@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/server.js

@@ -0,0 +1,314 @@
+/**
+ * @license
+ * Copyright 2022 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Server-safe app-utils: every app-util EXCEPT the client-only React
+ * contexts (see ./contexts). Nothing here calls `createContext` at module
+ * scope, so this barrel — re-exported by `@aglyn/aglyn/server` — is safe to
+ * import from tenant Server Components (AGL-405). The full `./index` barrel
+ * re-adds the contexts for client consumers.
+ */ export * from "./binding-token-catalog.js";
+export * from "./binding-tokens.js";
+export * from "./breadcrumb-json-ld.js";
+// What a search listing holds and how long each field may be (AGL-2910):
+// the SEO editors and anything that proposes a value read one catalog.
+export * from "./seo-listing-fields.js";
+// `VideoObject` for the Video elements a page actually ships (AGL-2747).
+// Beside the other structured-data builders, and server-only like them: only
+// the route emits JSON-LD, and a crawler-facing block has no client caller.
+export * from "./video-object.js";
+export * from "./collection-delete.js";
+export * from "./collection-entries.js";
+export * from "./collection-kind.js";
+export * from "./collection-slug.js";
+export * from "./content-authors.js";
+export * from "./content-schema-type.js";
+export * from "./content-author-profile.js";
+export * from "./url-slug.js";
+export * from "./child-contract.js";
+export * from "./child-contract-compose.js";
+// The one reading of `restrictChildren`/`restrictParent`, shared by the
+// besigner's drop check and the AI plugin's node-tree validator (AGL-2905).
+export * from "./lineal-order.js";
+// What a node tree must satisfy before it lands on a canvas that did not
+// author it (AGL-2939): the marketplace's install sanitizer and the AI
+// plugin's node-tree validator both pass through it.
+export * from "./node-definition-sanitizer.js";
+export * from "./console-routes.js";
+export * from "./console-record-links.js";
+// What a stored screen-link value means, with no React attached — the
+// where-used scan reads these on the server (AGL-703).
+export * from "./screen-link-value.js";
+// Which entries a page's links name (AGL-3118). The tenant render reads
+// exactly those entry documents, so the walk runs on the server.
+export * from "./link-references.js";
+export * from "./analytics-path-key.js";
+export * from "./contacts.js";
+// The records that sit beside a contact — companies, pipelines, deals, tasks,
+// activities, field definitions (AGL-2595). Pure like `contacts`, and beside
+// it because `ContactFacet` names its lifecycle stage and custom-value types;
+// the scope stamp every CRM creator writes lives here too.
+export * from "./crm.js";
+// Email templates, snippets and the merge-field resolver (AGL-2658): the
+// letter a rep keeps under a name, and the one grammar the send route and
+// the dialog fill it in by. Pure like `crm`, and beside it because a
+// template is scoped the way a task is.
+export * from "./crm-email-templates.js";
+// The booking door's shared vocabulary (AGL-2660): the query keys a booking
+// link carries, the record reference inside it, and the wording and due
+// date of what a booking files back on the record.
+export * from "./crm-booking.js";
+// Two contact documents folded into one (AGL-2625): the plan the console
+// previews and the server writes, reading the facet shape from `contacts`
+// and the company mirror from `crm`.
+export * from "./contact-merge.js";
+// A person's privacy erasure from one workspace (AGL-2623): the request's
+// shape and id, the marker a record carries while it waits, and the lists
+// the dialog and the docs share. Pure like `crm`; the sweep is server-side.
+export * from "./person-erasure.js";
+// What the CRM's reports compute from what they read — periods, weekly
+// buckets, the lifecycle funnel, pipeline totals (AGL-2604). Pure like `crm`,
+// and beside it because it reads the stage list and the deal weighting from
+// there rather than restating either.
+export * from "./crm-reports.js";
+// Every CRM CSV, written once (AGL-2662): the column lists and the cells
+// each section's Export button writes, and the server's whole-collection
+// export streams — one implementation, because the console app may not
+// import the plugin whose sections used to hold it.
+export * from "./crm-csv.js";
+// Which holder a cross-site reader sees one contact through (AGL-2630),
+// beside the files that write it: the org-level list and the server's
+// export both flatten a contact this way.
+export * from "./contact-holder.js";
+// What one member is owed this morning — the day's window in a named zone,
+// the task and lead bucketing, and the words the notification and the mail
+// say (AGL-2619). Pure like `crm-reports`, read by the scheduled route.
+export * from "./crm-digest.js";
+// A task's reminder at its own time (AGL-2659): which reminder a save
+// leaves, whether one is owed, and the words the notification and the mail
+// say. Pure like `crm-digest`, read by the hourly route and by every
+// writer of the field.
+export * from "./crm-task-reminders.js";
+// Email capture (AGL-2657): the address's shape and token, which of a
+// message's addresses is the correspondent, the excerpt, and the row a
+// captured message becomes. Pure like `crm-digest`; the webhook route and
+// the address route are the readers with Firestore.
+export * from "./crm-inbound.js";
+// A member's own addresses in a workspace (AGL-2975): the ones they have
+// confirmed count as theirs wherever the roster is asked who wrote a
+// message. Pure; the store and the confirmation link are server-side.
+export * from "./member-email-aliases.js";
+// The next activity a record carries (AGL-2661): what `nextTaskAtMs` IS given
+// a record's open tasks, the view clause a list filters on, the report figure.
+// Pure like `crm`; the admin library's `recomputeCrmNextTaskAt` is the writer.
+export * from "./crm-next-activity.js";
+// The CSV cell grammar the exports write with (AGL-2621), and the target a
+// mapped column names for a custom field — named rather than starred, because
+// an importer built on this file exports the shared ceilings under its own
+// names.
+export { csvCell, csvDocument, customImportTarget, customImportTargetKey } from "./csv-import.js";
+// What a VALUE under a custom contact field may be, and the coercion every
+// door applies to one (AGL-2601): a mapped form field, an API `custom` body,
+// and the carry-over that keeps a mapping across a publish. Pure like `crm`.
+export * from "./contact-custom-fields.js";
+// The consent JOIN (`docs/specs/email-overhaul.md` §3f). Pure, and it composes
+// `contacts` for the normalizer, so it sits directly beside it. No Node
+// builtin, which is what keeps it out of the `/server`-only group `person-key`
+// belongs to.
+export * from "./consent-groups.js";
+export * from "./marketing-consent.js";
+// The ENROLLMENT-time half of the same question, beside its reader for the
+// same reason: `marketing-consent` decides whether a recorded basis lets us
+// mail somebody, and this decides what basis putting them on a list may
+// record. Two enrollment surfaces import it — the Inbox assignment route and
+// the Emails console's audience card — and neither could import the other.
