@aglyn/plugins-marketplace 1.15.0 → 1.15.1

package/src/lib/server/connections/provider-http.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/provider-http.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  preparePluginConnectionRequest,\n  readPluginConnectionPath,\n  type PluginConnectionDeclaration,\n  type PluginConnectionRequest,\n  type PluginConnectionResource,\n} from '@aglyn/aglyn/app-utils/plugin-connections'\nimport type { PluginConnectionChoice } from '../../model/plugin-connections'\n\n/**\n * HOW THE PLATFORM TALKS TO A DECLARED CONNECTION'S PROVIDER (AGL-4193).\n *\n * Every outbound request a connection causes goes through here: the code\n * exchange and the refresh at the declared `tokenUrl`, the revoke at the\n * declared `revocationUrl`, and the templated API requests, which\n * `preparePluginConnectionRequest` refuses to send anywhere but the declared\n * `apiHosts`. One runtime object holds the fetch, the clock and the sleep, so\n * a spec swaps them in one place and no request leaves the process.\n *\n * Redirects are NOT followed: a provider answering a token or API request\n * with a redirect would otherwise carry the grant to a host nobody declared.\n * Answers are read up to a ceiling, so a hostile or broken endpoint cannot\n * make the console buffer an unbounded body.\n */\n\nexport interface PluginConnectionRuntime {\n  fetch: typeof fetch\n  now: () => number\n  sleep: (ms: number) => Promise<void>\n}\n\nexport const pluginConnectionRuntime: PluginConnectionRuntime = {\n  fetch: (input, init) => globalThis.fetch(input, init),\n  now: () => Date.now(),\n  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),\n}\n\n/** Why a provider call failed: the grant is gone (`auth`), try later (`transient`), or the answer is unusable (`refused`). */\nexport type PluginConnectionErrorCode = 'auth' | 'transient' | 'refused'\n\nexport class PluginConnectionProviderError extends Error {\n  constructor(\n    readonly code: PluginConnectionErrorCode,\n    message: string,\n    readonly status = 0,\n  ) {\n    super(message)\n    this.name = 'PluginConnectionProviderError'\n  }\n}\n\n/** The publisher's OAuth app, opened from its sealed record. */\nexport interface PluginConnectionClient {\n  clientId: string\n  clientSecret: string\n}\n\n/** A token endpoint's answer, normalized. */\nexport interface PluginConnectionTokenSet {\n  accessToken: string\n  /** `null` when the provider issued none (or kept the one it issued before). */\n  refreshToken: string | null\n  /** Epoch ms; an hour from now when the provider did not say. */\n  accessExpiresAtMs: number\n  /** The scopes granted, when the provider said; else the ones asked for. */\n  scopes: string[]\n}\n\n/** Bytes of an answer read at most. */\nexport const PLUGIN_CONNECTION_MAX_RESPONSE_BYTES = 2 * 1024 * 1024\nconst ATTEMPT_TIMEOUT_MS = 30_000\nconst RETRIES = 2\nconst BASE_BACKOFF_MS = 500\nconst DEFAULT_ACCESS_LIFETIME_MS = 60 * 60 * 1000\n\n/** Reads an answer's body, refusing one past the ceiling. */\nasync function readBody(response: Response): Promise<string> {\n  const declared = Number(response.headers.get('content-length'))\n  if (Number.isFinite(declared) && declared > PLUGIN_CONNECTION_MAX_RESPONSE_BYTES) {\n    throw new PluginConnectionProviderError('refused', 'The provider’s answer is too large.', response.status)\n  }\n  const text = await response.text()\n  if (text.length > PLUGIN_CONNECTION_MAX_RESPONSE_BYTES) {\n    throw new PluginConnectionProviderError('refused', 'The provider’s answer is too large.', response.status)\n  }\n  return text\n}\n\nconst parseJson = (text: string): unknown => {\n  try {\n    return JSON.parse(text)\n  } catch {\n    return null\n  }\n}\n\n/** The provider's own sentence for a refusal, cut short; never a token. */\nfunction providerSentence(body: unknown, status: number): string {\n  if (body && typeof body === 'object') {\n    const record = body as Record<string, unknown>\n    if (typeof record['error_description'] === 'string') return record['error_description'].slice(0, 300)\n    const error = record['error']\n    if (typeof error === 'string') return error.slice(0, 300)\n    if (error && typeof error === 'object' && typeof (error as Record<string, unknown>)['message'] === 'string') {\n      return String((error as Record<string, unknown>)['message']).slice(0, 300)\n    }\n  }\n  return `HTTP ${status}`\n}\n\nconst retryable = (status: number) => status === 429 || status >= 500\n\n/** One request: no redirects, a timeout per attempt, a throttle or server error retried. */\nasync function send(url: string, init: RequestInit): Promise<{ status: number; body: unknown }> {\n  let lastError: unknown = null\n  for (let attempt = 0; attempt <= RETRIES; attempt += 1) {\n    let response: Response | null = null\n    try {\n      response = await pluginConnectionRuntime.fetch(url, {\n        ...init,\n        redirect: 'manual',\n        signal: AbortSignal.timeout(ATTEMPT_TIMEOUT_MS),\n      })\n    } catch (error) {\n      lastError = error\n    }\n    if (response && !retryable(response.status)) {\n      if (response.status >= 300 && response.status < 400) {\n        throw new PluginConnectionProviderError('refused', 'The provider answered with a redirect, which is not followed.', response.status)\n      }\n      return { status: response.status, body: parseJson(await readBody(response)) }\n    }\n    if (attempt === RETRIES) {\n      if (response) {\n        const body = parseJson(await readBody(response).catch(() => ''))\n        throw new PluginConnectionProviderError('transient', providerSentence(body, response.status), response.status)\n      }\n      break\n    }\n    await pluginConnectionRuntime.sleep(BASE_BACKOFF_MS * 2 ** attempt)\n  }\n  throw new PluginConnectionProviderError(\n    'transient',\n    `The provider could not be reached: ${String((lastError as Error)?.message ?? lastError).slice(0, 200)}`,\n  )\n}\n\n/** The token endpoint's answer, or the refusal: `invalid_grant` and a 401 mean the grant is gone. */\nfunction readTokenAnswer(\n  answer: { status: number; body: unknown },\n  connection: PluginConnectionDeclaration,\n): PluginConnectionTokenSet {\n  const body = (answer.body && typeof answer.body === 'object' ? answer.body : {}) as Record<string, unknown>\n  if (answer.status < 200 || answer.status >= 300 || typeof body['access_token'] !== 'string' || !body['access_token']) {\n    const sentence = providerSentence(body, answer.status)\n    const grantGone = body['error'] === 'invalid_grant' || answer.status === 401 || body['error'] === 'unauthorized_client'\n    throw new PluginConnectionProviderError(grantGone ? 