@aglyn/aglyn 1.0.0-beta.143

package/src/lib/plugin-manager/enabled-plugins.js

@@ -0,0 +1,403 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Per-org plugin enablement (AGL-416): `org.enabledPlugins` is the
+ * switchboard that decides which plugins LOAD for a workspace — the loader
+ * (AGL-417) dynamically imports only these. It composes with (not replaces)
+ * the existing gates: a surface renders when its plugin is enabled AND its
+ * `featureFlag` entitlement resolves; marketplace/marketplace listings keep
+ * their per-host/org `installs` docs on top.
+ *
+ * The catalog's rows are declared by the plugins themselves, in
+ * `plugins.config.json`, beside the package names the loader manifests are
+ * generated from; this module holds the row's shape and the resolvers.
+ */ import { FIRST_PARTY_PLUGINS, PUBLISHED_SITE_IMPACT } from "./first-party-plugins.generated.js";
+/**
+ * Every catalog id classified, from the `publishedSiteImpact` each plugin
+ * declares on its own row. The generator refuses a row whose verdict
+ * disagrees with its `register.site`, so a site-registering bundle cannot be
+ * added without declaring its consequence.
+ */ export { PUBLISHED_SITE_IMPACT };
+/**
+ * The user-accounts capability (AGL-2486): visitor sign-in, sign-up and
+ * password recovery on a published site.
+ *
+ * It carries no loader manifest entry, and that is deliberate rather than an
+ * oversight. The member blocks and the `membership/*` API handlers already
+ * ship inside the commerce bundle, so there is no separate package to load;
+ * what this id contributes is the SWITCH — the thing the tenant route gate,
+ * the console card and the sitemap all ask. Several catalog ids already have
+ * no tenant bundle (`contacts`, `data`, `logic`), so a manifest-less entry is
+ * the existing shape, not a new one.
+ */ export const ACCOUNTS_PLUGIN_ID = 'accounts';
+/**
+ * The Forms capability's id, named in core (AGL-3029).
+ *
+ * A form's server half is core — `/api/forms/submit`, the publish-time
+ * contract check, the published page's render — and core may not import a
+ * plugin, so each asks the site's plugin set about this id rather than asking
+ * the Forms plugin anything.
+ */ export const FORMS_PLUGIN_ID = 'forms';
+/**
+ * The switchboard catalog. The core holds no row of it: each plugin declares
+ * its own in `plugins.config.json` (`catalog`, and one per `capabilities`
+ * entry), and the generator compiles them here in their declared order, so
+ * adding a plugin edits no core file.
+ *
+ * Compiled in rather than registered at runtime, because every resolver below
+ * is synchronous and runs in each bundle of both apps; a registry that one of
+ * those bundles had not filled would read as every plugin switched OFF.
+ */ export { FIRST_PARTY_PLUGINS };
+/** Ids loaded for orgs that have never touched the switchboard. */ export const DEFAULT_ENABLED_PLUGINS = FIRST_PARTY_PLUGINS.map((plugin)=>plugin.id);
+/**
+ * The id a stored plugin id means today — the seam a rename re-arms.
+ *
+ * A first-party id is written into every org's `enabledPlugins` and every
+ * site's `disabledPlugins` the moment somebody touches the switchboard, so a
+ * rename in this file alone would silently turn the plugin OFF for every
+ * workspace that had listed it under the old name — the stored id would match
+ * nothing in the catalog and fall through as a marketplace listing id. Every
+ * reader of a stored list runs it through here first, so a document written
+ * before a rename keeps meaning what it meant while the backfill runs.
+ *
+ * Nothing is aliased today. `contacts` read as `crm` from the CRM's rename
+ * (AGL-2595) until its backfill reported zero documents carrying the old id,
+ * and the alias was retired (AGL-2614) — an alias that outlives its backfill
+ * is a second name for the plugin that nothing writes and every reader must
+ * keep honoring. The next rename adds its pair here, ships a backfill over
+ * `org.enabledPlugins`, `host.disabledPlugins`, `host.enabledPlugins` and the
+ * `pluginSettings` document ids, and removes the pair the same way.
+ */ export function canonicalPluginId(pluginId) {
+    return pluginId;
+}
+/** A stored list, read through the alias seam and de-duplicated. */ function canonicalPluginIds(pluginIds) {
+    return Array.from(new Set(pluginIds.map((id)=>canonicalPluginId(String(id)))));
+}
+/** On everywhere, a site's deny-list included: the base component library. */ const ALWAYS_ON = FIRST_PARTY_PLUGINS.filter((plugin)=>plugin.alwaysOn).map((plugin)=>plugin.id);
+/**
+ * Unioned into every workspace's set whatever the org stored: {@link ALWAYS_ON}
+ * plus the ids that are on for every workspace and switchable per site.
+ */ const ALWAYS_ON_FOR_WORKSPACE = FIRST_PARTY_PLUGINS.filter((plugin)=>plugin.alwaysOn || plugin.alwaysOnForWorkspace).map((plugin)=>plugin.id);
+/**
+ * Whether the WORKSPACE switch for this plugin is locked on (AGL-3028): the
+ * base library, and every plugin that is on for every workspace and
+ * switchable only per site. The org switchboard renders these on and inert.
+ */ export function isLockedOnForWorkspace(pluginId) {
+    return ALWAYS_ON_FOR_WORKSPACE.includes(pluginId);
+}
+/**
+ * Whether the SITE switch for this plugin is locked on: the base library
+ * alone. Every other plugin a workspace runs can be switched off for one site.
+ */ export function isLockedOnForSite(pluginId) {
+    return ALWAYS_ON.includes(pluginId);
+}
+const FIRST_PARTY_IDS = new Set(FIRST_PARTY_PLUGINS.map((plugin)=>plugin.id));
+/**
+ * Ids a SITE does not get until it asks (AGL-2486). See
+ * {@link FirstPartyPlugin.defaultOffPerSite} for why this inversion exists.
+ */ export const DEFAULT_OFF_PER_SITE_PLUGIN_IDS = new Set(FIRST_PARTY_PLUGINS.filter((plugin)=>plugin.defaultOffPerSite).map((plugin)=>plugin.id));
+/** Whether a plugin id is off for a site until that site opts in. */ export function isDefaultOffPerSite(pluginId) {
+    return DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(pluginId);
+}
+/**
+ * Applies a host's `enabledPlugins` OPT-IN list (AGL-2486): subtracts every
+ * default-off id the host has not explicitly asked for.
+ *
+ * Narrow-only, like its deny-list sibling. The list can only ever REMOVE the
+ * default-off subtraction for an id the org already enables — listing an
+ * ordinary id buys nothing, and listing one the org switched off buys
+ * nothing either, because this runs against the org's resolved set.
+ */ export function applyDefaultOffOptIn(pluginIds, optedIn) {
+    if (!DEFAULT_OFF_PER_SITE_PLUGIN_IDS.size) return [
+        ...pluginIds
+    ];
+    const asked = new Set(Array.isArray(optedIn) ? canonicalPluginIds(optedIn) : []);
+    return pluginIds.filter((id)=>!DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(id) || asked.has(id));
+}
+/**
+ * Whether an `enabledPlugins` id is a first-party BUNDLE (vs a marketplace
+ * listing id) — AGL-777. `enabledPlugins` is a flat mix of the two: bundle
+ * ids are the short, stable names in {@link FIRST_PARTY_PLUGINS}; marketplace
+ * installs ride the same field under their Firestore listing doc id. This is
+ * the single classifier both writers and readers use so the two kinds never
+ * get confused — e.g. an install sync must never add/remove a bundle id.
+ */ export function isFirstPartyPlugin(pluginId) {
+    return FIRST_PARTY_IDS.has(pluginId);
+}
+/**
+ * Splits a mixed `enabledPlugins` array into first-party bundle ids and
+ * marketplace listing ids (AGL-777). The field stays a single flat list;
+ * this just names the two kinds for callers that need to treat them apart.
