@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/idp-profile.js

@@ -0,0 +1,268 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The profile fields an identity provider sent, from wherever it put them
+ * (AGL-1131).
+ *
+ * AGL-1131 assumed mapping attributes in Google Workspace would be enough,
+ * because "GCIP surfaces mapped SAML attributes on the token" and the JIT
+ * path already reads `decoded['name']`. Measured after the mapping was
+ * added: the tenant auth record still had `displayName: null`, on both the
+ * account and its `saml.aglyn-workspace` provider entry, on a sign-in that
+ * definitely happened.
+ *
+ * The reason is that a SAML assertion's attributes arrive under
+ * `firebase.sign_in_attributes`, NOT as a top-level `name` claim. Nothing in
+ * the codebase read that, so mapping attributes correctly still produced
+ * nothing. OIDC providers do populate `name`, which is why the existing code
+ * looked right.
+ *
+ * Deliberately generous about attribute naming, because the name is chosen
+ * by the CUSTOMER's IdP admin, not by us. Workspace suggests `firstName`,
+ * ADFS emits the full schema URIs, Okta commonly uses `given_name`. Guessing
+ * wrong costs a blank name and a support ticket, so this checks all of them
+ * rather than picking a house style nobody else follows.
+ */ /** Attribute keys that hold a complete display name, best first. */ const FULL_NAME_KEYS = [
+    'name',
+    'displayName',
+    'display_name',
+    'cn',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
+];
+const FIRST_NAME_KEYS = [
+    'firstName',
+    'first_name',
+    'given_name',
+    'givenName',
+    'givenname',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'
+];
+const LAST_NAME_KEYS = [
+    'lastName',
+    'last_name',
+    'family_name',
+    'familyName',
+    'surname',
+    'sn',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'
+];
+/**
+ * A SAML attribute value may be a string or a single-element array — the
+ * assertion permits repeats, and GCIP passes the shape through.
+ */ function readAttribute(bag, keys) {
+    if (!bag) return '';
+    for (const key of keys){
+        const raw = bag[key];
+        const value = Array.isArray(raw) ? raw[0] : raw;
+        const text = typeof value === 'string' ? value.trim() : '';
+        if (text) return text;
+    }
+    return '';
+}
+/**
+ * Where GCIP puts a SAML assertion's attributes. Guarded rather than cast:
+ * this runs on EVERY interactive sign-in, including email/password accounts
+ * that have no `firebase` claim at all.
+ */ function signInAttributes(decoded) {
+    const firebase = decoded.firebase;
+    if (!firebase || typeof firebase !== 'object') return undefined;
+    const attributes = firebase.sign_in_attributes;
+    return attributes && typeof attributes === 'object' ? attributes : undefined;
+}
+/**
+ * Resolve a display name from a decoded ID token, or `''` when the provider
+ * genuinely sent nothing.
+ *
+ * Empty rather than a placeholder: callers seed only ABSENT fields, and a
+ * fabricated name would be indistinguishable from one the user chose and
+ * would never be corrected.
+ */ export function resolveIdpDisplayName(decoded) {
+    if (!decoded) return '';
+    // A top-level `name` wins — OIDC providers populate it, and it is the
+    // provider's own idea of the whole name rather than our reassembly.
+    const topLevel = typeof decoded.name === 'string' ? decoded.name.trim() : '';
+    if (topLevel) return topLevel;
+    const attributes = signInAttributes(decoded);
+    const full = readAttribute(attributes, FULL_NAME_KEYS);
+    if (full) return full;
+    const first = readAttribute(attributes, FIRST_NAME_KEYS);
+    const last = readAttribute(attributes, LAST_NAME_KEYS);
+    // Either half alone is still better than nothing — a first name renders a
+    // usable roster row, and demanding both would discard it.
+    return [
+        first,
+        last
+    ].filter(Boolean).join(' ');
+}
+const PHOTO_KEYS = [
+    'picture',
+    'photoUrl',
+    'photo_url',
+    'photoURL',
+    'thumbnailPhotoUrl'
+];
+const PHONE_KEYS = [
+    'phoneNumber',
+    'phone_number',
+    'phone',
+    'telephoneNumber',
+    'mobile',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone'
+];
+/**
+ * Resolve an avatar URL from a decoded ID token, or `''`.
+ *
+ * Only `https:` survives. The value is written to the roster and rendered as
+ * an `<img src>` for every member of the org, so an assertion carrying a
+ * `javascript:` or `data:` URL would turn a mapped IdP attribute into stored
+ * script that we hand to teammates. The IdP is trusted to say who someone is,
+ * which is not the same as being trusted to supply markup.
