@aglyn/aglyn 1.0.0-beta.252 → 1.0.0-beta.254

package/src/lib/app-utils/screen-slug.js

@@ -0,0 +1,173 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { ENTRY_PREVIEW_ROUTE_SEGMENT } from "./entry-preview-link.js";
+import { LEAVING_NOTICE_ROUTE_SEGMENT } from "./leaving-notice.js";
+import { PLATFORM_BRAND_NAME } from "./platform-brand.js";
+/*
+ * The address rules of a page's slug, in a leaf of their own so the native apps
+ * (which cannot import the routing map's reach into the whole foundation) read
+ * the same answers: `screen-route.ts` re-exports every name below, so no
+ * importer changes. The routing map, tree walks and links stay there.
+ */ /**
+ * Route path of a host's root screen. The tenant matcher joins the catch-all
+ * segments and collapses an empty one to this value (`load-page-data.ts`:
+ * `slugSegments.length ? slugSegments.join('/') : SCREEN_ROOT_PATH`), so the
+ * root is `'/'` and every other path is slash-joined segments WITHOUT a
+ * leading slash (`about`, later `company/about`).
+ */ export const SCREEN_ROOT_PATH = '/';
+/**
+ * Normalizes user slug input into the routing-map path format described on
+ * {@link SCREEN_ROOT_PATH}. `'/'` normalizes to the root path; anything else
+ * becomes a single lowercase url-safe segment.
+ *
+ * Returns `undefined` for EMPTY input and for anything that sanitizes away
+ * (`'###'`) — the two cases are deliberately the same answer, and the caller
+ * decides what it means. In the Screens page's slug field an empty string
+ * means "no address typed"; in a starter template it meant "home". Two
+ * meanings for one value is what made AGL-1575 possible, so this function
+ * refuses to pick one: a caller that wants the root must say `'/'`.
+ *
+ * This docstring used to claim empty input normalized to the root, which the
+ * code has never done (see the spec, which asserts the `undefined`). A fix
+ * written against the docstring instead of the behaviour would have shipped
+ * broken; if you are here to make the code match the comment, do not.
+ */ export function normalizeScreenSlug(input) {
+    const trimmed = (input != null ? input : '').trim();
+    if (!trimmed) return undefined;
+    if (trimmed === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH;
+    const segment = trimmed.toLowerCase().replace(/^\/+|\/+$/g, '').replace(/\s+/g, '-').replace(/[^a-z0-9-_]/g, '').replace(/-{2,}/g, '-').replace(/^-+|-+$/g, '');
+    return segment || undefined;
+}
+/**
+ * Route segments the published site CANNOT serve, whatever the routing map
+ * says (AGL-2076).
+ *
+ * Every entry was measured against production on 2026-08-19 with a fresh
+ * `x-vercel-cache: MISS`, because a stale negative always passes. Two
+ * mechanisms, both of which resolve ahead of `[host]/[scheme]/[[...slug]]`:
+ *
+ *  - `404`, `500` — Next emits `pages/404.html` and `pages/500.html` even for
+ *    an app-router-only build, and the deployed filesystem answers them as
+ *    static files (`content-disposition: inline; filename="404"`,
+ *    `accept-ranges`, an `etag`, and no `x-nextjs-prerender`). The tenant
+ *    middleware's own CSP headers are on those responses, so the middleware
+ *    ran and its rewrite still lost. There is no rewrite this app can write
+ *    that beats them, which is why the honest fix is to refuse the slug at
+ *    authoring time rather than to keep promising an address that is dead.
+ *  - `search`, `api`, `_next`, `_static` — routes and exclusions the tenant
+ *    app owns. `/search` matches `app/[host]/[scheme]/search`; the other three are the
+ *    middleware matcher's exclusions, so no host rewrite happens at all and
+ *    the path is parsed as `[host]` with an empty slug.
+ *  - `aglyn-preview` — the same mechanism as `search`, one route over
+ *    (AGL-3205). The live-site preview of an unpublished collection entry is
+ *    a rewrite to `app/[host]/[scheme]/aglyn-preview/[...slug]`, because it
+ *    must be a DIFFERENT Next route from the ISR-cached catch-all; a static
+ *    folder wins over the optional catch-all beside it, so `/aglyn-preview/x`
+ *    would reach the preview page and 404 rather than render a screen. The
+ *    bare `/aglyn-preview` would in fact still serve — the preview route's
+ *    catch-all is required, not optional — and it is reserved anyway for the
+ *    reason given below about child paths: a child's path is composed from
+ *    its parent's slug, and this rule refuses that slug.
+ *  - `_aglyn` — the platform's own pages on every site, the leaving notice
+ *    at `/_aglyn/leaving` first (AGL-3452). The middleware rewrites that path
+ *    to an api route before the catch-all could see it.
+ *
+ * NOT reserved, and deliberately so, because measuring found them fine:
+ * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the
+ * four designed error screens have always been viewable at their slugs, which
+ * is what made the `404` case look like a Next.js defect), and `index`.
+ *
+ * `fonts` and `examples` USED to be dead for the third reason and are not
+ * here: they were exclusions inherited from the Vercel platforms starter kit
+ * for directories `apps/tenant/public` has never contained. They are given
+ * back rather than reserved — see the matcher in `apps/tenant/middleware.ts`.
+ */ export const RESERVED_SCREEN_ROUTE_SEGMENTS = [
+    '404',
+    '500',
+    'search',
+    ENTRY_PREVIEW_ROUTE_SEGMENT,
+    'api',
+    '_next',
+    '_static',
+    LEAVING_NOTICE_ROUTE_SEGMENT
+];
+/**
+ * The reserved segment a routing-map path would collide with, or `undefined`
+ * when the path is servable. The segment rather than a boolean, so a refusal
+ * can name what it is refusing over.
+ *
+ * Reads the FIRST segment only. For `api`/`_next`/`_static` that is exactly
+ * right — the middleware excludes the whole subtree, so `api/docs` is as dead
+ * as `api`. For `404`/`500`/`search` it over-refuses in principle (`/404/why`
+ * would serve), and that is deliberate: a child path is composed from its
+ * PARENT's slug, the parent would have to hold `404`, and this same rule
+ * refuses that slug wherever one is typed. A second list to express a case
+ * that cannot arise would be a second list to keep correct.
+ *
+ * Takes a composed routing-map path (`about`, `company/about`, `'/'`), not a
+ * raw slug field — `'/'` is the home screen and is never reserved.
+ */ export function reservedScreenRouteSegment(path) {
+    if (!path || path === SCREEN_ROOT_PATH) return undefined;
+    const [first] = path.replace(/^\/+/, '').split('/');
+    return RESERVED_SCREEN_ROUTE_SEGMENTS.includes(first) ? first : undefined;
+}
+/**
+ * The refusal an author reads when {@link reservedScreenRouteSegment} names a
+ * segment. One sentence, in one place, because the Screens page, the version
+ * view and the besigner all have to say the same thing — three surfaces
+ * wording a platform constraint three ways is how AGL-2093's precheck drifted.
+ */ export function reservedScreenRouteMessage(segment) {
+    return `"/${segment}" is a reserved address on every ${PLATFORM_BRAND_NAME} site — pick another slug`;
+}
+/**
+ * Does a raw slug value carry a path separator the one segment it describes
+ * cannot hold (AGL-2572)?
+ *
+ * {@link normalizeScreenSlug} answers with a SINGLE segment, and it gets there
+ * by deleting every character outside `[a-z0-9-_]` — an interior `/` included.
+ * Whitespace becomes a `-`, but a `/` becomes nothing at all, so
+ * `alternatives/webflow` normalizes to `alternativeswebflow` and the two words
+ * are stored glued. Nothing about that is visible: the field accepts the
+ * keystroke, the composed path reads plausibly, and the screen ends up
+ * answering an address nobody typed. Two screens on `aglyn-marketing` carry a
+ * slug of that shape.
+ *
+ * So the separator is a question a slug field asks BEFORE normalizing, and the
+ * answer is a refusal rather than a silent repair — the caller cannot know
+ * which segment the author meant, and guessing is how the glue happened.
+ *
+ * LEADING and TRAILING slashes are not separators here. `normalizeScreenSlug`
+ * strips them deliberately (`/about/` → `about`), an author typing an address
+ * writes them without meaning a hierarchy, and refusing them would reject a
+ * value the normalizer has always handled correctly. `'/'` alone is the home
+ * page and is never a separator.
+ */ export function screenSlugHasPathSeparator(input) {
+    const trimmed = (input != null ? input : '').trim();
+    if (!trimmed || trimmed === SCREEN_ROOT_PATH) return false;
+    return trimmed.replace(/^\/+|\/+$/g, '').includes('/');
+}
+/**
+ * The refusal an author reads when {@link screenSlugHasPathSeparator} answers
+ * true. One sentence, in one place, for the same reason
+ * {@link reservedScreenRouteMessage} is: the Screens page, the version view
+ * and the besigner all take a slug, and a constraint worded three ways drifts
+ * into three different constraints.
+ *
+ * It names the alternative, because a `/` in this field almost always means
+ * "nest me" and the hierarchy is what actually composes the longer path.
+ */ export const SCREEN_SLUG_PATH_SEPARATOR_MESSAGE = 'A slug is one path segment — remove the "/" and nest the page under a ' + 'parent page instead';
+
+//# sourceMappingURL=screen-slug.js.map

package/src/lib/app-utils/screen-slug.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/screen-slug.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ENTRY_PREVIEW_ROUTE_SEGMENT } from './entry-preview-link'\nimport { LEAVING_NOTICE_ROUTE_SEGMENT } from './leaving-notice'\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\n\n/*\n * The address rules of a page's slug, in a leaf of their own so the native apps\n * (which cannot import the routing map's reach into the whole foundation) read\n * the same answers: `screen-route.ts` re-exports every name below, so no\n * importer changes. The routing map, tree walks and links stay there.\n */\n\n/**\n * Route path of a host's root screen. The tenant matcher joins the catch-all\n * segments and collapses an empty one to this value (`load-page-data.ts`:\n * `slugSegments.length ? slugSegments.join('/') : SCREEN_ROOT_PATH`), so the\n * root is `'/'` and every other path is slash-joined segments WITHOUT a\n * leading slash (`about`, later `company/about`).\n */\nexport const SCREEN_ROOT_PATH = '/'\n\n/**\n * Normalizes user slug input into the routing-map path format described on\n * {@link SCREEN_ROOT_PATH}. `'/'` normalizes to the root path; anything else\n * becomes a single lowercase url-safe segment.\n *\n * Returns `undefined` for EMPTY input and for anything that sanitizes away\n * (`'###'`) — the two cases are deliberately the same answer, and the caller\n * decides what it means. In the Screens page's slug field an empty string\n * means \"no address typed\"; in a starter template it meant \"home\". Two\n * meanings for one value is what made AGL-1575 possible, so this function\n * refuses to pick one: a caller that wants the root must say `'/'`.\n *\n * This docstring used to claim empty input normalized to the root, which the\n * code has never done (see the spec, which asserts the `undefined`). A fix\n * written against the docstring instead of the behaviour would have shipped\n * broken; if you are here to make the code match the comment, do not.\n */\nexport function normalizeScreenSlug(\n  input: string | null | undefined,\n): string | undefined {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed) return undefined\n  if (trimmed === SCREEN_ROOT_PATH) return SCREEN_ROOT_PATH\n\n  const segment = trimmed\n    .toLowerCase()\n    .replace(/^\\/+|\\/+$/g, '')\n    .replace(/\\s+/g, '-')\n    .replace(/[^a-z0-9-_]/g, '')\n    .replace(/-{2,}/g, '-')\n    .replace(/^-+|-+$/g, '')\n\n  return segment || undefined\n}\n\n/**\n * Route segments the published site CANNOT serve, whatever the routing map\n * says (AGL-2076).\n *\n * Every entry was measured against production on 2026-08-19 with a fresh\n * `x-vercel-cache: MISS`, because a stale negative always passes. Two\n * mechanisms, both of which resolve ahead of `[host]/[scheme]/[[...slug]]`:\n *\n *  - `404`, `500` — Next emits `pages/404.html` and `pages/500.html` even for\n *    an app-router-only build, and the deployed filesystem answers them as\n *    static files (`content-disposition: inline; filename=\"404\"`,\n *    `accept-ranges`, an `etag`, and no `x-nextjs-prerender`). The tenant\n *    middleware's own CSP headers are on those responses, so the middleware\n *    ran and its rewrite still lost. There is no rewrite this app can write\n *    that beats them, which is why the honest fix is to refuse the slug at\n *    authoring time rather than to keep promising an address that is dead.\n *  - `search`, `api`, `_next`, `_static` — routes and exclusions the tenant\n *    app owns. `/search` matches `app/[host]/[scheme]/search`; the other three are the\n *    middleware matcher's exclusions, so no host rewrite happens at all and\n *    the path is parsed as `[host]` with an empty slug.\n *  - `aglyn-preview` — the same mechanism as `search`, one route over\n *    (AGL-3205). The live-site preview of an unpublished collection entry is\n *    a rewrite to `app/[host]/[scheme]/aglyn-preview/[...slug]`, because it\n *    must be a DIFFERENT Next route from the ISR-cached catch-all; a static\n *    folder wins over the optional catch-all beside it, so `/aglyn-preview/x`\n *    would reach the preview page and 404 rather than render a screen. The\n *    bare `/aglyn-preview` would in fact still serve — the preview route's\n *    catch-all is required, not optional — and it is reserved anyway for the\n *    reason given below about child paths: a child's path is composed from\n *    its parent's slug, and this rule refuses that slug.\n *  - `_aglyn` — the platform's own pages on every site, the leaving notice\n *    at `/_aglyn/leaving` first (AGL-3452). The middleware rewrites that path\n *    to an api route before the catch-all could see it.\n *\n * NOT reserved, and deliberately so, because measuring found them fine:\n * `401`, `403`, `503` (`/401` returns 200 through the catch-all — two of the\n * four designed error screens have always been viewable at their slugs, which\n * is what made the `404` case look like a Next.js defect), and `index`.\n *\n * `fonts` and `examples` USED to be dead for the third reason and are not\n * here: they were exclusions inherited from the Vercel platforms starter kit\n * for directories `apps/tenant/public` has never contained. They are given\n * back rather than reserved — see the matcher in `apps/tenant/middleware.ts`.\n */\nexport const RESERVED_SCREEN_ROUTE_SEGMENTS: readonly string[] = [\n  '404',\n  '500',\n  'search',\n  ENTRY_PREVIEW_ROUTE_SEGMENT,\n  'api',\n  '_next',\n  '_static',\n  LEAVING_NOTICE_ROUTE_SEGMENT,\n]\n\n/**\n * The reserved segment a routing-map path would collide with, or `undefined`\n * when the path is servable. The segment rather than a boolean, so a refusal\n * can name what it is refusing over.\n *\n * Reads the FIRST segment only. For `api`/`_next`/`_static` that is exactly\n * right — the middleware excludes the whole subtree, so `api/docs` is as dead\n * as `api`. For `404`/`500`/`search` it over-refuses in principle (`/404/why`\n * would serve), and that is deliberate: a child path is composed from its\n * PARENT's slug, the parent would have to hold `404`, and this same rule\n * refuses that slug wherever one is typed. A second list to express a case\n * that cannot arise would be a second list to keep correct.\n *\n * Takes a composed routing-map path (`about`, `company/about`, `'/'`), not a\n * raw slug field — `'/'` is the home screen and is never reserved.\n */\nexport function reservedScreenRouteSegment(\n  path: string | null | undefined,\n): string | undefined {\n  if (!path || path === SCREEN_ROOT_PATH) return undefined\n  const [first] = path.replace(/^\\/+/, '').split('/')\n  return RESERVED_SCREEN_ROUTE_SEGMENTS.includes(first) ? first : undefined\n}\n\n/**\n * The refusal an author reads when {@link reservedScreenRouteSegment} names a\n * segment. One sentence, in one place, because the Screens page, the version\n * view and the besigner all have to say the same thing — three surfaces\n * wording a platform constraint three ways is how AGL-2093's precheck drifted.\n */\nexport function reservedScreenRouteMessage(segment: string): string {\n  return `\"/${segment}\" is a reserved address on every ${PLATFORM_BRAND_NAME} site — pick another slug`\n}\n\n/**\n * Does a raw slug value carry a path separator the one segment it describes\n * cannot hold (AGL-2572)?\n *\n * {@link normalizeScreenSlug} answers with a SINGLE segment, and it gets there\n * by deleting every character outside `[a-z0-9-_]` — an interior `/` included.\n * Whitespace becomes a `-`, but a `/` becomes nothing at all, so\n * `alternatives/webflow` normalizes to `alternativeswebflow` and the two words\n * are stored glued. Nothing about that is visible: the field accepts the\n * keystroke, the composed path reads plausibly, and the screen ends up\n * answering an address nobody typed. Two screens on `aglyn-marketing` carry a\n * slug of that shape.\n *\n * So the separator is a question a slug field asks BEFORE normalizing, and the\n * answer is a refusal rather than a silent repair — the caller cannot know\n * which segment the author meant, and guessing is how the glue happened.\n *\n * LEADING and TRAILING slashes are not separators here. `normalizeScreenSlug`\n * strips them deliberately (`/about/` → `about`), an author typing an address\n * writes them without meaning a hierarchy, and refusing them would reject a\n * value the normalizer has always handled correctly. `'/'` alone is the home\n * page and is never a separator.\n */\nexport function screenSlugHasPathSeparator(\n  input: string | null | undefined,\n): boolean {\n  const trimmed = (input ?? '').trim()\n  if (!trimmed || trimmed === SCREEN_ROOT_PATH) return false\n  return trimmed.replace(/^\\/+|\\/+$/g, '').includes('/')\n}\n\n/**\n * The refusal an author reads when {@link screenSlugHasPathSeparator} answers\n * true. One sentence, in one place, for the same reason\n * {@link reservedScreenRouteMessage} is: the Screens page, the version view\n * and the besigner all take a slug, and a constraint worded three ways drifts\n * into three different constraints.\n *\n * It names the alternative, because a `/` in this field almost always means\n * \"nest me\" and the hierarchy is what actually composes the longer path.\n */\nexport const SCREEN_SLUG_PATH_SEPARATOR_MESSAGE =\n  'A slug is one path segment — remove the \"/\" and nest the page under a ' +\n  'parent page instead'\n"],"names":["ENTRY_PREVIEW_ROUTE_SEGMENT","LEAVING_NOTICE_ROUTE_SEGMENT","PLATFORM_BRAND_NAME","SCREEN_ROOT_PATH","normalizeScreenSlug","input","trimmed","trim","undefined","segment","toLowerCase","replace","RESERVED_SCREEN_ROUTE_SEGMENTS","reservedScreenRouteSegment","path","first","split","includes","reservedScreenRouteMessage","screenSlugHasPathSeparator","SCREEN_SLUG_PATH_SEPARATOR_MESSAGE"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,2BAA2B,QAAQ,0BAAsB;AAClE,SAASC,4BAA4B,QAAQ,sBAAkB;AAC/D,SAASC,mBAAmB,QAAQ,sBAAkB;AAEtD;;;;;CAKC,GAED;;;;;;CAMC,GACD,OAAO,MAAMC,mBAAmB,IAAG;AAEnC;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,oBACdC,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,SAAS,OAAOE;IACrB,IAAIF,YAAYH,kBAAkB,OAAOA;IAEzC,MAAMM,UAAUH,QACbI,WAAW,GACXC,OAAO,CAAC,cAAc,IACtBA,OAAO,CAAC,QAAQ,KAChBA,OAAO,CAAC,gBAAgB,IACxBA,OAAO,CAAC,UAAU,KAClBA,OAAO,CAAC,YAAY;IAEvB,OAAOF,WAAWD;AACpB;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GACD,OAAO,MAAMI,iCAAoD;IAC/D;IACA;IACA;IACAZ;IACA;IACA;IACA;IACAC;CACD,CAAA;AAED;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASY,2BACdC,IAA+B;IAE/B,IAAI,CAACA,QAAQA,SAASX,kBAAkB,OAAOK;IAC/C,MAAM,CAACO,MAAM,GAAGD,KAAKH,OAAO,CAAC,QAAQ,IAAIK,KAAK,CAAC;IAC/C,OAAOJ,+BAA+BK,QAAQ,CAACF,SAASA,QAAQP;AAClE;AAEA;;;;;CAKC,GACD,OAAO,SAASU,2BAA2BT,OAAe;IACxD,OAAO,CAAC,EAAE,EAAEA,QAAQ,iCAAiC,EAAEP,oBAAoB,yBAAyB,CAAC;AACvG;AAEA;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASiB,2BACdd,KAAgC;IAEhC,MAAMC,UAAU,CAACD,gBAAAA,QAAS,IAAIE,IAAI;IAClC,IAAI,CAACD,WAAWA,YAAYH,kBAAkB,OAAO;IACrD,OAAOG,QAAQK,OAAO,CAAC,cAAc,IAAIM,QAAQ,CAAC;AACpD;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMG,qCACX,2EACA,sBAAqB"}

package/src/lib/app-utils/site-theme.d.ts

@@ -230,6 +230,17 @@ export declare function describeThemePath(path: string): string;
  * the thing that was saved, so it cannot disagree with what will be applied.
