@buoy-gg/shared-ui 7.0.36 → 7.0.38

package/lib/commonjs/license/tierLimits.js

@@ -4,107 +4,87 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.TIER_LIMITS = void 0;
-exports.freeKeyRaises = freeKeyRaises;
 exports.resolveEffectiveTier = resolveEffectiveTier;
 exports.useLimit = useLimit;
 var _licenseModule = require("./licenseModule.js");
 /**
- * Per-tier numeric limits — the ONLY thing that separates anonymous from free.
+ * Per-tier numeric limits — the ONLY thing that separates free from pro on a
+ * count.
  *
- * Every binary Pro gate (copy-to-clipboard, state editing, storage mutations,
- * navigation) is identical for both: locked. That keeps the tier split to one
- * table instead of scattered conditionals.
- *
- * The governing rule: **the free column never moves.** Anonymous is carved out
- * BELOW today's free tier — nothing is ever added to free in exchange for an
- * account, because that would come straight out of the Pro upgrade.
+ * Binary Pro gates (copy-to-clipboard, state editing, storage mutations,
+ * navigation) live in the tools themselves; this table is only for "how many".
+ * Whether the tools are usable at all is account admission, which is a
+ * separate question from the tier and is never expressed as a limit.
  */
 
 const LIMITS = {
   // ── network ───────────────────────────────────────────────────────────────
   "network.requests": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "network.saved": {
-    anonymous: 1,
     free: 5,
     pro: 50
   },
-  // Already 1 for free, so 25% would be 0 — which deletes the feature rather
-  // than trialling it. Raising the FREE value to make room is not an option.
   "network.overrideRules": {
-    anonymous: 1,
     free: 1,
     pro: 50
   },
   // ── storage ───────────────────────────────────────────────────────────────
   "storage.events": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "storage.keys": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
-  // Same floor-at-1 reasoning as network.overrideRules.
   "storage.mmkvInstances": {
-    anonymous: 1,
     free: 1,
     pro: Infinity
   },
   // ── state tools ───────────────────────────────────────────────────────────
   "redux.actions": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "zustand.changes": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "jotai.changes": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "events.entries": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   // ── render / navigation ───────────────────────────────────────────────────
   "highlightUpdates.components": {
-    anonymous: 5,
     free: 25,
     pro: Infinity
   },
   "highlightUpdates.historyEvents": {
-    anonymous: 1,
     free: 3,
     pro: Infinity
   },
   "highlightUpdates.detailEvents": {
-    anonymous: 2,
     free: 5,
     pro: Infinity
   },
   "routeEvents.entries": {
-    anonymous: 1,
     free: 3,
     pro: Infinity
   },
+  // One restore point at a time. The floating bar's safety slot is not one
+  // the user chose to keep, so it is not counted against this.
   "timeMachine.snapshots": {
-    anonymous: 1,
-    free: 2,
+    free: 1,
     pro: Infinity
   },
   "perfMonitor.automationCases": {
-    anonymous: 1,
     free: 3,
     pro: Infinity
   },
@@ -113,12 +93,10 @@ const LIMITS = {
   // three-endpoint scenario either runs whole or refuses up front, and is never
   // silently trimmed to one rule mid-run. Enforcement is atomic in pre-flight.
   "scenarios.saved": {
-    anonymous: 1,
     free: 3,
     pro: Infinity
   },
   "scenarios.active": {
-    anonymous: 1,
     free: 1,
     pro: 3
   }
@@ -129,17 +107,11 @@ const TIER_LIMITS = exports.TIER_LIMITS = LIMITS;
  * The tier whose limits actually apply.
  *
  * `hasProAccess` is `useIsPro()`, which is true for a real Pro license OR the
- * free Weekend Pass. Routing the Weekend Pass through here is what keeps
- * today's behavior intact: weekend users get Pro limits, exactly as they do
- * now. When the Weekend Pass is later gated to key-holders, that change lands
- * here for free — no limit call site has to know about it.
+ * Weekend Pass. Routing the Weekend Pass through here is what gives weekend
+ * users Pro limits without any limit call site having to know about it.
  */
 function resolveEffectiveTier(tier, hasProAccess) {
-  if (hasProAccess) return "pro";
-  // The switch lives in @buoy-gg/license so that this and the Weekend Pass
-  // change flip together — see isAnonymousTierEnabled().
-  if (!(0, _licenseModule.isAnonymousTierEnabled)() && tier === "anonymous") return "free";
-  return tier;
+  return hasProAccess ? "pro" : tier;
 }
 
