@vendure/cloud-config 0.0.0

package/README.md

@@ -0,0 +1,298 @@
+# @vendure/cloud-config
+
+The interface package a Vendure Cloud application depends on. It holds the Cloud Config
+type and the checks that keep the ownership boundary honest, per
+[ADR-0017](../../internal/adr/0017-cloud-config.md),
+[ADR-0043](../../internal/adr/0043-cloud-config-composition-and-the-platform-entrypoint.md),
+[ADR-0044](../../internal/adr/0044-which-vendure-plugins-the-platform-supplies.md) and
+[ADR-0047](../../internal/adr/0047-vendure-extensions-are-declared-in-the-cloud-config.md).
+
+A customer writes a configuration file and no entrypoint, importing from `@vendure/cloud`
+rather than from here:
+
+```ts
+import { defineCloudConfig, defineVendureExtension } from "@vendure/cloud";
+import { DefaultSearchPlugin } from "@vendure/core";
+import { ErpPlugin } from "./plugins/erp/erp.plugin.js";
+
+export default defineCloudConfig({
+  plugins: [
+    DefaultSearchPlugin.init({ bufferUpdates: false }),
+    defineVendureExtension({
+      id: "acme.erp",
+      plugins: [ErpPlugin],
+      migrations: ["./migrations/*.js"],
+      outboundHosts: ["erp.acme.com"],
+    }),
+  ],
+});
+```
+
+## Vendure Extensions
+
+A **Vendure Extension** is a named group of the customer's own plugins carrying the three
+pieces of metadata the platform reads
+([ADR-0047](../../internal/adr/0047-vendure-extensions-are-declared-in-the-cloud-config.md)).
+It is written inline as above, or exported by a package and referenced by name; the wrapper
+does not distinguish the two, and a third-party extension's author declares its metadata so a
+consumer does not restate it. That ADR's table records why every other field the original
+proposal carried was removed, and the input is a function argument so an object literal
+reintroducing one fails the build.
+
+`defineCloudConfig` flattens the extensions out of the plugins array before anything else
+sees it, keeping declaration order, and records which extension declared each plugin.
+`PlatformFieldSetByPluginError` reads that map, so a plugin inside an extension that writes a
+platform-owned field is named together with the extension it came from. Everything
+downstream — `hoistCloudPluginsLast`, `recordPlatformFieldWrites`, the two assertions —
+operates on the flattened array and needed no change.
+
+**A `migrations` glob resolves against the file that declared the extension**, not against
+the configuration file that references it. `defineVendureExtension` reads its own call site
+off the stack for this, which is the one piece of machinery here that is not obvious; the
+reasoning, including why `import.meta.url` is not asked for and why the stack has to be read
+through our own `Error.prepareStackTrace`, is at the function in `src/vendure-extension.ts`.
+`test/managed-build.test.ts` proves it against compiled output laid out and run the way the
+managed build produces it, because nothing about the trap survives being tested against this
+package's own TypeScript sources.
+
+### Migrations are resolved into an ordered class list
+
+A glob never reaches TypeORM. The config handle carries `loadMigrations()`, which expands each
+extension's globs, imports what they match, and returns the migration classes with the
+extension that declared each one:
+
+```ts
+const { loadMigrations } = readCloudConfig(handle);
+const loaded = await loadMigrations();
+// loaded[n] is { migration, name, timestamp, file, extension }
+// dbConnectionOptions.migrations = loaded.map((entry) => entry.migration)
+```
+
+It is a function on the handle rather than a value on it, and it is bound to that handle's own
+extensions rather than callable with any array. ADR-0048's "Ordering is a property of the array
+we build" argues both, and is the place to change if either stops being true.
+
+The order is **ascending timestamp, then extension declaration order, then class name.**
+TypeORM sorts the set by timestamp and `Array.prototype.sort` is stable, so equal timestamps
+run in whatever order the array holds them; today that order comes from `glob.sync`, which
+does not sort, so a tie resolves by filesystem walk order and can differ between the
+customer's machine and the managed build. The last two keys make the tie a value the platform
+computed. **Ordering across extensions is not a contract**
+([ADR-0048](../../internal/adr/0048-extension-migrations-keep-typeorms-ledger-identity.md)):
+an extension cannot declare that it must migrate after another, and nothing here adds a way
+to say so.
+
+The ledger identity is TypeORM's own — the migration class name, read off an instance so that
+a migration declaring `name` as an instance field is called here what it is called in the
+ledger. A glob that contributes no migrations raises `MigrationGlobMatchedNoMigrationsError`
+naming the extension and the glob as it was written. It distinguishes a glob that matched
+nothing at all, which is far more often a wrong path than an extension with no migrations,
+from one whose every match was filtered out as not being a migration file.
+
+## Secrets
+
+`secret('NAME')` reads a customer-supplied value, registers the name, and returns a plain
+string. Values arrive as ordinary environment variables (ADR-0030), so this is a read helper
+over `process.env` rather than a second delivery mechanism.
+
+```ts
+export default defineCloudConfig({
+  plugins: [
+    PaymentPlugin.init({ apiKey: secret("STRIPE_SECRET_KEY") }),
+  ],
+});
+```
+
+It exists because `process.env` gives the platform no hook. Three things follow from the call
+that a direct read cannot provide:
+
+- **Every missing name is reported at once.** A name that is unset — or set to an empty or
+  whitespace-only value, which counts as unset because an empty credential fails inside a
