@endora-commerce/platform 0.100.0

package/dist/lifecycle/resident.d.ts

@@ -0,0 +1,16 @@
+import type { RegisteredManifestEntry } from './manifest-registry.js';
+/**
+ * Every module whose sources are this package's, as manifest entries.
+ *
+ * A function rather than a constant because `import.meta.url` is read once per
+ * call and the array is handed to callers that may sort or splice it; there is
+ * nothing here worth memoising.
+ *
+ * `origin: 'core'` is the truth and it is load-bearing: `deploymentShippedEntries`
+ * narrows the first-boot `module_registrations` insert and the boot settings
+ * reconcile to entries that are **not** `'package'`, and `_lifecycle` is not an
+ * installed package — there is no `module:install` that could converge it, so an
+ * instance whose registry never learns about it has no module registry at all.
+ */
+export declare function platformResidentManifestEntries(): RegisteredManifestEntry[];
+//# sourceMappingURL=resident.d.ts.map

package/dist/lifecycle/resident.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resident.d.ts","sourceRoot":"","sources":["../../src/lifecycle/resident.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,IAAI,uBAAuB,EAAE,CAE3E"}

package/dist/lifecycle/resident.js

@@ -0,0 +1,59 @@
+/**
+ * The modules that arrive **with this package** rather than with the tree that
+ * installs it (`specs/110-instance-repository/` T141).
+ *
+ * ## The defect this closes
+ *
+ * `_lifecycle` is a registered module that is not a package (D-160.11): its
+ * sources are this package's, at `lifecycle/`, and the only thing that has ever
+ * named it is this repository's own generated manifest index, through the
+ * host-internal `@endora-commerce/platform/lifecycle` subpath. An instance ships
+ * no generated index — that is what an instance *is* — so it passes `core: []`
+ * to {@link resolveManifestEntries} and composes `_lifecycle` nowhere.
+ *
+ * Measured on the first end-to-end run of `endora new instance` (T140), the boot
+ * refuses with `not-shipped: _lifecycle`, needed by `admin_actions`,
+ * `credentials`, `_i18n`, `prompt_actions` and `pwa` — every one of them in the
+ * default module set the command writes. There is nothing a client could put in
+ * their own tree to fix it: the module is ours, and the subpath that reaches it
+ * is one `check:platform-surface` gives a module a finding for naming.
+ *
+ * ## Why the platform contributes it, and why the host still may not be asked
+ *
+ * It is the same argument `../migrations/index.ts` makes for
+ * `BASELINE_MIGRATIONS` and `../db/platform-schema.ts` makes for the twelve
+ * migrations and six entities beside it: a datum that arrives by installing this
+ * package is this package's to supply, and a client receives a correction to it
+ * by `pnpm update`. The host keeps supplying **its** core registry, which is a
+ * fact about its own tree (R7.4); this adds what is a fact about ours.
+ *
+ * ## The `filePath` is this file, and that is not an approximation
+ *
+ * Every consumer of `filePath` takes `dirname` of it and joins a directory —
+ * `i18n.bundlesDir` above all, which the `_i18n` boot reconciler *logs and
+ * skips* when it is absent. `dirname` of this file is `lifecycle/`, which is
+ * where `i18n/en.json` and `i18n/pl.json` are, in the sources and in the build
+ * alike. It is the same directory `resolveManifestPath` answers for
+ * `@endora-commerce/platform/lifecycle` — that call resolves the subpath to
+ * `lifecycle/index.js` — reached here without a resolver, because a file knows
+ * where it is.
+ */
+import { fileURLToPath } from 'node:url';
+import { manifest } from './manifest.js';
+/**
+ * Every module whose sources are this package's, as manifest entries.
+ *
+ * A function rather than a constant because `import.meta.url` is read once per
+ * call and the array is handed to callers that may sort or splice it; there is
+ * nothing here worth memoising.
+ *
+ * `origin: 'core'` is the truth and it is load-bearing: `deploymentShippedEntries`
+ * narrows the first-boot `module_registrations` insert and the boot settings
+ * reconcile to entries that are **not** `'package'`, and `_lifecycle` is not an
+ * installed package — there is no `module:install` that could converge it, so an
+ * instance whose registry never learns about it has no module registry at all.
+ */
+export function platformResidentManifestEntries() {
+    return [{ manifest, filePath: fileURLToPath(import.meta.url), origin: 'core' }];
+}
+//# sourceMappingURL=resident.js.map

package/dist/lifecycle/resident.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resident.js","sourceRoot":"","sources":["../../src/lifecycle/resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/lifecycle/routes.admin.d.ts

