@vendure/cloud-config 0.0.0

package/dist/outbound-hosts.d.ts

@@ -0,0 +1,16 @@
+import type { VendureExtension } from "./vendure-extension.js";
+export interface UndeclaredHostReport {
+    readonly host: string;
+    readonly extensionId: string | undefined;
+    readonly declaredHosts: readonly string[];
+    readonly message: string;
+}
+export type UndeclaredHostReporter = (report: UndeclaredHostReport) => void;
+export interface OutboundHostCheckOptions {
+    readonly extensions: readonly VendureExtension[];
+    readonly report?: UndeclaredHostReporter;
+}
+type Uninstall = () => void;
+export declare function installOutboundHostCheck(options: OutboundHostCheckOptions): Uninstall;
+export {};
+//# sourceMappingURL=outbound-hosts.d.ts.map

package/dist/outbound-hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-hosts.d.ts","sourceRoot":"","sources":["../src/outbound-hosts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAa/D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAGjD,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAmKD,KAAK,SAAS,GAAG,MAAM,IAAI,CAAC;AAQ5B,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,GAAG,SAAS,CAwErF"}

package/dist/outbound-hosts.js

@@ -0,0 +1,211 @@
+import { createRequire } from "node:module";
+import { dirname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { stackFrameFiles } from "./stack.js";
+// A hostname as declared and as dialled, compared the way DNS does: case-insensitively, and
+// ignoring the trailing dot of a fully qualified name. Matching is exact — there is no
+// wildcard and no implied subdomain, because "declared api.acme.com" allowing
+// "evil.api.acme.com" would be a surprise in the direction that matters.
+function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, "");
+}
+// How far down the stack to look for an extension. A plugin calling out through a client
+// library sits under however many frames that library adds, and 30 covers the ones measured
+// here with room to spare; past that the call is left unattributed rather than searched for
+// indefinitely, because reading a deep stack is the expensive part of this check.
+const ATTRIBUTION_FRAME_LIMIT = 30;
+// This file's own directory, so its frames can be skipped when reading the stack.
+const selfDirectory = dirname(fileURLToPath(import.meta.url));
+// Which extension made the call, read from the stack. Same technique as
+// `defineVendureExtension`'s declaring-file trap and for the same reason: our own
+// `prepareStackTrace` is installed so that `--enable-source-maps` cannot rewrite the frames
+// back to `.ts` paths the image does not ship.
+function attribute(state, boundary) {
+    for (const path of stackFrameFiles(boundary, ATTRIBUTION_FRAME_LIMIT)) {
+        if (path === undefined || path.startsWith(selfDirectory))
+            continue;
+        const match = state.attributions.find((candidate) => path === candidate.directory || path.startsWith(candidate.directory + sep));
+        if (match)
+            return match.extension;
+    }
+    return undefined;
+}
+// The message ADR-0028 specifies, verbatim in shape:
+//
+//   Extension acme.erp attempted outbound access to api.other-erp.example.
+//   Declared outbound hosts: erp.acme.com
+function formatReport(host, extension) {
+    const declaredHosts = extension ? [...extension.outboundHosts] : [];
+    const subject = extension ? `Extension ${extension.id}` : "An extension";
+    const declared = declaredHosts.length > 0
+        ? `Declared outbound hosts: ${declaredHosts.join(", ")}`
+        : "It declares no outbound hosts.";
+    return {
+        host,
+        extensionId: extension?.id,
+        declaredHosts,
+        message: `Vendure Cloud: ${subject} attempted outbound access to ${host}.\n${declared}\n  This is reported, not blocked. Add the host to the extension's outboundHosts to silence it.`,
+    };
+}
+function check(state, rawHost) {
+    if (rawHost === undefined || rawHost === "")
+        return;
+    const host = normalizeHost(rawHost);
+    // The fast path, and the reason an allowed call costs one Set lookup rather than a captured
+    // stack. Its cost is that an extension reaching a host another extension declared is not
+    // reported. That is accepted: this is a hygiene control, and one acceptance criterion on
+    // CLO-412 is that an allowed call carries no measurable per-request cost. Attributing every
+    // call would mean capturing a stack on every request to satisfy a control that a single
+    // line of code can bypass anyway.
+    if (state.declaredAnywhere.has(host))
+        return;
+    const extension = attribute(state, check);
+    // Nothing on the stack belongs to an extension, so there is no declaration this call is
+    // measured against. Vendure core's own traffic, the database driver's, and a library called
+    // from platform code all land here, and reporting them would drown the signal.
+    if (extension === undefined)
+        return;
+    // The extension declared nothing, so it opted out of the check. CLO-412 records the
+    // reasoning: reading "declared nothing" as "may reach nothing" would report against every
+    // extension in existence today, and a report that fires on everything is not read.
+    if (extension.outboundHosts.length === 0)
+        return;
+    const seen = `${extension.id}\u0000${host}`;
+    if (state.reported.has(seen))
+        return;
+    state.reported.add(seen);
+    state.report(formatReport(host, extension));
+}
+function hostFromUrl(value) {
+    try {
+        return new URL(value).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+// `fetch` takes a string, a URL, or a Request. Reading `.url` off the third rather than
