@aglyn/aglyn 1.0.0-beta.217 → 1.0.0-beta.219

package/src/lib/app-utils/publisher-agreement.js

@@ -1,321 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ /**
- * The marketplace publisher agreement, and whether an org has accepted the
- * current one (AGL-1077).
- *
- * Deliberately NOT the per-version attestation (AGL-969). An attestation is
- * a statement about *specific bytes* and re-asks on every republish, because
- * the bytes changed. This is about the *relationship*: what we may do with a
- * listing, what the publisher warrants, indemnity, takedown, payouts, what
- * survives termination. It is accepted once, by an org, and re-asked only
- * when we change it.
- *
- * Shared like the attestation model is, and for the same reason: the publish
- * route enforces it, the profile page collects it, and the review page shows
- * staff which terms a publisher is actually under. Three copies of a version
- * string would drift, and a drifted version is one that either re-asks
- * forever or never re-asks at all.
- */ import { LEGAL_ORIGIN, isPublishedLegalUrl } from "./published-legal-pages.js";
-/**
- * The version of the agreement currently in force.
- *
- * Matches the `Agreement version` header of the document itself, which is now
- * besigner content at {@link PUBLISHER_AGREEMENT_URL} rather than a repo file
- * (same practice as the Terms of Service). Bump this **only** when the
- * substance changes in a way a publisher should re-read — a typo fix is not a
- * bump. Bumping it stops every publisher at their next publish until they
- * accept again.
- *
- * Moved off `2026-07-28.1` on 2026-08-14 (AGL-1674). That string named the
- * July draft, which was never published and whose §8 said the publisher is the
- * seller of record. The published text says the opposite — Aglyn processes the
- * sale and remits transaction tax — so it is a different document in
- * substance, not a reissue, and re-asking is the point rather than a cost.
- *
- * Moved to `2026-08-18.1` on 2026-08-18 (AGL-1840 + AGL-1661). Two body-text
- * changes: §1 now says "the Aglyn marketplace" (the AGL-975 rename, and the
- * reason this snapshot must NOT need the AGL-975 naming-guard exemption that
- * the `2026-08-14.1` one still carries), and §1's cross-reference to
- * the "End User Licence Agreement"
- * becomes "License" to match the document that agreement actually is, which
- * was renamed on the same day.
- *
- * ⚠️ Read against the "a typo fix is not a bump" rule above, both edits are
- * closer to a typo than to substance, and the tension is real. The bump was
- * taken anyway on the decision (2026-08-18), for a reason the rule does not
- * cover: the served page changed, so keeping `2026-08-14.1` would leave the
- * pin below asserting a hash for text nobody is shown any more — a FALSE
- * RECORD, which is the exact failure the pin exists to detect. The choice is
- * therefore between a bump and a broken pin, not between a bump and nothing.
- *
- * ## 2026-08-22 — the page changed and this string DELIBERATELY did not
- *
- * Three clauses were added on 2026-08-22 (§3(h) listing conduct, §8.6 sales
- * through the Marketplace, §13.6 marks) and the pin below moved with them, but
- * `2026-08-18.1` stayed. That is not the third option the paragraph above says
- * does not exist — it is the same choice with one input changed. A bump exists
- * to re-ask publishers who accepted the OLD text; production holds exactly one
- * acceptance record and it is the own, so there is nobody to re-ask and the
- * bump would buy nothing. the decision, 2026-08-22.
- *
- * The pin still had to move, for precisely the reason given above: the served
- * bytes changed, so leaving the old hash here would assert a document nobody
- * is shown. Version unchanged + pin re-captured is coherent ONLY while the
- * acceptance set is empty. The first real publisher acceptance ends that, and
- * from then on any body-text change costs a bump — see the same rule in
- * `apps/console/constants/legal-documents.ts`, where the clickwrap snapshots
- * collapsed back to `v1` on the identical argument.
- *
- * ## 2026-08-24 — `2026-08-24.1`, and why this one CANNOT be folded (AGL-1956)
- *
- * §13.3 changed twice in one sentence. The venue moved from Williamson County
- * to TRAVIS County (decided) — Williamson entered from the former
- * Jarrell residential address, while every published Aglyn address is 5900
- * Balcones Dr STE 100, Austin, TX 78731, which is Travis. And the clause cited
- * "Terms of Service Section 19" for governing law and venue when those live at
- * §18.6; §19 is General. A wrong cross-reference in a forum-selection clause is
- * the kind of defect that gets argued about, so it was corrected in the same
- * pass.
- *
- * Unlike 2026-08-22, this one takes the bump rather than only re-pinning, and
- * the deciding reason is mechanical rather than editorial: THIS VERSION STRING
- * IS PUBLISHED IN THE DOCUMENT. The page at {@link PUBLISHER_AGREEMENT_URL}
- * serves `Agreement version: 2026-08-24.1` in its own second line, so the
- * capture below contains it, and `publisher-agreement-version.spec.ts` asserts
- * the snapshot contains `Agreement version: ${PUBLISHER_AGREEMENT_VERSION}`.
- * Holding the constant at `2026-08-18.1` against that text would need the page
- * republished to say so, and would otherwise record a publisher as having
- * accepted `2026-08-18.1` while naming bytes that call themselves
- * `2026-08-24.1`. That is a false record of exactly the shape the pin exists
- * to prevent.
- *
- * ⚠️ THIS IS THE ONE PLACE THE CLICKWRAP ARGUMENT DOES NOT REACH. The signup
- * clickwrap folded its 2026-08-24 corrections into `v1` and did not bump
- * (`apps/console/constants/legal-documents.ts`) — decided: no v2
- * before launch. That works there because `v1` is a REPO-SIDE label: the
- * published Terms carry a "Last updated" date and no version string at all, so
- * the label can stay still while the text moves. Here the label is part of the
- * document a publisher reads. The two schemes are not the same kind of thing
- * and must not be reasoned about as one — that difference is the whole content
- * of this paragraph.
- *
- * On the merits it would have been a bump anyway: a forum-selection clause is
- * substance, not a typo — it names the court a publisher would have to travel
- * to. The 2026-08-22 cost argument is unchanged and still cheap, production
- * holding exactly one acceptance record which is the own.
- *
- * §8.1 and §8.3 are UNTOUCHED and were already correct: they have said Aglyn is
- * merchant of record and determines, collects and remits transaction tax since
- * 2026-08-14. The Terms of Service moved TO them in this pass (new ToS §10.7),
- * not the other way around.
- */ export const PUBLISHER_AGREEMENT_VERSION = '2026-08-24.1';
-export const PUBLISHER_AGREEMENT_TITLE = 'Marketplace Publisher Agreement';
-/**
- * The snapshot pin for the version above (AGL-1678).
- *
- * A version string is a label we control and can reuse, so on its own it
- * proves nothing about what a publisher actually read. These two values pin
- * the archived snapshot at
- * `legal/publisher-agreement/{PUBLISHER_AGREEMENT_VERSION}/marketplace-publisher-agreement.txt`
- * (beside this module), captured FROM THE LIVE PAGE after publication — the
- * same publication-first machinery as the signup clickwrap
- * (`apps/console/constants/legal-documents.ts`, AGL-1497), and deliberately a
- * PARALLEL manifest rather than an entry in `LEGAL_DOCUMENTS`: ToS §19.1 makes
- * that set the entire signup agreement, and the publisher agreement is
- * deliberately not part of it. Mixing them would widen what a signup
- * acceptance covers.
- *
- * Both values go onto every acceptance record, so a record is self-contained
- * evidence of content and later tampering with the archive is detectable
- * rather than invisible. `publisher-agreement-version.spec.ts` re-hashes the
- * snapshot, so one version string can never come to mean two different
- * documents.
