@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/paid-media-source.js

@@ -0,0 +1,184 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isFirstPartyHost, MEDIA_CDN_ROUTE, MEDIA_REF_PREFIX, parseMediaRef } from "./media-ref.js";
+const STORAGE_DOWNLOAD_HOST = 'firebasestorage.googleapis.com';
+const GCS_HOST = 'storage.googleapis.com';
+/**
+ * The Storage emulator's `host:port`, whose download URLs have the same shape
+ * as production's. Read per call so a test can set it.
+ */ function storageEmulatorHost() {
+    var _process_env;
+    const env = typeof process === 'undefined' ? undefined : (_process_env = process.env) == null ? void 0 : _process_env['FIREBASE_STORAGE_EMULATOR_HOST'];
+    return String(env != null ? env : '').trim().toLowerCase();
+}
+/** A library asset from `/api/media/cdn/{scope}/{mediaId}[/{hash}]`. */ function assetFromCdnPath(path) {
+    const rest = path.slice(`${MEDIA_CDN_ROUTE}/`.length).split(/[?#]/)[0];
+    const segments = rest.split('/');
+    if (segments.length < 2 || segments.length > 3) return {
+        kind: 'malformed'
+    };
+    let scope;
+    try {
+        scope = decodeURIComponent(segments[0]);
+    } catch (unused) {
+        return {
+            kind: 'malformed'
+        };
+    }
+    // Parsed through the reference grammar rather than a second copy of it. A
+    // content pin in the path is dropped: a paid link names the asset, and the
+    // stable URL always serves its current bytes.
+    const ref = parseMediaRef(`${MEDIA_REF_PREFIX}${scope}/${segments[1]}`);
+    return ref ? {
+        kind: 'asset',
+        scope: ref.scope,
+        mediaId: ref.mediaId
+    } : {
+        kind: 'malformed'
+    };
+}
+/** Decodes each `/`-separated piece of a path; null when one is malformed. */ function decodePath(pieces) {
+    try {
+        return pieces.map((piece)=>decodeURIComponent(piece)).join('/');
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * Classifies a stored value. The same input always gives the same answer, so
+ * every branch is checkable without a project.
+ */ export function parsePaidMediaSource(stored) {
+    const value = typeof stored === 'string' ? stored.trim() : '';
+    if (!value) return {
+        kind: 'malformed'
+    };
+    if (value.startsWith(MEDIA_REF_PREFIX)) {
+        const ref = parseMediaRef(value);
+        return ref ? {
+            kind: 'asset',
+            scope: ref.scope,
+            mediaId: ref.mediaId
+        } : {
+            kind: 'malformed'
+        };
+    }
+    if (value.startsWith(`${MEDIA_CDN_ROUTE}/`)) return assetFromCdnPath(value);
+    if (!/^https?:\/\//i.test(value)) return {
+        kind: 'malformed'
+    };
+    let url;
+    try {
+        url = new URL(value);
+    } catch (unused) {
+        return {
+            kind: 'malformed'
+        };
+    }
+    const hostname = url.hostname.toLowerCase();
+    const emulator = storageEmulatorHost();
+    if (hostname === STORAGE_DOWNLOAD_HOST || emulator && url.host.toLowerCase() === emulator) {
+        // `/v0/b/{bucket}/o/{object}`, with the object key percent-encoded as one
+        // segment. A download URL in any other shape is still a token URL, so it
+        // is refused rather than handed through as a hotlink.
+        const match = /^\/v0\/b\/([^/]+)\/o\/([^/]+)$/.exec(url.pathname);
+        const bucket = match ? decodePath([
+            match[1]
+        ]) : null;
+        const objectPath = match ? decodePath([
+            match[2]
+        ]) : null;
+        return bucket && objectPath ? {
+            kind: 'storage-object',
+            bucket,
+            objectPath
+        } : {
+            kind: 'malformed'
+        };
+    }
+    if (hostname === GCS_HOST) {
+        const [, bucketPiece, ...objectPieces] = url.pathname.split('/');
+        const bucket = bucketPiece ? decodePath([
+            bucketPiece
+        ]) : null;
+        const objectPath = objectPieces.length ? decodePath(objectPieces) : null;
+        return bucket && objectPath ? {
+            kind: 'storage-object',
+            bucket,
+            objectPath
+        } : {
+            kind: 'malformed'
+        };
+    }
+    if (isFirstPartyHost(hostname) && url.pathname.startsWith(`${MEDIA_CDN_ROUTE}/`)) {
+        return assetFromCdnPath(url.pathname);
+    }
+    return {
+        kind: 'external',
+        url: value
+    };
+}
+/**
+ * The library asset a media object key belongs to, or null.
+ *
+ * Every writer keys an asset's object as `{base}/media/[folders/]{mediaId}`,
+ * with `base` either `hosts/{hostId}` or `orgs/{orgId}`. So a key in that
+ * shape whose last segment is id-shaped IS that asset, wherever a folder move
+ * has since put it. Derived objects (`…__r720p.mp4`, `…__poster.webp`) carry
+ * a dot and are no asset's key.
+ *
+ * This names the asset and decides nothing about access: a caller that signs
+ * still has to check the bucket and that the library is its own.
+ */ export function paidMediaAssetOfObject(objectPath) {
+    const segments = String(objectPath != null ? objectPath : '').split('/');
+    if (segments.length < 4 || segments[2] !== 'media') return null;
+    if (segments.some((segment)=>!segment || segment === '..')) return null;
+    const [root, scopeId] = segments;
+    const scope = root === 'hosts' ? scopeId : root === 'orgs' ? `org:${scopeId}` : null;
+    if (!scope) return null;
+    const ref = parseMediaRef(`${MEDIA_REF_PREFIX}${scope}/${segments[segments.length - 1]}`);
+    return ref ? {
+        scope: ref.scope,
+        mediaId: ref.mediaId
+    } : null;
+}
+/**
+ * The library asset a stored paid-media URL names, in whichever form it was
+ * written, or null for a hotlink, a malformed value, or a Storage URL that
+ * names no asset. Pass `bucket` to refuse a download URL from any other
+ * bucket, which is what every server-side caller should do.
+ */ export function paidMediaAssetOf(stored, options) {
+    const source = parsePaidMediaSource(stored);
+    if (source.kind === 'asset') {
+        return {
+            scope: source.scope,
+            mediaId: source.mediaId
+        };
+    }
+    if (source.kind !== 'storage-object') return null;
+    if ((options == null ? void 0 : options.bucket) !== undefined && source.bucket !== options.bucket) {
+        return null;
+    }
+    return paidMediaAssetOfObject(source.objectPath);
+}
+/**
+ * Whether two scope segments name the same library: the same host, or the
+ * same org whatever site either is qualified with.