 /**
@@ -153,27 +125,4 @@ function useLimit(key) {
   const hasProAccess = (0, _licenseModule.getUseIsPro)()();
   const tier = (0, _licenseModule.getUseTier)()();
   return TIER_LIMITS[key][resolveEffectiveTier(tier, hasProAccess)];
-}
-
-/**
- * Whether claiming a FREE key would actually raise this limit right now.
- *
- * The anonymous upsell must never promise something a free key won't deliver.
- * Two ways it could lie, and this closes both:
- *
- *  - **Pro-exclusive features.** Copy-to-clipboard, state editing, storage
- *    mutations and navigation are locked for anonymous AND free alike. Telling
- *    an anonymous user a free key opens them would be false.
- *  - **Limits that are already equal.** Override rules and MMKV instances sit
- *    at 1 for both tiers, so a key changes nothing there either.
- *
- * It also respects `ANONYMOUS_TIER_ENABLED`: while the anonymous tier is off,
- * an anonymous user is *already* getting the free limits, so there is nothing
- * to claim and this correctly returns false everywhere. That falls out of
- * asking `resolveEffectiveTier` rather than reading the table directly, so the
- * switch and the copy can never disagree.
- */
-function freeKeyRaises(key) {
-  const limits = TIER_LIMITS[key];
-  return limits[resolveEffectiveTier("anonymous", false)] < limits[resolveEffectiveTier("free", false)];
 }

package/lib/commonjs/storage/devToolsStorageKeys.js

@@ -133,7 +133,14 @@ const devToolsStorageKeys = exports.devToolsStorageKeys = {
    */
   timeMachine: {
     root: () => `${devToolsStorageKeys.base}_time_machine`,
-    diffViewerMode: () => `${devToolsStorageKeys.timeMachine.root()}_diff_viewer_mode` // 'split' | 'tree'
+    diffViewerMode: () => `${devToolsStorageKeys.timeMachine.root()}_diff_viewer_mode`,
+    // 'split' | 'tree'
+    /** The restore point the floating restore bar restores on tap (snapshot id). */
+    armedPoint: () => `${devToolsStorageKeys.timeMachine.root()}_armed_point`,
+    /** "1" when the action bar restores in reload mode (storage, then a JS reload). */
+    barReloadMode: () => `${devToolsStorageKeys.timeMachine.root()}_bar_reload_mode`,
+    /** Source ids switched OFF in the Sources strip (JSON string array). */
+    disabledSources: () => `${devToolsStorageKeys.timeMachine.root()}_disabled_sources`
   },
   /**
    * Scenarios storage keys. The library (saved + draft scenarios) and the

package/lib/commonjs/stores/BaseEventStore.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.BaseEventStore = void 0;
+var _licenseModule = require("../license/licenseModule.js");
 var _subscribable = require("../utils/subscribable.js");
 var _subscriberCountNotifier = require("../utils/subscriberCountNotifier.js");
 /**
@@ -68,6 +69,20 @@ class BaseEventStore extends _subscribable.Subscribable {
     super();
     this.maxEvents = options.maxEvents ?? 500;
     this.storeName = options.storeName;
+    // Defer until subclass fields are initialized before invoking lifecycle hooks.
+    Promise.resolve().then(() => {
+      const reconcile = () => {
+        if ((0, _licenseModule.getAccountAccess)().status === "locked") {
+          this.stopCapturing();
+          this.events = [];
+          this.notifyArrayListeners();
+        } else if (this.getTotalSubscriberCount() > 0 && !this.captureSuppressed && !this.isCapturing()) {
+          this.startCapturing();
+        }
+      };
+      (0, _licenseModule.subscribeAccountAccess)(reconcile);
+      reconcile();
+    });
   }
 
   // ===========================================================================
@@ -97,7 +112,7 @@ class BaseEventStore extends _subscribable.Subscribable {
    * Starts capturing if no one was subscribed.
    */
   onSubscribe() {
-    if (this.getTotalSubscriberCount() === 1 && !this.captureSuppressed) {
+    if (this.getTotalSubscriberCount() === 1 && !this.captureSuppressed && (0, _licenseModule.getAccountAccess)().status !== "locked") {
       this.startCapturing();
     }
     (0, _subscriberCountNotifier.notifySubscriberCountChange)(this.storeName);
@@ -137,7 +152,7 @@ class BaseEventStore extends _subscribable.Subscribable {
     this.arrayListeners.add(listener);
 
