@aglyn/plugins-marketplace 1.15.0 → 1.15.2

package/src/lib/server/connections/credentials-store.js

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { openSecret, sealSecret } from "@aglyn/shared-util-tools/secret-box";
+import { PLUGIN_CONNECTION_CREDENTIALS_COLLECTION, pluginConnectionDocId } from "../../model/plugin-connections.js";
+export function credentialsRef(firestore, listingId, connectionId) {
+    return firestore.collection(PLUGIN_CONNECTION_CREDENTIALS_COLLECTION).doc(pluginConnectionDocId(listingId, connectionId));
+}
+/** The seal's context: this document and this value's purpose. */ export const credentialsContext = (listingId, connectionId, purpose)=>`plugin-connections:credentials:${listingId}:${connectionId}:${purpose}`;
+/** Builds the stored record for a pair the publisher typed. */ export function sealCredentials(keyring, input) {
+    return {
+        orgId: input.orgId,
+        listingId: input.listingId,
+        connectionId: input.connectionId,
+        sealedClientId: sealSecret(input.clientId, keyring.current, {
+            context: credentialsContext(input.listingId, input.connectionId, 'client-id')
+        }),
+        sealedClientSecret: sealSecret(input.clientSecret, keyring.current, {
+            context: credentialsContext(input.listingId, input.connectionId, 'client-secret')
+        }),
+        updatedAtMs: input.nowMs,
+        updatedBy: input.uid
+    };
+}
+export async function saveCredentials(firestore, record) {
+    await credentialsRef(firestore, record.listingId, record.connectionId).set(record);
+}
+export async function clearCredentials(firestore, listingId, connectionId) {
+    await credentialsRef(firestore, listingId, connectionId).delete();
+}
+/** Whether each named connection's credentials are set, and when: never the values. */ export async function credentialsStatus(firestore, listingId, connectionIds) {
+    const snapshots = await Promise.all(connectionIds.map((id)=>credentialsRef(firestore, listingId, id).get()));
+    const out = {};
+    connectionIds.forEach((id, index)=>{
+        const data = snapshots[index].exists ? snapshots[index].data() : undefined;
+        const set = typeof (data == null ? void 0 : data['sealedClientId']) === 'string' && typeof (data == null ? void 0 : data['sealedClientSecret']) === 'string';
+        out[id] = {
+            set,
+            updatedAtMs: set ? Number(data == null ? void 0 : data['updatedAtMs']) || null : null
+        };
+    });
+    return out;
+}
+/**
+ * The publisher's OAuth app for a listing's connection, opened, or `null`
+ * when it is not set. Throws `SecretBoxError` for a value that does not open
+ * (a key that was dropped from the ring, or a tampered document).
+ */ export async function openCredentials(firestore, keyring, listingId, connectionId) {
+    const snapshot = await credentialsRef(firestore, listingId, connectionId).get();
+    const data = snapshot.exists ? snapshot.data() : undefined;
+    if (typeof (data == null ? void 0 : data['sealedClientId']) !== 'string' || typeof (data == null ? void 0 : data['sealedClientSecret']) !== 'string') return null;
+    return {
+        clientId: openSecret(data['sealedClientId'], keyring, {
+            context: credentialsContext(listingId, connectionId, 'client-id')
+        }).plaintext,
+        clientSecret: openSecret(data['sealedClientSecret'], keyring, {
+            context: credentialsContext(listingId, connectionId, 'client-secret')
+        }).plaintext
+    };
+}
+/** Every credentials document a workspace's listings hold, for its erasure. */ export async function credentialsForOrg(firestore, orgId) {
+    const snapshot = await firestore.collection(PLUGIN_CONNECTION_CREDENTIALS_COLLECTION).where('orgId', '==', orgId).get();
+    return snapshot.docs;
+}
+
+//# sourceMappingURL=credentials-store.js.map

package/src/lib/server/connections/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/credentials-store.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { openSecret, sealSecret, type SecretBoxKeyring } from '@aglyn/shared-util-tools/secret-box'\nimport { PLUGIN_CONNECTION_CREDENTIALS_COLLECTION, pluginConnectionDocId } from '../../model/plugin-connections'\nimport type { PluginConnectionClient } from './provider-http'\n\n/**\n * A LISTING'S OAUTH APP, SEALED (AGL-4193).\n *\n * `pluginConnectionCredentials/{listingId}__{connectionId}`: the client id\n * and secret of the PUBLISHER's own OAuth app, which every site's connect for\n * that listing authenticates with. Both are sealed with\n * `PLUGIN_CONNECTIONS_TOKEN_KEY`, each bound to this document and its purpose\n * as the seal's context, so a value copied into another listing's document\n * refuses to open there.