@aglyn/aglyn 1.0.0-beta.147 → 1.0.0-beta.150

package/src/lib/foundation/definitions/host-content-collections.d.ts

@@ -15,7 +15,8 @@
  * limitations under the License.
  */
 /**
- * Which host subcollections the media usage scan reads (AGL-1867).
+ * The host subcollections CORE owns, and how the media usage scan reads them
+ * (AGL-1867, AGL-3080).
  *
  * ## Why this exists, and why it is shaped the way it is
  *
@@ -34,8 +35,8 @@
  * feared is only necessary if the default is NOT to scan. So the default here
  * is inverted:
  *
- * **Every host subcollection is scanned unless it is named below with a
- * reason it is not.**
+ * **Every host subcollection is scanned unless it is named with a reason it is
+ * not.**
  *
  * That turns the open question from "does this carry media?" — which needs a
  * judgement about a schema nobody wrote down — into "is scanning this wasteful
@@ -44,15 +45,27 @@
  * thought about is READ, so a plugin shipping a new media-bearing collection is
  * covered the day it lands rather than the day somebody remembers it.
  *
- * ## What keeps the list from rotting
+ * ## Core holds core's, and asks the plugins for theirs (AGL-3080)
+ *
+ * This file used to hold every collection in the product: which ones commerce
+ * writes, which ones marketing writes, and which console page each deep-links
+ * to. That is the platform keeping a map of its plugins' storage, and the map
+ * went stale exactly where a stale map is invisible — three of its deep links
+ * pointed at a hub that did not hold the document, and nothing could tell.
+ *
+ * So a plugin declares its own collections in `plugins.config.json` and the
+ * readers ask `plugin-manager/plugin-host-collections`. What is left here is
+ * core's own storage, which is the only part core is entitled to name.
+ *
+ * ## What keeps these lists from rotting
  *
  * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host
  * subcollection names — the same derived sweep
  * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —
- * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus
- * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new
- * collection fails the build with a one-line decision to make, and the default
- * answer — add it to the scanned list — is also the safe one.
+ * and asserts the sweep is EXACTLY these three lists plus the plugins'
+ * declarations. A new collection fails the build with a one-line decision to
+ * make, and the default answer — declare it scanned, on the plugin that writes
+ * it — is also the safe one.
  *
  * ## The plugin boundary was NOT crossed to do this
  *
@@ -86,45 +99,31 @@
  */
 export declare const CORE_CONTENT_COLLECTIONS: readonly ["screens", "layouts", "components", "emailTemplates", "collections"];
 /**
- * Host subcollections deliberately NOT read by the media scan, and why.
- *
- * Every entry has to answer one of two questions: what would scanning it cost,
- * or what would scanning it get wrong. "It probably has no images in it" is not
- * an accepted reason — that is the guess this file is arranged to avoid making.
- */
-export declare const MEDIA_SCAN_EXCLUDED: Record<string, string>;
-/**
- * Host subcollections the media scan reads generically.
+ * Core's own host subcollections that the scan reads generically.
  *
  * Generically: no per-collection field list and no per-collection decoder.
  * Each document is flattened by `documentHaystack` — which decodes `nodes` and
- * `elements` through `decodeStoredNodes` first, so a plugin that adopts the
- * compressed storage form is covered without touching this file — and the
- * matching field's dotted path is recovered by walking the document. A field
- * list here would be the same staleness trap `referencingFieldPath` was written
- * to avoid one level down.
- *
- * MUST equal the repo-wide host subcollection sweep minus
- * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard
- * spec asserts exactly that, in both directions, so this list can neither miss
- * a new collection nor keep naming a deleted one.
+ * `elements` through `decodeStoredNodes` first — and the matching field's
+ * dotted path is recovered by walking the document. A field list here would be
+ * the same staleness trap `referencingFieldPath` was written to avoid one
+ * level down.
+ *
+ * Short because it is only core's: a blog author, the per-plugin settings
+ * document the plugin manager owns, and a site template. Everything else that
+ * is scanned generically belongs to a plugin and is declared by it.
  */
-export declare const PLUGIN_CONTENT_COLLECTIONS: readonly ["actions", "authors", "campaigns", "coupons", "discounts", "events", "experiments", "forms", "functions", "installs", "locations", "memberPosts", "overlays", "pluginSettings", "productCategories", "products", "redirects", "resources", "reviews", "services", "settings", "siteMembers", "suppliers", "templates", "variables", "webhooks", "workflows"];
-export type PluginContentCollection = (typeof PLUGIN_CONTENT_COLLECTIONS)[number];
+export declare const CORE_GENERIC_SCAN_COLLECTIONS: readonly ["authors", "pluginSettings", "templates"];
 /**
- * Console page slug a plugin-content reference row deep-links to.
+ * Core's own host subcollections that the media scan deliberately does NOT
+ * read, and why.
  *
- * Optional on purpose, and deliberately not required for a collection to be
- * scanned. A row with no destination still renders — as text rather than a
- * link — and that is strictly better than the row not existing, which is the
- * bug this issue is about. Requiring a slug would have made the deep link a
- * precondition for coverage and quietly re-created the hole for every
- * collection nobody had got round to routing.
- *
- * Keyed by collection, valued with the `[pluginSlug]` segment of
- * `Route.HOST_PLUGIN`.
+ * Every entry has to answer one of two questions: what would scanning it cost,
+ * or what would scanning it get wrong. "It probably has no images in it" is not
+ * an accepted reason — that is the guess this file is arranged to avoid making.
+ * A plugin's exclusions carry the same burden and live in its own declaration,
+ * where `mediaScanReason` is required with `mediaScan: 'none'`.
  */
-export declare const PLUGIN_CONTENT_ROUTE_SLUG: Partial<Record<PluginContentCollection, string>>;
+export declare const MEDIA_SCAN_EXCLUDED: Record<string, string>;
 /**
  * What to call one of these in a reference row.
  *
@@ -133,5 +132,8 @@ export declare const PLUGIN_CONTENT_ROUTE_SLUG: Partial<Record<PluginContentColl
  * `productCategories` reads as "Product category". Singularised with the two
  * rules English spells consistently enough to be worth automating; anything
  * else keeps its name, which is a cosmetic miss rather than a coverage one.
+ *
+ * Shared with `pluginHostCollectionLabel`, which prefers a plugin's declared
+ * label and falls back to exactly this.
  */
 export declare function hostContentCollectionLabel(collection: string): string;

package/src/lib/foundation/definitions/host-content-collections.js

@@ -14,7 +14,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ /**
- * Which host subcollections the media usage scan reads (AGL-1867).
