@aglyn/aglyn 1.0.0-beta.151 → 1.0.0-beta.153

package/src/lib/plugin-manager/plugin-trust-signing.js

@@ -0,0 +1,119 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHO HOLDS THE PLATFORM'S TRUST KEY (AGL-3080).
+ *
+ * Realm trust is the strongest grant in the platform: it drops a marketplace
+ * bundle into the app realm, where neither the sandbox iframe nor the
+ * manifest CSP stands between it and user data. A grant is an Ed25519
+ * signature, made with `PLUGIN_TRUST_PRIVATE_KEY`, over the reviewed
+ * version's sha256 — and every loader verifies it before a byte executes.
+ *
+ * ## Why this is a seam rather than a move
+ *
+ * The queue around it is the MARKETPLACE's: `marketplaceListings` is its
+ * collection, "a version must have passed review" is its rule, and the
+ * fields the grant writes are its documents. All of that belongs with the
+ * plugin, the way the review queue and the report queue already do.
+ *
+ * The KEY does not. It is deployed to the console and nowhere else — never
+ * to a tenant runtime — and this package is published to npm, where a
+ * self-hoster generates their own pair. A plugin that read the key directly
+ * would put the platform's signing authority inside a package anyone can
+ * install, to no benefit: the plugin has nothing to do with it beyond
+ * wanting one string signed.
+ *
+ * So the shell signs, and the marketplace decides what is worth signing.
+ * The sibling of `core.site-cache`, and the same direction: the shell
+ * offering a capability down.
+ *
+ * ## ⛔ AN ABSENT SIGNER REFUSES. IT DOES NOT GRANT.
+ *
+ * This is the opposite failure direction from every other contract here, and
+ * it is the one that matters. `core.site-cache` answers `complete: false`
+ * and the caller carries on, because a stale cache is survivable. An
+ * unsigned realm grant is not survivable: the loaders fail closed on a
+ * missing signature, so a "grant" without one produces a version that is
+ * marked trusted and cannot load — or, far worse if a loader is ever
+ * lenient, one that loads unverified.
+ *
+ * {@link signPluginTrust} therefore never returns a bare string. It answers
+ * `{ signed: false, reason }` when nothing is registered, when the
+ * deployment has no key, or when signing throws, and the caller MUST refuse
+ * the grant on it rather than writing a partial one.
+ */ import { definePluginServiceContract, registerPluginService, resolvePluginService } from "./plugin-services.js";
+/**
+ * One implementation: the app that holds the key. A second would be a second
+ * signing authority, and the loaders verify against ONE public key.
+ */ export const PLUGIN_TRUST_SIGNER = definePluginServiceContract('core.plugin-trust-signer', {
+    multiple: false
+});
+/** Installs the app's signer. Called once, at server boot. */ export function registerPluginTrustSigner(signer, options) {
+    if (typeof (signer == null ? void 0 : signer.sign) !== 'function') {
+        throw new Error('a plugin trust signer needs a sign function');
+    }
+    registerPluginService(PLUGIN_TRUST_SIGNER, signer, _extends({}, (options == null ? void 0 : options.pluginId) ? {
+        pluginId: options.pluginId
+    } : {}));
+}
+/** Whether this deployment can sign at all — for a surface that says so. */ export function hasPluginTrustSigner() {
+    return Boolean(resolvePluginService(PLUGIN_TRUST_SIGNER));
+}
+/**
+ * Signs `sha256`, or says why it could not.
+ *
+ * NEVER THROWS, and never answers a signature it did not make. Read
+ * `signed` before reading `signature`; see the module docblock for why a
+ * caller must refuse rather than continue.
+ */ export async function signPluginTrust(sha256) {
+    const digest = sha256 == null ? void 0 : sha256.trim();
+    if (!digest) {
+        return {
+            signed: false,
+            reason: 'No version hash to sign.'
+        };
+    }
+    const signer = resolvePluginService(PLUGIN_TRUST_SIGNER);
+    if (!signer) {
+        console.error('[trust-signer] no implementation is installed, so realm trust cannot ' + 'be granted. The app registers this at boot.');
+        return {
+            signed: false,
+            reason: 'Trust signing is not available on this deployment.'
+        };
+    }
+    try {
+        const result = await signer.sign(digest);
+        // A signer that answered `signed` with nothing to show is a bug in the
+        // signer, and granting on it would write the trust flag with no
+        // signature — the one state the loaders cannot distinguish from tampering.
+        if (result.signed && !result.signature) {
+            return {
+                signed: false,
+                reason: 'Trust signing returned no signature.'
+            };
+        }
+        return result;
+    } catch (error) {
+        console.error('[trust-signer] signing failed', error);
+        return {
+            signed: false,
+            reason: 'Trust signing failed.'