  */
 export declare function describeThemeOverride(host: ThemeHostDocument | null | undefined): ThemeOverrideEntry[];
+/**
+ * The `themeOverride` to store once ONE value is back at the theme's own
+ * (the "Reset" beside a row of "What you have changed").
+ * Computed by resolving the patch, putting the publisher's value back at that
+ * path, and re-diffing — rather than by deleting a key from the patch object.
+ * The two differ whenever a path was reached through a keyed array or a
+ * deletion sentinel, and re-diffing is right in every case because it asks the
+ * same question the save path asks. `undefined` when the site has no override
+ * to change.
+ */
+export declare function themeOverrideAfterReset(host: ThemeHostDocument | null | undefined, path: string): ArtifactOverride | null | undefined;
 /**
  * The override this site should store after the theme editor produced `edited`.
  *

package/src/lib/app-utils/site-theme.js

@@ -13,7 +13,8 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { diffOverride, isEmptyOverride, overrideConflicts, overridePaths, readArtifactOverride, resolveOverride } from "./artifact-overrides.js";
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { diffOverride, isEmptyOverride, overrideConflicts, overridePaths, overrideWriteValue, readArtifactOverride, resolveOverride } from "./artifact-overrides.js";
 /**
  * WCAG AA for body text. The same 4.5 the accessibility audit uses, rather
  * than a house number, so a theme that passes here passes there.
@@ -491,6 +492,36 @@ const SEGMENT_LABELS = {
         };
     });
 }
+/** Copy-on-write set of a dotted path; `undefined` removes the key. */ function setThemePath(target, path, value) {
+    const [head, ...rest] = path;
+    const container = target != null && typeof target === 'object' && !Array.isArray(target) ? _extends({}, target) : {};
+    if (!rest.length) {
+        if (value === undefined) delete container[head];
+        else container[head] = value;
+        return container;
+    }
+    container[head] = setThemePath(container[head], rest, value);
+    return container;
+}
+/**
+ * The `themeOverride` to store once ONE value is back at the theme's own
+ * (the "Reset" beside a row of "What you have changed").
+ * Computed by resolving the patch, putting the publisher's value back at that
+ * path, and re-diffing — rather than by deleting a key from the patch object.
+ * The two differ whenever a path was reached through a keyed array or a
+ * deletion sentinel, and re-diffing is right in every case because it asks the
+ * same question the save path asks. `undefined` when the site has no override
+ * to change.
+ */ export function themeOverrideAfterReset(host, path) {
+    var _ref, _ref1;
+    var _host_themeInstalledFrom;
+    const override = readThemeOverride(host);
+    if (!override) return undefined;
+    const base = (_ref = host == null ? void 0 : host.theme) != null ? _ref : {};
+    const resolved = resolveOverride(base, override.patch);
+    const restored = setThemePath(resolved, path.split('.'), readThemePath(base, path));
+    return overrideWriteValue(diffOverride(base, restored), (_ref1 = host == null ? void 0 : (_host_themeInstalledFrom = host.themeInstalledFrom) == null ? void 0 : _host_themeInstalledFrom.sha256) != null ? _ref1 : null);
+}
 /** Reads a dotted path out of a theme. */ function readThemePath(theme, path) {
     let cursor = theme;
     for (const segment of path.split('.')){

package/src/lib/app-utils/site-theme.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/site-theme.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  HostTheme,\n  HostThemeFont,\n  HostThemeScheme,\n  HostThemeSchemeColors,\n} from '@aglyn/shared-data-types'\nimport {\n  diffOverride,\n  isEmptyOverride,\n  overrideConflicts,\n  overridePaths,\n  readArtifactOverride,\n  resolveOverride,\n  type ArtifactOverride,\n} from './artifact-overrides'\n\n/**\n * A site's theme (AGL-1020, named for it in AGL-3080): whether one is complete\n * and readable, what it resolves to once the site's own edits are applied over\n * an installed theme, and where it came from.\n *\n * Every reader is a platform surface or a plugin that is not the installer —\n * the published page and its manifest, every besigner canvas, the site's theme\n * settings, the AI plugin's theme proposals, the themes plugin's presets — so\n * it is core's. It was first written for the marketplace's publish route,\n * which is why the validation below is phrased as a gate on publishing; it is\n * the same gate for a theme a model proposes.\n *\n * ## Validating a theme\n *\n * A plugin bundle is validated because it is code and the risk is a\n * compromised site. A theme is data, so the risk is different in kind but not\n * in consequence: the failure mode is an unreadable or half-painted site, which\n * a publisher cannot see from their own machine because their fonts are\n * installed and their eyes already know what the text says.\n *\n * Both of the things that go wrong are mechanically checkable, so they are\n * checked here rather than left to review:\n *\n * * **Completeness.** Light and dark are not one palette with a filter. A theme\n *   that defines only light is half a theme, and installing it leaves every\n *   dark-mode visitor on MUI's stock blue — which reads as the site being\n *   broken, not as the theme being partial.\n * * **Contrast.** Text on its background, and label on its button, are the two\n *   pairs that make a site unusable when they are wrong. WCAG gives an exact\n *   ratio, so \"is this readable\" has an answer rather than an opinion.\n *\n * Errors refuse the publish; warnings are shown and can be published past. The\n * split is deliberate — a 3.9:1 heading is a judgement call a designer may\n * legitimately win, but a theme with no dark scheme is not a complete artifact\n * whoever is asking.\n *\n * Pure and MUI-free so the publish route, the console's pre-flight and the\n * tests all reach the same verdict from the same code.\n */\n\nexport interface ThemeValidationIssue {\n  /** Dotted path into the theme, so the editor can focus the offending field. */\n  path: string\n  message: string\n}\n\nexport interface ThemeValidation {\n  /** No errors. Warnings do not block. */\n  ok: boolean\n  errors: ThemeValidationIssue[]\n  warnings: ThemeValidationIssue[]\n}\n\n/**\n * WCAG AA for body text. The same 4.5 the accessibility audit uses, rather\n * than a house number, so a theme that passes here passes there.\n */\nexport const CONTRAST_AA = 4.5\n\n/**\n * WCAG AA for large text (18pt+/14pt bold) and UI component boundaries. Button\n * labels are judged against this rather than 4.5 because they are large, short\n * and centred, and holding them to body-text contrast rejects palettes that are\n * genuinely fine.\n */\nexport const CONTRAST_AA_LARGE = 3\n\nconst SCHEMES: HostThemeScheme[] = ['light', 'dark']\n\n/**\n * Font families that need no loading. Anything else is either declared in the\n * theme's own `fonts` array or will silently fall back to the browser's default\n * — which is the failure the issue calls out, so it is at least a warning.\n */\nconst SYSTEM_FAMILIES = new Set(\n  [\n    'system-ui',\n    'sans-serif',\n    'serif',\n    'monospace',\n    'cursive',\n    'fantasy',\n    'ui-sans-serif',\n    'ui-serif',\n    'ui-monospace',\n    'ui-rounded',\n    '-apple-system',\n    'blinkmacsystemfont',\n    'segoe ui',\n    'roboto',\n    'helvetica',\n    'helvetica neue',\n    'arial',\n    'georgia',\n    'times new roman',\n    'courier new',\n    'inherit',\n    'initial',\n  ].map((family) => family.toLowerCase()),\n)\n\n/**\n * Parses a CSS colour into sRGB channels, or null when it is not something we\n * can reason about.\n *\n * `null` means \"not checked\", never \"failed\": a theme is free to use `color-mix`\n * or a CSS variable, and refusing to publish because this parser is narrower\n * than CSS would be a validator inventing a rule the platform does not have.\n */\nexport function parseColor(\n  value: unknown,\n): { r: number; g: number; b: number } | null {\n  if (typeof value !== 'string') return null\n  const text = value.trim().toLowerCase()\n\n  const hex = /^#([0-9a-f]{3,8})$/.exec(text)\n  if (hex) {\n    const digits = hex[1]\n    if (digits.length === 3 || digits.length === 4) {\n      return {\n        r: parseInt(digits[0] + digits[0], 16),\n        g: parseInt(digits[1] + digits[1], 16),\n        b: parseInt(digits[2] + digits[2], 16),\n      }\n    }\n    if (digits.length === 6 || digits.length === 8) {\n      return {\n        r: parseInt(digits.slice(0, 2), 16),\n        g: parseInt(digits.slice(2, 4), 16),\n        b: parseInt(digits.slice(4, 6), 16),\n      }\n    }\n    return null\n  }\n\n  const rgb = /^rgba?\\(([^)]+)\\)$/.exec(text)\n  if (rgb) {\n    const parts = rgb[1].split(/[,/\\s]+/).filter(Boolean)\n    if (parts.length < 3) return null\n    const channels = parts.slice(0, 3).map((part) =>\n      part.endsWith('%')\n        ? (Number(part.slice(0, -1)) / 100) * 255\n        : Number(part),\n    )\n    if (channels.some((channel) => !Number.isFinite(channel))) return null\n    const [r, g, b] = channels\n    return { r, g, b }\n  }\n\n  if (text === 'white') return { r: 255, g: 255, b: 255 }\n  if (text === 'black') return { r: 0, g: 0, b: 0 }\n  return null\n}\n\n/** WCAG relative luminance. */\nfunction luminance(channels: { r: number; g: number; b: number }): number {\n  const channel = (raw: number) => {\n    const value = Math.min(255, Math.max(0, raw)) / 255\n    return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4\n  }\n  return (\n    0.2126 * channel(channels.r) +\n    0.7152 * channel(channels.g) +\n    0.0722 * channel(channels.b)\n  )\n}\n\n/**\n * WCAG contrast ratio between two colours, or null when either is unparseable.\n * Ranges 1 (identical) to 21 (black on white).\n */\nexport function contrastRatio(a: unknown, b: unknown): number | null {\n  const first = parseColor(a)\n  const second = parseColor(b)\n  if (!first || !second) return null\n  const light = Math.max(luminance(first), luminance(second))\n  const dark = Math.min(luminance(first), luminance(second))\n  return (light + 0.05) / (dark + 0.05)\n}\n\nconst round = (ratio: number) => Math.round(ratio * 10) / 10\n\n/**\n * The colours a scheme must actually define to be usable on its own.\n *\n * Deliberately short. MUI derives an enormous amount from very little, and\n * demanding a full palette would reject good themes; but a scheme that names no\n * primary, no background and no text has not expressed an identity at all — it\n * is an empty object that happens to have a key.\n */\nfunction validateScheme(\n  scheme: HostThemeScheme,\n  colors: HostThemeSchemeColors | undefined,\n  errors: ThemeValidationIssue[],\n  warnings: ThemeValidationIssue[],\n): void {\n  const at = `colorSchemes.${scheme}`\n  if (!colors || !Object.keys(colors).length) {\n    errors.push({\n      path: at,\n      message:\n        `This theme defines no ${scheme} scheme. Light and dark are not one ` +\n        'palette with a filter — install it and every visitor in ' +\n        `${scheme} mode sees the stock palette instead of your design.`,\n    })\n    return\n  }\n  if (!colors.primary?.main) {\n    errors.push({\n      path: `${at}.primary.main`,\n      message: `The ${scheme} scheme has no primary color.`,\n    })\n  }\n\n  const background = colors.background?.default\n  const paper = colors.background?.paper\n  const text = colors.text?.primary\n  const secondaryText = colors.text?.secondary\n\n  // Text on background is the pair that decides whether a site can be read at\n  // all, so it is the one contrast failure that refuses the publish.\n  const bodyContrast = contrastRatio(text, background)\n  if (bodyContrast != null && bodyContrast < CONTRAST_AA) {\n    errors.push({\n      path: `${at}.text.primary`,\n      message:\n        `Body text on the ${scheme} background is ${round(bodyContrast)}:1, ` +\n        `below the ${CONTRAST_AA}:1 minimum for readable text.`,\n    })\n  }\n\n  const paperContrast = contrastRatio(text, paper)\n  if (paperContrast != null && paperContrast < CONTRAST_AA) {\n    errors.push({\n      path: `${at}.background.paper`,\n      message:\n        `Body text on ${scheme} cards and menus is ${round(paperContrast)}:1, ` +\n        `below the ${CONTRAST_AA}:1 minimum. Surfaces inherit this everywhere ` +\n        'a Paper is used, which is most of the site.',\n    })\n  }\n\n  // Secondary text is legitimately dimmer by design, so it warns rather than\n  // refuses — but silently shipping unreadable captions is worse than saying so.