@aglyn/aglyn 1.0.0-beta.254 → 1.0.0-beta.256

package/src/lib/app-utils/native-app-association.d.ts

@@ -0,0 +1,139 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Where Apple's verifier reads the association file: no `.json` suffix. */
+export declare const APPLE_APP_SITE_ASSOCIATION_PATH = "/.well-known/apple-app-site-association";
+/** Where Google's verifier reads the statement list. */
+export declare const ASSET_LINKS_PATH = "/.well-known/assetlinks.json";
+/**
+ * The route handlers each middleware rewrites the two public paths to. They
+ * live under `/api` because both apps keep their route handlers there, and
+ * neither middleware runs again on `/api`.
+ */
+export declare const NATIVE_APP_ASSOCIATION_ROUTES: Readonly<Record<string, string>>;
+/** The route handler a public association path is served by, or null. */
+export declare function nativeAppAssociationRoute(pathname: string): string | null;
+/**
+ * The console's top-level sections the native apps have no screen for, so a
+ * link to one stays in the browser: the sign-in page and SSO (the system
+ * auth session opens them for the app, and a universal link there would loop
+ * back into the app), the native hand-off and other `/auth` pages, the
+ * sign-out page, the site admin bar's connect page and a plugin's public
+ * device pages. The sections the apps finish natively are
+ * {@link NATIVE_AUTH_LINK_SEGMENTS}.
+ *
+ * The rest of the console's top-level sections (`admin`, `billing`,
+ * `manage`, `support`) and every workspace path are what the native
+ * deep-link grammar resolves (`DeepLinks.swift`, `DeepLinks.kt`): a
+ * registered screen, the Besigner in the app's own web view, or the nearest
+ * native screen. `apps/console/specs/native-app-association.spec.ts` holds
+ * this list to the console's route set and the native link specs.
+ */
+export declare const NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS: readonly string[];
+/**
+ * The pre-sign-in sections whose exact page the apps finish natively: sign-up
+ * (with its `?plan=`), an emailed verification link, an emailed password
+ * reset and account recovery (`AuthFlow.swift`; Android's console intent
+ * filter lists the same four paths). Only the page itself opens the app;
+ * anything under it stays in the browser, where the console handles it.
+ */
+export declare const NATIVE_AUTH_LINK_SEGMENTS: readonly string[];
+/** One `applinks` component: a URL path pattern, optionally excluded. */
+export interface AppLinksComponent {
+    '/': string;
+    exclude?: true;
+    comment?: string;
+}
+/**
+ * The console paths the apps open, as `applinks` components. Apple reads
+ * them in order and the first match wins, so every exclusion comes ahead of
+ * the closing catch-all.
+ */
+export declare function consoleAppLinksComponents(): AppLinksComponent[];
+/** The Apple app ids in `NATIVE_APPLE_APP_IDS`, in order; invalid ones dropped. */
+export declare function parseAppleAppIds(raw: string | undefined): string[];
+/** One Android app and the signing certificates it may be verified by. */
+export interface AndroidAppAssociation {
+    packageName: string;
+    sha256Fingerprints: string[];
+}
+/**
+ * The Android apps in `NATIVE_ANDROID_APPS`. An entry without a valid package
+ * or without one valid fingerprint is dropped whole: a statement with no
+ * certificate verifies nothing.
+ */
+export declare function parseAndroidApps(raw: string | undefined): AndroidAppAssociation[];
+/** The `apple-app-site-association` document Apple's CDN reads. */
+export interface AppleAppSiteAssociation {
+    applinks?: {
+        apps: [];
+        details: Array<{
+            appIDs: string[];
+            components: AppLinksComponent[];
+        }>;
+    };
+    webcredentials: {
+        apps: string[];
+    };
+}
+/**
+ * The association file for these app ids. `applinks` is only for a host
+ * whose paths the native deep-link grammar resolves: the console. A host
+ * that serves the passkey relying party alone gets `webcredentials` only.
+ *
+ * One `details` entry per app, in the configured order, because when two
+ * installed apps claim the same path the system takes the first.
+ */
+export declare function appleAppSiteAssociation(appIds: string[], options: {
+    applinks: boolean;
+}): AppleAppSiteAssociation;
+/** One Digital Asset Links statement. */
+export interface AssetLinkStatement {
+    relation: string[];
+    target: {
+        namespace: 'android_app';
+        package_name: string;
+        sha256_cert_fingerprints: string[];
+    };
+}
+/** Passkeys and app links, for every configured app. */
+export declare const ASSET_LINK_RELATIONS: readonly ["delegate_permission/common.handle_all_urls", "delegate_permission/common.get_login_creds"];
+/** The `assetlinks.json` statement list Google's verifier reads. */
+export declare function assetLinks(apps: AndroidAppAssociation[]): AssetLinkStatement[];
+/** The request's hostname: lowercase, no port. */
+export declare function requestHostname(host: string | null | undefined): string;
+/** A URL's hostname, or null when it is not one. */
+export declare function hostnameOfUrl(url: string | null | undefined): string | null;
+/** What a route handler needs to answer one of the two documents. */
+export interface NativeAppAssociationRequest {
+    /** The request's `Host` header. */
+    host: string | null;
+    /**
+     * The hostnames this deployment vouches for. Every other host an app
+     * serves (a customer's custom domain, a workspace subdomain, a white-label
+     * console) answers 404, because the apps are this deployment's and not
+     * theirs.
+     */
+    servedHosts: ReadonlyArray<string | null | undefined>;
+    /** Whether this host's paths are console links the apps resolve. */
+    applinks: boolean;
+    /** The environment; `process.env` in the routes, a fixture in specs. */
+    env: Readonly<Record<string, string | undefined>>;
+}
+/** `GET /.well-known/apple-app-site-association`. */
+export declare function appleAppSiteAssociationResponse(request: NativeAppAssociationRequest): Response;
+/** `GET /.well-known/assetlinks.json`. */
+export declare function assetLinksResponse(request: NativeAppAssociationRequest): Response;

package/src/lib/app-utils/native-app-association.js

@@ -0,0 +1,264 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE DOCUMENTS THAT TIE THE NATIVE APPS TO A DOMAIN (AGL-3817).
+ *
+ * Apple's `apple-app-site-association` and Google's `assetlinks.json` are how
+ * a domain says which apps may use its passkeys (`webcredentials`,
+ * `get_login_creds`) and open its links (`applinks`, `handle_all_urls`). Both
+ * are fetched by the platform's verifier, not by a person, so each has to be
+ * exactly `application/json`, a 200, no redirect and no cookie.