+export * from "./list-assignment-policy.js";
+// Reading the FILE a merchant arrives with (`docs/specs/email-competitive-gaps.md`
+// G5/P4), directly after the policy it hands its addresses to: parsing and
+// mechanical screening only, so that an import asks the enrollment question
+// through the same module the one-address add path asks it through rather
+// than answering it a second way.
+export * from "./list-import.js";
+// The dynamic-list rule (§3b/§3c), beside it for the same reasons: pure, and
+// it composes `contacts` for the segment vocabulary rather than restating it.
+export * from "./dynamic-list-rule.js";
+// The subscribable streams a recipient can leave one at a time
+// (`docs/specs/email-competitive-gaps.md` §1f). Pure, and read from all three
+// sides of the feature: the composer picks one, the send path signs it into
+// the unsubscribe link, and the unauthenticated preference page renders the
+// catalog. No Node builtin, so it stays out of the `/server`-only group.
+export * from "./email-topics.js";
+export * from "./compose-layout-nodes.js";
+// Layout properties applied through the chain (AGL-2893).
+export * from "./compose-layout-props.js";
+export * from "./document-landmark.js";
+export * from "./functions.js";
+export * from "./compose-reusable-components.js";
+export * from "./compress.js";
+export * from "./merge-node-sx.js";
+export * from "./palette-sx.js";
+export * from "./scheme-sx.js";
+export * from "./create-resource-uid.js";
+export * from "./decompress.js";
+export * from "./stored-nodes.js";
+export * from "./strip-undefined.js";
+export * from "./organizations.js";
+export * from "./org-permissions.js";
+// The AI verdict on either membership axis (AGL-2927). After both modules it
+// composes: the org catalog for org-wide members, the host role for site
+// collaborators.
+export * from "./host-permissions.js";
+export * from "./password-policy.js";
+export * from "./idp-profile.js";
+export * from "./onboarding-deep-link.js";
+// Where an account came from (AGL-1731). Beside the plan intent because
+// they are the same hop — the marketing CTA's query string — and both are
+// remembered on `users/{uid}` across the verification wall.
+export * from "./campaign-attribution.js";
+// The edge between a campaign and the forms, screens and contacts a push is
+// coordinated across. Beside the attribution above because the two answer
+// opposite questions about the same word: attribution records where somebody
+// CAME from, this records what a merchant DECLARED belongs together.
+export * from "./campaign-membership.js";
+export * from "./deployment-shape.js";
+// Which browser origins may complete a signed direct-to-GCS upload (AGL-1452).
+// GCS matches the origin list EXACTLY, so every serving console name needs its
+// own entry — the rule nobody could be expected to remember at attach time.
+export * from "./upload-cors.js";
+// The docs-help subset the first-party plugin consoles read (AGL-2213) — the
+// console's own registry lives in apps/console/constants and a lib cannot
+// import an app.
+export * from "./docs-help.js";
+export * from "./platform-brand.js";
+export * from "./plan-entitlements.js";
+// The free plan's bandwidth hard cap (AGL-1967/2070/2155). After
+// `plan-entitlements`, which owns the predicate it keys off.
+export * from "./bandwidth-cap.js";
+export * from "./form-abuse-ceiling.js";
+export * from "./forms.js";
+// What a form's DESIGN must still satisfy for its submissions to arrive.
+// After `forms`, whose field walk it reads the drawn fields with.
+export * from "./form-contract.js";
+export * from "./visitor-record-ceiling.js";
+export * from "./health-report.js";
+// Did a webhook delivery actually DO anything (AGL-1954)? After
+// `health-report`, whose billing verdict consumes the counts this produces.
+export * from "./webhook-delivery.js";
+export * from "./support-tiers.js";
+export * from "./release-flags.js";
+// Who runs THIS deployment, and where its notices go (AGL-2016). Ordered
+// before the four surfaces that print it, all of which used to declare their
+// own `support@aglyn.com` literal.
+export * from "./operator-identity.js";
+export * from "./lockdown.js";
+export * from "./media-quarantine.js";
+export * from "./media-takedown-reach.js";
+export * from "./upload-inspection.js";
+export * from "./abuse-report.js";
+// The other three quarters of §512 (AGL-1983): the put-back procedure that
+// answers a notice, and the strike ledger that conditions the safe harbour.
+export * from "./dmca-counter-notice.js";
+export * from "./repeat-infringer.js";
+// `addBusinessDays` briefly existed TWICE — once here in './support-tiers'
+// and once in './dmca-counter-notice' — and two `export *` made the name
+// ambiguous, TS2308'ing this barrel and every tsconfig that reads it. The
+// interleave was fixed twice in parallel: once by naming a winner here, and
+// once by deleting the second definition so './dmca-counter-notice' imports
+// this one. Only the deletion survives, so the disambiguating re-export that
+// stood on this line is gone with it — `export *` is unambiguous again.
+//
+// The concern that argued for keeping two copies is worth answering rather
+// than dropping: a later tweak to the SUPPORT SLA window must never silently
+// move the §512(g)(2)(C) put-back deadline. It cannot. This function embeds
+// no window — it is "add N business days", and N is the argument. The two
+// windows live in their own constants (`SUPPORT_*` there,
+// `COUNTER_NOTICE_*_BUSINESS_DAYS` in the DMCA module) and never meet. What
+// SHOULD stay shared is the day arithmetic itself: two copies of a weekend
+// rule are two chances to disagree about which day a deadline falls on.
+export * from "./org-override-reason.js";
+export * from "./host-tokens.js";
+export * from "./variables.js";
+export * from "./workflows.js";
+export * from "./datasets.js";
+export * from "./expand-repeatables.js";
+export * from "./org-roles.js";
+export * from "./markdown-lite.js";
+export * from "./notifications.js";
+export * from "./definition-canvas-tree.js";
+export * from "./ensure-canvas-root.js";
+export * from "./repair-canvas-nodes.js";
+export * from "./detect-template-placeholders.js";
+export * from "./guarded-version-save.js";
+export * from "./local-storage-budget.js";
+export * from "./measure-node-map.js";
+export * from "./resolve-named-tokens.js";
+export * from "./screen-route.js";
+export * from "./host-naming.js";
+export * from "./marketplace-verification.js";
+export * from "./name-search.js";
+export * from "./name-match.js";
+export * from "./api-plugins.js";
+export * from "./plugin-api-rate-limit.js";
+// The same-origin gate on visitor-facing plugin writes (AGL-1880). After
+// `plugin-api-rate-limit`, whose `isMachinePluginApiPath` it reuses so the
+// two gates exempt exactly the same machine surfaces.
+export * from "./plugin-api-cross-origin.js";
+export * from "./actions.js";
+export * from "./element-animation.js";
+export * from "./attribution-guard.js";
+export * from "./node-interactions.js";
+export * from "./element-ui.js";
+export * from "./image-upload-types.js";
+export * from "./sanitize-svg.js";
+export * from "./media-folders.js";
+export * from "./media-metadata.js";
+export * from "./media-ref.js";
+// After `media-ref`, whose reference grammar it reads stored URLs with.