+ */ export function classifyEnabledPlugins(pluginIds) {
+    const bundles = [];
+    const listings = [];
+    for (const id of pluginIds){
+        if (isFirstPartyPlugin(id)) bundles.push(id);
+        else listings.push(id);
+    }
+    return {
+        bundles,
+        listings
+    };
+}
+/**
+ * The org's effective enabled-plugin set. Absent field → every first-party
+ * plugin (existing orgs keep working untouched); always-on ids — and the ids
+ * that are on for every workspace and switchable only per site — are unioned
+ * in, so no stored list can switch them off for a workspace, including one
+ * saved before the plugin existed. Unknown ids are kept — realm-trusted
+ * marketplace plugins (AGL-420) ride the same field.
+ */ export function resolveEnabledPlugins(org) {
+    const configured = org == null ? void 0 : org.enabledPlugins;
+    const base = Array.isArray(configured) ? canonicalPluginIds(configured) : [
+        ...DEFAULT_ENABLED_PLUGINS
+    ];
+    return Array.from(new Set([
+        ...ALWAYS_ON_FOR_WORKSPACE,
+        ...base
+    ]));
+}
+/**
+ * Subtracts a host's per-site deny-list from an enabled set (AGL-1014).
+ * Always-on ids survive — the base component library cannot be switched
+ * off per site any more than per org. A plugin that is on for every
+ * workspace (`alwaysOnForWorkspace`) does NOT survive: its site switch is
+ * the one switch it has. Order of the surviving ids is kept.
+ */ export function subtractDisabledPlugins(pluginIds, disabledPlugins) {
+    if (!Array.isArray(disabledPlugins) || !disabledPlugins.length) return [
+        ...pluginIds
+    ];
+    const disabled = new Set(canonicalPluginIds(disabledPlugins));
+    return pluginIds.filter((id)=>ALWAYS_ON.includes(id) || !disabled.has(id));
+}
+/**
+ * A HOST's effective enabled-plugin set (AGL-1014): the org's resolved set
+ * minus the host's `disabledPlugins` deny-list. This is the single source
+ * of truth for per-site enablement — console navigation, the editor,
+ * published sites, and API dispatch must all read it, or a "disabled"
+ * plugin is merely hidden, not off.
+ *
+ * Semantics are narrow-only by construction: a host stores what it turns
+ * OFF, so it can never widen beyond what the org enables, and an absent
+ * field means every org-enabled plugin runs (newly installed plugins
+ * default to enabled per site until a host admin disables them).
+ *
+ * ONE class of id reads the other way (AGL-2486): a `defaultOffPerSite`
+ * plugin is subtracted unless the host names it in `enabledPlugins`. That
+ * list un-defaults; it does not grant. Both fields are still bounded by the
+ * org's set, and an explicit deny still beats an explicit opt-in — the two
+ * are applied in that order below, so the safe reading wins whenever a
+ * hand-edited or stale doc sets both.
+ */ export function resolveHostEnabledPlugins(org, host) {
+    return subtractDisabledPlugins(applyDefaultOffOptIn(resolveEnabledPlugins(org), host == null ? void 0 : host.enabledPlugins), host == null ? void 0 : host.disabledPlugins);
+}
+/**
+ * Whether ONE plugin runs on this site — the host-aware counterpart of
+ * {@link isPluginEnabled}, and the form every route gate wants.
+ */ export function isHostPluginEnabled(org, host, pluginId) {
+    return resolveHostEnabledPlugins(org, host).includes(pluginId);
+}
+export function isPluginEnabled(org, pluginId) {
+    return resolveEnabledPlugins(org).includes(pluginId);
+}
+export function resolvePluginSiteState(org, host, pluginId) {
+    if (ALWAYS_ON.includes(pluginId)) return 'always-on';
+    if (!resolveEnabledPlugins(org).includes(pluginId)) return 'off-for-workspace';
+    if (resolveHostEnabledPlugins(org, host).includes(pluginId)) return 'runs-here';
+    // A default-off plugin this site has not named is off because nobody asked
+    // for it; naming it in the deny-list is a decision, and an explicit deny
+    // beats an opt-in, so the deny-list is checked first.
+    const denied = Array.isArray(host == null ? void 0 : host.disabledPlugins) ? host.disabledPlugins.map(String).includes(pluginId) : false;
+    return !denied && isDefaultOffPerSite(pluginId) ? 'awaiting-opt-in' : 'off-for-site';
+}
+/**
+ * The declared dependency graph, both directions, built once (AGL-2486).
+ *
+ * `requires` on the catalog is the forward edge — what a plugin cannot run
+ * without — and every consumer so far wanted the reverse one. Building both
+ * here keeps the cascade, the console's dependency card and the server-side
+ * refusal reading the SAME edges: a graph assembled a second time is a graph
+ * that can disagree with itself about which plugins are coupled, and the
+ * disagreement would show up as a warning shown on one surface and not on the
+ * one that writes.
+ *
+ * `extraRequirements` extends the catalog and cannot shrink it, exactly as it
+ * does for {@link resolveDisableCascade} — a third-party id can add edges of
+ * its own but can never declare away a first-party one.
+ */ function dependencyEdges(extraRequirements) {
+    var _plugin_requires;
+    const dependents = new Map();
+    const requires = new Map();
+    const addEdge = (dependent, required)=>{
+        const reverse = dependents.get(required);
+        if (reverse) reverse.push(dependent);
+        else dependents.set(required, [
+            dependent
+        ]);
+        const forward = requires.get(dependent);
+        if (forward) forward.push(required);
+        else requires.set(dependent, [
+            required
+        ]);
+    };
+    for (const plugin of FIRST_PARTY_PLUGINS)for (const required of (_plugin_requires = plugin.requires) != null ? _plugin_requires : [])addEdge(plugin.id, required);
+    for (const [dependent, required] of Object.entries(extraRequirements != null ? extraRequirements : {}))for (const one of required != null ? required : [])addEdge(dependent, String(one));
+    return {
+        dependents,
+        requires
+    };
+}
+/** What `pluginId` declares it cannot run without — DIRECT edges only. */ export function pluginRequirements(pluginId, extraRequirements) {
+    var _dependencyEdges_requires_get;
+    return [
+        ...(_dependencyEdges_requires_get = dependencyEdges(extraRequirements).requires.get(pluginId)) != null ? _dependencyEdges_requires_get : []
+    ];
+}
+/** What declares it cannot run without `pluginId` — DIRECT edges only. */ export function pluginDependents(pluginId, extraRequirements) {
+    var _dependencyEdges_dependents_get;
+    return [
+        ...(_dependencyEdges_dependents_get = dependencyEdges(extraRequirements).dependents.get(pluginId)) != null ? _dependencyEdges_dependents_get : []
+    ];
+}
+/**
+ * Which of `enabledIds` would be left running with a requirement switched off
+ * (AGL-2486) — the same question the cascade dialog asks, phrased so a WRITER
+ * can refuse instead of a reader warning.
+ *
+ * The dialog is a courtesy: it stands in front of the console's own switches
+ * and nothing else. A direct API call, a stale tab that posts an older set, or
+ * a second console surface that forgot to ask can still store a set where
+ * User Accounts is on and the Commerce bundle that answers its sign-in POST is
+ * not. This is what a write path calls to reject that set outright, so the
+ * boundary does not live in a dialog anyone can skip.
+ *
+ * Only DECLARED requirements are checked, with the same limit
+ * {@link PLUGIN_CASCADE_IS_DECLARED_ONLY} states: an undeclared coupling is
+ * invisible here too. A requirement naming an id outside the catalog is
+ * ignored rather than treated as unmet — a stale edge must not lock a
+ * workspace out of its own switchboard.
