@aglyn/tenant-runtime 1.0.0-beta.143

package/src/lib/get-forms.js

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { PUBLISHED_SITE_DATA_TTL_SECONDS, tenantDataTag, withRenderCache } from "@aglyn/tenant-data-admin/render-cache";
+/**
+ * Cached exactly as the components read is (AGL-1302): a form publish busts
+ * `tenant-data:{hostId}` through the console revalidate route, and the TTL is
+ * only the backstop for writes that never announce themselves.
+ */ const FORMS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS;
+/**
+ * How many form documents ONE RENDER reads.
+ *
+ * Deliberately below `Aglyn.FORMS_MAX_PER_HOST`, which bounds the catalog
+ * listings, and equal to the components bound this read is otherwise a copy
+ * of: a catalog is read when a person opens a page in the console, while this
+ * is on the hot path of every published page that places a form. The two
+ * numbers answer different questions and must not be collapsed into one.
+ *
+ * Unordered, like the components query, so past this bound the page read is an
+ * arbitrary subset rather than the first N by any rule. That is a backstop,
+ * not a plan: a site with more forms than this needs the read narrowed to the
+ * ids the page actually places, not a larger constant.
+ */ const FORMS_PER_RENDER = 200;
+/**
+ * The host's form entities keyed by id, in the shape the placed-form graft
+ * consumes (`Aglyn.placedFormPlacement`).
+ *
+ * Only forms with a design are returned: a `rootId` that is in the form's own
+ * `nodes`. That is not the same as a PUBLISHED design. The Forms page creates a
+ * form with its design seeded, so a form nobody has published yet still
+ * renders wherever a page places it; placing it on a published page is what
+ * puts it live. A form with no `rootId`/`nodes`, or whose root is missing from
+ * its own nodes, has no tree to graft — both are "this entity contributes
+ * nothing", and the graft leaves such a placement rendering the fields drawn on
+ * the page itself. Filtering here rather than in the graft keeps the payload
+ * to what can actually be rendered.
+ *
+ * An ARCHIVED form is deliberately still returned. Archiving retires an entity
+ * from the catalog the console lists; it is not a tombstone and it says nothing
+ * about publication. A page that still places the form keeps rendering it,
+ * because the alternative is a live page quietly losing its form the moment
+ * someone tidies up a list.
+ *
+ * Fail-open like every other compose read: on error an empty map, so every
+ * placement falls back to its own inline content and the page still serves.
+ */ async function readForms(hostId) {
+    const data = {
+        forms: {},
+        error: null
+    };
+    const firestore = firebaseAdmin.app().firestore();
+    await firestore.collection('hosts').doc(hostId).collection('forms').limit(FORMS_PER_RENDER).get().then((res)=>{
+        for (const docSnapshot of res.docs){
+            const value = docSnapshot.data();
+            if (!(value == null ? void 0 : value.nodes) || !(value == null ? void 0 : value.rootId)) continue;
+            // BOTH stored forms, on the hot path (AGL-1151). A form's published
+            // tree is written by the same promotion path a component's is, so it
+            // is msgpack for anything published since compression landed and a
+            // plain map for anything older. Skipping the decode would hand the
+            // graft a `Buffer`, which has no `rootId` entry — every placement
+            // would render an empty form, and the result would be stored under the
+            // render cache for the rest of its TTL.
+            const nodes = Aglyn.decodeStoredNodes(value.nodes);
+            // An undecodable design is skipped rather than grafted empty: the
+            // placement then keeps its own fields, and `decodeStoredNodes` logs
+            // why the entity did not resolve.
+            if (!(nodes == null ? void 0 : nodes[value.rootId])) continue;
+            data.forms[docSnapshot.id] = {
+                rootId: value.rootId,
+                nodes
+            };
+        }
+    }).catch((error)=>{
+        console.error(error);
+        data.error = error;
+    });
+    return data;
+}
+export async function getForms(options) {
+    const { hostId } = options;
+    try {
+        return await withRenderCache({
+            key: [
+                'tenant-forms',
+                hostId
+            ],
+            revalidate: FORMS_TTL_SECONDS,
+            tags: [
+                tenantDataTag(hostId)
+            ],
+            read: ()=>readForms(hostId),
+            // A failed read keeps its fail-open empty map per-request only.
+            store: (value)=>!value.error
+        });
+    } catch (error) {
+        console.error(error);
+        return readForms(hostId);
+    }
+}
+export default getForms;
+
+//# sourceMappingURL=get-forms.js.map