\n *\n * Write-only by design: no route reads either value back. A publisher sees\n * \"set\" or \"not set\", and replaces the pair whole. `orgId` names the\n * publishing workspace, so that workspace's erasure sweeps the document by\n * field (`orgKeyedCollections`), and the Firestore rules refuse every client.\n */\n\nexport interface PluginConnectionCredentialsRecord {\n  /** The publishing workspace. */\n  orgId: string\n  listingId: string\n  connectionId: string\n  sealedClientId: string\n  sealedClientSecret: string\n  updatedAtMs: number\n  updatedBy: string\n}\n\nexport function credentialsRef(\n  firestore: FirebaseFirestore.Firestore,\n  listingId: string,\n  connectionId: string,\n): FirebaseFirestore.DocumentReference {\n  return firestore.collection(PLUGIN_CONNECTION_CREDENTIALS_COLLECTION).doc(pluginConnectionDocId(listingId, connectionId))\n}\n\n/** The seal's context: this document and this value's purpose. */\nexport const credentialsContext = (listingId: string, connectionId: string, purpose: 'client-id' | 'client-secret') =>\n  `plugin-connections:credentials:${listingId}:${connectionId}:${purpose}`\n\n/** Builds the stored record for a pair the publisher typed. */\nexport function sealCredentials(\n  keyring: SecretBoxKeyring,\n  input: { orgId: string; listingId: string; connectionId: string; clientId: string; clientSecret: string; uid: string; nowMs: number },\n): PluginConnectionCredentialsRecord {\n  return {\n    orgId: input.orgId,\n    listingId: input.listingId,\n    connectionId: input.connectionId,\n    sealedClientId: sealSecret(input.clientId, keyring.current, {\n      context: credentialsContext(input.listingId, input.connectionId, 'client-id'),\n    }),\n    sealedClientSecret: sealSecret(input.clientSecret, keyring.current, {\n      context: credentialsContext(input.listingId, input.connectionId, 'client-secret'),\n    }),\n    updatedAtMs: input.nowMs,\n    updatedBy: input.uid,\n  }\n}\n\nexport async function saveCredentials(\n  firestore: FirebaseFirestore.Firestore,\n  record: PluginConnectionCredentialsRecord,\n): Promise<void> {\n  await credentialsRef(firestore, record.listingId, record.connectionId).set(record)\n}\n\nexport async function clearCredentials(\n  firestore: FirebaseFirestore.Firestore,\n  listingId: string,\n  connectionId: string,\n): Promise<void> {\n  await credentialsRef(firestore, listingId, connectionId).delete()\n}\n\n/** Whether each named connection's credentials are set, and when: never the values. */\nexport async function credentialsStatus(\n  firestore: FirebaseFirestore.Firestore,\n  listingId: string,\n  connectionIds: readonly string[],\n): Promise<Record<string, { set: boolean; updatedAtMs: number | null }>> {\n  const snapshots = await Promise.all(connectionIds.map((id) => credentialsRef(firestore, listingId, id).get()))\n  const out: Record<string, { set: boolean; updatedAtMs: number | null }> = {}\n  connectionIds.forEach((id, index) => {\n    const data = snapshots[index].exists ? snapshots[index].data() : undefined\n    const set = typeof data?.['sealedClientId'] === 'string' && typeof data?.['sealedClientSecret'] === 'string'\n    out[id] = { set, updatedAtMs: set ? Number(data?.['updatedAtMs']) || null : null }\n  })\n  return out\n}\n\n/**\n * The publisher's OAuth app for a listing's connection, opened, or `null`\n * when it is not set. Throws `SecretBoxError` for a value that does not open\n * (a key that was dropped from the ring, or a tampered document).\n */\nexport async function openCredentials(\n  firestore: FirebaseFirestore.Firestore,\n  keyring: SecretBoxKeyring,\n  listingId: string,\n  connectionId: string,\n): Promise<PluginConnectionClient | null> {\n  const snapshot = await credentialsRef(firestore, listingId, connectionId).get()\n  const data = snapshot.exists ? snapshot.data() : undefined\n  if (typeof data?.['sealedClientId'] !== 'string' || typeof data?.['sealedClientSecret'] !== 'string') return null\n  return {\n    clientId: openSecret(data['sealedClientId'], keyring, {\n      context: credentialsContext(listingId, connectionId, 'client-id'),\n    }).plaintext,\n    clientSecret: openSecret(data['sealedClientSecret'], keyring, {\n      context: credentialsContext(listingId, connectionId, 'client-secret'),\n    }).plaintext,\n  }\n}\n\n/** Every credentials document a workspace's listings hold, for its erasure. */\nexport async function credentialsForOrg(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n): Promise<FirebaseFirestore.QueryDocumentSnapshot[]> {\n  const snapshot = await firestore.collection(PLUGIN_CONNECTION_CREDENTIALS_COLLECTION).where('orgId', '==', orgId).get()\n  return