@aglyn/tenant-runtime 1.0.0-beta.143

package/src/lib/template-screens.js

@@ -0,0 +1,364 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { SCREEN_KIND_TEMPLATE } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { PUBLISHED_SITE_DATA_TTL_SECONDS, tenantDataTag, withRenderCache } from "@aglyn/tenant-data-admin/render-cache";
+/**
+ * Cached as an ARRAY (a `Set` does not survive the cache's JSON round trip)
+ * and rehydrated at the boundary (AGL-1302). Publishing a template screen
+ * re-points a collection or the store settings, and both writes ride the
+ * same publish flow that busts `tenant-data:{hostId}`; 60s is the backstop.
+ */ const TEMPLATE_SCREEN_IDS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS;
+/**
+ * The three fields a CONTENT collection can point at a template screen with.
+ * `templateScreenId` is the legacy AGL-105 field `resolveCollectionTemplateScreenId`
+ * still falls back to, so hosts predating the list/entry split are covered.
+ *
+ * `apps/console/app/api/hosts/resources/count-billable-screens.ts` subtracts
+ * this same set from the plan's screen allowance. It deliberately does NOT
+ * subtract the store fields below — what a template costs the subscriber is a
+ * separate question from whether it is a page.
+ */ export const COLLECTION_TEMPLATE_SCREEN_FIELDS = [
+    'listScreenId',
+    'entryScreenId',
+    'templateScreenId'
+];
+/**
+ * The two fields COMMERCE points at a template screen with (AGL-1270). They
+ * live on `hosts/{hostId}/settings/store` (AGL-295), not on a collection doc,
+ * which is the only reason AGL-1267's fix did not already reach them —
+ * `pdpScreenId` renders `/products/{slug}` and `collectionScreenId` renders
+ * `/collections/{slug}`, both of which are templates in exactly the same sense.
+ *
+ * NOT yet mirrored in `apps/console/constants/collection-templates.ts`, which
+ * re-declares the collection fields for its `'use client'` readers: publishing a
+ * PDP template still toasts the author a route it does not have (the AGL-1269
+ * half of AGL-1270). Widening it is a console change and belongs with that file.
+ */ export const STORE_TEMPLATE_SCREEN_FIELDS = [
+    'pdpScreenId',
+    'collectionScreenId'
+];
+/**
+ * The field the HOST points a template screen at (AGL-2518).
+ *
+ * One so far: the screen every `/author/{slug}` page renders through. It sits
+ * on the host rather than on a collection because there is one author page
+ * shape per SITE, not per collection.
+ *
+ * Listed here rather than left to `kind: 'template'` because designating this
+ * screen deliberately does NOT demote it. An author template is a designed
+ * page in exactly the sense a collection's LIST template is (AGL-1387) — it
+ * stays billable, and the site keeps paying for the page it built — but like
+ * that one it must still 404 at the slug it was published under, or the site
+ * ships a page rendering raw `{{author.*}}` as body text. That is AGL-1267's
+ * defect, and the pointer half of this union is what closes it without the
+ * stamp that would also make the screen free (AGL-1400's settlement: a
+ * pointer excuses nothing, only the stamp does).
+ */ export const HOST_TEMPLATE_SCREEN_FIELDS = [
+    'authorScreenId'
+];
+/**
+ * Every screen id this host treats as a template — the screens that SAY so
+ * (`kind: 'template'`), plus a content collection's list/entry screens and
+ * commerce's PDP and catalog-collection screens. Pure, so the routing rule can
+ * be tested without Firestore.
+ *
+ * A UNION, and each half covers what the other cannot (AGL-1400):
+ *
+ *  - The `kind` half reaches a template no pointer names any more. Clearing a
+ *    collection's `entryScreenId` deliberately does NOT promote the screen back
+ *    to a page — promotion is a gated act — so without this an orphaned
+ *    template would become reachable at its own slug again, rendering raw
+ *    `{{entry.*}}` tokens: AGL-1267, back.
+ *  - The pointer half reaches the templates that are NOT `kind: 'template'`,
+ *    and there are two kinds of those on purpose. A collection's LIST template
+ *    is a page (AGL-1387) — billable, and served at `/{collectionSlug}` — but
+ *    it must still 404 at the slug it was published under. Commerce's PDP and
+ *    catalog templates are billable today too, and re-pricing them is a
+ *    separate decision from this one.
+ *
+ * Any source may be absent (`null`/`undefined`): a host with no store settings
+ * doc, or a read that failed on its own while the others succeeded.
+ */ export function collectTemplateScreenIds(sources) {
+    var _ref, _ref1;
+    var _sources_templateScreens, _sources_collections;
+    const ids = new Set();
+    const add = (screenId)=>{
+        if (typeof screenId === 'string' && screenId) ids.add(screenId);
+    };
+    for (const screen of (_ref = (_sources_templateScreens = sources.templateScreens) == null ? void 0 : _sources_templateScreens.docs) != null ? _ref : [])add(screen.id);
+    for (const contentCollection of (_ref1 = (_sources_collections = sources.collections) == null ? void 0 : _sources_collections.docs) != null ? _ref1 : []){
+        for (const field of COLLECTION_TEMPLATE_SCREEN_FIELDS){
+            add(contentCollection.get(field));
+        }
+    }
+    if (sources.storeSettings) {
+        for (const field of STORE_TEMPLATE_SCREEN_FIELDS){
+            add(sources.storeSettings.get(field));
+        }
+    }
+    if (sources.host) {
+        for (const field of HOST_TEMPLATE_SCREEN_FIELDS){
+            add(sources.host.get(field));
+        }
+    }
+    return ids;
+}
+/**
+ * Where a collection's LIST template is actually served, keyed by screen id
+ * (AGL-1998): `blogListTmpl` → `blog`, in the routing map's own path format.