- *
- * Capture method (proven byte-for-byte against the clickwrap v4 hashes before
- * this snapshot was taken): fetch the live page, walk its HTML text nodes
- * skipping script/style, trim each, drop empties, take the document's content
- * block (first line `Last updated: …` through its closing `© …` line,
- * excluding site chrome and the table of contents), join with `\n`, and end
- * with a trailing newline. UTF-8 throughout.
- *
- * TO PUBLISH A CHANGE: publish the besigner edit first, confirm the live page
- * serves it, capture a new snapshot under the new version's directory, then
- * bump `PUBLISHER_AGREEMENT_VERSION` and these two values together, and add
- * the version's entry to `PUBLISHER_AGREEMENT_CHANGES` below. Never
- * hand-write a snapshot: it is evidence of what a publisher was shown, and a
- * snapshot of unpublished text is a false record.
- */ export const PUBLISHER_AGREEMENT_SHA256 = '2df6e940f037b4630e53c8f63bad8604ef4bf370374b89afcd4ea7f9fe8e8d63';
-/** Byte length of the same snapshot — a cheap second check on the content. */ export const PUBLISHER_AGREEMENT_BYTES = 13730;
-/**
- * Canonical document, on the operator's legal origin beside the other terms.
- *
- * Built from `LEGAL_ORIGIN` (AGL-2196), which this module already depends on:
- * `publisherAgreementIsPublished` below calls `isPublishedLegalUrl`, and that
- * accepts ONLY `LEGAL_ORIGIN`. So the gate was operator-aware while the link
- * it gates was a bare `aglyn.com` literal — meaning on a self-host install
- * with `NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN` set, the gate rejected the very URL
- * this file handed it, and every publisher was blocked from accepting. One
- * origin for both closes that, and leaves Aglyn's own URL byte-identical.
- */ export const PUBLISHER_AGREEMENT_URL = `${LEGAL_ORIGIN}/legal/marketplace-publisher-agreement`;
-/**
- * Whether that document can actually be read (AGL-1660).
- *
- * It could not, from the day this gate shipped until the day this check did:
- * the URL above 404ed, and the console still rendered it as "Read the full
- * Marketplace Publisher Agreement" above an Accept button. An acceptance
- * collected that way is a signature on a blank page — the same
- * publication-first principle the clickwrap snapshots are built on, failing in
- * the one place the text was never published at all.
- *
- * Derived, not a second flag: it reads `PUBLISHED_LEGAL_PATHS`, so the ONE
- * edit that adds the path when the page goes live is what re-opens acceptance
- * everywhere. There is no boolean to forget to flip, and no way for the link
- * and the gate to disagree.
- */ export function publisherAgreementIsPublished(url = PUBLISHER_AGREEMENT_URL) {
-    return isPublishedLegalUrl(url);
-}
-/**
- * What a publisher is told while the document has no page.
- *
- * Deliberately not "try again later" — it names the reason, because the fix is
- * ours and the publisher can do nothing about it. It must never read as though
- * accepting is something they merely have not got round to.
- */ export const PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE = `The ${PUBLISHER_AGREEMENT_TITLE} is not published yet, so there is ` + 'nothing here for you to read — and we will not ask you to agree to a ' + 'document we have not shown you. Acceptance is paused until it is ' + 'available, which also means marketplace publishing is paused. Nothing is ' + 'required of you in the meantime.';
-/**
- * What the agreement actually commits a publisher to.
- *
- * Shown above the accept control. A link alone is the pattern that produces
- * agreements nobody has read; these are the terms most likely to surprise
- * someone later, in the words they would need at that moment. They summarise
- * the document — they are not it, and the copy says so.
- */ export const PUBLISHER_AGREEMENT_POINTS = [
-    {
-        id: 'hosting-license',
-        label: 'We may host, verify and distribute what you publish',
-        detail: 'Including keeping an immutable copy of every version, inspecting its code, and showing your listing content in the marketplace and console.'
-    },
-    {
-        id: 'warranties',
-        label: 'You warrant each version as you publish it',
-        detail: 'That you have the right to publish it, that its license is accurate and compatible, that it carries no malware or hidden telemetry, and that its documentation describes what it does with data.'
-    },
-    {
-        id: 'immutable',
-        label: 'You cannot recall code that is already installed',
-        detail: 'Installs pin an exact version and hash. A mistake ships until an installer chooses to upgrade — publishing a new version is the only remedy you have.'
-    },
-    {
-        id: 'revocation',
-        label: 'We can disable a version everywhere, without notice',
-        detail: 'If a version looks like a security, legal or privacy risk we stop it on every site running it, and tell you afterwards. Operating a platform that executes other people’s code requires this.'
-    },
-    {
-        id: 'review',
-        label: 'Review is a safety screen, not an endorsement',
-        detail: 'Approval is not an audit and not a guarantee your plugin works. We may decline, delist or unsign anything, for reasons that may have nothing to do with your code.'
-    },
-    {
-        id: 'payouts',
-        label: 'On paid listings we process the sale and take a fee',
-        detail: 'We process the purchase and pay your share into your own Stripe Connect account, less a platform fee that may change. We collect and remit sales tax on Marketplace sales; refunds, chargebacks and support on your Artifacts are yours.'
-    },
-    {
-        id: 'indemnity',
-        label: 'You indemnify us for claims arising from what you publish',
-        detail: 'Including infringement claims and disputes with the organizations that install it.'
-    }
-];
-/**
- * What each version changed from the one before it, in the words a publisher
- * re-accepting needs (AGL-3407).
- *
- * An org that accepted an older version is asked again, and "the terms
- * changed" with nothing more is a request to re-read thirteen sections to
- * find two edited clauses. Each entry names the sections that moved, read off
- * the archived snapshots beside this module (`legal/publisher-agreement/`) —
- * never written from memory of the edit, for the same reason a snapshot is
- * never hand-written.
- *
- * Oldest first. The last entry is always {@link PUBLISHER_AGREEMENT_VERSION}:
- * a bump adds its entry in the same change, and
- * `publisher-agreement-version.spec.ts` fails a bump that did not. The first
- * published version has no entry, because nothing preceded it that anyone
- * accepted.
- */ export const PUBLISHER_AGREEMENT_CHANGES = [
-    {
-        version: '2026-08-18.1',
-        changes: [
-            '§1 names the marketplace and the End User License Agreement by their current names.',
-            '§3(h), new: listing conduct — what an Artifact and its listing may not claim about the platform, its plans or its prices.',
-            '§8.6, new: a paid Artifact, tier or license key must be sold through the Marketplace.',
-            '§13.6, new: how you may use the platform’s names and marks.'
-        ]
-    },
-    {
-        version: '2026-08-24.1',
-        changes: [
-            '§13.3: venue moves to Travis County, Texas, and governing law now cites Terms of Service Section 18.6.'
-        ]
-    }
-];
-/**
- * The changes an org has not yet accepted, oldest first.
- *
- * Versions are dated strings (`YYYY-MM-DD.n`), so they order as text. An
- * acceptance of a version this list does not name — one older than the first
- * entry — gets every entry, which is the honest answer: all of it is new to
- * them. No acceptance at all gets none, because a first acceptance is of the
- * whole document, not a set of edits.
- */ export function publisherAgreementChangesSince(acceptedVersion, currentVersion = PUBLISHER_AGREEMENT_VERSION) {
-    const accepted = typeof acceptedVersion === 'string' ? acceptedVersion.trim() : '';
-    if (!accepted) return [];
-    return PUBLISHER_AGREEMENT_CHANGES.filter((entry)=>entry.version > accepted && entry.version <= currentVersion);
-}
-export function publisherAgreementState(acceptance, currentVersion = PUBLISHER_AGREEMENT_VERSION) {
-    const accepted = acceptance == null ? void 0 : acceptance.version;
-    if (typeof accepted !== 'string' || !accepted.trim()) return 'none';
-    return accepted === currentVersion ? 'current' : 'outdated';
-}
-/**
- * Whether a publish may proceed.
