimport { publishTemplateHandler } from './server/publish-template'\nimport { publishThemeHandler } from './server/publish-theme'\nimport { updateArtifactHandler } from './server/update-artifact'\n\n/**\n * Registers the marketplace plugin's console-side API routes (AGL-396):\n * marketplace publish/install of templates and plugins, and the Stripe\n * Connect + checkout flows for paid listings.\n *\n * Upload-bodied routes register here too. The note that used to sit here —\n * that they had to stay as named console routes because the dispatcher\n * \"can't grant per-route bodyParser limits\" — was a Pages Router leftover:\n * `runLegacyHandler` reads the request through the same\n * `pluginRequestFromWeb` a named App Router route would, and imposes no\n * limit of its own. publish-plugin's 8 MB bundle has been going through the\n * dispatcher the whole time.\n */\nexport function registerMarketplaceConsoleApi(): void {\n  // Server side of the rating custom field (AGL-434): validators run\n  // on import/write paths even when no client loaded the plugin.\n  registerCustomFieldType(RATING_FIELD)\n  /*\n   * What a listing link unfurls as (AGL-876, handed to the platform by\n   * AGL-3080).\n   *\n   * The card used to be built by a hand-written console route with a server\n   * layout of its own, which is what kept that route out of the generic\n   * plugin route — moving it would have dropped every listing's card with\n   * nothing red. The shell asks this instead, so the card survives the move\n   * and no console file reads `marketplaceListings` to build a head.\n   *\n   * One segment and one only: `/{org}/marketplace/{listingId}`. The hub, the\n   * publish page and every other address under this route answer `null`,\n   * which leaves the shell's own title exactly as it was.\n   */\n  registerPluginRouteMetadata(\n    {\n      route: 'marketplace',\n      resolve: async (segments) => {\n        if (segments.length !== 1) return null\n        const { readListingForSocialCard } = await import(\n          './server/listing-social-card.server'\n        )\n        const { listingSocialCard } = await import('./model/listing-social-card')\n        return listingSocialCard(await readListingForSocialCard(segments[0]))\n      },\n    },\n    // Named, because this registrar is called directly by the app's server\n    // loader rather than from inside a plugin `register` fn, where the\n    // loader's owner marker would be set.\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginApiRoute('marketplace/checkout', checkoutHandler)\n  registerPluginApiRoute('marketplace/connect', connectHandler)\n  registerPluginApiRoute('marketplace/install', installHandler)\n  registerPluginApiRoute('marketplace/install-plugin', installPluginHandler)\n  registerPluginApiRoute('marketplace/install-layout', installLayoutHandler)\n  registerPluginApiRoute('marketplace/install-template', installTemplateHandler)\n  // A theme install DOES change the running site (AGL-1020) — it is the site's\n  // appearance — so this route also owns the ways back: `revert` and `reset`.\n  registerPluginApiRoute('marketplace/install-theme', installThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/install-dataset-schema',\n    installDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-starter',\n    installEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/install-email-template',\n    installEmailTemplateHandler,\n  )\n  // Updating a copied artifact is its own route (AGL-1018), not a flag on\n  // install: install writes the publisher's version, this one reconciles it\n  // with a copy that has diverged and refuses to overwrite silently.\n  registerPluginApiRoute('marketplace/update-artifact', updateArtifactHandler)\n  registerPluginApiRoute('marketplace/listing-versions', listingVersionsHandler)\n  registerPluginApiRoute('marketplace/preview-image', previewImageHandler)\n  registerPluginApiRoute('marketplace/publish', publishHandler)\n  registerPluginApiRoute('marketplace/report', reportHandler)\n  /*\n   * The staff end of that button (AGL-2310), moved out of\n   * `apps/console/app/api/admin/` by AGL-3080. `web:` because it is a plain\n   * fetch from this plugin's own staff page, not a plugin-request handler —\n   * the same shape the AI plugin's `ai/admin/*` routes use, and for the same\n   * reason: a staff route names no host, so there is no subject to resolve.\n   */\n  registerPluginApiRoute('marketplace/admin/reports', {\n    web: marketplaceAdminReports,\n  })\n  // The review queue (AGL-432, moved by AGL-3080). Same shape and the same\n  // reason: a staff route names no host, so there is no subject to resolve.