+export * from "./paid-media-source.js";
+export * from "./author-css.js";
+// The isomorphic HTML rule (AGL-1901), after the CSS one it depends on.
+export * from "./author-html.js";
+export * from "./dataset-models.js";
+export * from "./dataset-csv.js";
+export * from "./marketplace-provenance.js";
+export * from "./marketplace-update-state.js";
+export * from "./dataset-query.js";
+export * from "./plugin-manifest.js";
+// After `plugin-manifest`, whose revocation predicates it asks the kill
+// question with, and after `media-ref`, whose grammar decides what counts as a
+// first-party image.
+export * from "./email-starter-policy.js";
+export * from "./safe-json-ld.js";
+// Agent readiness (AGL-2716): content negotiation, the Markdown rendering of a
+// page, `/llms.txt` and the per-site OpenAPI document. All pure, all server-safe.
+export * from "./accept-negotiation.js";
+export * from "./agent-api-catalog.js";
+export * from "./agent-openapi.js";
+export * from "./author-html-markdown.js";
+export * from "./llms-txt.js";
+export * from "./page-markdown.js";
+export * from "./request-geo.js";
+export * from "./request-ip.js";
+export * from "./search-indexing.js";
+export * from "./seo-title.js";
+export * from "./sitemap.js";
+export * from "./visitor-consent.js";
+export * from "./social-image.js";
+export * from "./scope-tokens.js";
+export * from "./org-billing-doc.js";
+export * from "./stripe-deployment-mode.js";
+export * from "./deferred-image.js";
+
+//# sourceMappingURL=server.js.map

package/src/lib/app-utils/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/server.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Server-safe app-utils: every app-util EXCEPT the client-only React\n * contexts (see ./contexts). Nothing here calls `createContext` at module\n * scope, so this barrel — re-exported by `@aglyn/aglyn/server` — is safe to\n * import from tenant Server Components (AGL-405). The full `./index` barrel\n * re-adds the contexts for client consumers.\n */\nexport * from './binding-token-catalog'\nexport * from './binding-tokens'\nexport * from './breadcrumb-json-ld'\n// What a search listing holds and how long each field may be (AGL-2910):\n// the SEO editors and anything that proposes a value read one catalog.\nexport * from './seo-listing-fields'\n// `VideoObject` for the Video elements a page actually ships (AGL-2747).\n// Beside the other structured-data builders, and server-only like them: only\n// the route emits JSON-LD, and a crawler-facing block has no client caller.\nexport * from './video-object'\nexport * from './collection-delete'\nexport * from './collection-entries'\nexport * from './collection-kind'\nexport * from './collection-slug'\nexport * from './content-authors'\nexport * from './content-schema-type'\nexport * from './content-author-profile'\nexport * from './url-slug'\nexport * from './child-contract'\nexport * from './child-contract-compose'\n// The one reading of `restrictChildren`/`restrictParent`, shared by the\n// besigner's drop check and the AI plugin's node-tree validator (AGL-2905).\nexport * from './lineal-order'\n// What a node tree must satisfy before it lands on a canvas that did not\n// author it (AGL-2939): the marketplace's install sanitizer and the AI\n// plugin's node-tree validator both pass through it.\nexport * from './node-definition-sanitizer'\nexport * from './console-routes'\nexport * from './console-record-links'\n// What a stored screen-link value means, with no React attached — the\n// where-used scan reads these on the server (AGL-703).\nexport * from './screen-link-value'\n// Which entries a page's links name (AGL-3118). The tenant render reads\n// exactly those entry documents, so the walk runs on the server.\nexport * from './link-references'\nexport * from './analytics-path-key'\nexport * from './contacts'\n// The records that sit beside a contact — companies, pipelines, deals, tasks,\n// activities, field definitions (AGL-2595). Pure like `contacts`, and beside\n// it because `ContactFacet` names its lifecycle stage and custom-value types;\n// the scope stamp every CRM creator writes lives here too.\nexport * from './crm'\n// Email templates, snippets and the merge-field resolver (AGL-2658): the\n// letter a rep keeps under a name, and the one grammar the send route and\n// the dialog fill it in by. Pure like `crm`, and beside it because a\n// template is scoped the way a task is.\nexport * from './crm-email-templates'\n// The booking door's shared vocabulary (AGL-2660): the query keys a booking\n// link carries, the record reference inside it, and the wording and due\n// date of what a booking files back on the record.\nexport * from './crm-booking'\n// Two contact documents folded into one (AGL-2625): the plan the console\n// previews and the server writes, reading the facet shape from `contacts`\n// and the company mirror from `crm`.\nexport * from './contact-merge'\n// A person's privacy erasure from one workspace (AGL-2623): the request's\n// shape and id, the marker a record carries while it waits, and the lists\n// the dialog and the docs share. Pure like `crm`; the sweep is server-side.\nexport * from './person-erasure'\n// What the CRM's reports compute from what they read — periods, weekly\n// buckets, the lifecycle funnel, pipeline totals (AGL-2604). Pure like `crm`,\n// and beside it because it reads the stage list and the deal weighting from\n// there rather than restating either.\nexport * from './crm-reports'\n// Every CRM CSV, written once (AGL-2662): the column lists and the cells\n// each section's Export button writes, and the server's whole-collection\n// export streams — one implementation, because the console app may not\n// import the plugin whose sections used to hold it.\nexport * from './crm-csv'\n// Which holder a cross-site reader sees one contact through (AGL-2630),\n// beside the files that write it: the org-level list and the server's\n// export both flatten a contact this way.\nexport * from './contact-holder'\n// What one member is owed this morning — the day's window in a named zone,\n// the task and lead bucketing, and the words the notification and the mail\n// say (AGL-2619). Pure like `crm-reports`, read by the scheduled route.