@aglyn/plugins-marketplace 1.15.0 → 1.15.2

package/src/lib/server/connections/site-records.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/marketplace/src/lib/server/connections/site-records.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { checkEntitlement } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport {\n  pluginConnectionRecordVariables,\n  validatePluginImageHosts,\n  type PluginConnectionDeclaration,\n  type PluginConnectionRecordField,\n} from '@aglyn/aglyn/app-utils/plugin-connections'\nimport {\n  PLUGIN_CONNECTION_RECORDS_PROP,\n  type PluginConnectionRecordsPageData,\n  type PluginConnectionRecordValue,\n  type PluginConnectionSiteRecord,\n} from '@aglyn/aglyn/app-utils/plugin-connection-records'\nimport type { HostVariable } from '@aglyn/aglyn/app-utils/variables'\nimport type { VariableComputation, VariableComputer } from '@aglyn/aglyn/plugin-manager/computed-variables'\nimport type { PluginSiteCspSource } from '@aglyn/aglyn/plugin-manager/plugin-site-csp'\nimport type { RealmPluginInstall } from '@aglyn/aglyn/plugin-manager/realm-plugins'\nimport type { SitePageContext, SitePageEnricher } from '@aglyn/aglyn/plugin-manager/site-page-hooks'\nimport { PLUGIN_CONNECTIONS_FEATURE, pluginConnectionRecordDocId } from '../../model/plugin-connections'\nimport { connectionsCollection } from './connection-store'\nimport { installedConnectionsForHost } from './installed-connection'\n\n/*\n * WHAT A SITE SHOWS OF ITS PLUGINS' DECLARED CONNECTIONS (AGL-4195).\n *\n * The sync (AGL-4194) writes, per site, the record each connection's\n * declaration maps (`hosts/{hostId}/pluginConnections/record-…`). That\n * collection is server-only, so the published page reads it here, in three\n * places, all on the server:\n *\n *   - the PAGE ENRICHER hands each signed element on the page its own\n *     listing's records, as one page prop, so the element renders in the\n *     page's HTML (`usePluginConnectionRecord` in core looks it up);\n *   - the VARIABLE COMPUTER turns each record's declared summary fields into\n *     site variables a page binds as `{{var:…}}`;\n *   - the CSP SOURCE names the image hosts the site's signed plugins declare\n *     (`capabilities.imageHosts`), so the tenant admits them to `img-src` on\n *     the sites that run those plugins and nowhere else.\n *\n * A record is exposed only while the plugin is still installed at a version\n * that declares the connection (not revoked), and only on a plan with the\n * connections feature. What is exposed is held to the declaration again:\n * the record's keys are filtered to the declared ones, so a record written\n * under an older version's schema cannot show a field the pinned version no\n * longer declares.\n */\n\n/** Records read for one site at most: four connections a plugin, a page of plugins. */\nexport const SITE_CONNECTION_RECORDS_READ = 40\n\n/** One connection's record on a site, as the page and the variables read it. */\nexport interface SiteConnectionRecordEntry {\n  listingId: string\n  connectionId: string\n  record: PluginConnectionSiteRecord\n  variables: Record<string, HostVariable>\n}\n\n/** What reading a site's records needs: the store and the site's workspace. */\nexport interface SiteConnectionRecordsReadDeps {\n  firestore: FirebaseFirestore.Firestore\n  /** The site's workspace and its document, or `null` for an unindexed site. */\n  orgForHost(hostId: string): Promise<{ orgId: string; org: Record<string, unknown> } | null>\n}\n\nconst isPrimitive = (value: unknown): value is PluginConnectionRecordValue =>\n  value === null || typeof value === 'string' || typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value))\n\n/** `source` held to the declared keys: anything else, or a non-primitive, is dropped. */\nfunction declaredOnly(\n  source: unknown,\n  declared: Readonly<Record<string, PluginConnectionRecordField>>,\n): Record<string, PluginConnectionRecordValue> {\n  const out: Record<string, PluginConnectionRecordValue> = {}\n  if (!source || typeof source !== 'object' || Array.isArray(source)) return out\n  for (const key of Object.keys(declared)) {\n    const value = (source as Record<string, unknown>)[key]\n    if (value !== undefined && isPrimitive(value)) out[key] = value\n  }\n  return out\n}\n\n/** A stored record, held to what `connection` declares, or `null` when it is not one. */\nexport function toSiteRecord(\n  data: Record<string, unknown> | undefined,\n  connection: PluginConnectionDeclaration,\n): PluginConnectionSiteRecord | null {\n  const schema = connection.sync?.record\n  if (!data || data['kind'] !== 'record' || !schema) return null\n  const syncedAtMs = Number(data['syncedAtMs'])\n  const items = Array.isArray(data['items']) ? data['items'] : []\n  const itemFields = schema.items?.fields ?? {}\n  return {\n    fields: declaredOnly(data['fields'], schema.fields ?? {}),\n    items: schema.items ? items.slice(0, schema.items.maxItems).map((item) => declaredOnly(item, itemFields)) : [],\n    syncedAtMs: Number.isFinite(syncedAtMs) ? syncedAtMs : 0,\n  }\n}\n\n/**\n * Every record the site's installed plugins may show, read uncached.