package/src/lib/get-forms.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/get-forms.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  PUBLISHED_SITE_DATA_TTL_SECONDS,\n  tenantDataTag,\n  withRenderCache,\n} from '@aglyn/tenant-data-admin/render-cache'\n\n/**\n * Cached exactly as the components read is (AGL-1302): a form publish busts\n * `tenant-data:{hostId}` through the console revalidate route, and the TTL is\n * only the backstop for writes that never announce themselves.\n */\nconst FORMS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS\n\n/**\n * How many form documents ONE RENDER reads.\n *\n * Deliberately below `Aglyn.FORMS_MAX_PER_HOST`, which bounds the catalog\n * listings, and equal to the components bound this read is otherwise a copy\n * of: a catalog is read when a person opens a page in the console, while this\n * is on the hot path of every published page that places a form. The two\n * numbers answer different questions and must not be collapsed into one.\n *\n * Unordered, like the components query, so past this bound the page read is an\n * arbitrary subset rather than the first N by any rule. That is a backstop,\n * not a plan: a site with more forms than this needs the read narrowed to the\n * ids the page actually places, not a larger constant.\n */\nconst FORMS_PER_RENDER = 200\n\n/**\n * The host's form entities keyed by id, in the shape the placed-form graft\n * consumes (`Aglyn.placedFormPlacement`).\n *\n * Only forms with a design are returned: a `rootId` that is in the form's own\n * `nodes`. That is not the same as a PUBLISHED design. The Forms page creates a\n * form with its design seeded, so a form nobody has published yet still\n * renders wherever a page places it; placing it on a published page is what\n * puts it live. A form with no `rootId`/`nodes`, or whose root is missing from\n * its own nodes, has no tree to graft — both are \"this entity contributes\n * nothing\", and the graft leaves such a placement rendering the fields drawn on\n * the page itself. Filtering here rather than in the graft keeps the payload\n * to what can actually be rendered.\n *\n * An ARCHIVED form is deliberately still returned. Archiving retires an entity\n * from the catalog the console lists; it is not a tombstone and it says nothing\n * about publication. A page that still places the form keeps rendering it,\n * because the alternative is a live page quietly losing its form the moment\n * someone tidies up a list.\n *\n * Fail-open like every other compose read: on error an empty map, so every\n * placement falls back to its own inline content and the page still serves.\n */\nasync function readForms(hostId: Aglyn.HostUid) {\n  const data = {\n    forms: {} as Record<string, Aglyn.PlacedFormDesign>,\n    error: null as unknown,\n  }\n  const firestore = firebaseAdmin.app().firestore()\n\n  await firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('forms')\n    .limit(FORMS_PER_RENDER)\n    .get()\n    .then((res) => {\n      for (const docSnapshot of res.docs) {\n        const value = docSnapshot.data() as Aglyn.FormDocument\n        if (!value?.nodes || !value?.rootId) continue\n        // BOTH stored forms, on the hot path (AGL-1151). A form's published\n        // tree is written by the same promotion path a component's is, so it\n        // is msgpack for anything published since compression landed and a\n        // plain map for anything older. Skipping the decode would hand the\n        // graft a `Buffer`, which has no `rootId` entry — every placement\n        // would render an empty form, and the result would be stored under the\n        // render cache for the rest of its TTL.\n        const nodes = Aglyn.decodeStoredNodes<\n          NonNullable<Aglyn.FormDocument['nodes']>\n        >(value.nodes)\n        // An undecodable design is skipped rather than grafted empty: the\n        // placement then keeps its own fields, and `decodeStoredNodes` logs\n        // why the entity did not resolve.\n        if (!nodes?.[value.rootId]) continue\n        data.forms[docSnapshot.id] = { rootId: value.rootId, nodes }\n      }\n    })\n    .catch((error) => {\n      console.error(error)\n      data.error = error\n    })\n\n  return data\n}\n\nexport async function getForms(options: { hostId: Aglyn.HostUid }) {\n  const { hostId } = options\n  try {\n    return await withRenderCache({\n      key: ['tenant-forms', hostId as string],\n      revalidate: FORMS_TTL_SECONDS,\n      tags: [tenantDataTag(hostId as string)],\n      read: () => readForms(hostId),\n      // A failed read keeps its fail-open empty map per-request only.\n      store: (value) => !value.error,\n    })\n  } catch (error) {\n    console.error(error)\n    return readForms(hostId)\n  }\n}\n\nexport default getForms\n"],"names":["Aglyn","firebaseAdmin","PUBLISHED_SITE_DATA_TTL_SECONDS","tenantDataTag","withRenderCache","FORMS_TTL_SECONDS","FORMS_PER_RENDER","readForms","hostId","data","forms","error","firestore","app","collection","doc","limit","get","then","res","docSnapshot","docs","value","nodes","rootId","decodeStoredNodes","id","catch","console","getForms","options","key","revalidate","tags","read","store"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SACEC,+BAA+B,EAC/BC,aAAa,EACbC,eAAe,QACV,wCAAuC;AAE9C;;;;CAIC,GACD,MAAMC,oBAAoBH;AAE1B;;;;;;;;;;;;;CAaC,GACD,MAAMI,mBAAmB;AAEzB;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,eAAeC,UAAUC,MAAqB;IAC5C,MAAMC,OAAO;QACXC,OAAO,CAAC;QACRC,OAAO;IACT;IACA,MAAMC,YAAYX,cAAcY,GAAG,GAAGD,SAAS;IAE/C,MAAMA,UACHE,UAAU,CAAC,SACXC,GAAG,CAACP,QACJM,UAAU,CAAC,SACXE,KAAK,CAACV,kBACNW,GAAG,GACHC,IAAI,CAAC,CAACC;QACL,KAAK,MAAMC,eAAeD,IAAIE,IAAI,CAAE;YAClC,MAAMC,QAAQF,YAAYX,IAAI;YAC9B,IAAI,EAACa,yBAAAA,MAAOC,KAAK,KAAI,EAACD,yBAAAA,MAAOE,MAAM,GAAE;YACrC,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,uEAAuE;YACvE,wCAAwC;YACxC,MAAMD,QAAQvB,MAAMyB,iBAAiB,CAEnCH,MAAMC,KAAK;YACb,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,EAACA,yBAAAA,KAAO,CAACD,MAAME,MAAM,CAAC,GAAE;YAC5Bf,KAAKC,KAAK,CAACU,YAAYM,EAAE,CAAC,GAAG;gBAAEF,QAAQF,MAAME,MAAM;gBAAED;YAAM;QAC7D;IACF,GACCI,KAAK,CAAC,CAAChB;QACNiB,QAAQjB,KAAK,CAACA;QACdF,KAAKE,KAAK,GAAGA;IACf;IAEF,OAAOF;AACT;AAEA,OAAO,eAAeoB,SAASC,OAAkC;IAC/D,MAAM,EAAEtB,MAAM,EAAE,GAAGsB;IACnB,IAAI;QACF,OAAO,MAAM1B,gBAAgB;YAC3B2B,KAAK;gBAAC;gBAAgBvB;aAAiB;YACvCwB,YAAY3B;YACZ4B,MAAM;gBAAC9B,cAAcK;aAAkB;YACvC0B,MAAM,IAAM3B,UAAUC;YACtB,gEAAgE;YAChE2B,OAAO,CAACb,QAAU,CAACA,MAAMX,KAAK;QAChC;IACF,EAAE,OAAOA,OAAO;QACdiB,QAAQjB,KAAK,CAACA;QACd,OAAOJ,UAAUC;IACnB;AACF;AAEA,eAAeqB,SAAQ"}

package/src/lib/get-layout-version.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as Aglyn from '@aglyn/aglyn/server';
+export declare function getPublishedLayoutVersion(options: {
+    hostId: Aglyn.HostUid;
+    layoutId: Aglyn.LayoutUid;
+}): Promise<{
+    layout: Aglyn.AglynLayout | undefined;
+    version: Aglyn.AglynLayoutVersion | undefined;
+    error: unknown;
+}>;
+export default getPublishedLayoutVersion;

