@aglyn/aglyn 1.0.0-beta.144 → 1.0.0-beta.146

package/src/lib/app-utils/wistia-embed.d.ts

@@ -82,5 +82,23 @@ export interface WistiaPlayerOptions {
  * `autoPlay=false` rather than leaving the option out: an option in the embed
  * overrides the media's own settings in the Wistia account, and those may be
  * set to autoplay.
+ *
+ * ## The corners belong to the page (AGL-3209)
+ *
+ * `roundedPlayer=false` is stated on every address, and is not an option a
+ * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the
+ * frame, where the document's own canvas is white: on a dark page the corner
+ * arcs and the clip's antialiased edge composite as a white ring around the
+ * film rather than as the page behind them.
+ *
+ * Measured on 2026-09-21 against the live videos page, whose background is
+ * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column
+ * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —
+ * lighter than either, so painted rather than blended. With the option off
+ * the same pixels are the film.
+ *
+ * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes
+ * a `radius` from the element's own control and puts it on the frame, which a
+ * second rounding inside the frame can only fight.
  */
 export declare function wistiaPlayerSrc(value: unknown, options?: WistiaPlayerOptions): string | undefined;

package/src/lib/app-utils/wistia-embed.js

@@ -104,11 +104,30 @@
  * `autoPlay=false` rather than leaving the option out: an option in the embed
  * overrides the media's own settings in the Wistia account, and those may be
  * set to autoplay.
+ *
+ * ## The corners belong to the page (AGL-3209)
+ *
+ * `roundedPlayer=false` is stated on every address, and is not an option a
+ * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the
+ * frame, where the document's own canvas is white: on a dark page the corner
+ * arcs and the clip's antialiased edge composite as a white ring around the
+ * film rather than as the page behind them.
+ *
+ * Measured on 2026-09-21 against the live videos page, whose background is
+ * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column
+ * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —
+ * lighter than either, so painted rather than blended. With the option off
+ * the same pixels are the film.
+ *
+ * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes
+ * a `radius` from the element's own control and puts it on the frame, which a
+ * second rounding inside the frame can only fight.
  */ export function wistiaPlayerSrc(value, options = {}) {
     const embedUrl = wistiaEmbedUrl(value);
     if (!embedUrl) return undefined;
     const params = new URLSearchParams({
-        autoPlay: options.autoPlay === false ? 'false' : 'true'
+        autoPlay: options.autoPlay === false ? 'false' : 'true',
+        roundedPlayer: 'false'
     });
     if (options.doNotTrack) params.set('doNotTrack', 'true');
     if (options.muted) params.set('muted', 'true');

package/src/lib/app-utils/wistia-embed.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/wistia-embed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Wistia video, as the Video element plays it (AGL-2826).\n *\n * ## Only the media id survives\n *\n * An author pastes whatever link Wistia showed them. That string never reaches\n * a frame: every builder below reads the media's hashed id out of it and\n * rebuilds the address, so the only frame this module can produce is on\n * {@link WISTIA_PLAYER_ORIGIN}. That closed set is what lets the tenant's\n * `frame-src` name the origin for every site, and it is the rule\n * `parseVideoEmbedSrc` already holds YouTube and Vimeo to.\n *\n * ## The iframe embed, not the player script\n *\n * Wistia offers two embeds. The script embed runs Wistia's JavaScript in the\n * page itself, so every site would need `connect-src`, `img-src` and\n * `media-src` grants for Wistia's hosts, and the player's storage and beacons\n * would run as the site. The iframe embed runs all of that inside a document on\n * Wistia's origin, under Wistia's own policy: the page needs one `frame-src`\n * entry, and whatever the player stores is keyed to Wistia inside the site's\n * partition rather than written as the site.\n *\n * Measured on 2026-09-10: `fast.wistia.net/embed/iframe/{id}` answers 200 with\n * no redirect, so no second origin is involved in loading the frame.\n */\n\n/** The only origin a Wistia player frame is ever loaded from. */\nexport const WISTIA_PLAYER_ORIGIN = 'https://fast.wistia.net'\n\n/** A hashed id: ten lowercase letters and digits, e.g. `e4a27b971d`. */\nconst HASHED_ID = /^[a-z0-9]{10}$/\n\n/**\n * The paths a Wistia link carries a media id in. Wistia's oEmbed endpoint\n * matches on the path rather than the host, and so does this; the host is\n * checked separately by {@link isWistiaHostname}.\n */\nconst MEDIA_ID_PATHS: readonly RegExp[] = [\n  // A media page: `https://acme.wistia.com/medias/{id}`, and its `/manage`.\n  /^\\/medias\\/([^/]+)(?:\\/manage)?\\/?$/,\n  // The short form of the same page.\n  /^\\/m\\/([^/]+)\\/?$/,\n  // An iframe embed's own address.\n  /^\\/embed\\/iframe\\/([^/]+)\\/?$/,\n  // A script embed's media address, with or without its `.jsonp` suffix.\n  /^\\/embed\\/medias\\/([^/.]+)(?:\\.jsonp?)?\\/?$/,\n]\n\n/**\n * Whether a hostname is Wistia's. Exact or dot-anchored matches only, so\n * `wistia.com.example.net` and `notwistia.com` are refused.\n */\nfunction isWistiaHostname(hostname: string): boolean {\n  return ['wistia.com', 'wistia.net', 'wi.st'].some(\n    (domain) => hostname === domain || hostname.endsWith(`.${domain}`),\n  )\n}\n\n/**\n * The hashed id a Wistia link names, or `undefined` for anything else.\n *\n * A share link (`/s/{slug}`) names no id and is refused rather than guessed\n * at, as is a value that is not an http(s) URL.\n */\nexport function wistiaMediaId(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined\n  let url: URL\n  try {\n    url = new URL(value.trim())\n  } catch {\n    return undefined\n  }\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined\n  if (!isWistiaHostname(url.hostname)) return undefined\n  for (const pattern of MEDIA_ID_PATHS) {\n    const id = pattern.exec(url.pathname)?.[1]\n    if (id && HASHED_ID.test(id)) return id\n  }\n  return undefined\n}\n\n/**\n * The player page for a Wistia link, with no per-visit options: what\n * `VideoObject.embedUrl` names.\n */\nexport function wistiaEmbedUrl(value: unknown): string | undefined {\n  const id = wistiaMediaId(value)\n  return id ? `${WISTIA_PLAYER_ORIGIN}/embed/iframe/${id}` : undefined\n}\n\nexport interface WistiaPlayerOptions {\n  /**\n   * Start playing as soon as the player is ready. On unless this is exactly\n   * `false`; see {@link wistiaPlayerSrc} for which frame turns it off.\n   */\n  autoPlay?: boolean\n  /**\n   * Ask Wistia not to record the viewing session (its `doNotTrack` embed\n   * option). The element sets it for every visitor whose analytics consent is\n   * not on record.\n   */\n  doNotTrack?: boolean\n  /** Start without sound. */\n  muted?: boolean\n  /** Restart at the end (`endVideoBehavior=loop`). */\n  loop?: boolean\n}\n\n/**\n * The address of a Wistia player frame.\n *\n * `autoPlay` is on by default, because the usual frame is the one a visitor's\n * press loads: it exists only because somebody pressed play, and a second play\n * button inside the player would ask them twice.\n *\n * The frame a page loads before anyone has pressed anything (\"Load the player\n * with the page\", AGL-2962) passes `autoPlay: false`. The address then says\n * `autoPlay=false` rather than leaving the option out: an option in the embed\n * overrides the media's own settings in the Wistia account, and those may be\n * set to autoplay.\n */\nexport function wistiaPlayerSrc(\n  value: unknown,\n  options: WistiaPlayerOptions = {},\n): string | undefined {\n  const embedUrl = wistiaEmbedUrl(value)\n  if (!embedUrl) return undefined\n  const params = new URLSearchParams({\n    autoPlay: options.autoPlay === false ? 'false' : 'true',\n  })\n  if (options.doNotTrack) params.set('doNotTrack', 'true')\n  if (options.muted) params.set('muted', 'true')\n  if (options.loop) params.set('endVideoBehavior', 'loop')\n  return `${embedUrl}?${params.toString()}`\n}\n"],"names":["WISTIA_PLAYER_ORIGIN","HASHED_ID","MEDIA_ID_PATHS","isWistiaHostname","hostname","some","domain","endsWith","wistiaMediaId","value","undefined","url","URL","trim","protocol","pattern","id","exec","pathname","test","wistiaEmbedUrl","wistiaPlayerSrc","options","embedUrl","params","URLSearchParams","autoPlay","doNotTrack","set","muted","loop","toString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,+DAA+D,GAC/D,OAAO,MAAMA,uBAAuB,0BAAyB;AAE7D,sEAAsE,GACtE,MAAMC,YAAY;AAElB;;;;CAIC,GACD,MAAMC,iBAAoC;IACxC,0EAA0E;IAC1E;IACA,mCAAmC;IACnC;IACA,iCAAiC;IACjC;IACA,uEAAuE;IACvE;CACD;AAED;;;CAGC,GACD,SAASC,iBAAiBC,QAAgB;IACxC,OAAO;QAAC;QAAc;QAAc;KAAQ,CAACC,IAAI,CAC/C,CAACC,SAAWF,aAAaE,UAAUF,SAASG,QAAQ,CAAC,CAAC,CAAC,EAAED,QAAQ;AAErE;AAEA;;;;;CAKC,GACD,OAAO,SAASE,cAAcC,KAAc;IAC1C,IAAI,OAAOA,UAAU,UAAU,OAAOC;IACtC,IAAIC;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIH,MAAMI,IAAI;IAC1B,EAAE,eAAM;QACN,OAAOH;IACT;IACA,IAAIC,IAAIG,QAAQ,KAAK,YAAYH,IAAIG,QAAQ,KAAK,SAAS,OAAOJ;IAClE,IAAI,CAACP,iBAAiBQ,IAAIP,QAAQ,GAAG,OAAOM;IAC5C,KAAK,MAAMK,WAAWb,eAAgB;YACzBa;QAAX,MAAMC,MAAKD,gBAAAA,QAAQE,IAAI,CAACN,IAAIO,QAAQ,sBAAzBH,aAA4B,CAAC,EAAE;QAC1C,IAAIC,MAAMf,UAAUkB,IAAI,CAACH,KAAK,OAAOA;IACvC;IACA,OAAON;AACT;AAEA;;;CAGC,GACD,OAAO,SAASU,eAAeX,KAAc;IAC3C,MAAMO,KAAKR,cAAcC;IACzB,OAAOO,KAAK,GAAGhB,qBAAqB,cAAc,EAAEgB,IAAI,GAAGN;AAC7D;AAoBA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASW,gBACdZ,KAAc,EACda,UAA+B,CAAC,CAAC;IAEjC,MAAMC,WAAWH,eAAeX;IAChC,IAAI,CAACc,UAAU,OAAOb;IACtB,MAAMc,SAAS,IAAIC,gBAAgB;QACjCC,UAAUJ,QAAQI,QAAQ,KAAK,QAAQ,UAAU;IACnD;IACA,IAAIJ,QAAQK,UAAU,EAAEH,OAAOI,GAAG,CAAC,cAAc;IACjD,IAAIN,QAAQO,KAAK,EAAEL,OAAOI,GAAG,CAAC,SAAS;IACvC,IAAIN,QAAQQ,IAAI,EAAEN,OAAOI,GAAG,CAAC,oBAAoB;IACjD,OAAO,GAAGL,SAAS,CAAC,EAAEC,OAAOO,QAAQ,IAAI;AAC3C"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/wistia-embed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Wistia video, as the Video element plays it (AGL-2826).\n *\n * ## Only the media id survives\n *\n * An author pastes whatever link Wistia showed them. That string never reaches\n * a frame: every builder below reads the media's hashed id out of it and\n * rebuilds the address, so the only frame this module can produce is on\n * {@link WISTIA_PLAYER_ORIGIN}. That closed set is what lets the tenant's\n * `frame-src` name the origin for every site, and it is the rule\n * `parseVideoEmbedSrc` already holds YouTube and Vimeo to.\n *\n * ## The iframe embed, not the player script\n *\n * Wistia offers two embeds. The script embed runs Wistia's JavaScript in the\n * page itself, so every site would need `connect-src`, `img-src` and\n * `media-src` grants for Wistia's hosts, and the player's storage and beacons\n * would run as the site. The iframe embed runs all of that inside a document on\n * Wistia's origin, under Wistia's own policy: the page needs one `frame-src`\n * entry, and whatever the player stores is keyed to Wistia inside the site's\n * partition rather than written as the site.\n *\n * Measured on 2026-09-10: `fast.wistia.net/embed/iframe/{id}` answers 200 with\n * no redirect, so no second origin is involved in loading the frame.