+ * The host subcollections CORE owns, and how the media usage scan reads them
+ * (AGL-1867, AGL-3080).
  *
  * ## Why this exists, and why it is shaped the way it is
  *
@@ -33,8 +34,8 @@
  * feared is only necessary if the default is NOT to scan. So the default here
  * is inverted:
  *
- * **Every host subcollection is scanned unless it is named below with a
- * reason it is not.**
+ * **Every host subcollection is scanned unless it is named with a reason it is
+ * not.**
  *
  * That turns the open question from "does this carry media?" — which needs a
  * judgement about a schema nobody wrote down — into "is scanning this wasteful
@@ -43,15 +44,27 @@
  * thought about is READ, so a plugin shipping a new media-bearing collection is
  * covered the day it lands rather than the day somebody remembers it.
  *
- * ## What keeps the list from rotting
+ * ## Core holds core's, and asks the plugins for theirs (AGL-3080)
+ *
+ * This file used to hold every collection in the product: which ones commerce
+ * writes, which ones marketing writes, and which console page each deep-links
+ * to. That is the platform keeping a map of its plugins' storage, and the map
+ * went stale exactly where a stale map is invisible — three of its deep links
+ * pointed at a hub that did not hold the document, and nothing could tell.
+ *
+ * So a plugin declares its own collections in `plugins.config.json` and the
+ * readers ask `plugin-manager/plugin-host-collections`. What is left here is
+ * core's own storage, which is the only part core is entitled to name.
+ *
+ * ## What keeps these lists from rotting
  *
  * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host
  * subcollection names — the same derived sweep
  * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —
- * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus
- * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new
- * collection fails the build with a one-line decision to make, and the default
- * answer — add it to the scanned list — is also the safe one.
+ * and asserts the sweep is EXACTLY these three lists plus the plugins'
+ * declarations. A new collection fails the build with a one-line decision to
+ * make, and the default answer — declare it scanned, on the plugin that writes
+ * it — is also the safe one.
  *
  * ## The plugin boundary was NOT crossed to do this
  *
@@ -89,119 +102,41 @@
     'collections'
 ];
 /**
- * Host subcollections deliberately NOT read by the media scan, and why.
+ * Core's own host subcollections that the scan reads generically.
+ *
+ * Generically: no per-collection field list and no per-collection decoder.
+ * Each document is flattened by `documentHaystack` — which decodes `nodes` and
+ * `elements` through `decodeStoredNodes` first — and the matching field's
+ * dotted path is recovered by walking the document. A field list here would be
+ * the same staleness trap `referencingFieldPath` was written to avoid one
+ * level down.
+ *
+ * Short because it is only core's: a blog author, the per-plugin settings
+ * document the plugin manager owns, and a site template. Everything else that
+ * is scanned generically belongs to a plugin and is declared by it.
+ */ export const CORE_GENERIC_SCAN_COLLECTIONS = [
+    'authors',
+    'pluginSettings',
+    'templates'
+];
+/**
+ * Core's own host subcollections that the media scan deliberately does NOT
+ * read, and why.
  *
  * Every entry has to answer one of two questions: what would scanning it cost,
  * or what would scanning it get wrong. "It probably has no images in it" is not
  * an accepted reason — that is the guess this file is arranged to avoid making.
+ * A plugin's exclusions carry the same burden and live in its own declaration,
+ * where `mediaScanReason` is required with `mediaScan: 'none'`.
  */ export const MEDIA_SCAN_EXCLUDED = {
-    // ── Scanning these would be WRONG, not merely expensive ────────────────
-    media: 'The library itself. The asset under audit IS a document in here, and its ' + 'own record holds its own url, cdnPath and storage path — every needle ' + 'the scan carries. Reading this collection would report every asset as ' + 'referencing itself, which turns a deletion-safety control into noise ' + 'that nobody reads.',
+    media: 'The library itself. The asset under audit IS a document in here, and ' + 'its own record holds its own url, cdnPath and storage path — every ' + 'needle the scan carries. Reading this collection would report every ' + 'asset as referencing itself, which turns a deletion-safety control into ' + 'noise that nobody reads.',
     mediaFolders: 'Folder records: a name, a parent pointer and a scope. A folder never ' + 'holds an asset reference, and it is not a dependent either — deleting a ' + 'file does not break the folder it sat in.',
-    emailCampaigns: 'The campaign CONTAINER — a name, a date window, the list ids it is ' + 'aimed at and a topic. Distinct from `campaigns`, which holds the sends ' + 'and IS scanned because a send carries the copy that went out. A ' + 'container carries no copy and no asset reference: the design a send ' + 'renders is a screen, and the screen is where the picker writes.',
-    // ── Machine-written telemetry: unbounded, and no author picks into it ──
     analytics: 'Per-day traffic rollups written by the tenant collector. One document ' + 'per day per site forever, no author-editable field, and no surface that ' + 'can pick an asset into one.',
     screenAnalytics: 'Per-screen traffic history behind the Pro+ panel, written by the same ' + 'collector on the same unbounded per-day cadence.',
     counters: 'Quota and usage counters, server-owned (AGL-1367) and denied to client ' + 'writes outright. Numbers, not content.',
     activity: 'The site activity feed — an append-only audit log the console writes a ' + 'row into on every change. Unbounded by design, and a row that quotes an ' + 'asset id is a record that somebody touched it, not a place it is used.',
-    // ── Transaction and ledger rows: unbounded, and a SNAPSHOT is not a use ─
