@aglyn/tenant-runtime 1.0.0-beta.143

package/src/lib/social-image-facts.d.ts

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * A page's social card, described by the assets it names as they are NOW
+ * (AGL-2850).
+ *
+ * A card's reference is stored with the pixel pair its picker copied from the
+ * asset: on the host, on each screen, on each template screen. A replace
+ * (AGL-2732) rewrites the asset's pair and cannot reach those copies, so the
+ * head is handed what each named asset's document records when the page is
+ * composed, and `resolveSocialImage` prefers that to the copy.
+ *
+ * The documents are read in the batch `composeNodesWithChrome` already issues
+ * for the images and films a page places (`get-media-asset-facts.ts`), so a
+ * card adds documents to that read rather than a read of its own. This module
+ * turns the card's references into the batch's input and the batch's answer
+ * into the head's view, and it reads on its own only for a page that composes
+ * nothing.
+ */
+import { type MediaRef, type SocialImageAssetFacts } from '@aglyn/aglyn/server';
+import { type MediaAssetFacts } from '@aglyn/aglyn/app-utils/media-asset-facts';
+/** The references a card may resolve from, in the head's precedence order. */
+export type SocialCardImages = ReadonlyArray<string | null | undefined>;
+/**
+ * The card handed to a composition, so the assets it names are read in the
+ * page's one facts batch.
+ */
+export interface ComposeSocialImages {
+    /**
+     * The references the head resolves the card from: a screen's and the host's
+     * `seo.image`, an entry's cover, an author's pictures. Unset, blank and
+     * non-library values are skipped.
+     */
+    images: SocialCardImages;
+    /**
+     * Called once the batch answers, with each reference's current pair. Not
+     * called when it answered for none of them (no usable pair, an asset this
+     * site may not be shown, a failed read), which leaves the card on the pair
+     * stored beside its reference.
+     */
+    onFacts: (facts: SocialImageAssetFacts) => void;
+}
+/**
+ * Each distinct library asset the references name, in the order given.
+ *
+ * `[]` when none is a library reference, so a caller that gates its read on
+ * the length spends nothing. A pinned and an unpinned reference to one asset
+ * are one entry: a pin names bytes, not a different asset.
+ */
+export declare function socialImageRefs(images: SocialCardImages): MediaRef[];
+/**
+ * What the head is told: the current pair of each reference whose document
+ * records a usable one, keyed by the reference exactly as it is stored.
+ * `undefined` when none does, which the head reads as "emit the stored copy",
+ * the same answer a failed read gets.
+ *
+ * A usable pair passes the gate a placed image's does (`intrinsicMediaSize`):
+ * both halves, finite and positive. The card and the Image element agree on
+ * what a document's pair is worth.
+ */
+export declare function socialImageAssetFacts(images: SocialCardImages, facts: ReadonlyMap<string, MediaAssetFacts>): SocialImageAssetFacts | undefined;
+/**
+ * A composition's `socialImages` option, with somewhere for its facts to land.
+ *
+ * The composition answers with nodes and reports the card through a callback,
+ * so a caller that hands both on needs a place for the callback to write. This
+ * is that place, once, rather than a closure at every caller.
+ */
+export declare function collectSocialImageFacts(images: SocialCardImages): {
+    /** Hand to `composeScreenNodes` or `composeNodesWithChrome`. */
+    socialImages: ComposeSocialImages;
+    /** `{ socialImageFacts }` once the batch answered for the card, else `{}`. */
+    collected: () => {
+        socialImageFacts?: SocialImageAssetFacts;
+    };
+};
+/**
+ * The card's current pairs for a page that composes NOTHING, so has no batch
+ * for its documents to join: a password-protected screen, whose nodes stay
+ * withheld until unlock while its head still shares the card.
+ *
+ * ONE projected read, through the composition's own reader, so the verdict on
+ * which assets this site may be shown is the CDN's here too. No read at all
+ * when no reference names a library asset.
+ *
+ * Fail-open: any failure answers `undefined` and the card keeps its stored
+ * pair. A page is never lost to the description of its share card.
+ */
+export declare function getSocialImageAssetFacts(options: {
+    hostId: string;
+    images: SocialCardImages;
+}): Promise<SocialImageAssetFacts | undefined>;
+export default getSocialImageAssetFacts;

package/src/lib/social-image-facts.js

@@ -0,0 +1,133 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * A page's social card, described by the assets it names as they are NOW
+ * (AGL-2850).
+ *
+ * A card's reference is stored with the pixel pair its picker copied from the
+ * asset: on the host, on each screen, on each template screen. A replace
+ * (AGL-2732) rewrites the asset's pair and cannot reach those copies, so the
+ * head is handed what each named asset's document records when the page is
+ * composed, and `resolveSocialImage` prefers that to the copy.