\n */\n\n/** The only origin a Wistia player frame is ever loaded from. */\nexport const WISTIA_PLAYER_ORIGIN = 'https://fast.wistia.net'\n\n/** A hashed id: ten lowercase letters and digits, e.g. `e4a27b971d`. */\nconst HASHED_ID = /^[a-z0-9]{10}$/\n\n/**\n * The paths a Wistia link carries a media id in. Wistia's oEmbed endpoint\n * matches on the path rather than the host, and so does this; the host is\n * checked separately by {@link isWistiaHostname}.\n */\nconst MEDIA_ID_PATHS: readonly RegExp[] = [\n  // A media page: `https://acme.wistia.com/medias/{id}`, and its `/manage`.\n  /^\\/medias\\/([^/]+)(?:\\/manage)?\\/?$/,\n  // The short form of the same page.\n  /^\\/m\\/([^/]+)\\/?$/,\n  // An iframe embed's own address.\n  /^\\/embed\\/iframe\\/([^/]+)\\/?$/,\n  // A script embed's media address, with or without its `.jsonp` suffix.\n  /^\\/embed\\/medias\\/([^/.]+)(?:\\.jsonp?)?\\/?$/,\n]\n\n/**\n * Whether a hostname is Wistia's. Exact or dot-anchored matches only, so\n * `wistia.com.example.net` and `notwistia.com` are refused.\n */\nfunction isWistiaHostname(hostname: string): boolean {\n  return ['wistia.com', 'wistia.net', 'wi.st'].some(\n    (domain) => hostname === domain || hostname.endsWith(`.${domain}`),\n  )\n}\n\n/**\n * The hashed id a Wistia link names, or `undefined` for anything else.\n *\n * A share link (`/s/{slug}`) names no id and is refused rather than guessed\n * at, as is a value that is not an http(s) URL.\n */\nexport function wistiaMediaId(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined\n  let url: URL\n  try {\n    url = new URL(value.trim())\n  } catch {\n    return undefined\n  }\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined\n  if (!isWistiaHostname(url.hostname)) return undefined\n  for (const pattern of MEDIA_ID_PATHS) {\n    const id = pattern.exec(url.pathname)?.[1]\n    if (id && HASHED_ID.test(id)) return id\n  }\n  return undefined\n}\n\n/**\n * The player page for a Wistia link, with no per-visit options: what\n * `VideoObject.embedUrl` names.\n */\nexport function wistiaEmbedUrl(value: unknown): string | undefined {\n  const id = wistiaMediaId(value)\n  return id ? `${WISTIA_PLAYER_ORIGIN}/embed/iframe/${id}` : undefined\n}\n\nexport interface WistiaPlayerOptions {\n  /**\n   * Start playing as soon as the player is ready. On unless this is exactly\n   * `false`; see {@link wistiaPlayerSrc} for which frame turns it off.\n   */\n  autoPlay?: boolean\n  /**\n   * Ask Wistia not to record the viewing session (its `doNotTrack` embed\n   * option). The element sets it for every visitor whose analytics consent is\n   * not on record.\n   */\n  doNotTrack?: boolean\n  /** Start without sound. */\n  muted?: boolean\n  /** Restart at the end (`endVideoBehavior=loop`). */\n  loop?: boolean\n}\n\n/**\n * The address of a Wistia player frame.\n *\n * `autoPlay` is on by default, because the usual frame is the one a visitor's\n * press loads: it exists only because somebody pressed play, and a second play\n * button inside the player would ask them twice.\n *\n * The frame a page loads before anyone has pressed anything (\"Load the player\n * with the page\", AGL-2962) passes `autoPlay: false`. The address then says\n * `autoPlay=false` rather than leaving the option out: an option in the embed\n * overrides the media's own settings in the Wistia account, and those may be\n * set to autoplay.\n *\n * ## The corners belong to the page (AGL-3209)\n *\n * `roundedPlayer=false` is stated on every address, and is not an option a\n * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the\n * frame, where the document's own canvas is white: on a dark page the corner\n * arcs and the clip's antialiased edge composite as a white ring around the\n * film rather than as the page behind them.\n *\n * Measured on 2026-09-21 against the live videos page, whose background is\n * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column\n * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —\n * lighter than either, so painted rather than blended. With the option off\n * the same pixels are the film.\n *\n * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes\n * a `radius` from the element's own control and puts it on the frame, which a\n * second rounding inside the frame can only fight.\n */\nexport function wistiaPlayerSrc(\n  value: unknown,\n  options: WistiaPlayerOptions = {},\n): string | undefined {\n  const embedUrl = wistiaEmbedUrl(value)\n  if (!embedUrl) return undefined\n  const params = new URLSearchParams({\n    autoPlay: options.autoPlay === false ? 'false' : 'true',\n    roundedPlayer: 'false',\n  })\n  if (options.doNotTrack) params.set('doNotTrack', 'true')\n  if (options.muted) params.set('muted', 'true')\n  if (options.loop) params.set('endVideoBehavior', 'loop')\n  return `${embedUrl}?${params.toString()}`\n}\n"],"names":["WISTIA_PLAYER_ORIGIN","HASHED_ID","MEDIA_ID_PATHS","isWistiaHostname","hostname","some","domain","endsWith","wistiaMediaId","value","undefined","url","URL","trim","protocol","pattern","id","exec","pathname","test","wistiaEmbedUrl","wistiaPlayerSrc","options","embedUrl","params","URLSearchParams","autoPlay","roundedPlayer","doNotTrack","set","muted","loop","toString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,+DAA+D,GAC/D,OAAO,MAAMA,uBAAuB,0BAAyB;AAE7D,sEAAsE,GACtE,MAAMC,YAAY;AAElB;;;;CAIC,GACD,MAAMC,iBAAoC;IACxC,0EAA0E;IAC1E;IACA,mCAAmC;IACnC;IACA,iCAAiC;IACjC;IACA,uEAAuE;IACvE;CACD;AAED;;;CAGC,GACD,SAASC,iBAAiBC,QAAgB;IACxC,OAAO;QAAC;QAAc;QAAc;KAAQ,CAACC,IAAI,CAC/C,CAACC,SAAWF,aAAaE,UAAUF,SAASG,QAAQ,CAAC,CAAC,CAAC,EAAED,QAAQ;AAErE;AAEA;;;;;CAKC,GACD,OAAO,SAASE,cAAcC,KAAc;IAC1C,IAAI,OAAOA,UAAU,UAAU,OAAOC;IACtC,IAAIC;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIH,MAAMI,IAAI;IAC1B,EAAE,eAAM;QACN,OAAOH;IACT;IACA,IAAIC,IAAIG,QAAQ,KAAK,YAAYH,IAAIG,QAAQ,KAAK,SAAS,OAAOJ;IAClE,IAAI,CAACP,iBAAiBQ,IAAIP,QAAQ,GAAG,OAAOM;IAC5C,KAAK,MAAMK,WAAWb,eAAgB;YACzBa;QAAX,MAAMC,MAAKD,gBAAAA,QAAQE,IAAI,CAACN,IAAIO,QAAQ,sBAAzBH,aAA4B,CAAC,EAAE;QAC1C,IAAIC,MAAMf,UAAUkB,IAAI,CAACH,KAAK,OAAOA;IACvC;IACA,OAAON;AACT;AAEA;;;CAGC,GACD,OAAO,SAASU,eAAeX,KAAc;IAC3C,MAAMO,KAAKR,cAAcC;IACzB,OAAOO,KAAK,GAAGhB,qBAAqB,cAAc,EAAEgB,IAAI,GAAGN;AAC7D;AAoBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASW,gBACdZ,KAAc,EACda,UAA+B,CAAC,CAAC;IAEjC,MAAMC,WAAWH,eAAeX;IAChC,IAAI,CAACc,UAAU,OAAOb;IACtB,MAAMc,SAAS,IAAIC,gBAAgB;QACjCC,UAAUJ,QAAQI,QAAQ,KAAK,QAAQ,UAAU;QACjDC,eAAe;IACjB;IACA,IAAIL,QAAQM,UAAU,EAAEJ,OAAOK,GAAG,CAAC,cAAc;IACjD,IAAIP,QAAQQ,KAAK,EAAEN,OAAOK,GAAG,CAAC,SAAS;IACvC,IAAIP,QAAQS,IAAI,EAAEP,OAAOK,GAAG,CAAC,oBAAoB;IACjD,OAAO,GAAGN,SAAS,CAAC,EAAEC,OAAOQ,QAAQ,IAAI;AAC3C"}

package/src/lib/plugin-manager/enabled-plugins.d.ts

@@ -27,6 +27,35 @@
  * generated from; this module holds the row's shape and the resolvers.
  */
 import { FIRST_PARTY_PLUGINS, PUBLISHED_SITE_IMPACT } from './first-party-plugins.generated';
+/**
+ * One quick link on a live site's admin edit bar, declared by the plugin whose
+ * console page it opens (AGL-3080).
+ *
+ * The bar is drawn by the TENANT server, which never loads a plugin's console
+ * code, so this is DATA compiled from `plugins.config.json` rather than a
+ * runtime registration — a registry that process had not filled would drop the
+ * link silently instead of failing, which is the AGL-3025 shape. It is also
+ * why the label is written here rather than taken from the plugin's nav item:
+ * the nav item lives in the console bundle, and "Orders" is a section of
+ * Commerce rather than the plugin's own name.
+ *
+ * The link is drawn only where the SITE runs the plugin. The bar asks the same
+ * resolved plugin set the rest of the edit context is built from, so a site
+ * with Commerce switched off is not offered its Orders page.
+ */
+export interface PluginEditBarLink {
+    /** The plugin that owns the page — also the id the site's set is checked against. */
+    pluginId: string;
+    /** Where it sits in the bar; every declared order is distinct. */
+    order: number;
+    /** What the bar says. A SECTION's name where that is the honest one. */
+    label: string;
+    /**
+     * Console path beneath the site, beginning with `/` and carrying no query —
+     * `/inbox`, `/products/orders`. Joined onto `/{orgSlug}/hosts/{host}`.
+     */
+    path: string;
+}
 export interface FirstPartyPlugin {
     /**
      * Stable plugin id — persisted in `org.enabledPlugins`,
@@ -197,6 +226,21 @@ export declare const FORMS_PLUGIN_ID = "forms";
  * those bundles had not filled would read as every plugin switched OFF.
  */
 export { FIRST_PARTY_PLUGINS };
+/**
+ * The admin edit bar's quick links that THIS SITE runs, in the order the bar
+ * draws them (AGL-3080).
+ *
+ * `enabledPluginIds` is the site's resolved plugin set — the same one the rest
+ * of the edit context is built from, already narrowed by the org's switchboard,
+ * the site's own deny-list and the release flags. A link whose plugin is not
+ * in it is not offered, which is what stops the bar linking a site with
+ * Commerce switched off to its Orders page.
+ *
+ * Compiled in rather than registered, for the reason the catalog above is:
+ * the tenant server draws this bar and never loads a plugin's console code,
+ * so a registry it had not filled would drop every link with nothing red.
+ */
+export declare function pluginEditBarLinks(enabledPluginIds: readonly string[] | undefined): readonly PluginEditBarLink[];
 /** Ids loaded for orgs that have never touched the switchboard. */
 export declare const DEFAULT_ENABLED_PLUGINS: readonly string[];
 /**

package/src/lib/plugin-manager/enabled-plugins.js

@@ -24,7 +24,7 @@
  * The catalog's rows are declared by the plugins themselves, in
  * `plugins.config.json`, beside the package names the loader manifests are
  * generated from; this module holds the row's shape and the resolvers.
- */ import { FIRST_PARTY_PLUGINS, PUBLISHED_SITE_IMPACT } from "./first-party-plugins.generated.js";
+ */ import { FIRST_PARTY_PLUGINS, PLUGIN_EDIT_BAR_LINKS, PUBLISHED_SITE_IMPACT } from "./first-party-plugins.generated.js";
 /**
  * Every catalog id classified, from the `publishedSiteImpact` each plugin
  * declares on its own row. The generator refuses a row whose verdict
@@ -61,6 +61,23 @@
  * is synchronous and runs in each bundle of both apps; a registry that one of
  * those bundles had not filled would read as every plugin switched OFF.
  */ export { FIRST_PARTY_PLUGINS };
+/**
+ * The admin edit bar's quick links that THIS SITE runs, in the order the bar
+ * draws them (AGL-3080).
+ *
+ * `enabledPluginIds` is the site's resolved plugin set — the same one the rest
+ * of the edit context is built from, already narrowed by the org's switchboard,
+ * the site's own deny-list and the release flags. A link whose plugin is not
+ * in it is not offered, which is what stops the bar linking a site with
+ * Commerce switched off to its Orders page.
+ *
+ * Compiled in rather than registered, for the reason the catalog above is:
+ * the tenant server draws this bar and never loads a plugin's console code,
+ * so a registry it had not filled would drop every link with nothing red.
+ */ export function pluginEditBarLinks(enabledPluginIds) {
+    const enabled = new Set(enabledPluginIds != null ? enabledPluginIds : []);
+    return PLUGIN_EDIT_BAR_LINKS.filter((link)=>enabled.has(link.pluginId));
+}
 /** Ids loaded for orgs that have never touched the switchboard. */ export const DEFAULT_ENABLED_PLUGINS = FIRST_PARTY_PLUGINS.map((plugin)=>plugin.id);
 /**
  * The id a stored plugin id means today — the seam a rename re-arms.

