@aglyn/aglyn 1.0.0-beta.220 → 1.0.0-beta.221

package/src/lib/app-utils/screen-link-context.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-link-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n// Lives in @aglyn/aglyn (not a UI lib) deliberately, WITHOUT a 'use client'\n// banner: every surface that renders canvas nodes already imports this\n// package, and a client boundary here (or importing the shared-ui-jsx\n// barrel from the tenant page) makes the bundler duplicate parts of the\n// module graph — a second canvas/emitter instance renders the site blank.\nimport { useContext, useMemo } from 'react'\nimport {\n  ScreenLinkContext,\n  type ScreenRouteMap,\n} from './screen-link-context-value'\nimport {\n  EXTERNAL_HREF_PATTERN,\n  SAFE_HREF_PATTERN,\n  formatCollectionLinkValue,\n  linkTargetKind,\n  parseCollectionLinkValue,\n  parseEntryLinkValue,\n  parseFeedLinkValue,\n  resolveScreenHref,\n  screenRoutesAnswerFor,\n  splitLinkValue,\n} from './screen-link-value'\n\nexport * from './screen-link-context-value'\n\nexport interface ResolvedScreenLink {\n  /** Site-relative href (`/`, `/company/about`), undefined when unresolvable. */\n  href?: string\n  suppressNavigation: boolean\n  /** True only on the static besigner canvas — interactions are inert. */\n  editorInert: boolean\n  /**\n   * A screen id WAS authored and the routing map does not have it — the\n   * target is unpublished or deleted (AGL-1893).\n   *\n   * Distinct from \"no href\": the canvas and the preview withhold hrefs on\n   * purpose, and an element with no link at all never had one to lose.\n   * Only this flag means the author asked for a link that cannot exist, and\n   * only elements reading THIS may say so — see {@link isScreenLinkBroken}\n   * for why an absent or empty map is deliberately not \"broken\".\n   */\n  broken: boolean\n}\n\n/**\n * Whether an authored screen id points at nothing (AGL-1893).\n *\n * Unpublishing or deleting a screen is a normal authoring action, and until\n * this existed nothing anywhere reported what it had just broken: a Tabs\n * link to a retired screen shipped as a live-looking control that silently\n * did nothing on `aglyn.com/changelog` and `/newsroom` for two days.\n *\n * The two \"we cannot tell\" cases are NOT broken, and the distinction is the\n * whole safety of this predicate:\n *\n * - **no map** — a surface that renders canvas nodes without providing\n *   `ScreenLinkContext` (an isolated spec, an embed) knows nothing about\n *   the host's screens, and must not conclude that every link is dead;\n * - **an empty map** — the same thing one beat earlier: the console's live\n *   host subscription starts empty, and a moment of `{}` must not repaint a\n *   whole navigation row as broken and then repaint it back.\n *\n * Both failure directions were weighed. Calling a live link broken hides or\n * disables working navigation on a customer's site; calling a dead link fine\n * leaves exactly the defect this issue is about. Only the first is\n * unrecoverable from the visitor's side, so the doubt resolves that way.\n */\nexport function isScreenLinkBroken(\n  screens: ScreenRouteMap | undefined,\n  screenId: string | null | undefined,\n): boolean {\n  if (!screenId) return false\n  // Both \"we cannot tell\" cases, asked of the half of the map that holds this\n  // target's kind: a collection listing (AGL-2799) is judged against the\n  // listings, a screen against the screens — see `screenRoutesAnswerFor`.\n  if (!screenRoutesAnswerFor(screens, screenId)) return false\n  return resolveScreenHref(screens, screenId) === undefined\n}\n\n/**\n * The extra option a Screen picker needs when its stored value matches none\n * of the host's screens (AGL-1893).\n *\n * The console builds `SCREEN_SELECT` options from the routing map, so a\n * value the map has lost — the retired `/blog` screen, say — matches\n * nothing and the field renders EMPTY. Which reads, to the person looking\n * at it, as \"no link set\". Meanwhile the element still behaves as linked:\n * the strip is still a nav landmark, that tab is still skipped as\n * \"navigates\", and the panel it would have revealed is still suppressed. So\n * the one surface where this is repairable was also the one actively\n * denying there was anything to repair.\n *\n * Returns the stored value UNCHANGED as the option's value: naming a dead\n * target must not rewrite it, or opening the panel and pressing Save would\n * quietly convert a recoverable reference into something else.\n *\n * Three shapes get named, because a Screen picker can legally hold any of\n * them (AGL-1335 / AGL-1894 / AGL-2799): a screen reference whose screen is\n * gone, a collection listing whose collection is gone, and a plain address\n * typed in before the picker existed. The last is not broken — but it is\n * just as invisible, and an author who cannot see it is the reason those\n * links are not rename-safe yet.\n */\nexport function unavailableScreenLabel(\n  screenId: string,\n  screensKnown: boolean,\n): string {\n  // With no map loaded yet nothing is known to be missing, so the id is\n  // shown plainly. Flashing \"unavailable\" over every link for the beat\n  // before the console's host subscription lands would teach authors to\n  // ignore the warning that matters.\n  if (!screensKnown) return screenId\n  // A listing has no publish state of its own: its collection is either gone\n  // or no longer has the slug its address is built from. A feed hangs off the\n  // same listing, so it is lost the same two ways (AGL-3118).\n  const collectionId = parseCollectionLinkValue(screenId)\n  if (collectionId) {\n    return `⚠ Unavailable collection listing (${collectionId}) — deleted or has no slug`\n  }\n  const feedCollectionId = parseFeedLinkValue(screenId)\n  if (feedCollectionId) {\n    return `⚠ Unavailable RSS feed (${feedCollectionId}) — collection deleted or has no slug`\n  }\n  const entry = parseEntryLinkValue(screenId)\n  return entry\n    ? `⚠ Unavailable entry (${entry.entryId}) — unpublished or deleted`\n    : `⚠ Unavailable page (${screenId}) — unpublished or deleted`\n}\n\nexport function unresolvedScreenOption(\n  value: unknown,\n  screens: ScreenRouteMap | undefined,\n): { value: string; label: string } | undefined {\n  const raw = typeof value === 'string' ? value.trim() : ''\n  if (!raw) return undefined\n  const target = splitLinkValue(raw, undefined)\n  if (target.screenId) {\n    if (resolveScreenHref(screens, target.screenId) !== undefined) {\n      return undefined\n    }\n    return {\n      value: raw,\n      label: unavailableScreenLabel(\n        target.screenId,\n        screenRoutesAnswerFor(screens, target.screenId),\n      ),\n    }\n  }\n  return target.href\n    ? { value: raw, label: `⚠ Plain address (${target.href}) — not a page` }\n    : undefined\n}\n\n/** One target a link picker offers — see {@link screenLinkTargetOptions}. */\nexport interface ScreenLinkTargetOption {\n  /**\n   * The routing-map key: a bare screen id, a collection listing's\n   * `collection:<id>`, or its feed's `feed:<id>`. Stored as it is in a screen\n   * slot, and through `formatScreenLinkValue` in a `Link`-typed prop.\n   */\n  value: string\n  label: string\n  kind: 'screen' | 'collection-listing' | 'feed'\n}\n\n/**\n * What a picker calls one routing-map target, or `undefined` for a key the\n * map does not hold — the label {@link screenLinkTargetOptions} gives it.\n *\n * A listing and a feed are labeled with their collection's name and address,\n * like a screen, and marked as what they are IN the label rather than only by\n * position: a closed picker shows the chosen label and nothing else, and\n * \"Blog (/blog)\" there reads exactly like a screen named Blog. A feed borrows\n * its collection's name, which is the only name it has (AGL-3119).\n *\n * An entry is never named here. A map holds only the entries a page\n * references, under no label, so an entry is named by the search seam\n * (`LinkTargetSearchContext`), which reads the entry itself.\n */\nexport function screenLinkTargetLabel(\n  key: string,\n  screens: ScreenRouteMap | undefined,\n  labels: Record<string, string> | undefined,\n): string | undefined {\n  const href = resolveScreenHref(screens, key)\n  if (href === undefined) return undefined\n  const collectionId = parseCollectionLinkValue(key)\n  if (collectionId) {\n    return `${labels?.[key] ?? collectionId} (${href}) — collection listing`\n  }\n  const feedCollectionId = parseFeedLinkValue(key)\n  if (feedCollectionId) {\n    const name =\n      labels?.[key] ??\n      labels?.[formatCollectionLinkValue(feedCollectionId)] ??\n      feedCollectionId\n    return `${name} (${href}) — RSS feed`\n  }\n  if (parseEntryLinkValue(key)) return undefined\n  return `${labels?.[key] ?? key} (${href})`\n}\n\n/**\n * Everything a Screen picker offers, in the order it offers it (AGL-2799):\n * the host's screens, then its content collections' listing pages, then\n * their RSS feeds (AGL-3119).\n *\n * ONE builder for both pickers — the attributes panel's `SCREEN_SELECT` and\n * the `Link`-typed prop picker. Each used to map the routing map into options\n * by itself, so a target added to one list was missing from the other; and\n * neither offered a collection's listing at all, which is how the drawer on\n * aglyn.com came to link its blog as a typed `/blog`.\n *\n * Entries are left out even when the map holds some: they are searched, not\n * listed, because a site's entries are far too many to read into a dropdown\n * — see `LinkTargetSearchContext`.\n *\n * `order` keeps each picker's established screen order — by path in the\n * attributes panel, by name in the prop picker — and the listings and feeds\n * follow the screens in the same order.\n */\nexport function screenLinkTargetOptions(\n  screens: ScreenRouteMap | undefined,\n  labels: Record<string, string> | undefined,\n  order: 'path' | 'label' = 'path',\n): ScreenLinkTargetOption[] {\n  type Ranked = ScreenLinkTargetOption & { path: string }\n  const pages: Ranked[] = []\n  const listings: Ranked[] = []\n  const feeds: Ranked[] = []\n  for (const [key, path] of Object.entries(screens ?? {})) {\n    const kind = linkTargetKind(key)\n    if (kind === 'entry') continue\n    const label = screenLinkTargetLabel(key, screens, labels) ?? key\n    if (kind === 'collection') {\n      listings.push({ value: key, label, kind: 'collection-listing', path })\n    } else if (kind === 'feed') {\n      feeds.push({ value: key, label, kind: 'feed', path })\n    } else {\n      pages.push({ value: key, label, kind: 'screen', path })\n    }\n  }\n  const compare = (a: Ranked, b: Ranked) =>\n    order === 'path'\n      ? a.path.localeCompare(b.path)\n      : a.label.localeCompare(b.label)\n  return [\n    ...pages.sort(compare),\n    ...listings.sort(compare),\n    ...feeds.sort(compare),\n  ].map(({ value, label, kind }) => ({ value, label, kind }))\n}\n\n/**\n * Marks the element in the DOM. Present on the live site too, deliberately:\n * a smoke pass can then find every dead control on a page with one selector\n * instead of reading five different components' conditions.\n */\nexport const BROKEN_SCREEN_LINK_ATTR = 'data-aglyn-broken-link'\n\n/** What the AUTHOR is told, on the one surface that can fix it. */\nexport const BROKEN_SCREEN_LINK_MESSAGE =\n  'Broken link: this points at a page or collection listing that is ' +\n  'unpublished or deleted, so it will not work on the published site. Pick ' +\n  'a target again in the attributes panel, or clear the link.'\n\n/**\n * The editor-only outline. A warning ring rather than an error one: the\n * screen may be deliberately unpublished and about to come back, and the\n * page is not broken, one control on it is.\n */\nexport const BROKEN_SCREEN_LINK_SX = {\n  outline: '2px dashed',\n  outlineColor: 'warning.main',\n  outlineOffset: '2px',\n  borderRadius: 1,\n}\n\n/**\n * Props that make a dead screen link visible to its author (AGL-1893).\n *\n * The tooltip and the ring are `editorInert` only — that is the static\n * besigner canvas, the one surface where the person who can fix this is\n * looking at it. Preview deliberately does NOT get them: preview exists to\n * show what visitors will see, and an authoring annotation painted into it\n * is a lie of a different kind.\n *\n * The data attribute ships everywhere, canvas and live site alike.\n */\nexport function brokenScreenLinkProps(\n  broken: boolean,\n  editorInert: boolean,\n): Record<string, unknown> {\n  if (!broken) return {}\n  return {\n    [BROKEN_SCREEN_LINK_ATTR]: '',\n    ...(editorInert ? { title: BROKEN_SCREEN_LINK_MESSAGE } : null),\n  }\n}\n\n/**\n * Link VALUE parsing AND resolution live in `./screen-link-value` —\n * server-safe, because the where-used scan and the Markdown representation of\n * a page both run on the server, and the `createContext` this module reaches\n * keeps it out of the `@aglyn/aglyn/server` barrel (AGL-703, AGL-2740).\n * Re-exported here so every existing importer, and the spec beside this file,\n * keeps reaching them at the address they have always used.\n */\nexport {\n  COLLECTION_LINK_VALUE_PREFIX,\n  ENTRY_LINK_VALUE_PREFIX,\n  EXTERNAL_HREF_PATTERN,\n  FEED_LINK_VALUE_PREFIX,\n  SAFE_HREF_PATTERN,\n  SCREEN_LINK_VALUE_PREFIX,\n  formatCollectionLinkValue,\n  formatEntryLinkValue,\n  formatFeedLinkValue,\n  formatScreenLinkValue,\n  linkTargetKind,\n  nodesReferenceScreen,\n  parseCollectionLinkValue,\n  parseEntryLinkValue,\n  parseFeedLinkValue,\n  parseScreenLinkValue,\n  resolveScreenHref,\n  screenRoutesAnswerFor,\n  splitLinkValue,\n  type LinkTargetKind,\n} from './screen-link-value'\n\n/** What a linking element renders — see {@link useLinkTarget}. */\nexport interface ResolvedLinkTarget extends ResolvedScreenLink {\n  /** The literal href in play once safety-checked, when no screen resolved. */\n  externalHref?: string\n  /** True when `href` leaves the site — what \"open in a new tab\" may act on. */\n  leavesSite: boolean\n}\n\n/**\n * The single href a linking element should render, from the `screenId` +\n * `href` pair every one of them declares (AGL-1335).\n *\n * Button, Screen Link, Link Box and Image each had the same four lines —\n * resolve the id, safety-check the URL, prefer the id — which is three\n * copies too many now that a `Link`-typed component prop can feed either\n * slot with either shape. Hook-shaped because {@link useScreenLink} is;\n * it is always called, so the hook order never depends on the values.\n */\nexport function useLinkTarget(\n  screenId: string | null | undefined,\n  href: string | null | undefined,\n): ResolvedLinkTarget {\n  const target = splitLinkValue(screenId, href)\n  const resolved = useScreenLink(target.screenId)\n  const externalHref =\n    target.href && SAFE_HREF_PATTERN.test(target.href) ? target.href : undefined\n  const finalHref = target.screenId ? resolved.href : externalHref\n  return {\n    ...resolved,\n    href: finalHref,\n    externalHref,\n    leavesSite: Boolean(\n      !target.screenId && externalHref && EXTERNAL_HREF_PATTERN.test(externalHref),\n    ),\n  }\n}\n\n/**\n * Resolves a screen id to its current href. Memoized on the routing-map\n * identity: a slug rename, parent-slug change, or re-parent produces a new\n * map value, so cached hrefs reset exactly when the map changes. Returns no\n * href for unknown/unpublished ids — callers degrade to plain content\n * instead of rendering a dead link.\n */\nexport function useScreenLink(\n  screenId: string | null | undefined,\n): ResolvedScreenLink {\n  const { screens, suppressNavigation, editorInert } = useContext(ScreenLinkContext)\n  const href = useMemo(() => {\n    if (!screenId) return undefined\n    const resolved = resolveScreenHref(screens, screenId)\n    if (resolved === undefined) {\n      if (process.env.NODE_ENV !== 'production') {\n        console.warn(\n          `[ScreenLink] screen \"${screenId}\" has no routing-map entry — ` +\n            'it may be unpublished or deleted; rendering without an href.',\n        )\n      }\n      return undefined\n    }\n    return resolved\n  }, [screenId, screens])\n  return {\n    href,\n    suppressNavigation: Boolean(suppressNavigation),\n    editorInert: Boolean(editorInert),\n    // NOT `!href`: a suppressed surface has no href for links that resolve\n    // perfectly well, and the whole point of this flag is to separate the\n    // two (AGL-1893).\n    broken: isScreenLinkBroken(screens, screenId),\n  }\n}\n"],"names":["useContext","useMemo","ScreenLinkContext","EXTERNAL_HREF_PATTERN","SAFE_HREF_PATTERN","formatCollectionLinkValue","linkTargetKind","parseCollectionLinkValue","parseEntryLinkValue","parseFeedLinkValue","resolveScreenHref","screenRoutesAnswerFor","splitLinkValue","isScreenLinkBroken","screens","screenId","undefined","unavailableScreenLabel","screensKnown","collectionId","feedCollectionId","entry","entryId","unresolvedScreenOption","value","raw","trim","target","label","href","screenLinkTargetLabel","key","labels","name","screenLinkTargetOptions","order","pages","listings","feeds","path","Object","entries","kind","push","compare","a","b","localeCompare","sort","map","BROKEN_SCREEN_LINK_ATTR","BROKEN_SCREEN_LINK_MESSAGE","BROKEN_SCREEN_LINK_SX","outline","outlineColor","outlineOffset","borderRadius","brokenScreenLinkProps","broken","editorInert","title","COLLECTION_LINK_VALUE_PREFIX","ENTRY_LINK_VALUE_PREFIX","FEED_LINK_VALUE_PREFIX","SCREEN_LINK_VALUE_PREFIX","formatEntryLinkValue","formatFeedLinkValue","formatScreenLinkValue","nodesReferenceScreen","parseScreenLinkValue","useLinkTarget","resolved","useScreenLink","externalHref","test","finalHref","leavesSite","Boolean","suppressNavigation","process","env","NODE_ENV","console","warn"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GACD,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,0EAA0E;AAC1E,SAASA,UAAU,EAAEC,OAAO,QAAQ,QAAO;AAC3C,SACEC,iBAAiB,QAEZ,iCAA6B;AACpC,SACEC,qBAAqB,EACrBC,iBAAiB,EACjBC,yBAAyB,EACzBC,cAAc,EACdC,wBAAwB,EACxBC,mBAAmB,EACnBC,kBAAkB,EAClBC,iBAAiB,EACjBC,qBAAqB,EACrBC,cAAc,QACT,yBAAqB;AAE5B,cAAc,iCAA6B;AAqB3C;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASC,mBACdC,OAAmC,EACnCC,QAAmC;IAEnC,IAAI,CAACA,UAAU,OAAO;IACtB,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAACJ,sBAAsBG,SAASC,WAAW,OAAO;IACtD,OAAOL,kBAAkBI,SAASC,cAAcC;AAClD;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,SAASC,uBACdF,QAAgB,EAChBG,YAAqB;IAErB,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,mCAAmC;IACnC,IAAI,CAACA,cAAc,OAAOH;IAC1B,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAMI,eAAeZ,yBAAyBQ;IAC9C,IAAII,cAAc;QAChB,OAAO,CAAC,kCAAkC,EAAEA,aAAa,0BAA0B,CAAC;IACtF;IACA,MAAMC,mBAAmBX,mBAAmBM;IAC5C,IAAIK,kBAAkB;QACpB,OAAO,CAAC,wBAAwB,EAAEA,iBAAiB,qCAAqC,CAAC;IAC3F;IACA,MAAMC,QAAQb,oBAAoBO;IAClC,OAAOM,QACH,CAAC,qBAAqB,EAAEA,MAAMC,OAAO,CAAC,0BAA0B,CAAC,GACjE,CAAC,oBAAoB,EAAEP,SAAS,0BAA0B,CAAC;AACjE;AAEA,OAAO,SAASQ,uBACdC,KAAc,EACdV,OAAmC;IAEnC,MAAMW,MAAM,OAAOD,UAAU,WAAWA,MAAME,IAAI,KAAK;IACvD,IAAI,CAACD,KAAK,OAAOT;IACjB,MAAMW,SAASf,eAAea,KAAKT;IACnC,IAAIW,OAAOZ,QAAQ,EAAE;QACnB,IAAIL,kBAAkBI,SAASa,OAAOZ,QAAQ,MAAMC,WAAW;YAC7D,OAAOA;QACT;QACA,OAAO;YACLQ,OAAOC;YACPG,OAAOX,uBACLU,OAAOZ,QAAQ,EACfJ,sBAAsBG,SAASa,OAAOZ,QAAQ;QAElD;IACF;IACA,OAAOY,OAAOE,IAAI,GACd;QAAEL,OAAOC;QAAKG,OAAO,CAAC,iBAAiB,EAAED,OAAOE,IAAI,CAAC,cAAc,CAAC;IAAC,IACrEb;AACN;AAcA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASc,sBACdC,GAAW,EACXjB,OAAmC,EACnCkB,MAA0C;;IAE1C,MAAMH,OAAOnB,kBAAkBI,SAASiB;IACxC,IAAIF,SAASb,WAAW,OAAOA;IAC/B,MAAMG,eAAeZ,yBAAyBwB;IAC9C,IAAIZ,cAAc;;QAChB,OAAO,YAAGa,0BAAAA,MAAQ,CAACD,IAAI,oBAAIZ,aAAa,EAAE,EAAEU,KAAK,sBAAsB,CAAC;IAC1E;IACA,MAAMT,mBAAmBX,mBAAmBsB;IAC5C,IAAIX,kBAAkB;YAElBY;QADF,MAAMC,QACJD,iBAAAA,0BAAAA,MAAQ,CAACD,IAAI,oBACbC,0BAAAA,MAAQ,CAAC3B,0BAA0Be,kBAAkB,YADrDY,QAEAZ;QACF,OAAO,GAAGa,KAAK,EAAE,EAAEJ,KAAK,YAAY,CAAC;IACvC;IACA,IAAIrB,oBAAoBuB,MAAM,OAAOf;IACrC,OAAO,WAAGgB,0BAAAA,MAAQ,CAACD,IAAI,mBAAIA,IAAI,EAAE,EAAEF,KAAK,CAAC,CAAC;AAC5C;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASK,wBACdpB,OAAmC,EACnCkB,MAA0C,EAC1CG,QAA0B,MAAM;IAGhC,MAAMC,QAAkB,EAAE;IAC1B,MAAMC,WAAqB,EAAE;IAC7B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAM,CAACP,KAAKQ,KAAK,IAAIC,OAAOC,OAAO,CAAC3B,kBAAAA,UAAW,CAAC,GAAI;YAGzCgB;QAFd,MAAMY,OAAOpC,eAAeyB;QAC5B,IAAIW,SAAS,SAAS;QACtB,MAAMd,SAAQE,yBAAAA,sBAAsBC,KAAKjB,SAASkB,mBAApCF,yBAA+CC;QAC7D,IAAIW,SAAS,cAAc;YACzBL,SAASM,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAsBH;YAAK;QACtE,OAAO,IAAIG,SAAS,QAAQ;YAC1BJ,MAAMK,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAQH;YAAK;QACrD,OAAO;YACLH,MAAMO,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAUH;YAAK;QACvD;IACF;IACA,MAAMK,UAAU,CAACC,GAAWC,IAC1BX,UAAU,SACNU,EAAEN,IAAI,CAACQ,aAAa,CAACD,EAAEP,IAAI,IAC3BM,EAAEjB,KAAK,CAACmB,aAAa,CAACD,EAAElB,KAAK;IACnC,OAAO;WACFQ,MAAMY,IAAI,CAACJ;WACXP,SAASW,IAAI,CAACJ;WACdN,MAAMU,IAAI,CAACJ;KACf,CAACK,GAAG,CAAC,CAAC,EAAEzB,KAAK,EAAEI,KAAK,EAAEc,IAAI,EAAE,GAAM,CAAA;YAAElB;YAAOI;YAAOc;QAAK,CAAA;AAC1D;AAEA;;;;CAIC,GACD,OAAO,MAAMQ,0BAA0B,yBAAwB;AAE/D,iEAAiE,GACjE,OAAO,MAAMC,6BACX,sEACA,6EACA,6DAA4D;AAE9D;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB;IACnCC,SAAS;IACTC,cAAc;IACdC,eAAe;IACfC,cAAc;AAChB,EAAC;AAED;;;;;;;;;;CAUC,GACD,OAAO,SAASC,sBACdC,MAAe,EACfC,WAAoB;IAEpB,IAAI,CAACD,QAAQ,OAAO,CAAC;IACrB,OAAO;QACL,CAACR,wBAAwB,EAAE;OACvBS,cAAc;QAAEC,OAAOT;IAA2B,IAAI;AAE9D;AAEA;;;;;;;CAOC,GACD,SACEU,4BAA4B,EAC5BC,uBAAuB,EACvB3D,qBAAqB,EACrB4D,sBAAsB,EACtB3D,iBAAiB,EACjB4D,wBAAwB,EACxB3D,yBAAyB,EACzB4D,oBAAoB,EACpBC,mBAAmB,EACnBC,qBAAqB,EACrB7D,cAAc,EACd8D,oBAAoB,EACpB7D,wBAAwB,EACxBC,mBAAmB,EACnBC,kBAAkB,EAClB4D,oBAAoB,EACpB3D,iBAAiB,EACjBC,qBAAqB,EACrBC,cAAc,QAET,yBAAqB;AAU5B;;;;;;;;;CASC,GACD,OAAO,SAAS0D,cACdvD,QAAmC,EACnCc,IAA+B;IAE/B,MAAMF,SAASf,eAAeG,UAAUc;IACxC,MAAM0C,WAAWC,cAAc7C,OAAOZ,QAAQ;IAC9C,MAAM0D,eACJ9C,OAAOE,IAAI,IAAIzB,kBAAkBsE,IAAI,CAAC/C,OAAOE,IAAI,IAAIF,OAAOE,IAAI,GAAGb;IACrE,MAAM2D,YAAYhD,OAAOZ,QAAQ,GAAGwD,SAAS1C,IAAI,GAAG4C;IACpD,OAAO,aACFF;QACH1C,MAAM8C;QACNF;QACAG,YAAYC,QACV,CAAClD,OAAOZ,QAAQ,IAAI0D,gBAAgBtE,sBAAsBuE,IAAI,CAACD;;AAGrE;AAEA;;;;;;CAMC,GACD,OAAO,SAASD,cACdzD,QAAmC;IAEnC,MAAM,EAAED,OAAO,EAAEgE,kBAAkB,EAAEnB,WAAW,EAAE,GAAG3D,WAAWE;IAChE,MAAM2B,OAAO5B,QAAQ;QACnB,IAAI,CAACc,UAAU,OAAOC;QACtB,MAAMuD,WAAW7D,kBAAkBI,SAASC;QAC5C,IAAIwD,aAAavD,WAAW;YAC1B,IAAI+D,QAAQC,GAAG,CAACC,QAAQ,KAAK,cAAc;gBACzCC,QAAQC,IAAI,CACV,CAAC,qBAAqB,EAAEpE,SAAS,6BAA6B,CAAC,GAC7D;YAEN;YACA,OAAOC;QACT;QACA,OAAOuD;IACT,GAAG;QAACxD;QAAUD;KAAQ;IACtB,OAAO;QACLe;QACAiD,oBAAoBD,QAAQC;QAC5BnB,aAAakB,QAAQlB;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,kBAAkB;QAClBD,QAAQ7C,mBAAmBC,SAASC;IACtC;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-link-context.