+ *
+ * Everything that names an app comes from the environment, never from here:
+ *
+ *  - `NATIVE_APPLE_APP_IDS`: comma-separated `<team id>.<bundle id>` values,
+ *    in the order the system should prefer them;
+ *  - `NATIVE_ANDROID_APPS`: `;`-separated `<package>=<sha256>,<sha256>`
+ *    entries, each fingerprint the colon-separated hex Play Console prints.
+ *
+ * Unset (or nothing valid in it), the document answers 404: a deployment
+ * with no apps of its own vouches for none.
+ *
+ * A leaf with no imports, because both middlewares read the paths below.
+ *=========================================*/ /** Where Apple's verifier reads the association file: no `.json` suffix. */ export const APPLE_APP_SITE_ASSOCIATION_PATH = '/.well-known/apple-app-site-association';
+/** Where Google's verifier reads the statement list. */ export const ASSET_LINKS_PATH = '/.well-known/assetlinks.json';
+/**
+ * The route handlers each middleware rewrites the two public paths to. They
+ * live under `/api` because both apps keep their route handlers there, and
+ * neither middleware runs again on `/api`.
+ */ export const NATIVE_APP_ASSOCIATION_ROUTES = {
+    [APPLE_APP_SITE_ASSOCIATION_PATH]: '/api/native-app-association/apple-app-site-association',
+    [ASSET_LINKS_PATH]: '/api/native-app-association/assetlinks'
+};
+/** The route handler a public association path is served by, or null. */ export function nativeAppAssociationRoute(pathname) {
+    return Object.prototype.hasOwnProperty.call(NATIVE_APP_ASSOCIATION_ROUTES, pathname) ? NATIVE_APP_ASSOCIATION_ROUTES[pathname] : null;
+}
+/**
+ * The console's top-level sections the native apps have no screen for, so a
+ * link to one stays in the browser: the sign-in page and SSO (the system
+ * auth session opens them for the app, and a universal link there would loop
+ * back into the app), the native hand-off and other `/auth` pages, the
+ * sign-out page, the site admin bar's connect page and a plugin's public
+ * device pages. The sections the apps finish natively are
+ * {@link NATIVE_AUTH_LINK_SEGMENTS}.
+ *
+ * The rest of the console's top-level sections (`admin`, `billing`,
+ * `manage`, `support`) and every workspace path are what the native
+ * deep-link grammar resolves (`DeepLinks.swift`, `DeepLinks.kt`): a
+ * registered screen, the Besigner in the app's own web view, or the nearest
+ * native screen. `apps/console/specs/native-app-association.spec.ts` holds
+ * this list to the console's route set and the native link specs.
+ */ export const NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS = [
+    'auth',
+    'edit-access',
+    'kiosk',
+    'signin',
+    'signout',
+    'sso'
+];
+/**
+ * The pre-sign-in sections whose exact page the apps finish natively: sign-up
+ * (with its `?plan=`), an emailed verification link, an emailed password
+ * reset and account recovery (`AuthFlow.swift`; Android's console intent
+ * filter lists the same four paths). Only the page itself opens the app;
+ * anything under it stays in the browser, where the console handles it.
+ */ export const NATIVE_AUTH_LINK_SEGMENTS = [
+    'account-recovery',
+    'reset-password',
+    'signup',
+    'verify-email'
+];
+/**
+ * The console paths the apps open, as `applinks` components. Apple reads
+ * them in order and the first match wins, so every exclusion comes ahead of
+ * the closing catch-all.
+ */ export function consoleAppLinksComponents() {
+    const excluded = [
+        {
+            '/': '/_*',
+            exclude: true,
+            comment: 'framework and internal paths'
+        },
+        {
+            '/': '/api',
+            exclude: true
+        },
+        {
+            '/': '/api/*',
+            exclude: true,
+            comment: 'route handlers'
+        },
+        {
+            '/': '/.well-known/*',
+            exclude: true
+        }
+    ];
+    for (const segment of NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS){
+        excluded.push({
+            '/': `/${segment}`,
+            exclude: true
+        }, {
+            '/': `/${segment}/*`,
+            exclude: true
+        });
+    }
+    for (const segment of NATIVE_AUTH_LINK_SEGMENTS){
+        excluded.push({
+            '/': `/${segment}/*`,
+            exclude: true
+        });
+    }
+    return [
+        ...excluded,
+        {
+            '/': '/*',
+            comment: 'workspace, site, account, billing, support and staff pages'
+        }
+    ];
+}
+/** `TEAMID1234.com.example.app`: a 10-character team id, then a bundle id. */ const APPLE_APP_ID = /^[A-Z0-9]{10}\.[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/;
+/** A Java package name: dot-separated identifiers, at least two. */ const ANDROID_PACKAGE = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
+/** A SHA-256 certificate fingerprint as 32 colon-separated hex pairs. */ const SHA256_FINGERPRINT = /^([0-9A-F]{2}:){31}[0-9A-F]{2}$/;
+/** The Apple app ids in `NATIVE_APPLE_APP_IDS`, in order; invalid ones dropped. */ export function parseAppleAppIds(raw) {
+    const ids = (raw != null ? raw : '').split(',').map((value)=>value.trim()).filter((value)=>APPLE_APP_ID.test(value));
+    return [
+        ...new Set(ids)
+    ];
+}
+/**
+ * The Android apps in `NATIVE_ANDROID_APPS`. An entry without a valid package
+ * or without one valid fingerprint is dropped whole: a statement with no
+ * certificate verifies nothing.
+ */ export function parseAndroidApps(raw) {
+    const apps = [];
+    for (const entry of (raw != null ? raw : '').split(';')){
+        const at = entry.indexOf('=');
+        if (at < 0) continue;
+        const packageName = entry.slice(0, at).trim();
+        if (!ANDROID_PACKAGE.test(packageName)) continue;
+        if (apps.some((app)=>app.packageName === packageName)) continue;
+        const fingerprints = entry.slice(at + 1).split(',').map((value)=>value.trim().toUpperCase()).filter((value)=>SHA256_FINGERPRINT.test(value));
+        if (fingerprints.length === 0) continue;
+        apps.push({
+            packageName,
+            sha256Fingerprints: [
+                ...new Set(fingerprints)
+            ]
+        });
+    }
+    return apps;
+}
+/**
+ * The association file for these app ids. `applinks` is only for a host
+ * whose paths the native deep-link grammar resolves: the console. A host
+ * that serves the passkey relying party alone gets `webcredentials` only.