snapshot.docs\n}\n"],"names":["openSecret","sealSecret","PLUGIN_CONNECTION_CREDENTIALS_COLLECTION","pluginConnectionDocId","credentialsRef","firestore","listingId","connectionId","collection","doc","credentialsContext","purpose","sealCredentials","keyring","input","orgId","sealedClientId","clientId","current","context","sealedClientSecret","clientSecret","updatedAtMs","nowMs","updatedBy","uid","saveCredentials","record","set","clearCredentials","delete","credentialsStatus","connectionIds","snapshots","Promise","all","map","id","get","out","forEach","index","data","exists","undefined","Number","openCredentials","snapshot","plaintext","credentialsForOrg","where","docs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,UAAU,QAA+B,sCAAqC;AACnG,SAASC,wCAAwC,EAAEC,qBAAqB,QAAQ,oCAAgC;AA8BhH,OAAO,SAASC,eACdC,SAAsC,EACtCC,SAAiB,EACjBC,YAAoB;IAEpB,OAAOF,UAAUG,UAAU,CAACN,0CAA0CO,GAAG,CAACN,sBAAsBG,WAAWC;AAC7G;AAEA,gEAAgE,GAChE,OAAO,MAAMG,qBAAqB,CAACJ,WAAmBC,cAAsBI,UAC1E,CAAC,+BAA+B,EAAEL,UAAU,CAAC,EAAEC,aAAa,CAAC,EAAEI,SAAS,CAAA;AAE1E,6DAA6D,GAC7D,OAAO,SAASC,gBACdC,OAAyB,EACzBC,KAAqI;IAErI,OAAO;QACLC,OAAOD,MAAMC,KAAK;QAClBT,WAAWQ,MAAMR,SAAS;QAC1BC,cAAcO,MAAMP,YAAY;QAChCS,gBAAgBf,WAAWa,MAAMG,QAAQ,EAAEJ,QAAQK,OAAO,EAAE;YAC1DC,SAAST,mBAAmBI,MAAMR,SAAS,EAAEQ,MAAMP,YAAY,EAAE;QACnE;QACAa,oBAAoBnB,WAAWa,MAAMO,YAAY,EAAER,QAAQK,OAAO,EAAE;YAClEC,SAAST,mBAAmBI,MAAMR,SAAS,EAAEQ,MAAMP,YAAY,EAAE;QACnE;QACAe,aAAaR,MAAMS,KAAK;QACxBC,WAAWV,MAAMW,GAAG;IACtB;AACF;AAEA,OAAO,eAAeC,gBACpBrB,SAAsC,EACtCsB,MAAyC;IAEzC,MAAMvB,eAAeC,WAAWsB,OAAOrB,SAAS,EAAEqB,OAAOpB,YAAY,EAAEqB,GAAG,CAACD;AAC7E;AAEA,OAAO,eAAeE,iBACpBxB,SAAsC,EACtCC,SAAiB,EACjBC,YAAoB;IAEpB,MAAMH,eAAeC,WAAWC,WAAWC,cAAcuB,MAAM;AACjE;AAEA,qFAAqF,GACrF,OAAO,eAAeC,kBACpB1B,SAAsC,EACtCC,SAAiB,EACjB0B,aAAgC;IAEhC,MAAMC,YAAY,MAAMC,QAAQC,GAAG,CAACH,cAAcI,GAAG,CAAC,CAACC,KAAOjC,eAAeC,WAAWC,WAAW+B,IAAIC,GAAG;IAC1G,MAAMC,MAAoE,CAAC;IAC3EP,cAAcQ,OAAO,CAAC,CAACH,IAAII;QACzB,MAAMC,OAAOT,SAAS,CAACQ,MAAM,CAACE,MAAM,GAAGV,SAAS,CAACQ,MAAM,CAACC,IAAI,KAAKE;QACjE,MAAMhB,MAAM,QAAOc,wBAAAA,IAAM,CAAC,iBAAiB,MAAK,YAAY,QAAOA,wBAAAA,IAAM,CAAC,qBAAqB,MAAK;QACpGH,GAAG,CAACF,GAAG,GAAG;YAAET;YAAKN,aAAaM,MAAMiB,OAAOH,wBAAAA,IAAM,CAAC,cAAc,KAAK,OAAO;QAAK;IACnF;IACA,OAAOH;AACT;AAEA;;;;CAIC,GACD,OAAO,eAAeO,gBACpBzC,SAAsC,EACtCQ,OAAyB,EACzBP,SAAiB,EACjBC,YAAoB;IAEpB,MAAMwC,WAAW,MAAM3C,eAAeC,WAAWC,WAAWC,cAAc+B,GAAG;IAC7E,MAAMI,OAAOK,SAASJ,MAAM,GAAGI,SAASL,IAAI,KAAKE;IACjD,IAAI,QAAOF,wBAAAA,IAAM,CAAC,iBAAiB,MAAK,YAAY,QAAOA,wBAAAA,IAAM,CAAC,qBAAqB,MAAK,UAAU,OAAO;IAC7G,OAAO;QACLzB,UAAUjB,WAAW0C,IAAI,CAAC,iBAAiB,EAAE7B,SAAS;YACpDM,SAAST,mBAAmBJ,WAAWC,cAAc;QACvD,GAAGyC,SAAS;QACZ3B,cAAcrB,WAAW0C,IAAI,CAAC,qBAAqB,EAAE7B,SAAS;YAC5DM,SAAST,mBAAmBJ,WAAWC,cAAc;QACvD,GAAGyC,SAAS;IACd;AACF;AAEA,6EAA6E,GAC7E,OAAO,eAAeC,kBACpB5C,SAAsC,EACtCU,KAAa;IAEb,MAAMgC,WAAW,MAAM1C,UAAUG,UAAU,CAACN,0CAA0CgD,KAAK,CAAC,SAAS,MAAMnC,OAAOuB,GAAG;IACrH,OAAOS,SAASI,IAAI;AACtB"}

package/src/lib/server/connections/erasure.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginOrgErasureReport, PluginOrgErasureRequest } from '@aglyn/aglyn/plugin-manager/plugin-org-erasure';
+import type { PluginSiteResourcePreview, PluginSiteResourceRequest } from '@aglyn/aglyn/plugin-manager/plugin-site-resources';
+/** The site-resource eraser: nothing to preview, every grant revoked and deleted on erase. */
+export declare const pluginConnectionsSiteEraser: {
+    preview(): Promise<PluginSiteResourcePreview>;
+    erase(request: PluginSiteResourceRequest): Promise<number>;
+};
+/** The workspace's share: its listings' OAuth app credentials, counted and (unless a dry run) deleted. */
+export declare function erasePluginConnectionCredentials(request: PluginOrgErasureRequest): Promise<PluginOrgErasureReport>;

package/src/lib/server/connections/erasure.js

@@ -0,0 +1,72 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { connectionsCollection, listHostConnections } from "./connection-store.js";
+import { credentialsForOrg } from "./credentials-store.js";
+import { revokeRecord } from "./revoke.js";
+/**
+ * DECLARED CONNECTIONS GO WITH WHAT HELD THEM (AGL-4193).
+ *
+ * A SITE deleted takes its connections: `hosts/{hostId}/pluginConnections`
+ * is under the site's tree, so `eraseHost`'s recursive delete removes the
+ * documents. What it cannot reach is the grant at the provider, which would
+ * otherwise go on opening the business's account after the site that held
+ * it is gone. So the site-resource eraser, which runs before that delete,
+ * revokes each grant first (best effort: a revoke that fails is logged, and
+ * the sealed token is deleted either way), then deletes the documents itself
+ * so nothing depends on the order.
+ *
+ * A WORKSPACE erased takes the OAuth app credentials its listings hold
+ * (`pluginConnectionCredentials`, keyed by `orgId`): the erasure sweeps that
+ * collection by field (`orgKeyedCollections`), and the marketplace's org
+ * eraser deletes them too and counts them, so the audit record says how many
+ * went. Its sites' connections go with each site, through the eraser above.
+ *
+ * Nothing is listed on the Delete site card: a connection holds no content of
+ * the owner's, only a grant the owner can make again.