-    orders: 'Completed orders. Line items COPY a product\'s `imageUrl` at purchase ' + 'time, so these would match — and matching would be the wrong answer: an ' + 'order is an immutable record of what was sold, deleting the asset ' + 'changes nothing about it, and no author can edit one. A busy store also ' + 'holds more of these than the whole read budget.',
-    carts: 'Live and abandoned carts, with the same copied line-item image and the ' + 'same reasoning, at higher volume — one document per shopper session.',
-    checkouts: 'In-flight checkout sessions. Transient buyer state carrying the same ' + 'line-item snapshot as `carts`.',
-    formSubmissions: 'Visitor form submissions. Unbounded, PII-heavy, and a file attached to ' + 'one is the visitor\'s upload — not a library asset an author picked, and ' + 'not something deleting a library asset would break.',
-    leads: 'Captured leads, on the same footing as `formSubmissions`: visitor-' + 'submitted, unbounded, and never a place an author places an asset.',
-    bookings: 'Booking records — a customer, a time and a service pointer. The service ' + 'holds the imagery and IS scanned; a booking is the transaction against ' + 'it.',
-    campaignAttributions: 'One row per conversion — a form submission, a lead, a contact or a ' + 'booking — recording which campaign the visitor arrived from. Written ' + 'only by the Admin SDK, and the whole record is three sanitized UTM ' + 'strings capped at a hundred characters: there is no field an asset ' + 'could occupy and no surface that could pick one into it. Unbounded on ' + 'the same footing as the conversions it credits.',
-    reservations: 'POS and booking holds. Short-lived transaction rows pointing at a ' + 'resource that is itself scanned.',
-    stockHolds: 'Inventory holds taken during checkout. Machine-written, short-lived, ' + 'and a quantity rather than content.',
-    subscriptions: 'Site membership subscriptions: a plan pointer, a status and Stripe ' + 'ids. Server-written from the billing webhook.',
-    registers: 'POS register allocations — a count against the register add-on, read by ' + 'billing (AGL-1775). No content field at all.',
-    giftCards: 'Gift card balances and redemption history. Money, not content.',
-    licenseKeys: 'Digital-product license keys issued at fulfilment: a code, an order ' + 'pointer and a revocation flag.',
-    inventoryAdjustments: 'The append-only stock adjustment ledger (AGL-2269). One row per manual ' + 'stock edit and per cancellation release, unbounded over a store\'s life.',
-    inventoryReconciliation: 'Reconciliation runs comparing counted stock against recorded stock. ' + 'Machine-written totals.',
-    restockAlerts: 'Back-in-stock requests: an email address and a product pointer, written ' + 'by visitors.',
-    suppressions: 'Unsubscribes, bounces and spam complaints. Email addresses and a ' + 'reason.',
-    stripeTaxRates: 'Cached Stripe tax rate ids, written by the tax sync. Vendor ids.',
     members: 'The ORG-facing member roster mirrored onto the site, server-owned ' + '(AGL-1367). A member\'s photo is their own account photo, uploaded ' + 'through /api/account/photo and stored outside any site\'s library, so it ' + 'is not an asset this scan can be asked about.'
 };
-/**
- * Host subcollections the media scan reads generically.
- *
- * Generically: no per-collection field list and no per-collection decoder.
- * Each document is flattened by `documentHaystack` — which decodes `nodes` and
- * `elements` through `decodeStoredNodes` first, so a plugin that adopts the
- * compressed storage form is covered without touching this file — and the
- * matching field's dotted path is recovered by walking the document. A field
- * list here would be the same staleness trap `referencingFieldPath` was written
- * to avoid one level down.
- *
- * MUST equal the repo-wide host subcollection sweep minus
- * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard
- * spec asserts exactly that, in both directions, so this list can neither miss
- * a new collection nor keep naming a deleted one.
- */ export const PLUGIN_CONTENT_COLLECTIONS = [
-    'actions',
-    'authors',
-    'campaigns',
-    'coupons',
-    'discounts',
-    'events',
-    'experiments',
-    'forms',
-    'functions',
-    'installs',
-    'locations',
-    'memberPosts',
-    'overlays',
-    'pluginSettings',
-    'productCategories',
-    'products',
-    'redirects',
-    'resources',
-    'reviews',
-    'services',
-    'settings',
-    'siteMembers',
-    'suppliers',
-    'templates',
-    'variables',
-    'webhooks',
-    'workflows'
-];
-/**
- * Console page slug a plugin-content reference row deep-links to.
- *
- * Optional on purpose, and deliberately not required for a collection to be
- * scanned. A row with no destination still renders — as text rather than a
- * link — and that is strictly better than the row not existing, which is the
- * bug this issue is about. Requiring a slug would have made the deep link a
- * precondition for coverage and quietly re-created the hole for every
- * collection nobody had got round to routing.
- *
- * Keyed by collection, valued with the `[pluginSlug]` segment of
- * `Route.HOST_PLUGIN`.
- */ export const PLUGIN_CONTENT_ROUTE_SLUG = {
-    products: 'products',
-    productCategories: 'products',
-    suppliers: 'products',
-    locations: 'products',
-    coupons: 'products',
-    discounts: 'products',
-    reviews: 'products',
-    memberPosts: 'products',
-    events: 'events',
-    services: 'bookings',
-    resources: 'bookings',
-    redirects: 'redirects',
-    campaigns: 'marketing',
-    experiments: 'marketing',
-    workflows: 'workflows',
-    webhooks: 'workflows',
-    functions: 'logic',
-    variables: 'logic',
-    actions: 'logic'
-};
 /**
  * What to call one of these in a reference row.
  *
@@ -210,6 +145,9 @@
  * `productCategories` reads as "Product category". Singularised with the two
  * rules English spells consistently enough to be worth automating; anything
  * else keeps its name, which is a cosmetic miss rather than a coverage one.
+ *
+ * Shared with `pluginHostCollectionLabel`, which prefers a plugin's declared
+ * label and falls back to exactly this.