\n  const captionContrast = contrastRatio(secondaryText, background)\n  if (captionContrast != null && captionContrast < CONTRAST_AA) {\n    warnings.push({\n      path: `${at}.text.secondary`,\n      message:\n        `Secondary text on the ${scheme} background is ` +\n        `${round(captionContrast)}:1. Captions and helper text will be hard ` +\n        'to read.',\n    })\n  }\n\n  // A button whose label disappears into its own fill. Only checkable when the\n  // theme states contrastText — otherwise MUI derives one, and derives it well.\n  // Every accent a button can be filled with. Tertiary is one (AGL-3411):\n  // `<Button color=\"tertiary\">` is offered wherever primary and secondary are.\n  for (const key of ['primary', 'secondary', 'tertiary', 'error'] as const) {\n    const color = colors[key]\n    const ratio = contrastRatio(color?.contrastText, color?.main)\n    if (ratio != null && ratio < CONTRAST_AA_LARGE) {\n      warnings.push({\n        path: `${at}.${key}.contrastText`,\n        message:\n          `The ${scheme} ${key} button label is ${round(ratio)}:1 against its ` +\n          `own fill, below ${CONTRAST_AA_LARGE}:1. Leave contrast text unset ` +\n          'to let the theme derive a readable one.',\n      })\n    }\n  }\n}\n\n/**\n * Every family named in the typography, split out of its CSS stack.\n *\n * A stack is a fallback chain, so only the FIRST entry is the one the design\n * depends on; the rest exist precisely to be substituted and warning about them\n * would be noise.\n */\nfunction declaredFamilies(theme: HostTheme): string[] {\n  const stacks: string[] = []\n  if (theme.typography?.fontFamily) stacks.push(theme.typography.fontFamily)\n  for (const variant of Object.values(theme.typography?.variants ?? {})) {\n    if (variant?.fontFamily) stacks.push(variant.fontFamily)\n  }\n  const primary: string[] = []\n  for (const stack of stacks) {\n    const first = stack.split(',')[0]?.trim().replace(/^[\"']|[\"']$/g, '')\n    if (first) primary.push(first)\n  }\n  return primary\n}\n\nfunction validateFonts(\n  theme: HostTheme,\n  warnings: ThemeValidationIssue[],\n): void {\n  const loadable = new Set(\n    (theme.fonts ?? [])\n      .map((font: HostThemeFont) => font.family?.trim().toLowerCase())\n      .filter(Boolean) as string[],\n  )\n  const seen = new Set<string>()\n  for (const family of declaredFamilies(theme)) {\n    const key = family.toLowerCase()\n    if (seen.has(key) || loadable.has(key) || SYSTEM_FAMILIES.has(key)) continue\n    seen.add(key)\n    warnings.push({\n      path: 'typography.fontFamily',\n      message:\n        `\"${family}\" is used but not listed in the theme's fonts, so it will ` +\n        'only appear on machines that happen to have it installed. Add it as ' +\n        'a Google font, or fall back to a system family.',\n    })\n  }\n}\n\n/**\n * Validates a theme for publishing.\n *\n * The same function backs the console's pre-flight and the publish route: a\n * publisher who is told \"this will be refused\" and then has it accepted (or the\n * reverse) stops trusting either, so there is one verdict from one place.\n */\nexport function validateThemeForPublish(\n  theme: HostTheme | null | undefined,\n): ThemeValidation {\n  const errors: ThemeValidationIssue[] = []\n  const warnings: ThemeValidationIssue[] = []\n\n  if (!theme || !Object.keys(theme).length) {\n    return {\n      ok: false,\n      errors: [\n        {\n          path: '',\n          message:\n            'This site has no theme customisations yet, so there is nothing ' +\n            'to publish.',\n        },\n      ],\n      warnings,\n    }\n  }\n\n  for (const scheme of SCHEMES) {\n    validateScheme(scheme, theme.colorSchemes?.[scheme], errors, warnings)\n  }\n  validateFonts(theme, warnings)\n\n  return { ok: !errors.length, errors, warnings }\n}\n\n/**\n * Every field of a `HostTheme` that is part of the published artifact.\n *\n * Typed as a total record over `keyof HostTheme` on purpose: adding a field to\n * `HostTheme` fails to compile here until someone decides whether it ships. The\n * alternative — a hand-written list of `if` statements — silently drops the new\n * field, and a theme that loses one is not obviously broken, it is subtly\n * wrong. `mixins` arrived exactly that way (AGL-1242, toolbar heights) while\n * this was being written, which is why the check is a type and not a comment.\n *\n * A `false` means \"host-local, never published\". `darkScheme` is the one such\n * field: whether visitors get a dark scheme is a decision about a SITE's\n * content (does it read in dark?), not about the design being published, so a\n * publisher's opt-out must not travel with the theme and an installer's must\n * not read as a divergence from it.\n */\nconst THEME_ARTIFACT_FIELDS: Record<keyof Required<HostTheme>, boolean> = {\n  colorSchemes: true,\n  typography: true,\n  fonts: true,\n  shape: true,\n  spacing: true,\n  mixins: true,\n  components: true,\n  darkScheme: false,\n}\n\n/**\n * The theme content as published — the artifact and nothing else.\n *\n * What goes in here is what \"reset to the publisher's version\" restores and\n * what the update diff compares against, so it must hold no per-install data:\n * a host document also carries `updatedAt`, `updatedBy` and whatever else the\n * editor writes alongside, and any of those in the content would read as a user\n * edit on the next diff.\n *\n * Empty branches are dropped so two themes that render identically also hash\n * identically — `{fonts: []}` and `{}` must not produce two base snapshots.\n */\nexport function themeArtifactContent(\n  theme: HostTheme | null | undefined,\n): HostTheme {\n  const content: Record<string, unknown> = {}\n  if (!theme) return content\n  for (const [key, ships] of Object.entries(THEME_ARTIFACT_FIELDS)) {\n    if (!ships) continue\n    const value = (theme as Record<string, unknown>)[key]\n    if (value == null) continue\n    if (Array.isArray(value) ? !value.length : typeof value === 'object'\n      ? !Object.keys(value as object).length\n      : false) {\n      continue\n    }\n    content[key] = value\n  }\n  return content\n}\n\n/**\n * A short, human summary of what a theme actually contains, for the install\n * confirmation and the listing card.\n *\n * Installing a theme replaces a site's visual identity, so the confirmation has\n * to say what is about to change in terms someone recognises — \"both schemes,\n * 2 fonts, 4 component styles\" — rather than showing them a JSON blob and\n * asking them to agree to it.\n */\nexport function describeTheme(theme: HostTheme | null | undefined): string[] {\n  if (!theme) return []\n  const parts: string[] = []\n  const schemes = SCHEMES.filter(\n    (scheme) => Object.keys(theme.colorSchemes?.[scheme] ?? {}).length,\n  )\n  if (schemes.length === 2) parts.push('Light and dark schemes')\n  else if (schemes.length === 1) parts.push(`${schemes[0]} scheme only`)\n\n  const fonts = theme.fonts?.length ?? 0\n  if (fonts) parts.push(`${fonts} font${fonts === 1 ? '' : 's'}`)\n  if (theme.typography?.variants) {\n    const count = Object.keys(theme.typography.variants).length\n    if (count) parts.push(`${count} text style${count === 1 ? '' : 's'}`)\n  }\n  if (theme.shape?.borderRadius != null) {\n    parts.push(`${theme.shape.borderRadius}px corners`)\n  }\n  if (typeof theme.spacing === 'number') parts.push(`${theme.spacing}px spacing`)\n  const components = Object.keys(theme.components ?? {}).length\n  if (components) {\n    parts.push(`${components} component style${components === 1 ? '' : 's'}`)\n  }\n  return parts\n}\n\n/* ------------------------------------------------------------------------ *\n * The override layer, applied to themes (AGL-1021)\n * ------------------------------------------------------------------------ */\n\n/**\n * The field on a host document holding the site's theme override.\n *\n * A theme is a FIELD on the host, not a document of its own, so it cannot use\n * `ARTIFACT_OVERRIDE_FIELD` — a host may one day override more than one thing,\n * and a bare `overrides` would be the first to claim the name. The override\n * layer is general precisely so a namespaced field works with it unchanged.\n */\nexport const THEME_OVERRIDE_FIELD = 'themeOverride'\n\n/** A host document, as far as the theme layer is concerned. */\nexport interface ThemeHostDocument {\n  theme?: HostTheme | null\n  themeOverride?: unknown\n  themeInstalledFrom?: { sha256?: string | null; listingId?: string } | null\n  /** The library theme the site picked (AGL-3404) — see `theme-library`. */\n  themeSelection?: unknown\n}\n\n/** Reads the stored theme override off a host document, tolerating junk. */\nexport function readThemeOverride(\n  host: ThemeHostDocument | null | undefined,\n): ArtifactOverride | undefined {\n  // The override layer's reader is keyed to its own field name, so hand it a\n  // shim rather than duplicating its validation — which is where the \"a\n  // top-level null blanks the artifact\" guard lives.\n  return readArtifactOverride({ overrides: host?.themeOverride })\n}\n\n/**\n * The site's effective theme: the marketplace theme (or the site's own) with\n * this site's overrides resolved over it.\n *\n * This is the MIDDLE and TOP of the three layers the issue describes. The\n * bottom — the platform default — is applied further down by\n * `HostThemeProvider`, which layers whatever this returns onto the brand base\n * (AGL-1180) so a theme that omits a value still yields a complete theme\n * rather than an undefined-shaped hole. Doing it there rather than here is not\n * a detail: the default is a runtime MUI theme with FUNCTION style overrides\n * that JSON cannot represent, so a \"default\" merged at this layer would be a\n * lossy copy of the real one.\n *\n * Every surface that renders a site's appearance calls this — the tenant, all\n * four besigner editors, and the document preview — because a theme that\n * resolves differently in the editor than on the site is worse than one that\n * does not resolve at all.\n */\nexport function resolveSiteTheme(\n  host: ThemeHostDocument | null | undefined,\n): HostTheme | undefined {\n  const base = host?.theme ?? undefined\n  const override = readThemeOverride(host)\n  if (!override) return base\n  return resolveOverride<HostTheme>(base ?? {}, override.patch)\n}\n\n/**\n * Where a site's theme came from (AGL-2938).\n *\n * - `installed` — a marketplace theme. The site's edits are its override\n *   patch over the publisher's version, which stays untouched and can still\n *   take an update.\n * - `preset` — a built-in theme a plugin contributes (AGL-3404).\n * - `custom` — one of the site's own themes.\n * - `default` — the platform default.\n *\n * Whichever it is, an edit is an override patch over the picked theme and the\n * theme itself is never rewritten (AGL-3404), so every source can be restored.\n *\n * One reading for every surface that needs it — the page that lays out the\n * Theme section, a widget proposing a change there, and a generator deciding\n * what its change will be stored as — so none of them can file a site under\n * a different source than the save path does.\n */\nexport type HostThemeSource = 'installed' | 'preset' | 'custom' | 'default'\n\nconst THEME_SOURCES: readonly HostThemeSource[] = [\n  'installed',\n  'preset',\n  'custom',\n  'default',\n]\n\nexport function hostThemeSource(\n  host: ThemeHostDocument | null | undefined,\n): HostThemeSource {\n  const picked = (host?.themeSelection as { kind?: unknown } | null | undefined)\n    ?.kind\n  if (THEME_SOURCES.includes(picked as HostThemeSource)) {\n    return picked as HostThemeSource\n  }\n  if (host?.themeInstalledFrom?.listingId) return 'installed'\n  return host?.theme && Object.keys(host.theme).length ? 'custom' : 'default'\n}\n\n/**\n * Was this override authored against the theme currently installed?\n *\n * False after a theme swap, which is the whole reason `baseSha256` is recorded.\n * Overrides deliberately SURVIVE a swap (the issue's call, and the right one —\n * a brand colour still expresses intent when the theme underneath it changes)\n * but surviving silently is what would surprise people, so every surface that\n * shows an override can ask this and say so.\n *\n * True when there is no override, and when either side has no hash to compare:\n * \"we cannot tell\" must not render as \"these are stale\".\n */\nexport function isOverrideForCurrentTheme(\n  host: ThemeHostDocument | null | undefined,\n): boolean {\n  const override = readThemeOverride(host)\n  if (!override?.baseSha256) return true\n  const installed = host?.themeInstalledFrom?.sha256\n  if (!installed) return true\n  return override.baseSha256 === installed\n}\n\n/** One row of the \"what have I changed?