package/src/lib/get-layout-version.js

@@ -0,0 +1,99 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin, layoutConverter, layoutVersionConverter } from "@aglyn/tenant-data-admin";
+import { PUBLISHED_SITE_DATA_TTL_SECONDS, tenantDataTag, withRenderCache } from "@aglyn/tenant-data-admin/render-cache";
+import applyDuePublishSchedule from "./apply-publish-schedule.js";
+/**
+ * Backstop TTL only (AGL-1302): a layout publish goes through the console's
+ * `/api/screens/revalidate`, which busts `tenant-data:{hostId}` on the
+ * tenant alongside dropping every dependent page — so publishes stay
+ * instant and 60s only bounds unannounced writes, exactly like the page's
+ * own ISR window did.
+ */ const LAYOUT_VERSION_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS;
+/**
+ * Fetches a layout's published version (the `versionId` pointer on the
+ * layout doc). Errors and missing docs resolve to `version: undefined` so a
+ * broken layout never 404s a published screen — composition falls back to
+ * the bare screen.
+ *
+ * The layout chain runs on EVERY page of a site that carries chrome, which
+ * made this pair of reads one of the most amplified in the render
+ * (AGL-1302). The doc+version pair is cached whole; a layout carrying a
+ * PENDING publish schedule is served but never stored, because
+ * `applyDuePublishSchedule` needs the live `Timestamp` (`publishAt.seconds`
+ * does not survive the cache's JSON round trip) and the flip it performs is
+ * a write this cache must not suppress.
+ */ async function readPublishedLayoutVersion(hostId, layoutId) {
+    const data = {
+        layout: undefined,
+        version: undefined,
+        error: null
+    };
+    const firestore = firebaseAdmin.app().firestore();
+    const layoutRef = firestore.collection('hosts').doc(hostId).collection('layouts').doc(layoutId);
+    try {
+        const layoutSnapshot = await layoutRef.withConverter(layoutConverter).get();
+        if (!layoutSnapshot.exists) return data;
+        data.layout = layoutSnapshot.data();
+        // Scheduled publishing applies to layouts too (AGL-61).
+        const versionId = await applyDuePublishSchedule({
+            hostId,
+            collectionName: 'layouts',
+            docId: layoutId,
+            parent: data.layout
+        });
+        if (!versionId) return data;
+        const versionSnapshot = await layoutRef.collection('versions').withConverter(layoutVersionConverter).doc(versionId).get();
+        if (!versionSnapshot.exists) return data;
+        data.version = versionSnapshot.data();
+    } catch (error) {
+        console.error(error);
+        data.error = error;
+    }
+    return data;
+}
+export async function getPublishedLayoutVersion(options) {
+    const hostId = options == null ? void 0 : options.hostId;
+    const layoutId = options == null ? void 0 : options.layoutId;
+    try {
+        return await withRenderCache({
+            key: [
+                'tenant-layout-version',
+                hostId,
+                layoutId
+            ],
+            revalidate: LAYOUT_VERSION_TTL_SECONDS,
+            tags: [
+                tenantDataTag(hostId)
+            ],
+            read: ()=>readPublishedLayoutVersion(hostId, layoutId),
+            // Errors, missing layouts and pending schedules are served fresh each
+            // time — only a clean published read is worth replaying.
+            store: (value)=>{
+                var _value_layout_publishSchedule;
+                return !value.error && value.layout !== undefined && ((_value_layout_publishSchedule = value.layout.publishSchedule) == null ? void 0 : _value_layout_publishSchedule.status) !== 'pending';
+            }
+        });
+    } catch (error) {
+        // The cache wrapper itself failed; degrade to the uncached read so a
+        // caching problem can never 404 a published screen.
+        console.error(error);
+        return readPublishedLayoutVersion(hostId, layoutId);
+    }
+}
+export default getPublishedLayoutVersion;
+
+//# sourceMappingURL=get-layout-version.js.map

