@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/plugin-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/plugin-manifest.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginConfigField } from '../plugin-manager/plugin-config'\nimport {\n  sanitizePluginContributions,\n  type PluginContributions,\n} from '../plugin-manager/plugin-contributions'\n\n/**\n * Executable-plugin manifest, artifact-path, CSP, and revocation helpers\n * (AGL-45), per the accepted AGL-43 design. Plugins — unlike declarative\n * components (see `marketplace.ts`) — are code, so they never run in the\n * console/tenant origin: they load in a sandboxed iframe on a dedicated\n * plugin origin, and this manifest is the contract the install screen\n * shows verbatim and the serving layer turns into CSP. Pure module — safe\n * to import from API routes, the loader, and the host runtime alike.\n */\n\n/** Capabilities a plugin declares; shown verbatim at install. */\n/**\n * How a declared prop should be EDITED. Authoring metadata only (AGL-1049).\n *\n * Deliberately separate from `props`, which stays the security allowlist. A\n * schema entry for a name that is not in `props` widens nothing — it is\n * dropped, because the filter and the author disagreeing must resolve in the\n * filter's favour. The point of this is to make them agree, never to let a\n * publisher grant themselves a prop by describing it.\n */\nexport interface PluginPropSchema {\n  /** Must also appear in `capabilities.props`, or this entry is ignored. */\n  name: string\n  /**\n   * Which editor to render. Unknown values degrade to `string` rather than\n   * being rejected: this is publisher-authored data, and a manifest from a\n   * newer platform version must not make an older host refuse the plugin.\n   */\n  type?: 'string' | 'number' | 'boolean' | 'color' | 'date' | 'url' | 'select'\n  label?: string\n  description?: string\n  /** Shown as the field's initial value, so \"leave it alone\" is visible. */\n  default?: string | number | boolean\n  /** `select` only. */\n  options?: Array<{ value: string; label?: string }>\n}\n\n/**\n * A canvas element a plugin version contributes (AGL-1031).\n *\n * A first-party plugin that extends the besigner declares a `ComponentSchema`\n * and gets a first-class palette entry. A marketplace plugin doing the same\n * work got a generic \"Plugin\" wrapper and a JSON textarea. Where an element\n * came from is a fact about its provenance, not a different kind of thing.\n *\n * The line this must not cross: **declared schema drives AUTHORING; the\n * sandbox still owns runtime.** This is publisher-authored DATA. It never\n * becomes a React component in the host bundle — the palette entry, the label\n * and the attribute fields are host-rendered from the declaration, and the\n * saved node still resolves to a sandboxed `PluginFrame` integrity-checked\n * against the pinned sha256. Nothing here changes what executes or where.\n */\nexport interface PluginElementDeclaration {\n  /**\n   * Stable id, unique within the plugin. Saved on the node beside the listing\n   * id, so renaming the display name never orphans a placed element.\n   */\n  id: string\n  displayName: string\n  description?: string\n  /**\n   * Drawer category. Constrained to a subset — see\n   * {@link PLUGIN_ELEMENT_CATEGORIES}.\n   */\n  category?: string\n  /**\n   * An mdi icon NAME (`mdiTimerOutline`), never markup and never a path.\n   *\n   * A path would be arbitrary SVG from a publisher rendered into console\n   * chrome; a name is looked up in the icon set the host already ships, so the\n   * worst a bad value can do is render nothing.\n   */\n  icon?: string\n  /**\n   * The element's editable attributes. Intersected with `capabilities.props`\n   * exactly as {@link PluginPropSchema} is — an attribute the plugin cannot\n   * receive is not an attribute.\n   */\n  attributes?: PluginPropSchema[]\n}\n\n/**\n * Categories a third-party element may declare.\n *\n * Deliberately not the whole enum. `LAYOUT` and `NAVIGATION` are structural —\n * a third-party element appearing among the containers a page is built out of\n * invites placements the sandbox cannot honour, and taking a category away\n * later breaks every site that used it. Cheaper to decide now, as the issue\n * says; widening later is easy and narrowing is not.\n */\nexport const PLUGIN_ELEMENT_CATEGORIES: readonly string[] = [\n  'Data Display',\n  'Media',\n  'Commerce',\n  'Forms',\n  'Input',\n  'Text',\n  'Sections & Blocks',\n]\n\n/** Bound on how many elements one plugin may contribute to the palette. */\nexport const PLUGIN_MAX_ELEMENTS = 12\n\nexport interface PluginCapabilities {\n  /**\n   * Outbound origins the plugin may call (`connect-src`), each an exact\n   * https origin (`https://api.example.com`). Empty = no network.\n   */\n  network?: string[]\n  /** Prop names the host passes IN through the bridge. THE allowlist. */\n  props?: string[]\n  /**\n   * Optional editing metadata for the props above (AGL-1049). Absent on every\n   * plugin published before this existed, which is why the authoring surface\n   * falls back to a plain text field per declared name rather than requiring\n   * it.\n   */\n  propSchema?: PluginPropSchema[]\n  /** Event names the plugin may emit OUT through the bridge. */\n  events?: string[]\n  /** Rendered iframe region size (host reserves this box). */\n  size?: { width?: number; height?: number }\n}\n\nexport interface PluginManifest {\n  /** Stable plugin id (matches the listing); persisted, never renamed. */\n  id: string\n  /** Human name shown in the drawer + install screen. */\n  name: string\n  /** Semver-ish version string (`1.2.0`); must match the artifact version. */\n  version: string\n  /** Bundle entry the loader imports on the plugin origin. */\n  entry: string\n  /**\n   * Host ABI generation the bundle was built against (AGL-429). Realm and\n   * remote-server loaders refuse a bundle whose declared ABI differs from\n   * the running host's PLUGIN_HOST_ABI_VERSION; absent = pre-compat\n   * bundle, loaded with a warning. Bumping the ABI is a breaking change.\n   */\n  hostAbi?: number\n  capabilities?: PluginCapabilities\n  /**\n   * Canvas elements this version contributes to the palette (AGL-1031).\n   *\n   * Part of the reviewed bytes: a new element is a new version through review,\n   * and a revoked version's elements vanish from the palette with it, because\n   * the palette is built from the pinned install.\n   */\n  elements?: PluginElementDeclaration[]\n  /** Besigner lineal rules the registered component honors (AGL-45 §4). */\n  restrictParent?: string[]\n  restrictChildren?: string[]\n  description?: string\n  /**\n   * Settings this plugin takes, declared in the manifest (AGL-428).\n   *\n   * First-party plugins call `registerPluginConfigSchema` at module scope,\n   * which a sandboxed third-party bundle cannot do: it does not run in the\n   * console process at all, so nothing it executes can reach the registry the\n   * settings form reads. The manifest is the one declaration of a marketplace\n   * plugin that IS present in the console — denormalized onto every install\n   * pin, and part of the reviewed bytes — so it is where a publisher's fields\n   * come from.\n   *\n   * Read through `pluginConfigSchemaFromManifest`, never directly: this is\n   * publisher-authored data on a document the console renders a form from, so\n   * every field is re-validated on the way in rather than trusted for having\n   * been reviewed once.\n   */\n  config?: {\n    fields: PluginConfigField[]\n    defaults?: Record<string, unknown>\n  }\n  /**\n   * What `register(host)` contributes, and where (AGL-3116): the elements and\n   * features a published page loads the plugin for, and the console slots,\n   * routes and shell entries a console screen loads it for. See\n   * `plugin-contributions.ts`.\n   *\n   * Absent on every version published before the contract, and those load\n   * under its documented default. A version that declares it is held to it:\n   * the verifier compares it with what the bundle registers, and a published\n   * page never loads the plugin anywhere the declaration does not place it.\n   */\n  contributes?: PluginContributions\n}\n\n/** A published, content-addressed version of a plugin listing. */\nexport interface PluginListingVersion {\n  version: string\n  /** Content hash of the artifact bundle (integrity check at load). */\n  sha256: string\n  /**\n   * Trust tier (AGL-420): 'realm' = staff-reviewed + platform-signed,\n   * may load into the app realm; anything else stays in the sandboxed\n   * PluginFrame. Staff-writable only.\n   */\n  trust?: string\n  /** Ed25519 signature (base64) over the sha256 hex (AGL-420). */\n  signature?: string\n  changelog?: string\n  createdAtMs?: number\n  manifest: PluginManifest\n}\n\n/** `hosts/{hostId}/installs/{listingId}` — a pinned plugin install. */\nexport interface PluginInstall {\n  listingId: string\n  version: string\n  sha256: string\n  /** Mirrored trust tier + signature at install time (AGL-420). */\n  trust?: string\n  signature?: string\n  installedAtMs?: number\n  updatedAtMs?: number\n  entitlementRef?: string\n}\n\n/** `revocations/{listingId}` — platform kill switch checked at load. */\nexport interface PluginRevocation {\n  /**\n   * Specific versions revoked, or `'all'` to kill the whole listing. The\n   * field every INSTALLABILITY reader consults, via `isPluginRevoked`.