@aglyn/aglyn 1.0.0-beta.270 → 1.0.0-beta.272

package/src/lib/plugin-manager/plugin-site-resources.js

@@ -0,0 +1,135 @@
+var _globalScope_ERASERS_KEY;
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A PLUGIN'S SHARE OF DELETING A SITE (AGL-4003).
+ *
+ * Deleting a site (`eraseHost`) destroys what the platform holds for it: its
+ * document tree, its Storage, its routing, and the organization documents a
+ * plugin declares as the site's (`orgCollections` with a `siteField`). Some
+ * plugin resources belong to the ORGANIZATION and are shared with sites by a
+ * scope list instead — a dataset shared with one site, or with several. Which
+ * of those are the site's own, and what becomes of the rest, is the plugin's
+ * to say, so the plugin registers a site-resource eraser here:
+ *
+ * - `preview` lists what deleting the site would take — the resources shared
+ *   with this site alone, each with how many items it holds — and how many it
+ *   shares with other sites, which stay. The Delete site card shows it before
+ *   anyone confirms, so it must change nothing.
+ * - `erase` erases the resources shared with this site alone, items and all,
+ *   and takes the site off the sharing of the ones it shares with others. It
+ *   answers how many it erased.
+ *
+ * Erasers run in registration order and are ISOLATED, like every trailing
+ * cleanup of a site delete: a throw is logged against its plugin and does not
+ * stop the next one or the delete. A preview that throws is reported as
+ * `null` for its plugin, so the card can say the list is incomplete rather
+ * than show an empty one.
+ *
+ * Registered from a plugin's `serverDeclarations`, so the eraser is in place
+ * in every server process that can delete a site.
+ */ import { getRegisteringPluginId } from "../app-utils/registering-plugin.js";
+import { runPluginDeclarationsRepair } from "./plugin-declarations-repair.js";
+/**
+ * One list per process, on `globalThis` (AGL-3464): the app registers its
+ * plugins' declarations from `instrumentation.ts`, which Next compiles apart
+ * from the route that deletes a site, and a module-scoped list is filled in
+ * one copy and read empty in the other.
+ */ const ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-site-resource-erasers');
+const globalScope = globalThis;
+const registrations = (_globalScope_ERASERS_KEY = globalScope[ERASERS_KEY]) != null ? _globalScope_ERASERS_KEY : globalScope[ERASERS_KEY] = [];
+/**
+ * Registers a plugin's site-resource eraser. Owner = the loader's marker
+ * inside a register fn, else `options.pluginId`; an eraser with neither
+ * throws. One per plugin: registering again replaces the plugin's earlier
+ * eraser in place, so a module evaluated twice does not erase twice.
+ */ export function registerPluginSiteResourceEraser(eraser, options) {
+    var _ref, _getRegisteringPluginId;
+    const pluginId = ((_ref = (_getRegisteringPluginId = getRegisteringPluginId()) != null ? _getRegisteringPluginId : options == null ? void 0 : options.pluginId) != null ? _ref : '').trim();
+    if (!pluginId) {
+        throw new Error('a plugin site-resource eraser was registered with no owner: pass ' + '{ pluginId } when registering outside a plugin register fn');
+    }
+    if (typeof (eraser == null ? void 0 : eraser.preview) !== 'function' || typeof (eraser == null ? void 0 : eraser.erase) !== 'function') {
+        throw new Error('a site-resource eraser needs a preview and an erase function');
+    }
+    const index = registrations.findIndex((entry)=>entry.pluginId === pluginId);
+    if (index >= 0) registrations[index] = {
+        pluginId,
+        eraser
+    };
+    else registrations.push({
+        pluginId,
+        eraser
+    });
+}
+/**
+ * The erasers in place, after running the app's boot step once when none is:
+ * a boot whose declarations failed must not read as a workspace with nothing
+ * shared with the site.
+ */ async function registered() {
+    if (!registrations.length) {
+        await runPluginDeclarationsRepair().catch((error)=>{
+            console.error('[plugins] the declarations repair failed before a site delete', error);
+        });
+    }
+    return [
+        ...registrations
+    ];
+}
+/**
+ * Every plugin's preview, in registration order. Never throws: a preview that
+ * fails is logged and answered as `null` for its plugin.