\n *\n * One query when the site has none — the case for nearly every site — and\n * the install pins and the workspace only when it has some.\n */\nexport async function readSiteConnectionRecords(\n  deps: SiteConnectionRecordsReadDeps,\n  hostId: string,\n): Promise<SiteConnectionRecordEntry[]> {\n  const snapshot = await connectionsCollection(deps.firestore, hostId)\n    .where('kind', '==', 'record')\n    .limit(SITE_CONNECTION_RECORDS_READ)\n    .get()\n  if (snapshot.empty) return []\n  const owner = await deps.orgForHost(hostId)\n  // A site with no workspace has no plan to hold the feature (`checkEntitlement`\n  // fails open on a missing org, which is right for a page and wrong here).\n  if (!owner || !checkEntitlement(owner.org as never, PLUGIN_CONNECTIONS_FEATURE)) return []\n  const installed = await installedConnectionsForHost(deps.firestore, { hostId, orgId: owner.orgId })\n  const out: SiteConnectionRecordEntry[] = []\n  for (const doc of snapshot.docs) {\n    const data = doc.data() as Record<string, unknown>\n    const listingId = String(data['listingId'] ?? '')\n    const connectionId = String(data['connectionId'] ?? '')\n    // The id is the contract (`record-{listingId}__{connectionId}`); a record\n    // whose body names another connection than its id is not trusted.\n    if (!listingId || !connectionId || doc.id !== pluginConnectionRecordDocId(listingId, connectionId)) continue\n    const connection = installed\n      .find((plugin) => plugin.listingId === listingId)\n      ?.connections.find((declared) => declared.id === connectionId)\n    if (!connection) continue\n    const record = toSiteRecord(data, connection)\n    if (!record) continue\n    out.push({\n      listingId,\n      connectionId,\n      record,\n      variables: pluginConnectionRecordVariables(listingId, connection, record.fields),\n    })\n  }\n  return out\n}\n\n/* ------------------------------------------------------------------ */\n/* The page enricher                                                    */\n/* ------------------------------------------------------------------ */\n\nexport interface ConnectionRecordsEnricherDeps {\n  /** The site's signed (realm) installs, as the page loader reads them. */\n  realmInstalls(hostId: string): Promise<readonly RealmPluginInstall[]>\n  /** The site's records ({@link readSiteConnectionRecords}, cached). */\n  records(hostId: string): Promise<readonly SiteConnectionRecordEntry[]>\n}\n\ntype PageNode = { $id?: unknown; componentId?: unknown } | null | undefined\n\n/**\n * Node id → listing id, for every element on the page in a signed install's\n * namespace (`<identity>.<role>`). A node is attributed to the install whose\n * identity is the LONGEST prefix of its component id, so one identity being a\n * prefix of another (`acme.reviews` and `acme.reviews.pro`) cannot hand an\n * element the other's records.\n */\nexport function signedElementOwners(\n  nodes: Record<string, PageNode> | null | undefined,\n  installs: readonly RealmPluginInstall[],\n): Record<string, string> {\n  const owners: Record<string, string> = {}\n  if (!nodes || typeof nodes !== 'object') return owners\n  const namespaces = installs\n    .filter((install) => typeof install.identity === 'string' && install.identity)\n    .map((install) => ({ prefix: `${install.identity}.`, listingId: install.listingId }))\n    .sort((a, b) => b.prefix.length - a.prefix.length)\n  if (!namespaces.length) return owners\n  for (const [key, node] of Object.entries(nodes)) {\n    const componentId = node?.componentId\n    if (typeof componentId !== 'string' || !componentId.includes('.')) continue\n    const owner = namespaces.find((namespace) => componentId.startsWith(namespace.prefix))\n    if (!owner) continue\n    const nodeId = typeof node?.$id === 'string' && node.$id ? node.$id : key\n    owners[nodeId] = owner.listingId\n  }\n  return owners\n}\n\n/**\n * The enricher. A page with no element in a marketplace namespace — nearly\n * every page — returns before reading anything.\n */\nexport function createConnectionRecordsEnricher(deps: ConnectionRecordsEnricherDeps): SitePageEnricher {\n  return async (context: SitePageContext) => {\n    const nodes = context.nodes as Record<string, PageNode> | undefined\n    if (!nodes || typeof nodes !== 'object') return undefined\n    const anyNamespaced = Object.values(nodes).some(\n      (node) => typeof node?.componentId === 'string' && node.componentId.includes('.'),\n    )\n    if (!anyNamespaced) return undefined\n    const owners = signedElementOwners(nodes, await deps.realmInstalls(context.hostId))\n    const listings = new Set(Object.values(owners))\n    if (!listings.size) return undefined\n    const records: PluginConnectionRecordsPageData['records'] = {}\n    for (const entry of await deps.records(context.hostId)) {\n      if (!listings.has(entry.listingId)) continue\n      ;(records[entry.listingId] ??