\" view. */\nexport interface ThemeOverrideEntry {\n  /** Dotted path into the theme, e.g. `colorSchemes.dark.primary.main`. */\n  path: string\n  /** A human label for the path, for a UI that is not a JSON viewer. */\n  label: string\n  /** Which scheme this touches, when it touches one. */\n  scheme?: HostThemeScheme\n  /** The publisher's value, or undefined when the override adds the field. */\n  themeValue: unknown\n  /** What this site set it to, or undefined when the override removes it. */\n  overrideValue: unknown\n}\n\nconst SEGMENT_LABELS: Record<string, string> = {\n  darkScheme: 'Dark scheme',\n  colorSchemes: 'Color',\n  typography: 'Typography',\n  components: 'Component',\n  shape: 'Shape',\n  spacing: 'Spacing',\n  fonts: 'Fonts',\n  mixins: 'Layout',\n  variants: '',\n  background: 'background',\n  text: 'text',\n  main: '',\n  contrastText: 'label color',\n  borderRadius: 'corner radius',\n  fontFamily: 'font',\n}\n\n/**\n * A readable label for a theme path.\n *\n * \"Colour · dark · primary\" beats `colorSchemes.dark.primary.main`, and the\n * difference matters because this list is the answer to \"what have I changed?\"\n * — a question nobody asks wanting to read JSON paths.\n */\nexport function describeThemePath(path: string): string {\n  const segments = path.split('.').filter(Boolean)\n  const words: string[] = []\n  for (const segment of segments) {\n    const mapped = SEGMENT_LABELS[segment]\n    if (mapped === '') continue\n    words.push(mapped ?? segment)\n  }\n  return words.join(' · ') || 'the whole theme'\n}\n\n/**\n * \"What have I changed?\" — the patch, rendered.\n *\n * Literally a read of the stored override rather than a diff computed at call\n * time, which is the property the whole layer exists to provide: the answer is\n * the thing that was saved, so it cannot disagree with what will be applied.\n */\nexport function describeThemeOverride(\n  host: ThemeHostDocument | null | undefined,\n): ThemeOverrideEntry[] {\n  const override = readThemeOverride(host)\n  if (!override) return []\n  const base = host?.theme ?? {}\n  const resolved = resolveOverride<HostTheme>(base, override.patch)\n  return overridePaths(override.patch).map((path) => {\n    const segments = path.split('.')\n    const scheme =\n      segments[0] === 'colorSchemes' &&\n      (segments[1] === 'light' || segments[1] === 'dark')\n        ? (segments[1] as HostThemeScheme)\n        : undefined\n    return {\n      path,\n      label: describeThemePath(path),\n      scheme,\n      themeValue: readThemePath(base, path),\n      overrideValue: readThemePath(resolved, path),\n    }\n  })\n}\n\n/** Reads a dotted path out of a theme. */\nfunction readThemePath(theme: unknown, path: string): unknown {\n  let cursor: unknown = theme\n  for (const segment of path.split('.')) {\n    if (cursor == null || typeof cursor !== 'object') return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * The override this site should store after the theme editor produced `edited`.\n *\n * The editor edits the RESOLVED theme — that is what it renders and what the\n * user sees — so the patch is the difference between the publisher's base and\n * what came back. Diffing here rather than tracking per-field dirty state means\n * a field the user set and then set back to the theme's value stops being an\n * override, which is what \"reset\" means without needing a reset button to have\n * been pressed.\n */\nexport function themeOverridePatch(\n  host: ThemeHostDocument | null | undefined,\n  edited: HostTheme,\n): unknown {\n  return diffOverride(host?.theme ?? {}, edited)\n}\n\n/**\n * Where this site's overrides sit on top of values a theme update also changes\n * — the only place a conflict can exist.\n *\n * Narrow by construction: an override touching four paths can conflict in at\n * most four places however much of the theme the publisher rewrote. That is the\n * difference between \"the publisher also changed your heading colour, whose\n * wins?\" and \"this update rewrites your theme, continue?\".\n */\nexport function themeUpdateConflicts(\n  host: ThemeHostDocument | null | undefined,\n  incoming: HostTheme,\n): ThemeOverrideEntry[] {\n  const override = readThemeOverride(host)\n  if (!override || isEmptyOverride(override.patch)) return []\n  const base = host?.theme ?? {}\n  const resolved = resolveOverride<HostTheme>(base, override.patch)\n  return overrideConflicts(base, override.patch, incoming).map((path) => ({\n    path,\n    label: describeThemePath(path),\n    scheme:\n      path.startsWith('colorSchemes.light.')\n        ? ('light' as const)\n        : path.startsWith('colorSchemes.dark.')\n          ? ('dark' as const)\n          : undefined,\n    themeValue: readThemePath(incoming, path),\n    overrideValue: readThemePath(resolved, path),\n  }))\n}\n"],"names":["diffOverride","isEmptyOverride","overrideConflicts","overridePaths","readArtifactOverride","resolveOverride","CONTRAST_AA","CONTRAST_AA_LARGE","SCHEMES","SYSTEM_FAMILIES","Set","map","family","toLowerCase","parseColor","value","text","trim","hex","exec","digits","length","r","parseInt","g","b","slice","rgb","parts","split","filter","Boolean","channels","part","endsWith","Number","some","channel","isFinite","luminance","raw","Math","min","max","contrastRatio","a","first","second","light","dark","round","ratio","validateScheme","scheme","colors","errors","warnings","at","Object","keys","push","path","message","primary","main","background","default","paper","secondaryText","secondary","bodyContrast","paperContrast","captionContrast","key","color","contrastText","declaredFamilies","theme","stacks","typography","fontFamily","variant","values","variants","stack","replace","validateFonts","loadable","fonts","font","seen","has","add","validateThemeForPublish","ok","colorSchemes","THEME_ARTIFACT_FIELDS","shape","spacing","mixins","components","darkScheme","themeArtifactContent","content","ships","entries","Array","isArray","describeTheme","schemes","count","borderRadius","THEME_OVERRIDE_FIELD","readThemeOverride","host","overrides","themeOverride","resolveSiteTheme","base","undefined","override","patch","THEME_SOURCES","hostThemeSource","picked","themeSelection","kind","includes","themeInstalledFrom","listingId","isOverrideForCurrentTheme","baseSha256","installed","sha256","SEGMENT_LABELS","describeThemePath","segments","words","segment","mapped","join","describeThemeOverride","resolved","label","themeValue","readThemePath","overrideValue","cursor","themeOverridePatch","edited","themeUpdateConflicts","incoming","startsWith"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAQD,SACEA,YAAY,EACZC,eAAe,EACfC,iBAAiB,EACjBC,aAAa,EACbC,oBAAoB,EACpBC,eAAe,QAEV,0BAAsB;AAuD7B;;;CAGC,GACD,OAAO,MAAMC,cAAc,IAAG;AAE9B;;;;;CAKC,GACD,OAAO,MAAMC,oBAAoB,EAAC;AAElC,MAAMC,UAA6B;IAAC;IAAS;CAAO;AAEpD;;;;CAIC,GACD,MAAMC,kBAAkB,IAAIC,IAC1B;IACE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,GAAG,CAAC,CAACC,SAAWA,OAAOC,WAAW;AAGtC;;;;;;;CAOC,GACD,OAAO,SAASC,WACdC,KAAc;IAEd,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,OAAOD,MAAME,IAAI,GAAGJ,WAAW;IAErC,MAAMK,MAAM,qBAAqBC,IAAI,CAACH;IACtC,IAAIE,KAAK;QACP,MAAME,SAASF,GAAG,CAAC,EAAE;QACrB,IAAIE,OAAOC,MAAM,KAAK,KAAKD,OAAOC,MAAM,KAAK,GAAG;YAC9C,OAAO;gBACLC,GAAGC,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;gBACnCI,GAAGD,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;gBACnCK,GAAGF,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;YACrC;QACF;QACA,IAAIA,OAAOC,MAAM,KAAK,KAAKD,OAAOC,MAAM,KAAK,GAAG;YAC9C,OAAO;gBACLC,GAAGC,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;gBAChCF,GAAGD,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;gBAChCD,GAAGF,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;YAClC;QACF;QACA,OAAO;IACT;IAEA,MAAMC,MAAM,qBAAqBR,IAAI,CAACH;IACtC,IAAIW,KAAK;QACP,MAAMC,QAAQD,GAAG,CAAC,EAAE,CAACE,KAAK,CAAC,WAAWC,MAAM,CAACC;QAC7C,IAAIH,MAAMP,MAAM,GAAG,GAAG,OAAO;QAC7B,MAAMW,WAAWJ,MAAMF,KAAK,CAAC,GAAG,GAAGf,GAAG,CAAC,CAACsB,OACtCA,KAAKC,QAAQ,CAAC,OACV,AAACC,OAAOF,KAAKP,KAAK,CAAC,GAAG,CAAC,MAAM,MAAO,MACpCS,OAAOF;QAEb,IAAID,SAASI,IAAI,CAAC,CAACC,UAAY,CAACF,OAAOG,QAAQ,CAACD,WAAW,OAAO;QAClE,MAAM,CAACf,GAAGE,GAAGC,EAAE,GAAGO;QAClB,OAAO;YAAEV;YAAGE;YAAGC;QAAE;IACnB;IAEA,IAAIT,SAAS,SAAS,OAAO;QAAEM,GAAG;QAAKE,GAAG;QAAKC,GAAG;IAAI;IACtD,IAAIT,SAAS,SAAS,OAAO;QAAEM,GAAG;QAAGE,GAAG;QAAGC,GAAG;IAAE;IAChD,OAAO;AACT;AAEA,6BAA6B,GAC7B,SAASc,UAAUP,QAA6C;IAC9D,MAAMK,UAAU,CAACG;QACf,MAAMzB,QAAQ0B,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGH,QAAQ;QAChD,OAAOzB,SAAS,UAAUA,QAAQ,QAAQ,AAAC,CAAA,AAACA,CAAAA,QAAQ,KAAI,IAAK,KAAI,KAAM;IACzE;IACA,OACE,SAASsB,QAAQL,SAASV,CAAC,IAC3B,SAASe,QAAQL,SAASR,CAAC,IAC3B,SAASa,QAAQL,SAASP,CAAC;AAE/B;AAEA;;;CAGC,GACD,OAAO,SAASmB,cAAcC,CAAU,EAAEpB,CAAU;IAClD,MAAMqB,QAAQhC,WAAW+B;IACzB,MAAME,SAASjC,WAAWW;IAC1B,IAAI,CAACqB,SAAS,CAACC,QAAQ,OAAO;IAC9B,MAAMC,QAAQP,KAAKE,GAAG,CAACJ,UAAUO,QAAQP,UAAUQ;IACnD,MAAME,OAAOR,KAAKC,GAAG,CAACH,UAAUO,QAAQP,UAAUQ;IAClD,OAAO,AAACC,CAAAA,QAAQ,IAAG,IAAMC,CAAAA,OAAO,IAAG;AACrC;AAEA,MAAMC,QAAQ,CAACC,QAAkBV,KAAKS,KAAK,CAACC,QAAQ,MAAM;AAE1D;;;;;;;CAOC,GACD,SAASC,eACPC,MAAuB,EACvBC,MAAyC,EACzCC,MAA8B,EAC9BC,QAAgC;QAa3BF,iBAOcA,oBACLA,qBACDA,cACSA;IArBtB,MAAMG,KAAK,CAAC,aAAa,EAAEJ,QAAQ;IACnC,IAAI,CAACC,UAAU,CAACI,OAAOC,IAAI,CAACL,QAAQjC,MAAM,EAAE;QAC1CkC,OAAOK,IAAI,CAAC;YACVC,MAAMJ;YACNK,SACE,CAAC,sBAAsB,EAAET,OAAO,oCAAoC,CAAC,GACrE,6DACA,GAAGA,OAAO,oDAAoD,CAAC;QACnE;QACA;IACF;IACA,IAAI,GAACC,kBAAAA,OAAOS,OAAO,qBAAdT,gBAAgBU,IAAI,GAAE;QACzBT,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,aAAa,CAAC;YAC1BK,SAAS,CAAC,IAAI,EAAET,OAAO,6BAA6B,CAAC;QACvD;IACF;IAEA,MAAMY,cAAaX,qBAAAA,OAAOW,UAAU,qBAAjBX,mBAAmBY,OAAO;IAC7C,MAAMC,SAAQb,sBAAAA,OAAOW,UAAU,qBAAjBX,oBAAmBa,KAAK;IACtC,MAAMnD,QAAOsC,eAAAA,OAAOtC,IAAI,qBAAXsC,aAAaS,OAAO;IACjC,MAAMK,iBAAgBd,gBAAAA,OAAOtC,IAAI,qBAAXsC,cAAae,SAAS;IAE5C,4EAA4E;IAC5E,mEAAmE;IACnE,MAAMC,eAAe1B,cAAc5B,MAAMiD;IACzC,IAAIK,gBAAgB,QAAQA,eAAehE,aAAa;QACtDiD,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,aAAa,CAAC;YAC1BK,SACE,CAAC,iBAAiB,EAAET,OAAO,eAAe,EAAEH,MAAMoB,cAAc,IAAI,CAAC,GACrE,CAAC,UAAU,EAAEhE,YAAY,6BAA6B,CAAC;QAC3D;IACF;IAEA,MAAMiE,gBAAgB3B,cAAc5B,MAAMmD;IAC1C,IAAII,iBAAiB,QAAQA,gBAAgBjE,aAAa;QACxDiD,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,iBAAiB,CAAC;YAC9BK,SACE,CAAC,aAAa,EAAET,OAAO,oBAAoB,EAAEH,MAAMqB,eAAe,IAAI,CAAC,GACvE,CAAC,UAAU,EAAEjE,YAAY,6CAA6C,CAAC,GACvE;QACJ;IACF;IAEA,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAMkE,kBAAkB5B,cAAcwB,eAAeH;IACrD,IAAIO,mBAAmB,QAAQA,kBAAkBlE,aAAa;QAC5DkD,SAASI,IAAI,CAAC;YACZC,MAAM,GAAGJ,GAAG,eAAe,CAAC;YAC5BK,SACE,CAAC,sBAAsB,EAAET,OAAO,eAAe,CAAC,GAChD,GAAGH,MAAMsB,iBAAiB,0CAA0C,CAAC,GACrE;QACJ;IACF;IAEA,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,KAAK,MAAMC,OAAO;QAAC;QAAW;QAAa;QAAY;KAAQ,CAAW;QACxE,MAAMC,QAAQpB,MAAM,CAACmB,IAAI;QACzB,MAAMtB,QAAQP,cAAc8B,yBAAAA,MAAOC,YAAY,EAAED,yBAAAA,MAAOV,IAAI;QAC5D,IAAIb,SAAS,QAAQA,QAAQ5C,mBAAmB;YAC9CiD,SAASI,IAAI,CAAC;gBACZC,MAAM,GAAGJ,GAAG,CAAC,EAAEgB,IAAI,aAAa,CAAC;gBACjCX,SACE,CAAC,IAAI,EAAET,OAAO,CAAC,EAAEoB,IAAI,iBAAiB,EAAEvB,MAAMC,OAAO,eAAe,CAAC,GACrE,CAAC,gBAAgB,EAAE5C,kBAAkB,8BAA8B,CAAC,GACpE;YACJ;QACF;IACF;AACF;AAEA;;;;;;CAMC,GACD,SAASqE,iBAAiBC,KAAgB;;QAEpCA,mBACgCA;IAFpC,MAAMC,SAAmB,EAAE;IAC3B,KAAID,oBAAAA,MAAME,UAAU,qBAAhBF,kBAAkBG,UAAU,EAAEF,OAAOlB,IAAI,CAACiB,MAAME,UAAU,CAACC,UAAU;IACzE,KAAK,MAAMC,WAAWvB,OAAOwB,MAAM,UAACL,qBAAAA,MAAME,UAAU,qBAAhBF,mBAAkBM,QAAQ,mBAAI,CAAC,GAAI;QACrE,IAAIF,2BAAAA,QAASD,UAAU,EAAEF,OAAOlB,IAAI,CAACqB,QAAQD,UAAU;IACzD;IACA,MAAMjB,UAAoB,EAAE;IAC5B,KAAK,MAAMqB,SAASN,OAAQ;YACZM;QAAd,MAAMtC,SAAQsC,gBAAAA,MAAMvD,KAAK,CAAC,IAAI,CAAC,EAAE,qBAAnBuD,cAAqBnE,IAAI,GAAGoE,OAAO,CAAC,gBAAgB;QAClE,IAAIvC,OAAOiB,QAAQH,IAAI,CAACd;IAC1B;IACA,OAAOiB;AACT;AAEA,SAASuB,cACPT,KAAgB,EAChBrB,QAAgC;QAG7BqB;IADH,MAAMU,WAAW,IAAI7E,IACnB,EAACmE,eAAAA,MAAMW,KAAK,YAAXX,eAAe,EAAE,EACflE,GAAG,CAAC,CAAC8E;YAAwBA;gBAAAA,eAAAA,KAAK7E,MAAM,qBAAX6E,aAAaxE,IAAI,GAAGJ,WAAW;OAC5DiB,MAAM,CAACC;IAEZ,MAAM2D,OAAO,IAAIhF;IACjB,KAAK,MAAME,UAAUgE,iBAAiBC,OAAQ;QAC5C,MAAMJ,MAAM7D,OAAOC,WAAW;QAC9B,IAAI6E,KAAKC,GAAG,CAAClB,QAAQc,SAASI,GAAG,CAAClB,QAAQhE,gBAAgBkF,GAAG,CAAClB,MAAM;QACpEiB,KAAKE,GAAG,CAACnB;QACTjB,SAASI,IAAI,CAAC;YACZC,MAAM;YACNC,SACE,CAAC,CAAC,EAAElD,OAAO,0DAA0D,CAAC,GACtE,yEACA;QACJ;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASiF,wBACdhB,KAAmC;IAEnC,MAAMtB,SAAiC,EAAE;IACzC,MAAMC,WAAmC,EAAE;IAE3C,IAAI,CAACqB,SAAS,CAACnB,OAAOC,IAAI,CAACkB,OAAOxD,MAAM,EAAE;QACxC,OAAO;YACLyE,IAAI;YACJvC,QAAQ;gBACN;oBACEM,MAAM;oBACNC,SACE,oEACA;gBACJ;aACD;YACDN;QACF;IACF;IAEA,KAAK,MAAMH,UAAU7C,QAAS;YACLqE;QAAvBzB,eAAeC,SAAQwB,sBAAAA,MAAMkB,YAAY,qBAAlBlB,mBAAoB,CAACxB,OAAO,EAAEE,QAAQC;IAC/D;IACA8B,cAAcT,OAAOrB;IAErB,OAAO;QAAEsC,IAAI,CAACvC,OAAOlC,MAAM;QAAEkC;QAAQC;IAAS;AAChD;AAEA;;;;;;;;;;;;;;;CAeC,GACD,MAAMwC,wBAAoE;IACxED,cAAc;IACdhB,YAAY;IACZS,OAAO;IACPS,OAAO;IACPC,SAAS;IACTC,QAAQ;IACRC,YAAY;IACZC,YAAY;AACd;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,qBACdzB,KAAmC;IAEnC,MAAM0B,UAAmC,CAAC;IAC1C,IAAI,CAAC1B,OAAO,OAAO0B;IACnB,KAAK,MAAM,CAAC9B,KAAK+B,MAAM,IAAI9C,OAAO+C,OAAO,CAACT,uBAAwB;QAChE,IAAI,CAACQ,OAAO;QACZ,MAAMzF,QAAQ,AAAC8D,KAAiC,CAACJ,IAAI;QACrD,IAAI1D,SAAS,MAAM;QACnB,IAAI2F,MAAMC,OAAO,CAAC5F,SAAS,CAACA,MAAMM,MAAM,GAAG,OAAON,UAAU,WACxD,CAAC2C,OAAOC,IAAI,CAAC5C,OAAiBM,MAAM,GACpC,OAAO;YACT;QACF;QACAkF,OAAO,CAAC9B,IAAI,GAAG1D;IACjB;IACA,OAAOwF;