@aglyn/aglyn 1.0.0-beta.160 → 1.0.0-beta.161

package/src/lib/app-utils/health-report.d.ts

@@ -1517,6 +1517,34 @@ export declare const SIGNUP_CANARY_ORG_SLUG_PREFIX = "signup-canary-";
  * number looks wrong.
  */
 export declare function isSignupCanaryOrgSlug(slug: string | null | undefined): boolean;
+/**
+ * The plus tag every canary address carries.
+ *
+ * Identity Platform will not reuse an address, so the walk stamps a fresh one
+ * per run by appending to the LOCAL PART of `SIGNUP_CANARY_EMAIL`:
+ * `name+signup-canary@example.com` becomes
+ * `name+signup-canary-m2rso9ab12@example.com`, which still reaches the same
+ * mailbox. The tag is therefore the only part of a canary account that the
+ * console can recognize at the moment it first sees one — there is no org yet,
+ * no claim, and nothing on the token that says CI.
+ *
+ * The address is operator-supplied, so this is a convention rather than a
+ * fact, and `tools/e2e/signup-canary.mjs` is what makes it one: it refuses to
+ * start on a base address whose tag is not this. Held together by
+ * `apps/console/specs/signup-canary-marker-wiring.spec.ts`, exactly as the
+ * slug prefix above is.
+ */
+export declare const SIGNUP_CANARY_EMAIL_TAG = "signup-canary";
+/**
+ * Is this sign-up the canary's own?
+ *
+ * The cost mirrors the slug prefix's: a stranger who signs up as
+ * `them+signup-canary@example.com` goes unannounced. That is bounded to the
+ * one address, it cannot hide anything staff need — the account still exists,
+ * still appears in the admin user list, and still bills — and it is the price
+ * of a check that needs no secret and no second code path.
+ */
+export declare function isSignupCanaryEmail(email: string | null | undefined): boolean;
 /**
  * How old the last walk may be before the check goes red.
  *

package/src/lib/app-utils/health-report.js

@@ -1806,6 +1806,42 @@ export async function writeCronBeat(store, jobId, now = Date.now()) {
  */ export function isSignupCanaryOrgSlug(slug) {
     return typeof slug === 'string' && slug.startsWith(SIGNUP_CANARY_ORG_SLUG_PREFIX);
 }
+/**
+ * The plus tag every canary address carries.
+ *
+ * Identity Platform will not reuse an address, so the walk stamps a fresh one
+ * per run by appending to the LOCAL PART of `SIGNUP_CANARY_EMAIL`:
+ * `name+signup-canary@example.com` becomes
+ * `name+signup-canary-m2rso9ab12@example.com`, which still reaches the same
+ * mailbox. The tag is therefore the only part of a canary account that the
+ * console can recognize at the moment it first sees one — there is no org yet,
+ * no claim, and nothing on the token that says CI.
+ *
+ * The address is operator-supplied, so this is a convention rather than a
+ * fact, and `tools/e2e/signup-canary.mjs` is what makes it one: it refuses to
+ * start on a base address whose tag is not this. Held together by
+ * `apps/console/specs/signup-canary-marker-wiring.spec.ts`, exactly as the
+ * slug prefix above is.
+ */ export const SIGNUP_CANARY_EMAIL_TAG = 'signup-canary';
+/**
+ * Is this sign-up the canary's own?
+ *
+ * The cost mirrors the slug prefix's: a stranger who signs up as
+ * `them+signup-canary@example.com` goes unannounced. That is bounded to the
+ * one address, it cannot hide anything staff need — the account still exists,
+ * still appears in the admin user list, and still bills — and it is the price
+ * of a check that needs no secret and no second code path.
+ */ export function isSignupCanaryEmail(email) {
+    var _email_toLowerCase_split_;
+    if (typeof email !== 'string') return false;
+    const local = (_email_toLowerCase_split_ = email.toLowerCase().split('@')[0]) != null ? _email_toLowerCase_split_ : '';
+    const plus = local.indexOf('+');
+    if (plus < 0) return false;
+    // `startsWith`, not equality: the walk's own address is the base tag plus a
+    // stamp, and the base address itself must match too — a human reading the
+    // mailbox should not find the two classified differently.
+    return local.slice(plus + 1).startsWith(SIGNUP_CANARY_EMAIL_TAG);
+}
 /**
  * How old the last walk may be before the check goes red.
  *