@aglyn/aglyn 1.0.0-beta.219 → 1.0.0-beta.221

package/src/lib/app-utils/inbound-mail-domain.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Where the platform receives mail when the deployment names no domain. */
+export declare const INBOUND_MAIL_DEFAULT_DOMAIN = "in.aglyn.com";
+/**
+ * The domain the platform receives mail on for the workspaces it serves —
+ * the one its mail provider's inbound route answers, and so one no member
+ * may claim an address on (AGL-2657, AGL-2975). `CRM_INBOUND_DOMAIN`, the
+ * name the deployment has always set it under, or the platform's default
+ * when it names none or names something that is not a hostname. Lowercased,
+ * because a domain is.
+ */
+export declare function inboundMailDomain(env?: Record<string, string | undefined>): string;

package/src/lib/app-utils/inbound-mail-domain.js

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /** Where the platform receives mail when the deployment names no domain. */ export const INBOUND_MAIL_DEFAULT_DOMAIN = 'in.aglyn.com';
+const DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/**
+ * The domain the platform receives mail on for the workspaces it serves —
+ * the one its mail provider's inbound route answers, and so one no member
+ * may claim an address on (AGL-2657, AGL-2975). `CRM_INBOUND_DOMAIN`, the
+ * name the deployment has always set it under, or the platform's default
+ * when it names none or names something that is not a hostname. Lowercased,
+ * because a domain is.
+ */ export function inboundMailDomain(env = process.env) {
+    var _env_CRM_INBOUND_DOMAIN;
+    const configured = String((_env_CRM_INBOUND_DOMAIN = env['CRM_INBOUND_DOMAIN']) != null ? _env_CRM_INBOUND_DOMAIN : '').trim().toLowerCase();
+    return DOMAIN_PATTERN.test(configured) ? configured : INBOUND_MAIL_DEFAULT_DOMAIN;
+}
+
+//# sourceMappingURL=inbound-mail-domain.js.map

package/src/lib/app-utils/inbound-mail-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/inbound-mail-domain.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/** Where the platform receives mail when the deployment names no domain. */\nexport const INBOUND_MAIL_DEFAULT_DOMAIN = 'in.aglyn.com'\n\nconst DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/\n\n/**\n * The domain the platform receives mail on for the workspaces it serves —\n * the one its mail provider's inbound route answers, and so one no member\n * may claim an address on (AGL-2657, AGL-2975). `CRM_INBOUND_DOMAIN`, the\n * name the deployment has always set it under, or the platform's default\n * when it names none or names something that is not a hostname. Lowercased,\n * because a domain is.\n */\nexport function inboundMailDomain(\n  env: Record<string, string | undefined> = process.env,\n): string {\n  const configured = String(env['CRM_INBOUND_DOMAIN'] ?? '')\n    .trim()\n    .toLowerCase()\n  return DOMAIN_PATTERN.test(configured) ? configured : INBOUND_MAIL_DEFAULT_DOMAIN\n}\n"],"names":["INBOUND_MAIL_DEFAULT_DOMAIN","DOMAIN_PATTERN","inboundMailDomain","env","process","configured","String","trim","toLowerCase","test"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,0EAA0E,GAC1E,OAAO,MAAMA,8BAA8B,eAAc;AAEzD,MAAMC,iBAAiB;AAEvB;;;;;;;CAOC,GACD,OAAO,SAASC,kBACdC,MAA0CC,QAAQD,GAAG;QAE3BA;IAA1B,MAAME,aAAaC,QAAOH,0BAAAA,GAAG,CAAC,qBAAqB,YAAzBA,0BAA6B,IACpDI,IAAI,GACJC,WAAW;IACd,OAAOP,eAAeQ,IAAI,CAACJ,cAAcA,aAAaL;AACxD"}

package/src/lib/app-utils/leaving-notice.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The first path segment the notice owns on every site (a reserved slug). */
+export declare const LEAVING_NOTICE_ROUTE_SEGMENT = "_aglyn";
+/** Where the notice is served, on the site's own host. */
+export declare const LEAVING_NOTICE_PATH = "/_aglyn/leaving";
+/** The query parameter carrying the destination. */
+export declare const LEAVING_NOTICE_DESTINATION_PARAM = "to";
+/** The query parameter carrying the destination's signature. */
+export declare const LEAVING_NOTICE_SIGNATURE_PARAM = "sig";
+/** What a page in its notice window carries, from the server. */
+export interface LeavingNoticeConfig {
+    /**
+     * Epoch ms the window closes. For people and specs reading the payload:
+     * nothing here compares it to a clock, because the page that carries this
+     * config was rendered inside the window and its href has to match the
+     * server's byte for byte.