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASK,cAAc/B,KAAmC;cAmBhCA;QAVjBA,cAEVA,mBAIAA;IAdJ,IAAI,CAACA,OAAO,OAAO,EAAE;IACrB,MAAMjD,QAAkB,EAAE;IAC1B,MAAMiF,UAAUrG,QAAQsB,MAAM,CAC5B,CAACuB;;YAAuBwB;eAAZnB,OAAOC,IAAI,UAACkB,sBAAAA,MAAMkB,YAAY,qBAAlBlB,mBAAoB,CAACxB,OAAO,mBAAI,CAAC,GAAGhC,MAAM;;IAEpE,IAAIwF,QAAQxF,MAAM,KAAK,GAAGO,MAAMgC,IAAI,CAAC;SAChC,IAAIiD,QAAQxF,MAAM,KAAK,GAAGO,MAAMgC,IAAI,CAAC,GAAGiD,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC;IAErE,MAAMrB,iBAAQX,eAAAA,MAAMW,KAAK,qBAAXX,aAAaxD,MAAM,mBAAI;IACrC,IAAImE,OAAO5D,MAAMgC,IAAI,CAAC,GAAG4B,MAAM,KAAK,EAAEA,UAAU,IAAI,KAAK,KAAK;IAC9D,KAAIX,oBAAAA,MAAME,UAAU,qBAAhBF,kBAAkBM,QAAQ,EAAE;QAC9B,MAAM2B,QAAQpD,OAAOC,IAAI,CAACkB,MAAME,UAAU,CAACI,QAAQ,EAAE9D,MAAM;QAC3D,IAAIyF,OAAOlF,MAAMgC,IAAI,CAAC,GAAGkD,MAAM,WAAW,EAAEA,UAAU,IAAI,KAAK,KAAK;IACtE;IACA,IAAIjC,EAAAA,eAAAA,MAAMoB,KAAK,qBAAXpB,aAAakC,YAAY,KAAI,MAAM;QACrCnF,MAAMgC,IAAI,CAAC,GAAGiB,MAAMoB,KAAK,CAACc,YAAY,CAAC,UAAU,CAAC;IACpD;IACA,IAAI,OAAOlC,MAAMqB,OAAO,KAAK,UAAUtE,MAAMgC,IAAI,CAAC,GAAGiB,MAAMqB,OAAO,CAAC,UAAU,CAAC;IAC9E,MAAME,aAAa1C,OAAOC,IAAI,EAACkB,oBAAAA,MAAMuB,UAAU,YAAhBvB,oBAAoB,CAAC,GAAGxD,MAAM;IAC7D,IAAI+E,YAAY;QACdxE,MAAMgC,IAAI,CAAC,GAAGwC,WAAW,gBAAgB,EAAEA,eAAe,IAAI,KAAK,KAAK;IAC1E;IACA,OAAOxE;AACT;AAEA;;4EAE4E,GAE5E;;;;;;;CAOC,GACD,OAAO,MAAMoF,uBAAuB,gBAAe;AAWnD,0EAA0E,GAC1E,OAAO,SAASC,kBACdC,IAA0C;IAE1C,2EAA2E;IAC3E,sEAAsE;IACtE,mDAAmD;IACnD,OAAO9G,qBAAqB;QAAE+G,SAAS,EAAED,wBAAAA,KAAME,aAAa;IAAC;AAC/D;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC,iBACdH,IAA0C;;IAE1C,MAAMI,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI0C;IAC5B,MAAMC,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,UAAU,OAAOF;IACtB,OAAOjH,gBAA2BiH,eAAAA,OAAQ,CAAC,GAAGE,SAASC,KAAK;AAC9D;AAsBA,MAAMC,gBAA4C;IAChD;IACA;IACA;IACA;CACD;AAED,OAAO,SAASC,gBACdT,IAA0C;QAE1BA,sBAKZA;IALJ,MAAMU,SAAUV,yBAAAA,uBAAAA,KAAMW,cAAc,qBAArB,AAACX,qBACZY,IAAI;IACR,IAAIJ,cAAcK,QAAQ,CAACH,SAA4B;QACrD,OAAOA;IACT;IACA,IAAIV,yBAAAA,2BAAAA,KAAMc,kBAAkB,qBAAxBd,yBAA0Be,SAAS,EAAE,OAAO;IAChD,OAAOf,CAAAA,wBAAAA,KAAMrC,KAAK,KAAInB,OAAOC,IAAI,CAACuD,KAAKrC,KAAK,EAAExD,MAAM,GAAG,WAAW;AACpE;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAAS6G,0BACdhB,IAA0C;QAIxBA;IAFlB,MAAMM,WAAWP,kBAAkBC;IACnC,IAAI,EAACM,4BAAAA,SAAUW,UAAU,GAAE,OAAO;IAClC,MAAMC,YAAYlB,yBAAAA,2BAAAA,KAAMc,kBAAkB,qBAAxBd,yBAA0BmB,MAAM;IAClD,IAAI,CAACD,WAAW,OAAO;IACvB,OAAOZ,SAASW,UAAU,KAAKC;AACjC;AAgBA,MAAME,iBAAyC;IAC7CjC,YAAY;IACZN,cAAc;IACdhB,YAAY;IACZqB,YAAY;IACZH,OAAO;IACPC,SAAS;IACTV,OAAO;IACPW,QAAQ;IACRhB,UAAU;IACVlB,YAAY;IACZjD,MAAM;IACNgD,MAAM;IACNW,cAAc;IACdoC,cAAc;IACd/B,YAAY;AACd;AAEA;;;;;;CAMC,GACD,OAAO,SAASuD,kBAAkB1E,IAAY;IAC5C,MAAM2E,WAAW3E,KAAKhC,KAAK,CAAC,KAAKC,MAAM,CAACC;IACxC,MAAM0G,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWF,SAAU;QAC9B,MAAMG,SAASL,cAAc,CAACI,QAAQ;QACtC,IAAIC,WAAW,IAAI;QACnBF,MAAM7E,IAAI,CAAC+E,iBAAAA,SAAUD;IACvB;IACA,OAAOD,MAAMG,IAAI,CAAC,UAAU;AAC9B;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,sBACd3B,IAA0C;;IAE1C,MAAMM,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,UAAU,OAAO,EAAE;IACxB,MAAMF,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC;IAC7B,MAAMiE,WAAWzI,gBAA2BiH,MAAME,SAASC,KAAK;IAChE,OAAOtH,cAAcqH,SAASC,KAAK,EAAE9G,GAAG,CAAC,CAACkD;QACxC,MAAM2E,WAAW3E,KAAKhC,KAAK,CAAC;QAC5B,MAAMwB,SACJmF,QAAQ,CAAC,EAAE,KAAK,kBACfA,CAAAA,QAAQ,CAAC,EAAE,KAAK,WAAWA,QAAQ,CAAC,EAAE,KAAK,MAAK,IAC5CA,QAAQ,CAAC,EAAE,GACZjB;QACN,OAAO;YACL1D;YACAkF,OAAOR,kBAAkB1E;YACzBR;YACA2F,YAAYC,cAAc3B,MAAMzD;YAChCqF,eAAeD,cAAcH,UAAUjF;QACzC;IACF;AACF;AAEA,wCAAwC,GACxC,SAASoF,cAAcpE,KAAc,EAAEhB,IAAY;IACjD,IAAIsF,SAAkBtE;IACtB,KAAK,MAAM6D,WAAW7E,KAAKhC,KAAK,CAAC,KAAM;QACrC,IAAIsH,UAAU,QAAQ,OAAOA,WAAW,UAAU,OAAO5B;QACzD4B,SAAS,AAACA,MAAkC,CAACT,QAAQ;IACvD;IACA,OAAOS;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASC,mBACdlC,IAA0C,EAC1CmC,MAAiB;;IAEjB,OAAOrJ,qBAAakH,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC,GAAGwE;AACzC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,qBACdpC,IAA0C,EAC1CqC,QAAmB;;IAEnB,MAAM/B,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,YAAYvH,gBAAgBuH,SAASC,KAAK,GAAG,OAAO,EAAE;IAC3D,MAAMH,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC;IAC7B,MAAMiE,WAAWzI,gBAA2BiH,MAAME,SAASC,KAAK;IAChE,OAAOvH,kBAAkBoH,MAAME,SAASC,KAAK,EAAE8B,UAAU5I,GAAG,CAAC,CAACkD,OAAU,CAAA;YACtEA;YACAkF,OAAOR,kBAAkB1E;YACzBR,QACEQ,KAAK2F,UAAU,CAAC,yBACX,UACD3F,KAAK2F,UAAU,CAAC,wBACb,SACDjC;YACRyB,YAAYC,cAAcM,UAAU1F;YACpCqF,eAAeD,cAAcH,UAAUjF;QACzC,CAAA;AACF"}
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/site-theme.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  HostTheme,\n  HostThemeFont,\n  HostThemeScheme,\n  HostThemeSchemeColors,\n} from '@aglyn/shared-data-types'\nimport {\n  diffOverride,\n  isEmptyOverride,\n  overrideConflicts,\n  overridePaths,\n  overrideWriteValue,\n  readArtifactOverride,\n  resolveOverride,\n  type ArtifactOverride,\n} from './artifact-overrides'\n\n/**\n * A site's theme (AGL-1020, named for it in AGL-3080): whether one is complete\n * and readable, what it resolves to once the site's own edits are applied over\n * an installed theme, and where it came from.\n *\n * Every reader is a platform surface or a plugin that is not the installer —\n * the published page and its manifest, every besigner canvas, the site's theme\n * settings, the AI plugin's theme proposals, the themes plugin's presets — so\n * it is core's. It was first written for the marketplace's publish route,\n * which is why the validation below is phrased as a gate on publishing; it is\n * the same gate for a theme a model proposes.\n *\n * ## Validating a theme\n *\n * A plugin bundle is validated because it is code and the risk is a\n * compromised site. A theme is data, so the risk is different in kind but not\n * in consequence: the failure mode is an unreadable or half-painted site, which\n * a publisher cannot see from their own machine because their fonts are\n * installed and their eyes already know what the text says.\n *\n * Both of the things that go wrong are mechanically checkable, so they are\n * checked here rather than left to review:\n *\n * * **Completeness.** Light and dark are not one palette with a filter. A theme\n *   that defines only light is half a theme, and installing it leaves every\n *   dark-mode visitor on MUI's stock blue — which reads as the site being\n *   broken, not as the theme being partial.\n * * **Contrast.** Text on its background, and label on its button, are the two\n *   pairs that make a site unusable when they are wrong. WCAG gives an exact\n *   ratio, so \"is this readable\" has an answer rather than an opinion.\n *\n * Errors refuse the publish; warnings are shown and can be published past. The\n * split is deliberate — a 3.9:1 heading is a judgement call a designer may\n * legitimately win, but a theme with no dark scheme is not a complete artifact\n * whoever is asking.\n *\n * Pure and MUI-free so the publish route, the console's pre-flight and the\n * tests all reach the same verdict from the same code.\n */\n\nexport interface ThemeValidationIssue {\n  /** Dotted path into the theme, so the editor can focus the offending field. */\n  path: string\n  message: string\n}\n\nexport interface ThemeValidation {\n  /** No errors. Warnings do not block. */\n  ok: boolean\n  errors: ThemeValidationIssue[]\n  warnings: ThemeValidationIssue[]\n}\n\n/**\n * WCAG AA for body text. The same 4.5 the accessibility audit uses, rather\n * than a house number, so a theme that passes here passes there.\n */\nexport const CONTRAST_AA = 4.5\n\n/**\n * WCAG AA for large text (18pt+/14pt bold) and UI component boundaries. Button\n * labels are judged against this rather than 4.5 because they are large, short\n * and centred, and holding them to body-text contrast rejects palettes that are\n * genuinely fine.\n */\nexport const CONTRAST_AA_LARGE = 3\n\nconst SCHEMES: HostThemeScheme[] = ['light', 'dark']\n\n/**\n * Font families that need no loading. Anything else is either declared in the\n * theme's own `fonts` array or will silently fall back to the browser's default\n * — which is the failure the issue calls out, so it is at least a warning.\n */\nconst SYSTEM_FAMILIES = new Set(\n  [\n    'system-ui',\n    'sans-serif',\n    'serif',\n    'monospace',\n    'cursive',\n    'fantasy',\n    'ui-sans-serif',\n    'ui-serif',\n    'ui-monospace',\n    'ui-rounded',\n    '-apple-system',\n    'blinkmacsystemfont',\n    'segoe ui',\n    'roboto',\n    'helvetica',\n    'helvetica neue',\n    'arial',\n    'georgia',\n    'times new roman',\n    'courier new',\n    'inherit',\n    'initial',\n  ].map((family) => family.toLowerCase()),\n)\n\n/**\n * Parses a CSS colour into sRGB channels, or null when it is not something we\n * can reason about.\n *\n * `null` means \"not checked\", never \"failed\": a theme is free to use `color-mix`\n * or a CSS variable, and refusing to publish because this parser is narrower\n * than CSS would be a validator inventing a rule the platform does not have.\n */\nexport function parseColor(\n  value: unknown,\n): { r: number; g: number; b: number } | null {\n  if (typeof value !== 'string') return null\n  const text = value.trim().toLowerCase()\n\n  const hex = /^#([0-9a-f]{3,8})$/.exec(text)\n  if (hex) {\n    const digits = hex[1]\n    if (digits.length === 3 || digits.length === 4) {\n      return {\n        r: parseInt(digits[0] + digits[0], 16),\n        g: parseInt(digits[1] + digits[1], 16),\n        b: parseInt(digits[2] + digits[2], 16),\n      }\n    }\n    if (digits.length === 6 || digits.length === 8) {\n      return {\n        r: parseInt(digits.slice(0, 2), 16),\n        g: parseInt(digits.slice(2, 4), 16),\n        b: parseInt(digits.slice(4, 6), 16),\n      }\n    }\n    return null\n  }\n\n  const rgb = /^rgba?\\(([^)]+)\\)$/.exec(text)\n  if (rgb) {\n    const parts = rgb[1].split(/[,/\\s]+/).filter(Boolean)\n    if (parts.length < 3) return null\n    const channels = parts.slice(0, 3).map((part) =>\n      part.endsWith('%')\n        ? (Number(part.slice(0, -1)) / 100) * 255\n        : Number(part),\n    )\n    if (channels.some((channel) => !Number.isFinite(channel))) return null\n    const [r, g, b] = channels\n    return { r, g, b }\n  }\n\n  if (text === 'white') return { r: 255, g: 255, b: 255 }\n  if (text === 'black') return { r: 0, g: 0, b: 0 }\n  return null\n}\n\n/** WCAG relative luminance. */\nfunction luminance(channels: { r: number; g: number; b: number }): number {\n  const channel = (raw: number) => {\n    const value = Math.min(255, Math.max(0, raw)) / 255\n    return value <= 0.03928 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4\n  }\n  return (\n    0.2126 * channel(channels.r) +\n    0.7152 * channel(channels.g) +\n    0.0722 * channel(channels.b)\n  )\n}\n\n/**\n * WCAG contrast ratio between two colours, or null when either is unparseable.\n * Ranges 1 (identical) to 21 (black on white).\n */\nexport function contrastRatio(a: unknown, b: unknown): number | null {\n  const first = parseColor(a)\n  const second = parseColor(b)\n  if (!first || !second) return null\n  const light = Math.max(luminance(first), luminance(second))\n  const dark = Math.min(luminance(first), luminance(second))\n  return (light + 0.05) / (dark + 0.05)\n}\n\nconst round = (ratio: number) => Math.round(ratio * 10) / 10\n\n/**\n * The colours a scheme must actually define to be usable on its own.\n *\n * Deliberately short. MUI derives an enormous amount from very little, and\n * demanding a full palette would reject good themes; but a scheme that names no\n * primary, no background and no text has not expressed an identity at all — it\n * is an empty object that happens to have a key.\n */\nfunction validateScheme(\n  scheme: HostThemeScheme,\n  colors: HostThemeSchemeColors | undefined,\n  errors: ThemeValidationIssue[],\n  warnings: ThemeValidationIssue[],\n): void {\n  const at = `colorSchemes.${scheme}`\n  if (!colors || !Object.keys(colors).length) {\n    errors.push({\n      path: at,\n      message:\n        `This theme defines no ${scheme} scheme. Light and dark are not one ` +\n        'palette with a filter — install it and every visitor in ' +\n        `${scheme} mode sees the stock palette instead of your design.`,\n    })\n    return\n  }\n  if (!colors.primary?.main) {\n    errors.push({\n      path: `${at}.primary.main`,\n      message: `The ${scheme} scheme has no primary color.`,\n    })\n  }\n\n  const background = colors.background?.default\n  const paper = colors.background?.paper\n  const text = colors.text?.primary\n  const secondaryText = colors.text?.secondary\n\n  // Text on background is the pair that decides whether a site can be read at\n  // all, so it is the one contrast failure that refuses the publish.\n  const bodyContrast = contrastRatio(text, background)\n  if (bodyContrast != null && bodyContrast < CONTRAST_AA) {\n    errors.push({\n      path: `${at}.text.primary`,\n      message:\n        `Body text on the ${scheme} background is ${round(bodyContrast)}:1, ` +\n        `below the ${CONTRAST_AA}:1 minimum for readable text.