@aglyn/aglyn 1.0.0-beta.285 → 1.0.0-beta.288

package/src/lib/plugin-manager/plugin-customer-display.d.ts

@@ -0,0 +1,135 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A PLUGIN'S SCREEN ON A PAIRED CUSTOMER DISPLAY (AGL-4042).
+ *
+ * A register can pair a screen that faces the customer (AGL-3608). That
+ * screen belongs to the plugin that runs the register, and until now it
+ * could show only that plugin's own prompts — a basket, a tip, a receipt
+ * choice. Another plugin that needs the customer's own hands on a screen
+ * (a form to fill in, a document to sign) had no way to ask for it.
+ *
+ * So the seam has two halves, and neither names the other plugin:
+ *
+ * 1. A **display host**: the page running a register with a connected
+ *    display registers itself here ({@link registerCustomerDisplayHost}) while
+ *    it can show something, and unregisters when it can't. Any plugin's
+ *    console widget on that page asks {@link customerDisplayHost} and, when
+ *    there is one, hands it a {@link CustomerDisplayScreen}.
+ * 2. A **screen** is one of the asking plugin's own public console pages
+ *    (`ConsolePublicPage`, served at `/kiosk/{pluginId}{path}` with no staff
+ *    session), with a few short parameters. The display opens it, and the
+ *    page sends the display back to where it came from
+ *    ({@link customerDisplayReturnPath}) when the customer is done.
+ *
+ * THE PAIRED DISPLAY IS THE AUTHORIZATION (AGL-4042). A screen's page has no
+ * staff session, and needs none: the display it runs on was paired to one
+ * store by staff, and that pairing is what it shows. The display's page hands
+ * its credential to core ({@link rememberCustomerDisplayCredential}); a
+ * screen's page reads it ({@link customerDisplayCredential}) and sends it to
+ * its own plugin's server, which asks core who the display is
+ * (`plugin-customer-display-verifier`): the store it is paired to, the screen
+ * it is showing now, and who put that screen there. Nothing is minted per
+ * screen, nothing is opened or closed, and nothing names the plugin on the
+ * other side.
+ *
+ * The display opens only a page the plugin DECLARED public: the console's
+ * public route refuses any other before a byte of the plugin loads. The
+ * parameters are capped and plain, because they ride the display's state and
+ * its address bar; they must never carry a customer's details, and never the
+ * display's credential.
+ *
+ * A screen has no timer (AGL-4042): it stays, however long the customer
+ * takes, until the register shows something else on the display, the plugin
+ * takes it off ({@link CustomerDisplayHost.close}), or its page sends the
+ * display back once the customer is done. A screen's page follows the
+ * register by asking its server whether its screen is still the one showing.
+ *
+ * Client-only, React-free, and reached by its own subpath, never the barrel:
+ * a published page has no use for it.
+ */
+/** What a plugin asks a paired display to show. */
+export interface CustomerDisplayScreen {
+    /** The plugin whose public page it is. */
+    pluginId: string;
+    /** The page's path beneath `/kiosk/{pluginId}`, with its leading slash: `/display-sign`. */
+    path: string;
+    /** Short plain values the page reads from its query string. Never a customer's details. */
+    params: Record<string, string>;
+}
+/** The query key a screen's page reads the display's own address from. */
+export declare const CUSTOMER_DISPLAY_RETURN_PARAM = "return";
+/**
+ * A screen as a register may store it, or `null` for anything else: a plugin
+ * id and a public page path in their own shapes, and at most eight short
+ * string parameters with plain keys. The return address is never one of
+ * them; the display adds its own.
+ */
+export declare function sanitizeCustomerDisplayScreen(raw: unknown): CustomerDisplayScreen | null;
+/** Whether a path is a display's own address, which a screen may send it back to. */
+export declare function isCustomerDisplayReturnPath(path: unknown): path is string;
+/**
+ * Where a display opens a screen: the plugin's public page with the screen's
+ * parameters and, under {@link CUSTOMER_DISPLAY_RETURN_PARAM}, the display's
+ * own address to come back to. `null` for a screen or a return address out
+ * of shape.
+ */
+export declare function customerDisplayScreenHref(screen: CustomerDisplayScreen, returnTo: string): string | null;
+/** The address a screen's page sends the display back to, from its query string, or `null`. */
+export declare function customerDisplayReturnPath(search: string): string | null;
+/** What the page running a register offers while it has a display to show things on. */
+export interface CustomerDisplayHost {
+    /** Puts a plugin's screen on the display; `false` when it could not. */
+    show(screen: CustomerDisplayScreen): Promise<boolean>;
+    /**
+     * Takes this plugin's screen off the display, when it is the one the
+     * register last put there, so the display shows the register's own screen
+     * again; `false` when it could not. A screen of another plugin, or one the
+     * register already replaced, is left alone (and answers `true`: this
+     * plugin's screen is not showing). A display already on the plugin's page
+     * goes back when that page sees its screen is no longer the one showing.
+     */
+    close?(pluginId: string): Promise<boolean>;
+}
+/**
+ * Offers a display host to every plugin on the page, replacing any other;
+ * answers the function that withdraws it (and only it).
+ */
+export declare function registerCustomerDisplayHost(host: CustomerDisplayHost): () => void;
+/** The display host on this page, or `null` when no register here has a display to show on. */
+export declare function customerDisplayHost(): CustomerDisplayHost | null;
+/** Calls `listener` whenever a host arrives or leaves; answers the unsubscribe. */
+export declare function subscribeCustomerDisplayHost(listener: () => void): () => void;
+/**
+ * Where the display's credential is kept on the display itself: the
+ * browser's own storage for the console's public pages, which the display's
+ * page and every screen's page share.
+ */
+export declare const CUSTOMER_DISPLAY_CREDENTIAL_KEY = "aglyn.customerDisplay.credential";
+/**
+ * Called by the page that RUNS a paired display (AGL-4042): keeps the
+ * credential its pairing gave it where a screen's page can read it, or
+ * forgets it (`null`) when the display is unpaired. Best effort: a browser
+ * that refuses storage keeps nothing, and a screen's page then signs nothing.
+ */
+export declare function rememberCustomerDisplayCredential(credential: string | null): void;
+/**
+ * The credential of the paired display this page is running on, for a
+ * screen's page to send to its own plugin's server, which asks core's
+ * verifier who the display is; `null` on a device that is not one.
+ */
+export declare function customerDisplayCredential(): string | null;

package/src/lib/plugin-manager/plugin-customer-display.js

@@ -0,0 +1,189 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A PLUGIN'S SCREEN ON A PAIRED CUSTOMER DISPLAY (AGL-4042).
+ *
+ * A register can pair a screen that faces the customer (AGL-3608). That
+ * screen belongs to the plugin that runs the register, and until now it
+ * could show only that plugin's own prompts — a basket, a tip, a receipt
+ * choice. Another plugin that needs the customer's own hands on a screen
+ * (a form to fill in, a document to sign) had no way to ask for it.
+ *
+ * So the seam has two halves, and neither names the other plugin:
+ *
+ * 1. A **display host**: the page running a register with a connected
+ *    display registers itself here ({@link registerCustomerDisplayHost}) while
+ *    it can show something, and unregisters when it can't. Any plugin's
+ *    console widget on that page asks {@link customerDisplayHost} and, when
+ *    there is one, hands it a {@link CustomerDisplayScreen}.
+ * 2. A **screen** is one of the asking plugin's own public console pages
+ *    (`ConsolePublicPage`, served at `/kiosk/{pluginId}{path}` with no staff
+ *    session), with a few short parameters. The display opens it, and the
+ *    page sends the display back to where it came from
+ *    ({@link customerDisplayReturnPath}) when the customer is done.
+ *
+ * THE PAIRED DISPLAY IS THE AUTHORIZATION (AGL-4042). A screen's page has no
+ * staff session, and needs none: the display it runs on was paired to one
+ * store by staff, and that pairing is what it shows. The display's page hands
+ * its credential to core ({@link rememberCustomerDisplayCredential}); a
+ * screen's page reads it ({@link customerDisplayCredential}) and sends it to
+ * its own plugin's server, which asks core who the display is
+ * (`plugin-customer-display-verifier`): the store it is paired to, the screen
+ * it is showing now, and who put that screen there. Nothing is minted per
+ * screen, nothing is opened or closed, and nothing names the plugin on the
+ * other side.
+ *
+ * The display opens only a page the plugin DECLARED public: the console's
+ * public route refuses any other before a byte of the plugin loads. The
+ * parameters are capped and plain, because they ride the display's state and
+ * its address bar; they must never carry a customer's details, and never the
+ * display's credential.
+ *
+ * A screen has no timer (AGL-4042): it stays, however long the customer
+ * takes, until the register shows something else on the display, the plugin
+ * takes it off ({@link CustomerDisplayHost.close}), or its page sends the
+ * display back once the customer is done. A screen's page follows the
+ * register by asking its server whether its screen is still the one showing.
+ *
+ * Client-only, React-free, and reached by its own subpath, never the barrel:
+ * a published page has no use for it.
+ */ /** What a plugin asks a paired display to show. */ import { _ as _extends } from "@swc/helpers/_/_extends";
+var _globalScope_REGISTRY_KEY;
+/** The query key a screen's page reads the display's own address from. */ export const CUSTOMER_DISPLAY_RETURN_PARAM = 'return';
+const PLUGIN_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const PATH = /^(\/[a-z0-9][a-z0-9-]{0,63}){1,4}$/;
+const PARAM_KEY = /^[a-zA-Z][a-zA-Z0-9]{0,31}$/;
+const MAX_PARAMS = 8;
+const MAX_PARAM_LENGTH = 2000;
+/** A display's own address: a public console page, and nothing that leaves it. */ const RETURN_PATH = /^\/kiosk(\/[a-z0-9][a-z0-9-]{0,63}){1,5}$/;
+/**
+ * A screen as a register may store it, or `null` for anything else: a plugin
+ * id and a public page path in their own shapes, and at most eight short
+ * string parameters with plain keys. The return address is never one of
+ * them; the display adds its own.
+ */ export function sanitizeCustomerDisplayScreen(raw) {
+    var _input_pluginId, _input_path;
+    const input = raw && typeof raw === 'object' ? raw : {};
+    const pluginId = String((_input_pluginId = input['pluginId']) != null ? _input_pluginId : '');
+    const path = String((_input_path = input['path']) != null ? _input_path : '');
+    if (!PLUGIN_ID.test(pluginId) || !PATH.test(path)) return null;
+    const rawParams = input['params'] && typeof input['params'] === 'object' ? input['params'] : {};
+    const entries = Object.entries(rawParams);
+    if (entries.length > MAX_PARAMS) return null;
+    const params = {};
+    for (const [key, value] of entries){
+        if (!PARAM_KEY.test(key) || key === CUSTOMER_DISPLAY_RETURN_PARAM || typeof value !== 'string') return null;
+        if (value.length > MAX_PARAM_LENGTH) return null;
+        params[key] = value;
+    }
+    return {
+        pluginId,
+        path,
+        params
+    };
+}
+/** Whether a path is a display's own address, which a screen may send it back to. */ export function isCustomerDisplayReturnPath(path) {
+    return typeof path === 'string' && RETURN_PATH.test(path);
+}
+/**
+ * Where a display opens a screen: the plugin's public page with the screen's
+ * parameters and, under {@link CUSTOMER_DISPLAY_RETURN_PARAM}, the display's
+ * own address to come back to. `null` for a screen or a return address out
+ * of shape.
+ */ export function customerDisplayScreenHref(screen, returnTo) {
+    const clean = sanitizeCustomerDisplayScreen(screen);
+    if (!clean || !isCustomerDisplayReturnPath(returnTo)) return null;
+    const query = new URLSearchParams(_extends({}, clean.params, {
+        [CUSTOMER_DISPLAY_RETURN_PARAM]: returnTo
+    }));
+    return `/kiosk/${clean.pluginId}${clean.path}?${query.toString()}`;
+}
+/** The address a screen's page sends the display back to, from its query string, or `null`. */ export function customerDisplayReturnPath(search) {
+    const value = new URLSearchParams(search).get(CUSTOMER_DISPLAY_RETURN_PARAM);
+    return isCustomerDisplayReturnPath(value) ? value : null;
+}
+/**
+ * One registry per JavaScript realm, on `globalThis` under `Symbol.for`
+ * (AGL-3947), so two copies of this module in one bundle agree on whether a
+ * display is there.
+ */ const REGISTRY_KEY = Symbol.for('@aglyn/aglyn:customer-display-host');
+const globalScope = globalThis;
+const registry = (_globalScope_REGISTRY_KEY = globalScope[REGISTRY_KEY]) != null ? _globalScope_REGISTRY_KEY : globalScope[REGISTRY_KEY] = {
+    host: null,
+    listeners: new Set()
+};
+const notify = ()=>{
+    for (const listener of [
+        ...registry.listeners
+    ])listener();
+};
+/**
+ * Offers a display host to every plugin on the page, replacing any other;
+ * answers the function that withdraws it (and only it).
+ */ export function registerCustomerDisplayHost(host) {
+    registry.host = host;
+    notify();
+    return ()=>{
+        if (registry.host !== host) return;
+        registry.host = null;
+        notify();
+    };
+}
+/** The display host on this page, or `null` when no register here has a display to show on. */ export function customerDisplayHost() {
+    return registry.host;
+}
+/** Calls `listener` whenever a host arrives or leaves; answers the unsubscribe. */ export function subscribeCustomerDisplayHost(listener) {
+    registry.listeners.add(listener);
+    return ()=>{
+        registry.listeners.delete(listener);
+    };
+}
+/**
+ * Where the display's credential is kept on the display itself: the
+ * browser's own storage for the console's public pages, which the display's
+ * page and every screen's page share.