+ */ export function resolveIdpPhotoUrl(decoded) {
+    if (!decoded) return '';
+    const attributes = signInAttributes(decoded);
+    const candidate = (typeof decoded['picture'] === 'string' ? decoded['picture'].trim() : '') || readAttribute(attributes, PHOTO_KEYS);
+    if (!candidate) return '';
+    try {
+        return new URL(candidate).protocol === 'https:' ? candidate : '';
+    } catch (unused) {
+        // Not a URL at all — a relative path or free text.
+        return '';
+    }
+}
+/**
+ * Resolve a phone number from a decoded ID token, or `''`.
+ *
+ * Returned verbatim rather than normalised to E.164: this is the number the
+ * directory holds, and guessing a country code for a national-format string
+ * invents digits. `normalizePhone` is applied where a user confirms it, not
+ * here.
+ */ export function resolveIdpPhone(decoded) {
+    if (!decoded) return '';
+    const topLevel = typeof decoded['phone_number'] === 'string' ? decoded['phone_number'].trim() : '';
+    return topLevel || readAttribute(signInAttributes(decoded), PHONE_KEYS);
+}
+/**
+ * Address attribute names, same generosity as the name keys and for the same
+ * reason: the customer's IdP admin chooses these, not us.
+ *
+ * Google Workspace's SAML attribute mapping offers `Street address`,
+ * `Locality`, `Region` and `Postal code` from the Directory and lets the admin
+ * name each one; Okta and ADFS emit `streetAddress`/`l`/`st`/`postalCode` and
+ * the full `schemas.xmlsoap.org` URIs respectively. LDAP's own short forms
+ * (`l` for locality, `st` for state, `c` for country) are included because
+ * both of those are ultimately reading a directory that spells them that way.
+ */ const ADDRESS_LINE1_KEYS = [
+    'streetAddress',
+    'street_address',
+    'addressLine1',
+    'address_line1',
+    'line1',
+    'street',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddress'
+];
+const ADDRESS_LINE2_KEYS = [
+    'addressLine2',
+    'address_line2',
+    'line2',
+    'street_address_2',
+    'streetAddress2'
+];
+const ADDRESS_CITY_KEYS = [
+    'locality',
+    'city',
+    'l',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality'
+];
+const ADDRESS_STATE_KEYS = [
+    'region',
+    'state',
+    'province',
+    'st',
+    'stateOrProvince',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince'
+];
+const ADDRESS_POSTAL_KEYS = [
+    'postalCode',
+    'postal_code',
+    'postalcode',
+    'zip',
+    'zipCode',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode'
+];
+const ADDRESS_COUNTRY_KEYS = [
+    'country',
+    'countryCode',
+    'country_code',
+    'c',
+    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country'
+];
+/**
+ * OIDC's `address` claim is a JSON OBJECT, not a string (OpenID Connect Core
+ * §5.1.1), with its own field names. SAML has no equivalent — its attributes
+ * arrive flat in `sign_in_attributes` — so this is the OIDC-only half, read
+ * for the same reason `resolveIdpDisplayName` prefers a top-level `name`.
+ */ function oidcAddressClaim(decoded) {
+    const address = decoded['address'];
+    return address && typeof address === 'object' && !Array.isArray(address) ? address : undefined;
+}
+/**
+ * Resolve a postal address from a decoded ID token.
+ *
+ * Every field independently optional: a directory that holds a city and no
+ * street is a normal directory, and demanding a complete address would
+ * discard the parts it does have. `normalizeAddress` downstream is what turns
+ * "some parts" into either a stored address or `null`.
+ *
+ * `state`, never `region`, in the RESULT — that is the canonical spelling in
+ * `AglynPostalAddress`, matching Stripe's customer address. `region` appears
+ * only as an INPUT key, because that is what Google Workspace calls it.
+ */ export function resolveIdpAddress(decoded) {
+    const empty = {
+        line1: '',
+        line2: '',
+        city: '',
+        state: '',
+        postalCode: '',
+        country: ''
+    };
+    if (!decoded) return empty;
+    const attributes = signInAttributes(decoded);
+    const oidc = oidcAddressClaim(decoded);
+    // SAML attributes win a tie. An org that has mapped its directory into the
+    // assertion has said what it wants us to use, and the OIDC claim is the
+    // fallback for providers that send the standard object instead.