+     */
+    until: number;
+    /**
+     * The hosts a link may go to without the notice: the site's own subdomain
+     * and custom domain, and the platform's own. An entry starting with `.` is
+     * that domain AND every name under it.
+     */
+    hosts: readonly string[];
+    /**
+     * Destination (as {@link normalizeLeavingDestination} writes it) → its
+     * signature, for every outside address the server found on this page. A
+     * destination with none still goes through the notice, which refuses it.
+     */
+    sigs: Readonly<Record<string, string>>;
+}
+/**
+ * The absolute http(s) address an href navigates to when it names another
+ * host, or `null` for anything that stays on the page's own origin or is not
+ * a navigation at all.
+ *
+ * Resolved the way a browser resolves it rather than pattern-matched, because
+ * a pattern is exactly what a disguised link is built to get past: `//evil`
+ * and `/\evil` are both protocol-relative to a browser while reading as
+ * site paths to a `^/` test. `mailto:`, `tel:` and `sms:` hand off to another
+ * app and are not navigations, so they answer `null` with every other scheme.
+ *
+ * The answer is the URL's `href` — lowercased host, default port dropped,
+ * root path filled in — so the server that signs a destination and the
+ * client that looks the signature up agree on one spelling.
+ */
+export declare function normalizeLeavingDestination(raw: unknown): string | null;
+/**
+ * Whether a hostname is one a link may reach without the notice: listed in
+ * `hosts` (exactly, or under a `.domain` entry), or a development machine's
+ * own `localhost`, which sends a visitor nowhere.
+ */
+export declare function isLeavingNoticeExempt(hostname: string, hosts: readonly string[]): boolean;
+/**
+ * The normalized destination of an href that leaves for a host outside
+ * `hosts`, or `null` when the href stays, is not a navigation, or is exempt.
+ */
+export declare function leavingDestination(raw: unknown, hosts: readonly string[]): string | null;
+/** The notice's own address for a destination, signed when a signature is known. */
+export declare function leavingNoticeHref(destination: string, signature?: string | null): string;
+/**
+ * The href a link should carry instead of `raw` — the notice for its
+ * destination — or `undefined` to leave it as it is: no config (the site is
+ * not in its window), a destination on an exempt host, or not a navigation.
+ */
+export declare function routeThroughLeavingNotice(raw: unknown, config: LeavingNoticeConfig | null | undefined): string | undefined;
+/**
+ * Points the anchor an event landed in at the notice, when it leaves.
+ *
+ * The catch-all for every link `useLinkTarget` never saw — Markdown and rich
+ * text bodies, collection blocks, a plugin's own anchors. The href is
+ * rewritten IN PLACE, before the browser acts on the event, so the visitor's
+ * own gesture still decides how it opens: a modified click, a middle click
+ * and "Open in new tab" all take the notice with them. Next's `Link` leaves
+ * a non-local href to the browser, so the browser is what reads the change.
+ *
+ * Returns whether it rewrote anything.
+ */
+export declare function rerouteLeavingAnchor(target: EventTarget | null, config: LeavingNoticeConfig | null | undefined): boolean;
+/** Installs {@link rerouteLeavingAnchor} on a document; returns the uninstall. */
+export declare function installLeavingNoticeInterceptor(doc: Document, config: LeavingNoticeConfig): () => void;

package/src/lib/app-utils/leaving-notice.js

@@ -0,0 +1,157 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE "YOU'RE LEAVING THIS SITE" NOTICE, CLIENT HALF (AGL-3452).
+ *
+ * Both phishing pages found on free sites on 2026-10-01 had one button, and it
+ * went straight to an outside credential harvester: the site's address was
+ * only the trusted-looking hop. So for a FREE workspace in its first 14 days,
+ * a link to another domain goes through a notice on the site's own host
+ * first, which names the destination in plain text and says the platform
+ * does not operate it.
+ *
+ * The server decides whether a page is in that window and hands the page a
+ * {@link LeavingNoticeConfig}; this module only applies it. Nothing here
+ * reads the clock, so the server render and the hydrating client always
+ * produce the same href.
+ *
+ * A leaf with no imports: it is on every published page through
+ * `useLinkTarget`, and the hosts and signatures it needs arrive as data.