+ */ export function samePaidMediaLibrary(a, b) {
+    const library = (scope)=>scope.startsWith('org:') ? `org:${scope.slice(4).split(':')[0]}` : scope;
+    return library(a) === library(b);
+}
+
+//# sourceMappingURL=paid-media-source.js.map

package/src/lib/app-utils/paid-media-source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/paid-media-source.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isFirstPartyHost,\n  MEDIA_CDN_ROUTE,\n  MEDIA_REF_PREFIX,\n  parseMediaRef,\n} from './media-ref'\n\n/**\n * What a URL stored on a product's paid media names (AGL-2814).\n *\n * A members video is stored as whatever wrote it: the paid-media picker's\n * reference, an older picker's CDN path, the raw Storage download URL a\n * free-tier library hands out, or a hotlink typed into an import. Three\n * places have to agree on which ASSET that is: the stream route that signs\n * it, the console that shows the author whether it is protected, and the\n * media route that refuses to publish a file a product still sells. One\n * grammar, here, so they cannot disagree.\n *\n * Pure and environment-light: nothing here reads Firestore, Storage or a\n * secret, so the console bundle can carry it.\n */\nexport type PaidMediaSource =\n  /** A media-library asset, named by scope segment and id. */\n  | { kind: 'asset'; scope: string; mediaId: string }\n  /** An object in a Storage bucket, from a download or GCS URL. */\n  | { kind: 'storage-object'; bucket: string; objectPath: string }\n  /** Somebody else's server. */\n  | { kind: 'external'; url: string }\n  /** Nothing that can be delivered, including a Storage URL we cannot read. */\n  | { kind: 'malformed' }\n\nconst STORAGE_DOWNLOAD_HOST = 'firebasestorage.googleapis.com'\nconst GCS_HOST = 'storage.googleapis.com'\n\n/**\n * The Storage emulator's `host:port`, whose download URLs have the same shape\n * as production's. Read per call so a test can set it.\n */\nfunction storageEmulatorHost(): string {\n  const env =\n    typeof process === 'undefined' ? undefined : process.env?.['FIREBASE_STORAGE_EMULATOR_HOST']\n  return String(env ?? '')\n    .trim()\n    .toLowerCase()\n}\n\n/** A library asset from `/api/media/cdn/{scope}/{mediaId}[/{hash}]`. */\nfunction assetFromCdnPath(path: string): PaidMediaSource {\n  const rest = path.slice(`${MEDIA_CDN_ROUTE}/`.length).split(/[?#]/)[0]\n  const segments = rest.split('/')\n  if (segments.length < 2 || segments.length > 3) return { kind: 'malformed' }\n  let scope: string\n  try {\n    scope = decodeURIComponent(segments[0])\n  } catch {\n    return { kind: 'malformed' }\n  }\n  // Parsed through the reference grammar rather than a second copy of it. A\n  // content pin in the path is dropped: a paid link names the asset, and the\n  // stable URL always serves its current bytes.\n  const ref = parseMediaRef(`${MEDIA_REF_PREFIX}${scope}/${segments[1]}`)\n  return ref\n    ? { kind: 'asset', scope: ref.scope, mediaId: ref.mediaId }\n    : { kind: 'malformed' }\n}\n\n/** Decodes each `/`-separated piece of a path; null when one is malformed. */\nfunction decodePath(pieces: string[]): string | null {\n  try {\n    return pieces.map((piece) => decodeURIComponent(piece)).join('/')\n  } catch {\n    return null\n  }\n}\n\n/**\n * Classifies a stored value. The same input always gives the same answer, so\n * every branch is checkable without a project.\n */\nexport function parsePaidMediaSource(stored: unknown): PaidMediaSource {\n  const value = typeof stored === 'string' ? stored.trim() : ''\n  if (!value) return { kind: 'malformed' }\n  if (value.startsWith(MEDIA_REF_PREFIX)) {\n    const ref = parseMediaRef(value)\n    return ref\n      ? { kind: 'asset', scope: ref.scope, mediaId: ref.mediaId }\n      : { kind: 'malformed' }\n  }\n  if (value.startsWith(`${MEDIA_CDN_ROUTE}/`)) return assetFromCdnPath(value)\n  if (!/^https?:\\/\\//i.test(value)) return { kind: 'malformed' }\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    return { kind: 'malformed' }\n  }\n  const hostname = url.hostname.toLowerCase()\n  const emulator = storageEmulatorHost()\n  if (\n    hostname === STORAGE_DOWNLOAD_HOST ||\n    (emulator && url.host.toLowerCase() === emulator)\n  ) {\n    // `/v0/b/{bucket}/o/{object}`, with the object key percent-encoded as one\n    // segment. A download URL in any other shape is still a token URL, so it\n    // is refused rather than handed through as a hotlink.\n    const match = /^\\/v0\\/b\\/([^/]+)\\/o\\/([^/]+)$/.exec(url.pathname)\n    const bucket = match ? decodePath([match[1]]) : null\n    const objectPath = match ? decodePath([match[2]]) : null\n    return bucket && objectPath\n      ? { kind: 'storage-object', bucket, objectPath }\n      : { kind: 'malformed' }\n  }\n  if (hostname === GCS_HOST) {\n    const [, bucketPiece, ...objectPieces] = url.pathname.split('/')\n    const bucket = bucketPiece ? decodePath([bucketPiece]) : null\n    const objectPath = objectPieces.length ? decodePath(objectPieces) : null\n    return bucket && objectPath\n      ? { kind: 'storage-object', bucket, objectPath }\n      : { kind: 'malformed' }\n  }\n  if (\n    isFirstPartyHost(hostname) &&\n    url.pathname.startsWith(`${MEDIA_CDN_ROUTE}/`)\n  ) {\n    return assetFromCdnPath(url.pathname)\n  }\n  return { kind: 'external', url: value }\n}\n\n/**\n * The library asset a media object key belongs to, or null.