@endora-commerce/platform 0.100.0

package/dist/kernel/settings/settings.service.js

@@ -0,0 +1,294 @@
+import { Setting } from './setting.entity.js';
+import { SettingValue } from './setting-value.entity.js';
+import { decryptSecretValue, isSecretEnvelope } from './secret-value-codec.js';
+/**
+ * SettingsService — the universal getter (US3 / T049).
+ *
+ * The single read mechanism every other module uses to retrieve a setting's
+ * value. A read either **names a real sales channel** or says it has **none**;
+ * nothing in between is spellable (feature 072, D-41).
+ *
+ * Resolution order for a channel-scoped read (`salesChannelId` is a uuid):
+ *
+ *   0. Channel-id shape check; a non-uuid → throw {@link SettingsChannelIdInvalid}.
+ *   1. Cache hit (read-through Redis + per-process LRU).
+ *   2. Setting lookup by code; absent → throw {@link SettingNotRegistered}.
+ *   3. Scope check; the channel must be in the setting's `salesChannels`
+ *      collection (or the collection must be empty = "all channels").
+ *      Otherwise → throw {@link SettingOutOfScopeForChannel}.
+ *   4. Per-channel `setting_values` row → return its `value`.
+ *   5. Else → `setting.globalValue`, else `setting.defaultValue`.
+ *
+ * For a **platform-wide** read (`salesChannelId === null`) step 4 is skipped:
+ * the answer is `globalValue ?? defaultValue`, the tier the admin service has
+ * always written ("Platform-wide global override") and `resolveEffectiveValue`
+ * has always resolved, but which had no read API. Three modules independently
+ * invented the nil UUID as its spelling and a fourth inlined it — it worked by
+ * accident, being well-formed enough for Postgres and matching no row. A
+ * setting scoped to a *subset* of channels has no platform-wide answer, so it
+ * throws {@link SettingOutOfScopeForChannel} with a `null` channel.
+ *
+ * No schema change: `setting_values.sales_channel_id` stays `uuid NOT NULL`.
+ * The null lives in the read signature, not in a column.
+ *
+ * The optional caller-supplied schema is validated AFTER the resolved value
+ * is materialised; mismatches surface as {@link SettingValueShapeMismatch}.
+ */
+export class SettingNotRegistered extends Error {
+    settingCode;
+    name = 'SettingNotRegistered';
+    code = 'SETTING_NOT_REGISTERED';
+    constructor(settingCode) {
+        super(`Setting "${settingCode}" is not registered.`);
+        this.settingCode = settingCode;
+    }
+}
+export class SettingOutOfScopeForChannel extends Error {
+    settingCode;
+    salesChannelId;
+    name = 'SettingOutOfScopeForChannel';
+    code = 'SETTING_OUT_OF_SCOPE_FOR_CHANNEL';
+    constructor(settingCode, 
+    /** `null` = the read was platform-wide, and this setting is not. */
+    salesChannelId) {
+        super(salesChannelId === null
+            ? `Setting "${settingCode}" is scoped to specific sales channels, so it has no platform-wide value.`
+            : `Setting "${settingCode}" is not in scope for sales channel "${salesChannelId}".`);
+        this.settingCode = settingCode;
+        this.salesChannelId = salesChannelId;
+    }
+}
+/**
+ * The caller passed something that is not a sales-channel id (feature 072,
+ * D-42 layer 3).
+ *
+ * `setting_values.sales_channel_id` is `uuid`, so a channel **code**, an empty
+ * string or any other id-shaped string cannot address a row: PostgreSQL rejects
+ * the comparison outright. Before this guard the failure surfaced as a driver
+ * error naming a column, which every caller's `catch` read as "not configured
+ * yet" — that is the whole of the defect family this error exists to end.
+ *
+ * Thrown **before** the `EntityManager` is touched, and deliberately outside
+ * the set of errors a settings read may absorb (D-43): a malformed channel id
+ * is a code defect, not a missing value. "No channel" is spelled `null`.
+ */
+export class SettingsChannelIdInvalid extends Error {
+    settingCode;
+    salesChannelId;
+    name = 'SettingsChannelIdInvalid';
+    code = 'SETTINGS_CHANNEL_ID_INVALID';
+    constructor(settingCode, salesChannelId) {
+        super(`"${salesChannelId}" is not a sales-channel id (reading setting "${settingCode}"). ` +
+            `Pass a channel uuid, or null for a platform-wide read.`);
+        this.settingCode = settingCode;
+        this.salesChannelId = salesChannelId;
+    }
+}
+/**
+ * The shape `sales_channels.id` and `setting_values.sales_channel_id` share.