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n// Lives in @aglyn/aglyn (not a UI lib) deliberately, WITHOUT a 'use client'\n// banner: every surface that renders canvas nodes already imports this\n// package, and a client boundary here (or importing the shared-ui-jsx\n// barrel from the tenant page) makes the bundler duplicate parts of the\n// module graph — a second canvas/emitter instance renders the site blank.\nimport { useContext, useMemo } from 'react'\nimport { routeThroughLeavingNotice } from './leaving-notice'\nimport {\n  ScreenLinkContext,\n  type ScreenRouteMap,\n} from './screen-link-context-value'\nimport {\n  EXTERNAL_HREF_PATTERN,\n  SAFE_HREF_PATTERN,\n  formatCollectionLinkValue,\n  linkTargetKind,\n  parseCollectionLinkValue,\n  parseEntryLinkValue,\n  parseFeedLinkValue,\n  resolveScreenHref,\n  screenRoutesAnswerFor,\n  splitLinkValue,\n} from './screen-link-value'\n\nexport * from './screen-link-context-value'\n\nexport interface ResolvedScreenLink {\n  /** Site-relative href (`/`, `/company/about`), undefined when unresolvable. */\n  href?: string\n  suppressNavigation: boolean\n  /** True only on the static besigner canvas — interactions are inert. */\n  editorInert: boolean\n  /**\n   * A screen id WAS authored and the routing map does not have it — the\n   * target is unpublished or deleted (AGL-1893).\n   *\n   * Distinct from \"no href\": the canvas and the preview withhold hrefs on\n   * purpose, and an element with no link at all never had one to lose.\n   * Only this flag means the author asked for a link that cannot exist, and\n   * only elements reading THIS may say so — see {@link isScreenLinkBroken}\n   * for why an absent or empty map is deliberately not \"broken\".\n   */\n  broken: boolean\n}\n\n/**\n * Whether an authored screen id points at nothing (AGL-1893).\n *\n * Unpublishing or deleting a screen is a normal authoring action, and until\n * this existed nothing anywhere reported what it had just broken: a Tabs\n * link to a retired screen shipped as a live-looking control that silently\n * did nothing on `aglyn.com/changelog` and `/newsroom` for two days.\n *\n * The two \"we cannot tell\" cases are NOT broken, and the distinction is the\n * whole safety of this predicate:\n *\n * - **no map** — a surface that renders canvas nodes without providing\n *   `ScreenLinkContext` (an isolated spec, an embed) knows nothing about\n *   the host's screens, and must not conclude that every link is dead;\n * - **an empty map** — the same thing one beat earlier: the console's live\n *   host subscription starts empty, and a moment of `{}` must not repaint a\n *   whole navigation row as broken and then repaint it back.\n *\n * Both failure directions were weighed. Calling a live link broken hides or\n * disables working navigation on a customer's site; calling a dead link fine\n * leaves exactly the defect this issue is about. Only the first is\n * unrecoverable from the visitor's side, so the doubt resolves that way.\n */\nexport function isScreenLinkBroken(\n  screens: ScreenRouteMap | undefined,\n  screenId: string | null | undefined,\n): boolean {\n  if (!screenId) return false\n  // Both \"we cannot tell\" cases, asked of the half of the map that holds this\n  // target's kind: a collection listing (AGL-2799) is judged against the\n  // listings, a screen against the screens — see `screenRoutesAnswerFor`.\n  if (!screenRoutesAnswerFor(screens, screenId)) return false\n  return resolveScreenHref(screens, screenId) === undefined\n}\n\n/**\n * The extra option a Screen picker needs when its stored value matches none\n * of the host's screens (AGL-1893).\n *\n * The console builds `SCREEN_SELECT` options from the routing map, so a\n * value the map has lost — the retired `/blog` screen, say — matches\n * nothing and the field renders EMPTY. Which reads, to the person looking\n * at it, as \"no link set\". Meanwhile the element still behaves as linked:\n * the strip is still a nav landmark, that tab is still skipped as\n * \"navigates\", and the panel it would have revealed is still suppressed. So\n * the one surface where this is repairable was also the one actively\n * denying there was anything to repair.\n *\n * Returns the stored value UNCHANGED as the option's value: naming a dead\n * target must not rewrite it, or opening the panel and pressing Save would\n * quietly convert a recoverable reference into something else.\n *\n * Three shapes get named, because a Screen picker can legally hold any of\n * them (AGL-1335 / AGL-1894 / AGL-2799): a screen reference whose screen is\n * gone, a collection listing whose collection is gone, and a plain address\n * typed in before the picker existed. The last is not broken — but it is\n * just as invisible, and an author who cannot see it is the reason those\n * links are not rename-safe yet.\n */\nexport function unavailableScreenLabel(\n  screenId: string,\n  screensKnown: boolean,\n): string {\n  // With no map loaded yet nothing is known to be missing, so the id is\n  // shown plainly. Flashing \"unavailable\" over every link for the beat\n  // before the console's host subscription lands would teach authors to\n  // ignore the warning that matters.\n  if (!screensKnown) return screenId\n  // A listing has no publish state of its own: its collection is either gone\n  // or no longer has the slug its address is built from. A feed hangs off the\n  // same listing, so it is lost the same two ways (AGL-3118).\n  const collectionId = parseCollectionLinkValue(screenId)\n  if (collectionId) {\n    return `⚠ Unavailable collection listing (${collectionId}) — deleted or has no slug`\n  }\n  const feedCollectionId = parseFeedLinkValue(screenId)\n  if (feedCollectionId) {\n    return `⚠ Unavailable RSS feed (${feedCollectionId}) — collection deleted or has no slug`\n  }\n  const entry = parseEntryLinkValue(screenId)\n  return entry\n    ? `⚠ Unavailable entry (${entry.entryId}) — unpublished or deleted`\n    : `⚠ Unavailable page (${screenId}) — unpublished or deleted`\n}\n\nexport function unresolvedScreenOption(\n  value: unknown,\n  screens: ScreenRouteMap | undefined,\n): { value: string; label: string } | undefined {\n  const raw = typeof value === 'string' ? value.trim() : ''\n  if (!raw) return undefined\n  const target = splitLinkValue(raw, undefined)\n  if (target.screenId) {\n    if (resolveScreenHref(screens, target.screenId) !== undefined) {\n      return undefined\n    }\n    return {\n      value: raw,\n      label: unavailableScreenLabel(\n        target.screenId,\n        screenRoutesAnswerFor(screens, target.screenId),\n      ),\n    }\n  }\n  return target.href\n    ? { value: raw, label: `⚠ Plain address (${target.href}) — not a page` }\n    : undefined\n}\n\n/** One target a link picker offers — see {@link screenLinkTargetOptions}. */\nexport interface ScreenLinkTargetOption {\n  /**\n   * The routing-map key: a bare screen id, a collection listing's\n   * `collection:<id>`, or its feed's `feed:<id>`. Stored as it is in a screen\n   * slot, and through `formatScreenLinkValue` in a `Link`-typed prop.\n   */\n  value: string\n  label: string\n  kind: 'screen' | 'collection-listing' | 'feed'\n}\n\n/**\n * What a picker calls one routing-map target, or `undefined` for a key the\n * map does not hold — the label {@link screenLinkTargetOptions} gives it.\n *\n * A listing and a feed are labeled with their collection's name and address,\n * like a screen, and marked as what they are IN the label rather than only by\n * position: a closed picker shows the chosen label and nothing else, and\n * \"Blog (/blog)\" there reads exactly like a screen named Blog. A feed borrows\n * its collection's name, which is the only name it has (AGL-3119).\n *\n * An entry is never named here. A map holds only the entries a page\n * references, under no label, so an entry is named by the search seam\n * (`LinkTargetSearchContext`), which reads the entry itself.\n */\nexport function screenLinkTargetLabel(\n  key: string,\n  screens: ScreenRouteMap | undefined,\n  labels: Record<string, string> | undefined,\n): string | undefined {\n  const href = resolveScreenHref(screens, key)\n  if (href === undefined) return undefined\n  const collectionId = parseCollectionLinkValue(key)\n  if (collectionId) {\n    return `${labels?.[key] ?? collectionId} (${href}) — collection listing`\n  }\n  const feedCollectionId = parseFeedLinkValue(key)\n  if (feedCollectionId) {\n    const name =\n      labels?.[key] ??\n      labels?.[formatCollectionLinkValue(feedCollectionId)] ??\n      feedCollectionId\n    return `${name} (${href}) — RSS feed`\n  }\n  if (parseEntryLinkValue(key)) return undefined\n  return `${labels?.[key] ?? key} (${href})`\n}\n\n/**\n * Everything a Screen picker offers, in the order it offers it (AGL-2799):\n * the host's screens, then its content collections' listing pages, then\n * their RSS feeds (AGL-3119).\n *\n * ONE builder for both pickers — the attributes panel's `SCREEN_SELECT` and\n * the `Link`-typed prop picker. Each used to map the routing map into options\n * by itself, so a target added to one list was missing from the other; and\n * neither offered a collection's listing at all, which is how the drawer on\n * aglyn.com came to link its blog as a typed `/blog`.\n *\n * Entries are left out even when the map holds some: they are searched, not\n * listed, because a site's entries are far too many to read into a dropdown\n * — see `LinkTargetSearchContext`.\n *\n * `order` keeps each picker's established screen order — by path in the\n * attributes panel, by name in the prop picker — and the listings and feeds\n * follow the screens in the same order.\n */\nexport function screenLinkTargetOptions(\n  screens: ScreenRouteMap | undefined,\n  labels: Record<string, string> | undefined,\n  order: 'path' | 'label' = 'path',\n): ScreenLinkTargetOption[] {\n  type Ranked = ScreenLinkTargetOption & { path: string }\n  const pages: Ranked[] = []\n  const listings: Ranked[] = []\n  const feeds: Ranked[] = []\n  for (const [key, path] of Object.entries(screens ?? {})) {\n    const kind = linkTargetKind(key)\n    if (kind === 'entry') continue\n    const label = screenLinkTargetLabel(key, screens, labels) ?? key\n    if (kind === 'collection') {\n      listings.push({ value: key, label, kind: 'collection-listing', path })\n    } else if (kind === 'feed') {\n      feeds.push({ value: key, label, kind: 'feed', path })\n    } else {\n      pages.push({ value: key, label, kind: 'screen', path })\n    }\n  }\n  const compare = (a: Ranked, b: Ranked) =>\n    order === 'path'\n      ? a.path.localeCompare(b.path)\n      : a.label.localeCompare(b.label)\n  return [\n    ...pages.sort(compare),\n    ...listings.sort(compare),\n    ...feeds.sort(compare),\n  ].map(({ value, label, kind }) => ({ value, label, kind }))\n}\n\n/**\n * Marks the element in the DOM. Present on the live site too, deliberately:\n * a smoke pass can then find every dead control on a page with one selector\n * instead of reading five different components' conditions.\n */\nexport const BROKEN_SCREEN_LINK_ATTR = 'data-aglyn-broken-link'\n\n/** What the AUTHOR is told, on the one surface that can fix it. */\nexport const BROKEN_SCREEN_LINK_MESSAGE =\n  'Broken link: this points at a page or collection listing that is ' +\n  'unpublished or deleted, so it will not work on the published site. Pick ' +\n  'a target again in the attributes panel, or clear the link.'\n\n/**\n * The editor-only outline. A warning ring rather than an error one: the\n * screen may be deliberately unpublished and about to come back, and the\n * page is not broken, one control on it is.\n */\nexport const BROKEN_SCREEN_LINK_SX = {\n  outline: '2px dashed',\n  outlineColor: 'warning.main',\n  outlineOffset: '2px',\n  borderRadius: 1,\n}\n\n/**\n * Props that make a dead screen link visible to its author (AGL-1893).\n *\n * The tooltip and the ring are `editorInert` only — that is the static\n * besigner canvas, the one surface where the person who can fix this is\n * looking at it. Preview deliberately does NOT get them: preview exists to\n * show what visitors will see, and an authoring annotation painted into it\n * is a lie of a different kind.\n *\n * The data attribute ships everywhere, canvas and live site alike.\n */\nexport function brokenScreenLinkProps(\n  broken: boolean,\n  editorInert: boolean,\n): Record<string, unknown> {\n  if (!broken) return {}\n  return {\n    [BROKEN_SCREEN_LINK_ATTR]: '',\n    ...(editorInert ? { title: BROKEN_SCREEN_LINK_MESSAGE } : null),\n  }\n}\n\n/**\n * Link VALUE parsing AND resolution live in `./screen-link-value` —\n * server-safe, because the where-used scan and the Markdown representation of\n * a page both run on the server, and the `createContext` this module reaches\n * keeps it out of the `@aglyn/aglyn/server` barrel (AGL-703, AGL-2740).\n * Re-exported here so every existing importer, and the spec beside this file,\n * keeps reaching them at the address they have always used.\n */\nexport {\n  COLLECTION_LINK_VALUE_PREFIX,\n  ENTRY_LINK_VALUE_PREFIX,\n  EXTERNAL_HREF_PATTERN,\n  FEED_LINK_VALUE_PREFIX,\n  SAFE_HREF_PATTERN,\n  SCREEN_LINK_VALUE_PREFIX,\n  formatCollectionLinkValue,\n  formatEntryLinkValue,\n  formatFeedLinkValue,\n  formatScreenLinkValue,\n  linkTargetKind,\n  nodesReferenceScreen,\n  parseCollectionLinkValue,\n  parseEntryLinkValue,\n  parseFeedLinkValue,\n  parseScreenLinkValue,\n  resolveScreenHref,\n  screenRoutesAnswerFor,\n  splitLinkValue,\n  type LinkTargetKind,\n} from './screen-link-value'\n\n/** What a linking element renders — see {@link useLinkTarget}. */\nexport interface ResolvedLinkTarget extends ResolvedScreenLink {\n  /** The literal href in play once safety-checked, when no screen resolved. */\n  externalHref?: string\n  /** True when `href` leaves the site — what \"open in a new tab\" may act on. */\n  leavesSite: boolean\n}\n\n/**\n * The single href a linking element should render, from the `screenId` +\n * `href` pair every one of them declares (AGL-1335).\n *\n * Button, Screen Link, Link Box and Image each had the same four lines —\n * resolve the id, safety-check the URL, prefer the id — which is three\n * copies too many now that a `Link`-typed component prop can feed either\n * slot with either shape. Hook-shaped because {@link useScreenLink} is;\n * it is always called, so the hook order never depends on the values.\n */\nexport function useLinkTarget(\n  screenId: string | null | undefined,\n  href: string | null | undefined,\n): ResolvedLinkTarget {\n  const target = splitLinkValue(screenId, href)\n  const resolved = useScreenLink(target.screenId)\n  const { leavingNotice } = useContext(ScreenLinkContext)\n  const externalHref =\n    target.href && SAFE_HREF_PATTERN.test(target.href) ? target.href : undefined\n  const finalHref = target.screenId ? resolved.href : externalHref\n  /*\n   * A new free site's links to other domains go through the leaving notice on\n   * its own host (AGL-3452). Here rather than in each element so the served\n   * HTML already carries the notice's address: it holds without JavaScript,\n   * and it is what a hover, a copied link and \"Open in new tab\" all see.\n   *\n   * The notice is on the site, so the rewritten link no longer leaves it —\n   * and keeping the referrer is what lets the notice's Go back return to the\n   * page the visitor came from.\n   */\n  const noticeHref =\n    !target.screenId && !resolved.suppressNavigation\n      ? routeThroughLeavingNotice(externalHref, leavingNotice)\n      : undefined\n  return {\n    ...resolved,\n    href: noticeHref ?? finalHref,\n    externalHref,\n    leavesSite: Boolean(\n      !noticeHref &&\n        !target.screenId &&\n        externalHref &&\n        EXTERNAL_HREF_PATTERN.test(externalHref),\n    ),\n  }\n}\n\n/**\n * Resolves a screen id to its current href. Memoized on the routing-map\n * identity: a slug rename, parent-slug change, or re-parent produces a new\n * map value, so cached hrefs reset exactly when the map changes. Returns no\n * href for unknown/unpublished ids — callers degrade to plain content\n * instead of rendering a dead link.\n */\nexport function useScreenLink(\n  screenId: string | null | undefined,\n): ResolvedScreenLink {\n  const { screens, suppressNavigation, editorInert } = useContext(ScreenLinkContext)\n  const href = useMemo(() => {\n    if (!screenId) return undefined\n    const resolved = resolveScreenHref(screens, screenId)\n    if (resolved === undefined) {\n      if (process.env.NODE_ENV !== 'production') {\n        console.warn(\n          `[ScreenLink] screen \"${screenId}\" has no routing-map entry — ` +\n            'it may be unpublished or deleted; rendering without an href.',\n        )\n      }\n      return undefined\n    }\n    return resolved\n  }, [screenId, screens])\n  return {\n    href,\n    suppressNavigation: Boolean(suppressNavigation),\n    editorInert: Boolean(editorInert),\n    // NOT `!href`: a suppressed surface has no href for links that resolve\n    // perfectly well, and the whole point of this flag is to separate the\n    // two (AGL-1893).