+ *
+ * One `details` entry per app, in the configured order, because when two
+ * installed apps claim the same path the system takes the first.
+ */ export function appleAppSiteAssociation(appIds, options) {
+    const document = {
+        webcredentials: {
+            apps: [
+                ...appIds
+            ]
+        }
+    };
+    if (options.applinks) {
+        const components = consoleAppLinksComponents();
+        document.applinks = {
+            apps: [],
+            details: appIds.map((appId)=>({
+                    appIDs: [
+                        appId
+                    ],
+                    components
+                }))
+        };
+    }
+    return document;
+}
+/** Passkeys and app links, for every configured app. */ export const ASSET_LINK_RELATIONS = [
+    'delegate_permission/common.handle_all_urls',
+    'delegate_permission/common.get_login_creds'
+];
+/** The `assetlinks.json` statement list Google's verifier reads. */ export function assetLinks(apps) {
+    return apps.map((app)=>({
+            relation: [
+                ...ASSET_LINK_RELATIONS
+            ],
+            target: {
+                namespace: 'android_app',
+                package_name: app.packageName,
+                sha256_cert_fingerprints: [
+                    ...app.sha256Fingerprints
+                ]
+            }
+        }));
+}
+/** The request's hostname: lowercase, no port. */ export function requestHostname(host) {
+    return (host != null ? host : '').trim().toLowerCase().replace(/:\d+$/, '');
+}
+/** A URL's hostname, or null when it is not one. */ export function hostnameOfUrl(url) {
+    if (!url) return null;
+    try {
+        return new URL(url).hostname.toLowerCase() || null;
+    } catch (unused) {
+        return null;
+    }
+}
+/** Short on purpose: Apple's CDN caches on top, and a fix must land within minutes. */ const CACHE_CONTROL = 'public, max-age=300, s-maxage=300';
+/**
+ * Whether this host may answer. A Vercel preview deployment is reachable only
+ * at the platform's own generated hostnames, so it answers on any host, which
+ * is what lets a preview be checked before it is promoted.
+ */ function servesHost(request) {
+    if (request.env['VERCEL_ENV'] === 'preview') return true;
+    const hostname = requestHostname(request.host);
+    if (!hostname) return false;
+    return request.servedHosts.some((served)=>requestHostname(served) === hostname);
+}
+function notFound() {
+    return new Response('Not Found', {
+        status: 404,
+        headers: {
+            'content-type': 'text/plain; charset=utf-8',
+            'cache-control': CACHE_CONTROL
+        }
+    });
+}
+function json(body) {
+    return new Response(JSON.stringify(body), {
+        status: 200,
+        headers: {
+            'content-type': 'application/json',
+            'cache-control': CACHE_CONTROL
+        }
+    });
+}
+/** `GET /.well-known/apple-app-site-association`. */ export function appleAppSiteAssociationResponse(request) {
+    const appIds = parseAppleAppIds(request.env['NATIVE_APPLE_APP_IDS']);
+    if (appIds.length === 0 || !servesHost(request)) return notFound();
+    return json(appleAppSiteAssociation(appIds, {
+        applinks: request.applinks
+    }));
+}
+/** `GET /.well-known/assetlinks.json`. */ export function assetLinksResponse(request) {
+    const apps = parseAndroidApps(request.env['NATIVE_ANDROID_APPS']);
+    if (apps.length === 0 || !servesHost(request)) return notFound();
+    return json(assetLinks(apps));
+}
+
+//# sourceMappingURL=native-app-association.js.map

package/src/lib/app-utils/native-app-association.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/native-app-association.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE DOCUMENTS THAT TIE THE NATIVE APPS TO A DOMAIN (AGL-3817).\n *\n * Apple's `apple-app-site-association` and Google's `assetlinks.json` are how\n * a domain says which apps may use its passkeys (`webcredentials`,\n * `get_login_creds`) and open its links (`applinks`, `handle_all_urls`). Both\n * are fetched by the platform's verifier, not by a person, so each has to be\n * exactly `application/json`, a 200, no redirect and no cookie.\n *\n * Everything that names an app comes from the environment, never from here:\n *\n *  - `NATIVE_APPLE_APP_IDS`: comma-separated `<team id>.<bundle id>` values,\n *    in the order the system should prefer them;\n *  - `NATIVE_ANDROID_APPS`: `;`-separated `<package>=<sha256>,<sha256>`\n *    entries, each fingerprint the colon-separated hex Play Console prints.\n *\n * Unset (or nothing valid in it), the document answers 404: a deployment\n * with no apps of its own vouches for none.\n *\n * A leaf with no imports, because both middlewares read the paths below.\n *=========================================*/\n\n/** Where Apple's verifier reads the association file: no `.json` suffix. */\nexport const APPLE_APP_SITE_ASSOCIATION_PATH = '/.well-known/apple-app-site-association'\n\n/** Where Google's verifier reads the statement list. */\nexport const ASSET_LINKS_PATH = '/.well-known/assetlinks.json'\n\n/**\n * The route handlers each middleware rewrites the two public paths to. They\n * live under `/api` because both apps keep their route handlers there, and\n * neither middleware runs again on `/api`.