@aglyn/aglyn 1.0.0-beta.205 → 1.0.0-beta.206

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/aglyn",
-  "version": "1.0.0-beta.205",
+  "version": "1.0.0-beta.206",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -33,16 +33,16 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/shared-data-enums": "1.0.0-beta.205",
-    "@aglyn/shared-data-mdi": "1.0.0-beta.205",
-    "@aglyn/shared-data-types": "1.0.0-beta.205",
-    "@aglyn/shared-util-email": "1.0.0-beta.205",
-    "@aglyn/shared-util-first-touch": "1.0.0-beta.205",
-    "@aglyn/shared-util-http": "1.0.0-beta.205",
-    "@aglyn/shared-util-logger": "1.0.0-beta.205",
-    "@aglyn/shared-util-timestamp": "1.0.0-beta.205",
-    "@aglyn/shared-util-tools": "1.0.0-beta.205",
-    "@aglyn/shared-util-vendor": "1.0.0-beta.205",
+    "@aglyn/shared-data-enums": "1.0.0-beta.206",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.206",
+    "@aglyn/shared-data-types": "1.0.0-beta.206",
+    "@aglyn/shared-util-email": "1.0.0-beta.206",
+    "@aglyn/shared-util-first-touch": "1.0.0-beta.206",
+    "@aglyn/shared-util-http": "1.0.0-beta.206",
+    "@aglyn/shared-util-logger": "1.0.0-beta.206",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.206",
+    "@aglyn/shared-util-tools": "1.0.0-beta.206",
+    "@aglyn/shared-util-vendor": "1.0.0-beta.206",
     "@data-driven-forms/react-form-renderer": "^4.2.0",
     "@msgpack/msgpack": "^3.1.3",
     "@types/unist": "^3.0.3",

package/src/lib/app-utils/console-routes.d.ts

@@ -18,6 +18,9 @@ export declare enum Route {
     ADMIN_ORGS = "/admin/orgs",
     ADMIN_ORG_DETAIL = "/admin/orgs/[orgId]",
     ADMIN_ORG_HOST_DETAIL = "/admin/orgs/[orgId]/host/[hostId]",
+    ADMIN_SITES = "/admin/sites",
+    ADMIN_SITE_DETAIL = "/admin/sites/[hostId]",
+    ADMIN_SITE_PREVIEW = "/admin/sites/[hostId]/preview/[kind]/[docId]",
     ADMIN_OVERVIEW = "/admin/overview",
     ADMIN_COUPONS = "/admin/coupons",
     ADMIN_LOCKDOWN = "/admin/lockdown",
@@ -210,6 +213,15 @@ export interface RoutePayload {
         orgId: string;
         hostId: string;
     };
+    [Route.ADMIN_SITES]: undefined;
+    [Route.ADMIN_SITE_DETAIL]: {
+        hostId: string;
+    };
+    [Route.ADMIN_SITE_PREVIEW]: {
+        hostId: string;
+        kind: string;
+        docId: string;
+    };
     [Route.ADMIN_OVERVIEW]: undefined;
     [Route.ADMIN_COUPONS]: undefined;
     [Route.ADMIN_LOCKDOWN]: undefined;

package/src/lib/app-utils/console-routes.js

@@ -24,6 +24,14 @@ export var Route = /*#__PURE__*/ function(Route) {
     Route["ADMIN_ORGS"] = "/admin/orgs";
     Route["ADMIN_ORG_DETAIL"] = "/admin/orgs/[orgId]";
     Route["ADMIN_ORG_HOST_DETAIL"] = "/admin/orgs/[orgId]/host/[hostId]";
+    // Every site on the platform, across organizations, and one site's staff
+    // detail (AGL-3378). The org-nested host route above redirects here.
+    Route["ADMIN_SITES"] = "/admin/sites";
+    Route["ADMIN_SITE_DETAIL"] = "/admin/sites/[hostId]";
+    // A site's screen, layout, component, template or form as its draft renders,
+    // for staff who are not members of the site (AGL-3378). `kind` is a
+    // `PreviewKind`; the version, when not the current one, rides `?version=`.
+    Route["ADMIN_SITE_PREVIEW"] = "/admin/sites/[hostId]/preview/[kind]/[docId]";
     Route["ADMIN_OVERVIEW"] = "/admin/overview";
     // Staff coupon management (AGL-1105): create discount coupons + promotion
     // codes and read the live net-margin rating before committing to one.

package/src/lib/app-utils/console-routes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/console-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// URL scheme (AGL-621): the org is a first-class path segment `[orgSlug]`\n// so the URL — not client-side precedence — is the source of truth for the\n// active workspace. Host routes nest under `/[orgSlug]/hosts/[host]`; the\n// org area (settings, team, billing, media, data, plugins, support,\n// marketplace) lives directly under `/[orgSlug]`. User-level `manage/*`,\n// staff `admin/*`, and `auth` routes are NOT org-scoped. Hosts stay keyed\n// by doc id here; AGL-622 swaps `[hostId]` for the subdomain slug.\nexport enum Route {\n  ADMIN_ORGS = '/admin/orgs',\n  ADMIN_ORG_DETAIL = '/admin/orgs/[orgId]',\n  ADMIN_ORG_HOST_DETAIL = '/admin/orgs/[orgId]/host/[hostId]',\n  ADMIN_OVERVIEW = '/admin/overview',\n  // Staff coupon management (AGL-1105): create discount coupons + promotion\n  // codes and read the live net-margin rating before committing to one.\n  ADMIN_COUPONS = '/admin/coupons',\n  // The panic button (AGL-1501): platform/org/host/user lockdown controls.\n  ADMIN_LOCKDOWN = '/admin/lockdown',\n  // The narrow lever beside it (AGL-1687): disable or release ONE uploaded\n  // file. Its own page rather than a panel on Lockdown because the input is\n  // an asset, not a scope — the two forms share no field but the reason.\n  ADMIN_MEDIA_QUARANTINE = '/admin/media-quarantine',\n  // The INPUT to the two levers above (AGL-1964). Lockdown and quarantine are\n  // both things an operator does after learning there is a problem; until\n  // this page there was no way for anyone outside the company to say there\n  // was one. Reports arrive from the unauthenticated form the tenant runtime\n  // serves at /api/report-abuse on every origin.\n  ADMIN_ABUSE_REPORTS = '/admin/abuse-reports',\n  // The same input, one collection over (AGL-2310). The marketplace's own\n  // report button wrote `marketplaceReports` from the day it shipped and\n  // nothing read it — every report filed, acknowledged, and unreachable. This\n  // is that queue, deliberately shaped like the abuse one rather than as a\n  // second vocabulary for the same act.\n  // The probes, on a screen (AGL-1900). /api/health/{backups,rate-limits,\n  // signups} and /api/admin/email-health each answered a bad-day question to\n  // a curl and to nothing else; this is where an operator reads them.\n  ADMIN_HEALTH = '/admin/health',\n  // The maintenance jobs, on a screen (AGL-1949). audit-archive,\n  // reap-plugin-artifacts and reverify-plugin-versions accepted the shared\n  // cron secret and nothing else, so the only way to preview or run one was a\n  // shell holding the production secret. Separate from Health because Health\n  // reads and this acts.\n  ADMIN_MAINTENANCE = '/admin/maintenance',\n  // The Texas sales tax return (AGL-1900). The figures AGL-1811 computes had\n  // only a curl to reach them; filing happens on a fixed quarterly calendar\n  // from 2026-09-01, so the return needs a URL a person can bookmark.\n  ADMIN_REVENUE = '/admin/revenue',\n  // Realised band utilization and the margin that follows from it. Beside\n  // Revenue because the two are the halves of one question: that page reports\n  // what came in, this one what serving it cost.\n  ADMIN_MARGIN_UTILIZATION = '/admin/margin-utilization',\n  ADMIN_TAX_RETURN = '/admin/tax-return',\n  ADMIN_AUDIT = '/admin/audit',\n  ADMIN_USERS = '/admin/users',\n  ADMIN_USER_DETAIL = '/admin/users/[uid]',\n  ADMIN_FLAGS = '/admin/flags',\n  // Platform-wide settings that are not a release flag (AGL-2486). The\n  // free-workspace ceiling was the first of them and it opened the\n  // Organizations LIST, above the table — a global lever wedged into the\n  // screen for browsing individual orgs. Settings that describe the platform\n  // rather than one org belong on their own tab, beside the flags.\n  ADMIN_SETTINGS = '/admin/settings',\n  // One submission or listed plugin in full (AGL-959): the queue index is\n  // for scanning, this is where a reviewer reads the manifest, weighs the\n  // verifier findings and acts.\n  // A page a plugin adds to the staff area (AGL-2939), rendered by the\n  // console's generic staff route. The console's own staff routes win the\n  // segments they use.\n  ADMIN_STAFF_PAGE = '/admin/[staffPage]',\n  // Staff support-ticket queue (AGL-849): the operator side of the\n  // subscriber `MANAGE_SUPPORT_TICKETS` page — every org's tickets in one place.\n  ADMIN_SUPPORT = '/admin/support',\n  // Do-not-contact list (AGL-1592): the intake and the queue for Privacy\n  // Policy v4 §11's marketing call/text opt-out, and for \"delete the phone\n  // number you hold for me\".\n  ADMIN_CONTACT_SUPPRESSIONS = '/admin/contact-suppressions',\n  ADMIN_EMAILS = '/admin/emails',\n  // The one besigner route with no host and no org in it (AGL-749). A system\n  // email belongs to the platform, not to a workspace, so it is staff-scoped\n  // like the rest of `/admin/*` rather than nested under `[orgSlug]`.\n  ADMIN_EMAIL_BESIGNER = '/admin/emails/[templateKey]/versions/[versionId]/besigner',\n  ORG_HOME = '/[orgSlug]',\n  ORG_MEDIA = '/[orgSlug]/media',\n  ORG_DATA = '/[orgSlug]/data',\n  /*\n   * The organization's address book.\n   *\n   * Org-scoped rather than a section of a site, because it answers the one\n   * question a site page cannot: which of the organization's sites know a\n   * given person. A contact document is shared by every site in the org — one\n   * human who touched two of them is one row — and until this route there was\n   * no surface anywhere that showed the deduped person, so the dedupe the\n   * shared address book exists for was invisible and the billing unit\n   * (unique people per org) had nothing standing behind it.\n   *\n   * It shows identity, which sites hold the person, and consent per site. The\n   * per-site CRM — notes, tags, timeline, order history — stays on the site's\n   * own Contacts surface, because those are the holder's business records and\n   * this is the one route designed to cross between holders.\n   *\n   * A LEGACY ADDRESS since AGL-2630: the page behind it redirects, permanently,\n   * to the org-level CRM hub's contacts section. It stays declared so a link\n   * kept from before — a bookmark, a docs page, an email — still resolves,\n   * and so the redirect has a constant to be built from rather than a string.\n   */\n  ORG_CONTACTS = '/[orgSlug]/contacts',\n  /*\n   * The organization-level CRM hub (AGL-2630): the same sections the site hub\n   * has — `/[orgSlug]/crm/<section>[/<recordId>]` — mounted with an ORG scope,\n   * for an org-wide member who works every site's people at once. A bare\n   * `/crm` lands on the first section the reader may open, as the site hub's\n   * does. What this route adds over the site hub is the cross-site fact the\n   * old address book carried — which sites know a person — and what it takes\n   * from it is the site every create must name, since a record is always\n   * captured BY a site.\n   */\n  ORG_CRM = '/[orgSlug]/crm',\n  /*\n   * The generic ORGANIZATION-level plugin route (AGL-2974): every surface an\n   * extension declares in `orgNavItems` is served here, at\n   * `/[orgSlug]/<href>[/<section>…]`, by\n   * `app/(app)/[orgSlug]/[...pluginSlug]/page.tsx`. The org twin of\n   * `HOST_PLUGIN`, and like it the one org route whose leaf segment is data:\n   * every named org route in this enum wins over it.\n   */\n  ORG_PLUGIN = '/[orgSlug]/[pluginSlug]',\n  ORG_PLUGINS = '/[orgSlug]/plugins',\n  // One plugin, as installed in this workspace (AGL-1007): scope, settings\n  // and permissions in one place. The segment takes EITHER identifier\n  // (AGL-1010) — a listing id for a marketplace install, a registry id for a\n  // first-party plugin — hence `pluginRef` rather than `listingId`.