\n   *\n   * It used to say this was the only field any reader consulted, and that\n   * was the defect rather than a description of one: staff are required to\n   * type a reason, it was written here, and nothing rendered it — so the\n   * customer whose site broke and the publisher whose version was pulled\n   * both got a bare chip (AGL-2328). `reason` and the timestamp are now\n   * read by `host-plugins-card` and by the publisher branch of\n   * `listing-versions`. Do not restore the old claim.\n   */\n  versions: string[] | 'all'\n  /** Typed by staff, REQUIRED to revoke. Rendered to both audiences. */\n  reason?: string\n  /**\n   * ⚠️ DECLARED HERE AND WRITTEN BY NOTHING. Every writer in\n   * `apps/console/app/api/admin/plugin-reviews/route.ts` stores\n   * `revokedAt` instead. A reader that trusts this field alone shows no\n   * date for every revocation that actually exists — read both, the way\n   * `revocationTimeMs` in `listing-versions.ts` does.\n   */\n  atMs?: number\n  /**\n   * What the writers actually store — a Firestore server timestamp, so its\n   * shape depends on which SDK read it back (`toMillis()` on admin, a\n   * `seconds` field through a client). Deliberately `unknown` rather than a\n   * lie about which one a given reader will see.\n   */\n  revokedAt?: unknown\n  /**\n   * The staff uid that pulled it. Recorded, and deliberately NEVER returned\n   * to a customer or a publisher: who acted belongs in the audit log, not\n   * on the screen of the person it was done to (AGL-2328).\n   */\n  revokedBy?: string\n  /**\n   * `'takedown'` when the listing-level hide wrote it (AGL-948). Un-hiding\n   * clears a takedown-owned entry, so it must not be the only record.\n   */\n  source?: string\n  /**\n   * Versions revoked by a REVIEW decision (AGL-1085), kept separately from\n   * `versions` because a takedown flattens that to `'all'`. Without this,\n   * un-hiding a listing would silently un-revoke versions a reviewer stopped\n   * for an unrelated reason.\n   */\n  reviewVersions?: string[]\n}\n\nexport * from './plugin-artifact-path'\n\nexport const PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]{1,63}$/\nexport const PLUGIN_VERSION_PATTERN = /^\\d+\\.\\d+\\.\\d+$/\nexport const PLUGIN_MAX_NETWORK_ORIGINS = 10\nexport const PLUGIN_MAX_PROPS = 32\n/** Label/description/default text is publisher-authored; keep it bounded. */\nconst PLUGIN_PROP_TEXT_MAX = 200\n/**\n * `mdiTimerOutline` — an icon NAME from the set the host already ships.\n *\n * Never a path: a path is arbitrary SVG from a publisher rendered into console\n * chrome. A name is a lookup, so the worst an unknown one does is render\n * nothing.\n */\nconst MDI_ICON_NAME_PATTERN = /^mdi[A-Za-z0-9]{1,48}$/\nconst PROP_SCHEMA_TYPES = new Set([\n  'string',\n  'number',\n  'boolean',\n  'color',\n  'date',\n  'url',\n  'select',\n])\nexport const PLUGIN_MAX_EVENTS = 32\nexport const PLUGIN_MAX_SIZE_PX = 4096\nconst HTTPS_ORIGIN_PATTERN = /^https:\\/\\/[a-z0-9.-]+(:\\d+)?$/i\nconst IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/\n\n/**\n * Validates a manifest at publish time. Returns the normalized manifest or\n * a human-readable error — the publish Cloud Function refuses to store a\n * bundle whose manifest doesn't pass, so bad capabilities never reach a\n * consumer's install screen.\n */\n/**\n * Sanitizes a publisher-authored prop schema against a set of declared props.\n *\n * Shared by `capabilities.propSchema` and each element's `attributes`, so a\n * declared element cannot describe its way past the allowlist any more than a\n * top-level schema can. One implementation, one rule.\n */\nfunction sanitizePropSchemaList(\n  input: unknown,\n  declared: ReadonlySet<string>,\n): PluginPropSchema[] {\n  if (!Array.isArray(input)) return []\n  const out: PluginPropSchema[] = []\n  const seen = new Set<string>()\n  for (const raw of input.slice(0, PLUGIN_MAX_PROPS)) {\n    if (!raw || typeof raw !== 'object') continue\n    const entry = raw as Record<string, unknown>\n    const name = entry['name']\n    if (typeof name !== 'string' || !IDENTIFIER_PATTERN.test(name)) continue\n    if (!declared.has(name) || seen.has(name)) continue\n    seen.add(name)\n    const type = PROP_SCHEMA_TYPES.has(String(entry['type']))\n      ? (entry['type'] as PluginPropSchema['type'])\n      : 'string'\n    const next: PluginPropSchema = { name, type }\n    for (const key of ['label', 'description'] as const) {\n      const value = entry[key]\n      if (typeof value === 'string' && value.trim()) {\n        next[key] = value.trim().slice(0, PLUGIN_PROP_TEXT_MAX)\n      }\n    }\n    const fallback = entry['default']\n    if (\n      typeof fallback === 'string' ||\n      typeof fallback === 'number' ||\n      typeof fallback === 'boolean'\n    ) {\n      next.default =\n        typeof fallback === 'string'\n          ? fallback.slice(0, PLUGIN_PROP_TEXT_MAX)\n          : fallback\n    }\n    if (type === 'select' && Array.isArray(entry['options'])) {\n      const options = (entry['options'] as unknown[])\n        .map((option) => {\n          const record = (option ?? {}) as Record<string, unknown>\n          const value = record['value']\n          if (typeof value !== 'string' || !value) return null\n          const label = record['label']\n          return {\n            value: value.slice(0, PLUGIN_PROP_TEXT_MAX),\n            ...(typeof label === 'string' && label.trim()\n              ? { label: label.trim().slice(0, PLUGIN_PROP_TEXT_MAX) }\n              : {}),\n          }\n        })\n        .filter(Boolean) as Array<{ value: string; label?: string }>\n      if (options.length) next.options = options.slice(0, PLUGIN_MAX_PROPS)\n    }\n    out.push(next)\n  }\n  return out\n}\n\nexport function validatePluginManifest(\n  input: unknown,\n): { ok: true; manifest: PluginManifest } | { ok: false; error: string } {\n  if (!input || typeof input !== 'object') {\n    return { ok: false, error: 'Manifest must be an object' }\n  }\n  const raw = input as Record<string, unknown>\n  const id = String(raw['id'] ?? '')\n  if (!PLUGIN_ID_PATTERN.test(id)) {\n    return { ok: false, error: 'Invalid plugin id' }\n  }\n  const version = String(raw['version'] ?? '')\n  if (!PLUGIN_VERSION_PATTERN.test(version)) {\n    return { ok: false, error: 'Version must be semver (e.g. 1.0.0)' }\n  }\n  const name = String(raw['name'] ?? '').trim()\n  if (!name || name.length > 80) {\n    return { ok: false, error: 'Name is required (max 80 chars)' }\n  }\n  const entry = String(raw['entry'] ?? '').trim()\n  // Entry is a relative bundle path — absolute URLs would let a plugin\n  // point the loader at an off-origin script.\n  if (!entry || /^[a-z][a-z0-9+.-]*:/i.test(entry) || entry.startsWith('//')) {\n    return { ok: false, error: 'Entry must be a relative bundle path' }\n  }\n\n  const capabilitiesInput = (raw['capabilities'] ?? {}) as Record<\n    string,\n    unknown\n  >\n  const capabilities: PluginCapabilities = {}\n\n  const network = capabilitiesInput['network']\n  if (network !== undefined) {\n    if (!Array.isArray(network) || network.length > PLUGIN_MAX_NETWORK_ORIGINS) {\n      return { ok: false, error: 'Too many network origins declared' }\n    }\n    for (const origin of network) {\n      if (typeof origin !== 'string' || !HTTPS_ORIGIN_PATTERN.test(origin)) {\n        return {\n          ok: false,\n          error: `Network origin \"${origin}\" must be an https origin`,\n        }\n      }\n    }\n    if (network.length) capabilities.network = [...new Set(network as string[])]\n  }\n\n  for (const key of ['props', 'events'] as const) {\n    const list = capabilitiesInput[key]\n    if (list === undefined) continue\n    const max = key === 'props' ? PLUGIN_MAX_PROPS : PLUGIN_MAX_EVENTS\n    if (!Array.isArray(list) || list.length > max) {\n      return { ok: false, error: `Too many ${key} declared` }\n    }\n    for (const name of list) {\n      if (typeof name !== 'string' || !IDENTIFIER_PATTERN.test(name)) {\n        return { ok: false, error: `Invalid ${key} name \"${name}\"` }\n      }\n    }\n    if (list.length) capabilities[key] = [...new Set(list as string[])]\n  }\n\n  /**\n   * Editing metadata (AGL-1049). Sanitized, never trusted, and INTERSECTED\n   * with the allowlist above — an entry naming a prop that is not declared in\n   * `props` is dropped rather than rejected.\n   *\n   * Dropped and not rejected on purpose: a publisher who describes a prop they\n   * forgot to declare has made an authoring mistake, not an attack, and\n   * refusing the whole manifest for it would fail the publish over a label.\n   * The prop still does not cross the bridge, because `filterPluginProps`\n   * reads `props` and never this.\n   *\n   * An unknown `type` degrades to a text field rather than failing: a manifest\n   * written against a newer platform must not make an older host refuse a\n   * plugin that is otherwise fine.\n   */\n  const propSchemaInput = capabilitiesInput['propSchema']\n  if (propSchemaInput !