@aglyn/aglyn 1.0.0-beta.212 → 1.0.0-beta.213

package/src/lib/app-utils/plugin-host-abi.js

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * What the realm-plugin host ABI hands a signed bundle (AGL-420, AGL-3392):
+ * the keys of `globalThis.__AGLYN_PLUGIN_HOST__`, which every app composes
+ * from its OWN module instances.
+ *
+ * Two rules decide what is here. What must be ONE instance across the app and
+ * a bundle comes from the host, or the bundle splits it silently. And a
+ * library the site already runs is never compiled into a bundle a second time
+ * — so the host holds it, and the realm build refuses to compile it in:
+ *
+ * - `React`, `jsxRuntime` — two Reacts cannot render one tree.
+ * - `aglyn` — core's REALM PLUGIN SURFACE: the registries a bundle registers
+ *   into and the vocabulary it registers with.
+ * - `mui` — MUI's realm plugin surface: the components a site element is laid
+ *   out, filled in and printed with, their class names, `useMediaQuery`, and
+ *   `createSvgIcon` (how an icon from `@mui/icons-material` draws).
+ * - `muiStyles` — the part of `@mui/material/styles` an element styles itself
+ *   with: `styled`, `useTheme`, the color helpers, `css`, `keyframes`,
+ *   `useColorScheme` — the site's theme and style cache behind them.
+ *
+ * Each is a short reviewed list of NAMES (`generate-realm-host-exports.mjs`),
+ * read member by member and imported STATICALLY by the host module a page
+ * loads only when it runs a realm plugin. Measured on the tenant build, both
+ * shapes that looked cheaper cost every published page: an `import()` reaching
+ * a library module re-cut the chunks every page loads, and a whole module
+ * passed as a value (`import * as styles`) kept every one of its exports alive
+ * in the page's own copy. Loading per export would also have tied every signed
+ * bundle to the host's exact MUI version.
+ *
+ * One list, read by the apps that compose the host, the realm Rollup configs
+ * that compile imports into lookups on it, and the bundle verifier that
+ * refuses a lookup on any other key, and a name its module does not hold.
+ * Adding a key is additive and keeps `PLUGIN_HOST_ABI_VERSION`; removing or
+ * reshaping one is not.
+ */ export const PLUGIN_HOST_ABI_KEYS = [
+    'version',
+    'React',
+    'jsxRuntime',
+    'aglyn',
+    'mui',
+    'muiStyles'
+];
+/**
+ * The keys that are SURFACES, whose names the verifier checks against what the
+ * host holds (`realm-host-surface.generated.ts`).
+ */ export const PLUGIN_HOST_MODULE_KEYS = [
+    'aglyn',
+    'mui',
+    'muiStyles'
+];
+/** The global the host ABI is published on. */ export const PLUGIN_HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__';
+
+//# sourceMappingURL=plugin-host-abi.js.map

package/src/lib/app-utils/plugin-host-abi.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/plugin-host-abi.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * What the realm-plugin host ABI hands a signed bundle (AGL-420, AGL-3392):\n * the keys of `globalThis.__AGLYN_PLUGIN_HOST__`, which every app composes\n * from its OWN module instances.\n *\n * Two rules decide what is here. What must be ONE instance across the app and\n * a bundle comes from the host, or the bundle splits it silently. And a\n * library the site already runs is never compiled into a bundle a second time\n * — so the host holds it, and the realm build refuses to compile it in:\n *\n * - `React`, `jsxRuntime` — two Reacts cannot render one tree.\n * - `aglyn` — core's REALM PLUGIN SURFACE: the registries a bundle registers\n *   into and the vocabulary it registers with.\n * - `mui` — MUI's realm plugin surface: the components a site element is laid\n *   out, filled in and printed with, their class names, `useMediaQuery`, and\n *   `createSvgIcon` (how an icon from `@mui/icons-material` draws).\n * - `muiStyles` — the part of `@mui/material/styles` an element styles itself\n *   with: `styled`, `useTheme`, the color helpers, `css`, `keyframes`,\n *   `useColorScheme` — the site's theme and style cache behind them.\n *\n * Each is a short reviewed list of NAMES (`generate-realm-host-exports.mjs`),\n * read member by member and imported STATICALLY by the host module a page\n * loads only when it runs a realm plugin. Measured on the tenant build, both\n * shapes that looked cheaper cost every published page: an `import()` reaching\n * a library module re-cut the chunks every page loads, and a whole module\n * passed as a value (`import * as styles`) kept every one of its exports alive\n * in the page's own copy. Loading per export would also have tied every signed\n * bundle to the host's exact MUI version.\n *\n * One list, read by the apps that compose the host, the realm Rollup configs\n * that compile imports into lookups on it, and the bundle verifier that\n * refuses a lookup on any other key, and a name its module does not hold.\n * Adding a key is additive and keeps `PLUGIN_HOST_ABI_VERSION`; removing or\n * reshaping one is not.\n */\nexport const PLUGIN_HOST_ABI_KEYS = [\n  'version',\n  'React',\n  'jsxRuntime',\n  'aglyn',\n  'mui',\n  'muiStyles',\n] as const\n\nexport type PluginHostAbiKey = (typeof PLUGIN_HOST_ABI_KEYS)[number]\n\n/**\n * The keys that are SURFACES, whose names the verifier checks against what the\n * host holds (`realm-host-surface.generated.ts`).\n */\nexport const PLUGIN_HOST_MODULE_KEYS = ['aglyn', 'mui', 'muiStyles'] as const\n\nexport type PluginHostModuleKey = (typeof PLUGIN_HOST_MODULE_KEYS)[number]\n\n/** The global the host ABI is published on. */\nexport const PLUGIN_HOST_GLOBAL = '__AGLYN_PLUGIN_HOST__'\n"],"names":["PLUGIN_HOST_ABI_KEYS","PLUGIN_HOST_MODULE_KEYS","PLUGIN_HOST_GLOBAL"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,MAAMA,uBAAuB;IAClC;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAIV;;;CAGC,GACD,OAAO,MAAMC,0BAA0B;IAAC;IAAS;IAAO;CAAY,CAAS;AAI7E,6CAA6C,GAC7C,OAAO,MAAMC,qBAAqB,wBAAuB"}