+  payment call rather than at boot — is recorded rather than thrown on. `defineCloudConfig`
+  then raises `MissingSecretsError` naming all of them, so a configuration with four unset
+  secrets takes one deploy to fix rather than four.
+- **The value is trimmed**, so a credential that picked up a trailing newline from a
+  file-based secret store or a `.env` loader does not reach the caller intact and fail in the
+  same place an empty one would. Only the ends: a multi-line value such as a PEM key keeps its
+  interior exactly, per ADR-0030's note that customers put private keys in these variables.
+- **The declared set is exactly what the code asked for.** Registration is a side effect of
+  the call, so it cannot drift from the code the way a hand-written `requirements.secrets`
+  list would. `listDeclaredSecrets()` is the entrypoint's accessor after composition.
+- **The value can be redacted.** `redactSecrets(text)` replaces every resolved value wherever
+  it appears. A value read straight out of `process.env` is an ordinary string that nothing
+  downstream can recognise.
+
+**The argument has to be a string literal**, enforced by the type rather than by a lint rule.
+Passing a variable makes the parameter type `never` and fails the build. A literal is what
+makes the declared set readable by static analysis, and a type constraint needs no tooling in
+the customer's project.
+
+### Reading a secret at request time is not supported
+
+`secret()` resolves once, while the configuration object is being built. A call made later —
+inside a request handler, a job processor, or a lazily constructed client — happens after
+`defineCloudConfig` has already checked the registry, so a missing value is not reported at
+boot and is not part of the declared set.
+
+The answer is to read the secret during composition and hold it, which is the natural shape
+when secrets are plugin options:
+
+```ts
+// Yes: resolved once, declared, redactable.
+PaymentPlugin.init({ apiKey: secret("STRIPE_SECRET_KEY") })
+
+// No: resolved per request, invisible to the missing-secret report.
+class PaymentService {
+  charge() {
+    const key = secret("STRIPE_SECRET_KEY");
+  }
+}
+```
+
+A plugin that genuinely needs the value later should take it as an option and keep it, rather
+than reaching for it at the point of use.
+
+## Declared outbound hosts
+
+A Vendure Extension declares the hosts it talks to, and `installOutboundHostCheck` reports a
+call to a host it did not declare, naming the extension
+([ADR-0028's amendment](../../internal/adr/0028-cell-network-topology.md)).
+
+```
+Vendure Cloud: Extension acme.erp attempted outbound access to api.other-erp.example.
+Declared outbound hosts: erp.acme.com
+```
+
+The check runs inside the customer's own process rather than in the network path, and
+attribution is the reason. A firewall sees a source address and a TLS server name and cannot
+say which extension made the call, so it cannot produce that message. Reading the stack can.
+
+**It is reported and never blocked** (CLO-412 records the reasoning). This is a hygiene
+control over trusted code, not a security boundary — code written to bypass it will succeed,
+and a compromised dependency can exfiltrate through a *declared* host anyway. So blocking
+stops no attacker, and everything it would stop is an honest extension whose declaration is
+incomplete. Escalating to a block is left available and would need its own stated, announced
+decision, the same condition ADR-0045 put on its own advisory.
+
+**An extension that declares no hosts is not checked.** The declaration is the opt-in. Reading
+"declared nothing" as "may reach nothing" would report against every extension in existence
+today, and a report that fires on everything is not read. Note that `defineVendureExtension`
+normalises an absent `outboundHosts` and an explicit `[]` to the same empty array, so
+"deliberately talks to nothing" cannot currently be expressed distinctly from "did not say".
+
+**A call the stack attributes to no extension is not checked either.** Vendure core's own
+traffic, the database driver's, and anything reached from platform code land there, and
+reporting them would drown the signal.
+
+That is also the one real limit of reading the stack, and it is about where the code is rather
+than about async boundaries. Attribution needs a frame belonging to the extension somewhere on
+the stack when the socket opens. An extension that supplies a host as *data* and lets other
+code dial it has no such frame, and that call is dropped. Crossing a timer, an await, or a
+helper the extension did not write does not cause this — the extension's own frame is still
+further down the same stack, and the suite covers all three.
+
+### What it costs, and where it is imprecise
+
+An allowed call costs one `Set` lookup. The host is compared against the union of every
+declared host first, and only a host that appears in none of them is attributed, because
+capturing a stack is the expensive part. The cost of that ordering is that an extension
+reaching a host *another* extension declared is not reported.
+
+Interception is `globalThis.fetch` plus `net.Socket.prototype.connect`. The socket is where
+`http.request`, `https.request`, `net.connect` and every client library end up, and — unlike
+replacing `net.connect` on the module object — it behaves the same whether the caller is ESM
+or CommonJS. An ES module's named import is a snapshot taken at link time, so rewriting the
+module object reaches CommonJS callers only, which would be the same control behaving
+differently in the two module systems.
+
+Each extension and host pair is reported once per process. An extension polling an undeclared