+ *
+ * A list template is the one template kind that IS a page (AGL-1387) — and it
+ * is a page at somebody ELSE's address. `/{collectionSlug}` renders it through
+ * `composeCollectionTemplatePage`, while the slug it was published under is
+ * dropped from the route table by {@link getTemplateScreenIds} and 404s. So
+ * the routing map says one thing and the router does another, and everything
+ * that RESOLVES a screen link believed the map: on aglyn.com no screen link
+ * could point at `/blog` at all, because the only entry for the screen that
+ * serves it read `blog-list-template`.
+ *
+ * Two conditions, matching `collectionListTemplateScreenIds` in the console
+ * (which answers the same question for the Screens list's Path column):
+ *
+ *  - **A slug**, since `/{slug}` is the whole address; and
+ *  - **content kind**, because only a content collection answers `/{slug}` —
+ *    a catalog collection's listing is `/collections/{slug}`, composed by
+ *    commerce, and pointing a link there through this map would send visitors
+ *    to a path that does not exist.
+ *
+ * Publishing is deliberately NOT a condition: the collection branch resolves
+ * the screen through `listScreenId` and never through the routing map, so an
+ * unpublished list template serves `/{slug}` exactly like a published one.
+ * That is the live blog's state today.
+ */ export function collectCollectionListRoutes(sources) {
+    var _ref;
+    var _sources_collections;
+    const routes = {};
+    for (const contentCollection of (_ref = (_sources_collections = sources.collections) == null ? void 0 : _sources_collections.docs) != null ? _ref : []){
+        // Mirrors `hostCollectionKind`: only `kind: 'catalog'` is catalog, and a
+        // document that does not say what it is reads as content.
+        if (contentCollection.get('kind') === 'catalog') continue;
+        const slug = contentCollection.get('slug');
+        if (typeof slug !== 'string' || !slug) continue;
+        const listScreenId = contentCollection.get('listScreenId');
+        if (typeof listScreenId !== 'string' || !listScreenId) continue;
+        routes[listScreenId] = slug;
+    }
+    return routes;
+}
+/**
+ * Every content collection's LISTING as a link target: collection id → slug
+ * (AGL-2799).
+ *
+ * `/{slug}` serves a content collection's listing whether or not a list
+ * template screen renders it — the built-in fallback composes one otherwise —
+ * so this is a different fact from {@link collectCollectionListRoutes}, which
+ * answers only for the collections that have such a screen. A link authored
+ * against a listing stores the collection's id, and `linkableScreenRoutes`
+ * turns this table into the `collection:<id>` entries it resolves through.
+ *
+ * The same two conditions as the list routes, for the same reasons: a slug,
+ * since `/{slug}` is the whole address, and content kind, since a catalog
+ * collection's listing is commerce's `/collections/{slug}`. `id` is optional
+ * on the structural snapshot type, so a document without one is skipped
+ * rather than keyed as `undefined`.
+ */ export function collectCollectionListings(sources) {
+    var _ref;
+    var _sources_collections;
+    const listings = {};
+    for (const contentCollection of (_ref = (_sources_collections = sources.collections) == null ? void 0 : _sources_collections.docs) != null ? _ref : []){
+        if (contentCollection.get('kind') === 'catalog') continue;
+        const collectionId = contentCollection.id;
+        if (typeof collectionId !== 'string' || !collectionId) continue;
+        const slug = contentCollection.get('slug');
+        if (typeof slug !== 'string' || !slug) continue;
+        listings[collectionId] = slug;
+    }
+    return listings;
+}
+/**
+ * Screens that must NOT resolve as pages of the site (AGL-1267, AGL-1270).
+ *
+ * A template screen is a composition input, not a page. It only has meaning
+ * against a routed subject — `/{collection}/{entry}` substitutes `{{entry.*}}`,
+ * `/products/{slug}` substitutes `{{product.*}}` — so there is no request for
+ * which serving it at its own slug produces something correct. Publishing one
+ * is what makes the compose pipeline pick it up (`publishScreenRoute` stamps
+ * `publishedAt`), but publishing ALSO writes `hosts/{hostId}.screens[screenId]`,
+ * which is the tenant router's whole route table. That second write is the bug:
+ * publishing the blog's entry template put a live `/blog-entry-template` page on
+ * the site rendering seven raw `{{entry.*}}` tokens as body text, and publishing
+ * a PDP template does the same with `{{product.*}}`.
+ *
+ * A stored marker AND the pointers (AGL-1400): `kind: 'template'` is the fact
+ * for an entry template, and the pointers still answer for the two template
+ * kinds that stay pages — a collection's LIST template (AGL-1387) and
+ * commerce's PDP/catalog templates. See {@link collectTemplateScreenIds} for
+ * why neither half subsumes the other. Re-pointing a collection (or the store)
+ * at a different screen still takes effect on the next revalidate.
+ *
+ * THREE reads, not one — and one read cannot cover them. The template screens
+ * and the collection templates are QUERIES over different subcollections; the
+ * store templates are a single document at `hosts/{h}/settings/store`. Firestore
+ * has no read that spans a query and a document in a different subcollection
+ * (`getAll` batches document refs only, and cannot take the query). So they are
+ * issued CONCURRENTLY: three RPCs, one round trip of latency, which is what the
+ * cold-start budget cares about (AGL-1152). Both queries carry a field mask —
+ * the screens one projects to ids alone — and the store doc is a single small
+ * doc read whole, since `select` is a Query method and there is nothing to
+ * project on a document get.