     // Start capturing if this is the first subscriber
-    if (wasEmpty && !this.captureSuppressed) {
+    if (wasEmpty && !this.captureSuppressed && (0, _licenseModule.getAccountAccess)().status !== "locked") {
       this.startCapturing();
     }
 
@@ -184,11 +199,12 @@ class BaseEventStore extends _subscribable.Subscribable {
    * @param event - The event to add
    */
   addEvent(event) {
+    if ((0, _licenseModule.getAccountAccess)().status === "locked") return;
     // Add to beginning (newest first) and limit to maxEvents
     this.events = [event, ...this.events].slice(0, this.maxEvents);
 
     // Notify individual event callbacks (via Subscribable)
-    this.notify(event);
+    if ((0, _licenseModule.hasAccountAccess)()) this.notify(event);
 
     // Notify array listeners
     this.notifyArrayListeners();
@@ -212,14 +228,14 @@ class BaseEventStore extends _subscribable.Subscribable {
    * Get all events (newest first)
    */
   getEvents() {
-    return this.events;
+    return (0, _licenseModule.hasAccountAccess)() ? this.events : [];
   }
 
   /**
    * Get event count
    */
   getEventCount() {
-    return this.events.length;
+    return (0, _licenseModule.hasAccountAccess)() ? this.events.length : 0;
   }
 
   /**

package/lib/commonjs/stores/createToolStore.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.createToolStore = createToolStore;
+var _licenseModule = require("../license/licenseModule.js");
 /**
  * createToolStore — the one bounded, subscribable buffer every tool used to
  * hand-roll.
@@ -53,6 +54,16 @@ function createToolStore(options) {
   let nextId = options.firstId ?? 1;
   let lastFlushAt = 0;
   let emitScheduled = false;
+  const empty = [];
+  let observing = false;
+  function observe() {
+    if (observing) return;
+    observing = true;
+    (0, _licenseModule.subscribeAccountAccess)(() => {
+      if ((0, _licenseModule.getAccountAccess)().status === "locked") items = [];
+      emit();
+    });
+  }
   const listeners = new Set();
   const clearListeners = new Set();
   function fire() {
@@ -83,19 +94,22 @@ function createToolStore(options) {
   const store = {
     id,
     subscribe(listener) {
+      observe();
       listeners.add(listener);
       return () => {
         listeners.delete(listener);
       };
     },
     getSnapshot() {
-      return items;
+      observe();
+      return (0, _licenseModule.hasAccountAccess)() ? items : empty;
     },
     size() {
-      return items.length;
+      return (0, _licenseModule.hasAccountAccess)() ? items.length : 0;
     },
     add(item) {
-      if (paused) return;
+      observe();
+      if (paused || (0, _licenseModule.getAccountAccess)().status === "locked") return;
       if (order === "append") {
         items = items.length >= max ? [...items.slice(items.length - max + 1), item] : [...items, item];
       } else {
@@ -104,10 +118,14 @@ function createToolStore(options) {
       emit();
     },
     set(next) {
+      observe();
+      if (!(0, _licenseModule.hasAccountAccess)()) return;
       items = trim(next);
       emit();
     },
     update(fn) {
+      observe();
+      if ((0, _licenseModule.getAccountAccess)().status === "locked") return;
       items = trim(fn(items));
       emit();
     },

