@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/api-plugins.js

@@ -0,0 +1,221 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Server half of the plugin pattern (AGL-396): the API-route registry, the
+ * server counterpart to the ConsoleExtension registry. A feature plugin
+ * registers request handlers here from its `/server` entry point (never its
+ * client barrel, so firebase-admin and other server-only deps stay out of
+ * the browser bundle). The app ships one catch-all dispatcher route per
+ * Next app that resolves a request path to a registered handler — so moving
+ * a feature's API into its plugin needs no new app route and keeps the same
+ * URL. Reference implementation: events-calendar `events/list` (AGL-396).
+ *
+ * The request/response shapes are structural (not `next` types) so plugins
+ * stay framework-light; `NextApiRequest`/`NextApiResponse` satisfy them, so
+ * the dispatcher passes Next's objects straight through.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/** Leading/trailing slashes stripped so '/events/list' and 'events/list' key alike. */ function normalizeApiPath(path) {
+    return path.replace(/^\/+|\/+$/g, '');
+}
+const apiRoutes = new Map();
+const apiRouteOwners = new Map();
+const apiRouteOptions = new Map();
+/**
+ * The "currently registering plugin" marker moved to a leaf module
+ * (`registering-plugin`) so `site-page-hooks` can read it too — this file is
+ * only reachable through the `/server` entry, and importing it from the shared
+ * plugin-manager barrel formed a cycle (AGL-1289). Re-exported here so the
+ * plugin loader's existing import keeps working unchanged.
+ */ import { getRegisteringPluginId } from "./registering-plugin.js";
+export { setRegisteringPluginId, getRegisteringPluginId } from "./registering-plugin.js";
+/**
+ * Registers a plugin API handler at a host-relative path (e.g.
+ * 'events/list'), served by the app dispatcher at `/api/events/list`.
+ *
+ * Idempotent by path FOR ITS OWNER — re-registration by the plugin that
+ * holds the path replaces the previous handler, which is what a hot reload,
+ * a second surface, and a repeated init all depend on.
+ *
+ * A different plugin is REFUSED (AGL-2484). This map is process-global and
+ * was last-writer-wins on the path alone, while Aglyn's own commission-taking
+ * handlers sit at `marketplace/checkout` and `commerce/checkout` — and the
+ * tenant dispatcher calls `ensureRemoteServerBundles()` after the first-party
+ * loader has run, so a remote bundle registering either path was simply the
+ * later writer. Getting there needs `PLUGIN_REMOTE_SERVER=enabled` (off by
+ * default), realm trust and a valid signature, so this is the last of several
+ * doors rather than the only one; it is also the one the registry could close
+ * by itself, because it already recorded who registered what.
+ *
+ * Anonymous registration — no loader marker — is an IDENTITY here, not a
+ * wildcard: it may replace itself and nothing else may take it.
+ */ export function registerPluginApiRoute(path, handler, options) {
+    var _getRegisteringPluginId;
+    const key = normalizeApiPath(path);
+    const owner = (_getRegisteringPluginId = getRegisteringPluginId()) != null ? _getRegisteringPluginId : ANONYMOUS_OWNER;
+    const incumbent = apiRouteOwners.get(key);
+    if (incumbent !== undefined && incumbent !== owner) {
+        // Loud, because the silent version of this is a payment route quietly
+        // answering from someone else's code. Refusing is the safe direction:
+        // the incumbent keeps serving.
+        console.error(`[plugins] refused API route "${key}" to "${owner}": already ` + `registered by "${incumbent}"`);
+        return;
+    }
+    apiRoutes.set(key, handler);
+    apiRouteOwners.set(key, owner);
+    // Replaced with the handler, never merged: a re-registration that drops its
+    // subject resolver must not keep answering with the previous one.
+    if (options) apiRouteOptions.set(key, options);
+    else apiRouteOptions.delete(key);
+}
+/** The marker for a registration made outside any loader context. */ const ANONYMOUS_OWNER = '';
+/** The plugin that registered a path, for per-org enablement gating. */ export function pluginIdForRegisteredApiPath(path) {
+    const owner = apiRouteOwners.get(normalizeApiPath(path));
+    // An anonymous registration has no plugin to gate on, and this has always
+    // answered `undefined` for one — the sentinel must not leak out as an id.