  */ export function hostContentCollectionLabel(collection) {
     const singular = /ies$/.test(collection) ? collection.replace(/ies$/, 'y') : /(ss|s)$/.test(collection) ? collection.replace(/s$/, '') : collection;
     const spaced = singular.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase();

package/src/lib/foundation/definitions/host-content-collections.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/host-content-collections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Which host subcollections the media usage scan reads (AGL-1867).\n *\n * ## Why this exists, and why it is shaped the way it is\n *\n * `scanMediaReferences` answers \"what uses this asset\" immediately before an\n * author deletes it, and every way it can be wrong points at \"unused\". AGL-1413\n * closed the screen/layout/component/host-field half. AGL-1867 closed emails.\n * What was left was plugin-owned content: a commerce product carries `imageUrl`\n * and `mediaUrls`, so a product photo used nowhere else reported as unused, and\n * the panel said so with a straight face.\n *\n * An earlier pass at this issue concluded the gap could not be closed by hand,\n * because closing it looked like classifying fifty-odd collection names as\n * media-bearing or not — \"a large list of guesses dressed as decisions, and the\n * first stale entry is where the next hole hides\". That reasoning was right\n * about the hazard and wrong about the shape of the fix. The classification it\n * feared is only necessary if the default is NOT to scan. So the default here\n * is inverted:\n *\n * **Every host subcollection is scanned unless it is named below with a\n * reason it is not.**\n *\n * That turns the open question from \"does this carry media?\" — which needs a\n * judgement about a schema nobody wrote down — into \"is scanning this wasteful\n * or wrong?\", which is answerable from the collection's own volume and who\n * writes it. It also puts the failure on the safe side: a collection nobody has\n * thought about is READ, so a plugin shipping a new media-bearing collection is\n * covered the day it lands rather than the day somebody remembers it.\n *\n * ## What keeps the list from rotting\n *\n * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host\n * subcollection names — the same derived sweep\n * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —\n * and asserts {@link PLUGIN_CONTENT_COLLECTIONS} is EXACTLY that sweep minus\n * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. A new\n * collection fails the build with a one-line decision to make, and the default\n * answer — add it to the scanned list — is also the safe one.\n *\n * ## The plugin boundary was NOT crossed to do this\n *\n * Worth stating, because \"read plugin data into a first-party corpus\" sounds\n * like it should be. It is not, and the reason is that \"plugin\" means two\n * disjoint things:\n *\n *  - a SANDBOXED marketplace plugin runs in an iframe on a separate origin and\n *    has no Firestore access at all — `plugin-bridge.ts` is the whole protocol\n *    and its guest verbs are `ready`, `resize`, `event`, `fetch-request` and\n *    `error`, with `parseGuestMessage` rejecting anything else. It owns no\n *    documents, so there is nothing here to reach into.\n *  - a FIRST-PARTY feature plugin under `libs/plugins/*` is compiled into the\n *    apps and writes ORDINARY host subcollections with the ordinary SDKs. Those\n *    documents already sit under the same `hosts/{hostId}` rules as a screen,\n *    are already read by first-party console pages, and are already covered by\n *    the same scope check the scan runs before it reads anything.\n *\n * So the corpus grows to include documents the caller could already read\n * through the console, under an authorization decision that has not changed.\n * Nothing in the sandbox boundary is bypassed, because no sandboxed guest owns\n * any of this.\n */\n\n/**\n * Host subcollections the media scan reads through its own dedicated machinery.\n *\n * Not \"excluded\" — covered, by a pass that knows their shape. Screens, layouts,\n * components and email templates each hang a node tree off\n * `…/versions/{versionId}` and get the published-version and history passes;\n * `collections` is walked one level deeper, into `…/entries`.\n */\nexport const CORE_CONTENT_COLLECTIONS = [\n  'screens',\n  'layouts',\n  'components',\n  'emailTemplates',\n  'collections',\n] as const\n\n/**\n * Host subcollections deliberately NOT read by the media scan, and why.\n *\n * Every entry has to answer one of two questions: what would scanning it cost,\n * or what would scanning it get wrong. \"It probably has no images in it\" is not\n * an accepted reason — that is the guess this file is arranged to avoid making.\n */\nexport const MEDIA_SCAN_EXCLUDED: Record<string, string> = {\n  // ── Scanning these would be WRONG, not merely expensive ────────────────\n  media:\n    'The library itself. The asset under audit IS a document in here, and its ' +\n    'own record holds its own url, cdnPath and storage path — every needle ' +\n    'the scan carries. Reading this collection would report every asset as ' +\n    'referencing itself, which turns a deletion-safety control into noise ' +\n    'that nobody reads.',\n  mediaFolders:\n    'Folder records: a name, a parent pointer and a scope. A folder never ' +\n    'holds an asset reference, and it is not a dependent either — deleting a ' +\n    'file does not break the folder it sat in.',\n  emailCampaigns:\n    'The campaign CONTAINER — a name, a date window, the list ids it is ' +\n    'aimed at and a topic. Distinct from `campaigns`, which holds the sends ' +\n    'and IS scanned because a send carries the copy that went out. A ' +\n    'container carries no copy and no asset reference: the design a send ' +\n    'renders is a screen, and the screen is where the picker writes.',\n\n  // ── Machine-written telemetry: unbounded, and no author picks into it ──\n  analytics:\n    'Per-day traffic rollups written by the tenant collector. One document ' +\n    'per day per site forever, no author-editable field, and no surface that ' +\n    'can pick an asset into one.',\n  screenAnalytics:\n    'Per-screen traffic history behind the Pro+ panel, written by the same ' +\n    'collector on the same unbounded per-day cadence.',\n  counters:\n    'Quota and usage counters, server-owned (AGL-1367) and denied to client ' +\n    'writes outright. Numbers, not content.',\n  activity:\n    'The site activity feed — an append-only audit log the console writes a ' +\n    'row into on every change. Unbounded by design, and a row that quotes an ' +\n    'asset id is a record that somebody touched it, not a place it is used.',\n\n  // ── Transaction and ledger rows: unbounded, and a SNAPSHOT is not a use ─\n  orders:\n    'Completed orders. Line items COPY a product\\'s `imageUrl` at