\n *\n * Every writer keys an asset's object as `{base}/media/[folders/]{mediaId}`,\n * with `base` either `hosts/{hostId}` or `orgs/{orgId}`. So a key in that\n * shape whose last segment is id-shaped IS that asset, wherever a folder move\n * has since put it. Derived objects (`…__r720p.mp4`, `…__poster.webp`) carry\n * a dot and are no asset's key.\n *\n * This names the asset and decides nothing about access: a caller that signs\n * still has to check the bucket and that the library is its own.\n */\nexport function paidMediaAssetOfObject(\n  objectPath: string,\n): { scope: string; mediaId: string } | null {\n  const segments = String(objectPath ?? '').split('/')\n  if (segments.length < 4 || segments[2] !== 'media') return null\n  if (segments.some((segment) => !segment || segment === '..')) return null\n  const [root, scopeId] = segments\n  const scope =\n    root === 'hosts' ? scopeId : root === 'orgs' ? `org:${scopeId}` : null\n  if (!scope) return null\n  const ref = parseMediaRef(\n    `${MEDIA_REF_PREFIX}${scope}/${segments[segments.length - 1]}`,\n  )\n  return ref ? { scope: ref.scope, mediaId: ref.mediaId } : null\n}\n\n/**\n * The library asset a stored paid-media URL names, in whichever form it was\n * written, or null for a hotlink, a malformed value, or a Storage URL that\n * names no asset. Pass `bucket` to refuse a download URL from any other\n * bucket, which is what every server-side caller should do.\n */\nexport function paidMediaAssetOf(\n  stored: unknown,\n  options?: { bucket?: string },\n): { scope: string; mediaId: string } | null {\n  const source = parsePaidMediaSource(stored)\n  if (source.kind === 'asset') {\n    return { scope: source.scope, mediaId: source.mediaId }\n  }\n  if (source.kind !== 'storage-object') return null\n  if (options?.bucket !== undefined && source.bucket !== options.bucket) {\n    return null\n  }\n  return paidMediaAssetOfObject(source.objectPath)\n}\n\n/**\n * Whether two scope segments name the same library: the same host, or the\n * same org whatever site either is qualified with.\n */\nexport function samePaidMediaLibrary(a: string, b: string): boolean {\n  const library = (scope: string) =>\n    scope.startsWith('org:') ? `org:${scope.slice(4).split(':')[0]}` : scope\n  return library(a) === library(b)\n}\n"],"names":["isFirstPartyHost","MEDIA_CDN_ROUTE","MEDIA_REF_PREFIX","parseMediaRef","STORAGE_DOWNLOAD_HOST","GCS_HOST","storageEmulatorHost","process","env","undefined","String","trim","toLowerCase","assetFromCdnPath","path","rest","slice","length","split","segments","kind","scope","decodeURIComponent","ref","mediaId","decodePath","pieces","map","piece","join","parsePaidMediaSource","stored","value","startsWith","test","url","URL","hostname","emulator","host","match","exec","pathname","bucket","objectPath","bucketPiece","objectPieces","paidMediaAssetOfObject","some","segment","root","scopeId","paidMediaAssetOf","options","source","samePaidMediaLibrary","a","b","library"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,gBAAgB,EAChBC,eAAe,EACfC,gBAAgB,EAChBC,aAAa,QACR,iBAAa;AA0BpB,MAAMC,wBAAwB;AAC9B,MAAMC,WAAW;AAEjB;;;CAGC,GACD,SAASC;QAEwCC;IAD/C,MAAMC,MACJ,OAAOD,YAAY,cAAcE,aAAYF,eAAAA,QAAQC,GAAG,qBAAXD,YAAa,CAAC,iCAAiC;IAC9F,OAAOG,OAAOF,cAAAA,MAAO,IAClBG,IAAI,GACJC,WAAW;AAChB;AAEA,sEAAsE,GACtE,SAASC,iBAAiBC,IAAY;IACpC,MAAMC,OAAOD,KAAKE,KAAK,CAAC,GAAGf,gBAAgB,CAAC,CAAC,CAACgB,MAAM,EAAEC,KAAK,CAAC,OAAO,CAAC,EAAE;IACtE,MAAMC,WAAWJ,KAAKG,KAAK,CAAC;IAC5B,IAAIC,SAASF,MAAM,GAAG,KAAKE,SAASF,MAAM,GAAG,GAAG,OAAO;QAAEG,MAAM;IAAY;IAC3E,IAAIC;IACJ,IAAI;QACFA,QAAQC,mBAAmBH,QAAQ,CAAC,EAAE;IACxC,EAAE,eAAM;QACN,OAAO;YAAEC,MAAM;QAAY;IAC7B;IACA,0EAA0E;IAC1E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAMG,MAAMpB,cAAc,GAAGD,mBAAmBmB,MAAM,CAAC,EAAEF,QAAQ,CAAC,EAAE,EAAE;IACtE,OAAOI,MACH;QAAEH,MAAM;QAASC,OAAOE,IAAIF,KAAK;QAAEG,SAASD,IAAIC,OAAO;IAAC,IACxD;QAAEJ,MAAM;IAAY;AAC1B;AAEA,4EAA4E,GAC5E,SAASK,WAAWC,MAAgB;IAClC,IAAI;QACF,OAAOA,OAAOC,GAAG,CAAC,CAACC,QAAUN,mBAAmBM,QAAQC,IAAI,CAAC;IAC/D,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,OAAO,SAASC,qBAAqBC,MAAe;IAClD,MAAMC,QAAQ,OAAOD,WAAW,WAAWA,OAAOpB,IAAI,KAAK;IAC3D,IAAI,CAACqB,OAAO,OAAO;QAAEZ,MAAM;IAAY;IACvC,IAAIY,MAAMC,UAAU,CAAC/B,mBAAmB;QACtC,MAAMqB,MAAMpB,cAAc6B;QAC1B,OAAOT,MACH;YAAEH,MAAM;YAASC,OAAOE,IAAIF,KAAK;YAAEG,SAASD,IAAIC,OAAO;QAAC,IACxD;YAAEJ,MAAM;QAAY;IAC1B;IACA,IAAIY,MAAMC,UAAU,CAAC,GAAGhC,gBAAgB,CAAC,CAAC,GAAG,OAAOY,iBAAiBmB;IACrE,IAAI,CAAC,gBAAgBE,IAAI,CAACF,QAAQ,OAAO;QAAEZ,MAAM;IAAY;IAC7D,IAAIe;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIJ;IAChB,EAAE,eAAM;QACN,OAAO;YAAEZ,MAAM;QAAY;IAC7B;IACA,MAAMiB,WAAWF,IAAIE,QAAQ,CAACzB,WAAW;IACzC,MAAM0B,WAAWhC;IACjB,IACE+B,aAAajC,yBACZkC,YAAYH,IAAII,IAAI,CAAC3B,WAAW,OAAO0B,UACxC;QACA,0EAA0E;QAC1E,yEAAyE;QACzE,sDAAsD;QACtD,MAAME,QAAQ,iCAAiCC,IAAI,CAACN,IAAIO,QAAQ;QAChE,MAAMC,SAASH,QAAQf,WAAW;YAACe,KAAK,CAAC,EAAE;SAAC,IAAI;QAChD,MAAMI,aAAaJ,QAAQf,WAAW;YAACe,KAAK,CAAC,EAAE;SAAC,IAAI;QACpD,OAAOG,UAAUC,aACb;YAAExB,MAAM;YAAkBuB;YAAQC;QAAW,IAC7C;YAAExB,MAAM;QAAY;IAC1B;IACA,IAAIiB,aAAahC,UAAU;QACzB,MAAM,GAAGwC,aAAa,GAAGC,aAAa,GAAGX,IAAIO,QAAQ,CAACxB,KAAK,CAAC;QAC5D,MAAMyB,SAASE,cAAcpB,WAAW;YAACoB;SAAY,IAAI;QACzD,MAAMD,aAAaE,aAAa7B,MAAM,GAAGQ,WAAWqB,gBAAgB;QACpE,OAAOH,UAAUC,aACb;YAAExB,MAAM;YAAkBuB;YAAQC;QAAW,IAC7C;YAAExB,MAAM;QAAY;IAC1B;IACA,IACEpB,iBAAiBqC,aACjBF,IAAIO,QAAQ,CAACT,UAAU,CAAC,GAAGhC,gBAAgB,CAAC,CAAC,GAC7C;QACA,OAAOY,iBAAiBsB,IAAIO,QAAQ;IACtC;IACA,OAAO;QAAEtB,MAAM;QAAYe,KAAKH;IAAM;AACxC;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASe,uBACdH,UAAkB;IAElB,MAAMzB,WAAWT,OAAOkC,qBAAAA,aAAc,IAAI1B,KAAK,CAAC;IAChD,IAAIC,SAASF,MAAM,GAAG,KAAKE,QAAQ,CAAC,EAAE,KAAK,SAAS,OAAO;IAC3D,IAAIA,SAAS6B,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAO,OAAO;IACrE,MAAM,CAACC,MAAMC,QAAQ,GAAGhC;IACxB,MAAME,QACJ6B,SAAS,UAAUC,UAAUD,SAAS,SAAS,CAAC,IAAI,EAAEC,SAAS,GAAG;IACpE,IAAI,CAAC9B,OAAO,OAAO;IACnB,MAAME,MAAMpB,cACV,GAAGD,mBAAmBmB,MAAM,CAAC,EAAEF,QAAQ,CAACA,SAASF,MAAM,GAAG,EAAE,EAAE;IAEhE,OAAOM,MAAM;QAAEF,OAAOE,IAAIF,KAAK;QAAEG,SAASD,IAAIC,OAAO;IAAC,IAAI;AAC5D;AAEA;;;;;CAKC,GACD,OAAO,SAAS4B,iBACdrB,MAAe,EACfsB,OAA6B;IAE7B,MAAMC,SAASxB,qBAAqBC;IACpC,IAAIuB,OAAOlC,IAAI,KAAK,SAAS;QAC3B,OAAO;YAAEC,OAAOiC,OAAOjC,KAAK;YAAEG,SAAS8B,OAAO9B,OAAO;QAAC;IACxD;IACA,IAAI8B,OAAOlC,IAAI,KAAK,kBAAkB,OAAO;IAC7C,IAAIiC,CAAAA,2BAAAA,QAASV,MAAM,MAAKlC,aAAa6C,OAAOX,MAAM,KAAKU,QAAQV,MAAM,EAAE;QACrE,OAAO;IACT;IACA,OAAOI,uBAAuBO,OAAOV,UAAU;AACjD;AAEA;;;CAGC,GACD,OAAO,SAASW,qBAAqBC,CAAS,EAAEC,CAAS;IACvD,MAAMC,UAAU,CAACrC,QACfA,MAAMY,UAAU,CAAC,UAAU,CAAC,IAAI,EAAEZ,MAAML,KAAK,CAAC,GAAGE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAGG;IACrE,OAAOqC,QAAQF,OAAOE,QAAQD;AAChC"}

package/src/lib/app-utils/palette-sx.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Substitutes palette `var()` references in one string. Returns the same
+ * string (identity) when there is nothing to substitute, so callers can
+ * cheaply tell an untouched value from a rewritten one. A reference whose
+ * token the palette does not define collapses to its literal fallback —
+ * never left as a `var()` that an ancestor provider could hijack.
+ */
+export declare function resolvePaletteVars(value: string, palette: Record<string, unknown> | undefined): string;
+/**
+ * Walks an sx value substituting palette `var()` references against the
+ * active theme's palette. Arrays resolve per entry, theme callbacks are
+ * wrapped, nested objects (breakpoint slices, pseudo selectors, custom
+ * CSS) resolve recursively, and the input is never mutated. Values with no
+ * palette reference come back by identity, so an sx that uses none is not
+ * reallocated.
+ */
+export declare function resolvePaletteVarsSx<T>(sx: T, palette: Record<string, unknown> | undefined): T;
+export default resolvePaletteVarsSx;

package/src/lib/app-utils/palette-sx.js

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // Subpath, NOT the `@aglyn/shared-data-enums` barrel — see the note on the
+// same import in `merge-node-sx.ts` (AGL-2486). The barrel reaches
+// `firebase/auth`; this file wants the palette-token readers, and takes them
+// from the module that holds only those rather than from `lib/styles`, which
+// re-exports them alongside the unit enum and the gradient model.
+import { channelCssVarNameToPaletteToken, cssColorToChannel, cssVarNameToPaletteToken } from "@aglyn/shared-data-enums/palette-token-css-var";
+/**
+ * Palette-token references inside sx STRING values (AGL-1331).
+ *
+ * MUI resolves palette token paths for the handful of sx properties it
+ * declares with `themeKey: 'palette'` — `color`, `bgcolor`,
+ * `backgroundColor`, `borderColor`. Everything else, `backgroundImage`
+ * included, reaches CSS verbatim. So a gradient stop bound to a theme
+ * token cannot be written as `primary.main`: it has to be a value CSS
+ * itself understands.
+ *
+ * The Background Fill field therefore persists token stops as
+ * `var(--mui-palette-primary-main, #00B0FF)`, and this pass substitutes
+ * the ACTIVE theme's palette value before the sx reaches emotion. Two
+ * reasons it resolves here rather than leaving the `var()` to the browser:
+ *
+ * 1. Sites build their theme with `createResponsiveTheme` (plain
+ *    `createTheme`, no `cssVariables`), so `--mui-palette-*` is not defined
+ *    on the tenant at all — the browser would fall back to the literal and
+ *    a later palette change would never reach the gradient.
+ * 2. On the canvas the opposite hazard: the besigner runs INSIDE the
+ *    console's `CssVarsProvider`, which DOES define `--mui-palette-*` — the
+ *    console's own brand colours. An unresolved `var()` would paint the
+ *    console's primary into the site's gradient.
+ *
+ * Substituting from the site theme's palette is correct in both places, and
+ * it makes scheme adaptation free: the leaf resolves against the theme that
+ * is already light or dark, so a token stop behaves exactly like
+ * `backgroundColor: 'primary.main'` does.
