@aglyn/tenant-runtime 1.0.0-beta.220 → 1.0.0-beta.222

package/README.md

@@ -36,9 +36,12 @@ single plugin owns, and runs none of what an event triggers:
 - `listHostEventListeners` and `runHostEventListeners` for diagnostics and
   direct use.
 
-Also from the root: contact capture and owner assignment for a host
-(`captureHostContact`, `assignOwnerForCapture`, `reassignContactOwner`), and
-dataset lookup (`findDatasetByName`, `resolveDatasetDoc`).
+Contact capture and owner assignment are the CRM's
+(`@aglyn/plugins-crm/server/capture-host-contact`,
+`@aglyn/plugins-crm/server/assign-contact-owner`): another plugin reports a
+person through the platform's capture contract (`plugin-contact-capture`).
+Finding a dataset by its id or name is the data plugin's
+(`@aglyn/plugins-data/server/resolve-dataset`).
 
 By subpath, the screen-composition pipeline. This is the render read-path
 shared by the tenant app's server rendering and any plugin that needs to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglyn/tenant-runtime",
-  "version": "1.0.0-beta.220",
+  "version": "1.0.0-beta.222",
   "license": "Apache-2.0",
   "homepage": "https://aglyn.com",
   "repository": {
@@ -25,8 +25,10 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@aglyn/aglyn": "1.0.0-beta.220",
-    "@aglyn/tenant-data-admin": "1.0.0-beta.220",
+    "@aglyn/aglyn": "1.0.0-beta.222",
+    "@aglyn/shared-data-types": "1.0.0-beta.222",
+    "@aglyn/shared-ui-theme": "1.0.0-beta.222",
+    "@aglyn/tenant-data-admin": "1.0.0-beta.222",
     "@swc/helpers": "0.5.23"
   },
   "peerDependencies": {

package/src/index.d.ts

@@ -14,8 +14,5 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-export * from './lib/assign-contact-owner';
-export * from './lib/capture-host-contact';
 export * from './lib/emit-host-event';
 export * from './lib/host-event-listeners';
-export * from './lib/resolve-dataset';

package/src/index.js

@@ -13,10 +13,7 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ export * from "./lib/assign-contact-owner.js";
-export * from "./lib/capture-host-contact.js";
-export * from "./lib/emit-host-event.js";
+ */ export * from "./lib/emit-host-event.js";
 export * from "./lib/host-event-listeners.js";
-export * from "./lib/resolve-dataset.js";
 
 //# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../libs/tenant/runtime/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/assign-contact-owner'\nexport * from './lib/capture-host-contact'\nexport * from './lib/emit-host-event'\nexport * from './lib/host-event-listeners'\nexport * from './lib/resolve-dataset'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,gCAA4B;AAC1C,cAAc,gCAA4B;AAC1C,cAAc,2BAAuB;AACrC,cAAc,gCAA4B;AAC1C,cAAc,2BAAuB"}
+{"version":3,"sources":["../../../../../libs/tenant/runtime/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/emit-host-event'\nexport * from './lib/host-event-listeners'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,2BAAuB;AACrC,cAAc,gCAA4B"}