\n    broken: isScreenLinkBroken(screens, screenId),\n  }\n}\n"],"names":["useContext","useMemo","routeThroughLeavingNotice","ScreenLinkContext","EXTERNAL_HREF_PATTERN","SAFE_HREF_PATTERN","formatCollectionLinkValue","linkTargetKind","parseCollectionLinkValue","parseEntryLinkValue","parseFeedLinkValue","resolveScreenHref","screenRoutesAnswerFor","splitLinkValue","isScreenLinkBroken","screens","screenId","undefined","unavailableScreenLabel","screensKnown","collectionId","feedCollectionId","entry","entryId","unresolvedScreenOption","value","raw","trim","target","label","href","screenLinkTargetLabel","key","labels","name","screenLinkTargetOptions","order","pages","listings","feeds","path","Object","entries","kind","push","compare","a","b","localeCompare","sort","map","BROKEN_SCREEN_LINK_ATTR","BROKEN_SCREEN_LINK_MESSAGE","BROKEN_SCREEN_LINK_SX","outline","outlineColor","outlineOffset","borderRadius","brokenScreenLinkProps","broken","editorInert","title","COLLECTION_LINK_VALUE_PREFIX","ENTRY_LINK_VALUE_PREFIX","FEED_LINK_VALUE_PREFIX","SCREEN_LINK_VALUE_PREFIX","formatEntryLinkValue","formatFeedLinkValue","formatScreenLinkValue","nodesReferenceScreen","parseScreenLinkValue","useLinkTarget","resolved","useScreenLink","leavingNotice","externalHref","test","finalHref","noticeHref","suppressNavigation","leavesSite","Boolean","process","env","NODE_ENV","console","warn"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GACD,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,wEAAwE;AACxE,0EAA0E;AAC1E,SAASA,UAAU,EAAEC,OAAO,QAAQ,QAAO;AAC3C,SAASC,yBAAyB,QAAQ,sBAAkB;AAC5D,SACEC,iBAAiB,QAEZ,iCAA6B;AACpC,SACEC,qBAAqB,EACrBC,iBAAiB,EACjBC,yBAAyB,EACzBC,cAAc,EACdC,wBAAwB,EACxBC,mBAAmB,EACnBC,kBAAkB,EAClBC,iBAAiB,EACjBC,qBAAqB,EACrBC,cAAc,QACT,yBAAqB;AAE5B,cAAc,iCAA6B;AAqB3C;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASC,mBACdC,OAAmC,EACnCC,QAAmC;IAEnC,IAAI,CAACA,UAAU,OAAO;IACtB,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAACJ,sBAAsBG,SAASC,WAAW,OAAO;IACtD,OAAOL,kBAAkBI,SAASC,cAAcC;AAClD;AAEA;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,SAASC,uBACdF,QAAgB,EAChBG,YAAqB;IAErB,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,mCAAmC;IACnC,IAAI,CAACA,cAAc,OAAOH;IAC1B,2EAA2E;IAC3E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAMI,eAAeZ,yBAAyBQ;IAC9C,IAAII,cAAc;QAChB,OAAO,CAAC,kCAAkC,EAAEA,aAAa,0BAA0B,CAAC;IACtF;IACA,MAAMC,mBAAmBX,mBAAmBM;IAC5C,IAAIK,kBAAkB;QACpB,OAAO,CAAC,wBAAwB,EAAEA,iBAAiB,qCAAqC,CAAC;IAC3F;IACA,MAAMC,QAAQb,oBAAoBO;IAClC,OAAOM,QACH,CAAC,qBAAqB,EAAEA,MAAMC,OAAO,CAAC,0BAA0B,CAAC,GACjE,CAAC,oBAAoB,EAAEP,SAAS,0BAA0B,CAAC;AACjE;AAEA,OAAO,SAASQ,uBACdC,KAAc,EACdV,OAAmC;IAEnC,MAAMW,MAAM,OAAOD,UAAU,WAAWA,MAAME,IAAI,KAAK;IACvD,IAAI,CAACD,KAAK,OAAOT;IACjB,MAAMW,SAASf,eAAea,KAAKT;IACnC,IAAIW,OAAOZ,QAAQ,EAAE;QACnB,IAAIL,kBAAkBI,SAASa,OAAOZ,QAAQ,MAAMC,WAAW;YAC7D,OAAOA;QACT;QACA,OAAO;YACLQ,OAAOC;YACPG,OAAOX,uBACLU,OAAOZ,QAAQ,EACfJ,sBAAsBG,SAASa,OAAOZ,QAAQ;QAElD;IACF;IACA,OAAOY,OAAOE,IAAI,GACd;QAAEL,OAAOC;QAAKG,OAAO,CAAC,iBAAiB,EAAED,OAAOE,IAAI,CAAC,cAAc,CAAC;IAAC,IACrEb;AACN;AAcA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASc,sBACdC,GAAW,EACXjB,OAAmC,EACnCkB,MAA0C;;IAE1C,MAAMH,OAAOnB,kBAAkBI,SAASiB;IACxC,IAAIF,SAASb,WAAW,OAAOA;IAC/B,MAAMG,eAAeZ,yBAAyBwB;IAC9C,IAAIZ,cAAc;;QAChB,OAAO,YAAGa,0BAAAA,MAAQ,CAACD,IAAI,oBAAIZ,aAAa,EAAE,EAAEU,KAAK,sBAAsB,CAAC;IAC1E;IACA,MAAMT,mBAAmBX,mBAAmBsB;IAC5C,IAAIX,kBAAkB;YAElBY;QADF,MAAMC,QACJD,iBAAAA,0BAAAA,MAAQ,CAACD,IAAI,oBACbC,0BAAAA,MAAQ,CAAC3B,0BAA0Be,kBAAkB,YADrDY,QAEAZ;QACF,OAAO,GAAGa,KAAK,EAAE,EAAEJ,KAAK,YAAY,CAAC;IACvC;IACA,IAAIrB,oBAAoBuB,MAAM,OAAOf;IACrC,OAAO,WAAGgB,0BAAAA,MAAQ,CAACD,IAAI,mBAAIA,IAAI,EAAE,EAAEF,KAAK,CAAC,CAAC;AAC5C;AAEA;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,SAASK,wBACdpB,OAAmC,EACnCkB,MAA0C,EAC1CG,QAA0B,MAAM;IAGhC,MAAMC,QAAkB,EAAE;IAC1B,MAAMC,WAAqB,EAAE;IAC7B,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAM,CAACP,KAAKQ,KAAK,IAAIC,OAAOC,OAAO,CAAC3B,kBAAAA,UAAW,CAAC,GAAI;YAGzCgB;QAFd,MAAMY,OAAOpC,eAAeyB;QAC5B,IAAIW,SAAS,SAAS;QACtB,MAAMd,SAAQE,yBAAAA,sBAAsBC,KAAKjB,SAASkB,mBAApCF,yBAA+CC;QAC7D,IAAIW,SAAS,cAAc;YACzBL,SAASM,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAsBH;YAAK;QACtE,OAAO,IAAIG,SAAS,QAAQ;YAC1BJ,MAAMK,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAQH;YAAK;QACrD,OAAO;YACLH,MAAMO,IAAI,CAAC;gBAAEnB,OAAOO;gBAAKH;gBAAOc,MAAM;gBAAUH;YAAK;QACvD;IACF;IACA,MAAMK,UAAU,CAACC,GAAWC,IAC1BX,UAAU,SACNU,EAAEN,IAAI,CAACQ,aAAa,CAACD,EAAEP,IAAI,IAC3BM,EAAEjB,KAAK,CAACmB,aAAa,CAACD,EAAElB,KAAK;IACnC,OAAO;WACFQ,MAAMY,IAAI,CAACJ;WACXP,SAASW,IAAI,CAACJ;WACdN,MAAMU,IAAI,CAACJ;KACf,CAACK,GAAG,CAAC,CAAC,EAAEzB,KAAK,EAAEI,KAAK,EAAEc,IAAI,EAAE,GAAM,CAAA;YAAElB;YAAOI;YAAOc;QAAK,CAAA;AAC1D;AAEA;;;;CAIC,GACD,OAAO,MAAMQ,0BAA0B,yBAAwB;AAE/D,iEAAiE,GACjE,OAAO,MAAMC,6BACX,sEACA,6EACA,6DAA4D;AAE9D;;;;CAIC,GACD,OAAO,MAAMC,wBAAwB;IACnCC,SAAS;IACTC,cAAc;IACdC,eAAe;IACfC,cAAc;AAChB,EAAC;AAED;;;;;;;;;;CAUC,GACD,OAAO,SAASC,sBACdC,MAAe,EACfC,WAAoB;IAEpB,IAAI,CAACD,QAAQ,OAAO,CAAC;IACrB,OAAO;QACL,CAACR,wBAAwB,EAAE;OACvBS,cAAc;QAAEC,OAAOT;IAA2B,IAAI;AAE9D;AAEA;;;;;;;CAOC,GACD,SACEU,4BAA4B,EAC5BC,uBAAuB,EACvB3D,qBAAqB,EACrB4D,sBAAsB,EACtB3D,iBAAiB,EACjB4D,wBAAwB,EACxB3D,yBAAyB,EACzB4D,oBAAoB,EACpBC,mBAAmB,EACnBC,qBAAqB,EACrB7D,cAAc,EACd8D,oBAAoB,EACpB7D,wBAAwB,EACxBC,mBAAmB,EACnBC,kBAAkB,EAClB4D,oBAAoB,EACpB3D,iBAAiB,EACjBC,qBAAqB,EACrBC,cAAc,QAET,yBAAqB;AAU5B;;;;;;;;;CASC,GACD,OAAO,SAAS0D,cACdvD,QAAmC,EACnCc,IAA+B;IAE/B,MAAMF,SAASf,eAAeG,UAAUc;IACxC,MAAM0C,WAAWC,cAAc7C,OAAOZ,QAAQ;IAC9C,MAAM,EAAE0D,aAAa,EAAE,GAAG1E,WAAWG;IACrC,MAAMwE,eACJ/C,OAAOE,IAAI,IAAIzB,kBAAkBuE,IAAI,CAAChD,OAAOE,IAAI,IAAIF,OAAOE,IAAI,GAAGb;IACrE,MAAM4D,YAAYjD,OAAOZ,QAAQ,GAAGwD,SAAS1C,IAAI,GAAG6C;IACpD;;;;;;;;;GASC,GACD,MAAMG,aACJ,CAAClD,OAAOZ,QAAQ,IAAI,CAACwD,SAASO,kBAAkB,GAC5C7E,0BAA0ByE,cAAcD,iBACxCzD;IACN,OAAO,aACFuD;QACH1C,IAAI,EAAEgD,qBAAAA,aAAcD;QACpBF;QACAK,YAAYC,QACV,CAACH,cACC,CAAClD,OAAOZ,QAAQ,IAChB2D,gBACAvE,sBAAsBwE,IAAI,CAACD;;AAGnC;AAEA;;;;;;CAMC,GACD,OAAO,SAASF,cACdzD,QAAmC;IAEnC,MAAM,EAAED,OAAO,EAAEgE,kBAAkB,EAAEnB,WAAW,EAAE,GAAG5D,WAAWG;IAChE,MAAM2B,OAAO7B,QAAQ;QACnB,IAAI,CAACe,UAAU,OAAOC;QACtB,MAAMuD,WAAW7D,kBAAkBI,SAASC;QAC5C,IAAIwD,aAAavD,WAAW;YAC1B,IAAIiE,QAAQC,GAAG,CAACC,QAAQ,KAAK,cAAc;gBACzCC,QAAQC,IAAI,CACV,CAAC,qBAAqB,EAAEtE,SAAS,6BAA6B,CAAC,GAC7D;YAEN;YACA,OAAOC;QACT;QACA,OAAOuD;IACT,GAAG;QAACxD;QAAUD;KAAQ;IACtB,OAAO;QACLe;QACAiD,oBAAoBE,QAAQF;QAC5BnB,aAAaqB,QAAQrB;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,kBAAkB;QAClBD,QAAQ7C,mBAAmBC,SAASC;IACtC;AACF"}

package/src/lib/app-utils/screen-route.d.ts

@@ -71,6 +71,9 @@ export declare function normalizeScreenSlug(input: string | null | undefined): s
  *    catch-all is required, not optional — and it is reserved anyway for the
  *    reason given below about child paths: a child only exists when its
  *    parent is published, and this rule refuses the parent.
+ *  - `_aglyn` — the platform's own pages on every site, the leaving notice
+ *    at `/_aglyn/leaving` first (AGL-3452). The middleware rewrites that path
+ *    to an api route before the catch-all could see it.
  *
  * NOT reserved, and deliberately so, because measuring found them fine:
  * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the

package/src/lib/app-utils/screen-route.js

@@ -17,6 +17,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  */ import { HOST_ERROR_SCREEN_SLOTS } from "../foundation/index.js";
 import { collectionListUrl } from "./collection-entries.js";
 import { ENTRY_PREVIEW_ROUTE_SEGMENT } from "./entry-preview-link.js";
+import { LEAVING_NOTICE_ROUTE_SEGMENT } from "./leaving-notice.js";
 import { PLATFORM_BRAND_NAME } from "./platform-brand.js";
 import { formatCollectionLinkValue, formatEntryLinkValue, formatFeedLinkValue, parseEntryLinkValue } from "./screen-link-value.js";
 /**
@@ -79,6 +80,9 @@ import { formatCollectionLinkValue, formatEntryLinkValue, formatFeedLinkValue, p
  *    catch-all is required, not optional — and it is reserved anyway for the
  *    reason given below about child paths: a child only exists when its
  *    parent is published, and this rule refuses the parent.
+ *  - `_aglyn` — the platform's own pages on every site, the leaving notice
+ *    at `/_aglyn/leaving` first (AGL-3452). The middleware rewrites that path
+ *    to an api route before the catch-all could see it.
  *
  * NOT reserved, and deliberately so, because measuring found them fine:
  * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the
@@ -96,7 +100,8 @@ import { formatCollectionLinkValue, formatEntryLinkValue, formatFeedLinkValue, p
     ENTRY_PREVIEW_ROUTE_SEGMENT,
     'api',
     '_next',
-    '_static'
+    '_static',
+    LEAVING_NOTICE_ROUTE_SEGMENT
 ];
 /**
  * The reserved segment a routing-map path would collide with, or `undefined`

package/src/lib/app-utils/screen-route.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { HOST_ERROR_SCREEN_SLOTS, type ScreenUid } from '../foundation'\nimport { collectionListUrl } from './collection-entries'\nimport { ENTRY_PREVIEW_ROUTE_SEGMENT } from './entry-preview-link'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\nimport {\n  formatCollectionLinkValue,\n  formatEntryLinkValue,\n  formatFeedLinkValue,\n  parseEntryLinkValue,\n} from './screen-link-value'\n\n/**\n * Route path of a host's root screen. The tenant matcher joins the catch-all\n * segments and collapses an empty one to this value (`load-page-data.ts`:\n * `slugSegments.length ? slugSegments.join('/') : SCREEN_ROOT_PATH`), so the\n * root is `'/'` and every other path is slash-joined segments WITHOUT a\n * leading slash (`about`, later `company/about`).\n */\nexport const SCREEN_ROOT_PATH = '/'\n\n/**\n * Normalizes user slug input into the routing-map path format described on\n * {@link SCREEN_ROOT_PATH}. `'/'` normalizes to the root path; anything else\n * becomes a single lowercase url-safe segment.\n *\n * Returns `undefined` for EMPTY input and for anything that sanitizes away\n * (`'###'`) — the two cases are deliberately the same answer, and the caller\n * decides what it means. In the Screens page's slug field an empty string\n * means \"no address typed\"; in a starter template it meant \"home\". Two\n * meanings for one value is what made AGL-1575 possible, so this function\n * refuses to pick one: a caller that wants the root must say `'/'`.\n *\n * This docstring used to claim empty input normalized to the root, which the\n * code has never done (see the spec, which asserts the `undefined`). A fix\n * written against the docstring instead of the behaviour would have shipped\n * broken; if you are here to make the code match the comment, do not.\n */\nexport function normalizeScreenSlug(\n  input: string | null | undefined,\n): string | undefined {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed) return undefined\n  if (trimmed === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH\n\n  const segment = trimmed\n    .toLowerCase()\n    .replace(/^\\/+|\\/+$/g, '')\n    .replace(/\\s+/g, '-')\n    .replace(/[^a-z0-9-_]/g, '')\n    .replace(/-{2,}/g, '-')\n    .replace(/^-+|-+$/g, '')\n\n  return segment || undefined\n}\n\n/**\n * Route segments the published site CANNOT serve, whatever the routing map\n * says (AGL-2076).\n *\n * Every entry was measured against production on 2026-08-19 with a fresh\n * `x-vercel-cache: MISS`, because a stale negative always passes. Two\n * mechanisms, both of which resolve ahead of `[host]/[scheme]/[[...slug]]`:\n *\n *  - `404`, `500` — Next emits `pages/404.html` and `pages/500.html` even for\n *    an app-router-only build, and the deployed filesystem answers them as\n *    static files (`content-disposition: inline; filename=\"404\"`,\n *    `accept-ranges`, an `etag`, and no `x-nextjs-prerender`). The tenant\n *    middleware's own CSP headers are on those responses, so the middleware\n *    ran and its rewrite still lost. There is no rewrite this app can write\n *    that beats them, which is why the honest fix is to refuse the slug at\n *    authoring time rather than to keep promising an address that is dead.\n *  - `search`, `api`, `_next`, `_static` — routes and exclusions the tenant\n *    app owns. `/search` matches `app/[host]/[scheme]/search`; the other three are the\n *    middleware matcher's exclusions, so no host rewrite happens at all and\n *    the path is parsed as `[host]` with an empty slug.\n *  - `aglyn-preview` — the same mechanism as `search`, one route over\n *    (AGL-3205). The live-site preview of an unpublished collection entry is\n *    a rewrite to `app/[host]/[scheme]/aglyn-preview/[...slug]`, because it\n *    must be a DIFFERENT Next route from the ISR-cached catch-all; a static\n *    folder wins over the optional catch-all beside it, so `/aglyn-preview/x`\n *    would reach the preview page and 404 rather than render a screen. The\n *    bare `/aglyn-preview` would in fact still serve — the preview route's\n *    catch-all is required, not optional — and it is reserved anyway for the\n *    reason given below about child paths: a child only exists when its\n *    parent is published, and this rule refuses the parent.\n *\n * NOT reserved, and deliberately so, because measuring found them fine:\n * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the\n * four designed error screens have always been viewable at their slugs, which\n * is what made the `404` case look like a Next.js defect), and `index`.\n *\n * `fonts` and `examples` USED to be dead for the third reason and are not\n * here: they were exclusions inherited from the Vercel platforms starter kit\n * for directories `apps/tenant/public` has never contained. They are given\n * back rather than reserved — see the matcher in `apps/tenant/middleware.ts`.\n */\nexport const RESERVED_SCREEN_ROUTE_SEGMENTS: readonly string[] = [\n  '404',\n  '500',\n  'search',\n  ENTRY_PREVIEW_ROUTE_SEGMENT,\n  'api',\n  '_next',\n  '_static',\n]\n\n/**\n * The reserved segment a routing-map path would collide with, or `undefined`\n * when the path is servable. The segment rather than a boolean, so a refusal\n * can name what it is refusing over.\n *\n * Reads the FIRST segment only. For `api`/`_next`/`_static` that is exactly\n * right — the middleware excludes the whole subtree, so `api/docs` is as dead\n * as `api`. For `404`/`500`/`search` it over-refuses in principle (`/404/why`\n * would serve), and that is deliberate: a child path only exists when its\n * PARENT screen is published, the parent would sit at `404`, and this same\n * rule refuses that. A second list to express a case that cannot arise would\n * be a second list to keep correct.\n *\n * Takes a composed routing-map path (`about`, `company/about`, `'/'`), not a\n * raw slug field — `'/'` is the home screen and is never reserved.\n */\nexport function reservedScreenRouteSegment(\n  path: string | null | undefined,\n): string | undefined {\n  if (!path || path === SCREEN_ROOT_PATH) return undefined\n  const [first] = path.replace(/^\\/+/, '').split('/')\n  return RESERVED_SCREEN_ROUTE_SEGMENTS.includes(first) ? first : undefined\n}\n\n/**\n * The refusal an author reads when {@link reservedScreenRouteSegment} names a\n * segment. One sentence, in one place, because the Screens page, the version\n * view and the besigner all have to say the same thing — three surfaces\n * wording a platform constraint three ways is how AGL-2093's precheck drifted.\n */\nexport function reservedScreenRouteMessage(segment: string): string {\n  return `\"/${segment}\" is a reserved address on every ${PLATFORM_BRAND_NAME} site — pick another slug`\n}\n\n/**\n * Does a raw slug value carry a path separator the one segment it describes\n * cannot hold (AGL-2572)?\n *\n * {@link normalizeScreenSlug} answers with a SINGLE segment, and it gets there\n * by deleting every character outside `[a-z0-9-_]` — an interior `/` included.\n * Whitespace becomes a `-`, but a `/` becomes nothing at all, so\n * `alternatives/webflow` normalizes to `alternativeswebflow` and the two words\n * are stored glued. Nothing about that is visible: the field accepts the\n * keystroke, the composed path reads plausibly, and the screen ends up\n * answering an address nobody typed. Two screens on `aglyn-marketing` carry a\n * slug of that shape.\n *\n * So the separator is a question a slug field asks BEFORE normalizing, and the\n * answer is a refusal rather than a silent repair — the caller cannot know\n * which segment the author meant, and guessing is how the glue happened.\n *\n * LEADING and TRAILING slashes are not separators here. `normalizeScreenSlug`\n * strips them deliberately (`/about/` → `about`), an author typing an address\n * writes them without meaning a hierarchy, and refusing them would reject a\n * value the normalizer has always handled correctly. `'/'` alone is the home\n * page and is never a separator.\n */\nexport function screenSlugHasPathSeparator(\n  input: string | null | undefined,\n): boolean {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed || trimmed === SCREEN_ROOT_PATH) return false\n  return trimmed.replace(/^\\/+|\\/+$/g, '').includes('/')\n}\n\n/**\n * The refusal an author reads when {@link screenSlugHasPathSeparator} answers\n * true. One sentence, in one place, for the same reason\n * {@link reservedScreenRouteMessage} is: the Screens page, the version view\n * and the besigner all take a slug, and a constraint worded three ways drifts\n * into three different constraints.\n *\n * It names the alternative, because a `/` in this field almost always means\n * \"nest me\" and the hierarchy is what actually composes the longer path.\n */\nexport const SCREEN_SLUG_PATH_SEPARATOR_MESSAGE =\n  'A slug is one path segment — remove the \"/\" and nest the page under a ' +\n  'parent page instead'\n\n/** Minimal screen shape the hierarchy helpers need. */\nexport interface ScreenRouteNode {\n  slug?: string\n  parentId?: ScreenUid\n}\n\n/** Defensive cap: parent chains deeper than this are treated as invalid. */\nconst MAX_SCREEN_DEPTH = 32\n\n/**\n * Composes a screen's routing-map path from its own slug plus its ancestor\n * chain: parent `company` + own `about` → `company/about`. Root (`'/'`)\n * segments contribute nothing, so children of the home screen sit at the\n * top level. Returns `undefined` when the screen (or any ancestor) has no\n * slug, when the screen's own slug is `'/'` while it has a parent, or when\n * the chain has a cycle / exceeds {@link MAX_SCREEN_DEPTH}.\n */\nexport function composeScreenRoutePath(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): string | undefined {\n  const segments: string[] = []\n  const visited = new Set<ScreenUid>()\n  let currentId: ScreenUid | undefined = screenId\n\n  while (currentId) {\n    if (visited.has(currentId) || visited.size >= MAX_SCREEN_DEPTH) {\n      return undefined\n    }\n    visited.add(currentId)\n    const screen = screensById[currentId]\n    if (!screen?.slug) return undefined\n    if (screen.slug === SCREEN_ROOT_PATH) {\n      // The home screen's segment is empty (children of home sit at the top\n      // level), but a screen can't itself be the home page AND have a parent.\n      if (currentId === screenId && screen.parentId) return undefined\n    } else {\n      segments.unshift(screen.slug)\n    }\n    currentId = screen.parentId\n  }\n\n  if (!segments.length) {\n    return screensById[screenId]?.slug === SCREEN_ROOT_PATH\n      ? SCREEN_ROOT_PATH\n      : undefined\n  }\n  return segments.join('/')\n}\n\n/**\n * All screens whose parent chain passes through `screenId` (children,\n * grandchildren, …). Used to cascade routing-map rewrites when a screen's\n * slug or parent changes.\n */\nexport function collectScreenDescendantIds(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): ScreenUid[] {\n  const childrenByParent = new Map<ScreenUid, ScreenUid[]>()\n  for (const [id, screen] of Object.entries(screensById)) {\n    if (!screen?.parentId) continue\n    const siblings = childrenByParent.get(screen.parentId) ?? []\n    siblings.push(id)\n    childrenByParent.set(screen.parentId, siblings)\n  }\n  const result: ScreenUid[] = []\n  const queue = [...(childrenByParent.get(screenId) ?? [])]\n  while (queue.length) {\n    const id = queue.shift() as ScreenUid\n    if (result.includes(id)) continue\n    result.push(id)\n    queue.push(...(childrenByParent.get(id) ?? []))\n  }\n  return result\n}\n\n/**\n * True when making `nextParentId` the parent of `screenId` would create a\n * loop — i.e. the candidate parent is the screen itself or one of its own\n * descendants.\n */\nexport function wouldCreateScreenCycle(\n  screenId: ScreenUid,\n  nextParentId: ScreenUid | undefined,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): boolean {\n  if (!nextParentId) return false\n  if (nextParentId === screenId) return true\n  return collectScreenDescendantIds(screenId, screensById).includes(\n    nextParentId,\n  )\n}\n\n/** How {@link buildScreenRouteEntries} treats a screen with no entry today. */\nexport interface BuildScreenRouteEntriesOptions {\n  /**\n   * Is this call a PUBLISH, or only a move? (AGL-2571)\n   *\n   * An entry in the host's `screens` map is the whole of what makes a path\n   * reachable, so writing one IS publishing — there is no second switch. This\n   * function is used for both, and until now it could not tell them apart: it\n   * wrote a path for every screen in the subtree whose slug chain happened to\n   * resolve, whether or not anyone had asked for that screen to go live.\n   *\n   * What that produced on `aglyn-marketing`: assigning a parent to an\n   * unpublished screen that merely CARRIED a slug registered it in the map,\n   * and the besigner toolbar — which reads the map — then offered `Unpublish`\n   * and an enabled `Live` link for a screen nobody had published, with no\n   * `publishedAt` on the document and a 404 at the address.\n   *\n   * `false` therefore restricts the write to entries that ALREADY exist:\n   * paths are rewritten, broken ones are removed, and nothing new goes live.\n   * A move is not an activation.\n   *\n   * Defaults to `true`, which is what the publish buttons mean.