+        };
+    }
+}
+
+//# sourceMappingURL=plugin-trust-signing.js.map

package/src/lib/plugin-manager/plugin-trust-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/plugin-manager/plugin-trust-signing.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHO HOLDS THE PLATFORM'S TRUST KEY (AGL-3080).\n *\n * Realm trust is the strongest grant in the platform: it drops a marketplace\n * bundle into the app realm, where neither the sandbox iframe nor the\n * manifest CSP stands between it and user data. A grant is an Ed25519\n * signature, made with `PLUGIN_TRUST_PRIVATE_KEY`, over the reviewed\n * version's sha256 — and every loader verifies it before a byte executes.\n *\n * ## Why this is a seam rather than a move\n *\n * The queue around it is the MARKETPLACE's: `marketplaceListings` is its\n * collection, \"a version must have passed review\" is its rule, and the\n * fields the grant writes are its documents. All of that belongs with the\n * plugin, the way the review queue and the report queue already do.\n *\n * The KEY does not. It is deployed to the console and nowhere else — never\n * to a tenant runtime — and this package is published to npm, where a\n * self-hoster generates their own pair. A plugin that read the key directly\n * would put the platform's signing authority inside a package anyone can\n * install, to no benefit: the plugin has nothing to do with it beyond\n * wanting one string signed.\n *\n * So the shell signs, and the marketplace decides what is worth signing.\n * The sibling of `core.site-cache`, and the same direction: the shell\n * offering a capability down.\n *\n * ## ⛔ AN ABSENT SIGNER REFUSES. IT DOES NOT GRANT.\n *\n * This is the opposite failure direction from every other contract here, and\n * it is the one that matters. `core.site-cache` answers `complete: false`\n * and the caller carries on, because a stale cache is survivable. An\n * unsigned realm grant is not survivable: the loaders fail closed on a\n * missing signature, so a \"grant\" without one produces a version that is\n * marked trusted and cannot load — or, far worse if a loader is ever\n * lenient, one that loads unverified.\n *\n * {@link signPluginTrust} therefore never returns a bare string. It answers\n * `{ signed: false, reason }` when nothing is registered, when the\n * deployment has no key, or when signing throws, and the caller MUST refuse\n * the grant on it rather than writing a partial one.\n */\n\nimport {\n  definePluginServiceContract,\n  registerPluginService,\n  resolvePluginService,\n} from './plugin-services'\n\nexport interface PluginTrustSignature {\n  /** Base64 Ed25519 signature over the sha256 hex. Absent unless `signed`. */\n  signature?: string\n  /**\n   * Whether a signature was produced. FALSE when nothing is registered, the\n   * deployment holds no key, or signing failed — and a caller must refuse\n   * the grant, never write one without a signature.\n   */\n  signed: boolean\n  /** Why not, in the operator's terms, when `signed` is false. */\n  reason?: string\n}\n\nexport interface PluginTrustSigner {\n  /** Signs a version's sha256 hex with the platform's Ed25519 key. */\n  sign(sha256: string): Promise<PluginTrustSignature>\n}\n\n/**\n * One implementation: the app that holds the key. A second would be a second\n * signing authority, and the loaders verify against ONE public key.\n */\nexport const PLUGIN_TRUST_SIGNER =\n  definePluginServiceContract<PluginTrustSigner>('core.plugin-trust-signer', {\n    multiple: false,\n  })\n\n/** Installs the app's signer. Called once, at server boot. */\nexport function registerPluginTrustSigner(\n  signer: PluginTrustSigner,\n  options?: { pluginId?: string },\n): void {\n  if (typeof signer?.sign !== 'function') {\n    throw new Error('a plugin trust signer needs a sign function')\n  }\n  registerPluginService(PLUGIN_TRUST_SIGNER, signer, {\n    ...(options?.pluginId ? { pluginId: options.pluginId } : {}),\n  })\n}\n\n/** Whether this deployment can sign at all — for a surface that says so. */\nexport function hasPluginTrustSigner(): boolean {\n  return Boolean(resolvePluginService(PLUGIN_TRUST_SIGNER))\n}\n\n/**\n * Signs `sha256`, or says why it could not.\n *\n * NEVER THROWS, and never answers a signature it did not make. Read\n * `signed` before reading `signature`; see the module docblock for why a\n * caller must refuse rather than continue.\n */\nexport async function signPluginTrust(\n  sha256: string,\n): Promise<PluginTrustSignature> {\n  const digest = sha256?.trim()\n  if (!digest) {\n    return { signed: false, reason: 'No version hash to sign.' }\n  }\n  const signer = resolvePluginService(PLUGIN_TRUST_SIGNER)\n  if (!signer) {\n    console.error(\n      '[trust-signer] no implementation is installed, so realm trust cannot ' +\n        'be granted. The app registers this at boot.',\n    )\n    return {\n      signed: false,\n      reason: 'Trust signing is not available on this deployment.',\n    }\n  }\n  try {\n    const result = await signer.sign(digest)\n    // A signer that answered `signed` with nothing to show is a bug in the\n    // signer, and granting on it would write the trust flag with no\n    // signature — the one state the loaders cannot distinguish from tampering.\n    if (result.signed && !result.signature) {\n      return {\n        signed: false,\n        reason: 'Trust signing returned no signature.',\n      }\n    }\n    return result\n  } catch (error) {\n    console.error('[trust-signer] signing failed', error)\n    return { signed: false, reason: 'Trust signing failed.' }\n  }\n}\n"],"names":["definePluginServiceContract","registerPluginService","resolvePluginService","PLUGIN_TRUST_SIGNER","multiple","registerPluginTrustSigner","signer","options","sign","Error","pluginId","hasPluginTrustSigner","Boolean","signPluginTrust","sha256","digest","trim","signed","reason","console","error","result","signature"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,SACEA,2BAA2B,EAC3BC,qBAAqB,EACrBC,oBAAoB,QACf,uBAAmB;AAoB1B;;;CAGC,GACD,OAAO,MAAMC,sBACXH,4BAA+C,4BAA4B;IACzEI,UAAU;AACZ,GAAE;AAEJ,4DAA4D,GAC5D,OAAO,SAASC,0BACdC,MAAyB,EACzBC,OAA+B;IAE/B,IAAI,QAAOD,0BAAAA,OAAQE,IAAI,MAAK,YAAY;QACtC,MAAM,IAAIC,MAAM;IAClB;IACAR,sBAAsBE,qBAAqBG,QAAQ,aAC7CC,CAAAA,2BAAAA,QAASG,QAAQ,IAAG;QAAEA,UAAUH,QAAQG,QAAQ;IAAC,IAAI,CAAC;AAE9D;AAEA,0EAA0E,GAC1E,OAAO,SAASC;IACd,OAAOC,QAAQV,qBAAqBC;AACtC;AAEA;;;;;;CAMC,GACD,OAAO,eAAeU,gBACpBC,MAAc;IAEd,MAAMC,SAASD,0BAAAA,OAAQE,IAAI;IAC3B,IAAI,CAACD,QAAQ;QACX,OAAO;YAAEE,QAAQ;YAAOC,QAAQ;QAA2B;IAC7D;IACA,MAAMZ,SAASJ,qBAAqBC;IACpC,IAAI,CAACG,QAAQ;QACXa,QAAQC,KAAK,CACX,0EACE;QAEJ,OAAO;YACLH,QAAQ;YACRC,QAAQ;QACV;IACF;IACA,IAAI;QACF,MAAMG,SAAS,MAAMf,OAAOE,IAAI,CAACO;QACjC,uEAAuE;QACvE,gEAAgE;QAChE,2EAA2E;QAC3E,IAAIM,OAAOJ,MAAM,IAAI,CAACI,OAAOC,SAAS,EAAE;YACtC,OAAO;gBACLL,QAAQ;gBACRC,QAAQ;YACV;QACF;QACA,OAAOG;IACT,EAAE,OAAOD,OAAO;QACdD,QAAQC,KAAK,CAAC,iCAAiCA;QAC/C,OAAO;YAAEH,QAAQ;YAAOC,QAAQ;QAAwB;IAC1D;AACF"}

package/src/lib/app-utils/marketplace-verification.d.ts

@@ -1,95 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * Who may ask for the Verified badge, and when (AGL-1217).
- *
- * In core rather than beside the rest of the marketplace model for the same
- * reason `marketplace-provenance` is (AGL-1016): the console's staff review
- * route needs this policy, and `scope:app` may not depend on `aglyn:addons`.