= {})[entry.connectionId] = entry.record\n    }\n    const attributed: Record<string, string> = {}\n    for (const [nodeId, listingId] of Object.entries(owners)) {\n      if (records[listingId]) attributed[nodeId] = listingId\n    }\n    if (!Object.keys(attributed).length) return undefined\n    const data: PluginConnectionRecordsPageData = { nodes: attributed, records }\n    return { [PLUGIN_CONNECTION_RECORDS_PROP]: data }\n  }\n}\n\n/* ------------------------------------------------------------------ */\n/* The variable computer                                                */\n/* ------------------------------------------------------------------ */\n\nconst unchanged: VariableComputation = ({ variables }) => variables\n\n/**\n * Adds each record's summary-field variables to the site's own. A site's own\n * variable is never replaced: the ids cannot collide by construction\n * (`pluginConnectionVariableId`), and this holds even if one somehow did.\n */\nexport function createConnectionVariableComputer(deps: Pick<ConnectionRecordsEnricherDeps, 'records'>): VariableComputer {\n  return {\n    prepare: async (hostId) => {\n      const entries = await deps.records(hostId)\n      const computed: Record<string, HostVariable> = {}\n      for (const entry of entries) Object.assign(computed, entry.variables)\n      if (!Object.keys(computed).length) return unchanged\n      return ({ variables }) => {\n        const out = { ...variables }\n        for (const [id, variable] of Object.entries(computed)) {\n          if (!Object.prototype.hasOwnProperty.call(variables, id)) out[id] = variable\n        }\n        return out\n      }\n    },\n  }\n}\n\n/* ------------------------------------------------------------------ */\n/* The image hosts                                                      */\n/* ------------------------------------------------------------------ */\n\nexport interface PluginImageHostsDeps {\n  realmInstalls(hostId: string): Promise<readonly RealmPluginInstall[]>\n  /** The `capabilities.imageHosts` the pinned version's manifest declares, unvalidated. */\n  declaredImageHosts(listingId: string, version: string): Promise<unknown>\n}\n\n/**\n * The image hosts a site's signed plugins declare, each re-validated, in\n * install order, de-duplicated. A signed (realm) install is the only kind\n * whose elements draw into the page itself; a sandboxed plugin draws in a\n * frame of its own origin, which the page's `img-src` does not govern. A\n * declaration that no longer validates admits nothing at all.\n */\nexport async function siteDeclaredImageHosts(deps: PluginImageHostsDeps, hostId: string): Promise<string[]> {\n  const installs = await deps.realmInstalls(hostId)\n  if (!installs.length) return []\n  const declared = await Promise.all(\n    installs.map(async (install) => {\n      try {\n        const verdict = validatePluginImageHosts(await deps.declaredImageHosts(install.listingId, install.version))\n        return verdict.ok ? verdict.value : []\n      } catch (error) {\n        console.error(`plugin-connections: the image hosts of ${install.listingId} were unreadable`, error)\n        return []\n      }\n    }),\n  )\n  return [...new Set(declared.flat())]\n}\n\n/** The CSP source the tenant's verdict asks. */\nexport function createPluginImageHostsSource(hosts: (hostId: string) => Promise<string[]>): PluginSiteCspSource {\n  return {\n    hosts: async ({ hostId }) => {\n      const img = await hosts(hostId)\n      return img.length ? { img } : {}\n    },\n  }\n}\n"],"names":["checkEntitlement","pluginConnectionRecordVariables","validatePluginImageHosts","PLUGIN_CONNECTION_RECORDS_PROP","PLUGIN_CONNECTIONS_FEATURE","pluginConnectionRecordDocId","connectionsCollection","installedConnectionsForHost","SITE_CONNECTION_RECORDS_READ","isPrimitive","value","Number","isFinite","declaredOnly","source","declared","out","Array","isArray","key","Object","keys","undefined","toSiteRecord","data","connection","schema","sync","record","syncedAtMs","items","itemFields","fields","slice","maxItems","map","item","readSiteConnectionRecords","deps","hostId","snapshot","firestore","where","limit","get","empty","owner","orgForHost","org","installed","orgId","doc","docs","listingId","String","connectionId","id","find","plugin","connections","push","variables","signedElementOwners","nodes","installs","owners","namespaces","filter","install","identity","prefix","sort","a","b","length","node","entries","componentId","includes","namespace","startsWith","nodeId","$id","createConnectionRecordsEnricher","context","anyNamespaced","values","some","realmInstalls","listings","Set","size","records","entry","has","attributed","unchanged","createConnectionVariableComputer","prepare","computed","assign","variable","prototype","hasOwnProperty","call","siteDeclaredImageHosts","Promise","all","verdict","declaredImageHosts","version","ok","error","console","flat","createPluginImageHostsSource","hosts","img"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,2CAA0C;AAC3E,SACEC,+BAA+B,EAC/BC,wBAAwB,QAGnB,4CAA2C;AAClD,SACEC,8BAA8B,QAIzB,mDAAkD;AAMzD,SAASC,0BAA0B,EAAEC,2BAA2B,QAAQ,oCAAgC;AACxG,SAASC,qBAAqB,QAAQ,wBAAoB;AAC1D,SAASC,2BAA2B,QAAQ,4BAAwB;AAEpE;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,qFAAqF,GACrF,OAAO,MAAMC,+BAA+B,GAAE;AAiB9C,MAAMC,cAAc,CAACC,QACnBA,UAAU,QAAQ,OAAOA,UAAU,YAAY,OAAOA,UAAU,aAAc,OAAOA,UAAU,YAAYC,OAAOC,QAAQ,CAACF;AAE7H,uFAAuF,GACvF,SAASG,aACPC,MAAe,EACfC,QAA+D;IAE/D,MAAMC,MAAmD,CAAC;IAC1D,IAAI,CAACF,UAAU,OAAOA,WAAW,YAAYG,MAAMC,OAAO,CAACJ,SAAS,OAAOE;IAC3E,