@aglyn/aglyn 1.0.0-beta.143

package/src/lib/plugin-manager/plugin-services.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-services.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Typed plugin service registry (AGL-2940).\n *\n * A plugin that wants OTHER plugins to extend it — a provider behind a\n * contract, a tool a generator can call, a generator kind — declares a\n * contract token here, and any plugin (first-party or marketplace) registers\n * an implementation against the token. The declaring plugin resolves the\n * implementations when it needs them and never imports the plugin that\n * supplied one, so the dependency runs only from an adopter to a contract.\n *\n * `registerBillingWebhookHandler` and `registerSiteRuntime` are the\n * precedent: one registry per extension seam, filled at registration time,\n * read lazily. What those cannot do is carry a TYPE for the thing registered\n * beyond their one shape, and each new seam meant a new module in core. A\n * contract token carries the implementation type with it, so a seam another\n * plugin invents needs no core edit at all.\n *\n * Attribution follows every other registry: the owner is the plugin whose\n * register fn is running (`setRegisteringPluginId`), or the `pluginId` the\n * caller names for a registration made at module scope, where the loader's\n * marker is not yet set. An implementation with no owner is refused —\n * ownership is what lets a duplicate single-service registration name both\n * claimants rather than silently taking the later one.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\n\n/**\n * A contract token. `T` is the implementation type and is carried at the\n * type level only; `__type` never holds a value.\n */\nexport interface PluginServiceContract<T> {\n  readonly id: string\n  /**\n   * Whether more than one plugin may register against the contract. A\n   * single-implementation contract (`false`) is a slot — an AI provider\n   * routing table, a payment processor — where a second registration from a\n   * different plugin is a conflict, not a list. A multiple contract is a set\n   * every implementation joins.\n   */\n  readonly multiple: boolean\n  readonly __type?: T\n}\n\nexport interface PluginServiceRegistration<T> {\n  contractId: string\n  pluginId: string\n  /**\n   * Which of a plugin's implementations this is, on a multiple contract\n   * where one plugin registers several (two provider adapters from one\n   * plugin). Absent when the plugin registers one.\n   */\n  key?: string\n  impl: T\n  /** Higher resolves first among several implementations; default 0. */\n  priority: number\n}\n\nconst contracts = new Map<string, PluginServiceContract<unknown>>()\nconst registrations = new Map<string, PluginServiceRegistration<unknown>[]>()\n\n/**\n * Declares a contract. Idempotent by id for the same `multiple` setting, so\n * a hot reload or a second surface re-evaluating the declaring module gets\n * the token back; declaring the same id with a DIFFERENT setting is a\n * programming error and throws, because two plugins would then disagree\n * about whether the seam is a slot or a set.\n */\nexport function definePluginServiceContract<T>(\n  id: string,\n  options: { multiple: boolean },\n): PluginServiceContract<T> {\n  const key = id.trim()\n  if (!key) throw new Error('a plugin service contract needs an id')\n  const existing = contracts.get(key)\n  if (existing) {\n    if (existing.multiple !== options.multiple) {\n      throw new Error(\n        `plugin service contract \"${key}\" is already defined with ` +\n          `multiple=${existing.multiple}; cannot redefine it with ` +\n          `multiple=${options.multiple}`,\n      )\n    }\n    return existing as PluginServiceContract<T>\n  }\n  const contract: PluginServiceContract<T> = { id: key, multiple: options.multiple }\n  contracts.set(key, contract)\n  return contract\n}\n\nfunction requireContract<T>(contract: PluginServiceContract<T>): PluginServiceContract<T> {\n  const known = contracts.get(contract.id)\n  if (!known) {\n    throw new Error(\n      `plugin service contract \"${contract.id}\" is not defined; call ` +\n        'definePluginServiceContract before registering against it',\n    )\n  }\n  return known as PluginServiceContract<T>\n}\n\n/**\n * Registers an implementation. The owner is the loader's marker when a\n * register fn is running, else `options.pluginId`; a registration with\n * neither throws.\n *\n * Re-registration by the SAME plugin under the same `key` replaces its\n * previous entry (hot reload, a second surface, a repeated init); a plugin\n * registering several implementations on a multiple contract tells them\n * apart with `key`. On a single-implementation contract a registration\n * from a DIFFERENT plugin throws naming both, and the incumbent keeps\n * serving.\n */\nexport function registerPluginService<T>(\n  contract: PluginServiceContract<T>,\n  impl: T,\n  options?: { pluginId?: string; priority?: number; key?: string },\n): void {\n  const known = requireContract(contract)\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      `plugin service \"${known.id}\" registered with no owner: pass ` +\n        '{ pluginId } when registering outside a plugin register fn',\n    )\n  }\n  const key = options?.key?.trim() || undefined\n  const list = registrations.get(known.id) ?? []\n  const foreign = list.find((entry) => entry.pluginId !== pluginId)\n  if (!known.multiple && foreign) {\n    throw new Error(\n      `plugin service \"${known.id}\" is a single-implementation contract ` +\n        `already registered by \"${foreign.pluginId}\"; refused \"${pluginId}\"`,\n    )\n  }\n  const kept = list.filter(\n    (entry) => !(entry.pluginId === pluginId && (entry.key ?? null) === (key ?? null)),\n  )\n  kept.push({\n    contractId: known.id,\n    pluginId,\n    ...(key ? { key } : {}),\n    impl,\n    priority: options?.priority ?? 0,\n  })\n  registrations.set(known.id, kept)\n}\n\n/**\n * Every implementation of a contract, highest priority first and\n * registration order within a priority. Empty when nothing registered.