package/src/lib/apply-publish-schedule.js

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */ import { _ as _extends } from "@swc/helpers/_/_extends";
-import { blockingRouteOwner, checkEntitlement, composeScreenRoutePath, SCREEN_KIND_EMAIL, SCREEN_ROOT_PATH } from "@aglyn/aglyn/server";
+import { blockingRouteOwner, checkEntitlement, composeScreenRoutePath, SCREEN_KIND_EMAIL, SCREEN_KIND_GROUP, SCREEN_ROOT_PATH, toScreenRouteNode } from "@aglyn/aglyn/server";
 // Deep import, like the Measurement Protocol sender's: `analytics-events.ts`
 // is deliberately DOM-free so both sides of the publish path can share the
 // one definition of `first_publish` (AGL-1588).
@@ -35,11 +35,12 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
  * The three refusals are all "this cannot become an address", and all three
  * are silent no-ops if left unrecorded, which is the bug this issue is about:
  *
- * - `not-a-page` — an email document (AGL-1383). It has no URL, the serve
- *   path refuses to render it, and a routing entry would make it BILLABLE
- *   against `screensPerHost` without making it reachable. `kind: 'template'`
- *   is deliberately NOT refused: a collection entry template is routed on
- *   purpose, which is how the compose pipeline picks it up (AGL-1400).
+ * - `not-a-page` — an email document (AGL-1383) or a page group (AGL-3463).
+ *   Neither has a URL, the serve path refuses to render either, and a routing
+ *   entry would make it BILLABLE against `screensPerHost` without making it
+ *   reachable. `kind: 'template'` is deliberately NOT refused: a collection
+ *   entry template is routed on purpose, which is how the compose pipeline
+ *   picks it up (AGL-1400).
  * - `no-path` — the screen or an ancestor has no slug, so there is no address
  *   to publish at.
  * - `path-taken` — another screen already holds the address. The interactive
@@ -57,16 +58,19 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
         const snapshot = await screens.doc(currentId).get();
         if (!snapshot.exists) break;
         if (currentId === screenId) {
-            if (snapshot.get('deletedAt') != null || snapshot.get('kind') === SCREEN_KIND_EMAIL) {
+            if (snapshot.get('deletedAt') != null || snapshot.get('kind') === SCREEN_KIND_EMAIL || snapshot.get('kind') === SCREEN_KIND_GROUP) {
                 return {
                     refused: 'not-a-page'
                 };
             }
         }
-        screensById[currentId] = {
+        // The kind rides along so a GROUP ancestor composes as nothing rather
+        // than as a slugless page that refuses the path (AGL-3463).
+        screensById[currentId] = toScreenRouteNode({
             slug: snapshot.get('slug'),
-            parentId: snapshot.get('parentId')
-        };
+            parentId: snapshot.get('parentId'),
+            kind: snapshot.get('kind')
+        });
         currentId = snapshot.get('parentId');
     }
     const path = composeScreenRoutePath(screenId, screensById);
@@ -137,6 +141,11 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
     // Scheduled unpublish (AGL-113, screens only): drop the routing-map entry
     // so the path 404s on the next revalidate. This render still serves the
     // current version — the map is matched before this runs.
+    //
+    // THIS screen's entry only (AGL-3463). A scheduled unpublish of a parent
+    // leaves every page nested under it serving at its own address, exactly as
+    // the console's unpublish does; a page below only goes when it is
+    // unpublished itself.
     if (schedule.action === 'unpublish') {
         if (collectionName === 'screens') {
             try {
@@ -178,6 +187,10 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
     // Screens only. A layout has no address of its own, exactly as the
     // unpublish branch above is screens-only.