+ */ export const CUSTOMER_DISPLAY_CREDENTIAL_KEY = 'aglyn.customerDisplay.credential';
+const CREDENTIAL = /^[A-Za-z0-9_.~-]{16,512}$/;
+/**
+ * Called by the page that RUNS a paired display (AGL-4042): keeps the
+ * credential its pairing gave it where a screen's page can read it, or
+ * forgets it (`null`) when the display is unpaired. Best effort: a browser
+ * that refuses storage keeps nothing, and a screen's page then signs nothing.
+ */ export function rememberCustomerDisplayCredential(credential) {
+    try {
+        if (credential && CREDENTIAL.test(credential)) {
+            window.localStorage.setItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY, credential);
+        } else {
+            window.localStorage.removeItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY);
+        }
+    } catch (unused) {
+    // No storage: nothing to keep, and nothing kept.
+    }
+}
+/**
+ * The credential of the paired display this page is running on, for a
+ * screen's page to send to its own plugin's server, which asks core's
+ * verifier who the display is; `null` on a device that is not one.
+ */ export function customerDisplayCredential() {
+    try {
+        const value = window.localStorage.getItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY);
+        return value && CREDENTIAL.test(value) ? value : null;
+    } catch (unused) {
+        return null;
+    }
+}
+
+//# sourceMappingURL=plugin-customer-display.js.map

package/src/lib/plugin-manager/plugin-customer-display.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-customer-display.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A PLUGIN'S SCREEN ON A PAIRED CUSTOMER DISPLAY (AGL-4042).\n *\n * A register can pair a screen that faces the customer (AGL-3608). That\n * screen belongs to the plugin that runs the register, and until now it\n * could show only that plugin's own prompts — a basket, a tip, a receipt\n * choice. Another plugin that needs the customer's own hands on a screen\n * (a form to fill in, a document to sign) had no way to ask for it.\n *\n * So the seam has two halves, and neither names the other plugin:\n *\n * 1. A **display host**: the page running a register with a connected\n *    display registers itself here ({@link registerCustomerDisplayHost}) while\n *    it can show something, and unregisters when it can't. Any plugin's\n *    console widget on that page asks {@link customerDisplayHost} and, when\n *    there is one, hands it a {@link CustomerDisplayScreen}.\n * 2. A **screen** is one of the asking plugin's own public console pages\n *    (`ConsolePublicPage`, served at `/kiosk/{pluginId}{path}` with no staff\n *    session), with a few short parameters. The display opens it, and the\n *    page sends the display back to where it came from\n *    ({@link customerDisplayReturnPath}) when the customer is done.\n *\n * THE PAIRED DISPLAY IS THE AUTHORIZATION (AGL-4042). A screen's page has no\n * staff session, and needs none: the display it runs on was paired to one\n * store by staff, and that pairing is what it shows. The display's page hands\n * its credential to core ({@link rememberCustomerDisplayCredential}); a\n * screen's page reads it ({@link customerDisplayCredential}) and sends it to\n * its own plugin's server, which asks core who the display is\n * (`plugin-customer-display-verifier`): the store it is paired to, the screen\n * it is showing now, and who put that screen there. Nothing is minted per\n * screen, nothing is opened or closed, and nothing names the plugin on the\n * other side.\n *\n * The display opens only a page the plugin DECLARED public: the console's\n * public route refuses any other before a byte of the plugin loads. The\n * parameters are capped and plain, because they ride the display's state and\n * its address bar; they must never carry a customer's details, and never the\n * display's credential.\n *\n * A screen has no timer (AGL-4042): it stays, however long the customer\n * takes, until the register shows something else on the display, the plugin\n * takes it off ({@link CustomerDisplayHost.close}), or its page sends the\n * display back once the customer is done. A screen's page follows the\n * register by asking its server whether its screen is still the one showing.\n *\n * Client-only, React-free, and reached by its own subpath, never the barrel:\n * a published page has no use for it.\n */\n\n/** What a plugin asks a paired display to show. */\nexport interface CustomerDisplayScreen {\n  /** The plugin whose public page it is. */\n  pluginId: string\n  /** The page's path beneath `/kiosk/{pluginId}`, with its leading slash: `/display-sign`. */\n  path: string\n  /** Short plain values the page reads from its query string. Never a customer's details. */\n  params: Record<string, string>\n}\n\n/** The query key a screen's page reads the display's own address from. */\nexport const CUSTOMER_DISPLAY_RETURN_PARAM = 'return'\n\nconst PLUGIN_ID = /^[a-z0-9][a-z0-9-]{0,63}$/\nconst PATH = /^(\\/[a-z0-9][a-z0-9-]{0,63}){1,4}$/\nconst PARAM_KEY = /^[a-zA-Z][a-zA-Z0-9]{0,31}$/\nconst MAX_PARAMS = 8\nconst MAX_PARAM_LENGTH = 2000\n/** A display's own address: a public console page, and nothing that leaves it. */\nconst RETURN_PATH = /^\\/kiosk(\\/[a-z0-9][a-z0-9-]{0,63}){1,5}$/\n\n/**\n * A screen as a register may store it, or `null` for anything else: a plugin\n * id and a public page path in their own shapes, and at most eight short\n * string parameters with plain keys. The return address is never one of\n * them; the display adds its own.\n */\nexport function sanitizeCustomerDisplayScreen(raw: unknown): CustomerDisplayScreen | null {\n  const input = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>\n  const pluginId = String(input['pluginId'] ?? '')\n  const path = String(input['path'] ?? '')\n  if (!PLUGIN_ID.test(pluginId) || !PATH.test(path)) return null\n  const rawParams = (input['params'] && typeof input['params'] === 'object' ? input['params'] : {}) as Record<\n    string,\n    unknown\n  >\n  const entries = Object.entries(rawParams)\n  if (entries.length > MAX_PARAMS) return null\n  const params: Record<string, string> = {}\n  for (const [key, value] of entries) {\n    if (!PARAM_KEY.test(key) || key === CUSTOMER_DISPLAY_RETURN_PARAM || typeof value !== 'string') return null\n    if (value.length > MAX_PARAM_LENGTH) return null\n    params[key] = value\n  }\n  return { pluginId, path, params }\n}\n\n/** Whether a path is a display's own address, which a screen may send it back to. */\nexport function isCustomerDisplayReturnPath(path: unknown): path is string {\n  return typeof path === 'string' && RETURN_PATH.test(path)\n}\n\n/**\n * Where a display opens a screen: the plugin's public page with the screen's\n * parameters and, under {@link CUSTOMER_DISPLAY_RETURN_PARAM}, the display's\n * own address to come back to. `null` for a screen or a return address out\n * of shape.\n */\nexport function customerDisplayScreenHref(screen: CustomerDisplayScreen, returnTo: string): string | null {\n  const clean = sanitizeCustomerDisplayScreen(screen)\n  if (!clean || !isCustomerDisplayReturnPath(returnTo)) return null\n  const query = new URLSearchParams({ ...clean.params, [CUSTOMER_DISPLAY_RETURN_PARAM]: returnTo })\n  return `/kiosk/${clean.pluginId}${clean.path}?${query.toString()}`\n}\n\n/** The address a screen's page sends the display back to, from its query string, or `null`. */\nexport function customerDisplayReturnPath(search: string): string | null {\n  const value = new URLSearchParams(search).get(CUSTOMER_DISPLAY_RETURN_PARAM)\n  return isCustomerDisplayReturnPath(value) ? value : null\n}\n\n/** What the page running a register offers while it has a display to show things on. */\nexport interface CustomerDisplayHost {\n  /** Puts a plugin's screen on the display; `false` when it could not. */\n  show(screen: CustomerDisplayScreen): Promise<boolean>\n  /**\n   * Takes this plugin's screen off the display, when it is the one the\n   * register last put there, so the display shows the register's own screen\n   * again; `false` when it could not. A screen of another plugin, or one the\n   * register already replaced, is left alone (and answers `true`: this\n   * plugin's screen is not showing). A display already on the plugin's page\n   * goes back when that page sees its screen is no longer the one showing.\n   */\n  close?(pluginId: string): Promise<boolean>\n}\n\ninterface HostRegistry {\n  host: CustomerDisplayHost | null\n  listeners: Set<() => void>\n}\n\n/**\n * One registry per JavaScript realm, on `globalThis` under `Symbol.for`\n * (AGL-3947), so two copies of this module in one bundle agree on whether a\n * display is there.\n */\nconst REGISTRY_KEY = Symbol.for('@aglyn/aglyn:customer-display-host')\nconst globalScope = globalThis as typeof globalThis & { [REGISTRY_KEY]?: HostRegistry }\nconst registry: HostRegistry =\n  globalScope[REGISTRY_KEY] ?? (globalScope[REGISTRY_KEY] = { host: null, listeners: new Set() })\n\nconst notify = () => {\n  for (const listener of [...registry.listeners]) listener()\n}\n\n/**\n * Offers a display host to every plugin on the page, replacing any other;\n * answers the function that withdraws it (and only it).\n */\nexport function registerCustomerDisplayHost(host: CustomerDisplayHost): () => void {\n  registry.host = host\n  notify()\n  return () => {\n    if (registry.host !== host) return\n    registry.host = null\n    notify()\n  }\n}\n\n/** The display host on this page, or `null` when no register here has a display to show on. */\nexport function customerDisplayHost(): CustomerDisplayHost | null {\n  return registry.host\n}\n\n/** Calls `listener` whenever a host arrives or leaves; answers the unsubscribe. */\nexport function subscribeCustomerDisplayHost(listener: () => void): () => void {\n  registry.listeners.add(listener)\n  return () => {\n    registry.listeners.delete(listener)\n  }\n}\n\n/**\n * Where the display's credential is kept on the display itself: the\n * browser's own storage for the console's public pages, which the display's\n * page and every screen's page share.\n */\nexport const CUSTOMER_DISPLAY_CREDENTIAL_KEY = 'aglyn.customerDisplay.credential'\n\nconst CREDENTIAL = /^[A-Za-z0-9_.~-]{16,512}$/\n\n/**\n * Called by the page that RUNS a paired display (AGL-4042): keeps the\n * credential its pairing gave it where a screen's page can read it, or\n * forgets it (`null`) when the display is unpaired. Best effort: a browser\n * that refuses storage keeps nothing, and a screen's page then signs nothing.\n */\nexport function rememberCustomerDisplayCredential(credential: string | null): void {\n  try {\n    if (credential && CREDENTIAL.test(credential)) {\n      window.localStorage.setItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY, credential)\n    } else {\n      window.localStorage.removeItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY)\n    }\n  } catch {\n    // No storage: nothing to keep, and nothing kept.\n  }\n}\n\n/**\n * The credential of the paired display this page is running on, for a\n * screen's page to send to its own plugin's server, which asks core's\n * verifier who the display is; `null` on a device that is not one.\n */\nexport function customerDisplayCredential(): string | null {\n  try {\n    const value = window.localStorage.getItem(CUSTOMER_DISPLAY_CREDENTIAL_KEY)\n    return value && CREDENTIAL.test(value) ? value : null\n  } catch {\n    return null\n  }\n}\n"],"names":["globalScope","CUSTOMER_DISPLAY_RETURN_PARAM","PLUGIN_ID","PATH","PARAM_KEY","MAX_PARAMS","MAX_PARAM_LENGTH","RETURN_PATH","sanitizeCustomerDisplayScreen","raw","input","pluginId","String","path","test","rawParams","entries","Object","length","params","key","value","isCustomerDisplayReturnPath","customerDisplayScreenHref","screen","returnTo","clean","query","URLSearchParams","toString","customerDisplayReturnPath","search","get","REGISTRY_KEY","Symbol","for","globalThis","registry","host","listeners","Set","notify","listener","registerCustomerDisplayHost","customerDisplayHost","subscribeCustomerDisplayHost","add","delete","CUSTOMER_DISPLAY_CREDENTIAL_KEY","CREDENTIAL","rememberCustomerDisplayCredential","credential","window","localStorage","setItem","removeItem","customerDisplayCredential","getItem"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CC,GAED,iDAAiD;IAmG/CA;AAzFF,wEAAwE,GACxE,OAAO,MAAMC,gCAAgC,SAAQ;AAErD,MAAMC,YAAY;AAClB,MAAMC,OAAO;AACb,MAAMC,YAAY;AAClB,MAAMC,aAAa;AACnB,MAAMC,mBAAmB;AACzB,gFAAgF,GAChF,MAAMC,cAAc;AAEpB;;;;;CAKC,GACD,OAAO,SAASC,8BAA8BC,GAAY;QAEhCC,iBACJA;IAFpB,MAAMA,QAASD,OAAO,OAAOA,QAAQ,WAAWA,MAAM,CAAC;IACvD,MAAME,WAAWC,QAAOF,kBAAAA,KAAK,CAAC,WAAW,YAAjBA,kBAAqB;IAC7C,MAAMG,OAAOD,QAAOF,cAAAA,KAAK,CAAC,OAAO,YAAbA,cAAiB;IACrC,IAAI,CAACR,UAAUY,IAAI,CAACH,aAAa,CAACR,KAAKW,IAAI,CAACD,OAAO,OAAO;IAC1D,MAAME,YAAaL,KAAK,CAAC,SAAS,IAAI,OAAOA,KAAK,CAAC,SAAS,KAAK,WAAWA,KAAK,CAAC,SAAS,GAAG,CAAC;IAI/F,MAAMM,UAAUC,OAAOD,OAAO,CAACD;IAC/B,IAAIC,QAAQE,MAAM,GAAGb,YAAY,OAAO;IACxC,MAAMc,SAAiC,CAAC;IACxC,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIL,QAAS;QAClC,IAAI,CAACZ,UAAUU,IAAI,CAACM,QAAQA,QAAQnB,iCAAiC,OAAOoB,UAAU,UAAU,OAAO;QACvG,IAAIA,MAAMH,MAAM,GAAGZ,kBAAkB,OAAO;QAC5Ca,MAAM,CAACC,IAAI,GAAGC;IAChB;IACA,OAAO;QAAEV;QAAUE;QAAMM;IAAO;AAClC;AAEA,mFAAmF,GACnF,OAAO,SAASG,4BAA4BT,IAAa;IACvD,OAAO,OAAOA,SAAS,YAAYN,YAAYO,IAAI,CAACD;AACtD;AAEA;;;;;CAKC,GACD,OAAO,SAASU,0BAA0BC,MAA6B,EAAEC,QAAgB;IACvF,MAAMC,QAAQlB,8BAA8BgB;IAC5C,IAAI,CAACE,SAAS,CAACJ,4BAA4BG,WAAW,OAAO;IAC7D,MAAME,QAAQ,IAAIC,gBAAgB,aAAKF,MAAMP,MAAM;QAAE,CAAClB,8BAA8B,EAAEwB;;IACtF,OAAO,CAAC,OAAO,EAAEC,MAAMf,QAAQ,GAAGe,MAAMb,IAAI,CAAC,CAAC,EAAEc,MAAME,QAAQ,IAAI;AACpE;AAEA,6FAA6F,GAC7F,OAAO,SAASC,0BAA0BC,MAAc;IACtD,MAAMV,QAAQ,IAAIO,gBAAgBG,QAAQC,GAAG,CAAC/B;IAC9C,OAAOqB,4BAA4BD,SAASA,QAAQ;AACtD;AAsBA;;;;CAIC,GACD,MAAMY,eAAeC,OAAOC,GAAG,CAAC;AAChC,MAAMnC,cAAcoC;AACpB,MAAMC,YACJrC,4BAAAA,WAAW,CAACiC,aAAa,YAAzBjC,4BAA8BA,WAAW,CAACiC,aAAa,GAAG;IAAEK,MAAM;IAAMC,WAAW,IAAIC;AAAM;AAE/F,MAAMC,SAAS;IACb,KAAK,MAAMC,YAAY;WAAIL,SAASE,SAAS;KAAC,CAAEG;AAClD;AAEA;;;CAGC,GACD,OAAO,SAASC,4BAA4BL,IAAyB;IACnED,SAASC,IAAI,GAAGA;IAChBG;IACA,OAAO;QACL,IAAIJ,SAASC,IAAI,KAAKA,MAAM;QAC5BD,SAASC,IAAI,GAAG;QAChBG;IACF;AACF;AAEA,6FAA6F,GAC7F,OAAO,SAASG;IACd,OAAOP,SAASC,IAAI;AACtB;AAEA,iFAAiF,GACjF,OAAO,SAASO,6BAA6BH,QAAoB;IAC/DL,SAASE,SAAS,CAACO,GAAG,CAACJ;IACvB,OAAO;QACLL,SAASE,SAAS,CAACQ,MAAM,CAACL;IAC5B;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMM,kCAAkC,mCAAkC;AAEjF,MAAMC,aAAa;AAEnB;;;;;CAKC,GACD,OAAO,SAASC,kCAAkCC,UAAyB;IACzE,IAAI;QACF,IAAIA,cAAcF,WAAWnC,IAAI,CAACqC,aAAa;YAC7CC,OAAOC,YAAY,CAACC,OAAO,CAACN,iCAAiCG;QAC/D,OAAO;YACLC,OAAOC,YAAY,CAACE,UAAU,CAACP;QACjC;IACF,EAAE,eAAM;IACN,iDAAiD;IACnD;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASQ;IACd,IAAI;QACF,MAAMnC,QAAQ+B,OAAOC,YAAY,CAACI,OAAO,CAACT;QAC1C,OAAO3B,SAAS4B,WAAWnC,IAAI,CAACO,SAASA,QAAQ;IACnD,EAAE,eAAM;QACN,OAAO;IACT;AACF"}

package/src/lib/plugin-manager/plugin-entitlements.d.ts

@@ -169,6 +169,52 @@ export interface PluginOrgPermissionDeclaration {
     group?: string;
     /** The heading of a group of the plugin's own; absent: the plugin's catalog label. */
     groupLabel?: string;
+    /**
+     * A broader key this one is a finer part of (AGL-4047): never granted
+     * without it, and following it where nothing sets this key. See
+     * `PluginPermission.refines`.