+ */ const firestore = ()=>firebaseAdmin.app().firestore();
+/** The site-resource eraser: nothing to preview, every grant revoked and deleted on erase. */ export const pluginConnectionsSiteEraser = {
+    async preview () {
+        return {
+            noun: [
+                'plugin connection',
+                'plugin connections'
+            ],
+            itemNoun: [
+                'item',
+                'items'
+            ],
+            going: [],
+            staying: 0
+        };
+    },
+    async erase (request) {
+        const records = await listHostConnections(firestore(), request.hostId);
+        for (const record of records)await revokeRecord(record, request.orgId);
+        const snapshot = await connectionsCollection(firestore(), request.hostId).get();
+        await Promise.all(snapshot.docs.map((doc)=>doc.ref.delete()));
+        return records.length;
+    }
+};
+/** The workspace's share: its listings' OAuth app credentials, counted and (unless a dry run) deleted. */ export async function erasePluginConnectionCredentials(request) {
+    const docs = await credentialsForOrg(firestore(), request.orgId);
+    if (!request.dryRun) await Promise.all(docs.map((doc)=>doc.ref.delete()));
+    return {
+        connectionCredentials: docs.length
+    };
+}
+
+//# sourceMappingURL=erasure.js.map

package/src/lib/server/connections/erasure.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/erasure.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginOrgErasureReport, PluginOrgErasureRequest } from '@aglyn/aglyn/plugin-manager/plugin-org-erasure'\nimport type {\n  PluginSiteResourcePreview,\n  PluginSiteResourceRequest,\n} from '@aglyn/aglyn/plugin-manager/plugin-site-resources'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { connectionsCollection, listHostConnections } from './connection-store'\nimport { credentialsForOrg } from './credentials-store'\nimport { revokeRecord } from './revoke'\n\n/**\n * DECLARED CONNECTIONS GO WITH WHAT HELD THEM (AGL-4193).\n *\n * A SITE deleted takes its connections: `hosts/{hostId}/pluginConnections`\n * is under the site's tree, so `eraseHost`'s recursive delete removes the\n * documents. What it cannot reach is the grant at the provider, which would\n * otherwise go on opening the business's account after the site that held\n * it is gone. So the site-resource eraser, which runs before that delete,\n * revokes each grant first (best effort: a revoke that fails is logged, and\n * the sealed token is deleted either way), then deletes the documents itself\n * so nothing depends on the order.\n *\n * A WORKSPACE erased takes the OAuth app credentials its listings hold\n * (`pluginConnectionCredentials`, keyed by `orgId`): the erasure sweeps that\n * collection by field (`orgKeyedCollections`), and the marketplace's org\n * eraser deletes them too and counts them, so the audit record says how many\n * went. Its sites' connections go with each site, through the eraser above.\n *\n * Nothing is listed on the Delete site card: a connection holds no content of\n * the owner's, only a grant the owner can make again.\n */\n\nconst firestore = (): FirebaseFirestore.Firestore => firebaseAdmin.app().firestore()\n\n/** The site-resource eraser: nothing to preview, every grant revoked and deleted on erase. */\nexport const pluginConnectionsSiteEraser = {\n  async preview(): Promise<PluginSiteResourcePreview> {\n    return { noun: ['plugin connection', 'plugin connections'], itemNoun: ['item', 'items'], going: [], staying: 0 }\n  },\n  async erase(request: PluginSiteResourceRequest): Promise<number> {\n    const records = await listHostConnections(firestore(), request.hostId)\n    for (const record of records) await revokeRecord(record, request.orgId)\n    const snapshot = await connectionsCollection(firestore(), request.hostId).get()\n    await Promise.all(snapshot.docs.map((doc) => doc.ref.delete()))\n    return records.length\n  },\n}\n\n/** The workspace's share: its listings' OAuth app credentials, counted and (unless a dry run) deleted. */\nexport async function erasePluginConnectionCredentials(request: PluginOrgErasureRequest): Promise<PluginOrgErasureReport> {\n  const docs = await credentialsForOrg(firestore(), request.orgId)\n  if (!request.dryRun) await Promise.all(docs.map((doc) => doc.ref.delete()))\n  return { connectionCredentials: docs.length }\n}\n"],"names":["firebaseAdmin","connectionsCollection","listHostConnections","credentialsForOrg","revokeRecord","firestore","app","pluginConnectionsSiteEraser","preview","noun","itemNoun","going","staying","erase","request","records","hostId","record","orgId","snapshot","get","Promise","all","docs","map","doc","ref","delete","length","erasePluginConnectionCredentials","dryRun","connectionCredentials"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAOD,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,qBAAqB,EAAEC,mBAAmB,QAAQ,wBAAoB;AAC/E,SAASC,iBAAiB,QAAQ,yBAAqB;AACvD,SAASC,YAAY,QAAQ,cAAU;AAEvC;;;;;;;;;;;;;;;;;;;;CAoBC,GAED,MAAMC,YAAY,IAAmCL,cAAcM,GAAG,GAAGD,SAAS;AAElF,4FAA4F,GAC5F,OAAO,MAAME,8BAA8B;IACzC,MAAMC;QACJ,OAAO;YAAEC,MAAM;gBAAC;gBAAqB;aAAqB;YAAEC,UAAU;gBAAC;gBAAQ;aAAQ;YAAEC,OAAO,EAAE;YAAEC,SAAS;QAAE;IACjH;IACA,MAAMC,OAAMC,OAAkC;QAC5C,MAAMC,UAAU,MAAMb,oBAAoBG,aAAaS,QAAQE,MAAM;QACrE,KAAK,MAAMC,UAAUF,QAAS,MAAMX,aAAaa,QAAQH,QAAQI,KAAK;QACtE,MAAMC,WAAW,MAAMlB,sBAAsBI,aAAaS,QAAQE,MAAM,EAAEI,GAAG;QAC7E,MAAMC,QAAQC,GAAG,CAACH,SAASI,IAAI,CAACC,GAAG,CAAC,CAACC,MAAQA,IAAIC,GAAG,CAACC,MAAM;QAC3D,OAAOZ,QAAQa,MAAM;IACvB;AACF,EAAC;AAED,wGAAwG,GACxG,OAAO,eAAeC,iCAAiCf,OAAgC;IACrF,MAAMS,OAAO,MAAMpB,kBAAkBE,aAAaS,QAAQI,KAAK;IAC/D,IAAI,CAACJ,QAAQgB,MAAM,EAAE,MAAMT,QAAQC,GAAG,CAACC,KAAKC,GAAG,CAAC,CAACC,MAAQA,IAAIC,GAAG,CAACC,MAAM;IACvE,OAAO;QAAEI,uBAAuBR,KAAKK,MAAM;IAAC;AAC9C"}

package/src/lib/server/connections/installed-connection.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginConnectionDeclaration } from '@aglyn/aglyn/app-utils/plugin-connections';
+/**
+ * WHICH CONNECTIONS A SITE'S INSTALLED PLUGINS DECLARE (AGL-4193).
