@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/scope-tokens.js

@@ -0,0 +1,331 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Scoped sharing (AGL-1037): org-owned resources — datasets, media assets,
+ * media folders — carry a `visibleTo` array naming who may see them, so an
+ * agency can keep an internal dataset off its client sites without forking
+ * storage into a second host-scoped collection (see AGL-237, which moved
+ * these the other way).
+ *
+ * The shape is dictated by what both enforcement layers can evaluate:
+ * Firestore rules have no `.map()`, so the caller's read set is denormalized
+ * onto their member doc (AGL-1038) and matched with `list.hasAny(list)`;
+ * clients match the same field with `array-contains-any`. A flat array of
+ * strings is the only shape both primitives accept — the friendlier
+ * `{ kind, hostIds }` form is a presentation concern and lives in
+ * `describeScope` below, never on the doc.
+ */ /** Everyone in the owning org, and every host it owns. */ export const ORG_SCOPE_TOKEN = 'org';
+const HOST_TOKEN_PREFIX = 'host:';
+/**
+ * `array-contains-any` and `hasAny` both cap at 30 values. That caps a
+ * selected-sites scope at 30 hosts, and a collaborator's read query at 29
+ * hosts plus `'org'`. Wider than that is the `['org']` case.
+ */ export const MAX_SCOPE_HOSTS = 30;
+/** `host:{hostId}` — the token naming a single site. */ export function hostScopeToken(hostId) {
+    return `${HOST_TOKEN_PREFIX}${hostId}`;
+}
+export function isScopeToken(value) {
+    if (typeof value !== 'string') return false;
+    if (value === ORG_SCOPE_TOKEN) return true;
+    return value.startsWith(HOST_TOKEN_PREFIX) && value.length > HOST_TOKEN_PREFIX.length;
+}
+/** Reads a token back apart; null when it isn't one. */ export function parseScopeToken(token) {
+    if (token === ORG_SCOPE_TOKEN) return {
+        kind: 'org'
+    };
+    if (!isScopeToken(token)) return null;
+    return {
+        kind: 'host',
+        hostId: token.slice(HOST_TOKEN_PREFIX.length)
+    };
+}
+/** Every host id named by a scope, in order; `['org']` names none. */ export function hostIdsFromScope(visibleTo) {
+    const ids = [];
+    for (const token of visibleTo != null ? visibleTo : []){
+        const parsed = parseScopeToken(token);
+        if ((parsed == null ? void 0 : parsed.kind) === 'host') ids.push(parsed.hostId);
+    }
+    return ids;
+}
+/**
+ * The read set for one site: what a server read path or a scoped client
+ * query passes to `array-contains-any`. `'org'` is included because an
+ * org-wide resource is visible to every host in the org.
+ */ export function scopeTokensForHost(hostId) {
+    return [
+        ORG_SCOPE_TOKEN,
+        hostScopeToken(hostId)
+    ];
+}
+/**
+ * Whether a host may see a resource.
+ *
+ * ## A missing `visibleTo` is visible to NOBODY
+ *
+ * It once read as org-wide, so that documents predating the scope backfill
+ * stayed visible until it reached them. That default is the shape of failure
+ * this codebase keeps paying for: **a read that cannot see a value answered
+ * the same as a value that is absent.** "This document was never scoped" and
+ * "this document is shared with every site" are different facts, and one
+ * unscoped document under an agency account was one client's data on every
+ * other client's site — silently, because the permissive answer is the one
+ * nothing complains about.
+ *
+ * Both enforcement layers below this function already fail CLOSED on the
+ * missing field: `array-contains-any` matches nothing on a document that
+ * lacks the array, and the rules' `hasAny` is false for the same reason. So
+ * the permissive default was never a policy either of them agreed with — it
+ * was one TypeScript helper disagreeing with the database, which is what made
+ * AGL-1466 invisible for three weeks.
+ *
+ * The migration is `tools/scripts/backfill-consent-host.mjs`, which stamps
+ * `['org']` on the documents that should carry it. Until a document is
+ * stamped it is hidden, and hiding is the recoverable direction.
+ *
+ * An **empty array** answers the same and always did.
+ */ export function visibleToHost(visibleTo, hostId) {
+    if (visibleTo == null) return false;
+    if (visibleTo.includes(ORG_SCOPE_TOKEN)) return true;
+    return visibleTo.includes(hostScopeToken(hostId));
+}
+/**
+ * Whether a caller holding `scopeTokens` (AGL-1038) may see a resource.
+ * The TypeScript twin of the rules' `visibleTo.hasAny(scopeTokens)`, for
+ * the Admin-SDK paths that never evaluate rules at all.
+ *
+ * A missing `visibleTo` is visible to nobody, for the reason
+ * {@link visibleToHost} gives — and here the twinning is the argument on its
+ * own: `hasAny` over a missing field is false in the rules, so a helper that
+ * answered `true` was not a twin of anything.
+ */ export function visibleToTokens(visibleTo, scopeTokens) {
+    if (visibleTo == null) return false;
+    if (!(scopeTokens == null ? void 0 : scopeTokens.length)) return false;
+    return visibleTo.some((token)=>scopeTokens.includes(token));
+}
+/**
+ * The scope a document ACTUALLY carries — `null` when it carries none
+ * (AGL-1466/AGL-1480).
+ *
+ * Every helper above this line answers "may this be seen", and answers it
+ * the way both enforcement layers do: a missing `visibleTo` is seen by
+ * nobody.
+ *
+ * An **editor** asks a different question — "what did somebody choose" —
+ * and it still needs its own answer, because "nobody chose" and "somebody
+ * chose nobody" are the same to an editor and different on the document.
+ * Four call sites across two files each wrote their own
+ *
+ * ```ts
+ * Array.isArray(doc.visibleTo) ? doc.visibleTo : [ORG_SCOPE_TOKEN]
+ * ```
+ *
+ * and every one of them rendered "All sites" over a document no site could
+ * see. That inversion is why AGL-1466 went three weeks unnoticed with the
+ * folder tree missing from every host, and AGL-1480 is the third and fourth
+ * copies of it turning up at the surface people use most.
