@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/platform-advertising-tags.js

@@ -0,0 +1,203 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Which advertising tags may load on AGLYN'S OWN NON-TENANT SURFACES — the
+ * console (`app.aglyn.com`, `auth.aglyn.com`) and the docs site
+ * (`docs.aglyn.com`).
+ *
+ * ## Why this exists beside `advertising-tags.ts` rather than inside it
+ *
+ * {@link resolveAdvertisingTags} answers the same question for a TENANT page,
+ * and every one of its inputs is a host document: the surface discriminator is
+ * `isPlatformMarketingHost`, the configuration is `analytics.adTags`, and the
+ * consent record is keyed per host id. None of those exist here. The console
+ * and the docs are not sites anybody published; they are Aglyn's own
+ * properties, so their ids come from build configuration and their consent
+ * comes from the platform record.
+ *
+ * What is deliberately NOT duplicated is the vendor registry. Both resolvers
+ * read {@link ADVERTISING_VENDORS}, so a vendor is described — loaded, torn
+ * down, and its cookies named — exactly once. A second registry is how a
+ * vendor comes to be revocable on one surface and resident forever on
+ * another.
+ *
+ * ## Configuration, and why nothing is hardcoded
+ *
+ * ⛔ No default id, for any vendor. `analyticsMayEmit()` is true for ANY
+ * production build, self-hosted ones included, so a hardcoded pixel id would
+ * have every operator's console building retargeting audiences in Aglyn's ad
+ * accounts out of their users. Unset means unset and nothing loads — the same
+ * rule `platform-ad-conversions.ts` and the docs site's `DOCS_*` values are
+ * built on, and the one this file follows rather than reinvents.
+ *
+ * A self-host operator's own advertising tags are their business: setting
+ * these variables to their own ids is how they run them, and leaving them
+ * unset is how they run none.
+ *
+ * ⚠️ `process.env.NAME` is inlined at BUILD time by Next and never the bracket
+ * form, so every read below is written out literally. They are fixed when the
+ * image is built rather than when it starts; changing ad accounts is a
+ * rebuild.
+ */ import { ADVERTISING_VENDORS } from "./advertising-tags.js";
+import { analyticsEnvironmentForcesInternal, analyticsMayEmit, readAnalyticsEnvironment } from "./analytics-environment.js";
+import { readInternalTrafficOverride } from "./internal-traffic.js";
+import { GTM_CONTAINER_ID_PATTERN } from "./visitor-consent.js";
+/**
+ * The build-configured account id for each vendor this surface can mount,
+ * keyed by {@link AdvertisingVendor.id}.
+ *
+ * Read at CALL time rather than captured in a module constant, so a spec can
+ * drive every branch — the alternative is a constant that can only ever be
+ * observed in one state, which is the shape of a check that cannot fail.
+ * `readAnalyticsEnvironment` is written the same way and for the same reason.
+ */ export function readPlatformAdTagIds() {
+    return {
+        meta: process.env.NEXT_PUBLIC_META_PIXEL_ID || '',
+        // The SAME variable the conversion reporter reads. One `AW-` account id
+        // per deployment: a build that fired conversions into one advertiser and
+        // built audiences in another would split a funnel that has to be joined,
+        // and the second variable is the one that would go stale.
+        'google-ads': process.env.NEXT_PUBLIC_ADS_CONVERSION_ID || '',
+        linkedin: process.env.NEXT_PUBLIC_LINKEDIN_PARTNER_ID || ''
+    };
+}
+/** The build-configured Google Tag Manager container, or an empty string. */ export function readPlatformGtmContainerId() {
+    return process.env.NEXT_PUBLIC_GTM_CONTAINER_ID || '';
+}
+/**
+ * Which advertising tags may exist on this surface, for this visitor, right
+ * now.
+ *
+ * Pure, and empty is the answer to every question it cannot answer — a build
+ * that may not emit, a visitor who has not granted, an unconfigured vendor, a
+ * malformed id.
+ *
+ * `advertisingGranted` is PASSED IN rather than read here, and that is the
+ * whole of the arrangement this module is for. Each surface resolves consent
+ * through the machinery it already has — the console through
+ * `platformAdvertisingAllowed()` over its own posture-resolved record, the
+ * docs site through the registrable-domain mirror of that same record — and
+ * neither gets a second reading of a cookie from inside an analytics helper.
+ * One resolver per surface, asked by the mount rather than re-implemented in
+ * it.
+ *
+ * `analyticsMayEmit` is checked HERE and not left to the caller, because it is
+ * the one condition that is a property of the BUILD rather than of the
+ * visitor: `next dev` and any Vercel preview build resolve these ids exactly
+ * as production does, and without this a preview deploy would build real
+ * retargeting audiences out of our own engineers (AGL-2067).
+ */ export function resolvePlatformAdvertisingTags(advertisingGranted, ids = readPlatformAdTagIds(), env = readAnalyticsEnvironment(), internal = readInternalTrafficOverride()) {
+    if (advertisingGranted !== true) return [];
+    if (analyticsMayEmit(env) === false) return [];
+    // The same clause the tenant resolver calls condition 6 (AGL-3188), which
+    // this surface never had. A GA4 data filter is PROPERTY-scoped: it drops
+    // `traffic_type: internal` from the GA4 property and has no reach into an
+    // `AW-` destination, which is a separate product reached by separate
+    // requests. Measured on `auth.aglyn.com`: a pinned browser's pageview sent
+    // `tt=internal` to `g/collect` and, in the same document, an unmarked
+    // `ccm/collect` to `AW-18401436785`. Excluding ourselves from the reports
+    // while still training the bidding on ourselves is the worse half, because
+    // it is the half nobody can see in a report.
+    //
+    // Structural, not suppression: a resident tag fires on its own and the
+    // first automatic event writes a `_gcl_*` cookie, so the tag must not be
+    // MOUNTED rather than mounted and silenced.
+    if (internal === true) return [];
+    // A non-production build emitting because someone turned the hatch on is
+    // ours by definition, and must not hand a preview the real `AW-` id.
+    if (analyticsEnvironmentForcesInternal(env) === true) return [];
+    const tags = [];
+    for (const vendor of ADVERTISING_VENDORS){
+        var _ids_vendor_id;
+        // Sweep-only: nothing to mount, and no `accountIdPattern` to test with.
+        // Skipped explicitly rather than left to fail a pattern check, so a stray
+        // configured value cannot conjure a script.
+        if (vendor.sweepOnly || !vendor.accountIdPattern) continue;
+        const accountId = String((_ids_vendor_id = ids[vendor.id]) != null ? _ids_vendor_id : '');
+        // Strict format check, exactly as the tenant resolver applies: the id
+        // lands inside an inline script (the AGL-138 concern), and a half-set
+        // variable must read as absent rather than as an id.
+        if (vendor.accountIdPattern.test(accountId)) {
+            tags.push({
+                vendor,
+                accountId
+            });
+        }
+    }
+    return tags;
+}
+/**
+ * The Google Tag Manager container this surface may load, or null.