purchase ' +\n    'time, so these would match — and matching would be the wrong answer: an ' +\n    'order is an immutable record of what was sold, deleting the asset ' +\n    'changes nothing about it, and no author can edit one. A busy store also ' +\n    'holds more of these than the whole read budget.',\n  carts:\n    'Live and abandoned carts, with the same copied line-item image and the ' +\n    'same reasoning, at higher volume — one document per shopper session.',\n  checkouts:\n    'In-flight checkout sessions. Transient buyer state carrying the same ' +\n    'line-item snapshot as `carts`.',\n  formSubmissions:\n    'Visitor form submissions. Unbounded, PII-heavy, and a file attached to ' +\n    'one is the visitor\\'s upload — not a library asset an author picked, and ' +\n    'not something deleting a library asset would break.',\n  leads:\n    'Captured leads, on the same footing as `formSubmissions`: visitor-' +\n    'submitted, unbounded, and never a place an author places an asset.',\n  bookings:\n    'Booking records — a customer, a time and a service pointer. The service ' +\n    'holds the imagery and IS scanned; a booking is the transaction against ' +\n    'it.',\n  campaignAttributions:\n    'One row per conversion — a form submission, a lead, a contact or a ' +\n    'booking — recording which campaign the visitor arrived from. Written ' +\n    'only by the Admin SDK, and the whole record is three sanitized UTM ' +\n    'strings capped at a hundred characters: there is no field an asset ' +\n    'could occupy and no surface that could pick one into it. Unbounded on ' +\n    'the same footing as the conversions it credits.',\n  reservations:\n    'POS and booking holds. Short-lived transaction rows pointing at a ' +\n    'resource that is itself scanned.',\n  stockHolds:\n    'Inventory holds taken during checkout. Machine-written, short-lived, ' +\n    'and a quantity rather than content.',\n  subscriptions:\n    'Site membership subscriptions: a plan pointer, a status and Stripe ' +\n    'ids. Server-written from the billing webhook.',\n  registers:\n    'POS register allocations — a count against the register add-on, read by ' +\n    'billing (AGL-1775). No content field at all.',\n  giftCards:\n    'Gift card balances and redemption history. Money, not content.',\n  licenseKeys:\n    'Digital-product license keys issued at fulfilment: a code, an order ' +\n    'pointer and a revocation flag.',\n  inventoryAdjustments:\n    'The append-only stock adjustment ledger (AGL-2269). One row per manual ' +\n    'stock edit and per cancellation release, unbounded over a store\\'s life.',\n  inventoryReconciliation:\n    'Reconciliation runs comparing counted stock against recorded stock. ' +\n    'Machine-written totals.',\n  restockAlerts:\n    'Back-in-stock requests: an email address and a product pointer, written ' +\n    'by visitors.',\n  suppressions:\n    'Unsubscribes, bounces and spam complaints. Email addresses and a ' +\n    'reason.',\n  stripeTaxRates:\n    'Cached Stripe tax rate ids, written by the tax sync. Vendor ids.',\n  members:\n    'The ORG-facing member roster mirrored onto the site, server-owned ' +\n    '(AGL-1367). A member\\'s photo is their own account photo, uploaded ' +\n    'through /api/account/photo and stored outside any site\\'s library, so it ' +\n    'is not an asset this scan can be asked about.',\n}\n\n/**\n * Host subcollections the media scan reads generically.\n *\n * Generically: no per-collection field list and no per-collection decoder.\n * Each document is flattened by `documentHaystack` — which decodes `nodes` and\n * `elements` through `decodeStoredNodes` first, so a plugin that adopts the\n * compressed storage form is covered without touching this file — and the\n * matching field's dotted path is recovered by walking the document. A field\n * list here would be the same staleness trap `referencingFieldPath` was written\n * to avoid one level down.\n *\n * MUST equal the repo-wide host subcollection sweep minus\n * {@link CORE_CONTENT_COLLECTIONS} minus {@link MEDIA_SCAN_EXCLUDED}. The guard\n * spec asserts exactly that, in both directions, so this list can neither miss\n * a new collection nor keep naming a deleted one.\n */\nexport const PLUGIN_CONTENT_COLLECTIONS = [\n  'actions',\n  'authors',\n  'campaigns',\n  'coupons',\n  'discounts',\n  'events',\n  'experiments',\n  'forms',\n  'functions',\n  'installs',\n  'locations',\n  'memberPosts',\n  'overlays',\n  'pluginSettings',\n  'productCategories',\n  'products',\n  'redirects',\n  'resources',\n  'reviews',\n  'services',\n  'settings',\n  'siteMembers',\n  'suppliers',\n  'templates',\n  'variables',\n  'webhooks',\n  'workflows',\n] as const\n\nexport type PluginContentCollection =\n  (typeof PLUGIN_CONTENT_COLLECTIONS)[number]\n\n/**\n * Console page slug a plugin-content reference row deep-links to.\n *\n * Optional on purpose, and deliberately not required for a collection to be\n * scanned. A row with no destination still renders — as text rather than a\n * link — and that is strictly better than the row not existing, which is the\n * bug this issue is about. Requiring a slug would have made the deep link a\n * precondition for coverage and quietly re-created the hole for every\n * collection nobody had got round to routing.\n *\n * Keyed by collection, valued with the `[pluginSlug]` segment of\n * `Route.HOST_PLUGIN`.\n */\nexport const PLUGIN_CONTENT_ROUTE_SLUG: Partial<\n  Record<PluginContentCollection, string>\n> = {\n  products: 'products',\n  productCategories: 'products',\n  suppliers: 'products',\n  locations: 'products',\n  coupons: 'products',\n  discounts: 'products',\n  reviews: 'products',\n  memberPosts: 'products',\n  events: 'events',\n  services: 'bookings',\n  resources: 'bookings',\n  redirects: 'redirects',\n  campaigns: 'marketing',\n  experiments: 'marketing',\n  workflows: 'workflows',\n  webhooks: 'workflows',\n  functions: 'logic',\n  variables: 'logic',\n  actions: 'logic',\n}\n\n/**\n * What to call one of these in a reference row.\n *\n * Derived from the collection name rather than declared, so a newly scanned\n * collection gets a readable label without a second list to keep in step —\n * `productCategories` reads as \"Product category\". Singularised with the two\n * rules English spells consistently enough to be worth automating; anything\n * else keeps its name, which is a cosmetic miss rather than a coverage one.\n */\nexport function hostContentCollectionLabel(collection: string): string {\n  const singular = /ies$/.test(collection)\n    ? collection.replace(/ies$/, 'y')\n    : /(ss|s)$/.test(collection)\n      ? collection.replace(/s$/, '')\n      : collection\n  const spaced = singular.