package/src/lib/app-utils/realm-host-surface.generated.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GENERATED FILE — do not edit. Regenerate with:
+ *   node tools/scripts/generate-realm-host-exports.mjs
+ *
+ * The names each realm host module holds (AGL-3392), for the bundle
+ * verifier: a bundle reading any other name from the host is refused,
+ * because it would read `undefined` on every site.
+ */
+export declare const REALM_HOST_SURFACE_NAMES: Readonly<Record<'aglyn' | 'mui' | 'muiStyles', ReadonlySet<string>>>;

package/src/lib/app-utils/realm-host-surface.generated.js

@@ -0,0 +1,143 @@
+/**
+ * GENERATED FILE — do not edit. Regenerate with:
+ *   node tools/scripts/generate-realm-host-exports.mjs
+ *
+ * The names each realm host module holds (AGL-3392), for the bundle
+ * verifier: a bundle reading any other name from the host is refused,
+ * because it would read `undefined` on every site.
+ */ /* eslint-disable */ export const REALM_HOST_SURFACE_NAMES = {
+    aglyn: new Set([
+        "Aglyn",
+        "CATEGORY_REQUIRED_CAPABILITY",
+        "COMPONENT_CATEGORY_ORDER",
+        "CONSOLE_STAFF_WIDGET_SLOTS",
+        "CONSOLE_WIDGET_SLOTS",
+        "ComponentCategory",
+        "EnabledPluginsContext",
+        "FEATURE_FLAG",
+        "FUNCTION_BUILTIN_NAMES",
+        "FUNCTION_MAX_OPERATIONS",
+        "FUNCTION_TOKEN_PATTERN",
+        "FieldComponentType",
+        "FieldValidatorType",
+        "HOST_VARIABLE_TYPE_LABELS",
+        "LinealDirectiveFlag",
+        "MISSING_BINDING_LABEL",
+        "MUI_BUNDLE_ID",
+        "NAME_TOKEN_PATTERN",
+        "NodeIdentityContext",
+        "NodeType",
+        "PREVIEW_REFUSED_STATUS",
+        "PREVIEW_WRITE_BLOCKED_EVENT",
+        "REUSABLE_COMPONENT_CATEGORY",
+        "REUSABLE_EMAIL_BLOCK_CATEGORY",
+        "RICH_TEXT_COMMANDS",
+        "ScreenLinkContext",
+        "SiteContext",
+        "VARIABLE_ID_TOKEN_PATTERN",
+        "VARIABLE_NAME_PATTERN",
+        "aglyn",
+        "attachFunctionDefinitions",
+        "bindingTokenNeedsDeep",
+        "canvas",
+        "components",
+        "defineUiFeatureBundle",
+        "displayBindingTokens",
+        "editableBindingTokens",
+        "emitter",
+        "evaluateExpression",
+        "evaluateHostFunction",
+        "expressionIdentifiers",
+        "formatFunctionIdToken",
+        "formatFunctionParameterOptions",
+        "formatVariableIdToken",
+        "formatVariableValue",
+        "functionGlobals",
+        "functionReferencedNames",
+        "hasBindings",
+        "isCategoryCapabilityEnabled",
+        "isConsoleStaffWidgetSlot",
+        "isFromEnabledPlugin",
+        "isPreviewRefusal",
+        "isSwitchedOffForRenderedSite",
+        "keyById",
+        "listConsoleExtensions",
+        "listConsoleNavItems",
+        "listConsoleOrgNavItems",
+        "listConsoleProviders",
+        "listConsoleStaffPages",
+        "listConsoleWidgets",
+        "logger",
+        "nodesReferenceBinding",
+        "normalizeBindingTokens",
+        "parseFunctionParameterOptions",
+        "plugins",
+        "registerConsoleExtension",
+        "resolveBindings",
+        "resolveConsoleOrgPluginPage",
+        "resolveConsolePluginPage",
+        "resolveConsoleStaffPage",
+        "resolveNodesBindings",
+        "rewriteBindingTokensDeep",
+        "textReferencesBinding",
+        "unregisterConsoleExtension",
+        "useEnabledPlugins",
+        "useNodeId",
+        "useSite",
+        "useSiteFetch"
+    ]),
+    mui: new Set([
+        "Alert",
+        "Box",
+        "Button",
+        "Card",
+        "CardContent",
+        "Checkbox",
+        "Chip",
+        "CircularProgress",
+        "Collapse",
+        "Divider",
+        "FormControl",
+        "FormControlLabel",
+        "FormHelperText",
+        "IconButton",
+        "InputAdornment",
+        "InputLabel",
+        "Link",
+        "List",
+        "ListItem",
+        "ListItemText",
+        "MenuItem",
+        "Paper",
+        "Radio",
+        "RadioGroup",
+        "Select",
+        "Stack",
+        "SvgIcon",
+        "Switch",
+        "Table",
+        "TableBody",
+        "TableCell",
+        "TableHead",
+        "TableRow",
+        "TextField",
+        "Tooltip",
+        "Typography",
+        "createSvgIcon",
+        "useMediaQuery"
+    ]),
+    muiStyles: new Set([
+        "alpha",
+        "css",
+        "darken",
+        "emphasize",
+        "getContrastRatio",
+        "keyframes",
+        "lighten",
+        "styled",
+        "useColorScheme",
+        "useTheme"
+    ])
+};
+
+//# sourceMappingURL=realm-host-surface.generated.js.map