'auth' : 'refused', sentence, answer.status)\n  }\n  const expiresIn = Number(body['expires_in'])\n  const scope = typeof body['scope'] === 'string' ? body['scope'] : ''\n  return {\n    accessToken: body['access_token'],\n    refreshToken: typeof body['refresh_token'] === 'string' && body['refresh_token'] ? body['refresh_token'] : null,\n    accessExpiresAtMs:\n      pluginConnectionRuntime.now() +\n      (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1000 : DEFAULT_ACCESS_LIFETIME_MS),\n    scopes: scope ? scope.split(/[\\s,]+/).filter(Boolean) : [...connection.scopes],\n  }\n}\n\n/** Posts a form to the declared token endpoint, authenticating the publisher's app as declared. */\nasync function postToken(\n  connection: PluginConnectionDeclaration,\n  client: PluginConnectionClient,\n  fields: Record<string, string>,\n): Promise<{ status: number; body: unknown }> {\n  const form = new URLSearchParams(fields)\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/x-www-form-urlencoded',\n    Accept: 'application/json',\n  }\n  if (connection.tokenAuthMethod === 'basic') {\n    const pair = `${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`\n    headers['Authorization'] = `Basic ${Buffer.from(pair, 'utf8').toString('base64')}`\n  } else {\n    form.set('client_id', client.clientId)\n    form.set('client_secret', client.clientSecret)\n  }\n  return send(connection.tokenUrl, { method: 'POST', headers, body: form.toString() })\n}\n\n/** Exchanges an authorization code at the declared token endpoint. */\nexport async function exchangePluginConnectionCode(\n  connection: PluginConnectionDeclaration,\n  client: PluginConnectionClient,\n  input: { code: string; redirectUri: string },\n): Promise<PluginConnectionTokenSet> {\n  const answer = await postToken(connection, client, {\n    grant_type: 'authorization_code',\n    code: input.code,\n    redirect_uri: input.redirectUri,\n  })\n  return readTokenAnswer(answer, connection)\n}\n\n/** Refreshes a grant at the declared token endpoint. */\nexport async function refreshPluginConnectionToken(\n  connection: PluginConnectionDeclaration,\n  client: PluginConnectionClient,\n  refreshToken: string,\n): Promise<PluginConnectionTokenSet> {\n  const answer = await postToken(connection, client, { grant_type: 'refresh_token', refresh_token: refreshToken })\n  return readTokenAnswer(answer, connection)\n}\n\n/** Revokes a grant at the declared revocation endpoint, when there is one. Best effort; throws on failure. */\nexport async function revokePluginConnectionToken(\n  connection: PluginConnectionDeclaration,\n  client: PluginConnectionClient | null,\n  token: string,\n): Promise<boolean> {\n  if (!connection.revocationUrl) return false\n  const form = new URLSearchParams({ token })\n  if (client && connection.tokenAuthMethod !== 'basic') {\n    form.set('client_id', client.clientId)\n    form.set('client_secret', client.clientSecret)\n  }\n  const headers: Record<string, string> = { 'Content-Type': 'application/x-www-form-urlencoded' }\n  if (client && connection.tokenAuthMethod === 'basic') {\n    const pair = `${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`\n    headers['Authorization'] = `Basic ${Buffer.from(pair, 'utf8').toString('base64')}`\n  }\n  const answer = await send(connection.revocationUrl, { method: 'POST', headers, body: form.toString() })\n  if (answer.status >= 200 && answer.status < 300) return true\n  throw new PluginConnectionProviderError('refused', providerSentence(answer.body, answer.status), answer.status)\n}\n\n/**\n * One templated API request with the site's access token, filled from its\n * choices; answers the parsed JSON. A 401 or 403 is `auth` (the caller may\n * refresh once and retry), anything else not 2xx is `refused`.\n */\nexport async function pluginConnectionApiRequest(\n  connection: PluginConnectionDeclaration,\n  request: PluginConnectionRequest,\n  input: { accessToken: string; choices: Readonly<Record<string, string>>; cursor?: string | null },\n): Promise<unknown> {\n  const prepared = preparePluginConnectionRequest(request, {\n    apiHosts: connection.apiHosts,\n    choices: input.choices,\n    cursor: input.cursor ?? null,\n  })\n  if (prepared.ok === false) throw new PluginConnectionProviderError('refused', prepared.error)\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${input.accessToken}`,\n    Accept: 'application/json',\n  }\n  if (prepared.request.body !== undefined) headers['Content-Type'] = 'application/json'\n  const answer = await send(prepared.request.url, {\n    method: prepared.request.method,\n    headers,\n    ...(prepared.request.body !== undefined ? { body: prepared.request.body } : {}),\n  })\n  if (answer.status === 401 || answer.status === 403) {\n    throw new PluginConnectionProviderError('auth', providerSentence(answer.body, answer.status), answer.status)\n  }\n  if (answer.status < 200 || answer.status >= 300) {\n    throw new PluginConnectionProviderError('refused', providerSentence(answer.body, answer.status), answer.status)\n  }\n  return answer.body\n}\n\n/**\n * Every item of a paginated request, up to `maxItems` and the declared page\n * ceiling. Exported for the sync, which reads its requests the same way.\n */\nexport async function pluginConnectionApiItems(\n  connection: PluginConnectionDeclaration,\n  request: PluginConnectionRequest,\n  input: { accessToken: string; choices: Readonly<Record<string, string>>; maxItems: number },\n): Promise<{ items: unknown[]; pages: unknown[] }> {\n  const items: unknown[] = []\n  const pages: unknown[] = []\n  let cursor: string | null = null\n  const maxPages = request.pagination?.maxPages ?? 1\n  for (let page = 0; page < maxPages; page += 1) {\n    const body = await pluginConnectionApiRequest(connection, request, { ...input, cursor })\n    pages.push(body)\n    const list = request.itemsPath ? readPluginConnectionPath(body, request.itemsPath) : undefined\n    if (Array.isArray(list)) items.push(...list.slice(0, Math.max(0, input.maxItems - items.length)))\n    if (items.length >= input.maxItems || !request.pagination) break\n    const next = readPluginConnectionPath(body, request.pagination.cursorPath)\n    if (typeof next !== 'string' || !next || next.length > 2048 || next === cursor) break\n    cursor = next\n  }\n  return { items, pages }\n}\n\n/** The resource's items as the picker shows them: an id and a label, each a plain bounded string. */\nexport async function listPluginConnectionResource(\n  connection: PluginConnectionDeclaration,\n  resource: PluginConnectionResource,\n  input: { accessToken: string; choices: Readonly<Record<string, string>> },\n): Promise<PluginConnectionChoice[]> {\n  const { items } = await pluginConnectionApiItems(connection, resource.request, {\n    ...input,\n    maxItems: resource.maxItems,\n  })\n  const out: PluginConnectionChoice[] = []\n  const seen = new Set<string>()\n  for (const item of items) {\n    const id = readPluginConnectionPath(item, resource.idPath)\n    const label = readPluginConnectionPath(item, resource.labelPath)\n    if (typeof id !== 'string' && typeof id !== 'number') continue\n    const idText = String(id).slice(0, 256)\n    if (!idText || seen.has(idText)) continue\n    seen.add(idText)\n    out.push({ id: idText, label: typeof label === 'string' && label.trim() ? label.trim().slice(0, 200) : idText })\n  }\n  return out\n}\n"],"names":["preparePluginConnectionRequest","readPluginConnectionPath","pluginConnectionRuntime","fetch","input","init","globalThis","now","Date","sleep","ms","Promise","resolve","setTimeout","PluginConnectionProviderError","Error","code","message","status","name","PLUGIN_CONNECTION_MAX_RESPONSE_BYTES","ATTEMPT_TIMEOUT_MS","RETRIES","BASE_BACKOFF_MS","DEFAULT_ACCESS_LIFETIME_MS","readBody","response","declared","Number","headers","get","isFinite","text","length","parseJson","JSON","parse","providerSentence","body","record","slice","error","String","retryable","send","url","lastError","attempt","redirect","signal","AbortSignal","timeout","catch","readTokenAnswer","answer","connection","sentence","grantGone","expiresIn","scope","accessToken","refreshToken","accessExpiresAtMs","scopes","split","filter","Boolean","postToken","client","fields","form","URLSearchParams","Accept","tokenAuthMethod","pair","encodeURIComponent","clientId","clientSecret","Buffer","from","toString","set","tokenUrl","method","exchangePluginConnectionCode","grant_type","redirect_uri","redirectUri","refreshPluginConnectionToken","refresh_token","revokePluginConnectionToken","token","revocationUrl","pluginConnectionApiRequest","request","prepared","apiHosts","choices","cursor","ok","Authorization","undefined","pluginConnectionApiItems","items","pages","maxPages","pagination