+ *
+ * The documents are read in the batch `composeNodesWithChrome` already issues
+ * for the images and films a page places (`get-media-asset-facts.ts`), so a
+ * card adds documents to that read rather than a read of its own. This module
+ * turns the card's references into the batch's input and the batch's answer
+ * into the head's view, and it reads on its own only for a page that composes
+ * nothing.
+ */ import { intrinsicMediaSize, parseMediaRef } from "@aglyn/aglyn/server";
+// By path rather than through a barrel: the overlay is server-only, and every
+// `@aglyn/aglyn` barrel re-exports `app-utils/server` into published pages.
+import { IMAGE_COMPONENT_ID, mediaAssetFactsKey } from "@aglyn/aglyn/app-utils/media-asset-facts";
+import getMediaAssetFacts from "./get-media-asset-facts.js";
+/**
+ * Each distinct library asset the references name, in the order given.
+ *
+ * `[]` when none is a library reference, so a caller that gates its read on
+ * the length spends nothing. A pinned and an unpinned reference to one asset
+ * are one entry: a pin names bytes, not a different asset.
+ */ export function socialImageRefs(images) {
+    const refs = [];
+    const seen = new Set();
+    for (const image of images){
+        const ref = parseMediaRef(image);
+        if (!ref) continue;
+        const key = mediaAssetFactsKey(ref);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        refs.push(ref);
+    }
+    return refs;
+}
+/**
+ * What the head is told: the current pair of each reference whose document
+ * records a usable one, keyed by the reference exactly as it is stored.
+ * `undefined` when none does, which the head reads as "emit the stored copy",
+ * the same answer a failed read gets.
+ *
+ * A usable pair passes the gate a placed image's does (`intrinsicMediaSize`):
+ * both halves, finite and positive. The card and the Image element agree on
+ * what a document's pair is worth.
+ */ export function socialImageAssetFacts(images, facts) {
+    let answered;
+    for (const image of images){
+        const ref = parseMediaRef(image);
+        const found = ref ? facts.get(mediaAssetFactsKey(ref)) : undefined;
+        if (!found) continue;
+        const { intrinsicWidth, intrinsicHeight } = intrinsicMediaSize({
+            componentId: IMAGE_COMPONENT_ID,
+            propName: 'src',
+            assetWidth: found.width,
+            assetHeight: found.height
+        });
+        if (intrinsicWidth === undefined || intrinsicHeight === undefined) continue;
+        if (!answered) answered = {};
+        answered[image] = {
+            width: intrinsicWidth,
+            height: intrinsicHeight
+        };
+    }
+    return answered;
+}
+/**
+ * A composition's `socialImages` option, with somewhere for its facts to land.
+ *
+ * The composition answers with nodes and reports the card through a callback,
+ * so a caller that hands both on needs a place for the callback to write. This
+ * is that place, once, rather than a closure at every caller.
+ */ export function collectSocialImageFacts(images) {
+    let reported;
+    return {
+        socialImages: {
+            images,
+            onFacts: (facts)=>{
+                reported = facts;
+            }
+        },
+        collected: ()=>reported ? {
+                socialImageFacts: reported
+            } : {}
+    };
+}
+/**
+ * The card's current pairs for a page that composes NOTHING, so has no batch
+ * for its documents to join: a password-protected screen, whose nodes stay
+ * withheld until unlock while its head still shares the card.
+ *
+ * ONE projected read, through the composition's own reader, so the verdict on
+ * which assets this site may be shown is the CDN's here too. No read at all
+ * when no reference names a library asset.
+ *
+ * Fail-open: any failure answers `undefined` and the card keeps its stored
+ * pair. A page is never lost to the description of its share card.