package/src/lib/plugin-manager/enabled-plugins.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/enabled-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-org plugin enablement (AGL-416): `org.enabledPlugins` is the\n * switchboard that decides which plugins LOAD for a workspace — the loader\n * (AGL-417) dynamically imports only these. It composes with (not replaces)\n * the existing gates: a surface renders when its plugin is enabled AND its\n * `featureFlag` entitlement resolves; marketplace/marketplace listings keep\n * their per-host/org `installs` docs on top.\n *\n * The catalog's rows are declared by the plugins themselves, in\n * `plugins.config.json`, beside the package names the loader manifests are\n * generated from; this module holds the row's shape and the resolvers.\n */\n\nimport {\n  FIRST_PARTY_PLUGINS,\n  PUBLISHED_SITE_IMPACT,\n} from './first-party-plugins.generated'\n\nexport interface FirstPartyPlugin {\n  /**\n   * Stable plugin id — persisted in `org.enabledPlugins`,\n   * `host.disabledPlugins` and `host.enabledPlugins`, and the document id\n   * under every `pluginSettings` collection.\n   *\n   * Renaming one is therefore a data change, not a code change, and it is\n   * done in two halves that must both ship: the old id is read through\n   * {@link canonicalPluginId} so every stored list still resolves, and a\n   * backfill rewrites the stored documents so the alias can be retired once\n   * it reads nothing.\n   */\n  id: string\n  /** Console-facing display name. */\n  label: string\n  /**\n   * On for every workspace AND every site, with no switch anywhere: the base\n   * component library the canvas cannot render without.\n   */\n  alwaysOn?: boolean\n  /**\n   * On for every WORKSPACE, and switchable for one SITE (AGL-3028, AGL-3029).\n   *\n   * The workspace half is what `alwaysOn` gives: the id is unioned into the\n   * org's resolved set whatever `org.enabledPlugins` stores, so a list saved\n   * before the plugin existed still runs it, and no workspace switch is\n   * offered. The site half is ordinary: the id is subtracted by a site's\n   * `disabledPlugins` deny-list like any other, so an absent host field means\n   * ON and nothing needs migrating.\n   *\n   * It exists for capabilities whose workspace-level half must never stop.\n   * AI carries the add-on, credits, allotments and overage billing, none of\n   * which belongs to a site; Forms carries the catalog and the submissions\n   * already stored. A workspace switch would take those down with the\n   * site-facing half, so the only switch is the site's.\n   */\n  alwaysOnForWorkspace?: boolean\n  /**\n   * What switching this plugin off for ONE site stops, and what it leaves\n   * running (AGL-3028, AGL-3029) — the copy the site's Admin › Plugins page\n   * states beside the switch, so the decision is made knowing both halves.\n   *\n   * `confirm` makes the site switch ask before it applies, naming what it is\n   * about to break on published pages.\n   */\n  siteOff?: {\n    /** What stops on the site, stated as the consequence. */\n    stops: string\n    /** What keeps running, because it carries no site. */\n    keeps: string\n    /** Ask before applying. */\n    confirm?: boolean\n    /**\n     * How the confirmation names the site's published pages the switch\n     * reaches (AGL-3029): the sentence above the list, and the one that\n     * stands in for an empty list when the scan read everything.\n     */\n    pages?: { heading: string; none: string }\n  }\n  /** One-line description for the org-settings toggle list. */\n  description?: string\n  /**\n   * Release flag gating this plugin platform-wide (AGL-422). A flagged-off\n   * plugin is subtracted from every workspace's effective set — console\n   * loader, published sites, and API dispatch — unless the subject is\n   * staff. Always-on plugins carry no flag.\n   */\n  releaseFlag?: string\n  /**\n   * OFF for a site until that site turns it on (AGL-2486) — the inversion of\n   * this switchboard's default, and the only field here that changes what an\n   * absent host doc means.\n   *\n   * The per-host field is a DENY-list: a site records what it switches off,\n   * which makes \"absent means on\" the default for all twelve other bundles.\n   * That is right for a capability whose worst case is an unused nav tab, and\n   * wrong for one whose worst case is a PAGE — `/signin`, `/signup`,\n   * `/recover` were served by every published site on the platform,\n   * including marketing sites whose real sign-in is somewhere else entirely.\n   * A sign-in-shaped page on a brand's own domain that is not that brand's\n   * sign-in is a credential-confusion hazard, so this one defaults closed.\n   *\n   * A site un-defaults it by listing the id in `host.enabledPlugins`. That\n   * list is scoped to default-off ids and cannot widen anything else, so the\n   * AGL-1014 invariant survives intact: a site still can never reach past\n   * what its org enables.\n   */\n  defaultOffPerSite?: boolean\n  /**\n   * Plugin ids this one cannot function without (AGL-2486) — DECLARED, never\n   * inferred.\n   *\n   * The switchboard has always let a workspace turn off a plugin another one\n   * is built on, and said nothing. `accounts` is the case that proves it: the\n   * Members blocks and every `membership/*` API handler ship inside the\n   * COMMERCE bundle, so switching Commerce off leaves a site advertising\n   * `/signin` while nothing can answer the login POST.\n   *\n   * Declared rather than derived on purpose. The couplings that matter are\n   * exactly the ones no static read can see — which bundle happens to\n   * register whose components — so a graph inferred from imports or from the\n   * registry would miss the real edges while looking authoritative. An\n   * incomplete warning that presents itself as complete is worse than none,\n   * so this list is the contract, and {@link resolveDisableCascade} is honest\n   * about covering only what is on it.\n   */\n  requires?: readonly string[]\n}\n\n/**\n * What a DISABLE does to a site that is already published (AGL-2486).\n *\n * The cascade dialog has to state a consequence, and there are two very\n * different ones. \"These blocks will no longer be offered\" is a different\n * decision from \"parts of your live pages go blank\", and one generic sentence\n * for both would be a lie in one direction or the other.\n *\n * - `elements` — the plugin registers site components. The tenant loads only\n *   the site's enabled bundles, so elements ALREADY PLACED on published pages\n *   stop rendering. Pre-existing AGL-1014 behaviour.\n * - `routes`   — the plugin registers no components, but a published site\n *   stops serving something: `accounts` gates `/signin`, `/signup`,\n *   `/recover`; `redirects` stops applying its rules; `workflows` stops\n *   answering its hooks.\n * - `console-only` — nothing a visitor can reach changes; the plugin leaves\n *   navigation and the editor.\n */\nexport type PublishedSiteImpact = 'elements' | 'routes' | 'console-only'\n\n/**\n * Every catalog id classified, from the `publishedSiteImpact` each plugin\n * declares on its own row. The generator refuses a row whose verdict\n * disagrees with its `register.site`, so a site-registering bundle cannot be\n * added without declaring its consequence.\n */\nexport { PUBLISHED_SITE_IMPACT }\n\n/**\n * The user-accounts capability (AGL-2486): visitor sign-in, sign-up and\n * password recovery on a published site.\n *\n * It carries no loader manifest entry, and that is deliberate rather than an\n * oversight. The member blocks and the `membership/*` API handlers already\n * ship inside the commerce bundle, so there is no separate package to load;\n * what this id contributes is the SWITCH — the thing the tenant route gate,\n * the console card and the sitemap all ask. Several catalog ids already have\n * no tenant bundle (`contacts`, `data`, `logic`), so a manifest-less entry is\n * the existing shape, not a new one.\n */\nexport const ACCOUNTS_PLUGIN_ID = 'accounts'\n\n/**\n * The Forms capability's id, named in core (AGL-3029).\n *\n * A form's server half is core — `/api/forms/submit`, the publish-time\n * contract check, the published page's render — and core may not import a\n * plugin, so each asks the site's plugin set about this id rather than asking\n * the Forms plugin anything.\n */\nexport const FORMS_PLUGIN_ID = 'forms'\n\n/**\n * The switchboard catalog. The core holds no row of it: each plugin declares\n * its own in `plugins.config.json` (`catalog`, and one per `capabilities`\n * entry), and the generator compiles them here in their declared order, so\n * adding a plugin edits no core file.\n *\n * Compiled in rather than registered at runtime, because every resolver below\n * is synchronous and runs in each bundle of both apps; a registry that one of\n * those bundles had not filled would read as every plugin switched OFF.\n */\nexport { FIRST_PARTY_PLUGINS }\n\n/** Ids loaded for orgs that have never touched the switchboard. */\nexport const DEFAULT_ENABLED_PLUGINS: readonly string[] =\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id)\n\n/**\n * The id a stored plugin id means today — the seam a rename re-arms.\n *\n * A first-party id is written into every org's `enabledPlugins` and every\n * site's `disabledPlugins` the moment somebody touches the switchboard, so a\n * rename in this file alone would silently turn the plugin OFF for every\n * workspace that had listed it under the old name — the stored id would match\n * nothing in the catalog and fall through as a marketplace listing id. Every\n * reader of a stored list runs it through here first, so a document written\n * before a rename keeps meaning what it meant while the backfill runs.\n *\n * Nothing is aliased today. `contacts` read as `crm` from the CRM's rename\n * (AGL-2595) until its backfill reported zero documents carrying the old id,\n * and the alias was retired (AGL-2614) — an alias that outlives its backfill\n * is a second name for the plugin that nothing writes and every reader must\n * keep honoring. The next rename adds its pair here, ships a backfill over\n * `org.enabledPlugins`, `host.disabledPlugins`, `host.enabledPlugins` and the\n * `pluginSettings` document ids, and removes the pair the same way.\n */\nexport function canonicalPluginId(pluginId: string): string {\n  return pluginId\n}\n\n/** A stored list, read through the alias seam and de-duplicated. */\nfunction canonicalPluginIds(pluginIds: readonly unknown[]): string[] {\n  return Array.from(\n    new Set(pluginIds.map((id) => canonicalPluginId(String(id)))),\n  )\n}\n\n/** On everywhere, a site's deny-list included: the base component library. */\nconst ALWAYS_ON: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn,\n).map((plugin) => plugin.id)\n\n/**\n * Unioned into every workspace's set whatever the org stored: {@link ALWAYS_ON}\n * plus the ids that are on for every workspace and switchable per site.\n */\nconst ALWAYS_ON_FOR_WORKSPACE: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn || plugin.alwaysOnForWorkspace,\n).map((plugin) => plugin.id)\n\n/**\n * Whether the WORKSPACE switch for this plugin is locked on (AGL-3028): the\n * base library, and every plugin that is on for every workspace and\n * switchable only per site. The org switchboard renders these on and inert.\n */\nexport function isLockedOnForWorkspace(pluginId: string): boolean {\n  return ALWAYS_ON_FOR_WORKSPACE.includes(pluginId)\n}\n\n/**\n * Whether the SITE switch for this plugin is locked on: the base library\n * alone. Every other plugin a workspace runs can be switched off for one site.\n */\nexport function isLockedOnForSite(pluginId: string): boolean {\n  return ALWAYS_ON.includes(pluginId)\n}\n\nconst FIRST_PARTY_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n)\n\n/**\n * Ids a SITE does not get until it asks (AGL-2486). See\n * {@link FirstPartyPlugin.defaultOffPerSite} for why this inversion exists.\n */\nexport const DEFAULT_OFF_PER_SITE_PLUGIN_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.filter((plugin) => plugin.defaultOffPerSite).map(\n    (plugin) => plugin.id,\n  ),\n)\n\n/** Whether a plugin id is off for a site until that site opts in. */\nexport function isDefaultOffPerSite(pluginId: string): boolean {\n  return DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(pluginId)\n}\n\n/**\n * Applies a host's `enabledPlugins` OPT-IN list (AGL-2486): subtracts every\n * default-off id the host has not explicitly asked for.\n *\n * Narrow-only, like its deny-list sibling. The list can only ever REMOVE the\n * default-off subtraction for an id the org already enables — listing an\n * ordinary id buys nothing, and listing one the org switched off buys\n * nothing either, because this runs against the org's resolved set.\n */\nexport function applyDefaultOffOptIn(\n  pluginIds: readonly string[],\n  optedIn?: readonly string[] | null,\n): string[] {\n  if (!DEFAULT_OFF_PER_SITE_PLUGIN_IDS.size) return [...pluginIds]\n  const asked = new Set(\n    Array.isArray(optedIn) ? canonicalPluginIds(optedIn) : [],\n  )\n  return pluginIds.filter(\n    (id) => !DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(id) || asked.has(id),\n  )\n}\n\n/**\n * Whether an `enabledPlugins` id is a first-party BUNDLE (vs a marketplace\n * listing id) — AGL-777. `enabledPlugins` is a flat mix of the two: bundle\n * ids are the short, stable names in {@link FIRST_PARTY_PLUGINS}; marketplace\n * installs ride the same field under their Firestore listing doc id. This is\n * the single classifier both writers and readers use so the two kinds never\n * get confused — e.g. an install sync must never add/remove a bundle id.