\n */\nexport function resolvePluginServices<T>(\n  contract: PluginServiceContract<T>,\n): PluginServiceRegistration<T>[] {\n  const known = requireContract(contract)\n  const list = (registrations.get(known.id) ?? []) as PluginServiceRegistration<T>[]\n  return [...list].sort((a, b) => b.priority - a.priority)\n}\n\n/**\n * The one implementation of a single contract — or, on a multiple\n * contract, the highest-priority one — or `undefined`.\n */\nexport function resolvePluginService<T>(\n  contract: PluginServiceContract<T>,\n): T | undefined {\n  return resolvePluginServices(contract)[0]?.impl\n}\n\n/** Whether any plugin has registered against the contract. */\nexport function hasPluginService<T>(contract: PluginServiceContract<T>): boolean {\n  return (registrations.get(requireContract(contract).id) ?? []).length > 0\n}\n\n/** Every declared contract id, for diagnostics. */\nexport function listPluginServiceContracts(): string[] {\n  return [...contracts.keys()]\n}\n\n/**\n * Drops a plugin's registrations across every contract — what the loader's\n * reverse (a bundle unloading) would call, and what a spec calls to give\n * one fake plugin back its slot.\n */\nexport function unregisterPluginServices(pluginId: string): void {\n  for (const [id, list] of registrations) {\n    registrations.set(\n      id,\n      list.filter((entry) => entry.pluginId !== pluginId),\n    )\n  }\n}\n\n/** Test seam: forget every registration; contracts stay defined. */\nexport function resetPluginServicesForTests(): void {\n  registrations.clear()\n}\n"],"names":["getRegisteringPluginId","contracts","Map","registrations","definePluginServiceContract","id","options","key","trim","Error","existing","get","multiple","contract","set","requireContract","known","registerPluginService","impl","pluginId","undefined","list","foreign","find","entry","kept","filter","push","contractId","priority","resolvePluginServices","sort","a","b","resolvePluginService","hasPluginService","length","listPluginServiceContracts","keys","unregisterPluginServices","resetPluginServicesForTests","clear"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GAED,SAASA,sBAAsB,QAAQ,qCAAiC;AAiCxE,MAAMC,YAAY,IAAIC;AACtB,MAAMC,gBAAgB,IAAID;AAE1B;;;;;;CAMC,GACD,OAAO,SAASE,4BACdC,EAAU,EACVC,OAA8B;IAE9B,MAAMC,MAAMF,GAAGG,IAAI;IACnB,IAAI,CAACD,KAAK,MAAM,IAAIE,MAAM;IAC1B,MAAMC,WAAWT,UAAUU,GAAG,CAACJ;IAC/B,IAAIG,UAAU;QACZ,IAAIA,SAASE,QAAQ,KAAKN,QAAQM,QAAQ,EAAE;YAC1C,MAAM,IAAIH,MACR,CAAC,yBAAyB,EAAEF,IAAI,0BAA0B,CAAC,GACzD,CAAC,SAAS,EAAEG,SAASE,QAAQ,CAAC,0BAA0B,CAAC,GACzD,CAAC,SAAS,EAAEN,QAAQM,QAAQ,EAAE;QAEpC;QACA,OAAOF;IACT;IACA,MAAMG,WAAqC;QAAER,IAAIE;QAAKK,UAAUN,QAAQM,QAAQ;IAAC;IACjFX,UAAUa,GAAG,CAACP,KAAKM;IACnB,OAAOA;AACT;AAEA,SAASE,gBAAmBF,QAAkC;IAC5D,MAAMG,QAAQf,UAAUU,GAAG,CAACE,SAASR,EAAE;IACvC,IAAI,CAACW,OAAO;QACV,MAAM,IAAIP,MACR,CAAC,yBAAyB,EAAEI,SAASR,EAAE,CAAC,uBAAuB,CAAC,GAC9D;IAEN;IACA,OAAOW;AACT;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,sBACdJ,QAAkC,EAClCK,IAAO,EACPZ,OAAgE;QAG9CN,MAAAA,yBAQLG;QADDG;IARZ,MAAMU,QAAQD,gBAAgBF;IAC9B,MAAMM,WAAW,EAACnB,QAAAA,0BAAAA,oCAAAA,0BAA4BM,2BAAAA,QAASa,QAAQ,YAA7CnB,OAAiD,IAAIQ,IAAI;IAC3E,IAAI,CAACW,UAAU;QACb,MAAM,IAAIV,MACR,CAAC,gBAAgB,EAAEO,MAAMX,EAAE,CAAC,iCAAiC,CAAC,GAC5D;IAEN;IACA,MAAME,MAAMD,CAAAA,4BAAAA,eAAAA,QAASC,GAAG,qBAAZD,aAAcE,IAAI,OAAMY;IACpC,MAAMC,QAAOlB,qBAAAA,cAAcQ,GAAG,CAACK,MAAMX,EAAE,aAA1BF,qBAA+B,EAAE;IAC9C,MAAMmB,UAAUD,KAAKE,IAAI,CAAC,CAACC,QAAUA,MAAML,QAAQ,KAAKA;IACxD,IAAI,CAACH,MAAMJ,QAAQ,IAAIU,SAAS;QAC9B,MAAM,IAAIb,MACR,CAAC,gBAAgB,EAAEO,MAAMX,EAAE,CAAC,sCAAsC,CAAC,GACjE,CAAC,uBAAuB,EAAEiB,QAAQH,QAAQ,CAAC,YAAY,EAAEA,SAAS,CAAC,CAAC;IAE1E;IACA,MAAMM,OAAOJ,KAAKK,MAAM,CACtB,CAACF;YAA4CA;eAAlC,CAAEA,CAAAA,MAAML,QAAQ,KAAKA,YAAY,EAACK,aAAAA,MAAMjB,GAAG,YAATiB,aAAa,WAAWjB,cAAAA,MAAO,KAAI;;IAElFkB,KAAKE,IAAI,CAAC;QACRC,YAAYZ,MAAMX,EAAE;QACpBc;OACIZ,MAAM;QAAEA;IAAI,IAAI,CAAC;QACrBW;QACAW,QAAQ,WAAEvB,2BAAAA,QAASuB,QAAQ,oBAAI;;IAEjC1B,cAAcW,GAAG,CAACE,MAAMX,EAAE,EAAEoB;AAC9B;AAEA;;;CAGC,GACD,OAAO,SAASK,sBACdjB,QAAkC;QAGpBV;IADd,MAAMa,QAAQD,gBAAgBF;IAC9B,MAAMQ,QAAQlB,qBAAAA,cAAcQ,GAAG,CAACK,MAAMX,EAAE,aAA1BF,qBAA+B,EAAE;IAC/C,OAAO;WAAIkB;KAAK,CAACU,IAAI,CAAC,CAACC,GAAGC,IAAMA,EAAEJ,QAAQ,GAAGG,EAAEH,QAAQ;AACzD;AAEA;;;CAGC,GACD,OAAO,SAASK,qBACdrB,QAAkC;QAE3BiB;IAAP,QAAOA,0BAAAA,sBAAsBjB,SAAS,CAAC,EAAE,qBAAlCiB,wBAAoCZ,IAAI;AACjD;AAEA,4DAA4D,GAC5D,OAAO,SAASiB,iBAAoBtB,QAAkC;QAC5DV;IAAR,OAAO,EAACA,qBAAAA,cAAcQ,GAAG,CAACI,gBAAgBF,UAAUR,EAAE,aAA9CF,qBAAmD,EAAE,EAAEiC,MAAM,GAAG;AAC1E;AAEA,iDAAiD,GACjD,OAAO,SAASC;IACd,OAAO;WAAIpC,UAAUqC,IAAI;KAAG;AAC9B;AAEA;;;;CAIC,GACD,OAAO,SAASC,yBAAyBpB,QAAgB;IACvD,KAAK,MAAM,CAACd,IAAIgB,KAAK,IAAIlB,cAAe;QACtCA,cAAcW,GAAG,CACfT,IACAgB,KAAKK,MAAM,CAAC,CAACF,QAAUA,MAAML,QAAQ,KAAKA;IAE9C;AACF;AAEA,kEAAkE,GAClE,OAAO,SAASqB;IACdrC,cAAcsC,KAAK;AACrB"}

package/src/lib/plugin-manager/plugin-styles-ui.d.ts

@@ -0,0 +1,71 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The React half of the plugin stylesheet route (AGL-2486). Its registry twin
+ * is `plugin-styles.ts`.
+ *
+ * ## Why this is a separate file, and NOT on the `@aglyn/aglyn` barrel
+ *
+ * It was one file to begin with, and that took the dev server to a 500 on
+ * every route. `plugin-manager/index.ts` is re-exported by `lib/aglyn.ts`,
+ * which `src/server.ts` re-exports in turn — so anything in the plugin-manager
+ * barrel is reachable from a SERVER route, and a module calling a client-only
+ * React hook (`useSyncExternalStore`) is not. Same family as the recorded
+ * `plugin-manager` → `app-utils/api-plugins` cycle: the barrel is the hazard,
+ * and the fix is to keep the shared state in a leaf both sides can import and
+ * leave the client-only piece off the barrel entirely.
+ *
+ * So: the REGISTRY (`registerPluginStyles`, `capturePluginStyles`, the store)
+ * is plain TypeScript with no React import and stays on the barrel, because
+ * `realm-plugins.ts` — which is isomorphic — has to call the capture. This
+ * component is deep-imported instead:
+ *
+ *     import { PluginStyles } from '@aglyn/aglyn/plugin-manager/plugin-styles-ui'
+ *
+ * exactly as `app-utils/consent-banner-ui` already is. Do not add it to
+ * `plugin-manager/index.ts`; that is the change that breaks every route.