KAAK,MAAMG,OAAOC,OAAOC,IAAI,CAACN,UAAW;QACvC,MAAML,QAAQ,AAACI,MAAkC,CAACK,IAAI;QACtD,IAAIT,UAAUY,aAAab,YAAYC,QAAQM,GAAG,CAACG,IAAI,GAAGT;IAC5D;IACA,OAAOM;AACT;AAEA,uFAAuF,GACvF,OAAO,SAASO,aACdC,IAAyC,EACzCC,UAAuC;cAQAC;QANxBD,kBAIIC;IAJnB,MAAMA,UAASD,mBAAAA,WAAWE,IAAI,qBAAfF,iBAAiBG,MAAM;IACtC,IAAI,CAACJ,QAAQA,IAAI,CAAC,OAAO,KAAK,YAAY,CAACE,QAAQ,OAAO;IAC1D,MAAMG,aAAalB,OAAOa,IAAI,CAAC,aAAa;IAC5C,MAAMM,QAAQb,MAAMC,OAAO,CAACM,IAAI,CAAC,QAAQ,IAAIA,IAAI,CAAC,QAAQ,GAAG,EAAE;IAC/D,MAAMO,sBAAaL,gBAAAA,OAAOI,KAAK,qBAAZJ,cAAcM,MAAM,mBAAI,CAAC;IAC5C,OAAO;QACLA,QAAQnB,aAAaW,IAAI,CAAC,SAAS,GAAEE,iBAAAA,OAAOM,MAAM,YAAbN,iBAAiB,CAAC;QACvDI,OAAOJ,OAAOI,KAAK,GAAGA,MAAMG,KAAK,CAAC,GAAGP,OAAOI,KAAK,CAACI,QAAQ,EAAEC,GAAG,CAAC,CAACC,OAASvB,aAAauB,MAAML,eAAe,EAAE;QAC9GF,YAAYlB,OAAOC,QAAQ,CAACiB,cAAcA,aAAa;IACzD;AACF;AAEA;;;;;CAKC,GACD,OAAO,eAAeQ,0BACpBC,IAAmC,EACnCC,MAAc;IAEd,MAAMC,WAAW,MAAMlC,sBAAsBgC,KAAKG,SAAS,EAAEF,QAC1DG,KAAK,CAAC,QAAQ,MAAM,UACpBC,KAAK,CAACnC,8BACNoC,GAAG;IACN,IAAIJ,SAASK,KAAK,EAAE,OAAO,EAAE;IAC7B,MAAMC,QAAQ,MAAMR,KAAKS,UAAU,CAACR;IACpC,+EAA+E;IAC/E,0EAA0E;IAC1E,IAAI,CAACO,SAAS,CAAC9C,iBAAiB8C,MAAME,GAAG,EAAW5C,6BAA6B,OAAO,EAAE;IAC1F,MAAM6C,YAAY,MAAM1C,4BAA4B+B,KAAKG,SAAS,EAAE;QAAEF;QAAQW,OAAOJ,MAAMI,KAAK;IAAC;IACjG,MAAMlC,MAAmC,EAAE;IAC3C,KAAK,MAAMmC,OAAOX,SAASY,IAAI,CAAE;YAEN5B,iBACGA;YAITyB;QANnB,MAAMzB,OAAO2B,IAAI3B,IAAI;QACrB,MAAM6B,YAAYC,QAAO9B,kBAAAA,IAAI,CAAC,YAAY,YAAjBA,kBAAqB;QAC9C,MAAM+B,eAAeD,QAAO9B,qBAAAA,IAAI,CAAC,eAAe,YAApBA,qBAAwB;QACpD,0EAA0E;QAC1E,kEAAkE;QAClE,IAAI,CAAC6B,aAAa,CAACE,gBAAgBJ,IAAIK,EAAE,KAAKnD,4BAA4BgD,WAAWE,eAAe;QACpG,MAAM9B,cAAawB,kBAAAA,UAChBQ,IAAI,CAAC,CAACC,SAAWA,OAAOL,SAAS,KAAKA,+BADtBJ,gBAEfU,WAAW,CAACF,IAAI,CAAC,CAAC1C,WAAaA,SAASyC,EAAE,KAAKD;QACnD,IAAI,CAAC9B,YAAY;QACjB,MAAMG,SAASL,aAAaC,MAAMC;QAClC,IAAI,CAACG,QAAQ;QACbZ,IAAI4C,IAAI,CAAC;YACPP;YACAE;YACA3B;YACAiC,WAAW5D,gCAAgCoD,WAAW5B,YAAYG,OAAOI,MAAM;QACjF;IACF;IACA,OAAOhB;AACT;AAeA;;;;;;CAMC,GACD,OAAO,SAAS8C,oBACdC,KAAkD,EAClDC,QAAuC;IAEvC,MAAMC,SAAiC,CAAC;IACxC,IAAI,CAACF,SAAS,OAAOA,UAAU,UAAU,OAAOE;IAChD,MAAMC,aAAaF,SAChBG,MAAM,CAAC,CAACC,UAAY,OAAOA,QAAQC,QAAQ,KAAK,YAAYD,QAAQC,QAAQ,EAC5ElC,GAAG,CAAC,CAACiC,UAAa,CAAA;YAAEE,QAAQ,GAAGF,QAAQC,QAAQ,CAAC,CAAC,CAAC;YAAEhB,WAAWe,QAAQf,SAAS;QAAC,CAAA,GACjFkB,IAAI,CAAC,CAACC,GAAGC,IAAMA,EAAEH,MAAM,CAACI,MAAM,GAAGF,EAAEF,MAAM,CAACI,MAAM;IACnD,IAAI,CAACR,WAAWQ,MAAM,EAAE,OAAOT;IAC/B,KAAK,MAAM,CAAC9C,KAAKwD,KAAK,IAAIvD,OAAOwD,OAAO,CAACb,OAAQ;QAC/C,MAAMc,cAAcF,wBAAAA,KAAME,WAAW;QACrC,IAAI,OAAOA,gBAAgB,YAAY,CAACA,YAAYC,QAAQ,CAAC,MAAM;QACnE,MAAMhC,QAAQoB,WAAWT,IAAI,CAAC,CAACsB,YAAcF,YAAYG,UAAU,CAACD,UAAUT,MAAM;QACpF,IAAI,CAACxB,OAAO;QACZ,MAAMmC,SAAS,QAAON,wBAAAA,KAAMO,GAAG,MAAK,YAAYP,KAAKO,GAAG,GAAGP,KAAKO,GAAG,GAAG/D;QACtE8C,MAAM,CAACgB,OAAO,GAAGnC,MAAMO,SAAS;IAClC;IACA,OAAOY;AACT;AAEA;;;CAGC,GACD,OAAO,SAASkB,gCAAgC7C,IAAmC;IACjF,OAAO,OAAO8C;QACZ,MAAMrB,QAAQqB,QAAQrB,KAAK;QAC3B,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU,OAAOzC;QAChD,MAAM+D,gBAAgBjE,OAAOkE,MAAM,CAACvB,OAAOwB,IAAI,CAC7C,CAACZ,OAAS,QAAOA,wBAAAA,KAAME,WAAW,MAAK,YAAYF,KAAKE,WAAW,CAACC,QAAQ,CAAC;QAE/E,IAAI,CAACO,eAAe,OAAO/D;QAC3B,MAAM2C,SAASH,oBAAoBC,OAAO,MAAMzB,KAAKkD,aAAa,CAACJ,QAAQ7C,MAAM;QACjF,MAAMkD,WAAW,IAAIC,IAAItE,OAAOkE,MAAM,CAACrB;QACvC,IAAI,CAACwB,SAASE,IAAI,EAAE,OAAOrE;QAC3B,MAAMsE,UAAsD,CAAC;QAC7D,KAAK,MAAMC,SAAS,CAAA,MAAMvD,KAAKsD,OAAO,CAACR,QAAQ7C,MAAM,CAAA,EAAG;gBAEpDqD,UAAQC,kBAARD;YADF,IAAI,CAACH,SAASK,GAAG,CAACD,MAAMxC,SAAS,GAAG;YACnC,EAACuC,IAAAA,CAAAA,WAAAA,QAAO,CAACC,mBAAAA,MAAMxC,SAAS,CAAC,YAAxBuC,IAAAA,QAAO,CAACC,iBAAgB,GAAK,CAAC,EAAE,CAACA,MAAMtC,YAAY,CAAC,GAAGsC,MAAMjE,MAAM;QACvE;QACA,MAAMmE,aAAqC,CAAC;QAC5C,KAAK,MAAM,CAACd,QAAQ5B,UAAU,IAAIjC,OAAOwD,OAAO,CAACX,QAAS;YACxD,IAAI2B,OAAO,CAACvC,UAAU,EAAE0C,UAAU,CAACd,OAAO,GAAG5B;QAC/C;QACA,IAAI,CAACjC,OAAOC,IAAI,CAAC0E,YAAYrB,MAAM,EAAE,OAAOpD;QAC5C,MAAME,OAAwC;YAAEuC,OAAOgC;YAAYH;QAAQ;QAC3E,OAAO;YAAE,CAACzF,+BAA+B,EAAEqB;QAAK;IAClD;AACF;AAEA,sEAAsE,GACtE,wEAAwE,GACxE,sEAAsE,GAEtE,MAAMwE,YAAiC,CAAC,EAAEnC,SAAS,EAAE,GAAKA;AAE1D;;;;CAIC,GACD,OAAO,SAASoC,iCAAiC3D,IAAoD;IACnG,OAAO;QACL4D,SAAS,OAAO3D;YACd,MAAMqC,UAAU,MAAMtC,KAAKsD,OAAO,CAACrD;YACnC,MAAM4D,WAAyC,CAAC;YAChD,KAAK,MAAMN,SAASjB,QAASxD,OAAOgF,MAAM,CAACD,UAAUN,MAAMhC,SAAS;YACpE,IAAI,CAACzC,OAAOC,IAAI,CAAC8E,UAAUzB,MAAM,EAAE,OAAOsB;YAC1C,OAAO,CAAC,EAAEnC,SAAS,EAAE;gBACnB,MAAM7C,MAAM,aAAK6C;gBACjB,KAAK,MAAM,CAACL,IAAI6C,SAAS,IAAIjF,OAAOwD,OAAO,CAACuB,UAAW;oBACrD,IAAI,CAAC/E,OAAOkF,SAAS,CAACC,cAAc,CAACC,IAAI,CAAC3C,WAAWL,KAAKxC,GAAG,CAACwC,GAAG,GAAG6C;gBACtE;gBACA,OAAOrF;YACT;QACF;IACF;AACF;AAYA;;;;;;CAMC,GACD,OAAO,eAAeyF,uBAAuBnE,IAA0B,EAAEC,MAAc;IACrF,MAAMyB,WAAW,MAAM1B,KAAKkD,aAAa,CAACjD;IAC1C,IAAI,CAACyB,SAASU,MAAM,EAAE,OAAO,EAAE;IAC/B,MAAM3D,WAAW,MAAM2F,QAAQC,GAAG,CAChC3C,SAAS7B,GAAG,CAAC,OAAOiC;QAClB,IAAI;YACF,MAAMwC,UAAU1G,yBAAyB,MAAMoC,KAAKuE,kBAAkB,CAACzC,QAAQf,SAAS,EAAEe,QAAQ0C,OAAO;YACzG,OAAOF,QAAQG,EAAE,GAAGH,QAAQlG,KAAK,GAAG,EAAE;QACxC,EAAE,OAAOsG,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,uCAAuC,EAAE5C,QAAQf,SAAS,CAAC,gBAAgB,CAAC,EAAE2D;YAC7F,OAAO,EAAE;QACX;IACF;IAEF,OAAO;WAAI,IAAItB,IAAI3E,SAASmG,IAAI;KAAI;AACtC;AAEA,8CAA8C,GAC9C,OAAO,SAASC,6BAA6BC,KAA4C;IACvF,OAAO;QACLA,OAAO,OAAO,EAAE7E,MAAM,EAAE;YACtB,MAAM8E,MAAM,MAAMD,MAAM7E;YACxB,OAAO8E,IAAI3C,MAAM,GAAG;gBAAE2C;YAAI,IAAI,CAAC;QACjC;IACF;AACF"}