+ *=========================================*/ /** The first path segment the notice owns on every site (a reserved slug). */ export const LEAVING_NOTICE_ROUTE_SEGMENT = '_aglyn';
+/** Where the notice is served, on the site's own host. */ export const LEAVING_NOTICE_PATH = `/${LEAVING_NOTICE_ROUTE_SEGMENT}/leaving`;
+/** The query parameter carrying the destination. */ export const LEAVING_NOTICE_DESTINATION_PARAM = 'to';
+/** The query parameter carrying the destination's signature. */ export const LEAVING_NOTICE_SIGNATURE_PARAM = 'sig';
+/** The origin a site-relative href is resolved against to tell it apart. */ const SITE_RELATIVE_BASE = 'https://site-relative.invalid';
+const SITE_RELATIVE_HOSTNAME = 'site-relative.invalid';
+/**
+ * The absolute http(s) address an href navigates to when it names another
+ * host, or `null` for anything that stays on the page's own origin or is not
+ * a navigation at all.
+ *
+ * Resolved the way a browser resolves it rather than pattern-matched, because
+ * a pattern is exactly what a disguised link is built to get past: `//evil`
+ * and `/\evil` are both protocol-relative to a browser while reading as
+ * site paths to a `^/` test. `mailto:`, `tel:` and `sms:` hand off to another
+ * app and are not navigations, so they answer `null` with every other scheme.
+ *
+ * The answer is the URL's `href` — lowercased host, default port dropped,
+ * root path filled in — so the server that signs a destination and the
+ * client that looks the signature up agree on one spelling.
+ */ export function normalizeLeavingDestination(raw) {
+    if (typeof raw !== 'string') return null;
+    const trimmed = raw.trim();
+    if (!trimmed) return null;
+    let url;
+    try {
+        url = new URL(trimmed, SITE_RELATIVE_BASE);
+    } catch (unused) {
+        return null;
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+    if (!url.hostname || url.hostname === SITE_RELATIVE_HOSTNAME) return null;
+    return url.href;
+}
+/**
+ * Whether a hostname is one a link may reach without the notice: listed in
+ * `hosts` (exactly, or under a `.domain` entry), or a development machine's
+ * own `localhost`, which sends a visitor nowhere.
+ */ export function isLeavingNoticeExempt(hostname, hosts) {
+    const name = String(hostname != null ? hostname : '').toLowerCase().replace(/\.+$/, '');
+    if (!name) return true;
+    if (name === 'localhost' || name.endsWith('.localhost')) return true;
+    for (const entry of hosts){
+        if (entry.startsWith('.')) {
+            if (name === entry.slice(1) || name.endsWith(entry)) return true;
+        } else if (name === entry) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * The normalized destination of an href that leaves for a host outside
+ * `hosts`, or `null` when the href stays, is not a navigation, or is exempt.
+ */ export function leavingDestination(raw, hosts) {
+    const destination = normalizeLeavingDestination(raw);
+    if (!destination) return null;
+    return isLeavingNoticeExempt(new URL(destination).hostname, hosts) ? null : destination;
+}
+/** The notice's own address for a destination, signed when a signature is known. */ export function leavingNoticeHref(destination, signature) {
+    const params = new URLSearchParams();
+    params.set(LEAVING_NOTICE_DESTINATION_PARAM, destination);
+    if (signature) params.set(LEAVING_NOTICE_SIGNATURE_PARAM, signature);
+    return `${LEAVING_NOTICE_PATH}?${params.toString()}`;
+}
+/**
+ * The href a link should carry instead of `raw` — the notice for its
+ * destination — or `undefined` to leave it as it is: no config (the site is
+ * not in its window), a destination on an exempt host, or not a navigation.
+ */ export function routeThroughLeavingNotice(raw, config) {
+    var _config_sigs;
+    if (!config) return undefined;
+    const destination = leavingDestination(raw, config.hosts);
+    if (!destination) return undefined;
+    return leavingNoticeHref(destination, (_config_sigs = config.sigs) == null ? void 0 : _config_sigs[destination]);
+}
+/**
+ * Points the anchor an event landed in at the notice, when it leaves.
+ *
+ * The catch-all for every link `useLinkTarget` never saw — Markdown and rich
+ * text bodies, collection blocks, a plugin's own anchors. The href is
+ * rewritten IN PLACE, before the browser acts on the event, so the visitor's
+ * own gesture still decides how it opens: a modified click, a middle click
+ * and "Open in new tab" all take the notice with them. Next's `Link` leaves
+ * a non-local href to the browser, so the browser is what reads the change.
+ *
+ * Returns whether it rewrote anything.