+    const read = (keys, oidcKeys)=>readAttribute(attributes, keys) || readAttribute(oidc, oidcKeys);
+    return {
+        line1: read(ADDRESS_LINE1_KEYS, [
+            'street_address'
+        ]),
+        line2: read(ADDRESS_LINE2_KEYS, []),
+        city: read(ADDRESS_CITY_KEYS, [
+            'locality'
+        ]),
+        state: read(ADDRESS_STATE_KEYS, [
+            'region'
+        ]),
+        postalCode: read(ADDRESS_POSTAL_KEYS, [
+            'postal_code'
+        ]),
+        country: read(ADDRESS_COUNTRY_KEYS, [
+            'country'
+        ])
+    };
+}
+
+//# sourceMappingURL=idp-profile.js.map

package/src/lib/app-utils/idp-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/idp-profile.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The profile fields an identity provider sent, from wherever it put them\n * (AGL-1131).\n *\n * AGL-1131 assumed mapping attributes in Google Workspace would be enough,\n * because \"GCIP surfaces mapped SAML attributes on the token\" and the JIT\n * path already reads `decoded['name']`. Measured after the mapping was\n * added: the tenant auth record still had `displayName: null`, on both the\n * account and its `saml.aglyn-workspace` provider entry, on a sign-in that\n * definitely happened.\n *\n * The reason is that a SAML assertion's attributes arrive under\n * `firebase.sign_in_attributes`, NOT as a top-level `name` claim. Nothing in\n * the codebase read that, so mapping attributes correctly still produced\n * nothing. OIDC providers do populate `name`, which is why the existing code\n * looked right.\n *\n * Deliberately generous about attribute naming, because the name is chosen\n * by the CUSTOMER's IdP admin, not by us. Workspace suggests `firstName`,\n * ADFS emits the full schema URIs, Okta commonly uses `given_name`. Guessing\n * wrong costs a blank name and a support ticket, so this checks all of them\n * rather than picking a house style nobody else follows.\n */\n\n/** Attribute keys that hold a complete display name, best first. */\nconst FULL_NAME_KEYS = [\n  'name',\n  'displayName',\n  'display_name',\n  'cn',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name',\n]\n\nconst FIRST_NAME_KEYS = [\n  'firstName',\n  'first_name',\n  'given_name',\n  'givenName',\n  'givenname',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',\n]\n\nconst LAST_NAME_KEYS = [\n  'lastName',\n  'last_name',\n  'family_name',\n  'familyName',\n  'surname',\n  'sn',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',\n]\n\n/**\n * A SAML attribute value may be a string or a single-element array — the\n * assertion permits repeats, and GCIP passes the shape through.\n */\nfunction readAttribute(\n  bag: Record<string, unknown> | null | undefined,\n  keys: readonly string[],\n): string {\n  if (!bag) return ''\n  for (const key of keys) {\n    const raw = bag[key]\n    const value = Array.isArray(raw) ? raw[0] : raw\n    const text = typeof value === 'string' ? value.trim() : ''\n    if (text) return text\n  }\n  return ''\n}\n\nexport interface IdpNameClaims {\n  name?: unknown\n  firebase?: { sign_in_attributes?: Record<string, unknown> } | unknown\n  [claim: string]: unknown\n}\n\n/**\n * Where GCIP puts a SAML assertion's attributes. Guarded rather than cast:\n * this runs on EVERY interactive sign-in, including email/password accounts\n * that have no `firebase` claim at all.\n */\nfunction signInAttributes(\n  decoded: IdpNameClaims,\n): Record<string, unknown> | undefined {\n  const firebase = decoded.firebase\n  if (!firebase || typeof firebase !== 'object') return undefined\n  const attributes = (firebase as { sign_in_attributes?: unknown })\n    .sign_in_attributes\n  return attributes && typeof attributes === 'object'\n    ? (attributes as Record<string, unknown>)\n    : undefined\n}\n\n/**\n * Resolve a display name from a decoded ID token, or `''` when the provider\n * genuinely sent nothing.\n *\n * Empty rather than a placeholder: callers seed only ABSENT fields, and a\n * fabricated name would be indistinguishable from one the user chose and\n * would never be corrected.