- * The marketplace model re-exports everything here, so publishing code keeps
- * importing it from one place.
- *
- * A leaf module with no imports — it is reached from the browser, from React
- * Server Components and from API routes, and every barrel that could carry it
- * is illegal in at least one of those.
- */
-export type VerificationRequestState = 'pending' | 'granted' | 'declined' | 'withdrawn';
-/**
- * Firestore timestamps arrive in two shapes: an SDK `Timestamp` carrying
- * `toMillis()`, and the plain `{seconds}` object a serialized doc decays into.
- * Policy has to read both or it silently scores a real date as absent.
- */
-export type TimestampLike = {
-    toMillis?: () => number;
-    seconds?: number;
-} | null | undefined;
-/** Milliseconds for either timestamp shape; `null` when there is no date. */
-export declare function timestampMs(value: TimestampLike): number | null;
-/**
- * A publisher's ask for the Verified badge.
- *
- * Deliberately NOT a member of `ListingReviewStatus`. That union's
- * consequential axis is live vs. not live — `listed` is what makes a plugin
- * installable by every workspace — and a listing can be live *and* awaiting a
- * verification decision at the same time. A `verification_requested` member
- * would have to answer "is this live?" and both answers are wrong.
- *
- * A record rather than a `verificationRequestedAt` timestamp because
- * verification may become a paid offering. A timestamp has to be rewritten the
- * day that lands; this absorbs an order reference without a migration.
- */
-export interface ListingVerificationRequest {
-    requestedAt?: TimestampLike;
-    /** Publisher uid — a person asked, not "the org asked". */
-    requestedBy?: string;
-    state: VerificationRequestState;
-    decidedAt?: TimestampLike;
-    /** Staff uid, or the publisher's own on a withdrawal. */
-    decidedBy?: string;
-    declineReason?: string;
-    /** Room for a payment reference when verification becomes purchasable. */
-    orderRef?: string;
-}
-/**
- * How long a publisher waits after a decline before asking again.
- *
- * Queue hygiene, not punishment: without it a publisher can re-request in a
- * loop and staff lose the signal that a request means something changed.
- */
-export declare const VERIFICATION_DECLINE_COOLDOWN_DAYS = 30;
-/** Why a publisher may not ask right now — `null` when they may. */
-export type VerificationRequestBlock = 'not-publisher' | 'already-verified' | 'not-listed' | 'already-pending' | 'cooling-down';
-/** The listing fields this policy reads, structurally — core cannot see the
- * marketplace model's `MarketplaceListing`. */
-export interface VerifiableListing {
-    profileId?: string;
-    reviewStatus?: string;
-    verificationRequest?: ListingVerificationRequest;
-}
-/**
- * A reason rather than a boolean, so the UI can say which and so the server
- * and the button cannot drift into disagreeing about the rule. Both call this.
- */
-export declare function verificationRequestBlock(options: {
-    listing: VerifiableListing | null | undefined;
-    /** The org the viewer is acting as. */
-    viewerOrgId: string | null | undefined;
-    /** `Date.now()` on the client; server time on the server. */
-    nowMs: number;
-}): VerificationRequestBlock | null;
-/** What to tell the publisher for each block reason. */
-export declare const VERIFICATION_BLOCK_MESSAGES: Record<VerificationRequestBlock, string>;

package/src/lib/app-utils/marketplace-verification.js

@@ -1,81 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ /**
- * Who may ask for the Verified badge, and when (AGL-1217).
- *
- * In core rather than beside the rest of the marketplace model for the same
- * reason `marketplace-provenance` is (AGL-1016): the console's staff review
- * route needs this policy, and `scope:app` may not depend on `aglyn:addons`.
- * The marketplace model re-exports everything here, so publishing code keeps
- * importing it from one place.
- *
- * A leaf module with no imports — it is reached from the browser, from React
- * Server Components and from API routes, and every barrel that could carry it
- * is illegal in at least one of those.
- */ /** Milliseconds for either timestamp shape; `null` when there is no date. */ export function timestampMs(value) {
-    if (!value) return null;
-    if (typeof value.toMillis === 'function') {
-        const ms = value.toMillis();
-        return Number.isFinite(ms) ? ms : null;
-    }
-    if (typeof value.seconds === 'number') return value.seconds * 1000;
-    return null;
-}
-/**
- * How long a publisher waits after a decline before asking again.
- *
- * Queue hygiene, not punishment: without it a publisher can re-request in a
- * loop and staff lose the signal that a request means something changed.
- */ export const VERIFICATION_DECLINE_COOLDOWN_DAYS = 30;
-/**
- * A reason rather than a boolean, so the UI can say which and so the server
- * and the button cannot drift into disagreeing about the rule. Both call this.
- */ export function verificationRequestBlock(options) {
-    const { listing, viewerOrgId, nowMs } = options;
-    if (!listing || !viewerOrgId || listing.profileId !== viewerOrgId) {
-        return 'not-publisher';
-    }
-    if (listing.reviewStatus === 'verified') return 'already-verified';
-    // Only a LIVE listing can be verified. Asking while `submitted`, `in_review`
-    // or `rejected` is asking for a badge on something customers cannot install,
-    // and it would put verification requests into a queue that already has a
-    // different reason to look at the listing.
-    //
-    // A legacy listing with NO status is treated as `listed` elsewhere, but not
-    // here: verification is a deliberate act, and an absent field is not enough
-    // to hang a badge request on.
-    if (listing.reviewStatus !== 'listed') return 'not-listed';
-    const request = listing.verificationRequest;
-    if ((request == null ? void 0 : request.state) === 'pending') return 'already-pending';
-    if ((request == null ? void 0 : request.state) === 'declined') {
-        const decidedAt = timestampMs(request.decidedAt);
-        // Fail closed on an undated decline. Assuming it is old enough turns a
-        // missing field into a free retry, which is what the cooldown prevents.