@@ -0,0 +1,57 @@
+import type { FastifyInstance } from 'fastify';
+import { type MfaEnrolmentCountPort } from '@endora-commerce/contracts';
+import type { CommandBus } from '../commands/index.js';
+import type { ApiInterceptorRegistry } from '../http/interceptors/index.js';
+import type { ModuleLifecycleOrchestrator } from './services/orchestrator.js';
+import { type ActivationPropagation } from './commands/activation.commands.js';
+import type { RequireAdminFactory } from '../kernel/ports/require-admin.js';
+export interface LifecycleAdminDeps {
+    orchestrator: ModuleLifecycleOrchestrator;
+    requireAdmin: RequireAdminFactory;
+}
+export declare function registerLifecycleAdminRoutes(app: FastifyInstance, deps: LifecycleAdminDeps): Promise<void>;
+export interface ModulePresenceAdminDeps {
+    requireAdmin: RequireAdminFactory;
+    /**
+     * The write path's collaborators. Omitted in a composition that has no
+     * Command Bus — the projection still serves, because rendering a correct
+     * navigation must not depend on being able to change it.
+     */
+    activation?: {
+        commandBus: CommandBus;
+        propagation: ActivationPropagation;
+    };
+    /**
+     * `mfa`'s live enrolment count, for the deactivation-impact projection.
+     * Resolved lazily by `backend.ts`; this surface decides `mfa`'s presence
+     * before it calls, and treats a failure as "unavailable".
+     */
+    mfaEnrolmentCount: MfaEnrolmentCountPort;
+}
+/**
+ * Feature 073 — the presence projection and the activation write.
+ *
+ * Registered outside `defineModuleRoutes`, and not because this module holds a
+ * privilege: gating a surface that reports on module presence on module
+ * presence is circular, which is the same argument `ctx.ungatedRoutes` states
+ * for the liveness probes (D-36b).
+ *
+ * The activation write joins them under D-36. It backs the kernel-served
+ * `/platform/modules` screen rather than a module's own admin surface, so
+ * switching a module off can no longer remove the control that would switch it
+ * back on — the circle is gone rather than patched with a flag.
+ */
+export declare function registerModulePresenceRoutes(app: FastifyInstance, deps: ModulePresenceAdminDeps): void;
+export interface ApiInterceptorAdminDeps {
+    registry: ApiInterceptorRegistry;
+    requireAdmin: RequireAdminFactory;
+}
+/**
+ * Feature 060 — read-only diagnostics for the API interceptor mechanism.
+ * The response IS the execution plan: items sorted by target, then phase
+ * (pre before post), then execution order. `moduleEnabled` is resolved live
+ * from the enabled-set predicate at request time. Registrations are shipped
+ * module code, so there is no write surface (and no Command Bus involvement).
+ */
+export declare function registerApiInterceptorAdminRoutes(app: FastifyInstance, deps: ApiInterceptorAdminDeps): void;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/lifecycle/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/lifecycle/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAUL,KAAK,qBAAqB,EAI3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAG9E,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAsB5E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,2BAA2B,CAAC;IAC1C,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,UAAU,EAAE,UAAU,CAAC;QACvB,WAAW,EAAE,qBAAqB,CAAC;KACpC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,EAAE,qBAAqB,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA8GN;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CAcN"}