+ *
+ * Fails OPEN — an empty set on error, and PER SOURCE. This sits on the critical
+ * path of every tenant page render, and a transient Firestore error must degrade
+ * to "the template is briefly reachable again", never to a site-wide 404. Per
+ * source because a store-settings failure has no business re-exposing the blog's
+ * entry template, or vice versa.
+ *
+ * The reads themselves are {@link getTemplateScreenRouting}'s, which answers
+ * the other half of the same question in the same trip (AGL-1998). This is the
+ * narrow view of it, and stays a named export because the four callers that
+ * only route requests have no use for the other half.
+ */ export async function getTemplateScreenIds(options) {
+    return (await getTemplateScreenRouting(options)).templateScreenIds;
+}
+/**
+ * Both halves of what the route table has to be corrected by, from ONE read
+ * (AGL-1998): the screens to drop, and where a list template really lives.
+ *
+ * They come out of the same collections query — the ids need `listScreenId`,
+ * the routes need the `slug` beside it — so asking separately would be a
+ * second identical round trip on the render path this arc keeps trimming
+ * (AGL-1152). {@link getTemplateScreenIds} is the narrow view of it, kept as
+ * its own export because four callers want only the set.
+ *
+ * Never rejects, and fails open to "no templates, no overrides" — the routing
+ * map as published — for the reason on {@link getTemplateScreenIds}.
+ */ export async function getTemplateScreenRouting(options) {
+    try {
+        var _ref, _ref1, _ref2;
+        // A NEW key rather than the old `tenant-template-screens`: the cached
+        // value's shape changed from an array to an object, and a deploy that
+        // read the previous shape back under the previous key would hand every
+        // in-flight render an `ids` of `undefined`.
+        const cached = await withRenderCache({
+            key: [
+                'tenant-template-routing',
+                options.hostId
+            ],
+            revalidate: TEMPLATE_SCREEN_IDS_TTL_SECONDS,
+            tags: [
+                tenantDataTag(options.hostId)
+            ],
+            read: async ()=>{
+                const routing = await readTemplateScreenRouting(options);
+                return {
+                    ids: [
+                        ...routing.templateScreenIds
+                    ],
+                    listRoutes: routing.listRoutes,
+                    collectionListings: routing.collectionListings
+                };
+            }
+        });
+        return {
+            // `Set`s and `Map`s do not survive the cache's JSON round trip, so the
+            // stored shape is an array and it is rehydrated here.
+            templateScreenIds: new Set((_ref = cached == null ? void 0 : cached.ids) != null ? _ref : []),
+            listRoutes: (_ref1 = cached == null ? void 0 : cached.listRoutes) != null ? _ref1 : {},
+            // An entry written without this field reads as no listings until it
+            // revalidates, which the TTL above bounds.
+            collectionListings: (_ref2 = cached == null ? void 0 : cached.collectionListings) != null ? _ref2 : {}
+        };
+    } catch (error) {
+        // The contract is "never rejects" — a cache failure degrades to the
+        // uncached read, which itself fails open to an empty set.
+        console.error('template screen lookup failed:', error);
+        return readTemplateScreenRouting(options);
+    }
+}
+async function readTemplateScreenRouting(options) {
+    try {
+        const hostRef = firebaseAdmin.app().firestore().collection('hosts').doc(options.hostId);
+        const [templateScreens, collections, storeSettings, host] = await Promise.all([
+            // The screens that say so (AGL-1400). `select()` with no fields returns
+            // ids only, and the equality filter rides Firestore's automatic
+            // single-field index — no composite index, and no read of the 100+ screen
+            // documents a large site has.
+            hostRef.collection('screens').where('kind', '==', SCREEN_KIND_TEMPLATE).select().limit(200).get().catch((error)=>{
+                console.error('template screen kind lookup failed:', error);
+                return null;
+            }),
+            hostRef.collection('collections')// `slug` and `kind` ride along for AGL-1998: which route a LIST
+            // template is really served at is decided by the same document, and
+            // widening a field mask costs nothing next to a second query.
+            .select(...COLLECTION_TEMPLATE_SCREEN_FIELDS, 'slug', 'kind').limit(100).get().catch((error)=>{
+                console.error('collection template lookup failed:', error);
+                return null;
+            }),
+            // A host with commerce disabled — or one that never opened Store
+            // settings — has no doc here. A missing doc is not an error: `get()`
+            // resolves with `exists: false` and every field read returns undefined,
+            // so it contributes nothing and costs nothing else.
+            hostRef.collection('settings').doc('store').get().catch((error)=>{
+                console.error('store template lookup failed:', error);
+                return null;
+            }),
+            // The host's own template pointer (AGL-2518). A FOURTH concurrent RPC
+            // in the same round trip rather than a fourth round trip, which is what
+            // the cold-start budget cares about (AGL-1152) — and the document is
+            // one every request has already read through `getHostCached`, so it is
+            // warm by the time this asks for it.
+            // Wrapped rather than called directly, so this source fails open the
+            // way the three above it do. `.catch()` only guards a REJECTION; a
+            // synchronous throw here would escape into the outer catch, which
+            // returns an EMPTY set — and an empty set re-exposes every template
+            // screen on the site as a page. Per-source isolation is the contract
+            // this function states, and it has to hold for the source that reads
+            // a different shape of ref from the other three.
+            Promise.resolve().then(()=>hostRef.get()).catch((error)=>{
+                console.error('host template pointer lookup failed:', error);
+                return null;
+            })
+        ]);
+        return {
+            templateScreenIds: collectTemplateScreenIds({
+                templateScreens,
+                collections,
+                storeSettings,
+                host
+            }),
+            listRoutes: collectCollectionListRoutes({
+                collections
+            }),
+            // The same read again: a document's id comes with it whatever the
+            // field mask projects.