+ *
+ * A connection is run under the declaration of the version the site has
+ * PINNED, never the listing's latest: a publisher shipping a new version must
+ * not change where an existing site's token is sent until that site moves to
+ * it. The pin carries its manifest (`hosts/{hostId}/installs/{listingId}`, or
+ * the workspace-wide `orgs/{orgId}/installs/{listingId}`), and every read here
+ * re-validates it, because a denormalized copy is data, not a verdict.
+ *
+ * A version the kill switch revoked declares nothing: its connections stop
+ * connecting with the code that declared them.
+ */
+export interface InstalledPluginConnections {
+    listingId: string;
+    version: string;
+    /** The pinned plugin's name, for the activity feed. */
+    displayName: string;
+    connections: PluginConnectionDeclaration[];
+}
+/** The site's pin of one listing (the site's own first, then the workspace's), with its connections. */
+export declare function installedPluginConnections(firestore: FirebaseFirestore.Firestore, input: {
+    hostId: string;
+    orgId: string | null;
+    listingId: string;
+}): Promise<InstalledPluginConnections | null>;
+/** One declared connection of a listing the site runs, or `null`. */
+export declare function installedConnection(firestore: FirebaseFirestore.Firestore, input: {
+    hostId: string;
+    orgId: string | null;
+    listingId: string;
+    connectionId: string;
+}): Promise<{
+    installed: InstalledPluginConnections;
+    connection: PluginConnectionDeclaration;
+} | null>;
+/** Every plugin the site runs that declares a connection: its own pins over the workspace's. */
+export declare function installedConnectionsForHost(firestore: FirebaseFirestore.Firestore, input: {
+    hostId: string;
+    orgId: string | null;
+}): Promise<InstalledPluginConnections[]>;
+/**
+ * The connections a listing's LATEST version declares, for its publisher's
+ * credentials form: credentials belong to the listing, and the form offers
+ * what the newest version asks for.
+ */
+export declare function latestListingConnections(firestore: FirebaseFirestore.Firestore, listingId: string, latestVersion: string): Promise<PluginConnectionDeclaration[]>;

package/src/lib/server/connections/installed-connection.js

@@ -0,0 +1,92 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { findPluginConnection, validatePluginConnections } from "@aglyn/aglyn/app-utils/plugin-connections";
+import { isPluginRevoked } from "@aglyn/aglyn/app-utils/plugin-manifest";
+async function revocationFor(firestore, listingId) {
+    return (await firestore.collection('revocations').doc(listingId).get()).data();
+}
+function readPin(listingId, data, revocation) {
+    var _data_version, _data_manifest, _ref, _data_displayName;
+    if (!data) return null;
+    const version = String((_data_version = data['version']) != null ? _data_version : '');
+    if (!version || isPluginRevoked(revocation, version)) return null;
+    const manifest = (_data_manifest = data['manifest']) != null ? _data_manifest : null;
+    const verdict = validatePluginConnections(manifest == null ? void 0 : manifest.connections);
+    if (verdict.ok === false || !verdict.value.length) return null;
+    return {
+        listingId,
+        version,
+        displayName: String((_ref = (_data_displayName = data['displayName']) != null ? _data_displayName : manifest == null ? void 0 : manifest.name) != null ? _ref : listingId).slice(0, 120),
+        connections: verdict.value
+    };
+}
+/** The site's pin of one listing (the site's own first, then the workspace's), with its connections. */ export async function installedPluginConnections(firestore, input) {
+    const [hostPin, orgPin, revocation] = await Promise.all([
+        firestore.collection('hosts').doc(input.hostId).collection('installs').doc(input.listingId).get(),
+        input.orgId ? firestore.collection('orgs').doc(input.orgId).collection('installs').doc(input.listingId).get() : Promise.resolve(null),
+        revocationFor(firestore, input.listingId)
+    ]);
+    const pin = hostPin.exists ? hostPin.data() : (orgPin == null ? void 0 : orgPin.exists) ? orgPin.data() : undefined;
+    return readPin(input.listingId, pin, revocation);
+}
+/** One declared connection of a listing the site runs, or `null`. */ export async function installedConnection(firestore, input) {
+    const installed = await installedPluginConnections(firestore, input);
+    if (!installed) return null;
+    const connection = findPluginConnection({
+        connections: installed.connections
+    }, input.connectionId);
+    return connection ? {
+        installed,
+        connection
+    } : null;
+}
+/** Every plugin the site runs that declares a connection: its own pins over the workspace's. */ export async function installedConnectionsForHost(firestore, input) {
+    var _ref;
+    const [hostPins, orgPins] = await Promise.all([
+        firestore.collection('hosts').doc(input.hostId).collection('installs').get(),
+        input.orgId ? firestore.collection('orgs').doc(input.orgId).collection('installs').get() : Promise.resolve(null)
+    ]);
+    const pins = new Map();
+    for (const doc of (_ref = orgPins == null ? void 0 : orgPins.docs) != null ? _ref : [])pins.set(doc.id, doc.data());
+    // The site's own pin wins, as it does for the loaders.
+    for (const doc of hostPins.docs)pins.set(doc.id, doc.data());
+    const declaring = [
+        ...pins.entries()
+    ].filter(([, data])=>{
+        var _data_manifest;
+        const connections = (_data_manifest = data['manifest']) == null ? void 0 : _data_manifest.connections;
+        return Array.isArray(connections) && connections.length > 0;
+    });
+    const out = [];
+    for (const [listingId, data] of declaring){
+        const read = readPin(listingId, data, await revocationFor(firestore, listingId));
+        if (read) out.push(read);
+    }
+    return out;
+}
+/**
+ * The connections a listing's LATEST version declares, for its publisher's
+ * credentials form: credentials belong to the listing, and the form offers
+ * what the newest version asks for.