+ *
+ * So: one function, the same lesson `newMediaFolderDoc` drew on the write
+ * side. A caller that wants a display default may still `?? []` or
+ * `?? [ORG_SCOPE_TOKEN]` — but it has to say so, in one visible place,
+ * instead of a ternary that reads like a null check.
+ *
+ * An empty array answers `null` too. On the document the two differ, and
+ * `newResourceScopeFields` refuses to WRITE one; to an editor they are the
+ * same fact — nobody chose this — and both must offer the choice rather
+ * than pre-fill an answer.
+ *
+ * Not normalized, deliberately. `normalizeVisibleTo` collapses for STORAGE;
+ * doing it here would make an untouched editor differ from the document it
+ * was seeded from, and the save gates compare exactly those two to decide
+ * whether to write at all.
+ */ export function storedScope(visibleTo) {
+    return Array.isArray(visibleTo) && visibleTo.length ? [
+        ...visibleTo
+    ] : null;
+}
+/**
+ * Cleans a scope for storage: drops junk, dedupes, and collapses to
+ * `['org']` when org-wide is present, since that already implies every
+ * host. Returns null when the result is unusable — empty, or over
+ * `MAX_SCOPE_HOSTS` — so the caller decides rather than this silently
+ * dropping hosts (losing access) or widening to org (leaking).
+ */ export function normalizeVisibleTo(input) {
+    const tokens = (input != null ? input : []).filter(isScopeToken);
+    if (!tokens.length) return null;
+    if (tokens.includes(ORG_SCOPE_TOKEN)) return [
+        ORG_SCOPE_TOKEN
+    ];
+    const unique = [
+        ...new Set(tokens)
+    ];
+    if (unique.length > MAX_SCOPE_HOSTS) return null;
+    return unique;
+}
+/**
+ * The scope a save writes, or why the selection cannot be written.
+ *
+ * {@link normalizeVisibleTo} answers null for a selection it cannot store, and
+ * a save has no safe substitute for that null: the org token shares the
+ * resource with every site, and dropping tokens takes access from sites
+ * somebody picked. So a caller refuses the save and shows `problem`.
+ */ export function scopeToStore(input) {
+    const scope = normalizeVisibleTo(input);
+    if (scope) return {
+        scope,
+        problem: null
+    };
+    return {
+        scope: null,
+        problem: (input != null ? input : []).some(isScopeToken) ? `Choose ${MAX_SCOPE_HOSTS} sites or fewer, or share with All sites.` : 'Choose at least one site, or share with All sites.'
+    };
+}
+/** A scope covering exactly the given hosts; null when unusable. */ export function scopeForHosts(hostIds) {
+    return normalizeVisibleTo(hostIds.map(hostScopeToken));
+}
+/**
+ * Whether a scope is the org-wide one.
+ *
+ * An absent scope is NOT org-wide — see {@link visibleToHost}. That is the
+ * whole correction: this predicate is what `describeScope` renders and what
+ * `scopeCovers` and `narrowsScope` reason from, and while it answered `true`
+ * for a document nothing could see, the console said "All sites" over it.
+ */ export function isOrgWideScope(visibleTo) {
+    return visibleTo != null && visibleTo.includes(ORG_SCOPE_TOKEN);
+}
+/**
+ * Whether moving from `before` to `after` takes visibility away from any
+ * host — the direction that can break a published page, and the one the
+ * console confirms before saving (AGL-1044/AGL-1045).
+ */ export function narrowsScope(before, after) {
+    if (isOrgWideScope(before)) return !isOrgWideScope(after);
+    if (isOrgWideScope(after)) return false;
+    const kept = new Set(after != null ? after : []);
+    return (before != null ? before : []).some((token)=>!kept.has(token));
+}
+/**
+ * The sentence the console shows. `hostNames` maps host id → display name;
+ * ids missing from it fall back to the count wording, since a name we
+ * can't resolve is worse than no name.
+ */ export function describeScope(visibleTo, hostNames = {}) {
+    if (isOrgWideScope(visibleTo)) return 'All sites';
+    const hostIds = hostIdsFromScope(visibleTo != null ? visibleTo : []);
+    if (!hostIds.length) return 'No sites';
+    if (hostIds.length === 1) {
+        const name = hostNames[hostIds[0]];
+        return name ? `${name} only` : '1 site';
+    }
+    return `${hostIds.length} sites`;
+}
+/**
+ * The scope a newly created resource starts with (AGL-1048).
+ *
+ * Honours the org's `defaultResourceScope`, but only when a site is
+ * actually in context: created from the org Media or Data page there is no
+ * host to scope to, and inventing one would hide the resource from the
+ * page that just created it.
+ */ export function defaultScopeForNewResource(options) {
+    return options.defaultResourceScope === 'host' && options.hostId ? [
+        hostScopeToken(options.hostId)
+    ] : [
+        ORG_SCOPE_TOKEN
+    ];
+}
+/**
+ * The scope fields a document being CREATED in a scoped collection carries
+ * (AGL-1478), as a spreadable object.
+ *
+ * The argument is REQUIRED and has no default, which is the whole point.
+ * AGL-1466 was two call sites that each built a `mediaFolders` document
+ * inline and each forgot `visibleTo`; `newMediaFolderDoc` fixed that one
+ * collection by making the input mandatory, and this is the same guarantee
+ * for the collections that have no document constructor of their own —
+ * `datasets`, `media`, `contacts`, `contactSegments`. A creator that has
+ * not decided cannot compile.
+ *
+ * Three inputs, three meanings:
+ *
+ * - **tokens** — stamp them.
+ * - **`null`** — this collection is NOT scoped (a `hosts/{hostId}`
+ *   subcollection is private by construction), so store nothing. Saying it
+ *   out loud is what distinguishes "not applicable" from "forgotten".