+ */ export async function getSocialImageAssetFacts(options) {
+    const { hostId, images } = options;
+    try {
+        const refs = socialImageRefs(images);
+        if (!refs.length) return undefined;
+        return socialImageAssetFacts(images, await getMediaAssetFacts({
+            hostId,
+            refs
+        }));
+    } catch (error) {
+        console.error('[social-image-facts] read failed; the card keeps its stored pair', error);
+        return undefined;
+    }
+}
+export default getSocialImageAssetFacts;
+
+//# sourceMappingURL=social-image-facts.js.map

package/src/lib/social-image-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/social-image-facts.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * A page's social card, described by the assets it names as they are NOW\n * (AGL-2850).\n *\n * A card's reference is stored with the pixel pair its picker copied from the\n * asset: on the host, on each screen, on each template screen. A replace\n * (AGL-2732) rewrites the asset's pair and cannot reach those copies, so the\n * head is handed what each named asset's document records when the page is\n * composed, and `resolveSocialImage` prefers that to the copy.\n *\n * The documents are read in the batch `composeNodesWithChrome` already issues\n * for the images and films a page places (`get-media-asset-facts.ts`), so a\n * card adds documents to that read rather than a read of its own. This module\n * turns the card's references into the batch's input and the batch's answer\n * into the head's view, and it reads on its own only for a page that composes\n * nothing.\n */\n\nimport {\n  intrinsicMediaSize,\n  type MediaRef,\n  parseMediaRef,\n  type SocialImageAssetFacts,\n} from '@aglyn/aglyn/server'\n// By path rather than through a barrel: the overlay is server-only, and every\n// `@aglyn/aglyn` barrel re-exports `app-utils/server` into published pages.\nimport {\n  IMAGE_COMPONENT_ID,\n  type MediaAssetFacts,\n  mediaAssetFactsKey,\n} from '@aglyn/aglyn/app-utils/media-asset-facts'\nimport getMediaAssetFacts from './get-media-asset-facts'\n\n/** The references a card may resolve from, in the head's precedence order. */\nexport type SocialCardImages = ReadonlyArray<string | null | undefined>\n\n/**\n * The card handed to a composition, so the assets it names are read in the\n * page's one facts batch.\n */\nexport interface ComposeSocialImages {\n  /**\n   * The references the head resolves the card from: a screen's and the host's\n   * `seo.image`, an entry's cover, an author's pictures. Unset, blank and\n   * non-library values are skipped.\n   */\n  images: SocialCardImages\n  /**\n   * Called once the batch answers, with each reference's current pair. Not\n   * called when it answered for none of them (no usable pair, an asset this\n   * site may not be shown, a failed read), which leaves the card on the pair\n   * stored beside its reference.\n   */\n  onFacts: (facts: SocialImageAssetFacts) => void\n}\n\n/**\n * Each distinct library asset the references name, in the order given.\n *\n * `[]` when none is a library reference, so a caller that gates its read on\n * the length spends nothing. A pinned and an unpinned reference to one asset\n * are one entry: a pin names bytes, not a different asset.\n */\nexport function socialImageRefs(images: SocialCardImages): MediaRef[] {\n  const refs: MediaRef[] = []\n  const seen = new Set<string>()\n  for (const image of images) {\n    const ref = parseMediaRef(image)\n    if (!ref) continue\n    const key = mediaAssetFactsKey(ref)\n    if (seen.has(key)) continue\n    seen.add(key)\n    refs.push(ref)\n  }\n  return refs\n}\n\n/**\n * What the head is told: the current pair of each reference whose document\n * records a usable one, keyed by the reference exactly as it is stored.\n * `undefined` when none does, which the head reads as \"emit the stored copy\",\n * the same answer a failed read gets.\n *\n * A usable pair passes the gate a placed image's does (`intrinsicMediaSize`):\n * both halves, finite and positive. The card and the Image element agree on\n * what a document's pair is worth.\n */\nexport function socialImageAssetFacts(\n  images: SocialCardImages,\n  facts: ReadonlyMap<string, MediaAssetFacts>,\n): SocialImageAssetFacts | undefined {\n  let answered: Record<string, { width: number; height: number }> | undefined\n  for (const image of images) {\n    const ref = parseMediaRef(image)\n    const found = ref ? facts.get(mediaAssetFactsKey(ref)) : undefined\n    if (!found) continue\n    const { intrinsicWidth, intrinsicHeight } = intrinsicMediaSize({\n      componentId: IMAGE_COMPONENT_ID,\n      propName: 'src',\n      assetWidth: found.width,\n      assetHeight: found.height,\n    })\n    if (intrinsicWidth === undefined || intrinsicHeight === undefined) continue\n    if (!answered) answered = {}\n    answered[image as string] = {\n      width: intrinsicWidth,\n      height: intrinsicHeight,\n    }\n  }\n  return answered\n}\n\n/**\n * A composition's `socialImages` option, with somewhere for its facts to land.