+// naming `Request`, because the DOM lib is not in this package's types and the shape is the
+// only part that matters.
+function hostFromFetchInput(input) {
+    if (typeof input === "string")
+        return hostFromUrl(input);
+    if (input instanceof URL)
+        return input.hostname;
+    if (typeof input === "object" && input !== null) {
+        const { url } = input;
+        if (typeof url === "string")
+            return hostFromUrl(url);
+    }
+    return undefined;
+}
+function hostFromRequestArguments(args, depth = 0) {
+    for (const argument of args) {
+        // `Socket.prototype.connect` is reached with Node's own normalised argument list, which is
+        // an array holding the options object and the callback, so the options are one level down
+        // rather than in the position a direct caller would put them.
+        //
+        // Bounded at the single level Node actually produces, because this runs on the caller's
+        // arguments before Node has validated them. Anything deeper is a caller passing something
+        // strange, and a self-referencing array would otherwise exhaust the stack inside a check
+        // whose whole job is to watch without getting in the way.
+        if (Array.isArray(argument)) {
+            if (depth >= 1)
+                continue;
+            const nested = hostFromRequestArguments(argument, depth + 1);
+            if (nested !== undefined)
+                return nested;
+            continue;
+        }
+        if (typeof argument === "string") {
+            const fromUrl = hostFromUrl(argument);
+            if (fromUrl !== undefined)
+                return fromUrl;
+            continue;
+        }
+        if (argument instanceof URL)
+            return argument.hostname;
+        if (typeof argument === "object" && argument !== null) {
+            const { hostname, host } = argument;
+            if (typeof hostname === "string")
+                return hostname;
+            // `host` may carry a port; the declaration is of hosts, so the port is dropped.
+            if (typeof host === "string")
+                return host.split(":")[0];
+        }
+    }
+    return undefined;
+}
+// Installed by the platform entrypoint, and by `vendure dev`, so the check behaves the same
+// in both. Returns the function that undoes it, which is what the tests use and what an
+// entrypoint would call on shutdown.
+//
+// Nothing is patched at all when no extension declares a host, so an application that has not
+// adopted the field pays nothing and cannot be affected by a bug in here.
+export function installOutboundHostCheck(options) {
+    const declaring = options.extensions.filter((extension) => extension.outboundHosts.length > 0);
+    if (declaring.length === 0)
+        return () => undefined;
+    const declaredAnywhere = new Set();
+    for (const extension of declaring) {
+        for (const host of extension.outboundHosts)
+            declaredAnywhere.add(normalizeHost(host));
+    }
+    const attributions = options.extensions
+        .flatMap((extension) => {
+        if (extension.declaredIn === undefined)
+            return [];
+        return [{ directory: dirname(extension.declaredIn), extension }];
+    })
+        .sort((left, right) => right.directory.length - left.directory.length);
+    const state = {
+        declaredAnywhere,
+        attributions,
+        report: options.report ?? ((report) => process.stderr.write(`${report.message}\n`)),
+        reported: new Set(),
+    };
+    const undo = [];
+    const originalFetch = globalThis.fetch;
+    if (typeof originalFetch === "function") {
+        globalThis.fetch = function patchedFetch(input, init) {
+            check(state, hostFromFetchInput(input));
+            return originalFetch.call(this, input, init);
+        };
+        undo.push(() => {
+            globalThis.fetch = originalFetch;
+        });
+    }
+    // Everything that is not `fetch` is caught one level lower, at the socket, because that is
+    // the only interception point that behaves the same under both module systems — which is an
+    // acceptance criterion on CLO-412 rather than a preference.
+    //
+    // Replacing `net.connect` and `http.request` on the module object does not work. An ES
+    // module's named import is a snapshot of the binding taken when the module was linked, so
+    // `import { connect } from "node:net"` keeps calling the original however the module object
+    // is rewritten afterwards, while a CommonJS caller doing `require("node:net").connect` sees
+    // the replacement. That is the same control behaving differently in the two module systems,
+    // and it silently covers only half of them.
+    //
+    // `net.Socket.prototype.connect` has no such split. `net.connect`, `net.createConnection`,
+    // `http.request`, `https.request` and the global `fetch` all end at a Socket, and the method
+    // is looked up on the prototype at call time whoever reached it.
+    const require = createRequire(import.meta.url);
+    const net = require("node:net");
+    const socketPrototype = net.Socket.prototype;
+    const originalConnect = socketPrototype.connect;
+    if (typeof originalConnect === "function") {
+        socketPrototype.connect = function patchedConnect(...args) {
+            check(state, hostFromRequestArguments(args));
+            return originalConnect.apply(this, args);
+        };
+        undo.push(() => {
+            socketPrototype.connect = originalConnect;
+        });
+    }
+    return () => {
+        for (const step of undo)
+            step();
+        undo.length = 0;
+    };
+}
+//# sourceMappingURL=outbound-hosts.js.map