+ *
+ * ## Why the gate here is ANALYTICS and never advertising
+ *
+ * A container is not a tag — it is a LOADER, and what it loads is decided in
+ * Google's UI by whoever owns it, not here. The tenant runtime already settled
+ * the rule this follows: a container cannot have a WEAKER gate than GA,
+ * because it is the likeliest thing on a page to carry an advertising tag, and
+ * it cannot have a stronger one either or a container-only surface would never
+ * load at all. So it rides the analytics grant, and the advertising signals
+ * the visitor did or did not give reach its tags through Consent Mode v2 —
+ * which is why `PLATFORM_CONSENT_DEFAULT_COMMANDS` has to be declared before
+ * `gtm.js` is requested and not after.
+ *
+ * ⚠️ A container's CONTENTS are not visible from this repository, and what is
+ * in one is a disclosure obligation as much as a technical one: a tag added in
+ * Google's UI appears in no inventory here and no spec can see it. That is a
+ * reason to know what a container holds before configuring one on a surface,
+ * not a reason for this function to be looser.
+ *
+ * ⛔ NO `<noscript>` iframe accompanies this anywhere, deliberately, and it is
+ * the one piece of Google's standard snippet always omitted. That iframe fires
+ * the container with no JavaScript — so no consent defaults, no gate, nothing
+ * to suppress it. It is a consent bypass with a fallback's reputation. A
+ * visitor with JavaScript off gets no container, which is the correct answer.
+ */ export function resolvePlatformGtmContainerId(analyticsGranted, containerId = readPlatformGtmContainerId(), env = readAnalyticsEnvironment(), internal = readInternalTrafficOverride()) {
+    if (analyticsGranted !== true) return null;
+    if (analyticsMayEmit(env) === false) return null;
+    // The container takes the gate too (AGL-3188). What it loads is decided in
+    // Google's UI and is invisible to every spec here, so it has to be assumed
+    // to carry advertising tags — and a container's tags reach `AW-` and Meta
+    // destinations no GA4 filter can touch.
+    if (internal === true) return null;
+    if (analyticsEnvironmentForcesInternal(env) === true) return null;
+    const candidate = String(containerId != null ? containerId : '').trim();
+    // Strict format check, same reason as the account ids above: the container
+    // id lands inside an inline script.
+    return GTM_CONTAINER_ID_PATTERN.test(candidate) ? candidate : null;
+}
+/**
+ * The inline boot for a Google Tag Manager container.
+ *
+ * The consent-mode declaration is NOT part of this string. Every surface that
+ * calls it declares `PLATFORM_CONSENT_DEFAULT_COMMANDS` earlier and by its own
+ * route — the console pushes them onto `dataLayer` before the Firebase SDK
+ * boots gtag, the docs site emits them from its `ssrTemplate` ahead of every
+ * plugin tag — and re-declaring a default mid-page re-DENIES what the first
+ * one granted until an update lands. One declaration per document, made by
+ * whoever is first.
+ *
+ * The `gtag` shim is defined anyway, because it is cheap and because
+ * `dataLayer.push` of a plain array is the classic silent no-op if anything
+ * downstream reaches for the function form.
+ */ export function platformGtmBootSnippet() {
+    return 'window.dataLayer=window.dataLayer||[];' + 'function gtag(){dataLayer.push(arguments);}' + "dataLayer.push({'gtm.start':new Date().getTime(),event:'gtm.js'});";
+}
+/** The container library URL for `containerId`. */ export function platformGtmScriptSrc(containerId) {
+    return `https://www.googletagmanager.com/gtm.js?id=${containerId}`;
+}
+
+//# sourceMappingURL=platform-advertising-tags.js.map

package/src/lib/app-utils/platform-advertising-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/platform-advertising-tags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Which advertising tags may load on AGLYN'S OWN NON-TENANT SURFACES — the\n * console (`app.aglyn.com`, `auth.aglyn.com`) and the docs site\n * (`docs.aglyn.com`).\n *\n * ## Why this exists beside `advertising-tags.ts` rather than inside it\n *\n * {@link resolveAdvertisingTags} answers the same question for a TENANT page,\n * and every one of its inputs is a host document: the surface discriminator is\n * `isPlatformMarketingHost`, the configuration is `analytics.adTags`, and the\n * consent record is keyed per host id. None of those exist here. The console\n * and the docs are not sites anybody published; they are Aglyn's own\n * properties, so their ids come from build configuration and their consent\n * comes from the platform record.\n *\n * What is deliberately NOT duplicated is the vendor registry. Both resolvers\n * read {@link ADVERTISING_VENDORS}, so a vendor is described — loaded, torn\n * down, and its cookies named — exactly once. A second registry is how a\n * vendor comes to be revocable on one surface and resident forever on\n * another.\n *\n * ## Configuration, and why nothing is hardcoded\n *\n * ⛔ No default id, for any vendor. `analyticsMayEmit()` is true for ANY\n * production build, self-hosted ones included, so a hardcoded pixel id would\n * have every operator's console building retargeting audiences in Aglyn's ad\n * accounts out of their users. Unset means unset and nothing loads — the same\n * rule `platform-ad-conversions.ts` and the docs site's `DOCS_*` values are\n * built on, and the one this file follows rather than reinvents.\n *\n * A self-host operator's own advertising tags are their business: setting\n * these variables to their own ids is how they run them, and leaving them\n * unset is how they run none.\n *\n * ⚠️ `process.env.NAME` is inlined at BUILD time by Next and never the bracket\n * form, so every read below is written out literally. They are fixed when the\n * image is built rather than when it starts; changing ad accounts is a\n * rebuild.\n */\n\nimport {\n  ADVERTISING_VENDORS,\n  type ResolvedAdvertisingTag,\n} from './advertising-tags'\nimport {\n  analyticsEnvironmentForcesInternal,\n  analyticsMayEmit,\n  type AnalyticsEnvironment,\n  readAnalyticsEnvironment,\n} from './analytics-environment'\nimport { readInternalTrafficOverride } from './internal-traffic'\nimport { GTM_CONTAINER_ID_PATTERN } from './visitor-consent'\n\n/**\n * The build-configured account id for each vendor this surface can mount,\n * keyed by {@link AdvertisingVendor.id}.