+ *
+ * If a route starts 500ing right after you touch this, RESTART the dev server
+ * before doubting the edit — Turbopack serves the stale server chunk and
+ * neither an edit nor a hard reload clears it.
+ *
+ * No `'use client'` directive: inside @aglyn/aglyn the directive splits the
+ * bundler into a duplicate module graph and the second canvas singleton
+ * renders the tenant blank (AGL-52). Every importer is itself a client module.
+ */
+import { type ReactElement } from 'react';
+import { type PluginStylesScope } from './plugin-styles';
+/**
+ * Renders every plugin stylesheet that belongs on this surface, as plain
+ * `<style>` children — so they land wherever the tree lands: the document on
+ * the published tenant and in Preview, inside the closed shadow root on the
+ * besigner canvas.
+ *
+ * Unlayered by construction, which is the whole point: that is the slot a
+ * plugin's CSS occupies on the published page, and reproducing the SLOT is
+ * what makes the editor agree with the published page about which rule wins.
+ * Do not route this through an emotion cache — the layered cache would put
+ * plugin CSS inside `@layer mui`, where it would start LOSING to component
+ * defaults it currently beats.
+ *
+ * Subscribed rather than read once: realm bundles load asynchronously (post
+ * hydration on the tenant, alongside the console shell in the editor), so the
+ * canvas is routinely mounted before any plugin has registered anything.
+ */
+export declare function PluginStyles(props?: {
+    scope?: PluginStylesScope;
+}): ReactElement;

package/src/lib/plugin-manager/plugin-styles-ui.js

@@ -0,0 +1,80 @@
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The React half of the plugin stylesheet route (AGL-2486). Its registry twin
+ * is `plugin-styles.ts`.
+ *
+ * ## Why this is a separate file, and NOT on the `@aglyn/aglyn` barrel
+ *
+ * It was one file to begin with, and that took the dev server to a 500 on
+ * every route. `plugin-manager/index.ts` is re-exported by `lib/aglyn.ts`,
+ * which `src/server.ts` re-exports in turn — so anything in the plugin-manager
+ * barrel is reachable from a SERVER route, and a module calling a client-only
+ * React hook (`useSyncExternalStore`) is not. Same family as the recorded
+ * `plugin-manager` → `app-utils/api-plugins` cycle: the barrel is the hazard,
+ * and the fix is to keep the shared state in a leaf both sides can import and
+ * leave the client-only piece off the barrel entirely.
+ *
+ * So: the REGISTRY (`registerPluginStyles`, `capturePluginStyles`, the store)
+ * is plain TypeScript with no React import and stays on the barrel, because
+ * `realm-plugins.ts` — which is isomorphic — has to call the capture. This
+ * component is deep-imported instead:
+ *
+ *     import { PluginStyles } from '@aglyn/aglyn/plugin-manager/plugin-styles-ui'
+ *
+ * exactly as `app-utils/consent-banner-ui` already is. Do not add it to
+ * `plugin-manager/index.ts`; that is the change that breaks every route.
+ *
+ * If a route starts 500ing right after you touch this, RESTART the dev server
+ * before doubting the edit — Turbopack serves the stale server chunk and
+ * neither an edit nor a hard reload clears it.
+ *
+ * No `'use client'` directive: inside @aglyn/aglyn the directive splits the
+ * bundler into a duplicate module graph and the second canvas singleton
+ * renders the tenant blank (AGL-52). Every importer is itself a client module.
+ */ import { useSyncExternalStore } from "react";
+import { listPluginStyles, subscribeToPluginStyles } from "./plugin-styles.js";
+/**
+ * Renders every plugin stylesheet that belongs on this surface, as plain
+ * `<style>` children — so they land wherever the tree lands: the document on
+ * the published tenant and in Preview, inside the closed shadow root on the
+ * besigner canvas.
+ *
+ * Unlayered by construction, which is the whole point: that is the slot a
+ * plugin's CSS occupies on the published page, and reproducing the SLOT is
+ * what makes the editor agree with the published page about which rule wins.
+ * Do not route this through an emotion cache — the layered cache would put
+ * plugin CSS inside `@layer mui`, where it would start LOSING to component
+ * defaults it currently beats.
+ *
+ * Subscribed rather than read once: realm bundles load asynchronously (post
+ * hydration on the tenant, alongside the console shell in the editor), so the
+ * canvas is routinely mounted before any plugin has registered anything.
+ */ export function PluginStyles(props) {
+    var _ref;
+    const scope = (_ref = props == null ? void 0 : props.scope) != null ? _ref : 'document';
+    const all = useSyncExternalStore(subscribeToPluginStyles, listPluginStyles, listPluginStyles);
+    const visible = all.filter((sheet)=>scope === 'shadow' || !sheet.mirrored);
+    return /*#__PURE__*/ _jsx(_Fragment, {
+        children: visible.map((sheet)=>/*#__PURE__*/ _jsx("style", {
+                "data-aglyn-plugin-styles": `${sheet.pluginId}:${sheet.styleId}`,
+                children: sheet.css
+            }, `${sheet.pluginId}\x00${sheet.styleId}`))
+    });
+}
+
+//# sourceMappingURL=plugin-styles-ui.js.map

package/src/lib/plugin-manager/plugin-styles-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-styles-ui.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The React half of the plugin stylesheet route (AGL-2486). Its registry twin\n * is `plugin-styles.ts`.\n *\n * ## Why this is a separate file, and NOT on the `@aglyn/aglyn` barrel\n *\n * It was one file to begin with, and that took the dev server to a 500 on\n * every route. `plugin-manager/index.ts` is re-exported by `lib/aglyn.ts`,\n * which `src/server.ts` re-exports in turn — so anything in the plugin-manager\n * barrel is reachable from a SERVER route, and a module calling a client-only\n * React hook (`useSyncExternalStore`) is not. Same family as the recorded\n * `plugin-manager` → `app-utils/api-plugins` cycle: the barrel is the hazard,\n * and the fix is to keep the shared state in a leaf both sides can import and\n * leave the client-only piece off the barrel entirely.\n *\n * So: the REGISTRY (`registerPluginStyles`, `capturePluginStyles`, the store)\n * is plain TypeScript with no React import and stays on the barrel, because\n * `realm-plugins.ts` — which is isomorphic — has to call the capture. This\n * component is deep-imported instead:\n *\n *     import { PluginStyles } from '@aglyn/aglyn/plugin-manager/plugin-styles-ui'\n *\n * exactly as `app-utils/consent-banner-ui` already is. Do not add it to\n * `plugin-manager/index.ts`; that is the change that breaks every route.\n *\n * If a route starts 500ing right after you touch this, RESTART the dev server\n * before doubting the edit — Turbopack serves the stale server chunk and\n * neither an edit nor a hard reload clears it.\n *\n * No `'use client'` directive: inside @aglyn/aglyn the directive splits the\n * bundler into a duplicate module graph and the second canvas singleton\n * renders the tenant blank (AGL-52). Every importer is itself a client module.\n */\n\nimport { type ReactElement, useSyncExternalStore } from 'react'\nimport {\n  listPluginStyles,\n  type PluginStylesScope,\n  subscribeToPluginStyles,\n} from './plugin-styles'\n\n/**\n * Renders every plugin stylesheet that belongs on this surface, as plain\n * `<style>` children — so they land wherever the tree lands: the document on\n * the published tenant and in Preview, inside the closed shadow root on the\n * besigner canvas.