== undefined) {\n    if (\n      !Array.isArray(propSchemaInput) ||\n      propSchemaInput.length > PLUGIN_MAX_PROPS\n    ) {\n      return { ok: false, error: 'Too many prop schemas declared' }\n    }\n    const propSchema = sanitizePropSchemaList(\n      propSchemaInput,\n      new Set(capabilities.props ?? []),\n    )\n    if (propSchema.length) capabilities.propSchema = propSchema\n  }\n\n  const size = capabilitiesInput['size'] as\n    | { width?: unknown; height?: unknown }\n    | undefined\n  if (size) {\n    const width = Number(size.width ?? 0)\n    const height = Number(size.height ?? 0)\n    if (\n      (size.width !== undefined &&\n        (!Number.isFinite(width) || width < 0 || width > PLUGIN_MAX_SIZE_PX)) ||\n      (size.height !== undefined &&\n        (!Number.isFinite(height) ||\n          height < 0 ||\n          height > PLUGIN_MAX_SIZE_PX))\n    ) {\n      return { ok: false, error: 'Declared size is out of range' }\n    }\n    capabilities.size = {\n      ...(size.width !== undefined ? { width } : {}),\n      ...(size.height !== undefined ? { height } : {}),\n    }\n  }\n\n  const restrict = (value: unknown): string[] | undefined => {\n    if (!Array.isArray(value)) return undefined\n    const ids = value.filter(\n      (entry): entry is string => typeof entry === 'string' && entry.length > 0,\n    )\n    return ids.length ? [...new Set(ids)] : undefined\n  }\n\n  const hostAbiRaw = raw['hostAbi']\n  let hostAbi: number | undefined\n  if (hostAbiRaw !== undefined) {\n    hostAbi = Number(hostAbiRaw)\n    if (!Number.isInteger(hostAbi) || hostAbi < 1 || hostAbi > 99) {\n      return { ok: false, error: 'hostAbi must be a small positive integer' }\n    }\n  }\n\n  /**\n   * Declared canvas elements (AGL-1031). Sanitized hard, because every field\n   * here is publisher-authored data the HOST renders into its own chrome.\n   *\n   * A malformed `elements` array is refused — that is a build error a\n   * publisher can see and fix. A single bad ENTRY is dropped instead, so one\n   * typo cannot fail a whole release.\n   */\n  const elementsInput = raw['elements']\n  const elements: PluginElementDeclaration[] = []\n  if (elementsInput !== undefined) {\n    if (\n      !Array.isArray(elementsInput) ||\n      elementsInput.length > PLUGIN_MAX_ELEMENTS\n    ) {\n      return { ok: false, error: 'Too many elements declared' }\n    }\n    const declaredProps = new Set(capabilities.props ?? [])\n    const seenIds = new Set<string>()\n    for (const rawElement of elementsInput) {\n      if (!rawElement || typeof rawElement !== 'object') continue\n      const entryRecord = rawElement as Record<string, unknown>\n      const elementId = entryRecord['id']\n      const elementName = entryRecord['displayName']\n      if (typeof elementId !== 'string' || !IDENTIFIER_PATTERN.test(elementId)) {\n        continue\n      }\n      if (seenIds.has(elementId)) continue\n      if (typeof elementName !== 'string' || !elementName.trim()) continue\n      seenIds.add(elementId)\n      const element: PluginElementDeclaration = {\n        id: elementId,\n        displayName: elementName.trim().slice(0, PLUGIN_PROP_TEXT_MAX),\n      }\n      const elementDescription = entryRecord['description']\n      if (typeof elementDescription === 'string' && elementDescription.trim()) {\n        element.description = elementDescription\n          .trim()\n          .slice(0, PLUGIN_PROP_TEXT_MAX)\n      }\n      // A category outside the permitted subset is DROPPED, not refused: the\n      // structural ones are withheld deliberately (see\n      // PLUGIN_ELEMENT_CATEGORIES), and a publisher aiming at one should still\n      // get a usable element rather than a failed publish.\n      const elementCategory = entryRecord['category']\n      if (\n        typeof elementCategory === 'string' &&\n        PLUGIN_ELEMENT_CATEGORIES.includes(elementCategory)\n      ) {\n        element.category = elementCategory\n      }\n      const elementIcon = entryRecord['icon']\n      if (\n        typeof elementIcon === 'string' &&\n        MDI_ICON_NAME_PATTERN.test(elementIcon)\n      ) {\n        element.icon = elementIcon\n      }\n      const elementAttributes = sanitizePropSchemaList(\n        entryRecord['attributes'],\n        declaredProps,\n      )\n      if (elementAttributes.length) element.attributes = elementAttributes\n      elements.push(element)\n    }\n  }\n\n  /**\n   * Declared contributions (AGL-3116). Refused whole when malformed rather\n   * than trimmed: a loader places the plugin by this block, and an entry\n   * dropped on the way in would stop it loading where it is used.\n   */\n  let contributes: PluginContributions | undefined\n  if (raw['contributes'] !== undefined) {\n    const verdict = sanitizePluginContributions(raw['contributes'])\n    if (verdict.ok === false) return { ok: false, error: verdict.error }\n    contributes = verdict.contributions\n  }\n\n  return {\n    ok: true,\n    manifest: {\n      id,\n      name,\n      version,\n      entry,\n      ...(hostAbi !== undefined ? { hostAbi } : {}),\n      ...(contributes ? { contributes } : {}),\n      ...(Object.keys(capabilities).length ? { capabilities } : {}),\n      ...(elements.length ? { elements } : {}),\n      ...(restrict(raw['restrictParent'])\n        ? { restrictParent: restrict(raw['restrictParent']) }\n        : {}),\n      ...(restrict(raw['restrictChildren'])\n        ? { restrictChildren: restrict(raw['restrictChildren']) }\n        : {}),\n      ...(typeof raw['description'] === 'string'\n        ? { description: String(raw['description']).slice(0, 500) }\n        : {}),\n    },\n  }\n}\n\n\n/**\n * The sandbox CSP is NOT built here (AGL-1092).\n *\n * A `pluginContentSecurityPolicy` used to live at this spot: exported,\n * unit-tested, and called by nothing. The policy that actually reaches a\n * browser is `csp()` in `tools/plugin-loader/origin/api/load.mjs`, on the\n * plugin-origin deployment, and the two disagreed — this one emitted\n * `connect-src 'none'` for a manifest with no network, which would have\n * broken every sandboxed load, since the frame fetches its own bundle from\n * its own origin. Deleted rather than reconciled: a tested policy nobody\n * serves is worse than none, because it answers a reader's question wrongly.\n * `capabilities.network` still decides the allowlist — the loader reads it\n * from the public listing-versions endpoint and appends it to `connect-src`,\n * with tests beside it (`npm run test:plugin-loader`).\n */\n\n/**\n * True when a pinned version is killed — the whole listing (`'all'`) or the\n * specific version. Loaders check this before executing and render a safe\n * placeholder when true (AGL-45 §3.5 kill switch).\n */\nexport function isPluginRevoked(\n  revocation: PluginRevocation | null | undefined,\n  version: string,\n): boolean {\n  if (!revocation) return false\n  if (isListingWideRevocation(revocation)) return true\n  return (\n    Array.isArray(revocation.versions) && revocation.versions.includes(version)\n  )\n}\n\n/**\n * True when the kill switch is thrown on the WHOLE listing, not one build.\n *\n * Split out for the one caller that has no version to ask about: marketplace\n * checkout (AGL-2288) must refuse to SELL a listing the platform has switched\n * off, and it decides that before any version is chosen. Written here rather\n * than as `revocation?.versions === 'all'` at that call site for the reason\n * the doc comment on `nextRevocationState` gives — what `'all'` means is a\n * property of this document's shape, and a second reader that spelled it out\n * itself is how a kill switch silently stops killing.\n *\n * A per-version revocation is deliberately NOT listing-wide: it stops one\n * build while the rest stay installable.\n */\nexport function isListingWideRevocation(\n  revocation: PluginRevocation | null | undefined,\n): boolean {\n  return revocation?.versions === 'all'\n}\n\n/**\n * What a listing OFFERS a client right now (AGL-2368).\n *\n * `newestInstallableVersion` is the derivation, and it needs the version set —\n * which is server-only (`pluginVersions`). A client has the listing's\n * `latestApprovedVersion` mirror instead, and since AGL-2306 every writer of\n * that mirror computes it with `newestInstallableVersion`. So on a client the\n * mirror IS the answer, with one gap: the revocation document and the listing\n * document are two non-transactional writes, and a live listener sees them\n * land at different times. In that window the mirror names a version the kill\n * switch has already stopped, which is the whole shape of this bug.\n *\n * So a client that holds the revocation checks it against the mirror and, when\n * they disagree, offers NOTHING rather than the next-best guess. It cannot\n * compute the next-best guess — it has no version list — and \"no update to\n * offer\" is the safe reading of a mirror it has caught mid-repair. The repair\n * lands moments later and the real answer appears.\n *\n * A client with no revocation in hand passes `undefined` and gets the mirror,\n * which is what it had before. That is a real fallback, not a silent one: the\n * gap it leaves is bounded by the repair, and the install route derives live\n * and refuses regardless.\n */\nexport function offeredPluginVersion(\n  listing: { latestApprovedVersion?: unknown } | null | undefined,\n  revocation: PluginRevocation | null | undefined,\n): string | null {\n  const offered = String(listing?.latestApprovedVersion ?? '')\n  if (!offered) return null\n  return isPluginRevoked(revocation, offered) ? null : offered\n}\n\n/**\n * The newest version a buyer could actually install right now (AGL-2306).