package/src/lib/app-utils/realm-host-surface.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/realm-host-surface.generated.ts"],"sourcesContent":["/**\n * GENERATED FILE — do not edit. Regenerate with:\n *   node tools/scripts/generate-realm-host-exports.mjs\n *\n * The names each realm host module holds (AGL-3392), for the bundle\n * verifier: a bundle reading any other name from the host is refused,\n * because it would read `undefined` on every site.\n */\n/* eslint-disable */\n\nexport const REALM_HOST_SURFACE_NAMES: Readonly<\n  Record<'aglyn' | 'mui' | 'muiStyles', ReadonlySet<string>>\n> = {\n  aglyn: new Set([\"Aglyn\",\"CATEGORY_REQUIRED_CAPABILITY\",\"COMPONENT_CATEGORY_ORDER\",\"CONSOLE_STAFF_WIDGET_SLOTS\",\"CONSOLE_WIDGET_SLOTS\",\"ComponentCategory\",\"EnabledPluginsContext\",\"FEATURE_FLAG\",\"FUNCTION_BUILTIN_NAMES\",\"FUNCTION_MAX_OPERATIONS\",\"FUNCTION_TOKEN_PATTERN\",\"FieldComponentType\",\"FieldValidatorType\",\"HOST_VARIABLE_TYPE_LABELS\",\"LinealDirectiveFlag\",\"MISSING_BINDING_LABEL\",\"MUI_BUNDLE_ID\",\"NAME_TOKEN_PATTERN\",\"NodeIdentityContext\",\"NodeType\",\"PREVIEW_REFUSED_STATUS\",\"PREVIEW_WRITE_BLOCKED_EVENT\",\"REUSABLE_COMPONENT_CATEGORY\",\"REUSABLE_EMAIL_BLOCK_CATEGORY\",\"RICH_TEXT_COMMANDS\",\"ScreenLinkContext\",\"SiteContext\",\"VARIABLE_ID_TOKEN_PATTERN\",\"VARIABLE_NAME_PATTERN\",\"aglyn\",\"attachFunctionDefinitions\",\"bindingTokenNeedsDeep\",\"canvas\",\"components\",\"defineUiFeatureBundle\",\"displayBindingTokens\",\"editableBindingTokens\",\"emitter\",\"evaluateExpression\",\"evaluateHostFunction\",\"expressionIdentifiers\",\"formatFunctionIdToken\",\"formatFunctionParameterOptions\",\"formatVariableIdToken\",\"formatVariableValue\",\"functionGlobals\",\"functionReferencedNames\",\"hasBindings\",\"isCategoryCapabilityEnabled\",\"isConsoleStaffWidgetSlot\",\"isFromEnabledPlugin\",\"isPreviewRefusal\",\"isSwitchedOffForRenderedSite\",\"keyById\",\"listConsoleExtensions\",\"listConsoleNavItems\",\"listConsoleOrgNavItems\",\"listConsoleProviders\",\"listConsoleStaffPages\",\"listConsoleWidgets\",\"logger\",\"nodesReferenceBinding\",\"normalizeBindingTokens\",\"parseFunctionParameterOptions\",\"plugins\",\"registerConsoleExtension\",\"resolveBindings\",\"resolveConsoleOrgPluginPage\",\"resolveConsolePluginPage\",\"resolveConsoleStaffPage\",\"resolveNodesBindings\",\"rewriteBindingTokensDeep\",\"textReferencesBinding\",\"unregisterConsoleExtension\",\"useEnabledPlugins\",\"useNodeId\",\"useSite\",\"useSiteFetch\"]),\n  mui: new Set([\"Alert\",\"Box\",\"Button\",\"Card\",\"CardContent\",\"Checkbox\",\"Chip\",\"CircularProgress\",\"Collapse\",\"Divider\",\"FormControl\",\"FormControlLabel\",\"FormHelperText\",\"IconButton\",\"InputAdornment\",\"InputLabel\",\"Link\",\"List\",\"ListItem\",\"ListItemText\",\"MenuItem\",\"Paper\",\"Radio\",\"RadioGroup\",\"Select\",\"Stack\",\"SvgIcon\",\"Switch\",\"Table\",\"TableBody\",\"TableCell\",\"TableHead\",\"TableRow\",\"TextField\",\"Tooltip\",\"Typography\",\"createSvgIcon\",\"useMediaQuery\"]),\n  muiStyles: new Set([\"alpha\",\"css\",\"darken\",\"emphasize\",\"getContrastRatio\",\"keyframes\",\"lighten\",\"styled\",\"useColorScheme\",\"useTheme\"]),\n}\n"],"names":["REALM_HOST_SURFACE_NAMES","aglyn","Set","mui","muiStyles"],"mappings":"AAAA;;;;;;;CAOC,GACD,kBAAkB,GAElB,OAAO,MAAMA,2BAET;IACFC,OAAO,IAAIC,IAAI;QAAC;QAAQ;QAA+B;QAA2B;QAA6B;QAAuB;QAAoB;QAAwB;QAAe;QAAyB;QAA0B;QAAyB;QAAqB;QAAqB;QAA4B;QAAsB;QAAwB;QAAgB;QAAqB;QAAsB;QAAW;QAAyB;QAA8B;QAA8B;QAAgC;QAAqB;QAAoB;QAAc;QAA4B;QAAwB;QAAQ;QAA4B;QAAwB;QAAS;QAAa;QAAwB;QAAuB;QAAwB;QAAU;QAAqB;QAAuB;QAAwB;QAAwB;QAAiC;QAAwB;QAAsB;QAAkB;QAA0B;QAAc;QAA8B;QAA2B;QAAsB;QAAmB;QAA+B;QAAU;QAAwB;QAAsB;QAAyB;QAAuB;QAAwB;QAAqB;QAAS;QAAwB;QAAyB;QAAgC;QAAU;QAA2B;QAAkB;QAA8B;QAA2B;QAA0B;QAAuB;QAA2B;QAAwB;QAA6B;QAAoB;QAAY;QAAU;KAAe;IACzsDC,KAAK,IAAID,IAAI;QAAC;QAAQ;QAAM;QAAS;QAAO;QAAc;QAAW;QAAO;QAAmB;QAAW;QAAU;QAAc;QAAmB;QAAiB;QAAa;QAAiB;QAAa;QAAO;QAAO;QAAW;QAAe;QAAW;QAAQ;QAAQ;QAAa;QAAS;QAAQ;QAAU;QAAS;QAAQ;QAAY;QAAY;QAAY;QAAW;QAAY;QAAU;QAAa;QAAgB;KAAgB;IAC/bE,WAAW,IAAIF,IAAI;QAAC;QAAQ;QAAM;QAAS;QAAY;QAAmB;QAAY;QAAU;QAAS;QAAiB;KAAW;AACvI,EAAC"}