\n */\nexport const NATIVE_APP_ASSOCIATION_ROUTES: Readonly<Record<string, string>> = {\n  [APPLE_APP_SITE_ASSOCIATION_PATH]: '/api/native-app-association/apple-app-site-association',\n  [ASSET_LINKS_PATH]: '/api/native-app-association/assetlinks',\n}\n\n/** The route handler a public association path is served by, or null. */\nexport function nativeAppAssociationRoute(pathname: string): string | null {\n  return Object.prototype.hasOwnProperty.call(NATIVE_APP_ASSOCIATION_ROUTES, pathname)\n    ? NATIVE_APP_ASSOCIATION_ROUTES[pathname]\n    : null\n}\n\n/**\n * The console's top-level sections the native apps have no screen for, so a\n * link to one stays in the browser: the sign-in page and SSO (the system\n * auth session opens them for the app, and a universal link there would loop\n * back into the app), the native hand-off and other `/auth` pages, the\n * sign-out page, the site admin bar's connect page and a plugin's public\n * device pages. The sections the apps finish natively are\n * {@link NATIVE_AUTH_LINK_SEGMENTS}.\n *\n * The rest of the console's top-level sections (`admin`, `billing`,\n * `manage`, `support`) and every workspace path are what the native\n * deep-link grammar resolves (`DeepLinks.swift`, `DeepLinks.kt`): a\n * registered screen, the Besigner in the app's own web view, or the nearest\n * native screen. `apps/console/specs/native-app-association.spec.ts` holds\n * this list to the console's route set and the native link specs.\n */\nexport const NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS: readonly string[] = [\n  'auth',\n  'edit-access',\n  'kiosk',\n  'signin',\n  'signout',\n  'sso',\n]\n\n/**\n * The pre-sign-in sections whose exact page the apps finish natively: sign-up\n * (with its `?plan=`), an emailed verification link, an emailed password\n * reset and account recovery (`AuthFlow.swift`; Android's console intent\n * filter lists the same four paths). Only the page itself opens the app;\n * anything under it stays in the browser, where the console handles it.\n */\nexport const NATIVE_AUTH_LINK_SEGMENTS: readonly string[] = [\n  'account-recovery',\n  'reset-password',\n  'signup',\n  'verify-email',\n]\n\n/** One `applinks` component: a URL path pattern, optionally excluded. */\nexport interface AppLinksComponent {\n  '/': string\n  exclude?: true\n  comment?: string\n}\n\n/**\n * The console paths the apps open, as `applinks` components. Apple reads\n * them in order and the first match wins, so every exclusion comes ahead of\n * the closing catch-all.\n */\nexport function consoleAppLinksComponents(): AppLinksComponent[] {\n  const excluded: AppLinksComponent[] = [\n    { '/': '/_*', exclude: true, comment: 'framework and internal paths' },\n    { '/': '/api', exclude: true },\n    { '/': '/api/*', exclude: true, comment: 'route handlers' },\n    { '/': '/.well-known/*', exclude: true },\n  ]\n  for (const segment of NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS) {\n    excluded.push({ '/': `/${segment}`, exclude: true }, { '/': `/${segment}/*`, exclude: true })\n  }\n  for (const segment of NATIVE_AUTH_LINK_SEGMENTS) {\n    excluded.push({ '/': `/${segment}/*`, exclude: true })\n  }\n  return [\n    ...excluded,\n    { '/': '/*', comment: 'workspace, site, account, billing, support and staff pages' },\n  ]\n}\n\n/** `TEAMID1234.com.example.app`: a 10-character team id, then a bundle id. */\nconst APPLE_APP_ID = /^[A-Z0-9]{10}\\.[A-Za-z0-9-]+(\\.[A-Za-z0-9-]+)+$/\n\n/** A Java package name: dot-separated identifiers, at least two. */\nconst ANDROID_PACKAGE = /^[A-Za-z][A-Za-z0-9_]*(\\.[A-Za-z][A-Za-z0-9_]*)+$/\n\n/** A SHA-256 certificate fingerprint as 32 colon-separated hex pairs. */\nconst SHA256_FINGERPRINT = /^([0-9A-F]{2}:){31}[0-9A-F]{2}$/\n\n/** The Apple app ids in `NATIVE_APPLE_APP_IDS`, in order; invalid ones dropped. */\nexport function parseAppleAppIds(raw: string | undefined): string[] {\n  const ids = (raw ?? '')\n    .split(',')\n    .map((value) => value.trim())\n    .filter((value) => APPLE_APP_ID.test(value))\n  return [...new Set(ids)]\n}\n\n/** One Android app and the signing certificates it may be verified by. */\nexport interface AndroidAppAssociation {\n  packageName: string\n  sha256Fingerprints: string[]\n}\n\n/**\n * The Android apps in `NATIVE_ANDROID_APPS`. An entry without a valid package\n * or without one valid fingerprint is dropped whole: a statement with no\n * certificate verifies nothing.