\n *\n * Unlayered by construction, which is the whole point: that is the slot a\n * plugin's CSS occupies on the published page, and reproducing the SLOT is\n * what makes the editor agree with the published page about which rule wins.\n * Do not route this through an emotion cache — the layered cache would put\n * plugin CSS inside `@layer mui`, where it would start LOSING to component\n * defaults it currently beats.\n *\n * Subscribed rather than read once: realm bundles load asynchronously (post\n * hydration on the tenant, alongside the console shell in the editor), so the\n * canvas is routinely mounted before any plugin has registered anything.\n */\nexport function PluginStyles(props?: {\n  scope?: PluginStylesScope\n}): ReactElement {\n  const scope = props?.scope ?? 'document'\n  const all = useSyncExternalStore(\n    subscribeToPluginStyles,\n    listPluginStyles,\n    listPluginStyles,\n  )\n  const visible = all.filter((sheet) => scope === 'shadow' || !sheet.mirrored)\n  return (\n    <>\n      {visible.map((sheet) => (\n        <style\n          key={`${sheet.pluginId}\\x00${sheet.styleId}`}\n          data-aglyn-plugin-styles={`${sheet.pluginId}:${sheet.styleId}`}\n        >\n          {sheet.css}\n        </style>\n      ))}\n    </>\n  )\n}\n"],"names":["useSyncExternalStore","listPluginStyles","subscribeToPluginStyles","PluginStyles","props","scope","all","visible","filter","sheet","mirrored","map","style","data-aglyn-plugin-styles","pluginId","styleId","css"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCC,GAED,SAA4BA,oBAAoB,QAAQ,QAAO;AAC/D,SACEC,gBAAgB,EAEhBC,uBAAuB,QAClB,qBAAiB;AAExB;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,aAAaC,KAE5B;;IACC,MAAMC,gBAAQD,yBAAAA,MAAOC,KAAK,mBAAI;IAC9B,MAAMC,MAAMN,qBACVE,yBACAD,kBACAA;IAEF,MAAMM,UAAUD,IAAIE,MAAM,CAAC,CAACC,QAAUJ,UAAU,YAAY,CAACI,MAAMC,QAAQ;IAC3E,qBACE;kBACGH,QAAQI,GAAG,CAAC,CAACF,sBACZ,KAACG;gBAECC,4BAA0B,GAAGJ,MAAMK,QAAQ,CAAC,CAAC,EAAEL,MAAMM,OAAO,EAAE;0BAE7DN,MAAMO,GAAG;eAHL,GAAGP,MAAMK,QAAQ,CAAC,IAAI,EAAEL,MAAMM,OAAO,EAAE;;AAQtD"}

package/src/lib/plugin-manager/plugin-styles.d.ts

@@ -0,0 +1,176 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Plugin stylesheet registry (AGL-2486) — the route a plugin's raw CSS takes
+ * onto EVERY surface that renders site content, so the besigner canvas shows
+ * what the published page will show.
+ *
+ * ## The divergence this closes, as measured
+ *
+ * `8dc718ed4` layered the canvas emotion cache so CSS that never touches
+ * emotion resolves against `@layer mui` the same way on both surfaces. It
+ * left one route open, and named it: a plugin's CSS has no way into the
+ * canvas at all. Measured 2026-08-23 in a real browser, injecting the SAME
+ * rule the SAME way a bundle's CSS injector does
+ * (`document.head.appendChild(<style>)`), against a stand-in emotion rule of
+ * specificity 0-1-0 inside `@layer mui`, with a 0-0-1 plugin selector:
+ *
+ * | | published tenant | besigner canvas |
+ * | -- | -- | -- |
+ * | emotion rule alone | `rgb(9,9,9)` | `rgb(9,9,9)` |
+ * | plugin CSS via `document.head` | **`rgb(1,2,3)` — wins** | `rgb(9,9,9)` — **no effect at all** |
+ * | plugin CSS in the shadow root | n/a | `rgb(1,2,3)` — wins |
+ * | control: plugin CSS wrapped in `@layer mui` | `rgb(9,9,9)` — loses | `rgb(9,9,9)` — loses |
+ *
+ * The canvas shadow root is `mode: 'closed'` with `:host { all: initial }`
+ * and no `adoptedStyleSheets`, so a document-level rule cannot cross into it
+ * — not a specificity loss, a total miss. On the published page the same rule
+ * beats every MUI and `sx` declaration UNCONDITIONALLY, because an unlayered
+ * normal declaration outranks every layered one. Two opposite outcomes from
+ * one plugin. That is "what you see is not what you publish".
+ *
+ * The control row is the load-bearing half: wrapped in `@layer mui` the
+ * identical rule LOSES on both surfaces, so the win is the layer and not
+ * insertion order — and the canvas now agrees with the published page on
+ * both the win and the loss.
+ *
+ * ## The shape of the fix
+ *
+ * Registered CSS is rendered by `PluginStyles` — the React half, which lives
+ * in the sibling `plugin-styles-ui.tsx` and is deep-imported rather than
+ * exported from this barrel, because a client-only hook on a barrel that
+ * `src/server.ts` re-exports 500s every server route (that is not
+ * hypothetical: it is how this shipped the first time). It renders each sheet
+ * as a plain `<style>` child of the site-content root — the same position, and the same unlayered
+ * cascade slot, that a Custom HTML `css` block already occupies
+ * (`custom-html.tsx`). On the tenant that root is the document; on the canvas
+ * it is inside the closed shadow root. One component, one order, one outcome.
+ *
+ * Two writers, because a route nothing writes to is not a fix:
+ *
+ * - `registerPluginStyles` is the sanctioned API, on the realm host ABI
+ *   (the host hands bundles the whole `aglyn` namespace) and available to
+ *   first-party plugins by import.
+ * - {@link capturePluginStyles} brackets a realm bundle's module evaluation
+ *   and `register()` call and picks up any `<style>` it appends to
+ *   `document.head` itself — which is exactly what every bundler's CSS
+ *   injector emits for an `import './styles.css'`. Those are registered as
+ *   MIRRORS: the original element is left alone, so anything a plugin styles
+ *   on the console side keeps working, and only shadow surfaces render the
+ *   copy (the document already has the original).
+ *
+ * ## What this deliberately does NOT do
+ *
+ * It does not remove or neutralise the plugin's own `document.head` element.
+ * A realm plugin can register console surfaces as well as site components,
+ * and CSS it injected for its console panel must keep applying there. The
+ * consequence — a realm bundle can still restyle console chrome through its
+ * own `document.head` write — is unchanged by this file and is not a boundary
+ * CSS was ever holding: a realm bundle is staff-reviewed, signed code running
+ * in the app realm with the host's React, so it can already do anything the
+ * console can. See [[project_plugin_sandbox_boundary]].
+ *
+ * What the NEW route adds is strictly less power than that: on the canvas it
+ * lands inside a closed shadow root, so it cannot match a console element at
+ * all, and it is scheme-filtered on the way in.
+ */
+export interface PluginStyleSheet {
+    /** Owning plugin id — the listing id for a realm bundle. */
+    pluginId: string;
+    /** Stable id within the plugin; re-registering the pair replaces. */
+    styleId: string;
+    /** CSS text, already through {@link sanitizeAuthorCss}. */
+    css: string;
+    /**
+     * True when these rules ALSO exist as a live `<style>` in the host
+     * document, because {@link capturePluginStyles} mirrored them rather than
+     * moving them. Document surfaces must not render a mirror — the original
+     * already applies there and a second copy would only double the bytes.
+     * Shadow surfaces must, because nothing in the document reaches them.
+     */
+    mirrored: boolean;
+}
+export interface RegisterPluginStylesInput {
+    pluginId: string;
+    /** Defaults to `'default'`; give distinct ids to register several sheets. */
+    styleId?: string;
+    css: string;
+}
+/** Where `PluginStyles` is rendering, which decides mirror handling. */
+export type PluginStylesScope = 'document' | 'shadow';
+/**
+ * Registers (or replaces) one plugin stylesheet.