package/dist/outbound-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-hosts.js","sourceRoot":"","sources":["../src/outbound-hosts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA+B7C,4FAA4F;AAC5F,uFAAuF;AACvF,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAuBD,yFAAyF;AACzF,4FAA4F;AAC5F,4FAA4F;AAC5F,kFAAkF;AAClF,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,kFAAkF;AAClF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D,wEAAwE;AACxE,kFAAkF;AAClF,4FAA4F;AAC5F,+CAA+C;AAC/C,SAAS,SAAS,CAChB,KAAgB,EAChB,QAAuC;IAEvC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,GAAG,GAAG,CAAC,CAC1F,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,EAAE;AACF,2EAA2E;AAC3E,0CAA0C;AAC1C,SAAS,YAAY,CAAC,IAAY,EAAE,SAAuC;IACzE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACzE,MAAM,QAAQ,GACZ,aAAa,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxD,CAAC,CAAC,gCAAgC,CAAC;IACvC,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,SAAS,EAAE,EAAE;QAC1B,aAAa;QACb,OAAO,EAAE,kBAAkB,OAAO,iCAAiC,IAAI,MAAM,QAAQ,iGAAiG;KACvL,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAgB,EAAE,OAA2B;IAC1D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,4FAA4F;IAC5F,yFAAyF;IACzF,yFAAyF;IACzF,4FAA4F;IAC5F,wFAAwF;IACxF,kCAAkC;IAClC,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAE7C,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,wFAAwF;IACxF,4FAA4F;IAC5F,+EAA+E;IAC/E,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,oFAAoF;IACpF,0FAA0F;IAC1F,mFAAmF;IACnF,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjD,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACrC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEzB,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,4FAA4F;AAC5F,0BAA0B;AAC1B,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,KAA0B,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,SAAS,wBAAwB,CAAC,IAAwB,EAAE,KAAK,GAAG,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,2FAA2F;QAC3F,0FAA0F;QAC1F,8DAA8D;QAC9D,EAAE;QACF,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,0DAA0D;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,KAAK,IAAI,CAAC;gBAAE,SAAS;YACzB,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;YACxC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,YAAY,GAAG;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;QACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,QAA8B,CAAC;YAC1D,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAClD,gFAAgF;YAChF,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,4FAA4F;AAC5F,wFAAwF;AACxF,qCAAqC;AACrC,EAAE;AACF,8FAA8F;AAC9F,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,OAAiC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAEnD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,aAAa;YAAE,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,YAAY,GAAkB,OAAO,CAAC,UAAU;SACnD,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;QACrB,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAc;QACvB,gBAAgB;QAChB,YAAY;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACnF,QAAQ,EAAE,IAAI,GAAG,EAAE;KACpB,CAAC;IAEF,MAAM,IAAI,GAAgB,EAAE,CAAC;IAE7B,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IACvC,IAAI,OAAO,aAAa,KAAK,UAAU,EAAE,CAAC;QACxC,UAAU,CAAC,KAAK,GAAG,SAAS,YAAY,CAEtC,KAAkC,EAClC,IAAkC;YAElC,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAiB,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,4FAA4F;IAC5F,4DAA4D;IAC5D,EAAE;IACF,uFAAuF;IACvF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,4FAA4F;IAC5F,4CAA4C;IAC5C,EAAE;IACF,2FAA2F;IAC3F,6FAA6F;IAC7F,iEAAiE;IACjE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAuD,CAAC;IACtF,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;IAC7C,MAAM,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC;IAChD,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;QAC1C,eAAe,CAAC,OAAO,GAAG,SAAS,cAAc,CAAgB,GAAG,IAAe;YACjF,KAAK,CAAC,KAAK,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,OAAQ,eAAgD,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACb,eAAe,CAAC,OAAO,GAAG,eAAe,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/path.d.ts

@@ -0,0 +1,2 @@
+export declare function readPath(source: unknown, path: string): unknown;
+//# sourceMappingURL=path.d.ts.map

package/dist/path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAQA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAO/D"}

package/dist/path.js

@@ -0,0 +1,18 @@
+// Walks a dot-separated path over an unknown value, returning undefined at anything that is
+// not a traversable object rather than throwing.
+//
+// Every check over the platform-owned fields reads through this one function — the runtime
+// backstop, the forward assertion and the attribution diff. They must agree on what "this
+// field is set" means: a second implementation that treated a null option object as a miss,
+// or that stopped at a prototype property, would let one check pass a config another
+// rejects, and the boot error would name a field the customer's file does not set.
+export function readPath(source, path) {
+    let current = source;
+    for (const segment of path.split(".")) {
+        if (typeof current !== "object" || current === null)
+            return undefined;
+        current = current[segment];
+    }
+    return current;
+}
+//# sourceMappingURL=path.js.map

package/dist/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,iDAAiD;AACjD,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,4FAA4F;AAC5F,qFAAqF;AACrF,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CAAC,MAAe,EAAE,IAAY;IACpD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/platform-fields.d.ts