package/src/lib/app-utils/search-engine-verification.d.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Search engine ownership verification by HTML meta tag (AGL-3399).
+ *
+ * ## Why this exists
+ *
+ * Google Search Console and Bing Webmaster Tools each offer three ways to
+ * prove a site is yours: a DNS record, an uploaded file, or a meta tag in the
+ * home page's head. A site on a platform subdomain has no DNS of its own and
+ * no way to upload a file to the origin root, so the meta tag is the only
+ * method it can use — and until this existed there was nowhere to put one.
+ *
+ * ## What is stored, and what is emitted
+ *
+ * The tools hand out a whole tag —
+ * `<meta name="google-site-verification" content="…" />` — and most people
+ * paste exactly that. Only the `content` value is stored
+ * (`host.seo.verification`), so the tenant always writes the tag itself and
+ * never echoes markup a person pasted.
+ *
+ * The token is validated at BOTH ends with the same pattern: in the console,
+ * so a bad paste is refused at the field, and again in the tenant before it
+ * reaches the head, so a value that got into the document some other way is
+ * dropped rather than rendered.
+ *
+ * Deliberately NOT re-exported from the `@aglyn/aglyn` root barrel: that
+ * barrel is part of the published-page and realm bundles, and the tenant
+ * layout and the console settings card each import this by path.
+ */
+/** The engines a site can verify with. */
+export type SearchEngineVerificationEngine = 'google' | 'bing';
+/** `host.seo.verification`, one token per engine. */
+export type SearchEngineVerification = Partial<Record<SearchEngineVerificationEngine, string>>;
+/** The `<meta name>` each engine looks for. */
+export declare const SEARCH_ENGINE_VERIFICATION_META_NAMES: Readonly<Record<SearchEngineVerificationEngine, string>>;
+/** What each engine is called on screen. */
+export declare const SEARCH_ENGINE_VERIFICATION_LABELS: Readonly<Record<SearchEngineVerificationEngine, string>>;
+/**
+ * A verification token: letters, digits, `-` and `_`, at most 128.
+ *
+ * Google's tokens are URL-safe base64 (about 43 characters) and Bing's are 32
+ * hex digits; both fit, and nothing that could close an attribute does.
+ */
+export declare const SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN: RegExp;
+/** What a paste into a verification field reads as. */
+export interface ParsedVerificationInput {
+    /** The token — the `content` value of a pasted tag, or the paste itself. */
+    token: string;
+    /** The `name` of a pasted tag, lower-cased; absent for a bare token. */
+    metaName?: string;
+}
+/**
+ * Reads a paste as either a bare token or the whole tag the tools hand out.
+ *
+ * A paste that looks like markup (it has a `<` or a `content=`) is read as a
+ * tag and yields its `content` value, `''` when it has none. Anything else is
+ * the token itself, trimmed. Never validates — see
+ * {@link searchEngineVerificationError}.
+ */
+export declare function parseSearchEngineVerificationInput(input: unknown): ParsedVerificationInput;
+/** The token a paste stores as: the tag's `content`, or the trimmed paste. */
+export declare function extractSearchEngineVerificationToken(input: unknown): string;
+/** Whether `value` is a token the tenant will emit. */
+export declare function isSearchEngineVerificationToken(value: unknown): value is string;
+/**
+ * The field error for a paste into `engine`'s field, or `undefined` when it
+ * is empty or reads as a valid token.
+ *
+ * A tag for the OTHER engine is named as such: a Bing tag pasted into the
+ * Google field holds a perfectly well-formed token, and storing it would make
+ * Search Console's Verify fail with nothing on this side saying why.
+ */
+export declare function searchEngineVerificationError(engine: SearchEngineVerificationEngine, input: unknown): string | undefined;
+/** One `<meta>` a published page emits. */
+export interface SearchEngineVerificationMeta {
+    name: string;
+    content: string;
+}
+/**
+ * The verification `<meta>` tags a published page emits: one per engine
+ * whose stored token passes the pattern, none for anything unset or invalid.
+ */
+export declare function searchEngineVerificationMeta(verification: unknown): SearchEngineVerificationMeta[];