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase()\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1)\n}\n"],"names":["CORE_CONTENT_COLLECTIONS","MEDIA_SCAN_EXCLUDED","media","mediaFolders","emailCampaigns","analytics","screenAnalytics","counters","activity","orders","carts","checkouts","formSubmissions","leads","bookings","campaignAttributions","reservations","stockHolds","subscriptions","registers","giftCards","licenseKeys","inventoryAdjustments","inventoryReconciliation","restockAlerts","suppressions","stripeTaxRates","members","PLUGIN_CONTENT_COLLECTIONS","PLUGIN_CONTENT_ROUTE_SLUG","products","productCategories","suppliers","locations","coupons","discounts","reviews","memberPosts","events","services","resources","redirects","campaigns","experiments","workflows","webhooks","functions","variables","actions","hostContentCollectionLabel","collection","singular","test","replace","spaced","toLowerCase","charAt","toUpperCase","slice"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6DC,GAED;;;;;;;CAOC,GACD,OAAO,MAAMA,2BAA2B;IACtC;IACA;IACA;IACA;IACA;CACD,CAAS;AAEV;;;;;;CAMC,GACD,OAAO,MAAMC,sBAA8C;IACzD,0EAA0E;IAC1EC,OACE,8EACA,2EACA,2EACA,0EACA;IACFC,cACE,0EACA,6EACA;IACFC,gBACE,wEACA,4EACA,qEACA,yEACA;IAEF,0EAA0E;IAC1EC,WACE,2EACA,6EACA;IACFC,iBACE,2EACA;IACFC,UACE,4EACA;IACFC,UACE,4EACA,6EACA;IAEF,2EAA2E;IAC3EC,QACE,2EACA,6EACA,uEACA,6EACA;IACFC,OACE,4EACA;IACFC,WACE,0EACA;IACFC,iBACE,4EACA,8EACA;IACFC,OACE,uEACA;IACFC,UACE,6EACA,4EACA;IACFC,sBACE,wEACA,0EACA,wEACA,wEACA,2EACA;IACFC,cACE,uEACA;IACFC,YACE,0EACA;IACFC,eACE,wEACA;IACFC,WACE,6EACA;IACFC,WACE;IACFC,aACE,yEACA;IACFC,sBACE,4EACA;IACFC,yBACE,yEACA;IACFC,eACE,6EACA;IACFC,cACE,sEACA;IACFC,gBACE;IACFC,SACE,uEACA,wEACA,8EACA;AACJ,EAAC;AAED;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,6BAA6B;IACxC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAKV;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,4BAET;IACFC,UAAU;IACVC,mBAAmB;IACnBC,WAAW;IACXC,WAAW;IACXC,SAAS;IACTC,WAAW;IACXC,SAAS;IACTC,aAAa;IACbC,QAAQ;IACRC,UAAU;IACVC,WAAW;IACXC,WAAW;IACXC,WAAW;IACXC,aAAa;IACbC,WAAW;IACXC,UAAU;IACVC,WAAW;IACXC,WAAW;IACXC,SAAS;AACX,EAAC;AAED;;;;;;;;CAQC,GACD,OAAO,SAASC,2BAA2BC,UAAkB;IAC3D,MAAMC,WAAW,OAAOC,IAAI,CAACF,cACzBA,WAAWG,OAAO,CAAC,QAAQ,OAC3B,UAAUD,IAAI,CAACF,cACbA,WAAWG,OAAO,CAAC,MAAM,MACzBH;IACN,MAAMI,SAASH,SAASE,OAAO,CAAC,sBAAsB,SAASE,WAAW;IAC1E,OAAOD,OAAOE,MAAM,CAAC,GAAGC,WAAW,KAAKH,OAAOI,KAAK,CAAC;AACvD"}
+{"version":3,"sources":["../../../../../../../libs/aglyn/src/lib/foundation/definitions/host-content-collections.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The host subcollections CORE owns, and how the media usage scan reads them\n * (AGL-1867, AGL-3080).\n *\n * ## Why this exists, and why it is shaped the way it is\n *\n * `scanMediaReferences` answers \"what uses this asset\" immediately before an\n * author deletes it, and every way it can be wrong points at \"unused\". AGL-1413\n * closed the screen/layout/component/host-field half. AGL-1867 closed emails.\n * What was left was plugin-owned content: a commerce product carries `imageUrl`\n * and `mediaUrls`, so a product photo used nowhere else reported as unused, and\n * the panel said so with a straight face.\n *\n * An earlier pass at this issue concluded the gap could not be closed by hand,\n * because closing it looked like classifying fifty-odd collection names as\n * media-bearing or not — \"a large list of guesses dressed as decisions, and the\n * first stale entry is where the next hole hides\". That reasoning was right\n * about the hazard and wrong about the shape of the fix. The classification it\n * feared is only necessary if the default is NOT to scan. So the default here\n * is inverted:\n *\n * **Every host subcollection is scanned unless it is named with a reason it is\n * not.**\n *\n * That turns the open question from \"does this carry media?\" — which needs a\n * judgement about a schema nobody wrote down — into \"is scanning this wasteful\n * or wrong?\", which is answerable from the collection's own volume and who\n * writes it. It also puts the failure on the safe side: a collection nobody has\n * thought about is READ, so a plugin shipping a new media-bearing collection is\n * covered the day it lands rather than the day somebody remembers it.\n *\n * ## Core holds core's, and asks the plugins for theirs (AGL-3080)\n *\n * This file used to hold every collection in the product: which ones commerce\n * writes, which ones marketing writes, and which console page each deep-links\n * to. That is the platform keeping a map of its plugins' storage, and the map\n * went stale exactly where a stale map is invisible — three of its deep links\n * pointed at a hub that did not hold the document, and nothing could tell.\n *\n * So a plugin declares its own collections in `plugins.config.json` and the\n * readers ask `plugin-manager/plugin-host-collections`. What is left here is\n * core's own storage, which is the only part core is entitled to name.\n *\n * ## What keeps these lists from rotting\n *\n * `host-content-media-coverage.spec.ts` sweeps `apps/**` and `libs/**` for host\n * subcollection names — the same derived sweep\n * `host-subcollection-write-deny-coverage.spec.ts` uses, for the same reason —\n * and asserts the sweep is EXACTLY these three lists plus the plugins'\n * declarations. A new collection fails the build with a one-line decision to\n * make, and the default answer — declare it scanned, on the plugin that writes\n * it — is also the safe one.\n *\n * ## The plugin boundary was NOT crossed to do this\n *\n * Worth stating, because \"read plugin data into a first-party corpus\" sounds\n * like it should be. It is not, and the reason is that \"plugin\" means two\n * disjoint things:\n *\n *  - a SANDBOXED marketplace plugin runs in an iframe on a separate origin and\n *    has no Firestore access at all — `plugin-bridge.ts` is the whole protocol\n *    and its guest verbs are `ready`, `resize`, `event`, `fetch-request` and\n *    `error`, with `parseGuestMessage` rejecting anything else. It owns no\n *    documents, so there is nothing here to reach into.\n *  - a FIRST-PARTY feature plugin under `libs/plugins/*` is compiled into the\n *    apps and writes ORDINARY host subcollections with the ordinary SDKs. Those\n *    documents already sit under the same `hosts/{hostId}` rules as a screen,\n *    are already read by first-party console pages, and are already covered by\n *    the same scope check the scan runs before it reads anything.\n *\n * So the corpus grows to include documents the caller could already read\n * through the console, under an authorization decision that has not changed.\n * Nothing in the sandbox boundary is bypassed, because no sandboxed guest owns\n * any of this.\n */\n\n/**\n * Host subcollections the media scan reads through its own dedicated machinery.\n *\n * Not \"excluded\" — covered, by a pass that knows their shape. Screens, layouts,\n * components and email templates each hang a node tree off\n * `…/versions/{versionId}` and get the published-version and history passes;\n * `collections` is walked one level deeper, into `…/entries`.