package/lib/commonjs/stores/floatingToolStore.js

@@ -0,0 +1,71 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.dismissFloatingTool = dismissFloatingTool;
+exports.getFloatingTools = void 0;
+exports.openFloatingTool = openFloatingTool;
+exports.registerPersistentFloatingTool = registerPersistentFloatingTool;
+exports.subscribeFloatingTools = void 0;
+let entries = [];
+let revision = 0;
+const listeners = new Set();
+const notify = () => listeners.forEach(listener => listener());
+const getFloatingTools = () => entries;
+exports.getFloatingTools = getFloatingTools;
+const subscribeFloatingTools = listener => {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+};
+
+/** Open or restore one tool. Mount FloatingToolHost once at the application root. */
+exports.subscribeFloatingTools = subscribeFloatingTools;
+function openFloatingTool(tool) {
+  if (!tool.id.trim()) throw new Error("Floating tools need a non-empty id");
+  const entry = {
+    ...tool,
+    revealToken: ++revision
+  };
+  entries = entries.some(value => value.id === tool.id) ? entries.map(value => value.id === tool.id ? entry : value) : [...entries, entry];
+  notify();
+}
+
+/** Removes the UI only. Tool actions such as Stop belong to the tool's own controller. */
+function dismissFloatingTool(id) {
+  if (!entries.some(entry => entry.id === id)) return;
+  entries = entries.filter(entry => entry.id !== id);
+  notify();
+}
+
+/** Register at app startup to restore an open tool using its existing position storage. */
+function registerPersistentFloatingTool(tool, storage) {
+  if (!tool.id.trim()) throw new Error("Floating tools need a non-empty id");
+  const key = `@buoy/floating-tool/${tool.id}/open`;
+  let disposed = false;
+  let changed = false;
+  let wasOpen = entries.some(entry => entry.id === tool.id);
+  let writes = Promise.resolve();
+  const unsubscribe = subscribeFloatingTools(() => {
+    const isOpen = entries.some(entry => entry.id === tool.id);
+    if (isOpen === wasOpen) return;
+    wasOpen = isOpen;
+    changed = true;
+    writes = writes.then(() => storage.setItem(key, isOpen ? "1" : "0")).then(() => {}, () => {});
+  });
+  void storage.getItem(key).then(saved => {
+    if (disposed || changed || wasOpen || saved !== "1") return;
+    // Zero restores the saved hidden state; explicit opens still reveal the tool.
+    entries = [...entries, {
+      ...tool,
+      revealToken: 0
+    }];
+    notify();
+  }).catch(() => {});
+  return () => {
+    disposed = true;
+    unsubscribe();
+  };
+}