\nexport * from './crm-digest'\n// A task's reminder at its own time (AGL-2659): which reminder a save\n// leaves, whether one is owed, and the words the notification and the mail\n// say. Pure like `crm-digest`, read by the hourly route and by every\n// writer of the field.\nexport * from './crm-task-reminders'\n// Email capture (AGL-2657): the address's shape and token, which of a\n// message's addresses is the correspondent, the excerpt, and the row a\n// captured message becomes. Pure like `crm-digest`; the webhook route and\n// the address route are the readers with Firestore.\nexport * from './crm-inbound'\n// A member's own addresses in a workspace (AGL-2975): the ones they have\n// confirmed count as theirs wherever the roster is asked who wrote a\n// message. Pure; the store and the confirmation link are server-side.\nexport * from './member-email-aliases'\n// The next activity a record carries (AGL-2661): what `nextTaskAtMs` IS given\n// a record's open tasks, the view clause a list filters on, the report figure.\n// Pure like `crm`; the admin library's `recomputeCrmNextTaskAt` is the writer.\nexport * from './crm-next-activity'\n// The CSV cell grammar the exports write with (AGL-2621), and the target a\n// mapped column names for a custom field — named rather than starred, because\n// an importer built on this file exports the shared ceilings under its own\n// names.\nexport {\n  csvCell,\n  csvDocument,\n  customImportTarget,\n  customImportTargetKey,\n} from './csv-import'\nexport type {\n  ImportChunkResult,\n  ImportDroppedValue,\n  ImportSkippedRow,\n} from './csv-import'\n// What a VALUE under a custom contact field may be, and the coercion every\n// door applies to one (AGL-2601): a mapped form field, an API `custom` body,\n// and the carry-over that keeps a mapping across a publish. Pure like `crm`.\nexport * from './contact-custom-fields'\n// The consent JOIN (`docs/specs/email-overhaul.md` §3f). Pure, and it composes\n// `contacts` for the normalizer, so it sits directly beside it. No Node\n// builtin, which is what keeps it out of the `/server`-only group `person-key`\n// belongs to.\nexport * from './consent-groups'\nexport * from './marketing-consent'\n// The ENROLLMENT-time half of the same question, beside its reader for the\n// same reason: `marketing-consent` decides whether a recorded basis lets us\n// mail somebody, and this decides what basis putting them on a list may\n// record. Two enrollment surfaces import it — the Inbox assignment route and\n// the Emails console's audience card — and neither could import the other.\nexport * from './list-assignment-policy'\n// Reading the FILE a merchant arrives with (`docs/specs/email-competitive-gaps.md`\n// G5/P4), directly after the policy it hands its addresses to: parsing and\n// mechanical screening only, so that an import asks the enrollment question\n// through the same module the one-address add path asks it through rather\n// than answering it a second way.\nexport * from './list-import'\n// The dynamic-list rule (§3b/§3c), beside it for the same reasons: pure, and\n// it composes `contacts` for the segment vocabulary rather than restating it.\nexport * from './dynamic-list-rule'\n// The subscribable streams a recipient can leave one at a time\n// (`docs/specs/email-competitive-gaps.md` §1f). Pure, and read from all three\n// sides of the feature: the composer picks one, the send path signs it into\n// the unsubscribe link, and the unauthenticated preference page renders the\n// catalog. No Node builtin, so it stays out of the `/server`-only group.\nexport * from './email-topics'\nexport * from './compose-layout-nodes'\n// Layout properties applied through the chain (AGL-2893).\nexport * from './compose-layout-props'\nexport * from './document-landmark'\nexport * from './functions'\nexport * from './compose-reusable-components'\nexport * from './compress'\nexport * from './merge-node-sx'\nexport * from './palette-sx'\nexport * from './scheme-sx'\nexport * from './create-resource-uid'\nexport * from './decompress'\nexport * from './stored-nodes'\nexport * from './strip-undefined'\nexport * from './organizations'\nexport * from './org-permissions'\n// The AI verdict on either membership axis (AGL-2927). After both modules it\n// composes: the org catalog for org-wide members, the host role for site\n// collaborators.\nexport * from './host-permissions'\nexport * from './password-policy'\nexport * from './idp-profile'\nexport * from './onboarding-deep-link'\n// Where an account came from (AGL-1731). Beside the plan intent because\n// they are the same hop — the marketing CTA's query string — and both are\n// remembered on `users/{uid}` across the verification wall.\nexport * from './campaign-attribution'\n// The edge between a campaign and the forms, screens and contacts a push is\n// coordinated across. Beside the attribution above because the two answer\n// opposite questions about the same word: attribution records where somebody\n// CAME from, this records what a merchant DECLARED belongs together.\nexport * from './campaign-membership'\nexport * from './deployment-shape'\n// Which browser origins may complete a signed direct-to-GCS upload (AGL-1452).\n// GCS matches the origin list EXACTLY, so every serving console name needs its\n// own entry — the rule nobody could be expected to remember at attach time.\nexport * from './upload-cors'\n// The docs-help subset the first-party plugin consoles read (AGL-2213) — the\n// console's own registry lives in apps/console/constants and a lib cannot\n// import an app.\nexport * from './docs-help'\nexport * from './platform-brand'\nexport * from './plan-entitlements'\n// The free plan's bandwidth hard cap (AGL-1967/2070/2155). After\n// `plan-entitlements`, which owns the predicate it keys off.\nexport * from './bandwidth-cap'\nexport * from './form-abuse-ceiling'\nexport * from './forms'\n// What a form's DESIGN must still satisfy for its submissions to arrive.\n// After `forms`, whose field walk it reads the drawn fields with.\nexport * from './form-contract'\nexport * from './visitor-record-ceiling'\nexport * from './health-report'\n// Did a webhook delivery actually DO anything (AGL-1954)? After\n// `health-report`, whose billing verdict consumes the counts this produces.\nexport * from './webhook-delivery'\nexport * from './support-tiers'\nexport * from './release-flags'\n// Who runs THIS deployment, and where its notices go (AGL-2016). Ordered\n// before the four surfaces that print it, all of which used to declare their\n// own `support@aglyn.com` literal.