package/src/lib/server/connections/sync.d.ts

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginConnectionDeclaration } from '@aglyn/aglyn/app-utils/plugin-connections';
+import type { PluginConsoleCronContext, PluginConsoleCronReport } from '@aglyn/aglyn/plugin-manager/plugin-console-crons';
+import type { SecretBoxKeyring } from '@aglyn/shared-util-tools/secret-box';
+import { type PluginConnectionRecord } from './connection-store';
+import { type PluginConnectionClient } from './provider-http';
+/**
+ * THE DECLARED SYNC, RUN BY THE PLATFORM (AGL-4194).
+ *
+ * A connection's manifest declares `sync`: a few templated requests, an
+ * interval, and the typed record its answers map into. This runs it, in the
+ * CONSOLE only — it opens sealed grants with `PLUGIN_CONNECTIONS_TOKEN_KEY`,
+ * which the tenant never holds:
+ *
+ *   - on the console's fifteen-minute `plugin-console-crons` tick, as the
+ *     `marketplace-connection-sync` job ({@link runPluginConnectionSyncJob}),
+ *     for every connection whose `nextSyncAtMs` has come, oldest first,
+ *     {@link PLUGIN_CONNECTION_SYNC_MAX_PER_TICK} at most per tick;
+ *   - on "Sync now" (`POST plugin-connections/sync`), for one connection.
+ *
+ * One sync ({@link runConnectionSync}):
+ *
+ *   1. under the declaration of the version the site has PINNED, never the
+ *      listing's newest;
+ *   2. with the site's access token, refreshed under the store's lease when
+ *      it is near expiry, and once more on a 401 or 403 from the API;
+ *   3. each request the record reads, filled from the site's choices by
+ *      `preparePluginConnectionRequest` (which refuses anything off the
+ *      declared `apiHosts`), page by page up to the declared `maxPages` and
+ *      the record's `maxItems`, each answer under the 2 MB ceiling and the
+ *      per-attempt timeout of `provider-http.ts`, and no page started after
+ *      the sync's own time budget;
+ *   4. mapped into the record (`record-mapping.ts`: undeclared keys dropped,
+ *      strings cut, the whole record bounded) and written WHOLE to
+ *      `hosts/{hostId}/pluginConnections/record-{listingId}__{connectionId}`,
+ *      which no client rule opens;
+ *   5. then the connection is marked synced, next due `intervalHours` on.
+ *
+ * Failures: a grant the provider refuses (`invalid_grant`, a 401 after a
+ * fresh token) is `reconnect_required`, and the schedule stops until the
+ * owner connects again. Anything else is `error` with the provider's
+ * sentence, retried after a backoff that doubles from fifteen minutes up to
+ * the declared interval. The last good record stays in place either way.
+ *
+ * Skipped quietly, with nothing written: the whole tick when the key is unset.
+ * Deferred, with only the next due time moved: a site whose plan has no
+ * connections, and a pinned version the kill switch revoked. Forgotten
+ * (revoked and deleted, `cleanup.ts`): a connection whose site no longer runs
+ * a version that declares it.
+ */
+/** The job id: its `platformCronBeats` mark and its row on `/api/health/crons`. */
+export declare const PLUGIN_CONNECTION_SYNC_JOB_ID = "marketplace-connection-sync";
+/** Connections synced at most per tick; the rest wait for the next, oldest first. */
+export declare const PLUGIN_CONNECTION_SYNC_MAX_PER_TICK = 25;
+/** How long one sync may keep starting pages. */
+export declare const PLUGIN_CONNECTION_SYNC_BUDGET_MS = 60000;
+/** The first retry after a failed sync; it doubles up to the declared interval. */
+export declare const PLUGIN_CONNECTION_SYNC_MIN_BACKOFF_MS: number;
+/** How far a deferred connection (plan, kill switch, no workspace) is moved on. */
+export declare const PLUGIN_CONNECTION_SYNC_DEFER_MS: number;
+/** The retry delay after `failures` failed syncs in a row, capped at the interval. */
+export declare function pluginConnectionSyncBackoffMs(failures: number, intervalHours: number): number;
+/** What one sync came to. */
+export type PluginConnectionSyncOutcome = 'synced' | 'error' | 'reconnect' | 'not-ready' | 'no-sync' | 'deferred' | 'forgotten' | 'gone';
+export interface RunConnectionSyncInput {
+    keyring: SecretBoxKeyring;
+    record: PluginConnectionRecord;
+    connection: PluginConnectionDeclaration;
+    /** The pinned version the declaration came from. */
+    version: string;
+    client: PluginConnectionClient;
+    /** Start no page after this, epoch ms. */
+    deadlineMs: number;
+}
+/**
+ * Runs one connection's declared sync and records the outcome on the
+ * connection. Never throws for a provider's failure; a Firestore failure
+ * propagates.
+ */
+export declare function runConnectionSync(input: RunConnectionSyncInput): Promise<PluginConnectionSyncOutcome>;
+/** One due connection: gates, then the sync. */
+export declare function syncDueConnection(keyring: SecretBoxKeyring, record: PluginConnectionRecord, deadlineMs: number): Promise<PluginConnectionSyncOutcome>;
+/**
+ * The due connections, oldest first: a collection-group query over every
+ * site's `pluginConnections`, which needs its `COLLECTION_GROUP` index
+ * (`kind`, `status`, `nextSyncAtMs`) in `cloud/firebase-firestore.indexes.json`.