\n */\nexport function isFirstPartyPlugin(pluginId: string): boolean {\n  return FIRST_PARTY_IDS.has(pluginId)\n}\n\n/**\n * Splits a mixed `enabledPlugins` array into first-party bundle ids and\n * marketplace listing ids (AGL-777). The field stays a single flat list;\n * this just names the two kinds for callers that need to treat them apart.\n */\nexport function classifyEnabledPlugins(pluginIds: readonly string[]): {\n  bundles: string[]\n  listings: string[]\n} {\n  const bundles: string[] = []\n  const listings: string[] = []\n  for (const id of pluginIds) {\n    if (isFirstPartyPlugin(id)) bundles.push(id)\n    else listings.push(id)\n  }\n  return { bundles, listings }\n}\n\n/**\n * The org's effective enabled-plugin set. Absent field → every first-party\n * plugin (existing orgs keep working untouched); always-on ids — and the ids\n * that are on for every workspace and switchable only per site — are unioned\n * in, so no stored list can switch them off for a workspace, including one\n * saved before the plugin existed. Unknown ids are kept — realm-trusted\n * marketplace plugins (AGL-420) ride the same field.\n */\nexport function resolveEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n): string[] {\n  const configured = org?.enabledPlugins\n  const base = Array.isArray(configured)\n    ? canonicalPluginIds(configured)\n    : [...DEFAULT_ENABLED_PLUGINS]\n  return Array.from(new Set([...ALWAYS_ON_FOR_WORKSPACE, ...base]))\n}\n\n/**\n * Subtracts a host's per-site deny-list from an enabled set (AGL-1014).\n * Always-on ids survive — the base component library cannot be switched\n * off per site any more than per org. A plugin that is on for every\n * workspace (`alwaysOnForWorkspace`) does NOT survive: its site switch is\n * the one switch it has. Order of the surviving ids is kept.\n */\nexport function subtractDisabledPlugins(\n  pluginIds: readonly string[],\n  disabledPlugins?: readonly string[] | null,\n): string[] {\n  if (!Array.isArray(disabledPlugins) || !disabledPlugins.length)\n    return [...pluginIds]\n  const disabled = new Set(canonicalPluginIds(disabledPlugins))\n  return pluginIds.filter(\n    (id) => ALWAYS_ON.includes(id) || !disabled.has(id),\n  )\n}\n\n/**\n * A HOST's effective enabled-plugin set (AGL-1014): the org's resolved set\n * minus the host's `disabledPlugins` deny-list. This is the single source\n * of truth for per-site enablement — console navigation, the editor,\n * published sites, and API dispatch must all read it, or a \"disabled\"\n * plugin is merely hidden, not off.\n *\n * Semantics are narrow-only by construction: a host stores what it turns\n * OFF, so it can never widen beyond what the org enables, and an absent\n * field means every org-enabled plugin runs (newly installed plugins\n * default to enabled per site until a host admin disables them).\n *\n * ONE class of id reads the other way (AGL-2486): a `defaultOffPerSite`\n * plugin is subtracted unless the host names it in `enabledPlugins`. That\n * list un-defaults; it does not grant. Both fields are still bounded by the\n * org's set, and an explicit deny still beats an explicit opt-in — the two\n * are applied in that order below, so the safe reading wins whenever a\n * hand-edited or stale doc sets both.\n */\nexport function resolveHostEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n  host?: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null,\n): string[] {\n  return subtractDisabledPlugins(\n    applyDefaultOffOptIn(resolveEnabledPlugins(org), host?.enabledPlugins),\n    host?.disabledPlugins,\n  )\n}\n\n/**\n * Whether ONE plugin runs on this site — the host-aware counterpart of\n * {@link isPluginEnabled}, and the form every route gate wants.\n */\nexport function isHostPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveHostEnabledPlugins(org, host).includes(pluginId)\n}\n\nexport function isPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveEnabledPlugins(org).includes(pluginId)\n}\n\n/**\n * Where one plugin stands ON ONE SITE (AGL-1014, AGL-2486).\n *\n * Three surfaces need this answer and they must not each derive it: the site\n * plugin page's \"Where it runs\" card, that page's dependency list — where the\n * same question is asked about a NEIGHBOR, and where the answer is the whole\n * point, because a dependency the workspace enables and this site has switched\n * off is a broken plugin behind a healthy-looking workspace page — and the\n * per-site switchboard. A second derivation is a second chance to disagree\n * with `resolveHostEnabledPlugins`, which is what actually runs.\n *\n * - `always-on`         — the base library; it cannot be switched off anywhere.\n *                         A plugin that is on for every workspace but\n *                         switchable per site is NOT this: it reads\n *                         `runs-here` or `off-for-site` like any other.\n * - `off-for-workspace` — the org has it off, so it runs on none of its sites\n *                         and this site cannot turn it on.\n * - `runs-here`         — the effective host set contains it.\n * - `awaiting-opt-in`   — a `defaultOffPerSite` plugin the org enables and\n *                         this site has not asked for. Off, but off by\n *                         DEFAULT rather than by a decision, which is a\n *                         different thing to tell an operator.\n * - `off-for-site`      — the org enables it and this site switched it off.\n */\nexport type PluginSiteState =\n  | 'always-on'\n  | 'off-for-workspace'\n  | 'runs-here'\n  | 'awaiting-opt-in'\n  | 'off-for-site'\n\nexport function resolvePluginSiteState(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): PluginSiteState {\n  if (ALWAYS_ON.includes(pluginId)) return 'always-on'\n  if (!resolveEnabledPlugins(org).includes(pluginId)) return 'off-for-workspace'\n  if (resolveHostEnabledPlugins(org, host).includes(pluginId)) return 'runs-here'\n  // A default-off plugin this site has not named is off because nobody asked\n  // for it; naming it in the deny-list is a decision, and an explicit deny\n  // beats an opt-in, so the deny-list is checked first.\n  const denied = Array.isArray(host?.disabledPlugins)\n    ? host.disabledPlugins.map(String).includes(pluginId)\n    : false\n  return !denied && isDefaultOffPerSite(pluginId)\n    ? 'awaiting-opt-in'\n    : 'off-for-site'\n}\n\n/**\n * The declared dependency graph, both directions, built once (AGL-2486).\n *\n * `requires` on the catalog is the forward edge — what a plugin cannot run\n * without — and every consumer so far wanted the reverse one. Building both\n * here keeps the cascade, the console's dependency card and the server-side\n * refusal reading the SAME edges: a graph assembled a second time is a graph\n * that can disagree with itself about which plugins are coupled, and the\n * disagreement would show up as a warning shown on one surface and not on the\n * one that writes.\n *\n * `extraRequirements` extends the catalog and cannot shrink it, exactly as it\n * does for {@link resolveDisableCascade} — a third-party id can add edges of\n * its own but can never declare away a first-party one.\n */\nfunction dependencyEdges(\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): {\n  /** Keyed by a required id; holds the ids that depend on it. */\n  dependents: Map<string, string[]>\n  /** Keyed by a dependent id; holds the ids it requires. */\n  requires: Map<string, string[]>\n} {\n  const dependents = new Map<string, string[]>()\n  const requires = new Map<string, string[]>()\n  const addEdge = (dependent: string, required: string) => {\n    const reverse = dependents.get(required)\n    if (reverse) reverse.push(dependent)\n    else dependents.set(required, [dependent])\n    const forward = requires.get(dependent)\n    if (forward) forward.push(required)\n    else requires.set(dependent, [required])\n  }\n  for (const plugin of FIRST_PARTY_PLUGINS)\n    for (const required of plugin.requires ?? []) addEdge(plugin.id, required)\n  for (const [dependent, required] of Object.entries(extraRequirements ?? {}))\n    for (const one of required ?? []) addEdge(dependent, String(one))\n  return { dependents, requires }\n}\n\n/** What `pluginId` declares it cannot run without — DIRECT edges only. */\nexport function pluginRequirements(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).requires.get(pluginId) ?? [])]\n}\n\n/** What declares it cannot run without `pluginId` — DIRECT edges only. */\nexport function pluginDependents(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).dependents.get(pluginId) ?? [])]\n}\n\n/**\n * Which of `enabledIds` would be left running with a requirement switched off\n * (AGL-2486) — the same question the cascade dialog asks, phrased so a WRITER\n * can refuse instead of a reader warning.\n *\n * The dialog is a courtesy: it stands in front of the console's own switches\n * and nothing else. A direct API call, a stale tab that posts an older set, or\n * a second console surface that forgot to ask can still store a set where\n * User Accounts is on and the Commerce bundle that answers its sign-in POST is\n * not. This is what a write path calls to reject that set outright, so the\n * boundary does not live in a dialog anyone can skip.\n *\n * Only DECLARED requirements are checked, with the same limit\n * {@link PLUGIN_CASCADE_IS_DECLARED_ONLY} states: an undeclared coupling is\n * invisible here too. A requirement naming an id outside the catalog is\n * ignored rather than treated as unmet — a stale edge must not lock a\n * workspace out of its own switchboard.\n */\nexport function strandedDependents(\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): Array<{ pluginId: string; missing: string[] }> {\n  const enabled = new Set(enabledIds.map(String))\n  const known = new Set<string>([\n    ...FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n    ...enabled,\n  ])\n  const { requires } = dependencyEdges(extraRequirements)\n  const stranded: Array<{ pluginId: string; missing: string[] }> = []\n  for (const pluginId of enabled) {\n    const missing = (requires.get(pluginId) ?? []).filter(\n      (required) => known.has(required) && !enabled.has(required),\n    )\n    if (missing.length) stranded.push({ pluginId, missing })\n  }\n  return stranded\n}\n\n/**\n * Everything that must ALSO be switched off when `pluginId` is (AGL-2486) —\n * the transitive closure over reverse `requires` edges, restricted to what is\n * currently on.\n *\n * Pure and surface-agnostic: the org switchboard and the per-site card both\n * call it with their own \"currently enabled\" set, so the same graph answers\n * both, and the org's wider blast radius comes from the set it passes, not\n * from a second implementation.\n *\n * `extraRequirements` is how a marketplace listing joins the graph. Third-party\n * ids ride the same `enabledPlugins` field, so a listing whose manifest\n * declares `requires` is cascaded exactly like a bundle. It EXTENDS the\n * catalog graph and cannot shrink it — a listing cannot declare away a\n * first-party edge.\n *\n * ⚠️ The result is only ever as complete as what has been DECLARED. A\n * marketplace plugin that uses first-party components without saying so in its\n * manifest will not appear here, and callers must not present the list as\n * exhaustive. See `PLUGIN_CASCADE_IS_DECLARED_ONLY`.\n */\nexport function resolveDisableCascade(\n  pluginId: string,\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  const enabled = new Set(enabledIds.map(String))\n  const dependents = dependencyEdges(extraRequirements).dependents\n\n  // Breadth-first over reverse edges. `seen` is seeded with the origin so a\n  // cycle back to it terminates and the plugin being disabled is never listed\n  // among its own dependents.\n  const seen = new Set<string>([pluginId])\n  const cascade: string[] = []\n  const queue: string[] = [pluginId]\n  while (queue.length) {\n    const current = queue.shift() as string\n    for (const dependent of dependents.get(current) ?? []) {\n      if (seen.has(dependent)) continue\n      seen.add(dependent)\n      // Walk THROUGH an already-off dependent — something may depend on it in\n      // turn — but do not claim it is being turned off.\n      if (enabled.has(dependent)) cascade.push(dependent)\n      queue.push(dependent)\n    }\n  }\n  return cascade\n}\n\n/**\n * Why the cascade list must never be presented as exhaustive (AGL-2486).\n *\n * Exported as copy rather than left to each caller to paraphrase: the whole\n * value of the warning rests on it being honest about its own limits, and two\n * surfaces wording that differently is how one of them ends up overclaiming.\n *\n * It says built-in ONLY, and that is the current truth rather than a hedge.\n * `PluginManifest` carries no `requires` field, so a publisher cannot declare\n * a dependency even if they want to, and `extraRequirements` above — the seam\n * that would carry them — is supplied by nothing outside tests. An earlier\n * draft said \"a plugin that uses this one WITHOUT declaring it cannot be\n * detected\", which quietly implied declaring was possible and would have made\n * this the exact overclaiming warning it exists to avoid. Adding the manifest\n * field is a separate change: it needs a publish form, validation and a line\n * on the install screen, or it is a field written by nobody and read by\n * nothing. Update this sentence in the same change, not before.