\n *\n * The composition answers with nodes and reports the card through a callback,\n * so a caller that hands both on needs a place for the callback to write. This\n * is that place, once, rather than a closure at every caller.\n */\nexport function collectSocialImageFacts(images: SocialCardImages): {\n  /** Hand to `composeScreenNodes` or `composeNodesWithChrome`. */\n  socialImages: ComposeSocialImages\n  /** `{ socialImageFacts }` once the batch answered for the card, else `{}`. */\n  collected: () => { socialImageFacts?: SocialImageAssetFacts }\n} {\n  let reported: SocialImageAssetFacts | undefined\n  return {\n    socialImages: {\n      images,\n      onFacts: (facts) => {\n        reported = facts\n      },\n    },\n    collected: () => (reported ? { socialImageFacts: reported } : {}),\n  }\n}\n\n/**\n * The card's current pairs for a page that composes NOTHING, so has no batch\n * for its documents to join: a password-protected screen, whose nodes stay\n * withheld until unlock while its head still shares the card.\n *\n * ONE projected read, through the composition's own reader, so the verdict on\n * which assets this site may be shown is the CDN's here too. No read at all\n * when no reference names a library asset.\n *\n * Fail-open: any failure answers `undefined` and the card keeps its stored\n * pair. A page is never lost to the description of its share card.\n */\nexport async function getSocialImageAssetFacts(options: {\n  hostId: string\n  images: SocialCardImages\n}): Promise<SocialImageAssetFacts | undefined> {\n  const { hostId, images } = options\n  try {\n    const refs = socialImageRefs(images)\n    if (!refs.length) return undefined\n    return socialImageAssetFacts(\n      images,\n      await getMediaAssetFacts({ hostId, refs }),\n    )\n  } catch (error) {\n    console.error(\n      '[social-image-facts] read failed; the card keeps its stored pair',\n      error,\n    )\n    return undefined\n  }\n}\n\nexport default getSocialImageAssetFacts\n"],"names":["intrinsicMediaSize","parseMediaRef","IMAGE_COMPONENT_ID","mediaAssetFactsKey","getMediaAssetFacts","socialImageRefs","images","refs","seen","Set","image","ref","key","has","add","push","socialImageAssetFacts","facts","answered","found","get","undefined","intrinsicWidth","intrinsicHeight","componentId","propName","assetWidth","width","assetHeight","height","collectSocialImageFacts","reported","socialImages","onFacts","collected","socialImageFacts","getSocialImageAssetFacts","options","hostId","length","error","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;CAgBC,GAED,SACEA,kBAAkB,EAElBC,aAAa,QAER,sBAAqB;AAC5B,8EAA8E;AAC9E,4EAA4E;AAC5E,SACEC,kBAAkB,EAElBC,kBAAkB,QACb,2CAA0C;AACjD,OAAOC,wBAAwB,6BAAyB;AAyBxD;;;;;;CAMC,GACD,OAAO,SAASC,gBAAgBC,MAAwB;IACtD,MAAMC,OAAmB,EAAE;IAC3B,MAAMC,OAAO,IAAIC;IACjB,KAAK,MAAMC,SAASJ,OAAQ;QAC1B,MAAMK,MAAMV,cAAcS;QAC1B,IAAI,CAACC,KAAK;QACV,MAAMC,MAAMT,mBAAmBQ;QAC/B,IAAIH,KAAKK,GAAG,CAACD,MAAM;QACnBJ,KAAKM,GAAG,CAACF;QACTL,KAAKQ,IAAI,CAACJ;IACZ;IACA,OAAOJ;AACT;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASS,sBACdV,MAAwB,EACxBW,KAA2C;IAE3C,IAAIC;IACJ,KAAK,MAAMR,SAASJ,OAAQ;QAC1B,MAAMK,MAAMV,cAAcS;QAC1B,MAAMS,QAAQR,MAAMM,MAAMG,GAAG,CAACjB,mBAAmBQ,QAAQU;QACzD,IAAI,CAACF,OAAO;QACZ,MAAM,EAAEG,cAAc,EAAEC,eAAe,EAAE,GAAGvB,mBAAmB;YAC7DwB,aAAatB;YACbuB,UAAU;YACVC,YAAYP,MAAMQ,KAAK;YACvBC,aAAaT,MAAMU,MAAM;QAC3B;QACA,IAAIP,mBAAmBD,aAAaE,oBAAoBF,WAAW;QACnE,IAAI,CAACH,UAAUA,WAAW,CAAC;QAC3BA,QAAQ,CAACR,MAAgB,GAAG;YAC1BiB,OAAOL;YACPO,QAAQN;QACV;IACF;IACA,OAAOL;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASY,wBAAwBxB,MAAwB;IAM9D,IAAIyB;IACJ,OAAO;QACLC,cAAc;YACZ1B;YACA2B,SAAS,CAAChB;gBACRc,WAAWd;YACb;QACF;QACAiB,WAAW,IAAOH,WAAW;gBAAEI,kBAAkBJ;YAAS,IAAI,CAAC;IACjE;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeK,yBAAyBC,OAG9C;IACC,MAAM,EAAEC,MAAM,EAAEhC,MAAM,EAAE,GAAG+B;IAC3B,IAAI;QACF,MAAM9B,OAAOF,gBAAgBC;QAC7B,IAAI,CAACC,KAAKgC,MAAM,EAAE,OAAOlB;QACzB,OAAOL,sBACLV,QACA,MAAMF,mBAAmB;YAAEkC;YAAQ/B;QAAK;IAE5C,EAAE,OAAOiC,OAAO;QACdC,QAAQD,KAAK,CACX,oEACAA;QAEF,OAAOnB;IACT;AACF;AAEA,eAAee,yBAAwB"}

package/src/lib/stamp-form-dataset-bindings.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** The prop a rendered `form` node carries its signed dataset binding in. */
+export declare const FORM_DATASET_BINDING_PROP = "datasetBindingToken";
+/**
+ * Signs every `form` node's dataset binding into its props, for the submit
+ * route to verify (AGL-2773).