\n */\nexport const CORE_CONTENT_COLLECTIONS = [\n  'screens',\n  'layouts',\n  'components',\n  'emailTemplates',\n  'collections',\n] as const\n\n/**\n * Core's own host subcollections that the scan reads generically.\n *\n * Generically: no per-collection field list and no per-collection decoder.\n * Each document is flattened by `documentHaystack` — which decodes `nodes` and\n * `elements` through `decodeStoredNodes` first — and the matching field's\n * dotted path is recovered by walking the document. A field list here would be\n * the same staleness trap `referencingFieldPath` was written to avoid one\n * level down.\n *\n * Short because it is only core's: a blog author, the per-plugin settings\n * document the plugin manager owns, and a site template. Everything else that\n * is scanned generically belongs to a plugin and is declared by it.\n */\nexport const CORE_GENERIC_SCAN_COLLECTIONS = [\n  'authors',\n  'pluginSettings',\n  'templates',\n] as const\n\n/**\n * Core's own host subcollections that the media scan deliberately does NOT\n * read, and why.\n *\n * Every entry has to answer one of two questions: what would scanning it cost,\n * or what would scanning it get wrong. \"It probably has no images in it\" is not\n * an accepted reason — that is the guess this file is arranged to avoid making.\n * A plugin's exclusions carry the same burden and live in its own declaration,\n * where `mediaScanReason` is required with `mediaScan: 'none'`.\n */\nexport const MEDIA_SCAN_EXCLUDED: Record<string, string> = {\n  media:\n    'The library itself. The asset under audit IS a document in here, and ' +\n    'its own record holds its own url, cdnPath and storage path — every ' +\n    'needle the scan carries. Reading this collection would report every ' +\n    'asset as referencing itself, which turns a deletion-safety control into ' +\n    'noise that nobody reads.',\n  mediaFolders:\n    'Folder records: a name, a parent pointer and a scope. A folder never ' +\n    'holds an asset reference, and it is not a dependent either — deleting a ' +\n    'file does not break the folder it sat in.',\n  analytics:\n    'Per-day traffic rollups written by the tenant collector. One document ' +\n    'per day per site forever, no author-editable field, and no surface that ' +\n    'can pick an asset into one.',\n  screenAnalytics:\n    'Per-screen traffic history behind the Pro+ panel, written by the same ' +\n    'collector on the same unbounded per-day cadence.',\n  counters:\n    'Quota and usage counters, server-owned (AGL-1367) and denied to client ' +\n    'writes outright. Numbers, not content.',\n  activity:\n    'The site activity feed — an append-only audit log the console writes a ' +\n    'row into on every change. Unbounded by design, and a row that quotes an ' +\n    'asset id is a record that somebody touched it, not a place it is used.',\n  members:\n    'The ORG-facing member roster mirrored onto the site, server-owned ' +\n    '(AGL-1367). A member\\'s photo is their own account photo, uploaded ' +\n    'through /api/account/photo and stored outside any site\\'s library, so it ' +\n    'is not an asset this scan can be asked about.',\n}\n\n/**\n * What to call one of these in a reference row.\n *\n * Derived from the collection name rather than declared, so a newly scanned\n * collection gets a readable label without a second list to keep in step —\n * `productCategories` reads as \"Product category\". Singularised with the two\n * rules English spells consistently enough to be worth automating; anything\n * else keeps its name, which is a cosmetic miss rather than a coverage one.\n *\n * Shared with `pluginHostCollectionLabel`, which prefers a plugin's declared\n * label and falls back to exactly this.\n */\nexport function hostContentCollectionLabel(collection: string): string {\n  const singular = /ies$/.test(collection)\n    ? collection.replace(/ies$/, 'y')\n    : /(ss|s)$/.test(collection)\n      ? collection.replace(/s$/, '')\n      : collection\n  const spaced = singular.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase()\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1)\n}\n"],"names":["CORE_CONTENT_COLLECTIONS","CORE_GENERIC_SCAN_COLLECTIONS","MEDIA_SCAN_EXCLUDED","media","mediaFolders","analytics","screenAnalytics","counters","activity","members","hostContentCollectionLabel","collection","singular","test","replace","spaced","toLowerCase","charAt","toUpperCase","slice"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0EC,GAED;;;;;;;CAOC,GACD,OAAO,MAAMA,2BAA2B;IACtC;IACA;IACA;IACA;IACA;CACD,CAAS;AAEV;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,gCAAgC;IAC3C;IACA;IACA;CACD,CAAS;AAEV;;;;;;;;;CASC,GACD,OAAO,MAAMC,sBAA8C;IACzDC,OACE,0EACA,wEACA,yEACA,6EACA;IACFC,cACE,0EACA,6EACA;IACFC,WACE,2EACA,6EACA;IACFC,iBACE,2EACA;IACFC,UACE,4EACA;IACFC,UACE,4EACA,6EACA;IACFC,SACE,uEACA,wEACA,8EACA;AACJ,EAAC;AAED;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,2BAA2BC,UAAkB;IAC3D,MAAMC,WAAW,OAAOC,IAAI,CAACF,cACzBA,WAAWG,OAAO,CAAC,QAAQ,OAC3B,UAAUD,IAAI,CAACF,cACbA,WAAWG,OAAO,CAAC,MAAM,MACzBH;IACN,MAAMI,SAASH,SAASE,OAAO,CAAC,sBAAsB,SAASE,WAAW;IAC1E,OAAOD,OAAOE,MAAM,CAAC,GAAGC,WAAW,KAAKH,OAAOI,KAAK,CAAC;AACvD"}

package/src/lib/plugin-manager/feature-plugins.d.ts

@@ -84,6 +84,17 @@ export interface ConsolePluginOrgHost {
  */
 export interface ConsolePluginOrgMount {
     orgId: string;
+    /**
+     * The organization's URL slug (AGL-3080) — the segment its console pages
+     * hang under, and what a surface needs to link to one of its siblings.
+     *
+     * Carried because plugins were reconstructing it: from `hostsPath` by
+     * splitting a string, or by resolving a site's org through an async lookup
+     * that can come back empty and leave a link unbuilt (AGL-867). The shell
+     * has it synchronously; every plugin paying for it again, differently, is
+     * the cost of not handing it over.
+     */
+    orgSlug: string;
     hosts: readonly ConsolePluginOrgHost[];
     hostsReady: boolean;
     /**
@@ -94,6 +105,27 @@ export interface ConsolePluginOrgMount {
      * cannot import the console's route table.
      */
     hostsPath: string;
+    /**
+     * Where this organization manages its PLAN — the console's billing page
+     * for the org (AGL-3080).
+     *
+     * Here for the same reason `hostsPath` is: a plugin cannot import the
+     * console's route table, and a surface that has to say "on a paid plan the
+     * cut is lower" is useless without somewhere to send the person who just
+     * read it. The shell's own upgrade notice covers an ENTITLEMENT refusal,
+     * where the surface never renders; this covers the case the surface renders
+     * fine and the plan is still the answer — a marketplace publisher seeing
+     * the free-plan fee on a listing they are about to price.