+ */ export async function latestListingConnections(firestore, listingId, latestVersion) {
+    var _snapshot_get;
+    if (!latestVersion) return [];
+    const snapshot = await firestore.collection('marketplaceListings').doc(listingId).collection('pluginVersions').doc(latestVersion).get();
+    const verdict = validatePluginConnections((_snapshot_get = snapshot.get('manifest')) == null ? void 0 : _snapshot_get.connections);
+    return verdict.ok === false ? [] : verdict.value;
+}
+
+//# sourceMappingURL=installed-connection.js.map

package/src/lib/server/connections/installed-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/installed-connection.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  findPluginConnection,\n  validatePluginConnections,\n  type PluginConnectionDeclaration,\n} from '@aglyn/aglyn/app-utils/plugin-connections'\nimport { isPluginRevoked, type PluginRevocation } from '@aglyn/aglyn/app-utils/plugin-manifest'\n\n/**\n * WHICH CONNECTIONS A SITE'S INSTALLED PLUGINS DECLARE (AGL-4193).\n *\n * A connection is run under the declaration of the version the site has\n * PINNED, never the listing's latest: a publisher shipping a new version must\n * not change where an existing site's token is sent until that site moves to\n * it. The pin carries its manifest (`hosts/{hostId}/installs/{listingId}`, or\n * the workspace-wide `orgs/{orgId}/installs/{listingId}`), and every read here\n * re-validates it, because a denormalized copy is data, not a verdict.\n *\n * A version the kill switch revoked declares nothing: its connections stop\n * connecting with the code that declared them.\n */\n\nexport interface InstalledPluginConnections {\n  listingId: string\n  version: string\n  /** The pinned plugin's name, for the activity feed. */\n  displayName: string\n  connections: PluginConnectionDeclaration[]\n}\n\nasync function revocationFor(\n  firestore: FirebaseFirestore.Firestore,\n  listingId: string,\n): Promise<PluginRevocation | undefined> {\n  return (await firestore.collection('revocations').doc(listingId).get()).data() as PluginRevocation | undefined\n}\n\nfunction readPin(\n  listingId: string,\n  data: Record<string, unknown> | undefined,\n  revocation: PluginRevocation | undefined,\n): InstalledPluginConnections | null {\n  if (!data) return null\n  const version = String(data['version'] ?? '')\n  if (!version || isPluginRevoked(revocation, version)) return null\n  const manifest = (data['manifest'] ?? null) as { connections?: unknown; name?: unknown } | null\n  const verdict = validatePluginConnections(manifest?.connections)\n  if (verdict.ok === false || !verdict.value.length) return null\n  return {\n    listingId,\n    version,\n    displayName: String(data['displayName'] ?? manifest?.name ?? listingId).slice(0, 120),\n    connections: verdict.value,\n  }\n}\n\n/** The site's pin of one listing (the site's own first, then the workspace's), with its connections. */\nexport async function installedPluginConnections(\n  firestore: FirebaseFirestore.Firestore,\n  input: { hostId: string; orgId: string | null; listingId: string },\n): Promise<InstalledPluginConnections | null> {\n  const [hostPin, orgPin, revocation] = await Promise.all([\n    firestore.collection('hosts').doc(input.hostId).collection('installs').doc(input.listingId).get(),\n    input.orgId\n      ? firestore.collection('orgs').doc(input.orgId).collection('installs').doc(input.listingId).get()\n      : Promise.resolve(null),\n    revocationFor(firestore, input.listingId),\n  ])\n  const pin = hostPin.exists ? hostPin.data() : orgPin?.exists ? orgPin.data() : undefined\n  return readPin(input.listingId, pin, revocation)\n}\n\n/** One declared connection of a listing the site runs, or `null`. */\nexport async function installedConnection(\n  firestore: FirebaseFirestore.Firestore,\n  input: { hostId: string; orgId: string | null; listingId: string; connectionId: string },\n): Promise<{ installed: InstalledPluginConnections; connection: PluginConnectionDeclaration } | null> {\n  const installed = await installedPluginConnections(firestore, input)\n  if (!installed) return null\n  const connection = findPluginConnection({ connections: installed.connections }, input.connectionId)\n  return connection ? { installed, connection } : null\n}\n\n/** Every plugin the site runs that declares a connection: its own pins over the workspace's. */\nexport async function installedConnectionsForHost(\n  firestore: FirebaseFirestore.Firestore,\n  input: { hostId: string; orgId: string | null },\n): Promise<InstalledPluginConnections[]> {\n  const [hostPins, orgPins] = await Promise.all([\n    firestore.collection('hosts').doc(input.hostId).collection('installs').get(),\n    input.orgId ? firestore.collection('orgs').doc(input.orgId).collection('installs').get() : Promise.resolve(null),\n  ])\n  const pins = new Map<string, Record<string, unknown>>()\n  for (const doc of orgPins?.docs ?? []) pins.set(doc.id, doc.data())\n  // The site's own pin wins, as it does for the loaders.