\n   */\n  publish?: boolean\n}\n\n/**\n * Routing-map entries for a screen plus all its descendants under a\n * candidate screens map: a composed path sets the entry, `null` marks an\n * existing entry whose chain no longer resolves for removal. Callers apply\n * the result in one write so slug/parent changes cascade atomically.\n *\n * See {@link BuildScreenRouteEntriesOptions.publish} for the difference\n * between publishing a screen and merely moving one.\n */\nexport function buildScreenRouteEntries(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n  routingMap: Record<ScreenUid, string> | null | undefined,\n  options: BuildScreenRouteEntriesOptions = {},\n): Record<ScreenUid, string | null> {\n  const { publish = true } = options\n  const entries: Record<ScreenUid, string | null> = {}\n  const ids = [screenId, ...collectScreenDescendantIds(screenId, screensById)]\n  for (const id of ids) {\n    const routed = routingMap?.[id] !== undefined\n    const path = composeScreenRoutePath(id, screensById)\n    if (path) {\n      // A move rewrites what is live; it never puts something new there.\n      if (routed || publish) entries[id] = path\n    } else if (routed) entries[id] = null\n  }\n  return entries\n}\n\n/**\n * Looks up which screen currently owns a routing path, for sibling-slug\n * uniqueness checks before publishing.\n */\nexport function findScreenIdByRoutePath(\n  screens: Record<ScreenUid, string> | null | undefined,\n  path: string,\n): ScreenUid | undefined {\n  if (!screens) return undefined\n  const entry = Object.entries(screens).find(([, value]) => value === path)\n  return entry?.[0]\n}\n\n/**\n * The screen a publish at `path` would collide with, or `undefined` when the\n * address is free to take (AGL-3408).\n *\n * {@link findScreenIdByRoutePath} with one exception: the placeholder home\n * page a site is created with (`host.defaultHomeScreenId`) does not block the\n * site root. It holds `/` only so a new site never answers its own address\n * with a 404, and the first real page published there replaces it — the\n * publish seam removes its entry in the same write. It still blocks any other\n * path it has been moved to, and no other screen is ever passed over.\n *\n * Every publish surface's conflict check reads this rather than the raw owner,\n * so \"is this address taken?\" has one answer across them.\n */\nexport function blockingRouteOwner(\n  screens: Record<ScreenUid, string> | null | undefined,\n  path: string,\n  defaultHomeScreenId?: string | null,\n): ScreenUid | undefined {\n  const owner = findScreenIdByRoutePath(screens, path)\n  if (owner && path === SCREEN_ROOT_PATH && owner === defaultHomeScreenId) {\n    return undefined\n  }\n  return owner\n}\n\n/** Human-facing URL for a routing-map path (`'/'` stays `/`, `about` → `/about`). */\nexport function screenRoutePathToUrl(path: string): string {\n  return path === SCREEN_ROOT_PATH ? SCREEN_ROOT_PATH : `/${path}`\n}\n\n/**\n * A screen's OWN slug segment, read back off its composed routing-map path\n * (`company/about` → `about`) — the inverse of the one step\n * {@link composeScreenRoutePath} adds for this screen (AGL-2572).\n *\n * The slug field holds one segment; the routing map holds the whole composed\n * path. A field that seeds itself from the map therefore has to take the last\n * segment, and the besigner's seeded the whole path instead. Its value then\n * went through {@link normalizeScreenSlug}, which DELETES an interior `/`\n * rather than separating on it, so `alternatives/webflow` came back as the\n * glued `alternativeswebflow` and was stored as the screen's own slug —\n * without anyone typing it. Two screens on `aglyn-marketing` carry a slug of\n * that shape.\n *\n * Not a general path parser: it answers only \"which segment is this screen's\n * own\", which is always the last one.\n */\nexport function ownScreenSlugFromRoutePath(\n  path: string | null | undefined,\n): string | undefined {\n  if (!path) return undefined\n  if (path === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH\n  const segments = path.split('/').filter(Boolean)\n  return segments[segments.length - 1]\n}\n\n/** What a screen is ACTUALLY served at, where that is not its own slug. */\nexport interface LinkableScreenRouteSources {\n  /**\n   * screen id → the routing-map path the screen really answers on, for\n   * screens routed by something other than their own slug. Today that is a\n   * content collection's LIST template: `/{collectionSlug}` renders it\n   * (`composeCollectionTemplatePage`), whatever slug it was published under.\n   * Applied LAST, so it also un-drops a screen named in `unrouted`.\n   */\n  routedElsewhere?: Record<string, string> | null | undefined\n  /**\n   * Screen ids that serve NO address of their own — a collection ENTRY\n   * template (AGL-1267), commerce's PDP/catalog templates (AGL-1270), a\n   * screen that says `kind: 'template'` (AGL-1400). The tenant router drops\n   * these before matching, so their routing-map path is a 404.\n   */\n  unrouted?: Iterable<string> | null | undefined\n  /**\n   * collection id → collection slug, for every CONTENT collection with a slug\n   * (AGL-2799): the collections whose listing `/{collectionSlug}` serves. Each\n   * becomes a link target of its own, keyed by `formatCollectionLinkValue`,\n   * so a link can name a blog's listing whether or not a list template screen\n   * renders it.\n   */\n  collectionListings?: Record<string, string> | null | undefined\n  /**\n   * entry key (`entry:<collectionId>/<entryId>`) → the entry's path, for the\n   * entries a page references (AGL-3118). Unlike every other source, this one\n   * is not the whole site: a renderer reads only the entries its own links\n   * name, so an entry key missing here means \"not asked for\", and\n   * `screenRoutesAnswerFor` judges entry links only against a map that has\n   * some.\n   */\n  entryRoutes?: Record<string, string> | null | undefined\n}\n\n/**\n * Where a collection's RSS feed is served, in the routing map's own format\n * (no leading slash): `blog/rss.xml` for the collection at `/blog`.\n */\nexport function collectionFeedRoutePath(collectionSlug: string): string {\n  const listing = collectionListUrl({ collectionSlug }).replace(/^\\/+|\\/+$/g, '')\n  return `${listing}/rss.xml`\n}\n\n/**\n * Where a collection ENTRY is served, in the routing map's own format (no\n * leading slash): `blog/hello` for the entry slugged `hello` in the\n * collection at `/blog` — the `/{collection}/{entry}` shape\n * `parseCollectionRoute` reads back.\n */\nexport function collectionEntryRoutePath(\n  collectionSlug: string,\n  entrySlug: string,\n): string {\n  const listing = collectionListUrl({ collectionSlug }).replace(/^\\/+|\\/+$/g, '')\n  return `${listing}/${entrySlug.trim().replace(/^\\/+|\\/+$/g, '')}`\n}\n\n/**\n * The routing map as a LINK TARGET table (AGL-1998).\n *\n * The host's `screens` map is written by publishing, one entry per screen\n * under its own composed slug, and the tenant router then edits it at serve\n * time: template screens are dropped (see {@link LinkableScreenRouteSources})\n * and a collection's list template is reached at `/{collectionSlug}` instead.\n * Everything that RESOLVES a screen link — `resolveScreenHref` on the live\n * site, the besigner's screen picker, every `Link`-typed component prop — was\n * reading the raw map, so the two surfaces disagreed with the router in both\n * directions at once:\n *\n *  - `/blog` was UNOFFERABLE. The blog's list template is published under\n *    `blog-list-template` and serves `/blog`, so no screen link on aglyn.com\n *    could point at the site's own blog index.\n *  - Every template screen was offered at a path that 404s, and an author who\n *    picked one got a dead anchor that looks exactly like a live one.\n *\n * So the map every linking surface reads is derived here, from the same two\n * facts the router uses, and the picker can no longer offer a path the router\n * would refuse.\n *\n * A content collection's LISTING is a target in its own right (AGL-2799),\n * keyed `collection:<collectionId>` beside the screen ids. Its path comes from\n * `collectionListUrl`, the builder the pager, the canonical link and the\n * sitemap already share, so a link cannot give a listing an address the rest\n * of the site does not; and because the key is the collection's id rather than\n * its slug, renaming the slug moves every link to it on the next render. A\n * collection that is gone, or that has lost its slug, has no entry — the same\n * absence `isScreenLinkBroken` reads as a dead target.\n *\n * A raw map with no source given comes back unchanged; an absent map with no\n * overrides and no listings stays absent, because `undefined` means \"nothing\n * resolves yet\" to {@link ScreenLinkContext} and `{}` would mean \"resolved:\n * nowhere\".\n */\nexport function linkableScreenRoutes(\n  screens: Record<ScreenUid, string> | null | undefined,\n  sources: LinkableScreenRouteSources = {},\n): Record<ScreenUid, string> | undefined {\n  const { routedElsewhere, unrouted, collectionListings, entryRoutes } = sources\n  const overrides = Object.entries(routedElsewhere ?? {})\n  const listings = Object.entries(collectionListings ?? {})\n  const entries = Object.entries(entryRoutes ?? {})\n  if (!screens && !overrides.length && !listings.length && !entries.length) {\n    return undefined\n  }\n  const next: Record<ScreenUid, string> = { ...(screens ?? {}) }\n  for (const id of unrouted ?? []) delete next[id]\n  for (const [collectionId, collectionSlug] of listings) {\n    const slug =\n      typeof collectionSlug === 'string'\n        ? collectionSlug.trim().replace(/^\\/+|\\/+$/g, '')\n        : ''\n    if (!collectionId.trim() || !slug) continue\n    // Built by the one listing-URL builder, then stored in the map's own\n    // format: no leading slash, which `resolveScreenHref` puts back.\n    next[formatCollectionLinkValue(collectionId)] = collectionListUrl({\n      collectionSlug: slug,\n    }).replace(/^\\/+/, '')\n    // The feed hangs off the same listing (AGL-3118), so it follows the same\n    // rename and disappears with the same collection.\n    next[formatFeedLinkValue(collectionId)] = collectionFeedRoutePath(slug)\n  }\n  for (const [key, path] of entries) {\n    // Only well-formed entry keys, stored under their canonical spelling: this\n    // source must not be able to plant a screen id or a listing key the other\n    // sources own.\n    const entry = parseEntryLinkValue(key)\n    if (!entry) continue\n    const normalized =\n      typeof path === 'string' ? path.trim().replace(/^\\/+|\\/+$/g, '') : ''\n    if (!normalized) continue\n    next[formatEntryLinkValue(entry.collectionId, entry.entryId)] = normalized\n  }\n  for (const [id, path] of overrides) {\n    // A collection slug (`blog`) arrives in the map's own format already, but\n    // the same fact is spelled `/blog` in half the places it is read from, and\n    // a stored `/blog` would resolve to `//blog` — an absolute URL to the host\n    // `blog`, i.e. off the site entirely.\n    const normalized =\n      typeof path === 'string' && path !== SCREEN_ROOT_PATH\n        ? path.replace(/^\\/+|\\/+$/g, '')\n        : path\n    if (!normalized) continue\n    next[id] = normalized\n  }\n  return next\n}\n\n/**\n * `kind` of a besigner email document (AGL-395): a screen authored on the\n * Emails page and sent by a campaign, never served at a URL.\n */\nexport const SCREEN_KIND_EMAIL = 'email'\n\n/**\n * `kind` of a collection ENTRY template (AGL-1400): a screen that composes\n * `/{collection}/{entry}` for every entry and has no address of its own.\n *\n * The value exists so that \"is this screen a page?\" stops being a JOIN.\n * Four issues (AGL-1173, AGL-1383, AGL-1387, AGL-1390) were the same sentence\n * at different depths because the answer was derived from a mutable field on a\n * DIFFERENT document — a collection's `entryScreenId` — and every new way to\n * edit that pointer was a new bypass of `screensPerHost`. Here the fact is a\n * property of the screen, server-stamped by /api/hosts/screens and frozen in\n * the rules exactly as `kind: 'email'` has been since AGL-1383.\n *\n * NOT a collection's LIST template. `/{collectionSlug}` renders that exact\n * screen with its entries, so it is a designed reachable page and AGL-1387\n * made it count; converting one would take the page off the site.\n */\nexport const SCREEN_KIND_TEMPLATE = 'template'\n\n/**\n * `kind` of a designed ERROR screen (AGL-2092): the screen a host assigns to\n * one of `errorScreens`' four status slots, rendered on paths that did not\n * match — and so, like an entry template, at no address of its own.\n *\n * the decision on 2026-08-18 was that these must not spend the plan's screen\n * allowance, for the reason AGL-1173 excluded an entry template: the governing\n * question is whether the screen occupies a URL of its own, and a 404 body does\n * not. (A collection's LIST template does — `/{collectionSlug}` renders that\n * exact screen — which is why AGL-1387 left it counting.)\n *\n * ## This value does NOT get `kind: 'template'`'s trust\n *\n * `billableScreenIds` short-circuits on `SCREEN_KIND_TEMPLATE` BEFORE it\n * consults the routing map, because a template is routed on purpose. An error\n * screen is not, so it deliberately falls through to the ordinary rule and\n * **the routing map outranks this field**: a screen still published at an\n * address of its own counts, whatever it says about itself. That is the whole\n * migration story for the error screens that already exist — see\n * {@link ERROR_SCREEN_MAX_PER_HOST}.\n *\n * Stamped only by /api/hosts/screens, as part of binding the screen to a slot,\n * and frozen against the client by the same rule that has frozen `kind` since\n * AGL-1383. Nothing about that is new for this value; what IS new is that the\n * stamp is BOUNDED, because unlike a template there is no natural limit on how\n * many screens somebody would like to declare as error pages.\n */\nexport const SCREEN_KIND_ERROR = 'error'\n\n/**\n * How many screens one host may hold with `kind: 'error'` (AGL-2092).\n *\n * An exclusion the metered party can ask for is a free-screen generator unless\n * something bounds it, and the four bindings in `HostErrorScreens` are the\n * bound: at most one exempt screen per error slot. It is `.length` of the slot\n * list rather than a literal `4` so the two can never disagree.\n *\n * Checked in TWO places, and the second is the one that makes the number true\n * (AGL-2093). At the moment of the STAMP, against the post-state — the\n * AGL-1390 shape, which produces the refusal worth reading because it can name\n * the four slots. And inside `billableScreenIds` itself, where a live error\n * screen past this bound is counted as an ordinary page: the stamp is not the\n * only writer, and a crafted import bundle carrying `kind: 'error'` on all 200\n * of its screens passed no bound at all until the rule owned one. An exclusion\n * enforced only at the write paths somebody remembered is the sentence this arc\n * has now repeated six times.\n *\n * The tempting alternative is to enforce \"bound to a slot\" as an\n * invariant, promoting a screen back to a page whenever its slot is cleared;\n * that is AGL-1390's refuse-the-clear bug wearing a different hat, because\n * promotion raises the count and a host at its cap could then never unassign an\n * error screen. So clearing a slot is always allowed and leaves the screen an\n * error screen — unbilled, unrouted, and one deliberate click from being a page\n * again — and what is bounded is how many of them can exist at once.\n */\nexport const ERROR_SCREEN_MAX_PER_HOST = HOST_ERROR_SCREEN_SLOTS.length\n\n/** The two self-describing fields {@link screenClaimsToBeAPage} reads. */\nexport interface ScreenPageClaim {\n  kind?: string\n  deletedAt?: unknown\n}\n\n/**\n * Whether a screen document claims to be a page of the site at all (AGL-1383).\n *\n * Four things say it is not: `deletedAt` (soft-deleted — delete stamps the\n * field rather than removing the doc), `kind: 'email'` (an Emails-page\n * document, which has no URL and is rendered only by the campaign sender,\n * straight off the doc), `kind: 'template'` (a collection entry template,\n * which composes `/{collection}/{entry}` and has no address of its own —\n * AGL-1400) and `kind: 'error'` (a screen assigned to one of the host's four\n * error slots, rendered on paths that matched nothing — AGL-2092). All four\n * are also the exclusions `countBillableScreens` subtracts before enforcing\n * `screensPerHost`, and since AGL-1400 they are the WHOLE of that subtraction:\n * the count reads no other collection.\n *\n * Adding the fourth needed no edit to `billableScreenIds` and no edit to\n * `nonPageScreenIds`, which is the property AGL-1439 wrote them for: the\n * routing-map override applies to a new non-page `kind` by default, and the\n * flat infrastructure cap is the complement, so there is no second list to\n * remember. Only `kind: 'template'` is named anywhere else, because only it\n * opts OUT of the routing-map override.\n *\n * That is exactly why this is ONE function with TWO callers rather than two\n * matching filters. Both fields are ordinary client-writable fields on\n * `hosts/{hostId}/screens/{screenId}`, and until AGL-1383 only the count read\n * them: an editor on a Free site could `updateDoc(screenRef, {kind: 'email'})`\n * and the screen stopped counting against the plan while the routing map still\n * pointed at it and the runtime still served it — a live page, for free. An\n * exclusion is only sound if an excluded screen genuinely is not a page, so the\n * serve path asks this question too, and flipping either field now costs the\n * page instead of the plan.\n *\n * A CLAIM, not the answer, for the two fields a client can still reach: the\n * routing map decides reachability, and `countBillableScreens` trusts\n * `deletedAt` / `kind: 'email'` only for screens the map does not route.\n * `kind: 'error'` is in the client-can-still-reach group for counting purposes\n * even though no client writes it either: an error screen that is ALSO\n * published at an address is a page somebody is using as a page, so the map\n * outranks the stamp and it counts. Serving is the other way round — see\n * `getScreen`, which returns error screens rather than 404ing them, because\n * refusing would break the customer's own designed error page without closing\n * anything (they are already paying for it if it is routed).\n *\n * `kind: 'template'` is the exception, and the reason it can be one is that no\n * client writes it — /api/hosts/screens stamps it, demotion lowers the count\n * and promotion is checked exactly like a create, so there is no toggle to\n * launder. A template is ROUTED on purpose (publishing is how the compose\n * pipeline picks it up), which is why the map cannot be the arbiter for it.\n */\nexport function screenClaimsToBeAPage(\n  screen: ScreenPageClaim | null | undefined,\n): boolean {\n  if (!screen) return false\n  return (\n    screen.deletedAt == null &&\n    screen.kind !== SCREEN_KIND_EMAIL &&\n    screen.kind !== SCREEN_KIND_TEMPLATE &&\n    screen.kind !== SCREEN_KIND_ERROR\n  )\n}\n\n/**\n * One screen, reduced to the two things {@link billableScreenIds} asks about.\n *\n * Rows rather than a query (AGL-1390) because the enforcement points ask about\n * a state that does not exist yet: a promotion is checked against the count it\n * WOULD leave behind. A function that does its own reads can only answer for\n * the present. `readScreenSources` in /api/hosts/resources is the reader.\n */\nexport interface BillableScreenSource {\n  id: string\n  kind?: unknown\n  deletedAt?: unknown\n}\n\n/**\n * A host's `screens` routing map (screen id → route path) as\n * `publishScreenRoute` writes it. Only membership is read, never the path.\n */\nexport type ScreenRoutingMap = Record<string, unknown> | null | undefined\n\n/**\n * WHICH screens spend the plan's screen allowance (AGL-1173).\n *\n * The ids rather than the count, because an enforcement point that cannot name\n * the screen it is refusing over is a refusal the person reading it cannot act\n * on.\n *\n * A plain `screens.count()` charged for three things the subscriber never\n * chose to author, and the screens list — which filters them out — then\n * disagreed with the server about how much of the plan was used:\n *\n *  - **Soft-deleted screens.** Delete stamps `deletedAt` rather than\n *    removing the doc, so deleting a screen never freed a slot. On the free\n *    plan (5 screens) that was a dead end with no way out from the UI.\n *  - **Email screens** (`kind: 'email'`), which live on the Emails page and\n *    were already excluded from the list count but not from enforcement.