+ * - **`[]`** — throws. Unlike a missing field, a stored empty array is a
+ *   written "visible to nobody": the backfill leaves it alone by design and
+ *   no read path treats it as legacy, so it is permanent where absent is
+ *   repairable. Getting here means a caller computed a scope and came back
+ *   with nothing, which is worth a stack trace.
+ */ export function newResourceScopeFields(visibleTo) {
+    if (visibleTo && !visibleTo.length) {
+        throw new Error('A scoped resource cannot be created with an empty scope');
+    }
+    return visibleTo ? {
+        visibleTo: [
+            ...visibleTo
+        ]
+    } : {};
+}
+/**
+ * Whether `target` is visible everywhere `source` is — the condition a
+ * cross-dataset REFERENCE has to satisfy (AGL-1044).
+ *
+ * A reference field on dataset A pointing at dataset B is only resolvable
+ * on the sites that can see BOTH. If A is shared with a site that cannot
+ * see B, a page there resolves the reference to nothing: the row renders
+ * with a blank where the linked value should be, and nothing says why. So
+ * B's scope must COVER A's.
+ *
+ * Org-wide covers everything. A missing scope is seen by nobody and
+ * therefore covers nothing, matching the rest of this module.
+ */ export function scopeCovers(target, source) {
+    if (isOrgWideScope(target)) return true;
+    // The target is restricted; an org-wide source reaches sites it cannot.
+    if (isOrgWideScope(source)) return false;
+    const reach = new Set(target != null ? target : []);
+    return (source != null ? source : []).every((token)=>reach.has(token));
+}
+/**
+ * Rewrites an org media CDN path so it names the site using the asset
+ * (AGL-1043/1045).
+ *
+ * `/api/media/cdn/org:{orgId}/{mediaId}` serves ORG-WIDE assets only. A
+ * restricted asset has to be requested through the form that names the
+ * site — `org:{orgId}:{hostId}` — because the CDN is unauthenticated and
+ * the URL is the only thing it can decide from.
+ *
+ * Returns the path untouched when there is nothing to do: an org-wide
+ * asset, a host-library asset, no host context, or a path that is not an
+ * org CDN URL. That keeps it safe to apply blindly at every pick site.
+ */ export function hostQualifiedCdnPath(cdnPath, visibleTo, hostId) {
+    if (!cdnPath) return cdnPath != null ? cdnPath : undefined;
+    if (!hostId || isOrgWideScope(visibleTo)) return cdnPath;
+    // `/api/media/cdn/{scope}/{mediaId}[/{hash}]`
+    const marker = '/api/media/cdn/';
+    const at = cdnPath.indexOf(marker);
+    if (at === -1) return cdnPath;
+    const head = cdnPath.slice(0, at + marker.length);
+    const rest = cdnPath.slice(at + marker.length);
+    const [scopeSegment, ...tail] = rest.split('/');
+    // Only the bare `org:{orgId}` form is rewritten; an already-qualified
+    // scope is left alone rather than gaining a second host.
+    if (!scopeSegment.startsWith('org:') || scopeSegment.includes(':', 4)) {
+        return cdnPath;
+    }
+    return [
+        `${head}${scopeSegment}:${hostId}`,
+        ...tail
+    ].join('/');
+}
+
+//# sourceMappingURL=scope-tokens.js.map

package/src/lib/app-utils/scope-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/scope-tokens.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Scoped sharing (AGL-1037): org-owned resources — datasets, media assets,\n * media folders — carry a `visibleTo` array naming who may see them, so an\n * agency can keep an internal dataset off its client sites without forking\n * storage into a second host-scoped collection (see AGL-237, which moved\n * these the other way).\n *\n * The shape is dictated by what both enforcement layers can evaluate:\n * Firestore rules have no `.map()`, so the caller's read set is denormalized\n * onto their member doc (AGL-1038) and matched with `list.hasAny(list)`;\n * clients match the same field with `array-contains-any`. A flat array of\n * strings is the only shape both primitives accept — the friendlier\n * `{ kind, hostIds }` form is a presentation concern and lives in\n * `describeScope` below, never on the doc.\n */\n\nimport type { ScopeToken } from '../foundation'\n\n// The type itself lives in foundation (app-utils imports foundation, never\n// the reverse) so the media doc interfaces can reference it; re-exported\n// here so callers get the type and its helpers from one place.\nexport type { ScopeToken }\n\n/** Everyone in the owning org, and every host it owns. */\nexport const ORG_SCOPE_TOKEN = 'org' as const satisfies ScopeToken\n\nconst HOST_TOKEN_PREFIX = 'host:'\n\n/**\n * `array-contains-any` and `hasAny` both cap at 30 values. That caps a\n * selected-sites scope at 30 hosts, and a collaborator's read query at 29\n * hosts plus `'org'`. Wider than that is the `['org']` case.\n */\nexport const MAX_SCOPE_HOSTS = 30\n\n/** `host:{hostId}` — the token naming a single site. */\nexport function hostScopeToken(hostId: string): ScopeToken {\n  return `${HOST_TOKEN_PREFIX}${hostId}`\n}\n\nexport function isScopeToken(value: unknown): value is ScopeToken {\n  if (typeof value !