+ */ export function strandedDependents(enabledIds, extraRequirements) {
+    const enabled = new Set(enabledIds.map(String));
+    const known = new Set([
+        ...FIRST_PARTY_PLUGINS.map((plugin)=>plugin.id),
+        ...enabled
+    ]);
+    const { requires } = dependencyEdges(extraRequirements);
+    const stranded = [];
+    for (const pluginId of enabled){
+        var _requires_get;
+        const missing = ((_requires_get = requires.get(pluginId)) != null ? _requires_get : []).filter((required)=>known.has(required) && !enabled.has(required));
+        if (missing.length) stranded.push({
+            pluginId,
+            missing
+        });
+    }
+    return stranded;
+}
+/**
+ * Everything that must ALSO be switched off when `pluginId` is (AGL-2486) —
+ * the transitive closure over reverse `requires` edges, restricted to what is
+ * currently on.
+ *
+ * Pure and surface-agnostic: the org switchboard and the per-site card both
+ * call it with their own "currently enabled" set, so the same graph answers
+ * both, and the org's wider blast radius comes from the set it passes, not
+ * from a second implementation.
+ *
+ * `extraRequirements` is how a marketplace listing joins the graph. Third-party
+ * ids ride the same `enabledPlugins` field, so a listing whose manifest
+ * declares `requires` is cascaded exactly like a bundle. It EXTENDS the
+ * catalog graph and cannot shrink it — a listing cannot declare away a
+ * first-party edge.
+ *
+ * ⚠️ The result is only ever as complete as what has been DECLARED. A
+ * marketplace plugin that uses first-party components without saying so in its
+ * manifest will not appear here, and callers must not present the list as
+ * exhaustive. See `PLUGIN_CASCADE_IS_DECLARED_ONLY`.
+ */ export function resolveDisableCascade(pluginId, enabledIds, extraRequirements) {
+    const enabled = new Set(enabledIds.map(String));
+    const dependents = dependencyEdges(extraRequirements).dependents;
+    // Breadth-first over reverse edges. `seen` is seeded with the origin so a
+    // cycle back to it terminates and the plugin being disabled is never listed
+    // among its own dependents.
+    const seen = new Set([
+        pluginId
+    ]);
+    const cascade = [];
+    const queue = [
+        pluginId
+    ];
+    while(queue.length){
+        var _dependents_get;
+        const current = queue.shift();
+        for (const dependent of (_dependents_get = dependents.get(current)) != null ? _dependents_get : []){
+            if (seen.has(dependent)) continue;
+            seen.add(dependent);
+            // Walk THROUGH an already-off dependent — something may depend on it in
+            // turn — but do not claim it is being turned off.
+            if (enabled.has(dependent)) cascade.push(dependent);
+            queue.push(dependent);
+        }
+    }
+    return cascade;
+}
+/**
+ * Why the cascade list must never be presented as exhaustive (AGL-2486).
+ *
+ * Exported as copy rather than left to each caller to paraphrase: the whole
+ * value of the warning rests on it being honest about its own limits, and two
+ * surfaces wording that differently is how one of them ends up overclaiming.
+ *
+ * It says built-in ONLY, and that is the current truth rather than a hedge.
+ * `PluginManifest` carries no `requires` field, so a publisher cannot declare
+ * a dependency even if they want to, and `extraRequirements` above — the seam
+ * that would carry them — is supplied by nothing outside tests. An earlier
+ * draft said "a plugin that uses this one WITHOUT declaring it cannot be
+ * detected", which quietly implied declaring was possible and would have made
+ * this the exact overclaiming warning it exists to avoid. Adding the manifest
+ * field is a separate change: it needs a publish form, validation and a line
+ * on the install screen, or it is a field written by nobody and read by
+ * nothing. Update this sentence in the same change, not before.
+ */ export const PLUGIN_CASCADE_IS_DECLARED_ONLY = 'This covers built-in plugins only. A marketplace plugin has no way to ' + 'declare that it depends on another one yet, so none are listed here — ' + 'check any third-party plugins you rely on before continuing.';
+/** Reverse lookup: which first-party plugin a release flag gates, if any. */ export function pluginForReleaseFlag(flagKey) {
+    return FIRST_PARTY_PLUGINS.find((plugin)=>plugin.releaseFlag === flagKey);
+}
+/**
+ * Subtracts release-flagged-off plugins from an effective set (AGL-422).
+ * Pure — the caller supplies the verdict source (client: the activated
+ * Remote Config hook state; server: the cached admin-SDK template read),
+ * so the same policy runs identically on every surface:
+ *
+ * - unknown ids (marketplace/realm installs) and always-on ids pass;
+ * - a first-party id with a `releaseFlag` passes only when the flag is on
+ *   for the subject, or `staffBypass` is set (staff preview keeps working
+ *   while a feature is dark).
+ */ export function filterPluginsByReleaseFlags(pluginIds, isFlagOn, options) {
+    if (options == null ? void 0 : options.staffBypass) return [
+        ...pluginIds
+    ];
+    const catalog = new Map(FIRST_PARTY_PLUGINS.map((plugin)=>[
+            plugin.id,
+            plugin
+        ]));
+    return pluginIds.filter((pluginId)=>{
+        const plugin = catalog.get(pluginId);
+        if (!(plugin == null ? void 0 : plugin.releaseFlag) || plugin.alwaysOn) return true;
+        return isFlagOn(plugin.releaseFlag);
+    });
+}
+
+//# sourceMappingURL=enabled-plugins.js.map

package/src/lib/plugin-manager/enabled-plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/enabled-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-org plugin enablement (AGL-416): `org.enabledPlugins` is the\n * switchboard that decides which plugins LOAD for a workspace — the loader\n * (AGL-417) dynamically imports only these. It composes with (not replaces)\n * the existing gates: a surface renders when its plugin is enabled AND its\n * `featureFlag` entitlement resolves; marketplace/marketplace listings keep\n * their per-host/org `installs` docs on top.\n *\n * The catalog's rows are declared by the plugins themselves, in\n * `plugins.config.json`, beside the package names the loader manifests are\n * generated from; this module holds the row's shape and the resolvers.\n */\n\nimport {\n  FIRST_PARTY_PLUGINS,\n  PUBLISHED_SITE_IMPACT,\n} from './first-party-plugins.generated'\n\nexport interface FirstPartyPlugin {\n  /**\n   * Stable plugin id — persisted in `org.enabledPlugins`,\n   * `host.disabledPlugins` and `host.enabledPlugins`, and the document id\n   * under every `pluginSettings` collection.\n   *\n   * Renaming one is therefore a data change, not a code change, and it is\n   * done in two halves that must both ship: the old id is read through\n   * {@link canonicalPluginId} so every stored list still resolves, and a\n   * backfill rewrites the stored documents so the alias can be retired once\n   * it reads nothing.