+ *
+ * The CSS is scheme-filtered by {@link sanitizeAuthorCss} — the same
+ * function the published Custom HTML path uses — so an `http:` or unknown
+ * scheme in a `url()` becomes `about:invalid` and contacts nobody. Hosts are
+ * deliberately not restricted; that is the AGL-1725 warn-and-disclose
+ * decision, and applying a different rule here would mean a plugin's CSS
+ * rendered differently from an author's.
+ *
+ * Registering identical CSS again is a no-op (no re-render), so a plugin may
+ * call this on every render without thinking about it.
+ *
+ * Do NOT wrap your rules in `@layer mui`. The unlayered slot is the whole
+ * point; inside the layer the same rule starts losing to component defaults
+ * it is meant to beat (the control row in the table above).
+ */
+export declare function registerPluginStyles(input: RegisterPluginStylesInput): void;
+/** Drops one sheet, or every sheet a plugin owns when `styleId` is omitted. */
+export declare function unregisterPluginStyles(pluginId: string, styleId?: string): void;
+/** Every registered sheet, in registration order. Identity-stable. */
+export declare function listPluginStyles(): readonly PluginStyleSheet[];
+/** Subscribes to registry changes; returns the unsubscribe. */
+export declare function subscribeToPluginStyles(listener: () => void): () => void;
+/** Test seam. Never called by product code. */
+export declare function resetPluginStylesForTest(): void;
+/**
+ * Runs `load` with `document.head` watched, and registers every `<style>`
+ * the bundle appends while it runs as a MIRRORED sheet.
+ *
+ * This is the writer that makes the registry real for bundles nobody has
+ * updated. `import './styles.css'` in any bundler compiles to a
+ * `document.head.appendChild(styleElement)` at module-evaluation time, which
+ * is inside this window, so the commonest shape of plugin CSS is picked up
+ * with no change to the plugin.
+ *
+ * Notes for whoever touches this next:
+ *
+ * - `<link rel="stylesheet">` is deliberately NOT captured. Next adds its own
+ *   chunk `<link>`s to the head at unpredictable moments, and a window this
+ *   wide cannot tell one from a plugin's — neutralising the wrong one breaks
+ *   the console. A plugin needing a linked stylesheet calls
+ *   {@link registerPluginStyles} with an `@import`, or inlines it.
+ * - There is deliberately no `takeRecords()` drain before `disconnect()`, and
+ *   adding one back would be dead code: a `MutationObserver` queues its
+ *   microtask AT MUTATION TIME, and the microtask queue is FIFO, so anything
+ *   appended inside `load` is always delivered before the `await load()`
+ *   continuation that reaches the `finally`. A drain was written first and
+ *   removed when mutating it away turned no test red — which is the only
+ *   honest signal that a branch is unreachable.
+ * - Text written to a captured element AFTER the window closes still
+ *   propagates: each captured element keeps its own observer for the life of
+ *   the page. That is what keeps a dev-mode emotion instance (which sets
+ *   `textContent`) in sync. A production emotion instance in "speedy" mode
+ *   inserts through `CSSOM` with no mutation to observe and is NOT tracked —
+ *   but a realm bundle carrying its own emotion is already an ABI violation
+ *   (it would carry a second React with it), so that is a shape this loader
+ *   refuses for other reasons.
+ * - Failures here must never take the load down: a plugin that renders is
+ *   better than a console that does not.
+ */
+export declare function capturePluginStyles<T>(pluginId: string, load: () => Promise<T>): Promise<T>;

package/src/lib/plugin-manager/plugin-styles.js

@@ -0,0 +1,186 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Deliberately NO 'use client' directive — see the note at the top of
+// `app-utils/consent-banner-ui.tsx`. Inside @aglyn/aglyn the directive splits
+// the bundler into a duplicate module graph and the second canvas singleton
+// renders the tenant blank (AGL-52). Every importer is itself a client module.
+import { sanitizeAuthorCss } from "../app-utils/author-css.js";
+const sheets = [];
+const listeners = new Set();
+// `useSyncExternalStore` compares snapshots by identity and calls
+// `getSnapshot` during render, so it MUST be a cached array — returning
+// `sheets.slice()` fresh each call is an infinite render loop.
+let snapshot = [];
+function publish() {
+    snapshot = sheets.slice();
+    for (const listener of [
+        ...listeners
+    ])listener();
+}
+function keyOf(pluginId, styleId) {
+    return `${pluginId}\x00${styleId}`;
+}
+/**
+ * Registers (or replaces) one plugin stylesheet.
+ *
+ * The CSS is scheme-filtered by {@link sanitizeAuthorCss} — the same
+ * function the published Custom HTML path uses — so an `http:` or unknown
+ * scheme in a `url()` becomes `about:invalid` and contacts nobody. Hosts are
+ * deliberately not restricted; that is the AGL-1725 warn-and-disclose
+ * decision, and applying a different rule here would mean a plugin's CSS
+ * rendered differently from an author's.
+ *
+ * Registering identical CSS again is a no-op (no re-render), so a plugin may
+ * call this on every render without thinking about it.
+ *
+ * Do NOT wrap your rules in `@layer mui`. The unlayered slot is the whole
+ * point; inside the layer the same rule starts losing to component defaults
+ * it is meant to beat (the control row in the table above).
+ */ export function registerPluginStyles(input) {
+    const pluginId = input == null ? void 0 : input.pluginId;
+    const styleId = (input == null ? void 0 : input.styleId) || 'default';
+    if (!pluginId || typeof (input == null ? void 0 : input.css) !== 'string') return;
+    writeSheet({
+        pluginId,
+        styleId,
+        css: sanitizeAuthorCss(input.css),
+        mirrored: false
+    });
+}
+function writeSheet(next) {
+    const key = keyOf(next.pluginId, next.styleId);
+    const index = sheets.findIndex((sheet)=>keyOf(sheet.pluginId, sheet.styleId) === key);
+    if (index >= 0) {
+        const current = sheets[index];
+        if (current.css === next.css && current.mirrored === next.mirrored) return;
+        sheets[index] = next;
+    } else {
+        sheets.push(next);
+    }
+    publish();
+}
+/** Drops one sheet, or every sheet a plugin owns when `styleId` is omitted. */ export function unregisterPluginStyles(pluginId, styleId) {
+    const before = sheets.length;
+    for(let index = sheets.length - 1; index >= 0; index--){
+        const sheet = sheets[index];
+        if (sheet.pluginId !== pluginId) continue;
+        if (styleId !== undefined && sheet.styleId !== styleId) continue;
+        sheets.splice(index, 1);
+    }
+    if (sheets.length !== before) publish();
+}
+/** Every registered sheet, in registration order. Identity-stable. */ export function listPluginStyles() {
+    return snapshot;
+}
+/** Subscribes to registry changes; returns the unsubscribe. */ export function subscribeToPluginStyles(listener) {
+    listeners.add(listener);
+    return ()=>{
+        listeners.delete(listener);
+    };
+}
+/** Test seam. Never called by product code. */ export function resetPluginStylesForTest() {
+    sheets.length = 0;
+    publish();
+}
+/**
+ * Runs `load` with `document.head` watched, and registers every `<style>`
+ * the bundle appends while it runs as a MIRRORED sheet.
+ *
+ * This is the writer that makes the registry real for bundles nobody has
+ * updated. `import './styles.css'` in any bundler compiles to a
+ * `document.head.appendChild(styleElement)` at module-evaluation time, which
+ * is inside this window, so the commonest shape of plugin CSS is picked up
+ * with no change to the plugin.