\n *\n * Read at CALL time rather than captured in a module constant, so a spec can\n * drive every branch — the alternative is a constant that can only ever be\n * observed in one state, which is the shape of a check that cannot fail.\n * `readAnalyticsEnvironment` is written the same way and for the same reason.\n */\nexport function readPlatformAdTagIds(): Record<string, string> {\n  return {\n    meta: process.env.NEXT_PUBLIC_META_PIXEL_ID || '',\n    // The SAME variable the conversion reporter reads. One `AW-` account id\n    // per deployment: a build that fired conversions into one advertiser and\n    // built audiences in another would split a funnel that has to be joined,\n    // and the second variable is the one that would go stale.\n    'google-ads': process.env.NEXT_PUBLIC_ADS_CONVERSION_ID || '',\n    linkedin: process.env.NEXT_PUBLIC_LINKEDIN_PARTNER_ID || '',\n  }\n}\n\n/** The build-configured Google Tag Manager container, or an empty string. */\nexport function readPlatformGtmContainerId(): string {\n  return process.env.NEXT_PUBLIC_GTM_CONTAINER_ID || ''\n}\n\n/**\n * Which advertising tags may exist on this surface, for this visitor, right\n * now.\n *\n * Pure, and empty is the answer to every question it cannot answer — a build\n * that may not emit, a visitor who has not granted, an unconfigured vendor, a\n * malformed id.\n *\n * `advertisingGranted` is PASSED IN rather than read here, and that is the\n * whole of the arrangement this module is for. Each surface resolves consent\n * through the machinery it already has — the console through\n * `platformAdvertisingAllowed()` over its own posture-resolved record, the\n * docs site through the registrable-domain mirror of that same record — and\n * neither gets a second reading of a cookie from inside an analytics helper.\n * One resolver per surface, asked by the mount rather than re-implemented in\n * it.\n *\n * `analyticsMayEmit` is checked HERE and not left to the caller, because it is\n * the one condition that is a property of the BUILD rather than of the\n * visitor: `next dev` and any Vercel preview build resolve these ids exactly\n * as production does, and without this a preview deploy would build real\n * retargeting audiences out of our own engineers (AGL-2067).\n */\nexport function resolvePlatformAdvertisingTags(\n  advertisingGranted: boolean,\n  ids: Record<string, string> = readPlatformAdTagIds(),\n  env: AnalyticsEnvironment = readAnalyticsEnvironment(),\n  internal: boolean = readInternalTrafficOverride(),\n): ResolvedAdvertisingTag[] {\n  if (advertisingGranted !== true) return []\n  if (analyticsMayEmit(env) === false) return []\n  // The same clause the tenant resolver calls condition 6 (AGL-3188), which\n  // this surface never had. A GA4 data filter is PROPERTY-scoped: it drops\n  // `traffic_type: internal` from the GA4 property and has no reach into an\n  // `AW-` destination, which is a separate product reached by separate\n  // requests. Measured on `auth.aglyn.com`: a pinned browser's pageview sent\n  // `tt=internal` to `g/collect` and, in the same document, an unmarked\n  // `ccm/collect` to `AW-18401436785`. Excluding ourselves from the reports\n  // while still training the bidding on ourselves is the worse half, because\n  // it is the half nobody can see in a report.\n  //\n  // Structural, not suppression: a resident tag fires on its own and the\n  // first automatic event writes a `_gcl_*` cookie, so the tag must not be\n  // MOUNTED rather than mounted and silenced.\n  if (internal === true) return []\n  // A non-production build emitting because someone turned the hatch on is\n  // ours by definition, and must not hand a preview the real `AW-` id.\n  if (analyticsEnvironmentForcesInternal(env) === true) return []\n  const tags: ResolvedAdvertisingTag[] = []\n  for (const vendor of ADVERTISING_VENDORS) {\n    // Sweep-only: nothing to mount, and no `accountIdPattern` to test with.\n    // Skipped explicitly rather than left to fail a pattern check, so a stray\n    // configured value cannot conjure a script.\n    if (vendor.sweepOnly || !vendor.accountIdPattern) continue\n    const accountId = String(ids[vendor.id] ?? '')\n    // Strict format check, exactly as the tenant resolver applies: the id\n    // lands inside an inline script (the AGL-138 concern), and a half-set\n    // variable must read as absent rather than as an id.\n    if (vendor.accountIdPattern.test(accountId)) {\n      tags.push({ vendor, accountId })\n    }\n  }\n  return tags\n}\n\n/**\n * The Google Tag Manager container this surface may load, or null.\n *\n * ## Why the gate here is ANALYTICS and never advertising\n *\n * A container is not a tag — it is a LOADER, and what it loads is decided in\n * Google's UI by whoever owns it, not here. The tenant runtime already settled\n * the rule this follows: a container cannot have a WEAKER gate than GA,\n * because it is the likeliest thing on a page to carry an advertising tag, and\n * it cannot have a stronger one either or a container-only surface would never\n * load at all. So it rides the analytics grant, and the advertising signals\n * the visitor did or did not give reach its tags through Consent Mode v2 —\n * which is why `PLATFORM_CONSENT_DEFAULT_COMMANDS` has to be declared before\n * `gtm.js` is requested and not after.\n *\n * ⚠️ A container's CONTENTS are not visible from this repository, and what is\n * in one is a disclosure obligation as much as a technical one: a tag added in\n * Google's UI appears in no inventory here and no spec can see it. That is a\n * reason to know what a container holds before configuring one on a surface,\n * not a reason for this function to be looser.\n *\n * ⛔ NO `<noscript>` iframe accompanies this anywhere, deliberately, and it is\n * the one piece of Google's standard snippet always omitted. That iframe fires\n * the container with no JavaScript — so no consent defaults, no gate, nothing\n * to suppress it. It is a consent bypass with a fallback's reputation. A\n * visitor with JavaScript off gets no container, which is the correct answer.\n */\nexport function resolvePlatformGtmContainerId(\n  analyticsGranted: boolean,\n  containerId: string = readPlatformGtmContainerId(),\n  env: AnalyticsEnvironment = readAnalyticsEnvironment(),\n  internal: boolean = readInternalTrafficOverride(),\n): string | null {\n  if (analyticsGranted !