\n  ORG_PLUGIN_INSTALLATION = '/[orgSlug]/plugins/[pluginRef]',\n  // Org-scope marketplace (AGL-772): the single place to browse, view and\n  // install marketplace items. The per-site tab it replaced, and the retired\n  // `/[orgSlug]/marketplace` seller area, were removed with the rest of the\n  // `marketplace` naming in AGL-975 — the word is being freed for a public\n  // forum, and a redirect stub sitting on `/marketplace` would have taken the\n  // one path that feature wants.\n  /*\n   * The marketplace's own SECTIONS are not here any more (AGL-3080). Eight\n   * of them — browse, licences, upload, the four seller cards and the\n   * publish form — were hand-written console routes, and became an\n   * `orgNavItems` declaration whose `sections` name those segments once, in\n   * the plugin. Restating them here was a second copy of a list the plugin\n   * owns, and every entry had zero callers the moment the routes went.\n   *\n   * What stays is what the CONSOLE still builds: the surface itself, a\n   * listing, a publisher, and the installed tab that the org plugins card\n   * links across to. A console page linking into a plugin's surface is the\n   * ordinary case; a console page enumerating that surface's sections is\n   * not.\n   */\n  ORG_MARKETPLACE = '/[orgSlug]/marketplace',\n  /*\n   * Marketplace SECTIONS are routes (AGL-2501), for the reason the settings\n   * and account sections are: a panel that is not open should cost nothing,\n   * and the seller half of this hub reads the organization's REVENUE.\n   *\n   * The four seller sections are the reason the layout gates rather than the\n   * rail. As tabs they were simply not rendered for a member without\n   * `publishToMarketplace`; as routes each one is reachable by typing its URL,\n   * so the refusal has to sit above them all rather than in the list that\n   * draws them.\n   *\n   * Every segment here is shorter than the ten characters `createResourceUid`\n   * emits, so none of them can ever shadow a real `[listingId]` sitting at the\n   * same level. `upload` rather than `publish` because `publish/plugin` is\n   * already a route beneath this one, and two directories contributing the\n   * same segment is a tree Next cannot resolve a layout for.\n   */\n  ORG_MARKETPLACE_INSTALLED = '/[orgSlug]/marketplace/installed',\n  ORG_MARKETPLACE_LISTING = '/[orgSlug]/marketplace/[listingId]',\n  ORG_MARKETPLACE_PUBLISHER = '/[orgSlug]/marketplace/publisher/[handle]',\n  // Publishing a plugin is a page, not a modal (AGL-1078): the most\n  // consequential thing a publisher does now has a URL, so it can be linked,\n  // reloaded, and reached from a listing to ship an update.\n  ORG_SETTINGS = '/[orgSlug]/settings',\n  /*\n   * Settings SECTIONS are routes (AGL-2501). `HubTabs` mounted every panel —\n   * `keepMounted`, with `lazy` off by default and passed by nobody — so\n   * opening General also mounted the API-keys, SSO and data-export cards and\n   * ran every read in them. Routes mount one page and code-split per route.\n   * `ORG_SETTINGS` itself redirects to General.\n   */\n  ORG_SETTINGS_GENERAL = '/[orgSlug]/settings/general',\n  ORG_SETTINGS_PROFILE = '/[orgSlug]/settings/profile',\n  ORG_SETTINGS_PLUGINS = '/[orgSlug]/settings/plugins',\n  ORG_SETTINGS_API_KEYS = '/[orgSlug]/settings/api-keys',\n  ORG_SETTINGS_BRANDING = '/[orgSlug]/settings/branding',\n  ORG_SETTINGS_SSO = '/[orgSlug]/settings/sso',\n  ORG_SETTINGS_OWNERSHIP = '/[orgSlug]/settings/ownership',\n  /**\n   * Export the people a workspace holds and file a person's erasure\n   * (AGL-2839) — outside the CRM, so it is there on every plan.\n   */\n  ORG_SETTINGS_PRIVACY = '/[orgSlug]/settings/privacy',\n  // Holds & reviews (AGL-3368): everything on the workspace that was held,\n  // flagged, locked or paused, its status, and the way to request a review.\n  // Where every risk notice's \"Request a review\" lands (`?notice=<id>`).\n  ORG_SETTINGS_HOLDS = '/[orgSlug]/settings/holds',\n  ORG_SETTINGS_DELETE = '/[orgSlug]/settings/delete',\n  /**\n   * Billing, section by section (AGL-2501).\n   *\n   * `MANAGE_BILLING` is unchanged and is the PLAN section — it resolves to a\n   * page inside a route group, which adds no path segment. That is what makes\n   * this split free: every link in the console, every hash anchor\n   * (`#addons`, `#collaborator-seats`) and Stripe's own dunning mail all point\n   * here already and none of them moves. No redirect, and no `?tab=` shim to\n   * carry forever.\n   */\n  MANAGE_BILLING = '/[orgSlug]/billing',\n  MANAGE_BILLING_USAGE = '/[orgSlug]/billing/usage',\n  MANAGE_BILLING_INVOICES = '/[orgSlug]/billing/invoices',\n  MANAGE_BILLING_SETTINGS = '/[orgSlug]/billing/settings',\n  // The ONE billing URL that carries no org (AGL-2430).\n  //\n  // Everything else on this table is org-scoped, which is correct for a\n  // console and wrong for the only caller that cannot template a URL:\n  // Stripe's dunning emails. \"Payment method updates\" takes a single static\n  // link for every customer in the account — there is no `{{org}}` to\n  // interpolate — so a table with no org-agnostic billing entry means those\n  // emails can only ever point at a page that is not billing. Today all four\n  // of them point at the marketing homepage, which is how a failed card\n  // becomes a cancelled subscription with no reachable way to fix it.\n  //\n  // This resolves the org from the SESSION instead of from the URL: one\n  // workspace goes straight through, several offer a choice, none says so.\n  // `billing` is a reserved subdomain (`RESERVED_SUBDOMAINS`), so no org can\n  // hold this slug and the literal segment can never shadow a real\n  // `/[orgSlug]`.\n  BILLING_ENTRY = '/billing',\n  MANAGE_USER_SETTINGS = '/manage/user',\n  /*\n   * Account SECTIONS are routes (AGL-2501). `HubTabs` mounted every panel —\n   * `keepMounted`, with `lazy` off by default and passed by nobody — so\n   * opening Account also mounted the email-addresses, passkeys, recent\n   * sign-ins, data-export and close-account cards and ran every read in them.\n   * Routes mount one page and code-split per route.\n   *\n   * The segments are the ids the panels carried, because a transactional\n   * email already in people's inboxes links `/manage/user?tab=security`:\n   * `MANAGE_USER_SETTINGS` forwards each of those ids to the section that\n   * holds it, and the segment matching the id is what keeps that map a\n   * one-liner rather than a second naming scheme.\n   */\n  MANAGE_USER_ACCOUNT = '/manage/user/account',\n  MANAGE_USER_EMAILS = '/manage/user/emails',\n  MANAGE_USER_PROFILE = '/manage/user/profile',\n  MANAGE_USER_BASIC = '/manage/user/basic',\n  MANAGE_USER_SECURITY = '/manage/user/security',\n  MANAGE_USER_CLOSE = '/manage/user/close',\n  MANAGE_NOTIFICATIONS = '/manage/notifications',\n  /*\n   * The preferences, off the feed (AGL-3226).\n   *\n   * They lived in the header of the feed itself, which was already the\n   * tallest thing on that page before per-channel and per-scope settings\n   * multiplied them — and it put an edit form above the list it edits, which\n   * the console does nowhere else.\n   *\n   * A CHILD of the feed rather than a sibling under `/manage`, because the\n   * relationship is exactly that: it configures what the page above it shows.\n   * That also keeps `/manage/notifications` the address in the transactional\n   * mail already in people's inboxes, which keeps working and now carries a\n   * button to here.\n   */\n  MANAGE_NOTIFICATION_SETTINGS = '/manage/notifications/settings',\n  /*\n   * A URL for the defect channel (AGL-2486). \"Report an issue\" was reachable\n   * only by opening the account menu, so nothing outside the console could\n   * send anyone to it — the repo's README pointed at GitHub issues, which we\n   * do not use, and every other \"tell us about it\" surface had the same\n   * problem. User-level rather than org-scoped because the dialog is: it\n   * needs no workspace, no role and no paid plan.\n   */\n  MANAGE_REPORT_ISSUE = '/manage/report-issue',\n  AUTH_SIGN_IN = '/signin',\n  AUTH_SIGN_OUT = '/signout',\n  AUTH_SIGN_UP = '/signup',\n  AUTH_VERIFY_EMAIL = '/verify-email',\n  HOST_LIST = '/[orgSlug]/hosts',\n  HOST_CONTENT = '/[orgSlug]/hosts/[host]/content',\n  // The collection is a PATH SEGMENT, not `?collection=` (AGL-2498).\n  //\n  // It was a query parameter because the manager began as one page with a\n  // Select on it, and the Select was the only thing that knew which\n  // collection you were looking at. That is the wrong owner: which collection\n  // is open is the page's IDENTITY, not a filter applied to it. As a\n  // parameter it could be dropped by any link that rebuilt the query, it\n  // sorted below `?tab=` in a URL nobody could read, and — the reason this\n  // moved — it left the entry beneath it with nowhere to hang: an entry is\n  // addressed `collection + entry`, and half of that address cannot live in\n  // the path while the other half lives in the query.\n  //\n  // The segment is the collection's SLUG, not its document id, and that is a\n  // correction rather than a preference. Collection document ids are not\n  // uniform — the seeded ones were given readable ids (`blog`, `changelog`)\n  // and everything created since gets a `createResourceUid`, so routing by id\n  // produced `/content/changelog` beside `/content/QgXv7lU_rG` on ONE site.\n  //\n  // A slug is the right key on the merits too: it is unique per host and kind\n  // (claimed in a transaction by /api/hosts/collections), it is the\n  // collection's own public address, and it is the thing an author recognises.\n  // A document id is still ACCEPTED and rewritten to the slug form, so no\n  // existing link breaks.\n  //\n  // `?collection=` still resolves the same way (AGL-845's DAM deep links are\n  // in the wild).\n  HOST_CONTENT_COLLECTION = '/[orgSlug]/hosts/[host]/content/[collectionSlug]',\n  // One entry's detail page (AGL-2498). `entries` is a LITERAL segment rather\n  // than `content/[collectionId]/[entryId]`, and it is load-bearing twice\n  // over: it mirrors the Firestore path the entry actually lives at\n  // (`collections/{c}/entries/{e}`), and it keeps the id space clear so a\n  // later sibling — a collection's own settings page, say — cannot be\n  // shadowed by an entry that happens to be called the same thing.\n  //\n  // `[entryId]` also carries the sentinel `new`, which is a draft that has no\n  // document yet. Entry ids come from `createResourceUid`, so nothing real\n  // can collide with it.\n  CONTENT_ENTRY_DETAILS = '/[orgSlug]/hosts/[host]/content/[collectionSlug]/entries/[entryId]',\n  MANAGE_TEAM = '/[orgSlug]/team',\n  /*\n   * Team SECTIONS are routes, not tabs (AGL-2501). A section's bundle then\n   * arrives when a reader opens it and never before, the section is linkable,\n   * and the active state is a fact about the URL rather than state that has to\n   * be kept in sync with it. `MANAGE_TEAM` itself redirects to members.\n   */\n  MANAGE_TEAM_MEMBERS = '/[orgSlug]/team/members',\n  MANAGE_TEAM_ROLES = '/[orgSlug]/team/roles',\n  MANAGE_TEAM_ACTIVITY = '/[orgSlug]/team/activity',\n  MANAGE_TEAM_MEMBER = '/[orgSlug]/team/[uid]',\n  // Support is an UMBRELLA, not a page (AGL-1158). The two channels beneath\n  // it are separate features that were only ever one screen: they are gated\n  // differently (tickets need a first-response commitment, from Pro; the\n  // forum is open to every tier including Free) and they fail independently.\n  // Sharing one route made them share a blast radius — AGL-1157 was one bad\n  // line in the common loader that emptied BOTH lists at once.\n  //\n  // `MANAGE_SUPPORT` itself stays, and stays the nav tab's href: it now\n  // forwards to whichever channel the org's tier makes primary, so a\n  // forum-only workspace lands on a whole forum instead of a half-empty page\n  // beside a ticket card it may not use.