+ */ export async function previewPluginSiteResources(request) {
+    const rows = [];
+    for (const { pluginId, eraser } of (await registered())){
+        try {
+            rows.push({
+                pluginId,
+                preview: await eraser.preview(request)
+            });
+        } catch (error) {
+            console.error(`[plugins] ${pluginId} could not list what goes with site ${request.hostId}`, error);
+            rows.push({
+                pluginId,
+                preview: null
+            });
+        }
+    }
+    return rows;
+}
+/**
+ * Runs every eraser, in registration order, and answers how many resources
+ * each erased by plugin id, or `null` for one that threw. Never throws.
+ */ export async function erasePluginSiteResources(request) {
+    const erased = {};
+    for (const { pluginId, eraser } of (await registered())){
+        try {
+            erased[pluginId] = await eraser.erase(request);
+        } catch (error) {
+            erased[pluginId] = null;
+            console.error(`[plugins] ${pluginId} failed to erase site ${request.hostId}'s resources`, error);
+        }
+    }
+    return erased;
+}
+/** The plugins with a site-resource eraser, in the order they run. */ export function listPluginSiteResourceErasers() {
+    return registrations.map((entry)=>entry.pluginId);
+}
+/** Test seam: forget every eraser. */ export function resetPluginSiteResourceErasersForTests() {
+    registrations.length = 0;
+}
+
+//# sourceMappingURL=plugin-site-resources.js.map

package/src/lib/plugin-manager/plugin-site-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-site-resources.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A PLUGIN'S SHARE OF DELETING A SITE (AGL-4003).\n *\n * Deleting a site (`eraseHost`) destroys what the platform holds for it: its\n * document tree, its Storage, its routing, and the organization documents a\n * plugin declares as the site's (`orgCollections` with a `siteField`). Some\n * plugin resources belong to the ORGANIZATION and are shared with sites by a\n * scope list instead — a dataset shared with one site, or with several. Which\n * of those are the site's own, and what becomes of the rest, is the plugin's\n * to say, so the plugin registers a site-resource eraser here:\n *\n * - `preview` lists what deleting the site would take — the resources shared\n *   with this site alone, each with how many items it holds — and how many it\n *   shares with other sites, which stay. The Delete site card shows it before\n *   anyone confirms, so it must change nothing.\n * - `erase` erases the resources shared with this site alone, items and all,\n *   and takes the site off the sharing of the ones it shares with others. It\n *   answers how many it erased.\n *\n * Erasers run in registration order and are ISOLATED, like every trailing\n * cleanup of a site delete: a throw is logged against its plugin and does not\n * stop the next one or the delete. A preview that throws is reported as\n * `null` for its plugin, so the card can say the list is incomplete rather\n * than show an empty one.\n *\n * Registered from a plugin's `serverDeclarations`, so the eraser is in place\n * in every server process that can delete a site.