== true) return null\n  if (analyticsMayEmit(env) === false) return null\n  // The container takes the gate too (AGL-3188). What it loads is decided in\n  // Google's UI and is invisible to every spec here, so it has to be assumed\n  // to carry advertising tags — and a container's tags reach `AW-` and Meta\n  // destinations no GA4 filter can touch.\n  if (internal === true) return null\n  if (analyticsEnvironmentForcesInternal(env) === true) return null\n  const candidate = String(containerId ?? '').trim()\n  // Strict format check, same reason as the account ids above: the container\n  // id lands inside an inline script.\n  return GTM_CONTAINER_ID_PATTERN.test(candidate) ? candidate : null\n}\n\n/**\n * The inline boot for a Google Tag Manager container.\n *\n * The consent-mode declaration is NOT part of this string. Every surface that\n * calls it declares `PLATFORM_CONSENT_DEFAULT_COMMANDS` earlier and by its own\n * route — the console pushes them onto `dataLayer` before the Firebase SDK\n * boots gtag, the docs site emits them from its `ssrTemplate` ahead of every\n * plugin tag — and re-declaring a default mid-page re-DENIES what the first\n * one granted until an update lands. One declaration per document, made by\n * whoever is first.\n *\n * The `gtag` shim is defined anyway, because it is cheap and because\n * `dataLayer.push` of a plain array is the classic silent no-op if anything\n * downstream reaches for the function form.\n */\nexport function platformGtmBootSnippet(): string {\n  return (\n    'window.dataLayer=window.dataLayer||[];' +\n    'function gtag(){dataLayer.push(arguments);}' +\n    \"dataLayer.push({'gtm.start':new Date().getTime(),event:'gtm.js'});\"\n  )\n}\n\n/** The container library URL for `containerId`. */\nexport function platformGtmScriptSrc(containerId: string): string {\n  return `https://www.googletagmanager.com/gtm.js?id=${containerId}`\n}\n"],"names":["ADVERTISING_VENDORS","analyticsEnvironmentForcesInternal","analyticsMayEmit","readAnalyticsEnvironment","readInternalTrafficOverride","GTM_CONTAINER_ID_PATTERN","readPlatformAdTagIds","meta","process","env","NEXT_PUBLIC_META_PIXEL_ID","NEXT_PUBLIC_ADS_CONVERSION_ID","linkedin","NEXT_PUBLIC_LINKEDIN_PARTNER_ID","readPlatformGtmContainerId","NEXT_PUBLIC_GTM_CONTAINER_ID","resolvePlatformAdvertisingTags","advertisingGranted","ids","internal","tags","vendor","sweepOnly","accountIdPattern","accountId","String","id","test","push","resolvePlatformGtmContainerId","analyticsGranted","containerId","candidate","trim","platformGtmBootSnippet","platformGtmScriptSrc"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GAED,SACEA,mBAAmB,QAEd,wBAAoB;AAC3B,SACEC,kCAAkC,EAClCC,gBAAgB,EAEhBC,wBAAwB,QACnB,6BAAyB;AAChC,SAASC,2BAA2B,QAAQ,wBAAoB;AAChE,SAASC,wBAAwB,QAAQ,uBAAmB;AAE5D;;;;;;;;CAQC,GACD,OAAO,SAASC;IACd,OAAO;QACLC,MAAMC,QAAQC,GAAG,CAACC,yBAAyB,IAAI;QAC/C,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,0DAA0D;QAC1D,cAAcF,QAAQC,GAAG,CAACE,6BAA6B,IAAI;QAC3DC,UAAUJ,QAAQC,GAAG,CAACI,+BAA+B,IAAI;IAC3D;AACF;AAEA,2EAA2E,GAC3E,OAAO,SAASC;IACd,OAAON,QAAQC,GAAG,CAACM,4BAA4B,IAAI;AACrD;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASC,+BACdC,kBAA2B,EAC3BC,MAA8BZ,sBAAsB,EACpDG,MAA4BN,0BAA0B,EACtDgB,WAAoBf,6BAA6B;IAEjD,IAAIa,uBAAuB,MAAM,OAAO,EAAE;IAC1C,IAAIf,iBAAiBO,SAAS,OAAO,OAAO,EAAE;IAC9C,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,6CAA6C;IAC7C,EAAE;IACF,uEAAuE;IACvE,yEAAyE;IACzE,4CAA4C;IAC5C,IAAIU,aAAa,MAAM,OAAO,EAAE;IAChC,yEAAyE;IACzE,qEAAqE;IACrE,IAAIlB,mCAAmCQ,SAAS,MAAM,OAAO,EAAE;IAC/D,MAAMW,OAAiC,EAAE;IACzC,KAAK,MAAMC,UAAUrB,oBAAqB;YAKfkB;QAJzB,wEAAwE;QACxE,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAIG,OAAOC,SAAS,IAAI,CAACD,OAAOE,gBAAgB,EAAE;QAClD,MAAMC,YAAYC,QAAOP,iBAAAA,GAAG,CAACG,OAAOK,EAAE,CAAC,YAAdR,iBAAkB;QAC3C,sEAAsE;QACtE,sEAAsE;QACtE,qDAAqD;QACrD,IAAIG,OAAOE,gBAAgB,CAACI,IAAI,CAACH,YAAY;YAC3CJ,KAAKQ,IAAI,CAAC;gBAAEP;gBAAQG;YAAU;QAChC;IACF;IACA,OAAOJ;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASS,8BACdC,gBAAyB,EACzBC,cAAsBjB,4BAA4B,EAClDL,MAA4BN,0BAA0B,EACtDgB,WAAoBf,6BAA6B;IAEjD,IAAI0B,qBAAqB,MAAM,OAAO;IACtC,IAAI5B,iBAAiBO,SAAS,OAAO,OAAO;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,wCAAwC;IACxC,IAAIU,aAAa,MAAM,OAAO;IAC9B,IAAIlB,mCAAmCQ,SAAS,MAAM,OAAO;IAC7D,MAAMuB,YAAYP,OAAOM,sBAAAA,cAAe,IAAIE,IAAI;IAChD,2EAA2E;IAC3E,oCAAoC;IACpC,OAAO5B,yBAAyBsB,IAAI,CAACK,aAAaA,YAAY;AAChE;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASE;IACd,OACE,2CACA,gDACA;AAEJ;AAEA,iDAAiD,GACjD,OAAO,SAASC,qBAAqBJ,WAAmB;IACtD,OAAO,CAAC,2CAA2C,EAAEA,aAAa;AACpE"}

package/src/lib/app-utils/platform-brand.d.ts

@@ -0,0 +1,151 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The product name, as shown to end users.
+ *
+ * This is the browser-tab affix, the PWA name, the WebAuthn relying-party name
+ * the OS credential prompt displays, the `<meta name="generator">` and
+ * `x-powered-by` on published sites, and the platform default `productName` /
+ * `fromName` every non-white-label org's surfaces resolve to.
+ */
+export declare const PLATFORM_BRAND_NAME: string;
+/**
+ * The legal entity operating the software's own cloud, for copy that needs a
+ * company rather than a product (`BRAND.ORG_NAME_LEGAL`).
+ *
+ * NOT the same thing as `operatorIdentity().name`, and the distinction matters.
+ * This is a *brand* string with a visible default; that one is the identity a
+ * statutory notice is addressed to and refuses to default. An operator who
+ * sets only this has renamed the product, not published who they are.
+ */
+export declare const PLATFORM_BRAND_LEGAL_NAME: string;
+/**
+ * Where a "need help?" line points.
+ *
+ * Falls through the operator's OWN support address before it falls back to
+ * ours, deliberately: an operator who followed the runbook has already set
+ * `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, and making them discover a second
+ * variable to stop pointing their customers at Aglyn's support desk — which
+ * cannot help those customers with anything — is a trap dressed as a default.
+ *
+ * Read here rather than imported from `operator-identity.ts` so this module
+ * stays dependency-free and safe to import from anywhere, including the places
+ * that cannot take the operator module's weight.
+ */
+export declare const PLATFORM_SUPPORT_URL: string;
+/** True when this deployment still answers to Aglyn's own brand. */
+export declare const isAglynOperatedBrand: () => boolean;
+/**
+ * Where the platform's own front door is — the marketing home, not the help
+ * desk.