\n  MANAGE_SUPPORT = '/[orgSlug]/support',\n  MANAGE_SUPPORT_TICKETS = '/[orgSlug]/support/tickets',\n  MANAGE_SUPPORT_FORUM = '/[orgSlug]/support/forum',\n  /*\n   * The ONE support URL that carries no org (AGL-3265), and the second member\n   * of the apex category `BILLING_ENTRY` opened.\n   *\n   * Everything a person is handed when they need help — a receipt, a system\n   * email footer, a Stripe customer portal, a self-host runbook — stores ONE\n   * link for every customer, with no workspace to interpolate. `/[orgSlug]`\n   * cannot be templated into any of them, so the only support address those\n   * surfaces could carry was one outside the console entirely.\n   *\n   * This resolves the workspace from the SESSION instead: one workspace goes\n   * straight through, several offer a choice, none says so. It forwards to\n   * `MANAGE_SUPPORT`, which is itself an umbrella — so the tier decision about\n   * tickets versus the forum stays in the one place that already makes it.\n   *\n   * `support` is a reserved subdomain (`RESERVED_SUBDOMAINS` in\n   * `host-naming.ts`), so no org can hold this slug and the literal segment\n   * can never shadow a real `/[orgSlug]`. That is the same guarantee\n   * `BILLING_ENTRY` rests on, and it is a precondition rather than a\n   * coincidence: an apex route whose segment an org could claim would take a\n   * workspace's own address away from it.\n   */\n  SUPPORT_ENTRY = '/support',\n  HOST_DASHBOARD = '/[orgSlug]/hosts/[host]',\n  // The catch-all console page a plugin's own nav items resolve against\n  // (`app/(app)/[orgSlug]/hosts/[host]/[pluginSlug]/page.tsx`). Plugin slugs\n  // are open-ended, so this is the one route whose leaf segment is data.\n  HOST_PLUGIN = '/[orgSlug]/hosts/[host]/[pluginSlug]',\n  HOST_INBOX = '/[orgSlug]/hosts/[host]/inbox',\n  HOST_CONTACTS = '/[orgSlug]/hosts/[host]/contacts',\n  HOST_MEDIA = '/[orgSlug]/hosts/[host]/media',\n  HOST_SETUP = '/[orgSlug]/hosts/[host]/setup',\n  /*\n   * Setup SECTIONS are routes (AGL-2501), so an unopened one costs neither a\n   * read nor a byte. `HOST_SETUP` stays the nav tab's href and redirects to\n   * Basic details, honouring the `?tab=` ids these sections were deep-linked\n   * by — unlike the settings and marketplace hubs, links holding those ids are\n   * demonstrably in the wild and two are built in this repo.\n   */\n  HOST_SETUP_DETAILS = '/[orgSlug]/hosts/[host]/setup/details',\n  HOST_SETUP_SEO = '/[orgSlug]/hosts/[host]/setup/seo',\n  HOST_SETUP_TRACKING = '/[orgSlug]/hosts/[host]/setup/tracking',\n  HOST_SETUP_THEME = '/[orgSlug]/hosts/[host]/setup/theme',\n  HOST_SETUP_EMAILS = '/[orgSlug]/hosts/[host]/setup/emails',\n  // Host Admin area (AGL-1014): owner/admin-only controls — per-site plugin\n  // enablement and the Danger zone — out of the Setup page collaborators\n  // legitimately visit.\n  HOST_ADMIN = '/[orgSlug]/hosts/[host]/admin',\n  /*\n   * Site-admin SECTIONS are routes (AGL-2501), so an unopened one costs neither\n   * a read nor a byte. `HOST_ADMIN` redirects to Plugins and still honours the\n   * `?tab=` ids these sections were deep-linked by.\n   */\n  /*\n   * The site as an OBJECT: its name in the console and the subdomain it\n   * answers to. First in the rail because an address and a name are what\n   * identify the thing every other section governs.\n   */\n  HOST_ADMIN_GENERAL = '/[orgSlug]/hosts/[host]/admin/general',\n  HOST_ADMIN_PLUGINS = '/[orgSlug]/hosts/[host]/admin/plugins',\n  /*\n   * One plugin, as installed on ONE site (AGL-428, AGL-1014) — the\n   * site-scoped twin of `ORG_PLUGIN_INSTALLATION`, reached by clicking a row\n   * on the site's plugin\n   * list exactly as the workspace list opens its own detail page. The segment\n   * is `[pluginRef]` and accepts either identifier for the same reason the\n   * workspace route does (AGL-1010): a marketplace install is keyed by listing\n   * id, a first-party plugin by its registry id, and an admin does not think\n   * of the two as different things.\n   */\n  HOST_ADMIN_PLUGIN = '/[orgSlug]/hosts/[host]/admin/plugins/[pluginRef]',\n  HOST_ADMIN_DOMAIN = '/[orgSlug]/hosts/[host]/admin/domain',\n  HOST_ADMIN_SECURITY = '/[orgSlug]/hosts/[host]/admin/security',\n  /*\n   * The designed screen behind each status code, and the switch that shows the\n   * 503 one at every address at once (AGL-3178).\n   *\n   * Beside Security because both answer what a visitor's browser is handed on\n   * a page the site did not design for them, and above Activity because it is\n   * a control rather than a record.\n   */\n  HOST_ADMIN_ERROR_PAGES = '/[orgSlug]/hosts/[host]/admin/error-pages',\n  HOST_ADMIN_ACTIVITY = '/[orgSlug]/hosts/[host]/admin/activity',\n  /*\n   * Backup, restore and publishing the site as a template — moving the whole\n   * site somewhere else, or bringing it back. Its own section rather than the\n   * Danger zone: restore overwrites, but export and publishing a template do\n   * not, and filing all three under a destructive heading mislabels two of\n   * them.\n   */\n  HOST_ADMIN_BACKUP = '/[orgSlug]/hosts/[host]/admin/backup',\n  HOST_ADMIN_DANGER = '/[orgSlug]/hosts/[host]/admin/danger',\n  HOST_THEME = '/[orgSlug]/hosts/[host]/theme',\n  /*\n   * The automation section: Workflows, Actions and Webhooks under one parent.\n   * The parent is named for what the three have in common, so no tab shares a\n   * name with the section that contains it.\n   */\n  HOST_AUTOMATION = '/[orgSlug]/hosts/[host]/automation',\n  /**\n   * The address the automation section answered to before it had a name of\n   * its own. Nothing links here — `HOST_AUTOMATION` is what the nav, the\n   * search results and the activity feed build — but the console redirects it\n   * permanently, so a held bookmark still lands on the section (and keeps its\n   * `?tab=`, which never changed).\n   *\n   * Kept on the table rather than as a bare literal in `next.config.js`\n   * because the redirect and the address it serves are one fact:\n   * `automation-section.spec.ts` reads this entry and fails if the rule for\n   * it goes missing.\n   */\n  HOST_WORKFLOWS = '/[orgSlug]/hosts/[host]/workflows',\n  HOST_DATA = '/[orgSlug]/hosts/[host]/data',\n  HOST_LOGIC = '/[orgSlug]/hosts/[host]/logic',\n  HOST_PRODUCTS = '/[orgSlug]/hosts/[host]/products',\n  HOST_COMPONENTS = '/[orgSlug]/hosts/[host]/components',\n  // Component detail (AGL-693): the listing links here, and the besigner is\n  // reached from here — matching SCREEN_DETAILS rather than jumping a row\n  // straight into the editor.\n  COMPONENT_DETAILS = '/[orgSlug]/hosts/[host]/components/[componentId]',\n  HOST_FORMS = '/[orgSlug]/hosts/[host]/forms',\n  // A form is a designable document, so its surface is the component one:\n  // a list, a detail page that owns the versions, and the besigner reached\n  // from there. Deliberately NOT a row that jumps into the editor — a form's\n  // routing and consent field are edited on the detail page, and those decide\n  // what the design is then checked against.\n  FORM_DETAILS = '/[orgSlug]/hosts/[host]/forms/[formId]',\n  HOST_TEMPLATES = '/[orgSlug]/hosts/[host]/templates',\n  // Template detail (AGL-694), the counterpart to COMPONENT_DETAILS. Note\n  // TEMPLATE_BESIGNER carries no versionId — templates version but never\n  // publish, so there is no \"current\" pointer to route through.\n  TEMPLATE_DETAILS = '/[orgSlug]/hosts/[host]/templates/[templateId]',\n  HOST_MARKETING = '/[orgSlug]/hosts/[host]/marketing',\n  HOST_BOOKINGS = '/[orgSlug]/hosts/[host]/bookings',\n  // Events now come from the events-calendar plugin, served by the generic\n  // `[orgSlug]/hosts/[host]/[pluginSlug]` route (AGL-394).\n  HOST_REDIRECTS = '/[orgSlug]/hosts/[host]/redirects',\n  HOST_USERS = '/[orgSlug]/hosts/[host]/users',\n  HOST_ANALYTICS = '/[orgSlug]/hosts/[host]/analytics',\n  COMPONENT_BESIGNER = '/[orgSlug]/hosts/[host]/components/[componentId]/versions/[versionId]/besigner',\n  FORM_BESIGNER = '/[orgSlug]/hosts/[host]/forms/[formId]/versions/[versionId]/besigner',\n  TEMPLATE_BESIGNER = '/[orgSlug]/hosts/[host]/templates/[templateId]/besigner',\n  LAYOUT_BESIGNER = '/[orgSlug]/hosts/[host]/layouts/[layoutId]/versions/[versionId]/besigner',\n  // Draft preview for every besigner document kind (AGL-1203). Screens had\n  // the only preview route; components, layouts and templates showed a\n  // Preview button that did nothing. Each renders the same localStorage\n  // snapshot through the site renderer, so they work on localhost with no\n  // deployment. TEMPLATE_PREVIEW carries no versionId, matching\n  // TEMPLATE_BESIGNER.\n  COMPONENT_PREVIEW = '/[orgSlug]/hosts/[host]/components/[componentId]/versions/[versionId]/preview',\n  FORM_PREVIEW = '/[orgSlug]/hosts/[host]/forms/[formId]/versions/[versionId]/preview',\n  TEMPLATE_PREVIEW = '/[orgSlug]/hosts/[host]/templates/[templateId]/preview',\n  LAYOUT_PREVIEW = '/[orgSlug]/hosts/[host]/layouts/[layoutId]/versions/[versionId]/preview',\n  // The list sits at the bare path, like HOST_COMPONENTS. It used to be\n  // `/layouts/list`: the pages router had a `layouts/index.tsx` that\n  // redirected to `layouts/list.tsx`, and the App Router migration carried\n  // the pair over verbatim. Components, added later, had no such legacy and\n  // put its list at the bare path — which is the shape we want everywhere.\n  // `/layouts/list` still serves the same page so old links survive — an\n  // alias, not a redirect, because the bare path used to answer a cached 308\n  // pointing at `/list` and redirecting back would loop. See the comment in\n  // `app/(app)/[orgSlug]/hosts/[host]/screens/list/page.tsx`.\n  HOST_LAYOUTS = '/[orgSlug]/hosts/[host]/layouts',\n  // Layout detail (AGL-695), completing the list → detail → besigner shape\n  // across screens, components, templates and layouts.\n  LAYOUT_DETAILS = '/[orgSlug]/hosts/[host]/layouts/[layoutId]',\n  SCREEN_BESIGNER = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/besigner',\n  // Per-site email besigner (AGL-770): a site owner designs a transactional\n  // email their site sends. The host-scoped sibling of the staff system-email\n  // editor (ADMIN_EMAIL_BESIGNER).\n  HOST_EMAIL_BESIGNER = '/[orgSlug]/hosts/[host]/emails/[templateKey]/versions/[versionId]/besigner',\n  SCREEN_DETAILS = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/view',\n  SCREEN_PREVIEW = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/preview',\n  // Bare path, matching HOST_LAYOUTS and HOST_COMPONENTS — see the note on\n  // HOST_LAYOUTS. `/screens/list` still serves the same page as an alias.\n  HOST_SCREENS = '/[orgSlug]/hosts/[host]/screens',\n}\n\n/**\n * Params required to build each {@link Route}.\n *\n * Deliberately NOT extended from an index signature (AGL-685). It used to be\n * `extends Record<keyof any, any>`, which meant any `Route` missing an entry\n * here silently typed its payload as `any` — `Route.HOST_SETUP` was one of\n * them, and `buildRoute(Route.HOST_SETUP, { hostId })` compiled cleanly while\n * emitting `/<orgSlug?>/hosts/<host?>/setup`. Without the index signature a\n * new `Route` with no entry is a compile error, which is the whole point of\n * the payload being required in the first place.