+     */
+    refines?: string;
+    /**
+     * A key this one takes its verdict from where nothing sets it, without
+     * needing it (AGL-4047). See `PluginPermission.follows`.
+     */
+    follows?: string;
+    /**
+     * A site can narrow this key, and the built-in roles' default for whether
+     * it does (AGL-4047). See `PluginPermission.narrowsPerSite`. Ignored on a
+     * key whose preset is the site role (`presetFromSiteRole`).
+     */
+    narrowsPerSite?: boolean | Partial<Record<OrgRole, boolean>>;
+    /**
+     * The key's preset is the member's role ON THE SITE, for every member
+     * (AGL-4047), not only for a site collaborator: the owner and admins are
+     * admins of every site, a workspace-wide editor or viewer holds their
+     * workspace role on a site unless the site gives them other access there
+     * (narrower or wider), and a collaborator holds their site role. So the
+     * key reads `hostRoleDefaults` for whatever access the member has on the
+     * site a request names, exactly as a gate on that host role did, and a
+     * custom role, the member's own permissions and that site's toggle then
+     * grant or refuse it like any other key. Needs `hostRoleDefaults`, and
+     * `roleDefaults` that match them tier for tier (the owner and admins on
+     * Admin, editors on Editor, viewers on Viewer), which is the answer with
+     * no site named.
+     *
+     * For a key that replaces a gate on the site role (who may edit a site's
+     * stays, say), so the built-in roles keep exactly the access they had
+     * while the key becomes grantable and deniable like every other.
+     */
+    presetFromSiteRole?: boolean;
+    /**
+     * With `presetFromSiteRole`: the site role is the preset only for a member
+     * of the WHOLE workspace (AGL-4047). Someone added to one site only holds
+     * the key there when the site's toggle grants it, whatever their site role,
+     * and `hostRoleDefaults` is not their default. For a key that replaces a
+     * gate asking for an admin of the whole workspace who is also this site's
+     * admin (refunds, say): a site's Members card can make a contractor the
+     * admin of one site, and that never carried those acts.
+     */
+    workspaceMembersOnly?: boolean;
 }
 /**
  * One key of the ONE permission catalog that a plugin contributes (AGL-4047),
@@ -187,6 +233,19 @@ export interface PluginCatalogPermission {
     group: string;
     groupLabel: string;
     source: 'catalog' | 'tier';
+    /** The broader key this one refines, when it does. */
+    refines?: string;
+    /** The key this one follows without needing it, when it does. */
+    follows?: string;
+    /**
+     * Present when a site can narrow the key (AGL-4047): each built-in role's
+     * default for whether it does, normalized from the declaration.
+     */
+    narrowsPerSite?: Readonly<Record<OrgRole, boolean>>;
+    /** The key's preset is the member's role on the site (AGL-4047); see the declaration's. */
+    presetFromSiteRole?: true;
+    /** That preset holds for members of the whole workspace only (AGL-4047); see the declaration's. */
+    workspaceMembersOnly?: true;
 }
 export interface PluginEntitlementRegistration {
     pluginId: string;

package/src/lib/plugin-manager/plugin-entitlements.js

@@ -173,6 +173,23 @@ const reportedCatalogRefusals = new Set();
     var _FIRST_PARTY_PLUGINS_find;
     return (_ref = (_FIRST_PARTY_PLUGINS_find = FIRST_PARTY_PLUGINS.find((plugin)=>plugin.id === pluginId)) == null ? void 0 : _FIRST_PARTY_PLUGINS_find.label) != null ? _ref : pluginId;
 }
+/**
+ * A declaration's `narrowsPerSite`, normalized to each built-in role's
+ * default (AGL-4047): `true` or `false` names every role, a map names each,
+ * a role it leaves out keeps. Absent: the key is not one a site can narrow.
+ */ function narrowingDefaultsOf(declared) {
+    if (declared === undefined || declared === null) return {};
+    const every = typeof declared === 'boolean' ? declared : undefined;
+    const map = typeof declared === 'object' ? declared : {};
+    return {
+        narrowsPerSite: {
+            owner: every != null ? every : map.owner === true,
+            admin: every != null ? every : map.admin === true,
+            editor: every != null ? every : map.editor === true,
+            viewer: every != null ? every : map.viewer === true
+        }
+    };
+}
 /**
  * Every key plugins contribute to the permission catalog, through EITHER
  * declaration API, in catalog order (AGL-4047): per plugin, its
@@ -218,11 +235,19 @@ const reportedCatalogRefusals = new Set();
             group: (_permission_group = permission.group) != null ? _permission_group : permission.pluginId,
             groupLabel: (_permission_groupLabel = permission.groupLabel) != null ? _permission_groupLabel : pluginLabel(permission.pluginId),
             source: 'catalog'
-        }));
+        }, permission.refines ? {
+            refines: permission.refines
+        } : {}, permission.follows ? {
+            follows: permission.follows
+        } : {}, permission.presetFromSiteRole && permission.hostRoleDefaults ? _extends({
+            presetFromSiteRole: true
+        }, permission.workspaceMembersOnly ? {
+            workspaceMembersOnly: true
+        } : {}) : narrowingDefaultsOf(permission.narrowsPerSite)));
     }
     for (const permission of listPluginPermissions()){
         var _permission_description, _permission_group1, _permission_groupLabel1;
-        add({
+        add(_extends({
             key: permission.key,
             label: permission.label,
             description: (_permission_description = permission.description) != null ? _permission_description : '',
@@ -231,7 +256,11 @@ const reportedCatalogRefusals = new Set();
             group: (_permission_group1 = permission.group) != null ? _permission_group1 : permission.pluginId,
             groupLabel: (_permission_groupLabel1 = permission.groupLabel) != null ? _permission_groupLabel1 : pluginLabel(permission.pluginId),
             source: 'tier'
-        });
+        }, permission.refines ? {
+            refines: permission.refines
+        } : {}, permission.follows ? {
+            follows: permission.follows
+        } : {}, narrowingDefaultsOf(permission.narrowsPerSite)));
     }
     return [
         ...byPlugin.keys()

package/src/lib/plugin-manager/plugin-entitlements.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-entitlements.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Plugin-declared billing and access keys (AGL-2940).\n *\n * A plugin that sells something, gates something, or can be switched off in\n * an incident declares the KEYS here — a seat add-on, a feature flag, a\n * lockdown lever, a permission — and the core catalogs that used to be\n * edited for each one read the declarations instead:\n *\n * - `plan-entitlements` folds every registered seat add-on into\n *   `resolveOrgEntitlements` (a quota raised per unit, features switched on)\n *   and answers a registered feature's plan defaults;\n * - `lockdown` lists a registered lever on the staff page, carries its label,\n *   its staff-bypass rule and its visitor notice, and maps the API paths it\n *   names onto it for the plugin dispatcher;\n * - `plugin-permissions` receives the permissions with the owner filled in;\n * - `org-permissions` folds every declared catalog key into the org\n *   permission catalog — the role editor, custom roles, per-member overrides\n *   and the rules stamp — and `host-permissions` decides the keys that\n *   declare host-role defaults for a site collaborator, per site.\n *\n * The NUMBERS stay where they are checked. A seat add-on's price is a row in\n * `PLAN_PRICING`, read by the Stripe wiring and reconciled by\n * `check-pricing-drift`; a declaration names the quota it widens and by how\n * much per plan, and nothing here restates a price.\n *\n * Registration order is deterministic: the catalog order of\n * `FIRST_PARTY_PLUGINS`, then any other id alphabetically. Plugin modules\n * load in parallel, so the order they REGISTER in is whatever the network\n * gave, and a list that followed it would put the staff lockdown checklist\n * in a different order per session.\n */\n\nimport type { AglynOrgBilling, HostAccessRole, OrgPlan, OrgRole } from '../foundation'\nimport { declarationRoleDefaults } from '../app-utils/org-role-grants'\nimport { FIRST_PARTY_PLUGINS } from './enabled-plugins'\nimport {\n  listPluginPermissions,\n  registerPluginPermissions,\n  type PluginPermission,\n} from './plugin-permissions'\n\nexport interface PluginSeatAddonDeclaration {\n  /** The `org.seatAddons` key the purchase is stored under (`aiAddon`). */\n  key: string\n  label: string\n  /**\n   * How many purchased units count. `1` for an org-wide add-on that is\n   * bought once, where a doubled webhook item or a hand edit above one is\n   * still one purchase; absent to count the stored quantity.\n   */\n  maxUnits?: number\n  /**\n   * The quota each unit widens: the resolved entitlement named by `key`\n   * gains `perUnit(org, plan) × units` when the figure depends on WHAT was\n   * bought (the Aglyn AI tier, AGL-3965), else `perUnitByPlan[plan] × units`.\n   * A plan the add-on is not sold on answers 0.\n   */\n  quota?: {\n    key: string\n    perUnitByPlan?: Readonly<Record<OrgPlan, number>>\n    /**\n     * The per-unit figure read off the org itself. `org` is the billing\n     * document as `resolveOrgEntitlements` received it and `plan` its\n     * effective plan.\n     */\n    perUnit?: (org: Readonly<Partial<AglynOrgBilling>>, plan: OrgPlan) => number\n  }\n  /** Feature flags a purchased unit switches on. */\n  features?: readonly string[]\n  /**\n   * Whether a plan sells the add-on, when `perUnitByPlan` cannot say so\n   * (a `perUnit` quota, AGL-3965). Absent: sold where `perUnitByPlan` names\n   * a figure above zero, or everywhere for an add-on with no quota.\n   */\n  soldOn?: (plan: OrgPlan) => boolean\n}\n\n/**\n * Whether a plan sells a declared seat add-on: its own `soldOn`, else a\n * `perUnitByPlan` figure above zero for the plan, else (no quota) yes.\n */\nexport function pluginSeatAddonSoldOn(\n  addon: PluginSeatAddonDeclaration,\n  plan: OrgPlan,\n): boolean {\n  if (addon.soldOn) return addon.soldOn(plan)\n  if (!addon.quota) return true\n  return (addon.quota.perUnitByPlan?.[plan] ?? 0) > 0\n}\n\nexport interface PluginFeatureDeclaration {\n  /** The `OrgFeatureFlags` key. */\n  key: string\n  label: string\n  /**\n   * The plan defaults, when the key is not one the plan tables already\n   * carry. Absent means the plan tables decide, which is the case for every\n   * key that predates this registry.