package/src/lib/app-utils/search-engine-verification.js

@@ -0,0 +1,140 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Search engine ownership verification by HTML meta tag (AGL-3399).
+ *
+ * ## Why this exists
+ *
+ * Google Search Console and Bing Webmaster Tools each offer three ways to
+ * prove a site is yours: a DNS record, an uploaded file, or a meta tag in the
+ * home page's head. A site on a platform subdomain has no DNS of its own and
+ * no way to upload a file to the origin root, so the meta tag is the only
+ * method it can use — and until this existed there was nowhere to put one.
+ *
+ * ## What is stored, and what is emitted
+ *
+ * The tools hand out a whole tag —
+ * `<meta name="google-site-verification" content="…" />` — and most people
+ * paste exactly that. Only the `content` value is stored
+ * (`host.seo.verification`), so the tenant always writes the tag itself and
+ * never echoes markup a person pasted.
+ *
+ * The token is validated at BOTH ends with the same pattern: in the console,
+ * so a bad paste is refused at the field, and again in the tenant before it
+ * reaches the head, so a value that got into the document some other way is
+ * dropped rather than rendered.
+ *
+ * Deliberately NOT re-exported from the `@aglyn/aglyn` root barrel: that
+ * barrel is part of the published-page and realm bundles, and the tenant
+ * layout and the console settings card each import this by path.
+ */ /** The engines a site can verify with. */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/** The `<meta name>` each engine looks for. */ export const SEARCH_ENGINE_VERIFICATION_META_NAMES = {
+    google: 'google-site-verification',
+    bing: 'msvalidate.01'
+};
+/** What each engine is called on screen. */ export const SEARCH_ENGINE_VERIFICATION_LABELS = {
+    google: 'Google Search Console',
+    bing: 'Bing Webmaster Tools'
+};
+/**
+ * A verification token: letters, digits, `-` and `_`, at most 128.
+ *
+ * Google's tokens are URL-safe base64 (about 43 characters) and Bing's are 32
+ * hex digits; both fit, and nothing that could close an attribute does.
+ */ export const SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+/** Engines in the order their tags are emitted. */ const ENGINES = [
+    'google',
+    'bing'
+];
+/** One attribute of a pasted tag, quoted either way or not at all. */ const attribute = (tag, name)=>{
+    var _ref, _ref1, _match_;
+    const match = new RegExp(`\\b${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'>/]+))`, 'i').exec(tag);
+    if (!match) return undefined;
+    return ((_ref = (_ref1 = (_match_ = match[1]) != null ? _match_ : match[2]) != null ? _ref1 : match[3]) != null ? _ref : '').trim();
+};
+/**
+ * Reads a paste as either a bare token or the whole tag the tools hand out.
+ *
+ * A paste that looks like markup (it has a `<` or a `content=`) is read as a
+ * tag and yields its `content` value, `''` when it has none. Anything else is
+ * the token itself, trimmed. Never validates — see
+ * {@link searchEngineVerificationError}.
+ */ export function parseSearchEngineVerificationInput(input) {
+    var _attribute;
+    var _attribute1;
+    if (typeof input !== 'string') return {
+        token: ''
+    };
+    const trimmed = input.trim();
+    if (!trimmed.includes('<') && !/\bcontent\s*=/i.test(trimmed)) {
+        return {
+            token: trimmed
+        };
+    }
+    const metaName = (_attribute1 = attribute(trimmed, 'name')) == null ? void 0 : _attribute1.toLowerCase();
+    return _extends({
+        token: (_attribute = attribute(trimmed, 'content')) != null ? _attribute : ''
+    }, metaName ? {
+        metaName
+    } : {});
+}
+/** The token a paste stores as: the tag's `content`, or the trimmed paste. */ export function extractSearchEngineVerificationToken(input) {
+    return parseSearchEngineVerificationInput(input).token;
+}
+/** Whether `value` is a token the tenant will emit. */ export function isSearchEngineVerificationToken(value) {
+    return typeof value === 'string' && SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN.test(value);
+}
+/**
+ * The field error for a paste into `engine`'s field, or `undefined` when it
+ * is empty or reads as a valid token.
+ *
+ * A tag for the OTHER engine is named as such: a Bing tag pasted into the
+ * Google field holds a perfectly well-formed token, and storing it would make
+ * Search Console's Verify fail with nothing on this side saying why.
+ */ export function searchEngineVerificationError(engine, input) {
+    if (input == null || typeof input === 'string' && !input.trim()) {
+        return undefined;
+    }
+    const { token, metaName } = parseSearchEngineVerificationInput(input);
+    if (metaName && metaName !== SEARCH_ENGINE_VERIFICATION_META_NAMES[engine]) {
+        const other = ENGINES.find((candidate)=>SEARCH_ENGINE_VERIFICATION_META_NAMES[candidate] === metaName);
+        return other ? `That tag is for ${SEARCH_ENGINE_VERIFICATION_LABELS[other]} — paste it in that field instead` : `That tag isn’t a ${SEARCH_ENGINE_VERIFICATION_LABELS[engine]} verification tag`;
+    }
+    if (!isSearchEngineVerificationToken(token)) {
+        return 'Paste the verification code, or the whole meta tag — the code is ' + 'letters, numbers, - and _ only';
+    }
+    return undefined;
+}
+/**
+ * The verification `<meta>` tags a published page emits: one per engine
+ * whose stored token passes the pattern, none for anything unset or invalid.
+ */ export function searchEngineVerificationMeta(verification) {
+    if (!verification || typeof verification !== 'object') return [];
+    const stored = verification;
+    const tags = [];
+    for (const engine of ENGINES){
+        const token = stored[engine];
+        if (isSearchEngineVerificationToken(token)) {
+            tags.push({
+                name: SEARCH_ENGINE_VERIFICATION_META_NAMES[engine],
+                content: token
+            });
+        }
+    }
+    return tags;
+}
+
+//# sourceMappingURL=search-engine-verification.js.map