@@ -0,0 +1,71 @@
+export interface PlatformOwnedField {
+    path: string;
+    reason: string;
+    writtenBy?: {
+        plugin: string;
+        replacement: string;
+    };
+}
+declare const FIELD_SPECS: readonly [{
+    readonly path: "dbConnectionOptions";
+    readonly reason: "The database connection is supplied by Vendure Cloud, including credential rotation. Remove dbConnectionOptions from your config.";
+}, {
+    readonly path: "logger";
+    readonly reason: "Logging is supplied by Vendure Cloud so output reaches the platform log pipeline from the server, the worker and migrations alike. To forward logs elsewhere, use a log drain rather than replacing the logger.";
+}, {
+    readonly path: "apiOptions.port";
+    readonly reason: "The port is supplied by Vendure Cloud and must match what the load balancer routes to. Remove apiOptions.port.";
+}, {
+    readonly path: "apiOptions.hostname";
+    readonly reason: "The hostname is supplied by Vendure Cloud. Remove apiOptions.hostname.";
+}, {
+    readonly path: "authOptions.superadminCredentials";
+    readonly reason: "Vendure Cloud generates the superadmin credential for each environment and surfaces it once. Remove authOptions.superadminCredentials.";
+}, {
+    readonly path: "authOptions.sessionCacheStrategy";
+    readonly reason: "The session cache is backed by platform-managed infrastructure. Remove authOptions.sessionCacheStrategy.";
+}, {
+    readonly path: "authOptions.sessionCacheTTL";
+    readonly reason: "The session cache TTL is the dominant lever on platform cache cost, so it is a platform decision. Remove authOptions.sessionCacheTTL.";
+}, {
+    readonly path: "systemOptions.cacheStrategy";
+    readonly reason: "The cache is supplied by Vendure Cloud. Remove systemOptions.cacheStrategy, and remove RedisCachePlugin from your plugins array.";
+    readonly writtenBy: {
+        readonly plugin: "RedisCachePlugin";
+        readonly replacement: "the platform cache strategy, which is injected automatically";
+    };
+}, {
+    readonly path: "systemOptions.healthChecks";
+    readonly reason: "The health check is shallow by design: it must not touch the database, because a target group that marks every server unhealthy during a database blip causes ECS to replace all of them at once. Remove systemOptions.healthChecks.";
+}, {
+    readonly path: "assetOptions.assetStorageStrategy";
+    readonly reason: "Asset storage is supplied by Vendure Cloud. Remove assetOptions.assetStorageStrategy, and use CloudAssetServerPlugin in place of AssetServerPlugin.";
+    readonly writtenBy: {
+        readonly plugin: "AssetServerPlugin";
+        readonly replacement: "CloudAssetServerPlugin";
+    };
+}, {
+    readonly path: "jobQueueOptions.jobQueueStrategy";
+    readonly reason: "The job queue is supplied by Vendure Cloud. Remove jobQueueOptions.jobQueueStrategy, and remove BullMQJobQueuePlugin from your plugins array.";
+    readonly writtenBy: {
+        readonly plugin: "BullMQJobQueuePlugin";
+        readonly replacement: "the platform job queue strategy, which is injected automatically";
+    };
+}, {
+    readonly path: "schedulerOptions.schedulerStrategy";
+    readonly reason: "Scheduled tasks are driven by Vendure Cloud, because a worker scaled to zero runs none. Remove schedulerOptions.schedulerStrategy, and remove DefaultSchedulerPlugin from your plugins array.";
+    readonly writtenBy: {
+        readonly plugin: "DefaultSchedulerPlugin";
+        readonly replacement: "the platform scheduler strategy, which is injected automatically";
+    };
+}, {
+    readonly path: "schedulerOptions.runTasksInWorkerOnly";
+    readonly reason: "Vendure Cloud pins runTasksInWorkerOnly to false so the server ticks when the worker is asleep. Remove schedulerOptions.runTasksInWorkerOnly.";
+}];
+export declare const PLATFORM_OWNED_FIELDS: readonly PlatformOwnedField[];
+export type PlatformOwnedFieldSpec = (typeof FIELD_SPECS)[number];
+export type PlatformOwnedFieldPath = PlatformOwnedFieldSpec["path"];
+export declare function findPlatformOwnedField(path: string): PlatformOwnedField | undefined;
+export declare function formatPlatformFieldDetail(fields: readonly PlatformOwnedField[]): string;
+export {};
+//# sourceMappingURL=platform-fields.d.ts.map