","page","push","list","itemsPath","Array","isArray","Math","max","maxItems","next","cursorPath","listPluginConnectionResource","resource","out","seen","Set","item","id","idPath","label","labelPath","idText","has","add","trim"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,8BAA8B,EAC9BC,wBAAwB,QAInB,4CAA2C;AAyBlD,OAAO,MAAMC,0BAAmD;IAC9DC,OAAO,CAACC,OAAOC,OAASC,WAAWH,KAAK,CAACC,OAAOC;IAChDE,KAAK,IAAMC,KAAKD,GAAG;IACnBE,OAAO,CAACC,KAAO,IAAIC,QAAQ,CAACC,UAAYC,WAAWD,SAASF;AAC9D,EAAC;AAKD,OAAO,MAAMI,sCAAsCC;IACjD,YACE,AAASC,IAA+B,EACxCC,OAAe,EACf,AAASC,SAAS,CAAC,CACnB;QACA,KAAK,CAACD,eAJGD,OAAAA,WAEAE,SAAAA;QAGT,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAmBA,qCAAqC,GACrC,OAAO,MAAMC,uCAAuC,IAAI,OAAO,KAAI;AACnE,MAAMC,qBAAqB;AAC3B,MAAMC,UAAU;AAChB,MAAMC,kBAAkB;AACxB,MAAMC,6BAA6B,KAAK,KAAK;AAE7C,2DAA2D,GAC3D,eAAeC,SAASC,QAAkB;IACxC,MAAMC,WAAWC,OAAOF,SAASG,OAAO,CAACC,GAAG,CAAC;IAC7C,IAAIF,OAAOG,QAAQ,CAACJ,aAAaA,WAAWP,sCAAsC;QAChF,MAAM,IAAIN,8BAA8B,WAAW,uCAAuCY,SAASR,MAAM;IAC3G;IACA,MAAMc,OAAO,MAAMN,SAASM,IAAI;IAChC,IAAIA,KAAKC,MAAM,GAAGb,sCAAsC;QACtD,MAAM,IAAIN,8BAA8B,WAAW,uCAAuCY,SAASR,MAAM;IAC3G;IACA,OAAOc;AACT;AAEA,MAAME,YAAY,CAACF;IACjB,IAAI;QACF,OAAOG,KAAKC,KAAK,CAACJ;IACpB,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,yEAAyE,GACzE,SAASK,iBAAiBC,IAAa,EAAEpB,MAAc;IACrD,IAAIoB,QAAQ,OAAOA,SAAS,UAAU;QACpC,MAAMC,SAASD;QACf,IAAI,OAAOC,MAAM,CAAC,oBAAoB,KAAK,UAAU,OAAOA,MAAM,CAAC,oBAAoB,CAACC,KAAK,CAAC,GAAG;QACjG,MAAMC,QAAQF,MAAM,CAAC,QAAQ;QAC7B,IAAI,OAAOE,UAAU,UAAU,OAAOA,MAAMD,KAAK,CAAC,GAAG;QACrD,IAAIC,SAAS,OAAOA,UAAU,YAAY,OAAO,AAACA,KAAiC,CAAC,UAAU,KAAK,UAAU;YAC3G,OAAOC,OAAO,AAACD,KAAiC,CAAC,UAAU,EAAED,KAAK,CAAC,GAAG;QACxE;IACF;IACA,OAAO,CAAC,KAAK,EAAEtB,QAAQ;AACzB;AAEA,MAAMyB,YAAY,CAACzB,SAAmBA,WAAW,OAAOA,UAAU;AAElE,0FAA0F,GAC1F,eAAe0B,KAAKC,GAAW,EAAExC,IAAiB;;IAChD,IAAIyC,YAAqB;IACzB,IAAK,IAAIC,UAAU,GAAGA,WAAWzB,SAASyB,WAAW,EAAG;QACtD,IAAIrB,WAA4B;QAChC,IAAI;YACFA,WAAW,MAAMxB,wBAAwBC,KAAK,CAAC0C,KAAK,aAC/CxC;gBACH2C,UAAU;gBACVC,QAAQC,YAAYC,OAAO,CAAC9B;;QAEhC,EAAE,OAAOoB,OAAO;YACdK,YAAYL;QACd;QACA,IAAIf,YAAY,CAACiB,UAAUjB,SAASR,MAAM,GAAG;YAC3C,IAAIQ,SAASR,MAAM,IAAI,OAAOQ,SAASR,MAAM,GAAG,KAAK;gBACnD,MAAM,IAAIJ,8BAA8B,WAAW,iEAAiEY,SAASR,MAAM;YACrI;YACA,OAAO;gBAAEA,QAAQQ,SAASR,MAAM;gBAAEoB,MAAMJ,UAAU,MAAMT,SAASC;YAAW;QAC9E;QACA,IAAIqB,YAAYzB,SAAS;YACvB,IAAII,UAAU;gBACZ,MAAMY,OAAOJ,UAAU,MAAMT,SAASC,UAAU0B,KAAK,CAAC,IAAM;gBAC5D,MAAM,IAAItC,8BAA8B,aAAauB,iBAAiBC,MAAMZ,SAASR,MAAM,GAAGQ,SAASR,MAAM;YAC/G;YACA;QACF;QACA,MAAMhB,wBAAwBO,KAAK,CAACc,kBAAkB,KAAKwB;IAC7D;IACA,MAAM,IAAIjC,8BACR,aACA,CAAC,mCAAmC,EAAE4B,eAAQI,6BAAD,AAACA,UAAqB7B,OAAO,mBAAI6B,WAAWN,KAAK,CAAC,GAAG,MAAM;AAE5G;AAEA,mGAAmG,GACnG,SAASa,gBACPC,MAAyC,EACzCC,UAAuC;IAEvC,MAAMjB,OAAQgB,OAAOhB,IAAI,IAAI,OAAOgB,OAAOhB,IAAI,KAAK,WAAWgB,OAAOhB,IAAI,GAAG,CAAC;IAC9E,IAAIgB,OAAOpC,MAAM,GAAG,OAAOoC,OAAOpC,MAAM,IAAI,OAAO,OAAOoB,IAAI,CAAC,eAAe,KAAK,YAAY,CAACA,IAAI,CAAC,eAAe,EAAE;QACpH,MAAMkB,WAAWnB,iBAAiBC,MAAMgB,OAAOpC,MAAM;QACrD,MAAMuC,YAAYnB,IAAI,CAAC,QAAQ,KAAK,mBAAmBgB,OAAOpC,MAAM,KAAK,OAAOoB,IAAI,CAAC,QAAQ,KAAK;QAClG,MAAM,IAAIxB,8BAA8B2C,YAAY,SAAS,WAAWD,UAAUF,OAAOpC,MAAM;IACjG;IACA,MAAMwC,YAAY9B,OAAOU,IAAI,CAAC,aAAa;IAC3C,MAAMqB,QAAQ,OAAOrB,IAAI,CAAC,QAAQ,KAAK,WAAWA,IAAI,CAAC,QAAQ,GAAG;IAClE,OAAO;QACLsB,aAAatB,IAAI,CAAC,eAAe;QACjCuB,cAAc,OAAOvB,IAAI,CAAC,gBAAgB,KAAK,YAAYA,IAAI,CAAC,gBAAgB,GAAGA,IAAI,CAAC,gBAAgB,GAAG;QAC3GwB,mBACE5D,wBAAwBK,GAAG,KAC1BqB,CAAAA,OAAOG,QAAQ,CAAC2B,cAAcA,YAAY,IAAIA,YAAY,OAAOlC,0BAAyB;QAC7FuC,QAAQJ,QAAQA,MAAMK,KAAK,CAAC,UAAUC,MAAM,CAACC,WAAW;eAAIX,WAAWQ,MAAM;SAAC;IAChF;AACF;AAEA,iGAAiG,GACjG,eAAeI,UACbZ,UAAuC,EACvCa,MAA8B,EAC9BC,MAA8B;IAE9B,MAAMC,OAAO,IAAIC,gBAAgBF;IACjC,MAAMxC,UAAkC;QACtC,gBAAgB;QAChB2C,QAAQ;IACV;IACA,IAAIjB,WAAWkB,eAAe,KAAK,SAAS;QAC1C,MAAMC,OAAO,GAAGC,mBAAmBP,OAAOQ,QAAQ,EAAE,CAAC,EAAED,mBAAmBP,OAAOS,YAAY,GAAG;QAChGhD,OAAO,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAEiD,OAAOC,IAAI,CAACL,MAAM,QAAQM,QAAQ,CAAC,WAAW;IACpF,OAAO;QACLV,KAAKW,GAAG,CAAC,aAAab,OAAOQ,QAAQ;QACrCN,KAAKW,GAAG,CAAC,iBAAiBb,OAAOS,YAAY;IAC/C;IACA,OAAOjC,KAAKW,WAAW2B,QAAQ,EAAE;QAAEC,QAAQ;QAAQtD;QAASS,MAAMgC,KAAKU,QAAQ;IAAG;AACpF;AAEA,oEAAoE,GACpE,OAAO,eAAeI,6BACpB7B,UAAuC,EACvCa,MAA8B,EAC9BhE,KAA4C;IAE5C,MAAMkD,SAAS,MAAMa,UAAUZ,YAAYa,QAAQ;QACjDiB,YAAY;QACZrE,MAAMZ,MAAMY,IAAI;QAChBsE,cAAclF,MAAMmF,WAAW;IACjC;IACA,OAAOlC,gBAAgBC,QAAQC;AACjC;AAEA,sDAAsD,GACtD,OAAO,eAAeiC,6BACpBjC,UAAuC,EACvCa,MAA8B,EAC9BP,YAAoB;IAEpB,MAAMP,SAAS,MAAMa,UAAUZ,YAAYa,QAAQ;QAAEiB,YAAY;QAAiBI,eAAe5B;IAAa;IAC9G,OAAOR,gBAAgBC,QAAQC;AACjC;AAEA,4GAA4G,GAC5G,OAAO,eAAemC,4BACpBnC,UAAuC,EACvCa,MAAqC,EACrCuB,KAAa;IAEb,IAAI,CAACpC,WAAWqC,aAAa,EAAE,OAAO;IACtC,MAAMtB,OAAO,IAAIC,gBAAgB;QAAEoB;IAAM;IACzC,IAAIvB,UAAUb,WAAWkB,eAAe,KAAK,SAAS;QACpDH,KAAKW,GAAG,CAAC,aAAab,OAAOQ,QAAQ;QACrCN,KAAKW,GAAG,CAAC,iBAAiBb,OAAOS,YAAY;IAC/C;IACA,MAAMhD,UAAkC;QAAE,gBAAgB;IAAoC;IAC9F,IAAIuC,UAAUb,WAAWkB,eAAe,KAAK,SAAS;QACpD,MAAMC,OAAO,GAAGC,mBAAmBP,OAAOQ,QAAQ,EAAE,CAAC,EAAED,mBAAmBP,OAAOS,YAAY,GAAG;QAChGhD,OAAO,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAEiD,OAAOC,IAAI,CAACL,MAAM,QAAQM,QAAQ,CAAC,WAAW;IACpF;IACA,MAAM1B,SAAS,MAAMV,KAAKW,WAAWqC,aAAa,EAAE;QAAET,QAAQ;QAAQtD;QAASS,MAAMgC,KAAKU,QAAQ;IAAG;IACrG,IAAI1B,OAAOpC,MAAM,IAAI,OAAOoC,OAAOpC,MAAM,GAAG,KAAK,OAAO;IACxD,MAAM,IAAIJ,8BAA8B,WAAWuB,iBAAiBiB,OAAOhB,IAAI,EAAEgB,OAAOpC,MAAM,GAAGoC,OAAOpC,MAAM;AAChH;AAEA;;;;CAIC,GACD,OAAO,eAAe2E,2BACpBtC,UAAuC,EACvCuC,OAAgC,EAChC1F,KAAiG;QAKvFA;IAHV,MAAM2F,WAAW/F,+BAA+B8F,SAAS;QACvDE,UAAUzC,WAAWyC,QAAQ;QAC7BC,SAAS7F,MAAM6F,OAAO;QACtBC,MAAM,GAAE9F,gBAAAA,MAAM8F,MAAM,YAAZ9F,gBAAgB;IAC1B;IACA,IAAI2F,SAASI,EAAE,KAAK,OAAO,MAAM,IAAIrF,8BAA8B,WAAWiF,SAAStD,KAAK;IAC5F,MAAMZ,UAAkC;QACtCuE,eAAe,CAAC,OAAO,EAAEhG,MAAMwD,WAAW,EAAE;QAC5CY,QAAQ;IACV;IACA,IAAIuB,SAASD,OAAO,CAACxD,IAAI,KAAK+D,WAAWxE,OAAO,CAAC,eAAe,GAAG;IACnE,MAAMyB,SAAS,MAAMV,KAAKmD,SAASD,OAAO,CAACjD,GAAG,EAAE;QAC9CsC,QAAQY,SAASD,OAAO,CAACX,MAAM;QAC/BtD;OACIkE,SAASD,OAAO,CAACxD,IAAI,KAAK+D,YAAY;QAAE/D,MAAMyD,SAASD,OAAO,CAACxD,IAAI;IAAC,IAAI,CAAC;IAE/E,IAAIgB,OAAOpC,MAAM,KAAK,OAAOoC,OAAOpC,MAAM,KAAK,KAAK;QAClD,MAAM,IAAIJ,8BAA8B,QAAQuB,iBAAiBiB,OAAOhB,IAAI,EAAEgB,OAAOpC,MAAM,GAAGoC,OAAOpC,MAAM;IAC7G;IACA,IAAIoC,OAAOpC,MAAM,GAAG,OAAOoC,OAAOpC,MAAM,IAAI,KAAK;QAC/C,MAAM,IAAIJ,8BAA8B,WAAWuB,iBAAiBiB,OAAOhB,IAAI,EAAEgB,OAAOpC,MAAM,GAAGoC,OAAOpC,MAAM;IAChH;IACA,OAAOoC,OAAOhB,IAAI;AACpB;AAEA;;;CAGC,GACD,OAAO,eAAegE,yBACpB/C,UAAuC,EACvCuC,OAAgC,EAChC1F,KAA2F;;QAK1E0F;IAHjB,MAAMS,QAAmB,EAAE;IAC3B,MAAMC,QAAmB,EAAE;IAC3B,IAAIN,SAAwB;IAC5B,MAAMO,oBAAWX,sBAAAA,QAAQY,UAAU,qBAAlBZ,oBAAoBW,QAAQ,mBAAI;IACjD,IAAK,IAAIE,OAAO,GAAGA,OAAOF,UAAUE,QAAQ,EAAG;QAC7C,MAAMrE,OAAO,MAAMuD,2BAA2BtC,YAAYuC,SAAS,aAAK1F;YAAO8F;;QAC/EM,MAAMI,IAAI,CAACtE;QACX,MAAMuE,OAAOf,QAAQgB,SAAS,GAAG7G,yBAAyBqC,MAAMwD,QAAQgB,SAAS,IAAIT;QACrF,IAAIU,MAAMC,OAAO,CAACH,OAAON,MAAMK,IAAI,IAAIC,KAAKrE,KAAK,CAAC,GAAGyE,KAAKC,GAAG,CAAC,GAAG9G,MAAM+G,QAAQ,GAAGZ,MAAMtE,MAAM;QAC9F,IAAIsE,MAAMtE,MAAM,IAAI7B,MAAM+G,QAAQ,IAAI,CAACrB,QAAQY,UAAU,EAAE;QAC3D,MAAMU,OAAOnH,yBAAyBqC,MAAMwD,QAAQY,UAAU,CAACW,UAAU;QACzE,IAAI,OAAOD,SAAS,YAAY,CAACA,QAAQA,KAAKnF,MAAM,GAAG,QAAQmF,SAASlB,QAAQ;QAChFA,SAASkB;IACX;IACA,OAAO;QAAEb;QAAOC;IAAM;AACxB;AAEA,mGAAmG,GACnG,OAAO,eAAec,6BACpB/D,UAAuC,EACvCgE,QAAkC,EAClCnH,KAAyE;IAEzE,MAAM,EAAEmG,KAAK,EAAE,GAAG,MAAMD,yBAAyB/C,YAAYgE,SAASzB,OAAO,EAAE,aAC1E1F;QACH+G,UAAUI,SAASJ,QAAQ;;IAE7B,MAAMK,MAAgC,EAAE;IACxC,MAAMC,OAAO,IAAIC;IACjB,KAAK,MAAMC,QAAQpB,MAAO;QACxB,MAAMqB,KAAK3H,yBAAyB0H,MAAMJ,SAASM,MAAM;QACzD,MAAMC,QAAQ7H,yBAAyB0H,MAAMJ,SAASQ,SAAS;QAC/D,IAAI,OAAOH,OAAO,YAAY,OAAOA,OAAO,UAAU;QACtD,MAAMI,SAAStF,OAAOkF,IAAIpF,KAAK,CAAC,GAAG;QACnC,IAAI,CAACwF,UAAUP,KAAKQ,GAAG,CAACD,SAAS;QACjCP,KAAKS,GAAG,CAACF;QACTR,IAAIZ,IAAI,CAAC;YAAEgB,IAAII;YAAQF,OAAO,OAAOA,UAAU,YAAYA,MAAMK,IAAI,KAAKL,MAAMK,IAAI,GAAG3F,KAAK,CAAC,GAAG,OAAOwF;QAAO;IAChH;IACA,OAAOR;AACT"}