package/dist/lifecycle/routes.admin.js

@@ -0,0 +1,162 @@
+import { AdminModulePresenceResponseSchema, ModuleActivationRequestSchema, ModuleActivationResponseSchema, ModuleDeactivationImpactSchema, ModuleListQuerySchema, ModuleListResponseSchema, apiInterceptorListSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '../http/error-envelope.js';
+import { effectiveState, toModulePresenceDto } from '../kernel/lifecycle/effective-state.js';
+import { rethrowIfModuleDisabled } from '../kernel/lifecycle/plugin-helpers.js';
+import { makeSetActivationCommand, propagateActivationChange, } from './commands/activation.commands.js';
+/**
+ * Read-only admin surface for the lifecycle subsystem (feature 018 / E-1).
+ *
+ * The platform axis stays CLI-only (per `contracts/admin-http.md` E-2
+ * deferred): installing, uninstalling, enabling and disabling a module at
+ * deployment level is deployment-operator work. The admin app renders an
+ * "Installed Modules" panel from this response and surfaces orphan /
+ * pending-upgrade flags as warnings.
+ *
+ * Feature 073 adds the **other** axis — the business operator's activation
+ * control — plus the presence projection both frontends resolve their surfaces
+ * from. Those two are not the same thing and the API keeps them apart.
+ */
+/**
+ * Wire shape for one module. The conjunction is computed once, in the kernel,
+ * because a second surface reports a module's presence too (issue #96).
+ */
+const toPresenceDto = toModulePresenceDto;
+export async function registerLifecycleAdminRoutes(app, deps) {
+    app.get('/api/v1/admin/modules', {
+        preHandler: deps.requireAdmin('platform.modules.read'),
+        schema: {
+            querystring: ModuleListQuerySchema,
+            response: { 200: ModuleListResponseSchema },
+        },
+    }, async (request) => {
+        const query = ModuleListQuerySchema.parse(request.query);
+        const all = await deps.orchestrator.status();
+        let modules = all;
+        if (query.state) {
+            modules = modules.filter((m) => m.state === query.state);
+        }
+        if (query.flag) {
+            modules = modules.filter((m) => m.flags.includes(query.flag));
+        }
+        return { modules };
+    });
+}
+/**
+ * Feature 073 — the presence projection and the activation write.
+ *
+ * Registered outside `defineModuleRoutes`, and not because this module holds a
+ * privilege: gating a surface that reports on module presence on module
+ * presence is circular, which is the same argument `ctx.ungatedRoutes` states
+ * for the liveness probes (D-36b).
+ *
+ * The activation write joins them under D-36. It backs the kernel-served
+ * `/platform/modules` screen rather than a module's own admin surface, so
+ * switching a module off can no longer remove the control that would switch it
+ * back on — the circle is gone rather than patched with a flag.
+ */
+export function registerModulePresenceRoutes(app, deps) {
+    /**
+     * No permission code, deliberately. Every admin needs this to render their
+     * own navigation; `platform.modules.read` is a restricted code, and gating
+     * presence behind it would leave most admins with an unfiltered sidebar —
+     * the exact leak this feature exists to close.
+     */
+    app.get('/api/v1/admin/module-presence', {
+        preHandler: deps.requireAdmin(),
+        schema: { response: { 200: AdminModulePresenceResponseSchema } },
+    }, async () => ({
+        modules: effectiveState.all().map(toPresenceDto),
+        degraded: effectiveState.isDegraded(),
+    }));
+    /**
+     * The live half of the deactivation confirmation — the owner's ruling on
+     * D-96.5, and the **first live datum** on a screen whose consequence rows are
+     * otherwise static facts about the code (one `whenAbsent` sentence per
+     * present dependent, from a manifest, computed by
+     * `deactivationConsequencesFor`).
+     *
+     * Read here rather than at flip time on purpose: the dialog renders *before*
+     * the operator confirms, while the module is still on, so
+     * `mfaEnrolmentCountPort` is asked through an **open** gate. The same
+     * question after the flip would be a read of `mfa_enrolments` through a
+     * closed one, which is why the "refuse only enrolled subjects" answer was
+     * ruled unimplementable (D-96.7). Nothing is cached, denormalised, or
+     * expected to survive deactivation.
+     *
+     * Two failure modes, one policy: **the number never blocks the flip.** If
+     * `mfa` is already off there is no dialog and no count; if the read fails,
+     * this answers `null` and the dialog renders the rest of the consequences
+     * saying the count is unavailable. The presence decision is taken *before*
+     * the `try`, so an absent module and a broken query are not one silent
+     * `null`, and `rethrowIfModuleDisabled` is the first line of the `catch` so a
+     * flip racing this read still fails closed rather than being laundered into
+     * "unavailable".
+     */
+    app.get('/api/v1/admin/modules/:id/deactivation-impact', {
+        preHandler: deps.requireAdmin('platform.modules.activate'),
+        schema: { response: { 200: ModuleDeactivationImpactSchema } },
+    }, async (request) => {
+        const moduleId = request.params.id;
+        if (moduleId !== 'mfa' || !effectiveState.isPresent('mfa')) {
+            return { moduleId, activeSecondFactorUsers: null };
+        }
+        try {
+            return {
+                moduleId,
+                activeSecondFactorUsers: await deps.mfaEnrolmentCount.countActiveEnrolments(),
+            };
+        }
+        catch (error) {
+            // Narrow tolerance, and the reason is the product's: an operator must
+            // be able to switch a module off when a count cannot be produced.
+            // Everything else in the dialog is still true without it.
+            rethrowIfModuleDisabled(error);
+            request.log.warn({ err: error, moduleId }, '[lifecycle] the active-second-factor count could not be read; the deactivation ' +
+                'dialog renders without it');
+            return { moduleId, activeSecondFactorUsers: null };
+        }
+    });
+    if (!deps.activation)
+        return;
+    const { commandBus, propagation } = deps.activation;