package/dist/platform-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-fields.d.ts","sourceRoot":"","sources":["../src/platform-fields.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,kBAAkB;IAGjC,IAAI,EAAE,MAAM,CAAC;IAIb,MAAM,EAAE,MAAM,CAAC;IAIf,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAMD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiFiC,CAAC;AAEnD,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EAAgB,CAAC;AAEhF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAEpE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEnF;AAKD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAEvF"}

package/dist/platform-fields.js

@@ -0,0 +1,94 @@
+// The canonical list of VendureConfig fields the platform owns, from ADR-0017's
+// "Platform-owned" category plus the two additions ADR-0023 assigned to it and the
+// `healthChecks` forcing CLO-355 delivers.
+//
+// This list is the single source for four things that must never disagree: the Cloud Config
+// type's branded keys, the runtime backstop, the post-composition assertion, and ADR-0044's
+// converse check. A field added to the type but not to this list is rejected at build time
+// and accepted at boot, so a config assembled at runtime would set it and no check would
+// object.
+// Literal-typed on purpose: cloud-config.ts derives each branded field's explanation from
+// these exact strings, so the build-time message and the runtime message cannot drift.
+// The cost is that an entry without `writtenBy` genuinely lacks the property, so runtime
+// callers iterate PLATFORM_OWNED_FIELDS below rather than this.
+const FIELD_SPECS = [
+    {
+        path: "dbConnectionOptions",
+        reason: "The database connection is supplied by Vendure Cloud, including credential rotation. Remove dbConnectionOptions from your config.",
+    },
+    {
+        path: "logger",
+        reason: "Logging is supplied by Vendure Cloud so output reaches the platform log pipeline from the server, the worker and migrations alike. To forward logs elsewhere, use a log drain rather than replacing the logger.",
+    },
+    {
+        path: "apiOptions.port",
+        reason: "The port is supplied by Vendure Cloud and must match what the load balancer routes to. Remove apiOptions.port.",
+    },
+    {
+        path: "apiOptions.hostname",
+        reason: "The hostname is supplied by Vendure Cloud. Remove apiOptions.hostname.",
+    },
+    {
+        path: "authOptions.superadminCredentials",
+        reason: "Vendure Cloud generates the superadmin credential for each environment and surfaces it once. Remove authOptions.superadminCredentials.",
+    },
+    {
+        path: "authOptions.sessionCacheStrategy",
+        reason: "The session cache is backed by platform-managed infrastructure. Remove authOptions.sessionCacheStrategy.",
+    },
+    {
+        path: "authOptions.sessionCacheTTL",
+        reason: "The session cache TTL is the dominant lever on platform cache cost, so it is a platform decision. Remove authOptions.sessionCacheTTL.",
+    },
+    {
+        path: "systemOptions.cacheStrategy",
+        reason: "The cache is supplied by Vendure Cloud. Remove systemOptions.cacheStrategy, and remove RedisCachePlugin from your plugins array.",
+        writtenBy: {
+            plugin: "RedisCachePlugin",
+            replacement: "the platform cache strategy, which is injected automatically",
+        },
+    },
+    {
+        path: "systemOptions.healthChecks",
+        reason: "The health check is shallow by design: it must not touch the database, because a target group that marks every server unhealthy during a database blip causes ECS to replace all of them at once. Remove systemOptions.healthChecks.",
+    },
+    {
+        path: "assetOptions.assetStorageStrategy",
+        reason: "Asset storage is supplied by Vendure Cloud. Remove assetOptions.assetStorageStrategy, and use CloudAssetServerPlugin in place of AssetServerPlugin.",
+        writtenBy: {
+            plugin: "AssetServerPlugin",
+            replacement: "CloudAssetServerPlugin",
+        },
+    },
+    {
+        path: "jobQueueOptions.jobQueueStrategy",
+        reason: "The job queue is supplied by Vendure Cloud. Remove jobQueueOptions.jobQueueStrategy, and remove BullMQJobQueuePlugin from your plugins array.",
+        writtenBy: {
+            plugin: "BullMQJobQueuePlugin",
+            replacement: "the platform job queue strategy, which is injected automatically",
+        },
+    },
+    {
+        path: "schedulerOptions.schedulerStrategy",
+        reason: "Scheduled tasks are driven by Vendure Cloud, because a worker scaled to zero runs none. Remove schedulerOptions.schedulerStrategy, and remove DefaultSchedulerPlugin from your plugins array.",
+        writtenBy: {
+            plugin: "DefaultSchedulerPlugin",
+            replacement: "the platform scheduler strategy, which is injected automatically",
+        },
+    },
+    {
+        path: "schedulerOptions.runTasksInWorkerOnly",
+        reason: "Vendure Cloud pins runTasksInWorkerOnly to false so the server ticks when the worker is asleep. Remove schedulerOptions.runTasksInWorkerOnly.",
+    },
+];
+export const PLATFORM_OWNED_FIELDS = FIELD_SPECS;
+export function findPlatformOwnedField(path) {
+    return PLATFORM_OWNED_FIELDS.find((field) => field.path === path);
+}
+// The shared body of the two boot-time failures. Both name the offending fields the same
+// way, and a customer meeting them one at a time during a migration should not find the
+// two laid out differently.
+export function formatPlatformFieldDetail(fields) {
+    return fields.map((field) => `  ${field.path}\n    ${field.reason}`).join("\n\n");
+}
+//# sourceMappingURL=platform-fields.js.map