+ *
+ * The literal fallback is never wasted work — it is what renders if this
+ * pass is ever skipped, so the failure mode of the whole feature is a
+ * slightly stale colour rather than a dropped declaration.
+ *
+ * AGL-2486 extends the same mechanism to ALPHA. `rgba(…)` cannot take a
+ * colour, only channels, so "primary.main at 12%" persists as
+ * `rgba(var(--mui-palette-primary-mainChannel, 31 41 55) / 0.12)` and this
+ * pass derives the triplet from the palette colour — see
+ * {@link readPaletteVarValue}. Flattening to `rgba(31, 41, 55, 0.12)` at
+ * author time would have been simpler and wrong: the value stops being a
+ * token, so a white-label palette swap silently keeps the old brand colour.
+ */ /**
+ * Matches one `var(--mui-palette-…[, fallback])` reference. The fallback
+ * group allows ONE level of nesting so an `rgb(…)`/`rgba(…)` fallback — what
+ * the colour picker emits for a token whose palette entry is not a hex —
+ * is captured whole rather than truncated at its first `)`.
+ */ const PALETTE_VAR_PATTERN = /var\(\s*(--mui-palette-[a-z0-9-]+)\s*(?:,((?:[^()]|\([^()]*\))*))?\)/gi;
+const isPlainObject = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+/** Resolves a dot path into a palette object to its colour string. */ function readPaletteToken(palette, path) {
+    if (!palette) return undefined;
+    const resolved = path.split('.').reduce((node, key)=>node && typeof node === 'object' ? node[key] : undefined, palette);
+    return typeof resolved === 'string' ? resolved : undefined;
+}
+/**
+ * What one `--mui-palette-…` custom property stands for in this palette.
+ *
+ * Two shapes, because MUI publishes two (AGL-2486):
+ *
+ * - `--mui-palette-primary-main` — the colour itself.
+ * - `--mui-palette-primary-mainChannel` — its `31 41 55` RGB triplet, which
+ *   is how alpha is applied to a TOKEN rather than to a flattened literal:
+ *   `rgba(var(--mui-palette-primary-mainChannel) / 0.12)`. That is the whole
+ *   point of the channel form, and it is what the styles panel's opacity
+ *   control persists.
+ *
+ * The direct read comes first so a theme that really does define channel
+ * entries (anything built through `CssVarsProvider`) wins with its own
+ * values. `createResponsiveTheme` is plain `createTheme` and defines none, so
+ * for every Aglyn site the triplet is DERIVED here from the colour the token
+ * resolves to — which is exactly what keeps an alpha'd token following the
+ * palette instead of freezing the colour it had on the day it was authored.
+ */ function readPaletteVarValue(name, palette) {
+    const path = cssVarNameToPaletteToken(name);
+    const direct = path ? readPaletteToken(palette, path) : undefined;
+    if (direct) return direct;
+    const channelPath = channelCssVarNameToPaletteToken(name);
+    if (!channelPath) return undefined;
+    const color = readPaletteToken(palette, channelPath);
+    return color ? cssColorToChannel(color) : undefined;
+}
+/**
+ * Substitutes palette `var()` references in one string. Returns the same
+ * string (identity) when there is nothing to substitute, so callers can
+ * cheaply tell an untouched value from a rewritten one. A reference whose
+ * token the palette does not define collapses to its literal fallback —
+ * never left as a `var()` that an ancestor provider could hijack.
+ */ export function resolvePaletteVars(value, palette) {
+    if (!value.includes('--mui-palette-')) return value;
+    return value.replace(PALETTE_VAR_PATTERN, (match, name, fallback)=>{
+        const resolved = readPaletteVarValue(name, palette);
+        if (resolved) return resolved;
+        const literal = (fallback != null ? fallback : '').trim();
+        return literal || match;
+    });
+}
+/**
+ * Walks an sx value substituting palette `var()` references against the
+ * active theme's palette. Arrays resolve per entry, theme callbacks are
+ * wrapped, nested objects (breakpoint slices, pseudo selectors, custom
+ * CSS) resolve recursively, and the input is never mutated. Values with no
+ * palette reference come back by identity, so an sx that uses none is not
+ * reallocated.
+ */ export function resolvePaletteVarsSx(sx, palette) {
+    if (typeof sx === 'string') return resolvePaletteVars(sx, palette);
+    if (Array.isArray(sx)) {
+        let changed = false;
+        const next = sx.map((entry)=>{
+            const resolved = resolvePaletteVarsSx(entry, palette);
+            if (resolved !== entry) changed = true;
+            return resolved;
+        });
+        return changed ? next : sx;
+    }
+    if (typeof sx === 'function') {
+        const callback = sx;
+        return (...args)=>resolvePaletteVarsSx(callback(...args), palette);
+    }
+    if (!isPlainObject(sx)) return sx;
+    let changed = false;
+    const out = {};
+    for (const [key, value] of Object.entries(sx)){
+        const resolved = resolvePaletteVarsSx(value, palette);
+        if (resolved !== value) changed = true;
+        out[key] = resolved;
+    }
+    return changed ? out : sx;
+}
+export default resolvePaletteVarsSx;
+
+//# sourceMappingURL=palette-sx.js.map

package/src/lib/app-utils/palette-sx.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/palette-sx.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Subpath, NOT the `@aglyn/shared-data-enums` barrel — see the note on the\n// same import in `merge-node-sx.ts` (AGL-2486). The barrel reaches\n// `firebase/auth`; this file wants the palette-token readers, and takes them\n// from the module that holds only those rather than from `lib/styles`, which\n// re-exports them alongside the unit enum and the gradient model.\nimport {\n  channelCssVarNameToPaletteToken,\n  cssColorToChannel,\n  cssVarNameToPaletteToken,\n} from '@aglyn/shared-data-enums/palette-token-css-var'\n\n/**\n * Palette-token references inside sx STRING values (AGL-1331).