- *
- * An older acceptance is NOT carried forward. Whoever publishes next reads
- * the changed agreement and accepts it, or does not publish — silently
- * inheriting an acceptance across a rewrite is precisely what makes the
- * record worthless.
- */ export function hasCurrentPublisherAgreement(acceptance, currentVersion = PUBLISHER_AGREEMENT_VERSION) {
-    return publisherAgreementState(acceptance, currentVersion) === 'current';
-}
-export function publisherAgreementPresentation(state, published = publisherAgreementIsPublished()) {
-    return {
-        documentUrl: published ? PUBLISHER_AGREEMENT_URL : null,
-        // Already current is not "cannot accept because unpublished" — it is
-        // nothing left to do, and the panel says so separately.
-        canAccept: published && state !== 'current',
-        unavailableNotice: published ? null : PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE
-    };
-}
-/** The refusal a publisher sees, saying which of the two problems it is. */ export function publisherAgreementRefusal(state, published = publisherAgreementIsPublished()) {
-    // Sending someone to a control we have disabled is worse than saying
-    // nothing: they go, find no button, and conclude the console is broken.
-    if (!published) {
-        return `The ${PUBLISHER_AGREEMENT_TITLE} is not published yet, so it cannot ` + 'be accepted and publishing is paused for everyone. This is on us, not ' + 'on your organization.';
-    }
-    return state === 'outdated' ? `The ${PUBLISHER_AGREEMENT_TITLE} has changed since your organization ` + 'accepted it. Review and accept the current version in Marketplace → ' + 'Publisher Profile, then publish.' : `Your organization has not accepted the ${PUBLISHER_AGREEMENT_TITLE}. ` + 'Accept it in Marketplace → Publisher Profile, then publish.';
-}
-
-//# sourceMappingURL=publisher-agreement.js.map

package/src/lib/app-utils/publisher-agreement.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/publisher-agreement.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The marketplace publisher agreement, and whether an org has accepted the\n * current one (AGL-1077).\n *\n * Deliberately NOT the per-version attestation (AGL-969). An attestation is\n * a statement about *specific bytes* and re-asks on every republish, because\n * the bytes changed. This is about the *relationship*: what we may do with a\n * listing, what the publisher warrants, indemnity, takedown, payouts, what\n * survives termination. It is accepted once, by an org, and re-asked only\n * when we change it.\n *\n * Shared like the attestation model is, and for the same reason: the publish\n * route enforces it, the profile page collects it, and the review page shows\n * staff which terms a publisher is actually under. Three copies of a version\n * string would drift, and a drifted version is one that either re-asks\n * forever or never re-asks at all.\n */\n\nimport { LEGAL_ORIGIN, isPublishedLegalUrl } from './published-legal-pages'\n\n/**\n * The version of the agreement currently in force.\n *\n * Matches the `Agreement version` header of the document itself, which is now\n * besigner content at {@link PUBLISHER_AGREEMENT_URL} rather than a repo file\n * (same practice as the Terms of Service). Bump this **only** when the\n * substance changes in a way a publisher should re-read — a typo fix is not a\n * bump. Bumping it stops every publisher at their next publish until they\n * accept again.\n *\n * Moved off `2026-07-28.1` on 2026-08-14 (AGL-1674). That string named the\n * July draft, which was never published and whose §8 said the publisher is the\n * seller of record. The published text says the opposite — Aglyn processes the\n * sale and remits transaction tax — so it is a different document in\n * substance, not a reissue, and re-asking is the point rather than a cost.\n *\n * Moved to `2026-08-18.1` on 2026-08-18 (AGL-1840 + AGL-1661). Two body-text\n * changes: §1 now says \"the Aglyn marketplace\" (the AGL-975 rename, and the\n * reason this snapshot must NOT need the AGL-975 naming-guard exemption that\n * the `2026-08-14.1` one still carries), and §1's cross-reference to\n * the \"End User Licence Agreement\"\n * becomes \"License\" to match the document that agreement actually is, which\n * was renamed on the same day.\n *\n * ⚠️ Read against the \"a typo fix is not a bump\" rule above, both edits are\n * closer to a typo than to substance, and the tension is real. The bump was\n * taken anyway on the decision (2026-08-18), for a reason the rule does not\n * cover: the served page changed, so keeping `2026-08-14.1` would leave the\n * pin below asserting a hash for text nobody is shown any more — a FALSE\n * RECORD, which is the exact failure the pin exists to detect. The choice is\n * therefore between a bump and a broken pin, not between a bump and nothing.\n *\n * ## 2026-08-22 — the page changed and this string DELIBERATELY did not\n *\n * Three clauses were added on 2026-08-22 (§3(h) listing conduct, §8.6 sales\n * through the Marketplace, §13.6 marks) and the pin below moved with them, but\n * `2026-08-18.1` stayed. That is not the third option the paragraph above says\n * does not exist — it is the same choice with one input changed. A bump exists\n * to re-ask publishers who accepted the OLD text; production holds exactly one\n * acceptance record and it is the own, so there is nobody to re-ask and the\n * bump would buy nothing. the decision, 2026-08-22.\n *\n * The pin still had to move, for precisely the reason given above: the served\n * bytes changed, so leaving the old hash here would assert a document nobody\n * is shown. Version unchanged + pin re-captured is coherent ONLY while the\n * acceptance set is empty. The first real publisher acceptance ends that, and\n * from then on any body-text change costs a bump — see the same rule in\n * `apps/console/constants/legal-documents.ts`, where the clickwrap snapshots\n * collapsed back to `v1` on the identical argument.\n *\n * ## 2026-08-24 — `2026-08-24.1`, and why this one CANNOT be folded (AGL-1956)\n *\n * §13.3 changed twice in one sentence. The venue moved from Williamson County\n * to TRAVIS County (decided) — Williamson entered from the former\n * Jarrell residential address, while every published Aglyn address is 5900\n * Balcones Dr STE 100, Austin, TX 78731, which is Travis. And the clause cited\n * \"Terms of Service Section 19\" for governing law and venue when those live at\n * §18.6; §19 is General. A wrong cross-reference in a forum-selection clause is\n * the kind of defect that gets argued about, so it was corrected in the same\n * pass.\n *\n * Unlike 2026-08-22, this one takes the bump rather than only re-pinning, and\n * the deciding reason is mechanical rather than editorial: THIS VERSION STRING\n * IS PUBLISHED IN THE DOCUMENT. The page at {@link PUBLISHER_AGREEMENT_URL}\n * serves `Agreement version: 2026-08-24.1` in its own second line, so the\n * capture below contains it, and `publisher-agreement-version.spec.ts` asserts\n * the snapshot contains `Agreement version: ${PUBLISHER_AGREEMENT_VERSION}`.\n * Holding the constant at `2026-08-18.1` against that text would need the page\n * republished to say so, and would otherwise record a publisher as having\n * accepted `2026-08-18.1` while naming bytes that call themselves\n * `2026-08-24.1`. That is a false record of exactly the shape the pin exists\n * to prevent.