-        if (decidedAt === null) return 'cooling-down';
-        const elapsedDays = (nowMs - decidedAt) / 86400000;
-        if (elapsedDays < VERIFICATION_DECLINE_COOLDOWN_DAYS) return 'cooling-down';
-    }
-    return null;
-}
-/** What to tell the publisher for each block reason. */ export const VERIFICATION_BLOCK_MESSAGES = {
-    'not-publisher': 'Only the publishing organization can request verification.',
-    'already-verified': 'This listing is already verified.',
-    'not-listed': 'Only a listed plugin can be verified. This one is still going through review.',
-    'already-pending': 'A verification request is already waiting for a decision.',
-    'cooling-down': `Verification was declined recently. You can ask again ${VERIFICATION_DECLINE_COOLDOWN_DAYS} days after the decision.`
-};
-
-//# sourceMappingURL=marketplace-verification.js.map

package/src/lib/app-utils/marketplace-verification.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/marketplace-verification.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Who may ask for the Verified badge, and when (AGL-1217).\n *\n * In core rather than beside the rest of the marketplace model for the same\n * reason `marketplace-provenance` is (AGL-1016): the console's staff review\n * route needs this policy, and `scope:app` may not depend on `aglyn:addons`.\n * The marketplace model re-exports everything here, so publishing code keeps\n * importing it from one place.\n *\n * A leaf module with no imports — it is reached from the browser, from React\n * Server Components and from API routes, and every barrel that could carry it\n * is illegal in at least one of those.\n */\n\nexport type VerificationRequestState =\n  | 'pending'\n  | 'granted'\n  | 'declined'\n  | 'withdrawn'\n\n/**\n * Firestore timestamps arrive in two shapes: an SDK `Timestamp` carrying\n * `toMillis()`, and the plain `{seconds}` object a serialized doc decays into.\n * Policy has to read both or it silently scores a real date as absent.\n */\nexport type TimestampLike =\n  | { toMillis?: () => number; seconds?: number }\n  | null\n  | undefined\n\n/** Milliseconds for either timestamp shape; `null` when there is no date. */\nexport function timestampMs(value: TimestampLike): number | null {\n  if (!value) return null\n  if (typeof value.toMillis === 'function') {\n    const ms = value.toMillis()\n    return Number.isFinite(ms) ? ms : null\n  }\n  if (typeof value.seconds === 'number') return value.seconds * 1000\n  return null\n}\n\n/**\n * A publisher's ask for the Verified badge.\n *\n * Deliberately NOT a member of `ListingReviewStatus`. That union's\n * consequential axis is live vs. not live — `listed` is what makes a plugin\n * installable by every workspace — and a listing can be live *and* awaiting a\n * verification decision at the same time. A `verification_requested` member\n * would have to answer \"is this live?\" and both answers are wrong.\n *\n * A record rather than a `verificationRequestedAt` timestamp because\n * verification may become a paid offering. A timestamp has to be rewritten the\n * day that lands; this absorbs an order reference without a migration.\n */\nexport interface ListingVerificationRequest {\n  requestedAt?: TimestampLike\n  /** Publisher uid — a person asked, not \"the org asked\". */\n  requestedBy?: string\n  state: VerificationRequestState\n  decidedAt?: TimestampLike\n  /** Staff uid, or the publisher's own on a withdrawal. */\n  decidedBy?: string\n  declineReason?: string\n  /** Room for a payment reference when verification becomes purchasable. */\n  orderRef?: string\n}\n\n/**\n * How long a publisher waits after a decline before asking again.\n *\n * Queue hygiene, not punishment: without it a publisher can re-request in a\n * loop and staff lose the signal that a request means something changed.\n */\nexport const VERIFICATION_DECLINE_COOLDOWN_DAYS = 30\n\n/** Why a publisher may not ask right now — `null` when they may. */\nexport type VerificationRequestBlock =\n  | 'not-publisher'\n  | 'already-verified'\n  | 'not-listed'\n  | 'already-pending'\n  | 'cooling-down'\n\n/** The listing fields this policy reads, structurally — core cannot see the\n * marketplace model's `MarketplaceListing`. */\nexport interface VerifiableListing {\n  profileId?: string\n  reviewStatus?: string\n  verificationRequest?: ListingVerificationRequest\n}\n\n/**\n * A reason rather than a boolean, so the UI can say which and so the server\n * and the button cannot drift into disagreeing about the rule. Both call this.\n */\nexport function verificationRequestBlock(options: {\n  listing: VerifiableListing | null | undefined\n  /** The org the viewer is acting as. */\n  viewerOrgId: string | null | undefined\n  /** `Date.now()` on the client; server time on the server. */\n  nowMs: number\n}): VerificationRequestBlock | null {\n  const { listing, viewerOrgId, nowMs } = options\n  if (!listing || !viewerOrgId || listing.profileId !== viewerOrgId) {\n    return 'not-publisher'\n  }\n  if (listing.reviewStatus === 'verified') return 'already-verified'\n  // Only a LIVE listing can be verified. Asking while `submitted`, `in_review`\n  // or `rejected` is asking for a badge on something customers cannot install,\n  // and it would put verification requests into a queue that already has a\n  // different reason to look at the listing.\n  //\n  // A legacy listing with NO status is treated as `listed` elsewhere, but not\n  // here: verification is a deliberate act, and an absent field is not enough\n  // to hang a badge request on.\n  if (listing.reviewStatus !== 'listed') return 'not-listed'\n\n  const request = listing.verificationRequest\n  if (request?.state === 'pending') return 'already-pending'\n  if (request?.state === 'declined') {\n    const decidedAt = timestampMs(request.decidedAt)\n    // Fail closed on an undated decline. Assuming it is old enough turns a\n    // missing field into a free retry, which is what the cooldown prevents.\n    if (decidedAt === null) return 'cooling-down'\n    const elapsedDays = (nowMs - decidedAt) / 86_400_000\n    if (elapsedDays < VERIFICATION_DECLINE_COOLDOWN_DAYS) return 'cooling-down'\n  }\n  return null\n}\n\n/** What to tell the publisher for each block reason. */\nexport const VERIFICATION_BLOCK_MESSAGES: Record<\n  VerificationRequestBlock,\n  string\n> = {\n  'not-publisher': 'Only the publishing organization can request verification.',\n  'already-verified': 'This listing is already verified.',\n  'not-listed':\n    'Only a listed plugin can be verified. This one is still going through review.',\n  'already-pending': 'A verification request is already waiting for a decision.',\n  'cooling-down': `Verification was declined recently. You can ask again ${VERIFICATION_DECLINE_COOLDOWN_DAYS} days after the decision.