\n *\n * MUI resolves palette token paths for the handful of sx properties it\n * declares with `themeKey: 'palette'` — `color`, `bgcolor`,\n * `backgroundColor`, `borderColor`. Everything else, `backgroundImage`\n * included, reaches CSS verbatim. So a gradient stop bound to a theme\n * token cannot be written as `primary.main`: it has to be a value CSS\n * itself understands.\n *\n * The Background Fill field therefore persists token stops as\n * `var(--mui-palette-primary-main, #00B0FF)`, and this pass substitutes\n * the ACTIVE theme's palette value before the sx reaches emotion. Two\n * reasons it resolves here rather than leaving the `var()` to the browser:\n *\n * 1. Sites build their theme with `createResponsiveTheme` (plain\n *    `createTheme`, no `cssVariables`), so `--mui-palette-*` is not defined\n *    on the tenant at all — the browser would fall back to the literal and\n *    a later palette change would never reach the gradient.\n * 2. On the canvas the opposite hazard: the besigner runs INSIDE the\n *    console's `CssVarsProvider`, which DOES define `--mui-palette-*` — the\n *    console's own brand colours. An unresolved `var()` would paint the\n *    console's primary into the site's gradient.\n *\n * Substituting from the site theme's palette is correct in both places, and\n * it makes scheme adaptation free: the leaf resolves against the theme that\n * is already light or dark, so a token stop behaves exactly like\n * `backgroundColor: 'primary.main'` does.\n *\n * The literal fallback is never wasted work — it is what renders if this\n * pass is ever skipped, so the failure mode of the whole feature is a\n * slightly stale colour rather than a dropped declaration.\n *\n * AGL-2486 extends the same mechanism to ALPHA. `rgba(…)` cannot take a\n * colour, only channels, so \"primary.main at 12%\" persists as\n * `rgba(var(--mui-palette-primary-mainChannel, 31 41 55) / 0.12)` and this\n * pass derives the triplet from the palette colour — see\n * {@link readPaletteVarValue}. Flattening to `rgba(31, 41, 55, 0.12)` at\n * author time would have been simpler and wrong: the value stops being a\n * token, so a white-label palette swap silently keeps the old brand colour.\n */\n\n/**\n * Matches one `var(--mui-palette-…[, fallback])` reference. The fallback\n * group allows ONE level of nesting so an `rgb(…)`/`rgba(…)` fallback — what\n * the colour picker emits for a token whose palette entry is not a hex —\n * is captured whole rather than truncated at its first `)`.\n */\nconst PALETTE_VAR_PATTERN =\n  /var\\(\\s*(--mui-palette-[a-z0-9-]+)\\s*(?:,((?:[^()]|\\([^()]*\\))*))?\\)/gi\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/** Resolves a dot path into a palette object to its colour string. */\nfunction readPaletteToken(\n  palette: Record<string, unknown> | undefined,\n  path: string,\n): string | undefined {\n  if (!palette) return undefined\n  const resolved = path\n    .split('.')\n    .reduce<unknown>(\n      (node, key) =>\n        node && typeof node === 'object'\n          ? (node as Record<string, unknown>)[key]\n          : undefined,\n      palette,\n    )\n  return typeof resolved === 'string' ? resolved : undefined\n}\n\n/**\n * What one `--mui-palette-…` custom property stands for in this palette.\n *\n * Two shapes, because MUI publishes two (AGL-2486):\n *\n * - `--mui-palette-primary-main` — the colour itself.\n * - `--mui-palette-primary-mainChannel` — its `31 41 55` RGB triplet, which\n *   is how alpha is applied to a TOKEN rather than to a flattened literal:\n *   `rgba(var(--mui-palette-primary-mainChannel) / 0.12)`. That is the whole\n *   point of the channel form, and it is what the styles panel's opacity\n *   control persists.\n *\n * The direct read comes first so a theme that really does define channel\n * entries (anything built through `CssVarsProvider`) wins with its own\n * values. `createResponsiveTheme` is plain `createTheme` and defines none, so\n * for every Aglyn site the triplet is DERIVED here from the colour the token\n * resolves to — which is exactly what keeps an alpha'd token following the\n * palette instead of freezing the colour it had on the day it was authored.\n */\nfunction readPaletteVarValue(\n  name: string,\n  palette: Record<string, unknown> | undefined,\n): string | undefined {\n  const path = cssVarNameToPaletteToken(name)\n  const direct = path ? readPaletteToken(palette, path) : undefined\n  if (direct) return direct\n  const channelPath = channelCssVarNameToPaletteToken(name)\n  if (!channelPath) return undefined\n  const color = readPaletteToken(palette, channelPath)\n  return color ? cssColorToChannel(color) : undefined\n}\n\n/**\n * Substitutes palette `var()` references in one string. Returns the same\n * string (identity) when there is nothing to substitute, so callers can\n * cheaply tell an untouched value from a rewritten one. A reference whose\n * token the palette does not define collapses to its literal fallback —\n * never left as a `var()` that an ancestor provider could hijack.\n */\nexport function resolvePaletteVars(\n  value: string,\n  palette: Record<string, unknown> | undefined,\n): string {\n  if (!value.includes('--mui-palette-')) return value\n  return value.replace(\n    PALETTE_VAR_PATTERN,\n    (match, name: string, fallback?: string) => {\n      const resolved = readPaletteVarValue(name, palette)\n      if (resolved) return resolved\n      const literal = (fallback ?? '').trim()\n      return literal || match\n    },\n  )\n}\n\n/**\n * Walks an sx value substituting palette `var()` references against the\n * active theme's palette. Arrays resolve per entry, theme callbacks are\n * wrapped, nested objects (breakpoint slices, pseudo selectors, custom\n * CSS) resolve recursively, and the input is never mutated. Values with no\n * palette reference come back by identity, so an sx that uses none is not\n * reallocated.\n */\nexport function resolvePaletteVarsSx<T>(\n  sx: T,\n  palette: Record<string, unknown> | undefined,\n): T {\n  if (typeof sx === 'string') return resolvePaletteVars(sx, palette) as T\n  if (Array.isArray(sx)) {\n    let changed = false\n    const next = sx.map((entry) => {\n      const resolved = resolvePaletteVarsSx(entry, palette)\n      if (resolved !