\n *  - **A collection's ENTRY template** — one screen serving every entry at no\n *    URL of its own. Adding a blog cost two of the free plan's five screens\n *    before the first page existed.\n *\n * ## Why it lives HERE, next to the predicate (AGL-2093)\n *\n * It was in /api/hosts/resources, and the console's Screens page — which runs\n * the same rule as a precheck before it lets somebody add a page — could not\n * import it from there (that module reaches `@aglyn/aglyn/server`, which pulls\n * `node:stream` in through the API adapter). So the page restated it, and the\n * restatement drifted: it never learned the error-screen bound below, and on a\n * host holding five `kind: 'error'` screens the console offered room the API\n * then refused. A precheck that warns on a different number than the API\n * enforces is worse than no precheck at all, and a rule that has to be\n * restated to be reused will be restated wrongly eventually. One function, two\n * callers.\n *\n * ## ONE document answers it now (AGL-1400)\n *\n * The third exclusion used to be a JOIN: the count read the `collections`\n * collection and subtracted whatever screen ids the template pointers named.\n * That shape produced four issues in one arc, because the other side of the\n * join is editable and each new way to edit it was a new bypass — AGL-1173\n * created the exclusion, AGL-1383 froze the two fields the screen itself\n * carried, AGL-1387 found the list template was a page after all, and AGL-1390\n * found the pointer could be toggled to mint permanent slots and had to move\n * the write server-side and evaluate the cap against the post-state.\n *\n * Since AGL-1400 an entry template says so on its own document\n * (`kind: 'template'`), stamped by /api/hosts/screens and frozen in the rules\n * exactly as `kind: 'email'` is. So this reads the `screens` collection and\n * nothing else: the pointer is a pointer again, freely writable, and it excuses\n * nothing. `screenClaimsToBeAPage` is the whole rule, which is the property\n * that keeps the count and the serve path (`getScreen`) from ever disagreeing.\n *\n * What did NOT change is what anybody pays. A collection's LIST template stays\n * a page — `/{collectionSlug}` renders that exact screen (AGL-1387) — so it is\n * never stamped and still counts, and an entry template stays excluded\n * (AGL-1173's charge is not reinstated).\n *\n * ## The routing map outranks the document, and ONLY ADDS (AGL-1383, AGL-1445)\n *\n * `deletedAt` and `kind: 'email'` are ordinary client-writable fields on the\n * screen's OWN document, and the party they are subtracted on behalf of is the\n * party being metered. `updateDoc(screenRef, {kind: 'email'})` — one write, no\n * route change — used to take a live page off a Free plan's five and leave it\n * serving, because nothing else read either field. So for those two the\n * document's account of itself is consulted only for screens the routing map\n * does not route: **a routed screen counts, whatever it says about itself**.\n *\n * The converse is NOT true and must not become true, which is AGL-1445's\n * settlement. An unrouted screen with no slug — a draft, or an orphan left\n * behind by an unpublish — serves nothing, and it still counts:\n *\n *  - `screensPerHost` is a CREATE-TIME gate. /api/hosts/resources counts and\n *    refuses; `report-usage` re-measures monthly but RECORDS rather than\n *    enforces. The create is the only door.\n *  - A screen is born unrouted, and publishing is a separate later act — a\n *    client `updateDoc` on the host's `screens` map (`publishScreenRoute`),\n *    gated on `canPublishHostContent` and on nothing else.\n *\n * So subtracting unrouted screens would not make the count fairer, it would\n * make every create free — the new document is unrouted by construction — and\n * leave the publishes that follow ungated. A Free site would hold unlimited\n * pages. AGL-1445's option 2 (server-stamping a non-page `kind` on orphans by\n * a sweep) lands in the same place unless the promotion BACK passes a gate,\n * and for an orphan the promotion is the publish. `kind: 'template'` can be\n * trusted precisely because its promotion is `convertScreenKind`, checked\n * exactly like a create; there is no equivalent door in front of the routing\n * map. The price is one slot until somebody deletes the orphan, which is one\n * click and which the Screens page lists like any other row —\n * `unrouted-screen-counts.spec.ts` pins it at the enforcement point.\n *\n * `kind: 'template'` is deliberately outside the map's override, and it is the\n * one value that can be. A template is routed ON PURPOSE — publishing is how\n * the compose pipeline picks it up, and AGL-1267 drops it from routing when the\n * request arrives — so the map cannot be the arbiter for it. What makes\n * trusting it safe is that no client writes it: the demotion that sets it\n * always succeeds (it lowers the count) and the promotion that clears it is\n * checked exactly like a create (it raises it), so there is no toggle to run a\n * loop through.\n */\nexport function billableScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n  routingMap?: ScreenRoutingMap,\n): Set<string> {\n  const routed = new Set(Object.keys(routingMap ?? {}))\n  const exemptErrors = exemptErrorScreenIds(screens)\n  const billable = new Set<string>()\n  for (const screen of screens) {\n    if (screen.kind === SCREEN_KIND_TEMPLATE) continue\n    const claimsToBeAPage = screenClaimsToBeAPage({\n      kind: screen.kind as string,\n      deletedAt: screen.deletedAt,\n    })\n    // A `kind: 'error'` screen OVER the slot bound is a page again (AGL-2093).\n    const exemptionSpent =\n      screen.kind === SCREEN_KIND_ERROR &&\n      screen.deletedAt == null &&\n      !exemptErrors.has(screen.id)\n    if (routed.has(screen.id) || claimsToBeAPage || exemptionSpent) {\n      billable.add(screen.id)\n    }\n  }\n  return billable\n}\n\n/**\n * The live `kind: 'error'` screens whose billing exemption actually HOLDS —\n * at most {@link ERROR_SCREEN_MAX_PER_HOST} of them (AGL-2093).\n *\n * ## Why the bound lives here and not at one endpoint\n *\n * AGL-2092 introduced the exemption and bounded it at four — one per\n * `HostErrorScreens` slot — by checking the post-state at the moment\n * /api/hosts/screens STAMPS the kind. That made the claim true of the assign\n * route and false end to end, because the stamp is not the only writer:\n * `SITE_EXPORT_FIELDS.screens` carries `kind`, so a hand-edited bundle could\n * declare `kind: 'error'` on all 200 of its screens and /api/hosts/import\n * excluded every one of them from `screensPerHost` — never passing the bound,\n * never binding a slot. N unbilled screens, one file.\n *\n * That is the arc's fifth repetition of one sentence (AGL-1173, AGL-1383,\n * AGL-1387, AGL-1390, AGL-1400): *an exclusion enforced at a write path is\n * enforced only at the write paths somebody remembered.* So the bound moves\n * into the rule the enforcement points SHARE. However a screen came to say\n * `kind: 'error'` — assign, import, or the next writer — a host gets four\n * unbilled ones and the rest spend the plan's allowance exactly as pages do.\n *\n * ## Which four\n *\n * The lowest ids, sorted. The choice is arbitrary and the DETERMINISM is not:\n * every enforcement point models a post-state by re-running this over a\n * different row set, and a rule that picked \"the first four encountered\" would\n * hand two callers different answers for the same host. The SIZE of the exempt\n * set never depends on the order — it is `min(live errors, 4)` — so only which\n * ids a refusal message names can move, never whether one is refused.\n *\n * Tombstones are excluded for `nonPageScreenIds`' reason: a cap counting\n * soft-deleted rows is AGL-1173's bug one cap over, where deleting an error\n * screen never frees its slot.\n *\n * The stamp-time bound in /api/hosts/screens is deliberately KEPT. It is the\n * better refusal — it names the four slots and arrives before the write — and\n * this is the backstop under it, so no writer can mint a fifth unbilled error\n * screen even by a path that never consults it.\n */\nexport function exemptErrorScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n): Set<string> {\n  const live: Array<string> = []\n  for (const screen of screens) {\n    if (screen.kind !== SCREEN_KIND_ERROR) continue\n    if (screen.deletedAt != null) continue\n    live.push(screen.id)\n  }\n  if (live.length <= ERROR_SCREEN_MAX_PER_HOST) return new Set(live)\n  return new Set(live.sort().slice(0, ERROR_SCREEN_MAX_PER_HOST))\n}\n\n/**\n * The screens the flat platform cap bounds (AGL-1399, AGL-1439): LIVE documents\n * that are not billable pages — the exact complement of {@link billableScreenIds}.\n *\n * ## Why the complement, and not `kind === 'email' || kind === 'template'`\n *\n * Both issues are one sentence — *a `kind` value that excludes a document from\n * billing, declarable by the metered party* — and a cap that enumerated the two\n * values would be correct until the third arrived, which is how this arc has\n * already gone four times (AGL-1173, AGL-1383, AGL-1387, AGL-1390). Written as\n * the complement, a new non-page `kind` is bounded by the act of adding it to\n * `screenClaimsToBeAPage`: there is no second list to remember.\n *\n * Two properties fall out of taking the complement rather than negating the\n * predicate directly:\n *\n *  - **A soft-deleted screen is in NEITHER set.** Delete stamps `deletedAt`\n *    rather than removing the doc, and a cap that counted tombstones would be\n *    the AGL-1173 bug one cap over — deleting an email document would never free\n *    a slot, and a host at the cap could never author another.\n *  - **A ROUTED email document counts once, against the plan.** The routing map\n *    outranks the document (AGL-1383), so such a screen is a page somebody is\n *    already paying for; charging it to the infrastructure cap as well would be\n *    counting one document twice. The two sets partition the live screens.\n *\n * Taking the complement is also what makes AGL-2093's bound arrive here for\n * free: an error screen past `ERROR_SCREEN_MAX_PER_HOST` becomes billable\n * above, so it leaves this set in the same act. The partition holds — every\n * live screen is in exactly one of the two — and the fifth error screen is\n * bounded by the PLAN rather than by the flat 5,000, which is the stronger of\n * the two numbers on every finite tier.\n */\nexport function nonPageScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n  routingMap?: ScreenRoutingMap,\n): Set<string> {\n  const billable = billableScreenIds(screens, routingMap)\n  const nonPage = new Set<string>()\n  for (const screen of screens) {\n    if (screen.deletedAt != null) continue\n    if (!billable.has(screen.id)) nonPage.add(screen.id)\n  }\n  return nonPage\n}\n\n/**\n * How many LIVE screen documents a host may hold that are NOT billable pages —\n * email documents, entry templates, and whatever non-page `kind` comes next\n * (AGL-1399, AGL-1439).\n *\n * ## Why a flat number and not a plan dimension\n *\n * Every exclusion `screenClaimsToBeAPage` names is declared by the party being\n * metered: `kind: 'email'` is on the create allow-list because the email\n * composer must send it, and AGL-1400 gave `kind: 'template'` the same\n * billing-excluding meaning. So `POST /api/hosts/resources` with\n * `kind: 'email'` created a document that no cap counted, without limit, on a\n * free plan — unbounded Firestore documents rather than a bypass of anything we\n * sell. AGL-1439 is the same sentence one value over, and a cap enumerating the\n * two values would leave the hole open for the third.\n *\n * The shape is `WEBHOOK_MAX_PER_HOST`'s (AGL-1360): no `OrgEntitlements` key, no\n * variation by plan, counted from a server read at the create path. An\n * `emailDocumentsPerHost` would have been a **pricing** decision — a number the\n * price list has to explain and support has to defend — for a limit whose only\n * job is to bound infrastructure. This is not the charge AGL-1173 removed and it\n * does not reinstate it: nothing here is billable, and `screensPerHost` counts\n * exactly what it counted yesterday.\n *\n * ## Why 5,000\n *\n * Sized to the heaviest library anybody could plausibly author, not to what\n * exists: production's busiest host holds FOUR non-page screens (one email,\n * three entry templates) across five hosts, so any bar sized to today's data\n * would be meaningless. The real quantity is campaigns, which accumulate and are\n * never deleted — a DAILY newsletter reaches 5,000 after thirteen years, and a\n * thrice-weekly one after thirty-two. Entry templates contribute one per\n * collection, so tens at the outside. Nothing a real customer does approaches\n * this, which is the property that matters: the failure mode of a too-low flat\n * cap is blocking legitimate work with an error the price list cannot explain.\n *\n * A cheaper bound is not worth much either. What the number defends against is a\n * script in a loop, and a loop stopped at 5,000 documents is stopped. It also\n * bounds the cost of the count itself — `countBillableScreens` scans the screens\n * collection on every create at one billed read per document (AGL-1440), and\n * before this cap that scan had no ceiling at all.\n */\nexport const NON_PAGE_SCREEN_MAX_PER_HOST = 5000\n"],"names":["HOST_ERROR_SCREEN_SLOTS","collectionListUrl","ENTRY_PREVIEW_ROUTE_SEGMENT","PLATFORM_BRAND_NAME","formatCollectionLinkValue","formatEntryLinkValue","formatFeedLinkValue","parseEntryLinkValue","SCREEN_ROOT_PATH","normalizeScreenSlug","input","trimmed","trim","undefined","segment","toLowerCase","replace","RESERVED_SCREEN_ROUTE_SEGMENTS","reservedScreenRouteSegment","path","first","split","includes","reservedScreenRouteMessage","screenSlugHasPathSeparator","SCREEN_SLUG_PATH_SEPARATOR_MESSAGE","MAX_SCREEN_DEPTH","composeScreenRoutePath","screenId","screensById","segments","visited","Set","currentId","has","size","add","screen","slug","parentId","unshift","length","join","collectScreenDescendantIds","childrenByParent","Map","id","Object","entries","siblings","get","push","set","result","queue","shift","wouldCreateScreenCycle","nextParentId","buildScreenRouteEntries","routingMap","options","publish","ids","routed","findScreenIdByRoutePath","screens","entry","find","value","blockingRouteOwner","defaultHomeScreenId","owner","screenRoutePathToUrl","ownScreenSlugFromRoutePath","filter","Boolean","collectionFeedRoutePath","collectionSlug","listing","collectionEntryRoutePath","entrySlug","linkableScreenRoutes","sources","routedElsewhere","unrouted","collectionListings","entryRoutes","overrides","listings","next","collectionId","key","normalized","entryId","SCREEN_KIND_EMAIL","SCREEN_KIND_TEMPLATE","SCREEN_KIND_ERROR","ERROR_SCREEN_MAX_PER_HOST","screenClaimsToBeAPage","deletedAt","kind","billableScreenIds","keys","exemptErrors","exemptErrorScreenIds","billable","claimsToBeAPage","exemptionSpent","live","sort","slice","nonPageScreenIds","nonPage","NON_PAGE_SCREEN_MAX_PER_HOST"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,uBAAuB,QAAwB,yBAAe;AACvE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,2BAA2B,QAAQ,0BAAsB;AAClE,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SACEC,yBAAyB,EACzBC,oBAAoB,EACpBC,mBAAmB,EACnBC,mBAAmB,QACd,yBAAqB;AAE5B;;;;;;CAMC,GACD,OAAO,MAAMC,mBAAmB,IAAG;AAEnC;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,oBACdC,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,SAAS,OAAOE;IACrB,IAAIF,YAAYH,kBAAkB,OAAOA;IAEzC,MAAMM,UAAUH,QACbI,WAAW,GACXC,OAAO,CAAC,cAAc,IACtBA,OAAO,CAAC,QAAQ,KAChBA,OAAO,CAAC,gBAAgB,IACxBA,OAAO,CAAC,UAAU,KAClBA,OAAO,CAAC,YAAY;IAEvB,OAAOF,WAAWD;AACpB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,MAAMI,iCAAoD;IAC/D;IACA;IACA;IACAf;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASgB,2BACdC,IAA+B;IAE/B,IAAI,CAACA,QAAQA,SAASX,kBAAkB,OAAOK;IAC/C,MAAM,CAACO,MAAM,GAAGD,KAAKH,OAAO,CAAC,QAAQ,IAAIK,KAAK,CAAC;IAC/C,OAAOJ,+BAA+BK,QAAQ,CAACF,SAASA,QAAQP;AAClE;AAEA;;;;;CAKC,GACD,OAAO,SAASU,2BAA2BT,OAAe;IACxD,OAAO,CAAC,EAAE,EAAEA,QAAQ,iCAAiC,EAAEX,oBAAoB,yBAAyB,CAAC;AACvG;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASqB,2BACdd,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,WAAWA,YAAYH,kBAAkB,OAAO;IACrD,OAAOG,QAAQK,OAAO,CAAC,cAAc,IAAIM,QAAQ,CAAC;AACpD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMG,qCACX,2EACA,sBAAqB;AAQvB,0EAA0E,GAC1E,MAAMC,mBAAmB;AAEzB;;;;;;;CAOC,GACD,OAAO,SAASC,uBACdC,QAAmB,EACnBC,WAA2D;IAE3D,MAAMC,WAAqB,EAAE;IAC7B,MAAMC,UAAU,IAAIC;IACpB,IAAIC,YAAmCL;IAEvC,MAAOK,UAAW;QAChB,IAAIF,QAAQG,GAAG,CAACD,cAAcF,QAAQI,IAAI,IAAIT,kBAAkB;YAC9D,OAAOb;QACT;QACAkB,QAAQK,GAAG,CAACH;QACZ,MAAMI,SAASR,WAAW,CAACI,UAAU;QACrC,IAAI,EAACI,0BAAAA,OAAQC,IAAI,GAAE,OAAOzB;QAC1B,IAAIwB,OAAOC,IAAI,KAAK9B,kBAAkB;YACpC,sEAAsE;YACtE,wEAAwE;YACxE,IAAIyB,cAAcL,YAAYS,OAAOE,QAAQ,EAAE,OAAO1B;QACxD,OAAO;YACLiB,SAASU,OAAO,CAACH,OAAOC,IAAI;QAC9B;QACAL,YAAYI,OAAOE,QAAQ;IAC7B;IAEA,IAAI,CAACT,SAASW,MAAM,EAAE;YACbZ;QAAP,OAAOA,EAAAA,wBAAAA,WAAW,CAACD,SAAS,qBAArBC,sBAAuBS,IAAI,MAAK9B,mBACnCA,mBACAK;IACN;IACA,OAAOiB,SAASY,IAAI,CAAC;AACvB;AAEA;;;;CAIC,GACD,OAAO,SAASC,2BACdf,QAAmB,EACnBC,WAA2D;QAUxCe;IARnB,MAAMA,mBAAmB,IAAIC;IAC7B,KAAK,MAAM,CAACC,IAAIT,OAAO,IAAIU,OAAOC,OAAO,CAACnB,aAAc;YAErCe;QADjB,IAAI,EAACP,0BAAAA,OAAQE,QAAQ,GAAE;QACvB,MAAMU,YAAWL,yBAAAA,iBAAiBM,GAAG,CAACb,OAAOE,QAAQ,aAApCK,yBAAyC,EAAE;QAC5DK,SAASE,IAAI,CAACL;QACdF,iBAAiBQ,GAAG,CAACf,OAAOE,QAAQ,EAAEU;IACxC;IACA,MAAMI,SAAsB,EAAE;IAC9B,MAAMC,QAAQ;YAAKV,wBAAAA,iBAAiBM,GAAG,CAACtB,qBAArBgB,wBAAkC,EAAE;KAAE;IACzD,MAAOU,MAAMb,MAAM,CAAE;YAIJG;QAHf,MAAME,KAAKQ,MAAMC,KAAK;QACtB,IAAIF,OAAO/B,QAAQ,CAACwB,KAAK;QACzBO,OAAOF,IAAI,CAACL;QACZQ,MAAMH,IAAI,KAAKP,yBAAAA,iBAAiBM,GAAG,CAACJ,eAArBF,yBAA4B,EAAE;IAC/C;IACA,OAAOS;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASG,uBACd5B,QAAmB,EACnB6B,YAAmC,EACnC5B,WAA2D;IAE3D,IAAI,CAAC4B,cAAc,OAAO;IAC1B,IAAIA,iBAAiB7B,UAAU,OAAO;IACtC,OAAOe,2BAA2Bf,UAAUC,aAAaP,QAAQ,CAC/DmC;AAEJ;AA4BA;;;;;;;;CAQC,GACD,OAAO,SAASC,wBACd9B,QAAmB,EACnBC,WAA2D,EAC3D8B,UAAwD,EACxDC,UAA0C,CAAC,CAAC;IAE5C,MAAM,EAAEC,UAAU,IAAI,EAAE,GAAGD;IAC3B,MAAMZ,UAA4C,CAAC;IACnD,MAAMc,MAAM;QAAClC;WAAae,2BAA2Bf,UAAUC;KAAa;IAC5E,KAAK,MAAMiB,MAAMgB,IAAK;QACpB,MAAMC,SAASJ,CAAAA,8BAAAA,UAAY,CAACb,GAAG,MAAKjC;QACpC,MAAMM,OAAOQ,uBAAuBmB,IAAIjB;QACxC,IAAIV,MAAM;YACR,mEAAmE;YACnE,IAAI4C,UAAUF,SAASb,OAAO,CAACF,GAAG,GAAG3B;QACvC,OAAO,IAAI4C,QAAQf,OAAO,CAACF,GAAG,GAAG;IACnC;IACA,OAAOE;AACT;AAEA;;;CAGC,GACD,OAAO,SAASgB,wBACdC,OAAqD,EACrD9C,IAAY;IAEZ,IAAI,CAAC8C,SAAS,OAAOpD;IACrB,MAAMqD,QAAQnB,OAAOC,OAAO,CAACiB,SAASE,IAAI,CAAC,CAAC,GAAGC,MAAM,GAAKA,UAAUjD;IACpE,OAAO+C,yBAAAA,KAAO,CAAC,EAAE;AACnB;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASG,mBACdJ,OAAqD,EACrD9C,IAAY,EACZmD,mBAAmC;IAEnC,MAAMC,QAAQP,wBAAwBC,SAAS9C;IAC/C,IAAIoD,SAASpD,SAASX,oBAAoB+D,UAAUD,qBAAqB;QACvE,OAAOzD;IACT;IACA,OAAO0D;AACT;AAEA,mFAAmF,GACnF,OAAO,SAASC,qBAAqBrD,IAAY;IAC/C,OAAOA,SAASX,mBAAmBA,mBAAmB,CAAC,CAAC,EAAEW,MAAM;AAClE;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASsD,2BACdtD,IAA+B;IAE/B,IAAI,CAACA,MAAM,OAAON;IAClB,IAAIM,SAASX,kBAAkB,OAAOA;IACtC,MAAMsB,WAAWX,KAAKE,KAAK,CAAC,KAAKqD,MAAM,CAACC;IACxC,OAAO7C,QAAQ,CAACA,SAASW,MAAM,GAAG,EAAE;AACtC;AAsCA;;;CAGC,GACD,OAAO,SAASmC,wBAAwBC,cAAsB;IAC5D,MAAMC,UAAU7E,kBAAkB;QAAE4E;IAAe,GAAG7D,OAAO,CAAC,cAAc;IAC5E,OAAO,GAAG8D,QAAQ,QAAQ,CAAC;AAC7B;AAEA;;;;;CAKC,GACD,OAAO,SAASC,yBACdF,cAAsB,EACtBG,SAAiB;IAEjB,MAAMF,UAAU7E,kBAAkB;QAAE4E;IAAe,GAAG7D,OAAO,CAAC,cAAc;IAC5E,OAAO,GAAG8D,QAAQ,CAAC,EAAEE,UAAUpE,IAAI,GAAGI,OAAO,CAAC,cAAc,KAAK;AACnE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCC,GACD,OAAO,SAASiE,qBACdhB,OAAqD,EACrDiB,UAAsC,CAAC,CAAC;IAExC,MAAM,EAAEC,eAAe,EAAEC,QAAQ,EAAEC,kBAAkB,EAAEC,WAAW,EAAE,GAAGJ;IACvE,MAAMK,YAAYxC,OAAOC,OAAO,CAACmC,0BAAAA,kBAAmB,CAAC;IACrD,MAAMK,WAAWzC,OAAOC,OAAO,CAACqC,6BAAAA,qBAAsB,CAAC;IACvD,MAAMrC,UAAUD,OAAOC,OAAO,CAACsC,sBAAAA,cAAe,CAAC;IAC/C,IAAI,CAACrB,WAAW,CAACsB,UAAU9C,MAAM,IAAI,CAAC+C,SAAS/C,MAAM,IAAI,CAACO,QAAQP,MAAM,EAAE;QACxE,OAAO5B;IACT;IACA,MAAM4E,OAAkC,aAAMxB,kBAAAA,UAAW,CAAC;IAC1D,KAAK,MAAMnB,MAAMsC,mBAAAA,WAAY,EAAE,CAAE,OAAOK,IAAI,CAAC3C,GAAG;IAChD,KAAK,MAAM,CAAC4C,cAAcb,eAAe,IAAIW,SAAU;QACrD,MAAMlD,OACJ,OAAOuC,mBAAmB,WACtBA,eAAejE,IAAI,GAAGI,OAAO,CAAC,cAAc,MAC5C;QACN,IAAI,CAAC0E,aAAa9E,IAAI,MAAM,CAAC0B,MAAM;QACnC,qEAAqE;QACrE,iEAAiE;QACjEmD,IAAI,CAACrF,0BAA0BsF,cAAc,GAAGzF,kBAAkB;YAChE4E,gBAAgBvC;QAClB,GAAGtB,OAAO,CAAC,QAAQ;QACnB,yEAAyE;QACzE,kDAAkD;QAClDyE,IAAI,CAACnF,oBAAoBoF,cAAc,GAAGd,wBAAwBtC;IACpE;IACA,KAAK,MAAM,CAACqD,KAAKxE,KAAK,IAAI6B,QAAS;QACjC,2EAA2E;QAC3E,0EAA0E;QAC1E,eAAe;QACf,MAAMkB,QAAQ3D,oBAAoBoF;QAClC,IAAI,CAACzB,OAAO;QACZ,MAAM0B,aACJ,OAAOzE,SAAS,WAAWA,KAAKP,IAAI,GAAGI,OAAO,CAAC,cAAc,MAAM;QACrE,IAAI,CAAC4E,YAAY;QACjBH,IAAI,CAACpF,qBAAqB6D,MAAMwB,YAAY,EAAExB,MAAM2B,OAAO,EAAE,GAAGD;IAClE;IACA,KAAK,MAAM,CAAC9C,IAAI3B,KAAK,IAAIoE,UAAW;QAClC,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,sCAAsC;QACtC,MAAMK,aACJ,OAAOzE,SAAS,YAAYA,SAASX,mBACjCW,KAAKH,OAAO,CAAC,cAAc,MAC3BG;QACN,IAAI,CAACyE,YAAY;QACjBH,IAAI,CAAC3C,GAAG,GAAG8C;IACb;IACA,OAAOH;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMK,oBAAoB,QAAO;AAExC;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,uBAAuB,WAAU;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMC,oBAAoB,QAAO;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMC,4BAA4BjG,wBAAwByC,MAAM,CAAA;AAQvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CC,GACD,OAAO,SAASyD,sBACd7D,MAA0C;IAE1C,IAAI,CAACA,QAAQ,OAAO;IACpB,OACEA,OAAO8D,SAAS,IAAI,QACpB9D,OAAO+D,IAAI,KAAKN,qBAChBzD,OAAO+D,IAAI,KAAKL,wBAChB1D,OAAO+D,IAAI,KAAKJ;AAEpB;AAsBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiGC,GACD,OAAO,SAASK,kBACdpC,OAA4C,EAC5CN,UAA6B;IAE7B,MAAMI,SAAS,IAAI/B,IAAIe,OAAOuD,IAAI,CAAC3C,qBAAAA,aAAc,CAAC;IAClD,MAAM4C,eAAeC,qBAAqBvC;IAC1C,MAAMwC,WAAW,IAAIzE;IACrB,KAAK,MAAMK,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO+D,IAAI,KAAKL,sBAAsB;QAC1C,MAAMW,kBAAkBR,sBAAsB;YAC5CE,MAAM/D,OAAO+D,IAAI;YACjBD,WAAW9D,OAAO8D,SAAS;QAC7B;QACA,2EAA2E;QAC3E,MAAMQ,iBACJtE,OAAO+D,IAAI,KAAKJ,qBAChB3D,OAAO8D,SAAS,IAAI,QACpB,CAACI,aAAarE,GAAG,CAACG,OAAOS,EAAE;QAC7B,IAAIiB,OAAO7B,GAAG,CAACG,OAAOS,EAAE,KAAK4D,mBAAmBC,gBAAgB;YAC9DF,SAASrE,GAAG,CAACC,OAAOS,EAAE;QACxB;IACF;IACA,OAAO2D;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,OAAO,SAASD,qBACdvC,OAA4C;IAE5C,MAAM2C,OAAsB,EAAE;IAC9B,KAAK,MAAMvE,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO+D,IAAI,KAAKJ,mBAAmB;QACvC,IAAI3D,OAAO8D,SAAS,IAAI,MAAM;QAC9BS,KAAKzD,IAAI,CAACd,OAAOS,EAAE;IACrB;IACA,IAAI8D,KAAKnE,MAAM,IAAIwD,2BAA2B,OAAO,IAAIjE,IAAI4E;IAC7D,OAAO,IAAI5E,IAAI4E,KAAKC,IAAI,GAAGC,KAAK,CAAC,GAAGb;AACtC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,SAASc,iBACd9C,OAA4C,EAC5CN,UAA6B;IAE7B,MAAM8C,WAAWJ,kBAAkBpC,SAASN;IAC5C,MAAMqD,UAAU,IAAIhF;IACpB,KAAK,MAAMK,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO8D,SAAS,IAAI,MAAM;QAC9B,IAAI,CAACM,SAASvE,GAAG,CAACG,OAAOS,EAAE,GAAGkE,QAAQ5E,GAAG,CAACC,OAAOS,EAAE;IACrD;IACA,OAAOkE;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,MAAMC,+BAA+B,KAAI"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { HOST_ERROR_SCREEN_SLOTS, type ScreenUid } from '../foundation'\nimport { collectionListUrl } from './collection-entries'\nimport { ENTRY_PREVIEW_ROUTE_SEGMENT } from './entry-preview-link'\nimport { LEAVING_NOTICE_ROUTE_SEGMENT } from './leaving-notice'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\nimport {\n  formatCollectionLinkValue,\n  formatEntryLinkValue,\n  formatFeedLinkValue,\n  parseEntryLinkValue,\n} from './screen-link-value'\n\n/**\n * Route path of a host's root screen. The tenant matcher joins the catch-all\n * segments and collapses an empty one to this value (`load-page-data.ts`:\n * `slugSegments.length ? slugSegments.join('/') : SCREEN_ROOT_PATH`), so the\n * root is `'/'` and every other path is slash-joined segments WITHOUT a\n * leading slash (`about`, later `company/about`).\n */\nexport const SCREEN_ROOT_PATH = '/'\n\n/**\n * Normalizes user slug input into the routing-map path format described on\n * {@link SCREEN_ROOT_PATH}. `'/'` normalizes to the root path; anything else\n * becomes a single lowercase url-safe segment.\n *\n * Returns `undefined` for EMPTY input and for anything that sanitizes away\n * (`'###'`) — the two cases are deliberately the same answer, and the caller\n * decides what it means. In the Screens page's slug field an empty string\n * means \"no address typed\"; in a starter template it meant \"home\". Two\n * meanings for one value is what made AGL-1575 possible, so this function\n * refuses to pick one: a caller that wants the root must say `'/'`.\n *\n * This docstring used to claim empty input normalized to the root, which the\n * code has never done (see the spec, which asserts the `undefined`). A fix\n * written against the docstring instead of the behaviour would have shipped\n * broken; if you are here to make the code match the comment, do not.\n */\nexport function normalizeScreenSlug(\n  input: string | null | undefined,\n): string | undefined {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed) return undefined\n  if (trimmed === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH\n\n  const segment = trimmed\n    .toLowerCase()\n    .replace(/^\\/+|\\/+$/g, '')\n    .replace(/\\s+/g, '-')\n    .replace(/[^a-z0-9-_]/g, '')\n    .replace(/-{2,}/g, '-')\n    .replace(/^-+|-+$/g, '')\n\n  return segment || undefined\n}\n\n/**\n * Route segments the published site CANNOT serve, whatever the routing map\n * says (AGL-2076).\n *\n * Every entry was measured against production on 2026-08-19 with a fresh\n * `x-vercel-cache: MISS`, because a stale negative always passes. Two\n * mechanisms, both of which resolve ahead of `[host]/[scheme]/[[...slug]]`:\n *\n *  - `404`, `500` — Next emits `pages/404.html` and `pages/500.html` even for\n *    an app-router-only build, and the deployed filesystem answers them as\n *    static files (`content-disposition: inline; filename=\"404\"`,\n *    `accept-ranges`, an `etag`, and no `x-nextjs-prerender`). The tenant\n *    middleware's own CSP headers are on those responses, so the middleware\n *    ran and its rewrite still lost. There is no rewrite this app can write\n *    that beats them, which is why the honest fix is to refuse the slug at\n *    authoring time rather than to keep promising an address that is dead.\n *  - `search`, `api`, `_next`, `_static` — routes and exclusions the tenant\n *    app owns. `/search` matches `app/[host]/[scheme]/search`; the other three are the\n *    middleware matcher's exclusions, so no host rewrite happens at all and\n *    the path is parsed as `[host]` with an empty slug.\n *  - `aglyn-preview` — the same mechanism as `search`, one route over\n *    (AGL-3205). The live-site preview of an unpublished collection entry is\n *    a rewrite to `app/[host]/[scheme]/aglyn-preview/[...slug]`, because it\n *    must be a DIFFERENT Next route from the ISR-cached catch-all; a static\n *    folder wins over the optional catch-all beside it, so `/aglyn-preview/x`\n *    would reach the preview page and 404 rather than render a screen. The\n *    bare `/aglyn-preview` would in fact still serve — the preview route's\n *    catch-all is required, not optional — and it is reserved anyway for the\n *    reason given below about child paths: a child only exists when its\n *    parent is published, and this rule refuses the parent.\n *  - `_aglyn` — the platform's own pages on every site, the leaving notice\n *    at `/_aglyn/leaving` first (AGL-3452). The middleware rewrites that path\n *    to an api route before the catch-all could see it.\n *\n * NOT reserved, and deliberately so, because measuring found them fine:\n * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the\n * four designed error screens have always been viewable at their slugs, which\n * is what made the `404` case look like a Next.js defect), and `index`.\n *\n * `fonts` and `examples` USED to be dead for the third reason and are not\n * here: they were exclusions inherited from the Vercel platforms starter kit\n * for directories `apps/tenant/public` has never contained. They are given\n * back rather than reserved — see the matcher in `apps/tenant/middleware.ts`.\n */\nexport const RESERVED_SCREEN_ROUTE_SEGMENTS: readonly string[] = [\n  '404',\n  '500',\n  'search',\n  ENTRY_PREVIEW_ROUTE_SEGMENT,\n  'api',\n  '_next',\n  '_static',\n  LEAVING_NOTICE_ROUTE_SEGMENT,\n]\n\n/**\n * The reserved segment a routing-map path would collide with, or `undefined`\n * when the path is servable. The segment rather than a boolean, so a refusal\n * can name what it is refusing over.\n *\n * Reads the FIRST segment only. For `api`/`_next`/`_static` that is exactly\n * right — the middleware excludes the whole subtree, so `api/docs` is as dead\n * as `api`. For `404`/`500`/`search` it over-refuses in principle (`/404/why`\n * would serve), and that is deliberate: a child path only exists when its\n * PARENT screen is published, the parent would sit at `404`, and this same\n * rule refuses that. A second list to express a case that cannot arise would\n * be a second list to keep correct.\n *\n * Takes a composed routing-map path (`about`, `company/about`, `'/'`), not a\n * raw slug field — `'/'` is the home screen and is never reserved.\n */\nexport function reservedScreenRouteSegment(\n  path: string | null | undefined,\n): string | undefined {\n  if (!path || path === SCREEN_ROOT_PATH) return undefined\n  const [first] = path.replace(/^\\/+/, '').split('/')\n  return RESERVED_SCREEN_ROUTE_SEGMENTS.includes(first) ? first : undefined\n}\n\n/**\n * The refusal an author reads when {@link reservedScreenRouteSegment} names a\n * segment. One sentence, in one place, because the Screens page, the version\n * view and the besigner all have to say the same thing — three surfaces\n * wording a platform constraint three ways is how AGL-2093's precheck drifted.\n */\nexport function reservedScreenRouteMessage(segment: string): string {\n  return `\"/${segment}\" is a reserved address on every ${PLATFORM_BRAND_NAME} site — pick another slug`\n}\n\n/**\n * Does a raw slug value carry a path separator the one segment it describes\n * cannot hold (AGL-2572)?\n *\n * {@link normalizeScreenSlug} answers with a SINGLE segment, and it gets there\n * by deleting every character outside `[a-z0-9-_]` — an interior `/` included.\n * Whitespace becomes a `-`, but a `/` becomes nothing at all, so\n * `alternatives/webflow` normalizes to `alternativeswebflow` and the two words\n * are stored glued. Nothing about that is visible: the field accepts the\n * keystroke, the composed path reads plausibly, and the screen ends up\n * answering an address nobody typed. Two screens on `aglyn-marketing` carry a\n * slug of that shape.\n *\n * So the separator is a question a slug field asks BEFORE normalizing, and the\n * answer is a refusal rather than a silent repair — the caller cannot know\n * which segment the author meant, and guessing is how the glue happened.\n *\n * LEADING and TRAILING slashes are not separators here. `normalizeScreenSlug`\n * strips them deliberately (`/about/` → `about`), an author typing an address\n * writes them without meaning a hierarchy, and refusing them would reject a\n * value the normalizer has always handled correctly. `'/'` alone is the home\n * page and is never a separator.\n */\nexport function screenSlugHasPathSeparator(\n  input: string | null | undefined,\n): boolean {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed || trimmed === SCREEN_ROOT_PATH) return false\n  return trimmed.replace(/^\\/+|\\/+$/g, '').includes('/')\n}\n\n/**\n * The refusal an author reads when {@link screenSlugHasPathSeparator} answers\n * true. One sentence, in one place, for the same reason\n * {@link reservedScreenRouteMessage} is: the Screens page, the version view\n * and the besigner all take a slug, and a constraint worded three ways drifts\n * into three different constraints.\n *\n * It names the alternative, because a `/` in this field almost always means\n * \"nest me\" and the hierarchy is what actually composes the longer path.\n */\nexport const SCREEN_SLUG_PATH_SEPARATOR_MESSAGE =\n  'A slug is one path segment — remove the \"/\" and nest the page under a ' +\n  'parent page instead'\n\n/** Minimal screen shape the hierarchy helpers need. */\nexport interface ScreenRouteNode {\n  slug?: string\n  parentId?: ScreenUid\n}\n\n/** Defensive cap: parent chains deeper than this are treated as invalid. */\nconst MAX_SCREEN_DEPTH = 32\n\n/**\n * Composes a screen's routing-map path from its own slug plus its ancestor\n * chain: parent `company` + own `about` → `company/about`. Root (`'/'`)\n * segments contribute nothing, so children of the home screen sit at the\n * top level. Returns `undefined` when the screen (or any ancestor) has no\n * slug, when the screen's own slug is `'/'` while it has a parent, or when\n * the chain has a cycle / exceeds {@link MAX_SCREEN_DEPTH}.\n */\nexport function composeScreenRoutePath(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): string | undefined {\n  const segments: string[] = []\n  const visited = new Set<ScreenUid>()\n  let currentId: ScreenUid | undefined = screenId\n\n  while (currentId) {\n    if (visited.has(currentId) || visited.size >= MAX_SCREEN_DEPTH) {\n      return undefined\n    }\n    visited.add(currentId)\n    const screen = screensById[currentId]\n    if (!screen?.slug) return undefined\n    if (screen.slug === SCREEN_ROOT_PATH) {\n      // The home screen's segment is empty (children of home sit at the top\n      // level), but a screen can't itself be the home page AND have a parent.\n      if (currentId === screenId && screen.parentId) return undefined\n    } else {\n      segments.unshift(screen.slug)\n    }\n    currentId = screen.parentId\n  }\n\n  if (!segments.length) {\n    return screensById[screenId]?.slug === SCREEN_ROOT_PATH\n      ? SCREEN_ROOT_PATH\n      : undefined\n  }\n  return segments.join('/')\n}\n\n/**\n * All screens whose parent chain passes through `screenId` (children,\n * grandchildren, …). Used to cascade routing-map rewrites when a screen's\n * slug or parent changes.\n */\nexport function collectScreenDescendantIds(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): ScreenUid[] {\n  const childrenByParent = new Map<ScreenUid, ScreenUid[]>()\n  for (const [id, screen] of Object.entries(screensById)) {\n    if (!screen?.parentId) continue\n    const siblings = childrenByParent.get(screen.parentId) ?? []\n    siblings.push(id)\n    childrenByParent.set(screen.parentId, siblings)\n  }\n  const result: ScreenUid[] = []\n  const queue = [...(childrenByParent.get(screenId) ?? [])]\n  while (queue.length) {\n    const id = queue.shift() as ScreenUid\n    if (result.includes(id)) continue\n    result.push(id)\n    queue.push(...(childrenByParent.get(id) ?? []))\n  }\n  return result\n}\n\n/**\n * True when making `nextParentId` the parent of `screenId` would create a\n * loop — i.e. the candidate parent is the screen itself or one of its own\n * descendants.\n */\nexport function wouldCreateScreenCycle(\n  screenId: ScreenUid,\n  nextParentId: ScreenUid | undefined,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n): boolean {\n  if (!nextParentId) return false\n  if (nextParentId === screenId) return true\n  return collectScreenDescendantIds(screenId, screensById).includes(\n    nextParentId,\n  )\n}\n\n/** How {@link buildScreenRouteEntries} treats a screen with no entry today. */\nexport interface BuildScreenRouteEntriesOptions {\n  /**\n   * Is this call a PUBLISH, or only a move? (AGL-2571)\n   *\n   * An entry in the host's `screens` map is the whole of what makes a path\n   * reachable, so writing one IS publishing — there is no second switch. This\n   * function is used for both, and until now it could not tell them apart: it\n   * wrote a path for every screen in the subtree whose slug chain happened to\n   * resolve, whether or not anyone had asked for that screen to go live.\n   *\n   * What that produced on `aglyn-marketing`: assigning a parent to an\n   * unpublished screen that merely CARRIED a slug registered it in the map,\n   * and the besigner toolbar — which reads the map — then offered `Unpublish`\n   * and an enabled `Live` link for a screen nobody had published, with no\n   * `publishedAt` on the document and a 404 at the address.\n   *\n   * `false` therefore restricts the write to entries that ALREADY exist:\n   * paths are rewritten, broken ones are removed, and nothing new goes live.\n   * A move is not an activation.\n   *\n   * Defaults to `true`, which is what the publish buttons mean.\n   */\n  publish?: boolean\n}\n\n/**\n * Routing-map entries for a screen plus all its descendants under a\n * candidate screens map: a composed path sets the entry, `null` marks an\n * existing entry whose chain no longer resolves for removal. Callers apply\n * the result in one write so slug/parent changes cascade atomically.\n *\n * See {@link BuildScreenRouteEntriesOptions.publish} for the difference\n * between publishing a screen and merely moving one.\n */\nexport function buildScreenRouteEntries(\n  screenId: ScreenUid,\n  screensById: Record<ScreenUid, ScreenRouteNode | undefined>,\n  routingMap: Record<ScreenUid, string> | null | undefined,\n  options: BuildScreenRouteEntriesOptions = {},\n): Record<ScreenUid, string | null> {\n  const { publish = true } = options\n  const entries: Record<ScreenUid, string | null> = {}\n  const ids = [screenId, ...collectScreenDescendantIds(screenId, screensById)]\n  for (const id of ids) {\n    const routed = routingMap?.[id] !== undefined\n    const path = composeScreenRoutePath(id, screensById)\n    if (path) {\n      // A move rewrites what is live; it never puts something new there.\n      if (routed || publish) entries[id] = path\n    } else if (routed) entries[id] = null\n  }\n  return entries\n}\n\n/**\n * Looks up which screen currently owns a routing path, for sibling-slug\n * uniqueness checks before publishing.\n */\nexport function findScreenIdByRoutePath(\n  screens: Record<ScreenUid, string> | null | undefined,\n  path: string,\n): ScreenUid | undefined {\n  if (!screens) return undefined\n  const entry = Object.entries(screens).find(([, value]) => value === path)\n  return entry?.[0]\n}\n\n/**\n * The screen a publish at `path` would collide with, or `undefined` when the\n * address is free to take (AGL-3408).\n *\n * {@link findScreenIdByRoutePath} with one exception: the placeholder home\n * page a site is created with (`host.defaultHomeScreenId`) does not block the\n * site root. It holds `/` only so a new site never answers its own address\n * with a 404, and the first real page published there replaces it — the\n * publish seam removes its entry in the same write. It still blocks any other\n * path it has been moved to, and no other screen is ever passed over.\n *\n * Every publish surface's conflict check reads this rather than the raw owner,\n * so \"is this address taken?\" has one answer across them.\n */\nexport function blockingRouteOwner(\n  screens: Record<ScreenUid, string> | null | undefined,\n  path: string,\n  defaultHomeScreenId?: string | null,\n): ScreenUid | undefined {\n  const owner = findScreenIdByRoutePath(screens, path)\n  if (owner && path === SCREEN_ROOT_PATH && owner === defaultHomeScreenId) {\n    return undefined\n  }\n  return owner\n}\n\n/** Human-facing URL for a routing-map path (`'/'` stays `/`, `about` → `/about`). */\nexport function screenRoutePathToUrl(path: string): string {\n  return path === SCREEN_ROOT_PATH ? SCREEN_ROOT_PATH : `/${path}`\n}\n\n/**\n * A screen's OWN slug segment, read back off its composed routing-map path\n * (`company/about` → `about`) — the inverse of the one step\n * {@link composeScreenRoutePath} adds for this screen (AGL-2572).\n *\n * The slug field holds one segment; the routing map holds the whole composed\n * path. A field that seeds itself from the map therefore has to take the last\n * segment, and the besigner's seeded the whole path instead. Its value then\n * went through {@link normalizeScreenSlug}, which DELETES an interior `/`\n * rather than separating on it, so `alternatives/webflow` came back as the\n * glued `alternativeswebflow` and was stored as the screen's own slug —\n * without anyone typing it. Two screens on `aglyn-marketing` carry a slug of\n * that shape.\n *\n * Not a general path parser: it answers only \"which segment is this screen's\n * own\", which is always the last one.\n */\nexport function ownScreenSlugFromRoutePath(\n  path: string | null | undefined,\n): string | undefined {\n  if (!path) return undefined\n  if (path === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH\n  const segments = path.split('/').filter(Boolean)\n  return segments[segments.length - 1]\n}\n\n/** What a screen is ACTUALLY served at, where that is not its own slug. */\nexport interface LinkableScreenRouteSources {\n  /**\n   * screen id → the routing-map path the screen really answers on, for\n   * screens routed by something other than their own slug. Today that is a\n   * content collection's LIST template: `/{collectionSlug}` renders it\n   * (`composeCollectionTemplatePage`), whatever slug it was published under.