`,\n}\n"],"names":["timestampMs","value","toMillis","ms","Number","isFinite","seconds","VERIFICATION_DECLINE_COOLDOWN_DAYS","verificationRequestBlock","options","listing","viewerOrgId","nowMs","profileId","reviewStatus","request","verificationRequest","state","decidedAt","elapsedDays","VERIFICATION_BLOCK_MESSAGES"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;CAYC,GAkBD,2EAA2E,GAC3E,OAAO,SAASA,YAAYC,KAAoB;IAC9C,IAAI,CAACA,OAAO,OAAO;IACnB,IAAI,OAAOA,MAAMC,QAAQ,KAAK,YAAY;QACxC,MAAMC,KAAKF,MAAMC,QAAQ;QACzB,OAAOE,OAAOC,QAAQ,CAACF,MAAMA,KAAK;IACpC;IACA,IAAI,OAAOF,MAAMK,OAAO,KAAK,UAAU,OAAOL,MAAMK,OAAO,GAAG;IAC9D,OAAO;AACT;AA4BA;;;;;CAKC,GACD,OAAO,MAAMC,qCAAqC,GAAE;AAkBpD;;;CAGC,GACD,OAAO,SAASC,yBAAyBC,OAMxC;IACC,MAAM,EAAEC,OAAO,EAAEC,WAAW,EAAEC,KAAK,EAAE,GAAGH;IACxC,IAAI,CAACC,WAAW,CAACC,eAAeD,QAAQG,SAAS,KAAKF,aAAa;QACjE,OAAO;IACT;IACA,IAAID,QAAQI,YAAY,KAAK,YAAY,OAAO;IAChD,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAIJ,QAAQI,YAAY,KAAK,UAAU,OAAO;IAE9C,MAAMC,UAAUL,QAAQM,mBAAmB;IAC3C,IAAID,CAAAA,2BAAAA,QAASE,KAAK,MAAK,WAAW,OAAO;IACzC,IAAIF,CAAAA,2BAAAA,QAASE,KAAK,MAAK,YAAY;QACjC,MAAMC,YAAYlB,YAAYe,QAAQG,SAAS;QAC/C,uEAAuE;QACvE,wEAAwE;QACxE,IAAIA,cAAc,MAAM,OAAO;QAC/B,MAAMC,cAAc,AAACP,CAAAA,QAAQM,SAAQ,IAAK;QAC1C,IAAIC,cAAcZ,oCAAoC,OAAO;IAC/D;IACA,OAAO;AACT;AAEA,sDAAsD,GACtD,OAAO,MAAMa,8BAGT;IACF,iBAAiB;IACjB,oBAAoB;IACpB,cACE;IACF,mBAAmB;IACnB,gBAAgB,CAAC,sDAAsD,EAAEb,mCAAmC,yBAAyB,CAAC;AACxI,EAAC"}

package/src/lib/app-utils/publisher-attestation.d.ts

@@ -1,99 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-export interface PublisherAttestationItem {
-    id: string;
-    /** First person — the publisher is the one saying it. */
-    label: string;
-    /** What they are actually committing to, shown under the item. */
-    detail: string;
-    /**
-     * Only asked when the listing already exists. A first submission has no
-     * "since the last version", and asking anyway teaches publishers that
-     * some of these boxes are noise.
-     */
-    updateOnly?: boolean;
-    /**
-     * The submitted field this item is a claim ABOUT (AGL-1076).
-     *
-     * An attestation whose subject is absent is a statement about nothing:
-     * `repository` shipped for a while confirming that a repository URL is
-     * public and matches, in a form with nowhere to name a repository, on
-     * listings whose `repositoryUrl` was empty. A reviewer opened it first and
-     * found nothing to open.
-     *
-     * So a subject makes the tick enforceable: the publish route refuses with
-     * the same 428 as a missing tick when the value is not in the request that
-     * stores it. Declared here rather than in the route so the form knows to
-     * ask for it and the route knows to require it from one place.
-     */
-    subject?: {
-        /** Key in the publish body, and on the listing/version doc. */
-        field: string;
-        /** How the field is labelled to the publisher, for the error. */
-        label: string;
-    };
-}
-export declare const PUBLISHER_ATTESTATION: readonly PublisherAttestationItem[];
-/** A stored attestation: who said it, when, and against which bytes. */
-export interface AttestationEntry {
-    by?: string;
-    at?: unknown;
-    sha256?: string;
-}
-/**
- * The ids a submission must carry.
- *
- * `isUpdate` is decided server-side from whether a listing already exists,
- * never from a client flag — otherwise "this is my first version" becomes a
- * way to skip an item.
- */
-export declare function requiredAttestationIds(isUpdate: boolean): string[];
-/**
- * Which required attestations a submission is missing, given the ids the
- * publisher ticked.
- */
-export declare function missingAttestations(ticked: readonly string[] | null | undefined, isUpdate: boolean): string[];
-/** The fields a submission must carry alongside its ticks (AGL-1076). */
-export declare function attestationSubjects(isUpdate: boolean): Array<{
-    id: string;
-    field: string;
-    label: string;
-}>;
-/**
- * Which required attestations have nothing to be about (AGL-1076).
- *
- * `values` is the submission being stored, never the listing doc: on a first
- * publish there is no listing, and on an update the tick is a statement about
- * what this publish declares, not about whatever the listing said last year.
- */
-export declare function missingAttestationSubjects(values: Record<string, unknown> | null | undefined, isUpdate: boolean): Array<{
-    id: string;
-    field: string;
-    label: string;
-}>;
-/** Human labels for a set of ids, for an error a publisher can act on. */
-export declare function attestationLabels(ids: readonly string[]): string[];
-/**
- * Which stored attestations count for a given bundle.
- *
- * Keyed to sha256 exactly like the staff checklist (AGL-963) and the
- * verifier verdict (AGL-962): an attestation is a statement about specific
- * bytes, so a republish under the same version string re-asks. Carrying
- * ticks across a rebuild would let a publisher attest to code they then
- * replaced.
- */
-export declare function attestationsForBytes(attestation: Record<string, AttestationEntry> | null | undefined, sha256: string): string[];

package/src/lib/app-utils/publisher-attestation.js

@@ -1,158 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ /**
- * What a publisher states about their own bundle before it enters the queue
- * (AGL-969).
- *
- * Deliberately NOT the staff checklist. Those items are judgements *about*
- * the publisher — "publisher is identifiable and contactable" is worthless
- * as self-attestation, because the answer is always yes. Every item here is
- * something only the publisher can know and a reviewer would otherwise have
- * to guess at or chase by email: whether the repo really holds this code,
- * whether they have the right to publish it, whether each declared host is
- * actually reached.
- *
- * Two things come out of this. Most review round-trips are questions the
- * publisher could have answered at submit time, so the queue moves faster.
- * And a false attestation is a timestamped statement by a named publisher
- * against specific bytes, which makes takedown a documented consequence
- * rather than a judgement call.
- *
- * This module is shared on purpose: the publish API is the enforcement
- * point, the upload dialog renders the same list, and the review page shows
- * staff what was claimed. Three copies of these strings would drift, and a
- * drifted attestation is one nobody can be held to.