== entry) changed = true\n      return resolved\n    })\n    return (changed ? next : sx) as T\n  }\n  if (typeof sx === 'function') {\n    const callback = sx as (...args: unknown[]) => unknown\n    return ((...args: unknown[]) =>\n      resolvePaletteVarsSx(callback(...args), palette)) as T\n  }\n  if (!isPlainObject(sx)) return sx\n\n  let changed = false\n  const out: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(sx)) {\n    const resolved = resolvePaletteVarsSx(value, palette)\n    if (resolved !== value) changed = true\n    out[key] = resolved\n  }\n  return (changed ? out : sx) as T\n}\n\nexport default resolvePaletteVarsSx\n"],"names":["channelCssVarNameToPaletteToken","cssColorToChannel","cssVarNameToPaletteToken","PALETTE_VAR_PATTERN","isPlainObject","value","Array","isArray","readPaletteToken","palette","path","undefined","resolved","split","reduce","node","key","readPaletteVarValue","name","direct","channelPath","color","resolvePaletteVars","includes","replace","match","fallback","literal","trim","resolvePaletteVarsSx","sx","changed","next","map","entry","callback","args","out","Object","entries"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;AAClE,SACEA,+BAA+B,EAC/BC,iBAAiB,EACjBC,wBAAwB,QACnB,iDAAgD;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GAED;;;;;CAKC,GACD,MAAMC,sBACJ;AAEF,MAAMC,gBAAgB,CAACC,QACrB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACC,MAAMC,OAAO,CAACF;AAEhE,oEAAoE,GACpE,SAASG,iBACPC,OAA4C,EAC5CC,IAAY;IAEZ,IAAI,CAACD,SAAS,OAAOE;IACrB,MAAMC,WAAWF,KACdG,KAAK,CAAC,KACNC,MAAM,CACL,CAACC,MAAMC,MACLD,QAAQ,OAAOA,SAAS,WACpB,AAACA,IAAgC,CAACC,IAAI,GACtCL,WACNF;IAEJ,OAAO,OAAOG,aAAa,WAAWA,WAAWD;AACnD;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,SAASM,oBACPC,IAAY,EACZT,OAA4C;IAE5C,MAAMC,OAAOR,yBAAyBgB;IACtC,MAAMC,SAAST,OAAOF,iBAAiBC,SAASC,QAAQC;IACxD,IAAIQ,QAAQ,OAAOA;IACnB,MAAMC,cAAcpB,gCAAgCkB;IACpD,IAAI,CAACE,aAAa,OAAOT;IACzB,MAAMU,QAAQb,iBAAiBC,SAASW;IACxC,OAAOC,QAAQpB,kBAAkBoB,SAASV;AAC5C;AAEA;;;;;;CAMC,GACD,OAAO,SAASW,mBACdjB,KAAa,EACbI,OAA4C;IAE5C,IAAI,CAACJ,MAAMkB,QAAQ,CAAC,mBAAmB,OAAOlB;IAC9C,OAAOA,MAAMmB,OAAO,CAClBrB,qBACA,CAACsB,OAAOP,MAAcQ;QACpB,MAAMd,WAAWK,oBAAoBC,MAAMT;QAC3C,IAAIG,UAAU,OAAOA;QACrB,MAAMe,UAAU,CAACD,mBAAAA,WAAY,IAAIE,IAAI;QACrC,OAAOD,WAAWF;IACpB;AAEJ;AAEA;;;;;;;CAOC,GACD,OAAO,SAASI,qBACdC,EAAK,EACLrB,OAA4C;IAE5C,IAAI,OAAOqB,OAAO,UAAU,OAAOR,mBAAmBQ,IAAIrB;IAC1D,IAAIH,MAAMC,OAAO,CAACuB,KAAK;QACrB,IAAIC,UAAU;QACd,MAAMC,OAAOF,GAAGG,GAAG,CAAC,CAACC;YACnB,MAAMtB,WAAWiB,qBAAqBK,OAAOzB;YAC7C,IAAIG,aAAasB,OAAOH,UAAU;YAClC,OAAOnB;QACT;QACA,OAAQmB,UAAUC,OAAOF;IAC3B;IACA,IAAI,OAAOA,OAAO,YAAY;QAC5B,MAAMK,WAAWL;QACjB,OAAQ,CAAC,GAAGM,OACVP,qBAAqBM,YAAYC,OAAO3B;IAC5C;IACA,IAAI,CAACL,cAAc0B,KAAK,OAAOA;IAE/B,IAAIC,UAAU;IACd,MAAMM,MAA+B,CAAC;IACtC,KAAK,MAAM,CAACrB,KAAKX,MAAM,IAAIiC,OAAOC,OAAO,CAACT,IAAK;QAC7C,MAAMlB,WAAWiB,qBAAqBxB,OAAOI;QAC7C,IAAIG,aAAaP,OAAO0B,UAAU;QAClCM,GAAG,CAACrB,IAAI,GAAGJ;IACb;IACA,OAAQmB,UAAUM,MAAMP;AAC1B;AAEA,eAAeD,qBAAoB"}

package/src/lib/app-utils/password-policy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Rules for a password an ADMIN chooses on somebody else's behalf
+ * (AGL-910). Pure and dependency-free so all three surfaces agree: the
+ * console form checks it before a round trip, the Firebase Auth endpoints
+ * check it again, and the site-member handler — which lives in the commerce
+ * plugin and shares nothing else with them — checks the same thing.
+ *
+ * Not the policy for passwords people choose for THEMSELVES. This one is
+ * stricter on length because the credential is handed over out of band
+ * (read aloud, pasted into a ticket) and is meant to be replaced.
+ */
+/** Firebase Auth's own floor is 6; a third party has seen this one. */
+export declare const PASSWORD_MIN_LENGTH = 12;
+export declare const PASSWORD_MAX_LENGTH = 128;
+export interface PasswordValidation {
+    /** Message to show the admin, or null when the password is acceptable. */
+    error: string | null;
+    /** The coerced password. Only meaningful when `error` is null. */
+    password: string;
+}
+/**
+ * Deliberately shallow — length plus a couple of triviality traps. A
+ * composition rulebook (one upper, one digit, one symbol) pushes admins
+ * toward `Password1!` shapes without adding real strength; length is what
+ * carries here, and the credential is short-lived by design.
+ *
+ * A nullable `error` rather than an ok/error union: this crosses three
+ * project boundaries (console app, commerce plugin, tenant app) and
+ * discriminated-union narrowing did not survive the trip.
+ */
+export declare function validateNewPassword(raw: unknown): PasswordValidation;

package/src/lib/app-utils/password-policy.js

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Rules for a password an ADMIN chooses on somebody else's behalf
+ * (AGL-910). Pure and dependency-free so all three surfaces agree: the
+ * console form checks it before a round trip, the Firebase Auth endpoints
+ * check it again, and the site-member handler — which lives in the commerce
+ * plugin and shares nothing else with them — checks the same thing.
+ *
+ * Not the policy for passwords people choose for THEMSELVES. This one is
+ * stricter on length because the credential is handed over out of band
+ * (read aloud, pasted into a ticket) and is meant to be replaced.
+ */ /** Firebase Auth's own floor is 6; a third party has seen this one. */ export const PASSWORD_MIN_LENGTH = 12;
+export const PASSWORD_MAX_LENGTH = 128;
+/**
+ * Deliberately shallow — length plus a couple of triviality traps. A
+ * composition rulebook (one upper, one digit, one symbol) pushes admins
+ * toward `Password1!` shapes without adding real strength; length is what
+ * carries here, and the credential is short-lived by design.
+ *
+ * A nullable `error` rather than an ok/error union: this crosses three
+ * project boundaries (console app, commerce plugin, tenant app) and
+ * discriminated-union narrowing did not survive the trip.