+    app.post('/api/v1/admin/modules/:id/activation', {
+        preHandler: deps.requireAdmin('platform.modules.activate'),
+        schema: {
+            body: ModuleActivationRequestSchema,
+            response: { 200: ModuleActivationResponseSchema },
+        },
+    }, async (request) => {
+        const body = ModuleActivationRequestSchema.parse(request.body);
+        const moduleId = request.params.id;
+        // The Command's factory performs the refusals, so an invalid flip never
+        // opens a transaction. `CommandBus.run` resolves the actor from the
+        // ambient TenantContext and throws without one, which satisfies FR-007's
+        // actor requirement without this handler naming an actor at all.
+        const result = await commandBus.run(makeSetActivationCommand({ moduleId, active: body.active }));
+        await propagateActivationChange(propagation, result);
+        const presence = effectiveState.presence(moduleId);
+        if (!presence) {
+            throw new HttpError(500, 'INTERNAL', `Module "${moduleId}" vanished from the presence projection after its activation was written.`);
+        }
+        return { module: toPresenceDto(presence) };
+    });
+}
+/**
+ * Feature 060 — read-only diagnostics for the API interceptor mechanism.
+ * The response IS the execution plan: items sorted by target, then phase
+ * (pre before post), then execution order. `moduleEnabled` is resolved live
+ * from the enabled-set predicate at request time. Registrations are shipped
+ * module code, so there is no write surface (and no Command Bus involvement).
+ */
+export function registerApiInterceptorAdminRoutes(app, deps) {
+    app.get('/api/v1/admin/api-interceptors', {
+        preHandler: deps.requireAdmin('platform.modules.read'),
+        schema: { response: { 200: apiInterceptorListSchema } },
+    }, async () => ({
+        items: deps.registry.list().map((item) => ({
+            ...item,
+            moduleEnabled: deps.registry.isModuleEnabled(item.module),
+        })),
+    }));
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/lifecycle/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/lifecycle/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iCAAiC,EACjC,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GAOzB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAG3C;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAoB,EACpB,IAAwB;IAExB,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB;QACE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC;QACtD,MAAM,EAAE;YACN,WAAW,EAAE,qBAAqB;YAClC,QAAQ,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE;SAC5C;KACF,EACD,KAAK,EAAE,OAAO,EAA+B,EAAE;QAC7C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAoB,EACpB,IAA6B;IAE7B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CACL,+BAA+B,EAC/B;QACE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,iCAAiC,EAAE,EAAE;KACjE,EACD,KAAK,IAA0C,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QAChD,QAAQ,EAAE,cAAc,CAAC,UAAU,EAAE;KACtC,CAAC,CACH,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,GAAG,CAAC,GAAG,CACL,+CAA+C,EAC/C;QACE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;QAC1D,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,8BAA8B,EAAE,EAAE;KAC9D,EACD,KAAK,EAAE,OAAO,EAAqC,EAAE;QACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO;gBACL,QAAQ;gBACR,uBAAuB,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,EAAE;aAC9E,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,kEAAkE;YAClE,0DAA0D;YAC1D,uBAAuB,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EACxB,iFAAiF;gBAC/E,2BAA2B,CAC9B,CAAC;YACF,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO;IAC7B,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;IAEpD,GAAG,CAAC,IAAI,CACN,sCAAsC,EACtC;QACE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;QAC1D,MAAM,EAAE;YACN,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,EAAE,GAAG,EAAE,8BAA8B,EAAE;SAClD;KACF,EACD,KAAK,EAAE,OAAO,EAAqC,EAAE;QACnD,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAEnC,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CACjC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAC5D,CAAC;QACF,MAAM,yBAAyB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,UAAU,EACV,WAAW,QAAQ,2EAA2E,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7C,CAAC,CACF,CAAC;AACJ,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAAoB,EACpB,IAA6B;IAE7B,GAAG,CAAC,GAAG,CACL,gCAAgC,EAChC;QACE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC;QACtD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,EAAE;KACxD,EACD,KAAK,IAAiC,EAAE,CAAC,CAAC;QACxC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,GAAG,IAAI;YACP,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SAC1D,CAAC,CAAC;KACJ,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/lifecycle/routes.storefront.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyInstance } from 'fastify';
+/**
+ * The storefront's presence projection — feature 073, FR-030 / FR-035.
+ *
+ * Owned by `_lifecycle` because `_lifecycle` is non-deactivatable. The
+ * storefront's most-called endpoint is `GET /api/v1/i18n/config`, resolved on
+ * every page in `getServerContext()`, but it belongs to `languages` — a
+ * deactivatable module — so hanging presence off it would make presence depend
+ * on something that can be switched off. `shop-info` is owned by `settings`
+ * (non-deactivatable) but is not called on every request.
+ *
+ * Only `{ id, present }`: the storefront has no use for the two axes. "Not
+ * installed here" and "the operator switched it off" are the same fact to a
+ * buyer, and giving the storefront the distinction would only create a second
+ * place where the conjunction could be recomputed differently.
+ *
+ * Absence is **projected, never inferred from a 503.** Nearly every storefront
+ * fetch already swallows errors into defaults, so gating the API alone yields
+ * silent defaults rather than absence — the storefront would keep rendering an
+ * empty module surface, which is precisely what Constitution XVII forbids.
+ *
+ * Public: the response says which capabilities a storefront renders, which is
+ * already observable from the pages themselves.
+ */
+export declare function registerModulePresenceStorefrontRoutes(app: FastifyInstance): void;
+//# sourceMappingURL=routes.storefront.d.ts.map