\nexport * from './operator-identity'\nexport * from './lockdown'\nexport * from './media-quarantine'\nexport * from './media-takedown-reach'\nexport * from './upload-inspection'\nexport * from './abuse-report'\n// The other three quarters of §512 (AGL-1983): the put-back procedure that\n// answers a notice, and the strike ledger that conditions the safe harbour.\nexport * from './dmca-counter-notice'\nexport * from './repeat-infringer'\n// `addBusinessDays` briefly existed TWICE — once here in './support-tiers'\n// and once in './dmca-counter-notice' — and two `export *` made the name\n// ambiguous, TS2308'ing this barrel and every tsconfig that reads it. The\n// interleave was fixed twice in parallel: once by naming a winner here, and\n// once by deleting the second definition so './dmca-counter-notice' imports\n// this one. Only the deletion survives, so the disambiguating re-export that\n// stood on this line is gone with it — `export *` is unambiguous again.\n//\n// The concern that argued for keeping two copies is worth answering rather\n// than dropping: a later tweak to the SUPPORT SLA window must never silently\n// move the §512(g)(2)(C) put-back deadline. It cannot. This function embeds\n// no window — it is \"add N business days\", and N is the argument. The two\n// windows live in their own constants (`SUPPORT_*` there,\n// `COUNTER_NOTICE_*_BUSINESS_DAYS` in the DMCA module) and never meet. What\n// SHOULD stay shared is the day arithmetic itself: two copies of a weekend\n// rule are two chances to disagree about which day a deadline falls on.\nexport * from './org-override-reason'\nexport * from './host-tokens'\nexport * from './variables'\nexport * from './workflows'\nexport * from './datasets'\nexport * from './expand-repeatables'\nexport * from './org-roles'\nexport * from './markdown-lite'\nexport * from './notifications'\nexport * from './definition-canvas-tree'\nexport * from './ensure-canvas-root'\nexport * from './repair-canvas-nodes'\nexport * from './detect-template-placeholders'\nexport * from './guarded-version-save'\nexport * from './local-storage-budget'\nexport * from './measure-node-map'\nexport * from './resolve-named-tokens'\nexport * from './screen-route'\nexport * from './host-naming'\nexport * from './marketplace-verification'\nexport * from './name-search'\nexport * from './name-match'\nexport * from './api-plugins'\nexport * from './plugin-api-rate-limit'\n// The same-origin gate on visitor-facing plugin writes (AGL-1880). After\n// `plugin-api-rate-limit`, whose `isMachinePluginApiPath` it reuses so the\n// two gates exempt exactly the same machine surfaces.\nexport * from './plugin-api-cross-origin'\nexport * from './actions'\nexport * from './element-animation'\nexport * from './attribution-guard'\nexport * from './node-interactions'\nexport * from './element-ui'\nexport * from './image-upload-types'\nexport * from './sanitize-svg'\nexport * from './media-folders'\nexport * from './media-metadata'\nexport * from './media-ref'\n// After `media-ref`, whose reference grammar it reads stored URLs with.\nexport * from './paid-media-source'\nexport * from './author-css'\n// The isomorphic HTML rule (AGL-1901), after the CSS one it depends on.\nexport * from './author-html'\nexport * from './dataset-models'\nexport * from './dataset-csv'\nexport * from './marketplace-provenance'\nexport * from './marketplace-update-state'\nexport * from './dataset-query'\nexport * from './plugin-manifest'\n// After `plugin-manifest`, whose revocation predicates it asks the kill\n// question with, and after `media-ref`, whose grammar decides what counts as a\n// first-party image.\nexport * from './email-starter-policy'\nexport * from './safe-json-ld'\n// Agent readiness (AGL-2716): content negotiation, the Markdown rendering of a\n// page, `/llms.txt` and the per-site OpenAPI document. All pure, all server-safe.\nexport * from './accept-negotiation'\nexport * from './agent-api-catalog'\nexport * from './agent-openapi'\nexport * from './author-html-markdown'\nexport * from './llms-txt'\nexport * from './page-markdown'\nexport * from './request-geo'\nexport * from './request-ip'\nexport * from './search-indexing'\nexport * from './seo-title'\nexport * from './sitemap'\nexport * from './visitor-consent'\nexport * from './social-image'\nexport * from './scope-tokens'\nexport * from './org-billing-doc'\nexport * from './stripe-deployment-mode'\nexport * from './deferred-image'\n"],"names":["csvCell","csvDocument","customImportTarget","customImportTargetKey"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;CAMC,GACD,cAAc,6BAAyB;AACvC,cAAc,sBAAkB;AAChC,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,uEAAuE;AACvE,cAAc,0BAAsB;AACpC,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,cAAc,yBAAqB;AACnC,cAAc,0BAAsB;AACpC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,cAAc,uBAAmB;AACjC,cAAc,2BAAuB;AACrC,cAAc,8BAA0B;AACxC,cAAc,gBAAY;AAC1B,cAAc,sBAAkB;AAChC,cAAc,8BAA0B;AACxC,wEAAwE;AACxE,4EAA4E;AAC5E,cAAc,oBAAgB;AAC9B,yEAAyE;AACzE,uEAAuE;AACvE,qDAAqD;AACrD,cAAc,iCAA6B;AAC3C,cAAc,sBAAkB;AAChC,cAAc,4BAAwB;AACtC,sEAAsE;AACtE,uDAAuD;AACvD,cAAc,yBAAqB;AACnC,wEAAwE;AACxE,iEAAiE;AACjE,cAAc,uBAAmB;AACjC,cAAc,0BAAsB;AACpC,cAAc,gBAAY;AAC1B,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,2DAA2D;AAC3D,cAAc,WAAO;AACrB,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,wCAAwC;AACxC,cAAc,2BAAuB;AACrC,4EAA4E;AAC5E,wEAAwE;AACxE,mDAAmD;AACnD,cAAc,mBAAe;AAC7B,yEAAyE;AACzE,0EAA0E;AAC1E,qCAAqC;AACrC,cAAc,qBAAiB;AAC/B,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,cAAc,sBAAkB;AAChC,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAC5E,sCAAsC;AACtC,cAAc,mBAAe;AAC7B,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,oDAAoD;AACpD,cAAc,eAAW;AACzB,wEAAwE;AACxE,sEAAsE;AACtE,0CAA0C;AAC1C,cAAc,sBAAkB;AAChC,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,cAAc,kBAAc;AAC5B,sEAAsE;AACtE,2EAA2E;AAC3E,qEAAqE;AACrE,uBAAuB;AACvB,cAAc,0BAAsB;AACpC,sEAAsE;AACtE,uEAAuE;AACvE,0EAA0E;AAC1E,oDAAoD;AACpD,cAAc,mBAAe;AAC7B,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,cAAc,4BAAwB;AACtC,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,SAAS;AACT,SACEA,OAAO,EACPC,WAAW,EACXC,kBAAkB,EAClBC,qBAAqB,QAChB,kBAAc;AAMrB,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,cAAc,6BAAyB;