\n   */\n  id: string\n  /** Console-facing display name. */\n  label: string\n  /**\n   * On for every workspace AND every site, with no switch anywhere: the base\n   * component library the canvas cannot render without.\n   */\n  alwaysOn?: boolean\n  /**\n   * On for every WORKSPACE, and switchable for one SITE (AGL-3028, AGL-3029).\n   *\n   * The workspace half is what `alwaysOn` gives: the id is unioned into the\n   * org's resolved set whatever `org.enabledPlugins` stores, so a list saved\n   * before the plugin existed still runs it, and no workspace switch is\n   * offered. The site half is ordinary: the id is subtracted by a site's\n   * `disabledPlugins` deny-list like any other, so an absent host field means\n   * ON and nothing needs migrating.\n   *\n   * It exists for capabilities whose workspace-level half must never stop.\n   * AI carries the add-on, credits, allotments and overage billing, none of\n   * which belongs to a site; Forms carries the catalog and the submissions\n   * already stored. A workspace switch would take those down with the\n   * site-facing half, so the only switch is the site's.\n   */\n  alwaysOnForWorkspace?: boolean\n  /**\n   * What switching this plugin off for ONE site stops, and what it leaves\n   * running (AGL-3028, AGL-3029) — the copy the site's Admin › Plugins page\n   * states beside the switch, so the decision is made knowing both halves.\n   *\n   * `confirm` makes the site switch ask before it applies, naming what it is\n   * about to break on published pages.\n   */\n  siteOff?: {\n    /** What stops on the site, stated as the consequence. */\n    stops: string\n    /** What keeps running, because it carries no site. */\n    keeps: string\n    /** Ask before applying. */\n    confirm?: boolean\n    /**\n     * How the confirmation names the site's published pages the switch\n     * reaches (AGL-3029): the sentence above the list, and the one that\n     * stands in for an empty list when the scan read everything.\n     */\n    pages?: { heading: string; none: string }\n  }\n  /** One-line description for the org-settings toggle list. */\n  description?: string\n  /**\n   * Release flag gating this plugin platform-wide (AGL-422). A flagged-off\n   * plugin is subtracted from every workspace's effective set — console\n   * loader, published sites, and API dispatch — unless the subject is\n   * staff. Always-on plugins carry no flag.\n   */\n  releaseFlag?: string\n  /**\n   * OFF for a site until that site turns it on (AGL-2486) — the inversion of\n   * this switchboard's default, and the only field here that changes what an\n   * absent host doc means.\n   *\n   * The per-host field is a DENY-list: a site records what it switches off,\n   * which makes \"absent means on\" the default for all twelve other bundles.\n   * That is right for a capability whose worst case is an unused nav tab, and\n   * wrong for one whose worst case is a PAGE — `/signin`, `/signup`,\n   * `/recover` were served by every published site on the platform,\n   * including marketing sites whose real sign-in is somewhere else entirely.\n   * A sign-in-shaped page on a brand's own domain that is not that brand's\n   * sign-in is a credential-confusion hazard, so this one defaults closed.\n   *\n   * A site un-defaults it by listing the id in `host.enabledPlugins`. That\n   * list is scoped to default-off ids and cannot widen anything else, so the\n   * AGL-1014 invariant survives intact: a site still can never reach past\n   * what its org enables.\n   */\n  defaultOffPerSite?: boolean\n  /**\n   * Plugin ids this one cannot function without (AGL-2486) — DECLARED, never\n   * inferred.\n   *\n   * The switchboard has always let a workspace turn off a plugin another one\n   * is built on, and said nothing. `accounts` is the case that proves it: the\n   * Members blocks and every `membership/*` API handler ship inside the\n   * COMMERCE bundle, so switching Commerce off leaves a site advertising\n   * `/signin` while nothing can answer the login POST.\n   *\n   * Declared rather than derived on purpose. The couplings that matter are\n   * exactly the ones no static read can see — which bundle happens to\n   * register whose components — so a graph inferred from imports or from the\n   * registry would miss the real edges while looking authoritative. An\n   * incomplete warning that presents itself as complete is worse than none,\n   * so this list is the contract, and {@link resolveDisableCascade} is honest\n   * about covering only what is on it.\n   */\n  requires?: readonly string[]\n}\n\n/**\n * What a DISABLE does to a site that is already published (AGL-2486).\n *\n * The cascade dialog has to state a consequence, and there are two very\n * different ones. \"These blocks will no longer be offered\" is a different\n * decision from \"parts of your live pages go blank\", and one generic sentence\n * for both would be a lie in one direction or the other.\n *\n * - `elements` — the plugin registers site components. The tenant loads only\n *   the site's enabled bundles, so elements ALREADY PLACED on published pages\n *   stop rendering. Pre-existing AGL-1014 behaviour.\n * - `routes`   — the plugin registers no components, but a published site\n *   stops serving something: `accounts` gates `/signin`, `/signup`,\n *   `/recover`; `redirects` stops applying its rules; `workflows` stops\n *   answering its hooks.\n * - `console-only` — nothing a visitor can reach changes; the plugin leaves\n *   navigation and the editor.\n */\nexport type PublishedSiteImpact = 'elements' | 'routes' | 'console-only'\n\n/**\n * Every catalog id classified, from the `publishedSiteImpact` each plugin\n * declares on its own row. The generator refuses a row whose verdict\n * disagrees with its `register.site`, so a site-registering bundle cannot be\n * added without declaring its consequence.\n */\nexport { PUBLISHED_SITE_IMPACT }\n\n/**\n * The user-accounts capability (AGL-2486): visitor sign-in, sign-up and\n * password recovery on a published site.\n *\n * It carries no loader manifest entry, and that is deliberate rather than an\n * oversight. The member blocks and the `membership/*` API handlers already\n * ship inside the commerce bundle, so there is no separate package to load;\n * what this id contributes is the SWITCH — the thing the tenant route gate,\n * the console card and the sitemap all ask. Several catalog ids already have\n * no tenant bundle (`contacts`, `data`, `logic`), so a manifest-less entry is\n * the existing shape, not a new one.\n */\nexport const ACCOUNTS_PLUGIN_ID = 'accounts'\n\n/**\n * The Forms capability's id, named in core (AGL-3029).\n *\n * A form's server half is core — `/api/forms/submit`, the publish-time\n * contract check, the published page's render — and core may not import a\n * plugin, so each asks the site's plugin set about this id rather than asking\n * the Forms plugin anything.