@velora-cms/server 0.11.0

package/dist/marketplace/install-bundle-members.d.ts

@@ -0,0 +1,33 @@
+import type { InstallFailure, InstallOutcome } from "./install-from-marketplace.js";
+export interface BundleMemberOutcome {
+    pluginId: string;
+    version: string;
+    outcome: "installed" | "already-installed";
+}
+export type BundleMembersResult = {
+    ok: true;
+    members: BundleMemberOutcome[];
+    installedIds: string[];
+} | {
+    ok: false;
+    failure: InstallFailure;
+};
+export interface InstallBundleMembersDeps {
+    fetchMemberListing: (memberId: string) => Promise<{
+        type?: string;
+        latestVersion?: {
+            version: string;
+        } | null;
+    }>;
+    installOne: (input: {
+        pluginId: string;
+        version: string;
+        installedBy?: string;
+    }) => Promise<InstallOutcome>;
+    rollbackOne: (memberId: string) => Promise<void>;
+}
+export declare function installBundleMembers(deps: InstallBundleMembersDeps, input: {
+    bundleId: string;
+    memberIds: string[];
+    installedBy?: string;
+}): Promise<BundleMembersResult>;

package/dist/marketplace/install-bundle-members.js

@@ -0,0 +1,137 @@
+import { MarketplaceNotFoundError } from "./marketplace-client.js";
+// Mirrors MarketplaceInstallBodySchema's PLUGIN_ID_PATTERN (packages/api-schemas/src/marketplace-listing-api.schema.ts):
+// duplicated by the same reasoning that schema documents — a bundle member id read from
+// the raw manifest.json never passed through that schema, but reaches filesystem-adjacent
+// code downstream (install-built-package.ts's directory-name/rmSync path) just the same.
+const PLUGIN_ID_PATTERN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
+function memberFailure(memberId, detail) {
+    return {
+        ok: false,
+        failure: {
+            code: "bundle-member-failed",
+            message: `Bundle member "${memberId}" failed: ${detail} — the bundle was not installed and every member installed by this operation was rolled back`,
+        },
+    };
+}
+export async function installBundleMembers(deps, input) {
+    const { bundleId, memberIds, installedBy } = input;
+    // Guards on the declared list itself. Dedupe preserves first-occurrence
+    // order so the response's members array matches the manifest's own
+    // declaration order.
+    const unique = [...new Set(memberIds)];
+    if (unique.length === 0) {
+        return {
+            ok: false,
+            failure: {
+                code: "install-refused",
+                message: `Bundle "${bundleId}" declares no members — installing it would be exactly the silent no-op bundle installs used to be`,
+            },
+        };
+    }
+    if (unique.includes(bundleId)) {
+        return {
+            ok: false,
+            failure: { code: "install-refused", message: `Bundle "${bundleId}" lists itself as a member — refusing to install` },
+        };
+    }
+    // Phase 1 — resolve every member's listing BEFORE installing anything,
+    // so a missing/nested/versionless member costs zero installs and zero
+    // rollbacks.
+    const resolved = [];
+    for (const memberId of unique) {
+        if (!PLUGIN_ID_PATTERN.test(memberId)) {
+            return memberFailure(memberId, "its id is not a valid reverse-domain plugin id");
+        }
+        let listing;
+        try {
+            listing = await deps.fetchMemberListing(memberId);
+        }
+        catch (error) {
+            if (error instanceof MarketplaceNotFoundError) {
+                return memberFailure(memberId, "no marketplace listing exists for it");
+            }
+            throw error;
+        }
+        if (listing.type === "bundle") {
+            return memberFailure(memberId, "it is itself a bundle — nested bundles are not supported");
+        }
+        const version = listing.latestVersion?.version;
+        if (!version) {
+            return memberFailure(memberId, "its listing has no published version");
+        }
+        resolved.push({ pluginId: memberId, version });
+    }
+    // Phase 2 — install, dependency-ordered by retry rounds. A member whose
+    // pluginDependencies aren't satisfied yet fails with dependency-missing
+    // (PluginRegistryService.install()'s existing check) and is retried in
+    // the next round; every marketplace install ends ACTIVE
+    // (registerLocalPlugin always activates), so installing a dependency in
+    // an earlier round genuinely satisfies the "installed AND enabled" check.
+    // Bounded: each round must install (or skip) at least one member, so at
+    // most resolved.length rounds run.
+    const installedIds = [];
+    const rollback = async () => {
+        for (const id of [...installedIds].reverse()) {
+            await deps.rollbackOne(id);
+        }
+    };
+    const outcomes = new Map();
+    let pending = resolved;
+    while (pending.length > 0) {
+        const deferred = [];
+        let progressed = false;
+        for (const member of pending) {
+            let outcome;
+            try {
+                outcome = await deps.installOne({ ...member, installedBy });
+            }
+            catch (error) {
+                // The atomic-set invariant holds for throws too: roll back what
+                // this call installed, then let the caller's own error handling
+                // (install-from-marketplace's catch-all / the route's 503 mapping)
+                // see the original error.
+                await rollback();
+                throw error;
+            }
+            if (outcome.ok) {
+                outcomes.set(member.pluginId, { pluginId: member.pluginId, version: member.version, outcome: "installed" });
+                installedIds.push(member.pluginId);
+                progressed = true;
+            }
+            else if (outcome.failure.code === "already-installed") {
+                // Recorded decision: skip, don't claim. No ownership row will be
+                // written for this member and no rollback/uninstall ever touches it.
+                outcomes.set(member.pluginId, {
+                    pluginId: member.pluginId,
+                    version: member.version,
+                    outcome: "already-installed",
+                });
+                progressed = true;
+            }
+            else if (outcome.failure.code === "dependency-missing") {
+                deferred.push({ ...member, lastMessage: outcome.failure.message });
+            }
+            else {
+                await rollback();
+                return memberFailure(member.pluginId, outcome.failure.message);
+            }
+        }
+        if (!progressed) {
+            await rollback();
+            const detail = deferred.map((d) => `"${d.pluginId}" (${d.lastMessage})`).join("; ");
+            return {
+                ok: false,
+                failure: {
+                    code: "bundle-member-failed",
+                    message: `Bundle members have dependencies no install order can satisfy: ${detail} — the bundle was not installed and every member installed by this operation was rolled back`,
+                },
+            };
+        }
+        pending = deferred.map(({ pluginId, version }) => ({ pluginId, version }));
+    }
+    return {
+        ok: true,
+        members: unique.map((id) => outcomes.get(id)),
+        installedIds,
+    };
+}