\n  registerPluginApiRoute('marketplace/admin/reviews', {\n    web: marketplaceAdminReviews,\n  })\n  // Realm trust (AGL-420, moved by AGL-3080). Super-staff only, and the\n  // SIGNATURE comes from the shell — the key is the console's and stays\n  // there. See `server/admin-trust.ts`.\n  registerPluginApiRoute('marketplace/admin/trust', {\n    web: marketplaceAdminTrust,\n  })\n  registerPluginApiRoute('marketplace/reviews', reviewsHandler)\n  registerPluginApiRoute(\n    'marketplace/publisher-profile',\n    publisherProfileSaveHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/verification-request',\n    verificationRequestHandler,\n  )\n  registerPluginApiRoute('marketplace/publish-layout', publishLayoutHandler)\n  registerPluginApiRoute('marketplace/publish-template', publishTemplateHandler)\n  registerPluginApiRoute('marketplace/publish-theme', publishThemeHandler)\n  registerPluginApiRoute(\n    'marketplace/publish-dataset-schema',\n    publishDatasetSchemaHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-starter',\n    publishEmailStarterHandler,\n  )\n  registerPluginApiRoute(\n    'marketplace/publish-email-template',\n    publishEmailTemplateHandler,\n  )\n  // Relocated console routes (AGL-418): URLs preserved via the dispatcher.\n  registerPluginApiRoute('marketplace/publish-plugin', publishPluginHandler)\n  // Marketplace purchases ride the platform Stripe webhook (AGL-418).\n  registerBillingWebhookHandler(marketplaceBillingWebhookHandler)\n}\n"],"names":["registerBillingWebhookHandler","registerPluginApiRoute","registerCustomFieldType","registerPluginRouteMetadata","BUNDLE_ID","marketplaceBillingWebhookHandler","publishPluginHandler","verificationRequestHandler","checkoutHandler","connectHandler","installHandler","installPluginHandler","listingVersionsHandler","RATING_FIELD","installDatasetSchemaHandler","installEmailStarterHandler","installEmailTemplateHandler","installLayoutHandler","installTemplateHandler","installThemeHandler","previewImageHandler","publishHandler","marketplaceAdminReports","marketplaceAdminReviews","marketplaceAdminTrust","reportHandler","reviewsHandler","publisherProfileSaveHandler","publishDatasetSchemaHandler","publishEmailStarterHandler","publishEmailTemplateHandler","publishLayoutHandler","publishTemplateHandler","publishThemeHandler","updateArtifactHandler","registerMarketplaceConsoleApi","route","resolve","segments","length","readListingForSocialCard","listingSocialCard","pluginId","web"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,6BAA6B,EAC7BC,sBAAsB,EACtBC,uBAAuB,QAClB,sBAAqB;AAC5B,0EAA0E;AAC1E,qCAAqC;AACrC,SAASC,2BAA2B,QAAQ,oDAAmD;AAC/F,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,gCAAgC,QAAQ,8BAA0B;AAC3E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,0BAA0B,QAAQ,mCAA+B;AAC1E,SAASC,eAAe,QAAQ,uBAAmB;AACnD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,YAAY,QAAQ,0BAAsB;AACnD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,uBAAuB,QAAQ,4BAAwB;AAChE,SAASC,uBAAuB,QAAQ,4BAAwB;AAChE,SAASC,qBAAqB,QAAQ,0BAAsB;AAC5D,SAASC,aAAa,QAAQ,qBAAiB;AAC/C,SAASC,cAAc,QAAQ,sBAAkB;AACjD,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,0BAA0B,QAAQ,oCAAgC;AAC3E,SAASC,2BAA2B,QAAQ,qCAAiC;AAC7E,SAASC,oBAAoB,QAAQ,6BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,+BAA2B;AAClE,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC;IACd,mEAAmE;IACnE,+DAA+D;IAC/DjC,wBAAwBW;IACxB;;;;;;;;;;;;;GAaC,GACDV,4BACE;QACEiC,OAAO;QACPC,SAAS,OAAOC;YACd,IAAIA,SAASC,MAAM,KAAK,GAAG,OAAO;YAClC,MAAM,EAAEC,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAC/C;YAEF,MAAM,EAAEC,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC;YAC3C,OAAOA,kBAAkB,MAAMD,yBAAyBF,QAAQ,CAAC,EAAE;QACrE;IACF,GACA,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC;QAAEI,UAAUtC;IAAU;IAExBH,uBAAuB,wBAAwBO;IAC/CP,uBAAuB,uBAAuBQ;IAC9CR,uBAAuB,uBAAuBS;IAC9CT,uBAAuB,8BAA8BU;IACrDV,uBAAuB,8BAA8BgB;IACrDhB,uBAAuB,gCAAgCiB;IACvD,6EAA6E;IAC7E,4EAA4E;IAC5EjB,uBAAuB,6BAA6BkB;IACpDlB,uBACE,sCACAa;IAEFb,uBACE,qCACAc;IAEFd,uBACE,sCACAe;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnEf,uBAAuB,+BAA+BiC;IACtDjC,uBAAuB,gCAAgCW;IACvDX,uBAAuB,6BAA6BmB;IACpDnB,uBAAuB,uBAAuBoB;IAC9CpB,uBAAuB,sBAAsBwB;IAC7C;;;;;;GAMC,GACDxB,uBAAuB,6BAA6B;QAClD0C,KAAKrB;IACP;IACA,yEAAyE;IACzE,0EAA0E;IAC1ErB,uBAAuB,6BAA6B;QAClD0C,KAAKpB;IACP;IACA,sEAAsE;IACtE,sEAAsE;IACtE,sCAAsC;IACtCtB,uBAAuB,2BAA2B;QAChD0C,KAAKnB;IACP;IACAvB,uBAAuB,uBAAuByB;IAC9CzB,uBACE,iCACA0B;IAEF1B,uBACE,oCACAM;IAEFN,uBAAuB,8BAA8B8B;IACrD9B,uBAAuB,gCAAgC+B;IACvD/B,uBAAuB,6BAA6BgC;IACpDhC,uBACE,sCACA2B;IAEF3B,uBACE,qCACA4B;IAEF5B,uBACE,sCACA6B;IAEF,yEAAyE;IACzE7B,uBAAuB,8BAA8BK;IACrD,oEAAoE;IACpEN,8BAA8BK;AAChC"}