\n */\nexport const FORMS_PLUGIN_ID = 'forms'\n\n/**\n * The switchboard catalog. The core holds no row of it: each plugin declares\n * its own in `plugins.config.json` (`catalog`, and one per `capabilities`\n * entry), and the generator compiles them here in their declared order, so\n * adding a plugin edits no core file.\n *\n * Compiled in rather than registered at runtime, because every resolver below\n * is synchronous and runs in each bundle of both apps; a registry that one of\n * those bundles had not filled would read as every plugin switched OFF.\n */\nexport { FIRST_PARTY_PLUGINS }\n\n/** Ids loaded for orgs that have never touched the switchboard. */\nexport const DEFAULT_ENABLED_PLUGINS: readonly string[] =\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id)\n\n/**\n * The id a stored plugin id means today — the seam a rename re-arms.\n *\n * A first-party id is written into every org's `enabledPlugins` and every\n * site's `disabledPlugins` the moment somebody touches the switchboard, so a\n * rename in this file alone would silently turn the plugin OFF for every\n * workspace that had listed it under the old name — the stored id would match\n * nothing in the catalog and fall through as a marketplace listing id. Every\n * reader of a stored list runs it through here first, so a document written\n * before a rename keeps meaning what it meant while the backfill runs.\n *\n * Nothing is aliased today. `contacts` read as `crm` from the CRM's rename\n * (AGL-2595) until its backfill reported zero documents carrying the old id,\n * and the alias was retired (AGL-2614) — an alias that outlives its backfill\n * is a second name for the plugin that nothing writes and every reader must\n * keep honoring. The next rename adds its pair here, ships a backfill over\n * `org.enabledPlugins`, `host.disabledPlugins`, `host.enabledPlugins` and the\n * `pluginSettings` document ids, and removes the pair the same way.\n */\nexport function canonicalPluginId(pluginId: string): string {\n  return pluginId\n}\n\n/** A stored list, read through the alias seam and de-duplicated. */\nfunction canonicalPluginIds(pluginIds: readonly unknown[]): string[] {\n  return Array.from(\n    new Set(pluginIds.map((id) => canonicalPluginId(String(id)))),\n  )\n}\n\n/** On everywhere, a site's deny-list included: the base component library. */\nconst ALWAYS_ON: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn,\n).map((plugin) => plugin.id)\n\n/**\n * Unioned into every workspace's set whatever the org stored: {@link ALWAYS_ON}\n * plus the ids that are on for every workspace and switchable per site.\n */\nconst ALWAYS_ON_FOR_WORKSPACE: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn || plugin.alwaysOnForWorkspace,\n).map((plugin) => plugin.id)\n\n/**\n * Whether the WORKSPACE switch for this plugin is locked on (AGL-3028): the\n * base library, and every plugin that is on for every workspace and\n * switchable only per site. The org switchboard renders these on and inert.\n */\nexport function isLockedOnForWorkspace(pluginId: string): boolean {\n  return ALWAYS_ON_FOR_WORKSPACE.includes(pluginId)\n}\n\n/**\n * Whether the SITE switch for this plugin is locked on: the base library\n * alone. Every other plugin a workspace runs can be switched off for one site.\n */\nexport function isLockedOnForSite(pluginId: string): boolean {\n  return ALWAYS_ON.includes(pluginId)\n}\n\nconst FIRST_PARTY_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n)\n\n/**\n * Ids a SITE does not get until it asks (AGL-2486). See\n * {@link FirstPartyPlugin.defaultOffPerSite} for why this inversion exists.\n */\nexport const DEFAULT_OFF_PER_SITE_PLUGIN_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.filter((plugin) => plugin.defaultOffPerSite).map(\n    (plugin) => plugin.id,\n  ),\n)\n\n/** Whether a plugin id is off for a site until that site opts in. */\nexport function isDefaultOffPerSite(pluginId: string): boolean {\n  return DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(pluginId)\n}\n\n/**\n * Applies a host's `enabledPlugins` OPT-IN list (AGL-2486): subtracts every\n * default-off id the host has not explicitly asked for.\n *\n * Narrow-only, like its deny-list sibling. The list can only ever REMOVE the\n * default-off subtraction for an id the org already enables — listing an\n * ordinary id buys nothing, and listing one the org switched off buys\n * nothing either, because this runs against the org's resolved set.\n */\nexport function applyDefaultOffOptIn(\n  pluginIds: readonly string[],\n  optedIn?: readonly string[] | null,\n): string[] {\n  if (!DEFAULT_OFF_PER_SITE_PLUGIN_IDS.size) return [...pluginIds]\n  const asked = new Set(\n    Array.isArray(optedIn) ? canonicalPluginIds(optedIn) : [],\n  )\n  return pluginIds.filter(\n    (id) => !DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(id) || asked.has(id),\n  )\n}\n\n/**\n * Whether an `enabledPlugins` id is a first-party BUNDLE (vs a marketplace\n * listing id) — AGL-777. `enabledPlugins` is a flat mix of the two: bundle\n * ids are the short, stable names in {@link FIRST_PARTY_PLUGINS}; marketplace\n * installs ride the same field under their Firestore listing doc id. This is\n * the single classifier both writers and readers use so the two kinds never\n * get confused — e.g. an install sync must never add/remove a bundle id.\n */\nexport function isFirstPartyPlugin(pluginId: string): boolean {\n  return FIRST_PARTY_IDS.has(pluginId)\n}\n\n/**\n * Splits a mixed `enabledPlugins` array into first-party bundle ids and\n * marketplace listing ids (AGL-777). The field stays a single flat list;\n * this just names the two kinds for callers that need to treat them apart.\n */\nexport function classifyEnabledPlugins(pluginIds: readonly string[]): {\n  bundles: string[]\n  listings: string[]\n} {\n  const bundles: string[] = []\n  const listings: string[] = []\n  for (const id of pluginIds) {\n    if (isFirstPartyPlugin(id)) bundles.push(id)\n    else listings.push(id)\n  }\n  return { bundles, listings }\n}\n\n/**\n * The org's effective enabled-plugin set. Absent field → every first-party\n * plugin (existing orgs keep working untouched); always-on ids — and the ids\n * that are on for every workspace and switchable only per site — are unioned\n * in, so no stored list can switch them off for a workspace, including one\n * saved before the plugin existed. Unknown ids are kept — realm-trusted\n * marketplace plugins (AGL-420) ride the same field.\n */\nexport function resolveEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n): string[] {\n  const configured = org?.enabledPlugins\n  const base = Array.isArray(configured)\n    ? canonicalPluginIds(configured)\n    : [...DEFAULT_ENABLED_PLUGINS]\n  return Array.from(new Set([...ALWAYS_ON_FOR_WORKSPACE, ...base]))\n}\n\n/**\n * Subtracts a host's per-site deny-list from an enabled set (AGL-1014).\n * Always-on ids survive — the base component library cannot be switched\n * off per site any more than per org. A plugin that is on for every\n * workspace (`alwaysOnForWorkspace`) does NOT survive: its site switch is\n * the one switch it has. Order of the surviving ids is kept.