\n *\n * Two things have to be true of an offer, and the listing's\n * `latestApprovedVersion` mirror only ever tracked one of them: the version\n * must be APPROVED (AGL-966 — review lives on the version) and it must not be\n * REVOKED (AGL-1085 — `install-plugin` answers 409 to a revoked pin).\n *\n * Written here rather than in the console route that repairs the mirror, and\n * rather than reusing `newestApprovedVersion` in the marketplace plugin's\n * model, because the console is `scope:app` and may not depend on\n * `aglyn:addons`. Both may import core, and \"what is on offer\" is one\n * question that must have one answer.\n *\n * `compare` is injected rather than imported so this module stays free of the\n * artifact-version comparator's own dependencies; every caller already has it.\n * A `null` comparison (an unparseable version string) sorts as \"not newer\",\n * which keeps a malformed version out of an offer rather than into one.\n *\n * Returns `null` when nothing qualifies — an ABSENT mirror reads as \"no update\n * to offer\", while a stale string reads as an update that does not exist.\n */\nexport function newestInstallableVersion(\n  versions: readonly { version: string; reviewState?: unknown }[],\n  revocation: PluginRevocation | null | undefined,\n  compare: (a: string, b: string) => number | null,\n): string | null {\n  let newest: string | null = null\n  for (const entry of versions) {\n    if (!entry?.version) continue\n    if (entry.reviewState !== 'approved') continue\n    if (isPluginRevoked(revocation, entry.version)) continue\n    if (newest == null || (compare(newest, entry.version) ?? 0) < 0) {\n      newest = entry.version\n    }\n  }\n  return newest\n}\n\n/**\n * The next `revocations/{listingId}` state after one write (AGL-1085).\n *\n * Two writers share this doc and neither may erase the other:\n *\n * * a **takedown** kills the listing, flattening `versions` to `'all'`, and\n *   un-hiding removes what it wrote (AGL-948);\n * * a **review** decision stops one version's bytes — the reviewer's only\n *   alternative used to be a full takedown, which also revokes the version\n *   customers are happily running.\n *\n * `versions` stays the single field every reader consults, so `isPluginRevoked`\n * and the loaders are untouched. `reviewVersions` is the durable record of the\n * review-owned half, which is what lets un-hiding restore rather than clear it.\n * Returns `null` when nothing is revoked any more and the doc should be\n * deleted — an empty `versions: []` would read as \"revoked nothing\" but keep a\n * doc around that a later reader has to interpret.\n *\n * Pure so both transitions are testable without Firestore, and colocated with\n * `isPluginRevoked` on purpose: a writer that disagreed with the reader about\n * this doc's shape is exactly how a kill switch silently stops killing.\n */\nexport function nextRevocationState(\n  current: PluginRevocation | null | undefined,\n  change:\n    | { type: 'revoke-version'; version: string }\n    | { type: 'unrevoke-version'; version: string }\n    | { type: 'takedown' }\n    | { type: 'restore' },\n): PluginRevocation | null {\n  const takenDown = current?.source === 'takedown'\n  // A document written before AGL-1085 — or by hand, which the rules permit\n  // any staff client to do — has `versions` and NO `reviewVersions`\n  // (AGL-2305). `withReview` REPLACES `versions` wholesale from this seed, so\n  // reading it as an empty list silently rebuilt the document: revoking a\n  // second version un-revoked the first, and un-revoking any version returned\n  // `null`, which the caller turns into a DELETE of the whole kill switch.\n  //\n  // A legacy `versions` array is adopted as the review-owned half, which is\n  // what it actually was: before AGL-1085 the only writer that produced an\n  // array here was a reviewer, and `'all'` (the takedown form) is excluded\n  // because that half is owned by `source` and restored by `restore`.\n  const reviewVersions = [\n    ...(current?.reviewVersions ??\n      (Array.isArray(current?.versions) ? current.versions : [])),\n  ]\n  const withReview = (versions: string[], stillTakenDown: boolean) => {\n    if (stillTakenDown) {\n      return { ...current, versions: 'all' as const, reviewVersions: versions }\n    }\n    if (!versions.length) return null\n    const { source: _source, ...rest } = current ?? {}\n    return { ...rest, versions, reviewVersions: versions }\n  }\n  switch (change.type) {\n    case 'revoke-version': {\n      const next = reviewVersions.includes(change.version)\n        ? reviewVersions\n        : [...reviewVersions, change.version]\n      return withReview(next, takenDown)\n    }\n    case 'unrevoke-version': {\n      return withReview(\n        reviewVersions.filter((entry) => entry !== change.version),\n        takenDown,\n      )\n    }\n    case 'takedown':\n      return { ...current, versions: 'all', source: 'takedown', reviewVersions }\n    case 'restore':\n      // Only the takedown's own contribution goes away. A version a reviewer\n      // stopped stays stopped — un-hiding is not a review decision.\n      return withReview(reviewVersions, false)\n  }\n}\n\n/** Methods a host-mediated plugin fetch may use (AGL-191). */\nexport const PLUGIN_FETCH_METHODS = ['GET', 'POST'] as const\nexport type PluginFetchMethod = (typeof PLUGIN_FETCH_METHODS)[number]\n/** Request/response body cap for host-mediated fetch (bytes). */\nexport const PLUGIN_FETCH_MAX_BODY_BYTES = 256 * 1024\n\n/**\n * True when `url`'s origin is an exact match against the manifest's\n * declared `network` allowlist (AGL-191). The host re-checks this before\n * proxying a plugin's `fetch-request`, so a plugin can only reach origins\n * it declared at install (and the install screen surfaced). No allowlist =\n * no host-mediated network; https-only.\n */\nexport function isPluginNetworkAllowed(\n  url: string,\n  capabilities: PluginCapabilities | undefined,\n): boolean {\n  const allow = capabilities?.network\n  if (!allow?.length) return false\n  try {\n    const parsed = new URL(url)\n    if (parsed.protocol !== 'https:') return false\n    return allow.includes(parsed.origin)\n  } catch {\n    return false\n  }\n}\n\n/** Component id of the sandboxed plugin canvas element (plugins-mui). */\nexport const PLUGIN_COMPONENT_ID = 'marketplacePlugin'\n\n/** Resolved install data injected into a plugin node's props at compose. */\nexport interface ResolvedPluginInstall {\n  listingId: string\n  version: string\n  sha256: string\n  capabilities?: PluginCapabilities\n  revoked?: boolean\n}\n\n/**\n * Compose-time injection (AGL-45), mirroring `attachFunctionDefinitions`:\n * a `marketplacePlugin` node carries only a `listingId` in the saved screen;\n * the tenant compose pass resolves that to the host's pinned install\n * (version/sha256/capabilities) and the kill-switch state, and stamps them\n * onto the node's props so `PluginFrame` renders without a client read.\n * Unknown/uninstalled listings leave the node untouched (it shows a safe\n * \"not installed\" placeholder rather than taking the screen down).\n */\nexport function attachPluginInstalls<T extends Record<string, any>>(\n  nodes: T,\n  installsByListingId: Record<string, ResolvedPluginInstall | undefined>,\n): T {\n  if (!Object.keys(installsByListingId).length) return nodes\n  const next: Record<string, any> = {}\n  for (const [id, node] of Object.entries(nodes)) {\n    const listingId =\n      node?.componentId === PLUGIN_COMPONENT_ID\n        ? node?.props?.listingId\n        : undefined\n    const install = listingId\n      ? installsByListingId[String(listingId)]\n      : undefined\n    next[id] = install\n      ? {\n          ...node,\n          props: {\n            ...node.props,\n            version: install.version,\n            sha256: install.sha256,\n            capabilities: install.capabilities,\n            revoked: Boolean(install.revoked),\n          },\n        }\n      : node\n  }\n  return next as T\n}\n\n/** One editable setting on a placed plugin, resolved for the attributes panel. */\nexport interface PluginPropField {\n  name: string\n  type: NonNullable<PluginPropSchema['type']>\n  label: string\n  description?: string\n  default?: string | number | boolean\n  options?: Array<{ value: string; label?: string }>\n}\n\n/**\n * The settings an author may edit on a placed plugin (AGL-1049).\n *\n * Driven by `capabilities.props` — THE allowlist — and decorated by\n * `propSchema` where the publisher supplied one. That order is the whole\n * security property: the list of editable settings can never be longer than\n * the list of props that cross the bridge, whatever the schema says, so a\n * publisher cannot describe their way into a prop they did not declare.\n *\n * A plugin published before `propSchema` existed still gets a field per\n * declared prop, as plain text. That is the difference between guessing key\n * names in a JSON textarea and being shown them, and it needs no manifest\n * change to work — which matters, because every plugin installed today\n * predates this.\n */\nexport function resolvePluginPropFields(\n  manifest: { capabilities?: PluginCapabilities } | null | undefined,\n): PluginPropField[] {\n  const props = manifest?.capabilities?.props ?? []\n  const schema = new Map(\n    (manifest?.capabilities?.propSchema ?? []).map((entry) => [\n      entry.name,\n      entry,\n    ]),\n  )\n  return props.map((name) => {\n    const declared = schema.get(name)\n    return {\n      name,\n      type: declared?.type ?? 