\n */\n\nimport { getRegisteringPluginId } from '../app-utils/registering-plugin'\nimport { runPluginDeclarationsRepair } from './plugin-declarations-repair'\n\n/** The site a preview or an erase is about, and the workspace that owns it. */\nexport interface PluginSiteResourceRequest {\n  orgId: string\n  hostId: string\n}\n\n/** One resource that goes with the site. */\nexport interface PluginSiteResourceGoing {\n  id: string\n  /** Its name, as the plugin's own page shows it. */\n  name: string\n  /** How many items it holds; `null` where they could not be counted. */\n  items: number | null\n}\n\n/** What deleting the site does to one plugin's resources. */\nexport interface PluginSiteResourcePreview {\n  /** What one resource is called, and several: `['dataset', 'datasets']`. */\n  noun: readonly [string, string]\n  /** What one of its items is called, and several: `['record', 'records']`. */\n  itemNoun: readonly [string, string]\n  /** Shared with this site alone: erased with every item. */\n  going: PluginSiteResourceGoing[]\n  /** Shared with this site and others: they stay, and lose this site. */\n  staying: number\n}\n\nexport interface PluginSiteResourceEraser {\n  /** What deleting the site would take. Reads only. */\n  preview(request: PluginSiteResourceRequest): Promise<PluginSiteResourcePreview>\n  /** Erases the site's own resources; answers how many it erased. */\n  erase(request: PluginSiteResourceRequest): Promise<number>\n}\n\ninterface Registration {\n  pluginId: string\n  eraser: PluginSiteResourceEraser\n}\n\n/**\n * One list per process, on `globalThis` (AGL-3464): the app registers its\n * plugins' declarations from `instrumentation.ts`, which Next compiles apart\n * from the route that deletes a site, and a module-scoped list is filled in\n * one copy and read empty in the other.\n */\nconst ERASERS_KEY = Symbol.for('@aglyn/aglyn:plugin-site-resource-erasers')\n\nconst globalScope = globalThis as typeof globalThis & {\n  [ERASERS_KEY]?: Registration[]\n}\n\nconst registrations: Registration[] =\n  globalScope[ERASERS_KEY] ?? (globalScope[ERASERS_KEY] = [])\n\n/**\n * Registers a plugin's site-resource eraser. Owner = the loader's marker\n * inside a register fn, else `options.pluginId`; an eraser with neither\n * throws. One per plugin: registering again replaces the plugin's earlier\n * eraser in place, so a module evaluated twice does not erase twice.\n */\nexport function registerPluginSiteResourceEraser(\n  eraser: PluginSiteResourceEraser,\n  options?: { pluginId?: string },\n): void {\n  const pluginId = (getRegisteringPluginId() ?? options?.pluginId ?? '').trim()\n  if (!pluginId) {\n    throw new Error(\n      'a plugin site-resource eraser was registered with no owner: pass ' +\n        '{ pluginId } when registering outside a plugin register fn',\n    )\n  }\n  if (typeof eraser?.preview !== 'function' || typeof eraser?.erase !== 'function') {\n    throw new Error('a site-resource eraser needs a preview and an erase function')\n  }\n  const index = registrations.findIndex((entry) => entry.pluginId === pluginId)\n  if (index >= 0) registrations[index] = { pluginId, eraser }\n  else registrations.push({ pluginId, eraser })\n}\n\n/**\n * The erasers in place, after running the app's boot step once when none is:\n * a boot whose declarations failed must not read as a workspace with nothing\n * shared with the site.