package/src/lib/get-layout-version.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/get-layout-version.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport {\n  firebaseAdmin,\n  layoutConverter,\n  layoutVersionConverter,\n} from '@aglyn/tenant-data-admin'\nimport {\n  PUBLISHED_SITE_DATA_TTL_SECONDS,\n  tenantDataTag,\n  withRenderCache,\n} from '@aglyn/tenant-data-admin/render-cache'\nimport applyDuePublishSchedule from './apply-publish-schedule'\n\n/**\n * Backstop TTL only (AGL-1302): a layout publish goes through the console's\n * `/api/screens/revalidate`, which busts `tenant-data:{hostId}` on the\n * tenant alongside dropping every dependent page — so publishes stay\n * instant and 60s only bounds unannounced writes, exactly like the page's\n * own ISR window did.\n */\nconst LAYOUT_VERSION_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS\n\n/**\n * Fetches a layout's published version (the `versionId` pointer on the\n * layout doc). Errors and missing docs resolve to `version: undefined` so a\n * broken layout never 404s a published screen — composition falls back to\n * the bare screen.\n *\n * The layout chain runs on EVERY page of a site that carries chrome, which\n * made this pair of reads one of the most amplified in the render\n * (AGL-1302). The doc+version pair is cached whole; a layout carrying a\n * PENDING publish schedule is served but never stored, because\n * `applyDuePublishSchedule` needs the live `Timestamp` (`publishAt.seconds`\n * does not survive the cache's JSON round trip) and the flip it performs is\n * a write this cache must not suppress.\n */\nasync function readPublishedLayoutVersion(hostId: string, layoutId: string) {\n  const data = {\n    layout: undefined as Aglyn.AglynLayout | undefined,\n    version: undefined as Aglyn.AglynLayoutVersion | undefined,\n    error: null as unknown,\n  }\n  const firestore = firebaseAdmin.app().firestore()\n  const layoutRef = firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('layouts')\n    .doc(layoutId)\n\n  try {\n    const layoutSnapshot = await layoutRef\n      .withConverter(layoutConverter)\n      .get()\n    if (!layoutSnapshot.exists) return data\n    data.layout = layoutSnapshot.data() as Aglyn.AglynLayout\n\n    // Scheduled publishing applies to layouts too (AGL-61).\n    const versionId = await applyDuePublishSchedule({\n      hostId,\n      collectionName: 'layouts',\n      docId: layoutId,\n      parent: data.layout,\n    })\n    if (!versionId) return data\n\n    const versionSnapshot = await layoutRef\n      .collection('versions')\n      .withConverter(layoutVersionConverter)\n      .doc(versionId)\n      .get()\n    if (!versionSnapshot.exists) return data\n    data.version = versionSnapshot.data() as Aglyn.AglynLayoutVersion\n  } catch (error) {\n    console.error(error)\n    data.error = error\n  }\n\n  return data\n}\n\nexport async function getPublishedLayoutVersion(options: {\n  hostId: Aglyn.HostUid\n  layoutId: Aglyn.LayoutUid\n}) {\n  const hostId = options?.hostId as string\n  const layoutId = options?.layoutId as string\n  try {\n    return await withRenderCache({\n      key: ['tenant-layout-version', hostId, layoutId],\n      revalidate: LAYOUT_VERSION_TTL_SECONDS,\n      tags: [tenantDataTag(hostId)],\n      read: () => readPublishedLayoutVersion(hostId, layoutId),\n      // Errors, missing layouts and pending schedules are served fresh each\n      // time — only a clean published read is worth replaying.\n      store: (value) =>\n        !value.error &&\n        value.layout !== undefined &&\n        (value.layout as { publishSchedule?: { status?: string } })\n          .publishSchedule?.status !== 'pending',\n    })\n  } catch (error) {\n    // The cache wrapper itself failed; degrade to the uncached read so a\n    // caching problem can never 404 a published screen.\n    console.error(error)\n    return readPublishedLayoutVersion(hostId, layoutId)\n  }\n}\n\nexport default getPublishedLayoutVersion\n"],"names":["firebaseAdmin","layoutConverter","layoutVersionConverter","PUBLISHED_SITE_DATA_TTL_SECONDS","tenantDataTag","withRenderCache","applyDuePublishSchedule","LAYOUT_VERSION_TTL_SECONDS","readPublishedLayoutVersion","hostId","layoutId","data","layout","undefined","version","error","firestore","app","layoutRef","collection","doc","layoutSnapshot","withConverter","get","exists","versionId","collectionName","docId","parent","versionSnapshot","console","getPublishedLayoutVersion","options","key","revalidate","tags","read","store","value","publishSchedule","status"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SACEA,aAAa,EACbC,eAAe,EACfC,sBAAsB,QACjB,2BAA0B;AACjC,SACEC,+BAA+B,EAC/BC,aAAa,EACbC,eAAe,QACV,wCAAuC;AAC9C,OAAOC,6BAA6B,8BAA0B;AAE9D;;;;;;CAMC,GACD,MAAMC,6BAA6BJ;AAEnC;;;;;;;;;;;;;CAaC,GACD,eAAeK,2BAA2BC,MAAc,EAAEC,QAAgB;IACxE,MAAMC,OAAO;QACXC,QAAQC;QACRC,SAASD;QACTE,OAAO;IACT;IACA,MAAMC,YAAYhB,cAAciB,GAAG,GAAGD,SAAS;IAC/C,MAAME,YAAYF,UACfG,UAAU,CAAC,SACXC,GAAG,CAACX,QACJU,UAAU,CAAC,WACXC,GAAG,CAACV;IAEP,IAAI;QACF,MAAMW,iBAAiB,MAAMH,UAC1BI,aAAa,CAACrB,iBACdsB,GAAG;QACN,IAAI,CAACF,eAAeG,MAAM,EAAE,OAAOb;QACnCA,KAAKC,MAAM,GAAGS,eAAeV,IAAI;QAEjC,wDAAwD;QACxD,MAAMc,YAAY,MAAMnB,wBAAwB;YAC9CG;YACAiB,gBAAgB;YAChBC,OAAOjB;YACPkB,QAAQjB,KAAKC,MAAM;QACrB;QACA,IAAI,CAACa,WAAW,OAAOd;QAEvB,MAAMkB,kBAAkB,MAAMX,UAC3BC,UAAU,CAAC,YACXG,aAAa,CAACpB,wBACdkB,GAAG,CAACK,WACJF,GAAG;QACN,IAAI,CAACM,gBAAgBL,MAAM,EAAE,OAAOb;QACpCA,KAAKG,OAAO,GAAGe,gBAAgBlB,IAAI;IACrC,EAAE,OAAOI,OAAO;QACde,QAAQf,KAAK,CAACA;QACdJ,KAAKI,KAAK,GAAGA;IACf;IAEA,OAAOJ;AACT;AAEA,OAAO,eAAeoB,0BAA0BC,OAG/C;IACC,MAAMvB,SAASuB,2BAAAA,QAASvB,MAAM;IAC9B,MAAMC,WAAWsB,2BAAAA,QAAStB,QAAQ;IAClC,IAAI;QACF,OAAO,MAAML,gBAAgB;YAC3B4B,KAAK;gBAAC;gBAAyBxB;gBAAQC;aAAS;YAChDwB,YAAY3B;YACZ4B,MAAM;gBAAC/B,cAAcK;aAAQ;YAC7B2B,MAAM,IAAM5B,2BAA2BC,QAAQC;YAC/C,sEAAsE;YACtE,yDAAyD;YACzD2B,OAAO,CAACC;oBAGN;uBAFA,CAACA,MAAMvB,KAAK,IACZuB,MAAM1B,MAAM,KAAKC,aACjB,EAAA,gCAAA,AAACyB,MAAM1B,MAAM,CACV2B,eAAe,qBADlB,8BACoBC,MAAM,MAAK;;QACnC;IACF,EAAE,OAAOzB,OAAO;QACd,qEAAqE;QACrE,oDAAoD;QACpDe,QAAQf,KAAK,CAACA;QACd,OAAOP,2BAA2BC,QAAQC;IAC5C;AACF;AAEA,eAAeqB,0BAAyB"}

package/src/lib/get-media-asset-facts.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { MediaRef } from '@aglyn/aglyn/server';
+import { type MediaAssetFacts } from '@aglyn/aglyn/app-utils/media-asset-facts';
+/**
+ * How many documents ONE composition reads facts for.
+ *
+ * A backstop sized well above what pages place, not a budget they are
+ * expected to approach. A page placing more keeps the pick-time copy on the
+ * rest, which is how every one of them rendered before these facts were read.
+ * Which ones are read is decided by the order the composition hands them
+ * over: the social card's references first (AGL-2850), then the placements in
+ * the order `mediaAssetRefs` lists them, films, then images, each from the top
+ * of the page down.
+ */
+export declare const MEDIA_ASSET_FACTS_PER_RENDER = 100;
+/**
+ * The current facts of each placed image and film this page may be shown, and
+ * of each asset its social card names, keyed by `mediaAssetFactsKey`
+ * (AGL-2807, AGL-2833, AGL-2850). `media-asset-facts.ts` in `@aglyn/aglyn`
+ * owns what is done with a placement's, and `social-image-facts.ts` beside
+ * this reader owns a card's.
+ *
+ * ## One read for the whole page
+ *
+ * Every document goes out in ONE `getAll`, projected to
+ * `MEDIA_ASSET_FACT_FIELDS`, however many elements and scope spellings place
+ * it, and a document is read once however many nodes name it. Firestore bills
+ * per document, so the cost of a composition is the number of distinct assets
+ * it places and its social card names, counted together and once each, up to
+ * {@link MEDIA_ASSET_FACTS_PER_RENDER}. A card names at most three of them (an
+ * entry's cover, a screen's image, the site default), and none the page does
+ * not already place when the card is one of its own pictures.
+ *
+ * ## Why this read is not behind the render cache
+ *
+ * Every other compose read is busted by the publish announce
+ * (`tenant-data:{hostId}`) and falls back to an hour's TTL for a write that
+ * never announces itself. A replace is exactly such a write: it goes through
+ * the console's `/api/media/replace` and tells the tenant nothing. Cached
+ * here, a replaced asset's facts could outlive the page's own ISR window by a
+ * second hour.
+ *
+ * ## What it answers for, and what it leaves to the node
+ *
+ * `mediaAssetFactsFromDocument` decides, per placement, from the projected
+ * document: an entry exists only for an asset that is live, not private, and
+ * visible to this site under the host-qualified scope the page renders, the
+ * verdict the CDN reaches when the browser asks for the bytes. The console's
+ * canvas and Preview decide through the same function, so the editor and the
+ * page agree about which assets answer. Anything else gets no entry and keeps
+ * its stored props, and so does every asset when the read fails. That is
+ * fail-open like every other compose read, because a Firestore fault must not
+ * strip the images and players on a live page of their shape.
+ */
+export declare function getMediaAssetFacts(options: {
+    hostId: string;
+    refs: readonly MediaRef[];
+}): Promise<Map<string, MediaAssetFacts>>;
+export default getMediaAssetFacts;