\n *\n * ⚠️ THIS IS THE ONE PLACE THE CLICKWRAP ARGUMENT DOES NOT REACH. The signup\n * clickwrap folded its 2026-08-24 corrections into `v1` and did not bump\n * (`apps/console/constants/legal-documents.ts`) — decided: no v2\n * before launch. That works there because `v1` is a REPO-SIDE label: the\n * published Terms carry a \"Last updated\" date and no version string at all, so\n * the label can stay still while the text moves. Here the label is part of the\n * document a publisher reads. The two schemes are not the same kind of thing\n * and must not be reasoned about as one — that difference is the whole content\n * of this paragraph.\n *\n * On the merits it would have been a bump anyway: a forum-selection clause is\n * substance, not a typo — it names the court a publisher would have to travel\n * to. The 2026-08-22 cost argument is unchanged and still cheap, production\n * holding exactly one acceptance record which is the own.\n *\n * §8.1 and §8.3 are UNTOUCHED and were already correct: they have said Aglyn is\n * merchant of record and determines, collects and remits transaction tax since\n * 2026-08-14. The Terms of Service moved TO them in this pass (new ToS §10.7),\n * not the other way around.\n */\nexport const PUBLISHER_AGREEMENT_VERSION = '2026-08-24.1'\n\nexport const PUBLISHER_AGREEMENT_TITLE = 'Marketplace Publisher Agreement'\n\n/**\n * The snapshot pin for the version above (AGL-1678).\n *\n * A version string is a label we control and can reuse, so on its own it\n * proves nothing about what a publisher actually read. These two values pin\n * the archived snapshot at\n * `legal/publisher-agreement/{PUBLISHER_AGREEMENT_VERSION}/marketplace-publisher-agreement.txt`\n * (beside this module), captured FROM THE LIVE PAGE after publication — the\n * same publication-first machinery as the signup clickwrap\n * (`apps/console/constants/legal-documents.ts`, AGL-1497), and deliberately a\n * PARALLEL manifest rather than an entry in `LEGAL_DOCUMENTS`: ToS §19.1 makes\n * that set the entire signup agreement, and the publisher agreement is\n * deliberately not part of it. Mixing them would widen what a signup\n * acceptance covers.\n *\n * Both values go onto every acceptance record, so a record is self-contained\n * evidence of content and later tampering with the archive is detectable\n * rather than invisible. `publisher-agreement-version.spec.ts` re-hashes the\n * snapshot, so one version string can never come to mean two different\n * documents.\n *\n * Capture method (proven byte-for-byte against the clickwrap v4 hashes before\n * this snapshot was taken): fetch the live page, walk its HTML text nodes\n * skipping script/style, trim each, drop empties, take the document's content\n * block (first line `Last updated: …` through its closing `© …` line,\n * excluding site chrome and the table of contents), join with `\\n`, and end\n * with a trailing newline. UTF-8 throughout.\n *\n * TO PUBLISH A CHANGE: publish the besigner edit first, confirm the live page\n * serves it, capture a new snapshot under the new version's directory, then\n * bump `PUBLISHER_AGREEMENT_VERSION` and these two values together, and add\n * the version's entry to `PUBLISHER_AGREEMENT_CHANGES` below. Never\n * hand-write a snapshot: it is evidence of what a publisher was shown, and a\n * snapshot of unpublished text is a false record.\n */\nexport const PUBLISHER_AGREEMENT_SHA256 =\n  '2df6e940f037b4630e53c8f63bad8604ef4bf370374b89afcd4ea7f9fe8e8d63'\n\n/** Byte length of the same snapshot — a cheap second check on the content. */\nexport const PUBLISHER_AGREEMENT_BYTES = 13730\n\n/**\n * Canonical document, on the operator's legal origin beside the other terms.\n *\n * Built from `LEGAL_ORIGIN` (AGL-2196), which this module already depends on:\n * `publisherAgreementIsPublished` below calls `isPublishedLegalUrl`, and that\n * accepts ONLY `LEGAL_ORIGIN`. So the gate was operator-aware while the link\n * it gates was a bare `aglyn.com` literal — meaning on a self-host install\n * with `NEXT_PUBLIC_OPERATOR_LEGAL_ORIGIN` set, the gate rejected the very URL\n * this file handed it, and every publisher was blocked from accepting. One\n * origin for both closes that, and leaves Aglyn's own URL byte-identical.\n */\nexport const PUBLISHER_AGREEMENT_URL = `${LEGAL_ORIGIN}/legal/marketplace-publisher-agreement`\n\n/**\n * Whether that document can actually be read (AGL-1660).\n *\n * It could not, from the day this gate shipped until the day this check did:\n * the URL above 404ed, and the console still rendered it as \"Read the full\n * Marketplace Publisher Agreement\" above an Accept button. An acceptance\n * collected that way is a signature on a blank page — the same\n * publication-first principle the clickwrap snapshots are built on, failing in\n * the one place the text was never published at all.\n *\n * Derived, not a second flag: it reads `PUBLISHED_LEGAL_PATHS`, so the ONE\n * edit that adds the path when the page goes live is what re-opens acceptance\n * everywhere. There is no boolean to forget to flip, and no way for the link\n * and the gate to disagree.\n */\nexport function publisherAgreementIsPublished(\n  url: string = PUBLISHER_AGREEMENT_URL,\n): boolean {\n  return isPublishedLegalUrl(url)\n}\n\n/**\n * What a publisher is told while the document has no page.\n *\n * Deliberately not \"try again later\" — it names the reason, because the fix is\n * ours and the publisher can do nothing about it. It must never read as though\n * accepting is something they merely have not got round to.\n */\nexport const PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE =\n  `The ${PUBLISHER_AGREEMENT_TITLE} is not published yet, so there is ` +\n  'nothing here for you to read — and we will not ask you to agree to a ' +\n  'document we have not shown you. Acceptance is paused until it is ' +\n  'available, which also means marketplace publishing is paused. Nothing is ' +\n  'required of you in the meantime.'\n\n/**\n * What the agreement actually commits a publisher to.\n *\n * Shown above the accept control. A link alone is the pattern that produces\n * agreements nobody has read; these are the terms most likely to surprise\n * someone later, in the words they would need at that moment. They summarise\n * the document — they are not it, and the copy says so.