package/src/lib/server/connections/record-announce.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Whether a record's shown content differs between two reads (`syncedAtMs` is not content). */
+export declare function connectionRecordChanged(before: Record<string, unknown> | null | undefined, after: Record<string, unknown> | null | undefined): boolean;
+/** Tells a site's pages that one of its connection records changed or went. */
+export declare function announceConnectionRecordChange(hostId: string, reason: string): Promise<void>;

package/src/lib/server/connections/record-announce.js

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { dropPluginSiteCache } from "@aglyn/aglyn/plugin-manager/plugin-site-cache";
+/*
+ * A SITE'S PAGES HEAR WHEN A CONNECTION'S RECORD CHANGES (AGL-4195).
+ *
+ * The published page reads a site's records through the tenant's render
+ * cache (`site-records-platform.ts`), tagged like the rest of the site's
+ * data and kept an hour, so a record that changes must say so: a deleted one
+ * (disconnect, uninstall, a grant gone mid-sync) must leave the page at once,
+ * and a sync that wrote new values should show them. A sync that wrote what
+ * was already there says nothing, so an hourly sync does not regenerate every
+ * page of the site every hour.
+ *
+ * Best effort and never throws: the write it follows has already happened.
+ */ const shape = (data)=>{
+    var _data_version, _data_fields, _data_items;
+    return data ? JSON.stringify([
+        (_data_version = data['version']) != null ? _data_version : null,
+        (_data_fields = data['fields']) != null ? _data_fields : null,
+        (_data_items = data['items']) != null ? _data_items : null
+    ]) : null;
+};
+/** Whether a record's shown content differs between two reads (`syncedAtMs` is not content). */ export function connectionRecordChanged(before, after) {
+    return shape(before) !== shape(after);
+}
+/** Tells a site's pages that one of its connection records changed or went. */ export async function announceConnectionRecordChange(hostId, reason) {
+    try {
+        await dropPluginSiteCache({
+            hostIds: [
+                hostId
+            ],
+            reason
+        });
+    } catch (error) {
+        console.error('[marketplace] a site was not told its connection record changed', error);
+    }
+}
+
+//# sourceMappingURL=record-announce.js.map

package/src/lib/server/connections/record-announce.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/record-announce.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { dropPluginSiteCache } from '@aglyn/aglyn/plugin-manager/plugin-site-cache'\n\n/*\n * A SITE'S PAGES HEAR WHEN A CONNECTION'S RECORD CHANGES (AGL-4195).\n *\n * The published page reads a site's records through the tenant's render\n * cache (`site-records-platform.ts`), tagged like the rest of the site's\n * data and kept an hour, so a record that changes must say so: a deleted one\n * (disconnect, uninstall, a grant gone mid-sync) must leave the page at once,\n * and a sync that wrote new values should show them. A sync that wrote what\n * was already there says nothing, so an hourly sync does not regenerate every\n * page of the site every hour.\n *\n * Best effort and never throws: the write it follows has already happened.\n */\n\nconst shape = (data: Record<string, unknown> | null | undefined) =>\n  data ? JSON.stringify([data['version'] ?? null, data['fields'] ?? null, data['items'] ?? null]) : null\n\n/** Whether a record's shown content differs between two reads (`syncedAtMs` is not content). */\nexport function connectionRecordChanged(\n  before: Record<string, unknown> | null | undefined,\n  after: Record<string, unknown> | null | undefined,\n): boolean {\n  return shape(before) !== shape(after)\n}\n\n/** Tells a site's pages that one of its connection records changed or went. */\nexport async function announceConnectionRecordChange(hostId: string, reason: string): Promise<void> {\n  try {\n    await dropPluginSiteCache({ hostIds: [hostId], reason })\n  } catch (error) {\n    console.error('[marketplace] a site was not told its connection record changed', error)\n  }\n}\n"],"names":["dropPluginSiteCache","shape","data","JSON","stringify","connectionRecordChanged","before","after","announceConnectionRecordChange","hostId","reason","hostIds","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mBAAmB,QAAQ,gDAA+C;AAEnF;;;;;;;;;;;;CAYC,GAED,MAAMC,QAAQ,CAACC;QACUA,eAAyBA,cAAwBA;WAAxEA,OAAOC,KAAKC,SAAS,CAAC;SAACF,gBAAAA,IAAI,CAAC,UAAU,YAAfA,gBAAmB;SAAMA,eAAAA,IAAI,CAAC,SAAS,YAAdA,eAAkB;SAAMA,cAAAA,IAAI,CAAC,QAAQ,YAAbA,cAAiB;KAAK,IAAI;;AAEpG,8FAA8F,GAC9F,OAAO,SAASG,wBACdC,MAAkD,EAClDC,KAAiD;IAEjD,OAAON,MAAMK,YAAYL,MAAMM;AACjC;AAEA,6EAA6E,GAC7E,OAAO,eAAeC,+BAA+BC,MAAc,EAAEC,MAAc;IACjF,IAAI;QACF,MAAMV,oBAAoB;YAAEW,SAAS;gBAACF;aAAO;YAAEC;QAAO;IACxD,EAAE,OAAOE,OAAO;QACdC,QAAQD,KAAK,CAAC,mEAAmEA;IACnF;AACF"}

package/src/lib/server/connections/record-mapping.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginConnectionRecordField, type PluginConnectionSync } from '@aglyn/aglyn/app-utils/plugin-connections';
+import type { PluginConnectionRecordDoc, PluginConnectionRecordValue } from '../../model/plugin-connections';
+/**
+ * HOW A SYNC'S ANSWERS BECOME A SITE'S RECORD (AGL-4194).
+ *
+ * The provider's answers are untrusted JSON. The record a page renders from
+ * is built field by field from the manifest's `sync.record`, so it can only
+ * ever hold what was declared, typed as declared and no longer than declared:
+ *
+ *   - a key the schema does not name is never read, so nothing undeclared
+ *     can be copied across, whatever the provider adds to its answer;
+ *   - a `map` is a whitelist: a value it does not list is dropped, never
+ *     passed through raw;
+ *   - a `string` is cut to its `maxLength`; a `url` must be `https` with no
+ *     credentials and fit its `maxLength` whole (a cut URL points somewhere
+ *     else, so a long one is dropped rather than cut);
+ *   - a `datetime` becomes epoch ms; a `number` must be finite;
+ *   - a declared field with no usable value is `null`, so every entry has the
+ *     same keys and an element can tell "missing" from "zero";
+ *   - `items` stops at its `maxItems`, and the whole record stops at
+ *     {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}, dropping trailing items, so
+ *     it always fits in one Firestore document with room to spare.
+ *
+ * Pure: no Firestore, no fetch.
+ */
+/** The serialized record is kept under this, well inside Firestore's 1 MiB document limit. */
+export declare const PLUGIN_CONNECTION_RECORD_MAX_BYTES: number;
+/** What one declared sync request answered: its first page (summary fields) and its items across pages. */
+export interface PluginConnectionSyncAnswer {
+    pages: unknown[];
+    items: unknown[];
+}
+/** One declared field's value out of `source`, or `null` when there is no usable one. */
+export declare function mapPluginConnectionField(field: PluginConnectionRecordField, source: unknown): PluginConnectionRecordValue;
+/**
+ * The record for one sync: the summary `fields` from each named request's
+ * first page, the `items` from the items request, capped to `maxItems` and to
+ * {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}.
+ */
+export declare function mapPluginConnectionRecord(sync: Pick<PluginConnectionSync, 'record'>, answers: Readonly<Record<string, PluginConnectionSyncAnswer>>, meta: {
+    listingId: string;
+    connectionId: string;
+    version: string;
+    syncedAtMs: number;
+}): PluginConnectionRecordDoc;
+/** The sync requests the record actually reads, in declared order: an unread one is never sent. */
+export declare function pluginConnectionSyncRequestsRead(sync: PluginConnectionSync): PluginConnectionSync['requests'];