+ */ export function rerouteLeavingAnchor(target, config) {
+    var _node_parentElement;
+    var _element_closest;
+    if (!config || !target) return false;
+    const node = target;
+    const element = node.nodeType === 1 ? node : (_node_parentElement = node.parentElement) != null ? _node_parentElement : null;
+    const anchor = element == null ? void 0 : (_element_closest = element.closest) == null ? void 0 : _element_closest.call(element, 'a[href], area[href]');
+    if (!anchor) return false;
+    const rerouted = routeThroughLeavingNotice(anchor.getAttribute('href'), config);
+    if (!rerouted) return false;
+    anchor.setAttribute('href', rerouted);
+    return true;
+}
+/**
+ * Every gesture that can follow, open or copy a link, caught on the way
+ * down so the href is the notice's before anything reads it.
+ */ const LEAVING_NOTICE_EVENTS = [
+    'pointerdown',
+    'click',
+    'auxclick',
+    'contextmenu',
+    'focusin'
+];
+/** Installs {@link rerouteLeavingAnchor} on a document; returns the uninstall. */ export function installLeavingNoticeInterceptor(doc, config) {
+    const handler = (event)=>{
+        rerouteLeavingAnchor(event.target, config);
+    };
+    for (const type of LEAVING_NOTICE_EVENTS){
+        doc.addEventListener(type, handler, true);
+    }
+    return ()=>{
+        for (const type of LEAVING_NOTICE_EVENTS){
+            doc.removeEventListener(type, handler, true);
+        }
+    };
+}
+
+//# sourceMappingURL=leaving-notice.js.map

package/src/lib/app-utils/leaving-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/leaving-notice.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE \"YOU'RE LEAVING THIS SITE\" NOTICE, CLIENT HALF (AGL-3452).\n *\n * Both phishing pages found on free sites on 2026-10-01 had one button, and it\n * went straight to an outside credential harvester: the site's address was\n * only the trusted-looking hop. So for a FREE workspace in its first 14 days,\n * a link to another domain goes through a notice on the site's own host\n * first, which names the destination in plain text and says the platform\n * does not operate it.\n *\n * The server decides whether a page is in that window and hands the page a\n * {@link LeavingNoticeConfig}; this module only applies it. Nothing here\n * reads the clock, so the server render and the hydrating client always\n * produce the same href.\n *\n * A leaf with no imports: it is on every published page through\n * `useLinkTarget`, and the hosts and signatures it needs arrive as data.\n *=========================================*/\n\n/** The first path segment the notice owns on every site (a reserved slug). */\nexport const LEAVING_NOTICE_ROUTE_SEGMENT = '_aglyn'\n\n/** Where the notice is served, on the site's own host. */\nexport const LEAVING_NOTICE_PATH = `/${LEAVING_NOTICE_ROUTE_SEGMENT}/leaving`\n\n/** The query parameter carrying the destination. */\nexport const LEAVING_NOTICE_DESTINATION_PARAM = 'to'\n\n/** The query parameter carrying the destination's signature. */\nexport const LEAVING_NOTICE_SIGNATURE_PARAM = 'sig'\n\n/** What a page in its notice window carries, from the server. */\nexport interface LeavingNoticeConfig {\n  /**\n   * Epoch ms the window closes. For people and specs reading the payload:\n   * nothing here compares it to a clock, because the page that carries this\n   * config was rendered inside the window and its href has to match the\n   * server's byte for byte.\n   */\n  until: number\n  /**\n   * The hosts a link may go to without the notice: the site's own subdomain\n   * and custom domain, and the platform's own. An entry starting with `.` is\n   * that domain AND every name under it.