\n   */\n  defaultByPlan?: Readonly<Partial<Record<OrgPlan, boolean>>>\n}\n\nexport interface PluginLockdownFeatureDeclaration {\n  /** The lever's wire identity (`ai-generate`). */\n  key: string\n  /** The staff checklist's label. */\n  label: string\n  /**\n   * What the lever is called in the customer's mail when staff pull it for\n   * their workspace (`media uploads`, `AI generation`). A noun phrase that\n   * reads right mid-sentence (\"our team paused media uploads\") and after a\n   * colon, so lowercase unless it starts with a name or an acronym. The\n   * staff `label` never reaches a customer.\n   */\n  customerName: string\n  /**\n   * Whether a verified staff claim passes the lock. Granted where a staff\n   * action aids incident response — one real call proves a provider is back\n   * — and withheld where the staff action would BE the incident.\n   */\n  staffBypass: boolean\n  /**\n   * What a visitor reads while the lever is pulled: what is paused AND what\n   * still works. The expected-back window is appended by the notice builder.\n   */\n  notice: { title: string; body: string }\n  /**\n   * Plugin API paths the lever gates at the dispatcher: exact paths, and\n   * prefixes matched on a segment boundary (`ai/generate` also gates\n   * `ai/generate/section`, never `ai/generated-report`).\n   */\n  apiPaths?: { exact?: readonly string[]; prefixes?: readonly string[] }\n}\n\n/**\n * A key a plugin adds to the org permission CATALOG (AGL-2984): the granular\n * map custom roles and per-member overrides are stored in, that\n * `resolveOrgPermissions` layers and the rules stamp carries, and that the\n * role editor lists. A declared key is stored, layered and resolved exactly\n * like a core key; the declaration supplies what a core key's catalog entry\n * and role table supply.\n */\nexport interface PluginOrgPermissionDeclaration {\n  /** The dotted key a custom role and a per-member override store (`reviews.reply`). */\n  key: string\n  /** The role editor's line for the key, and the word a refusal names. */\n  label: string\n  /** What the key opens, under the label in the role editor. */\n  description: string\n  /** Each org role's verdict when no custom role or per-member override sets the key. */\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  /**\n   * Each HOST role's verdict, for a key a site collaborator holds per site.\n   *\n   * A collaborator's membership carries no org standing to refine — it\n   * exists only to carry access to named sites — so a key with this field is\n   * decided for them on the site a request names: the host role they hold\n   * there, refined by the per-site toggle on their member document. A key\n   * without it is never held by a collaborator.\n   */\n  hostRoleDefaults?: Readonly<Record<HostAccessRole, boolean>>\n  /**\n   * The role editor's group for the key (AGL-4047): a core group id\n   * (`CORE_ORG_PERMISSION_GROUPS`) or, absent, a group of the plugin's own.\n   */\n  group?: string\n  /** The heading of a group of the plugin's own; absent: the plugin's catalog label. */\n  groupLabel?: string\n}\n\n/**\n * One key of the ONE permission catalog that a plugin contributes (AGL-4047),\n * whichever of the two declaration APIs it came through:\n * `registerPluginEntitlements({ orgPermissions })` (`source: 'catalog'`) or\n * `registerPluginPermissions` (`source: 'tier'`, its per-tier defaults read\n * as org-role defaults, the owner on the admin tier).\n */\nexport interface PluginCatalogPermission {\n  key: string\n  label: string\n  description: string\n  pluginId: string\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  hostRoleDefaults?: Readonly<Record<HostAccessRole, boolean>>\n  group: string\n  groupLabel: string\n  source: 'catalog' | 'tier'\n}\n\nexport interface PluginEntitlementRegistration {\n  pluginId: string\n  seatAddons?: readonly PluginSeatAddonDeclaration[]\n  features?: readonly PluginFeatureDeclaration[]\n  lockdownFeatures?: readonly PluginLockdownFeatureDeclaration[]\n  /** Per-tier keys a plugin's own pages read (`registerPluginPermissions`). */\n  permissions?: readonly Omit<PluginPermission, 'pluginId'>[]\n  /** Keys added to the org permission catalog — see {@link PluginOrgPermissionDeclaration}. */\n  orgPermissions?: readonly PluginOrgPermissionDeclaration[]\n}\n\n/**\n * The registrations and their listeners, held on `globalThis` rather than in\n * module `const`s (AGL-3596), as the custom field registry and the\n * declarations repair hook are (AGL-3412).\n *\n * An app registers the plugins' declarations from `instrumentation.ts`, which\n * Next compiles into a different module graph from the routes. A module-scoped\n * map was filled in the instrumentation's copy and read empty in a route's, so\n * a core route that never loaded a plugin knew none of its keys: the site\n * create door asked for `ai.generate`, read `undefined` from a catalog that\n * had never heard of it, and every guided AI start was born with the starter.\n * One map per process, under a `Symbol.for` key, is the same map in every\n * copy.\n */\nconst REGISTRY_KEY = Symbol.for('@aglyn/aglyn:plugin-entitlements')\n\ninterface PluginEntitlementsRegistry {\n  registrations: Map<string, PluginEntitlementRegistration>\n  /**\n   * Readers of the registrations that keep a derived view in step with them —\n   * every copy of the org permission catalog rebuilds itself on every\n   * registration and reset, because a plugin's declarations can register\n   * after a module that imported the catalog was evaluated, and in another\n   * module graph's copy of this file.\n   */\n  listeners: Set<() => void>\n}\n\nconst globalScope = globalThis as typeof globalThis & {\n  [REGISTRY_KEY]?: PluginEntitlementsRegistry\n}\n\nconst registry: PluginEntitlementsRegistry = (globalScope[REGISTRY_KEY] ??= {\n  registrations: new Map(),\n  listeners: new Set(),\n})\n\nconst registrations = registry.registrations\nconst listeners = registry.listeners\n\n/** Calls `listener` after every registration and reset; answers the unsubscribe. */\nexport function subscribePluginEntitlements(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => {\n    listeners.delete(listener)\n  }\n}\n\nfunction notifyListeners(): void {\n  for (const listener of [...listeners]) listener()\n}\n\nconst CATALOG_ORDER = new Map(\n  FIRST_PARTY_PLUGINS.map((plugin, index) => [plugin.id, index]),\n)\n\nfunction catalogRank(pluginId: string): number {\n  return CATALOG_ORDER.get(pluginId) ?? Number.MAX_SAFE_INTEGER\n}\n\nfunction orderedRegistrations(): PluginEntitlementRegistration[] {\n  return [...registrations.values()].sort(\n    (a, b) =>\n      catalogRank(a.pluginId) - catalogRank(b.pluginId) ||\n      a.pluginId.localeCompare(b.pluginId),\n  )\n}\n\nfunction refuseStolenKeys(\n  pluginId: string,\n  kind: 'seat add-on' | 'lockdown feature' | 'org permission',\n  keys: readonly string[],\n  ownerOf: (key: string) => string | undefined,\n): void {\n  for (const key of keys) {\n    const owner = ownerOf(key)\n    if (owner && owner !== pluginId) {\n      throw new Error(\n        `${kind} \"${key}\" is already declared by \"${owner}\"; refused \"${pluginId}\"`,\n      )\n    }\n  }\n}\n\n/**\n * Idempotent per plugin — re-registration replaces that plugin's\n * declarations. A seat add-on, lockdown or catalog permission key another\n * plugin already owns refuses the whole registration: one key, one owner,\n * or the two declarations disagree about what the key means.\n */\nexport function registerPluginEntitlements(\n  registration: PluginEntitlementRegistration,\n): void {\n  const pluginId = registration.pluginId.trim()\n  if (!pluginId) throw new Error('plugin entitlements need a pluginId')\n  refuseStolenKeys(\n    pluginId,\n    'seat add-on',\n    (registration.seatAddons ?? []).map((entry) => entry.key),\n    (key) => pluginSeatAddonOwner(key),\n  )\n  refuseStolenKeys(\n    pluginId,\n    'lockdown feature',\n    (registration.lockdownFeatures ?? []).map((entry) => entry.key),\n    (key) => pluginLockdownFeatureOwner(key),\n  )\n  refuseStolenKeys(\n    pluginId,\n    'org permission',\n    (registration.orgPermissions ?? []).map((entry) => entry.key),\n    (key) => pluginOrgPermissionOwner(key) ?? pluginTierPermissionOwner(key),\n  )\n  registrations.set(pluginId, { ...registration, pluginId })\n  if (registration.permissions?.length) {\n    registerPluginPermissions(\n      registration.permissions.map((permission) => ({ ...permission, pluginId })),\n    )\n  }\n  notifyListeners()\n}\n\nfunction pluginSeatAddonOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.seatAddons?.some((addon) => addon.key === key)) return entry.pluginId\n  }\n  return undefined\n}\n\nfunction pluginLockdownFeatureOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.lockdownFeatures?.some((feature) => feature.key === key)) {\n      return entry.pluginId\n    }\n  }\n  return undefined\n}\n\nfunction pluginOrgPermissionOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.orgPermissions?.some((permission) => permission.key === key)) {\n      return entry.pluginId\n    }\n  }\n  return undefined\n}\n\nfunction pluginTierPermissionOwner(key: string): string | undefined {\n  return listPluginPermissions().find((permission) => permission.key === key)?.pluginId\n}\n\n/** Refusals already logged by `listPluginCatalogPermissions`, so each is reported once. */\n// boot-registry: per copy — it only de-duplicates a warning; a second compiled copy logging the same refusal once more is harmless, and nothing reads it to decide anything.\nconst reportedCatalogRefusals = new Set<string>()\n\n/** A plugin's catalog label, the heading its own permission group carries. */\nfunction pluginLabel(pluginId: string): string {\n  return FIRST_PARTY_PLUGINS.find((plugin) => plugin.id === pluginId)?.label ?? pluginId\n}\n\n/**\n * Every key plugins contribute to the permission catalog, through EITHER\n * declaration API, in catalog order (AGL-4047): per plugin, its\n * `orgPermissions` declarations and then its `registerPluginPermissions`\n * keys. A key both APIs carry for the same plugin is the catalog\n * declaration's; one a DIFFERENT plugin already declared is refused and\n * logged once, the first declaration keeping its meaning and defaults.\n *\n * Read live: both registries fill at plugin module scope, which can be after\n * any reader of this was evaluated.\n */\nexport function listPluginCatalogPermissions(): PluginCatalogPermission[] {\n  const byPlugin = new Map<string, PluginCatalogPermission[]>()\n  const owner = new Map<string, string>()\n  const add = (entry: PluginCatalogPermission): void => {\n    const incumbent = owner.get(entry.key)\n    if (incumbent !== undefined) {\n      if (incumbent !