`,\n    })\n  }\n\n  const paperContrast = contrastRatio(text, paper)\n  if (paperContrast != null && paperContrast < CONTRAST_AA) {\n    errors.push({\n      path: `${at}.background.paper`,\n      message:\n        `Body text on ${scheme} cards and menus is ${round(paperContrast)}:1, ` +\n        `below the ${CONTRAST_AA}:1 minimum. Surfaces inherit this everywhere ` +\n        'a Paper is used, which is most of the site.',\n    })\n  }\n\n  // Secondary text is legitimately dimmer by design, so it warns rather than\n  // refuses — but silently shipping unreadable captions is worse than saying so.\n  const captionContrast = contrastRatio(secondaryText, background)\n  if (captionContrast != null && captionContrast < CONTRAST_AA) {\n    warnings.push({\n      path: `${at}.text.secondary`,\n      message:\n        `Secondary text on the ${scheme} background is ` +\n        `${round(captionContrast)}:1. Captions and helper text will be hard ` +\n        'to read.',\n    })\n  }\n\n  // A button whose label disappears into its own fill. Only checkable when the\n  // theme states contrastText — otherwise MUI derives one, and derives it well.\n  // Every accent a button can be filled with. Tertiary is one (AGL-3411):\n  // `<Button color=\"tertiary\">` is offered wherever primary and secondary are.\n  for (const key of ['primary', 'secondary', 'tertiary', 'error'] as const) {\n    const color = colors[key]\n    const ratio = contrastRatio(color?.contrastText, color?.main)\n    if (ratio != null && ratio < CONTRAST_AA_LARGE) {\n      warnings.push({\n        path: `${at}.${key}.contrastText`,\n        message:\n          `The ${scheme} ${key} button label is ${round(ratio)}:1 against its ` +\n          `own fill, below ${CONTRAST_AA_LARGE}:1. Leave contrast text unset ` +\n          'to let the theme derive a readable one.',\n      })\n    }\n  }\n}\n\n/**\n * Every family named in the typography, split out of its CSS stack.\n *\n * A stack is a fallback chain, so only the FIRST entry is the one the design\n * depends on; the rest exist precisely to be substituted and warning about them\n * would be noise.\n */\nfunction declaredFamilies(theme: HostTheme): string[] {\n  const stacks: string[] = []\n  if (theme.typography?.fontFamily) stacks.push(theme.typography.fontFamily)\n  for (const variant of Object.values(theme.typography?.variants ?? {})) {\n    if (variant?.fontFamily) stacks.push(variant.fontFamily)\n  }\n  const primary: string[] = []\n  for (const stack of stacks) {\n    const first = stack.split(',')[0]?.trim().replace(/^[\"']|[\"']$/g, '')\n    if (first) primary.push(first)\n  }\n  return primary\n}\n\nfunction validateFonts(\n  theme: HostTheme,\n  warnings: ThemeValidationIssue[],\n): void {\n  const loadable = new Set(\n    (theme.fonts ?? [])\n      .map((font: HostThemeFont) => font.family?.trim().toLowerCase())\n      .filter(Boolean) as string[],\n  )\n  const seen = new Set<string>()\n  for (const family of declaredFamilies(theme)) {\n    const key = family.toLowerCase()\n    if (seen.has(key) || loadable.has(key) || SYSTEM_FAMILIES.has(key)) continue\n    seen.add(key)\n    warnings.push({\n      path: 'typography.fontFamily',\n      message:\n        `\"${family}\" is used but not listed in the theme's fonts, so it will ` +\n        'only appear on machines that happen to have it installed. Add it as ' +\n        'a Google font, or fall back to a system family.',\n    })\n  }\n}\n\n/**\n * Validates a theme for publishing.\n *\n * The same function backs the console's pre-flight and the publish route: a\n * publisher who is told \"this will be refused\" and then has it accepted (or the\n * reverse) stops trusting either, so there is one verdict from one place.\n */\nexport function validateThemeForPublish(\n  theme: HostTheme | null | undefined,\n): ThemeValidation {\n  const errors: ThemeValidationIssue[] = []\n  const warnings: ThemeValidationIssue[] = []\n\n  if (!theme || !Object.keys(theme).length) {\n    return {\n      ok: false,\n      errors: [\n        {\n          path: '',\n          message:\n            'This site has no theme customisations yet, so there is nothing ' +\n            'to publish.',\n        },\n      ],\n      warnings,\n    }\n  }\n\n  for (const scheme of SCHEMES) {\n    validateScheme(scheme, theme.colorSchemes?.[scheme], errors, warnings)\n  }\n  validateFonts(theme, warnings)\n\n  return { ok: !errors.length, errors, warnings }\n}\n\n/**\n * Every field of a `HostTheme` that is part of the published artifact.\n *\n * Typed as a total record over `keyof HostTheme` on purpose: adding a field to\n * `HostTheme` fails to compile here until someone decides whether it ships. The\n * alternative — a hand-written list of `if` statements — silently drops the new\n * field, and a theme that loses one is not obviously broken, it is subtly\n * wrong. `mixins` arrived exactly that way (AGL-1242, toolbar heights) while\n * this was being written, which is why the check is a type and not a comment.\n *\n * A `false` means \"host-local, never published\". `darkScheme` is the one such\n * field: whether visitors get a dark scheme is a decision about a SITE's\n * content (does it read in dark?), not about the design being published, so a\n * publisher's opt-out must not travel with the theme and an installer's must\n * not read as a divergence from it.\n */\nconst THEME_ARTIFACT_FIELDS: Record<keyof Required<HostTheme>, boolean> = {\n  colorSchemes: true,\n  typography: true,\n  fonts: true,\n  shape: true,\n  spacing: true,\n  mixins: true,\n  components: true,\n  darkScheme: false,\n}\n\n/**\n * The theme content as published — the artifact and nothing else.\n *\n * What goes in here is what \"reset to the publisher's version\" restores and\n * what the update diff compares against, so it must hold no per-install data:\n * a host document also carries `updatedAt`, `updatedBy` and whatever else the\n * editor writes alongside, and any of those in the content would read as a user\n * edit on the next diff.\n *\n * Empty branches are dropped so two themes that render identically also hash\n * identically — `{fonts: []}` and `{}` must not produce two base snapshots.\n */\nexport function themeArtifactContent(\n  theme: HostTheme | null | undefined,\n): HostTheme {\n  const content: Record<string, unknown> = {}\n  if (!theme) return content\n  for (const [key, ships] of Object.entries(THEME_ARTIFACT_FIELDS)) {\n    if (!ships) continue\n    const value = (theme as Record<string, unknown>)[key]\n    if (value == null) continue\n    if (Array.isArray(value) ? !value.length : typeof value === 'object'\n      ? !Object.keys(value as object).length\n      : false) {\n      continue\n    }\n    content[key] = value\n  }\n  return content\n}\n\n/**\n * A short, human summary of what a theme actually contains, for the install\n * confirmation and the listing card.\n *\n * Installing a theme replaces a site's visual identity, so the confirmation has\n * to say what is about to change in terms someone recognises — \"both schemes,\n * 2 fonts, 4 component styles\" — rather than showing them a JSON blob and\n * asking them to agree to it.\n */\nexport function describeTheme(theme: HostTheme | null | undefined): string[] {\n  if (!theme) return []\n  const parts: string[] = []\n  const schemes = SCHEMES.filter(\n    (scheme) => Object.keys(theme.colorSchemes?.[scheme] ?? {}).length,\n  )\n  if (schemes.length === 2) parts.push('Light and dark schemes')\n  else if (schemes.length === 1) parts.push(`${schemes[0]} scheme only`)\n\n  const fonts = theme.fonts?.length ?? 0\n  if (fonts) parts.push(`${fonts} font${fonts === 1 ? '' : 's'}`)\n  if (theme.typography?.variants) {\n    const count = Object.keys(theme.typography.variants).length\n    if (count) parts.push(`${count} text style${count === 1 ? '' : 's'}`)\n  }\n  if (theme.shape?.borderRadius != null) {\n    parts.push(`${theme.shape.borderRadius}px corners`)\n  }\n  if (typeof theme.spacing === 'number') parts.push(`${theme.spacing}px spacing`)\n  const components = Object.keys(theme.components ?? {}).length\n  if (components) {\n    parts.push(`${components} component style${components === 1 ? '' : 's'}`)\n  }\n  return parts\n}\n\n/* ------------------------------------------------------------------------ *\n * The override layer, applied to themes (AGL-1021)\n * ------------------------------------------------------------------------ */\n\n/**\n * The field on a host document holding the site's theme override.\n *\n * A theme is a FIELD on the host, not a document of its own, so it cannot use\n * `ARTIFACT_OVERRIDE_FIELD` — a host may one day override more than one thing,\n * and a bare `overrides` would be the first to claim the name. The override\n * layer is general precisely so a namespaced field works with it unchanged.\n */\nexport const THEME_OVERRIDE_FIELD = 'themeOverride'\n\n/** A host document, as far as the theme layer is concerned. */\nexport interface ThemeHostDocument {\n  theme?: HostTheme | null\n  themeOverride?: unknown\n  themeInstalledFrom?: { sha256?: string | null; listingId?: string } | null\n  /** The library theme the site picked (AGL-3404) — see `theme-library`. */\n  themeSelection?: unknown\n}\n\n/** Reads the stored theme override off a host document, tolerating junk. */\nexport function readThemeOverride(\n  host: ThemeHostDocument | null | undefined,\n): ArtifactOverride | undefined {\n  // The override layer's reader is keyed to its own field name, so hand it a\n  // shim rather than duplicating its validation — which is where the \"a\n  // top-level null blanks the artifact\" guard lives.\n  return readArtifactOverride({ overrides: host?.themeOverride })\n}\n\n/**\n * The site's effective theme: the marketplace theme (or the site's own) with\n * this site's overrides resolved over it.\n *\n * This is the MIDDLE and TOP of the three layers the issue describes. The\n * bottom — the platform default — is applied further down by\n * `HostThemeProvider`, which layers whatever this returns onto the brand base\n * (AGL-1180) so a theme that omits a value still yields a complete theme\n * rather than an undefined-shaped hole. Doing it there rather than here is not\n * a detail: the default is a runtime MUI theme with FUNCTION style overrides\n * that JSON cannot represent, so a \"default\" merged at this layer would be a\n * lossy copy of the real one.\n *\n * Every surface that renders a site's appearance calls this — the tenant, all\n * four besigner editors, and the document preview — because a theme that\n * resolves differently in the editor than on the site is worse than one that\n * does not resolve at all.\n */\nexport function resolveSiteTheme(\n  host: ThemeHostDocument | null | undefined,\n): HostTheme | undefined {\n  const base = host?.theme ?? undefined\n  const override = readThemeOverride(host)\n  if (!override) return base\n  return resolveOverride<HostTheme>(base ?? {}, override.patch)\n}\n\n/**\n * Where a site's theme came from (AGL-2938).\n *\n * - `installed` — a marketplace theme. The site's edits are its override\n *   patch over the publisher's version, which stays untouched and can still\n *   take an update.\n * - `preset` — a built-in theme a plugin contributes (AGL-3404).\n * - `custom` — one of the site's own themes.\n * - `default` — the platform default.\n *\n * Whichever it is, an edit is an override patch over the picked theme and the\n * theme itself is never rewritten (AGL-3404), so every source can be restored.\n *\n * One reading for every surface that needs it — the page that lays out the\n * Theme section, a widget proposing a change there, and a generator deciding\n * what its change will be stored as — so none of them can file a site under\n * a different source than the save path does.\n */\nexport type HostThemeSource = 'installed' | 'preset' | 'custom' | 'default'\n\nconst THEME_SOURCES: readonly HostThemeSource[] = [\n  'installed',\n  'preset',\n  'custom',\n  'default',\n]\n\nexport function hostThemeSource(\n  host: ThemeHostDocument | null | undefined,\n): HostThemeSource {\n  const picked = (host?.themeSelection as { kind?: unknown } | null | undefined)\n    ?.kind\n  if (THEME_SOURCES.includes(picked as HostThemeSource)) {\n    return picked as HostThemeSource\n  }\n  if (host?.themeInstalledFrom?.listingId) return 'installed'\n  return host?.theme && Object.keys(host.theme).length ? 'custom' : 'default'\n}\n\n/**\n * Was this override authored against the theme currently installed?\n *\n * False after a theme swap, which is the whole reason `baseSha256` is recorded.\n * Overrides deliberately SURVIVE a swap (the issue's call, and the right one —\n * a brand colour still expresses intent when the theme underneath it changes)\n * but surviving silently is what would surprise people, so every surface that\n * shows an override can ask this and say so.