\n */\nexport const PUBLISHER_AGREEMENT_POINTS: readonly {\n  id: string\n  label: string\n  detail: string\n}[] = [\n  {\n    id: 'hosting-license',\n    label: 'We may host, verify and distribute what you publish',\n    detail:\n      'Including keeping an immutable copy of every version, inspecting its code, and showing your listing content in the marketplace and console.',\n  },\n  {\n    id: 'warranties',\n    label: 'You warrant each version as you publish it',\n    detail:\n      'That you have the right to publish it, that its license is accurate and compatible, that it carries no malware or hidden telemetry, and that its documentation describes what it does with data.',\n  },\n  {\n    id: 'immutable',\n    label: 'You cannot recall code that is already installed',\n    detail:\n      'Installs pin an exact version and hash. A mistake ships until an installer chooses to upgrade — publishing a new version is the only remedy you have.',\n  },\n  {\n    id: 'revocation',\n    label: 'We can disable a version everywhere, without notice',\n    detail:\n      'If a version looks like a security, legal or privacy risk we stop it on every site running it, and tell you afterwards. Operating a platform that executes other people’s code requires this.',\n  },\n  {\n    id: 'review',\n    label: 'Review is a safety screen, not an endorsement',\n    detail:\n      'Approval is not an audit and not a guarantee your plugin works. We may decline, delist or unsign anything, for reasons that may have nothing to do with your code.',\n  },\n  {\n    id: 'payouts',\n    label: 'On paid listings we process the sale and take a fee',\n    detail:\n      'We process the purchase and pay your share into your own Stripe Connect account, less a platform fee that may change. We collect and remit sales tax on Marketplace sales; refunds, chargebacks and support on your Artifacts are yours.',\n  },\n  {\n    id: 'indemnity',\n    label: 'You indemnify us for claims arising from what you publish',\n    detail:\n      'Including infringement claims and disputes with the organizations that install it.',\n  },\n]\n\n/**\n * What each version changed from the one before it, in the words a publisher\n * re-accepting needs (AGL-3407).\n *\n * An org that accepted an older version is asked again, and \"the terms\n * changed\" with nothing more is a request to re-read thirteen sections to\n * find two edited clauses. Each entry names the sections that moved, read off\n * the archived snapshots beside this module (`legal/publisher-agreement/`) —\n * never written from memory of the edit, for the same reason a snapshot is\n * never hand-written.\n *\n * Oldest first. The last entry is always {@link PUBLISHER_AGREEMENT_VERSION}:\n * a bump adds its entry in the same change, and\n * `publisher-agreement-version.spec.ts` fails a bump that did not. The first\n * published version has no entry, because nothing preceded it that anyone\n * accepted.\n */\nexport const PUBLISHER_AGREEMENT_CHANGES: readonly {\n  version: string\n  changes: readonly string[]\n}[] = [\n  {\n    version: '2026-08-18.1',\n    changes: [\n      '§1 names the marketplace and the End User License Agreement by their current names.',\n      '§3(h), new: listing conduct — what an Artifact and its listing may not claim about the platform, its plans or its prices.',\n      '§8.6, new: a paid Artifact, tier or license key must be sold through the Marketplace.',\n      '§13.6, new: how you may use the platform’s names and marks.',\n    ],\n  },\n  {\n    version: '2026-08-24.1',\n    changes: [\n      '§13.3: venue moves to Travis County, Texas, and governing law now cites Terms of Service Section 18.6.',\n    ],\n  },\n]\n\n/**\n * The changes an org has not yet accepted, oldest first.\n *\n * Versions are dated strings (`YYYY-MM-DD.n`), so they order as text. An\n * acceptance of a version this list does not name — one older than the first\n * entry — gets every entry, which is the honest answer: all of it is new to\n * them. No acceptance at all gets none, because a first acceptance is of the\n * whole document, not a set of edits.\n */\nexport function publisherAgreementChangesSince(\n  acceptedVersion: string | null | undefined,\n  currentVersion: string = PUBLISHER_AGREEMENT_VERSION,\n): readonly { version: string; changes: readonly string[] }[] {\n  const accepted = typeof acceptedVersion === 'string' ? acceptedVersion.trim() : ''\n  if (!accepted) return []\n  return PUBLISHER_AGREEMENT_CHANGES.filter(\n    (entry) => entry.version > accepted && entry.version <= currentVersion,\n  )\n}\n\n/**\n * A recorded acceptance: which version, of which exact bytes, by whom, when.\n *\n * `sha256`/`bytes` (AGL-1678) pin the acceptance to the archived snapshot of\n * the text the publisher was shown. Optional because records written before\n * the pin existed carry only the version string — absence means \"accepted\n * before 2026-08-17\", not \"accepted nothing\".\n */\nexport interface PublisherAgreementAcceptance {\n  version?: string\n  sha256?: string\n  bytes?: number\n  acceptedBy?: string\n  acceptedAt?: unknown\n}\n\n/**\n * Where an org stands with the agreement.\n *\n * `none` and `outdated` are deliberately different answers. \"You have never\n * agreed to anything\" and \"the terms changed since you agreed\" are different\n * situations with different copy, and collapsing them into a boolean is how\n * a re-acceptance ends up reading like a first-time setup step.\n */\nexport type PublisherAgreementState = 'none' | 'outdated' | 'current'\n\nexport function publisherAgreementState(\n  acceptance: PublisherAgreementAcceptance | null | undefined,\n  currentVersion: string = PUBLISHER_AGREEMENT_VERSION,\n): PublisherAgreementState {\n  const accepted = acceptance?.version\n  if (typeof accepted !== 'string' || !accepted.trim()) return 'none'\n  return accepted === currentVersion ? 'current' : 'outdated'\n}\n\n/**\n * Whether a publish may proceed.\n *\n * An older acceptance is NOT carried forward. Whoever publishes next reads\n * the changed agreement and accepts it, or does not publish — silently\n * inheriting an acceptance across a rewrite is precisely what makes the\n * record worthless.\n */\nexport function hasCurrentPublisherAgreement(\n  acceptance: PublisherAgreementAcceptance | null | undefined,\n  currentVersion: string = PUBLISHER_AGREEMENT_VERSION,\n): boolean {\n  return publisherAgreementState(acceptance, currentVersion) === 'current'\n}\n\n/**\n * What the acceptance UI may show (AGL-1660).\n *\n * The gate lives HERE rather than in the panel, for the reason every \"check it\n * in the component\" control eventually fails: the component is not the only\n * caller. The accept route consults the same function, so a client that skips\n * the UI entirely meets the same answer.\n *\n * `documentUrl` is null, not the URL, when the document is unpublished — the\n * console reads the link target from this, so an unreadable document is\n * structurally unable to reach an href.\n */\nexport interface PublisherAgreementPresentation {\n  /** The document to link, or null when there is no page to link to. */\n  documentUrl: string | null\n  /** Whether the accept control may be offered at all. */\n  canAccept: boolean\n  /** Why acceptance is unavailable, or null when it is available. */\n  unavailableNotice: string | null\n}\n\nexport function publisherAgreementPresentation(\n  state: PublisherAgreementState,\n  published: boolean = publisherAgreementIsPublished(),\n): PublisherAgreementPresentation {\n  return {\n    documentUrl: published ? PUBLISHER_AGREEMENT_URL : null,\n    // Already current is not \"cannot accept because unpublished\" — it is\n    // nothing left to do, and the panel says so separately.\n    canAccept: published && state !== 'current',\n    unavailableNotice: published ? null : PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE,\n  }\n}\n\n/** The refusal a publisher sees, saying which of the two problems it is. */\nexport function publisherAgreementRefusal(\n  state: PublisherAgreementState,\n  published: boolean = publisherAgreementIsPublished(),\n): string {\n  // Sending someone to a control we have disabled is worse than saying\n  // nothing: they go, find no button, and conclude the console is broken.\n  if (!published) {\n    return (\n      `The ${PUBLISHER_AGREEMENT_TITLE} is not published yet, so it cannot ` +\n      'be accepted and publishing is paused for everyone. This is on us, not ' +\n      'on your organization.'