\n */\nexport interface RoutePayload {\n  [Route.AUTH_SIGN_UP]: undefined\n  [Route.AUTH_SIGN_IN]: undefined\n  [Route.AUTH_SIGN_OUT]: undefined\n  [Route.AUTH_VERIFY_EMAIL]: undefined\n  [Route.SCREEN_BESIGNER]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.ORG_HOME]: { orgSlug: string }\n  [Route.HOST_DASHBOARD]: { orgSlug: string; host: string }\n  [Route.ADMIN_ORGS]: undefined\n  [Route.ADMIN_ORG_DETAIL]: { orgId: string }\n  [Route.ADMIN_ORG_HOST_DETAIL]: { orgId: string; hostId: string }\n  [Route.ADMIN_OVERVIEW]: undefined\n  [Route.ADMIN_COUPONS]: undefined\n  [Route.ADMIN_LOCKDOWN]: undefined\n  [Route.ADMIN_MEDIA_QUARANTINE]: undefined\n  [Route.ADMIN_ABUSE_REPORTS]: undefined\n  [Route.ADMIN_HEALTH]: undefined\n  [Route.ADMIN_MAINTENANCE]: undefined\n  [Route.ADMIN_REVENUE]: undefined\n  [Route.ADMIN_MARGIN_UTILIZATION]: undefined\n  [Route.ADMIN_TAX_RETURN]: undefined\n  [Route.ADMIN_AUDIT]: undefined\n  [Route.ADMIN_USERS]: undefined\n  [Route.ADMIN_USER_DETAIL]: { uid: string }\n  [Route.ADMIN_FLAGS]: undefined\n  [Route.ADMIN_SETTINGS]: undefined\n  [Route.ADMIN_STAFF_PAGE]: { staffPage: string }\n  [Route.ADMIN_SUPPORT]: undefined\n  [Route.ADMIN_CONTACT_SUPPRESSIONS]: undefined\n  [Route.ADMIN_EMAILS]: undefined\n  [Route.ADMIN_EMAIL_BESIGNER]: { templateKey: string; versionId: string }\n  [Route.HOST_EMAIL_BESIGNER]: {\n    orgSlug: string\n    host: string\n    templateKey: string\n    versionId: string\n  }\n  [Route.ORG_MEDIA]: { orgSlug: string }\n  [Route.ORG_DATA]: { orgSlug: string }\n  [Route.ORG_CONTACTS]: { orgSlug: string }\n  [Route.ORG_CRM]: { orgSlug: string }\n  [Route.ORG_PLUGIN]: { orgSlug: string; pluginSlug: string }\n  [Route.ORG_PLUGINS]: { orgSlug: string }\n  [Route.ORG_PLUGIN_INSTALLATION]: { orgSlug: string; pluginRef: string }\n  [Route.ORG_MARKETPLACE]: { orgSlug: string }\n  [Route.ORG_MARKETPLACE_INSTALLED]: { orgSlug: string }\n  [Route.ORG_MARKETPLACE_LISTING]: { orgSlug: string; listingId: string }\n  [Route.ORG_MARKETPLACE_PUBLISHER]: { orgSlug: string; handle: string }\n  [Route.MANAGE_USER_SETTINGS]: undefined\n  [Route.MANAGE_USER_ACCOUNT]: undefined\n  [Route.MANAGE_USER_EMAILS]: undefined\n  [Route.MANAGE_USER_PROFILE]: undefined\n  [Route.MANAGE_USER_BASIC]: undefined\n  [Route.MANAGE_USER_SECURITY]: undefined\n  [Route.MANAGE_USER_CLOSE]: undefined\n  [Route.MANAGE_NOTIFICATIONS]: undefined\n  [Route.MANAGE_NOTIFICATION_SETTINGS]: undefined\n  [Route.MANAGE_REPORT_ISSUE]: undefined\n  [Route.ORG_SETTINGS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_GENERAL]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PROFILE]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PLUGINS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_API_KEYS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_BRANDING]: { orgSlug: string }\n  [Route.ORG_SETTINGS_SSO]: { orgSlug: string }\n  [Route.ORG_SETTINGS_OWNERSHIP]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PRIVACY]: { orgSlug: string }\n  [Route.ORG_SETTINGS_HOLDS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_DELETE]: { orgSlug: string }\n  [Route.HOST_LIST]: { orgSlug: string }\n  [Route.HOST_CONTENT]: { orgSlug: string; host: string }\n  [Route.HOST_CONTENT_COLLECTION]: {\n    orgSlug: string\n    host: string\n    /** The collection's slug — see the route. A document id also resolves. */\n    collectionSlug: string\n  }\n  [Route.CONTENT_ENTRY_DETAILS]: {\n    orgSlug: string\n    host: string\n    collectionSlug: string\n    /**\n     * An entry id, or the literal `new` for a draft with no document yet.\n     *\n     * An ID here while the collection above is a SLUG, deliberately. An entry\n     * slug is unique only WITHIN its collection and it is editable on the\n     * detail page — so routing by it would move the console address out from\n     * under someone in the middle of typing in the slug field, and a draft has\n     * no slug at all to route by. The entry id is also what every activity\n     * record and the DAM's \"Used on\" list already carry.\n     */\n    entryId: string\n  }\n  [Route.MANAGE_TEAM]: { orgSlug: string }\n  [Route.MANAGE_TEAM_MEMBERS]: { orgSlug: string }\n  [Route.MANAGE_TEAM_ROLES]: { orgSlug: string }\n  [Route.MANAGE_TEAM_ACTIVITY]: { orgSlug: string }\n  [Route.MANAGE_TEAM_MEMBER]: { orgSlug: string; uid: string }\n  [Route.MANAGE_SUPPORT]: { orgSlug: string }\n  [Route.MANAGE_SUPPORT_TICKETS]: { orgSlug: string }\n  [Route.MANAGE_SUPPORT_FORUM]: { orgSlug: string }\n  [Route.MANAGE_BILLING]: { orgSlug: string }\n  [Route.MANAGE_BILLING_USAGE]: { orgSlug: string }\n  [Route.MANAGE_BILLING_INVOICES]: { orgSlug: string }\n  [Route.MANAGE_BILLING_SETTINGS]: { orgSlug: string }\n  [Route.BILLING_ENTRY]: undefined\n  [Route.SUPPORT_ENTRY]: undefined\n  [Route.HOST_INBOX]: { orgSlug: string; host: string }\n  [Route.HOST_CONTACTS]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_DETAILS]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_SEO]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_TRACKING]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_THEME]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_EMAILS]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_GENERAL]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_PLUGINS]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_PLUGIN]: { orgSlug: string; host: string; pluginRef: string }\n  [Route.HOST_ADMIN_DOMAIN]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_SECURITY]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_ERROR_PAGES]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_ACTIVITY]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_BACKUP]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_DANGER]: { orgSlug: string; host: string }\n  [Route.HOST_PLUGIN]: { orgSlug: string; host: string; pluginSlug: string }\n  [Route.HOST_MEDIA]: { orgSlug: string; host: string }\n  [Route.HOST_THEME]: { orgSlug: string; host: string }\n  [Route.HOST_AUTOMATION]: { orgSlug: string; host: string }\n  [Route.HOST_WORKFLOWS]: { orgSlug: string; host: string }\n  [Route.HOST_DATA]: { orgSlug: string; host: string }\n  [Route.HOST_LOGIC]: { orgSlug: string; host: string }\n  [Route.HOST_PRODUCTS]: { orgSlug: string; host: string }\n  [Route.HOST_COMPONENTS]: { orgSlug: string; host: string }\n  [Route.COMPONENT_DETAILS]: {\n    orgSlug: string\n    host: string\n    componentId: string\n  }\n  [Route.HOST_FORMS]: { orgSlug: string; host: string }\n  [Route.FORM_DETAILS]: {\n    orgSlug: string\n    host: string\n    formId: string\n  }\n  [Route.HOST_TEMPLATES]: { orgSlug: string; host: string }\n  [Route.TEMPLATE_DETAILS]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.HOST_MARKETING]: { orgSlug: string; host: string }\n  [Route.HOST_BOOKINGS]: { orgSlug: string; host: string }\n  [Route.HOST_REDIRECTS]: { orgSlug: string; host: string }\n  [Route.HOST_USERS]: { orgSlug: string; host: string }\n  [Route.HOST_ANALYTICS]: { orgSlug: string; host: string }\n  [Route.COMPONENT_BESIGNER]: {\n    orgSlug: string\n    host: string\n    componentId: string\n    versionId: string\n  }\n  [Route.FORM_BESIGNER]: {\n    orgSlug: string\n    host: string\n    formId: string\n    versionId: string\n  }\n  [Route.TEMPLATE_BESIGNER]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.LAYOUT_BESIGNER]: {\n    orgSlug: string\n    host: string\n    layoutId: string\n    versionId: string\n  }\n  [Route.COMPONENT_PREVIEW]: {\n    orgSlug: string\n    host: string\n    componentId: string\n    versionId: string\n  }\n  [Route.FORM_PREVIEW]: {\n    orgSlug: string\n    host: string\n    formId: string\n    versionId: string\n  }\n  [Route.TEMPLATE_PREVIEW]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.LAYOUT_PREVIEW]: {\n    orgSlug: string\n    host: string\n    layoutId: string\n    versionId: string\n  }\n  [Route.HOST_LAYOUTS]: { orgSlug: string; host: string }\n  [Route.LAYOUT_DETAILS]: { orgSlug: string; host: string; layoutId: string }\n  [Route.SCREEN_DETAILS]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.SCREEN_PREVIEW]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.HOST_SCREENS]: { orgSlug: string; host: string }\n}\n\nexport const routeReplacePattern = /\\[([^\\]]+)\\]/g\n\n/**\n * Builds a concrete path from a {@link Route} template. The payload is\n * REQUIRED whenever the route declares params (e.g. `orgSlug`, `hostId`) and\n * omitted only for param-less routes — so a forgotten `orgSlug` is a compile\n * error, not a `/<orgSlug?>/…` link that breaks at runtime (AGL-621).\n */\nexport function buildRoute<Tmpl extends Route>(\n  template: Tmpl,\n  ...[payload]: RoutePayload[Tmpl] extends undefined\n    ? [payload?: undefined]\n    : [payload: RoutePayload[Tmpl]]\n) {\n  return template.replace(routeReplacePattern, (match, key) => {\n    const value = (payload as Record<string, unknown> | undefined)?.[key]\n    return value != null ? String(value) : `<${key}?>`\n  })\n}\n"],"names":["Route","routeReplacePattern","buildRoute","template","payload","replace","match","key","value","String"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,0EAA0E;AAC1E,mEAAmE;AACnE,OAAO,IAAA,AAAKA,+BAAAA;;;;;IAKV,0EAA0E;IAC1E,sEAAsE;;IAEtE,yEAAyE;;IAEzE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;;IAEvE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,+CAA+C;;IAE/C,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;;IAEpE,+DAA+D;IAC/D,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uBAAuB;;IAEvB,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;;IAEpE,wEAAwE;IACxE,4EAA4E;IAC5E,+CAA+C;;;;;;;IAO/C,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;;IAEjE,wEAAwE;IACxE,wEAAwE;IACxE,8BAA8B;IAC9B,qEAAqE;IACrE,wEAAwE;IACxE,qBAAqB;;IAErB,iEAAiE;IACjE,+EAA+E;;IAE/E,uEAAuE;IACvE,yEAAyE;IACzE,2BAA2B;;;IAG3B,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;;;;;IAKpE;;;;;;;;;;;;;;;;;;;;GAoBC;IAED;;;;;;;;;GASC;IAED;;;;;;;GAOC;;IAGD,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,kEAAkE;;IAElE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B;;;;;;;;;;;;;GAaC;IAED;;;;;;;;;;;;;;;;GAgBC;;;IAID,kEAAkE;IAClE,2EAA2E;IAC3E,0DAA0D;;IAE1D;;;;;;GAMC;;;;;;;IAQD;;;GAGC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;;;IAGvE;;;;;;;;;GASC;;;;IAKD,sDAAsD;IACtD,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,gBAAgB;;;IAGhB;;;;;;;;;;;;GAYC;;;;;;;IAQD;;;;;;;;;;;;;GAaC;IAED;;;;;;;GAOC;;;;;;;IAQD,mEAAmE;IACnE,EAAE;IACF,wEAAwE;IACxE,kEAAkE;IAClE,4EAA4E;IAC5E,mEAAmE;IACnE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,oDAAoD;IACpD,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,EAAE;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,wBAAwB;IACxB,EAAE;IACF,2EAA2E;IAC3E,gBAAgB;;IAEhB,4EAA4E;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,uBAAuB;;;IAGvB;;;;;GAKC;;;;IAKD,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE;IACF,sEAAsE;IACtE,mEAAmE;IACnE,2EAA2E;IAC3E,uCAAuC;;;;IAIvC;;;;;;;;;;;;;;;;;;;;;GAqBC;;IAGD,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;;;;;;IAMvE;;;;;;GAMC;;;;;IAMD,0EAA0E;IAC1E,uEAAuE;IACvE,sBAAsB;;IAEtB;;;;GAIC,GACD;;;;GAIC;;IAGD;;;;;;;;;GASC;;;IAID;;;;;;;GAOC;;IAGD;;;;;;GAMC;;;IAID;;;;GAIC;IAED;;;;;;;;;;;GAWC;;;;;IAMD,0EAA0E;IAC1E,wEAAwE;IACxE,4BAA4B;;;IAG5B,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;;;IAG3C,wEAAwE;IACxE,uEAAuE;IACvE,8DAA8D;;;;IAI9D,yEAAyE;IACzE,yDAAyD;;;;;;;;IAQzD,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,qBAAqB;;;;;IAKrB,sEAAsE;IACtE,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;;IAE5D,yEAAyE;IACzE,qDAAqD;;;IAGrD,0EAA0E;IAC1E,4EAA4E;IAC5E,iCAAiC;;;;IAIjC,yEAAyE;IACzE,wEAAwE;;WAhgB9DA;MAkgBX;AA6OD,OAAO,MAAMC,sBAAsB,gBAAe;AAElD;;;;;CAKC,GACD,OAAO,SAASC,WACdC,QAAc,EACd,GAAG,CAACC,QAAQ,AAEqB;IAEjC,OAAOD,SAASE,OAAO,CAACJ,qBAAqB,CAACK,OAAOC;QACnD,MAAMC,QAASJ,2BAAD,AAACA,OAAiD,CAACG,IAAI;QACrE,OAAOC,SAAS,OAAOC,OAAOD,SAAS,CAAC,CAAC,EAAED,IAAI,EAAE,CAAC;IACpD;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/console-routes.