- */ import { PLATFORM_BRAND_NAME } from "./platform-brand.js";
-export const PUBLISHER_ATTESTATION = [
-    {
-        id: 'repository',
-        label: 'The repository URL is public and contains the source for this bundle',
-        detail: 'A reviewer opens it first. A repo that 404s, is private, or holds something unrelated is the cheapest reason a submission gets sent back.',
-        subject: {
-            field: 'repositoryUrl',
-            label: 'Repository URL'
-        }
-    },
-    {
-        id: 'license',
-        label: 'A license is included and I have the right to publish this code',
-        detail: 'Missing or incompatible licensing is a legal problem for every workspace that installs it, not only for us.'
-    },
-    {
-        id: 'data-disclosure',
-        label: 'The README documents what data this plugin reads, stores or sends, and where it goes',
-        detail: 'Anything the plugin does with member or page data belongs in the README before it is installed, not in a support thread afterwards.'
-    },
-    {
-        id: 'network-hosts',
-        label: 'Every declared network host is required — I have removed the ones I do not use',
-        detail: 'Declared hosts become this plugin’s CSP connect-src. An allowlist wider than the plugin needs is the single most common thing review sends back, and it widens the blast radius if the bundle is ever compromised.'
-    },
-    {
-        id: 'tested',
-        label: 'I have tested this version on a site I control',
-        detail: 'These exact bytes, not an earlier build. Static review cannot tell a reviewer what your plugin does at runtime.'
-    },
-    /**
-   * Publisher Agreement §3(h), which binds "Neither the Artifact nor its
-   * listing" — so it already reached the element names and descriptions a
-   * plugin declares in its manifest, which ship INSIDE the artifact. This
-   * sentence did not, and a publisher can only be held to what they were
-   * asked (AGL-2486).
-   *
-   * Written as a CAPABILITY — any text you supply that renders in, or ranks
-   * within, the console — rather than as a list of today's fields. The list
-   * was already wrong once: `tags` and `keywords` reached the picker's search
-   * ranking days after `description` reached its detail panel, and a sentence
-   * enumerating fields goes stale the next time one is added. Ranking is
-   * named explicitly because it is the non-obvious half: a search term never
-   * appears on screen, yet it decides which element a customer is SHOWN.
-   *
-   * The id stays `listing-conduct` deliberately. A stored tick is keyed by
-   * id (see {@link attestationsForBytes}), so renaming it to something truer
-   * to the widened wording would orphan every attestation on file as an
-   * unrecognised id, and re-ask for bytes already attested.
-   */ {
-        id: 'listing-conduct',
-        label: `Neither my listing nor any text on my elements disparages ${PLATFORM_BRAND_NAME}, quotes what its plans cost, or sells a way around one`,
-        detail: `Saying which ${PLATFORM_BRAND_NAME} plans or features your plugin needs, or works with, is fine and useful. Editorialising about ${PLATFORM_BRAND_NAME}’s prices or quotas, stating or implying what a plan contains, or pitching this version as a way to avoid a plan or an upgrade is not. This covers any text you supply that renders in — or ranks within — the console, not only the listing: an element’s name, description, tags, search keywords and attribute labels all ship inside your bundle, and a customer meets them in their own element picker. Search terms count even though nobody reads them, because they decide which element gets shown.`
-    },
-    {
-        id: 'changelog',
-        label: 'The changelog describes what changed since the last version',
-        detail: 'An update is where something slips through — the first version gets read closely, the fourth rarely does. Saying what moved is what makes reviewing a diff possible.',
-        updateOnly: true
-    }
-];
-/**
- * The ids a submission must carry.
- *
- * `isUpdate` is decided server-side from whether a listing already exists,
- * never from a client flag — otherwise "this is my first version" becomes a
- * way to skip an item.
- */ export function requiredAttestationIds(isUpdate) {
-    return PUBLISHER_ATTESTATION.filter((item)=>isUpdate || !item.updateOnly).map((item)=>item.id);
-}
-/**
- * Which required attestations a submission is missing, given the ids the
- * publisher ticked.
- */ export function missingAttestations(ticked, isUpdate) {
-    const given = new Set(ticked != null ? ticked : []);
-    return requiredAttestationIds(isUpdate).filter((id)=>!given.has(id));
-}
-/** The fields a submission must carry alongside its ticks (AGL-1076). */ export function attestationSubjects(isUpdate) {
-    return PUBLISHER_ATTESTATION.filter((item)=>item.subject && (isUpdate || !item.updateOnly)).map((item)=>{
-        var _ref, _ref1;
-        var _item_subject, _item_subject1;
-        return {
-            id: item.id,
-            field: (_ref = (_item_subject = item.subject) == null ? void 0 : _item_subject.field) != null ? _ref : '',
-            label: (_ref1 = (_item_subject1 = item.subject) == null ? void 0 : _item_subject1.label) != null ? _ref1 : ''
-        };
-    });
-}
-/**
- * Which required attestations have nothing to be about (AGL-1076).
- *
- * `values` is the submission being stored, never the listing doc: on a first
- * publish there is no listing, and on an update the tick is a statement about
- * what this publish declares, not about whatever the listing said last year.
- */ export function missingAttestationSubjects(values, isUpdate) {
-    return attestationSubjects(isUpdate).filter((subject)=>{
-        const value = (values != null ? values : {})[subject.field];
-        return typeof value !== 'string' || !value.trim();
-    });
-}
-/** Human labels for a set of ids, for an error a publisher can act on. */ export function attestationLabels(ids) {
-    return ids.map((id)=>{
-        var _PUBLISHER_ATTESTATION_find;
-        return (_PUBLISHER_ATTESTATION_find = PUBLISHER_ATTESTATION.find((item)=>item.id === id)) == null ? void 0 : _PUBLISHER_ATTESTATION_find.label;
-    }).filter((label)=>Boolean(label));
-}
-/**
- * Which stored attestations count for a given bundle.
- *
- * Keyed to sha256 exactly like the staff checklist (AGL-963) and the
- * verifier verdict (AGL-962): an attestation is a statement about specific
- * bytes, so a republish under the same version string re-asks. Carrying
- * ticks across a rebuild would let a publisher attest to code they then
- * replaced.