+ *
+ * ## Why this is not `PLATFORM_SUPPORT_URL`
+ *
+ * The "Made with …" badge on a published free-tier site used to link to
+ * `supportUrl`, and on this deployment `supportUrl` falls through to
+ * `mailto:` + the operator support address. So the one link the platform gets
+ * on every free customer's site — its only organic acquisition surface —
+ * opened the visitor's mail client addressed to our support desk. A visitor
+ * who liked the site and clicked to find out what built it got a blank email,
+ * and support got the misdirected replies.
+ *
+ * They are genuinely different destinations. `supportUrl` answers "I am a
+ * customer and something is wrong"; this answers "what is this, and can I have
+ * one". Keeping one value for both guarantees one of them is wrong.
+ *
+ * ## Why it is null rather than aglyn.com off-brand
+ *
+ * A self-hosted deployment that renamed the product but set no home URL has
+ * nowhere honest to send that visitor: "Made with Foo" pointing at aglyn.com
+ * advertises the wrong company on Foo's customers' sites. The badge already
+ * renders as a plain label when it has no destination (AGL-2428), which is the
+ * correct outcome — so the Aglyn default applies only while this really is the
+ * Aglyn-operated brand.
+ */
+export declare const PLATFORM_HOME_URL: string | null;
+/**
+ * The platform's own logo MARK — the compact, square, no-wordmark form — as a
+ * URL an `<img>` on a PUBLISHED SITE can load.
+ *
+ * Site-relative on purpose: every app that renders it serves
+ * `public/_static/…` from its own origin, so one path works on
+ * `{sub}.aglyn.app` and on a customer's custom domain alike without knowing
+ * either. The white variant is the one that survives the badge's dark pill and
+ * an org's `primaryColor` behind it.
+ *
+ * Null unless this is the Aglyn-operated brand, for the same reason as
+ * {@link PLATFORM_HOME_URL}: a renamed deployment must not stamp our mark on
+ * its customers' sites. Such an operator sets `NEXT_PUBLIC_PLATFORM_MARK_URL`
+ * to their own, or gets a text-only badge.
+ */
+export declare const PLATFORM_MARK_URL: string | null;
+/**
+ * A branding profile with every field present — what a branded surface
+ * renders. Image/color/domain fields are nullable (Aglyn's own surfaces
+ * bake those in rather than carry a URL); the remaining text fields always
+ * have a value so callers never string-concatenate `undefined`.
+ *
+ * `supportUrl` is nullable too, and it is the one field where null carries a
+ * decision rather than an absence — see {@link resolveBrandingProfile}. A
+ * caller must render NOTHING for it, never a placeholder and never a
+ * substitute.
+ */
+export interface ResolvedBrandingProfile {
+    productName: string;
+    logoUrl: string | null;
+    faviconUrl: string | null;
+    primaryColor: string | null;
+    supportUrl: string | null;
+    /**
+     * The brand's own FRONT DOOR — where "Made with <product>" sends a visitor
+     * who wants to know what built the site they are looking at.
+     *
+     * Deliberately separate from {@link ResolvedBrandingProfile.supportUrl},
+     * which the badge used to borrow: a help-desk address is the wrong answer to
+     * "what is this", and on this deployment it resolves to a `mailto:`, so the
+     * badge opened a blank email instead of a web page.
+     *
+     * Nullable for the same reason `supportUrl` is — a brand with nowhere to
+     * send that visitor gets a plain label, never a substitute destination.
+     */
+    homeUrl: string | null;
+    fromName: string;
+    emailLogoUrl: string | null;
+    customConsoleDomain: string | null;
+}
+/**
+ * The PLATFORM (non-white-label) brand — the fallback every surface gets when
+ * an org lacks the `whiteLabel` entitlement, and the gap-filler for a partial
+ * agency profile.
+ *
+ * It lives beside the literals it is assembled from rather than beside the
+ * entitlement gate that hands it out, and that placement is load-bearing
+ * rather than tidying. A published tenant page renders the attribution badge
+ * from this constant and reads nothing else out of `plan-entitlements.ts`;
+ * defining it there put that module's whole plan, quota and entitlement table
+ * — the single largest first-party module a visitor could reach — into the
+ * first load of every anonymous visitor to every customer site.
+ * `plan-entitlements.ts` re-exports it, so every existing caller is unchanged.
+ *
+ * The name says the PLATFORM's brand rather than Aglyn's because on a
+ * self-host install that assertion stops being true: which platform this is,
+ * is configuration. `resolveBrandingProfile` is the single resolver EVERY
+ * branded surface routes through — console chrome, published-site badge and
+ * title, transactional email — and this is its fallback, so all of them get a
+ * self-host brand without extending the white-label machinery at all.
+ */
+export declare const PLATFORM_BRANDING_PROFILE: ResolvedBrandingProfile;

package/src/lib/app-utils/platform-brand.js

@@ -0,0 +1,175 @@
+var _clean, _clean1, _clean2, _clean3;
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What this deployment calls itself (AGL-2153).
+ *
+ * the rule for the self-host path: *"the self hosted owner should not have
+ * to edit the source to update aglyn branded items urls or personal
+ * identification items, should move these to env vars"*. AGL-2016 did that for
+ * the values where getting it wrong misroutes a legal notice. This is the
+ * other half — the product name itself, which was a bare `'Aglyn'` literal in
+ * nine places.
+ *
+ * ## Why one module rather than nine reads
+ *
+ * The literals were not merely duplicated, they were duplicated across a
+ * boundary: `PLATFORM_GENERATOR_NAME` exists here AND as a hand-copied
+ * constant in `apps/tenant/middleware.ts`, because the edge bundle cannot
+ * import this lib. A single source they both read is what stops the copy from
+ * drifting into a deployment that half-renames itself.
+ *
+ * ## Why a default at all, when operator-identity.ts refuses to have one
+ *
+ * `operator-identity.ts` sets out the rule and it is the right one: a value
+ * whose wrongness is invisible to the operator and visible only off-site must
+ * not be guessed. The brand is the opposite case. An operator who does not set
+ * it sees "Aglyn" in their own browser tab on their own first page load, in
+ * their own console. That is a default they can see and correct, which is a
+ * default rather than a trap — the same test AGL-2022 applied to the tenant
+ * apex.
+ *
+ * ## Why `NEXT_PUBLIC_`, and why dot notation is load-bearing
+ *
+ * The brand is printed to the public — that is what it is for — so
+ * `NEXT_PUBLIC_` carries no disclosure risk. Next inlines `NEXT_PUBLIC_*` into
+ * the browser bundle by textually substituting `process.env.NAME`; the
+ * **bracket** form is never substituted and reads `undefined` in the browser
+ * (AGL-2037). Every read below is dot notation on purpose.
+ *
+ * Build-time consequence for self-hosters: these are baked in when the image
+ * is built, so they must be set *before* `docker compose build`, not merely
+ * before `up`. `docs/SELF_HOSTING.md` says so.