+ * Deliberately not a version-specific UUID pattern: the nil UUID must be
+ * rejected as a *spelling of platform-wide*, not as a malformed id, and it is
+ * `check-channel-resolution.ts` — which can see the literal — that says so.
+ */
+const CHANNEL_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export class SettingValueShapeMismatch extends Error {
+    settingCode;
+    issues;
+    name = 'SettingValueShapeMismatch';
+    code = 'SETTING_VALUE_SHAPE_MISMATCH';
+    constructor(settingCode, issues) {
+        super(`Stored value for setting "${settingCode}" does not match the caller's schema.`);
+        this.settingCode = settingCode;
+        this.issues = issues;
+    }
+}
+export class SettingsService {
+    emFactory;
+    cache;
+    secretEncryptionKey;
+    constructor(emFactory, cache, 
+    /**
+     * Base64 32-byte key for the `secret` value type (feature 043). The
+     * cache stores ciphertext envelopes; decryption happens per read in this
+     * process so plaintext never sits in Redis.
+     */
+    secretEncryptionKey) {
+        this.emFactory = emFactory;
+        this.cache = cache;
+        this.secretEncryptionKey = secretEncryptionKey;
+    }
+    async get(code, salesChannelId, schema) {
+        this.assertChannelId(code, salesChannelId);
+        // Cache lookup (covers both real values and "not registered" sentinel).
+        if (this.cache) {
+            const cached = await this.cache.get(code, salesChannelId);
+            if (cached.hit) {
+                if (cached.notRegistered)
+                    throw new SettingNotRegistered(code);
+                return this.validate(code, this.maybeDecrypt(cached.value), schema);
+            }
+        }
+        const em = this.emFactory();
+        const setting = await em.findOne(Setting, { code }, { populate: ['salesChannels'] });
+        if (!setting) {
+            if (this.cache)
+                await this.cache.setNotRegistered(code, salesChannelId);
+            throw new SettingNotRegistered(code);
+        }
+        // Scope check: empty collection ⇒ all channels in scope. A platform-wide
+        // read of a channel-subset setting has no answer at all.
+        const scope = setting.salesChannels.getItems();
+        if (scope.length > 0 && !scope.some((c) => c.id === salesChannelId)) {
+            throw new SettingOutOfScopeForChannel(code, salesChannelId);
+        }
+        const value = salesChannelId === null
+            ? null
+            : await em.findOne(SettingValue, {
+                setting,
+                salesChannel: { id: salesChannelId },
+            });
+        const resolved = resolveEffectiveValue(setting, value);
+        if (this.cache)
+            await this.cache.set(code, salesChannelId, resolved);
+        return this.validate(code, this.maybeDecrypt(resolved), schema);
+    }
+    /**
+     * Batch read. Every code is resolved independently; per-code errors are
+     * returned as `{ ok: false, error: ... }` instead of throwing, so a single
+     * missing code does not poison the whole batch.
+     */
+    async getMany(codes, salesChannelId) {
+        const out = new Map();
+        for (const code of codes) {
+            try {
+                const value = await this.getRaw(code, salesChannelId);
+                out.set(code, { ok: true, value });
+            }
+            catch (err) {
+                const name = err.name ?? 'Error';
+                if (name === 'SettingNotRegistered') {
+                    out.set(code, { ok: false, error: 'not_registered' });
+                }
+                else if (name === 'SettingOutOfScopeForChannel') {
+                    out.set(code, { ok: false, error: 'out_of_scope' });
+                }
+                else if (name === 'SettingValueShapeMismatch') {
+                    out.set(code, {
+                        ok: false,
+                        error: 'shape_mismatch',
+                        details: err.issues,
+                    });
+                }
+                else {
+                    // Includes SettingsChannelIdInvalid: a malformed channel is wrong for
+                    // the whole batch, not a per-code outcome.