- */ export function attestationsForBytes(attestation, sha256) {
-    if (!sha256) return [];
-    return Object.entries(attestation != null ? attestation : {}).filter(([, entry])=>(entry == null ? void 0 : entry.sha256) === sha256).map(([id])=>id);
-}
-
-//# sourceMappingURL=publisher-attestation.js.map

package/src/lib/app-utils/publisher-attestation.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/publisher-attestation.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * What a publisher states about their own bundle before it enters the queue\n * (AGL-969).\n *\n * Deliberately NOT the staff checklist. Those items are judgements *about*\n * the publisher — \"publisher is identifiable and contactable\" is worthless\n * as self-attestation, because the answer is always yes. Every item here is\n * something only the publisher can know and a reviewer would otherwise have\n * to guess at or chase by email: whether the repo really holds this code,\n * whether they have the right to publish it, whether each declared host is\n * actually reached.\n *\n * Two things come out of this. Most review round-trips are questions the\n * publisher could have answered at submit time, so the queue moves faster.\n * And a false attestation is a timestamped statement by a named publisher\n * against specific bytes, which makes takedown a documented consequence\n * rather than a judgement call.\n *\n * This module is shared on purpose: the publish API is the enforcement\n * point, the upload dialog renders the same list, and the review page shows\n * staff what was claimed. Three copies of these strings would drift, and a\n * drifted attestation is one nobody can be held to.\n */\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\n\nexport interface PublisherAttestationItem {\n  id: string\n  /** First person — the publisher is the one saying it. */\n  label: string\n  /** What they are actually committing to, shown under the item. */\n  detail: string\n  /**\n   * Only asked when the listing already exists. A first submission has no\n   * \"since the last version\", and asking anyway teaches publishers that\n   * some of these boxes are noise.\n   */\n  updateOnly?: boolean\n  /**\n   * The submitted field this item is a claim ABOUT (AGL-1076).\n   *\n   * An attestation whose subject is absent is a statement about nothing:\n   * `repository` shipped for a while confirming that a repository URL is\n   * public and matches, in a form with nowhere to name a repository, on\n   * listings whose `repositoryUrl` was empty. A reviewer opened it first and\n   * found nothing to open.\n   *\n   * So a subject makes the tick enforceable: the publish route refuses with\n   * the same 428 as a missing tick when the value is not in the request that\n   * stores it. Declared here rather than in the route so the form knows to\n   * ask for it and the route knows to require it from one place.\n   */\n  subject?: {\n    /** Key in the publish body, and on the listing/version doc. */\n    field: string\n    /** How the field is labelled to the publisher, for the error. */\n    label: string\n  }\n}\n\nexport const PUBLISHER_ATTESTATION: readonly PublisherAttestationItem[] = [\n  {\n    id: 'repository',\n    label: 'The repository URL is public and contains the source for this bundle',\n    detail:\n      'A reviewer opens it first. A repo that 404s, is private, or holds something unrelated is the cheapest reason a submission gets sent back.',\n    subject: { field: 'repositoryUrl', label: 'Repository URL' },\n  },\n  {\n    id: 'license',\n    label: 'A license is included and I have the right to publish this code',\n    detail:\n      'Missing or incompatible licensing is a legal problem for every workspace that installs it, not only for us.',\n  },\n  {\n    id: 'data-disclosure',\n    label:\n      'The README documents what data this plugin reads, stores or sends, and where it goes',\n    detail:\n      'Anything the plugin does with member or page data belongs in the README before it is installed, not in a support thread afterwards.',\n  },\n  {\n    id: 'network-hosts',\n    label:\n      'Every declared network host is required — I have removed the ones I do not use',\n    detail:\n      'Declared hosts become this plugin’s CSP connect-src. An allowlist wider than the plugin needs is the single most common thing review sends back, and it widens the blast radius if the bundle is ever compromised.',\n  },\n  {\n    id: 'tested',\n    label: 'I have tested this version on a site I control',\n    detail:\n      'These exact bytes, not an earlier build. Static review cannot tell a reviewer what your plugin does at runtime.',\n  },\n  /**\n   * Publisher Agreement §3(h), which binds \"Neither the Artifact nor its\n   * listing\" — so it already reached the element names and descriptions a\n   * plugin declares in its manifest, which ship INSIDE the artifact. This\n   * sentence did not, and a publisher can only be held to what they were\n   * asked (AGL-2486).\n   *\n   * Written as a CAPABILITY — any text you supply that renders in, or ranks\n   * within, the console — rather than as a list of today's fields. The list\n   * was already wrong once: `tags` and `keywords` reached the picker's search\n   * ranking days after `description` reached its detail panel, and a sentence\n   * enumerating fields goes stale the next time one is added. Ranking is\n   * named explicitly because it is the non-obvious half: a search term never\n   * appears on screen, yet it decides which element a customer is SHOWN.\n   *\n   * The id stays `listing-conduct` deliberately. A stored tick is keyed by\n   * id (see {@link attestationsForBytes}), so renaming it to something truer\n   * to the widened wording would orphan every attestation on file as an\n   * unrecognised id, and re-ask for bytes already attested.