package/src/lib/get-media-asset-facts.js

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // By path rather than through a barrel: every `@aglyn/aglyn` barrel
+// re-exports `app-utils/server` into published pages, and the overlay stays
+// out of them.
+import { MEDIA_ASSET_FACT_FIELDS, mediaAssetDocumentPath, mediaAssetFactsFromDocument, mediaAssetFactsKey } from "@aglyn/aglyn/app-utils/media-asset-facts";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+/**
+ * How many documents ONE composition reads facts for.
+ *
+ * A backstop sized well above what pages place, not a budget they are
+ * expected to approach. A page placing more keeps the pick-time copy on the
+ * rest, which is how every one of them rendered before these facts were read.
+ * Which ones are read is decided by the order the composition hands them
+ * over: the social card's references first (AGL-2850), then the placements in
+ * the order `mediaAssetRefs` lists them, films, then images, each from the top
+ * of the page down.
+ */ export const MEDIA_ASSET_FACTS_PER_RENDER = 100;
+/**
+ * The current facts of each placed image and film this page may be shown, and
+ * of each asset its social card names, keyed by `mediaAssetFactsKey`
+ * (AGL-2807, AGL-2833, AGL-2850). `media-asset-facts.ts` in `@aglyn/aglyn`
+ * owns what is done with a placement's, and `social-image-facts.ts` beside
+ * this reader owns a card's.
+ *
+ * ## One read for the whole page
+ *
+ * Every document goes out in ONE `getAll`, projected to
+ * `MEDIA_ASSET_FACT_FIELDS`, however many elements and scope spellings place
+ * it, and a document is read once however many nodes name it. Firestore bills
+ * per document, so the cost of a composition is the number of distinct assets
+ * it places and its social card names, counted together and once each, up to
+ * {@link MEDIA_ASSET_FACTS_PER_RENDER}. A card names at most three of them (an
+ * entry's cover, a screen's image, the site default), and none the page does
+ * not already place when the card is one of its own pictures.
+ *
+ * ## Why this read is not behind the render cache
+ *
+ * Every other compose read is busted by the publish announce
+ * (`tenant-data:{hostId}`) and falls back to an hour's TTL for a write that
+ * never announces itself. A replace is exactly such a write: it goes through
+ * the console's `/api/media/replace` and tells the tenant nothing. Cached
+ * here, a replaced asset's facts could outlive the page's own ISR window by a
+ * second hour.
+ *
+ * ## What it answers for, and what it leaves to the node
+ *
+ * `mediaAssetFactsFromDocument` decides, per placement, from the projected
+ * document: an entry exists only for an asset that is live, not private, and
+ * visible to this site under the host-qualified scope the page renders, the
+ * verdict the CDN reaches when the browser asks for the bytes. The console's
+ * canvas and Preview decide through the same function, so the editor and the
+ * page agree about which assets answer. Anything else gets no entry and keeps
+ * its stored props, and so does every asset when the read fails. That is
+ * fail-open like every other compose read, because a Firestore fault must not
+ * strip the images and players on a live page of their shape.
+ */ export async function getMediaAssetFacts(options) {
+    const { hostId, refs } = options;
+    const facts = new Map();
+    /** One read per DOCUMENT, however many scope spellings place it. */ const documents = new Map();
+    for (const ref of refs){
+        const path = mediaAssetDocumentPath(ref);
+        if (!path) continue;
+        const placements = documents.get(path);
+        if (placements) placements.push(ref);
+        else if (documents.size < MEDIA_ASSET_FACTS_PER_RENDER) {
+            documents.set(path, [
+                ref
+            ]);
+        }
+    }
+    if (!documents.size) return facts;
+    try {
+        const firestore = firebaseAdmin.app().firestore();
+        const paths = [
+            ...documents.keys()
+        ];
+        const snapshots = await firestore.getAll(...paths.map((path)=>firestore.doc(path)), {
+            fieldMask: [
+                ...MEDIA_ASSET_FACT_FIELDS
+            ]
+        });
+        snapshots.forEach((snapshot, index)=>{
+            var _documents_get;
+            if (!snapshot.exists) return;
+            const document = {};
+            for (const field of MEDIA_ASSET_FACT_FIELDS){
+                document[field] = snapshot.get(field);
+            }
+            for (const ref of (_documents_get = documents.get(paths[index])) != null ? _documents_get : []){
+                const found = mediaAssetFactsFromDocument(document, ref, hostId);
+                if (found) facts.set(mediaAssetFactsKey(ref), found);
+            }
+        });
+        return facts;
+    } catch (error) {
+        console.error('[media-asset-facts] read failed; placements keep their stored props', error);
+        return new Map();
+    }
+}
+export default getMediaAssetFacts;
+
+//# sourceMappingURL=get-media-asset-facts.js.map