     //
+    // Only THIS screen's entry is written, never a descendant's (AGL-3463): a
+    // scheduled publish of a parent neither puts the drafts beneath it live
+    // nor moves a page below that kept its own address.
+    //
     // In practice the CRON BEAT is the only caller that reaches a first publish:
     // the lazy ISR path resolves a request path through the routing map before
     // it ever loads a screen, so an unrouted screen 404s without its schedule
@@ -194,19 +207,28 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
     // The placeholder home page this publish takes `/` from, if it does
     // (AGL-3408) — its entry leaves the map in the same commit.
     let releasedPlaceholder;
+    // This IS the placeholder home page, published by its owner (AGL-3478): a
+    // schedule is somebody's deliberate act, and the platform never writes one.
+    // From here it is their home page, so the marker goes in the same commit —
+    // a starter must not unpublish it — and the publish is an activation.
+    let publishesPlaceholder = false;
     if (collectionName === 'screens') {
         try {
             var _host_get;
             const host = await hostRef.get();
             const routing = (_host_get = host.get('screens')) != null ? _host_get : {};
+            const defaultHomeScreenId = host.get('defaultHomeScreenId');
+            publishesPlaceholder = Boolean(defaultHomeScreenId) && defaultHomeScreenId === docId;
             // An existing entry is the republish case: the route is already live,
             // this only swaps which version it serves, and there is nothing to
-            // register and no activation to report.
-            if (!routing[docId]) {
+            // register and no activation to report — except on the placeholder,
+            // whose live route the platform registered rather than its owner.
+            if (!routing[docId] || publishesPlaceholder) {
                 // The same predicate the console's three publish surfaces use, so a
                 // `first_publish` breakdown means one thing across all four senders.
-                firstPublish = isFirstPublishedRoute(routing, host.get('defaultHomeScreenId'));
-                const defaultHomeScreenId = host.get('defaultHomeScreenId');
+                firstPublish = isFirstPublishedRoute(routing, defaultHomeScreenId);
+            }
+            if (!routing[docId]) {
                 const resolved = await resolveScheduledRoutePath({
                     hostRef,
                     screenId: docId,
@@ -247,18 +269,20 @@ import { FieldValue, Timestamp } from "firebase-admin/firestore";
             versionId: schedule.versionId,
             'publishSchedule.status': 'applied'
         };
-        if (routePath) {
+        if (routePath || publishesPlaceholder) {
             // ONE atomic commit, and the order matters more than the write count:
             // a status of `applied` with no routing entry is permanent (nothing
             // retries a terminal status), so the entry and the status must land
             // together or not at all. A failed commit leaves the schedule pending
             // and the next beat runs it again.
             const batch = firestore.batch();
-            batch.update(hostRef, _extends({
+            batch.update(hostRef, _extends({}, routePath ? {
                 [`screens.${docId}`]: routePath
-            }, releasedPlaceholder ? {
+            } : {}, releasedPlaceholder ? {
                 [`screens.${releasedPlaceholder}`]: FieldValue.delete(),
                 defaultHomeScreenId: FieldValue.delete()
+            } : {}, publishesPlaceholder ? {
+                defaultHomeScreenId: FieldValue.delete()
             } : {}));
             if (releasedPlaceholder) {
                 batch.set(hostRef.collection('screens').doc(releasedPlaceholder), {