+            collectionListings: collectCollectionListings({
+                collections
+            })
+        };
+    } catch (error) {
+        // The ref construction itself threw (no initialised admin app, say).
+        console.error('template screen lookup failed:', error);
+        return {
+            templateScreenIds: new Set(),
+            listRoutes: {},
+            collectionListings: {}
+        };
+    }
+}
+export default getTemplateScreenIds;
+
+//# sourceMappingURL=template-screens.js.map

package/src/lib/template-screens.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/template-screens.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SCREEN_KIND_TEMPLATE } from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport {\n  PUBLISHED_SITE_DATA_TTL_SECONDS,\n  tenantDataTag,\n  withRenderCache,\n} from '@aglyn/tenant-data-admin/render-cache'\n\n/**\n * Cached as an ARRAY (a `Set` does not survive the cache's JSON round trip)\n * and rehydrated at the boundary (AGL-1302). Publishing a template screen\n * re-points a collection or the store settings, and both writes ride the\n * same publish flow that busts `tenant-data:{hostId}`; 60s is the backstop.\n */\nconst TEMPLATE_SCREEN_IDS_TTL_SECONDS = PUBLISHED_SITE_DATA_TTL_SECONDS\n\n/**\n * The three fields a CONTENT collection can point at a template screen with.\n * `templateScreenId` is the legacy AGL-105 field `resolveCollectionTemplateScreenId`\n * still falls back to, so hosts predating the list/entry split are covered.\n *\n * `apps/console/app/api/hosts/resources/count-billable-screens.ts` subtracts\n * this same set from the plan's screen allowance. It deliberately does NOT\n * subtract the store fields below — what a template costs the subscriber is a\n * separate question from whether it is a page.\n */\nexport const COLLECTION_TEMPLATE_SCREEN_FIELDS = [\n  'listScreenId',\n  'entryScreenId',\n  'templateScreenId',\n] as const\n\n/**\n * The two fields COMMERCE points at a template screen with (AGL-1270). They\n * live on `hosts/{hostId}/settings/store` (AGL-295), not on a collection doc,\n * which is the only reason AGL-1267's fix did not already reach them —\n * `pdpScreenId` renders `/products/{slug}` and `collectionScreenId` renders\n * `/collections/{slug}`, both of which are templates in exactly the same sense.\n *\n * NOT yet mirrored in `apps/console/constants/collection-templates.ts`, which\n * re-declares the collection fields for its `'use client'` readers: publishing a\n * PDP template still toasts the author a route it does not have (the AGL-1269\n * half of AGL-1270). Widening it is a console change and belongs with that file.\n */\nexport const STORE_TEMPLATE_SCREEN_FIELDS = [\n  'pdpScreenId',\n  'collectionScreenId',\n] as const\n\n/**\n * The field the HOST points a template screen at (AGL-2518).\n *\n * One so far: the screen every `/author/{slug}` page renders through. It sits\n * on the host rather than on a collection because there is one author page\n * shape per SITE, not per collection.\n *\n * Listed here rather than left to `kind: 'template'` because designating this\n * screen deliberately does NOT demote it. An author template is a designed\n * page in exactly the sense a collection's LIST template is (AGL-1387) — it\n * stays billable, and the site keeps paying for the page it built — but like\n * that one it must still 404 at the slug it was published under, or the site\n * ships a page rendering raw `{{author.*}}` as body text. That is AGL-1267's\n * defect, and the pointer half of this union is what closes it without the\n * stamp that would also make the screen free (AGL-1400's settlement: a\n * pointer excuses nothing, only the stamp does).\n */\nexport const HOST_TEMPLATE_SCREEN_FIELDS = ['authorScreenId'] as const\n\n/** The shape this reads off a Firestore snapshot — kept structural so unit\n * tests don't need the admin SDK. */\ninterface FieldSnapshotLike {\n  get(field: string): unknown\n}\n\ninterface QuerySnapshotLike {\n  /** `id` is the document id — read only for a collection's listing. */\n  docs: Array<FieldSnapshotLike & { id?: string }>\n}\n\n/** Screen documents that say what they are — only the id is read. */\ninterface IdSnapshotLike {\n  id: string\n}\n\n/**\n * Every screen id this host treats as a template — the screens that SAY so\n * (`kind: 'template'`), plus a content collection's list/entry screens and\n * commerce's PDP and catalog-collection screens. Pure, so the routing rule can\n * be tested without Firestore.\n *\n * A UNION, and each half covers what the other cannot (AGL-1400):\n *\n *  - The `kind` half reaches a template no pointer names any more. Clearing a\n *    collection's `entryScreenId` deliberately does NOT promote the screen back\n *    to a page — promotion is a gated act — so without this an orphaned\n *    template would become reachable at its own slug again, rendering raw\n *    `{{entry.*}}` tokens: AGL-1267, back.