+ */ /** A non-empty trimmed string, else undefined — `'   '` is a half-finished `.env`. */ const clean = (value)=>{
+    const text = typeof value === 'string' ? value.trim() : '';
+    return text.length ? text : undefined;
+};
+/**
+ * The product name, as shown to end users.
+ *
+ * This is the browser-tab affix, the PWA name, the WebAuthn relying-party name
+ * the OS credential prompt displays, the `<meta name="generator">` and
+ * `x-powered-by` on published sites, and the platform default `productName` /
+ * `fromName` every non-white-label org's surfaces resolve to.
+ */ export const PLATFORM_BRAND_NAME = (_clean = clean(process.env.NEXT_PUBLIC_PLATFORM_BRAND_NAME)) != null ? _clean : 'Aglyn';
+/**
+ * The legal entity operating the software's own cloud, for copy that needs a
+ * company rather than a product (`BRAND.ORG_NAME_LEGAL`).
+ *
+ * NOT the same thing as `operatorIdentity().name`, and the distinction matters.
+ * This is a *brand* string with a visible default; that one is the identity a
+ * statutory notice is addressed to and refuses to default. An operator who
+ * sets only this has renamed the product, not published who they are.
+ */ export const PLATFORM_BRAND_LEGAL_NAME = (_clean1 = clean(process.env.NEXT_PUBLIC_PLATFORM_BRAND_LEGAL_NAME)) != null ? _clean1 : `${PLATFORM_BRAND_NAME} LLC`;
+/**
+ * Where a "need help?" line points.
+ *
+ * Falls through the operator's OWN support address before it falls back to
+ * ours, deliberately: an operator who followed the runbook has already set
+ * `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, and making them discover a second
+ * variable to stop pointing their customers at Aglyn's support desk — which
+ * cannot help those customers with anything — is a trap dressed as a default.
+ *
+ * Read here rather than imported from `operator-identity.ts` so this module
+ * stays dependency-free and safe to import from anywhere, including the places
+ * that cannot take the operator module's weight.
+ */ export const PLATFORM_SUPPORT_URL = (()=>{
+    const configured = clean(process.env.NEXT_PUBLIC_PLATFORM_SUPPORT_URL);
+    if (configured) return configured;
+    const operatorEmail = clean(process.env.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL);
+    if (operatorEmail) return `mailto:${operatorEmail}`;
+    return 'https://aglyn.com/support';
+})();
+/** True when this deployment still answers to Aglyn's own brand. */ export const isAglynOperatedBrand = ()=>PLATFORM_BRAND_NAME === 'Aglyn';
+/**
+ * Where the platform's own front door is — the marketing home, not the help
+ * desk.
+ *
+ * ## Why this is not `PLATFORM_SUPPORT_URL`
+ *
+ * The "Made with …" badge on a published free-tier site used to link to
+ * `supportUrl`, and on this deployment `supportUrl` falls through to
+ * `mailto:` + the operator support address. So the one link the platform gets
+ * on every free customer's site — its only organic acquisition surface —
+ * opened the visitor's mail client addressed to our support desk. A visitor
+ * who liked the site and clicked to find out what built it got a blank email,
+ * and support got the misdirected replies.
+ *
+ * They are genuinely different destinations. `supportUrl` answers "I am a
+ * customer and something is wrong"; this answers "what is this, and can I have
+ * one". Keeping one value for both guarantees one of them is wrong.
+ *
+ * ## Why it is null rather than aglyn.com off-brand
+ *
+ * A self-hosted deployment that renamed the product but set no home URL has
+ * nowhere honest to send that visitor: "Made with Foo" pointing at aglyn.com
+ * advertises the wrong company on Foo's customers' sites. The badge already
+ * renders as a plain label when it has no destination (AGL-2428), which is the
+ * correct outcome — so the Aglyn default applies only while this really is the
+ * Aglyn-operated brand.
+ */ export const PLATFORM_HOME_URL = (_clean2 = clean(process.env.NEXT_PUBLIC_PLATFORM_HOME_URL)) != null ? _clean2 : isAglynOperatedBrand() ? 'https://aglyn.com' : null;
+/**
+ * The platform's own logo MARK — the compact, square, no-wordmark form — as a
+ * URL an `<img>` on a PUBLISHED SITE can load.
+ *
+ * Site-relative on purpose: every app that renders it serves
+ * `public/_static/…` from its own origin, so one path works on
+ * `{sub}.aglyn.app` and on a customer's custom domain alike without knowing
+ * either. The white variant is the one that survives the badge's dark pill and
+ * an org's `primaryColor` behind it.
+ *
+ * Null unless this is the Aglyn-operated brand, for the same reason as
+ * {@link PLATFORM_HOME_URL}: a renamed deployment must not stamp our mark on
+ * its customers' sites. Such an operator sets `NEXT_PUBLIC_PLATFORM_MARK_URL`
+ * to their own, or gets a text-only badge.
+ */ export const PLATFORM_MARK_URL = (_clean3 = clean(process.env.NEXT_PUBLIC_PLATFORM_MARK_URL)) != null ? _clean3 : isAglynOperatedBrand() ? '/_static/images/brand/aglyn-logo-mark-white.svg' : null;
+/**
+ * The PLATFORM (non-white-label) brand — the fallback every surface gets when
+ * an org lacks the `whiteLabel` entitlement, and the gap-filler for a partial
+ * agency profile.
+ *
+ * It lives beside the literals it is assembled from rather than beside the
+ * entitlement gate that hands it out, and that placement is load-bearing
+ * rather than tidying. A published tenant page renders the attribution badge
+ * from this constant and reads nothing else out of `plan-entitlements.ts`;
+ * defining it there put that module's whole plan, quota and entitlement table
+ * — the single largest first-party module a visitor could reach — into the
+ * first load of every anonymous visitor to every customer site.
+ * `plan-entitlements.ts` re-exports it, so every existing caller is unchanged.
+ *
+ * The name says the PLATFORM's brand rather than Aglyn's because on a
+ * self-host install that assertion stops being true: which platform this is,
+ * is configuration. `resolveBrandingProfile` is the single resolver EVERY
+ * branded surface routes through — console chrome, published-site badge and
+ * title, transactional email — and this is its fallback, so all of them get a
+ * self-host brand without extending the white-label machinery at all.
+ */ export const PLATFORM_BRANDING_PROFILE = {
+    productName: PLATFORM_BRAND_NAME,
+    // The platform's own surfaces still bake their logo in — this is here for
+    // the surfaces that CANNOT, which is every surface rendered on somebody
+    // else's site. The free-tier attribution badge is the one that exists
+    // today, and it carried no mark at all while this was null.