\n */\nexport function resolveIdpDisplayName(\n  decoded: IdpNameClaims | null | undefined,\n): string {\n  if (!decoded) return ''\n  // A top-level `name` wins — OIDC providers populate it, and it is the\n  // provider's own idea of the whole name rather than our reassembly.\n  const topLevel = typeof decoded.name === 'string' ? decoded.name.trim() : ''\n  if (topLevel) return topLevel\n\n  const attributes = signInAttributes(decoded)\n  const full = readAttribute(attributes, FULL_NAME_KEYS)\n  if (full) return full\n\n  const first = readAttribute(attributes, FIRST_NAME_KEYS)\n  const last = readAttribute(attributes, LAST_NAME_KEYS)\n  // Either half alone is still better than nothing — a first name renders a\n  // usable roster row, and demanding both would discard it.\n  return [first, last].filter(Boolean).join(' ')\n}\n\nconst PHOTO_KEYS = [\n  'picture',\n  'photoUrl',\n  'photo_url',\n  'photoURL',\n  'thumbnailPhotoUrl',\n]\n\nconst PHONE_KEYS = [\n  'phoneNumber',\n  'phone_number',\n  'phone',\n  'telephoneNumber',\n  'mobile',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone',\n]\n\n/**\n * Resolve an avatar URL from a decoded ID token, or `''`.\n *\n * Only `https:` survives. The value is written to the roster and rendered as\n * an `<img src>` for every member of the org, so an assertion carrying a\n * `javascript:` or `data:` URL would turn a mapped IdP attribute into stored\n * script that we hand to teammates. The IdP is trusted to say who someone is,\n * which is not the same as being trusted to supply markup.\n */\nexport function resolveIdpPhotoUrl(\n  decoded: IdpNameClaims | null | undefined,\n): string {\n  if (!decoded) return ''\n  const attributes = signInAttributes(decoded)\n  const candidate =\n    (typeof decoded['picture'] === 'string' ? decoded['picture'].trim() : '') ||\n    readAttribute(attributes, PHOTO_KEYS)\n  if (!candidate) return ''\n  try {\n    return new URL(candidate).protocol === 'https:' ? candidate : ''\n  } catch {\n    // Not a URL at all — a relative path or free text.\n    return ''\n  }\n}\n\n/**\n * Resolve a phone number from a decoded ID token, or `''`.\n *\n * Returned verbatim rather than normalised to E.164: this is the number the\n * directory holds, and guessing a country code for a national-format string\n * invents digits. `normalizePhone` is applied where a user confirms it, not\n * here.\n */\nexport function resolveIdpPhone(\n  decoded: IdpNameClaims | null | undefined,\n): string {\n  if (!decoded) return ''\n  const topLevel =\n    typeof decoded['phone_number'] === 'string'\n      ? (decoded['phone_number'] as string).trim()\n      : ''\n  return topLevel || readAttribute(signInAttributes(decoded), PHONE_KEYS)\n}\n\n/**\n * Address attribute names, same generosity as the name keys and for the same\n * reason: the customer's IdP admin chooses these, not us.\n *\n * Google Workspace's SAML attribute mapping offers `Street address`,\n * `Locality`, `Region` and `Postal code` from the Directory and lets the admin\n * name each one; Okta and ADFS emit `streetAddress`/`l`/`st`/`postalCode` and\n * the full `schemas.xmlsoap.org` URIs respectively. LDAP's own short forms\n * (`l` for locality, `st` for state, `c` for country) are included because\n * both of those are ultimately reading a directory that spells them that way.\n */\nconst ADDRESS_LINE1_KEYS = [\n  'streetAddress',\n  'street_address',\n  'addressLine1',\n  'address_line1',\n  'line1',\n  'street',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddress',\n]\n\nconst ADDRESS_LINE2_KEYS = [\n  'addressLine2',\n  'address_line2',\n  'line2',\n  'street_address_2',\n  'streetAddress2',\n]\n\nconst ADDRESS_CITY_KEYS = [\n  'locality',\n  'city',\n  'l',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality',\n]\n\nconst ADDRESS_STATE_KEYS = [\n  'region',\n  'state',\n  'province',\n  'st',\n  'stateOrProvince',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince',\n]\n\nconst ADDRESS_POSTAL_KEYS = [\n  'postalCode',\n  'postal_code',\n  'postalcode',\n  'zip',\n  'zipCode',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode',\n]\n\nconst ADDRESS_COUNTRY_KEYS = [\n  'country',\n  'countryCode',\n  'country_code',\n  'c',\n  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country',\n]\n\n/**\n * The postal address an identity provider sent, as loose parts (AGL-1963).