package/dist/lifecycle/routes.storefront.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.storefront.d.ts","sourceRoot":"","sources":["../../src/lifecycle/routes.storefront.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO/C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sCAAsC,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAajF"}

package/dist/lifecycle/routes.storefront.js

@@ -0,0 +1,36 @@
+import { StorefrontModulePresenceResponseSchema, } from '@endora-commerce/contracts';
+import { effectiveState } from '../kernel/lifecycle/effective-state.js';
+/**
+ * The storefront's presence projection — feature 073, FR-030 / FR-035.
+ *
+ * Owned by `_lifecycle` because `_lifecycle` is non-deactivatable. The
+ * storefront's most-called endpoint is `GET /api/v1/i18n/config`, resolved on
+ * every page in `getServerContext()`, but it belongs to `languages` — a
+ * deactivatable module — so hanging presence off it would make presence depend
+ * on something that can be switched off. `shop-info` is owned by `settings`
+ * (non-deactivatable) but is not called on every request.
+ *
+ * Only `{ id, present }`: the storefront has no use for the two axes. "Not
+ * installed here" and "the operator switched it off" are the same fact to a
+ * buyer, and giving the storefront the distinction would only create a second
+ * place where the conjunction could be recomputed differently.
+ *
+ * Absence is **projected, never inferred from a 503.** Nearly every storefront
+ * fetch already swallows errors into defaults, so gating the API alone yields
+ * silent defaults rather than absence — the storefront would keep rendering an
+ * empty module surface, which is precisely what Constitution XVII forbids.
+ *
+ * Public: the response says which capabilities a storefront renders, which is
+ * already observable from the pages themselves.
+ */
+export function registerModulePresenceStorefrontRoutes(app) {
+    app.get('/api/v1/storefront/module-presence', { schema: { response: { 200: StorefrontModulePresenceResponseSchema } } }, async () => ({
+        modules: effectiveState
+            .all()
+            .map((state) => ({
+            id: state.moduleId,
+            present: state.platformAvailable && state.operatorActivated,
+        })),
+    }));
+}
+//# sourceMappingURL=routes.storefront.js.map