+                    throw err;
+                }
+            }
+        }
+        return out;
+    }
+    /** Raw-read variant used by `getMany` — no caller schema, returns `unknown`. */
+    async getRaw(code, salesChannelId) {
+        this.assertChannelId(code, salesChannelId);
+        if (this.cache) {
+            const cached = await this.cache.get(code, salesChannelId);
+            if (cached.hit) {
+                if (cached.notRegistered)
+                    throw new SettingNotRegistered(code);
+                return this.maybeDecrypt(cached.value);
+            }
+        }
+        const em = this.emFactory();
+        const setting = await em.findOne(Setting, { code }, { populate: ['salesChannels'] });
+        if (!setting) {
+            if (this.cache)
+                await this.cache.setNotRegistered(code, salesChannelId);
+            throw new SettingNotRegistered(code);
+        }
+        const scope = setting.salesChannels.getItems();
+        if (scope.length > 0 && !scope.some((c) => c.id === salesChannelId)) {
+            throw new SettingOutOfScopeForChannel(code, salesChannelId);
+        }
+        const value = salesChannelId === null
+            ? null
+            : await em.findOne(SettingValue, {
+                setting,
+                salesChannel: { id: salesChannelId },
+            });
+        const resolved = resolveEffectiveValue(setting, value);
+        if (this.cache)
+            await this.cache.set(code, salesChannelId, resolved);
+        return this.maybeDecrypt(resolved);
+    }
+    /**
+     * The seam guard (D-42 layer 3). Runs before the cache and before the
+     * `EntityManager`, so a caller learns it passed a non-id rather than the
+     * driver reporting a column it has never heard of.
+     */
+    assertChannelId(code, salesChannelId) {
+        if (salesChannelId === null)
+            return;
+        if (!CHANNEL_ID_PATTERN.test(salesChannelId)) {
+            throw new SettingsChannelIdInvalid(code, salesChannelId);
+        }
+    }
+    validate(code, value, schema) {
+        const r = schema.safeParse(value);
+        if (!r.success)
+            throw new SettingValueShapeMismatch(code, r.error.issues);
+        return r.data;
+    }
+    /**
+     * Secret settings (feature 043) resolve to a ciphertext envelope; backend
+     * consumers receive the plaintext. Non-envelope values (every other value
+     * type, plus legacy plaintext secrets) pass through untouched.
+     */
+    maybeDecrypt(value) {
+        if (!isSecretEnvelope(value))
+            return value;
+        return decryptSecretValue(value, this.secretEncryptionKey);
+    }
+    /**
+     * Feature 058 (US2) — delete-integrity lookup for the credentials module.
+     *
+     * Returns every `credential_ref` setting whose resolved value (global
+     * override OR a per-channel `SettingValue`) equals `configurationCode`. The
+     * credentials module calls this through its port interface (Principle I)
+     * before deleting a configuration; a non-empty result blocks the delete
+     * (`CREDENTIAL_IN_USE`, FR-012). The manifest `defaultValue` is intentionally
+     * ignored — a manifest never ships a real configuration code.
+     */
+    async listReferencesToConfiguration(configurationCode) {
+        const em = this.emFactory();
+        const settings = await em.find(Setting, { valueType: 'credential_ref' });
+        const refs = [];
+        for (const setting of settings) {
+            if (setting.globalValue === configurationCode) {
+                refs.push({ settingCode: setting.code });
+            }
+            const values = await em.find(SettingValue, { setting }, { populate: ['salesChannel'] });
+            for (const v of values) {
+                if (v.value === configurationCode) {
+                    refs.push({ settingCode: setting.code, salesChannelCode: v.salesChannel.code });
+                }
+            }
+        }
+        return refs;
+    }
+}
+/**
+ * Three-tier resolution: per-channel SettingValue row → setting.globalValue
+ * (when non-null) → manifest defaultValue. A NULL `globalValue` means the
+ * admin has not set a platform-wide override; the manifest default applies.
+ * Per-channel rows always win over `globalValue`.