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2022 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// URL scheme (AGL-621): the org is a first-class path segment `[orgSlug]`\n// so the URL — not client-side precedence — is the source of truth for the\n// active workspace. Host routes nest under `/[orgSlug]/hosts/[host]`; the\n// org area (settings, team, billing, media, data, plugins, support,\n// marketplace) lives directly under `/[orgSlug]`. User-level `manage/*`,\n// staff `admin/*`, and `auth` routes are NOT org-scoped. Hosts stay keyed\n// by doc id here; AGL-622 swaps `[hostId]` for the subdomain slug.\nexport enum Route {\n  ADMIN_ORGS = '/admin/orgs',\n  ADMIN_ORG_DETAIL = '/admin/orgs/[orgId]',\n  ADMIN_ORG_HOST_DETAIL = '/admin/orgs/[orgId]/host/[hostId]',\n  // Every site on the platform, across organizations, and one site's staff\n  // detail (AGL-3378). The org-nested host route above redirects here.\n  ADMIN_SITES = '/admin/sites',\n  ADMIN_SITE_DETAIL = '/admin/sites/[hostId]',\n  // A site's screen, layout, component, template or form as its draft renders,\n  // for staff who are not members of the site (AGL-3378). `kind` is a\n  // `PreviewKind`; the version, when not the current one, rides `?version=`.\n  ADMIN_SITE_PREVIEW = '/admin/sites/[hostId]/preview/[kind]/[docId]',\n  ADMIN_OVERVIEW = '/admin/overview',\n  // Staff coupon management (AGL-1105): create discount coupons + promotion\n  // codes and read the live net-margin rating before committing to one.\n  ADMIN_COUPONS = '/admin/coupons',\n  // The panic button (AGL-1501): platform/org/host/user lockdown controls.\n  ADMIN_LOCKDOWN = '/admin/lockdown',\n  // The narrow lever beside it (AGL-1687): disable or release ONE uploaded\n  // file. Its own page rather than a panel on Lockdown because the input is\n  // an asset, not a scope — the two forms share no field but the reason.\n  ADMIN_MEDIA_QUARANTINE = '/admin/media-quarantine',\n  // The INPUT to the two levers above (AGL-1964). Lockdown and quarantine are\n  // both things an operator does after learning there is a problem; until\n  // this page there was no way for anyone outside the company to say there\n  // was one. Reports arrive from the unauthenticated form the tenant runtime\n  // serves at /api/report-abuse on every origin.\n  ADMIN_ABUSE_REPORTS = '/admin/abuse-reports',\n  // The same input, one collection over (AGL-2310). The marketplace's own\n  // report button wrote `marketplaceReports` from the day it shipped and\n  // nothing read it — every report filed, acknowledged, and unreachable. This\n  // is that queue, deliberately shaped like the abuse one rather than as a\n  // second vocabulary for the same act.\n  // The probes, on a screen (AGL-1900). /api/health/{backups,rate-limits,\n  // signups} and /api/admin/email-health each answered a bad-day question to\n  // a curl and to nothing else; this is where an operator reads them.\n  ADMIN_HEALTH = '/admin/health',\n  // The maintenance jobs, on a screen (AGL-1949). audit-archive,\n  // reap-plugin-artifacts and reverify-plugin-versions accepted the shared\n  // cron secret and nothing else, so the only way to preview or run one was a\n  // shell holding the production secret. Separate from Health because Health\n  // reads and this acts.\n  ADMIN_MAINTENANCE = '/admin/maintenance',\n  // The Texas sales tax return (AGL-1900). The figures AGL-1811 computes had\n  // only a curl to reach them; filing happens on a fixed quarterly calendar\n  // from 2026-09-01, so the return needs a URL a person can bookmark.\n  ADMIN_REVENUE = '/admin/revenue',\n  // Realised band utilization and the margin that follows from it. Beside\n  // Revenue because the two are the halves of one question: that page reports\n  // what came in, this one what serving it cost.\n  ADMIN_MARGIN_UTILIZATION = '/admin/margin-utilization',\n  ADMIN_TAX_RETURN = '/admin/tax-return',\n  ADMIN_AUDIT = '/admin/audit',\n  ADMIN_USERS = '/admin/users',\n  ADMIN_USER_DETAIL = '/admin/users/[uid]',\n  ADMIN_FLAGS = '/admin/flags',\n  // Platform-wide settings that are not a release flag (AGL-2486). The\n  // free-workspace ceiling was the first of them and it opened the\n  // Organizations LIST, above the table — a global lever wedged into the\n  // screen for browsing individual orgs. Settings that describe the platform\n  // rather than one org belong on their own tab, beside the flags.\n  ADMIN_SETTINGS = '/admin/settings',\n  // One submission or listed plugin in full (AGL-959): the queue index is\n  // for scanning, this is where a reviewer reads the manifest, weighs the\n  // verifier findings and acts.\n  // A page a plugin adds to the staff area (AGL-2939), rendered by the\n  // console's generic staff route. The console's own staff routes win the\n  // segments they use.\n  ADMIN_STAFF_PAGE = '/admin/[staffPage]',\n  // Staff support-ticket queue (AGL-849): the operator side of the\n  // subscriber `MANAGE_SUPPORT_TICKETS` page — every org's tickets in one place.\n  ADMIN_SUPPORT = '/admin/support',\n  // Do-not-contact list (AGL-1592): the intake and the queue for Privacy\n  // Policy v4 §11's marketing call/text opt-out, and for \"delete the phone\n  // number you hold for me\".\n  ADMIN_CONTACT_SUPPRESSIONS = '/admin/contact-suppressions',\n  ADMIN_EMAILS = '/admin/emails',\n  // The one besigner route with no host and no org in it (AGL-749). A system\n  // email belongs to the platform, not to a workspace, so it is staff-scoped\n  // like the rest of `/admin/*` rather than nested under `[orgSlug]`.\n  ADMIN_EMAIL_BESIGNER = '/admin/emails/[templateKey]/versions/[versionId]/besigner',\n  ORG_HOME = '/[orgSlug]',\n  ORG_MEDIA = '/[orgSlug]/media',\n  ORG_DATA = '/[orgSlug]/data',\n  /*\n   * The organization's address book.\n   *\n   * Org-scoped rather than a section of a site, because it answers the one\n   * question a site page cannot: which of the organization's sites know a\n   * given person. A contact document is shared by every site in the org — one\n   * human who touched two of them is one row — and until this route there was\n   * no surface anywhere that showed the deduped person, so the dedupe the\n   * shared address book exists for was invisible and the billing unit\n   * (unique people per org) had nothing standing behind it.\n   *\n   * It shows identity, which sites hold the person, and consent per site. The\n   * per-site CRM — notes, tags, timeline, order history — stays on the site's\n   * own Contacts surface, because those are the holder's business records and\n   * this is the one route designed to cross between holders.\n   *\n   * A LEGACY ADDRESS since AGL-2630: the page behind it redirects, permanently,\n   * to the org-level CRM hub's contacts section. It stays declared so a link\n   * kept from before — a bookmark, a docs page, an email — still resolves,\n   * and so the redirect has a constant to be built from rather than a string.\n   */\n  ORG_CONTACTS = '/[orgSlug]/contacts',\n  /*\n   * The organization-level CRM hub (AGL-2630): the same sections the site hub\n   * has — `/[orgSlug]/crm/<section>[/<recordId>]` — mounted with an ORG scope,\n   * for an org-wide member who works every site's people at once. A bare\n   * `/crm` lands on the first section the reader may open, as the site hub's\n   * does. What this route adds over the site hub is the cross-site fact the\n   * old address book carried — which sites know a person — and what it takes\n   * from it is the site every create must name, since a record is always\n   * captured BY a site.\n   */\n  ORG_CRM = '/[orgSlug]/crm',\n  /*\n   * The generic ORGANIZATION-level plugin route (AGL-2974): every surface an\n   * extension declares in `orgNavItems` is served here, at\n   * `/[orgSlug]/<href>[/<section>…]`, by\n   * `app/(app)/[orgSlug]/[...pluginSlug]/page.tsx`. The org twin of\n   * `HOST_PLUGIN`, and like it the one org route whose leaf segment is data:\n   * every named org route in this enum wins over it.\n   */\n  ORG_PLUGIN = '/[orgSlug]/[pluginSlug]',\n  ORG_PLUGINS = '/[orgSlug]/plugins',\n  // One plugin, as installed in this workspace (AGL-1007): scope, settings\n  // and permissions in one place. The segment takes EITHER identifier\n  // (AGL-1010) — a listing id for a marketplace install, a registry id for a\n  // first-party plugin — hence `pluginRef` rather than `listingId`.\n  ORG_PLUGIN_INSTALLATION = '/[orgSlug]/plugins/[pluginRef]',\n  // Org-scope marketplace (AGL-772): the single place to browse, view and\n  // install marketplace items. The per-site tab it replaced, and the retired\n  // `/[orgSlug]/marketplace` seller area, were removed with the rest of the\n  // `marketplace` naming in AGL-975 — the word is being freed for a public\n  // forum, and a redirect stub sitting on `/marketplace` would have taken the\n  // one path that feature wants.\n  /*\n   * The marketplace's own SECTIONS are not here any more (AGL-3080). Eight\n   * of them — browse, licences, upload, the four seller cards and the\n   * publish form — were hand-written console routes, and became an\n   * `orgNavItems` declaration whose `sections` name those segments once, in\n   * the plugin. Restating them here was a second copy of a list the plugin\n   * owns, and every entry had zero callers the moment the routes went.\n   *\n   * What stays is what the CONSOLE still builds: the surface itself, a\n   * listing, a publisher, and the installed tab that the org plugins card\n   * links across to. A console page linking into a plugin's surface is the\n   * ordinary case; a console page enumerating that surface's sections is\n   * not.\n   */\n  ORG_MARKETPLACE = '/[orgSlug]/marketplace',\n  /*\n   * Marketplace SECTIONS are routes (AGL-2501), for the reason the settings\n   * and account sections are: a panel that is not open should cost nothing,\n   * and the seller half of this hub reads the organization's REVENUE.\n   *\n   * The four seller sections are the reason the layout gates rather than the\n   * rail. As tabs they were simply not rendered for a member without\n   * `publishToMarketplace`; as routes each one is reachable by typing its URL,\n   * so the refusal has to sit above them all rather than in the list that\n   * draws them.\n   *\n   * Every segment here is shorter than the ten characters `createResourceUid`\n   * emits, so none of them can ever shadow a real `[listingId]` sitting at the\n   * same level. `upload` rather than `publish` because `publish/plugin` is\n   * already a route beneath this one, and two directories contributing the\n   * same segment is a tree Next cannot resolve a layout for.\n   */\n  ORG_MARKETPLACE_INSTALLED = '/[orgSlug]/marketplace/installed',\n  ORG_MARKETPLACE_LISTING = '/[orgSlug]/marketplace/[listingId]',\n  ORG_MARKETPLACE_PUBLISHER = '/[orgSlug]/marketplace/publisher/[handle]',\n  // Publishing a plugin is a page, not a modal (AGL-1078): the most\n  // consequential thing a publisher does now has a URL, so it can be linked,\n  // reloaded, and reached from a listing to ship an update.\n  ORG_SETTINGS = '/[orgSlug]/settings',\n  /*\n   * Settings SECTIONS are routes (AGL-2501). `HubTabs` mounted every panel —\n   * `keepMounted`, with `lazy` off by default and passed by nobody — so\n   * opening General also mounted the API-keys, SSO and data-export cards and\n   * ran every read in them. Routes mount one page and code-split per route.\n   * `ORG_SETTINGS` itself redirects to General.