\n *  - The pointer half reaches the templates that are NOT `kind: 'template'`,\n *    and there are two kinds of those on purpose. A collection's LIST template\n *    is a page (AGL-1387) — billable, and served at `/{collectionSlug}` — but\n *    it must still 404 at the slug it was published under. Commerce's PDP and\n *    catalog templates are billable today too, and re-pricing them is a\n *    separate decision from this one.\n *\n * Any source may be absent (`null`/`undefined`): a host with no store settings\n * doc, or a read that failed on its own while the others succeeded.\n */\nexport function collectTemplateScreenIds(sources: {\n  collections?: QuerySnapshotLike | null\n  storeSettings?: FieldSnapshotLike | null\n  templateScreens?: { docs: Array<IdSnapshotLike> } | null\n  /** The host document, for {@link HOST_TEMPLATE_SCREEN_FIELDS}. */\n  host?: FieldSnapshotLike | null\n}): Set<string> {\n  const ids = new Set<string>()\n  const add = (screenId: unknown) => {\n    if (typeof screenId === 'string' && screenId) ids.add(screenId)\n  }\n  for (const screen of sources.templateScreens?.docs ?? []) add(screen.id)\n  for (const contentCollection of sources.collections?.docs ?? []) {\n    for (const field of COLLECTION_TEMPLATE_SCREEN_FIELDS) {\n      add(contentCollection.get(field))\n    }\n  }\n  if (sources.storeSettings) {\n    for (const field of STORE_TEMPLATE_SCREEN_FIELDS) {\n      add(sources.storeSettings.get(field))\n    }\n  }\n  if (sources.host) {\n    for (const field of HOST_TEMPLATE_SCREEN_FIELDS) {\n      add(sources.host.get(field))\n    }\n  }\n  return ids\n}\n\n/**\n * Where a collection's LIST template is actually served, keyed by screen id\n * (AGL-1998): `blogListTmpl` → `blog`, in the routing map's own path format.\n *\n * A list template is the one template kind that IS a page (AGL-1387) — and it\n * is a page at somebody ELSE's address. `/{collectionSlug}` renders it through\n * `composeCollectionTemplatePage`, while the slug it was published under is\n * dropped from the route table by {@link getTemplateScreenIds} and 404s. So\n * the routing map says one thing and the router does another, and everything\n * that RESOLVES a screen link believed the map: on aglyn.com no screen link\n * could point at `/blog` at all, because the only entry for the screen that\n * serves it read `blog-list-template`.\n *\n * Two conditions, matching `collectionListTemplateScreenIds` in the console\n * (which answers the same question for the Screens list's Path column):\n *\n *  - **A slug**, since `/{slug}` is the whole address; and\n *  - **content kind**, because only a content collection answers `/{slug}` —\n *    a catalog collection's listing is `/collections/{slug}`, composed by\n *    commerce, and pointing a link there through this map would send visitors\n *    to a path that does not exist.\n *\n * Publishing is deliberately NOT a condition: the collection branch resolves\n * the screen through `listScreenId` and never through the routing map, so an\n * unpublished list template serves `/{slug}` exactly like a published one.\n * That is the live blog's state today.\n */\nexport function collectCollectionListRoutes(sources: {\n  collections?: QuerySnapshotLike | null\n}): Record<string, string> {\n  const routes: Record<string, string> = {}\n  for (const contentCollection of sources.collections?.docs ?? []) {\n    // Mirrors `hostCollectionKind`: only `kind: 'catalog'` is catalog, and a\n    // document that does not say what it is reads as content.\n    if (contentCollection.get('kind') === 'catalog') continue\n    const slug = contentCollection.get('slug')\n    if (typeof slug !== 'string' || !slug) continue\n    const listScreenId = contentCollection.get('listScreenId')\n    if (typeof listScreenId !== 'string' || !listScreenId) continue\n    routes[listScreenId] = slug\n  }\n  return routes\n}\n\n/**\n * Every content collection's LISTING as a link target: collection id → slug\n * (AGL-2799).\n *\n * `/{slug}` serves a content collection's listing whether or not a list\n * template screen renders it — the built-in fallback composes one otherwise —\n * so this is a different fact from {@link collectCollectionListRoutes}, which\n * answers only for the collections that have such a screen. A link authored\n * against a listing stores the collection's id, and `linkableScreenRoutes`\n * turns this table into the `collection:<id>` entries it resolves through.\n *\n * The same two conditions as the list routes, for the same reasons: a slug,\n * since `/{slug}` is the whole address, and content kind, since a catalog\n * collection's listing is commerce's `/collections/{slug}`. `id` is optional\n * on the structural snapshot type, so a document without one is skipped\n * rather than keyed as `undefined`.\n */\nexport function collectCollectionListings(sources: {\n  collections?: QuerySnapshotLike | null\n}): Record<string, string> {\n  const listings: Record<string, string> = {}\n  for (const contentCollection of sources.collections?.docs ?? []) {\n    if (contentCollection.get('kind') === 'catalog') continue\n    const collectionId = contentCollection.id\n    if (typeof collectionId !