+ */
+function resolveEffectiveValue(setting, perChannel) {
+    if (perChannel)
+        return perChannel.value;
+    if (setting.globalValue !== null && setting.globalValue !== undefined) {
+        return setting.globalValue;
+    }
+    return setting.defaultValue;
+}
+//# sourceMappingURL=settings.service.js.map

package/dist/kernel/settings/settings.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.service.js","sourceRoot":"","sources":["../../../src/kernel/settings/settings.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGjB;IAFV,IAAI,GAAG,sBAAsB,CAAC;IACvC,IAAI,GAAG,wBAAiC,CAAC;IAClD,YAA4B,WAAmB;QAC7C,KAAK,CAAC,YAAY,WAAW,sBAAsB,CAAC,CAAC;QAD3B,gBAAW,GAAX,WAAW,CAAQ;IAE/C,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAIlC;IAEA;IALA,IAAI,GAAG,6BAA6B,CAAC;IAC9C,IAAI,GAAG,kCAA2C,CAAC;IAC5D,YACkB,WAAmB;IACnC,oEAAoE;IACpD,cAA6B;QAE7C,KAAK,CACH,cAAc,KAAK,IAAI;YACrB,CAAC,CAAC,YAAY,WAAW,2EAA2E;YACpG,CAAC,CAAC,YAAY,WAAW,wCAAwC,cAAc,IAAI,CACtF,CAAC;QARc,gBAAW,GAAX,WAAW,CAAQ;QAEnB,mBAAc,GAAd,cAAc,CAAe;IAO/C,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAI/B;IACA;IAJA,IAAI,GAAG,0BAA0B,CAAC;IAC3C,IAAI,GAAG,6BAAsC,CAAC;IACvD,YACkB,WAAmB,EACnB,cAAsB;QAEtC,KAAK,CACH,IAAI,cAAc,iDAAiD,WAAW,MAAM;YAClF,wDAAwD,CAC3D,CAAC;QANc,gBAAW,GAAX,WAAW,CAAQ;QACnB,mBAAc,GAAd,cAAc,CAAQ;IAMxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,iEAAiE,CAAC;AAE7F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAIhC;IACA;IAJA,IAAI,GAAG,2BAA2B,CAAC;IAC5C,IAAI,GAAG,8BAAuC,CAAC;IACxD,YACkB,WAAmB,EACnB,MAAe;QAE/B,KAAK,CAAC,6BAA6B,WAAW,uCAAuC,CAAC,CAAC;QAHvE,gBAAW,GAAX,WAAW,CAAQ;QACnB,WAAM,GAAN,MAAM,CAAS;IAGjC,CAAC;CACF;AAUD,MAAM,OAAO,eAAe;IAEP;IACA;IAMA;IARnB,YACmB,SAA8B,EAC9B,KAAqB;IACtC;;;;OAIG;IACc,mBAA4B;QAP5B,cAAS,GAAT,SAAS,CAAqB;QAC9B,UAAK,GAAL,KAAK,CAAgB;QAMrB,wBAAmB,GAAnB,mBAAmB,CAAS;IAC5C,CAAC;IAEJ,KAAK,CAAC,GAAG,CACP,IAAY,EACZ,cAA6B,EAC7B,MAAoB;QAEpB,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAE3C,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,aAAa;oBAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAC9B,OAAO,EACP,EAAE,IAAI,EAAE,EACR,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACxE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,2BAA2B,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GACT,cAAc,KAAK,IAAI;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC7B,OAAO;gBACP,YAAY,EAAE,EAAE,EAAE,EAAE,cAAc,EAA2B;aAC9D,CAAC,CAAC;QAET,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,KAAe,EACf,cAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACtD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,IAAI,OAAO,CAAC;gBACxD,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACpC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,IAAI,IAAI,KAAK,6BAA6B,EAAE,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtD,CAAC;qBAAM,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;oBAChD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;wBACZ,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,gBAAgB;wBACvB,OAAO,EAAG,GAAiC,CAAC,MAAM;qBACnD,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,sEAAsE;oBACtE,2CAA2C;oBAC3C,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,cAA6B;QAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAE3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,aAAa;oBAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAC9B,OAAO,EACP,EAAE,IAAI,EAAE,EACR,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACxE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,2BAA2B,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GACT,cAAc,KAAK,IAAI;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC7B,OAAO;gBACP,YAAY,EAAE,EAAE,EAAE,EAAE,cAAc,EAA2B;aAC9D,CAAC,CAAC;QACT,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAY,EAAE,cAA6B;QACjE,IAAI,cAAc,KAAK,IAAI;YAAE,OAAO;QACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,QAAQ,CAAI,IAAY,EAAE,KAAc,EAAE,MAAoB;QACpE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,KAAc;QACjC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,6BAA6B,CACjC,iBAAyB;QAEzB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzE,MAAM,IAAI,GAAyD,EAAE,CAAC;QACtE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAC1B,YAAY,EACZ,EAAE,OAAO,EAAE,EACX,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,CAC/B,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,OAAgB,EAChB,UAA+B;IAE/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,WAAW,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC;AAC9B,CAAC"}

package/dist/lifecycle/backend.d.ts

@@ -0,0 +1,51 @@
+import type { ModuleContext } from '../kernel/index.js';
+import type { ApiInterceptorRegistry } from '../http/interceptors/index.js';
+import type { RequireAdminFactory } from '../kernel/ports/require-admin.js';
+import { type LifecycleAdminDeps, type ModulePresenceAdminDeps } from './routes.admin.js';
+/**
+ * `_lifecycle` — the module remainder, after the wrappers and the registry
+ * became kernel-owned (feature 072, wave 2, T125).