\n */\nexport const PLUGIN_CASCADE_IS_DECLARED_ONLY =\n  'This covers built-in plugins only. A marketplace plugin has no way to ' +\n  'declare that it depends on another one yet, so none are listed here — ' +\n  'check any third-party plugins you rely on before continuing.'\n\n/** Reverse lookup: which first-party plugin a release flag gates, if any. */\nexport function pluginForReleaseFlag(\n  flagKey: string,\n): FirstPartyPlugin | undefined {\n  return FIRST_PARTY_PLUGINS.find((plugin) => plugin.releaseFlag === flagKey)\n}\n\n/**\n * Subtracts release-flagged-off plugins from an effective set (AGL-422).\n * Pure — the caller supplies the verdict source (client: the activated\n * Remote Config hook state; server: the cached admin-SDK template read),\n * so the same policy runs identically on every surface:\n *\n * - unknown ids (marketplace/realm installs) and always-on ids pass;\n * - a first-party id with a `releaseFlag` passes only when the flag is on\n *   for the subject, or `staffBypass` is set (staff preview keeps working\n *   while a feature is dark).\n */\nexport function filterPluginsByReleaseFlags(\n  pluginIds: readonly string[],\n  isFlagOn: (flagKey: string) => boolean,\n  options?: { staffBypass?: boolean },\n): string[] {\n  if (options?.staffBypass) return [...pluginIds]\n  const catalog = new Map(\n    FIRST_PARTY_PLUGINS.map((plugin) => [plugin.id, plugin]),\n  )\n  return pluginIds.filter((pluginId) => {\n    const plugin = catalog.get(pluginId)\n    if (!plugin?.releaseFlag || plugin.alwaysOn) return true\n    return isFlagOn(plugin.releaseFlag)\n  })\n}\n"],"names":["FIRST_PARTY_PLUGINS","PUBLISHED_SITE_IMPACT","ACCOUNTS_PLUGIN_ID","FORMS_PLUGIN_ID","DEFAULT_ENABLED_PLUGINS","map","plugin","id","canonicalPluginId","pluginId","canonicalPluginIds","pluginIds","Array","from","Set","String","ALWAYS_ON","filter","alwaysOn","ALWAYS_ON_FOR_WORKSPACE","alwaysOnForWorkspace","isLockedOnForWorkspace","includes","isLockedOnForSite","FIRST_PARTY_IDS","DEFAULT_OFF_PER_SITE_PLUGIN_IDS","defaultOffPerSite","isDefaultOffPerSite","has","applyDefaultOffOptIn","optedIn","size","asked","isArray","isFirstPartyPlugin","classifyEnabledPlugins","bundles","listings","push","resolveEnabledPlugins","org","configured","enabledPlugins","base","subtractDisabledPlugins","disabledPlugins","length","disabled","resolveHostEnabledPlugins","host","isHostPluginEnabled","isPluginEnabled","resolvePluginSiteState","denied","dependencyEdges","extraRequirements","dependents","Map","requires","addEdge","dependent","required","reverse","get","set","forward","Object","entries","one","pluginRequirements","pluginDependents","strandedDependents","enabledIds","enabled","known","stranded","missing","resolveDisableCascade","seen","cascade","queue","current","shift","add","PLUGIN_CASCADE_IS_DECLARED_ONLY","pluginForReleaseFlag","flagKey","find","releaseFlag","filterPluginsByReleaseFlags","isFlagOn","options","staffBypass","catalog"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,SACEA,mBAAmB,EACnBC,qBAAqB,QAChB,qCAAiC;AAmIxC;;;;;CAKC,GACD,SAASA,qBAAqB,GAAE;AAEhC;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,qBAAqB,WAAU;AAE5C;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,QAAO;AAEtC;;;;;;;;;CASC,GACD,SAASH,mBAAmB,GAAE;AAE9B,iEAAiE,GACjE,OAAO,MAAMI,0BACXJ,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE,EAAC;AAEhD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASC,kBAAkBC,QAAgB;IAChD,OAAOA;AACT;AAEA,kEAAkE,GAClE,SAASC,mBAAmBC,SAA6B;IACvD,OAAOC,MAAMC,IAAI,CACf,IAAIC,IAAIH,UAAUN,GAAG,CAAC,CAACE,KAAOC,kBAAkBO,OAAOR;AAE3D;AAEA,4EAA4E,GAC5E,MAAMS,YAA+BhB,oBAAoBiB,MAAM,CAC7D,CAACX,SAAWA,OAAOY,QAAQ,EAC3Bb,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;CAGC,GACD,MAAMY,0BAA6CnB,oBAAoBiB,MAAM,CAC3E,CAACX,SAAWA,OAAOY,QAAQ,IAAIZ,OAAOc,oBAAoB,EAC1Df,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;;CAIC,GACD,OAAO,SAASc,uBAAuBZ,QAAgB;IACrD,OAAOU,wBAAwBG,QAAQ,CAACb;AAC1C;AAEA;;;CAGC,GACD,OAAO,SAASc,kBAAkBd,QAAgB;IAChD,OAAOO,UAAUM,QAAQ,CAACb;AAC5B;AAEA,MAAMe,kBAAuC,IAAIV,IAC/Cd,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAG/C;;;CAGC,GACD,OAAO,MAAMkB,kCAAuD,IAAIX,IACtEd,oBAAoBiB,MAAM,CAAC,CAACX,SAAWA,OAAOoB,iBAAiB,EAAErB,GAAG,CAClE,CAACC,SAAWA,OAAOC,EAAE,GAExB;AAED,mEAAmE,GACnE,OAAO,SAASoB,oBAAoBlB,QAAgB;IAClD,OAAOgB,gCAAgCG,GAAG,CAACnB;AAC7C;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASoB,qBACdlB,SAA4B,EAC5BmB,OAAkC;IAElC,IAAI,CAACL,gCAAgCM,IAAI,EAAE,OAAO;WAAIpB;KAAU;IAChE,MAAMqB,QAAQ,IAAIlB,IAChBF,MAAMqB,OAAO,CAACH,WAAWpB,mBAAmBoB,WAAW,EAAE;IAE3D,OAAOnB,UAAUM,MAAM,CACrB,CAACV,KAAO,CAACkB,gCAAgCG,GAAG,CAACrB,OAAOyB,MAAMJ,GAAG,CAACrB;AAElE;AAEA;;;;;;;CAOC,GACD,OAAO,SAAS2B,mBAAmBzB,QAAgB;IACjD,OAAOe,gBAAgBI,GAAG,CAACnB;AAC7B;AAEA;;;;CAIC,GACD,OAAO,SAAS0B,uBAAuBxB,SAA4B;IAIjE,MAAMyB,UAAoB,EAAE;IAC5B,MAAMC,WAAqB,EAAE;IAC7B,KAAK,MAAM9B,MAAMI,UAAW;QAC1B,IAAIuB,mBAAmB3B,KAAK6B,QAAQE,IAAI,CAAC/B;aACpC8B,SAASC,IAAI,CAAC/B;IACrB;IACA,OAAO;QAAE6B;QAASC;IAAS;AAC7B;AAEA;;;;;;;CAOC,GACD,OAAO,SAASE,sBACdC,GAA0C;IAE1C,MAAMC,aAAaD,uBAAAA,IAAKE,cAAc;IACtC,MAAMC,OAAO/B,MAAMqB,OAAO,CAACQ,cACvB/B,mBAAmB+B,cACnB;WAAIrC;KAAwB;IAChC,OAAOQ,MAAMC,IAAI,CAAC,IAAIC,IAAI;WAAIK;WAA4BwB;KAAK;AACjE;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,wBACdjC,SAA4B,EAC5BkC,eAA0C;IAE1C,IAAI,CAACjC,MAAMqB,OAAO,CAACY,oBAAoB,CAACA,gBAAgBC,MAAM,EAC5D,OAAO;WAAInC;KAAU;IACvB,MAAMoC,WAAW,IAAIjC,IAAIJ,mBAAmBmC;IAC5C,OAAOlC,UAAUM,MAAM,CACrB,CAACV,KAAOS,UAAUM,QAAQ,CAACf,OAAO,CAACwC,SAASnB,GAAG,CAACrB;AAEpD;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASyC,0BACdR,GAA0C,EAC1CS,IAAuE;IAEvE,OAAOL,wBACLf,qBAAqBU,sBAAsBC,MAAMS,wBAAAA,KAAMP,cAAc,GACrEO,wBAAAA,KAAMJ,eAAe;AAEzB;AAEA;;;CAGC,GACD,OAAO,SAASK,oBACdV,GAAqD,EACrDS,IAAkF,EAClFxC,QAAgB;IAEhB,OAAOuC,0BAA0BR,KAAKS,MAAM3B,QAAQ,CAACb;AACvD;AAEA,OAAO,SAAS0C,gBACdX,GAAqD,EACrD/B,QAAgB;IAEhB,OAAO8B,sBAAsBC,KAAKlB,QAAQ,CAACb;AAC7C;AAiCA,OAAO,SAAS2C,uBACdZ,GAAqD,EACrDS,IAAkF,EAClFxC,QAAgB;IAEhB,IAAIO,UAAUM,QAAQ,CAACb,WAAW,OAAO;IACzC,IAAI,CAAC8B,sBAAsBC,KAAKlB,QAAQ,CAACb,WAAW,OAAO;IAC3D,IAAIuC,0BAA0BR,KAAKS,MAAM3B,QAAQ,CAACb,WAAW,OAAO;IACpE,2EAA2E;IAC3E,yEAAyE;IACzE,sDAAsD;IACtD,MAAM4C,SAASzC,MAAMqB,OAAO,CAACgB,wBAAAA,KAAMJ,eAAe,IAC9CI,KAAKJ,eAAe,CAACxC,GAAG,CAACU,QAAQO,QAAQ,CAACb,YAC1C;IACJ,OAAO,CAAC4C,UAAU1B,oBAAoBlB,YAClC,oBACA;AACN;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAAS6C,gBACPC,iBAA+D;QAkBtCjD;IAXzB,MAAMkD,aAAa,IAAIC;IACvB,MAAMC,WAAW,IAAID;IACrB,MAAME,UAAU,CAACC,WAAmBC;QAClC,MAAMC,UAAUN,WAAWO,GAAG,CAACF;QAC/B,IAAIC,SAASA,QAAQxB,IAAI,CAACsB;aACrBJ,WAAWQ,GAAG,CAACH,UAAU;YAACD;SAAU;QACzC,MAAMK,UAAUP,SAASK,GAAG,CAACH;QAC7B,IAAIK,SAASA,QAAQ3B,IAAI,CAACuB;aACrBH,SAASM,GAAG,CAACJ,WAAW;YAACC;SAAS;IACzC;IACA,KAAK,MAAMvD,UAAUN,oBACnB,KAAK,MAAM6D,aAAYvD,mBAAAA,OAAOoD,QAAQ,YAAfpD,mBAAmB,EAAE,CAAEqD,QAAQrD,OAAOC,EAAE,EAAEsD;IACnE,KAAK,MAAM,CAACD,WAAWC,SAAS,IAAIK,OAAOC,OAAO,CAACZ,4BAAAA,oBAAqB,CAAC,GACvE,KAAK,MAAMa,OAAOP,mBAAAA,WAAY,EAAE,CAAEF,QAAQC,WAAW7C,OAAOqD;IAC9D,OAAO;QAAEZ;QAAYE;IAAS;AAChC;AAEA,wEAAwE,GACxE,OAAO,SAASW,mBACd5D,QAAgB,EAChB8C,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,gCAAAA,gBAAgBC,mBAAmBG,QAAQ,CAACK,GAAG,CAACtD,qBAAhD6C,gCAA6D,EAAE;KAAE;AAC/E;AAEA,wEAAwE,GACxE,OAAO,SAASgB,iBACd7D,QAAgB,EAChB8C,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,kCAAAA,gBAAgBC,mBAAmBC,UAAU,CAACO,GAAG,CAACtD,qBAAlD6C,kCAA+D,EAAE;KAAE;AACjF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASiB,mBACdC,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMkB,UAAU,IAAI3D,IAAI0D,WAAWnE,GAAG,CAACU;IACvC,MAAM2D,QAAQ,IAAI5D,IAAY;WACzBd,oBAAoBK,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;WAC7CkE;KACJ;IACD,MAAM,EAAEf,QAAQ,EAAE,GAAGJ,gBAAgBC;IACrC,MAAMoB,WAA2D,EAAE;IACnE,KAAK,MAAMlE,YAAYgE,QAAS;YACbf;QAAjB,MAAMkB,UAAU,EAAClB,gBAAAA,SAASK,GAAG,CAACtD,qBAAbiD,gBAA0B,EAAE,EAAEzC,MAAM,CACnD,CAAC4C,WAAaa,MAAM9C,GAAG,CAACiC,aAAa,CAACY,QAAQ7C,GAAG,CAACiC;QAEpD,IAAIe,QAAQ9B,MAAM,EAAE6B,SAASrC,IAAI,CAAC;YAAE7B;YAAUmE;QAAQ;IACxD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASE,sBACdpE,QAAgB,EAChB+D,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMkB,UAAU,IAAI3D,IAAI0D,WAAWnE,GAAG,CAACU;IACvC,MAAMyC,aAAaF,gBAAgBC,mBAAmBC,UAAU;IAEhE,0EAA0E;IAC1E,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAMsB,OAAO,IAAIhE,IAAY;QAACL;KAAS;IACvC,MAAMsE,UAAoB,EAAE;IAC5B,MAAMC,QAAkB;QAACvE;KAAS;IAClC,MAAOuE,MAAMlC,MAAM,CAAE;YAEKU;QADxB,MAAMyB,UAAUD,MAAME,KAAK;QAC3B,KAAK,MAAMtB,cAAaJ,kBAAAA,WAAWO,GAAG,CAACkB,oBAAfzB,kBAA2B,EAAE,CAAE;YACrD,IAAIsB,KAAKlD,GAAG,CAACgC,YAAY;YACzBkB,KAAKK,GAAG,CAACvB;YACT,wEAAwE;YACxE,kDAAkD;YAClD,IAAIa,QAAQ7C,GAAG,CAACgC,YAAYmB,QAAQzC,IAAI,CAACsB;YACzCoB,MAAM1C,IAAI,CAACsB;QACb;IACF;IACA,OAAOmB;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMK,kCACX,2EACA,2EACA,+DAA8D;AAEhE,2EAA2E,GAC3E,OAAO,SAASC,qBACdC,OAAe;IAEf,OAAOtF,oBAAoBuF,IAAI,CAAC,CAACjF,SAAWA,OAAOkF,WAAW,KAAKF;AACrE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,4BACd9E,SAA4B,EAC5B+E,QAAsC,EACtCC,OAAmC;IAEnC,IAAIA,2BAAAA,QAASC,WAAW,EAAE,OAAO;WAAIjF;KAAU;IAC/C,MAAMkF,UAAU,IAAIpC,IAClBzD,oBAAoBK,GAAG,CAAC,CAACC,SAAW;YAACA,OAAOC,EAAE;YAAED;SAAO;IAEzD,OAAOK,UAAUM,MAAM,CAAC,CAACR;QACvB,MAAMH,SAASuF,QAAQ9B,GAAG,CAACtD;QAC3B,IAAI,EAACH,0BAAAA,OAAQkF,WAAW,KAAIlF,OAAOY,QAAQ,EAAE,OAAO;QACpD,OAAOwE,SAASpF,OAAOkF,WAAW;IACpC;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/enabled-plugins.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Per-org plugin enablement (AGL-416): `org.enabledPlugins` is the\n * switchboard that decides which plugins LOAD for a workspace — the loader\n * (AGL-417) dynamically imports only these. It composes with (not replaces)\n * the existing gates: a surface renders when its plugin is enabled AND its\n * `featureFlag` entitlement resolves; marketplace/marketplace listings keep\n * their per-host/org `installs` docs on top.\n *\n * The catalog's rows are declared by the plugins themselves, in\n * `plugins.config.json`, beside the package names the loader manifests are\n * generated from; this module holds the row's shape and the resolvers.\n */\n\nimport {\n  FIRST_PARTY_PLUGINS,\n  PLUGIN_EDIT_BAR_LINKS,\n  PUBLISHED_SITE_IMPACT,\n} from './first-party-plugins.generated'\n\n/**\n * One quick link on a live site's admin edit bar, declared by the plugin whose\n * console page it opens (AGL-3080).\n *\n * The bar is drawn by the TENANT server, which never loads a plugin's console\n * code, so this is DATA compiled from `plugins.config.json` rather than a\n * runtime registration — a registry that process had not filled would drop the\n * link silently instead of failing, which is the AGL-3025 shape. It is also\n * why the label is written here rather than taken from the plugin's nav item:\n * the nav item lives in the console bundle, and \"Orders\" is a section of\n * Commerce rather than the plugin's own name.\n *\n * The link is drawn only where the SITE runs the plugin. The bar asks the same\n * resolved plugin set the rest of the edit context is built from, so a site\n * with Commerce switched off is not offered its Orders page.\n */\nexport interface PluginEditBarLink {\n  /** The plugin that owns the page — also the id the site's set is checked against. */\n  pluginId: string\n  /** Where it sits in the bar; every declared order is distinct. */\n  order: number\n  /** What the bar says. A SECTION's name where that is the honest one. */\n  label: string\n  /**\n   * Console path beneath the site, beginning with `/` and carrying no query —\n   * `/inbox`, `/products/orders`. Joined onto `/{orgSlug}/hosts/{host}`.\n   */\n  path: string\n}\n\nexport interface FirstPartyPlugin {\n  /**\n   * Stable plugin id — persisted in `org.enabledPlugins`,\n   * `host.disabledPlugins` and `host.enabledPlugins`, and the document id\n   * under every `pluginSettings` collection.\n   *\n   * Renaming one is therefore a data change, not a code change, and it is\n   * done in two halves that must both ship: the old id is read through\n   * {@link canonicalPluginId} so every stored list still resolves, and a\n   * backfill rewrites the stored documents so the alias can be retired once\n   * it reads nothing.\n   */\n  id: string\n  /** Console-facing display name. */\n  label: string\n  /**\n   * On for every workspace AND every site, with no switch anywhere: the base\n   * component library the canvas cannot render without.\n   */\n  alwaysOn?: boolean\n  /**\n   * On for every WORKSPACE, and switchable for one SITE (AGL-3028, AGL-3029).\n   *\n   * The workspace half is what `alwaysOn` gives: the id is unioned into the\n   * org's resolved set whatever `org.enabledPlugins` stores, so a list saved\n   * before the plugin existed still runs it, and no workspace switch is\n   * offered. The site half is ordinary: the id is subtracted by a site's\n   * `disabledPlugins` deny-list like any other, so an absent host field means\n   * ON and nothing needs migrating.\n   *\n   * It exists for capabilities whose workspace-level half must never stop.\n   * AI carries the add-on, credits, allotments and overage billing, none of\n   * which belongs to a site; Forms carries the catalog and the submissions\n   * already stored. A workspace switch would take those down with the\n   * site-facing half, so the only switch is the site's.\n   */\n  alwaysOnForWorkspace?: boolean\n  /**\n   * What switching this plugin off for ONE site stops, and what it leaves\n   * running (AGL-3028, AGL-3029) — the copy the site's Admin › Plugins page\n   * states beside the switch, so the decision is made knowing both halves.\n   *\n   * `confirm` makes the site switch ask before it applies, naming what it is\n   * about to break on published pages.