+ *
+ * Notes for whoever touches this next:
+ *
+ * - `<link rel="stylesheet">` is deliberately NOT captured. Next adds its own
+ *   chunk `<link>`s to the head at unpredictable moments, and a window this
+ *   wide cannot tell one from a plugin's — neutralising the wrong one breaks
+ *   the console. A plugin needing a linked stylesheet calls
+ *   {@link registerPluginStyles} with an `@import`, or inlines it.
+ * - There is deliberately no `takeRecords()` drain before `disconnect()`, and
+ *   adding one back would be dead code: a `MutationObserver` queues its
+ *   microtask AT MUTATION TIME, and the microtask queue is FIFO, so anything
+ *   appended inside `load` is always delivered before the `await load()`
+ *   continuation that reaches the `finally`. A drain was written first and
+ *   removed when mutating it away turned no test red — which is the only
+ *   honest signal that a branch is unreachable.
+ * - Text written to a captured element AFTER the window closes still
+ *   propagates: each captured element keeps its own observer for the life of
+ *   the page. That is what keeps a dev-mode emotion instance (which sets
+ *   `textContent`) in sync. A production emotion instance in "speedy" mode
+ *   inserts through `CSSOM` with no mutation to observe and is NOT tracked —
+ *   but a realm bundle carrying its own emotion is already an ABI violation
+ *   (it would carry a second React with it), so that is a shape this loader
+ *   refuses for other reasons.
+ * - Failures here must never take the load down: a plugin that renders is
+ *   better than a console that does not.
+ */ export async function capturePluginStyles(pluginId, load) {
+    const doc = typeof document === 'undefined' ? null : document;
+    if (!(doc == null ? void 0 : doc.head) || typeof MutationObserver === 'undefined') return load();
+    const captured = new Map();
+    const take = (nodes)=>{
+        for (const node of Array.from(nodes)){
+            if (!isStyleElement(node) || captured.has(node)) continue;
+            const styleId = `captured-${captured.size + 1}`;
+            captured.set(node, styleId);
+            trackCapturedStyle(pluginId, styleId, node);
+        }
+    };
+    const observer = new MutationObserver((records)=>{
+        for (const record of records)take(record.addedNodes);
+    });
+    try {
+        observer.observe(doc.head, {
+            childList: true
+        });
+        return await load();
+    } finally{
+        try {
+            observer.disconnect();
+        } catch (error) {
+            console.warn(`plugin styles: capture for ${pluginId} failed:`, error);
+        }
+    }
+}
+function isStyleElement(node) {
+    var _node_tagName;
+    return (node == null ? void 0 : node.nodeType) === 1 && ((_node_tagName = node.tagName) == null ? void 0 : _node_tagName.toUpperCase()) === 'STYLE';
+}
+function trackCapturedStyle(pluginId, styleId, element) {
+    const sync = ()=>{
+        var _element_textContent;
+        writeSheet({
+            pluginId,
+            styleId,
+            css: sanitizeAuthorCss((_element_textContent = element.textContent) != null ? _element_textContent : ''),
+            mirrored: true
+        });
+    };
+    sync();
+    try {
+        new MutationObserver(sync).observe(element, {
+            childList: true,
+            characterData: true,
+            subtree: true
+        });
+    } catch (unused) {
+    // An environment without a working observer still gets the initial text.
+    }
+}
+
+//# sourceMappingURL=plugin-styles.js.map

package/src/lib/plugin-manager/plugin-styles.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-styles.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Deliberately NO 'use client' directive — see the note at the top of\n// `app-utils/consent-banner-ui.tsx`. Inside @aglyn/aglyn the directive splits\n// the bundler into a duplicate module graph and the second canvas singleton\n// renders the tenant blank (AGL-52). Every importer is itself a client module.\n\nimport { sanitizeAuthorCss } from '../app-utils/author-css'\n\n/**\n * Plugin stylesheet registry (AGL-2486) — the route a plugin's raw CSS takes\n * onto EVERY surface that renders site content, so the besigner canvas shows\n * what the published page will show.\n *\n * ## The divergence this closes, as measured\n *\n * `8dc718ed4` layered the canvas emotion cache so CSS that never touches\n * emotion resolves against `@layer mui` the same way on both surfaces. It\n * left one route open, and named it: a plugin's CSS has no way into the\n * canvas at all. Measured 2026-08-23 in a real browser, injecting the SAME\n * rule the SAME way a bundle's CSS injector does\n * (`document.head.appendChild(<style>)`), against a stand-in emotion rule of\n * specificity 0-1-0 inside `@layer mui`, with a 0-0-1 plugin selector:\n *\n * | | published tenant | besigner canvas |\n * | -- | -- | -- |\n * | emotion rule alone | `rgb(9,9,9)` | `rgb(9,9,9)` |\n * | plugin CSS via `document.head` | **`rgb(1,2,3)` — wins** | `rgb(9,9,9)` — **no effect at all** |\n * | plugin CSS in the shadow root | n/a | `rgb(1,2,3)` — wins |\n * | control: plugin CSS wrapped in `@layer mui` | `rgb(9,9,9)` — loses | `rgb(9,9,9)` — loses |\n *\n * The canvas shadow root is `mode: 'closed'` with `:host { all: initial }`\n * and no `adoptedStyleSheets`, so a document-level rule cannot cross into it\n * — not a specificity loss, a total miss. On the published page the same rule\n * beats every MUI and `sx` declaration UNCONDITIONALLY, because an unlayered\n * normal declaration outranks every layered one. Two opposite outcomes from\n * one plugin. That is \"what you see is not what you publish\".\n *\n * The control row is the load-bearing half: wrapped in `@layer mui` the\n * identical rule LOSES on both surfaces, so the win is the layer and not\n * insertion order — and the canvas now agrees with the published page on\n * both the win and the loss.\n *\n * ## The shape of the fix\n *\n * Registered CSS is rendered by `PluginStyles` — the React half, which lives\n * in the sibling `plugin-styles-ui.tsx` and is deep-imported rather than\n * exported from this barrel, because a client-only hook on a barrel that\n * `src/server.ts` re-exports 500s every server route (that is not\n * hypothetical: it is how this shipped the first time). It renders each sheet\n * as a plain `<style>` child of the site-content root — the same position, and the same unlayered\n * cascade slot, that a Custom HTML `css` block already occupies\n * (`custom-html.tsx`). On the tenant that root is the document; on the canvas\n * it is inside the closed shadow root. One component, one order, one outcome.