+host every second has one thing wrong with it, and the same interception seeing it at both
+`fetch` and the socket underneath is not two mistakes.
+
+## The boundary, and where each half is enforced
+
+A **Cloud Plugin** is a plugin Vendure Cloud supplies in place of one the customer would
+otherwise declare — `CloudAssetServerPlugin` for `AssetServerPlugin`, and the three ADR-0044
+lists as injected. The term is deliberately not "platform plugin", which reads as a plugin
+belonging to Vendure Platform.
+
+`PLATFORM_OWNED_FIELDS` is the single source for all four checks below, so they cannot
+disagree about which `VendureConfig` fields Vendure Cloud owns.
+
+| Check | Runs at | Catches |
+| --- | --- | --- |
+| The branded Cloud Config type | build | a config literal setting a platform-owned field |
+| `listPlatformOwnedFieldsSetIn` | boot | a config assembled programmatically, past the type |
+| `assertPlatformFieldsHold` | boot, after composition | a plugin that rewrote a platform-owned value after the Cloud Plugin ran |
+| `assertNoCustomerPluginWroteAPlatformField` | boot, after composition | ADR-0044's converse check — a customer plugin whose write a Cloud Plugin overwrote |
+
+Platform-owned keys stay *present* in the type carrying a brand that explains itself,
+rather than being removed with `Omit`. ADR-0043 requires the build-time error to carry a
+message we wrote, and an omitted key yields TypeScript's own wording instead. The brand's
+text is derived from `PLATFORM_OWNED_FIELDS`, so the compile-time and runtime messages are
+the same string.
+
+## Three things worth knowing before changing this package
+
+**A customer installs `@vendure/cloud` and imports from it, not from here.**
+[ADR-0045](../../internal/adr/0045-cloud-ships-as-ordinary-npm-packages-the-customer-pins.md)
+makes that package a facade whose exact-pinned dependencies are this package and the
+separately published plugin packages. What it re-exports today and what is still to join it
+is in [`packages/cloud/README.md`](../cloud/README.md).
+
+**This package is a peer dependency of every plugin package, and a direct dependency of
+nothing but the facade.** That is what stops a customer's tree holding two copies of it. Two
+copies mean `instanceof CloudConfigError` stops holding across the seam, and a boot failure a
+caller catches becomes an uncaught one — ADR-0045 argues the case, and the peer dependency is
+what turns it from a silent boot failure into an install-time resolution error naming both
+versions. Importing this package directly still works and is supported; it is what a plugin
+package does.
+
+**Nothing published is bundled or minified**, which is a decision rather than a property of
+how the build happens to be written. A bundler is the route back to a second copy of
+`@vendure/core`, and a minifier rewrites the class names that `CloudConfigError` and
+`pluginName` read at runtime to build the messages ADR-0044 requires. `tsc` can do neither,
+and `packages/cloud/test/published-output.test.ts` builds every publishable package and
+asserts it: one emitted file per source file, every dependency still a bare import, and every
+exported class still carrying its own name.
+
+Read ADR-0045's packaging decision only. Its delivery decision — that the customer pins these
+packages in their own lockfile and the platform reports a vulnerable version rather than
+replacing it — is superseded by
+[ADR-0046](../../internal/adr/0046-host-packages-are-dev-dependencies-and-the-runtime-supplies-production-copies.md).
+Customers declare these as development dependencies and the Cloud Runtime supplies the
+production copies, resolved from the `@vendure/core` version they declared.
+
+**It has to stay loadable from CommonJS, and that constrains the code.**
+[ADR-0049](../../internal/adr/0049-the-cloud-config-packages-are-consumable-from-commonjs.md):
+this package emits ESM and lists `require` alongside `import` in its `exports` map, pointing at
+the same file, so a customer whose application emits CommonJS can load it through Node's
+`require(esm)`. Vendure's own application template emits CommonJS, so that is most customers
+arriving from a self-hosted store.
+
+The standing cost is that **no top-level await may appear anywhere in this package's module
+graph**, ever. `require(esm)` refuses a graph containing one, at runtime in the customer's
+container, and nothing here would notice: every suite in this repository loads the package as
+ESM, where top-level await is legal. `test/managed-build.test.ts` builds and runs its fixture
+in both module systems, which is what catches it.
+
+**No runtime dependency on `@vendure/core`.** `@vendure/core` is a peer dependency and is
+imported for types only. The plugin metadata key core reads is restated as a constant and
+pinned to core's real value by a test, so a rename there fails our build rather than
+silently disabling attribution.
+
+## Runtime implementation
+
+CLO-355 supplies the platform-owned server, worker and migrate entrypoints, managed Postgres
+connection with rotating IAM credentials, structured logger, default cache/job queue/scheduler,
+shallow health check, one-copy core guard and local substitutes. The managed build typechecks the
+Cloud Config and installs the private implementation beside the single supplied copy of
+`@vendure/core`.
+
+The four wrapper plugins remain separate delivery work: CLO-399, CLO-400, CLO-401 and CLO-402.
+Extension migration globs are resolved into the managed database configuration at boot. The
+ownership snapshot on the Deployment row and the migration transaction, timeout and
+orphaned-schema controls remain CLO-423 and CLO-424.
+
+`apps/demo-store` is the reference Cloud Config: it contains only `vendure-config.ts`, with no
+customer-owned run-mode entrypoints.