'string',\n      label: declared?.label ?? name,\n      ...(declared?.description ? { description: declared.description } : {}),\n      ...(declared?.default !== undefined ? { default: declared.default } : {}),\n      ...(declared?.options ? { options: declared.options } : {}),\n    }\n  })\n}\n\n/**\n * Keys an author has set that the plugin will silently ignore.\n *\n * The failure this exists to surface: `filterPluginProps` drops anything not\n * in the allowlist, so a typo does not fail — it just quietly does nothing,\n * which is the worst of the options. Naming the key is the whole fix.\n */\nexport function unknownPluginPropKeys(\n  manifest: { capabilities?: PluginCapabilities } | null | undefined,\n  values: Record<string, unknown> | null | undefined,\n): string[] {\n  if (!values) return []\n  const allowed = new Set(manifest?.capabilities?.props ?? [])\n  return Object.keys(values).filter((key) => !allowed.has(key))\n}\n\n/** A declared element, resolved for the palette. */\nexport interface PluginPaletteElement {\n  listingId: string\n  elementId: string\n  displayName: string\n  description?: string\n  category: string\n  /** mdi icon NAME; the surface looks it up, never renders it as markup. */\n  icon?: string\n  fields: PluginPropField[]\n}\n\n/**\n * The palette entries an installed plugin contributes (AGL-1031).\n *\n * Resolved from the PINNED install, which is what makes the two guarantees in\n * the issue hold without extra machinery: an element only appears where the\n * plugin is installed, and a revoked or downgraded version's elements vanish\n * with it, because the palette is rebuilt from whatever the pin now points at.\n *\n * Attributes come back through `resolvePluginPropFields`, so an element's\n * editable fields are bounded by `capabilities.props` exactly like the generic\n * plugin element's are. A declared element cannot widen what crosses the\n * bridge; it only gives the same props a better name and a better editor.\n */\nexport function resolvePluginElements(\n  install:\n    | {\n        listingId?: string\n        capabilities?: PluginCapabilities\n        manifest?: { elements?: PluginElementDeclaration[] }\n        elements?: PluginElementDeclaration[]\n      }\n    | null\n    | undefined,\n): PluginPaletteElement[] {\n  const listingId = install?.listingId\n  if (!listingId) return []\n  const declared = install?.elements ?? install?.manifest?.elements ?? []\n  const capabilities = install?.capabilities\n  return declared.map((element) => ({\n    listingId,\n    elementId: element.id,\n    displayName: element.displayName,\n    ...(element.description ? { description: element.description } : {}),\n    category: element.category ?? 'Data Display',\n    ...(element.icon ? { icon: element.icon } : {}),\n    // Per-element attributes when declared; otherwise the plugin's whole\n    // declared prop set, which is still better than a JSON box.\n    fields: element.attributes?.length\n      ? resolvePluginPropFields({\n          capabilities: {\n            props: element.attributes.map((attribute) => attribute.name),\n            propSchema: element.attributes,\n          },\n        })\n      : resolvePluginPropFields({ capabilities }),\n  }))\n}\n"],"names":["sanitizePluginContributions","PLUGIN_ELEMENT_CATEGORIES","PLUGIN_MAX_ELEMENTS","PLUGIN_ID_PATTERN","PLUGIN_VERSION_PATTERN","PLUGIN_MAX_NETWORK_ORIGINS","PLUGIN_MAX_PROPS","PLUGIN_PROP_TEXT_MAX","MDI_ICON_NAME_PATTERN","PROP_SCHEMA_TYPES","Set","PLUGIN_MAX_EVENTS","PLUGIN_MAX_SIZE_PX","HTTPS_ORIGIN_PATTERN","IDENTIFIER_PATTERN","sanitizePropSchemaList","input","declared","Array","isArray","out","seen","raw","slice","entry","name","test","has","add","type","String","next","key","value","trim","fallback","default","options","map","option","record","label","filter","Boolean","length","push","validatePluginManifest","ok","error","id","version","startsWith","capabilitiesInput","capabilities","network","undefined","origin","list","max","propSchemaInput","propSchema","props","size","width","Number","height","isFinite","restrict","ids","hostAbiRaw","hostAbi","isInteger","elementsInput","elements","declaredProps","seenIds","rawElement","entryRecord","elementId","elementName","element","displayName","elementDescription","description","elementCategory","includes","category","elementIcon","icon","elementAttributes","attributes","contributes","verdict","contributions","manifest","Object","keys","restrictParent","restrictChildren","isPluginRevoked","revocation","isListingWideRevocation","versions","offeredPluginVersion","listing","offered","latestApprovedVersion","newestInstallableVersion","compare","newest","reviewState","nextRevocationState","current","change","takenDown","source","reviewVersions","withReview","stillTakenDown","_source","rest","PLUGIN_FETCH_METHODS","PLUGIN_FETCH_MAX_BODY_BYTES","isPluginNetworkAllowed","url","allow","parsed","URL","protocol","PLUGIN_COMPONENT_ID","attachPluginInstalls","nodes","installsByListingId","node","entries","listingId","componentId","install","sha256","revoked","resolvePluginPropFields","schema","Map","get","unknownPluginPropKeys","values","allowed","resolvePluginElements","fields","attribute"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;;AAGD,SACEA,2BAA2B,QAEtB,4CAAwC;AAmF/C;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA+C;IAC1D;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,yEAAyE,GACzE,OAAO,MAAMC,sBAAsB,GAAE;AAyKrC,cAAc,4BAAwB;AAEtC,OAAO,MAAMC,oBAAoB,yBAAwB;AACzD,OAAO,MAAMC,yBAAyB,kBAAiB;AACvD,OAAO,MAAMC,6BAA6B,GAAE;AAC5C,OAAO,MAAMC,mBAAmB,GAAE;AAClC,2EAA2E,GAC3E,MAAMC,uBAAuB;AAC7B;;;;;;CAMC,GACD,MAAMC,wBAAwB;AAC9B,MAAMC,oBAAoB,IAAIC,IAAI;IAChC;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AACD,OAAO,MAAMC,oBAAoB,GAAE;AACnC,OAAO,MAAMC,qBAAqB,KAAI;AACtC,MAAMC,uBAAuB;AAC7B,MAAMC,qBAAqB;AAE3B;;;;;CAKC,GACD;;;;;;CAMC,GACD,SAASC,uBACPC,KAAc,EACdC,QAA6B;IAE7B,IAAI,CAACC,MAAMC,OAAO,CAACH,QAAQ,OAAO,EAAE;IACpC,MAAMI,MAA0B,EAAE;IAClC,MAAMC,OAAO,IAAIX;IACjB,KAAK,MAAMY,OAAON,MAAMO,KAAK,CAAC,GAAGjB,kBAAmB;QAClD,IAAI,CAACgB,OAAO,OAAOA,QAAQ,UAAU;QACrC,MAAME,QAAQF;QACd,MAAMG,OAAOD,KAAK,CAAC,OAAO;QAC1B,IAAI,OAAOC,SAAS,YAAY,CAACX,mBAAmBY,IAAI,CAACD,OAAO;QAChE,IAAI,CAACR,SAASU,GAAG,CAACF,SAASJ,KAAKM,GAAG,CAACF,OAAO;QAC3CJ,KAAKO,GAAG,CAACH;QACT,MAAMI,OAAOpB,kBAAkBkB,GAAG,CAACG,OAAON,KAAK,CAAC,OAAO,KAClDA,KAAK,CAAC,OAAO,GACd;QACJ,MAAMO,OAAyB;YAAEN;YAAMI;QAAK;QAC5C,KAAK,MAAMG,OAAO;YAAC;YAAS;SAAc,CAAW;YACnD,MAAMC,QAAQT,KAAK,CAACQ,IAAI;YACxB,IAAI,OAAOC,UAAU,YAAYA,MAAMC,IAAI,IAAI;gBAC7CH,IAAI,CAACC,IAAI,GAAGC,MAAMC,IAAI,GAAGX,KAAK,CAAC,GAAGhB;YACpC;QACF;QACA,MAAM4B,WAAWX,KAAK,CAAC,UAAU;QACjC,IACE,OAAOW,aAAa,YACpB,OAAOA,aAAa,YACpB,OAAOA,aAAa,WACpB;YACAJ,KAAKK,OAAO,GACV,OAAOD,aAAa,WAChBA,SAASZ,KAAK,CAAC,GAAGhB,wBAClB4B;QACR;QACA,IAAIN,SAAS,YAAYX,MAAMC,OAAO,CAACK,KAAK,CAAC,UAAU,GAAG;YACxD,MAAMa,UAAU,AAACb,KAAK,CAAC,UAAU,CAC9Bc,GAAG,CAAC,CAACC;gBACJ,MAAMC,SAAUD,iBAAAA,SAAU,CAAC;gBAC3B,MAAMN,QAAQO,MAAM,CAAC,QAAQ;gBAC7B,IAAI,OAAOP,UAAU,YAAY,CAACA,OAAO,OAAO;gBAChD,MAAMQ,QAAQD,MAAM,CAAC,QAAQ;gBAC7B,OAAO;oBACLP,OAAOA,MAAMV,KAAK,CAAC,GAAGhB;mBAClB,OAAOkC,UAAU,YAAYA,MAAMP,IAAI,KACvC;oBAAEO,OAAOA,MAAMP,IAAI,GAAGX,KAAK,CAAC,GAAGhB;gBAAsB,IACrD,CAAC;YAET,GACCmC,MAAM,CAACC;YACV,IAAIN,QAAQO,MAAM,EAAEb,KAAKM,OAAO,GAAGA,QAAQd,KAAK,CAAC,GAAGjB;QACtD;QACAc,IAAIyB,IAAI,CAACd;IACX;IACA,OAAOX;AACT;AAEA,OAAO,SAAS0B,uBACd9B,KAAc;QAMIM,SAIKA,cAIHA,WAICA,YAOMA;IAvB3B,IAAI,CAACN,SAAS,OAAOA,UAAU,UAAU;QACvC,OAAO;YAAE+B,IAAI;YAAOC,OAAO;QAA6B;IAC1D;IACA,MAAM1B,MAAMN;IACZ,MAAMiC,KAAKnB,QAAOR,UAAAA,GAAG,CAAC,KAAK,YAATA,UAAa;IAC/B,IAAI,CAACnB,kBAAkBuB,IAAI,CAACuB,KAAK;QAC/B,OAAO;YAAEF,IAAI;YAAOC,OAAO;QAAoB;IACjD;IACA,MAAME,UAAUpB,QAAOR,eAAAA,GAAG,CAAC,UAAU,YAAdA,eAAkB;IACzC,IAAI,CAAClB,uBAAuBsB,IAAI,CAACwB,UAAU;QACzC,OAAO;YAAEH,IAAI;YAAOC,OAAO;QAAsC;IACnE;IACA,MAAMvB,OAAOK,QAAOR,YAAAA,GAAG,CAAC,OAAO,YAAXA,YAAe,IAAIY,IAAI;IAC3C,IAAI,CAACT,QAAQA,KAAKmB,MAAM,GAAG,IAAI;QAC7B,OAAO;YAAEG,IAAI;YAAOC,OAAO;QAAkC;IAC/D;IACA,MAAMxB,QAAQM,QAAOR,aAAAA,GAAG,CAAC,QAAQ,YAAZA,aAAgB,IAAIY,IAAI;IAC7C,qEAAqE;IACrE,4CAA4C;IAC5C,IAAI,CAACV,SAAS,uBAAuBE,IAAI,CAACF,UAAUA,MAAM2B,UAAU,CAAC,OAAO;QAC1E,OAAO;YAAEJ,IAAI;YAAOC,OAAO;QAAuC;IACpE;IAEA,MAAMI,qBAAqB9B,oBAAAA,GAAG,CAAC,eAAe,YAAnBA,oBAAuB,CAAC;IAInD,MAAM+B,eAAmC,CAAC;IAE1C,MAAMC,UAAUF,iBAAiB,CAAC,UAAU;IAC5C,IAAIE,YAAYC,WAAW;QACzB,IAAI,CAACrC,MAAMC,OAAO,CAACmC,YAAYA,QAAQV,MAAM,GAAGvC,4BAA4B;YAC1E,OAAO;gBAAE0C,IAAI;gBAAOC,OAAO;YAAoC;QACjE;QACA,KAAK,MAAMQ,UAAUF,QAAS;YAC5B,IAAI,OAAOE,WAAW,YAAY,CAAC3C,qBAAqBa,IAAI,CAAC8B,SAAS;gBACpE,OAAO;oBACLT,IAAI;oBACJC,OAAO,CAAC,gBAAgB,EAAEQ,OAAO,yBAAyB,CAAC;gBAC7D;YACF;QACF;QACA,IAAIF,QAAQV,MAAM,EAAES,aAAaC,OAAO,GAAG;eAAI,IAAI5C,IAAI4C;SAAqB;IAC9E;IAEA,KAAK,MAAMtB,OAAO;QAAC;QAAS;KAAS,CAAW;QAC9C,MAAMyB,OAAOL,iBAAiB,CAACpB,IAAI;QACnC,IAAIyB,SAASF,WAAW;QACxB,MAAMG,MAAM1B,QAAQ,UAAU1B,mBAAmBK;QACjD,IAAI,CAACO,MAAMC,OAAO,CAACsC,SAASA,KAAKb,MAAM,GAAGc,KAAK;YAC7C,OAAO;gBAAEX,IAAI;gBAAOC,OAAO,CAAC,SAAS,EAAEhB,IAAI,SAAS,CAAC;YAAC;QACxD;QACA,KAAK,MAAMP,QAAQgC,KAAM;YACvB,IAAI,OAAOhC,SAAS,YAAY,CAACX,mBAAmBY,IAAI,CAACD,OAAO;gBAC9D,OAAO;oBAAEsB,IAAI;oBAAOC,OAAO,CAAC,QAAQ,EAAEhB,IAAI,OAAO,EAAEP,KAAK,CAAC,CAAC;gBAAC;YAC7D;QACF;QACA,IAAIgC,KAAKb,MAAM,EAAES,YAAY,CAACrB,IAAI,GAAG;eAAI,IAAItB,IAAI+C;SAAkB