\n */\nexport function subtractDisabledPlugins(\n  pluginIds: readonly string[],\n  disabledPlugins?: readonly string[] | null,\n): string[] {\n  if (!Array.isArray(disabledPlugins) || !disabledPlugins.length)\n    return [...pluginIds]\n  const disabled = new Set(canonicalPluginIds(disabledPlugins))\n  return pluginIds.filter(\n    (id) => ALWAYS_ON.includes(id) || !disabled.has(id),\n  )\n}\n\n/**\n * A HOST's effective enabled-plugin set (AGL-1014): the org's resolved set\n * minus the host's `disabledPlugins` deny-list. This is the single source\n * of truth for per-site enablement — console navigation, the editor,\n * published sites, and API dispatch must all read it, or a \"disabled\"\n * plugin is merely hidden, not off.\n *\n * Semantics are narrow-only by construction: a host stores what it turns\n * OFF, so it can never widen beyond what the org enables, and an absent\n * field means every org-enabled plugin runs (newly installed plugins\n * default to enabled per site until a host admin disables them).\n *\n * ONE class of id reads the other way (AGL-2486): a `defaultOffPerSite`\n * plugin is subtracted unless the host names it in `enabledPlugins`. That\n * list un-defaults; it does not grant. Both fields are still bounded by the\n * org's set, and an explicit deny still beats an explicit opt-in — the two\n * are applied in that order below, so the safe reading wins whenever a\n * hand-edited or stale doc sets both.\n */\nexport function resolveHostEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n  host?: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null,\n): string[] {\n  return subtractDisabledPlugins(\n    applyDefaultOffOptIn(resolveEnabledPlugins(org), host?.enabledPlugins),\n    host?.disabledPlugins,\n  )\n}\n\n/**\n * Whether ONE plugin runs on this site — the host-aware counterpart of\n * {@link isPluginEnabled}, and the form every route gate wants.\n */\nexport function isHostPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveHostEnabledPlugins(org, host).includes(pluginId)\n}\n\nexport function isPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveEnabledPlugins(org).includes(pluginId)\n}\n\n/**\n * Where one plugin stands ON ONE SITE (AGL-1014, AGL-2486).\n *\n * Three surfaces need this answer and they must not each derive it: the site\n * plugin page's \"Where it runs\" card, that page's dependency list — where the\n * same question is asked about a NEIGHBOR, and where the answer is the whole\n * point, because a dependency the workspace enables and this site has switched\n * off is a broken plugin behind a healthy-looking workspace page — and the\n * per-site switchboard. A second derivation is a second chance to disagree\n * with `resolveHostEnabledPlugins`, which is what actually runs.\n *\n * - `always-on`         — the base library; it cannot be switched off anywhere.\n *                         A plugin that is on for every workspace but\n *                         switchable per site is NOT this: it reads\n *                         `runs-here` or `off-for-site` like any other.\n * - `off-for-workspace` — the org has it off, so it runs on none of its sites\n *                         and this site cannot turn it on.\n * - `runs-here`         — the effective host set contains it.\n * - `awaiting-opt-in`   — a `defaultOffPerSite` plugin the org enables and\n *                         this site has not asked for. Off, but off by\n *                         DEFAULT rather than by a decision, which is a\n *                         different thing to tell an operator.\n * - `off-for-site`      — the org enables it and this site switched it off.\n */\nexport type PluginSiteState =\n  | 'always-on'\n  | 'off-for-workspace'\n  | 'runs-here'\n  | 'awaiting-opt-in'\n  | 'off-for-site'\n\nexport function resolvePluginSiteState(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): PluginSiteState {\n  if (ALWAYS_ON.includes(pluginId)) return 'always-on'\n  if (!resolveEnabledPlugins(org).includes(pluginId)) return 'off-for-workspace'\n  if (resolveHostEnabledPlugins(org, host).includes(pluginId)) return 'runs-here'\n  // A default-off plugin this site has not named is off because nobody asked\n  // for it; naming it in the deny-list is a decision, and an explicit deny\n  // beats an opt-in, so the deny-list is checked first.\n  const denied = Array.isArray(host?.disabledPlugins)\n    ? host.disabledPlugins.map(String).includes(pluginId)\n    : false\n  return !denied && isDefaultOffPerSite(pluginId)\n    ? 'awaiting-opt-in'\n    : 'off-for-site'\n}\n\n/**\n * The declared dependency graph, both directions, built once (AGL-2486).\n *\n * `requires` on the catalog is the forward edge — what a plugin cannot run\n * without — and every consumer so far wanted the reverse one. Building both\n * here keeps the cascade, the console's dependency card and the server-side\n * refusal reading the SAME edges: a graph assembled a second time is a graph\n * that can disagree with itself about which plugins are coupled, and the\n * disagreement would show up as a warning shown on one surface and not on the\n * one that writes.\n *\n * `extraRequirements` extends the catalog and cannot shrink it, exactly as it\n * does for {@link resolveDisableCascade} — a third-party id can add edges of\n * its own but can never declare away a first-party one.\n */\nfunction dependencyEdges(\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): {\n  /** Keyed by a required id; holds the ids that depend on it. */\n  dependents: Map<string, string[]>\n  /** Keyed by a dependent id; holds the ids it requires. */\n  requires: Map<string, string[]>\n} {\n  const dependents = new Map<string, string[]>()\n  const requires = new Map<string, string[]>()\n  const addEdge = (dependent: string, required: string) => {\n    const reverse = dependents.get(required)\n    if (reverse) reverse.push(dependent)\n    else dependents.set(required, [dependent])\n    const forward = requires.get(dependent)\n    if (forward) forward.push(required)\n    else requires.set(dependent, [required])\n  }\n  for (const plugin of FIRST_PARTY_PLUGINS)\n    for (const required of plugin.requires ?? []) addEdge(plugin.id, required)\n  for (const [dependent, required] of Object.entries(extraRequirements ?? {}))\n    for (const one of required ?? []) addEdge(dependent, String(one))\n  return { dependents, requires }\n}\n\n/** What `pluginId` declares it cannot run without — DIRECT edges only. */\nexport function pluginRequirements(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).requires.get(pluginId) ?? [])]\n}\n\n/** What declares it cannot run without `pluginId` — DIRECT edges only. */\nexport function pluginDependents(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).dependents.get(pluginId) ?? [])]\n}\n\n/**\n * Which of `enabledIds` would be left running with a requirement switched off\n * (AGL-2486) — the same question the cascade dialog asks, phrased so a WRITER\n * can refuse instead of a reader warning.