+    return owner === undefined || owner === ANONYMOUS_OWNER ? undefined : owner;
+}
+export function unregisterPluginApiRoute(path) {
+    const key = normalizeApiPath(path);
+    apiRoutes.delete(key);
+    // Release the CLAIM too, or the refusal above outlives the route and the
+    // path can never be re-registered for the life of the process.
+    apiRouteOwners.delete(key);
+    apiRouteOptions.delete(key);
+}
+/**
+ * The registered key a request path resolves to, with its `:name` segments.
+ *
+ * An exact registration wins; otherwise a registration whose path carries
+ * `:name` segments matches segment for segment. One matcher for the route and
+ * for its options, so a request can never be answered by one registration and
+ * gated with another's subject.
+ */ function matchRegisteredApiKey(path) {
+    const key = normalizeApiPath(path);
+    if (apiRoutes.has(key)) return {
+        key,
+        params: {}
+    };
+    const segments = key.split('/');
+    for (const registered of apiRoutes.keys()){
+        if (!registered.includes(':')) continue;
+        const pattern = registered.split('/');
+        if (pattern.length !== segments.length) continue;
+        const params = {};
+        let matched = true;
+        for(let index = 0; index < pattern.length; index += 1){
+            const part = pattern[index];
+            if (part.startsWith(':') && segments[index]) {
+                params[part.slice(1)] = segments[index];
+            } else if (part !== segments[index]) {
+                matched = false;
+                break;
+            }
+        }
+        if (matched) return {
+            key: registered,
+            params
+        };
+    }
+    return undefined;
+}
+/**
+ * The route for a request path, or undefined when nothing is registered.
+ *
+ * An exact registration wins; otherwise a registration whose path carries
+ * `:name` segments matches segment for segment (`ai/jobs/:jobId/cancel`
+ * answers `ai/jobs/abc/cancel`), and the named segments come back as
+ * `params`. Patterns are tried in registration order and a static segment
+ * beats a named one only by being registered exactly.
+ */ export function resolvePluginApiMatch(path) {
+    const matched = matchRegisteredApiKey(path);
+    if (!matched) return undefined;
+    const route = apiRoutes.get(matched.key);
+    return route ? {
+        route,
+        params: matched.params
+    } : undefined;
+}
+/**
+ * Whether a request path resolves to a route registered as a
+ * {@link PluginApiRouteOptions.recipientLink} — what both dispatchers ask
+ * before their enablement and release gates (AGL-2981).
+ */ export function isPluginRecipientLinkRoute(path) {
+    var _apiRouteOptions_get;
+    const matched = matchRegisteredApiKey(path);
+    return matched ? ((_apiRouteOptions_get = apiRouteOptions.get(matched.key)) == null ? void 0 : _apiRouteOptions_get.recipientLink) === true : false;
+}
+/** An id a subject may carry: a non-empty path segment, not a path. */ const SUBJECT_ID = /^[^/\s]{1,128}$/;
+const subjectId = (value)=>typeof value === 'string' && SUBJECT_ID.test(value) ? value : null;
+/**
+ * The subject a request to a registered route names, or `null` (AGL-2978).
+ *
+ * `null` when the route declared no resolver, when the resolver answered
+ * nothing, and when it THREW: a resolver that cannot read its request has
+ * named no subject, and the gate then treats the request as anonymous — the
+ * conservative direction. The resolver reads a clone, so the handler still
+ * receives the untouched body. Ids are held to a plain path segment, so a
+ * resolver cannot hand the gate a path to read overrides from.
+ */ export async function resolvePluginApiRequestSubject(path, request) {
+    var _apiRouteOptions_get;
+    const matched = matchRegisteredApiKey(path);
+    const resolve = matched ? (_apiRouteOptions_get = apiRouteOptions.get(matched.key)) == null ? void 0 : _apiRouteOptions_get.subject : undefined;
+    if (!resolve) return null;
+    try {
+        const subject = await resolve(request.clone());
+        if (!subject) return null;
+        const orgId = subjectId(subject.orgId);
+        const uid = subjectId(subject.uid);
+        if (!orgId && !uid) return null;
+        return _extends({
+            orgId
+        }, uid ? {
+            uid
+        } : {});
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * The legacy (node-style) handler at a request path, or undefined when
+ * nothing is registered there or the route is a web handler — a web route
+ * is reached through `resolvePluginApiMatch` and `runPluginApiMatch`, since
+ * it takes the `Request` and the filled `:name` segments, not a `req`/`res`
+ * pair.