package/src/lib/get-media-asset-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/get-media-asset-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { MediaRef } from '@aglyn/aglyn/server'\n// By path rather than through a barrel: every `@aglyn/aglyn` barrel\n// re-exports `app-utils/server` into published pages, and the overlay stays\n// out of them.\nimport {\n  MEDIA_ASSET_FACT_FIELDS,\n  type MediaAssetDocument,\n  type MediaAssetFacts,\n  mediaAssetDocumentPath,\n  mediaAssetFactsFromDocument,\n  mediaAssetFactsKey,\n} from '@aglyn/aglyn/app-utils/media-asset-facts'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\n\n/**\n * How many documents ONE composition reads facts for.\n *\n * A backstop sized well above what pages place, not a budget they are\n * expected to approach. A page placing more keeps the pick-time copy on the\n * rest, which is how every one of them rendered before these facts were read.\n * Which ones are read is decided by the order the composition hands them\n * over: the social card's references first (AGL-2850), then the placements in\n * the order `mediaAssetRefs` lists them, films, then images, each from the top\n * of the page down.\n */\nexport const MEDIA_ASSET_FACTS_PER_RENDER = 100\n\n/**\n * The current facts of each placed image and film this page may be shown, and\n * of each asset its social card names, keyed by `mediaAssetFactsKey`\n * (AGL-2807, AGL-2833, AGL-2850). `media-asset-facts.ts` in `@aglyn/aglyn`\n * owns what is done with a placement's, and `social-image-facts.ts` beside\n * this reader owns a card's.\n *\n * ## One read for the whole page\n *\n * Every document goes out in ONE `getAll`, projected to\n * `MEDIA_ASSET_FACT_FIELDS`, however many elements and scope spellings place\n * it, and a document is read once however many nodes name it. Firestore bills\n * per document, so the cost of a composition is the number of distinct assets\n * it places and its social card names, counted together and once each, up to\n * {@link MEDIA_ASSET_FACTS_PER_RENDER}. A card names at most three of them (an\n * entry's cover, a screen's image, the site default), and none the page does\n * not already place when the card is one of its own pictures.\n *\n * ## Why this read is not behind the render cache\n *\n * Every other compose read is busted by the publish announce\n * (`tenant-data:{hostId}`) and falls back to an hour's TTL for a write that\n * never announces itself. A replace is exactly such a write: it goes through\n * the console's `/api/media/replace` and tells the tenant nothing. Cached\n * here, a replaced asset's facts could outlive the page's own ISR window by a\n * second hour.\n *\n * ## What it answers for, and what it leaves to the node\n *\n * `mediaAssetFactsFromDocument` decides, per placement, from the projected\n * document: an entry exists only for an asset that is live, not private, and\n * visible to this site under the host-qualified scope the page renders, the\n * verdict the CDN reaches when the browser asks for the bytes. The console's\n * canvas and Preview decide through the same function, so the editor and the\n * page agree about which assets answer. Anything else gets no entry and keeps\n * its stored props, and so does every asset when the read fails. That is\n * fail-open like every other compose read, because a Firestore fault must not\n * strip the images and players on a live page of their shape.\n */\nexport async function getMediaAssetFacts(options: {\n  hostId: string\n  refs: readonly MediaRef[]\n}): Promise<Map<string, MediaAssetFacts>> {\n  const { hostId, refs } = options\n  const facts = new Map<string, MediaAssetFacts>()\n  /** One read per DOCUMENT, however many scope spellings place it. */\n  const documents = new Map<string, MediaRef[]>()\n  for (const ref of refs) {\n    const path = mediaAssetDocumentPath(ref)\n    if (!path) continue\n    const placements = documents.get(path)\n    if (placements) placements.push(ref)\n    else if (documents.size < MEDIA_ASSET_FACTS_PER_RENDER) {\n      documents.set(path, [ref])\n    }\n  }\n  if (!documents.size) return facts\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    const paths = [...documents.keys()]\n    const snapshots = await firestore.getAll(\n      ...paths.map((path) => firestore.doc(path)),\n      { fieldMask: [...MEDIA_ASSET_FACT_FIELDS] },\n    )\n    snapshots.forEach((snapshot, index) => {\n      if (!snapshot.exists) return\n      const document: MediaAssetDocument = {}\n      for (const field of MEDIA_ASSET_FACT_FIELDS) {\n        document[field] = snapshot.get(field)\n      }\n      for (const ref of documents.get(paths[index]) ?? []) {\n        const found = mediaAssetFactsFromDocument(document, ref, hostId)\n        if (found) facts.set(mediaAssetFactsKey(ref), found)\n      }\n    })\n    return facts\n  } catch (error) {\n    console.error(\n      '[media-asset-facts] read failed; placements keep their stored props',\n      error,\n    )\n    return new Map()\n  }\n}\n\nexport default getMediaAssetFacts\n"],"names":["MEDIA_ASSET_FACT_FIELDS","mediaAssetDocumentPath","mediaAssetFactsFromDocument","mediaAssetFactsKey","firebaseAdmin","MEDIA_ASSET_FACTS_PER_RENDER","getMediaAssetFacts","options","hostId","refs","facts","Map","documents","ref","path","placements","get","push","size","set","firestore","app","paths","keys","snapshots","getAll","map","doc","fieldMask","forEach","snapshot","index","exists","document","field","found","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,oEAAoE;AACpE,4EAA4E;AAC5E,eAAe;AACf,SACEA,uBAAuB,EAGvBC,sBAAsB,EACtBC,2BAA2B,EAC3BC,kBAAkB,QACb,2CAA0C;AACjD,SAASC,aAAa,QAAQ,2BAA0B;AAExD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,+BAA+B,IAAG;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GACD,OAAO,eAAeC,mBAAmBC,OAGxC;IACC,MAAM,EAAEC,MAAM,EAAEC,IAAI,EAAE,GAAGF;IACzB,MAAMG,QAAQ,IAAIC;IAClB,kEAAkE,GAClE,MAAMC,YAAY,IAAID;IACtB,KAAK,MAAME,OAAOJ,KAAM;QACtB,MAAMK,OAAOb,uBAAuBY;QACpC,IAAI,CAACC,MAAM;QACX,MAAMC,aAAaH,UAAUI,GAAG,CAACF;QACjC,IAAIC,YAAYA,WAAWE,IAAI,CAACJ;aAC3B,IAAID,UAAUM,IAAI,GAAGb,8BAA8B;YACtDO,UAAUO,GAAG,CAACL,MAAM;gBAACD;aAAI;QAC3B;IACF;IACA,IAAI,CAACD,UAAUM,IAAI,EAAE,OAAOR;IAC5B,IAAI;QACF,MAAMU,YAAYhB,cAAciB,GAAG,GAAGD,SAAS;QAC/C,MAAME,QAAQ;eAAIV,UAAUW,IAAI;SAAG;QACnC,MAAMC,YAAY,MAAMJ,UAAUK,MAAM,IACnCH,MAAMI,GAAG,CAAC,CAACZ,OAASM,UAAUO,GAAG,CAACb,QACrC;YAAEc,WAAW;mBAAI5B;aAAwB;QAAC;QAE5CwB,UAAUK,OAAO,CAAC,CAACC,UAAUC;gBAMTnB;YALlB,IAAI,CAACkB,SAASE,MAAM,EAAE;YACtB,MAAMC,WAA+B,CAAC;YACtC,KAAK,MAAMC,SAASlC,wBAAyB;gBAC3CiC,QAAQ,CAACC,MAAM,GAAGJ,SAASd,GAAG,CAACkB;YACjC;YACA,KAAK,MAAMrB,QAAOD,iBAAAA,UAAUI,GAAG,CAACM,KAAK,CAACS,MAAM,aAA1BnB,iBAA+B,EAAE,CAAE;gBACnD,MAAMuB,QAAQjC,4BAA4B+B,UAAUpB,KAAKL;gBACzD,IAAI2B,OAAOzB,MAAMS,GAAG,CAAChB,mBAAmBU,MAAMsB;YAChD;QACF;QACA,OAAOzB;IACT,EAAE,OAAO0B,OAAO;QACdC,QAAQD,KAAK,CACX,uEACAA;QAEF,OAAO,IAAIzB;IACb;AACF;AAEA,eAAeL,mBAAkB"}