package/src/lib/server/connections/record-mapping.js

@@ -0,0 +1,151 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { readPluginConnectionPath } from "@aglyn/aglyn/app-utils/plugin-connections";
+/**
+ * HOW A SYNC'S ANSWERS BECOME A SITE'S RECORD (AGL-4194).
+ *
+ * The provider's answers are untrusted JSON. The record a page renders from
+ * is built field by field from the manifest's `sync.record`, so it can only
+ * ever hold what was declared, typed as declared and no longer than declared:
+ *
+ *   - a key the schema does not name is never read, so nothing undeclared
+ *     can be copied across, whatever the provider adds to its answer;
+ *   - a `map` is a whitelist: a value it does not list is dropped, never
+ *     passed through raw;
+ *   - a `string` is cut to its `maxLength`; a `url` must be `https` with no
+ *     credentials and fit its `maxLength` whole (a cut URL points somewhere
+ *     else, so a long one is dropped rather than cut);
+ *   - a `datetime` becomes epoch ms; a `number` must be finite;
+ *   - a declared field with no usable value is `null`, so every entry has the
+ *     same keys and an element can tell "missing" from "zero";
+ *   - `items` stops at its `maxItems`, and the whole record stops at
+ *     {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}, dropping trailing items, so
+ *     it always fits in one Firestore document with room to spare.
+ *
+ * Pure: no Firestore, no fetch.
+ */ /** The serialized record is kept under this, well inside Firestore's 1 MiB document limit. */ export const PLUGIN_CONNECTION_RECORD_MAX_BYTES = 512 * 1024;
+/** Dates outside these bounds are not dates a provider meant (year 1970 to 2200). */ const MIN_DATETIME_MS = 0;
+const MAX_DATETIME_MS = Date.UTC(2200, 0, 1);
+function coerceUrl(value, maxLength) {
+    if (typeof value !== 'string') return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > maxLength) return null;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    } catch (unused) {
+        return null;
+    }
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password) return null;
+    return trimmed;
+}
+function coerceDatetime(value) {
+    let ms;
+    if (typeof value === 'number') ms = value;
+    else if (typeof value === 'string' && value.trim()) ms = Date.parse(value.trim());
+    else return null;
+    if (!Number.isFinite(ms) || ms < MIN_DATETIME_MS || ms > MAX_DATETIME_MS) return null;
+    return Math.trunc(ms);
+}
+/** One declared field's value out of `source`, or `null` when there is no usable one. */ export function mapPluginConnectionField(field, source) {
+    let value = readPluginConnectionPath(source, field.path);
+    if (value === undefined || value === null) return null;
+    if (field.map) {
+        if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') return null;
+        const key = String(value);
+        if (!Object.prototype.hasOwnProperty.call(field.map, key)) return null;
+        value = field.map[key];
+    }
+    switch(field.type){
+        case 'string':
+            {
+                var _field_maxLength;
+                if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') return null;
+                const text = String(value);
+                return text.slice(0, (_field_maxLength = field.maxLength) != null ? _field_maxLength : 0);
+            }
+        case 'number':
+            {
+                const number = typeof value === 'number' ? value : typeof value === 'string' && value.trim() ? Number(value) : NaN;
+                return Number.isFinite(number) ? number : null;
+            }
+        case 'boolean':
+            if (typeof value === 'boolean') return value;
+            if (value === 'true') return true;
+            if (value === 'false') return false;
+            return null;
+        case 'datetime':
+            return coerceDatetime(value);
+        case 'url':
+            var _field_maxLength1;
+            return coerceUrl(value, (_field_maxLength1 = field.maxLength) != null ? _field_maxLength1 : 0);
+        default:
+            return null;
+    }
+}
+function mapFields(fields, source) {
+    const out = {};
+    for (const [name, field] of Object.entries(fields))out[name] = mapPluginConnectionField(field, source);
+    return out;
+}
+const byteLength = (value)=>Buffer.byteLength(JSON.stringify(value), 'utf8');
+/**
+ * The record for one sync: the summary `fields` from each named request's
+ * first page, the `items` from the items request, capped to `maxItems` and to
+ * {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}.
+ */ export function mapPluginConnectionRecord(sync, answers, meta) {
+    var _sync_record_fields;
+    const summary = (_sync_record_fields = sync.record.fields) != null ? _sync_record_fields : {};
+    const fields = {};
+    for (const [name, field] of Object.entries(summary)){
+        var _answers_field_request;
+        fields[name] = mapPluginConnectionField(field, (_answers_field_request = answers[field.request]) == null ? void 0 : _answers_field_request.pages[0]);
+    }
+    const items = [];
+    const declared = sync.record.items;
+    if (declared) {
+        var _ref;
+        var _answers_declared_request;
+        const source = (_ref = (_answers_declared_request = answers[declared.request]) == null ? void 0 : _answers_declared_request.items) != null ? _ref : [];
+        for (const item of source.slice(0, declared.maxItems)){
+            items.push(mapFields(declared.fields, item));
+        }
+    }
+    const record = _extends({
+        kind: 'record'
+    }, meta, {
+        fields,
+        items
+    });
+    // The byte ceiling: drop trailing items until the whole record fits.
+    while(record.items.length && byteLength(record) > PLUGIN_CONNECTION_RECORD_MAX_BYTES){
+        const over = byteLength(record) - PLUGIN_CONNECTION_RECORD_MAX_BYTES;
+        const last = byteLength(record.items[record.items.length - 1]);
+        const drop = Math.min(record.items.length, Math.max(1, Math.ceil(over / Math.max(1, last))));
+        record.items.splice(record.items.length - drop);
+    }
+    return record;
+}
+/** The sync requests the record actually reads, in declared order: an unread one is never sent. */ export function pluginConnectionSyncRequestsRead(sync) {
+    var _sync_record_fields;
+    const read = new Set();
+    for (const field of Object.values((_sync_record_fields = sync.record.fields) != null ? _sync_record_fields : {}))read.add(field.request);
+    if (sync.record.items) read.add(sync.record.items.request);
+    return sync.requests.filter((request)=>read.has(request.id));
+}
+
+//# sourceMappingURL=record-mapping.js.map