AACvC,+EAA+E;AAC/E,wEAAwE;AACxE,+EAA+E;AAC/E,cAAc;AACd,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,cAAc,8BAA0B;AACxC,mFAAmF;AACnF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,kCAAkC;AAClC,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,cAAc,yBAAqB;AACnC,+DAA+D;AAC/D,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,cAAc,oBAAgB;AAC9B,cAAc,4BAAwB;AACtC,0DAA0D;AAC1D,cAAc,4BAAwB;AACtC,cAAc,yBAAqB;AACnC,cAAc,iBAAa;AAC3B,cAAc,mCAA+B;AAC7C,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,kBAAc;AAC5B,cAAc,iBAAa;AAC3B,cAAc,2BAAuB;AACrC,cAAc,kBAAc;AAC5B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,qBAAiB;AAC/B,cAAc,uBAAmB;AACjC,6EAA6E;AAC7E,yEAAyE;AACzE,iBAAiB;AACjB,cAAc,wBAAoB;AAClC,cAAc,uBAAmB;AACjC,cAAc,mBAAe;AAC7B,cAAc,4BAAwB;AACtC,wEAAwE;AACxE,0EAA0E;AAC1E,4DAA4D;AAC5D,cAAc,4BAAwB;AACtC,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,qEAAqE;AACrE,cAAc,2BAAuB;AACrC,cAAc,wBAAoB;AAClC,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc,mBAAe;AAC7B,6EAA6E;AAC7E,0EAA0E;AAC1E,iBAAiB;AACjB,cAAc,iBAAa;AAC3B,cAAc,sBAAkB;AAChC,cAAc,yBAAqB;AACnC,iEAAiE;AACjE,6DAA6D;AAC7D,cAAc,qBAAiB;AAC/B,cAAc,0BAAsB;AACpC,cAAc,aAAS;AACvB,yEAAyE;AACzE,kEAAkE;AAClE,cAAc,qBAAiB;AAC/B,cAAc,8BAA0B;AACxC,cAAc,qBAAiB;AAC/B,gEAAgE;AAChE,4EAA4E;AAC5E,cAAc,wBAAoB;AAClC,cAAc,qBAAiB;AAC/B,cAAc,qBAAiB;AAC/B,yEAAyE;AACzE,6EAA6E;AAC7E,mCAAmC;AACnC,cAAc,yBAAqB;AACnC,cAAc,gBAAY;AAC1B,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,yBAAqB;AACnC,cAAc,oBAAgB;AAC9B,2EAA2E;AAC3E,4EAA4E;AAC5E,cAAc,2BAAuB;AACrC,cAAc,wBAAoB;AAClC,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,0DAA0D;AAC1D,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,cAAc,2BAAuB;AACrC,cAAc,mBAAe;AAC7B,cAAc,iBAAa;AAC3B,cAAc,iBAAa;AAC3B,cAAc,gBAAY;AAC1B,cAAc,0BAAsB;AACpC,cAAc,iBAAa;AAC3B,cAAc,qBAAiB;AAC/B,cAAc,qBAAiB;AAC/B,cAAc,8BAA0B;AACxC,cAAc,0BAAsB;AACpC,cAAc,2BAAuB;AACrC,cAAc,oCAAgC;AAC9C,cAAc,4BAAwB;AACtC,cAAc,4BAAwB;AACtC,cAAc,wBAAoB;AAClC,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,cAAc,mBAAe;AAC7B,cAAc,gCAA4B;AAC1C,cAAc,mBAAe;AAC7B,cAAc,kBAAc;AAC5B,cAAc,mBAAe;AAC7B,cAAc,6BAAyB;AACvC,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AACtD,cAAc,+BAA2B;AACzC,cAAc,eAAW;AACzB,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,cAAc,0BAAsB;AACpC,cAAc,oBAAgB;AAC9B,cAAc,qBAAiB;AAC/B,cAAc,sBAAkB;AAChC,cAAc,iBAAa;AAC3B,wEAAwE;AACxE,cAAc,yBAAqB;AACnC,cAAc,kBAAc;AAC5B,wEAAwE;AACxE,cAAc,mBAAe;AAC7B,cAAc,sBAAkB;AAChC,cAAc,mBAAe;AAC7B,cAAc,8BAA0B;AACxC,cAAc,gCAA4B;AAC1C,cAAc,qBAAiB;AAC/B,cAAc,uBAAmB;AACjC,wEAAwE;AACxE,+EAA+E;AAC/E,qBAAqB;AACrB,cAAc,4BAAwB;AACtC,cAAc,oBAAgB;AAC9B,+EAA+E;AAC/E,kFAAkF;AAClF,cAAc,0BAAsB;AACpC,cAAc,yBAAqB;AACnC,cAAc,qBAAiB;AAC/B,cAAc,4BAAwB;AACtC,cAAc,gBAAY;AAC1B,cAAc,qBAAiB;AAC/B,cAAc,mBAAe;AAC7B,cAAc,kBAAc;AAC5B,cAAc,uBAAmB;AACjC,cAAc,iBAAa;AAC3B,cAAc,eAAW;AACzB,cAAc,uBAAmB;AACjC,cAAc,oBAAgB;AAC9B,cAAc,oBAAgB;AAC9B,cAAc,uBAAmB;AACjC,cAAc,8BAA0B;AACxC,cAAc,sBAAkB"}

package/src/lib/app-utils/site-context.d.ts

@@ -0,0 +1,106 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Identity of the published site a node tree renders inside. Provided by
+ * the tenant page and by the console's Preview; absent in the besigner
+ * canvas, which is how components with side effects (forms) know to stay
+ * inert.
+ *
+ * Lives banner-free in @aglyn/aglyn for the same reason as
+ * ScreenLinkContext: a 'use client' banner in this module graph duplicates
+ * the canvas singleton and blanks the tenant site (AGL-52).
+ */
+export interface SiteContextValue {
+    /** Host document id of the rendered site. */
+    hostId?: string;
+    /**
+     * True on the console's Preview surface (AGL-1139).
+     *
+     * Preview now supplies a real `hostId`, because without one every plugin
+     * block took its `if (!hostId)` placeholder branch — thirty of them — and
+     * someone laying out a shop saw dashed boxes instead of their products.
+     * A `hostId` is what makes those blocks resolve real data.
+     *
+     * The same `hostId` is what would let them WRITE it. Preview exists to
+     * answer "what will this look like and do", not to place an order, post a
+     * review or book a table, so this flag is how a block tells the difference.
+     * Read through `useSiteFetch`, which refuses unsafe methods rather than
+     * asking each block to remember.
+     */
+    preview?: boolean;
+    /**
+     * Data a site-page resolver already loaded on the server for THIS page,
+     * keyed by plugin (AGL-659).
+     *
+     * Blocks whose primary content came from a `useEffect` fetch rendered a
+     * skeleton during SSR — so the crawler saw a product page with no product
+     * in it. Seeding from here lets a block render its real content in the
+     * server HTML and still hydrate normally, without giving up ISR caching.
+     *
+     * Absent in the besigner/preview, so blocks must keep working without it.
+     */
+    pageData?: Record<string, unknown>;
+}
+export declare const SiteContext: import("react").Context<SiteContextValue>;
+/** The rendered site's identity; empty in the besigner canvas. */
+export declare function useSite(): SiteContextValue;
+/**
+ * Dispatched when Preview refuses a write (AGL-1139). The preview surface
+ * listens once and says so; blocks do not each need their own message.
+ */
+export declare const PREVIEW_WRITE_BLOCKED_EVENT = "aglyn:preview-write-blocked";
+/**
+ * The status `useSiteFetch` answers a refused write with. Exported so a block
+ * can tell "Preview refused this" from "the server errored" — the two need
+ * opposite words, and a block that cannot tell them apart says "something went
+ * wrong" about a deliberate, correct refusal (AGL-1249).
+ */
+export declare const PREVIEW_REFUSED_STATUS = 423;
+/**
+ * Was this response Preview declining to write, rather than a failure?
+ *
+ * The status alone stopped being sufficient with AGL-1511: a read-only
+ * lockdown refuses a live site's writes with the SAME 423, so a block that
+ * keys on the status only would tell a paying visitor "Preview does not
+ * change real data" about a real checkout. Pass the parsed body and the
+ * `preview: true` marker decides; a caller with no body in hand keeps the
+ * old status-only behaviour, which is still right in the surface Preview
+ * actually renders (its refusal never reaches the network, so a lockdown 423
+ * cannot arrive there).