+     *
+     * OPTIONAL, and a plugin must branch on it rather than assume it: a
+     * deployment that bills nobody has no such page, and a self-hoster who
+     * removed it should not get a plugin's link into a 404. The shell's own
+     * upgrade notice makes the same allowance. `resolveOrgMount` supplies it
+     * for every mount this console builds.
+     *
+     * A plugin renders a link to it or does not, and never parses it.
+     */
+    billingPath?: string;
 }
 /**
  * Props every plugin-contributed console page receives from the shell's
@@ -113,6 +145,26 @@ export interface ConsolePluginPageProps {
     hostId: string | null;
     /** Present only at an org-level mount — see {@link ConsolePluginOrgMount}. */
     orgMount?: ConsolePluginOrgMount;
+    /**
+     * Every workspace the SIGNED-IN PERSON belongs to, as the org switcher
+     * already names them (AGL-3080) — not the mounted org's siblings, and
+     * nothing about what any of them contain.
+     *
+     * For a surface whose subject crosses workspaces. The marketplace's
+     * licences panel is the case: a purchase licenses one organization, so
+     * "I bought this once — which workspace did the licence land in?" is a
+     * question about the BUYER, and the answer is a name the reader already
+     * sees in the switcher. Resolving it from ids would be a read per row of
+     * documents the shell is already holding.
+     *
+     * Absent when the shell has not resolved them, and a surface must name the
+     * id rather than wait: this is a label, and a row with a raw id in it is
+     * worse than nothing only if the row does not appear at all.
+     */
+    viewerOrgs?: readonly {
+        id: string;
+        name: string;
+    }[];
     /** True when the org holds the extension's `featureFlag` entitlement. */
     entitled: boolean;
     /**
@@ -495,29 +547,34 @@ export declare const CONSOLE_WIDGET_SLOTS: {
     readonly orgData: "orgData";
     /** Besigner functions (ƒx) panel. Props: hostId. */
     readonly besignerFunctions: "besignerFunctions";
-    /** Marketplace listing detail body. Props: hostId, listingId, permissions. */
-    readonly marketplaceListing: "marketplaceListing";
-    /**
-     * Above the whole Marketplace subtree: what THIS DEPLOYMENT cannot do
-     * (AGL-2019, moved out of the console app by AGL-3080). No props — the
-     * widget reads {@link DeploymentCapabilities} from the context the org's
-     * server layout provides, and draws nothing when the deployment is
-     * configured.
-     *
-     * A zone rather than a component the app holds, because the sentence is
-     * the marketplace's: it names what still works without a Stripe platform
-     * (browsing, free installs) and that is the plugin's knowledge, not the
-     * shell's. The app supplies only the fact.
-     */
-    readonly marketplaceCapability: "marketplaceCapability";
     /**
-     * Org marketplace browse body (AGL-772). Props: hostId (acting site),
-     * permissions, orgScoped. The single org-scope place to browse + install,
-     * replacing the per-site marketplace tab.
-     */
-    readonly orgMarketplace: "orgMarketplace";
-    /** Plugins & add-ons hub installs section. Props: hostId. */
-    readonly orgAddons: "orgAddons";
+     * Wherever a console page offers to publish something it holds (AGL-3080).
+     * Props: {@link ConsoleArtifactPublishZoneProps}.
+     *
+     * A layouts page, a components page and the org publish panel each held a
+     * dialog that posted to `marketplace/publish-layout` and read the
+     * marketplace's price floor. The console knows it has a layout; where a
+     * layout can be PUBLISHED, what a listing costs at the least, and what to
+     * call the thing in the copy all belong to whatever sells it.
+     *
+     * ── The page says what it has, never where it goes ───────────────────────
+     *
+     * The zone is handed a {@link ConsolePublishableArtifact} in the console's
+     * own vocabulary — a kind, the site or org it belongs to, the document id —
+     * and the widget decides the endpoint, the noun and the form. A kind the
+     * widget does not publish is one it draws nothing for, which is the same
+     * answer as no widget at all.
+     *
+     * ── An offer with nowhere to go must not be made ─────────────────────────
+     *
+     * The control that OPENS this — a menu item, a button — belongs to the page
+     * and is not a widget, because it is one entry of a list the page builds.
+     * So a page offering it asks `useSlotWidgets` whether this zone has a
+     * widget at all and leaves the entry out when it does not. Drawing it
+     * anyway would be a menu item that opens nothing on a workspace with no
+     * marketplace.
+     */
+    readonly hostArtifactPublish: "hostArtifactPublish";
     /** Bottom of the host dashboard. Props: hostId, org. (AGL-433) */
     readonly dashboardFooter: "dashboardFooter";
     /** Org settings page, below the tabbed cards. Props: orgId, org. */
@@ -865,6 +922,48 @@ export interface ConsoleHostFirstRunZoneProps {
      */
     startBlank: () => void;
 }
+/**
+ * Something a console page holds that somebody may want to publish
+ * (AGL-3080).
+ *
+ * The console's own vocabulary and nothing else: a `kind` naming what the
+ * thing IS, the scope that holds it, and the document. Where it can be
+ * published to, what a listing of it is called and what it may cost are the
+ * publishing plugin's, which is the whole point of handing this over rather
+ * than building a request.
+ *
+ * `kind` is an open string for the reason a plugin's zone ids are: core
+ * listing every publishable noun would be core holding the catalog again. A
+ * widget that does not publish a kind draws nothing for it.
+ */
+export interface ConsolePublishableArtifact {
+    /** What the thing is: `layout`, `component`, `theme`, `site`, … */
+    kind: string;
+    /** The site it belongs to, where the kind belongs to one. */
+    hostId?: string | null;
+    /** The organization, for a kind held by the org rather than a site. */
+    orgId?: string | null;
+    /**
+     * The document, in the holding surface's terms. Absent for a kind that IS
+     * the site or the org — a theme, a whole site template — where the scope
+     * above already names it.
+     */
+    artifactId?: string | null;
+    /** Seeds the listing's name; the person may change it. */
+    displayName?: string;
+    description?: string;
+}
+/** What the `hostArtifactPublish` zone hands each widget (AGL-3080). */
+export interface ConsoleArtifactPublishZoneProps {
+    /**
+     * What the page asked to publish, or `null` while nothing is open. The
+     * page owns the open/closed state because the control that opens this is
+     * the page's own.
+     */
+    artifact: ConsolePublishableArtifact | null;
+    /** Closes it, however it was closed — cancelled, published, or refused. */
+    onClose: () => void;
+}
 /** What the `hostTheme` zone hands each widget (AGL-2938). */
 export interface ConsoleHostThemeZoneProps {
     hostId: string;