+ *
+ * What converts is the **route half**: the presence projections, the activation
+ * write, the interceptor admin screen and the module list. The orchestrator does
+ * not, and the reason is not squeamishness — it is the one collaborator whose
+ * absence is a real composition, not a degraded one. The test harness runs no
+ * orchestrator on purpose: it never populates `module_registrations`, and a
+ * refresh from the database would blank the seeded enabled-set and take every
+ * gated route down mid-run. So the orchestrator is a contribution a root makes,
+ * and the module list mounts only where one exists.
+ *
+ * **Every route here is ungated, and that is the point of the module.** Gating
+ * the presence projection on `_lifecycle`'s own presence is the circle D-36 was
+ * decided to break: an operator who has switched something off reaches
+ * `/platform/modules` to switch it back on, and that screen must answer when
+ * the rest of the platform does not. `routes.admin.ts` already said as much in
+ * a comment ("registered outside `defineModuleRoutes`"); `ctx.ungatedRoutes`
+ * makes it a declaration with a reason attached rather than an omission.
+ *
+ * Both roots mounted these by hand — production through
+ * `lifecycleModuleFromStaticEntries`, the harness through three direct calls
+ * with its own propagation shape. That divergence is what this file removes:
+ * the routes are registered once, and what differs between compositions is
+ * named (`lifecycleActivationPropagation`, `lifecycleOrchestrator`).
+ */
+/** What `_lifecycle` resolves from the container, and the names it owns. */
+export interface LifecycleCradle {
+    readonly requireAdmin: RequireAdminFactory;
+    readonly apiInterceptors: ApiInterceptorRegistry;
+    /**
+     * How a committed activation flip reaches the rest of the deployment:
+     * refreshing local state, publishing to other processes, dropping the
+     * storefront's cache. Root-shaped because the harness refreshes through the
+     * cache seam rather than the database — see the note above.
+     */
+    readonly lifecycleActivationPropagation: NonNullable<ModulePresenceAdminDeps['activation']>;
+    /**
+     * Contribution point: absent in a composition that boots no orchestrator, and
+     * the module list is then not served. The projections still are — rendering a
+     * correct navigation must not depend on being able to install anything.
+     */
+    readonly lifecycleOrchestrator: LifecycleAdminDeps['orchestrator'] | undefined;
+}
+export declare function registerModule(ctx: ModuleContext): void;
+//# sourceMappingURL=backend.d.ts.map

package/dist/lifecycle/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/lifecycle/backend.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,EAAE,WAAW,CAClD,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;CAChF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA2CvD"}

package/dist/lifecycle/backend.js

@@ -0,0 +1,40 @@
+import { lazyPort } from '../kernel/index.js';
+import { registerApiInterceptorAdminRoutes, registerLifecycleAdminRoutes, registerModulePresenceRoutes, } from './routes.admin.js';
+import { registerModulePresenceStorefrontRoutes } from './routes.storefront.js';
+export function registerModule(ctx) {
+    ctx.di.register({
+        // Contribution point, absent by default: no orchestrator, no module list.
+        lifecycleOrchestrator: ctx
+            .asFunction(() => undefined)
+            .singleton(),
+    });
+    ctx.ungatedRoutes('The module presence projection and the activation write: an operator reaches ' +
+        '/platform/modules precisely when something is switched off, so gating this surface on ' +
+        "this module's own presence is the circle D-36 exists to break — including the case " +
+        'where the module that is off is this one.', async (app) => {
+        const cradle = ctx.cradle();
+        registerApiInterceptorAdminRoutes(app, {
+            registry: cradle.apiInterceptors,
+            requireAdmin: cradle.requireAdmin,
+        });
+        registerModulePresenceRoutes(app, {
+            requireAdmin: cradle.requireAdmin,
+            activation: cradle.lifecycleActivationPropagation,
+            // The one live datum on the deactivation-confirmation screen: how many
+            // people hold a second factor. `mfa` owns `mfa_enrolments`, so it
+            // answers the question rather than this surface querying its table.
+            // The route probes `mfa`'s presence before it calls — the count is read
+            // while the module is still on, which is what the dialog is for.