\n   */\n  hosts: readonly string[]\n  /**\n   * Destination (as {@link normalizeLeavingDestination} writes it) → its\n   * signature, for every outside address the server found on this page. A\n   * destination with none still goes through the notice, which refuses it.\n   */\n  sigs: Readonly<Record<string, string>>\n}\n\n/** The origin a site-relative href is resolved against to tell it apart. */\nconst SITE_RELATIVE_BASE = 'https://site-relative.invalid'\nconst SITE_RELATIVE_HOSTNAME = 'site-relative.invalid'\n\n/**\n * The absolute http(s) address an href navigates to when it names another\n * host, or `null` for anything that stays on the page's own origin or is not\n * a navigation at all.\n *\n * Resolved the way a browser resolves it rather than pattern-matched, because\n * a pattern is exactly what a disguised link is built to get past: `//evil`\n * and `/\\evil` are both protocol-relative to a browser while reading as\n * site paths to a `^/` test. `mailto:`, `tel:` and `sms:` hand off to another\n * app and are not navigations, so they answer `null` with every other scheme.\n *\n * The answer is the URL's `href` — lowercased host, default port dropped,\n * root path filled in — so the server that signs a destination and the\n * client that looks the signature up agree on one spelling.\n */\nexport function normalizeLeavingDestination(raw: unknown): string | null {\n  if (typeof raw !== 'string') return null\n  const trimmed = raw.trim()\n  if (!trimmed) return null\n  let url: URL\n  try {\n    url = new URL(trimmed, SITE_RELATIVE_BASE)\n  } catch {\n    return null\n  }\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') return null\n  if (!url.hostname || url.hostname === SITE_RELATIVE_HOSTNAME) return null\n  return url.href\n}\n\n/**\n * Whether a hostname is one a link may reach without the notice: listed in\n * `hosts` (exactly, or under a `.domain` entry), or a development machine's\n * own `localhost`, which sends a visitor nowhere.\n */\nexport function isLeavingNoticeExempt(\n  hostname: string,\n  hosts: readonly string[],\n): boolean {\n  const name = String(hostname ?? '')\n    .toLowerCase()\n    .replace(/\\.+$/, '')\n  if (!name) return true\n  if (name === 'localhost' || name.endsWith('.localhost')) return true\n  for (const entry of hosts) {\n    if (entry.startsWith('.')) {\n      if (name === entry.slice(1) || name.endsWith(entry)) return true\n    } else if (name === entry) {\n      return true\n    }\n  }\n  return false\n}\n\n/**\n * The normalized destination of an href that leaves for a host outside\n * `hosts`, or `null` when the href stays, is not a navigation, or is exempt.\n */\nexport function leavingDestination(\n  raw: unknown,\n  hosts: readonly string[],\n): string | null {\n  const destination = normalizeLeavingDestination(raw)\n  if (!destination) return null\n  return isLeavingNoticeExempt(new URL(destination).hostname, hosts)\n    ? null\n    : destination\n}\n\n/** The notice's own address for a destination, signed when a signature is known. */\nexport function leavingNoticeHref(\n  destination: string,\n  signature?: string | null,\n): string {\n  const params = new URLSearchParams()\n  params.set(LEAVING_NOTICE_DESTINATION_PARAM, destination)\n  if (signature) params.set(LEAVING_NOTICE_SIGNATURE_PARAM, signature)\n  return `${LEAVING_NOTICE_PATH}?${params.toString()}`\n}\n\n/**\n * The href a link should carry instead of `raw` — the notice for its\n * destination — or `undefined` to leave it as it is: no config (the site is\n * not in its window), a destination on an exempt host, or not a navigation.\n */\nexport function routeThroughLeavingNotice(\n  raw: unknown,\n  config: LeavingNoticeConfig | null | undefined,\n): string | undefined {\n  if (!config) return undefined\n  const destination = leavingDestination(raw, config.hosts)\n  if (!destination) return undefined\n  return leavingNoticeHref(destination, config.sigs?.