+ *
+ * The route writes a record only where a valid signature says, so a form
+ * without one still submits — the Inbox copy is always written — but adds no
+ * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the
+ * tree is returned unsigned rather than failing the page render, and the
+ * missing secret is reported once per process instead of once per render.
+ *
+ * Never mutates `nodes`; a tree with no bound form comes back as the same
+ * object.
+ */
+export declare function stampFormDatasetBindings<N extends Record<string, any>>(nodes: N, hostId: string): N;

package/src/lib/stamp-form-dataset-bindings.js

@@ -0,0 +1,59 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { formDatasetBindingsOf } from "@aglyn/aglyn/app-utils/form-dataset-binding";
+import { signFormDatasetBinding } from "@aglyn/tenant-data-admin/server/form-dataset-binding-token";
+/** The prop a rendered `form` node carries its signed dataset binding in. */ export const FORM_DATASET_BINDING_PROP = 'datasetBindingToken';
+/** Whether an unsigned render has been reported in this process yet. */ let reportedUnsigned = false;
+/**
+ * Signs every `form` node's dataset binding into its props, for the submit
+ * route to verify (AGL-2773).
+ *
+ * The route writes a record only where a valid signature says, so a form
+ * without one still submits — the Inbox copy is always written — but adds no
+ * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the
+ * tree is returned unsigned rather than failing the page render, and the
+ * missing secret is reported once per process instead of once per render.
+ *
+ * Never mutates `nodes`; a tree with no bound form comes back as the same
+ * object.
+ */ export function stampFormDatasetBindings(nodes, hostId) {
+    const bindings = formDatasetBindingsOf(nodes);
+    if (!bindings.length) return nodes;
+    const signed = _extends({}, nodes);
+    for (const { nodeId, binding } of bindings){
+        var _ref;
+        let token;
+        try {
+            token = signFormDatasetBinding(hostId, binding);
+        } catch (error) {
+            if (!reportedUnsigned) {
+                reportedUnsigned = true;
+                console.error('Form dataset bindings are not being signed, so forms bound to a ' + 'dataset will not write records', error);
+            }
+            return nodes;
+        }
+        const node = signed[nodeId];
+        signed[nodeId] = _extends({}, node, {
+            props: _extends({}, (_ref = node == null ? void 0 : node.props) != null ? _ref : {}, {
+                [FORM_DATASET_BINDING_PROP]: token
+            })
+        });
+    }
+    return signed;
+}
+
+//# sourceMappingURL=stamp-form-dataset-bindings.js.map

package/src/lib/stamp-form-dataset-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/stamp-form-dataset-bindings.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { formDatasetBindingsOf } from '@aglyn/aglyn/app-utils/form-dataset-binding'\nimport { signFormDatasetBinding } from '@aglyn/tenant-data-admin/server/form-dataset-binding-token'\n\n/** The prop a rendered `form` node carries its signed dataset binding in. */\nexport const FORM_DATASET_BINDING_PROP = 'datasetBindingToken'\n\n/** Whether an unsigned render has been reported in this process yet. */\nlet reportedUnsigned = false\n\n/**\n * Signs every `form` node's dataset binding into its props, for the submit\n * route to verify (AGL-2773).\n *\n * The route writes a record only where a valid signature says, so a form\n * without one still submits — the Inbox copy is always written — but adds no\n * record. That is what happens when `TOKEN_SIGNING_SECRET` is missing: the\n * tree is returned unsigned rather than failing the page render, and the\n * missing secret is reported once per process instead of once per render.