\n    )\n  }\n  return state === 'outdated'\n    ? `The ${PUBLISHER_AGREEMENT_TITLE} has changed since your organization ` +\n        'accepted it. Review and accept the current version in Marketplace → ' +\n        'Publisher Profile, then publish.'\n    : `Your organization has not accepted the ${PUBLISHER_AGREEMENT_TITLE}. ` +\n        'Accept it in Marketplace → Publisher Profile, then publish.'\n}\n"],"names":["LEGAL_ORIGIN","isPublishedLegalUrl","PUBLISHER_AGREEMENT_VERSION","PUBLISHER_AGREEMENT_TITLE","PUBLISHER_AGREEMENT_SHA256","PUBLISHER_AGREEMENT_BYTES","PUBLISHER_AGREEMENT_URL","publisherAgreementIsPublished","url","PUBLISHER_AGREEMENT_UNAVAILABLE_NOTICE","PUBLISHER_AGREEMENT_POINTS","id","label","detail","PUBLISHER_AGREEMENT_CHANGES","version","changes","publisherAgreementChangesSince","acceptedVersion","currentVersion","accepted","trim","filter","entry","publisherAgreementState","acceptance","hasCurrentPublisherAgreement","publisherAgreementPresentation","state","published","documentUrl","canAccept","unavailableNotice","publisherAgreementRefusal"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;CAgBC,GAED,SAASA,YAAY,EAAEC,mBAAmB,QAAQ,6BAAyB;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4FC,GACD,OAAO,MAAMC,8BAA8B,eAAc;AAEzD,OAAO,MAAMC,4BAA4B,kCAAiC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCC,GACD,OAAO,MAAMC,6BACX,mEAAkE;AAEpE,4EAA4E,GAC5E,OAAO,MAAMC,4BAA4B,MAAK;AAE9C;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,0BAA0B,GAAGN,aAAa,sCAAsC,CAAC,CAAA;AAE9F;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASO,8BACdC,MAAcF,uBAAuB;IAErC,OAAOL,oBAAoBO;AAC7B;AAEA;;;;;;CAMC,GACD,OAAO,MAAMC,yCACX,CAAC,IAAI,EAAEN,0BAA0B,mCAAmC,CAAC,GACrE,0EACA,sEACA,8EACA,mCAAkC;AAEpC;;;;;;;CAOC,GACD,OAAO,MAAMO,6BAIP;IACJ;QACEC,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;IACA;QACEF,IAAI;QACJC,OAAO;QACPC,QACE;IACJ;CACD,CAAA;AAED;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,8BAGP;IACJ;QACEC,SAAS;QACTC,SAAS;YACP;YACA;YACA;YACA;SACD;IACH;IACA;QACED,SAAS;QACTC,SAAS;YACP;SACD;IACH;CACD,CAAA;AAED;;;;;;;;CAQC,GACD,OAAO,SAASC,+BACdC,eAA0C,EAC1CC,iBAAyBjB,2BAA2B;IAEpD,MAAMkB,WAAW,OAAOF,oBAAoB,WAAWA,gBAAgBG,IAAI,KAAK;IAChF,IAAI,CAACD,UAAU,OAAO,EAAE;IACxB,OAAON,4BAA4BQ,MAAM,CACvC,CAACC,QAAUA,MAAMR,OAAO,GAAGK,YAAYG,MAAMR,OAAO,IAAII;AAE5D;AA4BA,OAAO,SAASK,wBACdC,UAA2D,EAC3DN,iBAAyBjB,2BAA2B;IAEpD,MAAMkB,WAAWK,8BAAAA,WAAYV,OAAO;IACpC,IAAI,OAAOK,aAAa,YAAY,CAACA,SAASC,IAAI,IAAI,OAAO;IAC7D,OAAOD,aAAaD,iBAAiB,YAAY;AACnD;AAEA;;;;;;;CAOC,GACD,OAAO,SAASO,6BACdD,UAA2D,EAC3DN,iBAAyBjB,2BAA2B;IAEpD,OAAOsB,wBAAwBC,YAAYN,oBAAoB;AACjE;AAuBA,OAAO,SAASQ,+BACdC,KAA8B,EAC9BC,YAAqBtB,+BAA+B;IAEpD,OAAO;QACLuB,aAAaD,YAAYvB,0BAA0B;QACnD,qEAAqE;QACrE,wDAAwD;QACxDyB,WAAWF,aAAaD,UAAU;QAClCI,mBAAmBH,YAAY,OAAOpB;IACxC;AACF;AAEA,0EAA0E,GAC1E,OAAO,SAASwB,0BACdL,KAA8B,EAC9BC,YAAqBtB,+BAA+B;IAEpD,qEAAqE;IACrE,wEAAwE;IACxE,IAAI,CAACsB,WAAW;QACd,OACE,CAAC,IAAI,EAAE1B,0BAA0B,oCAAoC,CAAC,GACtE,2EACA;IAEJ;IACA,OAAOyB,UAAU,aACb,CAAC,IAAI,EAAEzB,0BAA0B,qCAAqC,CAAC,GACrE,yEACA,qCACF,CAAC,uCAAuC,EAAEA,0BAA0B,EAAE,CAAC,GACrE;AACR"}

package/src/lib/app-utils/wistia-embed.d.ts

@@ -1,104 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-/**
- * A Wistia video, as the Video element plays it (AGL-2826).
- *
- * ## Only the media id survives
- *
- * An author pastes whatever link Wistia showed them. That string never reaches
- * a frame: every builder below reads the media's hashed id out of it and
- * rebuilds the address, so the only frame this module can produce is on
- * {@link WISTIA_PLAYER_ORIGIN}. That closed set is what lets the tenant's
- * `frame-src` name the origin for every site, and it is the rule
- * `parseVideoEmbedSrc` already holds YouTube and Vimeo to.
- *
- * ## The iframe embed, not the player script
- *
- * Wistia offers two embeds. The script embed runs Wistia's JavaScript in the
- * page itself, so every site would need `connect-src`, `img-src` and
- * `media-src` grants for Wistia's hosts, and the player's storage and beacons
- * would run as the site. The iframe embed runs all of that inside a document on
- * Wistia's origin, under Wistia's own policy: the page needs one `frame-src`
- * entry, and whatever the player stores is keyed to Wistia inside the site's
- * partition rather than written as the site.
- *
- * Measured on 2026-09-10: `fast.wistia.net/embed/iframe/{id}` answers 200 with
- * no redirect, so no second origin is involved in loading the frame.
- */
-/** The only origin a Wistia player frame is ever loaded from. */
-export declare const WISTIA_PLAYER_ORIGIN = "https://fast.wistia.net";
-/**
- * The hashed id a Wistia link names, or `undefined` for anything else.
- *
- * A share link (`/s/{slug}`) names no id and is refused rather than guessed
- * at, as is a value that is not an http(s) URL.
- */
-export declare function wistiaMediaId(value: unknown): string | undefined;
-/**
- * The player page for a Wistia link, with no per-visit options: what
- * `VideoObject.embedUrl` names.
- */
-export declare function wistiaEmbedUrl(value: unknown): string | undefined;
-export interface WistiaPlayerOptions {
-    /**
-     * Start playing as soon as the player is ready. On unless this is exactly
-     * `false`; see {@link wistiaPlayerSrc} for which frame turns it off.
-     */
-    autoPlay?: boolean;
-    /**
-     * Ask Wistia not to record the viewing session (its `doNotTrack` embed
-     * option). The element sets it for every visitor whose analytics consent is
-     * not on record.
-     */
-    doNotTrack?: boolean;
-    /** Start without sound. */
-    muted?: boolean;
-    /** Restart at the end (`endVideoBehavior=loop`). */
-    loop?: boolean;
-}
-/**
- * The address of a Wistia player frame.
- *
- * `autoPlay` is on by default, because the usual frame is the one a visitor's
- * press loads: it exists only because somebody pressed play, and a second play
- * button inside the player would ask them twice.
- *
- * The frame a page loads before anyone has pressed anything ("Load the player
- * with the page", AGL-2962) passes `autoPlay: false`. The address then says
- * `autoPlay=false` rather than leaving the option out: an option in the embed
- * overrides the media's own settings in the Wistia account, and those may be
- * set to autoplay.
- *
- * ## The corners belong to the page (AGL-3209)
- *
- * `roundedPlayer=false` is stated on every address, and is not an option a
- * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the
- * frame, where the document's own canvas is white: on a dark page the corner
- * arcs and the clip's antialiased edge composite as a white ring around the
- * film rather than as the page behind them.
- *
- * Measured on 2026-09-21 against the live videos page, whose background is
- * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column
- * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —
- * lighter than either, so painted rather than blended. With the option off
- * the same pixels are the film.
- *
- * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes
- * a `radius` from the element's own control and puts it on the frame, which a
- * second rounding inside the frame can only fight.
- */
-export declare function wistiaPlayerSrc(value: unknown, options?: WistiaPlayerOptions): string | undefined;

package/src/lib/app-utils/wistia-embed.js

@@ -1,138 +0,0 @@
-/**
- * @license
- * Copyright 2026 Aglyn LLC
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */ /**
- * A Wistia video, as the Video element plays it (AGL-2826).