\n *\n * True when there is no override, and when either side has no hash to compare:\n * \"we cannot tell\" must not render as \"these are stale\".\n */\nexport function isOverrideForCurrentTheme(\n  host: ThemeHostDocument | null | undefined,\n): boolean {\n  const override = readThemeOverride(host)\n  if (!override?.baseSha256) return true\n  const installed = host?.themeInstalledFrom?.sha256\n  if (!installed) return true\n  return override.baseSha256 === installed\n}\n\n/** One row of the \"what have I changed?\" view. */\nexport interface ThemeOverrideEntry {\n  /** Dotted path into the theme, e.g. `colorSchemes.dark.primary.main`. */\n  path: string\n  /** A human label for the path, for a UI that is not a JSON viewer. */\n  label: string\n  /** Which scheme this touches, when it touches one. */\n  scheme?: HostThemeScheme\n  /** The publisher's value, or undefined when the override adds the field. */\n  themeValue: unknown\n  /** What this site set it to, or undefined when the override removes it. */\n  overrideValue: unknown\n}\n\nconst SEGMENT_LABELS: Record<string, string> = {\n  darkScheme: 'Dark scheme',\n  colorSchemes: 'Color',\n  typography: 'Typography',\n  components: 'Component',\n  shape: 'Shape',\n  spacing: 'Spacing',\n  fonts: 'Fonts',\n  mixins: 'Layout',\n  variants: '',\n  background: 'background',\n  text: 'text',\n  main: '',\n  contrastText: 'label color',\n  borderRadius: 'corner radius',\n  fontFamily: 'font',\n}\n\n/**\n * A readable label for a theme path.\n *\n * \"Colour · dark · primary\" beats `colorSchemes.dark.primary.main`, and the\n * difference matters because this list is the answer to \"what have I changed?\"\n * — a question nobody asks wanting to read JSON paths.\n */\nexport function describeThemePath(path: string): string {\n  const segments = path.split('.').filter(Boolean)\n  const words: string[] = []\n  for (const segment of segments) {\n    const mapped = SEGMENT_LABELS[segment]\n    if (mapped === '') continue\n    words.push(mapped ?? segment)\n  }\n  return words.join(' · ') || 'the whole theme'\n}\n\n/**\n * \"What have I changed?\" — the patch, rendered.\n *\n * Literally a read of the stored override rather than a diff computed at call\n * time, which is the property the whole layer exists to provide: the answer is\n * the thing that was saved, so it cannot disagree with what will be applied.\n */\nexport function describeThemeOverride(\n  host: ThemeHostDocument | null | undefined,\n): ThemeOverrideEntry[] {\n  const override = readThemeOverride(host)\n  if (!override) return []\n  const base = host?.theme ?? {}\n  const resolved = resolveOverride<HostTheme>(base, override.patch)\n  return overridePaths(override.patch).map((path) => {\n    const segments = path.split('.')\n    const scheme =\n      segments[0] === 'colorSchemes' &&\n      (segments[1] === 'light' || segments[1] === 'dark')\n        ? (segments[1] as HostThemeScheme)\n        : undefined\n    return {\n      path,\n      label: describeThemePath(path),\n      scheme,\n      themeValue: readThemePath(base, path),\n      overrideValue: readThemePath(resolved, path),\n    }\n  })\n}\n\n/** Copy-on-write set of a dotted path; `undefined` removes the key. */\nfunction setThemePath(target: unknown, path: string[], value: unknown): any {\n  const [head, ...rest] = path\n  const container: Record<string, unknown> =\n    target != null && typeof target === 'object' && !Array.isArray(target)\n      ? { ...(target as Record<string, unknown>) }\n      : {}\n  if (!rest.length) {\n    if (value === undefined) delete container[head]\n    else container[head] = value\n    return container\n  }\n  container[head] = setThemePath(container[head], rest, value)\n  return container\n}\n\n/**\n * The `themeOverride` to store once ONE value is back at the theme's own\n * (the \"Reset\" beside a row of \"What you have changed\").\n * Computed by resolving the patch, putting the publisher's value back at that\n * path, and re-diffing — rather than by deleting a key from the patch object.\n * The two differ whenever a path was reached through a keyed array or a\n * deletion sentinel, and re-diffing is right in every case because it asks the\n * same question the save path asks. `undefined` when the site has no override\n * to change.\n */\nexport function themeOverrideAfterReset(\n  host: ThemeHostDocument | null | undefined,\n  path: string,\n): ArtifactOverride | null | undefined {\n  const override = readThemeOverride(host)\n  if (!override) return undefined\n  const base = (host?.theme ?? {}) as HostTheme\n  const resolved = resolveOverride<HostTheme>(base, override.patch)\n  const restored = setThemePath(resolved, path.split('.'), readThemePath(base, path))\n  return overrideWriteValue(\n    diffOverride(base, restored),\n    host?.themeInstalledFrom?.sha256 ?? null,\n  )\n}\n\n/** Reads a dotted path out of a theme. */\nfunction readThemePath(theme: unknown, path: string): unknown {\n  let cursor: unknown = theme\n  for (const segment of path.split('.')) {\n    if (cursor == null || typeof cursor !== 'object') return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * The override this site should store after the theme editor produced `edited`.\n *\n * The editor edits the RESOLVED theme — that is what it renders and what the\n * user sees — so the patch is the difference between the publisher's base and\n * what came back. Diffing here rather than tracking per-field dirty state means\n * a field the user set and then set back to the theme's value stops being an\n * override, which is what \"reset\" means without needing a reset button to have\n * been pressed.\n */\nexport function themeOverridePatch(\n  host: ThemeHostDocument | null | undefined,\n  edited: HostTheme,\n): unknown {\n  return diffOverride(host?.theme ?? {}, edited)\n}\n\n/**\n * Where this site's overrides sit on top of values a theme update also changes\n * — the only place a conflict can exist.\n *\n * Narrow by construction: an override touching four paths can conflict in at\n * most four places however much of the theme the publisher rewrote. That is the\n * difference between \"the publisher also changed your heading colour, whose\n * wins?\" and \"this update rewrites your theme, continue?\".\n */\nexport function themeUpdateConflicts(\n  host: ThemeHostDocument | null | undefined,\n  incoming: HostTheme,\n): ThemeOverrideEntry[] {\n  const override = readThemeOverride(host)\n  if (!override || isEmptyOverride(override.patch)) return []\n  const base = host?.theme ?? {}\n  const resolved = resolveOverride<HostTheme>(base, override.patch)\n  return overrideConflicts(base, override.patch, incoming).map((path) => ({\n    path,\n    label: describeThemePath(path),\n    scheme:\n      path.startsWith('colorSchemes.light.')\n        ? ('light' as const)\n        : path.startsWith('colorSchemes.dark.')\n          ? ('dark' as const)\n          : undefined,\n    themeValue: readThemePath(incoming, path),\n    overrideValue: readThemePath(resolved, path),\n  }))\n}\n"],"names":["diffOverride","isEmptyOverride","overrideConflicts","overridePaths","overrideWriteValue","readArtifactOverride","resolveOverride","CONTRAST_AA","CONTRAST_AA_LARGE","SCHEMES","SYSTEM_FAMILIES","Set","map","family","toLowerCase","parseColor","value","text","trim","hex","exec","digits","length","r","parseInt","g","b","slice","rgb","parts","split","filter","Boolean","channels","part","endsWith","Number","some","channel","isFinite","luminance","raw","Math","min","max","contrastRatio","a","first","second","light","dark","round","ratio","validateScheme","scheme","colors","errors","warnings","at","Object","keys","push","path","message","primary","main","background","default","paper","secondaryText","secondary","bodyContrast","paperContrast","captionContrast","key","color","contrastText","declaredFamilies","theme","stacks","typography","fontFamily","variant","values","variants","stack","replace","validateFonts","loadable","fonts","font","seen","has","add","validateThemeForPublish","ok","colorSchemes","THEME_ARTIFACT_FIELDS","shape","spacing","mixins","components","darkScheme","themeArtifactContent","content","ships","entries","Array","isArray","describeTheme","schemes","count","borderRadius","THEME_OVERRIDE_FIELD","readThemeOverride","host","overrides","themeOverride","resolveSiteTheme","base","undefined","override","patch","THEME_SOURCES","hostThemeSource","picked","themeSelection","kind","includes","themeInstalledFrom","listingId","isOverrideForCurrentTheme","baseSha256","installed","sha256","SEGMENT_LABELS","describeThemePath","segments","words","segment","mapped","join","describeThemeOverride","resolved","label","themeValue","readThemePath","overrideValue","setThemePath","target","head","rest","container","themeOverrideAfterReset","restored","cursor","themeOverridePatch","edited","themeUpdateConflicts","incoming","startsWith"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAQD,SACEA,YAAY,EACZC,eAAe,EACfC,iBAAiB,EACjBC,aAAa,EACbC,kBAAkB,EAClBC,oBAAoB,EACpBC,eAAe,QAEV,0BAAsB;AAuD7B;;;CAGC,GACD,OAAO,MAAMC,cAAc,IAAG;AAE9B;;;;;CAKC,GACD,OAAO,MAAMC,oBAAoB,EAAC;AAElC,MAAMC,UAA6B;IAAC;IAAS;CAAO;AAEpD;;;;CAIC,GACD,MAAMC,kBAAkB,IAAIC,IAC1B;IACE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAACC,GAAG,CAAC,CAACC,SAAWA,OAAOC,WAAW;AAGtC;;;;;;;CAOC,GACD,OAAO,SAASC,WACdC,KAAc;IAEd,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,OAAOD,MAAME,IAAI,GAAGJ,WAAW;IAErC,MAAMK,MAAM,qBAAqBC,IAAI,CAACH;IACtC,IAAIE,KAAK;QACP,MAAME,SAASF,GAAG,CAAC,EAAE;QACrB,IAAIE,OAAOC,MAAM,KAAK,KAAKD,OAAOC,MAAM,KAAK,GAAG;YAC9C,OAAO;gBACLC,GAAGC,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;gBACnCI,GAAGD,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;gBACnCK,GAAGF,SAASH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,EAAE;YACrC;QACF;QACA,IAAIA,OAAOC,MAAM,KAAK,KAAKD,OAAOC,MAAM,KAAK,GAAG;YAC9C,OAAO;gBACLC,GAAGC,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;gBAChCF,GAAGD,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;gBAChCD,GAAGF,SAASH,OAAOM,KAAK,CAAC,GAAG,IAAI;YAClC;QACF;QACA,OAAO;IACT;IAEA,MAAMC,MAAM,qBAAqBR,IAAI,CAACH;IACtC,IAAIW,KAAK;QACP,MAAMC,QAAQD,GAAG,CAAC,EAAE,CAACE,KAAK,CAAC,WAAWC,MAAM,CAACC;QAC7C,IAAIH,MAAMP,MAAM,GAAG,GAAG,OAAO;QAC7B,MAAMW,WAAWJ,MAAMF,KAAK,CAAC,GAAG,GAAGf,GAAG,CAAC,CAACsB,OACtCA,KAAKC,QAAQ,CAAC,OACV,AAACC,OAAOF,KAAKP,KAAK,CAAC,GAAG,CAAC,MAAM,MAAO,MACpCS,OAAOF;QAEb,IAAID,SAASI,IAAI,CAAC,CAACC,UAAY,CAACF,OAAOG,QAAQ,CAACD,WAAW,OAAO;QAClE,MAAM,CAACf,GAAGE,GAAGC,EAAE,GAAGO;QAClB,OAAO;YAAEV;YAAGE;YAAGC;QAAE;IACnB;IAEA,IAAIT,SAAS,SAAS,OAAO;QAAEM,GAAG;QAAKE,GAAG;QAAKC,GAAG;IAAI;IACtD,IAAIT,SAAS,SAAS,OAAO;QAAEM,GAAG;QAAGE,GAAG;QAAGC,GAAG;IAAE;IAChD,OAAO;AACT;AAEA,6BAA6B,GAC7B,SAASc,UAAUP,QAA6C;IAC9D,MAAMK,UAAU,CAACG;QACf,MAAMzB,QAAQ0B,KAAKC,GAAG,CAAC,KAAKD,KAAKE,GAAG,CAAC,GAAGH,QAAQ;QAChD,OAAOzB,SAAS,UAAUA,QAAQ,QAAQ,AAAC,CAAA,AAACA,CAAAA,QAAQ,KAAI,IAAK,KAAI,KAAM;IACzE;IACA,OACE,SAASsB,QAAQL,SAASV,CAAC,IAC3B,SAASe,QAAQL,SAASR,CAAC,IAC3B,SAASa,QAAQL,SAASP,CAAC;AAE/B;AAEA;;;CAGC,GACD,OAAO,SAASmB,cAAcC,CAAU,EAAEpB,CAAU;IAClD,MAAMqB,QAAQhC,WAAW+B;IACzB,MAAME,SAASjC,WAAWW;IAC1B,IAAI,CAACqB,SAAS,CAACC,QAAQ,OAAO;IAC9B,MAAMC,QAAQP,KAAKE,GAAG,CAACJ,UAAUO,QAAQP,UAAUQ;IACnD,MAAME,OAAOR,KAAKC,GAAG,CAACH,UAAUO,QAAQP,UAAUQ;IAClD,OAAO,AAACC,CAAAA,QAAQ,IAAG,IAAMC,CAAAA,OAAO,IAAG;AACrC;AAEA,MAAMC,QAAQ,CAACC,QAAkBV,KAAKS,KAAK,CAACC,QAAQ,MAAM;AAE1D;;;;;;;CAOC,GACD,SAASC,eACPC,MAAuB,EACvBC,MAAyC,EACzCC,MAA8B,EAC9BC,QAAgC;QAa3BF,iBAOcA,oBACLA,qBACDA,cACSA;IArBtB,MAAMG,KAAK,CAAC,aAAa,EAAEJ,QAAQ;IACnC,IAAI,CAACC,UAAU,CAACI,OAAOC,IAAI,CAACL,QAAQjC,MAAM,EAAE;QAC1CkC,OAAOK,IAAI,CAAC;YACVC,MAAMJ;YACNK,SACE,CAAC,sBAAsB,EAAET,OAAO,oCAAoC,CAAC,GACrE,6DACA,GAAGA,OAAO,oDAAoD,CAAC;QACnE;QACA;IACF;IACA,IAAI,GAACC,kBAAAA,OAAOS,OAAO,qBAAdT,gBAAgBU,IAAI,GAAE;QACzBT,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,aAAa,CAAC;YAC1BK,SAAS,CAAC,IAAI,EAAET,OAAO,6BAA6B,CAAC;QACvD;IACF;IAEA,MAAMY,cAAaX,qBAAAA,OAAOW,UAAU,qBAAjBX,mBAAmBY,OAAO;IAC7C,MAAMC,SAAQb,sBAAAA,OAAOW,UAAU,qBAAjBX,oBAAmBa,KAAK;IACtC,MAAMnD,QAAOsC,eAAAA,OAAOtC,IAAI,qBAAXsC,aAAaS,OAAO;IACjC,MAAMK,iBAAgBd,gBAAAA,OAAOtC,IAAI,qBAAXsC,cAAae,SAAS;IAE5C,4EAA4E;IAC5E,mEAAmE;IACnE,MAAMC,eAAe1B,cAAc5B,MAAMiD;IACzC,IAAIK,gBAAgB,QAAQA,eAAehE,aAAa;QACtDiD,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,aAAa,CAAC;YAC1BK,SACE,CAAC,iBAAiB,EAAET,OAAO,eAAe,EAAEH,MAAMoB,cAAc,IAAI,CAAC,GACrE,CAAC,UAAU,EAAEhE,YAAY,6BAA6B,CAAC;QAC3D;IACF;IAEA,MAAMiE,gBAAgB3B,cAAc5B,MAAMmD;IAC1C,IAAII,iBAAiB,QAAQA,gBAAgBjE,aAAa;QACxDiD,OAAOK,IAAI,CAAC;YACVC,MAAM,GAAGJ,GAAG,iBAAiB,CAAC;YAC9BK,SACE,CAAC,aAAa,EAAET,OAAO,oBAAoB,EAAEH,MAAMqB,eAAe,IAAI,CAAC,GACvE,CAAC,UAAU,EAAEjE,YAAY,6CAA6C,CAAC,GACvE;QACJ;IACF;IAEA,2EAA2E;IAC3E,+EAA+E;IAC/E,MAAMkE,kBAAkB5B,cAAcwB,eAAeH;IACrD,IAAIO,mBAAmB,QAAQA,kBAAkBlE,aAAa;QAC5DkD,SAASI,IAAI,CAAC;YACZC,MAAM,GAAGJ,GAAG,eAAe,CAAC;YAC5BK,SACE,CAAC,sBAAsB,EAAET,OAAO