package/dist/cloud-config.d.ts

@@ -0,0 +1,55 @@
+import type { VendureConfig } from "@vendure/core";
+import type { PlatformOwnedFieldPath, PlatformOwnedFieldSpec } from "./platform-fields.js";
+import type { CloudPluginEntry, VendurePluginEntry } from "./vendure-extension.js";
+declare const platformOwnedBrand: unique symbol;
+export type PlatformOwned<Explanation extends string> = {
+    readonly [platformOwnedBrand]: Explanation;
+};
+type ReasonFor<Path extends PlatformOwnedFieldPath> = Extract<PlatformOwnedFieldSpec, {
+    path: Path;
+}>["reason"];
+type ApiOptions = VendureConfig["apiOptions"];
+type AuthOptions = VendureConfig["authOptions"];
+type AssetOptions = NonNullable<VendureConfig["assetOptions"]>;
+type SystemOptions = NonNullable<VendureConfig["systemOptions"]>;
+type JobQueueOptions = NonNullable<VendureConfig["jobQueueOptions"]>;
+type SchedulerOptions = NonNullable<VendureConfig["schedulerOptions"]>;
+export type CloudApiOptions = Omit<ApiOptions, "port" | "hostname"> & {
+    port?: PlatformOwned<ReasonFor<"apiOptions.port">>;
+    hostname?: PlatformOwned<ReasonFor<"apiOptions.hostname">>;
+};
+export type CloudAuthOptions = Omit<AuthOptions, "superadminCredentials" | "sessionCacheStrategy" | "sessionCacheTTL"> & {
+    superadminCredentials?: PlatformOwned<ReasonFor<"authOptions.superadminCredentials">>;
+    sessionCacheStrategy?: PlatformOwned<ReasonFor<"authOptions.sessionCacheStrategy">>;
+    sessionCacheTTL?: PlatformOwned<ReasonFor<"authOptions.sessionCacheTTL">>;
+};
+export type CloudAssetOptions = Omit<AssetOptions, "assetStorageStrategy"> & {
+    assetStorageStrategy?: PlatformOwned<ReasonFor<"assetOptions.assetStorageStrategy">>;
+};
+export type CloudSystemOptions = Omit<SystemOptions, "cacheStrategy" | "healthChecks"> & {
+    cacheStrategy?: PlatformOwned<ReasonFor<"systemOptions.cacheStrategy">>;
+    healthChecks?: PlatformOwned<ReasonFor<"systemOptions.healthChecks">>;
+};
+export type CloudJobQueueOptions = Omit<JobQueueOptions, "jobQueueStrategy"> & {
+    jobQueueStrategy?: PlatformOwned<ReasonFor<"jobQueueOptions.jobQueueStrategy">>;
+};
+export type CloudSchedulerOptions = Omit<SchedulerOptions, "schedulerStrategy" | "runTasksInWorkerOnly"> & {
+    schedulerStrategy?: PlatformOwned<ReasonFor<"schedulerOptions.schedulerStrategy">>;
+    runTasksInWorkerOnly?: PlatformOwned<ReasonFor<"schedulerOptions.runTasksInWorkerOnly">>;
+};
+export type CloudConfig = Partial<Omit<VendureConfig, "plugins" | "dbConnectionOptions" | "logger" | "apiOptions" | "authOptions" | "assetOptions" | "systemOptions" | "jobQueueOptions" | "schedulerOptions">> & {
+    plugins?: CloudPluginEntry[];
+    dbConnectionOptions?: PlatformOwned<ReasonFor<"dbConnectionOptions">>;
+    logger?: PlatformOwned<ReasonFor<"logger">>;
+    apiOptions?: CloudApiOptions;
+    authOptions?: CloudAuthOptions;
+    assetOptions?: CloudAssetOptions;
+    systemOptions?: CloudSystemOptions;
+    jobQueueOptions?: CloudJobQueueOptions;
+    schedulerOptions?: CloudSchedulerOptions;
+};
+export type FlattenedCloudConfig = Omit<CloudConfig, "plugins"> & {
+    plugins: VendurePluginEntry[];
+};
+export {};
+//# sourceMappingURL=cloud-config.d.ts.map