\n   * Applied LAST, so it also un-drops a screen named in `unrouted`.\n   */\n  routedElsewhere?: Record<string, string> | null | undefined\n  /**\n   * Screen ids that serve NO address of their own — a collection ENTRY\n   * template (AGL-1267), commerce's PDP/catalog templates (AGL-1270), a\n   * screen that says `kind: 'template'` (AGL-1400). The tenant router drops\n   * these before matching, so their routing-map path is a 404.\n   */\n  unrouted?: Iterable<string> | null | undefined\n  /**\n   * collection id → collection slug, for every CONTENT collection with a slug\n   * (AGL-2799): the collections whose listing `/{collectionSlug}` serves. Each\n   * becomes a link target of its own, keyed by `formatCollectionLinkValue`,\n   * so a link can name a blog's listing whether or not a list template screen\n   * renders it.\n   */\n  collectionListings?: Record<string, string> | null | undefined\n  /**\n   * entry key (`entry:<collectionId>/<entryId>`) → the entry's path, for the\n   * entries a page references (AGL-3118). Unlike every other source, this one\n   * is not the whole site: a renderer reads only the entries its own links\n   * name, so an entry key missing here means \"not asked for\", and\n   * `screenRoutesAnswerFor` judges entry links only against a map that has\n   * some.\n   */\n  entryRoutes?: Record<string, string> | null | undefined\n}\n\n/**\n * Where a collection's RSS feed is served, in the routing map's own format\n * (no leading slash): `blog/rss.xml` for the collection at `/blog`.\n */\nexport function collectionFeedRoutePath(collectionSlug: string): string {\n  const listing = collectionListUrl({ collectionSlug }).replace(/^\\/+|\\/+$/g, '')\n  return `${listing}/rss.xml`\n}\n\n/**\n * Where a collection ENTRY is served, in the routing map's own format (no\n * leading slash): `blog/hello` for the entry slugged `hello` in the\n * collection at `/blog` — the `/{collection}/{entry}` shape\n * `parseCollectionRoute` reads back.\n */\nexport function collectionEntryRoutePath(\n  collectionSlug: string,\n  entrySlug: string,\n): string {\n  const listing = collectionListUrl({ collectionSlug }).replace(/^\\/+|\\/+$/g, '')\n  return `${listing}/${entrySlug.trim().replace(/^\\/+|\\/+$/g, '')}`\n}\n\n/**\n * The routing map as a LINK TARGET table (AGL-1998).\n *\n * The host's `screens` map is written by publishing, one entry per screen\n * under its own composed slug, and the tenant router then edits it at serve\n * time: template screens are dropped (see {@link LinkableScreenRouteSources})\n * and a collection's list template is reached at `/{collectionSlug}` instead.\n * Everything that RESOLVES a screen link — `resolveScreenHref` on the live\n * site, the besigner's screen picker, every `Link`-typed component prop — was\n * reading the raw map, so the two surfaces disagreed with the router in both\n * directions at once:\n *\n *  - `/blog` was UNOFFERABLE. The blog's list template is published under\n *    `blog-list-template` and serves `/blog`, so no screen link on aglyn.com\n *    could point at the site's own blog index.\n *  - Every template screen was offered at a path that 404s, and an author who\n *    picked one got a dead anchor that looks exactly like a live one.\n *\n * So the map every linking surface reads is derived here, from the same two\n * facts the router uses, and the picker can no longer offer a path the router\n * would refuse.\n *\n * A content collection's LISTING is a target in its own right (AGL-2799),\n * keyed `collection:<collectionId>` beside the screen ids. Its path comes from\n * `collectionListUrl`, the builder the pager, the canonical link and the\n * sitemap already share, so a link cannot give a listing an address the rest\n * of the site does not; and because the key is the collection's id rather than\n * its slug, renaming the slug moves every link to it on the next render. A\n * collection that is gone, or that has lost its slug, has no entry — the same\n * absence `isScreenLinkBroken` reads as a dead target.\n *\n * A raw map with no source given comes back unchanged; an absent map with no\n * overrides and no listings stays absent, because `undefined` means \"nothing\n * resolves yet\" to {@link ScreenLinkContext} and `{}` would mean \"resolved:\n * nowhere\".\n */\nexport function linkableScreenRoutes(\n  screens: Record<ScreenUid, string> | null | undefined,\n  sources: LinkableScreenRouteSources = {},\n): Record<ScreenUid, string> | undefined {\n  const { routedElsewhere, unrouted, collectionListings, entryRoutes } = sources\n  const overrides = Object.entries(routedElsewhere ?? {})\n  const listings = Object.entries(collectionListings ?? {})\n  const entries = Object.entries(entryRoutes ?? {})\n  if (!screens && !overrides.length && !listings.length && !entries.length) {\n    return undefined\n  }\n  const next: Record<ScreenUid, string> = { ...(screens ?? {}) }\n  for (const id of unrouted ?? []) delete next[id]\n  for (const [collectionId, collectionSlug] of listings) {\n    const slug =\n      typeof collectionSlug === 'string'\n        ? collectionSlug.trim().replace(/^\\/+|\\/+$/g, '')\n        : ''\n    if (!collectionId.trim() || !slug) continue\n    // Built by the one listing-URL builder, then stored in the map's own\n    // format: no leading slash, which `resolveScreenHref` puts back.\n    next[formatCollectionLinkValue(collectionId)] = collectionListUrl({\n      collectionSlug: slug,\n    }).replace(/^\\/+/, '')\n    // The feed hangs off the same listing (AGL-3118), so it follows the same\n    // rename and disappears with the same collection.\n    next[formatFeedLinkValue(collectionId)] = collectionFeedRoutePath(slug)\n  }\n  for (const [key, path] of entries) {\n    // Only well-formed entry keys, stored under their canonical spelling: this\n    // source must not be able to plant a screen id or a listing key the other\n    // sources own.\n    const entry = parseEntryLinkValue(key)\n    if (!entry) continue\n    const normalized =\n      typeof path === 'string' ? path.trim().replace(/^\\/+|\\/+$/g, '') : ''\n    if (!normalized) continue\n    next[formatEntryLinkValue(entry.collectionId, entry.entryId)] = normalized\n  }\n  for (const [id, path] of overrides) {\n    // A collection slug (`blog`) arrives in the map's own format already, but\n    // the same fact is spelled `/blog` in half the places it is read from, and\n    // a stored `/blog` would resolve to `//blog` — an absolute URL to the host\n    // `blog`, i.e. off the site entirely.\n    const normalized =\n      typeof path === 'string' && path !== SCREEN_ROOT_PATH\n        ? path.replace(/^\\/+|\\/+$/g, '')\n        : path\n    if (!normalized) continue\n    next[id] = normalized\n  }\n  return next\n}\n\n/**\n * `kind` of a besigner email document (AGL-395): a screen authored on the\n * Emails page and sent by a campaign, never served at a URL.\n */\nexport const SCREEN_KIND_EMAIL = 'email'\n\n/**\n * `kind` of a collection ENTRY template (AGL-1400): a screen that composes\n * `/{collection}/{entry}` for every entry and has no address of its own.\n *\n * The value exists so that \"is this screen a page?\" stops being a JOIN.\n * Four issues (AGL-1173, AGL-1383, AGL-1387, AGL-1390) were the same sentence\n * at different depths because the answer was derived from a mutable field on a\n * DIFFERENT document — a collection's `entryScreenId` — and every new way to\n * edit that pointer was a new bypass of `screensPerHost`. Here the fact is a\n * property of the screen, server-stamped by /api/hosts/screens and frozen in\n * the rules exactly as `kind: 'email'` has been since AGL-1383.\n *\n * NOT a collection's LIST template. `/{collectionSlug}` renders that exact\n * screen with its entries, so it is a designed reachable page and AGL-1387\n * made it count; converting one would take the page off the site.\n */\nexport const SCREEN_KIND_TEMPLATE = 'template'\n\n/**\n * `kind` of a designed ERROR screen (AGL-2092): the screen a host assigns to\n * one of `errorScreens`' four status slots, rendered on paths that did not\n * match — and so, like an entry template, at no address of its own.\n *\n * the decision on 2026-08-18 was that these must not spend the plan's screen\n * allowance, for the reason AGL-1173 excluded an entry template: the governing\n * question is whether the screen occupies a URL of its own, and a 404 body does\n * not. (A collection's LIST template does — `/{collectionSlug}` renders that\n * exact screen — which is why AGL-1387 left it counting.)\n *\n * ## This value does NOT get `kind: 'template'`'s trust\n *\n * `billableScreenIds` short-circuits on `SCREEN_KIND_TEMPLATE` BEFORE it\n * consults the routing map, because a template is routed on purpose. An error\n * screen is not, so it deliberately falls through to the ordinary rule and\n * **the routing map outranks this field**: a screen still published at an\n * address of its own counts, whatever it says about itself. That is the whole\n * migration story for the error screens that already exist — see\n * {@link ERROR_SCREEN_MAX_PER_HOST}.\n *\n * Stamped only by /api/hosts/screens, as part of binding the screen to a slot,\n * and frozen against the client by the same rule that has frozen `kind` since\n * AGL-1383. Nothing about that is new for this value; what IS new is that the\n * stamp is BOUNDED, because unlike a template there is no natural limit on how\n * many screens somebody would like to declare as error pages.\n */\nexport const SCREEN_KIND_ERROR = 'error'\n\n/**\n * How many screens one host may hold with `kind: 'error'` (AGL-2092).\n *\n * An exclusion the metered party can ask for is a free-screen generator unless\n * something bounds it, and the four bindings in `HostErrorScreens` are the\n * bound: at most one exempt screen per error slot. It is `.length` of the slot\n * list rather than a literal `4` so the two can never disagree.\n *\n * Checked in TWO places, and the second is the one that makes the number true\n * (AGL-2093). At the moment of the STAMP, against the post-state — the\n * AGL-1390 shape, which produces the refusal worth reading because it can name\n * the four slots. And inside `billableScreenIds` itself, where a live error\n * screen past this bound is counted as an ordinary page: the stamp is not the\n * only writer, and a crafted import bundle carrying `kind: 'error'` on all 200\n * of its screens passed no bound at all until the rule owned one. An exclusion\n * enforced only at the write paths somebody remembered is the sentence this arc\n * has now repeated six times.\n *\n * The tempting alternative is to enforce \"bound to a slot\" as an\n * invariant, promoting a screen back to a page whenever its slot is cleared;\n * that is AGL-1390's refuse-the-clear bug wearing a different hat, because\n * promotion raises the count and a host at its cap could then never unassign an\n * error screen. So clearing a slot is always allowed and leaves the screen an\n * error screen — unbilled, unrouted, and one deliberate click from being a page\n * again — and what is bounded is how many of them can exist at once.\n */\nexport const ERROR_SCREEN_MAX_PER_HOST = HOST_ERROR_SCREEN_SLOTS.length\n\n/** The two self-describing fields {@link screenClaimsToBeAPage} reads. */\nexport interface ScreenPageClaim {\n  kind?: string\n  deletedAt?: unknown\n}\n\n/**\n * Whether a screen document claims to be a page of the site at all (AGL-1383).\n *\n * Four things say it is not: `deletedAt` (soft-deleted — delete stamps the\n * field rather than removing the doc), `kind: 'email'` (an Emails-page\n * document, which has no URL and is rendered only by the campaign sender,\n * straight off the doc), `kind: 'template'` (a collection entry template,\n * which composes `/{collection}/{entry}` and has no address of its own —\n * AGL-1400) and `kind: 'error'` (a screen assigned to one of the host's four\n * error slots, rendered on paths that matched nothing — AGL-2092). All four\n * are also the exclusions `countBillableScreens` subtracts before enforcing\n * `screensPerHost`, and since AGL-1400 they are the WHOLE of that subtraction:\n * the count reads no other collection.\n *\n * Adding the fourth needed no edit to `billableScreenIds` and no edit to\n * `nonPageScreenIds`, which is the property AGL-1439 wrote them for: the\n * routing-map override applies to a new non-page `kind` by default, and the\n * flat infrastructure cap is the complement, so there is no second list to\n * remember. Only `kind: 'template'` is named anywhere else, because only it\n * opts OUT of the routing-map override.\n *\n * That is exactly why this is ONE function with TWO callers rather than two\n * matching filters. Both fields are ordinary client-writable fields on\n * `hosts/{hostId}/screens/{screenId}`, and until AGL-1383 only the count read\n * them: an editor on a Free site could `updateDoc(screenRef, {kind: 'email'})`\n * and the screen stopped counting against the plan while the routing map still\n * pointed at it and the runtime still served it — a live page, for free. An\n * exclusion is only sound if an excluded screen genuinely is not a page, so the\n * serve path asks this question too, and flipping either field now costs the\n * page instead of the plan.\n *\n * A CLAIM, not the answer, for the two fields a client can still reach: the\n * routing map decides reachability, and `countBillableScreens` trusts\n * `deletedAt` / `kind: 'email'` only for screens the map does not route.\n * `kind: 'error'` is in the client-can-still-reach group for counting purposes\n * even though no client writes it either: an error screen that is ALSO\n * published at an address is a page somebody is using as a page, so the map\n * outranks the stamp and it counts. Serving is the other way round — see\n * `getScreen`, which returns error screens rather than 404ing them, because\n * refusing would break the customer's own designed error page without closing\n * anything (they are already paying for it if it is routed).\n *\n * `kind: 'template'` is the exception, and the reason it can be one is that no\n * client writes it — /api/hosts/screens stamps it, demotion lowers the count\n * and promotion is checked exactly like a create, so there is no toggle to\n * launder. A template is ROUTED on purpose (publishing is how the compose\n * pipeline picks it up), which is why the map cannot be the arbiter for it.\n */\nexport function screenClaimsToBeAPage(\n  screen: ScreenPageClaim | null | undefined,\n): boolean {\n  if (!screen) return false\n  return (\n    screen.deletedAt == null &&\n    screen.kind !== SCREEN_KIND_EMAIL &&\n    screen.kind !== SCREEN_KIND_TEMPLATE &&\n    screen.kind !== SCREEN_KIND_ERROR\n  )\n}\n\n/**\n * One screen, reduced to the two things {@link billableScreenIds} asks about.\n *\n * Rows rather than a query (AGL-1390) because the enforcement points ask about\n * a state that does not exist yet: a promotion is checked against the count it\n * WOULD leave behind. A function that does its own reads can only answer for\n * the present. `readScreenSources` in /api/hosts/resources is the reader.\n */\nexport interface BillableScreenSource {\n  id: string\n  kind?: unknown\n  deletedAt?: unknown\n}\n\n/**\n * A host's `screens` routing map (screen id → route path) as\n * `publishScreenRoute` writes it. Only membership is read, never the path.\n */\nexport type ScreenRoutingMap = Record<string, unknown> | null | undefined\n\n/**\n * WHICH screens spend the plan's screen allowance (AGL-1173).\n *\n * The ids rather than the count, because an enforcement point that cannot name\n * the screen it is refusing over is a refusal the person reading it cannot act\n * on.\n *\n * A plain `screens.count()` charged for three things the subscriber never\n * chose to author, and the screens list — which filters them out — then\n * disagreed with the server about how much of the plan was used:\n *\n *  - **Soft-deleted screens.** Delete stamps `deletedAt` rather than\n *    removing the doc, so deleting a screen never freed a slot. On the free\n *    plan (5 screens) that was a dead end with no way out from the UI.\n *  - **Email screens** (`kind: 'email'`), which live on the Emails page and\n *    were already excluded from the list count but not from enforcement.\n *  - **A collection's ENTRY template** — one screen serving every entry at no\n *    URL of its own. Adding a blog cost two of the free plan's five screens\n *    before the first page existed.\n *\n * ## Why it lives HERE, next to the predicate (AGL-2093)\n *\n * It was in /api/hosts/resources, and the console's Screens page — which runs\n * the same rule as a precheck before it lets somebody add a page — could not\n * import it from there (that module reaches `@aglyn/aglyn/server`, which pulls\n * `node:stream` in through the API adapter). So the page restated it, and the\n * restatement drifted: it never learned the error-screen bound below, and on a\n * host holding five `kind: 'error'` screens the console offered room the API\n * then refused. A precheck that warns on a different number than the API\n * enforces is worse than no precheck at all, and a rule that has to be\n * restated to be reused will be restated wrongly eventually. One function, two\n * callers.\n *\n * ## ONE document answers it now (AGL-1400)\n *\n * The third exclusion used to be a JOIN: the count read the `collections`\n * collection and subtracted whatever screen ids the template pointers named.\n * That shape produced four issues in one arc, because the other side of the\n * join is editable and each new way to edit it was a new bypass — AGL-1173\n * created the exclusion, AGL-1383 froze the two fields the screen itself\n * carried, AGL-1387 found the list template was a page after all, and AGL-1390\n * found the pointer could be toggled to mint permanent slots and had to move\n * the write server-side and evaluate the cap against the post-state.\n *\n * Since AGL-1400 an entry template says so on its own document\n * (`kind: 'template'`), stamped by /api/hosts/screens and frozen in the rules\n * exactly as `kind: 'email'` is. So this reads the `screens` collection and\n * nothing else: the pointer is a pointer again, freely writable, and it excuses\n * nothing. `screenClaimsToBeAPage` is the whole rule, which is the property\n * that keeps the count and the serve path (`getScreen`) from ever disagreeing.\n *\n * What did NOT change is what anybody pays. A collection's LIST template stays\n * a page — `/{collectionSlug}` renders that exact screen (AGL-1387) — so it is\n * never stamped and still counts, and an entry template stays excluded\n * (AGL-1173's charge is not reinstated).\n *\n * ## The routing map outranks the document, and ONLY ADDS (AGL-1383, AGL-1445)\n *\n * `deletedAt` and `kind: 'email'` are ordinary client-writable fields on the\n * screen's OWN document, and the party they are subtracted on behalf of is the\n * party being metered. `updateDoc(screenRef, {kind: 'email'})` — one write, no\n * route change — used to take a live page off a Free plan's five and leave it\n * serving, because nothing else read either field. So for those two the\n * document's account of itself is consulted only for screens the routing map\n * does not route: **a routed screen counts, whatever it says about itself**.\n *\n * The converse is NOT true and must not become true, which is AGL-1445's\n * settlement. An unrouted screen with no slug — a draft, or an orphan left\n * behind by an unpublish — serves nothing, and it still counts:\n *\n *  - `screensPerHost` is a CREATE-TIME gate. /api/hosts/resources counts and\n *    refuses; `report-usage` re-measures monthly but RECORDS rather than\n *    enforces. The create is the only door.\n *  - A screen is born unrouted, and publishing is a separate later act — a\n *    client `updateDoc` on the host's `screens` map (`publishScreenRoute`),\n *    gated on `canPublishHostContent` and on nothing else.\n *\n * So subtracting unrouted screens would not make the count fairer, it would\n * make every create free — the new document is unrouted by construction — and\n * leave the publishes that follow ungated. A Free site would hold unlimited\n * pages. AGL-1445's option 2 (server-stamping a non-page `kind` on orphans by\n * a sweep) lands in the same place unless the promotion BACK passes a gate,\n * and for an orphan the promotion is the publish. `kind: 'template'` can be\n * trusted precisely because its promotion is `convertScreenKind`, checked\n * exactly like a create; there is no equivalent door in front of the routing\n * map. The price is one slot until somebody deletes the orphan, which is one\n * click and which the Screens page lists like any other row —\n * `unrouted-screen-counts.spec.ts` pins it at the enforcement point.