package/dist/lifecycle/routes.storefront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.storefront.js","sourceRoot":"","sources":["../../src/lifecycle/routes.storefront.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sCAAsC,GAEvC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sCAAsC,CAAC,GAAoB;IACzE,GAAG,CAAC,GAAG,CACL,oCAAoC,EACpC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,sCAAsC,EAAE,EAAE,EAAE,EACzE,KAAK,IAA+C,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,cAAc;aACpB,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,OAAO,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB;SAC5D,CAAC,CAAC;KACN,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/lifecycle/services/deactivation-ledger.d.ts

@@ -0,0 +1,216 @@
+import type { NonBindingPortEdge } from './gating-graph.js';
+/**
+ * The deactivation-consequence ledger — feature 074, FR-017 … FR-023.
+ *
+ * **This is not machinery bought for CI.** It is the data the confirmation
+ * dialog renders. Principle XVII's flip-time refusal is becoming an informed
+ * confirmation, which means the platform may come to rest with a present module
+ * depending on an absent one — so every seam between them needs an answer to
+ * *"what happens?"*, and the operator being asked to accept the flip needs the
+ * same answer, by name, before the write. Two independent computations of "what
+ * will stop working" would drift, and the CI one would be the copy nobody
+ * reads. So there is one:
+ *
+ *  - {@link buildDeactivationLedger} assigns an outcome to every cross-module
+ *    edge whose owner an operator may switch off, and reports the edges it can
+ *    assign none to. `check-port-dependencies.ts` fails the build on that
+ *    second list.
+ *  - {@link deactivationConsequencesFor} projects the *same entries* into the
+ *    rows an operator is shown. It is the **only** way those rows may be
+ *    computed: the presence projection the dialog reads and the 409
+ *    `MODULE_DEACTIVATION_UNCONFIRMED` envelope the write is refused with each
+ *    call it, so FR-022's equality — the id set in the dialog equals the id set
+ *    in `details.consequences` — holds by being one expression evaluated twice
+ *    rather than two lists somebody keeps in step. A second computation of
+ *    "what will stop working" anywhere in the tree is the defect, however
+ *    correct it looks on the day it is written.
+ *
+ * The module is **pure**: it takes the edges as data and reads no tree, no
+ * container and no manifest index. That is what lets the build-time caller
+ * supply them from a TypeScript scan and a runtime caller supply them from the
+ * composed deployment without the classification differing between the two.
+ *
+ * **What exists today, honestly.** The build-time caller is
+ * `backend/scripts/check-port-dependencies.ts`, which measures the reads with
+ * the TypeScript compiler API. The two runtime callers are 074's later phases
+ * and do not exist yet; what this file settles ahead of them is that there is
+ * one classifier and one projection for both to call, and one place — the
+ * classification below — where a change reaches the build gate and the operator
+ * screen together.
+ *
+ * The four acceptable outcomes and the one unacceptable one are FR-017's table;
+ * {@link DeactivationOutcome} and {@link UnassignedShape} carry them.
+ */
+/**
+ * What happens to a dependent when the module it reads is switched off.
+ *
+ *  - `fails-closed` — the calls that touch the owner answer 503
+ *    `MODULE_DISABLED`, everything else in the dependent keeps working. The
+ *    default for a call-time read of a gated port, and equally for a read of a
+ *    registry whose host *skips* an absent owner's entry: the caller gets
+ *    nothing back, which is the same answer arriving at enumeration instead of
+ *    at the port. A `refuses-without` entry reaches the same outcome **and
+ *    brings a sentence with it** — same behaviour, named rather than inferred.
+ *  - `degrades` — the dependent keeps working with less, as its own manifest
+ *    declares. The `whenAbsent` sentence is the one the dialog renders.
+ *  - `contributes` — nothing happens: a boot-time push into an ungated table
+ *    the host filters, or a host that deliberately honours an absent owner's
+ *    entry.
+ *  - `schema-only` — nothing happens: deactivation drops no tables, so a