package/src/lib/server/connections/record-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/record-mapping.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  readPluginConnectionPath,\n  type PluginConnectionRecordField,\n  type PluginConnectionSync,\n} from '@aglyn/aglyn/app-utils/plugin-connections'\nimport type { PluginConnectionRecordDoc, PluginConnectionRecordValue } from '../../model/plugin-connections'\n\n/**\n * HOW A SYNC'S ANSWERS BECOME A SITE'S RECORD (AGL-4194).\n *\n * The provider's answers are untrusted JSON. The record a page renders from\n * is built field by field from the manifest's `sync.record`, so it can only\n * ever hold what was declared, typed as declared and no longer than declared:\n *\n *   - a key the schema does not name is never read, so nothing undeclared\n *     can be copied across, whatever the provider adds to its answer;\n *   - a `map` is a whitelist: a value it does not list is dropped, never\n *     passed through raw;\n *   - a `string` is cut to its `maxLength`; a `url` must be `https` with no\n *     credentials and fit its `maxLength` whole (a cut URL points somewhere\n *     else, so a long one is dropped rather than cut);\n *   - a `datetime` becomes epoch ms; a `number` must be finite;\n *   - a declared field with no usable value is `null`, so every entry has the\n *     same keys and an element can tell \"missing\" from \"zero\";\n *   - `items` stops at its `maxItems`, and the whole record stops at\n *     {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}, dropping trailing items, so\n *     it always fits in one Firestore document with room to spare.\n *\n * Pure: no Firestore, no fetch.\n */\n\n/** The serialized record is kept under this, well inside Firestore's 1 MiB document limit. */\nexport const PLUGIN_CONNECTION_RECORD_MAX_BYTES = 512 * 1024\n\n/** What one declared sync request answered: its first page (summary fields) and its items across pages. */\nexport interface PluginConnectionSyncAnswer {\n  pages: unknown[]\n  items: unknown[]\n}\n\n/** Dates outside these bounds are not dates a provider meant (year 1970 to 2200). */\nconst MIN_DATETIME_MS = 0\nconst MAX_DATETIME_MS = Date.UTC(2200, 0, 1)\n\nfunction coerceUrl(value: unknown, maxLength: number): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!trimmed || trimmed.length > maxLength) return null\n  let parsed: URL\n  try {\n    parsed = new URL(trimmed)\n  } catch {\n    return null\n  }\n  if (parsed.protocol !== 'https:' || parsed.username || parsed.password) return null\n  return trimmed\n}\n\nfunction coerceDatetime(value: unknown): number | null {\n  let ms: number\n  if (typeof value === 'number') ms = value\n  else if (typeof value === 'string' && value.trim()) ms = Date.parse(value.trim())\n  else return null\n  if (!Number.isFinite(ms) || ms < MIN_DATETIME_MS || ms > MAX_DATETIME_MS) return null\n  return Math.trunc(ms)\n}\n\n/** One declared field's value out of `source`, or `null` when there is no usable one. */\nexport function mapPluginConnectionField(\n  field: PluginConnectionRecordField,\n  source: unknown,\n): PluginConnectionRecordValue {\n  let value: unknown = readPluginConnectionPath(source, field.path)\n  if (value === undefined || value === null) return null\n  if (field.map) {\n    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') return null\n    const key = String(value)\n    if (!Object.prototype.hasOwnProperty.call(field.map, key)) return null\n    value = field.map[key]\n  }\n  switch (field.type) {\n    case 'string': {\n      if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') return null\n      const text = String(value)\n      return text.slice(0, field.maxLength ?? 0)\n    }\n    case 'number': {\n      const number = typeof value === 'number' ? value : typeof value === 'string' && value.trim() ? Number(value) : NaN\n      return Number.isFinite(number) ? number : null\n    }\n    case 'boolean':\n      if (typeof value === 'boolean') return value\n      if (value === 'true') return true\n      if (value === 'false') return false\n      return null\n    case 'datetime':\n      return coerceDatetime(value)\n    case 'url':\n      return coerceUrl(value, field.maxLength ?? 0)\n    default:\n      return null\n  }\n}\n\nfunction mapFields(\n  fields: Readonly<Record<string, PluginConnectionRecordField>>,\n  source: unknown,\n): Record<string, PluginConnectionRecordValue> {\n  const out: Record<string, PluginConnectionRecordValue> = {}\n  for (const [name, field] of Object.entries(fields)) out[name] = mapPluginConnectionField(field, source)\n  return out\n}\n\nconst byteLength = (value: unknown) => Buffer.byteLength(JSON.stringify(value), 'utf8')\n\n/**\n * The record for one sync: the summary `fields` from each named request's\n * first page, the `items` from the items request, capped to `maxItems` and to\n * {@link PLUGIN_CONNECTION_RECORD_MAX_BYTES}.\n */\nexport function mapPluginConnectionRecord(\n  sync: Pick<PluginConnectionSync, 'record'>,\n  answers: Readonly<Record<string, PluginConnectionSyncAnswer>>,\n  meta: { listingId: string; connectionId: string; version: string; syncedAtMs: number },\n): PluginConnectionRecordDoc {\n  const summary = sync.record.fields ?? {}\n  const fields: Record<string, PluginConnectionRecordValue> = {}\n  for (const [name, field] of Object.entries(summary)) {\n    fields[name] = mapPluginConnectionField(field, answers[field.request]?.pages[0])\n  }\n  const items: Array<Record<string, PluginConnectionRecordValue>> = []\n  const declared = sync.record.items\n  if (declared) {\n    const source = answers[declared.request]?.items ?? []\n    for (const item of source.slice(0, declared.maxItems)) {\n      items.push(mapFields(declared.fields, item))\n    }\n  }\n  const record: PluginConnectionRecordDoc = { kind: 'record', ...meta, fields, items }\n  // The byte ceiling: drop trailing items until the whole record fits.\n  while (record.items.length && byteLength(record) > PLUGIN_CONNECTION_RECORD_MAX_BYTES) {\n    const over = byteLength(record) - PLUGIN_CONNECTION_RECORD_MAX_BYTES\n    const last = byteLength(record.items[record.items.length - 1])\n    const drop = Math.min(record.items.length, Math.max(1, Math.ceil(over / Math.max(1, last))))\n    record.items.splice(record.items.length - drop)\n  }\n  return record\n}\n\n/** The sync requests the record actually reads, in declared order: an unread one is never sent. */\nexport function pluginConnectionSyncRequestsRead(sync: PluginConnectionSync): PluginConnectionSync['requests'] {\n  const read = new Set<string>()\n  for (const field of Object.values(sync.record.fields ?? {})) read.add(field.request)\n  if (sync.record.items) read.add(sync.record.items.request)\n  return sync.requests.filter((request) => read.has(request.id))\n}\n"],"names":["readPluginConnectionPath","PLUGIN_CONNECTION_RECORD_MAX_BYTES","MIN_DATETIME_MS","MAX_DATETIME_MS","Date","UTC","coerceUrl","value","maxLength","trimmed","trim","length","parsed","URL","protocol","username","password","coerceDatetime","ms","parse","Number","isFinite","Math","trunc","mapPluginConnectionField","field","source","path","undefined","map","key","String","Object","prototype","hasOwnProperty","call","type","text","slice","number","NaN","mapFields","fields","out","name","entries","byteLength","Buffer","JSON","stringify","mapPluginConnectionRecord","sync","answers","meta","summary","record","request","pages","items","declared","item","maxItems","push","kind","over","last","drop","min","max","ceil","splice","pluginConnectionSyncRequestsRead","read","Set","values","add","requests","filter","has","id"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,wBAAwB,QAGnB,4CAA2C;AAGlD;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,4FAA4F,GAC5F,OAAO,MAAMC,qCAAqC,MAAM,KAAI;AAQ5D,mFAAmF,GACnF,MAAMC,kBAAkB;AACxB,MAAMC,kBAAkBC,KAAKC,GAAG,CAAC,MAAM,GAAG;AAE1C,SAASC,UAAUC,KAAc,EAAEC,SAAiB;IAClD,IAAI,OAAOD,UAAU,UAAU,OAAO;IACtC,MAAME,UAAUF,MAAMG,IAAI;IAC1B,IAAI,CAACD,WAAWA,QAAQE,MAAM,GAAGH,WAAW,OAAO;IACnD,IAAII;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIJ;IACnB,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIG,OAAOE,QAAQ,KAAK,YAAYF,OAAOG,QAAQ,IAAIH,OAAOI,QAAQ,EAAE,OAAO;IAC/E,OAAOP;AACT;AAEA,SAASQ,eAAeV,KAAc;IACpC,IAAIW;IACJ,IAAI,OAAOX,UAAU,UAAUW,KAAKX;SAC/B,IAAI,OAAOA,UAAU,YAAYA,MAAMG,IAAI,IAAIQ,KAAKd,KAAKe,KAAK,CAACZ,MAAMG,IAAI;SACzE,OAAO;IACZ,IAAI,CAACU,OAAOC,QAAQ,CAACH,OAAOA,KAAKhB,mBAAmBgB,KAAKf,iBAAiB,OAAO;IACjF,OAAOmB,KAAKC,KAAK,CAACL;AACpB;AAEA,uFAAuF,GACvF,OAAO,SAASM,yBACdC,KAAkC,EAClCC,MAAe;IAEf,IAAInB,QAAiBP,yBAAyB0B,QAAQD,MAAME,IAAI;IAChE,IAAIpB,UAAUqB,aAAarB,UAAU,MAAM,OAAO;IAClD,IAAIkB,MAAMI,GAAG,EAAE;QACb,IAAI,OAAOtB,UAAU,YAAY,OAAOA,UAAU,YAAY,OAAOA,UAAU,WAAW,OAAO;QACjG,MAAMuB,MAAMC,OAAOxB;QACnB,IAAI,CAACyB,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,MAAMI,GAAG,EAAEC,MAAM,OAAO;QAClEvB,QAAQkB,MAAMI,GAAG,CAACC,IAAI;IACxB;IACA,OAAQL,MAAMW,IAAI;QAChB,KAAK;YAAU;oBAGQX;gBAFrB,IAAI,OAAOlB,UAAU,YAAY,OAAOA,UAAU,YAAY,OAAOA,UAAU,WAAW,OAAO;gBACjG,MAAM8B,OAAON,OAAOxB;gBACpB,OAAO8B,KAAKC,KAAK,CAAC,IAAGb,mBAAAA,MAAMjB,SAAS,YAAfiB,mBAAmB;YAC1C;QACA,KAAK;YAAU;gBACb,MAAMc,SAAS,OAAOhC,UAAU,WAAWA,QAAQ,OAAOA,UAAU,YAAYA,MAAMG,IAAI,KAAKU,OAAOb,SAASiC;gBAC/G,OAAOpB,OAAOC,QAAQ,CAACkB,UAAUA,SAAS;YAC5C;QACA,KAAK;YACH,IAAI,OAAOhC,UAAU,WAAW,OAAOA;YACvC,IAAIA,UAAU,QAAQ,OAAO;YAC7B,IAAIA,UAAU,SAAS,OAAO;YAC9B,OAAO;QACT,KAAK;YACH,OAAOU,eAAeV;QACxB,KAAK;gBACqBkB;YAAxB,OAAOnB,UAAUC,QAAOkB,oBAAAA,MAAMjB,SAAS,YAAfiB,oBAAmB;QAC7C;YACE,OAAO;IACX;AACF;AAEA,SAASgB,UACPC,MAA6D,EAC7DhB,MAAe;IAEf,MAAMiB,MAAmD,CAAC;IAC1D,KAAK,MAAM,CAACC,MAAMnB,MAAM,IAAIO,OAAOa,OAAO,CAACH,QAASC,GAAG,CAACC,KAAK,GAAGpB,yBAAyBC,OAAOC;IAChG,OAAOiB;AACT;AAEA,MAAMG,aAAa,CAACvC,QAAmBwC,OAAOD,UAAU,CAACE,KAAKC,SAAS,CAAC1C,QAAQ;AAEhF;;;;CAIC,GACD,OAAO,SAAS2C,0BACdC,IAA0C,EAC1CC,OAA6D,EAC7DC,IAAsF;QAEtEF;IAAhB,MAAMG,WAAUH,sBAAAA,KAAKI,MAAM,CAACb,MAAM,YAAlBS,sBAAsB,CAAC;IACvC,MAAMT,SAAsD,CAAC;IAC7D,KAAK,MAAM,CAACE,MAAMnB,MAAM,IAAIO,OAAOa,OAAO,CAACS,SAAU;YACJF;QAA/CV,MAAM,CAACE,KAAK,GAAGpB,yBAAyBC,QAAO2B,yBAAAA,OAAO,CAAC3B,MAAM+B,OAAO,CAAC,qBAAtBJ,uBAAwBK,KAAK,CAAC,EAAE;IACjF;IACA,MAAMC,QAA4D,EAAE;IACpE,MAAMC,WAAWR,KAAKI,MAAM,CAACG,KAAK;IAClC,IAAIC,UAAU;;YACGP;QAAf,MAAM1B,kBAAS0B,4BAAAA,OAAO,CAACO,SAASH,OAAO,CAAC,qBAAzBJ,0BAA2BM,KAAK,mBAAI,EAAE;QACrD,KAAK,MAAME,QAAQlC,OAAOY,KAAK,CAAC,GAAGqB,SAASE,QAAQ,EAAG;YACrDH,MAAMI,IAAI,CAACrB,UAAUkB,SAASjB,MAAM,EAAEkB;QACxC;IACF;IACA,MAAML,SAAoC;QAAEQ,MAAM;OAAaV;QAAMX;QAAQgB;;IAC7E,qEAAqE;IACrE,MAAOH,OAAOG,KAAK,CAAC/C,MAAM,IAAImC,WAAWS,UAAUtD,mCAAoC;QACrF,MAAM+D,OAAOlB,WAAWS,UAAUtD;QAClC,MAAMgE,OAAOnB,WAAWS,OAAOG,KAAK,CAACH,OAAOG,KAAK,CAAC/C,MAAM,GAAG,EAAE;QAC7D,MAAMuD,OAAO5C,KAAK6C,GAAG,CAACZ,OAAOG,KAAK,CAAC/C,MAAM,EAAEW,KAAK8C,GAAG,CAAC,GAAG9C,KAAK+C,IAAI,CAACL,OAAO1C,KAAK8C,GAAG,CAAC,GAAGH;QACpFV,OAAOG,KAAK,CAACY,MAAM,CAACf,OAAOG,KAAK,CAAC/C,MAAM,GAAGuD;IAC5C;IACA,OAAOX;AACT;AAEA,iGAAiG,GACjG,OAAO,SAASgB,iCAAiCpB,IAA0B;QAEvCA;IADlC,MAAMqB,OAAO,IAAIC;IACjB,KAAK,MAAMhD,SAASO,OAAO0C,MAAM,EAACvB,sBAAAA,KAAKI,MAAM,CAACb,MAAM,YAAlBS,sBAAsB,CAAC,GAAIqB,KAAKG,GAAG,CAAClD,MAAM+B,OAAO;IACnF,IAAIL,KAAKI,MAAM,CAACG,KAAK,EAAEc,KAAKG,GAAG,CAACxB,KAAKI,MAAM,CAACG,KAAK,CAACF,OAAO;IACzD,OAAOL,KAAKyB,QAAQ,CAACC,MAAM,CAAC,CAACrB,UAAYgB,KAAKM,GAAG,CAACtB,QAAQuB,EAAE;AAC9D"}