[destination])\n}\n\n/**\n * Points the anchor an event landed in at the notice, when it leaves.\n *\n * The catch-all for every link `useLinkTarget` never saw — Markdown and rich\n * text bodies, collection blocks, a plugin's own anchors. The href is\n * rewritten IN PLACE, before the browser acts on the event, so the visitor's\n * own gesture still decides how it opens: a modified click, a middle click\n * and \"Open in new tab\" all take the notice with them. Next's `Link` leaves\n * a non-local href to the browser, so the browser is what reads the change.\n *\n * Returns whether it rewrote anything.\n */\nexport function rerouteLeavingAnchor(\n  target: EventTarget | null,\n  config: LeavingNoticeConfig | null | undefined,\n): boolean {\n  if (!config || !target) return false\n  const node = target as Node\n  const element =\n    node.nodeType === 1 ? (node as Element) : (node.parentElement ?? null)\n  const anchor = element?.closest?.('a[href], area[href]')\n  if (!anchor) return false\n  const rerouted = routeThroughLeavingNotice(anchor.getAttribute('href'), config)\n  if (!rerouted) return false\n  anchor.setAttribute('href', rerouted)\n  return true\n}\n\n/**\n * Every gesture that can follow, open or copy a link, caught on the way\n * down so the href is the notice's before anything reads it.\n */\nconst LEAVING_NOTICE_EVENTS = [\n  'pointerdown',\n  'click',\n  'auxclick',\n  'contextmenu',\n  'focusin',\n] as const\n\n/** Installs {@link rerouteLeavingAnchor} on a document; returns the uninstall. */\nexport function installLeavingNoticeInterceptor(\n  doc: Document,\n  config: LeavingNoticeConfig,\n): () => void {\n  const handler = (event: Event) => {\n    rerouteLeavingAnchor(event.target, config)\n  }\n  for (const type of LEAVING_NOTICE_EVENTS) {\n    doc.addEventListener(type, handler, true)\n  }\n  return () => {\n    for (const type of LEAVING_NOTICE_EVENTS) {\n      doc.removeEventListener(type, handler, true)\n    }\n  }\n}\n"],"names":["LEAVING_NOTICE_ROUTE_SEGMENT","LEAVING_NOTICE_PATH","LEAVING_NOTICE_DESTINATION_PARAM","LEAVING_NOTICE_SIGNATURE_PARAM","SITE_RELATIVE_BASE","SITE_RELATIVE_HOSTNAME","normalizeLeavingDestination","raw","trimmed","trim","url","URL","protocol","hostname","href","isLeavingNoticeExempt","hosts","name","String","toLowerCase","replace","endsWith","entry","startsWith","slice","leavingDestination","destination","leavingNoticeHref","signature","params","URLSearchParams","set","toString","routeThroughLeavingNotice","config","undefined","sigs","rerouteLeavingAnchor","target","node","element","nodeType","parentElement","anchor","closest","rerouted","getAttribute","setAttribute","LEAVING_NOTICE_EVENTS","installLeavingNoticeInterceptor","doc","handler","event","type","addEventListener","removeEventListener"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;2CAiB2C,GAE3C,4EAA4E,GAC5E,OAAO,MAAMA,+BAA+B,SAAQ;AAEpD,wDAAwD,GACxD,OAAO,MAAMC,sBAAsB,CAAC,CAAC,EAAED,6BAA6B,QAAQ,CAAC,CAAA;AAE7E,kDAAkD,GAClD,OAAO,MAAME,mCAAmC,KAAI;AAEpD,8DAA8D,GAC9D,OAAO,MAAMC,iCAAiC,MAAK;AAyBnD,0EAA0E,GAC1E,MAAMC,qBAAqB;AAC3B,MAAMC,yBAAyB;AAE/B;;;;;;;;;;;;;;CAcC,GACD,OAAO,SAASC,4BAA4BC,GAAY;IACtD,IAAI,OAAOA,QAAQ,UAAU,OAAO;IACpC,MAAMC,UAAUD,IAAIE,IAAI;IACxB,IAAI,CAACD,SAAS,OAAO;IACrB,IAAIE;IACJ,IAAI;QACFA,MAAM,IAAIC,IAAIH,SAASJ;IACzB,EAAE,eAAM;QACN,OAAO;IACT;IACA,IAAIM,IAAIE,QAAQ,KAAK,WAAWF,IAAIE,QAAQ,KAAK,UAAU,OAAO;IAClE,IAAI,CAACF,IAAIG,QAAQ,IAAIH,IAAIG,QAAQ,KAAKR,wBAAwB,OAAO;IACrE,OAAOK,IAAII,IAAI;AACjB;AAEA;;;;CAIC,GACD,OAAO,SAASC,sBACdF,QAAgB,EAChBG,KAAwB;IAExB,MAAMC,OAAOC,OAAOL,mBAAAA,WAAY,IAC7BM,WAAW,GACXC,OAAO,CAAC,QAAQ;IACnB,IAAI,CAACH,MAAM,OAAO;IAClB,IAAIA,SAAS,eAAeA,KAAKI,QAAQ,CAAC,eAAe,OAAO;IAChE,KAAK,MAAMC,SAASN,MAAO;QACzB,IAAIM,MAAMC,UAAU,CAAC,MAAM;YACzB,IAAIN,SAASK,MAAME,KAAK,CAAC,MAAMP,KAAKI,QAAQ,CAACC,QAAQ,OAAO;QAC9D,OAAO,IAAIL,SAASK,OAAO;YACzB,OAAO;QACT;IACF;IACA,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,SAASG,mBACdlB,GAAY,EACZS,KAAwB;IAExB,MAAMU,cAAcpB,4BAA4BC;IAChD,IAAI,CAACmB,aAAa,OAAO;IACzB,OAAOX,sBAAsB,IAAIJ,IAAIe,aAAab,QAAQ,EAAEG,SACxD,OACAU;AACN;AAEA,kFAAkF,GAClF,OAAO,SAASC,kBACdD,WAAmB,EACnBE,SAAyB;IAEzB,MAAMC,SAAS,IAAIC;IACnBD,OAAOE,GAAG,CAAC7B,kCAAkCwB;IAC7C,IAAIE,WAAWC,OAAOE,GAAG,CAAC5B,gCAAgCyB;IAC1D,OAAO,GAAG3B,oBAAoB,CAAC,EAAE4B,OAAOG,QAAQ,IAAI;AACtD;AAEA;;;;CAIC,GACD,OAAO,SAASC,0BACd1B,GAAY,EACZ2B,MAA8C;QAKRA;IAHtC,IAAI,CAACA,QAAQ,OAAOC;IACpB,MAAMT,cAAcD,mBAAmBlB,KAAK2B,OAAOlB,KAAK;IACxD,IAAI,CAACU,aAAa,OAAOS;IACzB,OAAOR,kBAAkBD,cAAaQ,eAAAA,OAAOE,IAAI,qBAAXF,YAAa,CAACR,YAAY;AAClE;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASW,qBACdC,MAA0B,EAC1BJ,MAA8C;QAKDK;QAC9BC;IAJf,IAAI,CAACN,UAAU,CAACI,QAAQ,OAAO;IAC/B,MAAMC,OAAOD;IACb,MAAME,UACJD,KAAKE,QAAQ,KAAK,IAAKF,QAAoBA,sBAAAA,KAAKG,aAAa,YAAlBH,sBAAsB;IACnE,MAAMI,SAASH,4BAAAA,mBAAAA,QAASI,OAAO,qBAAhBJ,sBAAAA,SAAmB;IAClC,IAAI,CAACG,QAAQ,OAAO;IACpB,MAAME,WAAWZ,0BAA0BU,OAAOG,YAAY,CAAC,SAASZ;IACxE,IAAI,CAACW,UAAU,OAAO;IACtBF,OAAOI,YAAY,CAAC,QAAQF;IAC5B,OAAO;AACT;AAEA;;;CAGC,GACD,MAAMG,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;CACD;AAED,gFAAgF,GAChF,OAAO,SAASC,gCACdC,GAAa,EACbhB,MAA2B;IAE3B,MAAMiB,UAAU,CAACC;QACff,qBAAqBe,MAAMd,MAAM,EAAEJ;IACrC;IACA,KAAK,MAAMmB,QAAQL,sBAAuB;QACxCE,IAAII,gBAAgB,CAACD,MAAMF,SAAS;IACtC;IACA,OAAO;QACL,KAAK,MAAME,QAAQL,sBAAuB;YACxCE,IAAIK,mBAAmB,CAACF,MAAMF,SAAS;QACzC;IACF;AACF"}

package/src/lib/app-utils/lockdown.d.ts

@@ -53,6 +53,17 @@ export declare function lockdownFeatureDeclaration(key: unknown): PluginLockdown
 export declare function isLockdownFeatureKey(value: unknown): value is LockdownFeatureKey;
 /** Staff-surface label; the key stays the wire/API identity. */
 export declare function lockdownFeatureLabel(key: LockdownFeatureKey): string;
+/**
+ * What a customer's mail calls a lever (`media uploads`), never the staff
+ * label. A key nothing declares, or a declaration without a name, reads as
+ * "a feature" rather than leak a key or a staff label.
+ */
+export declare function lockdownFeatureCustomerName(key: LockdownFeatureKey): string;
+/**
+ * Several levers named together in a customer's mail: `AI assist and AI
+ * generation`. One pause of several levers is one notice.
+ */
+export declare function lockdownFeaturesCustomerText(keys: readonly LockdownFeatureKey[]): string;
 /**
  * Whether a verified staff claim passes this feature's lock. A key nothing
  * declared answers `false`: an undeclared lever has no bypass argument on

package/src/lib/app-utils/lockdown.js

@@ -89,6 +89,7 @@ import { listPluginLockdownFeatures } from "../plugin-manager/plugin-entitlement
     {
         key: 'signups',
         label: 'New signups',
+        customerName: 'new signups',
         staffBypass: false,
         notice: {
             title: 'New signups are paused',
@@ -98,6 +99,7 @@ import { listPluginLockdownFeatures } from "../plugin-manager/plugin-entitlement
     {
         key: 'uploads',
         label: 'Media uploads',
+        customerName: 'media uploads',
         staffBypass: true,
         notice: {
             title: 'Uploads are paused',
@@ -107,6 +109,9 @@ import { listPluginLockdownFeatures } from "../plugin-manager/plugin-entitlement
     {
         key: 'checkout',
         label: 'Checkout (new subscriptions)',
+        // Both doors it closes start a purchase: a plan or add-on, and a paid
+        // marketplace install.