package/src/lib/get-plugin-installs.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as Aglyn from '@aglyn/aglyn/server';
+/**
+ * Resolves a host's pinned plugin installs (AGL-45) into the compose-time
+ * shape `attachPluginInstalls` stamps onto `marketplacePlugin` nodes, keyed
+ * by listing id. The kill switch is folded in per install: a revoked pin
+ * renders the disabled placeholder. Fail-open: on error an empty map is
+ * returned and plugin nodes show a safe "not installed" placeholder rather
+ * than taking the published screen down.
+ */
+export declare function getPluginInstalls(options: {
+    hostId: string;
+}): Promise<Record<string, Aglyn.ResolvedPluginInstall>>;
+export default getPluginInstalls;

package/src/lib/get-plugin-installs.js

@@ -0,0 +1,94 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn/server";
+import { resolveOrgIdForHost, firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { PUBLISHED_SITE_DATA_TTL_SECONDS, tenantDataTag, withRenderCache } from "@aglyn/tenant-data-admin/render-cache";
+/**
+ * SECURITY-RELEVANT TTL (AGL-1302): the kill switch (`revocations/{id}`) is
+ * folded into each resolved install, so this cache bounds how long a revoked
+ * plugin keeps rendering — 60s, on par with the page ISR window that already
+ * bounded it. Do not raise it.
+ */ const PLUGIN_INSTALLS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS;
+/**
+ * Resolves a host's pinned plugin installs (AGL-45) into the compose-time
+ * shape `attachPluginInstalls` stamps onto `marketplacePlugin` nodes, keyed
+ * by listing id. The kill switch is folded in per install: a revoked pin
+ * renders the disabled placeholder. Fail-open: on error an empty map is
+ * returned and plugin nodes show a safe "not installed" placeholder rather
+ * than taking the published screen down.
+ */ export async function getPluginInstalls(options) {
+    try {
+        return await withRenderCache({
+            key: [
+                'tenant-plugin-installs',
+                options.hostId
+            ],
+            revalidate: PLUGIN_INSTALLS_TTL_SECONDS,
+            tags: [
+                tenantDataTag(options.hostId)
+            ],
+            read: ()=>readPluginInstalls(options)
+        });
+    } catch (error) {
+        console.error(error);
+        return readPluginInstalls(options);
+    }
+}
+async function readPluginInstalls(options) {
+    const installs = {};
+    try {
+        var _ref;
+        const firestore = firebaseAdmin.app().firestore();
+        // Org-tier installs apply to every host in the org (AGL-237); a
+        // host-level pin of the same listing wins (host docs merge second).
+        const orgId = await resolveOrgIdForHost(options.hostId);
+        const [orgSnapshot, snapshot] = await Promise.all([
+            orgId ? firestore.collection('orgs').doc(orgId).collection('installs').limit(50).get() : Promise.resolve(null),
+            firestore.collection('hosts').doc(options.hostId).collection('installs').limit(50).get()
+        ]);
+        const merged = new Map();
+        for (const docSnapshot of (_ref = orgSnapshot == null ? void 0 : orgSnapshot.docs) != null ? _ref : []){
+            merged.set(docSnapshot.id, docSnapshot);
+        }
+        for (const docSnapshot of snapshot.docs){
+            merged.set(docSnapshot.id, docSnapshot);
+        }
+        if (merged.size === 0) return installs;
+        await Promise.all([
+            ...merged.values()
+        ].map(async (docSnapshot)=>{
+            var _docSnapshot_get, _docSnapshot_get1;
+            var _docSnapshot_get2;
+            const version = String((_docSnapshot_get = docSnapshot.get('version')) != null ? _docSnapshot_get : '');
+            const sha256 = String((_docSnapshot_get1 = docSnapshot.get('sha256')) != null ? _docSnapshot_get1 : '');
+            if (!version || !sha256) return;
+            const revocation = (await firestore.collection('revocations').doc(docSnapshot.id).get()).data();
+            installs[docSnapshot.id] = {
+                listingId: docSnapshot.id,
+                version,
+                sha256,
+                capabilities: (_docSnapshot_get2 = docSnapshot.get('manifest')) == null ? void 0 : _docSnapshot_get2.capabilities,
+                revoked: Aglyn.isPluginRevoked(revocation, version)
+            };
+        }));
+    } catch (error) {
+        console.error(error);
+    }
+    return installs;
+}
+export default getPluginInstalls;
+
+//# sourceMappingURL=get-plugin-installs.js.map