+    logoUrl: PLATFORM_MARK_URL,
+    faviconUrl: null,
+    primaryColor: null,
+    supportUrl: PLATFORM_SUPPORT_URL,
+    homeUrl: PLATFORM_HOME_URL,
+    fromName: PLATFORM_BRAND_NAME,
+    emailLogoUrl: null,
+    customConsoleDomain: null
+};
+
+//# sourceMappingURL=platform-brand.js.map

package/src/lib/app-utils/platform-brand.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/platform-brand.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * What this deployment calls itself (AGL-2153).\n *\n * the rule for the self-host path: *\"the self hosted owner should not have\n * to edit the source to update aglyn branded items urls or personal\n * identification items, should move these to env vars\"*. AGL-2016 did that for\n * the values where getting it wrong misroutes a legal notice. This is the\n * other half — the product name itself, which was a bare `'Aglyn'` literal in\n * nine places.\n *\n * ## Why one module rather than nine reads\n *\n * The literals were not merely duplicated, they were duplicated across a\n * boundary: `PLATFORM_GENERATOR_NAME` exists here AND as a hand-copied\n * constant in `apps/tenant/middleware.ts`, because the edge bundle cannot\n * import this lib. A single source they both read is what stops the copy from\n * drifting into a deployment that half-renames itself.\n *\n * ## Why a default at all, when operator-identity.ts refuses to have one\n *\n * `operator-identity.ts` sets out the rule and it is the right one: a value\n * whose wrongness is invisible to the operator and visible only off-site must\n * not be guessed. The brand is the opposite case. An operator who does not set\n * it sees \"Aglyn\" in their own browser tab on their own first page load, in\n * their own console. That is a default they can see and correct, which is a\n * default rather than a trap — the same test AGL-2022 applied to the tenant\n * apex.\n *\n * ## Why `NEXT_PUBLIC_`, and why dot notation is load-bearing\n *\n * The brand is printed to the public — that is what it is for — so\n * `NEXT_PUBLIC_` carries no disclosure risk. Next inlines `NEXT_PUBLIC_*` into\n * the browser bundle by textually substituting `process.env.NAME`; the\n * **bracket** form is never substituted and reads `undefined` in the browser\n * (AGL-2037). Every read below is dot notation on purpose.\n *\n * Build-time consequence for self-hosters: these are baked in when the image\n * is built, so they must be set *before* `docker compose build`, not merely\n * before `up`. `docs/SELF_HOSTING.md` says so.\n */\n\n/** A non-empty trimmed string, else undefined — `'   '` is a half-finished `.env`. */\nconst clean = (value: unknown): string | undefined => {\n  const text = typeof value === 'string' ? value.trim() : ''\n  return text.length ? text : undefined\n}\n\n/**\n * The product name, as shown to end users.\n *\n * This is the browser-tab affix, the PWA name, the WebAuthn relying-party name\n * the OS credential prompt displays, the `<meta name=\"generator\">` and\n * `x-powered-by` on published sites, and the platform default `productName` /\n * `fromName` every non-white-label org's surfaces resolve to.\n */\nexport const PLATFORM_BRAND_NAME =\n  clean(process.env.NEXT_PUBLIC_PLATFORM_BRAND_NAME) ?? 'Aglyn'\n\n/**\n * The legal entity operating the software's own cloud, for copy that needs a\n * company rather than a product (`BRAND.ORG_NAME_LEGAL`).\n *\n * NOT the same thing as `operatorIdentity().name`, and the distinction matters.\n * This is a *brand* string with a visible default; that one is the identity a\n * statutory notice is addressed to and refuses to default. An operator who\n * sets only this has renamed the product, not published who they are.\n */\nexport const PLATFORM_BRAND_LEGAL_NAME =\n  clean(process.env.NEXT_PUBLIC_PLATFORM_BRAND_LEGAL_NAME) ??\n  `${PLATFORM_BRAND_NAME} LLC`\n\n/**\n * Where a \"need help?\" line points.\n *\n * Falls through the operator's OWN support address before it falls back to\n * ours, deliberately: an operator who followed the runbook has already set\n * `NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL`, and making them discover a second\n * variable to stop pointing their customers at Aglyn's support desk — which\n * cannot help those customers with anything — is a trap dressed as a default.\n *\n * Read here rather than imported from `operator-identity.ts` so this module\n * stays dependency-free and safe to import from anywhere, including the places\n * that cannot take the operator module's weight.\n */\nexport const PLATFORM_SUPPORT_URL: string = (() => {\n  const configured = clean(process.env.NEXT_PUBLIC_PLATFORM_SUPPORT_URL)\n  if (configured) return configured\n  const operatorEmail = clean(process.env.NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL)\n  if (operatorEmail) return `mailto:${operatorEmail}`\n  return 'https://aglyn.com/support'\n})()\n\n/** True when this deployment still answers to Aglyn's own brand. */\nexport const isAglynOperatedBrand = (): boolean =>\n  PLATFORM_BRAND_NAME === 'Aglyn'\n\n/**\n * Where the platform's own front door is — the marketing home, not the help\n * desk.\n *\n * ## Why this is not `PLATFORM_SUPPORT_URL`\n *\n * The \"Made with …\" badge on a published free-tier site used to link to\n * `supportUrl`, and on this deployment `supportUrl` falls through to\n * `mailto:` + the operator support address. So the one link the platform gets\n * on every free customer's site — its only organic acquisition surface —\n * opened the visitor's mail client addressed to our support desk. A visitor\n * who liked the site and clicked to find out what built it got a blank email,\n * and support got the misdirected replies.\n *\n * They are genuinely different destinations. `supportUrl` answers \"I am a\n * customer and something is wrong\"; this answers \"what is this, and can I have\n * one\". Keeping one value for both guarantees one of them is wrong.\n *\n * ## Why it is null rather than aglyn.com off-brand\n *\n * A self-hosted deployment that renamed the product but set no home URL has\n * nowhere honest to send that visitor: \"Made with Foo\" pointing at aglyn.com\n * advertises the wrong company on Foo's customers' sites. The badge already\n * renders as a plain label when it has no destination (AGL-2428), which is the\n * correct outcome — so the Aglyn default applies only while this really is the\n * Aglyn-operated brand.