\n */\nexport function parseAndroidApps(raw: string | undefined): AndroidAppAssociation[] {\n  const apps: AndroidAppAssociation[] = []\n  for (const entry of (raw ?? '').split(';')) {\n    const at = entry.indexOf('=')\n    if (at < 0) continue\n    const packageName = entry.slice(0, at).trim()\n    if (!ANDROID_PACKAGE.test(packageName)) continue\n    if (apps.some((app) => app.packageName === packageName)) continue\n    const fingerprints = entry\n      .slice(at + 1)\n      .split(',')\n      .map((value) => value.trim().toUpperCase())\n      .filter((value) => SHA256_FINGERPRINT.test(value))\n    if (fingerprints.length === 0) continue\n    apps.push({ packageName, sha256Fingerprints: [...new Set(fingerprints)] })\n  }\n  return apps\n}\n\n/** The `apple-app-site-association` document Apple's CDN reads. */\nexport interface AppleAppSiteAssociation {\n  applinks?: {\n    apps: []\n    details: Array<{ appIDs: string[]; components: AppLinksComponent[] }>\n  }\n  webcredentials: { apps: string[] }\n}\n\n/**\n * The association file for these app ids. `applinks` is only for a host\n * whose paths the native deep-link grammar resolves: the console. A host\n * that serves the passkey relying party alone gets `webcredentials` only.\n *\n * One `details` entry per app, in the configured order, because when two\n * installed apps claim the same path the system takes the first.\n */\nexport function appleAppSiteAssociation(\n  appIds: string[],\n  options: { applinks: boolean },\n): AppleAppSiteAssociation {\n  const document: AppleAppSiteAssociation = { webcredentials: { apps: [...appIds] } }\n  if (options.applinks) {\n    const components = consoleAppLinksComponents()\n    document.applinks = {\n      apps: [],\n      details: appIds.map((appId) => ({ appIDs: [appId], components })),\n    }\n  }\n  return document\n}\n\n/** One Digital Asset Links statement. */\nexport interface AssetLinkStatement {\n  relation: string[]\n  target: { namespace: 'android_app'; package_name: string; sha256_cert_fingerprints: string[] }\n}\n\n/** Passkeys and app links, for every configured app. */\nexport const ASSET_LINK_RELATIONS = [\n  'delegate_permission/common.handle_all_urls',\n  'delegate_permission/common.get_login_creds',\n] as const\n\n/** The `assetlinks.json` statement list Google's verifier reads. */\nexport function assetLinks(apps: AndroidAppAssociation[]): AssetLinkStatement[] {\n  return apps.map((app) => ({\n    relation: [...ASSET_LINK_RELATIONS],\n    target: {\n      namespace: 'android_app',\n      package_name: app.packageName,\n      sha256_cert_fingerprints: [...app.sha256Fingerprints],\n    },\n  }))\n}\n\n/** The request's hostname: lowercase, no port. */\nexport function requestHostname(host: string | null | undefined): string {\n  return (host ?? '').trim().toLowerCase().replace(/:\\d+$/, '')\n}\n\n/** A URL's hostname, or null when it is not one. */\nexport function hostnameOfUrl(url: string | null | undefined): string | null {\n  if (!url) return null\n  try {\n    return new URL(url).hostname.toLowerCase() || null\n  } catch {\n    return null\n  }\n}\n\n/** What a route handler needs to answer one of the two documents. */\nexport interface NativeAppAssociationRequest {\n  /** The request's `Host` header. */\n  host: string | null\n  /**\n   * The hostnames this deployment vouches for. Every other host an app\n   * serves (a customer's custom domain, a workspace subdomain, a white-label\n   * console) answers 404, because the apps are this deployment's and not\n   * theirs.\n   */\n  servedHosts: ReadonlyArray<string | null | undefined>\n  /** Whether this host's paths are console links the apps resolve. */\n  applinks: boolean\n  /** The environment; `process.env` in the routes, a fixture in specs. */\n  env: Readonly<Record<string, string | undefined>>\n}\n\n/** Short on purpose: Apple's CDN caches on top, and a fix must land within minutes. */\nconst CACHE_CONTROL = 'public, max-age=300, s-maxage=300'\n\n/**\n * Whether this host may answer. A Vercel preview deployment is reachable only\n * at the platform's own generated hostnames, so it answers on any host, which\n * is what lets a preview be checked before it is promoted.\n */\nfunction servesHost(request: NativeAppAssociationRequest): boolean {\n  if (request.env['VERCEL_ENV'] === 'preview') return true\n  const hostname = requestHostname(request.host)\n  if (!hostname) return false\n  return request.servedHosts.some((served) => requestHostname(served) === hostname)\n}\n\nfunction notFound(): Response {\n  return new Response('Not Found', {\n    status: 404,\n    headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': CACHE_CONTROL },\n  })\n}\n\nfunction json(body: unknown): Response {\n  return new Response(JSON.stringify(body), {\n    status: 200,\n    headers: { 'content-type': 'application/json', 'cache-control': CACHE_CONTROL },\n  })\n}\n\n/** `GET /.well-known/apple-app-site-association`. */\nexport function appleAppSiteAssociationResponse(request: NativeAppAssociationRequest): Response {\n  const appIds = parseAppleAppIds(request.env['NATIVE_APPLE_APP_IDS'])\n  if (appIds.length === 0 || !servesHost(request)) return notFound()\n  return json(appleAppSiteAssociation(appIds, { applinks: request.applinks }))\n}\n\n/** `GET /.well-known/assetlinks.json`. */\nexport function assetLinksResponse(request: NativeAppAssociationRequest): Response {\n  const apps = parseAndroidApps(request.env['NATIVE_ANDROID_APPS'])\n  if (apps.length === 0 || !servesHost(request)) return notFound()\n  return