+ */ export function resolvePluginApiRoute(path) {
+    var _resolvePluginApiMatch;
+    const route = (_resolvePluginApiMatch = resolvePluginApiMatch(path)) == null ? void 0 : _resolvePluginApiMatch.route;
+    return typeof route === 'function' ? route : undefined;
+}
+/**
+ * Runs a matched route against the dispatcher's request: a Web handler is
+ * called as it is, and a (req, res) handler goes through the adapter the
+ * caller supplies — the adapter lives on the `/server` entry, which this
+ * module may not import.
+ */ export async function runPluginApiMatch(match, request, params, runLegacy) {
+    const merged = _extends({}, params, match.params);
+    const route = match.route;
+    if (typeof route === 'object' && route !== null && typeof route.web === 'function') {
+        return route.web(request, {
+            params: merged
+        });
+    }
+    return runLegacy(match.route, request, merged);
+}
+/** Registered paths, for diagnostics. */ export function listPluginApiRoutes() {
+    return Array.from(apiRoutes.keys());
+}
+
+//# sourceMappingURL=api-plugins.js.map

package/src/lib/app-utils/api-plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/api-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Server half of the plugin pattern (AGL-396): the API-route registry, the\n * server counterpart to the ConsoleExtension registry. A feature plugin\n * registers request handlers here from its `/server` entry point (never its\n * client barrel, so firebase-admin and other server-only deps stay out of\n * the browser bundle). The app ships one catch-all dispatcher route per\n * Next app that resolves a request path to a registered handler — so moving\n * a feature's API into its plugin needs no new app route and keeps the same\n * URL. Reference implementation: events-calendar `events/list` (AGL-396).\n *\n * The request/response shapes are structural (not `next` types) so plugins\n * stay framework-light; `NextApiRequest`/`NextApiResponse` satisfy them, so\n * the dispatcher passes Next's objects straight through.\n */\n\nexport interface PluginApiRequest {\n  method?: string\n  query: Partial<Record<string, string | string[]>>\n  // `any` mirrors NextApiRequest.body (parsed JSON/form/text); handlers\n  // validate it themselves, as they did as Next routes.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  body: any\n  /**\n   * The unparsed request text, for handlers that verify signatures over the\n   * exact payload (Stripe/Svix webhooks registered as plugin API paths).\n   * UTF-8 re-encoding of the text is byte-identical for valid UTF-8 JSON.\n   */\n  rawBody?: string\n  headers: Partial<Record<string, string | string[]>>\n  cookies: Partial<Record<string, string>>\n  /**\n   * Node socket — the client-address fallback (`remoteAddress`).\n   *\n   * On the console's Pages Router this is the real transport peer. Behind the\n   * App Router adapter there is no socket, and `api-adapter.ts` fills it from\n   * the shared client-address reader so a handler falling back to it gets the\n   * same trusted hop rather than a caller-supplied one.