== 'string' || !collectionId) continue\n    const slug = contentCollection.get('slug')\n    if (typeof slug !== 'string' || !slug) continue\n    listings[collectionId] = slug\n  }\n  return listings\n}\n\n/** What the tenant router has to correct the published route table by. */\nexport interface TemplateScreenRouting {\n  /** Screens the router drops before matching — see {@link getTemplateScreenIds}. */\n  templateScreenIds: Set<string>\n  /** Where a list template is really served — see {@link collectCollectionListRoutes}. */\n  listRoutes: Record<string, string>\n  /** Every content collection's listing, by id — see {@link collectCollectionListings}. */\n  collectionListings: Record<string, string>\n}\n\n/**\n * Screens that must NOT resolve as pages of the site (AGL-1267, AGL-1270).\n *\n * A template screen is a composition input, not a page. It only has meaning\n * against a routed subject — `/{collection}/{entry}` substitutes `{{entry.*}}`,\n * `/products/{slug}` substitutes `{{product.*}}` — so there is no request for\n * which serving it at its own slug produces something correct. Publishing one\n * is what makes the compose pipeline pick it up (`publishScreenRoute` stamps\n * `publishedAt`), but publishing ALSO writes `hosts/{hostId}.screens[screenId]`,\n * which is the tenant router's whole route table. That second write is the bug:\n * publishing the blog's entry template put a live `/blog-entry-template` page on\n * the site rendering seven raw `{{entry.*}}` tokens as body text, and publishing\n * a PDP template does the same with `{{product.*}}`.\n *\n * A stored marker AND the pointers (AGL-1400): `kind: 'template'` is the fact\n * for an entry template, and the pointers still answer for the two template\n * kinds that stay pages — a collection's LIST template (AGL-1387) and\n * commerce's PDP/catalog templates. See {@link collectTemplateScreenIds} for\n * why neither half subsumes the other. Re-pointing a collection (or the store)\n * at a different screen still takes effect on the next revalidate.\n *\n * THREE reads, not one — and one read cannot cover them. The template screens\n * and the collection templates are QUERIES over different subcollections; the\n * store templates are a single document at `hosts/{h}/settings/store`. Firestore\n * has no read that spans a query and a document in a different subcollection\n * (`getAll` batches document refs only, and cannot take the query). So they are\n * issued CONCURRENTLY: three RPCs, one round trip of latency, which is what the\n * cold-start budget cares about (AGL-1152). Both queries carry a field mask —\n * the screens one projects to ids alone — and the store doc is a single small\n * doc read whole, since `select` is a Query method and there is nothing to\n * project on a document get.\n *\n * Fails OPEN — an empty set on error, and PER SOURCE. This sits on the critical\n * path of every tenant page render, and a transient Firestore error must degrade\n * to \"the template is briefly reachable again\", never to a site-wide 404. Per\n * source because a store-settings failure has no business re-exposing the blog's\n * entry template, or vice versa.\n *\n * The reads themselves are {@link getTemplateScreenRouting}'s, which answers\n * the other half of the same question in the same trip (AGL-1998). This is the\n * narrow view of it, and stays a named export because the four callers that\n * only route requests have no use for the other half.\n */\nexport async function getTemplateScreenIds(options: {\n  hostId: string\n}): Promise<Set<string>> {\n  return (await getTemplateScreenRouting(options)).templateScreenIds\n}\n\n/**\n * Both halves of what the route table has to be corrected by, from ONE read\n * (AGL-1998): the screens to drop, and where a list template really lives.\n *\n * They come out of the same collections query — the ids need `listScreenId`,\n * the routes need the `slug` beside it — so asking separately would be a\n * second identical round trip on the render path this arc keeps trimming\n * (AGL-1152). {@link getTemplateScreenIds} is the narrow view of it, kept as\n * its own export because four callers want only the set.\n *\n * Never rejects, and fails open to \"no templates, no overrides\" — the routing\n * map as published — for the reason on {@link getTemplateScreenIds}.\n */\nexport async function getTemplateScreenRouting(options: {\n  hostId: string\n}): Promise<TemplateScreenRouting> {\n  try {\n    // A NEW key rather than the old `tenant-template-screens`: the cached\n    // value's shape changed from an array to an object, and a deploy that\n    // read the previous shape back under the previous key would hand every\n    // in-flight render an `ids` of `undefined`.