\n */\nasync function registered(): Promise<Registration[]> {\n  if (!registrations.length) {\n    await runPluginDeclarationsRepair().catch((error: unknown) => {\n      console.error('[plugins] the declarations repair failed before a site delete', error)\n    })\n  }\n  return [...registrations]\n}\n\n/** One plugin's preview, or `null` where its preview failed. */\nexport interface PluginSiteResourcePreviewRow {\n  pluginId: string\n  preview: PluginSiteResourcePreview | null\n}\n\n/**\n * Every plugin's preview, in registration order. Never throws: a preview that\n * fails is logged and answered as `null` for its plugin.\n */\nexport async function previewPluginSiteResources(\n  request: PluginSiteResourceRequest,\n): Promise<PluginSiteResourcePreviewRow[]> {\n  const rows: PluginSiteResourcePreviewRow[] = []\n  for (const { pluginId, eraser } of await registered()) {\n    try {\n      rows.push({ pluginId, preview: await eraser.preview(request) })\n    } catch (error) {\n      console.error(\n        `[plugins] ${pluginId} could not list what goes with site ${request.hostId}`,\n        error,\n      )\n      rows.push({ pluginId, preview: null })\n    }\n  }\n  return rows\n}\n\n/**\n * Runs every eraser, in registration order, and answers how many resources\n * each erased by plugin id, or `null` for one that threw. Never throws.\n */\nexport async function erasePluginSiteResources(\n  request: PluginSiteResourceRequest,\n): Promise<Record<string, number | null>> {\n  const erased: Record<string, number | null> = {}\n  for (const { pluginId, eraser } of await registered()) {\n    try {\n      erased[pluginId] = await eraser.erase(request)\n    } catch (error) {\n      erased[pluginId] = null\n      console.error(`[plugins] ${pluginId} failed to erase site ${request.hostId}'s resources`, error)\n    }\n  }\n  return erased\n}\n\n/** The plugins with a site-resource eraser, in the order they run. */\nexport function listPluginSiteResourceErasers(): string[] {\n  return registrations.map((entry) => entry.pluginId)\n}\n\n/** Test seam: forget every eraser. */\nexport function resetPluginSiteResourceErasersForTests(): void {\n  registrations.length = 0\n}\n"],"names":["globalScope","getRegisteringPluginId","runPluginDeclarationsRepair","ERASERS_KEY","Symbol","for","globalThis","registrations","registerPluginSiteResourceEraser","eraser","options","pluginId","trim","Error","preview","erase","index","findIndex","entry","push","registered","length","catch","error","console","previewPluginSiteResources","request","rows","hostId","erasePluginSiteResources","erased","listPluginSiteResourceErasers","map","resetPluginSiteResourceErasersForTests"],"mappings":"IAqGEA;AArGF;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,SAASC,sBAAsB,QAAQ,qCAAiC;AACxE,SAASC,2BAA2B,QAAQ,kCAA8B;AAyC1E;;;;;CAKC,GACD,MAAMC,cAAcC,OAAOC,GAAG,CAAC;AAE/B,MAAML,cAAcM;AAIpB,MAAMC,iBACJP,2BAAAA,WAAW,CAACG,YAAY,YAAxBH,2BAA6BA,WAAW,CAACG,YAAY,GAAG,EAAE;AAE5D;;;;;CAKC,GACD,OAAO,SAASK,iCACdC,MAAgC,EAChCC,OAA+B;QAEbT,MAAAA;IAAlB,MAAMU,WAAW,EAACV,QAAAA,0BAAAA,oCAAAA,0BAA4BS,2BAAAA,QAASC,QAAQ,YAA7CV,OAAiD,IAAIW,IAAI;IAC3E,IAAI,CAACD,UAAU;QACb,MAAM,IAAIE,MACR,sEACE;IAEN;IACA,IAAI,QAAOJ,0BAAAA,OAAQK,OAAO,MAAK,cAAc,QAAOL,0BAAAA,OAAQM,KAAK,MAAK,YAAY;QAChF,MAAM,IAAIF,MAAM;IAClB;IACA,MAAMG,QAAQT,cAAcU,SAAS,CAAC,CAACC,QAAUA,MAAMP,QAAQ,KAAKA;IACpE,IAAIK,SAAS,GAAGT,aAAa,CAACS,MAAM,GAAG;QAAEL;QAAUF;IAAO;SACrDF,cAAcY,IAAI,CAAC;QAAER;QAAUF;IAAO;AAC7C;AAEA;;;;CAIC,GACD,eAAeW;IACb,IAAI,CAACb,cAAcc,MAAM,EAAE;QACzB,MAAMnB,8BAA8BoB,KAAK,CAAC,CAACC;YACzCC,QAAQD,KAAK,CAAC,iEAAiEA;QACjF;IACF;IACA,OAAO;WAAIhB;KAAc;AAC3B;AAQA;;;CAGC,GACD,OAAO,eAAekB,2BACpBC,OAAkC;IAElC,MAAMC,OAAuC,EAAE;IAC/C,KAAK,MAAM,EAAEhB,QAAQ,EAAEF,MAAM,EAAE,IAAI,CAAA,MAAMW,YAAW,EAAG;QACrD,IAAI;YACFO,KAAKR,IAAI,CAAC;gBAAER;gBAAUG,SAAS,MAAML,OAAOK,OAAO,CAACY;YAAS;QAC/D,EAAE,OAAOH,OAAO;YACdC,QAAQD,KAAK,CACX,CAAC,UAAU,EAAEZ,SAAS,oCAAoC,EAAEe,QAAQE,MAAM,EAAE,EAC5EL;YAEFI,KAAKR,IAAI,CAAC;gBAAER;gBAAUG,SAAS;YAAK;QACtC;IACF;IACA,OAAOa;AACT;AAEA;;;CAGC,GACD,OAAO,eAAeE,yBACpBH,OAAkC;IAElC,MAAMI,SAAwC,CAAC;IAC/C,KAAK,MAAM,EAAEnB,QAAQ,EAAEF,MAAM,EAAE,IAAI,CAAA,MAAMW,YAAW,EAAG;QACrD,IAAI;YACFU,MAAM,CAACnB,SAAS,GAAG,MAAMF,OAAOM,KAAK,CAACW;QACxC,EAAE,OAAOH,OAAO;YACdO,MAAM,CAACnB,SAAS,GAAG;YACnBa,QAAQD,KAAK,CAAC,CAAC,UAAU,EAAEZ,SAAS,sBAAsB,EAAEe,QAAQE,MAAM,CAAC,YAAY,CAAC,EAAEL;QAC5F;IACF;IACA,OAAOO;AACT;AAEA,oEAAoE,GACpE,OAAO,SAASC;IACd,OAAOxB,cAAcyB,GAAG,CAAC,CAACd,QAAUA,MAAMP,QAAQ;AACpD;AAEA,oCAAoC,GACpC,OAAO,SAASsB;IACd1B,cAAcc,MAAM,GAAG;AACzB"}

package/src/lib/plugin-manager/purchase-gate-preclearance.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The gates a preclearance may waive. One today. */
+export type PurchaseGate = 'domain-payment-history';
+export interface PurchaseGatePreclearanceInput {
+    /** The workspace the purchase is for. */
+    orgId: string;
+    gate: PurchaseGate;
+}
+export interface PurchaseGatePreclearance {
+    /**
+     * A live, unused waiver for this workspace and gate, or null. Reads only:
+     * asking does not spend it.
+     */
+    check(input: PurchaseGatePreclearanceInput): Promise<{
+        preclearanceId: string;
+    } | null>;
+    /**
+     * Spend the waiver: true exactly once per id, in a transaction that marks it
+     * used only if nothing has. False for an id this implementation does not
+     * hold, one already spent, or one that expired.
+     */
+    consume(preclearanceId: string): Promise<boolean>;
+}
+/**
+ * A set: more than one surface may mint a waiver (a bundle link today), and
+ * the gate asks each in turn.
+ */
+export declare const PURCHASE_GATE_PRECLEARANCE: import("./plugin-services").PluginServiceContract<PurchaseGatePreclearance>;
+/** Installs an implementation. The console registers the bundle links at boot. */
+export declare function registerPurchaseGatePreclearance(impl: PurchaseGatePreclearance, options?: {
+    pluginId?: string;
+    key?: string;
+}): void;
+/**
+ * The first live waiver any implementation holds for the workspace and gate,
+ * or null. Never throws; an implementation that throws is skipped and
+ * logged, so it can only ever cost a waiver, never grant one.
+ */
+export declare function checkPurchaseGatePreclearance(input: PurchaseGatePreclearanceInput): Promise<{
+    preclearanceId: string;
+} | null>;
+/**
+ * Spend a waiver. True only when an implementation marked it used just now.
+ * Never throws: a failure answers false, which refuses the purchase.
+ */
+export declare function consumePurchaseGatePreclearance(preclearanceId: string): Promise<boolean>;

package/src/lib/plugin-manager/purchase-gate-preclearance.js

@@ -0,0 +1,102 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHO MAY WAIVE A PURCHASE GATE, ONCE (AGL-3955).
+ *
+ * A plugin that sells something can hold a purchase behind a gate the
+ * workspace has to earn: the domains plugin refuses to register a name until
+ * the workspace has a paid platform invoice at least 72 hours old. Core owns
+ * the one thing that can stand in for that history: a staff member who met
+ * the owner in person and minted a single-use bundle link for that one
+ * workspace, accountable for it in `adminAudit`.