== 'string') return false\n  if (value === ORG_SCOPE_TOKEN) return true\n  return (\n    value.startsWith(HOST_TOKEN_PREFIX) &&\n    value.length > HOST_TOKEN_PREFIX.length\n  )\n}\n\n/** Reads a token back apart; null when it isn't one. */\nexport function parseScopeToken(\n  token: string\n): { kind: 'org' } | { kind: 'host'; hostId: string } | null {\n  if (token === ORG_SCOPE_TOKEN) return { kind: 'org' }\n  if (!isScopeToken(token)) return null\n  return { kind: 'host', hostId: token.slice(HOST_TOKEN_PREFIX.length) }\n}\n\n/** Every host id named by a scope, in order; `['org']` names none. */\nexport function hostIdsFromScope(\n  visibleTo: readonly string[] | undefined\n): string[] {\n  const ids: string[] = []\n  for (const token of visibleTo ?? []) {\n    const parsed = parseScopeToken(token)\n    if (parsed?.kind === 'host') ids.push(parsed.hostId)\n  }\n  return ids\n}\n\n/**\n * The read set for one site: what a server read path or a scoped client\n * query passes to `array-contains-any`. `'org'` is included because an\n * org-wide resource is visible to every host in the org.\n */\nexport function scopeTokensForHost(hostId: string): ScopeToken[] {\n  return [ORG_SCOPE_TOKEN, hostScopeToken(hostId)]\n}\n\n/**\n * Whether a host may see a resource.\n *\n * ## A missing `visibleTo` is visible to NOBODY\n *\n * It once read as org-wide, so that documents predating the scope backfill\n * stayed visible until it reached them. That default is the shape of failure\n * this codebase keeps paying for: **a read that cannot see a value answered\n * the same as a value that is absent.** \"This document was never scoped\" and\n * \"this document is shared with every site\" are different facts, and one\n * unscoped document under an agency account was one client's data on every\n * other client's site — silently, because the permissive answer is the one\n * nothing complains about.\n *\n * Both enforcement layers below this function already fail CLOSED on the\n * missing field: `array-contains-any` matches nothing on a document that\n * lacks the array, and the rules' `hasAny` is false for the same reason. So\n * the permissive default was never a policy either of them agreed with — it\n * was one TypeScript helper disagreeing with the database, which is what made\n * AGL-1466 invisible for three weeks.\n *\n * The migration is `tools/scripts/backfill-consent-host.mjs`, which stamps\n * `['org']` on the documents that should carry it. Until a document is\n * stamped it is hidden, and hiding is the recoverable direction.\n *\n * An **empty array** answers the same and always did.\n */\nexport function visibleToHost(\n  visibleTo: readonly string[] | undefined | null,\n  hostId: string\n): boolean {\n  if (visibleTo == null) return false\n  if (visibleTo.includes(ORG_SCOPE_TOKEN)) return true\n  return visibleTo.includes(hostScopeToken(hostId))\n}\n\n/**\n * Whether a caller holding `scopeTokens` (AGL-1038) may see a resource.\n * The TypeScript twin of the rules' `visibleTo.hasAny(scopeTokens)`, for\n * the Admin-SDK paths that never evaluate rules at all.\n *\n * A missing `visibleTo` is visible to nobody, for the reason\n * {@link visibleToHost} gives — and here the twinning is the argument on its\n * own: `hasAny` over a missing field is false in the rules, so a helper that\n * answered `true` was not a twin of anything.\n */\nexport function visibleToTokens(\n  visibleTo: readonly string[] | undefined | null,\n  scopeTokens: readonly string[] | undefined | null\n): boolean {\n  if (visibleTo == null) return false\n  if (!scopeTokens?.length) return false\n  return visibleTo.some((token) => scopeTokens.includes(token))\n}\n\n/**\n * The scope a document ACTUALLY carries — `null` when it carries none\n * (AGL-1466/AGL-1480).\n *\n * Every helper above this line answers \"may this be seen\", and answers it\n * the way both enforcement layers do: a missing `visibleTo` is seen by\n * nobody.\n *\n * An **editor** asks a different question — \"what did somebody choose\" —\n * and it still needs its own answer, because \"nobody chose\" and \"somebody\n * chose nobody\" are the same to an editor and different on the document.\n * Four call sites across two files each wrote their own\n *\n * ```ts\n * Array.isArray(doc.visibleTo) ? doc.visibleTo : [ORG_SCOPE_TOKEN]\n * ```\n *\n * and every one of them rendered \"All sites\" over a document no site could\n * see. That inversion is why AGL-1466 went three weeks unnoticed with the\n * folder tree missing from every host, and AGL-1480 is the third and fourth\n * copies of it turning up at the surface people use most.\n *\n * So: one function, the same lesson `newMediaFolderDoc` drew on the write\n * side. A caller that wants a display default may still `?? []` or\n * `?? [ORG_SCOPE_TOKEN]` — but it has to say so, in one visible place,\n * instead of a ternary that reads like a null check.