\n   */\n  ORG_SETTINGS_GENERAL = '/[orgSlug]/settings/general',\n  ORG_SETTINGS_PROFILE = '/[orgSlug]/settings/profile',\n  ORG_SETTINGS_PLUGINS = '/[orgSlug]/settings/plugins',\n  ORG_SETTINGS_API_KEYS = '/[orgSlug]/settings/api-keys',\n  ORG_SETTINGS_BRANDING = '/[orgSlug]/settings/branding',\n  ORG_SETTINGS_SSO = '/[orgSlug]/settings/sso',\n  ORG_SETTINGS_OWNERSHIP = '/[orgSlug]/settings/ownership',\n  /**\n   * Export the people a workspace holds and file a person's erasure\n   * (AGL-2839) — outside the CRM, so it is there on every plan.\n   */\n  ORG_SETTINGS_PRIVACY = '/[orgSlug]/settings/privacy',\n  // Holds & reviews (AGL-3368): everything on the workspace that was held,\n  // flagged, locked or paused, its status, and the way to request a review.\n  // Where every risk notice's \"Request a review\" lands (`?notice=<id>`).\n  ORG_SETTINGS_HOLDS = '/[orgSlug]/settings/holds',\n  ORG_SETTINGS_DELETE = '/[orgSlug]/settings/delete',\n  /**\n   * Billing, section by section (AGL-2501).\n   *\n   * `MANAGE_BILLING` is unchanged and is the PLAN section — it resolves to a\n   * page inside a route group, which adds no path segment. That is what makes\n   * this split free: every link in the console, every hash anchor\n   * (`#addons`, `#collaborator-seats`) and Stripe's own dunning mail all point\n   * here already and none of them moves. No redirect, and no `?tab=` shim to\n   * carry forever.\n   */\n  MANAGE_BILLING = '/[orgSlug]/billing',\n  MANAGE_BILLING_USAGE = '/[orgSlug]/billing/usage',\n  MANAGE_BILLING_INVOICES = '/[orgSlug]/billing/invoices',\n  MANAGE_BILLING_SETTINGS = '/[orgSlug]/billing/settings',\n  // The ONE billing URL that carries no org (AGL-2430).\n  //\n  // Everything else on this table is org-scoped, which is correct for a\n  // console and wrong for the only caller that cannot template a URL:\n  // Stripe's dunning emails. \"Payment method updates\" takes a single static\n  // link for every customer in the account — there is no `{{org}}` to\n  // interpolate — so a table with no org-agnostic billing entry means those\n  // emails can only ever point at a page that is not billing. Today all four\n  // of them point at the marketing homepage, which is how a failed card\n  // becomes a cancelled subscription with no reachable way to fix it.\n  //\n  // This resolves the org from the SESSION instead of from the URL: one\n  // workspace goes straight through, several offer a choice, none says so.\n  // `billing` is a reserved subdomain (`RESERVED_SUBDOMAINS`), so no org can\n  // hold this slug and the literal segment can never shadow a real\n  // `/[orgSlug]`.\n  BILLING_ENTRY = '/billing',\n  MANAGE_USER_SETTINGS = '/manage/user',\n  /*\n   * Account SECTIONS are routes (AGL-2501). `HubTabs` mounted every panel —\n   * `keepMounted`, with `lazy` off by default and passed by nobody — so\n   * opening Account also mounted the email-addresses, passkeys, recent\n   * sign-ins, data-export and close-account cards and ran every read in them.\n   * Routes mount one page and code-split per route.\n   *\n   * The segments are the ids the panels carried, because a transactional\n   * email already in people's inboxes links `/manage/user?tab=security`:\n   * `MANAGE_USER_SETTINGS` forwards each of those ids to the section that\n   * holds it, and the segment matching the id is what keeps that map a\n   * one-liner rather than a second naming scheme.\n   */\n  MANAGE_USER_ACCOUNT = '/manage/user/account',\n  MANAGE_USER_EMAILS = '/manage/user/emails',\n  MANAGE_USER_PROFILE = '/manage/user/profile',\n  MANAGE_USER_BASIC = '/manage/user/basic',\n  MANAGE_USER_SECURITY = '/manage/user/security',\n  MANAGE_USER_CLOSE = '/manage/user/close',\n  MANAGE_NOTIFICATIONS = '/manage/notifications',\n  /*\n   * The preferences, off the feed (AGL-3226).\n   *\n   * They lived in the header of the feed itself, which was already the\n   * tallest thing on that page before per-channel and per-scope settings\n   * multiplied them — and it put an edit form above the list it edits, which\n   * the console does nowhere else.\n   *\n   * A CHILD of the feed rather than a sibling under `/manage`, because the\n   * relationship is exactly that: it configures what the page above it shows.\n   * That also keeps `/manage/notifications` the address in the transactional\n   * mail already in people's inboxes, which keeps working and now carries a\n   * button to here.\n   */\n  MANAGE_NOTIFICATION_SETTINGS = '/manage/notifications/settings',\n  /*\n   * A URL for the defect channel (AGL-2486). \"Report an issue\" was reachable\n   * only by opening the account menu, so nothing outside the console could\n   * send anyone to it — the repo's README pointed at GitHub issues, which we\n   * do not use, and every other \"tell us about it\" surface had the same\n   * problem. User-level rather than org-scoped because the dialog is: it\n   * needs no workspace, no role and no paid plan.\n   */\n  MANAGE_REPORT_ISSUE = '/manage/report-issue',\n  AUTH_SIGN_IN = '/signin',\n  AUTH_SIGN_OUT = '/signout',\n  AUTH_SIGN_UP = '/signup',\n  AUTH_VERIFY_EMAIL = '/verify-email',\n  HOST_LIST = '/[orgSlug]/hosts',\n  HOST_CONTENT = '/[orgSlug]/hosts/[host]/content',\n  // The collection is a PATH SEGMENT, not `?collection=` (AGL-2498).\n  //\n  // It was a query parameter because the manager began as one page with a\n  // Select on it, and the Select was the only thing that knew which\n  // collection you were looking at. That is the wrong owner: which collection\n  // is open is the page's IDENTITY, not a filter applied to it. As a\n  // parameter it could be dropped by any link that rebuilt the query, it\n  // sorted below `?tab=` in a URL nobody could read, and — the reason this\n  // moved — it left the entry beneath it with nowhere to hang: an entry is\n  // addressed `collection + entry`, and half of that address cannot live in\n  // the path while the other half lives in the query.\n  //\n  // The segment is the collection's SLUG, not its document id, and that is a\n  // correction rather than a preference. Collection document ids are not\n  // uniform — the seeded ones were given readable ids (`blog`, `changelog`)\n  // and everything created since gets a `createResourceUid`, so routing by id\n  // produced `/content/changelog` beside `/content/QgXv7lU_rG` on ONE site.\n  //\n  // A slug is the right key on the merits too: it is unique per host and kind\n  // (claimed in a transaction by /api/hosts/collections), it is the\n  // collection's own public address, and it is the thing an author recognises.\n  // A document id is still ACCEPTED and rewritten to the slug form, so no\n  // existing link breaks.\n  //\n  // `?collection=` still resolves the same way (AGL-845's DAM deep links are\n  // in the wild).\n  HOST_CONTENT_COLLECTION = '/[orgSlug]/hosts/[host]/content/[collectionSlug]',\n  // One entry's detail page (AGL-2498). `entries` is a LITERAL segment rather\n  // than `content/[collectionId]/[entryId]`, and it is load-bearing twice\n  // over: it mirrors the Firestore path the entry actually lives at\n  // (`collections/{c}/entries/{e}`), and it keeps the id space clear so a\n  // later sibling — a collection's own settings page, say — cannot be\n  // shadowed by an entry that happens to be called the same thing.\n  //\n  // `[entryId]` also carries the sentinel `new`, which is a draft that has no\n  // document yet. Entry ids come from `createResourceUid`, so nothing real\n  // can collide with it.\n  CONTENT_ENTRY_DETAILS = '/[orgSlug]/hosts/[host]/content/[collectionSlug]/entries/[entryId]',\n  MANAGE_TEAM = '/[orgSlug]/team',\n  /*\n   * Team SECTIONS are routes, not tabs (AGL-2501). A section's bundle then\n   * arrives when a reader opens it and never before, the section is linkable,\n   * and the active state is a fact about the URL rather than state that has to\n   * be kept in sync with it. `MANAGE_TEAM` itself redirects to members.\n   */\n  MANAGE_TEAM_MEMBERS = '/[orgSlug]/team/members',\n  MANAGE_TEAM_ROLES = '/[orgSlug]/team/roles',\n  MANAGE_TEAM_ACTIVITY = '/[orgSlug]/team/activity',\n  MANAGE_TEAM_MEMBER = '/[orgSlug]/team/[uid]',\n  // Support is an UMBRELLA, not a page (AGL-1158). The two channels beneath\n  // it are separate features that were only ever one screen: they are gated\n  // differently (tickets need a first-response commitment, from Pro; the\n  // forum is open to every tier including Free) and they fail independently.\n  // Sharing one route made them share a blast radius — AGL-1157 was one bad\n  // line in the common loader that emptied BOTH lists at once.\n  //\n  // `MANAGE_SUPPORT` itself stays, and stays the nav tab's href: it now\n  // forwards to whichever channel the org's tier makes primary, so a\n  // forum-only workspace lands on a whole forum instead of a half-empty page\n  // beside a ticket card it may not use.\n  MANAGE_SUPPORT = '/[orgSlug]/support',\n  MANAGE_SUPPORT_TICKETS = '/[orgSlug]/support/tickets',\n  MANAGE_SUPPORT_FORUM = '/[orgSlug]/support/forum',\n  /*\n   * The ONE support URL that carries no org (AGL-3265), and the second member\n   * of the apex category `BILLING_ENTRY` opened.\n   *\n   * Everything a person is handed when they need help — a receipt, a system\n   * email footer, a Stripe customer portal, a self-host runbook — stores ONE\n   * link for every customer, with no workspace to interpolate. `/[orgSlug]`\n   * cannot be templated into any of them, so the only support address those\n   * surfaces could carry was one outside the console entirely.\n   *\n   * This resolves the workspace from the SESSION instead: one workspace goes\n   * straight through, several offer a choice, none says so. It forwards to\n   * `MANAGE_SUPPORT`, which is itself an umbrella — so the tier decision about\n   * tickets versus the forum stays in the one place that already makes it.\n   *\n   * `support` is a reserved subdomain (`RESERVED_SUBDOMAINS` in\n   * `host-naming.ts`), so no org can hold this slug and the literal segment\n   * can never shadow a real `/[orgSlug]`. That is the same guarantee\n   * `BILLING_ENTRY` rests on, and it is a precondition rather than a\n   * coincidence: an apex route whose segment an org could claim would take a\n   * workspace's own address away from it.\n   */\n  SUPPORT_ENTRY = '/support',\n  HOST_DASHBOARD = '/[orgSlug]/hosts/[host]',\n  // The catch-all console page a plugin's own nav items resolve against\n  // (`app/(app)/[orgSlug]/hosts/[host]/[pluginSlug]/page.tsx`). Plugin slugs\n  // are open-ended, so this is the one route whose leaf segment is data.\n  HOST_PLUGIN = '/[orgSlug]/hosts/[host]/[pluginSlug]',\n  HOST_INBOX = '/[orgSlug]/hosts/[host]/inbox',\n  HOST_CONTACTS = '/[orgSlug]/hosts/[host]/contacts',\n  HOST_MEDIA = '/[orgSlug]/hosts/[host]/media',\n  HOST_SETUP = '/[orgSlug]/hosts/[host]/setup',\n  /*\n   * Setup SECTIONS are routes (AGL-2501), so an unopened one costs neither a\n   * read nor a byte. `HOST_SETUP` stays the nav tab's href and redirects to\n   * Basic details, honouring the `?tab=` ids these sections were deep-linked\n   * by — unlike the settings and marketplace hubs, links holding those ids are\n   * demonstrably in the wild and two are built in this repo.\n   */\n  HOST_SETUP_DETAILS = '/[orgSlug]/hosts/[host]/setup/details',\n  HOST_SETUP_SEO = '/[orgSlug]/hosts/[host]/setup/seo',\n  HOST_SETUP_TRACKING = '/[orgSlug]/hosts/[host]/setup/tracking',\n  HOST_SETUP_THEME = '/[orgSlug]/hosts/[host]/setup/theme',\n  HOST_SETUP_EMAILS = '/[orgSlug]/hosts/[host]/setup/emails',\n  // Host Admin area (AGL-1014): owner/admin-only controls — per-site plugin\n  // enablement and the Danger zone — out of the Setup page collaborators\n  // legitimately visit.