+        customerName: 'new purchases',
         staffBypass: false,
         notice: {
             title: 'Checkout is temporarily unavailable',
@@ -124,6 +129,7 @@ import { listPluginLockdownFeatures } from "../plugin-manager/plugin-entitlement
     {
         key: 'marketplace-installs',
         label: 'Marketplace installs',
+        customerName: 'marketplace installs',
         staffBypass: true,
         notice: {
             title: 'Marketplace installs are paused',
@@ -172,6 +178,26 @@ export function isLockdownFeatureKey(value) {
     var _lockdownFeatureDeclaration;
     return (_ref = (_lockdownFeatureDeclaration = lockdownFeatureDeclaration(key)) == null ? void 0 : _lockdownFeatureDeclaration.label) != null ? _ref : key;
 }
+/**
+ * What a customer's mail calls a lever (`media uploads`), never the staff
+ * label. A key nothing declares, or a declaration without a name, reads as
+ * "a feature" rather than leak a key or a staff label.
+ */ export function lockdownFeatureCustomerName(key) {
+    var _lockdownFeatureDeclaration_customerName, _lockdownFeatureDeclaration;
+    return ((_lockdownFeatureDeclaration = lockdownFeatureDeclaration(key)) == null ? void 0 : (_lockdownFeatureDeclaration_customerName = _lockdownFeatureDeclaration.customerName) == null ? void 0 : _lockdownFeatureDeclaration_customerName.trim()) || 'a feature';
+}
+/**
+ * Several levers named together in a customer's mail: `AI assist and AI
+ * generation`. One pause of several levers is one notice.
+ */ export function lockdownFeaturesCustomerText(keys) {
+    const names = [
+        ...new Set(keys.map(lockdownFeatureCustomerName))
+    ];
+    return new Intl.ListFormat('en-US', {
+        style: 'long',
+        type: 'conjunction'
+    }).format(names);
+}
 /**
  * Whether a verified staff claim passes this feature's lock. A key nothing
  * declared answers `false`: an undeclared lever has no bypass argument on
@@ -634,6 +660,10 @@ export const userLockdownDocId = (uid)=>`user--${uid}`;
     if (state.scope === 'domain') {
         return domainLockdownNotice(state, custom);
     }
+    // A SITE lock closes one site, not the account that owns it: its default
+    // copy says "this site", or the owners' notice tells them their account was
+    // closed when their other sites are serving (AGL-3432).
+    const subject = state.scope === 'host' ? 'site' : 'account';
     switch(state.reason){
         case 'maintenance':
             {
@@ -647,7 +677,7 @@ export const userLockdownDocId = (uid)=>`user--${uid}`;
             var _lockdownSupportEmail;
             return {
                 title: 'Account on hold',
-                body: custom != null ? custom : 'This account is on hold over an unresolved billing issue. ' + 'Updating the payment method in workspace billing settings ' + 'restores access.',
+                body: custom != null ? custom : `This ${subject} is on hold over an unresolved billing issue. ` + 'Updating the payment method in workspace billing settings ' + 'restores access.',
                 contact: (_lockdownSupportEmail = lockdownSupportEmail()) != null ? _lockdownSupportEmail : undefined
             };
         case 'security':
@@ -663,7 +693,7 @@ export const userLockdownDocId = (uid)=>`user--${uid}`;
             var _lockdownSupportEmail2;
             return _extends({
                 title: 'Unavailable',
-                body: custom != null ? custom : 'This account has been closed for a violation of our Terms of ' + 'Service.',
+                body: custom != null ? custom : `This ${subject} has been closed for a violation of our Terms of ` + 'Service.',
                 contact: (_lockdownSupportEmail2 = lockdownSupportEmail()) != null ? _lockdownSupportEmail2 : undefined
             }, state.scope !== 'platform' ? {
                 appeal: true
@@ -673,7 +703,7 @@ export const userLockdownDocId = (uid)=>`user--${uid}`;
             var _lockdownSupportEmail3;
             return {
                 title: 'Temporarily unavailable',
-                body: custom != null ? custom : 'Access to this account is currently disabled.',
+                body: custom != null ? custom : `Access to this ${subject} is currently disabled.`,
                 contact: (_lockdownSupportEmail3 = lockdownSupportEmail()) != null ? _lockdownSupportEmail3 : undefined
             };
     }