\n *\n * An empty array answers `null` too. On the document the two differ, and\n * `newResourceScopeFields` refuses to WRITE one; to an editor they are the\n * same fact — nobody chose this — and both must offer the choice rather\n * than pre-fill an answer.\n *\n * Not normalized, deliberately. `normalizeVisibleTo` collapses for STORAGE;\n * doing it here would make an untouched editor differ from the document it\n * was seeded from, and the save gates compare exactly those two to decide\n * whether to write at all.\n */\nexport function storedScope(\n  visibleTo: readonly string[] | undefined | null\n): string[] | null {\n  return Array.isArray(visibleTo) && visibleTo.length ? [...visibleTo] : null\n}\n\n/**\n * Cleans a scope for storage: drops junk, dedupes, and collapses to\n * `['org']` when org-wide is present, since that already implies every\n * host. Returns null when the result is unusable — empty, or over\n * `MAX_SCOPE_HOSTS` — so the caller decides rather than this silently\n * dropping hosts (losing access) or widening to org (leaking).\n */\nexport function normalizeVisibleTo(\n  input: readonly string[] | undefined | null\n): ScopeToken[] | null {\n  const tokens = (input ?? []).filter(isScopeToken)\n  if (!tokens.length) return null\n  if (tokens.includes(ORG_SCOPE_TOKEN)) return [ORG_SCOPE_TOKEN]\n  const unique = [...new Set(tokens)]\n  if (unique.length > MAX_SCOPE_HOSTS) return null\n  return unique\n}\n\n/**\n * The scope a save writes, or why the selection cannot be written.\n *\n * {@link normalizeVisibleTo} answers null for a selection it cannot store, and\n * a save has no safe substitute for that null: the org token shares the\n * resource with every site, and dropping tokens takes access from sites\n * somebody picked. So a caller refuses the save and shows `problem`.\n */\nexport function scopeToStore(\n  input: readonly string[] | undefined | null\n): { scope: ScopeToken[]; problem: null } | { scope: null; problem: string } {\n  const scope = normalizeVisibleTo(input)\n  if (scope) return { scope, problem: null }\n  return {\n    scope: null,\n    problem: (input ?? []).some(isScopeToken)\n      ? `Choose ${MAX_SCOPE_HOSTS} sites or fewer, or share with All sites.`\n      : 'Choose at least one site, or share with All sites.',\n  }\n}\n\n/** A scope covering exactly the given hosts; null when unusable. */\nexport function scopeForHosts(\n  hostIds: readonly string[]\n): ScopeToken[] | null {\n  return normalizeVisibleTo(hostIds.map(hostScopeToken))\n}\n\n/**\n * Whether a scope is the org-wide one.\n *\n * An absent scope is NOT org-wide — see {@link visibleToHost}. That is the\n * whole correction: this predicate is what `describeScope` renders and what\n * `scopeCovers` and `narrowsScope` reason from, and while it answered `true`\n * for a document nothing could see, the console said \"All sites\" over it.\n */\nexport function isOrgWideScope(\n  visibleTo: readonly string[] | undefined | null\n): boolean {\n  return visibleTo != null && visibleTo.includes(ORG_SCOPE_TOKEN)\n}\n\n/**\n * Whether moving from `before` to `after` takes visibility away from any\n * host — the direction that can break a published page, and the one the\n * console confirms before saving (AGL-1044/AGL-1045).\n */\nexport function narrowsScope(\n  before: readonly string[] | undefined | null,\n  after: readonly string[] | undefined | null\n): boolean {\n  if (isOrgWideScope(before)) return !isOrgWideScope(after)\n  if (isOrgWideScope(after)) return false\n  const kept = new Set(after ?? [])\n  return (before ?? []).some((token) => !kept.has(token))\n}\n\n/**\n * The sentence the console shows. `hostNames` maps host id → display name;\n * ids missing from it fall back to the count wording, since a name we\n * can't resolve is worse than no name.\n */\nexport function describeScope(\n  visibleTo: readonly string[] | undefined | null,\n  hostNames: Readonly<Record<string, string>> = {}\n): string {\n  if (isOrgWideScope(visibleTo)) return 'All sites'\n  const hostIds = hostIdsFromScope(visibleTo ?? [])\n  if (!hostIds.length) return 'No sites'\n  if (hostIds.length === 1) {\n    const name = hostNames[hostIds[0]]\n    return name ? `${name} only` : '1 site'\n  }\n  return `${hostIds.length} sites`\n}\n\n/**\n * The scope a newly created resource starts with (AGL-1048).\n *\n * Honours the org's `defaultResourceScope`, but only when a site is\n * actually in context: created from the org Media or Data page there is no\n * host to scope to, and inventing one would hide the resource from the\n * page that just created it.\n */\nexport function defaultScopeForNewResource(options: {\n  defaultResourceScope?: 'org' | 'host'\n  hostId?: string | null\n}): ScopeToken[] {\n  return options.defaultResourceScope === 'host' && options.hostId\n    ? [hostScopeToken(options.hostId)]\n    : [ORG_SCOPE_TOKEN]\n}\n\n/**\n * The scope fields a document being CREATED in a scoped collection carries\n * (AGL-1478), as a spreadable object.