\n  HOST_ADMIN = '/[orgSlug]/hosts/[host]/admin',\n  /*\n   * Site-admin SECTIONS are routes (AGL-2501), so an unopened one costs neither\n   * a read nor a byte. `HOST_ADMIN` redirects to Plugins and still honours the\n   * `?tab=` ids these sections were deep-linked by.\n   */\n  /*\n   * The site as an OBJECT: its name in the console and the subdomain it\n   * answers to. First in the rail because an address and a name are what\n   * identify the thing every other section governs.\n   */\n  HOST_ADMIN_GENERAL = '/[orgSlug]/hosts/[host]/admin/general',\n  HOST_ADMIN_PLUGINS = '/[orgSlug]/hosts/[host]/admin/plugins',\n  /*\n   * One plugin, as installed on ONE site (AGL-428, AGL-1014) — the\n   * site-scoped twin of `ORG_PLUGIN_INSTALLATION`, reached by clicking a row\n   * on the site's plugin\n   * list exactly as the workspace list opens its own detail page. The segment\n   * is `[pluginRef]` and accepts either identifier for the same reason the\n   * workspace route does (AGL-1010): a marketplace install is keyed by listing\n   * id, a first-party plugin by its registry id, and an admin does not think\n   * of the two as different things.\n   */\n  HOST_ADMIN_PLUGIN = '/[orgSlug]/hosts/[host]/admin/plugins/[pluginRef]',\n  HOST_ADMIN_DOMAIN = '/[orgSlug]/hosts/[host]/admin/domain',\n  HOST_ADMIN_SECURITY = '/[orgSlug]/hosts/[host]/admin/security',\n  /*\n   * The designed screen behind each status code, and the switch that shows the\n   * 503 one at every address at once (AGL-3178).\n   *\n   * Beside Security because both answer what a visitor's browser is handed on\n   * a page the site did not design for them, and above Activity because it is\n   * a control rather than a record.\n   */\n  HOST_ADMIN_ERROR_PAGES = '/[orgSlug]/hosts/[host]/admin/error-pages',\n  HOST_ADMIN_ACTIVITY = '/[orgSlug]/hosts/[host]/admin/activity',\n  /*\n   * Backup, restore and publishing the site as a template — moving the whole\n   * site somewhere else, or bringing it back. Its own section rather than the\n   * Danger zone: restore overwrites, but export and publishing a template do\n   * not, and filing all three under a destructive heading mislabels two of\n   * them.\n   */\n  HOST_ADMIN_BACKUP = '/[orgSlug]/hosts/[host]/admin/backup',\n  HOST_ADMIN_DANGER = '/[orgSlug]/hosts/[host]/admin/danger',\n  HOST_THEME = '/[orgSlug]/hosts/[host]/theme',\n  /*\n   * The automation section: Workflows, Actions and Webhooks under one parent.\n   * The parent is named for what the three have in common, so no tab shares a\n   * name with the section that contains it.\n   */\n  HOST_AUTOMATION = '/[orgSlug]/hosts/[host]/automation',\n  /**\n   * The address the automation section answered to before it had a name of\n   * its own. Nothing links here — `HOST_AUTOMATION` is what the nav, the\n   * search results and the activity feed build — but the console redirects it\n   * permanently, so a held bookmark still lands on the section (and keeps its\n   * `?tab=`, which never changed).\n   *\n   * Kept on the table rather than as a bare literal in `next.config.js`\n   * because the redirect and the address it serves are one fact:\n   * `automation-section.spec.ts` reads this entry and fails if the rule for\n   * it goes missing.\n   */\n  HOST_WORKFLOWS = '/[orgSlug]/hosts/[host]/workflows',\n  HOST_DATA = '/[orgSlug]/hosts/[host]/data',\n  HOST_LOGIC = '/[orgSlug]/hosts/[host]/logic',\n  HOST_PRODUCTS = '/[orgSlug]/hosts/[host]/products',\n  HOST_COMPONENTS = '/[orgSlug]/hosts/[host]/components',\n  // Component detail (AGL-693): the listing links here, and the besigner is\n  // reached from here — matching SCREEN_DETAILS rather than jumping a row\n  // straight into the editor.\n  COMPONENT_DETAILS = '/[orgSlug]/hosts/[host]/components/[componentId]',\n  HOST_FORMS = '/[orgSlug]/hosts/[host]/forms',\n  // A form is a designable document, so its surface is the component one:\n  // a list, a detail page that owns the versions, and the besigner reached\n  // from there. Deliberately NOT a row that jumps into the editor — a form's\n  // routing and consent field are edited on the detail page, and those decide\n  // what the design is then checked against.\n  FORM_DETAILS = '/[orgSlug]/hosts/[host]/forms/[formId]',\n  HOST_TEMPLATES = '/[orgSlug]/hosts/[host]/templates',\n  // Template detail (AGL-694), the counterpart to COMPONENT_DETAILS. Note\n  // TEMPLATE_BESIGNER carries no versionId — templates version but never\n  // publish, so there is no \"current\" pointer to route through.\n  TEMPLATE_DETAILS = '/[orgSlug]/hosts/[host]/templates/[templateId]',\n  HOST_MARKETING = '/[orgSlug]/hosts/[host]/marketing',\n  HOST_BOOKINGS = '/[orgSlug]/hosts/[host]/bookings',\n  // Events now come from the events-calendar plugin, served by the generic\n  // `[orgSlug]/hosts/[host]/[pluginSlug]` route (AGL-394).\n  HOST_REDIRECTS = '/[orgSlug]/hosts/[host]/redirects',\n  HOST_USERS = '/[orgSlug]/hosts/[host]/users',\n  HOST_ANALYTICS = '/[orgSlug]/hosts/[host]/analytics',\n  COMPONENT_BESIGNER = '/[orgSlug]/hosts/[host]/components/[componentId]/versions/[versionId]/besigner',\n  FORM_BESIGNER = '/[orgSlug]/hosts/[host]/forms/[formId]/versions/[versionId]/besigner',\n  TEMPLATE_BESIGNER = '/[orgSlug]/hosts/[host]/templates/[templateId]/besigner',\n  LAYOUT_BESIGNER = '/[orgSlug]/hosts/[host]/layouts/[layoutId]/versions/[versionId]/besigner',\n  // Draft preview for every besigner document kind (AGL-1203). Screens had\n  // the only preview route; components, layouts and templates showed a\n  // Preview button that did nothing. Each renders the same localStorage\n  // snapshot through the site renderer, so they work on localhost with no\n  // deployment. TEMPLATE_PREVIEW carries no versionId, matching\n  // TEMPLATE_BESIGNER.\n  COMPONENT_PREVIEW = '/[orgSlug]/hosts/[host]/components/[componentId]/versions/[versionId]/preview',\n  FORM_PREVIEW = '/[orgSlug]/hosts/[host]/forms/[formId]/versions/[versionId]/preview',\n  TEMPLATE_PREVIEW = '/[orgSlug]/hosts/[host]/templates/[templateId]/preview',\n  LAYOUT_PREVIEW = '/[orgSlug]/hosts/[host]/layouts/[layoutId]/versions/[versionId]/preview',\n  // The list sits at the bare path, like HOST_COMPONENTS. It used to be\n  // `/layouts/list`: the pages router had a `layouts/index.tsx` that\n  // redirected to `layouts/list.tsx`, and the App Router migration carried\n  // the pair over verbatim. Components, added later, had no such legacy and\n  // put its list at the bare path — which is the shape we want everywhere.\n  // `/layouts/list` still serves the same page so old links survive — an\n  // alias, not a redirect, because the bare path used to answer a cached 308\n  // pointing at `/list` and redirecting back would loop. See the comment in\n  // `app/(app)/[orgSlug]/hosts/[host]/screens/list/page.tsx`.\n  HOST_LAYOUTS = '/[orgSlug]/hosts/[host]/layouts',\n  // Layout detail (AGL-695), completing the list → detail → besigner shape\n  // across screens, components, templates and layouts.\n  LAYOUT_DETAILS = '/[orgSlug]/hosts/[host]/layouts/[layoutId]',\n  SCREEN_BESIGNER = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/besigner',\n  // Per-site email besigner (AGL-770): a site owner designs a transactional\n  // email their site sends. The host-scoped sibling of the staff system-email\n  // editor (ADMIN_EMAIL_BESIGNER).\n  HOST_EMAIL_BESIGNER = '/[orgSlug]/hosts/[host]/emails/[templateKey]/versions/[versionId]/besigner',\n  SCREEN_DETAILS = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/view',\n  SCREEN_PREVIEW = '/[orgSlug]/hosts/[host]/screens/[screenId]/versions/[versionId]/preview',\n  // Bare path, matching HOST_LAYOUTS and HOST_COMPONENTS — see the note on\n  // HOST_LAYOUTS. `/screens/list` still serves the same page as an alias.\n  HOST_SCREENS = '/[orgSlug]/hosts/[host]/screens',\n}\n\n/**\n * Params required to build each {@link Route}.\n *\n * Deliberately NOT extended from an index signature (AGL-685). It used to be\n * `extends Record<keyof any, any>`, which meant any `Route` missing an entry\n * here silently typed its payload as `any` — `Route.HOST_SETUP` was one of\n * them, and `buildRoute(Route.HOST_SETUP, { hostId })` compiled cleanly while\n * emitting `/<orgSlug?>/hosts/<host?>/setup`. Without the index signature a\n * new `Route` with no entry is a compile error, which is the whole point of\n * the payload being required in the first place.\n */\nexport interface RoutePayload {\n  [Route.AUTH_SIGN_UP]: undefined\n  [Route.AUTH_SIGN_IN]: undefined\n  [Route.AUTH_SIGN_OUT]: undefined\n  [Route.AUTH_VERIFY_EMAIL]: undefined\n  [Route.SCREEN_BESIGNER]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.ORG_HOME]: { orgSlug: string }\n  [Route.HOST_DASHBOARD]: { orgSlug: string; host: string }\n  [Route.ADMIN_ORGS]: undefined\n  [Route.ADMIN_ORG_DETAIL]: { orgId: string }\n  [Route.ADMIN_ORG_HOST_DETAIL]: { orgId: string; hostId: string }\n  [Route.ADMIN_SITES]: undefined\n  [Route.ADMIN_SITE_DETAIL]: { hostId: string }\n  [Route.ADMIN_SITE_PREVIEW]: { hostId: string; kind: string; docId: string }\n  [Route.ADMIN_OVERVIEW]: undefined\n  [Route.ADMIN_COUPONS]: undefined\n  [Route.ADMIN_LOCKDOWN]: undefined\n  [Route.ADMIN_MEDIA_QUARANTINE]: undefined\n  [Route.ADMIN_ABUSE_REPORTS]: undefined\n  [Route.ADMIN_HEALTH]: undefined\n  [Route.ADMIN_MAINTENANCE]: undefined\n  [Route.ADMIN_REVENUE]: undefined\n  [Route.ADMIN_MARGIN_UTILIZATION]: undefined\n  [Route.ADMIN_TAX_RETURN]: undefined\n  [Route.ADMIN_AUDIT]: undefined\n  [Route.ADMIN_USERS]: undefined\n  [Route.ADMIN_USER_DETAIL]: { uid: string }\n  [Route.ADMIN_FLAGS]: undefined\n  [Route.ADMIN_SETTINGS]: undefined\n  [Route.ADMIN_STAFF_PAGE]: { staffPage: string }\n  [Route.ADMIN_SUPPORT]: undefined\n  [Route.ADMIN_CONTACT_SUPPRESSIONS]: undefined\n  [Route.ADMIN_EMAILS]: undefined\n  [Route.ADMIN_EMAIL_BESIGNER]: { templateKey: string; versionId: string }\n  [Route.HOST_EMAIL_BESIGNER]: {\n    orgSlug: string\n    host: string\n    templateKey: string\n    versionId: string\n  }\n  [Route.ORG_MEDIA]: { orgSlug: string }\n  [Route.ORG_DATA]: { orgSlug: string }\n  [Route.ORG_CONTACTS]: { orgSlug: string }\n  [Route.ORG_CRM]: { orgSlug: string }\n  [Route.ORG_PLUGIN]: { orgSlug: string; pluginSlug: string }\n  [Route.ORG_PLUGINS]: { orgSlug: string }\n  [Route.ORG_PLUGIN_INSTALLATION]: { orgSlug: string; pluginRef: string }\n  [Route.ORG_MARKETPLACE]: { orgSlug: string }\n  [Route.ORG_MARKETPLACE_INSTALLED]: { orgSlug: string }\n  [Route.ORG_MARKETPLACE_LISTING]: { orgSlug: string; listingId: string }\n  [Route.ORG_MARKETPLACE_PUBLISHER]: { orgSlug: string; handle: string }\n  [Route.MANAGE_USER_SETTINGS]: undefined\n  [Route.MANAGE_USER_ACCOUNT]: undefined\n  [Route.MANAGE_USER_EMAILS]: undefined\n  [Route.MANAGE_USER_PROFILE]: undefined\n  [Route.MANAGE_USER_BASIC]: undefined\n  [Route.MANAGE_USER_SECURITY]: undefined\n  [Route.MANAGE_USER_CLOSE]: undefined\n  [Route.MANAGE_NOTIFICATIONS]: undefined\n  [Route.MANAGE_NOTIFICATION_SETTINGS]: undefined\n  [Route.MANAGE_REPORT_ISSUE]: undefined\n  [Route.ORG_SETTINGS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_GENERAL]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PROFILE]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PLUGINS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_API_KEYS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_BRANDING]: { orgSlug: string }\n  [Route.ORG_SETTINGS_SSO]: { orgSlug: string }\n  [Route.ORG_SETTINGS_OWNERSHIP]: { orgSlug: string }\n  [Route.ORG_SETTINGS_PRIVACY]: { orgSlug: string }\n  [Route.ORG_SETTINGS_HOLDS]: { orgSlug: string }\n  [Route.ORG_SETTINGS_DELETE]: { orgSlug: string }\n  [Route.HOST_LIST]: { orgSlug: string }\n  [Route.HOST_CONTENT]: { orgSlug: string; host: string }\n  [Route.HOST_CONTENT_COLLECTION]: {\n    orgSlug: string\n    host: string\n    /** The collection's slug — see the route. A document id also resolves. */\n    collectionSlug: string\n  }\n  [Route.CONTENT_ENTRY_DETAILS]: {\n    orgSlug: string\n    host: string\n    collectionSlug: string\n    /**\n     * An entry id, or the literal `new` for a draft with no document yet.