\n */\nexport const PLATFORM_HOME_URL: string | null =\n  clean(process.env.NEXT_PUBLIC_PLATFORM_HOME_URL) ??\n  (isAglynOperatedBrand() ? 'https://aglyn.com' : null)\n\n/**\n * The platform's own logo MARK — the compact, square, no-wordmark form — as a\n * URL an `<img>` on a PUBLISHED SITE can load.\n *\n * Site-relative on purpose: every app that renders it serves\n * `public/_static/…` from its own origin, so one path works on\n * `{sub}.aglyn.app` and on a customer's custom domain alike without knowing\n * either. The white variant is the one that survives the badge's dark pill and\n * an org's `primaryColor` behind it.\n *\n * Null unless this is the Aglyn-operated brand, for the same reason as\n * {@link PLATFORM_HOME_URL}: a renamed deployment must not stamp our mark on\n * its customers' sites. Such an operator sets `NEXT_PUBLIC_PLATFORM_MARK_URL`\n * to their own, or gets a text-only badge.\n */\nexport const PLATFORM_MARK_URL: string | null =\n  clean(process.env.NEXT_PUBLIC_PLATFORM_MARK_URL) ??\n  (isAglynOperatedBrand()\n    ? '/_static/images/brand/aglyn-logo-mark-white.svg'\n    : null)\n\n/**\n * A branding profile with every field present — what a branded surface\n * renders. Image/color/domain fields are nullable (Aglyn's own surfaces\n * bake those in rather than carry a URL); the remaining text fields always\n * have a value so callers never string-concatenate `undefined`.\n *\n * `supportUrl` is nullable too, and it is the one field where null carries a\n * decision rather than an absence — see {@link resolveBrandingProfile}. A\n * caller must render NOTHING for it, never a placeholder and never a\n * substitute.\n */\nexport interface ResolvedBrandingProfile {\n  productName: string\n  logoUrl: string | null\n  faviconUrl: string | null\n  primaryColor: string | null\n  supportUrl: string | null\n  /**\n   * The brand's own FRONT DOOR — where \"Made with <product>\" sends a visitor\n   * who wants to know what built the site they are looking at.\n   *\n   * Deliberately separate from {@link ResolvedBrandingProfile.supportUrl},\n   * which the badge used to borrow: a help-desk address is the wrong answer to\n   * \"what is this\", and on this deployment it resolves to a `mailto:`, so the\n   * badge opened a blank email instead of a web page.\n   *\n   * Nullable for the same reason `supportUrl` is — a brand with nowhere to\n   * send that visitor gets a plain label, never a substitute destination.\n   */\n  homeUrl: string | null\n  fromName: string\n  emailLogoUrl: string | null\n  customConsoleDomain: string | null\n}\n\n/**\n * The PLATFORM (non-white-label) brand — the fallback every surface gets when\n * an org lacks the `whiteLabel` entitlement, and the gap-filler for a partial\n * agency profile.\n *\n * It lives beside the literals it is assembled from rather than beside the\n * entitlement gate that hands it out, and that placement is load-bearing\n * rather than tidying. A published tenant page renders the attribution badge\n * from this constant and reads nothing else out of `plan-entitlements.ts`;\n * defining it there put that module's whole plan, quota and entitlement table\n * — the single largest first-party module a visitor could reach — into the\n * first load of every anonymous visitor to every customer site.\n * `plan-entitlements.ts` re-exports it, so every existing caller is unchanged.\n *\n * The name says the PLATFORM's brand rather than Aglyn's because on a\n * self-host install that assertion stops being true: which platform this is,\n * is configuration. `resolveBrandingProfile` is the single resolver EVERY\n * branded surface routes through — console chrome, published-site badge and\n * title, transactional email — and this is its fallback, so all of them get a\n * self-host brand without extending the white-label machinery at all.\n */\nexport const PLATFORM_BRANDING_PROFILE: ResolvedBrandingProfile = {\n  productName: PLATFORM_BRAND_NAME,\n  // The platform's own surfaces still bake their logo in — this is here for\n  // the surfaces that CANNOT, which is every surface rendered on somebody\n  // else's site. The free-tier attribution badge is the one that exists\n  // today, and it carried no mark at all while this was null.\n  logoUrl: PLATFORM_MARK_URL,\n  faviconUrl: null,\n  primaryColor: null,\n  supportUrl: PLATFORM_SUPPORT_URL,\n  homeUrl: PLATFORM_HOME_URL,\n  fromName: PLATFORM_BRAND_NAME,\n  emailLogoUrl: null,\n  customConsoleDomain: null,\n}\n"],"names":["clean","value","text","trim","length","undefined","PLATFORM_BRAND_NAME","process","env","NEXT_PUBLIC_PLATFORM_BRAND_NAME","PLATFORM_BRAND_LEGAL_NAME","NEXT_PUBLIC_PLATFORM_BRAND_LEGAL_NAME","PLATFORM_SUPPORT_URL","configured","NEXT_PUBLIC_PLATFORM_SUPPORT_URL","operatorEmail","NEXT_PUBLIC_OPERATOR_SUPPORT_EMAIL","isAglynOperatedBrand","PLATFORM_HOME_URL","NEXT_PUBLIC_PLATFORM_HOME_URL","PLATFORM_MARK_URL","NEXT_PUBLIC_PLATFORM_MARK_URL","PLATFORM_BRANDING_PROFILE","productName","logoUrl","faviconUrl","primaryColor","supportUrl","homeUrl","fromName","emailLogoUrl","customConsoleDomain"],"mappings":"IAyEEA,QAYAA,SAwDAA,SAmBAA;AAhKF;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GAED,oFAAoF,GACpF,MAAMA,QAAQ,CAACC;IACb,MAAMC,OAAO,OAAOD,UAAU,WAAWA,MAAME,IAAI,KAAK;IACxD,OAAOD,KAAKE,MAAM,GAAGF,OAAOG;AAC9B;AAEA;;;;;;;CAOC,GACD,OAAO,MAAMC,uBACXN,SAAAA,MAAMO,QAAQC,GAAG,CAACC,+BAA+B,aAAjDT,SAAsD,QAAO;AAE/D;;;;;;;;CAQC,GACD,OAAO,MAAMU,6BACXV,UAAAA,MAAMO,QAAQC,GAAG,CAACG,qCAAqC,aAAvDX,UACA,GAAGM,oBAAoB,IAAI,CAAC,CAAA;AAE9B;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMM,uBAA+B,AAAC,CAAA;IAC3C,MAAMC,aAAab,MAAMO,QAAQC,GAAG,CAACM,gCAAgC;IACrE,IAAID,YAAY,OAAOA;IACvB,MAAME,gBAAgBf,MAAMO,QAAQC,GAAG,CAACQ,kCAAkC;IAC1E,IAAID,eAAe,OAAO,CAAC,OAAO,EAAEA,eAAe;IACnD,OAAO;AACT,CAAA,IAAI;AAEJ,kEAAkE,GAClE,OAAO,MAAME,uBAAuB,IAClCX,wBAAwB,QAAO;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMY,qBACXlB,UAAAA,MAAMO,QAAQC,GAAG,CAACW,6BAA6B,aAA/CnB,UACCiB,yBAAyB,sBAAsB,KAAK;AAEvD;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMG,qBACXpB,UAAAA,MAAMO,QAAQC,GAAG,CAACa,6BAA6B,aAA/CrB,UACCiB,yBACG,oDACA,KAAK;AAqCX;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,OAAO,MAAMK,4BAAqD;IAChEC,aAAajB;IACb,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,4DAA4D;IAC5DkB,SAASJ;IACTK,YAAY;IACZC,cAAc;IACdC,YAAYf;IACZgB,SAASV;IACTW,UAAUvB;IACVwB,cAAc;IACdC,qBAAqB;AACvB,EAAC"}