+ */
+export declare function isPreviewRefusal(response: {
+    status?: number;
+} | null | undefined, body?: unknown): boolean;
+/**
+ * `fetch` for a site block, aware of which surface it is rendering on.
+ *
+ * Once Preview supplies a real `hostId` every block's data call starts
+ * working — including the ones that book a table, post a review, register a
+ * member or place an order. Those are not previews of anything; they are the
+ * thing itself, triggered by someone checking their layout.
+ *
+ * So the boundary is drawn once, HERE, by method rather than by endpoint:
+ * reads pass through, anything that can change state resolves to a 423
+ * without a request being made. Drawing it per block would mean thirteen
+ * files each remembering, and the fourteenth block silently not — the same
+ * shape as the revalidate omission in AGL-1150.
+ *
+ * Deliberately resolves rather than rejects. Every caller already branches on
+ * `response.ok`, so a refusal travels down the path they already have for a
+ * server that said no, and no block needs a new `catch`.
+ */
+export declare function useSiteFetch(): typeof fetch;

package/src/lib/app-utils/site-context.js

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { createContext, useCallback, useContext } from "react";
+export const SiteContext = createContext({});
+SiteContext.displayName = 'AglynSiteContext';
+/** The rendered site's identity; empty in the besigner canvas. */ export function useSite() {
+    return useContext(SiteContext);
+}
+/**
+ * Dispatched when Preview refuses a write (AGL-1139). The preview surface
+ * listens once and says so; blocks do not each need their own message.
+ */ export const PREVIEW_WRITE_BLOCKED_EVENT = 'aglyn:preview-write-blocked';
+/**
+ * The status `useSiteFetch` answers a refused write with. Exported so a block
+ * can tell "Preview refused this" from "the server errored" — the two need
+ * opposite words, and a block that cannot tell them apart says "something went
+ * wrong" about a deliberate, correct refusal (AGL-1249).
+ */ export const PREVIEW_REFUSED_STATUS = 423;
+/**
+ * Was this response Preview declining to write, rather than a failure?
+ *
+ * The status alone stopped being sufficient with AGL-1511: a read-only
+ * lockdown refuses a live site's writes with the SAME 423, so a block that
+ * keys on the status only would tell a paying visitor "Preview does not
+ * change real data" about a real checkout. Pass the parsed body and the
+ * `preview: true` marker decides; a caller with no body in hand keeps the
+ * old status-only behaviour, which is still right in the surface Preview
+ * actually renders (its refusal never reaches the network, so a lockdown 423
+ * cannot arrive there).
+ */ export function isPreviewRefusal(response, body) {
+    if ((response == null ? void 0 : response.status) !== PREVIEW_REFUSED_STATUS) return false;
+    if (body === undefined) return true;
+    return Boolean(body) && typeof body === 'object' && body.preview === true;
+}
+/** Methods that cannot change server state, so Preview lets them through. */ const READ_METHODS = new Set([
+    'GET',
+    'HEAD',
+    'OPTIONS'
+]);
+/** What a blocked call resolves to. */ const BLOCKED_BODY = {
+    error: 'Preview does not change real data.',
+    preview: true
+};
+/**
+ * `fetch` for a site block, aware of which surface it is rendering on.
+ *
+ * Once Preview supplies a real `hostId` every block's data call starts
+ * working — including the ones that book a table, post a review, register a
+ * member or place an order. Those are not previews of anything; they are the
+ * thing itself, triggered by someone checking their layout.
+ *
+ * So the boundary is drawn once, HERE, by method rather than by endpoint:
+ * reads pass through, anything that can change state resolves to a 423
+ * without a request being made. Drawing it per block would mean thirteen
+ * files each remembering, and the fourteenth block silently not — the same
+ * shape as the revalidate omission in AGL-1150.
+ *
+ * Deliberately resolves rather than rejects. Every caller already branches on
+ * `response.ok`, so a refusal travels down the path they already have for a
+ * server that said no, and no block needs a new `catch`.
+ */ export function useSiteFetch() {
+    const { preview } = useSite();
+    return useCallback((input, init)=>{
+        var _ref;
+        const method = String((_ref = init == null ? void 0 : init.method) != null ? _ref : typeof Request !== 'undefined' && input instanceof Request ? input.method : 'GET').toUpperCase();
+        if (!preview || READ_METHODS.has(method)) return fetch(input, init);
+        if (typeof window !== 'undefined') {
+            window.dispatchEvent(new CustomEvent(PREVIEW_WRITE_BLOCKED_EVENT, {
+                detail: {
+                    method
+                }
+            }));
+        }
+        return Promise.resolve(new Response(JSON.stringify(BLOCKED_BODY), {
+            // 423 Locked: the request was understood and refused because of the
+            // surface it came from, not because it was malformed or forbidden.
+            status: PREVIEW_REFUSED_STATUS,
+            headers: {
+                'Content-Type': 'application/json'
+            }
+        }));
+    }, [
+        preview
+    ]);
+}
+
+//# sourceMappingURL=site-context.js.map

package/src/lib/app-utils/site-context.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/site-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createContext, useCallback, useContext } from 'react'\n\n/**\n * Identity of the published site a node tree renders inside. Provided by\n * the tenant page and by the console's Preview; absent in the besigner\n * canvas, which is how components with side effects (forms) know to stay\n * inert.\n *\n * Lives banner-free in @aglyn/aglyn for the same reason as\n * ScreenLinkContext: a 'use client' banner in this module graph duplicates\n * the canvas singleton and blanks the tenant site (AGL-52).\n */\nexport interface SiteContextValue {\n  /** Host document id of the rendered site. */\n  hostId?: string\n  /**\n   * True on the console's Preview surface (AGL-1139).\n   *\n   * Preview now supplies a real `hostId`, because without one every plugin\n   * block took its `if (!hostId)` placeholder branch — thirty of them — and\n   * someone laying out a shop saw dashed boxes instead of their products.\n   * A `hostId` is what makes those blocks resolve real data.