\n *\n * The argument is REQUIRED and has no default, which is the whole point.\n * AGL-1466 was two call sites that each built a `mediaFolders` document\n * inline and each forgot `visibleTo`; `newMediaFolderDoc` fixed that one\n * collection by making the input mandatory, and this is the same guarantee\n * for the collections that have no document constructor of their own —\n * `datasets`, `media`, `contacts`, `contactSegments`. A creator that has\n * not decided cannot compile.\n *\n * Three inputs, three meanings:\n *\n * - **tokens** — stamp them.\n * - **`null`** — this collection is NOT scoped (a `hosts/{hostId}`\n *   subcollection is private by construction), so store nothing. Saying it\n *   out loud is what distinguishes \"not applicable\" from \"forgotten\".\n * - **`[]`** — throws. Unlike a missing field, a stored empty array is a\n *   written \"visible to nobody\": the backfill leaves it alone by design and\n *   no read path treats it as legacy, so it is permanent where absent is\n *   repairable. Getting here means a caller computed a scope and came back\n *   with nothing, which is worth a stack trace.\n */\nexport function newResourceScopeFields(\n  visibleTo: readonly ScopeToken[] | null\n): { visibleTo?: ScopeToken[] } {\n  if (visibleTo && !visibleTo.length) {\n    throw new Error('A scoped resource cannot be created with an empty scope')\n  }\n  return visibleTo ? { visibleTo: [...visibleTo] } : {}\n}\n\n/**\n * Whether `target` is visible everywhere `source` is — the condition a\n * cross-dataset REFERENCE has to satisfy (AGL-1044).\n *\n * A reference field on dataset A pointing at dataset B is only resolvable\n * on the sites that can see BOTH. If A is shared with a site that cannot\n * see B, a page there resolves the reference to nothing: the row renders\n * with a blank where the linked value should be, and nothing says why. So\n * B's scope must COVER A's.\n *\n * Org-wide covers everything. A missing scope is seen by nobody and\n * therefore covers nothing, matching the rest of this module.\n */\nexport function scopeCovers(\n  target: readonly string[] | undefined | null,\n  source: readonly string[] | undefined | null,\n): boolean {\n  if (isOrgWideScope(target)) return true\n  // The target is restricted; an org-wide source reaches sites it cannot.\n  if (isOrgWideScope(source)) return false\n  const reach = new Set(target ?? [])\n  return (source ?? []).every((token) => reach.has(token))\n}\n\n/**\n * Rewrites an org media CDN path so it names the site using the asset\n * (AGL-1043/1045).\n *\n * `/api/media/cdn/org:{orgId}/{mediaId}` serves ORG-WIDE assets only. A\n * restricted asset has to be requested through the form that names the\n * site — `org:{orgId}:{hostId}` — because the CDN is unauthenticated and\n * the URL is the only thing it can decide from.\n *\n * Returns the path untouched when there is nothing to do: an org-wide\n * asset, a host-library asset, no host context, or a path that is not an\n * org CDN URL. That keeps it safe to apply blindly at every pick site.\n */\nexport function hostQualifiedCdnPath(\n  cdnPath: string | undefined | null,\n  visibleTo: readonly string[] | undefined | null,\n  hostId: string | undefined | null,\n): string | undefined {\n  if (!cdnPath) return cdnPath ?? undefined\n  if (!hostId || isOrgWideScope(visibleTo)) return cdnPath\n  // `/api/media/cdn/{scope}/{mediaId}[/{hash}]`\n  const marker = '/api/media/cdn/'\n  const at = cdnPath.indexOf(marker)\n  if (at === -1) return cdnPath\n  const head = cdnPath.slice(0, at + marker.length)\n  const rest = cdnPath.slice(at + marker.length)\n  const [scopeSegment, ...tail] = rest.split('/')\n  // Only the bare `org:{orgId}` form is rewritten; an already-qualified\n  // scope is left alone rather than gaining a second host.\n  if (!scopeSegment.startsWith('org:') || scopeSegment.includes(':', 4)) {\n    return cdnPath\n  }\n  return [`${head}${scopeSegment}:${hostId}`, ...tail].join('/')\n}\n"],"names":["ORG_SCOPE_TOKEN","HOST_TOKEN_PREFIX","MAX_SCOPE_HOSTS","hostScopeToken","hostId","isScopeToken","value","startsWith","length","parseScopeToken","token","kind","slice","hostIdsFromScope","visibleTo","ids","parsed","push","scopeTokensForHost","visibleToHost","includes","visibleToTokens","scopeTokens","some","storedScope","Array","isArray","normalizeVisibleTo","input","tokens","filter","unique","Set","scopeToStore","scope","problem","scopeForHosts","hostIds","map","isOrgWideScope","narrowsScope","before","after","kept","has","describeScope","hostNames","name","defaultScopeForNewResource","options","defaultResourceScope","newResourceScopeFields","Error","scopeCovers","target","source","reach","every","hostQualifiedCdnPath","cdnPath","undefined","marker","at","indexOf","head","rest","scopeSegment","tail","split","join"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;CAcC,GASD,wDAAwD,GACxD,OAAO,MAAMA,kBAAkB,MAAmC;AAElE,MAAMC,oBAAoB;AAE1B;