\n   */\n  socket: { remoteAddress?: string }\n}\n\nexport interface PluginApiResponse {\n  status(code: number): PluginApiResponse\n  json(body: unknown): void\n  send(body: unknown): void\n  setHeader(name: string, value: string | number | readonly string[]): void\n  redirect(url: string): void\n  redirect(status: number, url: string): void\n  end(): void\n}\n\nexport type PluginApiHandler = (\n  req: PluginApiRequest,\n  res: PluginApiResponse,\n) => void | Promise<void>\n\n/**\n * A handler in the Web shape (AGL-2939): the dispatcher's own `Request`\n * in, a `Response` out — with a streamed body when the door streams, as\n * the assistant's chat and a job's event feed do. `params` carries the\n * dispatcher's path segments and any `:name` segment the registered path\n * declared.\n */\nexport type PluginWebApiHandler = (\n  request: Request,\n  context: { params: Record<string, string | string[]> },\n) => Response | Promise<Response>\n\n/** What a route registers: the (req, res) shape, or a Web handler. */\nexport type PluginApiRoute = PluginApiHandler | { web: PluginWebApiHandler }\n\n/** A registered route matched to a request path, with its `:name` segments filled. */\nexport interface PluginApiMatch {\n  route: PluginApiRoute\n  params: Record<string, string>\n}\n\n/**\n * Who a request is FOR, as far as the dispatchers' release gate is concerned\n * (AGL-2978).\n *\n * The gate buckets a rollout and reads per-org overrides on an org id, and a\n * dispatcher learns that id from the site a request names (`hostId`). Two\n * kinds of request name no site and still belong to one organization:\n *\n * - a request to an ORGANIZATION-level surface (`ConsoleExtension.orgNavItems`,\n *   AGL-2974), which names its org rather than a site;\n * - a request that arrives with no bearer token by design — a provider's\n *   OAuth redirect back to the platform, which carries only what the platform\n *   signed into it.\n *\n * Without a subject the gate treats both as anonymous, so a plugin released to\n * one organization by override refused that organization's own requests, and\n * a staff member previewing a dark plugin could not complete a redirect their\n * own session had started.\n */\nexport interface PluginApiRequestSubject {\n  /** The organization: the rollout bucket and the override key. */\n  orgId: string | null\n  /**\n   * The account the request acts for, read ONLY when the request carries no\n   * bearer token — a token speaks for itself. A route may name one only when\n   * it verified a signature binding the uid to the request, because the gate\n   * lets a staff account named here preview a released-off plugin.\n   */\n  uid?: string | null\n}\n\n/** Reads a request's subject; answers `null` when the request names none. */\nexport type PluginApiSubjectResolver = (\n  request: Request,\n) => PluginApiRequestSubject | null | Promise<PluginApiRequestSubject | null>\n\n/** What a registration may say about its route beyond the handler. */\nexport interface PluginApiRouteOptions {\n  /**\n   * How a request to this route names its subject when it names no site.\n   * Consulted by both dispatchers before their release gate, and only for a\n   * request with no `hostId`: a named site always decides the org.\n   */\n  subject?: PluginApiSubjectResolver\n  /**\n   * The route answers a link the platform MAILED to somebody — an\n   * unsubscribe in a message's `List-Unsubscribe` header — rather than a door\n   * a member uses (AGL-2981).\n   *\n   * Such a link has to keep working whether or not its plugin is released,\n   * or switched on, for the workspace NOW. A recipient's way out does not\n   * close when a rollout is paused or a workspace turns the plugin off:\n   * CAN-SPAM holds an opt-out open for thirty days after the send, and an\n   * unsubscribe that 404s the day a kill switch is flipped is one nobody can\n   * use. So both dispatchers skip their per-site enablement and release\n   * gates for it — and nothing else: lockdown and the rate limit still\n   * apply. The flag says nothing about who may act, so the route\n   * authenticates the link itself, by a signature it verifies.