package/dist/cloud-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,OAAO,CAAC,MAAM,kBAAkB,EAAE,OAAO,MAAM,CAAC;AAMhD,MAAM,MAAM,aAAa,CAAC,WAAW,SAAS,MAAM,IAAI;IACtD,QAAQ,CAAC,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC;CAC5C,CAAC;AAKF,KAAK,SAAS,CAAC,IAAI,SAAS,sBAAsB,IAAI,OAAO,CAC3D,sBAAsB,EACtB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CACf,CAAC,QAAQ,CAAC,CAAC;AAYZ,KAAK,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;AAC9C,KAAK,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;AAChD,KAAK,YAAY,GAAG,WAAW,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;AAC/D,KAAK,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;AACjE,KAAK,eAAe,GAAG,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACrE,KAAK,gBAAgB,GAAG,WAAW,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAKvE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;IACpE,IAAI,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,uBAAuB,GAAG,sBAAsB,GAAG,iBAAiB,CACrE,GAAG;IACF,qBAAqB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;IACtF,oBAAoB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC,CAAC;IACpF,eAAe,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC,CAAC;CAC3E,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,GAAG;IAC3E,oBAAoB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC;CACtF,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,cAAc,CAAC,GAAG;IACvF,aAAa,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC,CAAC;CACvE,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG;IAC7E,gBAAgB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC,CAAC;CACjF,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,gBAAgB,EAChB,mBAAmB,GAAG,sBAAsB,CAC7C,GAAG;IACF,iBAAiB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACnF,oBAAoB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC,CAAC;CAC1F,CAAC;AAOF,MAAM,MAAM,WAAW,GAAG,OAAO,CAC/B,IAAI,CACF,aAAa,EACX,SAAS,GACT,qBAAqB,GACrB,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,kBAAkB,CACrB,CACF,GAAG;IACF,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B,mBAAmB,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C,CAAC;AAMF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;IAChE,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B,CAAC"}

package/dist/cloud-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-config.js.map

package/dist/cloud-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":""}

package/dist/cloud-dashboard-plugin.d.ts

@@ -0,0 +1,28 @@
+import type { FlattenedCloudConfig, PlatformOwned } from "./cloud-config.js";
+import { CloudConfigError } from "./errors.js";
+import type { VendurePluginEntry } from "./vendure-extension.js";
+export declare const CLOUD_DASHBOARD_PLUGIN_KIND = "dashboard";
+export declare const DEFAULT_DASHBOARD_ROUTE = "dashboard";
+export declare const PLATFORM_SUPPLIED_DASHBOARD_OPTIONS: {
+    readonly appDir: "The Dashboard's files are produced by the managed build, and Vendure Cloud tells the plugin where they are. A path set here would not exist in the runtime image. Remove appDir.";
+    readonly viteDevServerPort: "The Vite dev server does not run in a Vendure Cloud process, so there is nothing to probe for and no request is proxied to it. Remove viteDevServerPort. It still applies when you run the same configuration locally.";
+};
+export interface CloudDashboardPluginOptions {
+    route?: string;
+    appDir?: PlatformOwned<(typeof PLATFORM_SUPPLIED_DASHBOARD_OPTIONS)["appDir"]>;
+    viteDevServerPort?: PlatformOwned<(typeof PLATFORM_SUPPLIED_DASHBOARD_OPTIONS)["viteDevServerPort"]>;
+}
+export interface CloudDashboardSettings {
+    route: string;
+}
+export declare class InvalidDashboardRouteError extends CloudConfigError {
+    readonly route: string;
+    constructor(route: string, reason: string);
+}
+export declare const CloudDashboardPlugin: {
+    new (): {};
+} & {
+    init(options?: CloudDashboardPluginOptions): VendurePluginEntry;
+};
+export declare function resolveDashboardSettings(config: FlattenedCloudConfig): CloudDashboardSettings;
+//# sourceMappingURL=cloud-dashboard-plugin.d.ts.map

package/dist/cloud-dashboard-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-dashboard-plugin.d.ts","sourceRoot":"","sources":["../src/cloud-dashboard-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAOjE,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAIvD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAMnD,eAAO,MAAM,mCAAmC;;;CAKtC,CAAC;AAEX,MAAM,WAAW,2BAA2B;IAG1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,OAAO,mCAAmC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,iBAAiB,CAAC,EAAE,aAAa,CAC/B,CAAC,OAAO,mCAAmC,CAAC,CAAC,mBAAmB,CAAC,CAClE,CAAC;CACH;AAID,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAeD,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1C;AAsBD,eAAO,MAAM,oBAAoB;;;mBAOf,2BAA2B,GAAQ,kBAAkB;CAUtE,CAAC;AAaF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,CAS7F"}