+ * `error` is included: its `nextSyncAtMs` is the backoff. A
+ * `reconnect_required` connection has none, so it is never due.
+ */
+export declare function dueConnections(nowMs: number, limit?: number): Promise<PluginConnectionRecord[]>;
+/**
+ * The `marketplace-connection-sync` console job: every due connection, a few
+ * at a time, none started after the tick's deadline. Reports counts only.
+ */
+export declare function runPluginConnectionSyncJob(context: PluginConsoleCronContext): Promise<PluginConsoleCronReport>;

package/src/lib/server/connections/sync.js

@@ -0,0 +1,414 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkEntitlement } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { readPluginConnectionPath } from "@aglyn/aglyn/app-utils/plugin-connections";
+import { firebaseAdmin, getOrgForHost } from "@aglyn/tenant-data-admin";
+import { PLUGIN_CONNECTIONS_FEATURE, PLUGIN_CONNECTIONS_HOST_COLLECTION } from "../../model/plugin-connections.js";
+import { readPluginConnectionsKeyring } from "./config.js";
+import { forgetSiteConnection, pinnedConnectionState } from "./cleanup.js";
+import { connectionAccessToken, connectionReady, connectionRecordRef, connectionRef, markConnectionError, markConnectionSynced, PluginConnectionReconnectRequiredError, readConnection } from "./connection-store.js";
+import { announceConnectionRecordChange, connectionRecordChanged } from "./record-announce.js";
+import { openCredentials } from "./credentials-store.js";
+import { latestListingConnections } from "./installed-connection.js";
+import { pluginConnectionApiRequest, pluginConnectionRuntime, PluginConnectionProviderError } from "./provider-http.js";
+import { mapPluginConnectionRecord, pluginConnectionSyncRequestsRead } from "./record-mapping.js";
+/**
+ * THE DECLARED SYNC, RUN BY THE PLATFORM (AGL-4194).
+ *
+ * A connection's manifest declares `sync`: a few templated requests, an
+ * interval, and the typed record its answers map into. This runs it, in the
+ * CONSOLE only — it opens sealed grants with `PLUGIN_CONNECTIONS_TOKEN_KEY`,
+ * which the tenant never holds:
+ *
+ *   - on the console's fifteen-minute `plugin-console-crons` tick, as the
+ *     `marketplace-connection-sync` job ({@link runPluginConnectionSyncJob}),
+ *     for every connection whose `nextSyncAtMs` has come, oldest first,
+ *     {@link PLUGIN_CONNECTION_SYNC_MAX_PER_TICK} at most per tick;
+ *   - on "Sync now" (`POST plugin-connections/sync`), for one connection.
+ *
+ * One sync ({@link runConnectionSync}):
+ *
+ *   1. under the declaration of the version the site has PINNED, never the
+ *      listing's newest;
+ *   2. with the site's access token, refreshed under the store's lease when
+ *      it is near expiry, and once more on a 401 or 403 from the API;
+ *   3. each request the record reads, filled from the site's choices by
+ *      `preparePluginConnectionRequest` (which refuses anything off the
+ *      declared `apiHosts`), page by page up to the declared `maxPages` and
+ *      the record's `maxItems`, each answer under the 2 MB ceiling and the
+ *      per-attempt timeout of `provider-http.ts`, and no page started after
+ *      the sync's own time budget;
+ *   4. mapped into the record (`record-mapping.ts`: undeclared keys dropped,
+ *      strings cut, the whole record bounded) and written WHOLE to
+ *      `hosts/{hostId}/pluginConnections/record-{listingId}__{connectionId}`,
+ *      which no client rule opens;
+ *   5. then the connection is marked synced, next due `intervalHours` on.
+ *
+ * Failures: a grant the provider refuses (`invalid_grant`, a 401 after a
+ * fresh token) is `reconnect_required`, and the schedule stops until the
+ * owner connects again. Anything else is `error` with the provider's
+ * sentence, retried after a backoff that doubles from fifteen minutes up to
+ * the declared interval. The last good record stays in place either way.
+ *
+ * Skipped quietly, with nothing written: the whole tick when the key is unset.
+ * Deferred, with only the next due time moved: a site whose plan has no
+ * connections, and a pinned version the kill switch revoked. Forgotten
+ * (revoked and deleted, `cleanup.ts`): a connection whose site no longer runs
+ * a version that declares it.
+ */ /** The job id: its `platformCronBeats` mark and its row on `/api/health/crons`. */ export const PLUGIN_CONNECTION_SYNC_JOB_ID = 'marketplace-connection-sync';
+/** Connections synced at most per tick; the rest wait for the next, oldest first. */ export const PLUGIN_CONNECTION_SYNC_MAX_PER_TICK = 25;
+/** Connections synced at once within a tick. */ const CONCURRENCY = 4;
+/** How long one sync may keep starting pages. */ export const PLUGIN_CONNECTION_SYNC_BUDGET_MS = 60000;
+/** The first retry after a failed sync; it doubles up to the declared interval. */ export const PLUGIN_CONNECTION_SYNC_MIN_BACKOFF_MS = 15 * 60 * 1000;
+/** How far a deferred connection (plan, kill switch, no workspace) is moved on. */ export const PLUGIN_CONNECTION_SYNC_DEFER_MS = 6 * 60 * 60 * 1000;
+const HOUR_MS = 60 * 60 * 1000;
+const firestore = ()=>firebaseAdmin.app().firestore();
+/** The retry delay after `failures` failed syncs in a row, capped at the interval. */ export function pluginConnectionSyncBackoffMs(failures, intervalHours) {
+    const cap = Math.max(PLUGIN_CONNECTION_SYNC_MIN_BACKOFF_MS, intervalHours * HOUR_MS);
+    const exponent = Math.min(Math.max(0, failures - 1), 20);
+    return Math.min(cap, PLUGIN_CONNECTION_SYNC_MIN_BACKOFF_MS * 2 ** exponent);
+}
+const isNotFound = (error)=>Boolean(error) && (error.code === 5 || /NOT_FOUND/.test(String(error == null ? void 0 : error.message)));
+/** An update to a connection that may have been disconnected meanwhile: a missing document is not an error. */ async function updateIfPresent(write) {
+    try {
+        await write();
+        return true;
+    } catch (error) {
+        if (isNotFound(error)) return false;
+        throw error;
+    }
+}
+/**
+ * One declared request, page by page: every page's body (the summary fields
+ * read the first) and the items across pages, up to `maxItems`. A 401 or 403
+ * refreshes the token once for the whole sync; a second one is final.