\n   */\n  recipientLink?: boolean\n}\n\n/** Leading/trailing slashes stripped so '/events/list' and 'events/list' key alike. */\nfunction normalizeApiPath(path: string): string {\n  return path.replace(/^\\/+|\\/+$/g, '')\n}\n\nconst apiRoutes = new Map<string, PluginApiRoute>()\nconst apiRouteOwners = new Map<string, string>()\nconst apiRouteOptions = new Map<string, PluginApiRouteOptions>()\n\n/**\n * The \"currently registering plugin\" marker moved to a leaf module\n * (`registering-plugin`) so `site-page-hooks` can read it too — this file is\n * only reachable through the `/server` entry, and importing it from the shared\n * plugin-manager barrel formed a cycle (AGL-1289). Re-exported here so the\n * plugin loader's existing import keeps working unchanged.\n */\nimport { getRegisteringPluginId } from './registering-plugin'\n\nexport {\n  setRegisteringPluginId,\n  getRegisteringPluginId,\n} from './registering-plugin'\n\n/**\n * Registers a plugin API handler at a host-relative path (e.g.\n * 'events/list'), served by the app dispatcher at `/api/events/list`.\n *\n * Idempotent by path FOR ITS OWNER — re-registration by the plugin that\n * holds the path replaces the previous handler, which is what a hot reload,\n * a second surface, and a repeated init all depend on.\n *\n * A different plugin is REFUSED (AGL-2484). This map is process-global and\n * was last-writer-wins on the path alone, while Aglyn's own commission-taking\n * handlers sit at `marketplace/checkout` and `commerce/checkout` — and the\n * tenant dispatcher calls `ensureRemoteServerBundles()` after the first-party\n * loader has run, so a remote bundle registering either path was simply the\n * later writer. Getting there needs `PLUGIN_REMOTE_SERVER=enabled` (off by\n * default), realm trust and a valid signature, so this is the last of several\n * doors rather than the only one; it is also the one the registry could close\n * by itself, because it already recorded who registered what.\n *\n * Anonymous registration — no loader marker — is an IDENTITY here, not a\n * wildcard: it may replace itself and nothing else may take it.\n */\nexport function registerPluginApiRoute(\n  path: string,\n  handler: PluginApiRoute,\n  options?: PluginApiRouteOptions,\n): void {\n  const key = normalizeApiPath(path)\n  const owner = getRegisteringPluginId() ?? ANONYMOUS_OWNER\n  const incumbent = apiRouteOwners.get(key)\n  if (incumbent !== undefined && incumbent !== owner) {\n    // Loud, because the silent version of this is a payment route quietly\n    // answering from someone else's code. Refusing is the safe direction:\n    // the incumbent keeps serving.\n    console.error(\n      `[plugins] refused API route \"${key}\" to \"${owner}\": already ` +\n        `registered by \"${incumbent}\"`,\n    )\n    return\n  }\n  apiRoutes.set(key, handler)\n  apiRouteOwners.set(key, owner)\n  // Replaced with the handler, never merged: a re-registration that drops its\n  // subject resolver must not keep answering with the previous one.