;IACrE;IAEA;;;;;;;;;;;;;;GAcC,GACD,MAAME,kBAAkBP,iBAAiB,CAAC,aAAa;IACvD,IAAIO,oBAAoBJ,WAAW;YASvBF;QARV,IACE,CAACnC,MAAMC,OAAO,CAACwC,oBACfA,gBAAgBf,MAAM,GAAGtC,kBACzB;YACA,OAAO;gBAAEyC,IAAI;gBAAOC,OAAO;YAAiC;QAC9D;QACA,MAAMY,aAAa7C,uBACjB4C,iBACA,IAAIjD,KAAI2C,sBAAAA,aAAaQ,KAAK,YAAlBR,sBAAsB,EAAE;QAElC,IAAIO,WAAWhB,MAAM,EAAES,aAAaO,UAAU,GAAGA;IACnD;IAEA,MAAME,OAAOV,iBAAiB,CAAC,OAAO;IAGtC,IAAIU,MAAM;YACaA,aACCA;QADtB,MAAMC,QAAQC,QAAOF,cAAAA,KAAKC,KAAK,YAAVD,cAAc;QACnC,MAAMG,SAASD,QAAOF,eAAAA,KAAKG,MAAM,YAAXH,eAAe;QACrC,IACE,AAACA,KAAKC,KAAK,KAAKR,aACb,CAAA,CAACS,OAAOE,QAAQ,CAACH,UAAUA,QAAQ,KAAKA,QAAQnD,kBAAiB,KACnEkD,KAAKG,MAAM,KAAKV,aACd,CAAA,CAACS,OAAOE,QAAQ,CAACD,WAChBA,SAAS,KACTA,SAASrD,kBAAiB,GAC9B;YACA,OAAO;gBAAEmC,IAAI;gBAAOC,OAAO;YAAgC;QAC7D;QACAK,aAAaS,IAAI,GAAG,aACdA,KAAKC,KAAK,KAAKR,YAAY;YAAEQ;QAAM,IAAI,CAAC,GACxCD,KAAKG,MAAM,KAAKV,YAAY;YAAEU;QAAO,IAAI,CAAC;IAElD;IAEA,MAAME,WAAW,CAAClC;QAChB,IAAI,CAACf,MAAMC,OAAO,CAACc,QAAQ,OAAOsB;QAClC,MAAMa,MAAMnC,MAAMS,MAAM,CACtB,CAAClB,QAA2B,OAAOA,UAAU,YAAYA,MAAMoB,MAAM,GAAG;QAE1E,OAAOwB,IAAIxB,MAAM,GAAG;eAAI,IAAIlC,IAAI0D;SAAK,GAAGb;IAC1C;IAEA,MAAMc,aAAa/C,GAAG,CAAC,UAAU;IACjC,IAAIgD;IACJ,IAAID,eAAed,WAAW;QAC5Be,UAAUN,OAAOK;QACjB,IAAI,CAACL,OAAOO,SAAS,CAACD,YAAYA,UAAU,KAAKA,UAAU,IAAI;YAC7D,OAAO;gBAAEvB,IAAI;gBAAOC,OAAO;YAA2C;QACxE;IACF;IAEA;;;;;;;GAOC,GACD,MAAMwB,gBAAgBlD,GAAG,CAAC,WAAW;IACrC,MAAMmD,WAAuC,EAAE;IAC/C,IAAID,kBAAkBjB,WAAW;YAODF;QAN9B,IACE,CAACnC,MAAMC,OAAO,CAACqD,kBACfA,cAAc5B,MAAM,GAAG1C,qBACvB;YACA,OAAO;gBAAE6C,IAAI;gBAAOC,OAAO;YAA6B;QAC1D;QACA,MAAM0B,gBAAgB,IAAIhE,KAAI2C,uBAAAA,aAAaQ,KAAK,YAAlBR,uBAAsB,EAAE;QACtD,MAAMsB,UAAU,IAAIjE;QACpB,KAAK,MAAMkE,cAAcJ,cAAe;YACtC,IAAI,CAACI,cAAc,OAAOA,eAAe,UAAU;YACnD,MAAMC,cAAcD;YACpB,MAAME,YAAYD,WAAW,CAAC,KAAK;YACnC,MAAME,cAAcF,WAAW,CAAC,cAAc;YAC9C,IAAI,OAAOC,cAAc,YAAY,CAAChE,mBAAmBY,IAAI,CAACoD,YAAY;gBACxE;YACF;YACA,IAAIH,QAAQhD,GAAG,CAACmD,YAAY;YAC5B,IAAI,OAAOC,gBAAgB,YAAY,CAACA,YAAY7C,IAAI,IAAI;YAC5DyC,QAAQ/C,GAAG,CAACkD;YACZ,MAAME,UAAoC;gBACxC/B,IAAI6B;gBACJG,aAAaF,YAAY7C,IAAI,GAAGX,KAAK,CAAC,GAAGhB;YAC3C;YACA,MAAM2E,qBAAqBL,WAAW,CAAC,cAAc;YACrD,IAAI,OAAOK,uBAAuB,YAAYA,mBAAmBhD,IAAI,IAAI;gBACvE8C,QAAQG,WAAW,GAAGD,mBACnBhD,IAAI,GACJX,KAAK,CAAC,GAAGhB;YACd;YACA,uEAAuE;YACvE,iDAAiD;YACjD,yEAAyE;YACzE,qDAAqD;YACrD,MAAM6E,kBAAkBP,WAAW,CAAC,WAAW;YAC/C,IACE,OAAOO,oBAAoB,YAC3BnF,0BAA0BoF,QAAQ,CAACD,kBACnC;gBACAJ,QAAQM,QAAQ,GAAGF;YACrB;YACA,MAAMG,cAAcV,WAAW,CAAC,OAAO;YACvC,IACE,OAAOU,gBAAgB,YACvB/E,sBAAsBkB,IAAI,CAAC6D,cAC3B;gBACAP,QAAQQ,IAAI,GAAGD;YACjB;YACA,MAAME,oBAAoB1E,uBACxB8D,WAAW,CAAC,aAAa,EACzBH;YAEF,IAAIe,kBAAkB7C,MAAM,EAAEoC,QAAQU,UAAU,GAAGD;YACnDhB,SAAS5B,IAAI,CAACmC;QAChB;IACF;IAEA;;;;GAIC,GACD,IAAIW;IACJ,IAAIrE,GAAG,CAAC,cAAc,KAAKiC,WAAW;QACpC,MAAMqC,UAAU5F,4BAA4BsB,GAAG,CAAC,cAAc;QAC9D,IAAIsE,QAAQ7C,EAAE,KAAK,OAAO,OAAO;YAAEA,IAAI;YAAOC,OAAO4C,QAAQ5C,KAAK;QAAC;QACnE2C,cAAcC,QAAQC,aAAa;IACrC;IAEA,OAAO;QACL9C,IAAI;QACJ+C,UAAU;YACR7C;YACAxB;YACAyB;YACA1B;WACI8C,YAAYf,YAAY;YAAEe;QAAQ,IAAI,CAAC,GACvCqB,cAAc;YAAEA;QAAY,IAAI,CAAC,GACjCI,OAAOC,IAAI,CAAC3C,cAAcT,MAAM,GAAG;YAAES;QAAa,IAAI,CAAC,GACvDoB,SAAS7B,MAAM,GAAG;YAAE6B;QAAS,IAAI,CAAC,GAClCN,SAAS7C,GAAG,CAAC,iBAAiB,IAC9B;YAAE2E,gBAAgB9B,SAAS7C,GAAG,CAAC,iBAAiB;QAAE,IAClD,CAAC,GACD6C,SAAS7C,GAAG,CAAC,mBAAmB,IAChC;YAAE4E,kBAAkB/B,SAAS7C,GAAG,CAAC,mBAAmB;QAAE,IACtD,CAAC,GACD,OAAOA,GAAG,CAAC,cAAc,KAAK,WAC9B;YAAE6D,aAAarD,OAAOR,GAAG,CAAC,cAAc,EAAEC,KAAK,CAAC,GAAG;QAAK,IACxD,CAAC;IAET;AACF;AAGA;;;;;;;;;;;;;;CAcC,GAED;;;;CAIC,GACD,OAAO,SAAS4E,gBACdC,UAA+C,EAC/ClD,OAAe;IAEf,IAAI,CAACkD,YAAY,OAAO;IACxB,IAAIC,wBAAwBD,aAAa,OAAO;IAChD,OACElF,MAAMC,OAAO,CAACiF,WAAWE,QAAQ,KAAKF,WAAWE,QAAQ,CAACjB,QAAQ,CAACnC;AAEvE;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASmD,wBACdD,UAA+C;IAE/C,OAAOA,CAAAA,8BAAAA,WAAYE,QAAQ,MAAK;AAClC;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASC,qBACdC,OAA+D,EAC/DJ,UAA+C;;IAE/C,MAAMK,UAAU3E,eAAO0E,2BAAAA,QAASE,qBAAqB,mBAAI;IACzD,IAAI,CAACD,SAAS,OAAO;IACrB,OAAON,gBAAgBC,YAAYK,WAAW,OAAOA;AACvD;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE,yBACdL,QAA+D,EAC/DF,UAA+C,EAC/CQ,OAAgD;IAEhD,IAAIC,SAAwB;IAC5B,KAAK,MAAMrF,SAAS8E,SAAU;YAILM;QAHvB,IAAI,EAACpF,yBAAAA,MAAO0B,OAAO,GAAE;QACrB,IAAI1B,MAAMsF,WAAW,KAAK,YAAY;QACtC,IAAIX,gBAAgBC,YAAY5E,MAAM0B,OAAO,GAAG;QAChD,IAAI2D,UAAU,QAAQ,EAACD,WAAAA,QAAQC,QAAQrF,MAAM0B,OAAO,aAA7B0D,WAAkC,KAAK,GAAG;YAC/DC,SAASrF,MAAM0B,OAAO;QACxB;IACF;IACA,OAAO2D;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASE,oBACdC,OAA4C,EAC5CC,MAIuB;;IAEvB,MAAMC,YAAYF,CAAAA,2BAAAA,QAASG,MAAM,MAAK;IACtC,0EAA0E;IAC1E,kEAAkE;IAClE,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,MAAMC,iBAAiB;mBACjBJ,2BAAAA,QAASI,cAAc,mBACxBlG,MAAMC,OAAO,CAAC6F,2BAAAA,QAASV,QAAQ,IAAIU,QAAQV,QAAQ,GAAG,EAAE;KAC5D;IACD,MAAMe,aAAa,CAACf,UAAoBgB;QACtC,IAAIA,gBAAgB;YAClB,OAAO,aAAKN;gBAASV,UAAU;gBAAgBc,gBAAgBd;;QACjE;QACA,IAAI,CAACA,SAAS1D,MAAM,EAAE,OAAO;QAC7B,aAAqCoE,kBAAAA,UAAW,CAAC,GAA3C,EAAEG,QAAQI,OAAO,EAAW,SAANC;;;QAC5B,OAAO,aAAKA;YAAMlB;YAAUc,gBAAgBd;;IAC9C;IACA,OAAQW,OAAOpF,IAAI;QACjB,KAAK;YAAkB;gBACrB,MAAME,OAAOqF,eAAe/B,QAAQ,CAAC4B,OAAO/D,OAAO,IAC/CkE,iBACA;uBAAIA;oBAAgBH,OAAO/D,OAAO;iBAAC;gBACvC,OAAOmE,WAAWtF,MAAMmF;YAC1B;QACA,KAAK;YAAoB;gBACvB,OAAOG,WACLD,eAAe1E,MAAM,CAAC,CAAClB,QAAUA,UAAUyF,OAAO/D,OAAO,GACzDgE;YAEJ;QACA,KAAK;YACH,OAAO,aAAKF;gBAASV,UAAU;gBAAOa,QAAQ;gBAAYC;;QAC5D,KAAK;YACH,uEAAuE;YACvE,8DAA8D;YAC9D,OAAOC,WAAWD,gBAAgB;IACtC;AACF;AAEA,4DAA4D,GAC5D,OAAO,MAAMK,uBAAuB;IAAC;IAAO;CAAO,CAAS;AAE5D,+DAA+D,GAC/D,OAAO,MAAMC,8BAA8B,MAAM,KAAI;AAErD;;;;;;CAMC,GACD,OAAO,SAASC,uBACdC,GAAW,EACXvE,YAA4C;IAE5C,MAAMwE,QAAQxE,gCAAAA,aAAcC,OAAO;IACnC,IAAI,EAACuE,yBAAAA,MAAOjF,MAAM,GAAE,OAAO;IAC3B,IAAI;QACF,MAAMkF,SAAS,IAAIC,IAAIH;QACvB,IAAIE,OAAOE,QAAQ,KAAK,UAAU,OAAO;QACzC,OAAOH,MAAMxC,QAAQ,CAACyC,OAAOtE,MAAM;IACrC,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA,uEAAuE,GACvE,OAAO,MAAMyE,sBAAsB,oBAAmB;AAWtD;;;;;;;;CAQC,GACD,OAAO,SAASC,qBACdC,KAAQ,EACRC,mBAAsE;IAEtE,IAAI,CAACrC,OAAOC,IAAI,CAACoC,qBAAqBxF,MAAM,EAAE,OAAOuF;IACrD,MAAMpG,OAA4B,CAAC;IACnC,KAAK,MAAM,CAACkB,IAAIoF,KAAK,IAAItC,OAAOuC,OAAO,CAACH,OAAQ;YAGxCE;QAFN,MAAME,YACJF,CAAAA,wBAAAA,KAAMG,WAAW,MAAKP,sBAClBI,yBAAAA,cAAAA,KAAMxE,KAAK,qBAAXwE,YAAaE,SAAS,GACtBhF;QACN,MAAMkF,UAAUF,YACZH,mBAAmB,CAACtG,OAAOyG,WAAW,GACtChF;QACJxB,IAAI,CAACkB,GAAG,GAAGwF,UACP,aACKJ;YACHxE,OAAO,aACFwE,KAAKxE,KAAK;gBACbX,SAASuF,QAAQvF,OAAO;gBACxBwF,QAAQD,QAAQC,MAAM;gBACtBrF,cAAcoF,QAAQpF,YAAY;gBAClCsF,SAAShG,QAAQ8F,QAAQE,OAAO;;aAGpCN;IACN;IACA,OAAOtG;AACT;AAYA;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAAS6G,wBACd9C,QAAkE;;QAEpDA,wBAEXA;IAFH,MAAMjC,gBAAQiC,6BAAAA,yBAAAA,SAAUzC,YAAY,qBAAtByC,uBAAwBjC,KAAK,mBAAI,EAAE;IACjD,MAAMgF,SAAS,IAAIC,IACjB,UAAChD,6BAAAA,0BAAAA,SAAUzC,YAAY,qBAAtByC,wBAAwBlC,UAAU,oBAAI,EAAE,EAAEtB,GAAG,CAAC,CAACd,QAAU;YACxDA,MAAMC,IAAI;YACVD;SACD;IAEH,OAAOqC,MAAMvB,GAAG,CAAC,CAACb;;QAChB,MAAMR,WAAW4H,OAAOE,GAAG,CAACtH;QAC5B,OAAO;YACLA;YACAI,IAAI,UAAEZ,4BAAAA,SAAUY,IAAI,mBAAI;YACxBY,KAAK,WAAExB,4BAAAA,SAAUwB,KAAK,oBAAIhB;WACtBR,CAAAA,4BAAAA,SAAUkE,WAAW,IAAG;YAAEA,aAAalE,SAASkE,WAAW;QAAC,IAAI,CAAC,GACjElE,CAAAA,4BAAAA,SAAUmB,OAAO,MAAKmB,YAAY;YAAEnB,SAASnB,SAASmB,OAAO;QAAC,IAAI,CAAC,GACnEnB,CAAAA,4BAAAA,SAAUoB,OAAO,IAAG;YAAEA,SAASpB,SAASoB,OAAO;QAAC,IAAI,CAAC;IAE7D;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAAS2G,sBACdlD,QAAkE,EAClEmD,MAAkD;;QAG1BnD;IADxB,IAAI,CAACmD,QAAQ,OAAO,EAAE;IACtB,MAAMC,UAAU,IAAIxI,YAAIoF,6BAAAA,yBAAAA,SAAUzC,YAAY,qBAAtByC,uBAAwBjC,KAAK,mBAAI,EAAE;IAC3D,OAAOkC,OAAOC,IAAI,CAACiD,QAAQvG,MAAM,CAAC,CAACV,MAAQ,CAACkH,QAAQvH,GAAG,CAACK;AAC1D;AAcA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASmH,sBACdV,OAQa;QAIIA;QAAqBA;IAFtC,MAAMF,YAAYE,2BAAAA,QAASF,SAAS;IACpC,IAAI,CAACA,WAAW,OAAO,EAAE;IACzB,MAAMtH,YAAWwH,gBAAAA,2BAAAA,QAAShE,QAAQ,oBAAIgE,4BAAAA,oBAAAA,QAAS3C,QAAQ,qBAAjB2C,kBAAmBhE,QAAQ,YAAhDgE,OAAoD,EAAE;IACvE,MAAMpF,eAAeoF,2BAAAA,QAASpF,YAAY;IAC1C,OAAOpC,SAASqB,GAAG,CAAC,CAAC0C;YAKTA;YAIFA;eATwB;YAChCuD;YACAzD,WAAWE,QAAQ/B,EAAE;YACrBgC,aAAaD,QAAQC,WAAW;WAC5BD,QAAQG,WAAW,GAAG;YAAEA,aAAaH,QAAQG,WAAW;QAAC,IAAI,CAAC;YAClEG,QAAQ,GAAEN,oBAAAA,QAAQM,QAAQ,YAAhBN,oBAAoB;WAC1BA,QAAQQ,IAAI,GAAG;YAAEA,MAAMR,QAAQQ,IAAI;QAAC,IAAI,CAAC;YAC7C,qEAAqE;YACrE,4DAA4D;YAC5D4D,QAAQpE,EAAAA,sBAAAA,QAAQU,UAAU,qBAAlBV,oBAAoBpC,MAAM,IAC9BgG,wBAAwB;gBACtBvF,cAAc;oBACZQ,OAAOmB,QAAQU,UAAU,CAACpD,GAAG,CAAC,CAAC+G,YAAcA,UAAU5H,IAAI;oBAC3DmC,YAAYoB,QAAQU,UAAU;gBAChC;YACF,KACAkD,wBAAwB;gBAAEvF;YAAa;;;AAE/C"}

package/src/lib/app-utils/published-legal-pages.d.ts

@@ -0,0 +1,71 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Which legal documents actually have a page (AGL-1660).
+ *
+ * The apps link legal documents by absolute URL, because the canonical text
+ * lives on the marketing site rather than in the repo. That works right up
+ * until a constant names a document nobody published: `PUBLISHER_AGREEMENT_URL`
+ * pointed at `/legal/marketplace-publisher-agreement` for two and a half weeks
+ * while the console asked publishers to accept it, and the URL 404ed the whole
+ * time. Nothing in the build could see that, and a legal audit found it.
+ *
+ * So the repo keeps its own record of what the site serves. It is a *list*, not
+ * a fetch: a test that hit the network would be offline-flaky and would pass
+ * against a stale ISR cache anyway (a cached 200 for a page since removed).
+ * A list is checkable in CI, and wrong in exactly one direction — it can only
+ * go stale by claiming a page exists, which is the mistake the reviewer of the
+ * edit that adds a path is looking straight at.