- *
- * ## Only the media id survives
- *
- * An author pastes whatever link Wistia showed them. That string never reaches
- * a frame: every builder below reads the media's hashed id out of it and
- * rebuilds the address, so the only frame this module can produce is on
- * {@link WISTIA_PLAYER_ORIGIN}. That closed set is what lets the tenant's
- * `frame-src` name the origin for every site, and it is the rule
- * `parseVideoEmbedSrc` already holds YouTube and Vimeo to.
- *
- * ## The iframe embed, not the player script
- *
- * Wistia offers two embeds. The script embed runs Wistia's JavaScript in the
- * page itself, so every site would need `connect-src`, `img-src` and
- * `media-src` grants for Wistia's hosts, and the player's storage and beacons
- * would run as the site. The iframe embed runs all of that inside a document on
- * Wistia's origin, under Wistia's own policy: the page needs one `frame-src`
- * entry, and whatever the player stores is keyed to Wistia inside the site's
- * partition rather than written as the site.
- *
- * Measured on 2026-09-10: `fast.wistia.net/embed/iframe/{id}` answers 200 with
- * no redirect, so no second origin is involved in loading the frame.
- */ /** The only origin a Wistia player frame is ever loaded from. */ export const WISTIA_PLAYER_ORIGIN = 'https://fast.wistia.net';
-/** A hashed id: ten lowercase letters and digits, e.g. `e4a27b971d`. */ const HASHED_ID = /^[a-z0-9]{10}$/;
-/**
- * The paths a Wistia link carries a media id in. Wistia's oEmbed endpoint
- * matches on the path rather than the host, and so does this; the host is
- * checked separately by {@link isWistiaHostname}.
- */ const MEDIA_ID_PATHS = [
-    // A media page: `https://acme.wistia.com/medias/{id}`, and its `/manage`.
-    /^\/medias\/([^/]+)(?:\/manage)?\/?$/,
-    // The short form of the same page.
-    /^\/m\/([^/]+)\/?$/,
-    // An iframe embed's own address.
-    /^\/embed\/iframe\/([^/]+)\/?$/,
-    // A script embed's media address, with or without its `.jsonp` suffix.
-    /^\/embed\/medias\/([^/.]+)(?:\.jsonp?)?\/?$/
-];
-/**
- * Whether a hostname is Wistia's. Exact or dot-anchored matches only, so
- * `wistia.com.example.net` and `notwistia.com` are refused.
- */ function isWistiaHostname(hostname) {
-    return [
-        'wistia.com',
-        'wistia.net',
-        'wi.st'
-    ].some((domain)=>hostname === domain || hostname.endsWith(`.${domain}`));
-}
-/**
- * The hashed id a Wistia link names, or `undefined` for anything else.
- *
- * A share link (`/s/{slug}`) names no id and is refused rather than guessed
- * at, as is a value that is not an http(s) URL.
- */ export function wistiaMediaId(value) {
-    if (typeof value !== 'string') return undefined;
-    let url;
-    try {
-        url = new URL(value.trim());
-    } catch (unused) {
-        return undefined;
-    }
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined;
-    if (!isWistiaHostname(url.hostname)) return undefined;
-    for (const pattern of MEDIA_ID_PATHS){
-        var _pattern_exec;
-        const id = (_pattern_exec = pattern.exec(url.pathname)) == null ? void 0 : _pattern_exec[1];
-        if (id && HASHED_ID.test(id)) return id;
-    }
-    return undefined;
-}
-/**
- * The player page for a Wistia link, with no per-visit options: what
- * `VideoObject.embedUrl` names.
- */ export function wistiaEmbedUrl(value) {
-    const id = wistiaMediaId(value);
-    return id ? `${WISTIA_PLAYER_ORIGIN}/embed/iframe/${id}` : undefined;
-}
-/**
- * The address of a Wistia player frame.
- *
- * `autoPlay` is on by default, because the usual frame is the one a visitor's
- * press loads: it exists only because somebody pressed play, and a second play
- * button inside the player would ask them twice.
- *
- * The frame a page loads before anyone has pressed anything ("Load the player
- * with the page", AGL-2962) passes `autoPlay: false`. The address then says
- * `autoPlay=false` rather than leaving the option out: an option in the embed
- * overrides the media's own settings in the Wistia account, and those may be
- * set to autoplay.
- *
- * ## The corners belong to the page (AGL-3209)
- *
- * `roundedPlayer=false` is stated on every address, and is not an option a
- * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the
- * frame, where the document's own canvas is white: on a dark page the corner
- * arcs and the clip's antialiased edge composite as a white ring around the
- * film rather than as the page behind them.
- *
- * Measured on 2026-09-21 against the live videos page, whose background is
- * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column
- * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —
- * lighter than either, so painted rather than blended. With the option off
- * the same pixels are the film.
- *
- * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes
- * a `radius` from the element's own control and puts it on the frame, which a
- * second rounding inside the frame can only fight.
- */ export function wistiaPlayerSrc(value, options = {}) {
-    const embedUrl = wistiaEmbedUrl(value);
-    if (!embedUrl) return undefined;
-    const params = new URLSearchParams({
-        autoPlay: options.autoPlay === false ? 'false' : 'true',
-        roundedPlayer: 'false'
-    });
-    if (options.doNotTrack) params.set('doNotTrack', 'true');
-    if (options.muted) params.set('muted', 'true');
-    if (options.loop) params.set('endVideoBehavior', 'loop');
-    return `${embedUrl}?${params.toString()}`;
-}
-
-//# sourceMappingURL=wistia-embed.js.map

package/src/lib/app-utils/wistia-embed.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/wistia-embed.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A Wistia video, as the Video element plays it (AGL-2826).\n *\n * ## Only the media id survives\n *\n * An author pastes whatever link Wistia showed them. That string never reaches\n * a frame: every builder below reads the media's hashed id out of it and\n * rebuilds the address, so the only frame this module can produce is on\n * {@link WISTIA_PLAYER_ORIGIN}. That closed set is what lets the tenant's\n * `frame-src` name the origin for every site, and it is the rule\n * `parseVideoEmbedSrc` already holds YouTube and Vimeo to.\n *\n * ## The iframe embed, not the player script\n *\n * Wistia offers two embeds. The script embed runs Wistia's JavaScript in the\n * page itself, so every site would need `connect-src`, `img-src` and\n * `media-src` grants for Wistia's hosts, and the player's storage and beacons\n * would run as the site. The iframe embed runs all of that inside a document on\n * Wistia's origin, under Wistia's own policy: the page needs one `frame-src`\n * entry, and whatever the player stores is keyed to Wistia inside the site's\n * partition rather than written as the site.