\n  if (options) apiRouteOptions.set(key, options)\n  else apiRouteOptions.delete(key)\n}\n\n/** The marker for a registration made outside any loader context. */\nconst ANONYMOUS_OWNER = ''\n\n/** The plugin that registered a path, for per-org enablement gating. */\nexport function pluginIdForRegisteredApiPath(path: string): string | undefined {\n  const owner = apiRouteOwners.get(normalizeApiPath(path))\n  // An anonymous registration has no plugin to gate on, and this has always\n  // answered `undefined` for one — the sentinel must not leak out as an id.\n  return owner === undefined || owner === ANONYMOUS_OWNER ? undefined : owner\n}\n\nexport function unregisterPluginApiRoute(path: string): void {\n  const key = normalizeApiPath(path)\n  apiRoutes.delete(key)\n  // Release the CLAIM too, or the refusal above outlives the route and the\n  // path can never be re-registered for the life of the process.\n  apiRouteOwners.delete(key)\n  apiRouteOptions.delete(key)\n}\n\n/**\n * The registered key a request path resolves to, with its `:name` segments.\n *\n * An exact registration wins; otherwise a registration whose path carries\n * `:name` segments matches segment for segment. One matcher for the route and\n * for its options, so a request can never be answered by one registration and\n * gated with another's subject.\n */\nfunction matchRegisteredApiKey(\n  path: string,\n): { key: string; params: Record<string, string> } | undefined {\n  const key = normalizeApiPath(path)\n  if (apiRoutes.has(key)) return { key, params: {} }\n  const segments = key.split('/')\n  for (const registered of apiRoutes.keys()) {\n    if (!registered.includes(':')) continue\n    const pattern = registered.split('/')\n    if (pattern.length !== segments.length) continue\n    const params: Record<string, string> = {}\n    let matched = true\n    for (let index = 0; index < pattern.length; index += 1) {\n      const part = pattern[index]\n      if (part.startsWith(':') && segments[index]) {\n        params[part.slice(1)] = segments[index]\n      } else if (part !== segments[index]) {\n        matched = false\n        break\n      }\n    }\n    if (matched) return { key: registered, params }\n  }\n  return undefined\n}\n\n/**\n * The route for a request path, or undefined when nothing is registered.\n *\n * An exact registration wins; otherwise a registration whose path carries\n * `:name` segments matches segment for segment (`ai/jobs/:jobId/cancel`\n * answers `ai/jobs/abc/cancel`), and the named segments come back as\n * `params`. Patterns are tried in registration order and a static segment\n * beats a named one only by being registered exactly.\n */\nexport function resolvePluginApiMatch(path: string): PluginApiMatch | undefined {\n  const matched = matchRegisteredApiKey(path)\n  if (!matched) return undefined\n  const route = apiRoutes.get(matched.key)\n  return route ? { route, params: matched.params } : undefined\n}\n\n/**\n * Whether a request path resolves to a route registered as a\n * {@link PluginApiRouteOptions.recipientLink} — what both dispatchers ask\n * before their enablement and release gates (AGL-2981).\n */\nexport function isPluginRecipientLinkRoute(path: string): boolean {\n  const matched = matchRegisteredApiKey(path)\n  return matched ? apiRouteOptions.get(matched.key)?.recipientLink === true : false\n}\n\n/** An id a subject may carry: a non-empty path segment, not a path. */\nconst SUBJECT_ID = /^[^/\\s]{1,128}$/\n\nconst subjectId = (value: unknown): string | null =>\n  typeof value === 'string' && SUBJECT_ID.test(value) ? value : null\n\n/**\n * The subject a request to a registered route names, or `null` (AGL-2978).