\n *\n * Never mutates `nodes`; a tree with no bound form comes back as the same\n * object.\n */\nexport function stampFormDatasetBindings<N extends Record<string, any>>(\n  nodes: N,\n  hostId: string,\n): N {\n  const bindings = formDatasetBindingsOf(nodes as never)\n  if (!bindings.length) return nodes\n  const signed: Record<string, any> = { ...nodes }\n  for (const { nodeId, binding } of bindings) {\n    let token: string\n    try {\n      token = signFormDatasetBinding(hostId, binding)\n    } catch (error) {\n      if (!reportedUnsigned) {\n        reportedUnsigned = true\n        console.error(\n          'Form dataset bindings are not being signed, so forms bound to a ' +\n            'dataset will not write records',\n          error,\n        )\n      }\n      return nodes\n    }\n    const node = signed[nodeId]\n    signed[nodeId] = {\n      ...node,\n      props: { ...(node?.props ?? {}), [FORM_DATASET_BINDING_PROP]: token },\n    }\n  }\n  return signed as N\n}\n"],"names":["formDatasetBindingsOf","signFormDatasetBinding","FORM_DATASET_BINDING_PROP","reportedUnsigned","stampFormDatasetBindings","nodes","hostId","bindings","length","signed","nodeId","binding","token","error","console","node","props"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,qBAAqB,QAAQ,8CAA6C;AACnF,SAASC,sBAAsB,QAAQ,6DAA4D;AAEnG,2EAA2E,GAC3E,OAAO,MAAMC,4BAA4B,sBAAqB;AAE9D,sEAAsE,GACtE,IAAIC,mBAAmB;AAEvB;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,yBACdC,KAAQ,EACRC,MAAc;IAEd,MAAMC,WAAWP,sBAAsBK;IACvC,IAAI,CAACE,SAASC,MAAM,EAAE,OAAOH;IAC7B,MAAMI,SAA8B,aAAKJ;IACzC,KAAK,MAAM,EAAEK,MAAM,EAAEC,OAAO,EAAE,IAAIJ,SAAU;;QAC1C,IAAIK;QACJ,IAAI;YACFA,QAAQX,uBAAuBK,QAAQK;QACzC,EAAE,OAAOE,OAAO;YACd,IAAI,CAACV,kBAAkB;gBACrBA,mBAAmB;gBACnBW,QAAQD,KAAK,CACX,qEACE,kCACFA;YAEJ;YACA,OAAOR;QACT;QACA,MAAMU,OAAON,MAAM,CAACC,OAAO;QAC3BD,MAAM,CAACC,OAAO,GAAG,aACZK;YACHC,OAAO,qBAAMD,wBAAAA,KAAMC,KAAK,mBAAI,CAAC;gBAAI,CAACd,0BAA0B,EAAEU;;;IAElE;IACA,OAAOH;AACT"}

package/src/lib/template-screens.d.ts

@@ -0,0 +1,227 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The three fields a CONTENT collection can point at a template screen with.
+ * `templateScreenId` is the legacy AGL-105 field `resolveCollectionTemplateScreenId`
+ * still falls back to, so hosts predating the list/entry split are covered.
+ *
+ * `apps/console/app/api/hosts/resources/count-billable-screens.ts` subtracts
+ * this same set from the plan's screen allowance. It deliberately does NOT
+ * subtract the store fields below — what a template costs the subscriber is a
+ * separate question from whether it is a page.
+ */
+export declare const COLLECTION_TEMPLATE_SCREEN_FIELDS: readonly ["listScreenId", "entryScreenId", "templateScreenId"];
+/**
+ * The two fields COMMERCE points at a template screen with (AGL-1270). They
+ * live on `hosts/{hostId}/settings/store` (AGL-295), not on a collection doc,
+ * which is the only reason AGL-1267's fix did not already reach them —
+ * `pdpScreenId` renders `/products/{slug}` and `collectionScreenId` renders
+ * `/collections/{slug}`, both of which are templates in exactly the same sense.
+ *
+ * NOT yet mirrored in `apps/console/constants/collection-templates.ts`, which
+ * re-declares the collection fields for its `'use client'` readers: publishing a
+ * PDP template still toasts the author a route it does not have (the AGL-1269
+ * half of AGL-1270). Widening it is a console change and belongs with that file.
+ */
+export declare const STORE_TEMPLATE_SCREEN_FIELDS: readonly ["pdpScreenId", "collectionScreenId"];
+/**
+ * The field the HOST points a template screen at (AGL-2518).
+ *
+ * One so far: the screen every `/author/{slug}` page renders through. It sits
+ * on the host rather than on a collection because there is one author page
+ * shape per SITE, not per collection.