package/dist/platform-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-fields.js","sourceRoot":"","sources":["../src/platform-fields.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,2CAA2C;AAC3C,EAAE;AACF,4FAA4F;AAC5F,4FAA4F;AAC5F,2FAA2F;AAC3F,yFAAyF;AACzF,UAAU;AAgBV,0FAA0F;AAC1F,uFAAuF;AACvF,yFAAyF;AACzF,gEAAgE;AAChE,MAAM,WAAW,GAAG;IAClB;QACE,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EACJ,mIAAmI;KACtI;IACD;QACE,IAAI,EAAE,QAAQ;QACd,MAAM,EACJ,iNAAiN;KACpN;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,MAAM,EACJ,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,wEAAwE;KACjF;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,MAAM,EACJ,wIAAwI;KAC3I;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,MAAM,EACJ,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,MAAM,EACJ,uIAAuI;KAC1I;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,MAAM,EACJ,kIAAkI;QACpI,SAAS,EAAE;YACT,MAAM,EAAE,kBAAkB;YAC1B,WAAW,EAAE,8DAA8D;SAC5E;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,MAAM,EACJ,sOAAsO;KACzO;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,MAAM,EACJ,qJAAqJ;QACvJ,SAAS,EAAE;YACT,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EAAE,wBAAwB;SACtC;KACF;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,MAAM,EACJ,+IAA+I;QACjJ,SAAS,EAAE;YACT,MAAM,EAAE,sBAAsB;YAC9B,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EACJ,+LAA+L;QACjM,SAAS,EAAE;YACT,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD;QACE,IAAI,EAAE,uCAAuC;QAC7C,MAAM,EACJ,+IAA+I;KAClJ;CAC+C,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAkC,WAAW,CAAC;AAKhF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,yFAAyF;AACzF,wFAAwF;AACxF,4BAA4B;AAC5B,MAAM,UAAU,yBAAyB,CAAC,MAAqC;IAC7E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC"}

package/dist/plugin-attribution.d.ts

@@ -0,0 +1,27 @@
+import "reflect-metadata";
+import { CloudConfigError } from "./errors.js";
+import { type PlatformOwnedField } from "./platform-fields.js";
+export declare const PLUGIN_CONFIGURATION_METADATA_KEY = "configuration";
+export type PluginConstructor = abstract new (...args: never[]) => unknown;
+export type PluginLike = PluginConstructor | {
+    readonly module: PluginConstructor;
+};
+export interface PlatformFieldWrite {
+    plugin: string;
+    field: PlatformOwnedField;
+    extension?: string;
+}
+export type ExtensionOfPlugin = ReadonlyMap<PluginLike, {
+    readonly id: string;
+}>;
+export declare function pluginName(plugin: PluginLike): string;
+export interface PendingPlatformFieldWrites {
+    readonly writes: readonly PlatformFieldWrite[];
+}
+export declare function recordPlatformFieldWrites(plugins: readonly PluginLike[], extensionOf?: ExtensionOfPlugin): PendingPlatformFieldWrites;
+export declare class PlatformFieldSetByPluginError extends CloudConfigError {
+    readonly writes: readonly PlatformFieldWrite[];
+    constructor(writes: readonly PlatformFieldWrite[]);
+}
+export declare function assertNoCustomerPluginWroteAPlatformField(writes: readonly PlatformFieldWrite[], cloudPluginNames: readonly string[]): void;
+//# sourceMappingURL=plugin-attribution.d.ts.map

package/dist/plugin-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-attribution.d.ts","sourceRoot":"","sources":["../src/plugin-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAWtF,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAIjE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC;AAC3E,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEpF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAI1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,UAAU,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AASjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAIrD;AAsBD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAChD;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,WAAW,GAAE,iBAA6B,GACzC,0BAA0B,CA0C5B;AAYD,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;gBAEnC,MAAM,EAAE,SAAS,kBAAkB,EAAE;CAiBlD;AAED,wBAAgB,yCAAyC,CACvD,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,IAAI,CAKN"}