== entry.pluginId) {\n        const refusal = `${entry.pluginId}\\x00${entry.key}`\n        if (!reportedCatalogRefusals.has(refusal)) {\n          reportedCatalogRefusals.add(refusal)\n          console.error(\n            `[plugins] refused permission key \"${entry.key}\" to \"${entry.pluginId}\": ` +\n              `already declared by \"${incumbent}\"`,\n          )\n        }\n      }\n      return\n    }\n    owner.set(entry.key, entry.pluginId)\n    const list = byPlugin.get(entry.pluginId) ?? []\n    list.push(entry)\n    byPlugin.set(entry.pluginId, list)\n  }\n  for (const permission of listPluginOrgPermissions()) {\n    add({\n      key: permission.key,\n      label: permission.label,\n      description: permission.description,\n      pluginId: permission.pluginId,\n      roleDefaults: declarationRoleDefaults(permission),\n      ...(permission.hostRoleDefaults ? { hostRoleDefaults: permission.hostRoleDefaults } : {}),\n      group: permission.group ?? permission.pluginId,\n      groupLabel: permission.groupLabel ?? pluginLabel(permission.pluginId),\n      source: 'catalog',\n    })\n  }\n  for (const permission of listPluginPermissions()) {\n    add({\n      key: permission.key,\n      label: permission.label,\n      description: permission.description ?? '',\n      pluginId: permission.pluginId,\n      roleDefaults: declarationRoleDefaults(permission),\n      group: permission.group ?? permission.pluginId,\n      groupLabel: permission.groupLabel ?? pluginLabel(permission.pluginId),\n      source: 'tier',\n    })\n  }\n  return [...byPlugin.keys()]\n    .sort((a, b) => catalogRank(a) - catalogRank(b) || a.localeCompare(b))\n    .flatMap((pluginId) => byPlugin.get(pluginId) ?? [])\n}\n\n/** Every declared catalog permission, in catalog order, with the plugin that declared it. */\nexport function listPluginOrgPermissions(): Array<\n  PluginOrgPermissionDeclaration & { pluginId: string }\n> {\n  return orderedRegistrations().flatMap((entry) =>\n    (entry.orgPermissions ?? []).map((permission) => ({\n      ...permission,\n      pluginId: entry.pluginId,\n    })),\n  )\n}\n\n/** Every declared seat add-on, in catalog order. */\nexport function listPluginSeatAddons(): PluginSeatAddonDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [...(entry.seatAddons ?? [])])\n}\n\n/** One declared seat add-on by its `seatAddons` key. */\nexport function pluginSeatAddon(key: string): PluginSeatAddonDeclaration | undefined {\n  return listPluginSeatAddons().find((entry) => entry.key === key)\n}\n\n/** Every declared feature, in catalog order. */\nexport function listPluginFeatures(): PluginFeatureDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [...(entry.features ?? [])])\n}\n\n/** Every declared lockdown lever, in catalog order. */\nexport function listPluginLockdownFeatures(): PluginLockdownFeatureDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [\n    ...(entry.lockdownFeatures ?? []),\n  ])\n}\n\n/** One declared lockdown lever by key. */\nexport function pluginLockdownFeature(\n  key: string,\n): PluginLockdownFeatureDeclaration | undefined {\n  return listPluginLockdownFeatures().find((entry) => entry.key === key)\n}\n\n/** The plugin that declared a lockdown lever, for attribution. */\nexport function pluginIdForLockdownFeature(key: string): string | undefined {\n  return pluginLockdownFeatureOwner(key)\n}\n\n/** Every registration, in catalog order. */\nexport function listPluginEntitlementRegistrations(): PluginEntitlementRegistration[] {\n  return orderedRegistrations()\n}\n\n/**\n * Test seam: forget every registration. The per-tier permissions stay\n * registered; the catalog permissions go with their registrations.\n */\nexport function resetPluginEntitlementsForTests(): void {\n  registrations.clear()\n  notifyListeners()\n}\n"],"names":["globalScope","REGISTRY_KEY","declarationRoleDefaults","FIRST_PARTY_PLUGINS","listPluginPermissions","registerPluginPermissions","pluginSeatAddonSoldOn","addon","plan","soldOn","quota","perUnitByPlan","Symbol","for","globalThis","registry","registrations","Map","listeners","Set","subscribePluginEntitlements","listener","add","delete","notifyListeners","CATALOG_ORDER","map","plugin","index","id","catalogRank","pluginId","get","Number","MAX_SAFE_INTEGER","orderedRegistrations","values","sort","a","b","localeCompare","refuseStolenKeys","kind","keys","ownerOf","key","owner","Error","registerPluginEntitlements","registration","trim","seatAddons","entry","pluginSeatAddonOwner","lockdownFeatures","pluginLockdownFeatureOwner","orgPermissions","pluginOrgPermissionOwner","pluginTierPermissionOwner","set","permissions","length","permission","some","undefined","feature","find","reportedCatalogRefusals","pluginLabel","label","listPluginCatalogPermissions","byPlugin","incumbent","refusal","has","console","error","list","push","listPluginOrgPermissions","description","roleDefaults","hostRoleDefaults","group","groupLabel","source","flatMap","listPluginSeatAddons","pluginSeatAddon","listPluginFeatures","features","listPluginLockdownFeatures","pluginLockdownFeature","pluginIdForLockdownFeature","listPluginEntitlementRegistrations","resetPluginEntitlementsForTests","clear"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC;IA0M6CA,cAAYC,eAAZD;AAvM9C,SAASE,uBAAuB,QAAQ,kCAA8B;AACtE,SAASC,mBAAmB,QAAQ,uBAAmB;AACvD,SACEC,qBAAqB,EACrBC,yBAAyB,QAEpB,0BAAsB;AAsC7B;;;CAGC,GACD,OAAO,SAASC,sBACdC,KAAiC,EACjCC,IAAa;;QAILD;IAFR,IAAIA,MAAME,MAAM,EAAE,OAAOF,MAAME,MAAM,CAACD;IACtC,IAAI,CAACD,MAAMG,KAAK,EAAE,OAAO;IACzB,OAAO,UAACH,6BAAAA,MAAMG,KAAK,CAACC,aAAa,qBAAzBJ,0BAA2B,CAACC,KAAK,mBAAI,KAAK;AACpD;AAgHA;;;;;;;;;;;;;CAaC,GACD,MAAMP,eAAeW,OAAOC,GAAG,CAAC;AAchC,MAAMb,cAAcc;AAIpB,MAAMC,YAAwCf,IAAAA,CAAAA,eAAAA,YAAW,CAACC,gBAAAA,aAAa,YAAzBD,IAAAA,YAAW,CAACC,cAAa,GAAK;IAC1Ee,eAAe,IAAIC;IACnBC,WAAW,IAAIC;AACjB;AAEA,MAAMH,gBAAgBD,SAASC,aAAa;AAC5C,MAAME,YAAYH,SAASG,SAAS;AAEpC,kFAAkF,GAClF,OAAO,SAASE,4BAA4BC,QAAoB;IAC9DH,UAAUI,GAAG,CAACD;IACd,OAAO;QACLH,UAAUK,MAAM,CAACF;IACnB;AACF;AAEA,SAASG;IACP,KAAK,MAAMH,YAAY;WAAIH;KAAU,CAAEG;AACzC;AAEA,MAAMI,gBAAgB,IAAIR,IACxBd,oBAAoBuB,GAAG,CAAC,CAACC,QAAQC,QAAU;QAACD,OAAOE,EAAE;QAAED;KAAM;AAG/D,SAASE,YAAYC,QAAgB;QAC5BN;IAAP,QAAOA,qBAAAA,cAAcO,GAAG,CAACD,qBAAlBN,qBAA+BQ,OAAOC,gBAAgB;AAC/D;AAEA,SAASC;IACP,OAAO;WAAInB,cAAcoB,MAAM;KAAG,CAACC,IAAI,CACrC,CAACC,GAAGC,IACFT,YAAYQ,EAAEP,QAAQ,IAAID,YAAYS,EAAER,QAAQ,KAChDO,EAAEP,QAAQ,CAACS,aAAa,CAACD,EAAER,QAAQ;AAEzC;AAEA,SAASU,iBACPV,QAAgB,EAChBW,IAA2D,EAC3DC,IAAuB,EACvBC,OAA4C;IAE5C,KAAK,MAAMC,OAAOF,KAAM;QACtB,MAAMG,QAAQF,QAAQC;QACtB,IAAIC,SAASA,UAAUf,UAAU;YAC/B,MAAM,IAAIgB,MACR,GAAGL,KAAK,EAAE,EAAEG,IAAI,0BAA0B,EAAEC,MAAM,YAAY,EAAEf,SAAS,CAAC,CAAC;QAE/E;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASiB,2BACdC,YAA2C;QAOxCA,0BAMAA,gCAMAA;QAICA;IArBJ,MAAMlB,WAAWkB,aAAalB,QAAQ,CAACmB,IAAI;IAC3C,IAAI,CAACnB,UAAU,MAAM,IAAIgB,MAAM;IAC/BN,iBACEV,UACA,eACA,EAACkB,2BAAAA,aAAaE,UAAU,YAAvBF,2BAA2B,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GACxD,CAACA,MAAQQ,qBAAqBR;IAEhCJ,iBACEV,UACA,oBACA,EAACkB,iCAAAA,aAAaK,gBAAgB,YAA7BL,iCAAiC,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GAC9D,CAACA,MAAQU,2BAA2BV;IAEtCJ,iBACEV,UACA,kBACA,EAACkB,+BAAAA,aAAaO,cAAc,YAA3BP,+BAA+B,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GAC5D,CAACA;YAAQY;gBAAAA,4BAAAA,yBAAyBZ,gBAAzBY,4BAAiCC,0BAA0Bb;;IAEtE7B,cAAc2C,GAAG,CAAC5B,UAAU,aAAKkB;QAAclB;;IAC/C,KAAIkB,4BAAAA,aAAaW,WAAW,qBAAxBX,0BAA0BY,MAAM,EAAE;QACpCxD,0BACE4C,aAAaW,WAAW,CAAClC,GAAG,CAAC,CAACoC,aAAgB,aAAKA;gBAAY/B;;IAEnE;IACAP;AACF;AAEA,SAAS6B,qBAAqBR,GAAW;IACvC,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,oBAAAA,MAAMD,UAAU,qBAAhBC,kBAAkBW,IAAI,CAAC,CAACxD,QAAUA,MAAMsC,GAAG,KAAKA,MAAM,OAAOO,MAAMrB,QAAQ;IACjF;IACA,OAAOiC;AACT;AAEA,SAAST,2BAA2BV,GAAW;IAC7C,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,0BAAAA,MAAME,gBAAgB,qBAAtBF,wBAAwBW,IAAI,CAAC,CAACE,UAAYA,QAAQpB,GAAG,KAAKA,MAAM;YAClE,OAAOO,MAAMrB,QAAQ;QACvB;IACF;IACA,OAAOiC;AACT;AAEA,SAASP,yBAAyBZ,GAAW;IAC3C,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,wBAAAA,MAAMI,cAAc,qBAApBJ,sBAAsBW,IAAI,CAAC,CAACD,aAAeA,WAAWjB,GAAG,KAAKA,MAAM;YACtE,OAAOO,MAAMrB,QAAQ;QACvB;IACF;IACA,OAAOiC;AACT;AAEA,SAASN,0BAA0Bb,GAAW;QACrCzC;IAAP,QAAOA,8BAAAA,wBAAwB8D,IAAI,CAAC,CAACJ,aAAeA,WAAWjB,GAAG,KAAKA,yBAAhEzC,4BAAsE2B,QAAQ;AACvF;AAEA,yFAAyF,GACzF,6KAA6K;AAC7K,MAAMoC,0BAA0B,IAAIhD;AAEpC,4EAA4E,GAC5E,SAASiD,YAAYrC,QAAgB;;QAC5B5B;IAAP,gBAAOA,4BAAAA,oBAAoB+D,IAAI,CAAC,CAACvC,SAAWA,OAAOE,EAAE,KAAKE,8BAAnD5B,0BAA8DkE,KAAK,mBAAItC;AAChF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASuC;IACd,MAAMC,WAAW,IAAItD;IACrB,MAAM6B,QAAQ,IAAI7B;IAClB,MAAMK,MAAM,CAAC8B;YAgBEmB;QAfb,MAAMC,YAAY1B,MAAMd,GAAG,CAACoB,MAAMP,GAAG;QACrC,IAAI2B,cAAcR,WAAW;YAC3B,IAAIQ,cAAcpB,MAAMrB,QAAQ,EAAE;gBAChC,MAAM0C,UAAU,GAAGrB,MAAMrB,QAAQ,CAAC,IAAI,EAAEqB,MAAMP,GAAG,EAAE;gBACnD,IAAI,CAACsB,wBAAwBO,GAAG,CAACD,UAAU;oBACzCN,wBAAwB7C,GAAG,CAACmD;oBAC5BE,QAAQC,KAAK,CACX,CAAC,kCAAkC,EAAExB,MAAMP,GAAG,CAAC,MAAM,EAAEO,MAAMrB,QAAQ,CAAC,GAAG,CAAC,GACxE,CAAC,qBAAqB,EAAEyC,UAAU,CAAC,CAAC;gBAE1C;YACF;YACA;QACF;QACA1B,MAAMa,GAAG,CAACP,MAAMP,GAAG,EAAEO,MAAMrB,QAAQ;QACnC,MAAM8C,QAAON,gBAAAA,SAASvC,GAAG,CAACoB,MAAMrB,QAAQ,aAA3BwC,gBAAgC,EAAE;QAC/CM,KAAKC,IAAI,CAAC1B;QACVmB,SAASZ,GAAG,CAACP,MAAMrB,QAAQ,EAAE8C;IAC/B;IACA,KAAK,MAAMf,cAAciB,2BAA4B;YAQ1CjB,mBACKA;QARdxC,IAAI;YACFuB,KAAKiB,WAAWjB,GAAG;YACnBwB,OAAOP,WAAWO,KAAK;YACvBW,aAAalB,WAAWkB,WAAW;YACnCjD,UAAU+B,WAAW/B,QAAQ;YAC7BkD,cAAc/E,wBAAwB4D;WAClCA,WAAWoB,gBAAgB,GAAG;YAAEA,kBAAkBpB,WAAWoB,gBAAgB;QAAC,IAAI,CAAC;YACvFC,KAAK,GAAErB,oBAAAA,WAAWqB,KAAK,YAAhBrB,oBAAoBA,WAAW/B,QAAQ;YAC9CqD,UAAU,GAAEtB,yBAAAA,WAAWsB,UAAU,YAArBtB,yBAAyBM,YAAYN,WAAW/B,QAAQ;YACpEsD,QAAQ;;IAEZ;IACA,KAAK,MAAMvB,cAAc1D,wBAAyB;YAIjC0D,yBAGNA,oBACKA;QAPdxC,IAAI;YACFuB,KAAKiB,WAAWjB,GAAG;YACnBwB,OAAOP,WAAWO,KAAK;YACvBW,WAAW,GAAElB,0BAAAA,WAAWkB,WAAW,YAAtBlB,0BAA0B;YACvC/B,UAAU+B,WAAW/B,QAAQ;YAC7BkD,cAAc/E,wBAAwB4D;YACtCqB,KAAK,GAAErB,qBAAAA,WAAWqB,KAAK,YAAhBrB,qBAAoBA,WAAW/B,QAAQ;YAC9CqD,UAAU,GAAEtB,0BAAAA,WAAWsB,UAAU,YAArBtB,0BAAyBM,YAAYN,WAAW/B,QAAQ;YACpEsD,QAAQ;QACV;IACF;IACA,OAAO;WAAId,SAAS5B,IAAI;KAAG,CACxBN,IAAI,CAAC,CAACC,GAAGC,IAAMT,YAAYQ,KAAKR,YAAYS,MAAMD,EAAEE,aAAa,CAACD,IAClE+C,OAAO,CAAC,CAACvD;YAAawC;gBAAAA,gBAAAA,SAASvC,GAAG,CAACD,qBAAbwC,gBAA0B,EAAE;;AACvD;AAEA,2FAA2F,GAC3F,OAAO,SAASQ;IAGd,OAAO5C,uBAAuBmD,OAAO,CAAC,CAAClC;YACpCA;eAAD,EAACA,wBAAAA,MAAMI,cAAc,YAApBJ,wBAAwB,EAAE,EAAE1B,GAAG,CAAC,CAACoC,aAAgB,aAC7CA;gBACH/B,UAAUqB,MAAMrB,QAAQ;;;AAG9B;AAEA,kDAAkD,GAClD,OAAO,SAASwD;IACd,OAAOpD,uBAAuBmD,OAAO,CAAC,CAAClC;YAAeA;eAAL;gBAAKA,oBAAAA,MAAMD,UAAU,YAAhBC,oBAAoB,EAAE;SAAE;;AAChF;AAEA,sDAAsD,GACtD,OAAO,SAASoC,gBAAgB3C,GAAW;IACzC,OAAO0C,uBAAuBrB,IAAI,CAAC,CAACd,QAAUA,MAAMP,GAAG,KAAKA;AAC9D;AAEA,8CAA8C,GAC9C,OAAO,SAAS4C;IACd,OAAOtD,uBAAuBmD,OAAO,CAAC,CAAClC;YAAeA;eAAL;gBAAKA,kBAAAA,MAAMsC,QAAQ,YAAdtC,kBAAkB,EAAE;SAAE;;AAC9E;AAEA,qDAAqD,GACrD,OAAO,SAASuC;IACd,OAAOxD,uBAAuBmD,OAAO,CAAC,CAAClC;YACjCA;eAD2C;gBAC3CA,0BAAAA,MAAME,gBAAgB,YAAtBF,0BAA0B,EAAE;SACjC;;AACH;AAEA,wCAAwC,GACxC,OAAO,SAASwC,sBACd/C,GAAW;IAEX,OAAO8C,6BAA6BzB,IAAI,CAAC,CAACd,QAAUA,MAAMP,GAAG,KAAKA;AACpE;AAEA,gEAAgE,GAChE,OAAO,SAASgD,2BAA2BhD,GAAW;IACpD,OAAOU,2BAA2BV;AACpC;AAEA,0CAA0C,GAC1C,OAAO,SAASiD;IACd,OAAO3D;AACT;AAEA;;;CAGC,GACD,OAAO,SAAS4D;IACd/E,cAAcgF,KAAK;IACnBxE;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-entitlements.