package/src/lib/app-utils/search-engine-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/search-engine-verification.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Search engine ownership verification by HTML meta tag (AGL-3399).\n *\n * ## Why this exists\n *\n * Google Search Console and Bing Webmaster Tools each offer three ways to\n * prove a site is yours: a DNS record, an uploaded file, or a meta tag in the\n * home page's head. A site on a platform subdomain has no DNS of its own and\n * no way to upload a file to the origin root, so the meta tag is the only\n * method it can use — and until this existed there was nowhere to put one.\n *\n * ## What is stored, and what is emitted\n *\n * The tools hand out a whole tag —\n * `<meta name=\"google-site-verification\" content=\"…\" />` — and most people\n * paste exactly that. Only the `content` value is stored\n * (`host.seo.verification`), so the tenant always writes the tag itself and\n * never echoes markup a person pasted.\n *\n * The token is validated at BOTH ends with the same pattern: in the console,\n * so a bad paste is refused at the field, and again in the tenant before it\n * reaches the head, so a value that got into the document some other way is\n * dropped rather than rendered.\n *\n * Deliberately NOT re-exported from the `@aglyn/aglyn` root barrel: that\n * barrel is part of the published-page and realm bundles, and the tenant\n * layout and the console settings card each import this by path.\n */\n\n/** The engines a site can verify with. */\nexport type SearchEngineVerificationEngine = 'google' | 'bing'\n\n/** `host.seo.verification`, one token per engine. */\nexport type SearchEngineVerification = Partial<\n  Record<SearchEngineVerificationEngine, string>\n>\n\n/** The `<meta name>` each engine looks for. */\nexport const SEARCH_ENGINE_VERIFICATION_META_NAMES: Readonly<\n  Record<SearchEngineVerificationEngine, string>\n> = {\n  google: 'google-site-verification',\n  bing: 'msvalidate.01',\n}\n\n/** What each engine is called on screen. */\nexport const SEARCH_ENGINE_VERIFICATION_LABELS: Readonly<\n  Record<SearchEngineVerificationEngine, string>\n> = {\n  google: 'Google Search Console',\n  bing: 'Bing Webmaster Tools',\n}\n\n/**\n * A verification token: letters, digits, `-` and `_`, at most 128.\n *\n * Google's tokens are URL-safe base64 (about 43 characters) and Bing's are 32\n * hex digits; both fit, and nothing that could close an attribute does.\n */\nexport const SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN = /^[A-Za-z0-9_-]{1,128}$/\n\n/** Engines in the order their tags are emitted. */\nconst ENGINES: readonly SearchEngineVerificationEngine[] = ['google', 'bing']\n\n/** One attribute of a pasted tag, quoted either way or not at all. */\nconst attribute = (tag: string, name: string): string | undefined => {\n  const match = new RegExp(\n    `\\\\b${name}\\\\s*=\\\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\\\s\"'>/]+))`,\n    'i',\n  ).exec(tag)\n  if (!match) return undefined\n  return (match[1] ?? match[2] ?? match[3] ?? '').trim()\n}\n\n/** What a paste into a verification field reads as. */\nexport interface ParsedVerificationInput {\n  /** The token — the `content` value of a pasted tag, or the paste itself. */\n  token: string\n  /** The `name` of a pasted tag, lower-cased; absent for a bare token. */\n  metaName?: string\n}\n\n/**\n * Reads a paste as either a bare token or the whole tag the tools hand out.\n *\n * A paste that looks like markup (it has a `<` or a `content=`) is read as a\n * tag and yields its `content` value, `''` when it has none. Anything else is\n * the token itself, trimmed. Never validates — see\n * {@link searchEngineVerificationError}.\n */\nexport function parseSearchEngineVerificationInput(\n  input: unknown,\n): ParsedVerificationInput {\n  if (typeof input !== 'string') return { token: '' }\n  const trimmed = input.trim()\n  if (!trimmed.includes('<') && !/\\bcontent\\s*=/i.test(trimmed)) {\n    return { token: trimmed }\n  }\n  const metaName = attribute(trimmed, 'name')?.toLowerCase()\n  return {\n    token: attribute(trimmed, 'content') ?? '',\n    ...(metaName ? { metaName } : {}),\n  }\n}\n\n/** The token a paste stores as: the tag's `content`, or the trimmed paste. */\nexport function extractSearchEngineVerificationToken(input: unknown): string {\n  return parseSearchEngineVerificationInput(input).token\n}\n\n/** Whether `value` is a token the tenant will emit. */\nexport function isSearchEngineVerificationToken(\n  value: unknown,\n): value is string {\n  return (\n    typeof value === 'string' &&\n    SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN.test(value)\n  )\n}\n\n/**\n * The field error for a paste into `engine`'s field, or `undefined` when it\n * is empty or reads as a valid token.