+            mfaEnrolmentCount: lazyPort(ctx, 'mfaEnrolmentCountPort'),
+        });
+        registerModulePresenceStorefrontRoutes(app);
+        const orchestrator = ctx.cradle().lifecycleOrchestrator;
+        if (orchestrator !== undefined) {
+            await registerLifecycleAdminRoutes(app, {
+                orchestrator,
+                requireAdmin: cradle.requireAdmin,
+            });
+        }
+    });
+}
+//# sourceMappingURL=backend.js.map

package/dist/lifecycle/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../src/lifecycle/backend.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,4BAA4B,GAG7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAmDhF,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,0EAA0E;QAC1E,qBAAqB,EAAE,GAAG;aACvB,UAAU,CAAC,GAA6C,EAAE,CAAC,SAAS,CAAC;aACrE,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,aAAa,CACf,+EAA+E;QAC7E,wFAAwF;QACxF,qFAAqF;QACrF,2CAA2C,EAC7C,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAmB,CAAC;QAE7C,iCAAiC,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,MAAM,CAAC,eAAe;YAChC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,4BAA4B,CAAC,GAAG,EAAE;YAChC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,8BAA8B;YACjD,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,wEAAwE;YACxE,iEAAiE;YACjE,iBAAiB,EAAE,QAAQ,CAAwB,GAAG,EAAE,uBAAuB,CAAC;SACjF,CAAC,CAAC;QAEH,sCAAsC,CAAC,GAAG,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAmB,CAAC,qBAAqB,CAAC;QACzE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,4BAA4B,CAAC,GAAG,EAAE;gBACtC,YAAY;gBACZ,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/lifecycle/commands/activation.commands.d.ts

@@ -0,0 +1,97 @@
+import type { Command } from '../../commands/command.js';
+/**
+ * The operator-activation flip — feature 073 / US1, FR-007, Principle XIII.
+ *
+ * Hosted by `_lifecycle` rather than `settings`, for three reasons that are
+ * easy to lose:
+ *
+ *  - `_lifecycle` already imports the `Setting` entity (the orchestrator
+ *    reconciles rows on install) and already receives `auditLog`, so this adds
+ *    no dependency edge in either direction;
+ *  - there is **no existing settings-write Command to copy**. No `setting.*`
+ *    Command exists and the settings module never receives a `commandBus`:
+ *    `SettingsAdminService.setValue` audits by hand *after* `em.flush()` and
+ *    outside any transaction, which is exactly the torn-write window the
+ *    Command Bus exists to close;
+ *  - "activation is not an ordinary setting write" stays visible in the code
+ *    rather than being implied by a guard somewhere else.
+ *
+ * The control still *renders* in the Settings surface, as Constitution XVII
+ * requires. Only the write path is dedicated.
+ *
+ * What this command deliberately does **not** touch is `module_registrations`.
+ * The two axes never overwrite each other (FR-003), and that is enforced by
+ * this asymmetry rather than by a runtime check: the CLI path writes the
+ * registry and never the Setting, this path writes the Setting and never the
+ * registry.
+ */
+export interface SetModuleActivationInput {
+    moduleId: string;
+    active: boolean;
+}
+/**
+ * Refuse before the Command opens a transaction.
+ *
+ * A refusal rather than a no-op: a control that silently does nothing is worse
+ * than an absent one, because the operator believes they switched something.
+ *
+ * Four refusals, in the order an operator meets them: an unknown id, a module
+ * with no control, a deactivation something present still needs, and an
+ * activation into a deployment that cannot serve it. The last two are FR-008
+ * (T045/T046) and they are what makes this door agree with the CLI's — until
+ * they existed, `orchestrator.disable` refused `settings` because
+ * `organizations` depends on it while this function let the identical flip
+ * through in silence, taking the tenancy root down with it.
+ *
+ * **They read `gatingGraph()`, not `ModuleDepGraph`.** The manifest graph is a
+ * DAG on purpose and a handful of real edges are withheld from it so it can
+ * stay one; the refusal graph adds them back from
+ * `manifest.acknowledgedDependencies`. See `services/gating-graph.ts` for why
+ * the two directions read different edge sets.
+ *
+ * The direction is evaluated as asked, not as a delta against the stored value.
+ * A redundant write is an odd thing to refuse, but the alternative is a write
+ * path that skips its own invariant whenever the state is already wrong — which
+ * is precisely the state in which the check matters.
+ */
+export declare function assertActivationWritable(moduleId: string, active: boolean): string;
+/**
+ * Flip one module's operator activation.