\n *\n * `null` when the route declared no resolver, when the resolver answered\n * nothing, and when it THREW: a resolver that cannot read its request has\n * named no subject, and the gate then treats the request as anonymous — the\n * conservative direction. The resolver reads a clone, so the handler still\n * receives the untouched body. Ids are held to a plain path segment, so a\n * resolver cannot hand the gate a path to read overrides from.\n */\nexport async function resolvePluginApiRequestSubject(\n  path: string,\n  request: Request,\n): Promise<PluginApiRequestSubject | null> {\n  const matched = matchRegisteredApiKey(path)\n  const resolve = matched ? apiRouteOptions.get(matched.key)?.subject : undefined\n  if (!resolve) return null\n  try {\n    const subject = await resolve(request.clone())\n    if (!subject) return null\n    const orgId = subjectId(subject.orgId)\n    const uid = subjectId(subject.uid)\n    if (!orgId && !uid) return null\n    return { orgId, ...(uid ? { uid } : {}) }\n  } catch {\n    return null\n  }\n}\n\n/**\n * The legacy (node-style) handler at a request path, or undefined when\n * nothing is registered there or the route is a web handler — a web route\n * is reached through `resolvePluginApiMatch` and `runPluginApiMatch`, since\n * it takes the `Request` and the filled `:name` segments, not a `req`/`res`\n * pair.\n */\nexport function resolvePluginApiRoute(path: string): PluginApiHandler | undefined {\n  const route = resolvePluginApiMatch(path)?.route\n  return typeof route === 'function' ? route : undefined\n}\n\n/**\n * Runs a matched route against the dispatcher's request: a Web handler is\n * called as it is, and a (req, res) handler goes through the adapter the\n * caller supplies — the adapter lives on the `/server` entry, which this\n * module may not import.\n */\nexport async function runPluginApiMatch(\n  match: PluginApiMatch,\n  request: Request,\n  params: Record<string, string | string[]>,\n  runLegacy: (\n    handler: PluginApiHandler,\n    request: Request,\n    params: Record<string, string | string[]>,\n  ) => Promise<Response>,\n): Promise<Response> {\n  const merged = { ...params, ...match.params }\n  const route = match.route as { web?: PluginWebApiHandler }\n  if (typeof route === 'object' && route !== null && typeof route.web === 'function') {\n    return route.web(request, { params: merged })\n  }\n  return runLegacy(match.route as PluginApiHandler, request, merged)\n}\n\n/** Registered paths, for diagnostics. */\nexport function listPluginApiRoutes(): string[] {\n  return Array.from(apiRoutes.keys())\n}\n"],"names":["normalizeApiPath","path","replace","apiRoutes","Map","apiRouteOwners","apiRouteOptions","getRegisteringPluginId","setRegisteringPluginId","registerPluginApiRoute","handler","options","key","owner","ANONYMOUS_OWNER","incumbent","get","undefined","console","error","set","delete","pluginIdForRegisteredApiPath","unregisterPluginApiRoute","matchRegisteredApiKey","has","params","segments","split","registered","keys","includes","pattern","length","matched","index","part","startsWith","slice","resolvePluginApiMatch","route","isPluginRecipientLinkRoute","recipientLink","SUBJECT_ID","subjectId","value","test","resolvePluginApiRequestSubject","request","resolve","subject","clone","orgId","uid","resolvePluginApiRoute","runPluginApiMatch","match","runLegacy","merged","web","listPluginApiRoutes","Array","from"