\n   */\n  siteOff?: {\n    /** What stops on the site, stated as the consequence. */\n    stops: string\n    /** What keeps running, because it carries no site. */\n    keeps: string\n    /** Ask before applying. */\n    confirm?: boolean\n    /**\n     * How the confirmation names the site's published pages the switch\n     * reaches (AGL-3029): the sentence above the list, and the one that\n     * stands in for an empty list when the scan read everything.\n     */\n    pages?: { heading: string; none: string }\n  }\n  /** One-line description for the org-settings toggle list. */\n  description?: string\n  /**\n   * Release flag gating this plugin platform-wide (AGL-422). A flagged-off\n   * plugin is subtracted from every workspace's effective set — console\n   * loader, published sites, and API dispatch — unless the subject is\n   * staff. Always-on plugins carry no flag.\n   */\n  releaseFlag?: string\n  /**\n   * OFF for a site until that site turns it on (AGL-2486) — the inversion of\n   * this switchboard's default, and the only field here that changes what an\n   * absent host doc means.\n   *\n   * The per-host field is a DENY-list: a site records what it switches off,\n   * which makes \"absent means on\" the default for all twelve other bundles.\n   * That is right for a capability whose worst case is an unused nav tab, and\n   * wrong for one whose worst case is a PAGE — `/signin`, `/signup`,\n   * `/recover` were served by every published site on the platform,\n   * including marketing sites whose real sign-in is somewhere else entirely.\n   * A sign-in-shaped page on a brand's own domain that is not that brand's\n   * sign-in is a credential-confusion hazard, so this one defaults closed.\n   *\n   * A site un-defaults it by listing the id in `host.enabledPlugins`. That\n   * list is scoped to default-off ids and cannot widen anything else, so the\n   * AGL-1014 invariant survives intact: a site still can never reach past\n   * what its org enables.\n   */\n  defaultOffPerSite?: boolean\n  /**\n   * Plugin ids this one cannot function without (AGL-2486) — DECLARED, never\n   * inferred.\n   *\n   * The switchboard has always let a workspace turn off a plugin another one\n   * is built on, and said nothing. `accounts` is the case that proves it: the\n   * Members blocks and every `membership/*` API handler ship inside the\n   * COMMERCE bundle, so switching Commerce off leaves a site advertising\n   * `/signin` while nothing can answer the login POST.\n   *\n   * Declared rather than derived on purpose. The couplings that matter are\n   * exactly the ones no static read can see — which bundle happens to\n   * register whose components — so a graph inferred from imports or from the\n   * registry would miss the real edges while looking authoritative. An\n   * incomplete warning that presents itself as complete is worse than none,\n   * so this list is the contract, and {@link resolveDisableCascade} is honest\n   * about covering only what is on it.\n   */\n  requires?: readonly string[]\n}\n\n/**\n * What a DISABLE does to a site that is already published (AGL-2486).\n *\n * The cascade dialog has to state a consequence, and there are two very\n * different ones. \"These blocks will no longer be offered\" is a different\n * decision from \"parts of your live pages go blank\", and one generic sentence\n * for both would be a lie in one direction or the other.\n *\n * - `elements` — the plugin registers site components. The tenant loads only\n *   the site's enabled bundles, so elements ALREADY PLACED on published pages\n *   stop rendering. Pre-existing AGL-1014 behaviour.\n * - `routes`   — the plugin registers no components, but a published site\n *   stops serving something: `accounts` gates `/signin`, `/signup`,\n *   `/recover`; `redirects` stops applying its rules; `workflows` stops\n *   answering its hooks.\n * - `console-only` — nothing a visitor can reach changes; the plugin leaves\n *   navigation and the editor.\n */\nexport type PublishedSiteImpact = 'elements' | 'routes' | 'console-only'\n\n/**\n * Every catalog id classified, from the `publishedSiteImpact` each plugin\n * declares on its own row. The generator refuses a row whose verdict\n * disagrees with its `register.site`, so a site-registering bundle cannot be\n * added without declaring its consequence.\n */\nexport { PUBLISHED_SITE_IMPACT }\n\n/**\n * The user-accounts capability (AGL-2486): visitor sign-in, sign-up and\n * password recovery on a published site.\n *\n * It carries no loader manifest entry, and that is deliberate rather than an\n * oversight. The member blocks and the `membership/*` API handlers already\n * ship inside the commerce bundle, so there is no separate package to load;\n * what this id contributes is the SWITCH — the thing the tenant route gate,\n * the console card and the sitemap all ask. Several catalog ids already have\n * no tenant bundle (`contacts`, `data`, `logic`), so a manifest-less entry is\n * the existing shape, not a new one.\n */\nexport const ACCOUNTS_PLUGIN_ID = 'accounts'\n\n/**\n * The Forms capability's id, named in core (AGL-3029).\n *\n * A form's server half is core — `/api/forms/submit`, the publish-time\n * contract check, the published page's render — and core may not import a\n * plugin, so each asks the site's plugin set about this id rather than asking\n * the Forms plugin anything.\n */\nexport const FORMS_PLUGIN_ID = 'forms'\n\n/**\n * The switchboard catalog. The core holds no row of it: each plugin declares\n * its own in `plugins.config.json` (`catalog`, and one per `capabilities`\n * entry), and the generator compiles them here in their declared order, so\n * adding a plugin edits no core file.\n *\n * Compiled in rather than registered at runtime, because every resolver below\n * is synchronous and runs in each bundle of both apps; a registry that one of\n * those bundles had not filled would read as every plugin switched OFF.\n */\nexport { FIRST_PARTY_PLUGINS }\n\n/**\n * The admin edit bar's quick links that THIS SITE runs, in the order the bar\n * draws them (AGL-3080).\n *\n * `enabledPluginIds` is the site's resolved plugin set — the same one the rest\n * of the edit context is built from, already narrowed by the org's switchboard,\n * the site's own deny-list and the release flags. A link whose plugin is not\n * in it is not offered, which is what stops the bar linking a site with\n * Commerce switched off to its Orders page.\n *\n * Compiled in rather than registered, for the reason the catalog above is:\n * the tenant server draws this bar and never loads a plugin's console code,\n * so a registry it had not filled would drop every link with nothing red.\n */\nexport function pluginEditBarLinks(\n  enabledPluginIds: readonly string[] | undefined,\n): readonly PluginEditBarLink[] {\n  const enabled = new Set(enabledPluginIds ?? [])\n  return PLUGIN_EDIT_BAR_LINKS.filter((link) => enabled.has(link.pluginId))\n}\n\n/** Ids loaded for orgs that have never touched the switchboard. */\nexport const DEFAULT_ENABLED_PLUGINS: readonly string[] =\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id)\n\n/**\n * The id a stored plugin id means today — the seam a rename re-arms.\n *\n * A first-party id is written into every org's `enabledPlugins` and every\n * site's `disabledPlugins` the moment somebody touches the switchboard, so a\n * rename in this file alone would silently turn the plugin OFF for every\n * workspace that had listed it under the old name — the stored id would match\n * nothing in the catalog and fall through as a marketplace listing id. Every\n * reader of a stored list runs it through here first, so a document written\n * before a rename keeps meaning what it meant while the backfill runs.\n *\n * Nothing is aliased today. `contacts` read as `crm` from the CRM's rename\n * (AGL-2595) until its backfill reported zero documents carrying the old id,\n * and the alias was retired (AGL-2614) — an alias that outlives its backfill\n * is a second name for the plugin that nothing writes and every reader must\n * keep honoring. The next rename adds its pair here, ships a backfill over\n * `org.enabledPlugins`, `host.disabledPlugins`, `host.enabledPlugins` and the\n * `pluginSettings` document ids, and removes the pair the same way.\n */\nexport function canonicalPluginId(pluginId: string): string {\n  return pluginId\n}\n\n/** A stored list, read through the alias seam and de-duplicated. */\nfunction canonicalPluginIds(pluginIds: readonly unknown[]): string[] {\n  return Array.from(\n    new Set(pluginIds.map((id) => canonicalPluginId(String(id)))),\n  )\n}\n\n/** On everywhere, a site's deny-list included: the base component library. */\nconst ALWAYS_ON: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn,\n).map((plugin) => plugin.id)\n\n/**\n * Unioned into every workspace's set whatever the org stored: {@link ALWAYS_ON}\n * plus the ids that are on for every workspace and switchable per site.\n */\nconst ALWAYS_ON_FOR_WORKSPACE: readonly string[] = FIRST_PARTY_PLUGINS.filter(\n  (plugin) => plugin.alwaysOn || plugin.alwaysOnForWorkspace,\n).map((plugin) => plugin.id)\n\n/**\n * Whether the WORKSPACE switch for this plugin is locked on (AGL-3028): the\n * base library, and every plugin that is on for every workspace and\n * switchable only per site. The org switchboard renders these on and inert.\n */\nexport function isLockedOnForWorkspace(pluginId: string): boolean {\n  return ALWAYS_ON_FOR_WORKSPACE.includes(pluginId)\n}\n\n/**\n * Whether the SITE switch for this plugin is locked on: the base library\n * alone. Every other plugin a workspace runs can be switched off for one site.\n */\nexport function isLockedOnForSite(pluginId: string): boolean {\n  return ALWAYS_ON.includes(pluginId)\n}\n\nconst FIRST_PARTY_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n)\n\n/**\n * Ids a SITE does not get until it asks (AGL-2486). See\n * {@link FirstPartyPlugin.defaultOffPerSite} for why this inversion exists.\n */\nexport const DEFAULT_OFF_PER_SITE_PLUGIN_IDS: ReadonlySet<string> = new Set(\n  FIRST_PARTY_PLUGINS.filter((plugin) => plugin.defaultOffPerSite).map(\n    (plugin) => plugin.id,\n  ),\n)\n\n/** Whether a plugin id is off for a site until that site opts in. */\nexport function isDefaultOffPerSite(pluginId: string): boolean {\n  return DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(pluginId)\n}\n\n/**\n * Applies a host's `enabledPlugins` OPT-IN list (AGL-2486): subtracts every\n * default-off id the host has not explicitly asked for.\n *\n * Narrow-only, like its deny-list sibling. The list can only ever REMOVE the\n * default-off subtraction for an id the org already enables — listing an\n * ordinary id buys nothing, and listing one the org switched off buys\n * nothing either, because this runs against the org's resolved set.\n */\nexport function applyDefaultOffOptIn(\n  pluginIds: readonly string[],\n  optedIn?: readonly string[] | null,\n): string[] {\n  if (!DEFAULT_OFF_PER_SITE_PLUGIN_IDS.size) return [...pluginIds]\n  const asked = new Set(\n    Array.isArray(optedIn) ? canonicalPluginIds(optedIn) : [],\n  )\n  return pluginIds.filter(\n    (id) => !DEFAULT_OFF_PER_SITE_PLUGIN_IDS.has(id) || asked.has(id),\n  )\n}\n\n/**\n * Whether an `enabledPlugins` id is a first-party BUNDLE (vs a marketplace\n * listing id) — AGL-777. `enabledPlugins` is a flat mix of the two: bundle\n * ids are the short, stable names in {@link FIRST_PARTY_PLUGINS}; marketplace\n * installs ride the same field under their Firestore listing doc id. This is\n * the single classifier both writers and readers use so the two kinds never\n * get confused — e.g. an install sync must never add/remove a bundle id.\n */\nexport function isFirstPartyPlugin(pluginId: string): boolean {\n  return FIRST_PARTY_IDS.has(pluginId)\n}\n\n/**\n * Splits a mixed `enabledPlugins` array into first-party bundle ids and\n * marketplace listing ids (AGL-777). The field stays a single flat list;\n * this just names the two kinds for callers that need to treat them apart.\n */\nexport function classifyEnabledPlugins(pluginIds: readonly string[]): {\n  bundles: string[]\n  listings: string[]\n} {\n  const bundles: string[] = []\n  const listings: string[] = []\n  for (const id of pluginIds) {\n    if (isFirstPartyPlugin(id)) bundles.push(id)\n    else listings.push(id)\n  }\n  return { bundles, listings }\n}\n\n/**\n * The org's effective enabled-plugin set. Absent field → every first-party\n * plugin (existing orgs keep working untouched); always-on ids — and the ids\n * that are on for every workspace and switchable only per site — are unioned\n * in, so no stored list can switch them off for a workspace, including one\n * saved before the plugin existed. Unknown ids are kept — realm-trusted\n * marketplace plugins (AGL-420) ride the same field.\n */\nexport function resolveEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n): string[] {\n  const configured = org?.enabledPlugins\n  const base = Array.isArray(configured)\n    ? canonicalPluginIds(configured)\n    : [...DEFAULT_ENABLED_PLUGINS]\n  return Array.from(new Set([...ALWAYS_ON_FOR_WORKSPACE, ...base]))\n}\n\n/**\n * Subtracts a host's per-site deny-list from an enabled set (AGL-1014).\n * Always-on ids survive — the base component library cannot be switched\n * off per site any more than per org. A plugin that is on for every\n * workspace (`alwaysOnForWorkspace`) does NOT survive: its site switch is\n * the one switch it has. Order of the surviving ids is kept.