+ */ export function validateNewPassword(raw) {
+    const password = String(raw != null ? raw : '');
+    const error = password.length < PASSWORD_MIN_LENGTH ? `Passwords must be at least ${PASSWORD_MIN_LENGTH} characters` : password.length > PASSWORD_MAX_LENGTH ? `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters` : password.trim() !== password ? 'Passwords cannot start or end with a space' : new Set(password).size < 5 ? 'That password is too repetitive' : null;
+    return {
+        error,
+        password
+    };
+}
+
+//# sourceMappingURL=password-policy.js.map

package/src/lib/app-utils/password-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/password-policy.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Rules for a password an ADMIN chooses on somebody else's behalf\n * (AGL-910). Pure and dependency-free so all three surfaces agree: the\n * console form checks it before a round trip, the Firebase Auth endpoints\n * check it again, and the site-member handler — which lives in the commerce\n * plugin and shares nothing else with them — checks the same thing.\n *\n * Not the policy for passwords people choose for THEMSELVES. This one is\n * stricter on length because the credential is handed over out of band\n * (read aloud, pasted into a ticket) and is meant to be replaced.\n */\n\n/** Firebase Auth's own floor is 6; a third party has seen this one. */\nexport const PASSWORD_MIN_LENGTH = 12\nexport const PASSWORD_MAX_LENGTH = 128\n\nexport interface PasswordValidation {\n  /** Message to show the admin, or null when the password is acceptable. */\n  error: string | null\n  /** The coerced password. Only meaningful when `error` is null. */\n  password: string\n}\n\n/**\n * Deliberately shallow — length plus a couple of triviality traps. A\n * composition rulebook (one upper, one digit, one symbol) pushes admins\n * toward `Password1!` shapes without adding real strength; length is what\n * carries here, and the credential is short-lived by design.\n *\n * A nullable `error` rather than an ok/error union: this crosses three\n * project boundaries (console app, commerce plugin, tenant app) and\n * discriminated-union narrowing did not survive the trip.\n */\nexport function validateNewPassword(raw: unknown): PasswordValidation {\n  const password = String(raw ?? '')\n  const error =\n    password.length < PASSWORD_MIN_LENGTH\n      ? `Passwords must be at least ${PASSWORD_MIN_LENGTH} characters`\n      : password.length > PASSWORD_MAX_LENGTH\n        ? `Passwords can be at most ${PASSWORD_MAX_LENGTH} characters`\n        : password.trim() !== password\n          ? 'Passwords cannot start or end with a space'\n          : new Set(password).size < 5\n            ? 'That password is too repetitive'\n            : null\n  return { error, password }\n}\n"],"names":["PASSWORD_MIN_LENGTH","PASSWORD_MAX_LENGTH","validateNewPassword","raw","password","String","error","length","trim","Set","size"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;CAUC,GAED,qEAAqE,GACrE,OAAO,MAAMA,sBAAsB,GAAE;AACrC,OAAO,MAAMC,sBAAsB,IAAG;AAStC;;;;;;;;;CASC,GACD,OAAO,SAASC,oBAAoBC,GAAY;IAC9C,MAAMC,WAAWC,OAAOF,cAAAA,MAAO;IAC/B,MAAMG,QACJF,SAASG,MAAM,GAAGP,sBACd,CAAC,2BAA2B,EAAEA,oBAAoB,WAAW,CAAC,GAC9DI,SAASG,MAAM,GAAGN,sBAChB,CAAC,yBAAyB,EAAEA,oBAAoB,WAAW,CAAC,GAC5DG,SAASI,IAAI,OAAOJ,WAClB,+CACA,IAAIK,IAAIL,UAAUM,IAAI,GAAG,IACvB,oCACA;IACZ,OAAO;QAAEJ;QAAOF;IAAS;AAC3B"}

package/src/lib/app-utils/payments-configured.d.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * "Not configured" is not "failed" (AGL-2019).
+ *
+ * Every money door in this codebase answers `501` when the deployment has no
+ * Stripe key — server-side that is already correct and uniform. The defect was
+ * entirely on the client: the storefront cart had a `423` lockdown branch and
+ * no `501` branch, so an unconfigured-payments refusal fell through to the
+ * generic error tail and rendered as `<Alert severity="error">`. A shopper on a
+ * self-hosted store clicked **Checkout** and was shown a RED alert — which says
+ * *your payment failed* — for a store that had simply never been set up to take
+ * payments. Nothing failed. Nothing was even attempted.
+ *
+ * This is the same argument `lockdown.ts` makes for its `423`: a refusal that is
+ * not a failure needs its own state, not an error with gentler words, because
+ * the severity is read before the sentence is. The three states are distinct and
+ * must stay distinct:
+ *
+ *   423  paused      the operator switched writes off       — info
+ *   501  unconfigured this deployment never had payments    — info
+ *   4xx/5xx error     something was tried and went wrong    — error
+ *
+ * The copy is deliberately split by AUDIENCE, and that split is the reason this
+ * module exists rather than a bare status check at each call site:
+ *
+ *  - A STOREFRONT VISITOR is a stranger on someone else's site. They get a
+ *    neutral sentence about the store and NOTHING about the cause. Naming an
+ *    environment variable to a shopper leaks the operator's deployment shape to
+ *    the public internet, and there is nothing they could do with it anyway.
+ *  - A CONSOLE OPERATOR is the person who can fix it, so they are told what to
+ *    set. They also get `PLATFORM_BRAND_NAME`, because on a self-host install
+ *    the product is not called Aglyn.
+ */
+/**
+ * The status a server uses to say "this deployment has no payments configured".
+ * Named so a call site reads as a concept rather than as a magic number.
+ */
+export declare const PAYMENTS_NOT_CONFIGURED_STATUS = 501;
+/**
+ * Is this response the not-configured refusal rather than a failure?
+ *
+ * Deliberately a status-only test. The 501 bodies across commerce and
+ * marketplace do not share a machine-readable discriminator — some say
+ * "Purchases are not configured on this site.", others "Payments are not
+ * configured." — and matching on prose would break the moment one is reworded.
+ * The status is the contract.
+ */
+export declare function isPaymentsNotConfigured(status: number | null | undefined): status is 501;
+/**
+ * What a STOREFRONT VISITOR is shown. No cause, no variable names, no mention
+ * of the platform — from the shopper's side this is a fact about the store.
+ *
+ * Present tense and permanent-sounding on purpose: "right now" or "temporarily"
+ * would imply a transient outage and invite a retry that cannot succeed.
+ */
+export declare function storefrontPaymentsNotConfiguredText(): string;
+/**
+ * What a CONSOLE OPERATOR is shown. They can act, so they are told how.
+ *
+ * `PLATFORM_BRAND_NAME` rather than a literal: a self-hoster who renamed the
+ * product should not read our name in an explanation of their own deployment.
+ */
+export declare function operatorPaymentsNotConfiguredText(): string;
+/**
+ * The marketplace's own sentence. Browsing works without Stripe; only the
+ * money doors do not — so this says what still works, rather than presenting a
+ * whole feature as broken.
+ */
+export declare function operatorMarketplaceNotConfiguredText(): string;