+ *
+ * The plugin cannot read core's bundle-link records (a plugin never imports
+ * core's storage, and never another plugin), so the waiver is a contract
+ * here. The plugin asks `check` while deciding whether the gate refuses, and
+ * calls `consume` after it has taken its own hold and before it charges: a
+ * `false` from `consume` refuses the purchase, so one preclearance buys
+ * exactly one thing.
+ *
+ * Only the named gate is waived. Every other refusal the plugin makes (a
+ * brand lookalike, its per-workspace caps) stands, and an implementation has
+ * no say in them.
+ *
+ * ## FAILS CLOSED
+ *
+ * {@link checkPurchaseGatePreclearance} answers null on any error and when
+ * nothing is registered, and {@link consumePurchaseGatePreclearance} answers
+ * false: a waiver that cannot be confirmed is no waiver, and the gate keeps
+ * refusing.
+ */ import { definePluginServiceContract, registerPluginService, resolvePluginServices } from "./plugin-services.js";
+/**
+ * A set: more than one surface may mint a waiver (a bundle link today), and
+ * the gate asks each in turn.
+ */ export const PURCHASE_GATE_PRECLEARANCE = definePluginServiceContract('core.purchase-gate-preclearance', {
+    multiple: true
+});
+/** Installs an implementation. The console registers the bundle links at boot. */ export function registerPurchaseGatePreclearance(impl, options) {
+    if (typeof (impl == null ? void 0 : impl.check) !== 'function' || typeof (impl == null ? void 0 : impl.consume) !== 'function') {
+        throw new Error('a purchase gate preclearance needs check and consume functions');
+    }
+    registerPluginService(PURCHASE_GATE_PRECLEARANCE, impl, _extends({}, (options == null ? void 0 : options.pluginId) ? {
+        pluginId: options.pluginId
+    } : {}, (options == null ? void 0 : options.key) ? {
+        key: options.key
+    } : {}));
+}
+/**
+ * The first live waiver any implementation holds for the workspace and gate,
+ * or null. Never throws; an implementation that throws is skipped and
+ * logged, so it can only ever cost a waiver, never grant one.
+ */ export async function checkPurchaseGatePreclearance(input) {
+    var _ref;
+    const orgId = String((_ref = input == null ? void 0 : input.orgId) != null ? _ref : '').trim();
+    if (!orgId || (input == null ? void 0 : input.gate) !== 'domain-payment-history') return null;
+    for (const registration of resolvePluginServices(PURCHASE_GATE_PRECLEARANCE)){
+        try {
+            var _ref1;
+            const found = await registration.impl.check({
+                orgId,
+                gate: input.gate
+            });
+            const preclearanceId = String((_ref1 = found == null ? void 0 : found.preclearanceId) != null ? _ref1 : '').trim();
+            if (preclearanceId) return {
+                preclearanceId
+            };
+        } catch (error) {
+            console.error(`[purchase-gate-preclearance] check failed in "${registration.pluginId}"`, error);
+        }
+    }
+    return null;
+}
+/**
+ * Spend a waiver. True only when an implementation marked it used just now.
+ * Never throws: a failure answers false, which refuses the purchase.