\n *\n * `kind: 'template'` is deliberately outside the map's override, and it is the\n * one value that can be. A template is routed ON PURPOSE — publishing is how\n * the compose pipeline picks it up, and AGL-1267 drops it from routing when the\n * request arrives — so the map cannot be the arbiter for it. What makes\n * trusting it safe is that no client writes it: the demotion that sets it\n * always succeeds (it lowers the count) and the promotion that clears it is\n * checked exactly like a create (it raises it), so there is no toggle to run a\n * loop through.\n */\nexport function billableScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n  routingMap?: ScreenRoutingMap,\n): Set<string> {\n  const routed = new Set(Object.keys(routingMap ?? {}))\n  const exemptErrors = exemptErrorScreenIds(screens)\n  const billable = new Set<string>()\n  for (const screen of screens) {\n    if (screen.kind === SCREEN_KIND_TEMPLATE) continue\n    const claimsToBeAPage = screenClaimsToBeAPage({\n      kind: screen.kind as string,\n      deletedAt: screen.deletedAt,\n    })\n    // A `kind: 'error'` screen OVER the slot bound is a page again (AGL-2093).\n    const exemptionSpent =\n      screen.kind === SCREEN_KIND_ERROR &&\n      screen.deletedAt == null &&\n      !exemptErrors.has(screen.id)\n    if (routed.has(screen.id) || claimsToBeAPage || exemptionSpent) {\n      billable.add(screen.id)\n    }\n  }\n  return billable\n}\n\n/**\n * The live `kind: 'error'` screens whose billing exemption actually HOLDS —\n * at most {@link ERROR_SCREEN_MAX_PER_HOST} of them (AGL-2093).\n *\n * ## Why the bound lives here and not at one endpoint\n *\n * AGL-2092 introduced the exemption and bounded it at four — one per\n * `HostErrorScreens` slot — by checking the post-state at the moment\n * /api/hosts/screens STAMPS the kind. That made the claim true of the assign\n * route and false end to end, because the stamp is not the only writer:\n * `SITE_EXPORT_FIELDS.screens` carries `kind`, so a hand-edited bundle could\n * declare `kind: 'error'` on all 200 of its screens and /api/hosts/import\n * excluded every one of them from `screensPerHost` — never passing the bound,\n * never binding a slot. N unbilled screens, one file.\n *\n * That is the arc's fifth repetition of one sentence (AGL-1173, AGL-1383,\n * AGL-1387, AGL-1390, AGL-1400): *an exclusion enforced at a write path is\n * enforced only at the write paths somebody remembered.* So the bound moves\n * into the rule the enforcement points SHARE. However a screen came to say\n * `kind: 'error'` — assign, import, or the next writer — a host gets four\n * unbilled ones and the rest spend the plan's allowance exactly as pages do.\n *\n * ## Which four\n *\n * The lowest ids, sorted. The choice is arbitrary and the DETERMINISM is not:\n * every enforcement point models a post-state by re-running this over a\n * different row set, and a rule that picked \"the first four encountered\" would\n * hand two callers different answers for the same host. The SIZE of the exempt\n * set never depends on the order — it is `min(live errors, 4)` — so only which\n * ids a refusal message names can move, never whether one is refused.\n *\n * Tombstones are excluded for `nonPageScreenIds`' reason: a cap counting\n * soft-deleted rows is AGL-1173's bug one cap over, where deleting an error\n * screen never frees its slot.\n *\n * The stamp-time bound in /api/hosts/screens is deliberately KEPT. It is the\n * better refusal — it names the four slots and arrives before the write — and\n * this is the backstop under it, so no writer can mint a fifth unbilled error\n * screen even by a path that never consults it.\n */\nexport function exemptErrorScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n): Set<string> {\n  const live: Array<string> = []\n  for (const screen of screens) {\n    if (screen.kind !== SCREEN_KIND_ERROR) continue\n    if (screen.deletedAt != null) continue\n    live.push(screen.id)\n  }\n  if (live.length <= ERROR_SCREEN_MAX_PER_HOST) return new Set(live)\n  return new Set(live.sort().slice(0, ERROR_SCREEN_MAX_PER_HOST))\n}\n\n/**\n * The screens the flat platform cap bounds (AGL-1399, AGL-1439): LIVE documents\n * that are not billable pages — the exact complement of {@link billableScreenIds}.\n *\n * ## Why the complement, and not `kind === 'email' || kind === 'template'`\n *\n * Both issues are one sentence — *a `kind` value that excludes a document from\n * billing, declarable by the metered party* — and a cap that enumerated the two\n * values would be correct until the third arrived, which is how this arc has\n * already gone four times (AGL-1173, AGL-1383, AGL-1387, AGL-1390). Written as\n * the complement, a new non-page `kind` is bounded by the act of adding it to\n * `screenClaimsToBeAPage`: there is no second list to remember.\n *\n * Two properties fall out of taking the complement rather than negating the\n * predicate directly:\n *\n *  - **A soft-deleted screen is in NEITHER set.** Delete stamps `deletedAt`\n *    rather than removing the doc, and a cap that counted tombstones would be\n *    the AGL-1173 bug one cap over — deleting an email document would never free\n *    a slot, and a host at the cap could never author another.\n *  - **A ROUTED email document counts once, against the plan.** The routing map\n *    outranks the document (AGL-1383), so such a screen is a page somebody is\n *    already paying for; charging it to the infrastructure cap as well would be\n *    counting one document twice. The two sets partition the live screens.\n *\n * Taking the complement is also what makes AGL-2093's bound arrive here for\n * free: an error screen past `ERROR_SCREEN_MAX_PER_HOST` becomes billable\n * above, so it leaves this set in the same act. The partition holds — every\n * live screen is in exactly one of the two — and the fifth error screen is\n * bounded by the PLAN rather than by the flat 5,000, which is the stronger of\n * the two numbers on every finite tier.\n */\nexport function nonPageScreenIds(\n  screens: ReadonlyArray<BillableScreenSource>,\n  routingMap?: ScreenRoutingMap,\n): Set<string> {\n  const billable = billableScreenIds(screens, routingMap)\n  const nonPage = new Set<string>()\n  for (const screen of screens) {\n    if (screen.deletedAt != null) continue\n    if (!billable.has(screen.id)) nonPage.add(screen.id)\n  }\n  return nonPage\n}\n\n/**\n * How many LIVE screen documents a host may hold that are NOT billable pages —\n * email documents, entry templates, and whatever non-page `kind` comes next\n * (AGL-1399, AGL-1439).\n *\n * ## Why a flat number and not a plan dimension\n *\n * Every exclusion `screenClaimsToBeAPage` names is declared by the party being\n * metered: `kind: 'email'` is on the create allow-list because the email\n * composer must send it, and AGL-1400 gave `kind: 'template'` the same\n * billing-excluding meaning. So `POST /api/hosts/resources` with\n * `kind: 'email'` created a document that no cap counted, without limit, on a\n * free plan — unbounded Firestore documents rather than a bypass of anything we\n * sell. AGL-1439 is the same sentence one value over, and a cap enumerating the\n * two values would leave the hole open for the third.\n *\n * The shape is `WEBHOOK_MAX_PER_HOST`'s (AGL-1360): no `OrgEntitlements` key, no\n * variation by plan, counted from a server read at the create path. An\n * `emailDocumentsPerHost` would have been a **pricing** decision — a number the\n * price list has to explain and support has to defend — for a limit whose only\n * job is to bound infrastructure. This is not the charge AGL-1173 removed and it\n * does not reinstate it: nothing here is billable, and `screensPerHost` counts\n * exactly what it counted yesterday.\n *\n * ## Why 5,000\n *\n * Sized to the heaviest library anybody could plausibly author, not to what\n * exists: production's busiest host holds FOUR non-page screens (one email,\n * three entry templates) across five hosts, so any bar sized to today's data\n * would be meaningless. The real quantity is campaigns, which accumulate and are\n * never deleted — a DAILY newsletter reaches 5,000 after thirteen years, and a\n * thrice-weekly one after thirty-two. Entry templates contribute one per\n * collection, so tens at the outside. Nothing a real customer does approaches\n * this, which is the property that matters: the failure mode of a too-low flat\n * cap is blocking legitimate work with an error the price list cannot explain.\n *\n * A cheaper bound is not worth much either. What the number defends against is a\n * script in a loop, and a loop stopped at 5,000 documents is stopped. It also\n * bounds the cost of the count itself — `countBillableScreens` scans the screens\n * collection on every create at one billed read per document (AGL-1440), and\n * before this cap that scan had no ceiling at all.\n */\nexport const NON_PAGE_SCREEN_MAX_PER_HOST = 5000\n"],"names":["HOST_ERROR_SCREEN_SLOTS","collectionListUrl","ENTRY_PREVIEW_ROUTE_SEGMENT","LEAVING_NOTICE_ROUTE_SEGMENT","PLATFORM_BRAND_NAME","formatCollectionLinkValue","formatEntryLinkValue","formatFeedLinkValue","parseEntryLinkValue","SCREEN_ROOT_PATH","normalizeScreenSlug","input","trimmed","trim","undefined","segment","toLowerCase","replace","RESERVED_SCREEN_ROUTE_SEGMENTS","reservedScreenRouteSegment","path","first","split","includes","reservedScreenRouteMessage","screenSlugHasPathSeparator","SCREEN_SLUG_PATH_SEPARATOR_MESSAGE","MAX_SCREEN_DEPTH","composeScreenRoutePath","screenId","screensById","segments","visited","Set","currentId","has","size","add","screen","slug","parentId","unshift","length","join","collectScreenDescendantIds","childrenByParent","Map","id","Object","entries","siblings","get","push","set","result","queue","shift","wouldCreateScreenCycle","nextParentId","buildScreenRouteEntries","routingMap","options","publish","ids","routed","findScreenIdByRoutePath","screens","entry","find","value","blockingRouteOwner","defaultHomeScreenId","owner","screenRoutePathToUrl","ownScreenSlugFromRoutePath","filter","Boolean","collectionFeedRoutePath","collectionSlug","listing","collectionEntryRoutePath","entrySlug","linkableScreenRoutes","sources","routedElsewhere","unrouted","collectionListings","entryRoutes","overrides","listings","next","collectionId","key","normalized","entryId","SCREEN_KIND_EMAIL","SCREEN_KIND_TEMPLATE","SCREEN_KIND_ERROR","ERROR_SCREEN_MAX_PER_HOST","screenClaimsToBeAPage","deletedAt","kind","billableScreenIds","keys","exemptErrors","exemptErrorScreenIds","billable","claimsToBeAPage","exemptionSpent","live","sort","slice","nonPageScreenIds","nonPage","NON_PAGE_SCREEN_MAX_PER_HOST"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,uBAAuB,QAAwB,yBAAe;AACvE,SAASC,iBAAiB,QAAQ,0BAAsB;AACxD,SAASC,2BAA2B,QAAQ,0BAAsB;AAClE,SAASC,4BAA4B,QAAQ,sBAAkB;AAC/D,SAASC,mBAAmB,QAAQ,sBAAkB;AACtD,SACEC,yBAAyB,EACzBC,oBAAoB,EACpBC,mBAAmB,EACnBC,mBAAmB,QACd,yBAAqB;AAE5B;;;;;;CAMC,GACD,OAAO,MAAMC,mBAAmB,IAAG;AAEnC;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,oBACdC,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,SAAS,OAAOE;IACrB,IAAIF,YAAYH,kBAAkB,OAAOA;IAEzC,MAAMM,UAAUH,QACbI,WAAW,GACXC,OAAO,CAAC,cAAc,IACtBA,OAAO,CAAC,QAAQ,KAChBA,OAAO,CAAC,gBAAgB,IACxBA,OAAO,CAAC,UAAU,KAClBA,OAAO,CAAC,YAAY;IAEvB,OAAOF,WAAWD;AACpB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GACD,OAAO,MAAMI,iCAAoD;IAC/D;IACA;IACA;IACAhB;IACA;IACA;IACA;IACAC;CACD,CAAA;AAED;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASgB,2BACdC,IAA+B;IAE/B,IAAI,CAACA,QAAQA,SAASX,kBAAkB,OAAOK;IAC/C,MAAM,CAACO,MAAM,GAAGD,KAAKH,OAAO,CAAC,QAAQ,IAAIK,KAAK,CAAC;IAC/C,OAAOJ,+BAA+BK,QAAQ,CAACF,SAASA,QAAQP;AAClE;AAEA;;;;;CAKC,GACD,OAAO,SAASU,2BAA2BT,OAAe;IACxD,OAAO,CAAC,EAAE,EAAEA,QAAQ,iCAAiC,EAAEX,oBAAoB,yBAAyB,CAAC;AACvG;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASqB,2BACdd,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,WAAWA,YAAYH,kBAAkB,OAAO;IACrD,OAAOG,QAAQK,OAAO,CAAC,cAAc,IAAIM,QAAQ,CAAC;AACpD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMG,qCACX,2EACA,sBAAqB;AAQvB,0EAA0E,GAC1E,MAAMC,mBAAmB;AAEzB;;;;;;;CAOC,GACD,OAAO,SAASC,uBACdC,QAAmB,EACnBC,WAA2D;IAE3D,MAAMC,WAAqB,EAAE;IAC7B,MAAMC,UAAU,IAAIC;IACpB,IAAIC,YAAmCL;IAEvC,MAAOK,UAAW;QAChB,IAAIF,QAAQG,GAAG,CAACD,cAAcF,QAAQI,IAAI,IAAIT,kBAAkB;YAC9D,OAAOb;QACT;QACAkB,QAAQK,GAAG,CAACH;QACZ,MAAMI,SAASR,WAAW,CAACI,UAAU;QACrC,IAAI,EAACI,0BAAAA,OAAQC,IAAI,GAAE,OAAOzB;QAC1B,IAAIwB,OAAOC,IAAI,KAAK9B,kBAAkB;YACpC,sEAAsE;YACtE,wEAAwE;YACxE,IAAIyB,cAAcL,YAAYS,OAAOE,QAAQ,EAAE,OAAO1B;QACxD,OAAO;YACLiB,SAASU,OAAO,CAACH,OAAOC,IAAI;QAC9B;QACAL,YAAYI,OAAOE,QAAQ;IAC7B;IAEA,IAAI,CAACT,SAASW,MAAM,EAAE;YACbZ;QAAP,OAAOA,EAAAA,wBAAAA,WAAW,CAACD,SAAS,qBAArBC,sBAAuBS,IAAI,MAAK9B,mBACnCA,mBACAK;IACN;IACA,OAAOiB,SAASY,IAAI,CAAC;AACvB;AAEA;;;;CAIC,GACD,OAAO,SAASC,2BACdf,QAAmB,EACnBC,WAA2D;QAUxCe;IARnB,MAAMA,mBAAmB,IAAIC;IAC7B,KAAK,MAAM,CAACC,IAAIT,OAAO,IAAIU,OAAOC,OAAO,CAACnB,aAAc;YAErCe;QADjB,IAAI,EAACP,0BAAAA,OAAQE,QAAQ,GAAE;QACvB,MAAMU,YAAWL,yBAAAA,iBAAiBM,GAAG,CAACb,OAAOE,QAAQ,aAApCK,yBAAyC,EAAE;QAC5DK,SAASE,IAAI,CAACL;QACdF,iBAAiBQ,GAAG,CAACf,OAAOE,QAAQ,EAAEU;IACxC;IACA,MAAMI,SAAsB,EAAE;IAC9B,MAAMC,QAAQ;YAAKV,wBAAAA,iBAAiBM,GAAG,CAACtB,qBAArBgB,wBAAkC,EAAE;KAAE;IACzD,MAAOU,MAAMb,MAAM,CAAE;YAIJG;QAHf,MAAME,KAAKQ,MAAMC,KAAK;QACtB,IAAIF,OAAO/B,QAAQ,CAACwB,KAAK;QACzBO,OAAOF,IAAI,CAACL;QACZQ,MAAMH,IAAI,KAAKP,yBAAAA,iBAAiBM,GAAG,CAACJ,eAArBF,yBAA4B,EAAE;IAC/C;IACA,OAAOS;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASG,uBACd5B,QAAmB,EACnB6B,YAAmC,EACnC5B,WAA2D;IAE3D,IAAI,CAAC4B,cAAc,OAAO;IAC1B,IAAIA,iBAAiB7B,UAAU,OAAO;IACtC,OAAOe,2BAA2Bf,UAAUC,aAAaP,QAAQ,CAC/DmC;AAEJ;AA4BA;;;;;;;;CAQC,GACD,OAAO,SAASC,wBACd9B,QAAmB,EACnBC,WAA2D,EAC3D8B,UAAwD,EACxDC,UAA0C,CAAC,CAAC;IAE5C,MAAM,EAAEC,UAAU,IAAI,EAAE,GAAGD;IAC3B,MAAMZ,UAA4C,CAAC;IACnD,MAAMc,MAAM;QAAClC;WAAae,2BAA2Bf,UAAUC;KAAa;IAC5E,KAAK,MAAMiB,MAAMgB,IAAK;QACpB,MAAMC,SAASJ,CAAAA,8BAAAA,UAAY,CAACb,GAAG,MAAKjC;QACpC,MAAMM,OAAOQ,uBAAuBmB,IAAIjB;QACxC,IAAIV,MAAM;YACR,mEAAmE;YACnE,IAAI4C,UAAUF,SAASb,OAAO,CAACF,GAAG,GAAG3B;QACvC,OAAO,IAAI4C,QAAQf,OAAO,CAACF,GAAG,GAAG;IACnC;IACA,OAAOE;AACT;AAEA;;;CAGC,GACD,OAAO,SAASgB,wBACdC,OAAqD,EACrD9C,IAAY;IAEZ,IAAI,CAAC8C,SAAS,OAAOpD;IACrB,MAAMqD,QAAQnB,OAAOC,OAAO,CAACiB,SAASE,IAAI,CAAC,CAAC,GAAGC,MAAM,GAAKA,UAAUjD;IACpE,OAAO+C,yBAAAA,KAAO,CAAC,EAAE;AACnB;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASG,mBACdJ,OAAqD,EACrD9C,IAAY,EACZmD,mBAAmC;IAEnC,MAAMC,QAAQP,wBAAwBC,SAAS9C;IAC/C,IAAIoD,SAASpD,SAASX,oBAAoB+D,UAAUD,qBAAqB;QACvE,OAAOzD;IACT;IACA,OAAO0D;AACT;AAEA,mFAAmF,GACnF,OAAO,SAASC,qBAAqBrD,IAAY;IAC/C,OAAOA,SAASX,mBAAmBA,mBAAmB,CAAC,CAAC,EAAEW,MAAM;AAClE;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASsD,2BACdtD,IAA+B;IAE/B,IAAI,CAACA,MAAM,OAAON;IAClB,IAAIM,SAASX,kBAAkB,OAAOA;IACtC,MAAMsB,WAAWX,KAAKE,KAAK,CAAC,KAAKqD,MAAM,CAACC;IACxC,OAAO7C,QAAQ,CAACA,SAASW,MAAM,GAAG,EAAE;AACtC;AAsCA;;;CAGC,GACD,OAAO,SAASmC,wBAAwBC,cAAsB;IAC5D,MAAMC,UAAU9E,kBAAkB;QAAE6E;IAAe,GAAG7D,OAAO,CAAC,cAAc;IAC5E,OAAO,GAAG8D,QAAQ,QAAQ,CAAC;AAC7B;AAEA;;;;;CAKC,GACD,OAAO,SAASC,yBACdF,cAAsB,EACtBG,SAAiB;IAEjB,MAAMF,UAAU9E,kBAAkB;QAAE6E;IAAe,GAAG7D,OAAO,CAAC,cAAc;IAC5E,OAAO,GAAG8D,QAAQ,CAAC,EAAEE,UAAUpE,IAAI,GAAGI,OAAO,CAAC,cAAc,KAAK;AACnE;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCC,GACD,OAAO,SAASiE,qBACdhB,OAAqD,EACrDiB,UAAsC,CAAC,CAAC;IAExC,MAAM,EAAEC,eAAe,EAAEC,QAAQ,EAAEC,kBAAkB,EAAEC,WAAW,EAAE,GAAGJ;IACvE,MAAMK,YAAYxC,OAAOC,OAAO,CAACmC,0BAAAA,kBAAmB,CAAC;IACrD,MAAMK,WAAWzC,OAAOC,OAAO,CAACqC,6BAAAA,qBAAsB,CAAC;IACvD,MAAMrC,UAAUD,OAAOC,OAAO,CAACsC,sBAAAA,cAAe,CAAC;IAC/C,IAAI,CAACrB,WAAW,CAACsB,UAAU9C,MAAM,IAAI,CAAC+C,SAAS/C,MAAM,IAAI,CAACO,QAAQP,MAAM,EAAE;QACxE,OAAO5B;IACT;IACA,MAAM4E,OAAkC,aAAMxB,kBAAAA,UAAW,CAAC;IAC1D,KAAK,MAAMnB,MAAMsC,mBAAAA,WAAY,EAAE,CAAE,OAAOK,IAAI,CAAC3C,GAAG;IAChD,KAAK,MAAM,CAAC4C,cAAcb,eAAe,IAAIW,SAAU;QACrD,MAAMlD,OACJ,OAAOuC,mBAAmB,WACtBA,eAAejE,IAAI,GAAGI,OAAO,CAAC,cAAc,MAC5C;QACN,IAAI,CAAC0E,aAAa9E,IAAI,MAAM,CAAC0B,MAAM;QACnC,qEAAqE;QACrE,iEAAiE;QACjEmD,IAAI,CAACrF,0BAA0BsF,cAAc,GAAG1F,kBAAkB;YAChE6E,gBAAgBvC;QAClB,GAAGtB,OAAO,CAAC,QAAQ;QACnB,yEAAyE;QACzE,kDAAkD;QAClDyE,IAAI,CAACnF,oBAAoBoF,cAAc,GAAGd,wBAAwBtC;IACpE;IACA,KAAK,MAAM,CAACqD,KAAKxE,KAAK,IAAI6B,QAAS;QACjC,2EAA2E;QAC3E,0EAA0E;QAC1E,eAAe;QACf,MAAMkB,QAAQ3D,oBAAoBoF;QAClC,IAAI,CAACzB,OAAO;QACZ,MAAM0B,aACJ,OAAOzE,SAAS,WAAWA,KAAKP,IAAI,GAAGI,OAAO,CAAC,cAAc,MAAM;QACrE,IAAI,CAAC4E,YAAY;QACjBH,IAAI,CAACpF,qBAAqB6D,MAAMwB,YAAY,EAAExB,MAAM2B,OAAO,EAAE,GAAGD;IAClE;IACA,KAAK,MAAM,CAAC9C,IAAI3B,KAAK,IAAIoE,UAAW;QAClC,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,sCAAsC;QACtC,MAAMK,aACJ,OAAOzE,SAAS,YAAYA,SAASX,mBACjCW,KAAKH,OAAO,CAAC,cAAc,MAC3BG;QACN,IAAI,CAACyE,YAAY;QACjBH,IAAI,CAAC3C,GAAG,GAAG8C;IACb;IACA,OAAOH;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMK,oBAAoB,QAAO;AAExC;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,uBAAuB,WAAU;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAMC,oBAAoB,QAAO;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,MAAMC,4BAA4BlG,wBAAwB0C,MAAM,CAAA;AAQvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CC,GACD,OAAO,SAASyD,sBACd7D,MAA0C;IAE1C,IAAI,CAACA,QAAQ,OAAO;IACpB,OACEA,OAAO8D,SAAS,IAAI,QACpB9D,OAAO+D,IAAI,KAAKN,qBAChBzD,OAAO+D,IAAI,KAAKL,wBAChB1D,OAAO+D,IAAI,KAAKJ;AAEpB;AAsBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiGC,GACD,OAAO,SAASK,kBACdpC,OAA4C,EAC5CN,UAA6B;IAE7B,MAAMI,SAAS,IAAI/B,IAAIe,OAAOuD,IAAI,CAAC3C,qBAAAA,aAAc,CAAC;IAClD,MAAM4C,eAAeC,qBAAqBvC;IAC1C,MAAMwC,WAAW,IAAIzE;IACrB,KAAK,MAAMK,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO+D,IAAI,KAAKL,sBAAsB;QAC1C,MAAMW,kBAAkBR,sBAAsB;YAC5CE,MAAM/D,OAAO+D,IAAI;YACjBD,WAAW9D,OAAO8D,SAAS;QAC7B;QACA,2EAA2E;QAC3E,MAAMQ,iBACJtE,OAAO+D,IAAI,KAAKJ,qBAChB3D,OAAO8D,SAAS,IAAI,QACpB,CAACI,aAAarE,GAAG,CAACG,OAAOS,EAAE;QAC7B,IAAIiB,OAAO7B,GAAG,CAACG,OAAOS,EAAE,KAAK4D,mBAAmBC,gBAAgB;YAC9DF,SAASrE,GAAG,CAACC,OAAOS,EAAE;QACxB;IACF;IACA,OAAO2D;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuCC,GACD,OAAO,SAASD,qBACdvC,OAA4C;IAE5C,MAAM2C,OAAsB,EAAE;IAC9B,KAAK,MAAMvE,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO+D,IAAI,KAAKJ,mBAAmB;QACvC,IAAI3D,OAAO8D,SAAS,IAAI,MAAM;QAC9BS,KAAKzD,IAAI,CAACd,OAAOS,EAAE;IACrB;IACA,IAAI8D,KAAKnE,MAAM,IAAIwD,2BAA2B,OAAO,IAAIjE,IAAI4E;IAC7D,OAAO,IAAI5E,IAAI4E,KAAKC,IAAI,GAAGC,KAAK,CAAC,GAAGb;AACtC;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,SAASc,iBACd9C,OAA4C,EAC5CN,UAA6B;IAE7B,MAAM8C,WAAWJ,kBAAkBpC,SAASN;IAC5C,MAAMqD,UAAU,IAAIhF;IACpB,KAAK,MAAMK,UAAU4B,QAAS;QAC5B,IAAI5B,OAAO8D,SAAS,IAAI,MAAM;QAC9B,IAAI,CAACM,SAASvE,GAAG,CAACG,OAAOS,EAAE,GAAGkE,QAAQ5E,GAAG,CAACC,OAAOS,EAAE;IACrD;IACA,OAAOkE;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GACD,OAAO,MAAMC,+BAA+B,KAAI"}

package/src/lib/plugin-manager/first-party-plugins.generated.d.ts

@@ -23,6 +23,7 @@ import type { PluginOrgKeyedCollection } from './plugin-org-erasure';
 import type { ResolvedVideoEmbedProvider } from './video-embed-provider';
 import type { AnalyticsProviderDeclaration } from '../app-utils/analytics-provider';
 import type { InteractionStepDeclaration } from '../app-utils/site-interactions';
+import type { ServerStepDeclaration } from './plugin-server-steps';
 import type { NotificationCategoryDeclaration, NotificationDigestDeclaration } from '../app-utils/notifications';
 export declare const FIRST_PARTY_PLUGINS: readonly FirstPartyPlugin[];
 export declare const PUBLISHED_SITE_IMPACT: Readonly<Record<string, PublishedSiteImpact>>;
@@ -151,6 +152,11 @@ export declare const ANALYTICS_PROVIDERS_DECLARED: readonly AnalyticsProviderDec
  * builder, declared by that plugin (AGL-3080). Core names no plugin step.
  */
 export declare const PLUGIN_INTERACTION_STEPS_DECLARED: readonly InteractionStepDeclaration[];
+/**
+ * Every server step a first-party plugin runs for the automation engine,
+ * declared by that plugin (AGL-3080). Core names no plugin step.
+ */
+export declare const PLUGIN_SERVER_STEPS_DECLARED: readonly ServerStepDeclaration[];
 /**
  * Every first-party element that runs a site function, and the prop naming
  * it, declared by that element's plugin (AGL-3393). Core names no element.

package/src/lib/plugin-manager/first-party-plugins.generated.js

@@ -1208,6 +1208,10 @@ export const PUBLISHED_SITE_IMPACT = {
         }
     }
 ];
+/**
+ * Every server step a first-party plugin runs for the automation engine,
+ * declared by that plugin (AGL-3080). Core names no plugin step.
+ */ export const PLUGIN_SERVER_STEPS_DECLARED = [];
 /**
  * Every first-party element that runs a site function, and the prop naming
  * it, declared by that element's plugin (AGL-3393). Core names no element.