json(assetLinks(apps))\n}\n"],"names":["APPLE_APP_SITE_ASSOCIATION_PATH","ASSET_LINKS_PATH","NATIVE_APP_ASSOCIATION_ROUTES","nativeAppAssociationRoute","pathname","Object","prototype","hasOwnProperty","call","NATIVE_WEB_ONLY_TOP_LEVEL_SEGMENTS","NATIVE_AUTH_LINK_SEGMENTS","consoleAppLinksComponents","excluded","exclude","comment","segment","push","APPLE_APP_ID","ANDROID_PACKAGE","SHA256_FINGERPRINT","parseAppleAppIds","raw","ids","split","map","value","trim","filter","test","Set","parseAndroidApps","apps","entry","at","indexOf","packageName","slice","some","app","fingerprints","toUpperCase","length","sha256Fingerprints","appleAppSiteAssociation","appIds","options","document","webcredentials","applinks","components","details","appId","appIDs","ASSET_LINK_RELATIONS","assetLinks","relation","target","namespace","package_name","sha256_cert_fingerprints","requestHostname","host","toLowerCase","replace","hostnameOfUrl","url","URL","hostname","CACHE_CONTROL","servesHost","request","env","servedHosts","served","notFound","Response","status","headers","json","body","JSON","stringify","appleAppSiteAssociationResponse","assetLinksResponse"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;2CAoB2C,GAE3C,0EAA0E,GAC1E,OAAO,MAAMA,kCAAkC,0CAAyC;AAExF,sDAAsD,GACtD,OAAO,MAAMC,mBAAmB,+BAA8B;AAE9D;;;;CAIC,GACD,OAAO,MAAMC,gCAAkE;IAC7E,CAACF,gCAAgC,EAAE;IACnC,CAACC,iBAAiB,EAAE;AACtB,EAAC;AAED,uEAAuE,GACvE,OAAO,SAASE,0BAA0BC,QAAgB;IACxD,OAAOC,OAAOC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACN,+BAA+BE,YACvEF,6BAA6B,CAACE,SAAS,GACvC;AACN;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMK,qCAAwD;IACnE;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;CAMC,GACD,OAAO,MAAMC,4BAA+C;IAC1D;IACA;IACA;IACA;CACD,CAAA;AASD;;;;CAIC,GACD,OAAO,SAASC;IACd,MAAMC,WAAgC;QACpC;YAAE,KAAK;YAAOC,SAAS;YAAMC,SAAS;QAA+B;QACrE;YAAE,KAAK;YAAQD,SAAS;QAAK;QAC7B;YAAE,KAAK;YAAUA,SAAS;YAAMC,SAAS;QAAiB;QAC1D;YAAE,KAAK;YAAkBD,SAAS;QAAK;KACxC;IACD,KAAK,MAAME,WAAWN,mCAAoC;QACxDG,SAASI,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,EAAED,SAAS;YAAEF,SAAS;QAAK,GAAG;YAAE,KAAK,CAAC,CAAC,EAAEE,QAAQ,EAAE,CAAC;YAAEF,SAAS;QAAK;IAC7F;IACA,KAAK,MAAME,WAAWL,0BAA2B;QAC/CE,SAASI,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,EAAED,QAAQ,EAAE,CAAC;YAAEF,SAAS;QAAK;IACtD;IACA,OAAO;WACFD;QACH;YAAE,KAAK;YAAME,SAAS;QAA6D;KACpF;AACH;AAEA,4EAA4E,GAC5E,MAAMG,eAAe;AAErB,kEAAkE,GAClE,MAAMC,kBAAkB;AAExB,uEAAuE,GACvE,MAAMC,qBAAqB;AAE3B,iFAAiF,GACjF,OAAO,SAASC,iBAAiBC,GAAuB;IACtD,MAAMC,MAAM,CAACD,cAAAA,MAAO,IACjBE,KAAK,CAAC,KACNC,GAAG,CAAC,CAACC,QAAUA,MAAMC,IAAI,IACzBC,MAAM,CAAC,CAACF,QAAUR,aAAaW,IAAI,CAACH;IACvC,OAAO;WAAI,IAAII,IAAIP;KAAK;AAC1B;AAQA;;;;CAIC,GACD,OAAO,SAASQ,iBAAiBT,GAAuB;IACtD,MAAMU,OAAgC,EAAE;IACxC,KAAK,MAAMC,SAAS,CAACX,cAAAA,MAAO,IAAIE,KAAK,CAAC,KAAM;QAC1C,MAAMU,KAAKD,MAAME,OAAO,CAAC;QACzB,IAAID,KAAK,GAAG;QACZ,MAAME,cAAcH,MAAMI,KAAK,CAAC,GAAGH,IAAIP,IAAI;QAC3C,IAAI,CAACR,gBAAgBU,IAAI,CAACO,cAAc;QACxC,IAAIJ,KAAKM,IAAI,CAAC,CAACC,MAAQA,IAAIH,WAAW,KAAKA,cAAc;QACzD,MAAMI,eAAeP,MAClBI,KAAK,CAACH,KAAK,GACXV,KAAK,CAAC,KACNC,GAAG,CAAC,CAACC,QAAUA,MAAMC,IAAI,GAAGc,WAAW,IACvCb,MAAM,CAAC,CAACF,QAAUN,mBAAmBS,IAAI,CAACH;QAC7C,IAAIc,aAAaE,MAAM,KAAK,GAAG;QAC/BV,KAAKf,IAAI,CAAC;YAAEmB;YAAaO,oBAAoB;mBAAI,IAAIb,IAAIU;aAAc;QAAC;IAC1E;IACA,OAAOR;AACT;AAWA;;;;;;;CAOC,GACD,OAAO,SAASY,wBACdC,MAAgB,EAChBC,OAA8B;IAE9B,MAAMC,WAAoC;QAAEC,gBAAgB;YAAEhB,MAAM;mBAAIa;aAAO;QAAC;IAAE;IAClF,IAAIC,QAAQG,QAAQ,EAAE;QACpB,MAAMC,aAAatC;QACnBmC,SAASE,QAAQ,GAAG;YAClBjB,MAAM,EAAE;YACRmB,SAASN,OAAOpB,GAAG,CAAC,CAAC2B,QAAW,CAAA;oBAAEC,QAAQ;wBAACD;qBAAM;oBAAEF;gBAAW,CAAA;QAChE;IACF;IACA,OAAOH;AACT;AAQA,sDAAsD,GACtD,OAAO,MAAMO,uBAAuB;IAClC;IACA;CACD,CAAS;AAEV,kEAAkE,GAClE,OAAO,SAASC,WAAWvB,IAA6B;IACtD,OAAOA,KAAKP,GAAG,CAAC,CAACc,MAAS,CAAA;YACxBiB,UAAU;mBAAIF;aAAqB;YACnCG,QAAQ;gBACNC,WAAW;gBACXC,cAAcpB,IAAIH,WAAW;gBAC7BwB,0BAA0B;uBAAIrB,IAAII,kBAAkB;iBAAC;YACvD;QACF,CAAA;AACF;AAEA,gDAAgD,GAChD,OAAO,SAASkB,gBAAgBC,IAA+B;IAC7D,OAAO,CAACA,eAAAA,OAAQ,IAAInC,IAAI,GAAGoC,WAAW,GAAGC,OAAO,CAAC,SAAS;AAC5D;AAEA,kDAAkD,GAClD,OAAO,SAASC,cAAcC,GAA8B;IAC1D,IAAI,CAACA,KAAK,OAAO;IACjB,IAAI;QACF,OAAO,IAAIC,IAAID,KAAKE,QAAQ,CAACL,WAAW,MAAM;IAChD,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAmBA,qFAAqF,GACrF,MAAMM,gBAAgB;AAEtB;;;;CAIC,GACD,SAASC,WAAWC,OAAoC;IACtD,IAAIA,QAAQC,GAAG,CAAC,aAAa,KAAK,WAAW,OAAO;IACpD,MAAMJ,WAAWP,gBAAgBU,QAAQT,IAAI;IAC7C,IAAI,CAACM,UAAU,OAAO;IACtB,OAAOG,QAAQE,WAAW,CAACnC,IAAI,CAAC,CAACoC,SAAWb,gBAAgBa,YAAYN;AAC1E;AAEA,SAASO;IACP,OAAO,IAAIC,SAAS,aAAa;QAC/BC,QAAQ;QACRC,SAAS;YAAE,gBAAgB;YAA6B,iBAAiBT;QAAc;IACzF;AACF;AAEA,SAASU,KAAKC,IAAa;IACzB,OAAO,IAAIJ,SAASK,KAAKC,SAAS,CAACF,OAAO;QACxCH,QAAQ;QACRC,SAAS;YAAE,gBAAgB;YAAoB,iBAAiBT;QAAc;IAChF;AACF;AAEA,mDAAmD,GACnD,OAAO,SAASc,gCAAgCZ,OAAoC;IAClF,MAAM1B,SAASxB,iBAAiBkD,QAAQC,GAAG,CAAC,uBAAuB;IACnE,IAAI3B,OAAOH,MAAM,KAAK,KAAK,CAAC4B,WAAWC,UAAU,OAAOI;IACxD,OAAOI,KAAKnC,wBAAwBC,QAAQ;QAAEI,UAAUsB,QAAQtB,QAAQ;IAAC;AAC3E;AAEA,wCAAwC,GACxC,OAAO,SAASmC,mBAAmBb,OAAoC;IACrE,MAAMvC,OAAOD,iBAAiBwC,QAAQC,GAAG,CAAC,sBAAsB;IAChE,IAAIxC,KAAKU,MAAM,KAAK,KAAK,CAAC4B,WAAWC,UAAU,OAAOI;IACtD,OAAOI,KAAKxB,WAAWvB;AACzB"}

package/src/lib/app-utils/sso-enforcement.d.ts

@@ -0,0 +1,69 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHAT ENFORCING SINGLE SIGN-ON WOULD DO TO EACH ACCOUNT (AGL-1888, AGL-3671) —
+ * the pure half of the Single sign-on card's rehearsal table, with no import at
+ * all, so the native apps replay it (`ssoEnforcementAccounts`) beside the
+ * console's card, which draws the very same rows.