+ *
+ * VERIFIED 2026-08-14 against the live `/legal` index, which links these nine
+ * documents and no others. `/legal/marketplace-publisher-agreement` joined the
+ * list that day (AGL-1674), *after* the page was confirmed serving: fetched
+ * once, HTTP 200, and its body read out of the Flight payload rather than the
+ * DOM — at the time `<aglyn-text>` rendered into shadow roots and grepped
+ * empty (no longer so since AGL-2011). The payload
+ * carried exactly one text row, sha256
+ * 66e1f8fb3956cfed1b71712c9aaf38ed736b956de571160b7c3cf83add923d90, identical
+ * to the approved source, with all fourteen sections and no `DRAFT` or
+ * `[EFFECTIVE DATE]` anywhere in the response.
+ *
+ * That ordering is the rule, not a courtesy. `publisherAgreementIsPublished()`
+ * reads this list, so adding a path here is what re-opens the acceptance
+ * control in the console, the accept route and the publish refusal — all three
+ * at once. Added before the page serves, the gate becomes a lie in the other
+ * direction, and the acceptance it collects is the signature-on-a-blank-page
+ * this whole file exists to prevent. Verify first, then add.
+ */
+/**
+ * The origin the canonical legal documents are served from.
+ *
+ * Configurable (AGL-2017): `isPublishedLegalUrl` gates the marketplace
+ * publisher agreement, and pinned to our origin it answered `true` for AGLYN's
+ * URLs on an operator's deployment regardless of what they had published — a
+ * gate blind to the deployment it is gating. Same variable the clickwrap links
+ * read, so the two cannot disagree about whose documents this install serves.
+ */
+export declare const LEGAL_ORIGIN: string;
+/** Paths under {@link LEGAL_ORIGIN} that have a published page. */
+export declare const PUBLISHED_LEGAL_PATHS: readonly string[];
+/**
+ * Whether `url` names a legal document that is actually published.
+ *
+ * Accepts an absolute URL or a site-relative path. Anything on another origin
+ * is false — a lookalike host is not our published text, and this is used to
+ * decide whether a user may be asked to agree to something.
+ */
+export declare function isPublishedLegalUrl(url: string | null | undefined): boolean;

package/src/lib/app-utils/published-legal-pages.js

@@ -0,0 +1,90 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Which legal documents actually have a page (AGL-1660).
+ *
+ * The apps link legal documents by absolute URL, because the canonical text
+ * lives on the marketing site rather than in the repo. That works right up
+ * until a constant names a document nobody published: `PUBLISHER_AGREEMENT_URL`
+ * pointed at `/legal/marketplace-publisher-agreement` for two and a half weeks
+ * while the console asked publishers to accept it, and the URL 404ed the whole
+ * time. Nothing in the build could see that, and a legal audit found it.
+ *
+ * So the repo keeps its own record of what the site serves. It is a *list*, not
+ * a fetch: a test that hit the network would be offline-flaky and would pass
+ * against a stale ISR cache anyway (a cached 200 for a page since removed).
+ * A list is checkable in CI, and wrong in exactly one direction — it can only
+ * go stale by claiming a page exists, which is the mistake the reviewer of the
+ * edit that adds a path is looking straight at.
+ *
+ * VERIFIED 2026-08-14 against the live `/legal` index, which links these nine
+ * documents and no others. `/legal/marketplace-publisher-agreement` joined the
+ * list that day (AGL-1674), *after* the page was confirmed serving: fetched
+ * once, HTTP 200, and its body read out of the Flight payload rather than the
+ * DOM — at the time `<aglyn-text>` rendered into shadow roots and grepped
+ * empty (no longer so since AGL-2011). The payload
+ * carried exactly one text row, sha256
+ * 66e1f8fb3956cfed1b71712c9aaf38ed736b956de571160b7c3cf83add923d90, identical
+ * to the approved source, with all fourteen sections and no `DRAFT` or
+ * `[EFFECTIVE DATE]` anywhere in the response.
+ *
+ * That ordering is the rule, not a courtesy. `publisherAgreementIsPublished()`
+ * reads this list, so adding a path here is what re-opens the acceptance
+ * control in the console, the accept route and the publish refusal — all three
+ * at once. Added before the page serves, the gate becomes a lie in the other
+ * direction, and the acceptance it collects is the signature-on-a-blank-page
+ * this whole file exists to prevent. Verify first, then add.
+ */ /**
+ * The origin the canonical legal documents are served from.
+ *
+ * Configurable (AGL-2017): `isPublishedLegalUrl` gates the marketplace
+ * publisher agreement, and pinned to our origin it answered `true` for AGLYN's
+ * URLs on an operator's deployment regardless of what they had published — a
+ * gate blind to the deployment it is gating. Same variable the clickwrap links
+ * read, so the two cannot disagree about whose documents this install serves.
+ */ export const LEGAL_ORIGIN = (process.env.NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN || 'https://aglyn.com').replace(/\/+$/, '');
+/** Paths under {@link LEGAL_ORIGIN} that have a published page. */ export const PUBLISHED_LEGAL_PATHS = [
+    '/legal',
+    '/legal/acceptable-use',
+    '/legal/cookies',
+    '/legal/dmca',
+    '/legal/dpa',
+    '/legal/eula',
+    '/legal/marketplace-publisher-agreement',
+    '/legal/privacy',
+    '/legal/subprocessors',
+    '/legal/terms'
+];
+/**
+ * Whether `url` names a legal document that is actually published.
+ *
+ * Accepts an absolute URL or a site-relative path. Anything on another origin
+ * is false — a lookalike host is not our published text, and this is used to
+ * decide whether a user may be asked to agree to something.
+ */ export function isPublishedLegalUrl(url) {
+    if (typeof url !== 'string' || !url.trim()) return false;
+    let parsed;
+    try {
+        parsed = new URL(url, LEGAL_ORIGIN);
+    } catch (unused) {
+        return false;
+    }
+    if (parsed.origin !== LEGAL_ORIGIN) return false;
+    const path = parsed.pathname.replace(/\/+$/, '') || '/';
+    return PUBLISHED_LEGAL_PATHS.includes(path);
+}
+
+//# sourceMappingURL=published-legal-pages.js.map

package/src/lib/app-utils/published-legal-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/published-legal-pages.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Which legal documents actually have a page (AGL-1660).\n *\n * The apps link legal documents by absolute URL, because the canonical text\n * lives on the marketing site rather than in the repo. That works right up\n * until a constant names a document nobody published: `PUBLISHER_AGREEMENT_URL`\n * pointed at `/legal/marketplace-publisher-agreement` for two and a half weeks\n * while the console asked publishers to accept it, and the URL 404ed the whole\n * time. Nothing in the build could see that, and a legal audit found it.\n *\n * So the repo keeps its own record of what the site serves. It is a *list*, not\n * a fetch: a test that hit the network would be offline-flaky and would pass\n * against a stale ISR cache anyway (a cached 200 for a page since removed).\n * A list is checkable in CI, and wrong in exactly one direction — it can only\n * go stale by claiming a page exists, which is the mistake the reviewer of the\n * edit that adds a path is looking straight at.\n *\n * VERIFIED 2026-08-14 against the live `/legal` index, which links these nine\n * documents and no others. `/legal/marketplace-publisher-agreement` joined the\n * list that day (AGL-1674), *after* the page was confirmed serving: fetched\n * once, HTTP 200, and its body read out of the Flight payload rather than the\n * DOM — at the time `<aglyn-text>` rendered into shadow roots and grepped\n * empty (no longer so since AGL-2011). The payload\n * carried exactly one text row, sha256\n * 66e1f8fb3956cfed1b71712c9aaf38ed736b956de571160b7c3cf83add923d90, identical\n * to the approved source, with all fourteen sections and no `DRAFT` or\n * `[EFFECTIVE DATE]` anywhere in the response.\n *\n * That ordering is the rule, not a courtesy. `publisherAgreementIsPublished()`\n * reads this list, so adding a path here is what re-opens the acceptance\n * control in the console, the accept route and the publish refusal — all three\n * at once. Added before the page serves, the gate becomes a lie in the other\n * direction, and the acceptance it collects is the signature-on-a-blank-page\n * this whole file exists to prevent. Verify first, then add.\n */\n\n/**\n * The origin the canonical legal documents are served from.\n *\n * Configurable (AGL-2017): `isPublishedLegalUrl` gates the marketplace\n * publisher agreement, and pinned to our origin it answered `true` for AGLYN's\n * URLs on an operator's deployment regardless of what they had published — a\n * gate blind to the deployment it is gating. Same variable the clickwrap links\n * read, so the two cannot disagree about whose documents this install serves.\n */\nexport const LEGAL_ORIGIN = (\n  process.env.NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN || 'https://aglyn.com'\n).replace(/\\/+$/, '')\n\n/** Paths under {@link LEGAL_ORIGIN} that have a published page. */\nexport const PUBLISHED_LEGAL_PATHS: readonly string[] = [\n  '/legal',\n  '/legal/acceptable-use',\n  '/legal/cookies',\n  '/legal/dmca',\n  '/legal/dpa',\n  '/legal/eula',\n  '/legal/marketplace-publisher-agreement',\n  '/legal/privacy',\n  '/legal/subprocessors',\n  '/legal/terms',\n]\n\n/**\n * Whether `url` names a legal document that is actually published.\n *\n * Accepts an absolute URL or a site-relative path. Anything on another origin\n * is false — a lookalike host is not our published text, and this is used to\n * decide whether a user may be asked to agree to something.\n */\nexport function isPublishedLegalUrl(url: string | null | undefined): boolean {\n  if (typeof url !== 'string' || !url.trim()) return false\n  let parsed: URL\n  try {\n    parsed = new URL(url, LEGAL_ORIGIN)\n  } catch {\n    return false\n  }\n  if (parsed.origin !== LEGAL_ORIGIN) return false\n  const path = parsed.pathname.replace(/\\/+$/, '') || '/'\n  return PUBLISHED_LEGAL_PATHS.includes(path)\n}\n"],"names":["LEGAL_ORIGIN","process","env","NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN","replace","PUBLISHED_LEGAL_PATHS","isPublishedLegalUrl","url","trim","parsed","URL","origin","path","pathname","includes"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GAED;;;;;;;;CAQC,GACD,OAAO,MAAMA,eAAe,AAC1BC,CAAAA,QAAQC,GAAG,CAACC,iCAAiC,IAAI,mBAAkB,EACnEC,OAAO,CAAC,QAAQ,IAAG;AAErB,iEAAiE,GACjE,OAAO,MAAMC,wBAA2C;IACtD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;CAMC,GACD,OAAO,SAASC,oBAAoBC,GAA8B;IAChE,IAAI,OAAOA,QAAQ,YAAY,CAACA,IAAIC,IAAI,IAAI,OAAO;IACnD,IAAIC;IACJ,IAAI;QACFA,SAAS,IAAIC,IAAIH,KAAKP;IACxB,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIS,OAAOE,MAAM,KAAKX,cAAc,OAAO;IAC3C,MAAMY,OAAOH,OAAOI,QAAQ,CAACT,OAAO,CAAC,QAAQ,OAAO;IACpD,OAAOC,sBAAsBS,QAAQ,CAACF;AACxC"}

package/src/lib/app-utils/publisher-agreement.d.ts

@@ -0,0 +1,254 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The version of the agreement currently in force.
+ *
+ * Matches the `Agreement version` header of the document itself, which is now
+ * besigner content at {@link PUBLISHER_AGREEMENT_URL} rather than a repo file
+ * (same practice as the Terms of Service). Bump this **only** when the
+ * substance changes in a way a publisher should re-read — a typo fix is not a
+ * bump. Bumping it stops every publisher at their next publish until they
+ * accept again.
+ *
+ * Moved off `2026-07-28.1` on 2026-08-14 (AGL-1674). That string named the
+ * July draft, which was never published and whose §8 said the publisher is the
+ * seller of record. The published text says the opposite — Aglyn processes the
+ * sale and remits transaction tax — so it is a different document in
+ * substance, not a reissue, and re-asking is the point rather than a cost.