+ */ async function fetchSyncRequest(connection, request, input) {
+    var _ref;
+    var _request_pagination;
+    const pages = [];
+    const items = [];
+    let cursor = null;
+    const maxPages = input.maxItems > 0 ? (_ref = (_request_pagination = request.pagination) == null ? void 0 : _request_pagination.maxPages) != null ? _ref : 1 : 1;
+    for(let page = 0; page < maxPages; page += 1){
+        if (pluginConnectionRuntime.now() >= input.deadlineMs) {
+            if (page === 0) throw new PluginConnectionProviderError('transient', 'The sync ran out of time. It will try again.');
+            break;
+        }
+        let body;
+        try {
+            body = await pluginConnectionApiRequest(connection, request, {
+                accessToken: input.token.current,
+                choices: input.choices,
+                cursor
+            });
+        } catch (error) {
+            if (!(error instanceof PluginConnectionProviderError) || error.code !== 'auth' || input.token.refreshed) throw error;
+            input.token.current = await input.token.refresh();
+            input.token.refreshed = true;
+            body = await pluginConnectionApiRequest(connection, request, {
+                accessToken: input.token.current,
+                choices: input.choices,
+                cursor
+            });
+        }
+        pages.push(body);
+        if (input.maxItems <= 0) break;
+        const list = request.itemsPath ? readPluginConnectionPath(body, request.itemsPath) : undefined;
+        if (Array.isArray(list)) items.push(...list.slice(0, Math.max(0, input.maxItems - items.length)));
+        if (items.length >= input.maxItems || !request.pagination) break;
+        const next = readPluginConnectionPath(body, request.pagination.cursorPath);
+        if (typeof next !== 'string' || !next || next.length > 2048 || next === cursor) break;
+        cursor = next;
+    }
+    return {
+        pages,
+        items
+    };
+}
+/** The items a request feeds into the record, or 0 for one only summary fields read. */ function itemsWanted(sync, requestId) {
+    var _sync_record_items;
+    return ((_sync_record_items = sync.record.items) == null ? void 0 : _sync_record_items.request) === requestId ? sync.record.items.maxItems : 0;
+}
+/**
+ * Runs one connection's declared sync and records the outcome on the
+ * connection. Never throws for a provider's failure; a Firestore failure
+ * propagates.
+ */ export async function runConnectionSync(input) {
+    const { record, connection } = input;
+    const db = firestore();
+    const ref = connectionRef(db, record.hostId, record.listingId, record.connectionId);
+    const sync = connection.sync;
+    if (!sync) {
+        // Nothing declared to run: off the schedule until a version declares one.
+        await updateIfPresent(()=>ref.update({
+                nextSyncAtMs: null,
+                updatedAtMs: pluginConnectionRuntime.now()
+            }));
+        return 'no-sync';
+    }
+    if (!connectionReady(record, connection)) {
+        // The choose route puts it back on the schedule once every resource is chosen.
+        await updateIfPresent(()=>ref.update({
+                nextSyncAtMs: null,
+                updatedAtMs: pluginConnectionRuntime.now()
+            }));
+        return 'not-ready';
+    }
+    const choices = Object.fromEntries(Object.entries(record.choices).map(([key, choice])=>[
+            key,
+            choice.id
+        ]));
+    const tokenDeps = {
+        firestore: db,
+        keyring: input.keyring,
+        connection,
+        client: input.client,
+        now: pluginConnectionRuntime.now,
+        sleep: pluginConnectionRuntime.sleep
+    };
+    try {
+        const token = {
+            current: await connectionAccessToken(tokenDeps, record),
+            refreshed: false,
+            refresh: ()=>connectionAccessToken(tokenDeps, record, {
+                    force: true
+                })
+        };
+        const answers = {};
+        for (const request of pluginConnectionSyncRequestsRead(sync)){
+            answers[request.id] = await fetchSyncRequest(connection, request, {
+                token,
+                choices,
+                maxItems: itemsWanted(sync, request.id),
+                deadlineMs: input.deadlineMs
+            });
+        }
+        const nowMs = pluginConnectionRuntime.now();
+        const doc = mapPluginConnectionRecord(sync, answers, {
+            listingId: record.listingId,
+            connectionId: record.connectionId,
+            version: input.version,
+            syncedAtMs: nowMs
+        });
+        const recordRef = connectionRecordRef(db, record.hostId, record.listingId, record.connectionId);
+        const before = (await recordRef.get()).data();
+        // Whole, never merged: a key the new schema dropped must not survive.
+        await recordRef.set(doc);
+        const marked = await updateIfPresent(()=>markConnectionSynced(db, record, {
+                nowMs,
+                nextSyncAtMs: nowMs + sync.intervalHours * HOUR_MS
+            }));
+        if (!marked) {
+            // Disconnected while it ran: the record must not outlive the grant.
+            await recordRef.delete();
+            await announceConnectionRecordChange(record.hostId, `plugin connection ${record.listingId}/${record.connectionId} gone`);
+            return 'gone';
+        }
+        // The site's pages show the new values (AGL-4195); an unchanged record says nothing.
+        if (connectionRecordChanged(before, doc)) {
+            await announceConnectionRecordChange(record.hostId, `plugin connection ${record.listingId}/${record.connectionId} synced`);
+        }
+        return 'synced';
+    } catch (error) {
+        var _record_syncFailures;
+        const nowMs = pluginConnectionRuntime.now();
+        const grantGone = error instanceof PluginConnectionReconnectRequiredError || error instanceof PluginConnectionProviderError && error.code === 'auth' && error.status === 401;
+        if (grantGone) {
+            const message = error instanceof PluginConnectionReconnectRequiredError ? error.message : `${connection.label} refused the connection. Connect again.`;
+            await updateIfPresent(()=>markConnectionError(db, record, {
+                    nowMs,
+                    message,
+                    reconnect: true
+                }));
+            return 'reconnect';
+        }
+        if (!(error instanceof PluginConnectionProviderError)) {
+            console.error('plugin-connections: a sync failed', error instanceof Error ? error.message : error);
+        }
+        const message = error instanceof PluginConnectionProviderError ? `${connection.label} did not answer: ${error.message}` : 'The sync failed. It will try again.';
+        const failures = ((_record_syncFailures = record.syncFailures) != null ? _record_syncFailures : 0) + 1;
+        await updateIfPresent(()=>markConnectionError(db, record, {
+                nowMs,
+                message,
+                reconnect: false,
+                nextSyncAtMs: nowMs + pluginConnectionSyncBackoffMs(failures, sync.intervalHours),
+                syncFailures: failures
+            }));
+        return 'error';
+    }
+}
+/** Moves a connection's next run on without touching its status. */ async function defer(record, nowMs) {
+    await updateIfPresent(()=>connectionRef(firestore(), record.hostId, record.listingId, record.connectionId).update({
+            nextSyncAtMs: nowMs + PLUGIN_CONNECTION_SYNC_DEFER_MS,
+            updatedAtMs: nowMs
+        }));
+}
+/** The declaration to revoke an orphan with: the listing's newest version's, the pin being gone. */ async function orphanDeclaration(listingId, connectionId) {
+    try {
+        var _listing_get, _declared_find;
+        const listing = await firestore().collection('marketplaceListings').doc(listingId).get();
+        const declared = await latestListingConnections(firestore(), listingId, String((_listing_get = listing.get('latestVersion')) != null ? _listing_get : ''));
+        return (_declared_find = declared.find((one)=>one.id === connectionId)) != null ? _declared_find : null;
+    } catch (unused) {
+        return null;
+    }
+}
+/** One due connection: gates, then the sync. */ export async function syncDueConnection(keyring, record, deadlineMs) {
+    const nowMs = pluginConnectionRuntime.now();
+    const resolved = await getOrgForHost(record.hostId);
+    if (!resolved) {
+        const host = await firestore().collection('hosts').doc(record.hostId).get();
+        if (!host.exists) {
+            // The site is gone and its eraser missed this: revoke and forget.