package/dist/cloud-dashboard-plugin.js

@@ -0,0 +1,91 @@
+import { declareCloudPlugin, listCloudPluginDeclarations } from "./cloud-plugin-declaration.js";
+import { CloudConfigError } from "./errors.js";
+// ADR-0044 rules `DashboardPlugin` platform-supplied and wrapped, with `route` the only option the
+// customer keeps. This is the wrapper's declaration side: what a customer writes in their
+// configuration file. The plugin that serves the Dashboard is built by the platform runtime, which
+// is the only place that knows where the managed build put the Dashboard's files.
+export const CLOUD_DASHBOARD_PLUGIN_KIND = "dashboard";
+// The same default the upstream plugin documents, so a customer moving an existing store onto
+// Vendure Cloud finds the Dashboard where they left it.
+export const DEFAULT_DASHBOARD_ROUTE = "dashboard";
+// The two options that leave the type, with the explanation each one's build-time error carries.
+// Written as literals rather than assembled, for the reason `platform-fields.ts` records: the
+// explanation is what TypeScript prints when the field is set, so it is the message and not a key
+// into one.
+export const PLATFORM_SUPPLIED_DASHBOARD_OPTIONS = {
+    appDir: "The Dashboard's files are produced by the managed build, and Vendure Cloud tells the plugin where they are. A path set here would not exist in the runtime image. Remove appDir.",
+    viteDevServerPort: "The Vite dev server does not run in a Vendure Cloud process, so there is nothing to probe for and no request is proxied to it. Remove viteDevServerPort. It still applies when you run the same configuration locally.",
+};
+const DEFAULT_DASHBOARD_SETTINGS = { route: DEFAULT_DASHBOARD_ROUTE };
+// The route is one path segment. Nest mounts the Dashboard's middleware at it, and the Dashboard's
+// own `index.html` carries it as a `<base>` tag, so a value with a slash in it produces a mount
+// path and a base tag that disagree and a Dashboard that loads nothing. Starting at a letter or a
+// digit rules out `.` and `..`, which resolve to somewhere else again.
+const ROUTE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~-]*$/;
+// Vendure's own defaults for the two API paths, restated because a Cloud Config that sets neither
+// still serves them there and this check runs before core has filled them in.
+const DEFAULT_ADMIN_API_PATH = "admin-api";
+const DEFAULT_SHOP_API_PATH = "shop-api";
+export class InvalidDashboardRouteError extends CloudConfigError {
+    route;
+    constructor(route, reason) {
+        super(`Vendure Cloud: the Dashboard cannot be served at "${route}".\n  ${reason}\n  Give CloudDashboardPlugin one path segment, such as { route: "${DEFAULT_DASHBOARD_ROUTE}" }.\n`);
+        this.route = route;
+    }
+}
+// Runs where the customer wrote the route, so the message arrives before anything is deployed.
+// Nothing in the type system can reach this: `route` is an ordinary string and the values it
+// rejects are ordinary strings too.
+function assertRouteShape(route) {
+    if (route.length === 0) {
+        throw new InvalidDashboardRouteError(route, "The route is empty.");
+    }
+    if (!ROUTE_PATTERN.test(route)) {
+        throw new InvalidDashboardRouteError(route, "A route is one path segment: letters, digits, and then any of . _ ~ - after the first character. Slashes, spaces and a leading dot are not part of one.");
+    }
+}
+// A class carrying the default declaration, with `init` on it. A customer who moves the Dashboard
+// writes `CloudDashboardPlugin.init({ route })`; one who wants the default route but wants the
+// Dashboard visible in their file can write a bare `CloudDashboardPlugin`. The second is
+// redundant, because the platform injects the default declaration when the customer writes
+// neither, and it is supported so that writing it is not read as a plugin nobody recognises.
+export const CloudDashboardPlugin = Object.assign(declareCloudPlugin("CloudDashboardPlugin", CLOUD_DASHBOARD_PLUGIN_KIND, DEFAULT_DASHBOARD_SETTINGS), {
+    init(options = {}) {
+        const route = options.route ?? DEFAULT_DASHBOARD_ROUTE;
+        assertRouteShape(route);
+        return declareCloudPlugin("CloudDashboardPlugin", CLOUD_DASHBOARD_PLUGIN_KIND, { route });
+    },
+});
+// ADR-0044's rule that a wrapped plugin the customer declared replaces the platform's injected
+// default rather than joining it: the customer's declaration when there is one, the default when
+// there is not, and never both.
+//
+// A configuration declaring it more than once takes the last, which is what the upstream plugin's
+// static options do and therefore what a customer who has met that plugin expects. ADR-0044 calls a
+// double declaration a documentation problem rather than something to defend against, so this
+// resolves it quietly rather than refusing the boot over it.
+//
+// It takes the whole configuration rather than the plugins array, because the route has to be
+// checked against the paths the customer's own API options claim.
+export function resolveDashboardSettings(config) {
+    const declarations = listCloudPluginDeclarations(config.plugins, CLOUD_DASHBOARD_PLUGIN_KIND);
+    const settings = declarations[declarations.length - 1] ?? { options: DEFAULT_DASHBOARD_SETTINGS };
+    assertRouteShape(settings.options.route);
+    assertRouteIsFree(settings.options.route, config);
+    return settings.options;
+}
+// A route matching an API path is served by whichever of the two Nest matches first, so the
+// customer loses one of them with nothing said. Checked here rather than in `init`, because it is
+// the only point at which the route and the API paths are both known.
+function assertRouteIsFree(route, config) {
+    const claimed = [
+        ["the Admin API", config.apiOptions?.adminApiPath ?? DEFAULT_ADMIN_API_PATH],
+        ["the Shop API", config.apiOptions?.shopApiPath ?? DEFAULT_SHOP_API_PATH],
+    ];
+    for (const [what, path] of claimed) {
+        if (path === route) {
+            throw new InvalidDashboardRouteError(route, `${what} is served at the same path. Move one of the two.`);
+        }
+    }
+}
+//# sourceMappingURL=cloud-dashboard-plugin.js.map