package/lib/commonjs/stores/floatingToolStore.test.js

@@ -0,0 +1,112 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _floatingToolStore = require("./floatingToolStore.js");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+(0, _vitest.afterEach)(() => (0, _floatingToolStore.getFloatingTools)().forEach(tool => (0, _floatingToolStore.dismissFloatingTool)(tool.id)));
+(0, _vitest.describe)("floating tool registry", () => {
+  (0, _vitest.it)("restores an existing id and keeps other tools intact", () => {
+    (0, _floatingToolStore.openFloatingTool)({
+      id: "network",
+      render: () => null
+    });
+    (0, _floatingToolStore.openFloatingTool)({
+      id: "recorder",
+      render: () => null
+    });
+    const first = (0, _floatingToolStore.getFloatingTools)()[0].revealToken;
+    const other = (0, _floatingToolStore.getFloatingTools)()[1];
+    (0, _floatingToolStore.openFloatingTool)({
+      id: "network",
+      render: () => "updated"
+    });
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)()).toHaveLength(2);
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)()[0].revealToken).toBeGreaterThan(first);
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)()[1]).toBe(other);
+  });
+  (0, _vitest.it)("publishes stable snapshots and isolates dismissal", () => {
+    const listener = _vitest.vi.fn();
+    const unsubscribe = (0, _floatingToolStore.subscribeFloatingTools)(listener);
+    (0, _floatingToolStore.openFloatingTool)({
+      id: "one",
+      render: () => null
+    });
+    const snapshot = (0, _floatingToolStore.getFloatingTools)();
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)()).toBe(snapshot);
+    (0, _floatingToolStore.dismissFloatingTool)("missing");
+    (0, _vitest.expect)(listener).toHaveBeenCalledTimes(1);
+    (0, _floatingToolStore.openFloatingTool)({
+      id: "two",
+      render: () => null
+    });
+    (0, _floatingToolStore.dismissFloatingTool)("one");
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)().map(tool => tool.id)).toEqual(["two"]);
+    unsubscribe();
+    (0, _floatingToolStore.dismissFloatingTool)("two");
+    (0, _vitest.expect)(listener).toHaveBeenCalledTimes(3);
+  });
+  (0, _vitest.it)("rejects missing tool identities", () => {
+    (0, _vitest.expect)(() => (0, _floatingToolStore.openFloatingTool)({
+      id: "  ",
+      render: () => null
+    })).toThrow("non-empty id");
+    (0, _vitest.expect)((0, _floatingToolStore.getFloatingTools)()).toHaveLength(0);
+  });
+});
+(0, _vitest.describe)("persistent floating tools", () => {
+  (0, _vitest.it)("restores after a fresh registry loads and remembers dismissal", async () => {
+    const values = new Map();
+    const storage = {
+      getItem: _vitest.vi.fn(async key => values.get(key) ?? null),
+      setItem: _vitest.vi.fn(async (key, value) => {
+        values.set(key, value);
+      })
+    };
+    const tool = {
+      id: "persisted",
+      render: () => null
+    };
+    _vitest.vi.resetModules();
+    const first = await Promise.resolve().then(() => _interopRequireWildcard(require("./floatingToolStore")));
+    const disposeFirst = first.registerPersistentFloatingTool(tool, storage);
+    first.openFloatingTool(tool);
+    await _vitest.vi.waitFor(() => (0, _vitest.expect)(values.get("@buoy/floating-tool/persisted/open")).toBe("1"));
+    disposeFirst();
+    _vitest.vi.resetModules();
+    const second = await Promise.resolve().then(() => _interopRequireWildcard(require("./floatingToolStore")));
+    const disposeSecond = second.registerPersistentFloatingTool(tool, storage);
+    await _vitest.vi.waitFor(() => (0, _vitest.expect)(second.getFloatingTools()).toHaveLength(1));
+    (0, _vitest.expect)(second.getFloatingTools()[0].revealToken).toBe(0);
+    second.dismissFloatingTool(tool.id);
+    await _vitest.vi.waitFor(() => (0, _vitest.expect)(values.get("@buoy/floating-tool/persisted/open")).toBe("0"));
+    disposeSecond();
+    _vitest.vi.resetModules();
+    const third = await Promise.resolve().then(() => _interopRequireWildcard(require("./floatingToolStore")));
+    const disposeThird = third.registerPersistentFloatingTool(tool, storage);
+    await Promise.resolve();
+    (0, _vitest.expect)(third.getFloatingTools()).toHaveLength(0);
+    disposeThird();
+  });
+  (0, _vitest.it)("does not reopen a tool closed while its saved state was loading", async () => {
+    _vitest.vi.resetModules();
+    const registry = await Promise.resolve().then(() => _interopRequireWildcard(require("./floatingToolStore")));
+    let resolve;
+    const storage = {
+      getItem: () => new Promise(done => {
+        resolve = done;
+      }),
+      setItem: _vitest.vi.fn(async () => {})
+    };
+    const tool = {
+      id: "race",
+      render: () => null
+    };
+    const dispose = registry.registerPersistentFloatingTool(tool, storage);
+    registry.openFloatingTool(tool);
+    registry.dismissFloatingTool(tool.id);
+    resolve("1");
+    await _vitest.vi.waitFor(() => (0, _vitest.expect)(storage.setItem).toHaveBeenLastCalledWith("@buoy/floating-tool/race/open", "0"));
+    (0, _vitest.expect)(registry.getFloatingTools()).toHaveLength(0);
+    dispose();
+  });
+});

package/lib/commonjs/sync/toolActionRegistry.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.dispatchToolAction = dispatchToolAction;
 exports.getToolAdapters = getToolAdapters;
+exports.guardToolAdapter = guardToolAdapter;
 exports.isToolRegistryReady = isToolRegistryReady;
 exports.listSnapshotToolIds = listSnapshotToolIds;
 exports.listToolActions = listToolActions;
@@ -12,6 +13,7 @@ exports.listToolIds = listToolIds;
 exports.readToolSnapshot = readToolSnapshot;
 exports.registerToolAdapters = registerToolAdapters;
 exports.waitForToolRegistry = waitForToolRegistry;
+var _licenseModule = require("../license/licenseModule.js");
 /**
  * toolActionRegistry — the on-device twin of the broker's action dispatch.
  *
@@ -68,13 +70,45 @@ function sources() {
 function registerToolAdapters(getTools) {
   const set = sources();
   set.add(getTools);
+  let disposed = false;
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    const raw = getTools();
+    // Private inverse operations only. No credential bypass reaches public dispatch.
+    const cleanup = async (toolId, action, params) => {
+      if (!(toolId === "network" && action === "deleteOverrideRule" || toolId === "impersonate" && action === "stopImpersonation")) {
+        throw new Error("Unsupported account-lock cleanup operation");
+      }
+      if (toolId === "impersonate") return raw[toolId]?.dispose?.(cleanup);
+      const fn = raw[toolId]?.actions?.[action];
+      if (!fn) throw new Error(`Cleanup unavailable for ${toolId}`);
+      return fn(params);
+    };
+    for (const adapter of Object.values(raw)) {
+      try {
+        Promise.resolve(adapter.dispose?.(cleanup)).catch(error => console.warn("[Buoy] Tool cleanup failed", error));
+      } catch (error) {
+        console.warn("[Buoy] Tool cleanup failed", error);
+      }
+    }
+  };
+  const off = (0, _licenseModule.subscribeAccountAccess)(() => {
+    if (!(0, _licenseModule.hasAccountAccess)()) dispose();else disposed = false;
+  });
   return () => {
+    off();
     set.delete(getTools);
+    // A second provider still owns these adapters during Strict Mode/remount.
+    Promise.resolve().then(() => {
+      if (set.size === 0) dispose();
+    });
   };
 }
 