\n *\n * A tag for the OTHER engine is named as such: a Bing tag pasted into the\n * Google field holds a perfectly well-formed token, and storing it would make\n * Search Console's Verify fail with nothing on this side saying why.\n */\nexport function searchEngineVerificationError(\n  engine: SearchEngineVerificationEngine,\n  input: unknown,\n): string | undefined {\n  if (input == null || (typeof input === 'string' && !input.trim())) {\n    return undefined\n  }\n  const { token, metaName } = parseSearchEngineVerificationInput(input)\n  if (metaName && metaName !== SEARCH_ENGINE_VERIFICATION_META_NAMES[engine]) {\n    const other = ENGINES.find(\n      (candidate) =>\n        SEARCH_ENGINE_VERIFICATION_META_NAMES[candidate] === metaName,\n    )\n    return other\n      ? `That tag is for ${SEARCH_ENGINE_VERIFICATION_LABELS[other]} — paste it in that field instead`\n      : `That tag isn’t a ${SEARCH_ENGINE_VERIFICATION_LABELS[engine]} verification tag`\n  }\n  if (!isSearchEngineVerificationToken(token)) {\n    return (\n      'Paste the verification code, or the whole meta tag — the code is ' +\n      'letters, numbers, - and _ only'\n    )\n  }\n  return undefined\n}\n\n/** One `<meta>` a published page emits. */\nexport interface SearchEngineVerificationMeta {\n  name: string\n  content: string\n}\n\n/**\n * The verification `<meta>` tags a published page emits: one per engine\n * whose stored token passes the pattern, none for anything unset or invalid.\n */\nexport function searchEngineVerificationMeta(\n  verification: unknown,\n): SearchEngineVerificationMeta[] {\n  if (!verification || typeof verification !== 'object') return []\n  const stored = verification as Record<string, unknown>\n  const tags: SearchEngineVerificationMeta[] = []\n  for (const engine of ENGINES) {\n    const token = stored[engine]\n    if (isSearchEngineVerificationToken(token)) {\n      tags.push({\n        name: SEARCH_ENGINE_VERIFICATION_META_NAMES[engine],\n        content: token,\n      })\n    }\n  }\n  return tags\n}\n"],"names":["SEARCH_ENGINE_VERIFICATION_META_NAMES","google","bing","SEARCH_ENGINE_VERIFICATION_LABELS","SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN","ENGINES","attribute","tag","name","match","RegExp","exec","undefined","trim","parseSearchEngineVerificationInput","input","token","trimmed","includes","test","metaName","toLowerCase","extractSearchEngineVerificationToken","isSearchEngineVerificationToken","value","searchEngineVerificationError","engine","other","find","candidate","searchEngineVerificationMeta","verification","stored","tags","push","content"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GAED,wCAAwC;AAQxC,6CAA6C,GAC7C,OAAO,MAAMA,wCAET;IACFC,QAAQ;IACRC,MAAM;AACR,EAAC;AAED,0CAA0C,GAC1C,OAAO,MAAMC,oCAET;IACFF,QAAQ;IACRC,MAAM;AACR,EAAC;AAED;;;;;CAKC,GACD,OAAO,MAAME,2CAA2C,yBAAwB;AAEhF,iDAAiD,GACjD,MAAMC,UAAqD;IAAC;IAAU;CAAO;AAE7E,oEAAoE,GACpE,MAAMC,YAAY,CAACC,KAAaC;QAMtBC,MAAAA,OAAAA;IALR,MAAMA,QAAQ,IAAIC,OAChB,CAAC,GAAG,EAAEF,KAAK,8CAA8C,CAAC,EAC1D,KACAG,IAAI,CAACJ;IACP,IAAI,CAACE,OAAO,OAAOG;IACnB,OAAO,EAACH,QAAAA,SAAAA,UAAAA,KAAK,CAAC,EAAE,YAARA,UAAYA,KAAK,CAAC,EAAE,YAApBA,QAAwBA,KAAK,CAAC,EAAE,YAAhCA,OAAoC,IAAII,IAAI;AACtD;AAUA;;;;;;;CAOC,GACD,OAAO,SAASC,mCACdC,KAAc;QASLT;QAFQA;IALjB,IAAI,OAAOS,UAAU,UAAU,OAAO;QAAEC,OAAO;IAAG;IAClD,MAAMC,UAAUF,MAAMF,IAAI;IAC1B,IAAI,CAACI,QAAQC,QAAQ,CAAC,QAAQ,CAAC,iBAAiBC,IAAI,CAACF,UAAU;QAC7D,OAAO;YAAED,OAAOC;QAAQ;IAC1B;IACA,MAAMG,YAAWd,cAAAA,UAAUW,SAAS,4BAAnBX,YAA4Be,WAAW;IACxD,OAAO;QACLL,KAAK,GAAEV,aAAAA,UAAUW,SAAS,sBAAnBX,aAAiC;OACpCc,WAAW;QAAEA;IAAS,IAAI,CAAC;AAEnC;AAEA,4EAA4E,GAC5E,OAAO,SAASE,qCAAqCP,KAAc;IACjE,OAAOD,mCAAmCC,OAAOC,KAAK;AACxD;AAEA,qDAAqD,GACrD,OAAO,SAASO,gCACdC,KAAc;IAEd,OACE,OAAOA,UAAU,YACjBpB,yCAAyCe,IAAI,CAACK;AAElD;AAEA;;;;;;;CAOC,GACD,OAAO,SAASC,8BACdC,MAAsC,EACtCX,KAAc;IAEd,IAAIA,SAAS,QAAS,OAAOA,UAAU,YAAY,CAACA,MAAMF,IAAI,IAAK;QACjE,OAAOD;IACT;IACA,MAAM,EAAEI,KAAK,EAAEI,QAAQ,EAAE,GAAGN,mCAAmCC;IAC/D,IAAIK,YAAYA,aAAapB,qCAAqC,CAAC0B,OAAO,EAAE;QAC1E,MAAMC,QAAQtB,QAAQuB,IAAI,CACxB,CAACC,YACC7B,qCAAqC,CAAC6B,UAAU,KAAKT;QAEzD,OAAOO,QACH,CAAC,gBAAgB,EAAExB,iCAAiC,CAACwB,MAAM,CAAC,iCAAiC,CAAC,GAC9F,CAAC,iBAAiB,EAAExB,iCAAiC,CAACuB,OAAO,CAAC,iBAAiB,CAAC;IACtF;IACA,IAAI,CAACH,gCAAgCP,QAAQ;QAC3C,OACE,sEACA;IAEJ;IACA,OAAOJ;AACT;AAQA;;;CAGC,GACD,OAAO,SAASkB,6BACdC,YAAqB;IAErB,IAAI,CAACA,gBAAgB,OAAOA,iBAAiB,UAAU,OAAO,EAAE;IAChE,MAAMC,SAASD;IACf,MAAME,OAAuC,EAAE;IAC/C,KAAK,MAAMP,UAAUrB,QAAS;QAC5B,MAAMW,QAAQgB,MAAM,CAACN,OAAO;QAC5B,IAAIH,gCAAgCP,QAAQ;YAC1CiB,KAAKC,IAAI,CAAC;gBACR1B,MAAMR,qCAAqC,CAAC0B,OAAO;gBACnDS,SAASnB;YACX;QACF;IACF;IACA,OAAOiB;AACT"}