+            await forgetSiteConnection(firestore(), record, {
+                orgId: record.orgId || null,
+                declaration: await orphanDeclaration(record.listingId, record.connectionId)
+            });
+            return 'forgotten';
+        }
+        await defer(record, nowMs);
+        return 'deferred';
+    }
+    if (!checkEntitlement(resolved.org, PLUGIN_CONNECTIONS_FEATURE)) {
+        // A plan without connections keeps its grant and its last record; it is
+        // not run. Sync now (plan-gated) is how an upgrade gets a fresh one at once.
+        await defer(record, nowMs);
+        return 'deferred';
+    }
+    const pinned = await pinnedConnectionState(firestore(), {
+        hostId: record.hostId,
+        orgId: resolved.orgId,
+        listingId: record.listingId,
+        connectionId: record.connectionId
+    });
+    if (pinned.state === 'gone') {
+        await forgetSiteConnection(firestore(), record, {
+            orgId: resolved.orgId,
+            declaration: await orphanDeclaration(record.listingId, record.connectionId)
+        });
+        return 'forgotten';
+    }
+    if (pinned.state === 'paused') {
+        await defer(record, nowMs);
+        return 'deferred';
+    }
+    let client = null;
+    try {
+        client = await openCredentials(firestore(), keyring, record.listingId, record.connectionId);
+    } catch (error) {
+        console.error('plugin-connections: a listing’s credentials did not open', error instanceof Error ? error.message : error);
+    }
+    if (!client) {
+        var _record_syncFailures;
+        const failures = ((_record_syncFailures = record.syncFailures) != null ? _record_syncFailures : 0) + 1;
+        await updateIfPresent(()=>{
+            var _ref;
+            var _pinned_connection_sync;
+            return markConnectionError(firestore(), record, {
+                nowMs,
+                message: 'The plugin’s publisher has not finished setting up this connection yet.',
+                reconnect: false,
+                nextSyncAtMs: nowMs + pluginConnectionSyncBackoffMs(failures, (_ref = (_pinned_connection_sync = pinned.connection.sync) == null ? void 0 : _pinned_connection_sync.intervalHours) != null ? _ref : 24),
+                syncFailures: failures
+            });
+        });
+        return 'error';
+    }
+    return runConnectionSync({
+        keyring,
+        record,
+        connection: pinned.connection,
+        version: pinned.installed.version,
+        client,
+        deadlineMs: Math.min(deadlineMs, nowMs + PLUGIN_CONNECTION_SYNC_BUDGET_MS)
+    });
+}
+/**
+ * The due connections, oldest first: a collection-group query over every
+ * site's `pluginConnections`, which needs its `COLLECTION_GROUP` index
+ * (`kind`, `status`, `nextSyncAtMs`) in `cloud/firebase-firestore.indexes.json`.
+ * `error` is included: its `nextSyncAtMs` is the backoff. A
+ * `reconnect_required` connection has none, so it is never due.
+ */ export async function dueConnections(nowMs, limit = PLUGIN_CONNECTION_SYNC_MAX_PER_TICK) {
+    const snapshot = await firestore().collectionGroup(PLUGIN_CONNECTIONS_HOST_COLLECTION).where('kind', '==', 'connection').where('status', 'in', [
+        'connected',
+        'error'
+    ]).where('nextSyncAtMs', '<=', nowMs).orderBy('nextSyncAtMs', 'asc').limit(limit).get();
+    return snapshot.docs.map((doc)=>{
+        var _doc_ref_parent_parent;
+        const record = readConnection(doc.data());
+        // The site is the one the document sits under, whatever it says.
+        const hostId = (_doc_ref_parent_parent = doc.ref.parent.parent) == null ? void 0 : _doc_ref_parent_parent.id;
+        return record && hostId ? _extends({}, record, {
+            hostId
+        }) : null;
+    }).filter((record)=>Boolean(record));
+}
+/**
+ * The `marketplace-connection-sync` console job: every due connection, a few
+ * at a time, none started after the tick's deadline. Reports counts only.
+ */ export async function runPluginConnectionSyncJob(context) {
+    const keyring = readPluginConnectionsKeyring();
+    if (!keyring) return {
+        configured: false
+    };
+    const due = await dueConnections(context.nowMs);
+    const counts = {
+        synced: 0,
+        error: 0,
+        reconnect: 0,
+        'not-ready': 0,
+        'no-sync': 0,
+        deferred: 0,
+        forgotten: 0,
+        gone: 0,
+        failed: 0,
+        notStarted: 0
+    };
+    let next = 0;
+    const worker = async ()=>{
+        while(next < due.length){
+            const record = due[next++];
+            if (pluginConnectionRuntime.now() >= context.deadlineMs) {
+                counts.notStarted += 1;
+                continue;
+            }
+            try {
+                counts[await syncDueConnection(keyring, record, context.deadlineMs)] += 1;
+            } catch (error) {
+                counts.failed += 1;
+                console.error('plugin-connections: a due connection failed', error instanceof Error ? error.message : error);
+            }
+        }
+    };
+    await Promise.all(Array.from({
+        length: Math.min(CONCURRENCY, due.length)
+    }, worker));
+    return {
+        configured: true,
+        due: due.length,
+        synced: counts.synced,
+        errors: counts.error + counts.failed,
+        reconnectRequired: counts.reconnect,
+        deferred: counts.deferred,
+        forgotten: counts.forgotten,
+        notReady: counts['not-ready'] + counts['no-sync'],
+        notStarted: counts.notStarted
+    };
+}
+
+//# sourceMappingURL=sync.js.map