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB,GAAE;AAEjC,sDAAsD,GACtD,OAAO,SAASC,eAAeC,MAAc;IAC3C,OAAO,GAAGH,oBAAoBG,QAAQ;AACxC;AAEA,OAAO,SAASC,aAAaC,KAAc;IACzC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,IAAIA,UAAUN,iBAAiB,OAAO;IACtC,OACEM,MAAMC,UAAU,CAACN,sBACjBK,MAAME,MAAM,GAAGP,kBAAkBO,MAAM;AAE3C;AAEA,sDAAsD,GACtD,OAAO,SAASC,gBACdC,KAAa;IAEb,IAAIA,UAAUV,iBAAiB,OAAO;QAAEW,MAAM;IAAM;IACpD,IAAI,CAACN,aAAaK,QAAQ,OAAO;IACjC,OAAO;QAAEC,MAAM;QAAQP,QAAQM,MAAME,KAAK,CAACX,kBAAkBO,MAAM;IAAE;AACvE;AAEA,oEAAoE,GACpE,OAAO,SAASK,iBACdC,SAAwC;IAExC,MAAMC,MAAgB,EAAE;IACxB,KAAK,MAAML,SAASI,oBAAAA,YAAa,EAAE,CAAE;QACnC,MAAME,SAASP,gBAAgBC;QAC/B,IAAIM,CAAAA,0BAAAA,OAAQL,IAAI,MAAK,QAAQI,IAAIE,IAAI,CAACD,OAAOZ,MAAM;IACrD;IACA,OAAOW;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASG,mBAAmBd,MAAc;IAC/C,OAAO;QAACJ;QAAiBG,eAAeC;KAAQ;AAClD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASe,cACdL,SAA+C,EAC/CV,MAAc;IAEd,IAAIU,aAAa,MAAM,OAAO;IAC9B,IAAIA,UAAUM,QAAQ,CAACpB,kBAAkB,OAAO;IAChD,OAAOc,UAAUM,QAAQ,CAACjB,eAAeC;AAC3C;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASiB,gBACdP,SAA+C,EAC/CQ,WAAiD;IAEjD,IAAIR,aAAa,MAAM,OAAO;IAC9B,IAAI,EAACQ,+BAAAA,YAAad,MAAM,GAAE,OAAO;IACjC,OAAOM,UAAUS,IAAI,CAAC,CAACb,QAAUY,YAAYF,QAAQ,CAACV;AACxD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCC,GACD,OAAO,SAASc,YACdV,SAA+C;IAE/C,OAAOW,MAAMC,OAAO,CAACZ,cAAcA,UAAUN,MAAM,GAAG;WAAIM;KAAU,GAAG;AACzE;AAEA;;;;;;CAMC,GACD,OAAO,SAASa,mBACdC,KAA2C;IAE3C,MAAMC,SAAS,CAACD,gBAAAA,QAAS,EAAE,EAAEE,MAAM,CAACzB;IACpC,IAAI,CAACwB,OAAOrB,MAAM,EAAE,OAAO;IAC3B,IAAIqB,OAAOT,QAAQ,CAACpB,kBAAkB,OAAO;QAACA;KAAgB;IAC9D,MAAM+B,SAAS;WAAI,IAAIC,IAAIH;KAAQ;IACnC,IAAIE,OAAOvB,MAAM,GAAGN,iBAAiB,OAAO;IAC5C,OAAO6B;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASE,aACdL,KAA2C;IAE3C,MAAMM,QAAQP,mBAAmBC;IACjC,IAAIM,OAAO,OAAO;QAAEA;QAAOC,SAAS;IAAK;IACzC,OAAO;QACLD,OAAO;QACPC,SAAS,CAACP,gBAAAA,QAAS,EAAE,EAAEL,IAAI,CAAClB,gBACxB,CAAC,OAAO,EAAEH,gBAAgB,yCAAyC,CAAC,GACpE;IACN;AACF;AAEA,kEAAkE,GAClE,OAAO,SAASkC,cACdC,OAA0B;IAE1B,OAAOV,mBAAmBU,QAAQC,GAAG,CAACnC;AACxC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASoC,eACdzB,SAA+C;IAE/C,OAAOA,aAAa,QAAQA,UAAUM,QAAQ,CAACpB;AACjD;AAEA;;;;CAIC,GACD,OAAO,SAASwC,aACdC,MAA4C,EAC5CC,KAA2C;IAE3C,IAAIH,eAAeE,SAAS,OAAO,CAACF,eAAeG;IACnD,IAAIH,eAAeG,QAAQ,OAAO;IAClC,MAAMC,OAAO,IAAIX,IAAIU,gBAAAA,QAAS,EAAE;IAChC,OAAO,CAACD,iBAAAA,SAAU,EAAE,EAAElB,IAAI,CAAC,CAACb,QAAU,CAACiC,KAAKC,GAAG,CAAClC;AAClD;AAEA;;;;CAIC,GACD,OAAO,SAASmC,cACd/B,SAA+C,EAC/CgC,YAA8C,CAAC,CAAC;IAEhD,IAAIP,eAAezB,YAAY,OAAO;IACtC,MAAMuB,UAAUxB,iBAAiBC,oBAAAA,YAAa,EAAE;IAChD,IAAI,CAACuB,QAAQ7B,MAAM,EAAE,OAAO;IAC5B,IAAI6B,QAAQ7B,MAAM,KAAK,GAAG;QACxB,MAAMuC,OAAOD,SAAS,CAACT,OAAO,CAAC,EAAE,CAAC;QAClC,OAAOU,OAAO,GAAGA,KAAK,KAAK,CAAC,GAAG;IACjC;IACA,OAAO,GAAGV,QAAQ7B,MAAM,CAAC,MAAM,CAAC;AAClC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASwC,2BAA2BC,OAG1C;IACC,OAAOA,QAAQC,oBAAoB,KAAK,UAAUD,QAAQ7C,MAAM,GAC5D;QAACD,eAAe8C,QAAQ7C,MAAM;KAAE,GAChC;QAACJ;KAAgB;AACvB;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,SAASmD,uBACdrC,SAAuC;IAEvC,IAAIA,aAAa,CAACA,UAAUN,MAAM,EAAE;QAClC,MAAM,IAAI4C,MAAM;IAClB;IACA,OAAOtC,YAAY;QAAEA,WAAW;eAAIA;SAAU;IAAC,IAAI,CAAC;AACtD;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASuC,YACdC,MAA4C,EAC5CC,MAA4C;IAE5C,IAAIhB,eAAee,SAAS,OAAO;IACnC,wEAAwE;IACxE,IAAIf,eAAegB,SAAS,OAAO;IACnC,MAAMC,QAAQ,IAAIxB,IAAIsB,iBAAAA,SAAU,EAAE;IAClC,OAAO,CAACC,iBAAAA,SAAU,EAAE,EAAEE,KAAK,CAAC,CAAC/C,QAAU8C,MAAMZ,GAAG,CAAClC;AACnD;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASgD,qBACdC,OAAkC,EAClC7C,SAA+C,EAC/CV,MAAiC;IAEjC,IAAI,CAACuD,SAAS,OAAOA,kBAAAA,UAAWC;IAChC,IAAI,CAACxD,UAAUmC,eAAezB,YAAY,OAAO6C;IACjD,8CAA8C;IAC9C,MAAME,SAAS;IACf,MAAMC,KAAKH,QAAQI,OAAO,CAACF;IAC3B,IAAIC,OAAO,CAAC,GAAG,OAAOH;IACtB,MAAMK,OAAOL,QAAQ/C,KAAK,CAAC,GAAGkD,KAAKD,OAAOrD,MAAM;IAChD,MAAMyD,OAAON,QAAQ/C,KAAK,CAACkD,KAAKD,OAAOrD,MAAM;IAC7C,MAAM,CAAC0D,cAAc,GAAGC,KAAK,GAAGF,KAAKG,KAAK,CAAC;IAC3C,sEAAsE;IACtE,yDAAyD;IACzD,IAAI,CAACF,aAAa3D,UAAU,CAAC,WAAW2D,aAAa9C,QAAQ,CAAC,KAAK,IAAI;QACrE,OAAOuC;IACT;IACA,OAAO;QAAC,GAAGK,OAAOE,aAAa,CAAC,EAAE9D,QAAQ;WAAK+D;KAAK,CAACE,IAAI,CAAC;AAC5D"}

package/src/lib/app-utils/screen-link-context-value.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Host routing map: screen id → routed path in the tenant matcher format
+ * (root is `'/'`, nested paths are slash-joined segments WITHOUT a leading
+ * slash, e.g. `company/about`). This is the `screens` field of the host
+ * document — the single source of truth kept current by the publish and
+ * hierarchy flows.
+ */
+export type ScreenRouteMap = Record<string, string>;
+export interface ScreenLinkContextValue {
+    /** Routing map hrefs are resolved against. Absent → nothing resolves. */
+    screens?: ScreenRouteMap;
+    /** Optional display names by screen id, for editor-facing pickers. */
+    labels?: Record<string, string>;
+    /**
+     * True inside editing surfaces (besigner canvas, preview): screen links
+     * render their content but must not navigate.