+ */ export async function consumePurchaseGatePreclearance(preclearanceId) {
+    const id = String(preclearanceId != null ? preclearanceId : '').trim();
+    if (!id) return false;
+    for (const registration of resolvePluginServices(PURCHASE_GATE_PRECLEARANCE)){
+        try {
+            if (await registration.impl.consume(id) === true) return true;
+        } catch (error) {
+            console.error(`[purchase-gate-preclearance] consume failed in "${registration.pluginId}"`, error);
+        }
+    }
+    return false;
+}
+
+//# sourceMappingURL=purchase-gate-preclearance.js.map

package/src/lib/plugin-manager/purchase-gate-preclearance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/purchase-gate-preclearance.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHO MAY WAIVE A PURCHASE GATE, ONCE (AGL-3955).\n *\n * A plugin that sells something can hold a purchase behind a gate the\n * workspace has to earn: the domains plugin refuses to register a name until\n * the workspace has a paid platform invoice at least 72 hours old. Core owns\n * the one thing that can stand in for that history: a staff member who met\n * the owner in person and minted a single-use bundle link for that one\n * workspace, accountable for it in `adminAudit`.\n *\n * The plugin cannot read core's bundle-link records (a plugin never imports\n * core's storage, and never another plugin), so the waiver is a contract\n * here. The plugin asks `check` while deciding whether the gate refuses, and\n * calls `consume` after it has taken its own hold and before it charges: a\n * `false` from `consume` refuses the purchase, so one preclearance buys\n * exactly one thing.\n *\n * Only the named gate is waived. Every other refusal the plugin makes (a\n * brand lookalike, its per-workspace caps) stands, and an implementation has\n * no say in them.\n *\n * ## FAILS CLOSED\n *\n * {@link checkPurchaseGatePreclearance} answers null on any error and when\n * nothing is registered, and {@link consumePurchaseGatePreclearance} answers\n * false: a waiver that cannot be confirmed is no waiver, and the gate keeps\n * refusing.\n */\n\nimport {\n  definePluginServiceContract,\n  registerPluginService,\n  resolvePluginServices,\n} from './plugin-services'\n\n/** The gates a preclearance may waive. One today. */\nexport type PurchaseGate = 'domain-payment-history'\n\nexport interface PurchaseGatePreclearanceInput {\n  /** The workspace the purchase is for. */\n  orgId: string\n  gate: PurchaseGate\n}\n\nexport interface PurchaseGatePreclearance {\n  /**\n   * A live, unused waiver for this workspace and gate, or null. Reads only:\n   * asking does not spend it.\n   */\n  check(input: PurchaseGatePreclearanceInput): Promise<{ preclearanceId: string } | null>\n  /**\n   * Spend the waiver: true exactly once per id, in a transaction that marks it\n   * used only if nothing has. False for an id this implementation does not\n   * hold, one already spent, or one that expired.\n   */\n  consume(preclearanceId: string): Promise<boolean>\n}\n\n/**\n * A set: more than one surface may mint a waiver (a bundle link today), and\n * the gate asks each in turn.\n */\nexport const PURCHASE_GATE_PRECLEARANCE =\n  definePluginServiceContract<PurchaseGatePreclearance>('core.purchase-gate-preclearance', {\n    multiple: true,\n  })\n\n/** Installs an implementation. The console registers the bundle links at boot. */\nexport function registerPurchaseGatePreclearance(\n  impl: PurchaseGatePreclearance,\n  options?: { pluginId?: string; key?: string },\n): void {\n  if (typeof impl?.check !== 'function' || typeof impl?.consume !