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Plugin-declared billing and access keys (AGL-2940).\n *\n * A plugin that sells something, gates something, or can be switched off in\n * an incident declares the KEYS here — a seat add-on, a feature flag, a\n * lockdown lever, a permission — and the core catalogs that used to be\n * edited for each one read the declarations instead:\n *\n * - `plan-entitlements` folds every registered seat add-on into\n *   `resolveOrgEntitlements` (a quota raised per unit, features switched on)\n *   and answers a registered feature's plan defaults;\n * - `lockdown` lists a registered lever on the staff page, carries its label,\n *   its staff-bypass rule and its visitor notice, and maps the API paths it\n *   names onto it for the plugin dispatcher;\n * - `plugin-permissions` receives the permissions with the owner filled in;\n * - `org-permissions` folds every declared catalog key into the org\n *   permission catalog — the role editor, custom roles, per-member overrides\n *   and the rules stamp — and `host-permissions` decides the keys that\n *   declare host-role defaults for a site collaborator, per site.\n *\n * The NUMBERS stay where they are checked. A seat add-on's price is a row in\n * `PLAN_PRICING`, read by the Stripe wiring and reconciled by\n * `check-pricing-drift`; a declaration names the quota it widens and by how\n * much per plan, and nothing here restates a price.\n *\n * Registration order is deterministic: the catalog order of\n * `FIRST_PARTY_PLUGINS`, then any other id alphabetically. Plugin modules\n * load in parallel, so the order they REGISTER in is whatever the network\n * gave, and a list that followed it would put the staff lockdown checklist\n * in a different order per session.\n */\n\nimport type { AglynOrgBilling, HostAccessRole, OrgPlan, OrgRole } from '../foundation'\nimport { declarationRoleDefaults } from '../app-utils/org-role-grants'\nimport { FIRST_PARTY_PLUGINS } from './enabled-plugins'\nimport {\n  listPluginPermissions,\n  registerPluginPermissions,\n  type PluginPermission,\n} from './plugin-permissions'\n\nexport interface PluginSeatAddonDeclaration {\n  /** The `org.seatAddons` key the purchase is stored under (`aiAddon`). */\n  key: string\n  label: string\n  /**\n   * How many purchased units count. `1` for an org-wide add-on that is\n   * bought once, where a doubled webhook item or a hand edit above one is\n   * still one purchase; absent to count the stored quantity.\n   */\n  maxUnits?: number\n  /**\n   * The quota each unit widens: the resolved entitlement named by `key`\n   * gains `perUnit(org, plan) × units` when the figure depends on WHAT was\n   * bought (the Aglyn AI tier, AGL-3965), else `perUnitByPlan[plan] × units`.\n   * A plan the add-on is not sold on answers 0.\n   */\n  quota?: {\n    key: string\n    perUnitByPlan?: Readonly<Record<OrgPlan, number>>\n    /**\n     * The per-unit figure read off the org itself. `org` is the billing\n     * document as `resolveOrgEntitlements` received it and `plan` its\n     * effective plan.\n     */\n    perUnit?: (org: Readonly<Partial<AglynOrgBilling>>, plan: OrgPlan) => number\n  }\n  /** Feature flags a purchased unit switches on. */\n  features?: readonly string[]\n  /**\n   * Whether a plan sells the add-on, when `perUnitByPlan` cannot say so\n   * (a `perUnit` quota, AGL-3965). Absent: sold where `perUnitByPlan` names\n   * a figure above zero, or everywhere for an add-on with no quota.\n   */\n  soldOn?: (plan: OrgPlan) => boolean\n}\n\n/**\n * Whether a plan sells a declared seat add-on: its own `soldOn`, else a\n * `perUnitByPlan` figure above zero for the plan, else (no quota) yes.\n */\nexport function pluginSeatAddonSoldOn(\n  addon: PluginSeatAddonDeclaration,\n  plan: OrgPlan,\n): boolean {\n  if (addon.soldOn) return addon.soldOn(plan)\n  if (!addon.quota) return true\n  return (addon.quota.perUnitByPlan?.[plan] ?? 0) > 0\n}\n\nexport interface PluginFeatureDeclaration {\n  /** The `OrgFeatureFlags` key. */\n  key: string\n  label: string\n  /**\n   * The plan defaults, when the key is not one the plan tables already\n   * carry. Absent means the plan tables decide, which is the case for every\n   * key that predates this registry.\n   */\n  defaultByPlan?: Readonly<Partial<Record<OrgPlan, boolean>>>\n}\n\nexport interface PluginLockdownFeatureDeclaration {\n  /** The lever's wire identity (`ai-generate`). */\n  key: string\n  /** The staff checklist's label. */\n  label: string\n  /**\n   * What the lever is called in the customer's mail when staff pull it for\n   * their workspace (`media uploads`, `AI generation`). A noun phrase that\n   * reads right mid-sentence (\"our team paused media uploads\") and after a\n   * colon, so lowercase unless it starts with a name or an acronym. The\n   * staff `label` never reaches a customer.\n   */\n  customerName: string\n  /**\n   * Whether a verified staff claim passes the lock. Granted where a staff\n   * action aids incident response — one real call proves a provider is back\n   * — and withheld where the staff action would BE the incident.\n   */\n  staffBypass: boolean\n  /**\n   * What a visitor reads while the lever is pulled: what is paused AND what\n   * still works. The expected-back window is appended by the notice builder.\n   */\n  notice: { title: string; body: string }\n  /**\n   * Plugin API paths the lever gates at the dispatcher: exact paths, and\n   * prefixes matched on a segment boundary (`ai/generate` also gates\n   * `ai/generate/section`, never `ai/generated-report`).\n   */\n  apiPaths?: { exact?: readonly string[]; prefixes?: readonly string[] }\n}\n\n/**\n * A key a plugin adds to the org permission CATALOG (AGL-2984): the granular\n * map custom roles and per-member overrides are stored in, that\n * `resolveOrgPermissions` layers and the rules stamp carries, and that the\n * role editor lists. A declared key is stored, layered and resolved exactly\n * like a core key; the declaration supplies what a core key's catalog entry\n * and role table supply.\n */\nexport interface PluginOrgPermissionDeclaration {\n  /** The dotted key a custom role and a per-member override store (`reviews.reply`). */\n  key: string\n  /** The role editor's line for the key, and the word a refusal names. */\n  label: string\n  /** What the key opens, under the label in the role editor. */\n  description: string\n  /** Each org role's verdict when no custom role or per-member override sets the key. */\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  /**\n   * Each HOST role's verdict, for a key a site collaborator holds per site.\n   *\n   * A collaborator's membership carries no org standing to refine — it\n   * exists only to carry access to named sites — so a key with this field is\n   * decided for them on the site a request names: the host role they hold\n   * there, refined by the per-site toggle on their member document. A key\n   * without it is never held by a collaborator.\n   */\n  hostRoleDefaults?: Readonly<Record<HostAccessRole, boolean>>\n  /**\n   * The role editor's group for the key (AGL-4047): a core group id\n   * (`CORE_ORG_PERMISSION_GROUPS`) or, absent, a group of the plugin's own.\n   */\n  group?: string\n  /** The heading of a group of the plugin's own; absent: the plugin's catalog label. */\n  groupLabel?: string\n  /**\n   * A broader key this one is a finer part of (AGL-4047): never granted\n   * without it, and following it where nothing sets this key. See\n   * `PluginPermission.refines`.\n   */\n  refines?: string\n  /**\n   * A key this one takes its verdict from where nothing sets it, without\n   * needing it (AGL-4047). See `PluginPermission.follows`.\n   */\n  follows?: string\n  /**\n   * A site can narrow this key, and the built-in roles' default for whether\n   * it does (AGL-4047). See `PluginPermission.narrowsPerSite`. Ignored on a\n   * key whose preset is the site role (`presetFromSiteRole`).\n   */\n  narrowsPerSite?: boolean | Partial<Record<OrgRole, boolean>>\n  /**\n   * The key's preset is the member's role ON THE SITE, for every member\n   * (AGL-4047), not only for a site collaborator: the owner and admins are\n   * admins of every site, a workspace-wide editor or viewer holds their\n   * workspace role on a site unless the site gives them other access there\n   * (narrower or wider), and a collaborator holds their site role. So the\n   * key reads `hostRoleDefaults` for whatever access the member has on the\n   * site a request names, exactly as a gate on that host role did, and a\n   * custom role, the member's own permissions and that site's toggle then\n   * grant or refuse it like any other key. Needs `hostRoleDefaults`, and\n   * `roleDefaults` that match them tier for tier (the owner and admins on\n   * Admin, editors on Editor, viewers on Viewer), which is the answer with\n   * no site named.\n   *\n   * For a key that replaces a gate on the site role (who may edit a site's\n   * stays, say), so the built-in roles keep exactly the access they had\n   * while the key becomes grantable and deniable like every other.\n   */\n  presetFromSiteRole?: boolean\n  /**\n   * With `presetFromSiteRole`: the site role is the preset only for a member\n   * of the WHOLE workspace (AGL-4047). Someone added to one site only holds\n   * the key there when the site's toggle grants it, whatever their site role,\n   * and `hostRoleDefaults` is not their default. For a key that replaces a\n   * gate asking for an admin of the whole workspace who is also this site's\n   * admin (refunds, say): a site's Members card can make a contractor the\n   * admin of one site, and that never carried those acts.\n   */\n  workspaceMembersOnly?: boolean\n}\n\n/**\n * One key of the ONE permission catalog that a plugin contributes (AGL-4047),\n * whichever of the two declaration APIs it came through:\n * `registerPluginEntitlements({ orgPermissions })` (`source: 'catalog'`) or\n * `registerPluginPermissions` (`source: 'tier'`, its per-tier defaults read\n * as org-role defaults, the owner on the admin tier).