\n */\nexport function subtractDisabledPlugins(\n  pluginIds: readonly string[],\n  disabledPlugins?: readonly string[] | null,\n): string[] {\n  if (!Array.isArray(disabledPlugins) || !disabledPlugins.length)\n    return [...pluginIds]\n  const disabled = new Set(canonicalPluginIds(disabledPlugins))\n  return pluginIds.filter(\n    (id) => ALWAYS_ON.includes(id) || !disabled.has(id),\n  )\n}\n\n/**\n * A HOST's effective enabled-plugin set (AGL-1014): the org's resolved set\n * minus the host's `disabledPlugins` deny-list. This is the single source\n * of truth for per-site enablement — console navigation, the editor,\n * published sites, and API dispatch must all read it, or a \"disabled\"\n * plugin is merely hidden, not off.\n *\n * Semantics are narrow-only by construction: a host stores what it turns\n * OFF, so it can never widen beyond what the org enables, and an absent\n * field means every org-enabled plugin runs (newly installed plugins\n * default to enabled per site until a host admin disables them).\n *\n * ONE class of id reads the other way (AGL-2486): a `defaultOffPerSite`\n * plugin is subtracted unless the host names it in `enabledPlugins`. That\n * list un-defaults; it does not grant. Both fields are still bounded by the\n * org's set, and an explicit deny still beats an explicit opt-in — the two\n * are applied in that order below, so the safe reading wins whenever a\n * hand-edited or stale doc sets both.\n */\nexport function resolveHostEnabledPlugins(\n  org?: { enabledPlugins?: string[] } | null,\n  host?: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null,\n): string[] {\n  return subtractDisabledPlugins(\n    applyDefaultOffOptIn(resolveEnabledPlugins(org), host?.enabledPlugins),\n    host?.disabledPlugins,\n  )\n}\n\n/**\n * Whether ONE plugin runs on this site — the host-aware counterpart of\n * {@link isPluginEnabled}, and the form every route gate wants.\n */\nexport function isHostPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveHostEnabledPlugins(org, host).includes(pluginId)\n}\n\nexport function isPluginEnabled(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): boolean {\n  return resolveEnabledPlugins(org).includes(pluginId)\n}\n\n/**\n * Where one plugin stands ON ONE SITE (AGL-1014, AGL-2486).\n *\n * Three surfaces need this answer and they must not each derive it: the site\n * plugin page's \"Where it runs\" card, that page's dependency list — where the\n * same question is asked about a NEIGHBOR, and where the answer is the whole\n * point, because a dependency the workspace enables and this site has switched\n * off is a broken plugin behind a healthy-looking workspace page — and the\n * per-site switchboard. A second derivation is a second chance to disagree\n * with `resolveHostEnabledPlugins`, which is what actually runs.\n *\n * - `always-on`         — the base library; it cannot be switched off anywhere.\n *                         A plugin that is on for every workspace but\n *                         switchable per site is NOT this: it reads\n *                         `runs-here` or `off-for-site` like any other.\n * - `off-for-workspace` — the org has it off, so it runs on none of its sites\n *                         and this site cannot turn it on.\n * - `runs-here`         — the effective host set contains it.\n * - `awaiting-opt-in`   — a `defaultOffPerSite` plugin the org enables and\n *                         this site has not asked for. Off, but off by\n *                         DEFAULT rather than by a decision, which is a\n *                         different thing to tell an operator.\n * - `off-for-site`      — the org enables it and this site switched it off.\n */\nexport type PluginSiteState =\n  | 'always-on'\n  | 'off-for-workspace'\n  | 'runs-here'\n  | 'awaiting-opt-in'\n  | 'off-for-site'\n\nexport function resolvePluginSiteState(\n  org: { enabledPlugins?: string[] } | null | undefined,\n  host: { disabledPlugins?: string[]; enabledPlugins?: string[] } | null | undefined,\n  pluginId: string,\n): PluginSiteState {\n  if (ALWAYS_ON.includes(pluginId)) return 'always-on'\n  if (!resolveEnabledPlugins(org).includes(pluginId)) return 'off-for-workspace'\n  if (resolveHostEnabledPlugins(org, host).includes(pluginId)) return 'runs-here'\n  // A default-off plugin this site has not named is off because nobody asked\n  // for it; naming it in the deny-list is a decision, and an explicit deny\n  // beats an opt-in, so the deny-list is checked first.\n  const denied = Array.isArray(host?.disabledPlugins)\n    ? host.disabledPlugins.map(String).includes(pluginId)\n    : false\n  return !denied && isDefaultOffPerSite(pluginId)\n    ? 'awaiting-opt-in'\n    : 'off-for-site'\n}\n\n/**\n * The declared dependency graph, both directions, built once (AGL-2486).\n *\n * `requires` on the catalog is the forward edge — what a plugin cannot run\n * without — and every consumer so far wanted the reverse one. Building both\n * here keeps the cascade, the console's dependency card and the server-side\n * refusal reading the SAME edges: a graph assembled a second time is a graph\n * that can disagree with itself about which plugins are coupled, and the\n * disagreement would show up as a warning shown on one surface and not on the\n * one that writes.\n *\n * `extraRequirements` extends the catalog and cannot shrink it, exactly as it\n * does for {@link resolveDisableCascade} — a third-party id can add edges of\n * its own but can never declare away a first-party one.\n */\nfunction dependencyEdges(\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): {\n  /** Keyed by a required id; holds the ids that depend on it. */\n  dependents: Map<string, string[]>\n  /** Keyed by a dependent id; holds the ids it requires. */\n  requires: Map<string, string[]>\n} {\n  const dependents = new Map<string, string[]>()\n  const requires = new Map<string, string[]>()\n  const addEdge = (dependent: string, required: string) => {\n    const reverse = dependents.get(required)\n    if (reverse) reverse.push(dependent)\n    else dependents.set(required, [dependent])\n    const forward = requires.get(dependent)\n    if (forward) forward.push(required)\n    else requires.set(dependent, [required])\n  }\n  for (const plugin of FIRST_PARTY_PLUGINS)\n    for (const required of plugin.requires ?? []) addEdge(plugin.id, required)\n  for (const [dependent, required] of Object.entries(extraRequirements ?? {}))\n    for (const one of required ?? []) addEdge(dependent, String(one))\n  return { dependents, requires }\n}\n\n/** What `pluginId` declares it cannot run without — DIRECT edges only. */\nexport function pluginRequirements(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).requires.get(pluginId) ?? [])]\n}\n\n/** What declares it cannot run without `pluginId` — DIRECT edges only. */\nexport function pluginDependents(\n  pluginId: string,\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  return [...(dependencyEdges(extraRequirements).dependents.get(pluginId) ?? [])]\n}\n\n/**\n * Which of `enabledIds` would be left running with a requirement switched off\n * (AGL-2486) — the same question the cascade dialog asks, phrased so a WRITER\n * can refuse instead of a reader warning.\n *\n * The dialog is a courtesy: it stands in front of the console's own switches\n * and nothing else. A direct API call, a stale tab that posts an older set, or\n * a second console surface that forgot to ask can still store a set where\n * User Accounts is on and the Commerce bundle that answers its sign-in POST is\n * not. This is what a write path calls to reject that set outright, so the\n * boundary does not live in a dialog anyone can skip.\n *\n * Only DECLARED requirements are checked, with the same limit\n * {@link PLUGIN_CASCADE_IS_DECLARED_ONLY} states: an undeclared coupling is\n * invisible here too. A requirement naming an id outside the catalog is\n * ignored rather than treated as unmet — a stale edge must not lock a\n * workspace out of its own switchboard.\n */\nexport function strandedDependents(\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): Array<{ pluginId: string; missing: string[] }> {\n  const enabled = new Set(enabledIds.map(String))\n  const known = new Set<string>([\n    ...FIRST_PARTY_PLUGINS.map((plugin) => plugin.id),\n    ...enabled,\n  ])\n  const { requires } = dependencyEdges(extraRequirements)\n  const stranded: Array<{ pluginId: string; missing: string[] }> = []\n  for (const pluginId of enabled) {\n    const missing = (requires.get(pluginId) ?? []).filter(\n      (required) => known.has(required) && !enabled.has(required),\n    )\n    if (missing.length) stranded.push({ pluginId, missing })\n  }\n  return stranded\n}\n\n/**\n * Everything that must ALSO be switched off when `pluginId` is (AGL-2486) —\n * the transitive closure over reverse `requires` edges, restricted to what is\n * currently on.\n *\n * Pure and surface-agnostic: the org switchboard and the per-site card both\n * call it with their own \"currently enabled\" set, so the same graph answers\n * both, and the org's wider blast radius comes from the set it passes, not\n * from a second implementation.\n *\n * `extraRequirements` is how a marketplace listing joins the graph. Third-party\n * ids ride the same `enabledPlugins` field, so a listing whose manifest\n * declares `requires` is cascaded exactly like a bundle. It EXTENDS the\n * catalog graph and cannot shrink it — a listing cannot declare away a\n * first-party edge.\n *\n * ⚠️ The result is only ever as complete as what has been DECLARED. A\n * marketplace plugin that uses first-party components without saying so in its\n * manifest will not appear here, and callers must not present the list as\n * exhaustive. See `PLUGIN_CASCADE_IS_DECLARED_ONLY`.\n */\nexport function resolveDisableCascade(\n  pluginId: string,\n  enabledIds: readonly string[],\n  extraRequirements?: Readonly<Record<string, readonly string[]>>,\n): string[] {\n  const enabled = new Set(enabledIds.map(String))\n  const dependents = dependencyEdges(extraRequirements).dependents\n\n  // Breadth-first over reverse edges. `seen` is seeded with the origin so a\n  // cycle back to it terminates and the plugin being disabled is never listed\n  // among its own dependents.\n  const seen = new Set<string>([pluginId])\n  const cascade: string[] = []\n  const queue: string[] = [pluginId]\n  while (queue.length) {\n    const current = queue.shift() as string\n    for (const dependent of dependents.get(current) ?? []) {\n      if (seen.has(dependent)) continue\n      seen.add(dependent)\n      // Walk THROUGH an already-off dependent — something may depend on it in\n      // turn — but do not claim it is being turned off.\n      if (enabled.has(dependent)) cascade.push(dependent)\n      queue.push(dependent)\n    }\n  }\n  return cascade\n}\n\n/**\n * Why the cascade list must never be presented as exhaustive (AGL-2486).\n *\n * Exported as copy rather than left to each caller to paraphrase: the whole\n * value of the warning rests on it being honest about its own limits, and two\n * surfaces wording that differently is how one of them ends up overclaiming.\n *\n * It says built-in ONLY, and that is the current truth rather than a hedge.\n * `PluginManifest` carries no `requires` field, so a publisher cannot declare\n * a dependency even if they want to, and `extraRequirements` above — the seam\n * that would carry them — is supplied by nothing outside tests. An earlier\n * draft said \"a plugin that uses this one WITHOUT declaring it cannot be\n * detected\", which quietly implied declaring was possible and would have made\n * this the exact overclaiming warning it exists to avoid. Adding the manifest\n * field is a separate change: it needs a publish form, validation and a line\n * on the install screen, or it is a field written by nobody and read by\n * nothing. Update this sentence in the same change, not before.\n */\nexport const PLUGIN_CASCADE_IS_DECLARED_ONLY =\n  'This covers built-in plugins only. A marketplace plugin has no way to ' +\n  'declare that it depends on another one yet, so none are listed here — ' +\n  'check any third-party plugins you rely on before continuing.'\n\n/** Reverse lookup: which first-party plugin a release flag gates, if any. */\nexport function pluginForReleaseFlag(\n  flagKey: string,\n): FirstPartyPlugin | undefined {\n  return FIRST_PARTY_PLUGINS.find((plugin) => plugin.releaseFlag === flagKey)\n}\n\n/**\n * Subtracts release-flagged-off plugins from an effective set (AGL-422).\n * Pure — the caller supplies the verdict source (client: the activated\n * Remote Config hook state; server: the cached admin-SDK template read),\n * so the same policy runs identically on every surface:\n *\n * - unknown ids (marketplace/realm installs) and always-on ids pass;\n * - a first-party id with a `releaseFlag` passes only when the flag is on\n *   for the subject, or `staffBypass` is set (staff preview keeps working\n *   while a feature is dark).