package/src/lib/server/connections/record-routes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export declare function recordRoute(request: Request): Promise<Response>;

package/src/lib/server/connections/record-routes.js

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { isListingId } from "./config.js";
+import { connectionRecordRef } from "./connection-store.js";
+import { installedConnection } from "./installed-connection.js";
+import { routeError, routeJson, siteConnectionsGate } from "./routes.js";
+import { toSiteRecord } from "./site-records.js";
+/*
+ * THE RECORD, FOR THE EDITOR (AGL-4195).
+ *
+ * A published page hands a signed element its connection's record with the
+ * page (the enricher in `site-records.ts`). The Besigner renders the same
+ * element in the console's browser, where there is no page render to ride:
+ * this route answers the same record, so the canvas can show what the
+ * published page will.
+ *
+ *   GET /api/plugin-connections/record?hostId=&listingId=&connectionId=
+ *
+ *   200 { record }  the record, held to the pinned version's declaration
+ *                   exactly as the page holds it, or `null` before the
+ *                   first sync and on a plan without connections
+ *   400             a parameter missing or malformed
+ *   401/403/404     the site gate (`siteConnectionsGate`): signed in,
+ *                   verified, "Manage a site's plugin connections" on the site
+ *   404             the site runs no plugin that declares the connection
+ *
+ * The record collection is server-only; this reads it with the Admin SDK
+ * for a member holding the site key, which is the same key that connects it.
+ */ const methodNotAllowed = ()=>new Response(JSON.stringify({
+        error: 'Method not allowed'
+    }), {
+        status: 405,
+        headers: {
+            'Content-Type': 'application/json',
+            Allow: 'GET',
+            'Cache-Control': 'no-store'
+        }
+    });
+const firestore = ()=>firebaseAdmin.app().firestore();
+export async function recordRoute(request) {
+    var _ref;
+    if (request.method !== 'GET') return methodNotAllowed();
+    const params = Object.fromEntries(new URL(request.url).searchParams.entries());
+    const actor = await siteConnectionsGate(request, params, {
+        requirePlan: false
+    });
+    if (actor instanceof Response) return actor;
+    const listingId = params['listingId'];
+    const connectionId = params['connectionId'];
+    if (!isListingId(listingId) || typeof connectionId !== 'string' || !connectionId) {
+        return routeError(400, 'Missing listingId or connectionId');
+    }
+    const found = await installedConnection(firestore(), {
+        hostId: actor.hostId,
+        orgId: actor.orgId,
+        listingId,
+        connectionId
+    });
+    if (!found) return routeError(404, 'This site runs no plugin that declares that connection.');
+    if (!actor.planAllows) return routeJson({
+        record: null,
+        planAllows: false
+    });
+    const snapshot = await connectionRecordRef(firestore(), actor.hostId, listingId, connectionId).get();
+    const data = snapshot.data();
+    const held = data && data['listingId'] === listingId && data['connectionId'] === connectionId ? toSiteRecord(data, found.connection) : null;
+    const record = held ? {
+        kind: 'record',
+        listingId,
+        connectionId,
+        version: String((_ref = data == null ? void 0 : data['version']) != null ? _ref : ''),
+        syncedAtMs: held.syncedAtMs,
+        fields: held.fields,
+        items: held.items
+    } : null;
+    return routeJson({
+        record,
+        planAllows: true
+    });
+}
+
+//# sourceMappingURL=record-routes.js.map

package/src/lib/server/connections/record-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/record-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport type { PluginConnectionRecordDoc } from '../../model/plugin-connections'\nimport { isListingId } from './config'\nimport { connectionRecordRef } from './connection-store'\nimport { installedConnection } from './installed-connection'\nimport { routeError, routeJson, siteConnectionsGate } from './routes'\nimport { toSiteRecord } from './site-records'\n\n/*\n * THE RECORD, FOR THE EDITOR (AGL-4195).\n *\n * A published page hands a signed element its connection's record with the\n * page (the enricher in `site-records.ts`). The Besigner renders the same\n * element in the console's browser, where there is no page render to ride:\n * this route answers the same record, so the canvas can show what the\n * published page will.\n *\n *   GET /api/plugin-connections/record?hostId=&listingId=&connectionId=\n *\n *   200 { record }  the record, held to the pinned version's declaration\n *                   exactly as the page holds it, or `null` before the\n *                   first sync and on a plan without connections\n *   400             a parameter missing or malformed\n *   401/403/404     the site gate (`siteConnectionsGate`): signed in,\n *                   verified, \"Manage a site's plugin connections\" on the site\n *   404             the site runs no plugin that declares the connection\n *\n * The record collection is server-only; this reads it with the Admin SDK\n * for a member holding the site key, which is the same key that connects it.\n */\n\nconst methodNotAllowed = () =>\n  new Response(JSON.stringify({ error: 'Method not allowed' }), {\n    status: 405,\n    headers: { 'Content-Type': 'application/json', Allow: 'GET', 'Cache-Control': 'no-store' },\n  })\n\nconst firestore = (): FirebaseFirestore.Firestore => firebaseAdmin.app().firestore()\n\nexport async function recordRoute(request: Request): Promise<Response> {\n  if (request.method !== 'GET') return methodNotAllowed()\n  const params: Record<string, unknown> = Object.fromEntries(new URL(request.url).searchParams.entries())\n  const actor = await siteConnectionsGate(request, params, { requirePlan: false })\n  if (actor instanceof Response) return actor\n  const listingId = params['listingId']\n  const connectionId = params['connectionId']\n  if (!isListingId(listingId) || typeof connectionId !== 'string' || !connectionId) {\n    return routeError(400, 'Missing listingId or connectionId')\n  }\n  const found = await installedConnection(firestore(), { hostId: actor.hostId, orgId: actor.orgId, listingId, connectionId })\n  if (!found) return routeError(404, 'This site runs no plugin that declares that connection.')\n  if (!actor.planAllows) return routeJson({ record: null, planAllows: false })\n  const snapshot = await connectionRecordRef(firestore(), actor.hostId, listingId, connectionId).get()\n  const data = snapshot.data() as Record<string, unknown> | undefined\n  const held = data && data['listingId'] === listingId && data['connectionId'] === connectionId ? toSiteRecord(data, found.connection) : null\n  const record: PluginConnectionRecordDoc | null = held\n    ? {\n        kind: 'record',\n        listingId,\n        connectionId,\n        version: String(data?.['version'] ?? ''),\n        syncedAtMs: held.syncedAtMs,\n        fields: held.fields,\n        items: held.items,\n      }\n    : null\n  return routeJson({ record, planAllows: true })\n}\n"],"names":["firebaseAdmin","isListingId","connectionRecordRef","installedConnection","routeError","routeJson","siteConnectionsGate","toSiteRecord","methodNotAllowed","Response","JSON","stringify","error","status","headers","Allow","firestore","app","recordRoute","request","method","params","Object","fromEntries","URL","url","searchParams","entries","actor","requirePlan","listingId","connectionId","found","hostId","orgId","planAllows","record","snapshot","get","data","held","connection","kind","version","String","syncedAtMs","fields","items"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,QAAQ,2BAA0B;AAExD,SAASC,WAAW,QAAQ,cAAU;AACtC,SAASC,mBAAmB,QAAQ,wBAAoB;AACxD,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,UAAU,EAAEC,SAAS,EAAEC,mBAAmB,QAAQ,cAAU;AACrE,SAASC,YAAY,QAAQ,oBAAgB;AAE7C;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,MAAMC,mBAAmB,IACvB,IAAIC,SAASC,KAAKC,SAAS,CAAC;QAAEC,OAAO;IAAqB,IAAI;QAC5DC,QAAQ;QACRC,SAAS;YAAE,gBAAgB;YAAoBC,OAAO;YAAO,iBAAiB;QAAW;IAC3F;AAEF,MAAMC,YAAY,IAAmChB,cAAciB,GAAG,GAAGD,SAAS;AAElF,OAAO,eAAeE,YAAYC,OAAgB;;IAChD,IAAIA,QAAQC,MAAM,KAAK,OAAO,OAAOZ;IACrC,MAAMa,SAAkCC,OAAOC,WAAW,CAAC,IAAIC,IAAIL,QAAQM,GAAG,EAAEC,YAAY,CAACC,OAAO;IACpG,MAAMC,QAAQ,MAAMtB,oBAAoBa,SAASE,QAAQ;QAAEQ,aAAa;IAAM;IAC9E,IAAID,iBAAiBnB,UAAU,OAAOmB;IACtC,MAAME,YAAYT,MAAM,CAAC,YAAY;IACrC,MAAMU,eAAeV,MAAM,CAAC,eAAe;IAC3C,IAAI,CAACpB,YAAY6B,cAAc,OAAOC,iBAAiB,YAAY,CAACA,cAAc;QAChF,OAAO3B,WAAW,KAAK;IACzB;IACA,MAAM4B,QAAQ,MAAM7B,oBAAoBa,aAAa;QAAEiB,QAAQL,MAAMK,MAAM;QAAEC,OAAON,MAAMM,KAAK;QAAEJ;QAAWC;IAAa;IACzH,IAAI,CAACC,OAAO,OAAO5B,WAAW,KAAK;IACnC,IAAI,CAACwB,MAAMO,UAAU,EAAE,OAAO9B,UAAU;QAAE+B,QAAQ;QAAMD,YAAY;IAAM;IAC1E,MAAME,WAAW,MAAMnC,oBAAoBc,aAAaY,MAAMK,MAAM,EAAEH,WAAWC,cAAcO,GAAG;IAClG,MAAMC,OAAOF,SAASE,IAAI;IAC1B,MAAMC,OAAOD,QAAQA,IAAI,CAAC,YAAY,KAAKT,aAAaS,IAAI,CAAC,eAAe,KAAKR,eAAexB,aAAagC,MAAMP,MAAMS,UAAU,IAAI;IACvI,MAAML,SAA2CI,OAC7C;QACEE,MAAM;QACNZ;QACAC;QACAY,SAASC,eAAOL,wBAAAA,IAAM,CAAC,UAAU,mBAAI;QACrCM,YAAYL,KAAKK,UAAU;QAC3BC,QAAQN,KAAKM,MAAM;QACnBC,OAAOP,KAAKO,KAAK;IACnB,IACA;IACJ,OAAO1C,UAAU;QAAE+B;QAAQD,YAAY;IAAK;AAC9C"}