\n  for (const doc of hostPins.docs) pins.set(doc.id, doc.data())\n  const declaring = [...pins.entries()].filter(([, data]) => {\n    const connections = (data['manifest'] as { connections?: unknown } | undefined)?.connections\n    return Array.isArray(connections) && connections.length > 0\n  })\n  const out: InstalledPluginConnections[] = []\n  for (const [listingId, data] of declaring) {\n    const read = readPin(listingId, data, await revocationFor(firestore, listingId))\n    if (read) out.push(read)\n  }\n  return out\n}\n\n/**\n * The connections a listing's LATEST version declares, for its publisher's\n * credentials form: credentials belong to the listing, and the form offers\n * what the newest version asks for.\n */\nexport async function latestListingConnections(\n  firestore: FirebaseFirestore.Firestore,\n  listingId: string,\n  latestVersion: string,\n): Promise<PluginConnectionDeclaration[]> {\n  if (!latestVersion) return []\n  const snapshot = await firestore\n    .collection('marketplaceListings')\n    .doc(listingId)\n    .collection('pluginVersions')\n    .doc(latestVersion)\n    .get()\n  const verdict = validatePluginConnections((snapshot.get('manifest') as { connections?: unknown } | undefined)?.connections)\n  return verdict.ok === false ? [] : verdict.value\n}\n"],"names":["findPluginConnection","validatePluginConnections","isPluginRevoked","revocationFor","firestore","listingId","collection","doc","get","data","readPin","revocation","version","String","manifest","verdict","connections","ok","value","length","displayName","name","slice","installedPluginConnections","input","hostPin","orgPin","Promise","all","hostId","orgId","resolve","pin","exists","undefined","installedConnection","installed","connection","connectionId","installedConnectionsForHost","hostPins","orgPins","pins","Map","docs","set","id","declaring","entries","filter","Array","isArray","out","read","push","latestListingConnections","latestVersion","snapshot"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,oBAAoB,EACpBC,yBAAyB,QAEpB,4CAA2C;AAClD,SAASC,eAAe,QAA+B,yCAAwC;AAwB/F,eAAeC,cACbC,SAAsC,EACtCC,SAAiB;IAEjB,OAAO,AAAC,CAAA,MAAMD,UAAUE,UAAU,CAAC,eAAeC,GAAG,CAACF,WAAWG,GAAG,EAAC,EAAGC,IAAI;AAC9E;AAEA,SAASC,QACPL,SAAiB,EACjBI,IAAyC,EACzCE,UAAwC;QAGjBF,eAELA,gBAMIA,MAAAA;IATtB,IAAI,CAACA,MAAM,OAAO;IAClB,MAAMG,UAAUC,QAAOJ,gBAAAA,IAAI,CAAC,UAAU,YAAfA,gBAAmB;IAC1C,IAAI,CAACG,WAAWV,gBAAgBS,YAAYC,UAAU,OAAO;IAC7D,MAAME,YAAYL,iBAAAA,IAAI,CAAC,WAAW,YAAhBA,iBAAoB;IACtC,MAAMM,UAAUd,0BAA0Ba,4BAAAA,SAAUE,WAAW;IAC/D,IAAID,QAAQE,EAAE,KAAK,SAAS,CAACF,QAAQG,KAAK,CAACC,MAAM,EAAE,OAAO;IAC1D,OAAO;QACLd;QACAO;QACAQ,aAAaP,QAAOJ,QAAAA,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuBK,4BAAAA,SAAUO,IAAI,YAArCZ,OAAyCJ,WAAWiB,KAAK,CAAC,GAAG;QACjFN,aAAaD,QAAQG,KAAK;IAC5B;AACF;AAEA,sGAAsG,GACtG,OAAO,eAAeK,2BACpBnB,SAAsC,EACtCoB,KAAkE;IAElE,MAAM,CAACC,SAASC,QAAQf,WAAW,GAAG,MAAMgB,QAAQC,GAAG,CAAC;QACtDxB,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACiB,MAAMK,MAAM,EAAEvB,UAAU,CAAC,YAAYC,GAAG,CAACiB,MAAMnB,SAAS,EAAEG,GAAG;QAC/FgB,MAAMM,KAAK,GACP1B,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACiB,MAAMM,KAAK,EAAExB,UAAU,CAAC,YAAYC,GAAG,CAACiB,MAAMnB,SAAS,EAAEG,GAAG,KAC7FmB,QAAQI,OAAO,CAAC;QACpB5B,cAAcC,WAAWoB,MAAMnB,SAAS;KACzC;IACD,MAAM2B,MAAMP,QAAQQ,MAAM,GAAGR,QAAQhB,IAAI,KAAKiB,CAAAA,0BAAAA,OAAQO,MAAM,IAAGP,OAAOjB,IAAI,KAAKyB;IAC/E,OAAOxB,QAAQc,MAAMnB,SAAS,EAAE2B,KAAKrB;AACvC;AAEA,mEAAmE,GACnE,OAAO,eAAewB,oBACpB/B,SAAsC,EACtCoB,KAAwF;IAExF,MAAMY,YAAY,MAAMb,2BAA2BnB,WAAWoB;IAC9D,IAAI,CAACY,WAAW,OAAO;IACvB,MAAMC,aAAarC,qBAAqB;QAAEgB,aAAaoB,UAAUpB,WAAW;IAAC,GAAGQ,MAAMc,YAAY;IAClG,OAAOD,aAAa;QAAED;QAAWC;IAAW,IAAI;AAClD;AAEA,8FAA8F,GAC9F,OAAO,eAAeE,4BACpBnC,SAAsC,EACtCoB,KAA+C;;IAE/C,MAAM,CAACgB,UAAUC,QAAQ,GAAG,MAAMd,QAAQC,GAAG,CAAC;QAC5CxB,UAAUE,UAAU,CAAC,SAASC,GAAG,CAACiB,MAAMK,MAAM,EAAEvB,UAAU,CAAC,YAAYE,GAAG;QAC1EgB,MAAMM,KAAK,GAAG1B,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACiB,MAAMM,KAAK,EAAExB,UAAU,CAAC,YAAYE,GAAG,KAAKmB,QAAQI,OAAO,CAAC;KAC5G;IACD,MAAMW,OAAO,IAAIC;IACjB,KAAK,MAAMpC,eAAOkC,2BAAAA,QAASG,IAAI,mBAAI,EAAE,CAAEF,KAAKG,GAAG,CAACtC,IAAIuC,EAAE,EAAEvC,IAAIE,IAAI;IAChE,uDAAuD;IACvD,KAAK,MAAMF,OAAOiC,SAASI,IAAI,CAAEF,KAAKG,GAAG,CAACtC,IAAIuC,EAAE,EAAEvC,IAAIE,IAAI;IAC1D,MAAMsC,YAAY;WAAIL,KAAKM,OAAO;KAAG,CAACC,MAAM,CAAC,CAAC,GAAGxC,KAAK;YAC/BA;QAArB,MAAMO,eAAeP,iBAAAA,IAAI,CAAC,WAAW,qBAAjB,AAACA,eAA4DO,WAAW;QAC5F,OAAOkC,MAAMC,OAAO,CAACnC,gBAAgBA,YAAYG,MAAM,GAAG;IAC5D;IACA,MAAMiC,MAAoC,EAAE;IAC5C,KAAK,MAAM,CAAC/C,WAAWI,KAAK,IAAIsC,UAAW;QACzC,MAAMM,OAAO3C,QAAQL,WAAWI,MAAM,MAAMN,cAAcC,WAAWC;QACrE,IAAIgD,MAAMD,IAAIE,IAAI,CAACD;IACrB;IACA,OAAOD;AACT;AAEA;;;;CAIC,GACD,OAAO,eAAeG,yBACpBnD,SAAsC,EACtCC,SAAiB,EACjBmD,aAAqB;QASsBC;IAP3C,IAAI,CAACD,eAAe,OAAO,EAAE;IAC7B,MAAMC,WAAW,MAAMrD,UACpBE,UAAU,CAAC,uBACXC,GAAG,CAACF,WACJC,UAAU,CAAC,kBACXC,GAAG,CAACiD,eACJhD,GAAG;IACN,MAAMO,UAAUd,2BAA2BwD,gBAAAA,SAASjD,GAAG,CAAC,gCAAd,AAACiD,cAAoEzC,WAAW;IAC1H,OAAOD,QAAQE,EAAE,KAAK,QAAQ,EAAE,GAAGF,QAAQG,KAAK;AAClD"}

package/src/lib/server/connections/oauth-state.d.ts

@@ -0,0 +1,129 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE OAUTH `state` FOR A DECLARED CONNECTION (AGL-4193): signed,
+ * short-lived, single-use, and bound to one member, one site, one listing and
+ * one of its connections. Copied in shape from sales channels' connect state
+ * (`libs/plugins/sales-channels/.../oauth-state.ts`); one plugin never
+ * imports another.