\n    const cached = await withRenderCache({\n      key: ['tenant-template-routing', options.hostId],\n      revalidate: TEMPLATE_SCREEN_IDS_TTL_SECONDS,\n      tags: [tenantDataTag(options.hostId)],\n      read: async () => {\n        const routing = await readTemplateScreenRouting(options)\n        return {\n          ids: [...routing.templateScreenIds],\n          listRoutes: routing.listRoutes,\n          collectionListings: routing.collectionListings,\n        }\n      },\n    })\n    return {\n      // `Set`s and `Map`s do not survive the cache's JSON round trip, so the\n      // stored shape is an array and it is rehydrated here.\n      templateScreenIds: new Set(cached?.ids ?? []),\n      listRoutes: cached?.listRoutes ?? {},\n      // An entry written without this field reads as no listings until it\n      // revalidates, which the TTL above bounds.\n      collectionListings: cached?.collectionListings ?? {},\n    }\n  } catch (error) {\n    // The contract is \"never rejects\" — a cache failure degrades to the\n    // uncached read, which itself fails open to an empty set.\n    console.error('template screen lookup failed:', error)\n    return readTemplateScreenRouting(options)\n  }\n}\n\nasync function readTemplateScreenRouting(options: {\n  hostId: string\n}): Promise<TemplateScreenRouting> {\n  try {\n    const hostRef = firebaseAdmin\n      .app()\n      .firestore()\n      .collection('hosts')\n      .doc(options.hostId)\n\n    const [templateScreens, collections, storeSettings, host] =\n      await Promise.all([\n        // The screens that say so (AGL-1400). `select()` with no fields returns\n        // ids only, and the equality filter rides Firestore's automatic\n        // single-field index — no composite index, and no read of the 100+ screen\n        // documents a large site has.\n        hostRef\n          .collection('screens')\n          .where('kind', '==', SCREEN_KIND_TEMPLATE)\n          .select()\n          .limit(200)\n          .get()\n          .catch((error: unknown) => {\n            console.error('template screen kind lookup failed:', error)\n            return null\n          }),\n        hostRef\n          .collection('collections')\n          // `slug` and `kind` ride along for AGL-1998: which route a LIST\n          // template is really served at is decided by the same document, and\n          // widening a field mask costs nothing next to a second query.\n          .select(...COLLECTION_TEMPLATE_SCREEN_FIELDS, 'slug', 'kind')\n          .limit(100)\n          .get()\n          .catch((error: unknown) => {\n            console.error('collection template lookup failed:', error)\n            return null\n          }),\n        // A host with commerce disabled — or one that never opened Store\n        // settings — has no doc here. A missing doc is not an error: `get()`\n        // resolves with `exists: false` and every field read returns undefined,\n        // so it contributes nothing and costs nothing else.\n        hostRef\n          .collection('settings')\n          .doc('store')\n          .get()\n          .catch((error: unknown) => {\n            console.error('store template lookup failed:', error)\n            return null\n          }),\n        // The host's own template pointer (AGL-2518). A FOURTH concurrent RPC\n        // in the same round trip rather than a fourth round trip, which is what\n        // the cold-start budget cares about (AGL-1152) — and the document is\n        // one every request has already read through `getHostCached`, so it is\n        // warm by the time this asks for it.\n        // Wrapped rather than called directly, so this source fails open the\n        // way the three above it do. `.catch()` only guards a REJECTION; a\n        // synchronous throw here would escape into the outer catch, which\n        // returns an EMPTY set — and an empty set re-exposes every template\n        // screen on the site as a page. Per-source isolation is the contract\n        // this function states, and it has to hold for the source that reads\n        // a different shape of ref from the other three.\n        Promise.resolve()\n          .then(() => hostRef.get())\n          .catch((error: unknown) => {\n            console.error('host template pointer lookup failed:', error)\n            return null\n          }),\n      ])\n\n    return {\n      templateScreenIds: collectTemplateScreenIds({\n        templateScreens,\n        collections,\n        storeSettings,\n        host,\n      }),\n      listRoutes: collectCollectionListRoutes({ collections }),\n      // The same read again: a document's id comes with it whatever the\n      // field mask projects.\n      collectionListings: collectCollectionListings({ collections }),\n    }\n  } catch (error) {\n    // The ref construction itself threw (no initialised admin app, say).