package/src/lib/server/connections/revoke.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginConnectionDeclaration } from '@aglyn/aglyn/app-utils/plugin-connections';
+import { type PluginConnectionRecord } from './connection-store';
+/**
+ * Revokes a record's grant at the provider, best effort: a grant that cannot
+ * be revoked is still forgotten here, and the owner can remove the app on the
+ * provider's side. Never throws. Shared with the erasers.
+ *
+ * The revocation endpoint is the one the site's pinned version declares. A
+ * caller that has already lost the pin — an uninstall, a version that no
+ * longer declares the connection (AGL-4194) — passes the declaration it read
+ * before the pin moved.
+ */
+export declare function revokeRecord(record: PluginConnectionRecord, orgId: string | null, declaration?: PluginConnectionDeclaration | null): Promise<boolean>;

package/src/lib/server/connections/revoke.js

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { readPluginConnectionsKeyring } from "./config.js";
+import { openToken } from "./connection-store.js";
+import { openCredentials } from "./credentials-store.js";
+import { installedConnection } from "./installed-connection.js";
+import { revokePluginConnectionToken } from "./provider-http.js";
+/**
+ * Revokes a record's grant at the provider, best effort: a grant that cannot
+ * be revoked is still forgotten here, and the owner can remove the app on the
+ * provider's side. Never throws. Shared with the erasers.
+ *
+ * The revocation endpoint is the one the site's pinned version declares. A
+ * caller that has already lost the pin — an uninstall, a version that no
+ * longer declares the connection (AGL-4194) — passes the declaration it read
+ * before the pin moved.
+ */ export async function revokeRecord(record, orgId, declaration) {
+    const keyring = readPluginConnectionsKeyring();
+    if (!keyring) return false;
+    try {
+        var _this;
+        const connection = declaration != null ? declaration : (_this = await installedConnection(firebaseAdmin.app().firestore(), {
+            hostId: record.hostId,
+            orgId,
+            listingId: record.listingId,
+            connectionId: record.connectionId
+        })) == null ? void 0 : _this.connection;
+        if (!(connection == null ? void 0 : connection.revocationUrl)) return false;
+        const client = await openCredentials(firebaseAdmin.app().firestore(), keyring, record.listingId, record.connectionId).catch(()=>null);
+        const token = record.sealedRefreshToken ? openToken(keyring, record, 'refresh').token : openToken(keyring, record, 'access').token;
+        return await revokePluginConnectionToken(connection, client, token);
+    } catch (error) {
+        console.warn('plugin-connections: revoke failed', error instanceof Error ? error.message : error);
+        return false;
+    }
+}
+
+//# sourceMappingURL=revoke.js.map

package/src/lib/server/connections/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/revoke.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginConnectionDeclaration } from '@aglyn/aglyn/app-utils/plugin-connections'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { readPluginConnectionsKeyring } from './config'\nimport { openToken, type PluginConnectionRecord } from './connection-store'\nimport { openCredentials } from './credentials-store'\nimport { installedConnection } from './installed-connection'\nimport { revokePluginConnectionToken } from './provider-http'\n\n/**\n * Revokes a record's grant at the provider, best effort: a grant that cannot\n * be revoked is still forgotten here, and the owner can remove the app on the\n * provider's side. Never throws. Shared with the erasers.\n *\n * The revocation endpoint is the one the site's pinned version declares. A\n * caller that has already lost the pin — an uninstall, a version that no\n * longer declares the connection (AGL-4194) — passes the declaration it read\n * before the pin moved.\n */\nexport async function revokeRecord(\n  record: PluginConnectionRecord,\n  orgId: string | null,\n  declaration?: PluginConnectionDeclaration | null,\n): Promise<boolean> {\n  const keyring = readPluginConnectionsKeyring()\n  if (!keyring) return false\n  try {\n    const connection =\n      declaration ??\n      (\n        await installedConnection(firebaseAdmin.app().firestore(), {\n          hostId: record.hostId,\n          orgId,\n          listingId: record.listingId,\n          connectionId: record.connectionId,\n        })\n      )?.connection\n    if (!connection?.revocationUrl) return false\n    const client = await openCredentials(firebaseAdmin.app().firestore(), keyring, record.listingId, record.connectionId).catch(() => null)\n    const token = record.sealedRefreshToken\n      ? openToken(keyring, record, 'refresh').token\n      : openToken(keyring, record, 'access').token\n    return await revokePluginConnectionToken(connection, client, token)\n  } catch (error) {\n    console.warn('plugin-connections: revoke failed', error instanceof Error ? error.message : error)\n    return false\n  }\n}\n\n"],"names":["firebaseAdmin","readPluginConnectionsKeyring","openToken","openCredentials","installedConnection","revokePluginConnectionToken","revokeRecord","record","orgId","declaration","keyring","connection","app","firestore","hostId","listingId","connectionId","revocationUrl","client","catch","token","sealedRefreshToken","error","console","warn","Error","message"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,4BAA4B,QAAQ,cAAU;AACvD,SAASC,SAAS,QAAqC,wBAAoB;AAC3E,SAASC,eAAe,QAAQ,yBAAqB;AACrD,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,2BAA2B,QAAQ,qBAAiB;AAE7D;;;;;;;;;CASC,GACD,OAAO,eAAeC,aACpBC,MAA8B,EAC9BC,KAAoB,EACpBC,WAAgD;IAEhD,MAAMC,UAAUT;IAChB,IAAI,CAACS,SAAS,OAAO;IACrB,IAAI;YAIE;QAHJ,MAAMC,aACJF,sBAAAA,eAEE,QAAA,MAAML,oBAAoBJ,cAAcY,GAAG,GAAGC,SAAS,IAAI;YACzDC,QAAQP,OAAOO,MAAM;YACrBN;YACAO,WAAWR,OAAOQ,SAAS;YAC3BC,cAAcT,OAAOS,YAAY;QACnC,uBANF,AACE,MAMCL,UAAU;QACf,IAAI,EAACA,8BAAAA,WAAYM,aAAa,GAAE,OAAO;QACvC,MAAMC,SAAS,MAAMf,gBAAgBH,cAAcY,GAAG,GAAGC,SAAS,IAAIH,SAASH,OAAOQ,SAAS,EAAER,OAAOS,YAAY,EAAEG,KAAK,CAAC,IAAM;QAClI,MAAMC,QAAQb,OAAOc,kBAAkB,GACnCnB,UAAUQ,SAASH,QAAQ,WAAWa,KAAK,GAC3ClB,UAAUQ,SAASH,QAAQ,UAAUa,KAAK;QAC9C,OAAO,MAAMf,4BAA4BM,YAAYO,QAAQE;IAC/D,EAAE,OAAOE,OAAO;QACdC,QAAQC,IAAI,CAAC,qCAAqCF,iBAAiBG,QAAQH,MAAMI,OAAO,GAAGJ;QAC3F,OAAO;IACT;AACF"}