package/dist/plugin-attribution.js

@@ -0,0 +1,97 @@
+import "reflect-metadata";
+import { CloudConfigError } from "./errors.js";
+import { readPath } from "./path.js";
+import { PLATFORM_OWNED_FIELDS } from "./platform-fields.js";
+// Core reads a plugin's configuration function out of this metadata key
+// (`PLUGIN_METADATA.CONFIGURATION` in @vendure/core). It is restated rather than imported so
+// this package needs no runtime dependency on core. That keeps it a thin interface package,
+// and it means the package cannot itself load a second copy of `@vendure/core` — the failure
+// ADR-0043 measured, where the application's `Logger` and the platform's are different
+// classes and every log line goes to the one nobody reads.
+//
+// A test pins this string to core's real value, so a rename there fails our build rather
+// than silently disabling attribution.
+export const PLUGIN_CONFIGURATION_METADATA_KEY = "configuration";
+function metadataTarget(plugin) {
+    if (typeof plugin === "object" && plugin !== null && "module" in plugin) {
+        return plugin.module;
+    }
+    return plugin;
+}
+export function pluginName(plugin) {
+    const target = metadataTarget(plugin);
+    const named = target.name;
+    return typeof named === "string" && named.length > 0 ? named : "an anonymous plugin";
+}
+function snapshotPlatformFields(config) {
+    return new Map(PLATFORM_OWNED_FIELDS.map((field) => [field.path, readPath(config, field.path)]));
+}
+export function recordPlatformFieldWrites(plugins, extensionOf = new Map()) {
+    const writes = [];
+    // Guards against wrapping one configuration function twice. A plugins array holding the
+    // same reference twice, or a class and a DynamicModule around that same class, resolves to
+    // one metadata target: without this, the second pass reads the first wrapper back as the
+    // "original" and wraps it again, so every execution of that plugin records its writes twice
+    // and the boot message reports writes the plugin did not make.
+    const wrappedTargets = new WeakSet();
+    for (const plugin of plugins) {
+        const target = metadataTarget(plugin);
+        if (wrappedTargets.has(target))
+            continue;
+        const original = Reflect.getMetadata(PLUGIN_CONFIGURATION_METADATA_KEY, target);
+        if (typeof original !== "function")
+            continue;
+        const name = pluginName(plugin);
+        // The extension is read at the array entry that gets wrapped. For a plugin appearing
+        // more than once, that is the first entry: core keeps the configuration function on the
+        // class, so one wrapper covers every execution and there is no finer attribution to be
+        // had.
+        const extension = extensionOf.get(plugin)?.id;
+        const configure = original;
+        const wrapped = async (config) => {
+            const before = snapshotPlatformFields(config);
+            const result = await configure(config);
+            const after = snapshotPlatformFields(result ?? config);
+            for (const field of PLATFORM_OWNED_FIELDS) {
+                if (!Object.is(before.get(field.path), after.get(field.path))) {
+                    writes.push({ plugin: name, field, extension });
+                }
+            }
+            return result;
+        };
+        Reflect.defineMetadata(PLUGIN_CONFIGURATION_METADATA_KEY, wrapped, target);
+        wrappedTargets.add(target);
+    }
+    return { writes };
+}
+// ADR-0044's converse check. Cloud Plugins run last, so a customer plugin that wrote a
+// platform-owned field has already had its value overwritten. The customer set something,
+// saw no error, and is running with a different value than they wrote.
+//
+// The message names the plugin and the Cloud Plugin that replaces it, and the Vendure
+// Extension the plugin came from where one declared it. Naming only the offending plugin
+// leaves the customer knowing a line is wrong and not what to write instead, which turns a
+// one-line edit into a support ticket. The extension is named for the same reason: a plugin
+// declared inside one is not written in the config file at all, so its class name does not
+// say which line to look at.
+export class PlatformFieldSetByPluginError extends CloudConfigError {
+    writes;
+    constructor(writes) {
+        const detail = writes
+            .map(({ plugin, field, extension }) => {
+            const replacement = field.writtenBy?.replacement ?? "the platform equivalent, which is supplied for you";
+            const offender = extension === undefined ? plugin : `${plugin}, in the Vendure Extension "${extension}",`;
+            return `  ${offender} set ${field.path}, which Vendure Cloud supplies.\n    Use ${replacement}.`;
+        })
+            .join("\n\n");
+        super(`Vendure Cloud: ${writes.length} plugin write${writes.length === 1 ? "" : "s"} to platform-owned configuration would be discarded. Refusing to boot.\n\n${detail}\n`);
+        this.writes = writes;
+    }
+}
+export function assertNoCustomerPluginWroteAPlatformField(writes, cloudPluginNames) {
+    const offending = writes.filter((write) => !cloudPluginNames.includes(write.plugin));
+    if (offending.length > 0) {
+        throw new PlatformFieldSetByPluginError(offending);
+    }
+}
+//# sourceMappingURL=plugin-attribution.js.map