+     */
+    suppressNavigation?: boolean;
+    /**
+     * True ONLY on the static besigner canvas (AGL-830): interactions are
+     * inert and command-bus-driven elements (nav menus, drawers) render their
+     * editor affordance instead of the live popup. The Preview surface leaves
+     * this falsy — it suppresses navigation but runs interactions for real, so
+     * a hover-to-open mega menu behaves exactly like the live site. Split out
+     * of {@link suppressNavigation}, which now means only "links don't navigate".
+     */
+    editorInert?: boolean;
+    /** Current screen's translations: locale → screen id (AGL-164). */
+    localeVariants?: Record<string, string>;
+    /** Locale of the screen being rendered (AGL-164). */
+    currentLocale?: string;
+}
+/**
+ * Render-time resolution context for id-based screen links: canvas nodes
+ * persist a screen id, never a path, so slug renames and re-parenting can't
+ * break links. Provided by the tenant page (map from static props, refreshed
+ * by ISR) and by the console's besigner/preview surfaces (map from the live
+ * host doc subscription, navigation suppressed). Context crosses the canvas
+ * shadow DOM because the shadow root renders through a React portal.
+ */
+export declare const ScreenLinkContext: import("react").Context<ScreenLinkContextValue>;

package/src/lib/app-utils/screen-link-context-value.js

@@ -0,0 +1,43 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The render-time screen-link context, and the shape it carries.
+ *
+ * Its own module because a published page provides this context and reads
+ * nothing else here: the map goes in at the top of the tree and the canvas
+ * nodes below resolve their hrefs from it. `screen-link-context.ts` around it
+ * is the resolution machinery every editing surface needs — the broken-link
+ * verdict and its styling, the unavailable-screen labels, the href resolver,
+ * the link-value splitter and the two hooks — and through
+ * `screen-link-value.ts` the persisted link grammar as well. A bundler cannot
+ * drop that around a single named import.
+ *
+ * No `'use client'` banner, for the reason `screen-link-context.ts` records:
+ * inside this package the directive forks the module graph, and a second
+ * copy of the context is a second context — providers on one, consumers on
+ * the other, and every link resolving to nothing.
+ */ import { createContext } from "react";
+/**
+ * Render-time resolution context for id-based screen links: canvas nodes
+ * persist a screen id, never a path, so slug renames and re-parenting can't
+ * break links. Provided by the tenant page (map from static props, refreshed
+ * by ISR) and by the console's besigner/preview surfaces (map from the live
+ * host doc subscription, navigation suppressed). Context crosses the canvas
+ * shadow DOM because the shadow root renders through a React portal.
+ */ export const ScreenLinkContext = createContext({});
+ScreenLinkContext.displayName = 'ScreenLinkContext';
+
+//# sourceMappingURL=screen-link-context-value.js.map

package/src/lib/app-utils/screen-link-context-value.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-link-context-value.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The render-time screen-link context, and the shape it carries.\n *\n * Its own module because a published page provides this context and reads\n * nothing else here: the map goes in at the top of the tree and the canvas\n * nodes below resolve their hrefs from it. `screen-link-context.ts` around it\n * is the resolution machinery every editing surface needs — the broken-link\n * verdict and its styling, the unavailable-screen labels, the href resolver,\n * the link-value splitter and the two hooks — and through\n * `screen-link-value.ts` the persisted link grammar as well. A bundler cannot\n * drop that around a single named import.\n *\n * No `'use client'` banner, for the reason `screen-link-context.ts` records:\n * inside this package the directive forks the module graph, and a second\n * copy of the context is a second context — providers on one, consumers on\n * the other, and every link resolving to nothing.\n */\n\nimport { createContext } from 'react'\n\n/**\n * Host routing map: screen id → routed path in the tenant matcher format\n * (root is `'/'`, nested paths are slash-joined segments WITHOUT a leading\n * slash, e.g. `company/about`). This is the `screens` field of the host\n * document — the single source of truth kept current by the publish and\n * hierarchy flows.\n */\nexport type ScreenRouteMap = Record<string, string>\n\nexport interface ScreenLinkContextValue {\n  /** Routing map hrefs are resolved against. Absent → nothing resolves. */\n  screens?: ScreenRouteMap\n  /** Optional display names by screen id, for editor-facing pickers. */\n  labels?: Record<string, string>\n  /**\n   * True inside editing surfaces (besigner canvas, preview): screen links\n   * render their content but must not navigate.\n   */\n  suppressNavigation?: boolean\n  /**\n   * True ONLY on the static besigner canvas (AGL-830): interactions are\n   * inert and command-bus-driven elements (nav menus, drawers) render their\n   * editor affordance instead of the live popup. The Preview surface leaves\n   * this falsy — it suppresses navigation but runs interactions for real, so\n   * a hover-to-open mega menu behaves exactly like the live site. Split out\n   * of {@link suppressNavigation}, which now means only \"links don't navigate\".\n   */\n  editorInert?: boolean\n  /** Current screen's translations: locale → screen id (AGL-164). */\n  localeVariants?: Record<string, string>\n  /** Locale of the screen being rendered (AGL-164). */\n  currentLocale?: string\n}\n\n/**\n * Render-time resolution context for id-based screen links: canvas nodes\n * persist a screen id, never a path, so slug renames and re-parenting can't\n * break links. Provided by the tenant page (map from static props, refreshed\n * by ISR) and by the console's besigner/preview surfaces (map from the live\n * host doc subscription, navigation suppressed). Context crosses the canvas\n * shadow DOM because the shadow root renders through a React portal.\n */\nexport const ScreenLinkContext = createContext<ScreenLinkContextValue>({})\nScreenLinkContext.displayName = 'ScreenLinkContext'\n"],"names":["createContext","ScreenLinkContext","displayName"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;CAgBC,GAED,SAASA,aAAa,QAAQ,QAAO;AAoCrC;;;;;;;CAOC,GACD,OAAO,MAAMC,oBAAoBD,cAAsC,CAAC,GAAE;AAC1EC,kBAAkBC,WAAW,GAAG"}