+ *
+ * Listed here rather than left to `kind: 'template'` because designating this
+ * screen deliberately does NOT demote it. An author template is a designed
+ * page in exactly the sense a collection's LIST template is (AGL-1387) — it
+ * stays billable, and the site keeps paying for the page it built — but like
+ * that one it must still 404 at the slug it was published under, or the site
+ * ships a page rendering raw `{{author.*}}` as body text. That is AGL-1267's
+ * defect, and the pointer half of this union is what closes it without the
+ * stamp that would also make the screen free (AGL-1400's settlement: a
+ * pointer excuses nothing, only the stamp does).
+ */
+export declare const HOST_TEMPLATE_SCREEN_FIELDS: readonly ["authorScreenId"];
+/** The shape this reads off a Firestore snapshot — kept structural so unit
+ * tests don't need the admin SDK. */
+interface FieldSnapshotLike {
+    get(field: string): unknown;
+}
+interface QuerySnapshotLike {
+    /** `id` is the document id — read only for a collection's listing. */
+    docs: Array<FieldSnapshotLike & {
+        id?: string;
+    }>;
+}
+/** Screen documents that say what they are — only the id is read. */
+interface IdSnapshotLike {
+    id: string;
+}
+/**
+ * Every screen id this host treats as a template — the screens that SAY so
+ * (`kind: 'template'`), plus a content collection's list/entry screens and
+ * commerce's PDP and catalog-collection screens. Pure, so the routing rule can
+ * be tested without Firestore.
+ *
+ * A UNION, and each half covers what the other cannot (AGL-1400):
+ *
+ *  - The `kind` half reaches a template no pointer names any more. Clearing a
+ *    collection's `entryScreenId` deliberately does NOT promote the screen back
+ *    to a page — promotion is a gated act — so without this an orphaned
+ *    template would become reachable at its own slug again, rendering raw
+ *    `{{entry.*}}` tokens: AGL-1267, back.
+ *  - The pointer half reaches the templates that are NOT `kind: 'template'`,
+ *    and there are two kinds of those on purpose. A collection's LIST template
+ *    is a page (AGL-1387) — billable, and served at `/{collectionSlug}` — but
+ *    it must still 404 at the slug it was published under. Commerce's PDP and
+ *    catalog templates are billable today too, and re-pricing them is a
+ *    separate decision from this one.
+ *
+ * Any source may be absent (`null`/`undefined`): a host with no store settings
+ * doc, or a read that failed on its own while the others succeeded.
+ */
+export declare function collectTemplateScreenIds(sources: {
+    collections?: QuerySnapshotLike | null;
+    storeSettings?: FieldSnapshotLike | null;
+    templateScreens?: {
+        docs: Array<IdSnapshotLike>;
+    } | null;
+    /** The host document, for {@link HOST_TEMPLATE_SCREEN_FIELDS}. */
+    host?: FieldSnapshotLike | null;
+}): Set<string>;
+/**
+ * Where a collection's LIST template is actually served, keyed by screen id
+ * (AGL-1998): `blogListTmpl` → `blog`, in the routing map's own path format.
+ *
+ * A list template is the one template kind that IS a page (AGL-1387) — and it
+ * is a page at somebody ELSE's address. `/{collectionSlug}` renders it through
+ * `composeCollectionTemplatePage`, while the slug it was published under is
+ * dropped from the route table by {@link getTemplateScreenIds} and 404s. So
+ * the routing map says one thing and the router does another, and everything
+ * that RESOLVES a screen link believed the map: on aglyn.com no screen link
+ * could point at `/blog` at all, because the only entry for the screen that
+ * serves it read `blog-list-template`.
+ *
+ * Two conditions, matching `collectionListTemplateScreenIds` in the console
+ * (which answers the same question for the Screens list's Path column):
+ *
+ *  - **A slug**, since `/{slug}` is the whole address; and
+ *  - **content kind**, because only a content collection answers `/{slug}` —
+ *    a catalog collection's listing is `/collections/{slug}`, composed by
+ *    commerce, and pointing a link there through this map would send visitors
+ *    to a path that does not exist.
+ *
+ * Publishing is deliberately NOT a condition: the collection branch resolves
+ * the screen through `listScreenId` and never through the routing map, so an
+ * unpublished list template serves `/{slug}` exactly like a published one.
+ * That is the live blog's state today.
+ */
+export declare function collectCollectionListRoutes(sources: {
+    collections?: QuerySnapshotLike | null;
+}): Record<string, string>;
+/**
+ * Every content collection's LISTING as a link target: collection id → slug
+ * (AGL-2799).
+ *
+ * `/{slug}` serves a content collection's listing whether or not a list
+ * template screen renders it — the built-in fallback composes one otherwise —
+ * so this is a different fact from {@link collectCollectionListRoutes}, which
+ * answers only for the collections that have such a screen. A link authored
+ * against a listing stores the collection's id, and `linkableScreenRoutes`
+ * turns this table into the `collection:<id>` entries it resolves through.