\n *\n * Measured on 2026-09-10: `fast.wistia.net/embed/iframe/{id}` answers 200 with\n * no redirect, so no second origin is involved in loading the frame.\n */\n\n/** The only origin a Wistia player frame is ever loaded from. */\nexport const WISTIA_PLAYER_ORIGIN = 'https://fast.wistia.net'\n\n/** A hashed id: ten lowercase letters and digits, e.g. `e4a27b971d`. */\nconst HASHED_ID = /^[a-z0-9]{10}$/\n\n/**\n * The paths a Wistia link carries a media id in. Wistia's oEmbed endpoint\n * matches on the path rather than the host, and so does this; the host is\n * checked separately by {@link isWistiaHostname}.\n */\nconst MEDIA_ID_PATHS: readonly RegExp[] = [\n  // A media page: `https://acme.wistia.com/medias/{id}`, and its `/manage`.\n  /^\\/medias\\/([^/]+)(?:\\/manage)?\\/?$/,\n  // The short form of the same page.\n  /^\\/m\\/([^/]+)\\/?$/,\n  // An iframe embed's own address.\n  /^\\/embed\\/iframe\\/([^/]+)\\/?$/,\n  // A script embed's media address, with or without its `.jsonp` suffix.\n  /^\\/embed\\/medias\\/([^/.]+)(?:\\.jsonp?)?\\/?$/,\n]\n\n/**\n * Whether a hostname is Wistia's. Exact or dot-anchored matches only, so\n * `wistia.com.example.net` and `notwistia.com` are refused.\n */\nfunction isWistiaHostname(hostname: string): boolean {\n  return ['wistia.com', 'wistia.net', 'wi.st'].some(\n    (domain) => hostname === domain || hostname.endsWith(`.${domain}`),\n  )\n}\n\n/**\n * The hashed id a Wistia link names, or `undefined` for anything else.\n *\n * A share link (`/s/{slug}`) names no id and is refused rather than guessed\n * at, as is a value that is not an http(s) URL.\n */\nexport function wistiaMediaId(value: unknown): string | undefined {\n  if (typeof value !== 'string') return undefined\n  let url: URL\n  try {\n    url = new URL(value.trim())\n  } catch {\n    return undefined\n  }\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') return undefined\n  if (!isWistiaHostname(url.hostname)) return undefined\n  for (const pattern of MEDIA_ID_PATHS) {\n    const id = pattern.exec(url.pathname)?.[1]\n    if (id && HASHED_ID.test(id)) return id\n  }\n  return undefined\n}\n\n/**\n * The player page for a Wistia link, with no per-visit options: what\n * `VideoObject.embedUrl` names.\n */\nexport function wistiaEmbedUrl(value: unknown): string | undefined {\n  const id = wistiaMediaId(value)\n  return id ? `${WISTIA_PLAYER_ORIGIN}/embed/iframe/${id}` : undefined\n}\n\nexport interface WistiaPlayerOptions {\n  /**\n   * Start playing as soon as the player is ready. On unless this is exactly\n   * `false`; see {@link wistiaPlayerSrc} for which frame turns it off.\n   */\n  autoPlay?: boolean\n  /**\n   * Ask Wistia not to record the viewing session (its `doNotTrack` embed\n   * option). The element sets it for every visitor whose analytics consent is\n   * not on record.\n   */\n  doNotTrack?: boolean\n  /** Start without sound. */\n  muted?: boolean\n  /** Restart at the end (`endVideoBehavior=loop`). */\n  loop?: boolean\n}\n\n/**\n * The address of a Wistia player frame.\n *\n * `autoPlay` is on by default, because the usual frame is the one a visitor's\n * press loads: it exists only because somebody pressed play, and a second play\n * button inside the player would ask them twice.\n *\n * The frame a page loads before anyone has pressed anything (\"Load the player\n * with the page\", AGL-2962) passes `autoPlay: false`. The address then says\n * `autoPlay=false` rather than leaving the option out: an option in the embed\n * overrides the media's own settings in the Wistia account, and those may be\n * set to autoplay.\n *\n * ## The corners belong to the page (AGL-3209)\n *\n * `roundedPlayer=false` is stated on every address, and is not an option a\n * caller may turn back on. Wistia's rounded chrome rounds and clips INSIDE the\n * frame, where the document's own canvas is white: on a dark page the corner\n * arcs and the clip's antialiased edge composite as a white ring around the\n * film rather than as the page behind them.\n *\n * Measured on 2026-09-21 against the live videos page, whose background is\n * `rgb(42 52 64)` and whose film is `rgb(22 30 52)`: the frame's first column\n * read `rgb(137 141 152)` and its top-left corner `rgb(195 198 201)` —\n * lighter than either, so painted rather than blended. With the option off\n * the same pixels are the film.\n *\n * The shape is the placement's to decide in any case: `VideoPlayerFrame` takes\n * a `radius` from the element's own control and puts it on the frame, which a\n * second rounding inside the frame can only fight.\n */\nexport function wistiaPlayerSrc(\n  value: unknown,\n  options: WistiaPlayerOptions = {},\n): string | undefined {\n  const embedUrl = wistiaEmbedUrl(value)\n  if (!embedUrl) return undefined\n  const params = new URLSearchParams({\n    autoPlay: options.autoPlay === false ? 'false' : 'true',\n    roundedPlayer: 'false',\n  })\n  if (options.doNotTrack) params.set('doNotTrack', 'true')\n  if (options.muted) params.set('muted', 'true')\n  if (options.loop) params.set('endVideoBehavior', 'loop')\n  return `${embedUrl}?${params.toString()}`\n}\n"],"names":["WISTIA_PLAYER_ORIGIN","HASHED_ID","MEDIA_ID_PATHS","isWistiaHostname","hostname","some","domain","endsWith","wistiaMediaId","value","undefined","url","URL","trim","protocol","pattern","id","exec","pathname","test","wistiaEmbedUrl","wistiaPlayerSrc","options","embedUrl","params","URLSearchParams","autoPlay","roundedPlayer","doNotTrack","set","muted","loop","toString"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,+DAA+D,GAC/D,OAAO,MAAMA,uBAAuB,0BAAyB;AAE7D,sEAAsE,GACtE,MAAMC,YAAY;AAElB;;;;CAIC,GACD,MAAMC,iBAAoC;IACxC,0EAA0E;IAC1E;IACA,mCAAmC;IACnC;IACA,iCAAiC;IACjC;IACA,uEAAuE;IACvE;CACD;AAED;;;CAGC,GACD,SAASC,iBAAiBC,QAAgB;IACxC,OAAO;QAAC;QAAc;QAAc;KAAQ,CAACC,IAAI,CAC/C,CAACC,SAAWF,aAAaE,UAAUF,SAASG,QAAQ,CAAC,CAAC,CAAC,EAAED,QAAQ;AAErE;AAEA;;;;;CAKC,GACD,OAAO,SAASE,cAAcC,KAAc;IAC1C,IAAI,OAAOA,UAAU,UAAU,OAAOC;IACtC,IAAIC;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIH,MAAMI,IAAI;IAC1B,EAAE,eAAM;QACN,OAAOH;IACT;IACA,IAAIC,IAAIG,QAAQ,KAAK,YAAYH,IAAIG,QAAQ,KAAK,SAAS,OAAOJ;IAClE,IAAI,CAACP,iBAAiBQ,IAAIP,QAAQ,GAAG,OAAOM;IAC5C,KAAK,MAAMK,WAAWb,eAAgB;YACzBa;QAAX,MAAMC,MAAKD,gBAAAA,QAAQE,IAAI,CAACN,IAAIO,QAAQ,sBAAzBH,aAA4B,CAAC,EAAE;QAC1C,IAAIC,MAAMf,UAAUkB,IAAI,CAACH,KAAK,OAAOA;IACvC;IACA,OAAON;AACT;AAEA;;;CAGC,GACD,OAAO,SAASU,eAAeX,KAAc;IAC3C,MAAMO,KAAKR,cAAcC;IACzB,OAAOO,KAAK,GAAGhB,qBAAqB,cAAc,EAAEgB,IAAI,GAAGN;AAC7D;AAoBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASW,gBACdZ,KAAc,EACda,UAA+B,CAAC,CAAC;IAEjC,MAAMC,WAAWH,eAAeX;IAChC,IAAI,CAACc,UAAU,OAAOb;IACtB,MAAMc,SAAS,IAAIC,gBAAgB;QACjCC,UAAUJ,QAAQI,QAAQ,KAAK,QAAQ,UAAU;QACjDC,eAAe;IACjB;IACA,IAAIL,QAAQM,UAAU,EAAEJ,OAAOK,GAAG,CAAC,cAAc;IACjD,IAAIP,QAAQQ,KAAK,EAAEN,OAAOK,GAAG,CAAC,SAAS;IACvC,IAAIP,QAAQS,IAAI,EAAEP,OAAOK,GAAG,CAAC,oBAAoB;IACjD,OAAO,GAAGN,SAAS,CAAC,EAAEC,OAAOQ,QAAQ,IAAI;AAC3C"}