\n    console.error('template screen lookup failed:', error)\n    return {\n      templateScreenIds: new Set<string>(),\n      listRoutes: {},\n      collectionListings: {},\n    }\n  }\n}\n\nexport default getTemplateScreenIds\n"],"names":["SCREEN_KIND_TEMPLATE","firebaseAdmin","PUBLISHED_SITE_DATA_TTL_SECONDS","tenantDataTag","withRenderCache","TEMPLATE_SCREEN_IDS_TTL_SECONDS","COLLECTION_TEMPLATE_SCREEN_FIELDS","STORE_TEMPLATE_SCREEN_FIELDS","HOST_TEMPLATE_SCREEN_FIELDS","collectTemplateScreenIds","sources","ids","Set","add","screenId","screen","templateScreens","docs","id","contentCollection","collections","field","get","storeSettings","host","collectCollectionListRoutes","routes","slug","listScreenId","collectCollectionListings","listings","collectionId","getTemplateScreenIds","options","getTemplateScreenRouting","templateScreenIds","cached","key","hostId","revalidate","tags","read","routing","readTemplateScreenRouting","listRoutes","collectionListings","error","console","hostRef","app","firestore","collection","doc","Promise","all","where","select","limit","catch","resolve","then"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,sBAAqB;AAC1D,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SACEC,+BAA+B,EAC/BC,aAAa,EACbC,eAAe,QACV,wCAAuC;AAE9C;;;;;CAKC,GACD,MAAMC,kCAAkCH;AAExC;;;;;;;;;CASC,GACD,OAAO,MAAMI,oCAAoC;IAC/C;IACA;IACA;CACD,CAAS;AAEV;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,+BAA+B;IAC1C;IACA;CACD,CAAS;AAEV;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,8BAA8B;IAAC;CAAiB,CAAS;AAkBtE;;;;;;;;;;;;;;;;;;;;;;CAsBC,GACD,OAAO,SAASC,yBAAyBC,OAMxC;;QAKsBA,0BACWA;IALhC,MAAMC,MAAM,IAAIC;IAChB,MAAMC,MAAM,CAACC;QACX,IAAI,OAAOA,aAAa,YAAYA,UAAUH,IAAIE,GAAG,CAACC;IACxD;IACA,KAAK,MAAMC,mBAAUL,2BAAAA,QAAQM,eAAe,qBAAvBN,yBAAyBO,IAAI,mBAAI,EAAE,CAAEJ,IAAIE,OAAOG,EAAE;IACvE,KAAK,MAAMC,+BAAqBT,uBAAAA,QAAQU,WAAW,qBAAnBV,qBAAqBO,IAAI,oBAAI,EAAE,CAAE;QAC/D,KAAK,MAAMI,SAASf,kCAAmC;YACrDO,IAAIM,kBAAkBG,GAAG,CAACD;QAC5B;IACF;IACA,IAAIX,QAAQa,aAAa,EAAE;QACzB,KAAK,MAAMF,SAASd,6BAA8B;YAChDM,IAAIH,QAAQa,aAAa,CAACD,GAAG,CAACD;QAChC;IACF;IACA,IAAIX,QAAQc,IAAI,EAAE;QAChB,KAAK,MAAMH,SAASb,4BAA6B;YAC/CK,IAAIH,QAAQc,IAAI,CAACF,GAAG,CAACD;QACvB;IACF;IACA,OAAOV;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,SAASc,4BAA4Bf,OAE3C;;QAEiCA;IADhC,MAAMgB,SAAiC,CAAC;IACxC,KAAK,MAAMP,8BAAqBT,uBAAAA,QAAQU,WAAW,qBAAnBV,qBAAqBO,IAAI,mBAAI,EAAE,CAAE;QAC/D,yEAAyE;QACzE,0DAA0D;QAC1D,IAAIE,kBAAkBG,GAAG,CAAC,YAAY,WAAW;QACjD,MAAMK,OAAOR,kBAAkBG,GAAG,CAAC;QACnC,IAAI,OAAOK,SAAS,YAAY,CAACA,MAAM;QACvC,MAAMC,eAAeT,kBAAkBG,GAAG,CAAC;QAC3C,IAAI,OAAOM,iBAAiB,YAAY,CAACA,cAAc;QACvDF,MAAM,CAACE,aAAa,GAAGD;IACzB;IACA,OAAOD;AACT;AAEA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASG,0BAA0BnB,OAEzC;;QAEiCA;IADhC,MAAMoB,WAAmC,CAAC;IAC1C,KAAK,MAAMX,8BAAqBT,uBAAAA,QAAQU,WAAW,qBAAnBV,qBAAqBO,IAAI,mBAAI,EAAE,CAAE;QAC/D,IAAIE,kBAAkBG,GAAG,CAAC,YAAY,WAAW;QACjD,MAAMS,eAAeZ,kBAAkBD,EAAE;QACzC,IAAI,OAAOa,iBAAiB,YAAY,CAACA,cAAc;QACvD,MAAMJ,OAAOR,kBAAkBG,GAAG,CAAC;QACnC,IAAI,OAAOK,SAAS,YAAY,CAACA,MAAM;QACvCG,QAAQ,CAACC,aAAa,GAAGJ;IAC3B;IACA,OAAOG;AACT;AAYA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CC,GACD,OAAO,eAAeE,qBAAqBC,OAE1C;IACC,OAAO,AAAC,CAAA,MAAMC,yBAAyBD,QAAO,EAAGE,iBAAiB;AACpE;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeD,yBAAyBD,OAE9C;IACC,IAAI;;QACF,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,MAAMG,SAAS,MAAMhC,gBAAgB;YACnCiC,KAAK;gBAAC;gBAA2BJ,QAAQK,MAAM;aAAC;YAChDC,YAAYlC;YACZmC,MAAM;gBAACrC,cAAc8B,QAAQK,MAAM;aAAE;YACrCG,MAAM;gBACJ,MAAMC,UAAU,MAAMC,0BAA0BV;gBAChD,OAAO;oBACLtB,KAAK;2BAAI+B,QAAQP,iBAAiB;qBAAC;oBACnCS,YAAYF,QAAQE,UAAU;oBAC9BC,oBAAoBH,QAAQG,kBAAkB;gBAChD;YACF;QACF;QACA,OAAO;YACL,uEAAuE;YACvE,sDAAsD;YACtDV,mBAAmB,IAAIvB,YAAIwB,0BAAAA,OAAQzB,GAAG,mBAAI,EAAE;YAC5CiC,UAAU,WAAER,0BAAAA,OAAQQ,UAAU,oBAAI,CAAC;YACnC,oEAAoE;YACpE,2CAA2C;YAC3CC,kBAAkB,WAAET,0BAAAA,OAAQS,kBAAkB,oBAAI,CAAC;QACrD;IACF,EAAE,OAAOC,OAAO;QACd,oEAAoE;QACpE,0DAA0D;QAC1DC,QAAQD,KAAK,CAAC,kCAAkCA;QAChD,OAAOH,0BAA0BV;IACnC;AACF;AAEA,eAAeU,0BAA0BV,OAExC;IACC,IAAI;QACF,MAAMe,UAAU/C,cACbgD,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACnB,QAAQK,MAAM;QAErB,MAAM,CAACtB,iBAAiBI,aAAaG,eAAeC,KAAK,GACvD,MAAM6B,QAAQC,GAAG,CAAC;YAChB,wEAAwE;YACxE,gEAAgE;YAChE,0EAA0E;YAC1E,8BAA8B;YAC9BN,QACGG,UAAU,CAAC,WACXI,KAAK,CAAC,QAAQ,MAAMvD,sBACpBwD,MAAM,GACNC,KAAK,CAAC,KACNnC,GAAG,GACHoC,KAAK,CAAC,CAACZ;gBACNC,QAAQD,KAAK,CAAC,uCAAuCA;gBACrD,OAAO;YACT;YACFE,QACGG,UAAU,CAAC,cACZ,gEAAgE;YAChE,oEAAoE;YACpE,8DAA8D;aAC7DK,MAAM,IAAIlD,mCAAmC,QAAQ,QACrDmD,KAAK,CAAC,KACNnC,GAAG,GACHoC,KAAK,CAAC,CAACZ;gBACNC,QAAQD,KAAK,CAAC,sCAAsCA;gBACpD,OAAO;YACT;YACF,iEAAiE;YACjE,qEAAqE;YACrE,wEAAwE;YACxE,oDAAoD;YACpDE,QACGG,UAAU,CAAC,YACXC,GAAG,CAAC,SACJ9B,GAAG,GACHoC,KAAK,CAAC,CAACZ;gBACNC,QAAQD,KAAK,CAAC,iCAAiCA;gBAC/C,OAAO;YACT;YACF,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,qCAAqC;YACrC,qEAAqE;YACrE,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,iDAAiD;YACjDO,QAAQM,OAAO,GACZC,IAAI,CAAC,IAAMZ,QAAQ1B,GAAG,IACtBoC,KAAK,CAAC,CAACZ;gBACNC,QAAQD,KAAK,CAAC,wCAAwCA;gBACtD,OAAO;YACT;SACH;QAEH,OAAO;YACLX,mBAAmB1B,yBAAyB;gBAC1CO;gBACAI;gBACAG;gBACAC;YACF;YACAoB,YAAYnB,4BAA4B;gBAAEL;YAAY;YACtD,kEAAkE;YAClE,uBAAuB;YACvByB,oBAAoBhB,0BAA0B;gBAAET;YAAY;QAC9D;IACF,EAAE,OAAO0B,OAAO;QACd,qEAAqE;QACrEC,QAAQD,KAAK,CAAC,kCAAkCA;QAChD,OAAO;YACLX,mBAAmB,IAAIvB;YACvBgC,YAAY,CAAC;YACbC,oBAAoB,CAAC;QACvB;IACF;AACF;AAEA,eAAeb,qBAAoB"}