+ *
+ * The audit snapshot is the resolved activation on either side rather than the
+ * raw jsonb: `global_value` is `null` both for "the operator never chose" and
+ * for a literal JSON null, so recording it would leave two consecutive audit
+ * rows unable to say what the module's activation actually was at either moment.
+ */
+export declare function makeSetActivationCommand(input: SetModuleActivationInput): Command<{
+    moduleId: string;
+    active: boolean;
+}>;
+/** The two side effects that make a flip visible outside the writing process. */
+export interface ActivationPropagation {
+    /** Re-reads both axes locally, so the next request in *this* process is correct. */
+    refreshLocalState: () => Promise<void>;
+    /** Notifies every other API and worker process over `b2b:module:state-changed`. */
+    publishStateChanged: (payload: {
+        moduleId: string;
+        newState: string;
+    }) => Promise<void>;
+    /** Drops the storefront's `modules:presence` cache entry. */
+    revalidateStorefront: (tags: string[]) => Promise<void>;
+}
+/**
+ * Propagate a committed flip. Called **after** the Command's transaction, never
+ * inside it: a Redis hiccup must not roll back a change the operator was told
+ * had been saved, and a subscriber that acted on a notification for a
+ * transaction that then aborted would be acting on a state that never existed.
+ *
+ * Each step is best-effort and independent. The local refresh is what makes the
+ * flip take effect without a redeploy in the writing process; the publish does
+ * the same everywhere else; the revalidation does it for the storefront. A
+ * process that misses the notification recovers through the degraded-mode timer.
+ */
+export declare function propagateActivationChange(propagation: ActivationPropagation, input: {
+    moduleId: string;
+    active: boolean;
+}): Promise<void>;
+//# sourceMappingURL=activation.commands.d.ts.map

package/dist/lifecycle/commands/activation.commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activation.commands.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/commands/activation.commands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAOzD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CA8DlF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CA8ChD;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mFAAmF;IACnF,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,qBAAqB,EAClC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC3C,OAAO,CAAC,IAAI,CAAC,CASf"}

package/dist/lifecycle/commands/activation.commands.js

@@ -0,0 +1,142 @@
+import { randomUUID } from 'node:crypto';
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '../../http/error-envelope.js';
+import { Setting } from '../../kernel/settings/setting.entity.js';
+import { effectiveState } from '../../kernel/lifecycle/effective-state.js';
+import { gatingGraph } from '../services/gating-graph.js';
+import { registryCache } from '../../kernel/lifecycle/registry-cache.js';
+/**
+ * Refuse before the Command opens a transaction.
+ *
+ * A refusal rather than a no-op: a control that silently does nothing is worse
+ * than an absent one, because the operator believes they switched something.
+ *
+ * Four refusals, in the order an operator meets them: an unknown id, a module
+ * with no control, a deactivation something present still needs, and an
+ * activation into a deployment that cannot serve it. The last two are FR-008
+ * (T045/T046) and they are what makes this door agree with the CLI's — until
+ * they existed, `orchestrator.disable` refused `settings` because
+ * `organizations` depends on it while this function let the identical flip
+ * through in silence, taking the tenancy root down with it.
+ *
+ * **They read `gatingGraph()`, not `ModuleDepGraph`.** The manifest graph is a
+ * DAG on purpose and a handful of real edges are withheld from it so it can
+ * stay one; the refusal graph adds them back from
+ * `manifest.acknowledgedDependencies`. See `services/gating-graph.ts` for why
+ * the two directions read different edge sets.
+ *
+ * The direction is evaluated as asked, not as a delta against the stored value.
+ * A redundant write is an odd thing to refuse, but the alternative is a write
+ * path that skips its own invariant whenever the state is already wrong — which
+ * is precisely the state in which the check matters.
+ */
+export function assertActivationWritable(moduleId, active) {
+    const declaration = registryCache.activationDeclaration(moduleId);
+    if (!declaration) {
+        // Either the id is unknown, or the module has not declared a control yet
+        // (the conversion sweep is per batch). Both are "there is nothing here to
+        // switch", but they read differently to an operator.