 /** The merged adapter map across every live source. */
 function getToolAdapters() {
+  if (!(0, _licenseModule.hasAccountAccess)()) return {};
   const merged = {};
   for (const get of sources()) {
     try {
@@ -83,7 +117,7 @@ function getToolAdapters() {
       // A source that throws must not take the whole registry down.
     }
   }
-  return merged;
+  return Object.fromEntries(Object.entries(merged).map(([id, adapter]) => [id, guardToolAdapter(adapter)]));
 }
 
 /** Tool ids currently dispatchable. */
@@ -123,6 +157,7 @@ function listSnapshotToolIds() {
  * an adapter is free to make this a promise later without breaking them.
  */
 async function readToolSnapshot(toolId) {
+  (0, _licenseModule.assertAccountAccess)();
   const tools = getToolAdapters();
   const adapter = tools[toolId];
   if (!adapter) throw new Error(`Unknown tool "${toolId}"`);
@@ -132,7 +167,7 @@ async function readToolSnapshot(toolId) {
   return await adapter.getSnapshot();
 }
 function isToolRegistryReady() {
-  return sources().size > 0;
+  return (0, _licenseModule.hasAccountAccess)() && sources().size > 0;
 }
 
 /**
@@ -141,6 +176,7 @@ function isToolRegistryReady() {
  * surface as plain messages rather than objects nobody can read on a phone.
  */
 async function dispatchToolAction(toolId, action, params) {
+  (0, _licenseModule.assertAccountAccess)();
   const tools = getToolAdapters();
   const tool = tools[toolId];
   const fn = tool?.actions?.[action];
@@ -163,4 +199,51 @@ async function waitForToolRegistry(timeoutMs = 2000) {
     if (isToolRegistryReady()) return true;
   }
   return false;
+}
+
+/** Guard retained references too, and discard results completed after revocation. */
+function guardToolAdapter(adapter) {
+  const guard = fn => (...args) => {
+    (0, _licenseModule.assertAccountAccess)();
+    let revoked = false;
+    const off = (0, _licenseModule.subscribeAccountAccess)(() => {
+      if (!(0, _licenseModule.hasAccountAccess)()) revoked = true;
+    });
+    const check = () => {
+      if (revoked) throw new Error("Buoy account access ended while the operation was pending.");
+      (0, _licenseModule.assertAccountAccess)();
+    };
+    try {
+      const result = fn.apply(adapter, args);
+      if (result && typeof result.then === "function") {
+        return Promise.resolve(result).then(value => {
+          check();
+          return value;
+        }).finally(off);
+      }
+      check();
+      off();
+      return result;
+    } catch (error) {
+      off();
+      throw error;
+    }
+  };
+  return {
+    ...adapter,
+    ...(adapter.getSnapshot ? {
+      getSnapshot: guard(adapter.getSnapshot)
+    } : {}),
+    ...(adapter.actions ? {
+      actions: Object.fromEntries(Object.entries(adapter.actions).map(([name, action]) => [name, guard(action)]))
+    } : {}),
+    ...(adapter.subscribe ? {
+      subscribe: listener => {
+        (0, _licenseModule.assertAccountAccess)();
+        return adapter.subscribe(() => {
+          if ((0, _licenseModule.hasAccountAccess)()) listener();
+        });
+      }
+    } : {})
+  };
 }