package/dist/cloud-dashboard-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-dashboard-plugin.js","sourceRoot":"","sources":["../src/cloud-dashboard-plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/C,mGAAmG;AACnG,0FAA0F;AAC1F,mGAAmG;AACnG,kFAAkF;AAElF,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AAEvD,8FAA8F;AAC9F,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,YAAY;AACZ,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,MAAM,EACJ,kLAAkL;IACpL,iBAAiB,EACf,wNAAwN;CAClN,CAAC;AAkBX,MAAM,0BAA0B,GAA2B,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;AAE9F,mGAAmG;AACnG,gGAAgG;AAChG,kGAAkG;AAClG,uEAAuE;AACvE,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,kGAAkG;AAClG,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAC3C,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IACrD,KAAK,CAAS;IAEvB,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CACH,qDAAqD,KAAK,SAAS,MAAM,qEAAqE,uBAAuB,QAAQ,CAC9K,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,+FAA+F;AAC/F,6FAA6F;AAC7F,oCAAoC;AACpC,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,0BAA0B,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAA0B,CAClC,KAAK,EACL,yJAAyJ,CAC1J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,+FAA+F;AAC/F,yFAAyF;AACzF,2FAA2F;AAC3F,6FAA6F;AAC7F,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAC/C,kBAAkB,CAChB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,CAC3B,EACD;IACE,IAAI,CAAC,UAAuC,EAAE;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACvD,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,kBAAkB,CACvB,sBAAsB,EACtB,2BAA2B,EAC3B,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;CACF,CACF,CAAC;AAEF,+FAA+F;AAC/F,iGAAiG;AACjG,gCAAgC;AAChC,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,8FAA8F;AAC9F,6DAA6D;AAC7D,EAAE;AACF,8FAA8F;AAC9F,kEAAkE;AAClE,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,MAAM,YAAY,GAAG,2BAA2B,CAC9C,MAAM,CAAC,OAAgC,EACvC,2BAA2B,CAC5B,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAClG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED,4FAA4F;AAC5F,kGAAkG;AAClG,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAA4B;IACpE,MAAM,OAAO,GAAuB;QAClC,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,IAAI,sBAAsB,CAAC;QAC5E,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,IAAI,qBAAqB,CAAC;KAC1E,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,0BAA0B,CAClC,KAAK,EACL,GAAG,IAAI,mDAAmD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cloud-plugin-declaration.d.ts

@@ -0,0 +1,12 @@
+import type { PluginLike } from "./plugin-attribution.js";
+export interface CloudPluginDeclaration<Options = unknown> {
+    readonly kind: string;
+    readonly options: Options;
+}
+export declare function declareCloudPlugin<Options>(name: string, kind: string, options: Options): {
+    new (): {};
+};
+export declare function readCloudPluginDeclaration(entry: unknown): CloudPluginDeclaration | undefined;
+export declare function isCloudPluginDeclaration(entry: unknown): boolean;
+export declare function listCloudPluginDeclarations<Options>(plugins: readonly PluginLike[], kind: string): CloudPluginDeclaration<Options>[];
+//# sourceMappingURL=cloud-plugin-declaration.d.ts.map

package/dist/cloud-plugin-declaration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-plugin-declaration.d.ts","sourceRoot":"","sources":["../src/cloud-plugin-declaration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAkB1D,MAAM,WAAW,sBAAsB,CAAC,OAAO,GAAG,OAAO;IAGvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAMD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;;EAWvF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAK7F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE;AAKD,wBAAgB,2BAA2B,CAAC,OAAO,EACjD,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,IAAI,EAAE,MAAM,GACX,sBAAsB,CAAC,OAAO,CAAC,EAAE,CASnC"}