,eAAe,CAAC,GAChD,GAAGH,MAAMsB,iBAAiB,0CAA0C,CAAC,GACrE;QACJ;IACF;IAEA,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,KAAK,MAAMC,OAAO;QAAC;QAAW;QAAa;QAAY;KAAQ,CAAW;QACxE,MAAMC,QAAQpB,MAAM,CAACmB,IAAI;QACzB,MAAMtB,QAAQP,cAAc8B,yBAAAA,MAAOC,YAAY,EAAED,yBAAAA,MAAOV,IAAI;QAC5D,IAAIb,SAAS,QAAQA,QAAQ5C,mBAAmB;YAC9CiD,SAASI,IAAI,CAAC;gBACZC,MAAM,GAAGJ,GAAG,CAAC,EAAEgB,IAAI,aAAa,CAAC;gBACjCX,SACE,CAAC,IAAI,EAAET,OAAO,CAAC,EAAEoB,IAAI,iBAAiB,EAAEvB,MAAMC,OAAO,eAAe,CAAC,GACrE,CAAC,gBAAgB,EAAE5C,kBAAkB,8BAA8B,CAAC,GACpE;YACJ;QACF;IACF;AACF;AAEA;;;;;;CAMC,GACD,SAASqE,iBAAiBC,KAAgB;;QAEpCA,mBACgCA;IAFpC,MAAMC,SAAmB,EAAE;IAC3B,KAAID,oBAAAA,MAAME,UAAU,qBAAhBF,kBAAkBG,UAAU,EAAEF,OAAOlB,IAAI,CAACiB,MAAME,UAAU,CAACC,UAAU;IACzE,KAAK,MAAMC,WAAWvB,OAAOwB,MAAM,UAACL,qBAAAA,MAAME,UAAU,qBAAhBF,mBAAkBM,QAAQ,mBAAI,CAAC,GAAI;QACrE,IAAIF,2BAAAA,QAASD,UAAU,EAAEF,OAAOlB,IAAI,CAACqB,QAAQD,UAAU;IACzD;IACA,MAAMjB,UAAoB,EAAE;IAC5B,KAAK,MAAMqB,SAASN,OAAQ;YACZM;QAAd,MAAMtC,SAAQsC,gBAAAA,MAAMvD,KAAK,CAAC,IAAI,CAAC,EAAE,qBAAnBuD,cAAqBnE,IAAI,GAAGoE,OAAO,CAAC,gBAAgB;QAClE,IAAIvC,OAAOiB,QAAQH,IAAI,CAACd;IAC1B;IACA,OAAOiB;AACT;AAEA,SAASuB,cACPT,KAAgB,EAChBrB,QAAgC;QAG7BqB;IADH,MAAMU,WAAW,IAAI7E,IACnB,EAACmE,eAAAA,MAAMW,KAAK,YAAXX,eAAe,EAAE,EACflE,GAAG,CAAC,CAAC8E;YAAwBA;gBAAAA,eAAAA,KAAK7E,MAAM,qBAAX6E,aAAaxE,IAAI,GAAGJ,WAAW;OAC5DiB,MAAM,CAACC;IAEZ,MAAM2D,OAAO,IAAIhF;IACjB,KAAK,MAAME,UAAUgE,iBAAiBC,OAAQ;QAC5C,MAAMJ,MAAM7D,OAAOC,WAAW;QAC9B,IAAI6E,KAAKC,GAAG,CAAClB,QAAQc,SAASI,GAAG,CAAClB,QAAQhE,gBAAgBkF,GAAG,CAAClB,MAAM;QACpEiB,KAAKE,GAAG,CAACnB;QACTjB,SAASI,IAAI,CAAC;YACZC,MAAM;YACNC,SACE,CAAC,CAAC,EAAElD,OAAO,0DAA0D,CAAC,GACtE,yEACA;QACJ;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASiF,wBACdhB,KAAmC;IAEnC,MAAMtB,SAAiC,EAAE;IACzC,MAAMC,WAAmC,EAAE;IAE3C,IAAI,CAACqB,SAAS,CAACnB,OAAOC,IAAI,CAACkB,OAAOxD,MAAM,EAAE;QACxC,OAAO;YACLyE,IAAI;YACJvC,QAAQ;gBACN;oBACEM,MAAM;oBACNC,SACE,oEACA;gBACJ;aACD;YACDN;QACF;IACF;IAEA,KAAK,MAAMH,UAAU7C,QAAS;YACLqE;QAAvBzB,eAAeC,SAAQwB,sBAAAA,MAAMkB,YAAY,qBAAlBlB,mBAAoB,CAACxB,OAAO,EAAEE,QAAQC;IAC/D;IACA8B,cAAcT,OAAOrB;IAErB,OAAO;QAAEsC,IAAI,CAACvC,OAAOlC,MAAM;QAAEkC;QAAQC;IAAS;AAChD;AAEA;;;;;;;;;;;;;;;CAeC,GACD,MAAMwC,wBAAoE;IACxED,cAAc;IACdhB,YAAY;IACZS,OAAO;IACPS,OAAO;IACPC,SAAS;IACTC,QAAQ;IACRC,YAAY;IACZC,YAAY;AACd;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAASC,qBACdzB,KAAmC;IAEnC,MAAM0B,UAAmC,CAAC;IAC1C,IAAI,CAAC1B,OAAO,OAAO0B;IACnB,KAAK,MAAM,CAAC9B,KAAK+B,MAAM,IAAI9C,OAAO+C,OAAO,CAACT,uBAAwB;QAChE,IAAI,CAACQ,OAAO;QACZ,MAAMzF,QAAQ,AAAC8D,KAAiC,CAACJ,IAAI;QACrD,IAAI1D,SAAS,MAAM;QACnB,IAAI2F,MAAMC,OAAO,CAAC5F,SAAS,CAACA,MAAMM,MAAM,GAAG,OAAON,UAAU,WACxD,CAAC2C,OAAOC,IAAI,CAAC5C,OAAiBM,MAAM,GACpC,OAAO;YACT;QACF;QACAkF,OAAO,CAAC9B,IAAI,GAAG1D;IACjB;IACA,OAAOwF;AACT;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASK,cAAc/B,KAAmC;cAmBhCA;QAVjBA,cAEVA,mBAIAA;IAdJ,IAAI,CAACA,OAAO,OAAO,EAAE;IACrB,MAAMjD,QAAkB,EAAE;IAC1B,MAAMiF,UAAUrG,QAAQsB,MAAM,CAC5B,CAACuB;;YAAuBwB;eAAZnB,OAAOC,IAAI,UAACkB,sBAAAA,MAAMkB,YAAY,qBAAlBlB,mBAAoB,CAACxB,OAAO,mBAAI,CAAC,GAAGhC,MAAM;;IAEpE,IAAIwF,QAAQxF,MAAM,KAAK,GAAGO,MAAMgC,IAAI,CAAC;SAChC,IAAIiD,QAAQxF,MAAM,KAAK,GAAGO,MAAMgC,IAAI,CAAC,GAAGiD,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC;IAErE,MAAMrB,iBAAQX,eAAAA,MAAMW,KAAK,qBAAXX,aAAaxD,MAAM,mBAAI;IACrC,IAAImE,OAAO5D,MAAMgC,IAAI,CAAC,GAAG4B,MAAM,KAAK,EAAEA,UAAU,IAAI,KAAK,KAAK;IAC9D,KAAIX,oBAAAA,MAAME,UAAU,qBAAhBF,kBAAkBM,QAAQ,EAAE;QAC9B,MAAM2B,QAAQpD,OAAOC,IAAI,CAACkB,MAAME,UAAU,CAACI,QAAQ,EAAE9D,MAAM;QAC3D,IAAIyF,OAAOlF,MAAMgC,IAAI,CAAC,GAAGkD,MAAM,WAAW,EAAEA,UAAU,IAAI,KAAK,KAAK;IACtE;IACA,IAAIjC,EAAAA,eAAAA,MAAMoB,KAAK,qBAAXpB,aAAakC,YAAY,KAAI,MAAM;QACrCnF,MAAMgC,IAAI,CAAC,GAAGiB,MAAMoB,KAAK,CAACc,YAAY,CAAC,UAAU,CAAC;IACpD;IACA,IAAI,OAAOlC,MAAMqB,OAAO,KAAK,UAAUtE,MAAMgC,IAAI,CAAC,GAAGiB,MAAMqB,OAAO,CAAC,UAAU,CAAC;IAC9E,MAAME,aAAa1C,OAAOC,IAAI,EAACkB,oBAAAA,MAAMuB,UAAU,YAAhBvB,oBAAoB,CAAC,GAAGxD,MAAM;IAC7D,IAAI+E,YAAY;QACdxE,MAAMgC,IAAI,CAAC,GAAGwC,WAAW,gBAAgB,EAAEA,eAAe,IAAI,KAAK,KAAK;IAC1E;IACA,OAAOxE;AACT;AAEA;;4EAE4E,GAE5E;;;;;;;CAOC,GACD,OAAO,MAAMoF,uBAAuB,gBAAe;AAWnD,0EAA0E,GAC1E,OAAO,SAASC,kBACdC,IAA0C;IAE1C,2EAA2E;IAC3E,sEAAsE;IACtE,mDAAmD;IACnD,OAAO9G,qBAAqB;QAAE+G,SAAS,EAAED,wBAAAA,KAAME,aAAa;IAAC;AAC/D;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC,iBACdH,IAA0C;;IAE1C,MAAMI,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI0C;IAC5B,MAAMC,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,UAAU,OAAOF;IACtB,OAAOjH,gBAA2BiH,eAAAA,OAAQ,CAAC,GAAGE,SAASC,KAAK;AAC9D;AAsBA,MAAMC,gBAA4C;IAChD;IACA;IACA;IACA;CACD;AAED,OAAO,SAASC,gBACdT,IAA0C;QAE1BA,sBAKZA;IALJ,MAAMU,SAAUV,yBAAAA,uBAAAA,KAAMW,cAAc,qBAArB,AAACX,qBACZY,IAAI;IACR,IAAIJ,cAAcK,QAAQ,CAACH,SAA4B;QACrD,OAAOA;IACT;IACA,IAAIV,yBAAAA,2BAAAA,KAAMc,kBAAkB,qBAAxBd,yBAA0Be,SAAS,EAAE,OAAO;IAChD,OAAOf,CAAAA,wBAAAA,KAAMrC,KAAK,KAAInB,OAAOC,IAAI,CAACuD,KAAKrC,KAAK,EAAExD,MAAM,GAAG,WAAW;AACpE;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAAS6G,0BACdhB,IAA0C;QAIxBA;IAFlB,MAAMM,WAAWP,kBAAkBC;IACnC,IAAI,EAACM,4BAAAA,SAAUW,UAAU,GAAE,OAAO;IAClC,MAAMC,YAAYlB,yBAAAA,2BAAAA,KAAMc,kBAAkB,qBAAxBd,yBAA0BmB,MAAM;IAClD,IAAI,CAACD,WAAW,OAAO;IACvB,OAAOZ,SAASW,UAAU,KAAKC;AACjC;AAgBA,MAAME,iBAAyC;IAC7CjC,YAAY;IACZN,cAAc;IACdhB,YAAY;IACZqB,YAAY;IACZH,OAAO;IACPC,SAAS;IACTV,OAAO;IACPW,QAAQ;IACRhB,UAAU;IACVlB,YAAY;IACZjD,MAAM;IACNgD,MAAM;IACNW,cAAc;IACdoC,cAAc;IACd/B,YAAY;AACd;AAEA;;;;;;CAMC,GACD,OAAO,SAASuD,kBAAkB1E,IAAY;IAC5C,MAAM2E,WAAW3E,KAAKhC,KAAK,CAAC,KAAKC,MAAM,CAACC;IACxC,MAAM0G,QAAkB,EAAE;IAC1B,KAAK,MAAMC,WAAWF,SAAU;QAC9B,MAAMG,SAASL,cAAc,CAACI,QAAQ;QACtC,IAAIC,WAAW,IAAI;QACnBF,MAAM7E,IAAI,CAAC+E,iBAAAA,SAAUD;IACvB;IACA,OAAOD,MAAMG,IAAI,CAAC,UAAU;AAC9B;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,sBACd3B,IAA0C;;IAE1C,MAAMM,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,UAAU,OAAO,EAAE;IACxB,MAAMF,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC;IAC7B,MAAMiE,WAAWzI,gBAA2BiH,MAAME,SAASC,KAAK;IAChE,OAAOvH,cAAcsH,SAASC,KAAK,EAAE9G,GAAG,CAAC,CAACkD;QACxC,MAAM2E,WAAW3E,KAAKhC,KAAK,CAAC;QAC5B,MAAMwB,SACJmF,QAAQ,CAAC,EAAE,KAAK,kBACfA,CAAAA,QAAQ,CAAC,EAAE,KAAK,WAAWA,QAAQ,CAAC,EAAE,KAAK,MAAK,IAC5CA,QAAQ,CAAC,EAAE,GACZjB;QACN,OAAO;YACL1D;YACAkF,OAAOR,kBAAkB1E;YACzBR;YACA2F,YAAYC,cAAc3B,MAAMzD;YAChCqF,eAAeD,cAAcH,UAAUjF;QACzC;IACF;AACF;AAEA,qEAAqE,GACrE,SAASsF,aAAaC,MAAe,EAAEvF,IAAc,EAAE9C,KAAc;IACnE,MAAM,CAACsI,MAAM,GAAGC,KAAK,GAAGzF;IACxB,MAAM0F,YACJH,UAAU,QAAQ,OAAOA,WAAW,YAAY,CAAC1C,MAAMC,OAAO,CAACyC,UAC3D,aAAMA,UACN,CAAC;IACP,IAAI,CAACE,KAAKjI,MAAM,EAAE;QAChB,IAAIN,UAAUwG,WAAW,OAAOgC,SAAS,CAACF,KAAK;aAC1CE,SAAS,CAACF,KAAK,GAAGtI;QACvB,OAAOwI;IACT;IACAA,SAAS,CAACF,KAAK,GAAGF,aAAaI,SAAS,CAACF,KAAK,EAAEC,MAAMvI;IACtD,OAAOwI;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASC,wBACdtC,IAA0C,EAC1CrD,IAAY;;QASVqD;IAPF,MAAMM,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,UAAU,OAAOD;IACtB,MAAMD,eAAQJ,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC;IAC9B,MAAMiE,WAAWzI,gBAA2BiH,MAAME,SAASC,KAAK;IAChE,MAAMgC,WAAWN,aAAaL,UAAUjF,KAAKhC,KAAK,CAAC,MAAMoH,cAAc3B,MAAMzD;IAC7E,OAAO1D,mBACLJ,aAAauH,MAAMmC,oBACnBvC,yBAAAA,2BAAAA,KAAMc,kBAAkB,qBAAxBd,yBAA0BmB,MAAM,oBAAI;AAExC;AAEA,wCAAwC,GACxC,SAASY,cAAcpE,KAAc,EAAEhB,IAAY;IACjD,IAAI6F,SAAkB7E;IACtB,KAAK,MAAM6D,WAAW7E,KAAKhC,KAAK,CAAC,KAAM;QACrC,IAAI6H,UAAU,QAAQ,OAAOA,WAAW,UAAU,OAAOnC;QACzDmC,SAAS,AAACA,MAAkC,CAAChB,QAAQ;IACvD;IACA,OAAOgB;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASC,mBACdzC,IAA0C,EAC1C0C,MAAiB;;IAEjB,OAAO7J,qBAAamH,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC,GAAG+E;AACzC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,qBACd3C,IAA0C,EAC1C4C,QAAmB;;IAEnB,MAAMtC,WAAWP,kBAAkBC;IACnC,IAAI,CAACM,YAAYxH,gBAAgBwH,SAASC,KAAK,GAAG,OAAO,EAAE;IAC3D,MAAMH,eAAOJ,wBAAAA,KAAMrC,KAAK,mBAAI,CAAC;IAC7B,MAAMiE,WAAWzI,gBAA2BiH,MAAME,SAASC,KAAK;IAChE,OAAOxH,kBAAkBqH,MAAME,SAASC,KAAK,EAAEqC,UAAUnJ,GAAG,CAAC,CAACkD,OAAU,CAAA;YACtEA;YACAkF,OAAOR,kBAAkB1E;YACzBR,QACEQ,KAAKkG,UAAU,CAAC,yBACX,UACDlG,KAAKkG,UAAU,CAAC,wBACb,SACDxC;YACRyB,YAAYC,cAAca,UAAUjG;YACpCqF,eAAeD,cAAcH,UAAUjF;QACzC,CAAA;AACF"}

package/src/lib/app-utils/template-slug.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Why one template screen cannot be given the address it asks for, or
+ * `undefined` when it can (AGL-2588).
+ *
+ * The bundle appliers pass `slug` straight off a template document into
+ * {@link createPageFromTemplate}, so no field ever asks the two questions
+ * every typed slug field asks: is this ONE path segment (AGL-2572), and is
+ * the address one the published site can actually answer (AGL-2076)? The set
+ * of bundle slugs is safe today only because of where they come from —
+ * starter slugs are code-defined, and library-template slugs were captured
+ * off screens that already passed a guard. Provenance is not a guard, and it
+ * stops being true the first time a template carries an author-supplied slug.
+ *
+ * Answers over the address `resolveTemplateSlug` would REQUEST — the slug,
+ * or the display name when the slug sanitizes away, or `page` — because a
+ * screen whose slug is `###` and whose name is `Search` still lands on
+ * `search`. De-confliction only ever appends a numeric suffix, so it can
+ * neither create a reserved segment nor clear one.
+ *
+ * A refusal string rather than a boolean, so the caller can name to the
+ * author which rule the screen fell foul of.
+ */
+export declare function templateScreenAddressRefusal(input: {
+    slug?: string;
+    displayName?: string;
+}): string | undefined;
+/**
+ * The address one template page claims (AGL-1575).
+ *
+ * This used to be a private `slugifyPageName` that stripped every character
+ * outside `[a-z0-9]`, so `'/'` and `''` both reduced to the empty string and
+ * fell through to the display name. A template screen asking for the SITE
+ * ROOT could therefore never get it: the shop starters declared `slug: ''`
+ * meaning home and were published at `/home`, and a site started from any
+ * template 404'd at its own URL while the console showed a success toast.
+ *
+ * The routing-map format has one canonical normalizer — `normalizeScreenSlug`
+ * — which is what the Screens page and the besigner already publish through,
+ * and which is the only place that knows `'/'` is the root path rather than
+ * punctuation. Template pages now go through it too, so all three surfaces
+ * agree on what a user-supplied address means.
+ *
+ * ## De-confliction (the invariant)
+ *
+ * `usedSlugs` holds every path already routed on the host plus everything
+ * claimed earlier in the same batch. A claim that collides FALLS BACK; it
+ * never overwrites, because the caller publishes into the host's routing map
+ * and a duplicate path would take a live page off the site.
+ *
+ * The root is the interesting case: `'/-2'` is not an address, so a second
+ * claimant on a host that already has a home page falls back to its NAME
+ * (`Home` → `home`), and only then to numeric suffixes. First claimant wins
+ * the root; everybody after it gets a real path of their own.
+ *
+ * Mutates `usedSlugs` with whatever it hands out.
+ */
+export declare function resolveTemplateSlug(input: {
+    /** Preferred address as authored — `'/'` (or `SCREEN_ROOT_PATH`) for home. */
+    slug?: string;
+    /** Falls back to a slug of this when no address is authored. */
+    displayName: string;
+    /** Paths already taken. Mutated with whatever this page claims. */
+    usedSlugs: Set<string>;
+}): {
+    slug: string;
+    requestedSlug: string;
+};
+/**
+ * Gives a multi-page bundle a home page when nothing in it claims one
+ * (AGL-1575).
+ *
+ * A starter is somebody's whole site, and a site whose root 404s is broken in
+ * the one place every visitor lands. When no screen in the bundle asks for
+ * `SCREEN_ROOT_PATH` and the host has no root route yet, the FIRST screen —
+ * authored order, which is the order the author meant them to be created in —
+ * takes it. That also repairs starters materialized before this fix, whose
+ * seeded documents dropped the home screen's `slug: ''` on the floor.
+ *
+ * Deliberately NOT applied to the single-template "Use template" dialog: the
+ * user types an address there, and silently re-pointing an explicit answer at
+ * the root would be a worse surprise than a site that needs a home page.
+ * Deliberately conditional on the host having no root: it never moves a live
+ * home page, which is the same invariant `resolveTemplateSlug` protects.
+ */
+export declare function withBundleRootScreen<T extends {
+    slug?: string;
+}>(screens: readonly T[], usedSlugs: Iterable<string>): T[];
+/**
+ * {@link resolveTemplateSlug} over a list instead of a `Set` it mutates: the
+ * address a page claims, and the paths taken once it has. For a caller that
+ * cannot hold a `Set` (the native apps) and for the recorded cases.
+ */
+export declare function resolveTemplateSlugAmong(input: {
+    slug?: string;
+    displayName: string;
+    taken: readonly string[];
+}): {
+    slug: string;
+    requestedSlug: string;
+    taken: string[];
+};