\n */\nexport function filterPluginsByReleaseFlags(\n  pluginIds: readonly string[],\n  isFlagOn: (flagKey: string) => boolean,\n  options?: { staffBypass?: boolean },\n): string[] {\n  if (options?.staffBypass) return [...pluginIds]\n  const catalog = new Map(\n    FIRST_PARTY_PLUGINS.map((plugin) => [plugin.id, plugin]),\n  )\n  return pluginIds.filter((pluginId) => {\n    const plugin = catalog.get(pluginId)\n    if (!plugin?.releaseFlag || plugin.alwaysOn) return true\n    return isFlagOn(plugin.releaseFlag)\n  })\n}\n"],"names":["FIRST_PARTY_PLUGINS","PLUGIN_EDIT_BAR_LINKS","PUBLISHED_SITE_IMPACT","ACCOUNTS_PLUGIN_ID","FORMS_PLUGIN_ID","pluginEditBarLinks","enabledPluginIds","enabled","Set","filter","link","has","pluginId","DEFAULT_ENABLED_PLUGINS","map","plugin","id","canonicalPluginId","canonicalPluginIds","pluginIds","Array","from","String","ALWAYS_ON","alwaysOn","ALWAYS_ON_FOR_WORKSPACE","alwaysOnForWorkspace","isLockedOnForWorkspace","includes","isLockedOnForSite","FIRST_PARTY_IDS","DEFAULT_OFF_PER_SITE_PLUGIN_IDS","defaultOffPerSite","isDefaultOffPerSite","applyDefaultOffOptIn","optedIn","size","asked","isArray","isFirstPartyPlugin","classifyEnabledPlugins","bundles","listings","push","resolveEnabledPlugins","org","configured","enabledPlugins","base","subtractDisabledPlugins","disabledPlugins","length","disabled","resolveHostEnabledPlugins","host","isHostPluginEnabled","isPluginEnabled","resolvePluginSiteState","denied","dependencyEdges","extraRequirements","dependents","Map","requires","addEdge","dependent","required","reverse","get","set","forward","Object","entries","one","pluginRequirements","pluginDependents","strandedDependents","enabledIds","known","stranded","missing","resolveDisableCascade","seen","cascade","queue","current","shift","add","PLUGIN_CASCADE_IS_DECLARED_ONLY","pluginForReleaseFlag","flagKey","find","releaseFlag","filterPluginsByReleaseFlags","isFlagOn","options","staffBypass","catalog"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,SACEA,mBAAmB,EACnBC,qBAAqB,EACrBC,qBAAqB,QAChB,qCAAiC;AAiKxC;;;;;CAKC,GACD,SAASA,qBAAqB,GAAE;AAEhC;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,qBAAqB,WAAU;AAE5C;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,QAAO;AAEtC;;;;;;;;;CASC,GACD,SAASJ,mBAAmB,GAAE;AAE9B;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASK,mBACdC,gBAA+C;IAE/C,MAAMC,UAAU,IAAIC,IAAIF,2BAAAA,mBAAoB,EAAE;IAC9C,OAAOL,sBAAsBQ,MAAM,CAAC,CAACC,OAASH,QAAQI,GAAG,CAACD,KAAKE,QAAQ;AACzE;AAEA,iEAAiE,GACjE,OAAO,MAAMC,0BACXb,oBAAoBc,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE,EAAC;AAEhD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASC,kBAAkBL,QAAgB;IAChD,OAAOA;AACT;AAEA,kEAAkE,GAClE,SAASM,mBAAmBC,SAA6B;IACvD,OAAOC,MAAMC,IAAI,CACf,IAAIb,IAAIW,UAAUL,GAAG,CAAC,CAACE,KAAOC,kBAAkBK,OAAON;AAE3D;AAEA,4EAA4E,GAC5E,MAAMO,YAA+BvB,oBAAoBS,MAAM,CAC7D,CAACM,SAAWA,OAAOS,QAAQ,EAC3BV,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;CAGC,GACD,MAAMS,0BAA6CzB,oBAAoBS,MAAM,CAC3E,CAACM,SAAWA,OAAOS,QAAQ,IAAIT,OAAOW,oBAAoB,EAC1DZ,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAE3B;;;;CAIC,GACD,OAAO,SAASW,uBAAuBf,QAAgB;IACrD,OAAOa,wBAAwBG,QAAQ,CAAChB;AAC1C;AAEA;;;CAGC,GACD,OAAO,SAASiB,kBAAkBjB,QAAgB;IAChD,OAAOW,UAAUK,QAAQ,CAAChB;AAC5B;AAEA,MAAMkB,kBAAuC,IAAItB,IAC/CR,oBAAoBc,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;AAG/C;;;CAGC,GACD,OAAO,MAAMe,kCAAuD,IAAIvB,IACtER,oBAAoBS,MAAM,CAAC,CAACM,SAAWA,OAAOiB,iBAAiB,EAAElB,GAAG,CAClE,CAACC,SAAWA,OAAOC,EAAE,GAExB;AAED,mEAAmE,GACnE,OAAO,SAASiB,oBAAoBrB,QAAgB;IAClD,OAAOmB,gCAAgCpB,GAAG,CAACC;AAC7C;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASsB,qBACdf,SAA4B,EAC5BgB,OAAkC;IAElC,IAAI,CAACJ,gCAAgCK,IAAI,EAAE,OAAO;WAAIjB;KAAU;IAChE,MAAMkB,QAAQ,IAAI7B,IAChBY,MAAMkB,OAAO,CAACH,WAAWjB,mBAAmBiB,WAAW,EAAE;IAE3D,OAAOhB,UAAUV,MAAM,CACrB,CAACO,KAAO,CAACe,gCAAgCpB,GAAG,CAACK,OAAOqB,MAAM1B,GAAG,CAACK;AAElE;AAEA;;;;;;;CAOC,GACD,OAAO,SAASuB,mBAAmB3B,QAAgB;IACjD,OAAOkB,gBAAgBnB,GAAG,CAACC;AAC7B;AAEA;;;;CAIC,GACD,OAAO,SAAS4B,uBAAuBrB,SAA4B;IAIjE,MAAMsB,UAAoB,EAAE;IAC5B,MAAMC,WAAqB,EAAE;IAC7B,KAAK,MAAM1B,MAAMG,UAAW;QAC1B,IAAIoB,mBAAmBvB,KAAKyB,QAAQE,IAAI,CAAC3B;aACpC0B,SAASC,IAAI,CAAC3B;IACrB;IACA,OAAO;QAAEyB;QAASC;IAAS;AAC7B;AAEA;;;;;;;CAOC,GACD,OAAO,SAASE,sBACdC,GAA0C;IAE1C,MAAMC,aAAaD,uBAAAA,IAAKE,cAAc;IACtC,MAAMC,OAAO5B,MAAMkB,OAAO,CAACQ,cACvB5B,mBAAmB4B,cACnB;WAAIjC;KAAwB;IAChC,OAAOO,MAAMC,IAAI,CAAC,IAAIb,IAAI;WAAIiB;WAA4BuB;KAAK;AACjE;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,wBACd9B,SAA4B,EAC5B+B,eAA0C;IAE1C,IAAI,CAAC9B,MAAMkB,OAAO,CAACY,oBAAoB,CAACA,gBAAgBC,MAAM,EAC5D,OAAO;WAAIhC;KAAU;IACvB,MAAMiC,WAAW,IAAI5C,IAAIU,mBAAmBgC;IAC5C,OAAO/B,UAAUV,MAAM,CACrB,CAACO,KAAOO,UAAUK,QAAQ,CAACZ,OAAO,CAACoC,SAASzC,GAAG,CAACK;AAEpD;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASqC,0BACdR,GAA0C,EAC1CS,IAAuE;IAEvE,OAAOL,wBACLf,qBAAqBU,sBAAsBC,MAAMS,wBAAAA,KAAMP,cAAc,GACrEO,wBAAAA,KAAMJ,eAAe;AAEzB;AAEA;;;CAGC,GACD,OAAO,SAASK,oBACdV,GAAqD,EACrDS,IAAkF,EAClF1C,QAAgB;IAEhB,OAAOyC,0BAA0BR,KAAKS,MAAM1B,QAAQ,CAAChB;AACvD;AAEA,OAAO,SAAS4C,gBACdX,GAAqD,EACrDjC,QAAgB;IAEhB,OAAOgC,sBAAsBC,KAAKjB,QAAQ,CAAChB;AAC7C;AAiCA,OAAO,SAAS6C,uBACdZ,GAAqD,EACrDS,IAAkF,EAClF1C,QAAgB;IAEhB,IAAIW,UAAUK,QAAQ,CAAChB,WAAW,OAAO;IACzC,IAAI,CAACgC,sBAAsBC,KAAKjB,QAAQ,CAAChB,WAAW,OAAO;IAC3D,IAAIyC,0BAA0BR,KAAKS,MAAM1B,QAAQ,CAAChB,WAAW,OAAO;IACpE,2EAA2E;IAC3E,yEAAyE;IACzE,sDAAsD;IACtD,MAAM8C,SAAStC,MAAMkB,OAAO,CAACgB,wBAAAA,KAAMJ,eAAe,IAC9CI,KAAKJ,eAAe,CAACpC,GAAG,CAACQ,QAAQM,QAAQ,CAAChB,YAC1C;IACJ,OAAO,CAAC8C,UAAUzB,oBAAoBrB,YAClC,oBACA;AACN;AAEA;;;;;;;;;;;;;;CAcC,GACD,SAAS+C,gBACPC,iBAA+D;QAkBtC7C;IAXzB,MAAM8C,aAAa,IAAIC;IACvB,MAAMC,WAAW,IAAID;IACrB,MAAME,UAAU,CAACC,WAAmBC;QAClC,MAAMC,UAAUN,WAAWO,GAAG,CAACF;QAC/B,IAAIC,SAASA,QAAQxB,IAAI,CAACsB;aACrBJ,WAAWQ,GAAG,CAACH,UAAU;YAACD;SAAU;QACzC,MAAMK,UAAUP,SAASK,GAAG,CAACH;QAC7B,IAAIK,SAASA,QAAQ3B,IAAI,CAACuB;aACrBH,SAASM,GAAG,CAACJ,WAAW;YAACC;SAAS;IACzC;IACA,KAAK,MAAMnD,UAAUf,oBACnB,KAAK,MAAMkE,aAAYnD,mBAAAA,OAAOgD,QAAQ,YAAfhD,mBAAmB,EAAE,CAAEiD,QAAQjD,OAAOC,EAAE,EAAEkD;IACnE,KAAK,MAAM,CAACD,WAAWC,SAAS,IAAIK,OAAOC,OAAO,CAACZ,4BAAAA,oBAAqB,CAAC,GACvE,KAAK,MAAMa,OAAOP,mBAAAA,WAAY,EAAE,CAAEF,QAAQC,WAAW3C,OAAOmD;IAC9D,OAAO;QAAEZ;QAAYE;IAAS;AAChC;AAEA,wEAAwE,GACxE,OAAO,SAASW,mBACd9D,QAAgB,EAChBgD,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,gCAAAA,gBAAgBC,mBAAmBG,QAAQ,CAACK,GAAG,CAACxD,qBAAhD+C,gCAA6D,EAAE;KAAE;AAC/E;AAEA,wEAAwE,GACxE,OAAO,SAASgB,iBACd/D,QAAgB,EAChBgD,iBAA+D;QAEnDD;IAAZ,OAAO;YAAKA,kCAAAA,gBAAgBC,mBAAmBC,UAAU,CAACO,GAAG,CAACxD,qBAAlD+C,kCAA+D,EAAE;KAAE;AACjF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASiB,mBACdC,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMrD,UAAU,IAAIC,IAAIqE,WAAW/D,GAAG,CAACQ;IACvC,MAAMwD,QAAQ,IAAItE,IAAY;WACzBR,oBAAoBc,GAAG,CAAC,CAACC,SAAWA,OAAOC,EAAE;WAC7CT;KACJ;IACD,MAAM,EAAEwD,QAAQ,EAAE,GAAGJ,gBAAgBC;IACrC,MAAMmB,WAA2D,EAAE;IACnE,KAAK,MAAMnE,YAAYL,QAAS;YACbwD;QAAjB,MAAMiB,UAAU,EAACjB,gBAAAA,SAASK,GAAG,CAACxD,qBAAbmD,gBAA0B,EAAE,EAAEtD,MAAM,CACnD,CAACyD,WAAaY,MAAMnE,GAAG,CAACuD,aAAa,CAAC3D,QAAQI,GAAG,CAACuD;QAEpD,IAAIc,QAAQ7B,MAAM,EAAE4B,SAASpC,IAAI,CAAC;YAAE/B;YAAUoE;QAAQ;IACxD;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,SAASE,sBACdrE,QAAgB,EAChBiE,UAA6B,EAC7BjB,iBAA+D;IAE/D,MAAMrD,UAAU,IAAIC,IAAIqE,WAAW/D,GAAG,CAACQ;IACvC,MAAMuC,aAAaF,gBAAgBC,mBAAmBC,UAAU;IAEhE,0EAA0E;IAC1E,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAMqB,OAAO,IAAI1E,IAAY;QAACI;KAAS;IACvC,MAAMuE,UAAoB,EAAE;IAC5B,MAAMC,QAAkB;QAACxE;KAAS;IAClC,MAAOwE,MAAMjC,MAAM,CAAE;YAEKU;QADxB,MAAMwB,UAAUD,MAAME,KAAK;QAC3B,KAAK,MAAMrB,cAAaJ,kBAAAA,WAAWO,GAAG,CAACiB,oBAAfxB,kBAA2B,EAAE,CAAE;YACrD,IAAIqB,KAAKvE,GAAG,CAACsD,YAAY;YACzBiB,KAAKK,GAAG,CAACtB;YACT,wEAAwE;YACxE,kDAAkD;YAClD,IAAI1D,QAAQI,GAAG,CAACsD,YAAYkB,QAAQxC,IAAI,CAACsB;YACzCmB,MAAMzC,IAAI,CAACsB;QACb;IACF;IACA,OAAOkB;AACT;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,MAAMK,kCACX,2EACA,2EACA,+DAA8D;AAEhE,2EAA2E,GAC3E,OAAO,SAASC,qBACdC,OAAe;IAEf,OAAO1F,oBAAoB2F,IAAI,CAAC,CAAC5E,SAAWA,OAAO6E,WAAW,KAAKF;AACrE;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASG,4BACd1E,SAA4B,EAC5B2E,QAAsC,EACtCC,OAAmC;IAEnC,IAAIA,2BAAAA,QAASC,WAAW,EAAE,OAAO;WAAI7E;KAAU;IAC/C,MAAM8E,UAAU,IAAInC,IAClB9D,oBAAoBc,GAAG,CAAC,CAACC,SAAW;YAACA,OAAOC,EAAE;YAAED;SAAO;IAEzD,OAAOI,UAAUV,MAAM,CAAC,CAACG;QACvB,MAAMG,SAASkF,QAAQ7B,GAAG,CAACxD;QAC3B,IAAI,EAACG,0BAAAA,OAAQ6E,WAAW,KAAI7E,OAAOS,QAAQ,EAAE,OAAO;QACpD,OAAOsE,SAAS/E,OAAO6E,WAAW;IACpC;AACF"}

package/src/lib/plugin-manager/feature-plugins.d.ts

@@ -268,6 +268,48 @@ export interface ConsoleNavSection {
      * the sales suite built on that list starts at Starter.
      */
     featureFlag?: keyof OrgFeatureFlags;
+    /**
+     * Permission key gating THIS section, when the surface is open to every
+     * member and part of it is not (AGL-3080). Omit to inherit the
+     * extension's and the nav item's, which is the common case.
+     *
+     * The third gate, composed the way the other two are: ANDed with what the
+     * extension and the nav item already require, so a section can only ever
+     * be narrower than the surface holding it. A section this refuses is not
+     * drawn in the rail at all — unlike a `featureFlag` refusal, which draws
+     * locked and links to the notice that sells it, because a permission is
+     * not something the reader can buy — and a deep link to it is answered
+     * with the shell's refusal instead of its body. One verdict, both places.
+     *
+     * ⚠️ NOT a replacement for the server's rule. The rules and the plugin's
+     * own handlers enforce this regardless of what renders; this keeps a
+     * reader from being offered a page that is about to refuse them.
+     *
+     * The case it exists for is a hub most of a workspace uses and whose
+     * seller half only a publisher does: the Marketplace's browse, installed
+     * and licences sections are every member's, and listings, upload, sales
+     * and payouts read the organization's revenue.
+     */
+    permission?: string;
+    /**
+     * Query keys that land a BARE hub URL on this section instead of on the
+     * first one the reader may open (AGL-3080).
+     *
+     * The case it exists for is a return URL held by somebody else. Stripe
+     * bakes `?connect=` into account-onboarding links and `?purchase=` into
+     * checkout sessions, so a seller part-way through onboarding is carrying
+     * one right now — in a third party's records, not ours, and unfixable from
+     * this side once it lands somewhere that means nothing to them. A seller
+     * coming back from Connect wants Payouts; a buyer coming back from
+     * checkout wants what they now own.
+     *
+     * The key's VALUE is not read, only its presence: these are markers, and a
+     * marker nothing routes on still survives the hop, which is what makes it
+     * safe for anyone to add one. The gates still apply — a section this
+     * claims but the reader may not open is not landed on, and the bare rule
+     * takes over.
+     */
+    landsOnQuery?: readonly string[];
 }
 /** A {@link ConsoleNavSection} with the shell's answers filled in. */
 export interface ResolvedConsoleNavSection {
@@ -286,6 +328,18 @@ export interface ResolvedConsoleNavSection {
      * workspace would be the AGL-1380 defect in a new place.
      */
     locked?: boolean;
+    /**
+     * True when this section's own `permission` refuses this reader
+     * (AGL-3080) — the reason it is not `visible`, kept apart from the
+     * release flag's so a deep link is answered with the refusal that
+     * applies rather than with "coming soon". Never true while the member
+     * read is pending: the permission map answers as an admin's until it
+     * lands, so an unsettled read is neither a grant nor a refusal.
+     */
+    refused?: boolean;
+    /** The section's declared {@link ConsoleNavSection.landsOnQuery}, carried
+     * through so the shell's landing rule can read it (AGL-3080). */
+    landsOnQuery?: readonly string[];
 }
 export interface ConsoleNavItem {
     label: string;
@@ -443,6 +497,19 @@ export declare const CONSOLE_WIDGET_SLOTS: {
     readonly besignerFunctions: "besignerFunctions";
     /** Marketplace listing detail body. Props: hostId, listingId, permissions. */
     readonly marketplaceListing: "marketplaceListing";
+    /**
+     * Above the whole Marketplace subtree: what THIS DEPLOYMENT cannot do
+     * (AGL-2019, moved out of the console app by AGL-3080). No props — the
+     * widget reads {@link DeploymentCapabilities} from the context the org's
+     * server layout provides, and draws nothing when the deployment is
+     * configured.
+     *
+     * A zone rather than a component the app holds, because the sentence is
+     * the marketplace's: it names what still works without a Stripe platform
+     * (browsing, free installs) and that is the plugin's knowledge, not the
+     * shell's. The app supplies only the fact.
+     */
+    readonly marketplaceCapability: "marketplaceCapability";
     /**
      * Org marketplace browse body (AGL-772). Props: hostId (acting site),
      * permissions, orgScoped. The single org-scope place to browse + install,

package/src/lib/plugin-manager/feature-plugins.js

@@ -121,6 +121,18 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
     /** Besigner functions (ƒx) panel. Props: hostId. */ besignerFunctions: 'besignerFunctions',
     /** Marketplace listing detail body. Props: hostId, listingId, permissions. */ marketplaceListing: 'marketplaceListing',
     /**
+   * Above the whole Marketplace subtree: what THIS DEPLOYMENT cannot do
+   * (AGL-2019, moved out of the console app by AGL-3080). No props — the
+   * widget reads {@link DeploymentCapabilities} from the context the org's
+   * server layout provides, and draws nothing when the deployment is
+   * configured.
+   *
+   * A zone rather than a component the app holds, because the sentence is
+   * the marketplace's: it names what still works without a Stripe platform
+   * (browsing, free installs) and that is the plugin's knowledge, not the
+   * shell's. The app supplies only the fact.
+   */ marketplaceCapability: 'marketplaceCapability',
+    /**
    * Org marketplace browse body (AGL-772). Props: hostId (acting site),
    * permissions, orgScoped. The single org-scope place to browse + install,
    * replacing the per-site marketplace tab.