+ *
+ * ## Signed
+ *
+ * `pc1.<payload>.<signature>`: the payload names the site, its workspace, the
+ * member, the listing, the connection, a nonce, the expiry and the console
+ * page to come back to; the signature is an HMAC under the shared,
+ * fail-closed `TOKEN_SIGNING_SECRET` with its own context, so no other signed
+ * token here verifies as one. The provider hands the state back verbatim, so
+ * a state that verifies says whose connect it was — which is how the
+ * callback, a redirect with no bearer token, knows its site, and the release
+ * gate knows its workspace.
+ *
+ * ## Single-use
+ *
+ * Starting a connect also writes one pending record per member, site, listing
+ * and connection on `hosts/{hostId}/pluginConnections/oauth-…`, holding the
+ * SHA-256 of the nonce, the expiry and the redirect address the code is
+ * issued for. The callback consumes it in a transaction, so a replayed state
+ * finds nothing, and a later start replaces it, retiring every earlier state.
+ *
+ * ## Coming back
+ *
+ * The page to return to is checked against the console's own origin when the
+ * connect starts, signed into the state, and checked again on the way back;
+ * the redirect carries only its path, so it can only ever land on the console
+ * that served the callback.
+ */
+/** How long a member has to finish the provider's consent screen. */
+export declare const CONNECT_STATE_TTL_MS: number;
+/** The callback's path. Registered as a redirect URI at providers: never change it. */
+export declare const CONNECT_CALLBACK_PATH: string;
+export interface ConnectStateClaims {
+    hostId: string;
+    orgId: string;
+    uid: string;
+    listingId: string;
+    connectionId: string;
+    nonce: string;
+    /** Expiry, epoch ms. */
+    exp: number;
+    /** The console path (with its query) to return to. */
+    returnTo: string;
+}
+/** Mints a state. Throws when `TOKEN_SIGNING_SECRET` is not configured. */
+export declare function mintConnectState(input: Omit<ConnectStateClaims, 'nonce' | 'exp'> & {
+    nowMs: number;
+    nonce?: string;
+}): {
+    state: string;
+    claims: ConnectStateClaims;
+};
+export type ConnectStateRead = {
+    ok: true;
+    claims: ConnectStateClaims;
+}
+/** Authentic and past its expiry: the claims still say whose it was. */
+ | {
+    ok: false;
+    refusal: 'state-expired';
+    claims: ConnectStateClaims;
+}
+/** Tampered, truncated, another version, or no secret to check it with. */
+ | {
+    ok: false;
+    refusal: 'state-invalid';
+};
+/** Verifies a state's signature and expiry. Never throws. */
+export declare function readConnectState(state: unknown, nowMs: number): ConnectStateRead;
+/** The pending record's id: the member, listing and connection hashed, so a uid never names a document. */
+export declare function connectStateDocId(uid: string, listingId: string, connectionId: string): string;
+/** Writes the pending record for a freshly minted state, replacing any earlier one. */
+export declare function recordConnectState(firestore: FirebaseFirestore.Firestore, input: {
+    claims: ConnectStateClaims;
+    redirectUri: string;
+    nowMs: number;
+}): Promise<void>;
+export type ConnectStateConsumed = {
+    ok: true;
+    redirectUri: string;
+} | {
+    ok: false;
+    refusal: 'state-replayed' | 'state-superseded' | 'state-expired';
+};
+/** Consumes the pending record a verified state names — once. */
+export declare function consumeConnectState(firestore: FirebaseFirestore.Firestore, input: {
+    claims: ConnectStateClaims;
+    nowMs: number;
+}): Promise<ConnectStateConsumed>;
+/** The canonical console origin, or `null` when it is set to something that is not http(s). */
+export declare function canonicalConsoleOrigin(): string | null;
+/**
+ * The console origin a connect started by `requestUrl` comes back to: the
+ * canonical one — the address registered on each publisher's OAuth app —
+ * except in development, where a request from `http://localhost` or
+ * `127.0.0.1` comes back to itself. Nothing else a request claims about its
+ * origin is believed.
+ */
+export declare function consoleOriginFor(requestUrl: string): string | null;
+/** Where the provider sends the member back to, or `null` when no origin is usable. */
+export declare function connectRedirectUri(requestUrl: string): string | null;
+/**
+ * The page to return to as a console path with its query, or `null` when
+ * `returnTo` is not on `origin`. Accepts an absolute URL on the origin or a
+ * single-slash path; anything else — another host, a protocol-relative
+ * `//host`, a `javascript:` URL, the callback itself — is refused.
+ */
+export declare function consolePath(returnTo: unknown, origin: string): string | null;