\n */\nexport interface PluginCatalogPermission {\n  key: string\n  label: string\n  description: string\n  pluginId: string\n  roleDefaults: Readonly<Record<OrgRole, boolean>>\n  hostRoleDefaults?: Readonly<Record<HostAccessRole, boolean>>\n  group: string\n  groupLabel: string\n  source: 'catalog' | 'tier'\n  /** The broader key this one refines, when it does. */\n  refines?: string\n  /** The key this one follows without needing it, when it does. */\n  follows?: string\n  /**\n   * Present when a site can narrow the key (AGL-4047): each built-in role's\n   * default for whether it does, normalized from the declaration.\n   */\n  narrowsPerSite?: Readonly<Record<OrgRole, boolean>>\n  /** The key's preset is the member's role on the site (AGL-4047); see the declaration's. */\n  presetFromSiteRole?: true\n  /** That preset holds for members of the whole workspace only (AGL-4047); see the declaration's. */\n  workspaceMembersOnly?: true\n}\n\nexport interface PluginEntitlementRegistration {\n  pluginId: string\n  seatAddons?: readonly PluginSeatAddonDeclaration[]\n  features?: readonly PluginFeatureDeclaration[]\n  lockdownFeatures?: readonly PluginLockdownFeatureDeclaration[]\n  /** Per-tier keys a plugin's own pages read (`registerPluginPermissions`). */\n  permissions?: readonly Omit<PluginPermission, 'pluginId'>[]\n  /** Keys added to the org permission catalog — see {@link PluginOrgPermissionDeclaration}. */\n  orgPermissions?: readonly PluginOrgPermissionDeclaration[]\n}\n\n/**\n * The registrations and their listeners, held on `globalThis` rather than in\n * module `const`s (AGL-3596), as the custom field registry and the\n * declarations repair hook are (AGL-3412).\n *\n * An app registers the plugins' declarations from `instrumentation.ts`, which\n * Next compiles into a different module graph from the routes. A module-scoped\n * map was filled in the instrumentation's copy and read empty in a route's, so\n * a core route that never loaded a plugin knew none of its keys: the site\n * create door asked for `ai.generate`, read `undefined` from a catalog that\n * had never heard of it, and every guided AI start was born with the starter.\n * One map per process, under a `Symbol.for` key, is the same map in every\n * copy.\n */\nconst REGISTRY_KEY = Symbol.for('@aglyn/aglyn:plugin-entitlements')\n\ninterface PluginEntitlementsRegistry {\n  registrations: Map<string, PluginEntitlementRegistration>\n  /**\n   * Readers of the registrations that keep a derived view in step with them —\n   * every copy of the org permission catalog rebuilds itself on every\n   * registration and reset, because a plugin's declarations can register\n   * after a module that imported the catalog was evaluated, and in another\n   * module graph's copy of this file.\n   */\n  listeners: Set<() => void>\n}\n\nconst globalScope = globalThis as typeof globalThis & {\n  [REGISTRY_KEY]?: PluginEntitlementsRegistry\n}\n\nconst registry: PluginEntitlementsRegistry = (globalScope[REGISTRY_KEY] ??= {\n  registrations: new Map(),\n  listeners: new Set(),\n})\n\nconst registrations = registry.registrations\nconst listeners = registry.listeners\n\n/** Calls `listener` after every registration and reset; answers the unsubscribe. */\nexport function subscribePluginEntitlements(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => {\n    listeners.delete(listener)\n  }\n}\n\nfunction notifyListeners(): void {\n  for (const listener of [...listeners]) listener()\n}\n\nconst CATALOG_ORDER = new Map(\n  FIRST_PARTY_PLUGINS.map((plugin, index) => [plugin.id, index]),\n)\n\nfunction catalogRank(pluginId: string): number {\n  return CATALOG_ORDER.get(pluginId) ?? Number.MAX_SAFE_INTEGER\n}\n\nfunction orderedRegistrations(): PluginEntitlementRegistration[] {\n  return [...registrations.values()].sort(\n    (a, b) =>\n      catalogRank(a.pluginId) - catalogRank(b.pluginId) ||\n      a.pluginId.localeCompare(b.pluginId),\n  )\n}\n\nfunction refuseStolenKeys(\n  pluginId: string,\n  kind: 'seat add-on' | 'lockdown feature' | 'org permission',\n  keys: readonly string[],\n  ownerOf: (key: string) => string | undefined,\n): void {\n  for (const key of keys) {\n    const owner = ownerOf(key)\n    if (owner && owner !== pluginId) {\n      throw new Error(\n        `${kind} \"${key}\" is already declared by \"${owner}\"; refused \"${pluginId}\"`,\n      )\n    }\n  }\n}\n\n/**\n * Idempotent per plugin — re-registration replaces that plugin's\n * declarations. A seat add-on, lockdown or catalog permission key another\n * plugin already owns refuses the whole registration: one key, one owner,\n * or the two declarations disagree about what the key means.\n */\nexport function registerPluginEntitlements(\n  registration: PluginEntitlementRegistration,\n): void {\n  const pluginId = registration.pluginId.trim()\n  if (!pluginId) throw new Error('plugin entitlements need a pluginId')\n  refuseStolenKeys(\n    pluginId,\n    'seat add-on',\n    (registration.seatAddons ?? []).map((entry) => entry.key),\n    (key) => pluginSeatAddonOwner(key),\n  )\n  refuseStolenKeys(\n    pluginId,\n    'lockdown feature',\n    (registration.lockdownFeatures ?? []).map((entry) => entry.key),\n    (key) => pluginLockdownFeatureOwner(key),\n  )\n  refuseStolenKeys(\n    pluginId,\n    'org permission',\n    (registration.orgPermissions ?? []).map((entry) => entry.key),\n    (key) => pluginOrgPermissionOwner(key) ?? pluginTierPermissionOwner(key),\n  )\n  registrations.set(pluginId, { ...registration, pluginId })\n  if (registration.permissions?.length) {\n    registerPluginPermissions(\n      registration.permissions.map((permission) => ({ ...permission, pluginId })),\n    )\n  }\n  notifyListeners()\n}\n\nfunction pluginSeatAddonOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.seatAddons?.some((addon) => addon.key === key)) return entry.pluginId\n  }\n  return undefined\n}\n\nfunction pluginLockdownFeatureOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.lockdownFeatures?.some((feature) => feature.key === key)) {\n      return entry.pluginId\n    }\n  }\n  return undefined\n}\n\nfunction pluginOrgPermissionOwner(key: string): string | undefined {\n  for (const entry of registrations.values()) {\n    if (entry.orgPermissions?.some((permission) => permission.key === key)) {\n      return entry.pluginId\n    }\n  }\n  return undefined\n}\n\nfunction pluginTierPermissionOwner(key: string): string | undefined {\n  return listPluginPermissions().find((permission) => permission.key === key)?.pluginId\n}\n\n/** Refusals already logged by `listPluginCatalogPermissions`, so each is reported once. */\n// boot-registry: per copy — it only de-duplicates a warning; a second compiled copy logging the same refusal once more is harmless, and nothing reads it to decide anything.\nconst reportedCatalogRefusals = new Set<string>()\n\n/** A plugin's catalog label, the heading its own permission group carries. */\nfunction pluginLabel(pluginId: string): string {\n  return FIRST_PARTY_PLUGINS.find((plugin) => plugin.id === pluginId)?.label ?? pluginId\n}\n\n/**\n * A declaration's `narrowsPerSite`, normalized to each built-in role's\n * default (AGL-4047): `true` or `false` names every role, a map names each,\n * a role it leaves out keeps. Absent: the key is not one a site can narrow.\n */\nfunction narrowingDefaultsOf(\n  declared: boolean | Partial<Record<OrgRole, boolean>> | undefined,\n): { narrowsPerSite?: Readonly<Record<OrgRole, boolean>> } {\n  if (declared === undefined || declared === null) return {}\n  const every = typeof declared === 'boolean' ? declared : undefined\n  const map = typeof declared === 'object' ? declared : {}\n  return {\n    narrowsPerSite: {\n      owner: every ?? map.owner === true,\n      admin: every ?? map.admin === true,\n      editor: every ?? map.editor === true,\n      viewer: every ?? map.viewer === true,\n    },\n  }\n}\n\n/**\n * Every key plugins contribute to the permission catalog, through EITHER\n * declaration API, in catalog order (AGL-4047): per plugin, its\n * `orgPermissions` declarations and then its `registerPluginPermissions`\n * keys. A key both APIs carry for the same plugin is the catalog\n * declaration's; one a DIFFERENT plugin already declared is refused and\n * logged once, the first declaration keeping its meaning and defaults.\n *\n * Read live: both registries fill at plugin module scope, which can be after\n * any reader of this was evaluated.\n */\nexport function listPluginCatalogPermissions(): PluginCatalogPermission[] {\n  const byPlugin = new Map<string, PluginCatalogPermission[]>()\n  const owner = new Map<string, string>()\n  const add = (entry: PluginCatalogPermission): void => {\n    const incumbent = owner.get(entry.key)\n    if (incumbent !== undefined) {\n      if (incumbent !== entry.pluginId) {\n        const refusal = `${entry.pluginId}\\x00${entry.key}`\n        if (!reportedCatalogRefusals.has(refusal)) {\n          reportedCatalogRefusals.add(refusal)\n          console.error(\n            `[plugins] refused permission key \"${entry.key}\" to \"${entry.pluginId}\": ` +\n              `already declared by \"${incumbent}\"`,\n          )\n        }\n      }\n      return\n    }\n    owner.set(entry.key, entry.pluginId)\n    const list = byPlugin.get(entry.pluginId) ?? []\n    list.push(entry)\n    byPlugin.set(entry.pluginId, list)\n  }\n  for (const permission of listPluginOrgPermissions()) {\n    add({\n      key: permission.key,\n      label: permission.label,\n      description: permission.description,\n      pluginId: permission.pluginId,\n      roleDefaults: declarationRoleDefaults(permission),\n      ...(permission.hostRoleDefaults ? { hostRoleDefaults: permission.hostRoleDefaults } : {}),\n      group: permission.group ?? permission.pluginId,\n      groupLabel: permission.groupLabel ?? pluginLabel(permission.pluginId),\n      source: 'catalog',\n      ...(permission.refines ? { refines: permission.refines } : {}),\n      ...(permission.follows ? { follows: permission.follows } : {}),\n      // A key whose preset is the site role follows every site's access\n      // already, so it offers no narrowing control (AGL-4047).\n      ...(permission.presetFromSiteRole && permission.hostRoleDefaults\n        ? {\n            presetFromSiteRole: true as const,\n            ...(permission.workspaceMembersOnly ? { workspaceMembersOnly: true as const } : {}),\n          }\n        : narrowingDefaultsOf(permission.narrowsPerSite)),\n    })\n  }\n  for (const permission of listPluginPermissions()) {\n    add({\n      key: permission.key,\n      label: permission.label,\n      description: permission.description ?? '',\n      pluginId: permission.pluginId,\n      roleDefaults: declarationRoleDefaults(permission),\n      group: permission.group ?? permission.pluginId,\n      groupLabel: permission.groupLabel ?? pluginLabel(permission.pluginId),\n      source: 'tier',\n      ...(permission.refines ? { refines: permission.refines } : {}),\n      ...