+ *    foreign key into the owner's schema stays valid.
+ */
+export type DeactivationOutcome = 'fails-closed' | 'degrades' | 'contributes' | 'schema-only';
+/**
+ * The three shapes of "silently wrong, or a crash" — each a *fail-open* rather
+ * than a fail-closed, and each a build failure.
+ *
+ *  - `captured-registration` — the name is read once, at construction, so it
+ *    keeps answering after its owner is switched off.
+ *  - `registry-without-policy` — an ungated registration whose owner has not
+ *    said what happens to an entry, or to a caller, while it is absent. The
+ *    host is the only party that can answer, because the answer depends on the
+ *    contributor and a gate on the host's own registration cannot express that.
+ *  - `gated-port-before-first-request` — a gated port resolved from a boot hook
+ *    or a route-registration body, where the gate's "no" stops the next start
+ *    instead of stopping one request.
+ */
+export type UnassignedShape = 'captured-registration' | 'registry-without-policy' | 'gated-port-before-first-request';
+/** One cross-module read of a registration, as the caller measured it. */
+export interface CrossModuleRead {
+    /** The module doing the reading. */
+    readonly moduleId: string;
+    /** The module that owns the registration. */
+    readonly dependsOn: string;
+    /** The registration name. */
+    readonly name: string;
+    /** Registered with `di.providePort`, so resolving it asks a presence gate. */
+    readonly gated: boolean;
+    /** Resolved once, when the reading module's registration is constructed. */
+    readonly captured: boolean;
+    /** When the read happens, relative to the first request the platform serves. */
+    readonly site: 'boot' | 'wiring' | 'call';
+}
+export interface LedgerEntry {
+    /** The dependent. */
+    readonly moduleId: string;
+    /** The module an operator would be switching off. */
+    readonly dependsOn: string;
+    /** The registration the edge runs over; `null` for an edge with no container read under it. */
+    readonly name: string | null;
+    readonly outcome: DeactivationOutcome;
+    /**
+     * The dependent's own sentence. Always set for `degrades`; set for
+     * `fails-closed` when the dependent declared `refuses-without`, and `null`
+     * for the fail-closed the gate produces on its own.
+     */
+    readonly whenAbsent: string | null;
+}
+export interface UnassignedEdge {
+    readonly moduleId: string;
+    readonly dependsOn: string;
+    readonly name: string;
+    readonly shape: UnassignedShape;
+    readonly detail: string;
+}
+export interface DeactivationLedger {
+    readonly entries: readonly LedgerEntry[];
+    readonly unassigned: readonly UnassignedEdge[];
+    /**
+     * Reads left out because the name is not the owning module's registration —
+     * see {@link LedgerInput.excludedNames}. Counted rather than dropped, so a
+     * growing exclusion is visible in the check's own output line.
+     */
+    readonly excluded: number;
+}
+export interface LedgerInput {
+    /** Every cross-module read the caller measured. */
+    readonly reads: readonly CrossModuleRead[];
+    /** moduleId → `manifest.dependencies`, for the edges with no read under them. */
+    readonly declaredDependencies: ReadonlyMap<string, readonly string[]>;
+    /** The `nonBindingDependencies` edges, flattened (D-44). */
+    readonly nonBinding: readonly NonBindingPortEdge[];
+    /**
+     * Modules the platform refuses to switch off on either axis. Their edges need
+     * no outcome: the flip cannot happen, so there is no state to describe
+     * (FR-021).
+     */
+    readonly neverAbsentOwners: ReadonlySet<string>;
+    /**
+     * The `acknowledgedDependencies` edges, as `<dependent>` + `<name>` — D-101 §5.
+     *
+     * They are the one exception to the line above, and the exception is about
+     * *states* rather than flips. `nonDeactivatable` binds the transition: an
+     * operator cannot switch the owner off, and no `--force` exists. It does not
+     * bind the **initial state** — a deployment may omit the module outright, and
+     * since D-101 it may do so only by declaring the omission in a committed
+     * per-deployment ledger. The consequence rows are what that declaration is
+     * read against: the difference between "we shipped without `admin_users`" and