\n   *\n   * The same `hostId` is what would let them WRITE it. Preview exists to\n   * answer \"what will this look like and do\", not to place an order, post a\n   * review or book a table, so this flag is how a block tells the difference.\n   * Read through `useSiteFetch`, which refuses unsafe methods rather than\n   * asking each block to remember.\n   */\n  preview?: boolean\n  /**\n   * Data a site-page resolver already loaded on the server for THIS page,\n   * keyed by plugin (AGL-659).\n   *\n   * Blocks whose primary content came from a `useEffect` fetch rendered a\n   * skeleton during SSR — so the crawler saw a product page with no product\n   * in it. Seeding from here lets a block render its real content in the\n   * server HTML and still hydrate normally, without giving up ISR caching.\n   *\n   * Absent in the besigner/preview, so blocks must keep working without it.\n   */\n  pageData?: Record<string, unknown>\n}\n\nexport const SiteContext = createContext<SiteContextValue>({})\nSiteContext.displayName = 'AglynSiteContext'\n\n/** The rendered site's identity; empty in the besigner canvas. */\nexport function useSite(): SiteContextValue {\n  return useContext(SiteContext)\n}\n\n/**\n * Dispatched when Preview refuses a write (AGL-1139). The preview surface\n * listens once and says so; blocks do not each need their own message.\n */\nexport const PREVIEW_WRITE_BLOCKED_EVENT = 'aglyn:preview-write-blocked'\n\n/**\n * The status `useSiteFetch` answers a refused write with. Exported so a block\n * can tell \"Preview refused this\" from \"the server errored\" — the two need\n * opposite words, and a block that cannot tell them apart says \"something went\n * wrong\" about a deliberate, correct refusal (AGL-1249).\n */\nexport const PREVIEW_REFUSED_STATUS = 423\n\n/**\n * Was this response Preview declining to write, rather than a failure?\n *\n * The status alone stopped being sufficient with AGL-1511: a read-only\n * lockdown refuses a live site's writes with the SAME 423, so a block that\n * keys on the status only would tell a paying visitor \"Preview does not\n * change real data\" about a real checkout. Pass the parsed body and the\n * `preview: true` marker decides; a caller with no body in hand keeps the\n * old status-only behaviour, which is still right in the surface Preview\n * actually renders (its refusal never reaches the network, so a lockdown 423\n * cannot arrive there).\n */\nexport function isPreviewRefusal(\n  response: { status?: number } | null | undefined,\n  body?: unknown,\n): boolean {\n  if (response?.status !== PREVIEW_REFUSED_STATUS) return false\n  if (body === undefined) return true\n  return (\n    Boolean(body) &&\n    typeof body === 'object' &&\n    (body as { preview?: unknown }).preview === true\n  )\n}\n\n/** Methods that cannot change server state, so Preview lets them through. */\nconst READ_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])\n\n/** What a blocked call resolves to. */\nconst BLOCKED_BODY = {\n  error: 'Preview does not change real data.',\n  preview: true,\n}\n\n/**\n * `fetch` for a site block, aware of which surface it is rendering on.\n *\n * Once Preview supplies a real `hostId` every block's data call starts\n * working — including the ones that book a table, post a review, register a\n * member or place an order. Those are not previews of anything; they are the\n * thing itself, triggered by someone checking their layout.\n *\n * So the boundary is drawn once, HERE, by method rather than by endpoint:\n * reads pass through, anything that can change state resolves to a 423\n * without a request being made. Drawing it per block would mean thirteen\n * files each remembering, and the fourteenth block silently not — the same\n * shape as the revalidate omission in AGL-1150.\n *\n * Deliberately resolves rather than rejects. Every caller already branches on\n * `response.ok`, so a refusal travels down the path they already have for a\n * server that said no, and no block needs a new `catch`.\n */\nexport function useSiteFetch(): typeof fetch {\n  const { preview } = useSite()\n  return useCallback(\n    (input: RequestInfo | URL, init?: RequestInit) => {\n      const method = String(\n        init?.method ??\n          (typeof Request !== 'undefined' && input instanceof Request\n            ? input.method\n            : 'GET'),\n      ).toUpperCase()\n      if (!preview || READ_METHODS.has(method)) return fetch(input, init)\n      if (typeof window !== 'undefined') {\n        window.dispatchEvent(\n          new CustomEvent(PREVIEW_WRITE_BLOCKED_EVENT, { detail: { method } }),\n        )\n      }\n      return Promise.resolve(\n        new Response(JSON.stringify(BLOCKED_BODY), {\n          // 423 Locked: the request was understood and refused because of the\n          // surface it came from, not because it was malformed or forbidden.\n          status: PREVIEW_REFUSED_STATUS,\n          headers: { 'Content-Type': 'application/json' },\n        }),\n      )\n    },\n    [preview],\n  )\n}\n"],"names":["createContext","useCallback","useContext","SiteContext","displayName","useSite","PREVIEW_WRITE_BLOCKED_EVENT","PREVIEW_REFUSED_STATUS","isPreviewRefusal","response","body","status","undefined","Boolean","preview","READ_METHODS","Set","BLOCKED_BODY","error","useSiteFetch","input","init","method","String","Request","toUpperCase","has","fetch","window","dispatchEvent","CustomEvent","detail","Promise","resolve","Response","JSON","stringify","headers"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,aAAa,EAAEC,WAAW,EAAEC,UAAU,QAAQ,QAAO;AA4C9D,OAAO,MAAMC,cAAcH,cAAgC,CAAC,GAAE;AAC9DG,YAAYC,WAAW,GAAG;AAE1B,gEAAgE,GAChE,OAAO,SAASC;IACd,OAAOH,WAAWC;AACpB;AAEA;;;CAGC,GACD,OAAO,MAAMG,8BAA8B,8BAA6B;AAExE;;;;;CAKC,GACD,OAAO,MAAMC,yBAAyB,IAAG;AAEzC;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,iBACdC,QAAgD,EAChDC,IAAc;IAEd,IAAID,CAAAA,4BAAAA,SAAUE,MAAM,MAAKJ,wBAAwB,OAAO;IACxD,IAAIG,SAASE,WAAW,OAAO;IAC/B,OACEC,QAAQH,SACR,OAAOA,SAAS,YAChB,AAACA,KAA+BI,OAAO,KAAK;AAEhD;AAEA,2EAA2E,GAC3E,MAAMC,eAAe,IAAIC,IAAI;IAAC;IAAO;IAAQ;CAAU;AAEvD,qCAAqC,GACrC,MAAMC,eAAe;IACnBC,OAAO;IACPJ,SAAS;AACX;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASK;IACd,MAAM,EAAEL,OAAO,EAAE,GAAGT;IACpB,OAAOJ,YACL,CAACmB,OAA0BC;;QACzB,MAAMC,SAASC,eACbF,wBAAAA,KAAMC,MAAM,mBACT,OAAOE,YAAY,eAAeJ,iBAAiBI,UAChDJ,MAAME,MAAM,GACZ,OACNG,WAAW;QACb,IAAI,CAACX,WAAWC,aAAaW,GAAG,CAACJ,SAAS,OAAOK,MAAMP,OAAOC;QAC9D,IAAI,OAAOO,WAAW,aAAa;YACjCA,OAAOC,aAAa,CAClB,IAAIC,YAAYxB,6BAA6B;gBAAEyB,QAAQ;oBAAET;gBAAO;YAAE;QAEtE;QACA,OAAOU,QAAQC,OAAO,CACpB,IAAIC,SAASC,KAAKC,SAAS,CAACnB,eAAe;YACzC,oEAAoE;YACpE,mEAAmE;YACnEN,QAAQJ;YACR8B,SAAS;gBAAE,gBAAgB;YAAmB;QAChD;IAEJ,GACA;QAACvB;KAAQ;AAEb"}