+ *
+ * The rehearsal answers one entry per account of the identity pool: the sign-in
+ * methods enforcement would remove (`unlinked`), the ones it leaves (`kept`),
+ * and why it would leave the account alone (`skipped`). An account can be
+ * designated break-glass only if it holds a way in that is not the identity
+ * provider itself: anything else would look like protection and provide none.
+ */
+/** One account of the rehearsal, as the single sign-on route answers it. */
+export interface SsoEnforcementAccount {
+    uid: string;
+    email: string | null;
+    unlinked: readonly string[];
+    kept: readonly string[];
+    skipped?: string;
+}
+/** One row of the rehearsal table, in the words the console shows. */
+export interface SsoEnforcementRow {
+    uid: string;
+    /** The address, else the account's uid. */
+    label: string;
+    /** What the account would lose, or why it would lose nothing. */
+    wouldLose: string;
+    /** What it keeps. */
+    keeps: string;
+    /** Whether it can be designated break-glass (it holds a way in other than the provider). */
+    eligible: boolean;
+    /** Whether it is designated break-glass now. */
+    designated: boolean;
+}
+/**
+ * Would designating this account actually keep a way in?
+ *
+ * Mirrors `assessSsoLockoutRisk` deliberately, and over the same fact it
+ * uses: an account protects the org only when it holds a provider that is
+ * NOT the org's IdP. Designating an account whose sole credential is the SAML
+ * link is the most natural way to get this wrong, because it looks exactly
+ * like protection and fails in precisely the situation it exists for.
+ *
+ * The plan is read BEFORE designation, so both halves count: `unlinked` is
+ * what enforcement would strip (all non-IdP by construction), and `kept` is
+ * what it would leave — which for an already-designated or would-orphan
+ * account is the whole set.
+ */
+export declare function protectsIfDesignated(account: Pick<SsoEnforcementAccount, 'unlinked' | 'kept'>, providerId: string | undefined): boolean;
+/** What the account would lose, as the rehearsal table words it. */
+export declare function ssoEnforcementLoses(account: Pick<SsoEnforcementAccount, 'unlinked' | 'skipped'>): string;
+/** The rehearsal table's rows, one per account, for the break-glass choice. */
+export declare function ssoEnforcementAccounts(accounts: readonly SsoEnforcementAccount[] | null | undefined, providerId: string | undefined, designated: readonly string[] | null | undefined): SsoEnforcementRow[];

package/src/lib/app-utils/sso-enforcement.js

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * WHAT ENFORCING SINGLE SIGN-ON WOULD DO TO EACH ACCOUNT (AGL-1888, AGL-3671) —
+ * the pure half of the Single sign-on card's rehearsal table, with no import at
+ * all, so the native apps replay it (`ssoEnforcementAccounts`) beside the
+ * console's card, which draws the very same rows.
+ *
+ * The rehearsal answers one entry per account of the identity pool: the sign-in
+ * methods enforcement would remove (`unlinked`), the ones it leaves (`kept`),
+ * and why it would leave the account alone (`skipped`). An account can be
+ * designated break-glass only if it holds a way in that is not the identity
+ * provider itself: anything else would look like protection and provide none.
+ */ /** One account of the rehearsal, as the single sign-on route answers it. */ /**
+ * Would designating this account actually keep a way in?
+ *
+ * Mirrors `assessSsoLockoutRisk` deliberately, and over the same fact it
+ * uses: an account protects the org only when it holds a provider that is
+ * NOT the org's IdP. Designating an account whose sole credential is the SAML
+ * link is the most natural way to get this wrong, because it looks exactly
+ * like protection and fails in precisely the situation it exists for.
+ *
+ * The plan is read BEFORE designation, so both halves count: `unlinked` is
+ * what enforcement would strip (all non-IdP by construction), and `kept` is
+ * what it would leave — which for an already-designated or would-orphan
+ * account is the whole set.
+ */ export function protectsIfDesignated(account, providerId) {
+    return [
+        ...account.unlinked,
+        ...account.kept
+    ].some((id)=>id !== providerId);
+}
+/** What the account would lose, as the rehearsal table words it. */ export function ssoEnforcementLoses(account) {
+    if (account.skipped === 'break-glass') return 'Nothing — designated break-glass';
+    if (account.skipped) return 'Nothing — it would be left with no way in';
+    return account.unlinked.join(', ') || '—';
+}
+/** The rehearsal table's rows, one per account, for the break-glass choice. */ export function ssoEnforcementAccounts(accounts, providerId, designated) {
+    const chosen = new Set(designated != null ? designated : []);
+    return (accounts != null ? accounts : []).map((account)=>{
+        var _account_email;
+        return {
+            uid: account.uid,
+            label: (_account_email = account.email) != null ? _account_email : account.uid,
+            wouldLose: ssoEnforcementLoses(account),
+            keeps: account.kept.join(', ') || '—',
+            eligible: protectsIfDesignated(account, providerId),
+            designated: chosen.has(account.uid)
+        };
+    });
+}
+
+//# sourceMappingURL=sso-enforcement.js.map