\n *\n * Deliberately NOT an `AglynPostalAddress`, and this module deliberately does\n * not import one. `normalizeAddress` is what decides whether these parts add\n * up to an address at all — it drops blanks, rejects a country that is not\n * ISO-3166 alpha-2, and returns `null` when nothing survives. Returning a\n * half-populated object from here would hand the caller something that reads\n * as truthy to every `if (address)` while holding a city and no street, which\n * is exactly the shape AGL-1963 says must not exist.\n */\nexport interface IdpAddressParts {\n  line1: string\n  line2: string\n  city: string\n  state: string\n  postalCode: string\n  country: string\n}\n\n/**\n * OIDC's `address` claim is a JSON OBJECT, not a string (OpenID Connect Core\n * §5.1.1), with its own field names. SAML has no equivalent — its attributes\n * arrive flat in `sign_in_attributes` — so this is the OIDC-only half, read\n * for the same reason `resolveIdpDisplayName` prefers a top-level `name`.\n */\nfunction oidcAddressClaim(\n  decoded: IdpNameClaims,\n): Record<string, unknown> | undefined {\n  const address = decoded['address']\n  return address && typeof address === 'object' && !Array.isArray(address)\n    ? (address as Record<string, unknown>)\n    : undefined\n}\n\n/**\n * Resolve a postal address from a decoded ID token.\n *\n * Every field independently optional: a directory that holds a city and no\n * street is a normal directory, and demanding a complete address would\n * discard the parts it does have. `normalizeAddress` downstream is what turns\n * \"some parts\" into either a stored address or `null`.\n *\n * `state`, never `region`, in the RESULT — that is the canonical spelling in\n * `AglynPostalAddress`, matching Stripe's customer address. `region` appears\n * only as an INPUT key, because that is what Google Workspace calls it.\n */\nexport function resolveIdpAddress(\n  decoded: IdpNameClaims | null | undefined,\n): IdpAddressParts {\n  const empty: IdpAddressParts = {\n    line1: '',\n    line2: '',\n    city: '',\n    state: '',\n    postalCode: '',\n    country: '',\n  }\n  if (!decoded) return empty\n  const attributes = signInAttributes(decoded)\n  const oidc = oidcAddressClaim(decoded)\n  // SAML attributes win a tie. An org that has mapped its directory into the\n  // assertion has said what it wants us to use, and the OIDC claim is the\n  // fallback for providers that send the standard object instead.\n  const read = (keys: readonly string[], oidcKeys: readonly string[]) =>\n    readAttribute(attributes, keys) || readAttribute(oidc, oidcKeys)\n  return {\n    line1: read(ADDRESS_LINE1_KEYS, ['street_address']),\n    line2: read(ADDRESS_LINE2_KEYS, []),\n    city: read(ADDRESS_CITY_KEYS, ['locality']),\n    state: read(ADDRESS_STATE_KEYS, ['region']),\n    postalCode: read(ADDRESS_POSTAL_KEYS, ['postal_code']),\n    country: read(ADDRESS_COUNTRY_KEYS, ['country']),\n  }\n}\n"],"names":["FULL_NAME_KEYS","FIRST_NAME_KEYS","LAST_NAME_KEYS","readAttribute","bag","keys","key","raw","value","Array","isArray","text","trim","signInAttributes","decoded","firebase","undefined","attributes","sign_in_attributes","resolveIdpDisplayName","topLevel","name","full","first","last","filter","Boolean","join","PHOTO_KEYS","PHONE_KEYS","resolveIdpPhotoUrl","candidate","URL","protocol","resolveIdpPhone","ADDRESS_LINE1_KEYS","ADDRESS_LINE2_KEYS","ADDRESS_CITY_KEYS","ADDRESS_STATE_KEYS","ADDRESS_POSTAL_KEYS","ADDRESS_COUNTRY_KEYS","oidcAddressClaim","address","resolveIdpAddress","empty","line1","line2","city","state","postalCode","country","oidc","read","oidcKeys"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GAED,kEAAkE,GAClE,MAAMA,iBAAiB;IACrB;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,kBAAkB;IACtB;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,iBAAiB;IACrB;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;CAGC,GACD,SAASC,cACPC,GAA+C,EAC/CC,IAAuB;IAEvB,IAAI,CAACD,KAAK,OAAO;IACjB,KAAK,MAAME,OAAOD,KAAM;QACtB,MAAME,MAAMH,GAAG,CAACE,IAAI;QACpB,MAAME,QAAQC,MAAMC,OAAO,CAACH,OAAOA,GAAG,CAAC,EAAE,GAAGA;QAC5C,MAAMI,OAAO,OAAOH,UAAU,WAAWA,MAAMI,IAAI,KAAK;QACxD,IAAID,MAAM,OAAOA;IACnB;IACA,OAAO;AACT;AAQA;;;;CAIC,GACD,SAASE,iBACPC,OAAsB;IAEtB,MAAMC,WAAWD,QAAQC,QAAQ;IACjC,IAAI,CAACA,YAAY,OAAOA,aAAa,UAAU,OAAOC;IACtD,MAAMC,aAAa,AAACF,SACjBG,kBAAkB;IACrB,OAAOD,cAAc,OAAOA,eAAe,WACtCA,aACDD;AACN;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,sBACdL,OAAyC;IAEzC,IAAI,CAACA,SAAS,OAAO;IACrB,sEAAsE;IACtE,oEAAoE;IACpE,MAAMM,WAAW,OAAON,QAAQO,IAAI,KAAK,WAAWP,QAAQO,IAAI,CAACT,IAAI,KAAK;IAC1E,IAAIQ,UAAU,OAAOA;IAErB,MAAMH,aAAaJ,iBAAiBC;IACpC,MAAMQ,OAAOnB,cAAcc,YAAYjB;IACvC,IAAIsB,MAAM,OAAOA;IAEjB,MAAMC,QAAQpB,cAAcc,YAAYhB;IACxC,MAAMuB,OAAOrB,cAAcc,YAAYf;IACvC,0EAA0E;IAC1E,0DAA0D;IAC1D,OAAO;QAACqB;QAAOC;KAAK,CAACC,MAAM,CAACC,SAASC,IAAI,CAAC;AAC5C;AAEA,MAAMC,aAAa;IACjB;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,aAAa;IACjB;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;;;;;CAQC,GACD,OAAO,SAASC,mBACdhB,OAAyC;IAEzC,IAAI,CAACA,SAAS,OAAO;IACrB,MAAMG,aAAaJ,iBAAiBC;IACpC,MAAMiB,YACJ,AAAC,CAAA,OAAOjB,OAAO,CAAC,UAAU,KAAK,WAAWA,OAAO,CAAC,UAAU,CAACF,IAAI,KAAK,EAAC,KACvET,cAAcc,YAAYW;IAC5B,IAAI,CAACG,WAAW,OAAO;IACvB,IAAI;QACF,OAAO,IAAIC,IAAID,WAAWE,QAAQ,KAAK,WAAWF,YAAY;IAChE,EAAE,eAAM;QACN,mDAAmD;QACnD,OAAO;IACT;AACF;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,gBACdpB,OAAyC;IAEzC,IAAI,CAACA,SAAS,OAAO;IACrB,MAAMM,WACJ,OAAON,OAAO,CAAC,eAAe,KAAK,WAC/B,AAACA,OAAO,CAAC,eAAe,CAAYF,IAAI,KACxC;IACN,OAAOQ,YAAYjB,cAAcU,iBAAiBC,UAAUe;AAC9D;AAEA;;;;;;;;;;CAUC,GACD,MAAMM,qBAAqB;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,qBAAqB;IACzB;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,oBAAoB;IACxB;IACA;IACA;IACA;CACD;AAED,MAAMC,qBAAqB;IACzB;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,sBAAsB;IAC1B;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,uBAAuB;IAC3B;IACA;IACA;IACA;IACA;CACD;AAsBD;;;;;CAKC,GACD,SAASC,iBACP3B,OAAsB;IAEtB,MAAM4B,UAAU5B,OAAO,CAAC,UAAU;IAClC,OAAO4B,WAAW,OAAOA,YAAY,YAAY,CAACjC,MAAMC,OAAO,CAACgC,WAC3DA,UACD1B;AACN;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAAS2B,kBACd7B,OAAyC;IAEzC,MAAM8B,QAAyB;QAC7BC,OAAO;QACPC,OAAO;QACPC,MAAM;QACNC,OAAO;QACPC,YAAY;QACZC,SAAS;IACX;IACA,IAAI,CAACpC,SAAS,OAAO8B;IACrB,MAAM3B,aAAaJ,iBAAiBC;IACpC,MAAMqC,OAAOV,iBAAiB3B;IAC9B,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,MAAMsC,OAAO,CAAC/C,MAAyBgD,WACrClD,cAAcc,YAAYZ,SAASF,cAAcgD,MAAME;IACzD,OAAO;QACLR,OAAOO,KAAKjB,oBAAoB;YAAC;SAAiB;QAClDW,OAAOM,KAAKhB,oBAAoB,EAAE;QAClCW,MAAMK,KAAKf,mBAAmB;YAAC;SAAW;QAC1CW,OAAOI,KAAKd,oBAAoB;YAAC;SAAS;QAC1CW,YAAYG,KAAKb,qBAAqB;YAAC;SAAc;QACrDW,SAASE,KAAKZ,sBAAsB;YAAC;SAAU;IACjD;AACF"}

package/src/lib/app-utils/image-upload-types.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The image content types media ingress accepts.
+ *
+ * Every upload surface used to answer "is this an image?" with
+ * `contentType.startsWith('image/')`, against a string the CALLER chooses.
+ * Three separate decisions hang off that answer, and an open prefix gets all
+ * three wrong for a type nobody has ever heard of:
+ *
+ * - **Entitlement.** Everything that is not an image rides the `videoMedia`
+ *   gate, so `image/x-anything` is how arbitrary bytes reach a workspace
+ *   whose plan does not include file uploads.
+ * - **Ceilings.** An unrecognised `image/…` resolves the image ceiling
+ *   rather than the (much smaller) one its real format would get.
+ * - **Structure.** `inspectUploadBytes` only matches magic numbers for types
+ *   it knows, so an unrecognised label means no signature check runs at all
+ *   — the executable and macro checks still apply, but "these bytes are not
+ *   the format you declared" cannot be asked.
+ *
+ * The set below is exactly the image half of that module's signature table,
+ * plus SVG, which is text and has no magic number. A spec pins the two
+ * together so a format added to one cannot go missing from the other.
+ */
+export declare const IMAGE_UPLOAD_TYPES: ReadonlySet<string>;
+/** A content type reduced to its bare type: no parameters, lower case. */
+export declare function bareContentType(contentType: unknown): string;
+/**
+ * The canonical type for an image label, or the bare label unchanged when it
+ * is not one this platform recognises. Never widens: a type that was not an
+ * accepted image before does not become one here.