package/dist/marketplace/install-from-marketplace.d.ts

@@ -0,0 +1,60 @@
+import type { PrismaClient } from "@prisma/client";
+import type { DatabaseAdapter } from "@velora-cms/db-adapter";
+import { type PluginRegistryService } from "../plugins/plugin-registry-service.js";
+import { type BundleMemberOutcome } from "./install-bundle-members.js";
+export type InstallFailure = {
+    code: "already-installed";
+    message: string;
+} | {
+    code: "not-found";
+    message: string;
+} | {
+    code: "license-required";
+    message: string;
+} | {
+    code: "site-domain-missing";
+    message: string;
+} | {
+    code: "license-rejected";
+    message: string;
+} | {
+    code: "verification-failed";
+    message: string;
+} | {
+    code: "incompatible";
+    message: string;
+} | {
+    code: "dependency-missing";
+    message: string;
+} | {
+    code: "install-refused";
+    message: string;
+} | {
+    code: "bundle-member-failed";
+    message: string;
+};
+export type InstallOutcome = {
+    ok: true;
+    pluginId: string;
+    version: string;
+    trustTier: "verified";
+    licensed: boolean;
+    members?: BundleMemberOutcome[];
+} | {
+    ok: false;
+    failure: InstallFailure;
+};
+export interface InstallFromMarketplaceDeps {
+    prisma: PrismaClient;
+    registry: PluginRegistryService;
+    marketplaceBaseUrl: string;
+    adapter: DatabaseAdapter;
+}
+export interface InstallFromMarketplaceInput {
+    pluginId: string;
+    version: string;
+    licenseKey?: string;
+    installedBy?: string;
+    refuseBundleType?: boolean;
+}
+export declare function installFromMarketplace(deps: InstallFromMarketplaceDeps, input: InstallFromMarketplaceInput): Promise<InstallOutcome>;