\n *\n * Two writers, because a route nothing writes to is not a fix:\n *\n * - `registerPluginStyles` is the sanctioned API, on the realm host ABI\n *   (the host hands bundles the whole `aglyn` namespace) and available to\n *   first-party plugins by import.\n * - {@link capturePluginStyles} brackets a realm bundle's module evaluation\n *   and `register()` call and picks up any `<style>` it appends to\n *   `document.head` itself — which is exactly what every bundler's CSS\n *   injector emits for an `import './styles.css'`. Those are registered as\n *   MIRRORS: the original element is left alone, so anything a plugin styles\n *   on the console side keeps working, and only shadow surfaces render the\n *   copy (the document already has the original).\n *\n * ## What this deliberately does NOT do\n *\n * It does not remove or neutralise the plugin's own `document.head` element.\n * A realm plugin can register console surfaces as well as site components,\n * and CSS it injected for its console panel must keep applying there. The\n * consequence — a realm bundle can still restyle console chrome through its\n * own `document.head` write — is unchanged by this file and is not a boundary\n * CSS was ever holding: a realm bundle is staff-reviewed, signed code running\n * in the app realm with the host's React, so it can already do anything the\n * console can. See [[project_plugin_sandbox_boundary]].\n *\n * What the NEW route adds is strictly less power than that: on the canvas it\n * lands inside a closed shadow root, so it cannot match a console element at\n * all, and it is scheme-filtered on the way in.\n */\nexport interface PluginStyleSheet {\n  /** Owning plugin id — the listing id for a realm bundle. */\n  pluginId: string\n  /** Stable id within the plugin; re-registering the pair replaces. */\n  styleId: string\n  /** CSS text, already through {@link sanitizeAuthorCss}. */\n  css: string\n  /**\n   * True when these rules ALSO exist as a live `<style>` in the host\n   * document, because {@link capturePluginStyles} mirrored them rather than\n   * moving them. Document surfaces must not render a mirror — the original\n   * already applies there and a second copy would only double the bytes.\n   * Shadow surfaces must, because nothing in the document reaches them.\n   */\n  mirrored: boolean\n}\n\nexport interface RegisterPluginStylesInput {\n  pluginId: string\n  /** Defaults to `'default'`; give distinct ids to register several sheets. */\n  styleId?: string\n  css: string\n}\n\n/** Where `PluginStyles` is rendering, which decides mirror handling. */\nexport type PluginStylesScope = 'document' | 'shadow'\n\nconst sheets: PluginStyleSheet[] = []\nconst listeners = new Set<() => void>()\n// `useSyncExternalStore` compares snapshots by identity and calls\n// `getSnapshot` during render, so it MUST be a cached array — returning\n// `sheets.slice()` fresh each call is an infinite render loop.\nlet snapshot: readonly PluginStyleSheet[] = []\n\nfunction publish(): void {\n  snapshot = sheets.slice()\n  for (const listener of [...listeners]) listener()\n}\n\nfunction keyOf(pluginId: string, styleId: string): string {\n  return `${pluginId}\\x00${styleId}`\n}\n\n/**\n * Registers (or replaces) one plugin stylesheet.\n *\n * The CSS is scheme-filtered by {@link sanitizeAuthorCss} — the same\n * function the published Custom HTML path uses — so an `http:` or unknown\n * scheme in a `url()` becomes `about:invalid` and contacts nobody. Hosts are\n * deliberately not restricted; that is the AGL-1725 warn-and-disclose\n * decision, and applying a different rule here would mean a plugin's CSS\n * rendered differently from an author's.\n *\n * Registering identical CSS again is a no-op (no re-render), so a plugin may\n * call this on every render without thinking about it.\n *\n * Do NOT wrap your rules in `@layer mui`. The unlayered slot is the whole\n * point; inside the layer the same rule starts losing to component defaults\n * it is meant to beat (the control row in the table above).\n */\nexport function registerPluginStyles(input: RegisterPluginStylesInput): void {\n  const pluginId = input?.pluginId\n  const styleId = input?.styleId || 'default'\n  if (!pluginId || typeof input?.css !== 'string') return\n  writeSheet({\n    pluginId,\n    styleId,\n    css: sanitizeAuthorCss(input.css),\n    mirrored: false,\n  })\n}\n\nfunction writeSheet(next: PluginStyleSheet): void {\n  const key = keyOf(next.pluginId, next.styleId)\n  const index = sheets.findIndex(\n    (sheet) => keyOf(sheet.pluginId, sheet.styleId) === key,\n  )\n  if (index >= 0) {\n    const current = sheets[index]\n    if (current.css === next.css && current.mirrored === next.mirrored) return\n    sheets[index] = next\n  } else {\n    sheets.push(next)\n  }\n  publish()\n}\n\n/** Drops one sheet, or every sheet a plugin owns when `styleId` is omitted. */\nexport function unregisterPluginStyles(\n  pluginId: string,\n  styleId?: string,\n): void {\n  const before = sheets.length\n  for (let index = sheets.length - 1; index >= 0; index--) {\n    const sheet = sheets[index]\n    if (sheet.pluginId !== pluginId) continue\n    if (styleId !== undefined && sheet.styleId !== styleId) continue\n    sheets.splice(index, 1)\n  }\n  if (sheets.length !== before) publish()\n}\n\n/** Every registered sheet, in registration order. Identity-stable. */\nexport function listPluginStyles(): readonly PluginStyleSheet[] {\n  return snapshot\n}\n\n/** Subscribes to registry changes; returns the unsubscribe. */\nexport function subscribeToPluginStyles(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => {\n    listeners.delete(listener)\n  }\n}\n\n/** Test seam. Never called by product code. */\nexport function resetPluginStylesForTest(): void {\n  sheets.length = 0\n  publish()\n}\n\n/**\n * Runs `load` with `document.head` watched, and registers every `<style>`\n * the bundle appends while it runs as a MIRRORED sheet.\n *\n * This is the writer that makes the registry real for bundles nobody has\n * updated. `import './styles.css'` in any bundler compiles to a\n * `document.head.appendChild(styleElement)` at module-evaluation time, which\n * is inside this window, so the commonest shape of plugin CSS is picked up\n * with no change to the plugin.\n *\n * Notes for whoever touches this next:\n *\n * - `<link rel=\"stylesheet\">` is deliberately NOT captured. Next adds its own\n *   chunk `<link>`s to the head at unpredictable moments, and a window this\n *   wide cannot tell one from a plugin's — neutralising the wrong one breaks\n *   the console. A plugin needing a linked stylesheet calls\n *   {@link registerPluginStyles} with an `@import`, or inlines it.