\n     *\n     * An ID here while the collection above is a SLUG, deliberately. An entry\n     * slug is unique only WITHIN its collection and it is editable on the\n     * detail page — so routing by it would move the console address out from\n     * under someone in the middle of typing in the slug field, and a draft has\n     * no slug at all to route by. The entry id is also what every activity\n     * record and the DAM's \"Used on\" list already carry.\n     */\n    entryId: string\n  }\n  [Route.MANAGE_TEAM]: { orgSlug: string }\n  [Route.MANAGE_TEAM_MEMBERS]: { orgSlug: string }\n  [Route.MANAGE_TEAM_ROLES]: { orgSlug: string }\n  [Route.MANAGE_TEAM_ACTIVITY]: { orgSlug: string }\n  [Route.MANAGE_TEAM_MEMBER]: { orgSlug: string; uid: string }\n  [Route.MANAGE_SUPPORT]: { orgSlug: string }\n  [Route.MANAGE_SUPPORT_TICKETS]: { orgSlug: string }\n  [Route.MANAGE_SUPPORT_FORUM]: { orgSlug: string }\n  [Route.MANAGE_BILLING]: { orgSlug: string }\n  [Route.MANAGE_BILLING_USAGE]: { orgSlug: string }\n  [Route.MANAGE_BILLING_INVOICES]: { orgSlug: string }\n  [Route.MANAGE_BILLING_SETTINGS]: { orgSlug: string }\n  [Route.BILLING_ENTRY]: undefined\n  [Route.SUPPORT_ENTRY]: undefined\n  [Route.HOST_INBOX]: { orgSlug: string; host: string }\n  [Route.HOST_CONTACTS]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_DETAILS]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_SEO]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_TRACKING]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_THEME]: { orgSlug: string; host: string }\n  [Route.HOST_SETUP_EMAILS]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_GENERAL]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_PLUGINS]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_PLUGIN]: { orgSlug: string; host: string; pluginRef: string }\n  [Route.HOST_ADMIN_DOMAIN]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_SECURITY]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_ERROR_PAGES]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_ACTIVITY]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_BACKUP]: { orgSlug: string; host: string }\n  [Route.HOST_ADMIN_DANGER]: { orgSlug: string; host: string }\n  [Route.HOST_PLUGIN]: { orgSlug: string; host: string; pluginSlug: string }\n  [Route.HOST_MEDIA]: { orgSlug: string; host: string }\n  [Route.HOST_THEME]: { orgSlug: string; host: string }\n  [Route.HOST_AUTOMATION]: { orgSlug: string; host: string }\n  [Route.HOST_WORKFLOWS]: { orgSlug: string; host: string }\n  [Route.HOST_DATA]: { orgSlug: string; host: string }\n  [Route.HOST_LOGIC]: { orgSlug: string; host: string }\n  [Route.HOST_PRODUCTS]: { orgSlug: string; host: string }\n  [Route.HOST_COMPONENTS]: { orgSlug: string; host: string }\n  [Route.COMPONENT_DETAILS]: {\n    orgSlug: string\n    host: string\n    componentId: string\n  }\n  [Route.HOST_FORMS]: { orgSlug: string; host: string }\n  [Route.FORM_DETAILS]: {\n    orgSlug: string\n    host: string\n    formId: string\n  }\n  [Route.HOST_TEMPLATES]: { orgSlug: string; host: string }\n  [Route.TEMPLATE_DETAILS]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.HOST_MARKETING]: { orgSlug: string; host: string }\n  [Route.HOST_BOOKINGS]: { orgSlug: string; host: string }\n  [Route.HOST_REDIRECTS]: { orgSlug: string; host: string }\n  [Route.HOST_USERS]: { orgSlug: string; host: string }\n  [Route.HOST_ANALYTICS]: { orgSlug: string; host: string }\n  [Route.COMPONENT_BESIGNER]: {\n    orgSlug: string\n    host: string\n    componentId: string\n    versionId: string\n  }\n  [Route.FORM_BESIGNER]: {\n    orgSlug: string\n    host: string\n    formId: string\n    versionId: string\n  }\n  [Route.TEMPLATE_BESIGNER]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.LAYOUT_BESIGNER]: {\n    orgSlug: string\n    host: string\n    layoutId: string\n    versionId: string\n  }\n  [Route.COMPONENT_PREVIEW]: {\n    orgSlug: string\n    host: string\n    componentId: string\n    versionId: string\n  }\n  [Route.FORM_PREVIEW]: {\n    orgSlug: string\n    host: string\n    formId: string\n    versionId: string\n  }\n  [Route.TEMPLATE_PREVIEW]: {\n    orgSlug: string\n    host: string\n    templateId: string\n  }\n  [Route.LAYOUT_PREVIEW]: {\n    orgSlug: string\n    host: string\n    layoutId: string\n    versionId: string\n  }\n  [Route.HOST_LAYOUTS]: { orgSlug: string; host: string }\n  [Route.LAYOUT_DETAILS]: { orgSlug: string; host: string; layoutId: string }\n  [Route.SCREEN_DETAILS]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.SCREEN_PREVIEW]: {\n    orgSlug: string\n    host: string\n    screenId: string\n    versionId: string\n  }\n  [Route.HOST_SCREENS]: { orgSlug: string; host: string }\n}\n\nexport const routeReplacePattern = /\\[([^\\]]+)\\]/g\n\n/**\n * Builds a concrete path from a {@link Route} template. The payload is\n * REQUIRED whenever the route declares params (e.g. `orgSlug`, `hostId`) and\n * omitted only for param-less routes — so a forgotten `orgSlug` is a compile\n * error, not a `/<orgSlug?>/…` link that breaks at runtime (AGL-621).\n */\nexport function buildRoute<Tmpl extends Route>(\n  template: Tmpl,\n  ...[payload]: RoutePayload[Tmpl] extends undefined\n    ? [payload?: undefined]\n    : [payload: RoutePayload[Tmpl]]\n) {\n  return template.replace(routeReplacePattern, (match, key) => {\n    const value = (payload as Record<string, unknown> | undefined)?.[key]\n    return value != null ? String(value) : `<${key}?>`\n  })\n}\n"],"names":["Route","routeReplacePattern","buildRoute","template","payload","replace","match","key","value","String"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,0EAA0E;AAC1E,mEAAmE;AACnE,OAAO,IAAA,AAAKA,+BAAAA;;;;IAIV,yEAAyE;IACzE,qEAAqE;;;IAGrE,6EAA6E;IAC7E,oEAAoE;IACpE,2EAA2E;;;IAG3E,0EAA0E;IAC1E,sEAAsE;;IAEtE,yEAAyE;;IAEzE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;;IAEvE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,+CAA+C;;IAE/C,wEAAwE;IACxE,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;;IAEpE,+DAA+D;IAC/D,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uBAAuB;;IAEvB,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;;IAEpE,wEAAwE;IACxE,4EAA4E;IAC5E,+CAA+C;;;;;;;IAO/C,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;;IAEjE,wEAAwE;IACxE,wEAAwE;IACxE,8BAA8B;IAC9B,qEAAqE;IACrE,wEAAwE;IACxE,qBAAqB;;IAErB,iEAAiE;IACjE,+EAA+E;;IAE/E,uEAAuE;IACvE,yEAAyE;IACzE,2BAA2B;;;IAG3B,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;;;;;IAKpE;;;;;;;;;;;;;;;;;;;;GAoBC;IAED;;;;;;;;;GASC;IAED;;;;;;;GAOC;;IAGD,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,kEAAkE;;IAElE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B;;;;;;;;;;;;;GAaC;IAED;;;;;;;;;;;;;;;;GAgBC;;;IAID,kEAAkE;IAClE,2EAA2E;IAC3E,0DAA0D;;IAE1D;;;;;;GAMC;;;;;;;IAQD;;;GAGC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;;;IAGvE;;;;;;;;;GASC;;;;IAKD,sDAAsD;IACtD,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,oEAAoE;IACpE,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,iEAAiE;IACjE,gBAAgB;;;IAGhB;;;;;;;;;;;;GAYC;;;;;;;IAQD;;;;;;;;;;;;;GAaC;IAED;;;;;;;GAOC;;;;;;;IAQD,mEAAmE;IACnE,EAAE;IACF,wEAAwE;IACxE,kEAAkE;IAClE,4EAA4E;IAC5E,mEAAmE;IACnE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,oDAAoD;IACpD,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,EAAE;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,wBAAwB;IACxB,EAAE;IACF,2EAA2E;IAC3E,gBAAgB;;IAEhB,4EAA4E;IAC5E,wEAAwE;IACxE,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,uBAAuB;;;IAGvB;;;;;GAKC;;;;IAKD,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE;IACF,sEAAsE;IACtE,mEAAmE;IACnE,2EAA2E;IAC3E,uCAAuC;;;;IAIvC;;;;;;;;;;;;;;;;;;;;;GAqBC;;IAGD,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;;;;;;IAMvE;;;;;;GAMC;;;;;IAMD,0EAA0E;IAC1E,uEAAuE;IACvE,sBAAsB;;IAEtB;;;;GAIC,GACD;;;;GAIC;;IAGD;;;;;;;;;GASC;;;IAID;;;;;;;GAOC;;IAGD;;;;;;GAMC;;;IAID;;;;GAIC;IAED;;;;;;;;;;;GAWC;;;;;IAMD,0EAA0E;IAC1E,wEAAwE;IACxE,4BAA4B;;;IAG5B,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;;;IAG3C,wEAAwE;IACxE,uEAAuE;IACvE,8DAA8D;;;;IAI9D,yEAAyE;IACzE,yDAAyD;;;;;;;;IAQzD,yEAAyE;IACzE,qEAAqE;IACrE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,qBAAqB;;;;;IAKrB,sEAAsE;IACtE,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;;IAE5D,yEAAyE;IACzE,qDAAqD;;;IAGrD,0EAA0E;IAC1E,4EAA4E;IAC5E,iCAAiC;;;;IAIjC,yEAAyE;IACzE,wEAAwE;;WAxgB9DA;MA0gBX;AAgPD,OAAO,MAAMC,sBAAsB,gBAAe;AAElD;;;;;CAKC,GACD,OAAO,SAASC,WACdC,QAAc,EACd,GAAG,CAACC,QAAQ,AAEqB;IAEjC,OAAOD,SAASE,OAAO,CAACJ,qBAAqB,CAACK,OAAOC;QACnD,MAAMC,QAASJ,2BAAD,AAACA,OAAiD,CAACG,IAAI;QACrE,OAAOC,SAAS,OAAOC,OAAOD,SAAS,CAAC,CAAC,EAAED,IAAI,EAAE,CAAC;IACpD;AACF"}

package/src/lib/app-utils/docs-index.generated.js

@@ -8292,6 +8292,13 @@ export const ASSIST_DOCS_INDEX = [
         anchor: '#sign-in-methods',
         text: 'You can link both methods to one account, and then sign in either way — same profile, same workspaces, no duplicate account. Manage them under Manage Account → Account:\n- Continue with Google links Google to an account that signed up with a password.\n- Disconnect unlinks Google again.\n- Email & password is marked Required and can\'t be disconnected — it\'s the method that always works.\nYour last remaining sign-in method can never be removed, so there\'s no way to lock yourself out.\nSigning in with any of your addresses\nIf you keep more than one email address on your account, you can type any confirmed one on the sign-in page with your usual password — you don\'t have to remember which address the account was opened with. Unconfirmed addresses don\'t work here, and neither does an address on somebody else\'s account.\nSingle sign-on accounts are the exception. If your company signs you in through its own identity provider, no other method can be linked — see Manage Account for why, and for what happens to methods linked before your organization enabled enforcement.'
     },
+    {
+        path: '/workspace-and-billing/signing-in-and-sessions',
+        title: 'Signing In & Sessions',
+        heading: 'Verifying your email',
+        anchor: '#verifying-your-email',
+        text: 'A new email-and-password account is verified before it can open a workspace. Right after you sign up, the console emails you a link and waits on a Verify your email screen.\n- Open the link from the email. It opens a new tab (on a phone, often inside your mail app) that confirms Email verified. You can close that tab: the tab you signed up in moves on by itself as soon as you return to it. If you would rather carry on in the new tab, choose Continue to Aglyn, or Sign in to continue if that browser isn\'t signed in.\n- Opened it twice? A link works once. If the account signed in on that browser is already verified, the screen says You\'re already verified and offers to continue, so there is nothing to fix.\n- No email? Choose Resend verification email on the waiting screen. If a link has expired, the same button sends a fresh one.'
+    },
     {
         path: '/workspace-and-billing/signing-in-and-sessions',
         title: 'Signing In & Sessions',