+     * "we shipped without `admin_users`, and here are the seams that now fail
+     * closed."
+     *
+     * Only the acknowledged edges, because they are the ones a reader checking
+     * what a deployment loses would otherwise never see — an edge deliberately
+     * withheld from `dependencies` shows up in no array they would think to read.
+     */
+    readonly acknowledged: readonly {
+        readonly moduleId: string;
+        readonly name: string;
+    }[];
+    /**
+     * `<owner>:<name>` → what the host does with an entry whose owner is absent.
+     * `skip` answers as if the entry were not registered; `honour` returns it
+     * anyway, deliberately and with a reason written at the class.
+     */
+    readonly contributionPolicies: Readonly<Record<string, 'skip' | 'honour'>>;
+    /**
+     * Names a **composition root** registers on the owning module's behalf. They
+     * are excluded rather than classified: a root's registration does not
+     * disappear when the module it stands in for is switched off, so there is no
+     * host that could state a policy for it, and nothing the owning module can
+     * declare. Their ledger is the bridging table itself, which drains as each
+     * name becomes a real port.
+     */
+    readonly excludedNames: ReadonlySet<string>;
+}
+/**
+ * Assign an outcome to every cross-module edge, and report the ones that get
+ * none.
+ *
+ * Rule order is load-bearing and reads top to bottom as "what could make this
+ * edge lie to an operator?": a capture survives every other answer the edge
+ * might have had, because it is about *when* the name is read rather than what
+ * it answers; a gated port resolved too early takes the platform down rather
+ * than the request; only then do the declarations and the gate get to speak.
+ */
+export declare function buildDeactivationLedger(input: LedgerInput): DeactivationLedger;
+/** One row of the confirmation dialog, and one element of `details.consequences`. */
+export interface ConsequenceRow {
+    /** The dependent that has the consequence. */
+    readonly moduleId: string;
+    readonly effect: 'unavailable' | 'degraded';
+    /**
+     * The dependent's own `whenAbsent` sentence, or `null` when it declared none
+     * — in which case the caller renders the platform's translated default.
+     */
+    readonly description: string | null;
+}
+/**
+ * The rows an operator is shown before switching `moduleId` off, and the rows
+ * the refusal carries when they have not acknowledged them.
+ *
+ * One row per dependent, whatever the number of edges between the two: an
+ * operator is choosing about modules, not about registrations. Where a
+ * dependent both pulls and contributes, **the pull decides** — a contribution
+ * costs nothing and saying so beside a capability that stops would be a
+ * consequence list that reads as reassurance.
+ *
+ * **The sentence follows the effect that wins**, and it has to, now that
+ * `fails-closed` can carry one. A dependent that degrades on one edge and
+ * refuses on another gets `unavailable`, and pairing that word with the
+ * degrade's *"keeps working with less"* sentence would be a row that
+ * contradicts itself in six words. A declared sentence is still kept when the
+ * winning effect has none of its own, because it is then the only specific
+ * thing the platform knows about that dependent.
+ */
+export declare function deactivationConsequencesFor(entries: readonly LedgerEntry[], moduleId: string, isPresent: (dependentId: string) => boolean): ConsequenceRow[];
+//# sourceMappingURL=deactivation-ledger.d.ts.map

package/dist/lifecycle/services/deactivation-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deactivation-ledger.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/services/deactivation-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,UAAU,GAAG,aAAa,GAAG,aAAa,CAAC;AAE9F;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GACvB,uBAAuB,GACvB,yBAAyB,GACzB,iCAAiC,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtE,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvF;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;IAC3E;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAOD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,CA0H9E;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,GAC1C,cAAc,EAAE,CAoBlB"}