\n   */\n  {\n    id: 'listing-conduct',\n    label:\n      `Neither my listing nor any text on my elements disparages ${PLATFORM_BRAND_NAME}, quotes what its plans cost, or sells a way around one`,\n    detail:\n      `Saying which ${PLATFORM_BRAND_NAME} plans or features your plugin needs, or works with, is fine and useful. Editorialising about ${PLATFORM_BRAND_NAME}’s prices or quotas, stating or implying what a plan contains, or pitching this version as a way to avoid a plan or an upgrade is not. This covers any text you supply that renders in — or ranks within — the console, not only the listing: an element’s name, description, tags, search keywords and attribute labels all ship inside your bundle, and a customer meets them in their own element picker. Search terms count even though nobody reads them, because they decide which element gets shown.`,\n  },\n  {\n    id: 'changelog',\n    label: 'The changelog describes what changed since the last version',\n    detail:\n      'An update is where something slips through — the first version gets read closely, the fourth rarely does. Saying what moved is what makes reviewing a diff possible.',\n    updateOnly: true,\n  },\n]\n\n/** A stored attestation: who said it, when, and against which bytes. */\nexport interface AttestationEntry {\n  by?: string\n  at?: unknown\n  sha256?: string\n}\n\n/**\n * The ids a submission must carry.\n *\n * `isUpdate` is decided server-side from whether a listing already exists,\n * never from a client flag — otherwise \"this is my first version\" becomes a\n * way to skip an item.\n */\nexport function requiredAttestationIds(isUpdate: boolean): string[] {\n  return PUBLISHER_ATTESTATION.filter(\n    (item) => isUpdate || !item.updateOnly,\n  ).map((item) => item.id)\n}\n\n/**\n * Which required attestations a submission is missing, given the ids the\n * publisher ticked.\n */\nexport function missingAttestations(\n  ticked: readonly string[] | null | undefined,\n  isUpdate: boolean,\n): string[] {\n  const given = new Set(ticked ?? [])\n  return requiredAttestationIds(isUpdate).filter((id) => !given.has(id))\n}\n\n/** The fields a submission must carry alongside its ticks (AGL-1076). */\nexport function attestationSubjects(\n  isUpdate: boolean,\n): Array<{ id: string; field: string; label: string }> {\n  return PUBLISHER_ATTESTATION.filter(\n    (item) => item.subject && (isUpdate || !item.updateOnly),\n  ).map((item) => ({\n    id: item.id,\n    field: item.subject?.field ?? '',\n    label: item.subject?.label ?? '',\n  }))\n}\n\n/**\n * Which required attestations have nothing to be about (AGL-1076).\n *\n * `values` is the submission being stored, never the listing doc: on a first\n * publish there is no listing, and on an update the tick is a statement about\n * what this publish declares, not about whatever the listing said last year.\n */\nexport function missingAttestationSubjects(\n  values: Record<string, unknown> | null | undefined,\n  isUpdate: boolean,\n): Array<{ id: string; field: string; label: string }> {\n  return attestationSubjects(isUpdate).filter((subject) => {\n    const value = (values ?? {})[subject.field]\n    return typeof value !== 'string' || !value.trim()\n  })\n}\n\n/** Human labels for a set of ids, for an error a publisher can act on. */\nexport function attestationLabels(ids: readonly string[]): string[] {\n  return ids\n    .map((id) => PUBLISHER_ATTESTATION.find((item) => item.id === id)?.label)\n    .filter((label): label is string => Boolean(label))\n}\n\n/**\n * Which stored attestations count for a given bundle.\n *\n * Keyed to sha256 exactly like the staff checklist (AGL-963) and the\n * verifier verdict (AGL-962): an attestation is a statement about specific\n * bytes, so a republish under the same version string re-asks. Carrying\n * ticks across a rebuild would let a publisher attest to code they then\n * replaced.\n */\nexport function attestationsForBytes(\n  attestation: Record<string, AttestationEntry> | null | undefined,\n  sha256: string,\n): string[] {\n  if (!sha256) return []\n  return Object.entries(attestation ?? {})\n    .filter(([, entry]) => entry?.sha256 === sha256)\n    .map(([id]) => id)\n}\n"],"names":["PLATFORM_BRAND_NAME","PUBLISHER_ATTESTATION","id","label","detail","subject","field","updateOnly","requiredAttestationIds","isUpdate","filter","item","map","missingAttestations","ticked","given","Set","has","attestationSubjects","missingAttestationSubjects","values","value","trim","attestationLabels","ids","find","Boolean","attestationsForBytes","attestation","sha256","Object","entries","entry"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,SAASA,mBAAmB,QAAQ,sBAAkB;AAoCtD,OAAO,MAAMC,wBAA6D;IACxE;QACEC,IAAI;QACJC,OAAO;QACPC,QACE;QACFC,SAAS;YAAEC,OAAO;YAAiBH,OAAO;QAAiB;IAC7D;IACA;QACED,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OACE;QACFC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OACE;QACFC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;;;;;;;;;;;;;;;;;;;GAmBC,GACD;QACEF,IAAI;QACJC,OACE,CAAC,0DAA0D,EAAEH,oBAAoB,uDAAuD,CAAC;QAC3II,QACE,CAAC,aAAa,EAAEJ,oBAAoB,8FAA8F,EAAEA,oBAAoB,4eAA4e,CAAC;IACzoB;IACA;QACEE,IAAI;QACJC,OAAO;QACPC,QACE;QACFG,YAAY;IACd;CACD,CAAA;AASD;;;;;;CAMC,GACD,OAAO,SAASC,uBAAuBC,QAAiB;IACtD,OAAOR,sBAAsBS,MAAM,CACjC,CAACC,OAASF,YAAY,CAACE,KAAKJ,UAAU,EACtCK,GAAG,CAAC,CAACD,OAASA,KAAKT,EAAE;AACzB;AAEA;;;CAGC,GACD,OAAO,SAASW,oBACdC,MAA4C,EAC5CL,QAAiB;IAEjB,MAAMM,QAAQ,IAAIC,IAAIF,iBAAAA,SAAU,EAAE;IAClC,OAAON,uBAAuBC,UAAUC,MAAM,CAAC,CAACR,KAAO,CAACa,MAAME,GAAG,CAACf;AACpE;AAEA,uEAAuE,GACvE,OAAO,SAASgB,oBACdT,QAAiB;IAEjB,OAAOR,sBAAsBS,MAAM,CACjC,CAACC,OAASA,KAAKN,OAAO,IAAKI,CAAAA,YAAY,CAACE,KAAKJ,UAAU,AAAD,GACtDK,GAAG,CAAC,CAACD;;YAEEA,eACAA;eAHQ;YACfT,IAAIS,KAAKT,EAAE;YACXI,KAAK,WAAEK,gBAAAA,KAAKN,OAAO,qBAAZM,cAAcL,KAAK,mBAAI;YAC9BH,KAAK,YAAEQ,iBAAAA,KAAKN,OAAO,qBAAZM,eAAcR,KAAK,oBAAI;QAChC;;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASgB,2BACdC,MAAkD,EAClDX,QAAiB;IAEjB,OAAOS,oBAAoBT,UAAUC,MAAM,CAAC,CAACL;QAC3C,MAAMgB,QAAQ,CAACD,iBAAAA,SAAU,CAAC,EAAE,CAACf,QAAQC,KAAK,CAAC;QAC3C,OAAO,OAAOe,UAAU,YAAY,CAACA,MAAMC,IAAI;IACjD;AACF;AAEA,wEAAwE,GACxE,OAAO,SAASC,kBAAkBC,GAAsB;IACtD,OAAOA,IACJZ,GAAG,CAAC,CAACV;YAAOD;gBAAAA,8BAAAA,sBAAsBwB,IAAI,CAAC,CAACd,OAASA,KAAKT,EAAE,KAAKA,wBAAjDD,4BAAsDE,KAAK;OACvEO,MAAM,CAAC,CAACP,QAA2BuB,QAAQvB;AAChD;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASwB,qBACdC,WAAgE,EAChEC,MAAc;IAEd,IAAI,CAACA,QAAQ,OAAO,EAAE;IACtB,OAAOC,OAAOC,OAAO,CAACH,sBAAAA,cAAe,CAAC,GACnClB,MAAM,CAAC,CAAC,GAAGsB,MAAM,GAAKA,CAAAA,yBAAAA,MAAOH,MAAM,MAAKA,QACxCjB,GAAG,CAAC,CAAC,CAACV,GAAG,GAAKA;AACnB"}