+ *
+ * Moved to `2026-08-18.1` on 2026-08-18 (AGL-1840 + AGL-1661). Two body-text
+ * changes: §1 now says "the Aglyn marketplace" (the AGL-975 rename, and the
+ * reason this snapshot must NOT need the AGL-975 naming-guard exemption that
+ * the `2026-08-14.1` one still carries), and §1's cross-reference to
+ * the "End User Licence Agreement"
+ * becomes "License" to match the document that agreement actually is, which
+ * was renamed on the same day.
+ *
+ * ⚠️ Read against the "a typo fix is not a bump" rule above, both edits are
+ * closer to a typo than to substance, and the tension is real. The bump was
+ * taken anyway on the decision (2026-08-18), for a reason the rule does not
+ * cover: the served page changed, so keeping `2026-08-14.1` would leave the
+ * pin below asserting a hash for text nobody is shown any more — a FALSE
+ * RECORD, which is the exact failure the pin exists to detect. The choice is
+ * therefore between a bump and a broken pin, not between a bump and nothing.
+ *
+ * ## 2026-08-22 — the page changed and this string DELIBERATELY did not
+ *
+ * Three clauses were added on 2026-08-22 (§3(h) listing conduct, §8.6 sales
+ * through the Marketplace, §13.6 marks) and the pin below moved with them, but
+ * `2026-08-18.1` stayed. That is not the third option the paragraph above says
+ * does not exist — it is the same choice with one input changed. A bump exists
+ * to re-ask publishers who accepted the OLD text; production holds exactly one
+ * acceptance record and it is the own, so there is nobody to re-ask and the
+ * bump would buy nothing. the decision, 2026-08-22.
+ *
+ * The pin still had to move, for precisely the reason given above: the served
+ * bytes changed, so leaving the old hash here would assert a document nobody
+ * is shown. Version unchanged + pin re-captured is coherent ONLY while the
+ * acceptance set is empty. The first real publisher acceptance ends that, and
+ * from then on any body-text change costs a bump — see the same rule in
+ * `apps/console/constants/legal-documents.ts`, where the clickwrap snapshots
+ * collapsed back to `v1` on the identical argument.
+ *
+ * ## 2026-08-24 — `2026-08-24.1`, and why this one CANNOT be folded (AGL-1956)
+ *
+ * §13.3 changed twice in one sentence. The venue moved from Williamson County
+ * to TRAVIS County (decided) — Williamson entered from the former
+ * Jarrell residential address, while every published Aglyn address is 5900
+ * Balcones Dr STE 100, Austin, TX 78731, which is Travis. And the clause cited
+ * "Terms of Service Section 19" for governing law and venue when those live at
+ * §18.6; §19 is General. A wrong cross-reference in a forum-selection clause is
+ * the kind of defect that gets argued about, so it was corrected in the same
+ * pass.
+ *
+ * Unlike 2026-08-22, this one takes the bump rather than only re-pinning, and
+ * the deciding reason is mechanical rather than editorial: THIS VERSION STRING
+ * IS PUBLISHED IN THE DOCUMENT. The page at {@link PUBLISHER_AGREEMENT_URL}
+ * serves `Agreement version: 2026-08-24.1` in its own second line, so the
+ * capture below contains it, and `publisher-agreement-version.spec.ts` asserts
+ * the snapshot contains `Agreement version: ${PUBLISHER_AGREEMENT_VERSION}`.
+ * Holding the constant at `2026-08-18.1` against that text would need the page
+ * republished to say so, and would otherwise record a publisher as having
+ * accepted `2026-08-18.1` while naming bytes that call themselves
+ * `2026-08-24.1`. That is a false record of exactly the shape the pin exists
+ * to prevent.
+ *
+ * ⚠️ THIS IS THE ONE PLACE THE CLICKWRAP ARGUMENT DOES NOT REACH. The signup
+ * clickwrap folded its 2026-08-24 corrections into `v1` and did not bump
+ * (`apps/console/constants/legal-documents.ts`) — decided: no v2
+ * before launch. That works there because `v1` is a REPO-SIDE label: the
+ * published Terms carry a "Last updated" date and no version string at all, so
+ * the label can stay still while the text moves. Here the label is part of the
+ * document a publisher reads. The two schemes are not the same kind of thing
+ * and must not be reasoned about as one — that difference is the whole content
+ * of this paragraph.
+ *
+ * On the merits it would have been a bump anyway: a forum-selection clause is
+ * substance, not a typo — it names the court a publisher would have to travel
+ * to. The 2026-08-22 cost argument is unchanged and still cheap, production
+ * holding exactly one acceptance record which is the own.
+ *
+ * §8.1 and §8.3 are UNTOUCHED and were already correct: they have said Aglyn is
+ * merchant of record and determines, collects and remits transaction tax since
+ * 2026-08-14. The Terms of Service moved TO them in this pass (new ToS §10.7),
+ * not the other way around.
+ */
+export declare const PUBLISHER_AGREEMENT_VERSION = "2026-08-24.1";
+export declare const PUBLISHER_AGREEMENT_TITLE = "Marketplace Publisher Agreement";
+/**
+ * The snapshot pin for the version above (AGL-1678).
+ *
+ * A version string is a label we control and can reuse, so on its own it
+ * proves nothing about what a publisher actually read. These two values pin
+ * the archived snapshot at
+ * `legal/publisher-agreement/{PUBLISHER_AGREEMENT_VERSION}/marketplace-publisher-agreement.txt`
+ * (beside this module), captured FROM THE LIVE PAGE after publication — the
+ * same publication-first machinery as the signup clickwrap
+ * (`apps/console/constants/legal-documents.ts`, AGL-1497), and deliberately a
+ * PARALLEL manifest rather than an entry in `LEGAL_DOCUMENTS`: ToS §19.1 makes
+ * that set the entire signup agreement, and the publisher agreement is
+ * deliberately not part of it. Mixing them would widen what a signup
+ * acceptance covers.
+ *
+ * Both values go onto every acceptance record, so a record is self-contained
+ * evidence of content and later tampering with the archive is detectable
+ * rather than invisible. `publisher-agreement-version.spec.ts` re-hashes the
+ * snapshot, so one version string can never come to mean two different
+ * documents.
+ *
+ * Capture method (proven byte-for-byte against the clickwrap v4 hashes before
+ * this snapshot was taken): fetch the live page, walk its HTML text nodes
+ * skipping script/style, trim each, drop empties, take the document's content
+ * block (first line `Last updated: …` through its closing `© …` line,
+ * excluding site chrome and the table of contents), join with `\n`, and end
+ * with a trailing newline. UTF-8 throughout.
+ *
+ * TO PUBLISH A CHANGE: publish the besigner edit first, confirm the live page
+ * serves it, capture a new snapshot under the new version's directory, then
+ * bump `PUBLISHER_AGREEMENT_VERSION` and these two values together. Never
+ * hand-write a snapshot: it is evidence of what a publisher was shown, and a
+ * snapshot of unpublished text is a false record.
+ */
+export declare const PUBLISHER_AGREEMENT_SHA256 = "2df6e940f037b4630e53c8f63bad8604ef4bf370374b89afcd4ea7f9fe8e8d63";
+/** Byte length of the same snapshot — a cheap second check on the content. */
+export declare const PUBLISHER_AGREEMENT_BYTES = 13730;
+/**
+ * Canonical document, on the operator's legal origin beside the other terms.
+ *
+ * Built from `LEGAL_ORIGIN` (AGL-2196), which this module already depends on:
+ * `publisherAgreementIsPublished` below calls `isPublishedLegalUrl`, and that
+ * accepts ONLY `LEGAL_ORIGIN`. So the gate was operator-aware while the link
+ * it gates was a bare `aglyn.com` literal — meaning on a self-host install
+ * with `NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN` set, the gate rejected the very URL
+ * this file handed it, and every publisher was blocked from accepting. One
+ * origin for both closes that, and leaves Aglyn's own URL byte-identical.
+ */
+export declare const PUBLISHER_AGREEMENT_URL: string;
+/**
+ * Whether that document can actually be read (AGL-1660).
+ *
+ * It could not, from the day this gate shipped until the day this check did:
+ * the URL above 404ed, and the console still rendered it as "Read the full
+ * Marketplace Publisher Agreement" above an Accept button. An acceptance
+ * collected that way is a signature on a blank page — the same
+ * publication-first principle the clickwrap snapshots are built on, failing in
+ * the one place the text was never published at all.
+ *
+ * Derived, not a second flag: it reads `PUBLISHED_LEGAL_PATHS`, so the ONE
+ * edit that adds the path when the page goes live is what re-opens acceptance
+ * everywhere. There is no boolean to forget to flip, and no way for the link
+ * and the gate to disagree.
+ */
+export declare function publisherAgreementIsPublished(url?: string): boolean;
+/**
+ * What a publisher is told while the document has no page.
+ *
+ * Deliberately not "try again later" — it names the reason, because the fix is
+ * ours and the publisher can do nothing about it. It must never read as though
+ * accepting is something they merely have not got round to.
+ */
+export declare const PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE: string;
+/**
+ * What the agreement actually commits a publisher to.
+ *
+ * Shown above the accept control. A link alone is the pattern that produces
+ * agreements nobody has read; these are the terms most likely to surprise
+ * someone later, in the words they would need at that moment. They summarise
+ * the document — they are not it, and the copy says so.
+ */
+export declare const PUBLISHER_AGREEMENT_POINTS: readonly {
+    id: string;
+    label: string;
+    detail: string;
+}[];
+/**
+ * A recorded acceptance: which version, of which exact bytes, by whom, when.
+ *
+ * `sha256`/`bytes` (AGL-1678) pin the acceptance to the archived snapshot of
+ * the text the publisher was shown. Optional because records written before
+ * the pin existed carry only the version string — absence means "accepted
+ * before 2026-08-17", not "accepted nothing".
+ */
+export interface PublisherAgreementAcceptance {
+    version?: string;
+    sha256?: string;
+    bytes?: number;
+    acceptedBy?: string;
+    acceptedAt?: unknown;
+}
+/**
+ * Where an org stands with the agreement.
+ *
+ * `none` and `outdated` are deliberately different answers. "You have never
+ * agreed to anything" and "the terms changed since you agreed" are different
+ * situations with different copy, and collapsing them into a boolean is how
+ * a re-acceptance ends up reading like a first-time setup step.
+ */
+export type PublisherAgreementState = 'none' | 'outdated' | 'current';
+export declare function publisherAgreementState(acceptance: PublisherAgreementAcceptance | null | undefined, currentVersion?: string): PublisherAgreementState;
+/**
+ * Whether a publish may proceed.
+ *
+ * An older acceptance is NOT carried forward. Whoever publishes next reads
+ * the changed agreement and accepts it, or does not publish — silently
+ * inheriting an acceptance across a rewrite is precisely what makes the
+ * record worthless.
+ */
+export declare function hasCurrentPublisherAgreement(acceptance: PublisherAgreementAcceptance | null | undefined, currentVersion?: string): boolean;
+/**
+ * What the acceptance UI may show (AGL-1660).
+ *
+ * The gate lives HERE rather than in the panel, for the reason every "check it
+ * in the component" control eventually fails: the component is not the only
+ * caller. The accept route consults the same function, so a client that skips
+ * the UI entirely meets the same answer.
+ *
+ * `documentUrl` is null, not the URL, when the document is unpublished — the
+ * console reads the link target from this, so an unreadable document is
+ * structurally unable to reach an href.
+ */
+export interface PublisherAgreementPresentation {
+    /** The document to link, or null when there is no page to link to. */
+    documentUrl: string | null;
+    /** Whether the accept control may be offered at all. */
+    canAccept: boolean;
+    /** Why acceptance is unavailable, or null when it is available. */
+    unavailableNotice: string | null;
+}
+export declare function publisherAgreementPresentation(state: PublisherAgreementState, published?: boolean): PublisherAgreementPresentation;
+/** The refusal a publisher sees, saying which of the two problems it is. */
+export declare function publisherAgreementRefusal(state: PublisherAgreementState, published?: boolean): string;