+ *
+ * The same two conditions as the list routes, for the same reasons: a slug,
+ * since `/{slug}` is the whole address, and content kind, since a catalog
+ * collection's listing is commerce's `/collections/{slug}`. `id` is optional
+ * on the structural snapshot type, so a document without one is skipped
+ * rather than keyed as `undefined`.
+ */
+export declare function collectCollectionListings(sources: {
+    collections?: QuerySnapshotLike | null;
+}): Record<string, string>;
+/** What the tenant router has to correct the published route table by. */
+export interface TemplateScreenRouting {
+    /** Screens the router drops before matching — see {@link getTemplateScreenIds}. */
+    templateScreenIds: Set<string>;
+    /** Where a list template is really served — see {@link collectCollectionListRoutes}. */
+    listRoutes: Record<string, string>;
+    /** Every content collection's listing, by id — see {@link collectCollectionListings}. */
+    collectionListings: Record<string, string>;
+}
+/**
+ * Screens that must NOT resolve as pages of the site (AGL-1267, AGL-1270).
+ *
+ * A template screen is a composition input, not a page. It only has meaning
+ * against a routed subject — `/{collection}/{entry}` substitutes `{{entry.*}}`,
+ * `/products/{slug}` substitutes `{{product.*}}` — so there is no request for
+ * which serving it at its own slug produces something correct. Publishing one
+ * is what makes the compose pipeline pick it up (`publishScreenRoute` stamps
+ * `publishedAt`), but publishing ALSO writes `hosts/{hostId}.screens[screenId]`,
+ * which is the tenant router's whole route table. That second write is the bug:
+ * publishing the blog's entry template put a live `/blog-entry-template` page on
+ * the site rendering seven raw `{{entry.*}}` tokens as body text, and publishing
+ * a PDP template does the same with `{{product.*}}`.
+ *
+ * A stored marker AND the pointers (AGL-1400): `kind: 'template'` is the fact
+ * for an entry template, and the pointers still answer for the two template
+ * kinds that stay pages — a collection's LIST template (AGL-1387) and
+ * commerce's PDP/catalog templates. See {@link collectTemplateScreenIds} for
+ * why neither half subsumes the other. Re-pointing a collection (or the store)
+ * at a different screen still takes effect on the next revalidate.
+ *
+ * THREE reads, not one — and one read cannot cover them. The template screens
+ * and the collection templates are QUERIES over different subcollections; the
+ * store templates are a single document at `hosts/{h}/settings/store`. Firestore
+ * has no read that spans a query and a document in a different subcollection
+ * (`getAll` batches document refs only, and cannot take the query). So they are
+ * issued CONCURRENTLY: three RPCs, one round trip of latency, which is what the
+ * cold-start budget cares about (AGL-1152). Both queries carry a field mask —
+ * the screens one projects to ids alone — and the store doc is a single small
+ * doc read whole, since `select` is a Query method and there is nothing to
+ * project on a document get.
+ *
+ * Fails OPEN — an empty set on error, and PER SOURCE. This sits on the critical
+ * path of every tenant page render, and a transient Firestore error must degrade
+ * to "the template is briefly reachable again", never to a site-wide 404. Per
+ * source because a store-settings failure has no business re-exposing the blog's
+ * entry template, or vice versa.
+ *
+ * The reads themselves are {@link getTemplateScreenRouting}'s, which answers
+ * the other half of the same question in the same trip (AGL-1998). This is the
+ * narrow view of it, and stays a named export because the four callers that
+ * only route requests have no use for the other half.
+ */
+export declare function getTemplateScreenIds(options: {
+    hostId: string;
+}): Promise<Set<string>>;
+/**
+ * Both halves of what the route table has to be corrected by, from ONE read
+ * (AGL-1998): the screens to drop, and where a list template really lives.
+ *
+ * They come out of the same collections query — the ids need `listScreenId`,
+ * the routes need the `slug` beside it — so asking separately would be a
+ * second identical round trip on the render path this arc keeps trimming
+ * (AGL-1152). {@link getTemplateScreenIds} is the narrow view of it, kept as
+ * its own export because four callers want only the set.
+ *
+ * Never rejects, and fails open to "no templates, no overrides" — the routing
+ * map as published — for the reason on {@link getTemplateScreenIds}.
+ */
+export declare function getTemplateScreenRouting(options: {
+    hostId: string;
+}): Promise<TemplateScreenRouting>;
+export default getTemplateScreenIds;