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;CAaC;AA8HD,qFAAqF,GACrF,SAASA,iBAAiBC,IAAY;IACpC,OAAOA,KAAKC,OAAO,CAAC,cAAc;AACpC;AAEA,MAAMC,YAAY,IAAIC;AACtB,MAAMC,iBAAiB,IAAID;AAC3B,MAAME,kBAAkB,IAAIF;AAE5B;;;;;;CAMC,GACD,SAASG,sBAAsB,QAAQ,0BAAsB;AAE7D,SACEC,sBAAsB,EACtBD,sBAAsB,QACjB,0BAAsB;AAE7B;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASE,uBACdR,IAAY,EACZS,OAAuB,EACvBC,OAA+B;QAGjBJ;IADd,MAAMK,MAAMZ,iBAAiBC;IAC7B,MAAMY,SAAQN,0BAAAA,oCAAAA,0BAA4BO;IAC1C,MAAMC,YAAYV,eAAeW,GAAG,CAACJ;IACrC,IAAIG,cAAcE,aAAaF,cAAcF,OAAO;QAClD,sEAAsE;QACtE,sEAAsE;QACtE,+BAA+B;QAC/BK,QAAQC,KAAK,CACX,CAAC,6BAA6B,EAAEP,IAAI,MAAM,EAAEC,MAAM,WAAW,CAAC,GAC5D,CAAC,eAAe,EAAEE,UAAU,CAAC,CAAC;QAElC;IACF;IACAZ,UAAUiB,GAAG,CAACR,KAAKF;IACnBL,eAAee,GAAG,CAACR,KAAKC;IACxB,4EAA4E;IAC5E,kEAAkE;IAClE,IAAIF,SAASL,gBAAgBc,GAAG,CAACR,KAAKD;SACjCL,gBAAgBe,MAAM,CAACT;AAC9B;AAEA,mEAAmE,GACnE,MAAME,kBAAkB;AAExB,sEAAsE,GACtE,OAAO,SAASQ,6BAA6BrB,IAAY;IACvD,MAAMY,QAAQR,eAAeW,GAAG,CAAChB,iBAAiBC;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAOY,UAAUI,aAAaJ,UAAUC,kBAAkBG,YAAYJ;AACxE;AAEA,OAAO,SAASU,yBAAyBtB,IAAY;IACnD,MAAMW,MAAMZ,iBAAiBC;IAC7BE,UAAUkB,MAAM,CAACT;IACjB,yEAAyE;IACzE,+DAA+D;IAC/DP,eAAegB,MAAM,CAACT;IACtBN,gBAAgBe,MAAM,CAACT;AACzB;AAEA;;;;;;;CAOC,GACD,SAASY,sBACPvB,IAAY;IAEZ,MAAMW,MAAMZ,iBAAiBC;IAC7B,IAAIE,UAAUsB,GAAG,CAACb,MAAM,OAAO;QAAEA;QAAKc,QAAQ,CAAC;IAAE;IACjD,MAAMC,WAAWf,IAAIgB,KAAK,CAAC;IAC3B,KAAK,MAAMC,cAAc1B,UAAU2B,IAAI,GAAI;QACzC,IAAI,CAACD,WAAWE,QAAQ,CAAC,MAAM;QAC/B,MAAMC,UAAUH,WAAWD,KAAK,CAAC;QACjC,IAAII,QAAQC,MAAM,KAAKN,SAASM,MAAM,EAAE;QACxC,MAAMP,SAAiC,CAAC;QACxC,IAAIQ,UAAU;QACd,IAAK,IAAIC,QAAQ,GAAGA,QAAQH,QAAQC,MAAM,EAAEE,SAAS,EAAG;YACtD,MAAMC,OAAOJ,OAAO,CAACG,MAAM;YAC3B,IAAIC,KAAKC,UAAU,CAAC,QAAQV,QAAQ,CAACQ,MAAM,EAAE;gBAC3CT,MAAM,CAACU,KAAKE,KAAK,CAAC,GAAG,GAAGX,QAAQ,CAACQ,MAAM;YACzC,OAAO,IAAIC,SAAST,QAAQ,CAACQ,MAAM,EAAE;gBACnCD,UAAU;gBACV;YACF;QACF;QACA,IAAIA,SAAS,OAAO;YAAEtB,KAAKiB;YAAYH;QAAO;IAChD;IACA,OAAOT;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASsB,sBAAsBtC,IAAY;IAChD,MAAMiC,UAAUV,sBAAsBvB;IACtC,IAAI,CAACiC,SAAS,OAAOjB;IACrB,MAAMuB,QAAQrC,UAAUa,GAAG,CAACkB,QAAQtB,GAAG;IACvC,OAAO4B,QAAQ;QAAEA;QAAOd,QAAQQ,QAAQR,MAAM;IAAC,IAAIT;AACrD;AAEA;;;;CAIC,GACD,OAAO,SAASwB,2BAA2BxC,IAAY;QAEpCK;IADjB,MAAM4B,UAAUV,sBAAsBvB;IACtC,OAAOiC,UAAU5B,EAAAA,uBAAAA,gBAAgBU,GAAG,CAACkB,QAAQtB,GAAG,sBAA/BN,qBAAkCoC,aAAa,MAAK,OAAO;AAC9E;AAEA,qEAAqE,GACrE,MAAMC,aAAa;AAEnB,MAAMC,YAAY,CAACC,QACjB,OAAOA,UAAU,YAAYF,WAAWG,IAAI,CAACD,SAASA,QAAQ;AAEhE;;;;;;;;;CASC,GACD,OAAO,eAAeE,+BACpB9C,IAAY,EACZ+C,OAAgB;QAGU1C;IAD1B,MAAM4B,UAAUV,sBAAsBvB;IACtC,MAAMgD,UAAUf,WAAU5B,uBAAAA,gBAAgBU,GAAG,CAACkB,QAAQtB,GAAG,sBAA/BN,qBAAkC4C,OAAO,GAAGjC;IACtE,IAAI,CAACgC,SAAS,OAAO;IACrB,IAAI;QACF,MAAMC,UAAU,MAAMD,QAAQD,QAAQG,KAAK;QAC3C,IAAI,CAACD,SAAS,OAAO;QACrB,MAAME,QAAQR,UAAUM,QAAQE,KAAK;QACrC,MAAMC,MAAMT,UAAUM,QAAQG,GAAG;QACjC,IAAI,CAACD,SAAS,CAACC,KAAK,OAAO;QAC3B,OAAO;YAAED;WAAWC,MAAM;YAAEA;QAAI,IAAI,CAAC;IACvC,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,sBAAsBrD,IAAY;QAClCsC;IAAd,MAAMC,SAAQD,yBAAAA,sBAAsBtC,0BAAtBsC,uBAA6BC,KAAK;IAChD,OAAO,OAAOA,UAAU,aAAaA,QAAQvB;AAC/C;AAEA;;;;;CAKC,GACD,OAAO,eAAesC,kBACpBC,KAAqB,EACrBR,OAAgB,EAChBtB,MAAyC,EACzC+B,SAIsB;IAEtB,MAAMC,SAAS,aAAKhC,QAAW8B,MAAM9B,MAAM;IAC3C,MAAMc,QAAQgB,MAAMhB,KAAK;IACzB,IAAI,OAAOA,UAAU,YAAYA,UAAU,QAAQ,OAAOA,MAAMmB,GAAG,KAAK,YAAY;QAClF,OAAOnB,MAAMmB,GAAG,CAACX,SAAS;YAAEtB,QAAQgC;QAAO;IAC7C;IACA,OAAOD,UAAUD,MAAMhB,KAAK,EAAsBQ,SAASU;AAC7D;AAEA,uCAAuC,GACvC,OAAO,SAASE;IACd,OAAOC,MAAMC,IAAI,CAAC3D,UAAU2B,IAAI;AAClC"}