package/src/lib/app-utils/sso-enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/sso-enforcement.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * WHAT ENFORCING SINGLE SIGN-ON WOULD DO TO EACH ACCOUNT (AGL-1888, AGL-3671) —\n * the pure half of the Single sign-on card's rehearsal table, with no import at\n * all, so the native apps replay it (`ssoEnforcementAccounts`) beside the\n * console's card, which draws the very same rows.\n *\n * The rehearsal answers one entry per account of the identity pool: the sign-in\n * methods enforcement would remove (`unlinked`), the ones it leaves (`kept`),\n * and why it would leave the account alone (`skipped`). An account can be\n * designated break-glass only if it holds a way in that is not the identity\n * provider itself: anything else would look like protection and provide none.\n */\n\n/** One account of the rehearsal, as the single sign-on route answers it. */\nexport interface SsoEnforcementAccount {\n  uid: string\n  email: string | null\n  unlinked: readonly string[]\n  kept: readonly string[]\n  skipped?: string\n}\n\n/** One row of the rehearsal table, in the words the console shows. */\nexport interface SsoEnforcementRow {\n  uid: string\n  /** The address, else the account's uid. */\n  label: string\n  /** What the account would lose, or why it would lose nothing. */\n  wouldLose: string\n  /** What it keeps. */\n  keeps: string\n  /** Whether it can be designated break-glass (it holds a way in other than the provider). */\n  eligible: boolean\n  /** Whether it is designated break-glass now. */\n  designated: boolean\n}\n\n/**\n * Would designating this account actually keep a way in?\n *\n * Mirrors `assessSsoLockoutRisk` deliberately, and over the same fact it\n * uses: an account protects the org only when it holds a provider that is\n * NOT the org's IdP. Designating an account whose sole credential is the SAML\n * link is the most natural way to get this wrong, because it looks exactly\n * like protection and fails in precisely the situation it exists for.\n *\n * The plan is read BEFORE designation, so both halves count: `unlinked` is\n * what enforcement would strip (all non-IdP by construction), and `kept` is\n * what it would leave — which for an already-designated or would-orphan\n * account is the whole set.\n */\nexport function protectsIfDesignated(account: Pick<SsoEnforcementAccount, 'unlinked' | 'kept'>, providerId: string | undefined): boolean {\n  return [...account.unlinked, ...account.kept].some((id) => id !== providerId)\n}\n\n/** What the account would lose, as the rehearsal table words it. */\nexport function ssoEnforcementLoses(account: Pick<SsoEnforcementAccount, 'unlinked' | 'skipped'>): string {\n  if (account.skipped === 'break-glass') return 'Nothing — designated break-glass'\n  if (account.skipped) return 'Nothing — it would be left with no way in'\n  return account.unlinked.join(', ') || '—'\n}\n\n/** The rehearsal table's rows, one per account, for the break-glass choice. */\nexport function ssoEnforcementAccounts(\n  accounts: readonly SsoEnforcementAccount[] | null | undefined,\n  providerId: string | undefined,\n  designated: readonly string[] | null | undefined,\n): SsoEnforcementRow[] {\n  const chosen = new Set(designated ?? [])\n  return (accounts ?? []).map((account) => ({\n    uid: account.uid,\n    label: account.email ?? account.uid,\n    wouldLose: ssoEnforcementLoses(account),\n    keeps: account.kept.join(', ') || '—',\n    eligible: protectsIfDesignated(account, providerId),\n    designated: chosen.has(account.uid),\n  }))\n}\n"],"names":["protectsIfDesignated","account","providerId","unlinked","kept","some","id","ssoEnforcementLoses","skipped","join","ssoEnforcementAccounts","accounts","designated","chosen","Set","map","uid","label","email","wouldLose","keeps","eligible","has"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;CAWC,GAED,0EAA0E,GAwB1E;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASA,qBAAqBC,OAAyD,EAAEC,UAA8B;IAC5H,OAAO;WAAID,QAAQE,QAAQ;WAAKF,QAAQG,IAAI;KAAC,CAACC,IAAI,CAAC,CAACC,KAAOA,OAAOJ;AACpE;AAEA,kEAAkE,GAClE,OAAO,SAASK,oBAAoBN,OAA4D;IAC9F,IAAIA,QAAQO,OAAO,KAAK,eAAe,OAAO;IAC9C,IAAIP,QAAQO,OAAO,EAAE,OAAO;IAC5B,OAAOP,QAAQE,QAAQ,CAACM,IAAI,CAAC,SAAS;AACxC;AAEA,6EAA6E,GAC7E,OAAO,SAASC,uBACdC,QAA6D,EAC7DT,UAA8B,EAC9BU,UAAgD;IAEhD,MAAMC,SAAS,IAAIC,IAAIF,qBAAAA,aAAc,EAAE;IACvC,OAAO,CAACD,mBAAAA,WAAY,EAAE,EAAEI,GAAG,CAAC,CAACd;YAEpBA;eAFiC;YACxCe,KAAKf,QAAQe,GAAG;YAChBC,KAAK,GAAEhB,iBAAAA,QAAQiB,KAAK,YAAbjB,iBAAiBA,QAAQe,GAAG;YACnCG,WAAWZ,oBAAoBN;YAC/BmB,OAAOnB,QAAQG,IAAI,CAACK,IAAI,CAAC,SAAS;YAClCY,UAAUrB,qBAAqBC,SAASC;YACxCU,YAAYC,OAAOS,GAAG,CAACrB,QAAQe,GAAG;QACpC;;AACF"}

package/src/lib/app-utils/time-zone-choices.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE TIME ZONES THE PICKER OFFERS (AGL-3252, AGL-3671) — the list the console's
+ * time zone controls show, kept as data with no import at all, so the native
+ * apps replay it (`timeZoneChoices`) beside the console's pickers.
+ *
+ * The console reads its list off `Intl.supportedValuesOf('timeZone')`
+ * (`supportedTimeZones()`), because the IANA database renames zones and a
+ * picker built from the runtime cannot offer a name the runtime refuses. An app
+ * has no `Intl` to ask, and its platform's own list is a different one (it
+ * carries every legacy alias: `US/Eastern`, `GB-Eire`, `Etc/GMT+5`), so the
+ * apps offer THIS snapshot of what that call answers: canonical names only,
+ * each of which `isSupportedTimeZone` accepts, which is what the workspace
+ * route checks. It is a snapshot: when the IANA database moves, regenerate it
+ * from `Intl.supportedValuesOf('timeZone')` (the spec beside this file fails
+ * for a zone the runtime no longer accepts, which the route would refuse).
+ */
+export declare const TIME_ZONE_CHOICES: readonly string[];
+/** One entry of a picker: the stored zone name, and what the person reads. */
+export interface TimeZoneChoice {
+    value: string;
+    label: string;
+}
+/** The label of the first choice: an organization that never set a zone dates everything in UTC, and says so. */
+export declare const TIME_ZONE_DEFAULT_LABEL = "UTC (default)";
+/**
+ * The picker's choices, in the order the console shows them: the default (an empty value, which the route stores as
+ * no zone at all) first, then every zone by name, with its underscores read as spaces (`America/New_York` is
+ * `America/New York`).
+ */
+export declare function timeZoneChoices(): TimeZoneChoice[];