\n *\n * The dialog is a courtesy: it stands in front of the console's own switches\n * and nothing else. A direct API call, a stale tab that posts an older set, or\n * a second console surface that forgot to ask can still store a set where\n * User Accounts is on and the Commerce bundle that answers its sign-in POST is\n * not. This is what a write path calls to reject that set outright, so the\n * boundary does not live in a dialog anyone can skip.\n *\n * Only DECLARED requirements are checked, with the same limit\n * {@link PLUGIN_CASCADE_IS_DECLARED_ONLY} states: an undeclared coupling is\n * invisible here too. A requirement naming an id outside the catalog is\n * ignored rather than treated as unmet — a stale edge must not lock a\n * workspace out of its own switchboard.\n */\nexport function strandedDependents(\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): Array<{ pluginId: string; missing: string[] }> {\n  const enabled = new Set(enabledIds.map(String))\n  const known = new Set<string>([\n    ...FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n    ...enabled,\n  ])\n  const { requires } = dependencyEdges(extraRequirements)\n  const stranded: Array<{ pluginId: string; missing: string[] }> = []\n  for (const pluginId of enabled) {\n    const missing = (requires.get(pluginId) ?? []).filter(\n      (required) => known.has(required) && !enabled.has(required),\n    )\n    if (missing.length) stranded.push({ pluginId, missing })\n  }\n  return stranded\n}\n\n/**\n * Everything that must ALSO be switched off when `pluginId` is (AGL-2486) —\n * the transitive closure over reverse `requires` edges, restricted to what is\n * currently on.\n *\n * Pure and surface-agnostic: the org switchboard and the per-site card both\n * call it with their own \"currently enabled\" set, so the same graph answers\n * both, and the org's wider blast radius comes from the set it passes, not\n * from a second implementation.\n *\n * `extraRequirements` is how a marketplace listing joins the graph. Third-party\n * ids ride the same `enabledPlugins` field, so a listing whose manifest\n * declares `requires` is cascaded exactly like a bundle. It EXTENDS the\n * catalog graph and cannot shrink it — a listing cannot declare away a\n * first-party edge.\n *\n * ⚠️ The result is only ever as complete as what has been DECLARED. A\n * marketplace plugin that uses first-party components without saying so in its\n * manifest will not appear here, and callers must not present the list as\n * exhaustive. See `PLUGIN_CASCADE_IS_DECLARED_ONLY`.\n */\nexport function resolveDisableCascade(\n  pluginId: string,\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  const enabled = new Set(enabledIds.map(String))\n  const dependents = dependencyEdges(extraRequirements).dependents\n\n  // Breadth-first over reverse edges. `seen` is seeded with the origin so a\n  // cycle back to it terminates and the plugin being disabled is never listed\n  // among its own dependents.\n  const seen = new Set<string>([pluginId])\n  const cascade: string[] = []\n  const queue: string[] = [pluginId]\n  while (queue.length) {\n    const current = queue.shift() as string\n    for (const dependent of dependents.get(current) ?? []) {\n      if (seen.has(dependent)) continue\n      seen.add(dependent)\n      // Walk THROUGH an already-off dependent — something may depend on it in\n      // turn — but do not claim it is being turned off.\n      if (enabled.has(dependent)) cascade.push(dependent)\n      queue.push(dependent)\n    }\n  }\n  return cascade\n}\n\n/**\n * Why the cascade list must never be presented as exhaustive (AGL-2486).\n *\n * Exported as copy rather than left to each caller to paraphrase: the whole\n * value of the warning rests on it being honest about its own limits, and two\n * surfaces wording that differently is how one of them ends up overclaiming.\n *\n * It says built-in ONLY, and that is the current truth rather than a hedge.\n * `PluginManifest` carries no `requires` field, so a publisher cannot declare\n * a dependency even if they want to, and `extraRequirements` above — the seam\n * that would carry them — is supplied by nothing outside tests. An earlier\n * draft said \"a plugin that uses this one WITHOUT declaring it cannot be\n * detected\", which quietly implied declaring was possible and would have made\n * this the exact overclaiming warning it exists to avoid. Adding the manifest\n * field is a separate change: it needs a publish form, validation and a line\n * on the install screen, or it is a field written by nobody and read by\n * nothing. Update this sentence in the same change, not before.\n */\nexport const PLUGIN_CASCADE_IS_DECLARED_ONLY =\n  'This covers built-in plugins only. A marketplace plugin has no way to ' +\n  'declare that it depends on another one yet, so none are listed here — ' +\n  'check any third-party plugins you rely on before continuing.'\n\n/** Reverse lookup: which first-party plugin a release flag gates, if any. */\nexport function pluginForReleaseFlag(\n  flagKey: string,\n): FirstPartyPlugin | undefined {\n  return FIRST_PARTY_PLUGINS.find((plugin) => plugin.releaseFlag === flagKey)\n}\n\n/**\n * Subtracts release-flagged-off plugins from an effective set (AGL-422).\n * Pure — the caller supplies the verdict source (client: the activated\n * Remote Config hook state; server: the cached admin-SDK template read),\n * so the same policy runs identically on every surface:\n *\n * - unknown ids (marketplace/realm installs) and always-on ids pass;\n * - a first-party id with a `releaseFlag` passes only when the flag is on\n *   for the subject, or `staffBypass` is set (staff preview keeps working\n *   while a feature is dark).\n */\nexport function filterPluginsByReleaseFlags(\n  pluginIds: readonly string[],\n  isFlagOn: (flagKey: string) => boolean,\n  options?: { staffBypass?: boolean },\n): string[] {\n  if (options?.staffBypass) return [...pluginIds]\n  const catalog = new Map(\n    FIRST_PARTY_PLUGINS.map((plugin) => [plugin.id, plugin]),\n  )\n  return pluginIds.filter((pluginId) => {\n    const plugin = catalog.get(pluginId)\n    if (!plugin?.releaseFlag || plugin.alwaysOn) return true\n    return isFlagOn(plugin.releaseFlag)\n  })\n}\n"],"names":["FIRST_PARTY_PLUGINS","PUBLISHED_SITE_IMPACT","ACCOUNTS_PLUGIN_ID","FORMS_PLUGIN_ID","DEFAULT_ENABLED_PLUGINS","map","plugin","id","canonicalPluginId","pluginId","canonicalPluginIds","pluginIds","Array","from","Set","String","ALWAYS_ON","filter","alwaysOn","ALWAYS_ON_FOR_WORKSPACE","alwaysOnForWorkspace","isLockedOnForWorkspace","includes","isLockedOnForSite","FIRST_PARTY_IDS","DEFAULT_OFF_PER_SITE_PLUGIN_IDS","defaultOffPerSite","isDefaultOffPerSite","has","applyDefaultOffOptIn","optedIn","size","asked","isArray","isFirstPartyPlugin","classifyEnabledPlugins","bundles","listings","push","resolveEnabledPlugins","org","configured","enabledPlugins","base","subtractDisabledPlugins","disabledPlugins","length","disabled","resolveHostEnabledPlugins","host","isHostPluginEnabled","isPluginEnabled","resolvePluginSiteState","denied","dependencyEdges","extraRequirements","dependents","Map","requires","addEdge","dependent","required","reverse","get","set","forward","Object","entries","one","pluginRequirements","pluginDependents","strandedDependents","enabledIds","enabled","known","stranded","missing","resolveDisableCascade","seen","cascade","queue","current","shift","add","PLUGIN_CASCADE_IS_DECLARED_ONLY","pluginForReleaseFlag","flagKey","find","releaseFlag","filterPluginsByReleaseFlags","isFlagOn","options","staffBypass","catalog"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,SACEA,mBAAmB,EACnBC,qBAAqB,QAChB,qCAAiC;AAmIxC;;;;;CAKC,GACD,SAASA,qBAAqB,GAAE;AAEhC;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,qBAAqB,WAAU;AAE5C;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,QAAO;AAEtC;;;;;;;;;CASC,GACD,SAASH,mBAAmB,GAAE;AAE9B,iEAAiE,GACjE,OAAO,MAAMI,0BACXJ,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE,EAAC;AAEhD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASC,kBAAkBC,QAAgB;IAChD,OAAOA;AACT;AAEA,kEAAkE,GAClE,SAASC,mBAAmBC,SAA6B;IACvD,OAAOC,MAAMC,IAAI,CACf,IAAIC,IAAIH,UAAUN,GAAG,CAAC,CAACE,KAAOC,kBAAkBO,OAAOR;AAE3D;AAEA,4EAA4E,GAC5E,MAAMS,YAA+BhB,oBAAoBiB,MAAM,CAC7D,CAACX,SAAWA,OAAOY,QAAQ,EAC3Bb,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;CAGC,GACD,MAAMY,0BAA6CnB,oBAAoBiB,MAAM,CAC3E,CAACX,SAAWA,OAAOY,QAAQ,IAAIZ,OAAOc,oBAAoB,EAC1Df,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;;CAIC,GACD,OAAO,SAASc,uBAAuBZ,QAAgB;IACrD,OAAOU,wBAAwBG,QAAQ,CAACb;AAC1C;AAEA;;;CAGC,GACD,OAAO,SAASc,kBAAkBd,QAAgB;IAChD,OAAOO,UAAUM,QAAQ,CAACb;AAC5B;AAEA,MAAMe,kBAAuC,IAAIV,IAC/Cd,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAG/C;;;CAGC,GACD,OAAO,MAAMkB,kCAAuD,IAAIX,IACtEd,oBAAoBiB,MAAM,CAAC,CAACX,SAAWA,OAAOoB,iBAAiB,EAAErB,GAAG,CAClE,CAACC,SAAWA,OAAOC,EAAE,GAExB;AAED,mEAAmE,GACnE,OAAO,SAASoB,oBAAoBlB,QAAgB;IAClD,OAAOgB,gCAAgCG,GAAG,CAACnB;AAC7C;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASoB,qBACdlB,SAA4B,EAC5BmB,OAAkC;IAElC,IAAI,CAACL,gCAAgCM,IAAI,EAAE,OAAO;WAAIpB;KAAU;IAChE,MAAMqB,QAAQ,IAAIlB,IAChBF,MAAMqB,OAAO,CAACH,WAAWpB,mBAAmBoB,WAAW,EAAE;IAE3D,OAAOnB,UAAUM,MAAM,CACrB,CAACV,KAAO,CAACkB,gCAAgCG,GAAG,CAACrB,OAAOyB,MAAMJ,GAAG,CAACrB;AAElE;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS2B,mBAAmBzB,QAAgB;IACjD,OAAOe,gBAAgBI,GAAG,CAACnB;AAC7B;AAEA;;;;CAIC,GACD,OAAO,SAAS0B,uBAAuBxB,SAA4B;IAIjE,MAAMyB,UAAoB,EAAE;IAC5B,MAAMC,WAAqB,EAAE;IAC7B,KAAK,MAAM9B,MAAMI,UAAW;QAC1B,IAAIuB,mBAAmB3B,KAAK6B,QAAQE,IAAI,CAAC/B;aACpC8B,SAASC,IAAI,CAAC/B;IACrB;IACA,OAAO;QAAE6B;QAASC;IAAS;AAC7B;AAEA;;;;;;;CAOC,GACD,OAAO,SAASE,sBACdC,GAA0C;IAE1C,MAAMC,aAAaD,uBAAAA,IAAKE,cAAc;IACtC,MAAMC,OAAO/B,MAAMqB,OAAO,CAACQ,cACvB/B,mBAAmB+B,cACnB;WAAIrC;KAAwB;IAChC,OAAOQ,MAAMC,IAAI,CAAC,IAAIC,IAAI;WAAIK;WAA4BwB;KAAK;AACjE;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,wBACdjC,SAA4B,EAC5BkC,eAA0C;IAE1C,IAAI,CAACjC,MAAMqB,OAAO,CAACY,oBAAoB,CAACA,gBAAgBC,MAAM,EAC5D,OAAO;WAAInC;KAAU;IACvB,MAAMoC,WAAW,IAAIjC,IAAIJ,mBAAmBmC;IAC5C,OAAOlC,UAAUM,MAAM,CACrB,CAACV,KAAOS,UAAUM,QAAQ,CAACf,OAAO,CAACwC,SAASnB,GAAG,CAACrB;AAEpD;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASyC,0BACdR,GAA0C,EAC1CS,IAAuE;IAEvE,OAAOL,wBACLf,qBAAqBU,sBAAsBC,MAAMS,wBAAAA,KAAMP,cAAc,GACrEO,wBAAAA,KAAMJ,eAAe;AAEzB;AAEA;;;CAGC,GACD,OAAO,SAASK,oBACdV,GAAqD,EACrDS,IAAkF,EAClFxC,QAAgB;IAEhB,OAAOuC,0BAA0BR,KAAKS,MAAM3B,QAAQ,CAACb;AACvD;AAEA,OAAO,SAAS0C,gBACdX,GAAqD,EACrD/B,QAAgB;IAEhB,OAAO8B,sBAAsBC,KAAKlB,QAAQ,CAACb;AAC7C;AAiCA,OAAO,SAAS2C,uBACdZ,GAAqD,EACrDS,IAAkF,EAClFxC,QAAgB;IAEhB,IAAIO,UAAUM,QAAQ,CAACb,WAAW,OAAO;IACzC,IAAI,CAAC8B,sBAAsBC,KAAKlB,QAAQ,CAACb,WAAW,OAAO;IAC3D,IAAIuC,0BAA0BR,KAAKS,MAAM3B,QAAQ,CAACb,WAAW,OAAO;IACpE,2EAA2E;IAC3E,yEAAyE;IACzE,sDAAsD;IACtD,MAAM4C,SAASzC,MAAMqB,OAAO,CAACgB,wBAAAA,KAAMJ,eAAe,IAC9CI,KAAKJ,eAAe,CAACxC,GAAG,CAACU,QAAQO,QAAQ,CAACb,YAC1C;IACJ,OAAO,CAAC4C,UAAU1B,oBAAoBlB,YAClC,oBACA;AACN;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAAS6C,gBACPC,iBAA+D;QAkBtCjD;IAXzB,MAAMkD,aAAa,IAAIC;IACvB,MAAMC,WAAW,IAAID;IACrB,MAAME,UAAU,CAACC,WAAmBC;QAClC,MAAMC,UAAUN,WAAWO,GAAG,CAACF;QAC/B,IAAIC,SAASA,QAAQxB,IAAI,CAACsB;aACrBJ,WAAWQ,GAAG,CAACH,UAAU;YAACD;SAAU;QACzC,MAAMK,UAAUP,SAASK,GAAG,CAACH;QAC7B,IAAIK,SAASA,QAAQ3B,IAAI,CAACuB;aACrBH,SAASM,GAAG,CAACJ,WAAW;YAACC;SAAS;IACzC;IACA,KAAK,MAAMvD,UAAUN,oBACnB,KAAK,MAAM6D,aAAYvD,mBAAAA,OAAOoD,QAAQ,YAAfpD,mBAAmB,EAAE,CAAEqD,QAAQrD,OAAOC,EAAE,EAAEsD;IACnE,KAAK,MAAM,CAACD,WAAWC,SAAS,IAAIK,OAAOC,OAAO,CAACZ,4BAAAA,oBAAqB,CAAC,GACvE,KAAK,MAAMa,OAAOP,mBAAAA,WAAY,EAAE,CAAEF,QAAQC,WAAW7C,OAAOqD;IAC9D,OAAO;QAAEZ;QAAYE;IAAS;AAChC;AAEA,wEAAwE,GACxE,OAAO,SAASW,mBACd5D,QAAgB,EAChB8C,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,gCAAAA,gBAAgBC,mBAAmBG,QAAQ,CAACK,GAAG,CAACtD,qBAAhD6C,gCAA6D,EAAE;KAAE;AAC/E;AAEA,wEAAwE,GACxE,OAAO,SAASgB,iBACd7D,QAAgB,EAChB8C,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,kCAAAA,gBAAgBC,mBAAmBC,UAAU,CAACO,GAAG,CAACtD,qBAAlD6C,kCAA+D,EAAE;KAAE;AACjF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASiB,mBACdC,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMkB,UAAU,IAAI3D,IAAI0D,WAAWnE,GAAG,CAACU;IACvC,MAAM2D,QAAQ,IAAI5D,IAAY;WACzBd,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;WAC7CkE;KACJ;IACD,MAAM,EAAEf,QAAQ,EAAE,GAAGJ,gBAAgBC;IACrC,MAAMoB,WAA2D,EAAE;IACnE,KAAK,MAAMlE,YAAYgE,QAAS;YACbf;QAAjB,MAAMkB,UAAU,EAAClB,gBAAAA,SAASK,GAAG,CAACtD,qBAAbiD,gBAA0B,EAAE,EAAEzC,MAAM,CACnD,CAAC4C,WAAaa,MAAM9C,GAAG,CAACiC,aAAa,CAACY,QAAQ7C,GAAG,CAACiC;QAEpD,IAAIe,QAAQ9B,MAAM,EAAE6B,SAASrC,IAAI,CAAC;YAAE7B;YAAUmE;QAAQ;IACxD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASE,sBACdpE,QAAgB,EAChB+D,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMkB,UAAU,IAAI3D,IAAI0D,WAAWnE,GAAG,CAACU;IACvC,MAAMyC,aAAaF,gBAAgBC,mBAAmBC,UAAU;IAEhE,0EAA0E;IAC1E,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAMsB,OAAO,IAAIhE,IAAY;QAACL;KAAS;IACvC,MAAMsE,UAAoB,EAAE;IAC5B,MAAMC,QAAkB;QAACvE;KAAS;IAClC,MAAOuE,MAAMlC,MAAM,CAAE;YAEKU;QADxB,MAAMyB,UAAUD,MAAME,KAAK;QAC3B,KAAK,MAAMtB,cAAaJ,kBAAAA,WAAWO,GAAG,CAACkB,oBAAfzB,kBAA2B,EAAE,CAAE;YACrD,IAAIsB,KAAKlD,GAAG,CAACgC,YAAY;YACzBkB,KAAKK,GAAG,CAACvB;YACT,wEAAwE;YACxE,kDAAkD;YAClD,IAAIa,QAAQ7C,GAAG,CAACgC,YAAYmB,QAAQzC,IAAI,CAACsB;YACzCoB,MAAM1C,IAAI,CAACsB;QACb;IACF;IACA,OAAOmB;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMK,kCACX,2EACA,2EACA,+DAA8D;AAEhE,2EAA2E,GAC3E,OAAO,SAASC,qBACdC,OAAe;IAEf,OAAOtF,oBAAoBuF,IAAI,CAAC,CAACjF,SAAWA,OAAOkF,WAAW,KAAKF;AACrE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,4BACd9E,SAA4B,EAC5B+E,QAAsC,EACtCC,OAAmC;IAEnC,IAAIA,2BAAAA,QAASC,WAAW,EAAE,OAAO;WAAIjF;KAAU;IAC/C,MAAMkF,UAAU,IAAIpC,IAClBzD,oBAAoBK,GAAG,CAAC,CAACC,SAAW;YAACA,OAAOC,EAAE;YAAED;SAAO;IAEzD,OAAOK,UAAUM,MAAM,CAAC,CAACR;QACvB,MAAMH,SAASuF,QAAQ9B,GAAG,CAACtD;QAC3B,IAAI,EAACH,0BAAAA,OAAQkF,WAAW,KAAIlF,OAAOY,QAAQ,EAAE,OAAO;QACpD,OAAOwE,SAASpF,OAAOkF,WAAW;IACpC;AACF"}