package/src/lib/get-plugin-installs.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/get-plugin-installs.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn/server'\nimport {\n  resolveOrgIdForHost, firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  PUBLISHED_SITE_DATA_TTL_SECONDS,\n  tenantDataTag,\n  withRenderCache,\n} from '@aglyn/tenant-data-admin/render-cache'\n\n/**\n * SECURITY-RELEVANT TTL (AGL-1302): the kill switch (`revocations/{id}`) is\n * folded into each resolved install, so this cache bounds how long a revoked\n * plugin keeps rendering — 60s, on par with the page ISR window that already\n * bounded it. Do not raise it.\n */\nconst PLUGIN_INSTALLS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS\n\n/**\n * Resolves a host's pinned plugin installs (AGL-45) into the compose-time\n * shape `attachPluginInstalls` stamps onto `marketplacePlugin` nodes, keyed\n * by listing id. The kill switch is folded in per install: a revoked pin\n * renders the disabled placeholder. Fail-open: on error an empty map is\n * returned and plugin nodes show a safe \"not installed\" placeholder rather\n * than taking the published screen down.\n */\nexport async function getPluginInstalls(options: {\n  hostId: string\n}): Promise<Record<string, Aglyn.ResolvedPluginInstall>> {\n  try {\n    return await withRenderCache({\n      key: ['tenant-plugin-installs', options.hostId],\n      revalidate: PLUGIN_INSTALLS_TTL_SECONDS,\n      tags: [tenantDataTag(options.hostId)],\n      read: () => readPluginInstalls(options),\n    })\n  } catch (error) {\n    console.error(error)\n    return readPluginInstalls(options)\n  }\n}\n\nasync function readPluginInstalls(options: {\n  hostId: string\n}): Promise<Record<string, Aglyn.ResolvedPluginInstall>> {\n  const installs: Record<string, Aglyn.ResolvedPluginInstall> = {}\n  try {\n    const firestore = firebaseAdmin.app().firestore()\n    // Org-tier installs apply to every host in the org (AGL-237); a\n    // host-level pin of the same listing wins (host docs merge second).\n    const orgId = await resolveOrgIdForHost(options.hostId)\n    const [orgSnapshot, snapshot] = await Promise.all([\n      orgId\n        ? firestore\n            .collection('orgs')\n            .doc(orgId)\n            .collection('installs')\n            .limit(50)\n            .get()\n        : Promise.resolve(null),\n      firestore\n        .collection('hosts')\n        .doc(options.hostId)\n        .collection('installs')\n        .limit(50)\n        .get(),\n    ])\n    const merged = new Map()\n    for (const docSnapshot of orgSnapshot?.docs ?? []) {\n      merged.set(docSnapshot.id, docSnapshot)\n    }\n    for (const docSnapshot of snapshot.docs) {\n      merged.set(docSnapshot.id, docSnapshot)\n    }\n    if (merged.size === 0) return installs\n\n    await Promise.all(\n      [...merged.values()].map(async (docSnapshot) => {\n        const version = String(docSnapshot.get('version') ?? '')\n        const sha256 = String(docSnapshot.get('sha256') ?? '')\n        if (!version || !sha256) return\n        const revocation = (\n          await firestore\n            .collection('revocations')\n            .doc(docSnapshot.id)\n            .get()\n        ).data() as Aglyn.PluginRevocation | undefined\n        installs[docSnapshot.id] = {\n          listingId: docSnapshot.id,\n          version,\n          sha256,\n          capabilities: docSnapshot.get('manifest')?.capabilities,\n          revoked: Aglyn.isPluginRevoked(revocation, version),\n        }\n      }),\n    )\n  } catch (error) {\n    console.error(error)\n  }\n  return installs\n}\n\nexport default getPluginInstalls\n"],"names":["Aglyn","resolveOrgIdForHost","firebaseAdmin","PUBLISHED_SITE_DATA_TTL_SECONDS","tenantDataTag","withRenderCache","PLUGIN_INSTALLS_TTL_SECONDS","getPluginInstalls","options","key","hostId","revalidate","tags","read","readPluginInstalls","error","console","installs","firestore","app","orgId","orgSnapshot","snapshot","Promise","all","collection","doc","limit","get","resolve","merged","Map","docSnapshot","docs","set","id","size","values","map","version","String","sha256","revocation","data","listingId","capabilities","revoked","isPluginRevoked"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,sBAAqB;AAC5C,SACEC,mBAAmB,EAAEC,aAAa,QAAQ,2BAA0B;AACtE,SACEC,+BAA+B,EAC/BC,aAAa,EACbC,eAAe,QACV,wCAAuC;AAE9C;;;;;CAKC,GACD,MAAMC,8BAA8BH;AAEpC;;;;;;;CAOC,GACD,OAAO,eAAeI,kBAAkBC,OAEvC;IACC,IAAI;QACF,OAAO,MAAMH,gBAAgB;YAC3BI,KAAK;gBAAC;gBAA0BD,QAAQE,MAAM;aAAC;YAC/CC,YAAYL;YACZM,MAAM;gBAACR,cAAcI,QAAQE,MAAM;aAAE;YACrCG,MAAM,IAAMC,mBAAmBN;QACjC;IACF,EAAE,OAAOO,OAAO;QACdC,QAAQD,KAAK,CAACA;QACd,OAAOD,mBAAmBN;IAC5B;AACF;AAEA,eAAeM,mBAAmBN,OAEjC;IACC,MAAMS,WAAwD,CAAC;IAC/D,IAAI;;QACF,MAAMC,YAAYhB,cAAciB,GAAG,GAAGD,SAAS;QAC/C,gEAAgE;QAChE,oEAAoE;QACpE,MAAME,QAAQ,MAAMnB,oBAAoBO,QAAQE,MAAM;QACtD,MAAM,CAACW,aAAaC,SAAS,GAAG,MAAMC,QAAQC,GAAG,CAAC;YAChDJ,QACIF,UACGO,UAAU,CAAC,QACXC,GAAG,CAACN,OACJK,UAAU,CAAC,YACXE,KAAK,CAAC,IACNC,GAAG,KACNL,QAAQM,OAAO,CAAC;YACpBX,UACGO,UAAU,CAAC,SACXC,GAAG,CAAClB,QAAQE,MAAM,EAClBe,UAAU,CAAC,YACXE,KAAK,CAAC,IACNC,GAAG;SACP;QACD,MAAME,SAAS,IAAIC;QACnB,KAAK,MAAMC,uBAAeX,+BAAAA,YAAaY,IAAI,mBAAI,EAAE,CAAE;YACjDH,OAAOI,GAAG,CAACF,YAAYG,EAAE,EAAEH;QAC7B;QACA,KAAK,MAAMA,eAAeV,SAASW,IAAI,CAAE;YACvCH,OAAOI,GAAG,CAACF,YAAYG,EAAE,EAAEH;QAC7B;QACA,IAAIF,OAAOM,IAAI,KAAK,GAAG,OAAOnB;QAE9B,MAAMM,QAAQC,GAAG,CACf;eAAIM,OAAOO,MAAM;SAAG,CAACC,GAAG,CAAC,OAAON;gBACPA,kBACDA;gBAYNA;YAbhB,MAAMO,UAAUC,QAAOR,mBAAAA,YAAYJ,GAAG,CAAC,sBAAhBI,mBAA8B;YACrD,MAAMS,SAASD,QAAOR,oBAAAA,YAAYJ,GAAG,CAAC,qBAAhBI,oBAA6B;YACnD,IAAI,CAACO,WAAW,CAACE,QAAQ;YACzB,MAAMC,aAAa,AACjB,CAAA,MAAMxB,UACHO,UAAU,CAAC,eACXC,GAAG,CAACM,YAAYG,EAAE,EAClBP,GAAG,EAAC,EACPe,IAAI;YACN1B,QAAQ,CAACe,YAAYG,EAAE,CAAC,GAAG;gBACzBS,WAAWZ,YAAYG,EAAE;gBACzBI;gBACAE;gBACAI,YAAY,GAAEb,oBAAAA,YAAYJ,GAAG,CAAC,gCAAhBI,kBAA6Ba,YAAY;gBACvDC,SAAS9C,MAAM+C,eAAe,CAACL,YAAYH;YAC7C;QACF;IAEJ,EAAE,OAAOxB,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;IACA,OAAOE;AACT;AAEA,eAAeV,kBAAiB"}