(permission.follows ? { follows: permission.follows } : {}),\n      ...narrowingDefaultsOf(permission.narrowsPerSite),\n    })\n  }\n  return [...byPlugin.keys()]\n    .sort((a, b) => catalogRank(a) - catalogRank(b) || a.localeCompare(b))\n    .flatMap((pluginId) => byPlugin.get(pluginId) ?? [])\n}\n\n/** Every declared catalog permission, in catalog order, with the plugin that declared it. */\nexport function listPluginOrgPermissions(): Array<\n  PluginOrgPermissionDeclaration & { pluginId: string }\n> {\n  return orderedRegistrations().flatMap((entry) =>\n    (entry.orgPermissions ?? []).map((permission) => ({\n      ...permission,\n      pluginId: entry.pluginId,\n    })),\n  )\n}\n\n/** Every declared seat add-on, in catalog order. */\nexport function listPluginSeatAddons(): PluginSeatAddonDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [...(entry.seatAddons ?? [])])\n}\n\n/** One declared seat add-on by its `seatAddons` key. */\nexport function pluginSeatAddon(key: string): PluginSeatAddonDeclaration | undefined {\n  return listPluginSeatAddons().find((entry) => entry.key === key)\n}\n\n/** Every declared feature, in catalog order. */\nexport function listPluginFeatures(): PluginFeatureDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [...(entry.features ?? [])])\n}\n\n/** Every declared lockdown lever, in catalog order. */\nexport function listPluginLockdownFeatures(): PluginLockdownFeatureDeclaration[] {\n  return orderedRegistrations().flatMap((entry) => [\n    ...(entry.lockdownFeatures ?? []),\n  ])\n}\n\n/** One declared lockdown lever by key. */\nexport function pluginLockdownFeature(\n  key: string,\n): PluginLockdownFeatureDeclaration | undefined {\n  return listPluginLockdownFeatures().find((entry) => entry.key === key)\n}\n\n/** The plugin that declared a lockdown lever, for attribution. */\nexport function pluginIdForLockdownFeature(key: string): string | undefined {\n  return pluginLockdownFeatureOwner(key)\n}\n\n/** Every registration, in catalog order. */\nexport function listPluginEntitlementRegistrations(): PluginEntitlementRegistration[] {\n  return orderedRegistrations()\n}\n\n/**\n * Test seam: forget every registration. The per-tier permissions stay\n * registered; the catalog permissions go with their registrations.\n */\nexport function resetPluginEntitlementsForTests(): void {\n  registrations.clear()\n  notifyListeners()\n}\n"],"names":["globalScope","REGISTRY_KEY","declarationRoleDefaults","FIRST_PARTY_PLUGINS","listPluginPermissions","registerPluginPermissions","pluginSeatAddonSoldOn","addon","plan","soldOn","quota","perUnitByPlan","Symbol","for","globalThis","registry","registrations","Map","listeners","Set","subscribePluginEntitlements","listener","add","delete","notifyListeners","CATALOG_ORDER","map","plugin","index","id","catalogRank","pluginId","get","Number","MAX_SAFE_INTEGER","orderedRegistrations","values","sort","a","b","localeCompare","refuseStolenKeys","kind","keys","ownerOf","key","owner","Error","registerPluginEntitlements","registration","trim","seatAddons","entry","pluginSeatAddonOwner","lockdownFeatures","pluginLockdownFeatureOwner","orgPermissions","pluginOrgPermissionOwner","pluginTierPermissionOwner","set","permissions","length","permission","some","undefined","feature","find","reportedCatalogRefusals","pluginLabel","label","narrowingDefaultsOf","declared","every","narrowsPerSite","admin","editor","viewer","listPluginCatalogPermissions","byPlugin","incumbent","refusal","has","console","error","list","push","listPluginOrgPermissions","description","roleDefaults","hostRoleDefaults","group","groupLabel","source","refines","follows","presetFromSiteRole","workspaceMembersOnly","flatMap","listPluginSeatAddons","pluginSeatAddon","listPluginFeatures","features","listPluginLockdownFeatures","pluginLockdownFeature","pluginIdForLockdownFeature","listPluginEntitlementRegistrations","resetPluginEntitlementsForTests","clear"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC;IAqQ6CA,cAAYC,eAAZD;AAlQ9C,SAASE,uBAAuB,QAAQ,kCAA8B;AACtE,SAASC,mBAAmB,QAAQ,uBAAmB;AACvD,SACEC,qBAAqB,EACrBC,yBAAyB,QAEpB,0BAAsB;AAsC7B;;;CAGC,GACD,OAAO,SAASC,sBACdC,KAAiC,EACjCC,IAAa;;QAILD;IAFR,IAAIA,MAAME,MAAM,EAAE,OAAOF,MAAME,MAAM,CAACD;IACtC,IAAI,CAACD,MAAMG,KAAK,EAAE,OAAO;IACzB,OAAO,UAACH,6BAAAA,MAAMG,KAAK,CAACC,aAAa,qBAAzBJ,0BAA2B,CAACC,KAAK,mBAAI,KAAK;AACpD;AA2KA;;;;;;;;;;;;;CAaC,GACD,MAAMP,eAAeW,OAAOC,GAAG,CAAC;AAchC,MAAMb,cAAcc;AAIpB,MAAMC,YAAwCf,IAAAA,CAAAA,eAAAA,YAAW,CAACC,gBAAAA,aAAa,YAAzBD,IAAAA,YAAW,CAACC,cAAa,GAAK;IAC1Ee,eAAe,IAAIC;IACnBC,WAAW,IAAIC;AACjB;AAEA,MAAMH,gBAAgBD,SAASC,aAAa;AAC5C,MAAME,YAAYH,SAASG,SAAS;AAEpC,kFAAkF,GAClF,OAAO,SAASE,4BAA4BC,QAAoB;IAC9DH,UAAUI,GAAG,CAACD;IACd,OAAO;QACLH,UAAUK,MAAM,CAACF;IACnB;AACF;AAEA,SAASG;IACP,KAAK,MAAMH,YAAY;WAAIH;KAAU,CAAEG;AACzC;AAEA,MAAMI,gBAAgB,IAAIR,IACxBd,oBAAoBuB,GAAG,CAAC,CAACC,QAAQC,QAAU;QAACD,OAAOE,EAAE;QAAED;KAAM;AAG/D,SAASE,YAAYC,QAAgB;QAC5BN;IAAP,QAAOA,qBAAAA,cAAcO,GAAG,CAACD,qBAAlBN,qBAA+BQ,OAAOC,gBAAgB;AAC/D;AAEA,SAASC;IACP,OAAO;WAAInB,cAAcoB,MAAM;KAAG,CAACC,IAAI,CACrC,CAACC,GAAGC,IACFT,YAAYQ,EAAEP,QAAQ,IAAID,YAAYS,EAAER,QAAQ,KAChDO,EAAEP,QAAQ,CAACS,aAAa,CAACD,EAAER,QAAQ;AAEzC;AAEA,SAASU,iBACPV,QAAgB,EAChBW,IAA2D,EAC3DC,IAAuB,EACvBC,OAA4C;IAE5C,KAAK,MAAMC,OAAOF,KAAM;QACtB,MAAMG,QAAQF,QAAQC;QACtB,IAAIC,SAASA,UAAUf,UAAU;YAC/B,MAAM,IAAIgB,MACR,GAAGL,KAAK,EAAE,EAAEG,IAAI,0BAA0B,EAAEC,MAAM,YAAY,EAAEf,SAAS,CAAC,CAAC;QAE/E;IACF;AACF;AAEA;;;;;CAKC,GACD,OAAO,SAASiB,2BACdC,YAA2C;QAOxCA,0BAMAA,gCAMAA;QAICA;IArBJ,MAAMlB,WAAWkB,aAAalB,QAAQ,CAACmB,IAAI;IAC3C,IAAI,CAACnB,UAAU,MAAM,IAAIgB,MAAM;IAC/BN,iBACEV,UACA,eACA,EAACkB,2BAAAA,aAAaE,UAAU,YAAvBF,2BAA2B,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GACxD,CAACA,MAAQQ,qBAAqBR;IAEhCJ,iBACEV,UACA,oBACA,EAACkB,iCAAAA,aAAaK,gBAAgB,YAA7BL,iCAAiC,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GAC9D,CAACA,MAAQU,2BAA2BV;IAEtCJ,iBACEV,UACA,kBACA,EAACkB,+BAAAA,aAAaO,cAAc,YAA3BP,+BAA+B,EAAE,EAAEvB,GAAG,CAAC,CAAC0B,QAAUA,MAAMP,GAAG,GAC5D,CAACA;YAAQY;gBAAAA,4BAAAA,yBAAyBZ,gBAAzBY,4BAAiCC,0BAA0Bb;;IAEtE7B,cAAc2C,GAAG,CAAC5B,UAAU,aAAKkB;QAAclB;;IAC/C,KAAIkB,4BAAAA,aAAaW,WAAW,qBAAxBX,0BAA0BY,MAAM,EAAE;QACpCxD,0BACE4C,aAAaW,WAAW,CAAClC,GAAG,CAAC,CAACoC,aAAgB,aAAKA;gBAAY/B;;IAEnE;IACAP;AACF;AAEA,SAAS6B,qBAAqBR,GAAW;IACvC,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,oBAAAA,MAAMD,UAAU,qBAAhBC,kBAAkBW,IAAI,CAAC,CAACxD,QAAUA,MAAMsC,GAAG,KAAKA,MAAM,OAAOO,MAAMrB,QAAQ;IACjF;IACA,OAAOiC;AACT;AAEA,SAAST,2BAA2BV,GAAW;IAC7C,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,0BAAAA,MAAME,gBAAgB,qBAAtBF,wBAAwBW,IAAI,CAAC,CAACE,UAAYA,QAAQpB,GAAG,KAAKA,MAAM;YAClE,OAAOO,MAAMrB,QAAQ;QACvB;IACF;IACA,OAAOiC;AACT;AAEA,SAASP,yBAAyBZ,GAAW;IAC3C,KAAK,MAAMO,SAASpC,cAAcoB,MAAM,GAAI;YACtCgB;QAAJ,KAAIA,wBAAAA,MAAMI,cAAc,qBAApBJ,sBAAsBW,IAAI,CAAC,CAACD,aAAeA,WAAWjB,GAAG,KAAKA,MAAM;YACtE,OAAOO,MAAMrB,QAAQ;QACvB;IACF;IACA,OAAOiC;AACT;AAEA,SAASN,0BAA0Bb,GAAW;QACrCzC;IAAP,QAAOA,8BAAAA,wBAAwB8D,IAAI,CAAC,CAACJ,aAAeA,WAAWjB,GAAG,KAAKA,yBAAhEzC,4BAAsE2B,QAAQ;AACvF;AAEA,yFAAyF,GACzF,6KAA6K;AAC7K,MAAMoC,0BAA0B,IAAIhD;AAEpC,4EAA4E,GAC5E,SAASiD,YAAYrC,QAAgB;;QAC5B5B;IAAP,gBAAOA,4BAAAA,oBAAoB+D,IAAI,CAAC,CAACvC,SAAWA,OAAOE,EAAE,KAAKE,8BAAnD5B,0BAA8DkE,KAAK,mBAAItC;AAChF;AAEA;;;;CAIC,GACD,SAASuC,oBACPC,QAAiE;IAEjE,IAAIA,aAAaP,aAAaO,aAAa,MAAM,OAAO,CAAC;IACzD,MAAMC,QAAQ,OAAOD,aAAa,YAAYA,WAAWP;IACzD,MAAMtC,MAAM,OAAO6C,aAAa,WAAWA,WAAW,CAAC;IACvD,OAAO;QACLE,gBAAgB;YACd3B,KAAK,EAAE0B,gBAAAA,QAAS9C,IAAIoB,KAAK,KAAK;YAC9B4B,KAAK,EAAEF,gBAAAA,QAAS9C,IAAIgD,KAAK,KAAK;YAC9BC,MAAM,EAAEH,gBAAAA,QAAS9C,IAAIiD,MAAM,KAAK;YAChCC,MAAM,EAAEJ,gBAAAA,QAAS9C,IAAIkD,MAAM,KAAK;QAClC;IACF;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,SAASC;IACd,MAAMC,WAAW,IAAI7D;IACrB,MAAM6B,QAAQ,IAAI7B;IAClB,MAAMK,MAAM,CAAC8B;YAgBE0B;QAfb,MAAMC,YAAYjC,MAAMd,GAAG,CAACoB,MAAMP,GAAG;QACrC,IAAIkC,cAAcf,WAAW;YAC3B,IAAIe,cAAc3B,MAAMrB,QAAQ,EAAE;gBAChC,MAAMiD,UAAU,GAAG5B,MAAMrB,QAAQ,CAAC,IAAI,EAAEqB,MAAMP,GAAG,EAAE;gBACnD,IAAI,CAACsB,wBAAwBc,GAAG,CAACD,UAAU;oBACzCb,wBAAwB7C,GAAG,CAAC0D;oBAC5BE,QAAQC,KAAK,CACX,CAAC,kCAAkC,EAAE/B,MAAMP,GAAG,CAAC,MAAM,EAAEO,MAAMrB,QAAQ,CAAC,GAAG,CAAC,GACxE,CAAC,qBAAqB,EAAEgD,UAAU,CAAC,CAAC;gBAE1C;YACF;YACA;QACF;QACAjC,MAAMa,GAAG,CAACP,MAAMP,GAAG,EAAEO,MAAMrB,QAAQ;QACnC,MAAMqD,QAAON,gBAAAA,SAAS9C,GAAG,CAACoB,MAAMrB,QAAQ,aAA3B+C,gBAAgC,EAAE;QAC/CM,KAAKC,IAAI,CAACjC;QACV0B,SAASnB,GAAG,CAACP,MAAMrB,QAAQ,EAAEqD;IAC/B;IACA,KAAK,MAAMtB,cAAcwB,2BAA4B;YAQ1CxB,mBACKA;QARdxC,IAAI;YACFuB,KAAKiB,WAAWjB,GAAG;YACnBwB,OAAOP,WAAWO,KAAK;YACvBkB,aAAazB,WAAWyB,WAAW;YACnCxD,UAAU+B,WAAW/B,QAAQ;YAC7ByD,cAActF,wBAAwB4D;WAClCA,WAAW2B,gBAAgB,GAAG;YAAEA,kBAAkB3B,WAAW2B,gBAAgB;QAAC,IAAI,CAAC;YACvFC,KAAK,GAAE5B,oBAAAA,WAAW4B,KAAK,YAAhB5B,oBAAoBA,WAAW/B,QAAQ;YAC9C4D,UAAU,GAAE7B,yBAAAA,WAAW6B,UAAU,YAArB7B,yBAAyBM,YAAYN,WAAW/B,QAAQ;YACpE6D,QAAQ;WACJ9B,WAAW+B,OAAO,GAAG;YAAEA,SAAS/B,WAAW+B,OAAO;QAAC,IAAI,CAAC,GACxD/B,WAAWgC,OAAO,GAAG;YAAEA,SAAShC,WAAWgC,OAAO;QAAC,IAAI,CAAC,GAGxDhC,WAAWiC,kBAAkB,IAAIjC,WAAW2B,gBAAgB,GAC5D;YACEM,oBAAoB;WAChBjC,WAAWkC,oBAAoB,GAAG;YAAEA,sBAAsB;QAAc,IAAI,CAAC,KAEnF1B,oBAAoBR,WAAWW,cAAc;IAErD;IACA,KAAK,MAAMX,cAAc1D,wBAAyB;YAIjC0D,yBAGNA,oBACKA;QAPdxC,IAAI;YACFuB,KAAKiB,WAAWjB,GAAG;YACnBwB,OAAOP,WAAWO,KAAK;YACvBkB,WAAW,GAAEzB,0BAAAA,WAAWyB,WAAW,YAAtBzB,0BAA0B;YACvC/B,UAAU+B,WAAW/B,QAAQ;YAC7ByD,cAActF,wBAAwB4D;YACtC4B,KAAK,GAAE5B,qBAAAA,WAAW4B,KAAK,YAAhB5B,qBAAoBA,WAAW/B,QAAQ;YAC9C4D,UAAU,GAAE7B,0BAAAA,WAAW6B,UAAU,YAArB7B,0BAAyBM,YAAYN,WAAW/B,QAAQ;YACpE6D,QAAQ;WACJ9B,WAAW+B,OAAO,GAAG;YAAEA,SAAS/B,WAAW+B,OAAO;QAAC,IAAI,CAAC,GACxD/B,WAAWgC,OAAO,GAAG;YAAEA,SAAShC,WAAWgC,OAAO;QAAC,IAAI,CAAC,GACzDxB,oBAAoBR,WAAWW,cAAc;IAEpD;IACA,OAAO;WAAIK,SAASnC,IAAI;KAAG,CACxBN,IAAI,CAAC,CAACC,GAAGC,IAAMT,YAAYQ,KAAKR,YAAYS,MAAMD,EAAEE,aAAa,CAACD,IAClE0D,OAAO,CAAC,CAAClE;YAAa+C;gBAAAA,gBAAAA,SAAS9C,GAAG,CAACD,qBAAb+C,gBAA0B,EAAE;;AACvD;AAEA,2FAA2F,GAC3F,OAAO,SAASQ;IAGd,OAAOnD,uBAAuB8D,OAAO,CAAC,CAAC7C;YACpCA;eAAD,EAACA,wBAAAA,MAAMI,cAAc,YAApBJ,wBAAwB,EAAE,EAAE1B,GAAG,CAAC,CAACoC,aAAgB,aAC7CA;gBACH/B,UAAUqB,MAAMrB,QAAQ;;;AAG9B;AAEA,kDAAkD,GAClD,OAAO,SAASmE;IACd,OAAO/D,uBAAuB8D,OAAO,CAAC,CAAC7C;YAAeA;eAAL;gBAAKA,oBAAAA,MAAMD,UAAU,YAAhBC,oBAAoB,EAAE;SAAE;;AAChF;AAEA,sDAAsD,GACtD,OAAO,SAAS+C,gBAAgBtD,GAAW;IACzC,OAAOqD,uBAAuBhC,IAAI,CAAC,CAACd,QAAUA,MAAMP,GAAG,KAAKA;AAC9D;AAEA,8CAA8C,GAC9C,OAAO,SAASuD;IACd,OAAOjE,uBAAuB8D,OAAO,CAAC,CAAC7C;YAAeA;eAAL;gBAAKA,kBAAAA,MAAMiD,QAAQ,YAAdjD,kBAAkB,EAAE;SAAE;;AAC9E;AAEA,qDAAqD,GACrD,OAAO,SAASkD;IACd,OAAOnE,uBAAuB8D,OAAO,CAAC,CAAC7C;YACjCA;eAD2C;gBAC3CA,0BAAAA,MAAME,gBAAgB,YAAtBF,0BAA0B,EAAE;SACjC;;AACH;AAEA,wCAAwC,GACxC,OAAO,SAASmD,sBACd1D,GAAW;IAEX,OAAOyD,6BAA6BpC,IAAI,CAAC,CAACd,QAAUA,MAAMP,GAAG,KAAKA;AACpE;AAEA,gEAAgE,GAChE,OAAO,SAAS2D,2BAA2B3D,GAAW;IACpD,OAAOU,2BAA2BV;AACpC;AAEA,0CAA0C,GAC1C,OAAO,SAAS4D;IACd,OAAOtE;AACT;AAEA;;;CAGC,GACD,OAAO,SAASuE;IACd1F,cAAc2F,KAAK;IACnBnF;AACF"}