package/src/lib/foundation/definitions/platform.types.d.ts

@@ -167,6 +167,15 @@ export interface AglynHost extends AglynDocument {
      * `seo.entity.logo`, which is publisher-semantic JSON-LD.
      */
     logoUrl?: string;
+    /**
+     * The site logo for the DARK scheme (AGL-3400). A wordmark drawn for a
+     * light ground — dark ink on a transparent PNG — disappears on the dark
+     * loader scrim and error screens, so a site may name a second mark for
+     * them. Unset means {@link logoUrl} serves both schemes. Read only where a
+     * scheme is known; emails, `{{host.logo}}` and the install icon stay on
+     * `logoUrl`, because a mail client paints a light ground.
+     */
+    logoDarkUrl?: string;
     seo?: {
         title?: string;
         description?: string;
@@ -340,6 +349,21 @@ export interface AglynHost extends AglynDocument {
             /** How an agent should call the site — endpoints, etiquette, limits. */
             howToUse?: string;
         };
+        /**
+         * Search engine ownership tokens (AGL-3399), emitted by the tenant as
+         * `<meta name="google-site-verification">` and `<meta name="msvalidate.01">`
+         * in the head of every published page.
+         *
+         * The HTML-tag method is the only one a site on a platform subdomain can
+         * use: it has no DNS of its own and cannot upload a file to the origin.
+         * Only the tag's `content` value is stored, and the tenant re-checks it
+         * against `SEARCH_ENGINE_VERIFICATION_TOKEN_PATTERN` before emitting, so a
+         * stored value is never echoed into the head as written.
+         */
+        verification?: {
+            google?: string;
+            bing?: string;
+        };
     };
     /**
      * Customer-configured third-party analytics (AGL-138/661). Long written by

package/src/lib/foundation/definitions/platform.types.js

@@ -69,7 +69,8 @@ export var HostRedirectParams = /*#__PURE__*/ function(HostRedirectParams) {
  */ export const HOST_CLIENT_WRITABLE_FIELDS = {
     displayName: 'The site name shown in the console. Cosmetic, org-scoped, and decides ' + 'nothing — the public address is `subdomain`/`cname`, both denied.',
     logoUrl: 'The site brand mark rendered by the tenant nav (AGL-594). Authored ' + 'content pointing at already-public media; no gate reads it.',
-    seo: 'Title, description, favicon, app icon, social card and the AGL-1263 ' + '`discourageSearchEngines` switch. All of it is authoring: the values ' + 'end up in the page the editor is already free to write.',
+    logoDarkUrl: 'The dark-scheme variant of `logoUrl` (AGL-3400). Same reasoning: ' + 'authored content pointing at already-public media; no gate reads it.',
+    seo: 'Title, description, favicon, app icon, social card, search engine ' + 'verification tokens and the AGL-1263 `discourageSearchEngines` switch. ' + 'All of it is authoring: the values end up in the page the editor is ' + 'already free to write.',
     // `screens` LEFT this map in AGL-2334 and is now classified as denied,
     // following the `disabledPlugins` precedent: it is TIERED, not freely
     // client-writable. The reason it used to carry — "an editor who may add a