package/dist/cloud-plugin-declaration.js

@@ -0,0 +1,53 @@
+// How a customer declares a wrapped platform plugin (ADR-0044, shape 2). What they write is not
+// the plugin that runs. The plugin that runs needs `@vendure/core` and the platform's own values,
+// and build tooling imports the configuration file where neither is available. So
+// `CloudDashboardPlugin.init({ route })` returns a marker carrying the options and nothing else,
+// and the platform runtime builds the plugin that implements it during composition.
+//
+// The marker is a class rather than a plain object so that it is an ordinary member of the plugins
+// array. It satisfies `VendurePluginEntry`, it reads as a plugin in the file, and the extension
+// flattening and the attribution wrapping walk past it without a special case. Composition removes
+// it before core sees it.
+//
+// Registered rather than a module-local symbol, for the reason the config handle's symbol is
+// (ADR-0043): a second copy of this package in the tree would otherwise produce markers the
+// composing copy does not recognise, and the customer's declared route would be silently ignored.
+const DECLARATION = Symbol.for("vendure-cloud.cloud-plugin-declaration");
+// The return type is inferred rather than written as `VendurePluginEntry`, so a caller can add a
+// static `init` to the result and still have an ordinary member of the plugins array.
+export function declareCloudPlugin(name, kind, options) {
+    // Named through a computed key because a class expression takes its name from the binding it is
+    // assigned to, and this one is returned rather than assigned. The name reaches boot messages and
+    // build logs, and `pluginName` reports a class without one as "an anonymous plugin".
+    const marker = { [name]: class {
+        } }[name];
+    const declaration = { kind, options };
+    // Non-enumerable, so the marker spreads and serialises as an ordinary empty class. A visible
+    // property would appear in anything that inspects the plugins array — a build log, a diagnostic
+    // dump — as configuration the customer did not write.
+    Object.defineProperty(marker, DECLARATION, { value: declaration });
+    return marker;
+}
+export function readCloudPluginDeclaration(entry) {
+    if (typeof entry !== "function" && (typeof entry !== "object" || entry === null)) {
+        return undefined;
+    }
+    return entry[DECLARATION];
+}
+export function isCloudPluginDeclaration(entry) {
+    return readCloudPluginDeclaration(entry) !== undefined;
+}
+// The declarations of one kind, in the order the customer wrote them. The platform runtime reads
+// these to build the plugins that implement them, and composition drops the markers from the array
+// it hands core.
+export function listCloudPluginDeclarations(plugins, kind) {
+    const declarations = [];
+    for (const plugin of plugins) {
+        const declaration = readCloudPluginDeclaration(plugin);
+        if (declaration?.kind === kind) {
+            declarations.push(declaration);
+        }
+    }
+    return declarations;
+}
+//# sourceMappingURL=cloud-plugin-declaration.js.map

package/dist/cloud-plugin-declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-plugin-declaration.js","sourceRoot":"","sources":["../src/cloud-plugin-declaration.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,kGAAkG;AAClG,kFAAkF;AAClF,iGAAiG;AACjG,oFAAoF;AACpF,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,0BAA0B;AAC1B,EAAE;AACF,6FAA6F;AAC7F,4FAA4F;AAC5F,kGAAkG;AAClG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AAWzE,iGAAiG;AACjG,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAU,IAAY,EAAE,IAAY,EAAE,OAAgB;IACtF,gGAAgG;IAChG,iGAAiG;IACjG,qFAAqF;IACrF,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE;SAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAoC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACvE,6FAA6F;IAC7F,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAQ,KAA2B,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,0BAA0B,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,mGAAmG;AACnG,iBAAiB;AACjB,MAAM,UAAU,2BAA2B,CACzC,OAA8B,EAC9B,IAAY;IAEZ,MAAM,YAAY,GAAsC,EAAE,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,WAAW,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC,WAA8C,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/composition.d.ts

@@ -0,0 +1,23 @@
+import type { VendureConfig, VendurePluginMetadata } from "@vendure/core";
+import { type CloudConfigHandle } from "./define-cloud-config.js";
+import { CloudConfigError } from "./errors.js";
+import { type PlatformOwnedField, type PlatformOwnedFieldPath } from "./platform-fields.js";
+import { type PluginLike } from "./plugin-attribution.js";
+export declare const CLOUD_PLUGIN_COMPATIBILITY = "^3.7.0";
+export type PlatformFieldValues = Partial<Record<PlatformOwnedFieldPath, unknown>>;
+export declare function platformDefaultFieldValues(sessionCacheStrategy: unknown): PlatformFieldValues;
+export interface ComposeCloudConfigOptions {
+    values: PlatformFieldValues;
+    cloudPlugins: readonly PluginLike[];
+    guardPluginName: string;
+    vendurePlugin: (metadata: VendurePluginMetadata) => ClassDecorator;
+}
+export declare function composeCloudConfig(handle: CloudConfigHandle, options: ComposeCloudConfigOptions): VendureConfig;
+export declare function hoistCloudPluginsLast(customerPlugins: readonly PluginLike[], cloudPlugins: readonly PluginLike[]): PluginLike[];
+export declare function applyPlatformFields(config: object, values: PlatformFieldValues): void;
+export declare class PlatformFieldOverwrittenError extends CloudConfigError {
+    readonly fields: readonly PlatformOwnedField[];
+    constructor(fields: readonly PlatformOwnedField[]);
+}
+export declare function assertPlatformFieldsHold(config: unknown, values: PlatformFieldValues): void;
+//# sourceMappingURL=composition.d.ts.map

package/dist/composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composition.d.ts","sourceRoot":"","sources":["../src/composition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EAAE,KAAK,iBAAiB,EAAmB,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,yBAAyB,CAAC;AAMjC,eAAO,MAAM,0BAA0B,WAAW,CAAC;AAKnD,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnF,wBAAgB,0BAA0B,CAAC,oBAAoB,EAAE,OAAO,GAAG,mBAAmB,CAS7F;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,CAAC,QAAQ,EAAE,qBAAqB,KAAK,cAAc,CAAC;CACpE;AAKD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,yBAAyB,GACjC,aAAa,CA8Cf;AAuBD,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,SAAS,UAAU,EAAE,EACtC,YAAY,EAAE,SAAS,UAAU,EAAE,GAClC,UAAU,EAAE,CAGd;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAMrF;AAQD,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;gBAEnC,MAAM,EAAE,SAAS,kBAAkB,EAAE;CASlD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAU3F"}