\n * - There is deliberately no `takeRecords()` drain before `disconnect()`, and\n *   adding one back would be dead code: a `MutationObserver` queues its\n *   microtask AT MUTATION TIME, and the microtask queue is FIFO, so anything\n *   appended inside `load` is always delivered before the `await load()`\n *   continuation that reaches the `finally`. A drain was written first and\n *   removed when mutating it away turned no test red — which is the only\n *   honest signal that a branch is unreachable.\n * - Text written to a captured element AFTER the window closes still\n *   propagates: each captured element keeps its own observer for the life of\n *   the page. That is what keeps a dev-mode emotion instance (which sets\n *   `textContent`) in sync. A production emotion instance in \"speedy\" mode\n *   inserts through `CSSOM` with no mutation to observe and is NOT tracked —\n *   but a realm bundle carrying its own emotion is already an ABI violation\n *   (it would carry a second React with it), so that is a shape this loader\n *   refuses for other reasons.\n * - Failures here must never take the load down: a plugin that renders is\n *   better than a console that does not.\n */\nexport async function capturePluginStyles<T>(\n  pluginId: string,\n  load: () => Promise<T>,\n): Promise<T> {\n  const doc = typeof document === 'undefined' ? null : document\n  if (!doc?.head || typeof MutationObserver === 'undefined') return load()\n\n  const captured = new Map<HTMLStyleElement, string>()\n  const take = (nodes: NodeList | Node[]): void => {\n    for (const node of Array.from(nodes)) {\n      if (!isStyleElement(node) || captured.has(node)) continue\n      const styleId = `captured-${captured.size + 1}`\n      captured.set(node, styleId)\n      trackCapturedStyle(pluginId, styleId, node)\n    }\n  }\n  const observer = new MutationObserver((records) => {\n    for (const record of records) take(record.addedNodes)\n  })\n  try {\n    observer.observe(doc.head, { childList: true })\n    return await load()\n  } finally {\n    try {\n      observer.disconnect()\n    } catch (error) {\n      console.warn(`plugin styles: capture for ${pluginId} failed:`, error)\n    }\n  }\n}\n\nfunction isStyleElement(node: Node): node is HTMLStyleElement {\n  return (\n    (node as Element)?.nodeType === 1 &&\n    (node as Element).tagName?.toUpperCase() === 'STYLE'\n  )\n}\n\nfunction trackCapturedStyle(\n  pluginId: string,\n  styleId: string,\n  element: HTMLStyleElement,\n): void {\n  const sync = () => {\n    writeSheet({\n      pluginId,\n      styleId,\n      css: sanitizeAuthorCss(element.textContent ?? ''),\n      mirrored: true,\n    })\n  }\n  sync()\n  try {\n    new MutationObserver(sync).observe(element, {\n      childList: true,\n      characterData: true,\n      subtree: true,\n    })\n  } catch {\n    // An environment without a working observer still gets the initial text.\n  }\n}\n"],"names":["sanitizeAuthorCss","sheets","listeners","Set","snapshot","publish","slice","listener","keyOf","pluginId","styleId","registerPluginStyles","input","css","writeSheet","mirrored","next","key","index","findIndex","sheet","current","push","unregisterPluginStyles","before","length","undefined","splice","listPluginStyles","subscribeToPluginStyles","add","delete","resetPluginStylesForTest","capturePluginStyles","load","doc","document","head","MutationObserver","captured","Map","take","nodes","node","Array","from","isStyleElement","has","size","set","trackCapturedStyle","observer","records","record","addedNodes","observe","childList","disconnect","error","console","warn","nodeType","tagName","toUpperCase","element","sync","textContent","characterData","subtree"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,sEAAsE;AACtE,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAE/E,SAASA,iBAAiB,QAAQ,6BAAyB;AAuG3D,MAAMC,SAA6B,EAAE;AACrC,MAAMC,YAAY,IAAIC;AACtB,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,IAAIC,WAAwC,EAAE;AAE9C,SAASC;IACPD,WAAWH,OAAOK,KAAK;IACvB,KAAK,MAAMC,YAAY;WAAIL;KAAU,CAAEK;AACzC;AAEA,SAASC,MAAMC,QAAgB,EAAEC,OAAe;IAC9C,OAAO,GAAGD,SAAS,IAAI,EAAEC,SAAS;AACpC;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,qBAAqBC,KAAgC;IACnE,MAAMH,WAAWG,yBAAAA,MAAOH,QAAQ;IAChC,MAAMC,UAAUE,CAAAA,yBAAAA,MAAOF,OAAO,KAAI;IAClC,IAAI,CAACD,YAAY,QAAOG,yBAAAA,MAAOC,GAAG,MAAK,UAAU;IACjDC,WAAW;QACTL;QACAC;QACAG,KAAKb,kBAAkBY,MAAMC,GAAG;QAChCE,UAAU;IACZ;AACF;AAEA,SAASD,WAAWE,IAAsB;IACxC,MAAMC,MAAMT,MAAMQ,KAAKP,QAAQ,EAAEO,KAAKN,OAAO;IAC7C,MAAMQ,QAAQjB,OAAOkB,SAAS,CAC5B,CAACC,QAAUZ,MAAMY,MAAMX,QAAQ,EAAEW,MAAMV,OAAO,MAAMO;IAEtD,IAAIC,SAAS,GAAG;QACd,MAAMG,UAAUpB,MAAM,CAACiB,MAAM;QAC7B,IAAIG,QAAQR,GAAG,KAAKG,KAAKH,GAAG,IAAIQ,QAAQN,QAAQ,KAAKC,KAAKD,QAAQ,EAAE;QACpEd,MAAM,CAACiB,MAAM,GAAGF;IAClB,OAAO;QACLf,OAAOqB,IAAI,CAACN;IACd;IACAX;AACF;AAEA,6EAA6E,GAC7E,OAAO,SAASkB,uBACdd,QAAgB,EAChBC,OAAgB;IAEhB,MAAMc,SAASvB,OAAOwB,MAAM;IAC5B,IAAK,IAAIP,QAAQjB,OAAOwB,MAAM,GAAG,GAAGP,SAAS,GAAGA,QAAS;QACvD,MAAME,QAAQnB,MAAM,CAACiB,MAAM;QAC3B,IAAIE,MAAMX,QAAQ,KAAKA,UAAU;QACjC,IAAIC,YAAYgB,aAAaN,MAAMV,OAAO,KAAKA,SAAS;QACxDT,OAAO0B,MAAM,CAACT,OAAO;IACvB;IACA,IAAIjB,OAAOwB,MAAM,KAAKD,QAAQnB;AAChC;AAEA,oEAAoE,GACpE,OAAO,SAASuB;IACd,OAAOxB;AACT;AAEA,6DAA6D,GAC7D,OAAO,SAASyB,wBAAwBtB,QAAoB;IAC1DL,UAAU4B,GAAG,CAACvB;IACd,OAAO;QACLL,UAAU6B,MAAM,CAACxB;IACnB;AACF;AAEA,6CAA6C,GAC7C,OAAO,SAASyB;IACd/B,OAAOwB,MAAM,GAAG;IAChBpB;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,eAAe4B,oBACpBxB,QAAgB,EAChByB,IAAsB;IAEtB,MAAMC,MAAM,OAAOC,aAAa,cAAc,OAAOA;IACrD,IAAI,EAACD,uBAAAA,IAAKE,IAAI,KAAI,OAAOC,qBAAqB,aAAa,OAAOJ;IAElE,MAAMK,WAAW,IAAIC;IACrB,MAAMC,OAAO,CAACC;QACZ,KAAK,MAAMC,QAAQC,MAAMC,IAAI,CAACH,OAAQ;YACpC,IAAI,CAACI,eAAeH,SAASJ,SAASQ,GAAG,CAACJ,OAAO;YACjD,MAAMjC,UAAU,CAAC,SAAS,EAAE6B,SAASS,IAAI,GAAG,GAAG;YAC/CT,SAASU,GAAG,CAACN,MAAMjC;YACnBwC,mBAAmBzC,UAAUC,SAASiC;QACxC;IACF;IACA,MAAMQ,WAAW,IAAIb,iBAAiB,CAACc;QACrC,KAAK,MAAMC,UAAUD,QAASX,KAAKY,OAAOC,UAAU;IACtD;IACA,IAAI;QACFH,SAASI,OAAO,CAACpB,IAAIE,IAAI,EAAE;YAAEmB,WAAW;QAAK;QAC7C,OAAO,MAAMtB;IACf,SAAU;QACR,IAAI;YACFiB,SAASM,UAAU;QACrB,EAAE,OAAOC,OAAO;YACdC,QAAQC,IAAI,CAAC,CAAC,2BAA2B,EAAEnD,SAAS,QAAQ,CAAC,EAAEiD;QACjE;IACF;AACF;AAEA,SAASZ,eAAeH,IAAU;QAG9B;IAFF,OACE,CAACA,wBAAD,AAACA,KAAkBkB,QAAQ,MAAK,KAChC,EAAA,gBAAA,AAAClB,KAAiBmB,OAAO,qBAAzB,cAA2BC,WAAW,QAAO;AAEjD;AAEA,SAASb,mBACPzC,QAAgB,EAChBC,OAAe,EACfsD,OAAyB;IAEzB,MAAMC,OAAO;YAIcD;QAHzBlD,WAAW;YACTL;YACAC;YACAG,KAAKb,mBAAkBgE,uBAAAA,QAAQE,WAAW,YAAnBF,uBAAuB;YAC9CjD,UAAU;QACZ;IACF;IACAkD;IACA,IAAI;QACF,IAAI3B,iBAAiB2B,MAAMV,OAAO,CAACS,SAAS;YAC1CR,WAAW;YACXW,eAAe;YACfC,SAAS;QACX;IACF,EAAE,eAAM;IACN,yEAAyE;IAC3E;AACF"}