+ */
+export declare function normalizeImageContentType(contentType: unknown): string;
+/** Whether media ingress treats this content type as an image. */
+export declare function isImageUploadContentType(contentType: unknown): boolean;

package/src/lib/app-utils/image-upload-types.js

@@ -0,0 +1,86 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The image content types media ingress accepts.
+ *
+ * Every upload surface used to answer "is this an image?" with
+ * `contentType.startsWith('image/')`, against a string the CALLER chooses.
+ * Three separate decisions hang off that answer, and an open prefix gets all
+ * three wrong for a type nobody has ever heard of:
+ *
+ * - **Entitlement.** Everything that is not an image rides the `videoMedia`
+ *   gate, so `image/x-anything` is how arbitrary bytes reach a workspace
+ *   whose plan does not include file uploads.
+ * - **Ceilings.** An unrecognised `image/…` resolves the image ceiling
+ *   rather than the (much smaller) one its real format would get.
+ * - **Structure.** `inspectUploadBytes` only matches magic numbers for types
+ *   it knows, so an unrecognised label means no signature check runs at all
+ *   — the executable and macro checks still apply, but "these bytes are not
+ *   the format you declared" cannot be asked.
+ *
+ * The set below is exactly the image half of that module's signature table,
+ * plus SVG, which is text and has no magic number. A spec pins the two
+ * together so a format added to one cannot go missing from the other.
+ */ export const IMAGE_UPLOAD_TYPES = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/gif',
+    'image/webp',
+    'image/avif',
+    'image/heic',
+    'image/heif',
+    'image/bmp',
+    'image/tiff',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+    // A document wearing an image label. Accepted, sanitized at every ingress,
+    // and served under a sandboxing CSP — see `sanitize-svg`.
+    'image/svg+xml'
+]);
+/**
+ * Labels browsers and older tools emit for a format that already has a
+ * canonical type. Folded rather than added to the set above, so that one
+ * format is one stored type: the CDN's active-document check, the signature
+ * table and the SVG sanitizer all key off the type, and a second spelling is
+ * a second thing each of them has to remember.
+ */ const IMAGE_TYPE_ALIASES = {
+    'image/jpg': 'image/jpeg',
+    'image/pjpeg': 'image/jpeg',
+    'image/x-png': 'image/png',
+    'image/x-ms-bmp': 'image/bmp',
+    'image/x-bmp': 'image/bmp',
+    'image/x-tiff': 'image/tiff',
+    'image/ico': 'image/x-icon',
+    'image/x-icon+xml': 'image/x-icon',
+    'image/svg': 'image/svg+xml'
+};
+/** A content type reduced to its bare type: no parameters, lower case. */ export function bareContentType(contentType) {
+    return String(contentType != null ? contentType : '').split(';')[0].trim().toLowerCase();
+}
+/**
+ * The canonical type for an image label, or the bare label unchanged when it
+ * is not one this platform recognises. Never widens: a type that was not an
+ * accepted image before does not become one here.
+ */ export function normalizeImageContentType(contentType) {
+    var _IMAGE_TYPE_ALIASES_bare;
+    const bare = bareContentType(contentType);
+    return (_IMAGE_TYPE_ALIASES_bare = IMAGE_TYPE_ALIASES[bare]) != null ? _IMAGE_TYPE_ALIASES_bare : bare;
+}
+/** Whether media ingress treats this content type as an image. */ export function isImageUploadContentType(contentType) {
+    return IMAGE_UPLOAD_TYPES.has(normalizeImageContentType(contentType));
+}
+
+//# sourceMappingURL=image-upload-types.js.map

package/src/lib/app-utils/image-upload-types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/image-upload-types.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The image content types media ingress accepts.\n *\n * Every upload surface used to answer \"is this an image?\" with\n * `contentType.startsWith('image/')`, against a string the CALLER chooses.\n * Three separate decisions hang off that answer, and an open prefix gets all\n * three wrong for a type nobody has ever heard of:\n *\n * - **Entitlement.** Everything that is not an image rides the `videoMedia`\n *   gate, so `image/x-anything` is how arbitrary bytes reach a workspace\n *   whose plan does not include file uploads.\n * - **Ceilings.** An unrecognised `image/…` resolves the image ceiling\n *   rather than the (much smaller) one its real format would get.\n * - **Structure.