package/dist/plugin-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-attribution.js","sourceRoot":"","sources":["../src/plugin-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAA2B,MAAM,sBAAsB,CAAC;AAEtF,wEAAwE;AACxE,6FAA6F;AAC7F,4FAA4F;AAC5F,6FAA6F;AAC7F,uFAAuF;AACvF,2DAA2D;AAC3D,EAAE;AACF,yFAAyF;AACzF,uCAAuC;AACvC,MAAM,CAAC,MAAM,iCAAiC,GAAG,eAAe,CAAC;AAoBjE,SAAS,cAAc,CAAC,MAAkB;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,MAA6B,CAAC,IAAI,CAAC;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC;AACvF,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,OAAO,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAsBD,MAAM,UAAU,yBAAyB,CACvC,OAA8B,EAC9B,cAAiC,IAAI,GAAG,EAAE;IAE1C,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,wFAAwF;IACxF,2FAA2F;IAC3F,yFAAyF;IACzF,4FAA4F;IAC5F,+DAA+D;IAC/D,MAAM,cAAc,GAAG,IAAI,OAAO,EAAU,CAAC;IAE7C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAEzC,MAAM,QAAQ,GAAY,OAAO,CAAC,WAAW,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;QACzF,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,SAAS;QAE7C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,qFAAqF;QACrF,wFAAwF;QACxF,uFAAuF;QACvF,OAAO;QACP,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAwC,CAAC;QAE3D,MAAM,OAAO,GAAG,KAAK,EAAE,MAAe,EAAoB,EAAE;YAC1D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;YAEvD,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,iCAAiC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3E,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED,uFAAuF;AACvF,0FAA0F;AAC1F,uEAAuE;AACvE,EAAE;AACF,sFAAsF;AACtF,yFAAyF;AACzF,2FAA2F;AAC3F,4FAA4F;AAC5F,2FAA2F;AAC3F,6BAA6B;AAC7B,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACxD,MAAM,CAAgC;IAE/C,YAAY,MAAqC;QAC/C,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;YACpC,MAAM,WAAW,GACf,KAAK,CAAC,SAAS,EAAE,WAAW,IAAI,oDAAoD,CAAC;YACvF,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,+BAA+B,SAAS,IAAI,CAAC;YAC3F,OAAO,KAAK,QAAQ,QAAQ,KAAK,CAAC,IAAI,4CAA4C,WAAW,GAAG,CAAC;QACnG,CAAC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,KAAK,CACH,kBAAkB,MAAM,CAAC,MAAM,gBAC7B,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC7B,6EAA6E,MAAM,IAAI,CACxF,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,yCAAyC,CACvD,MAAqC,EACrC,gBAAmC;IAEnC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/runtime-backstop.d.ts

@@ -0,0 +1,8 @@
+import { CloudConfigError } from "./errors.js";
+import { type PlatformOwnedField } from "./platform-fields.js";
+export declare function listPlatformOwnedFieldsSetIn(config: unknown): PlatformOwnedField[];
+export declare class PlatformFieldSetByConfigError extends CloudConfigError {
+    readonly fields: readonly PlatformOwnedField[];
+    constructor(fields: readonly PlatformOwnedField[]);
+}
+//# sourceMappingURL=runtime-backstop.d.ts.map

package/dist/runtime-backstop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-backstop.d.ts","sourceRoot":"","sources":["../src/runtime-backstop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAQ9B,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,EAAE,CAElF;AAED,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;gBAEnC,MAAM,EAAE,SAAS,kBAAkB,EAAE;CASlD"}

package/dist/runtime-backstop.js

@@ -0,0 +1,20 @@
+import { CloudConfigError } from "./errors.js";
+import { readPath } from "./path.js";
+import { PLATFORM_OWNED_FIELDS, formatPlatformFieldDetail, } from "./platform-fields.js";
+// The build-time guarantee holds for a config written as an object literal and is absent
+// for one assembled programmatically, which no type can reach. ADR-0043 requires this
+// check so that second case fails loudly at boot rather than silently at runtime.
+// A key present but undefined is not a violation: that is what spreading an optional
+// object produces, and the customer expressed no intent. Only a set value counts.
+export function listPlatformOwnedFieldsSetIn(config) {
+    return PLATFORM_OWNED_FIELDS.filter((field) => readPath(config, field.path) !== undefined);
+}
+export class PlatformFieldSetByConfigError extends CloudConfigError {
+    fields;
+    constructor(fields) {
+        const detail = formatPlatformFieldDetail(fields);
+        super(`Vendure Cloud: this configuration sets ${fields.length} field${fields.length === 1 ? "" : "s"} that the platform supplies.\n\n${detail}\n`);
+        this.fields = fields;
+    }
+}
+//# sourceMappingURL=runtime-backstop.js.map

package/dist/runtime-backstop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-backstop.js","sourceRoot":"","sources":["../src/runtime-backstop.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAE9B,yFAAyF;AACzF,sFAAsF;AACtF,kFAAkF;AAElF,qFAAqF;AACrF,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IACxD,MAAM,CAAgC;IAE/C,YAAY,MAAqC;QAC/C,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,CACH,0CAA0C,MAAM,CAAC,MAAM,SACrD,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC7B,mCAAmC,MAAM,IAAI,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}