+        const known = registryCache.platformStateOf(moduleId) !== 'not-installed';
+        if (!known) {
+            throw new HttpError(404, ERROR_CODES.MODULE_NOT_FOUND, `No module "${moduleId}" is registered on this deployment.`);
+        }
+        throw new HttpError(409, ERROR_CODES.MODULE_NOT_DEACTIVATABLE, `Module "${moduleId}" declares no activation control, so it cannot be switched on or off.`);
+    }
+    if (declaration.settingCode === null) {
+        throw new HttpError(409, ERROR_CODES.MODULE_NOT_DEACTIVATABLE, declaration.nonDeactivatableReason ??
+            `Module "${moduleId}" cannot be switched off.`);
+    }
+    const graph = gatingGraph();
+    const isPresent = (id) => effectiveState.isPresent(id);
+    if (!active) {
+        const blockedBy = graph.presentDependentsOf(moduleId, isPresent);
+        if (blockedBy.length > 0) {
+            // A distinct code from MODULE_NOT_DEACTIVATABLE, which says "there is
+            // nothing here to switch, ever". This one is "not in this order", and the
+            // remedy is in `details.blockedBy` — the admin renders the two
+            // differently, and so does the CLI (`non-deactivatable` vs
+            // `dependents-block`).
+            throw new HttpError(409, ERROR_CODES.MODULE_DEPENDENTS_PRESENT, `Module "${moduleId}" cannot be switched off while these modules need it: ` +
+                `${blockedBy.join(', ')}. Switch them off first.`, { moduleId, blockedBy });
+        }
+    }
+    else {
+        const missing = graph.absentDependenciesOf(moduleId, isPresent);
+        if (missing.length > 0) {
+            throw new HttpError(409, ERROR_CODES.MODULE_DEPENDENCIES_ABSENT, `Module "${moduleId}" cannot be switched on while these modules it needs ` +
+                `are absent: ${missing.join(', ')}.`, { moduleId, missing });
+        }
+    }
+    return declaration.settingCode;
+}
+/**
+ * Flip one module's operator activation.
+ *
+ * The audit snapshot is the resolved activation on either side rather than the
+ * raw jsonb: `global_value` is `null` both for "the operator never chose" and
+ * for a literal JSON null, so recording it would leave two consecutive audit
+ * rows unable to say what the module's activation actually was at either moment.
+ */
+export function makeSetActivationCommand(input) {
+    const settingCode = assertActivationWritable(input.moduleId, input.active);
+    return {
+        action: 'module.activation.set',
+        objectType: 'module',
+        objectId: input.moduleId,
+        capture: async () => ({
+            moduleId: input.moduleId,
+            settingCode,
+            activated: effectiveState.presence(input.moduleId)?.operatorActivated ?? true,
+        }),
+        run: async ({ em }) => {
+            const setting = await em.findOne(Setting, { code: settingCode });
+            if (!setting) {
+                // The reconciler creates the row from the module's settings manifest at
+                // boot. Its absence means the module declared an activation code it
+                // does not own — a manifest error, not an operator one.
+                throw new HttpError(500, ERROR_CODES.SETTING_NOT_REGISTERED, `Module "${input.moduleId}" declares activation setting "${settingCode}", which is not registered.`);
+            }
+            setting.globalValue = input.active;
+            await em.flush();
+            return {
+                result: { moduleId: input.moduleId, active: input.active },
+                after: {
+                    moduleId: input.moduleId,
+                    settingCode,
+                    activated: input.active,
+                },
+            };
+        },
+        event: (result) => ({
+            eventName: 'module.activation.changed',
+            payload: {
+                eventId: randomUUID(),
+                occurredAt: new Date().toISOString(),
+                moduleId: result.moduleId,
+                active: result.active,
+            },
+        }),
+    };
+}
+/**
+ * Propagate a committed flip. Called **after** the Command's transaction, never
+ * inside it: a Redis hiccup must not roll back a change the operator was told
+ * had been saved, and a subscriber that acted on a notification for a
+ * transaction that then aborted would be acting on a state that never existed.
+ *
+ * Each step is best-effort and independent. The local refresh is what makes the
+ * flip take effect without a redeploy in the writing process; the publish does
+ * the same everywhere else; the revalidation does it for the storefront. A
+ * process that misses the notification recovers through the degraded-mode timer.
+ */
+export async function propagateActivationChange(propagation, input) {
+    await propagation.refreshLocalState().catch(() => undefined);
+    await propagation
+        .publishStateChanged({
+        moduleId: input.moduleId,
+        newState: input.active ? 'activated' : 'deactivated',
+    })
+        .catch(() => undefined);
+    await propagation.revalidateStorefront(['modules:presence']).catch(() => undefined);
+}
+//# sourceMappingURL=activation.commands.js.map