** `inspectUploadBytes` only matches magic numbers for types\n *   it knows, so an unrecognised label means no signature check runs at all\n *   — the executable and macro checks still apply, but \"these bytes are not\n *   the format you declared\" cannot be asked.\n *\n * The set below is exactly the image half of that module's signature table,\n * plus SVG, which is text and has no magic number. A spec pins the two\n * together so a format added to one cannot go missing from the other.\n */\nexport const IMAGE_UPLOAD_TYPES: ReadonlySet<string> = new Set([\n  'image/png',\n  'image/jpeg',\n  'image/gif',\n  'image/webp',\n  'image/avif',\n  'image/heic',\n  'image/heif',\n  'image/bmp',\n  'image/tiff',\n  'image/x-icon',\n  'image/vnd.microsoft.icon',\n  // A document wearing an image label. Accepted, sanitized at every ingress,\n  // and served under a sandboxing CSP — see `sanitize-svg`.\n  'image/svg+xml',\n])\n\n/**\n * Labels browsers and older tools emit for a format that already has a\n * canonical type. Folded rather than added to the set above, so that one\n * format is one stored type: the CDN's active-document check, the signature\n * table and the SVG sanitizer all key off the type, and a second spelling is\n * a second thing each of them has to remember.\n */\nconst IMAGE_TYPE_ALIASES: Readonly<Record<string, string>> = {\n  'image/jpg': 'image/jpeg',\n  'image/pjpeg': 'image/jpeg',\n  'image/x-png': 'image/png',\n  'image/x-ms-bmp': 'image/bmp',\n  'image/x-bmp': 'image/bmp',\n  'image/x-tiff': 'image/tiff',\n  'image/ico': 'image/x-icon',\n  'image/x-icon+xml': 'image/x-icon',\n  'image/svg': 'image/svg+xml',\n}\n\n/** A content type reduced to its bare type: no parameters, lower case. */\nexport function bareContentType(contentType: unknown): string {\n  return String(contentType ?? '')\n    .split(';')[0]\n    .trim()\n    .toLowerCase()\n}\n\n/**\n * The canonical type for an image label, or the bare label unchanged when it\n * is not one this platform recognises. Never widens: a type that was not an\n * accepted image before does not become one here.\n */\nexport function normalizeImageContentType(contentType: unknown): string {\n  const bare = bareContentType(contentType)\n  return IMAGE_TYPE_ALIASES[bare] ?? bare\n}\n\n/** Whether media ingress treats this content type as an image. */\nexport function isImageUploadContentType(contentType: unknown): boolean {\n  return IMAGE_UPLOAD_TYPES.has(normalizeImageContentType(contentType))\n}\n"],"names":["IMAGE_UPLOAD_TYPES","Set","IMAGE_TYPE_ALIASES","bareContentType","contentType","String","split","trim","toLowerCase","normalizeImageContentType","bare","isImageUploadContentType","has"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,MAAMA,qBAA0C,IAAIC,IAAI;IAC7D;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,2EAA2E;IAC3E,0DAA0D;IAC1D;CACD,EAAC;AAEF;;;;;;CAMC,GACD,MAAMC,qBAAuD;IAC3D,aAAa;IACb,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,oBAAoB;IACpB,aAAa;AACf;AAEA,wEAAwE,GACxE,OAAO,SAASC,gBAAgBC,WAAoB;IAClD,OAAOC,OAAOD,sBAAAA,cAAe,IAC1BE,KAAK,CAAC,IAAI,CAAC,EAAE,CACbC,IAAI,GACJC,WAAW;AAChB;AAEA;;;;CAIC,GACD,OAAO,SAASC,0BAA0BL,WAAoB;QAErDF;IADP,MAAMQ,OAAOP,gBAAgBC;IAC7B,QAAOF,2BAAAA,kBAAkB,CAACQ,KAAK,YAAxBR,2BAA4BQ;AACrC;AAEA,gEAAgE,GAChE,OAAO,SAASC,yBAAyBP,WAAoB;IAC3D,OAAOJ,mBAAmBY,GAAG,CAACH,0BAA0BL;AAC1D"}

package/src/lib/app-utils/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './server';
+export * from './contexts';

package/src/lib/app-utils/index.js

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Full app-utils surface = server-safe utils + the client-only React
+// contexts. Split so `@aglyn/aglyn/server` can re-export just `./server`
+// (no `createContext`) for tenant Server Components (AGL-405); this barrel,
+// reached via `@aglyn/aglyn`, keeps both for client consumers unchanged.
+export * from "./server.js";
+export * from "./contexts.js";
+
+//# sourceMappingURL=index.js.map

package/src/lib/app-utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Full app-utils surface = server-safe utils + the client-only React\n// contexts. Split so `@aglyn/aglyn/server` can re-export just `./server`\n// (no `createContext`) for tenant Server Components (AGL-405); this barrel,\n// reached via `@aglyn/aglyn`, keeps both for client consumers unchanged.\nexport * from './server'\nexport * from './contexts'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,qEAAqE;AACrE,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,cAAc,cAAU;AACxB,cAAc,gBAAY"}