== 'function') {\n    throw new Error('a purchase gate preclearance needs check and consume functions')\n  }\n  registerPluginService(PURCHASE_GATE_PRECLEARANCE, impl, {\n    ...(options?.pluginId ? { pluginId: options.pluginId } : {}),\n    ...(options?.key ? { key: options.key } : {}),\n  })\n}\n\n/**\n * The first live waiver any implementation holds for the workspace and gate,\n * or null. Never throws; an implementation that throws is skipped and\n * logged, so it can only ever cost a waiver, never grant one.\n */\nexport async function checkPurchaseGatePreclearance(\n  input: PurchaseGatePreclearanceInput,\n): Promise<{ preclearanceId: string } | null> {\n  const orgId = String(input?.orgId ?? '').trim()\n  if (!orgId || input?.gate !== 'domain-payment-history') return null\n  for (const registration of resolvePluginServices(PURCHASE_GATE_PRECLEARANCE)) {\n    try {\n      const found = await registration.impl.check({ orgId, gate: input.gate })\n      const preclearanceId = String(found?.preclearanceId ?? '').trim()\n      if (preclearanceId) return { preclearanceId }\n    } catch (error) {\n      console.error(\n        `[purchase-gate-preclearance] check failed in \"${registration.pluginId}\"`,\n        error,\n      )\n    }\n  }\n  return null\n}\n\n/**\n * Spend a waiver. True only when an implementation marked it used just now.\n * Never throws: a failure answers false, which refuses the purchase.\n */\nexport async function consumePurchaseGatePreclearance(\n  preclearanceId: string,\n): Promise<boolean> {\n  const id = String(preclearanceId ?? '').trim()\n  if (!id) return false\n  for (const registration of resolvePluginServices(PURCHASE_GATE_PRECLEARANCE)) {\n    try {\n      if ((await registration.impl.consume(id)) === true) return true\n    } catch (error) {\n      console.error(\n        `[purchase-gate-preclearance] consume failed in \"${registration.pluginId}\"`,\n        error,\n      )\n    }\n  }\n  return false\n}\n"],"names":["definePluginServiceContract","registerPluginService","resolvePluginServices","PURCHASE_GATE_PRECLEARANCE","multiple","registerPurchaseGatePreclearance","impl","options","check","consume","Error","pluginId","key","checkPurchaseGatePreclearance","input","orgId","String","trim","gate","registration","found","preclearanceId","error","console","consumePurchaseGatePreclearance","id"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,SACEA,2BAA2B,EAC3BC,qBAAqB,EACrBC,qBAAqB,QAChB,uBAAmB;AAyB1B;;;CAGC,GACD,OAAO,MAAMC,6BACXH,4BAAsD,mCAAmC;IACvFI,UAAU;AACZ,GAAE;AAEJ,gFAAgF,GAChF,OAAO,SAASC,iCACdC,IAA8B,EAC9BC,OAA6C;IAE7C,IAAI,QAAOD,wBAAAA,KAAME,KAAK,MAAK,cAAc,QAAOF,wBAAAA,KAAMG,OAAO,MAAK,YAAY;QAC5E,MAAM,IAAIC,MAAM;IAClB;IACAT,sBAAsBE,4BAA4BG,MAAM,aAClDC,CAAAA,2BAAAA,QAASI,QAAQ,IAAG;QAAEA,UAAUJ,QAAQI,QAAQ;IAAC,IAAI,CAAC,GACtDJ,CAAAA,2BAAAA,QAASK,GAAG,IAAG;QAAEA,KAAKL,QAAQK,GAAG;IAAC,IAAI,CAAC;AAE/C;AAEA;;;;CAIC,GACD,OAAO,eAAeC,8BACpBC,KAAoC;;IAEpC,MAAMC,QAAQC,eAAOF,yBAAAA,MAAOC,KAAK,mBAAI,IAAIE,IAAI;IAC7C,IAAI,CAACF,SAASD,CAAAA,yBAAAA,MAAOI,IAAI,MAAK,0BAA0B,OAAO;IAC/D,KAAK,MAAMC,gBAAgBjB,sBAAsBC,4BAA6B;QAC5E,IAAI;;YACF,MAAMiB,QAAQ,MAAMD,aAAab,IAAI,CAACE,KAAK,CAAC;gBAAEO;gBAAOG,MAAMJ,MAAMI,IAAI;YAAC;YACtE,MAAMG,iBAAiBL,gBAAOI,yBAAAA,MAAOC,cAAc,oBAAI,IAAIJ,IAAI;YAC/D,IAAII,gBAAgB,OAAO;gBAAEA;YAAe;QAC9C,EAAE,OAAOC,OAAO;YACdC,QAAQD,KAAK,CACX,CAAC,8CAA8C,EAAEH,aAAaR,QAAQ,CAAC,CAAC,CAAC,EACzEW;QAEJ;IACF;IACA,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,eAAeE,gCACpBH,cAAsB;IAEtB,MAAMI,KAAKT,OAAOK,yBAAAA,iBAAkB,IAAIJ,IAAI;IAC5C,IAAI,CAACQ,IAAI,OAAO;IAChB,KAAK,MAAMN,gBAAgBjB,sBAAsBC,4BAA6B;QAC5E,IAAI;YACF,IAAI,AAAC,MAAMgB,aAAab,IAAI,CAACG,OAAO,CAACgB,QAAS,MAAM,OAAO;QAC7D,EAAE,OAAOH,OAAO;YACdC,QAAQD,KAAK,CACX,CAAC,gDAAgD,EAAEH,aAAaR,QAAQ,CAAC,CAAC,CAAC,EAC3EW;QAEJ;IACF;IACA,OAAO;AACT"}