package/src/lib/apply-publish-schedule.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/apply-publish-schedule.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type * as Aglyn from '@aglyn/aglyn/server'\nimport {\n  blockingRouteOwner,\n  checkEntitlement,\n  composeScreenRoutePath,\n  SCREEN_KIND_EMAIL,\n  SCREEN_ROOT_PATH,\n} from '@aglyn/aglyn/server'\n// Deep import, like the Measurement Protocol sender's: `analytics-events.ts`\n// is deliberately DOM-free so both sides of the publish path can share the\n// one definition of `first_publish` (AGL-1588).\nimport { isFirstPublishedRoute } from '@aglyn/aglyn/app-utils/analytics-events'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  sendGa4SitePublished,\n} from '@aglyn/tenant-data-admin'\nimport { FieldValue, Timestamp } from 'firebase-admin/firestore'\n\n/** Parent chains deeper than `composeScreenRoutePath` accepts are invalid. */\nconst MAX_ANCESTOR_READS = 32\n\n/**\n * Why a due publish declined to make the screen reachable. Recorded on the\n * schedule as `skipped-unroutable` — see {@link resolveScheduledRoutePath}.\n */\ntype RouteRefusal = 'not-a-page' | 'no-path' | 'path-taken'\n\n/**\n * The routing-map path a due publish should register for a screen that has\n * no entry yet, or the reason it must not get one (AGL-1589).\n *\n * Reads the screen and walks its ancestor chain (one doc per level, bounded)\n * because the composed path is `parent segments + own slug` and the executor\n * is handed only the version pointer and the schedule. Runs at most once per\n * schedule that actually comes due, and never for the common case — a screen\n * whose route is already live is answered from the host document alone.\n *\n * The three refusals are all \"this cannot become an address\", and all three\n * are silent no-ops if left unrecorded, which is the bug this issue is about:\n *\n * - `not-a-page` — an email document (AGL-1383). It has no URL, the serve\n *   path refuses to render it, and a routing entry would make it BILLABLE\n *   against `screensPerHost` without making it reachable. `kind: 'template'`\n *   is deliberately NOT refused: a collection entry template is routed on\n *   purpose, which is how the compose pipeline picks it up (AGL-1400).\n * - `no-path` — the screen or an ancestor has no slug, so there is no address\n *   to publish at.\n * - `path-taken` — another screen already holds the address. The interactive\n *   path refuses this with a message (\"Another screen is already published at\n *   …\"); registering it anyway would put two screens at one path and could\n *   take a LIVE page off the site, which is a worse bug than the one being\n *   fixed here.\n */\nasync function resolveScheduledRoutePath(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  screenId: string\n  routing: Record<string, string>\n  /** The placeholder home page, which does not block `/` (AGL-3408). */\n  defaultHomeScreenId?: string\n}): Promise<{ path: string } | { refused: RouteRefusal }> {\n  const { hostRef, screenId, routing, defaultHomeScreenId } = options\n  const screens = hostRef.collection('screens')\n  const screensById: Record<string, Aglyn.ScreenRouteNode | undefined> = {}\n\n  let currentId: string | undefined = screenId\n  for (let depth = 0; currentId && depth < MAX_ANCESTOR_READS; depth += 1) {\n    if (screensById[currentId]) break // cycle — composeScreenRoutePath refuses\n    const snapshot = await screens.doc(currentId).get()\n    if (!snapshot.exists) break\n    if (currentId === screenId) {\n      if (\n        snapshot.get('deletedAt') != null ||\n        snapshot.get('kind') === SCREEN_KIND_EMAIL\n      ) {\n        return { refused: 'not-a-page' }\n      }\n    }\n    screensById[currentId] = {\n      slug: snapshot.get('slug'),\n      parentId: snapshot.get('parentId'),\n    }\n    currentId = snapshot.get('parentId')\n  }\n\n  const path = composeScreenRoutePath(screenId, screensById)\n  if (!path) return { refused: 'no-path' }\n  const owner = blockingRouteOwner(routing, path, defaultHomeScreenId)\n  if (owner && owner !== screenId) return { refused: 'path-taken' }\n  return { path }\n}\n\n/**\n * Lazy scheduled-publishing executor (AGL-61): if the doc carries a pending\n * `publishSchedule` whose time has passed, flip the `versionId` pointer,\n * register the screen's routing entry when the route is not live yet\n * (AGL-1589), and mark the schedule applied. Runs during ISR revalidation,\n * so a schedule\n * takes effect on the first regeneration after its time (within the\n * revalidate window) — no dedicated cron needed. Returns the effective\n * versionId; fail-open on write errors (the pointer flips next revalidate).\n */\nexport async function applyDuePublishSchedule(options: {\n  hostId: Aglyn.HostUid\n  collectionName: 'screens' | 'layouts'\n  docId: string\n  parent: Pick<Aglyn.AglynScreen, 'versionId' | 'publishSchedule'>\n}): Promise<Aglyn.VersionUid | undefined> {\n  const { hostId, collectionName, docId, parent } = options\n  const schedule = parent.publishSchedule\n  const publishAtMs = (schedule?.publishAt?.seconds ?? 0) * 1000\n  if (schedule?.status !== 'pending' || publishAtMs > Date.now()) {\n    return parent.versionId\n  }\n\n  // Plan gate (AGL-471): the console gates *writing* a schedule on the\n  // scheduledPublishing entitlement, but this executor is the authority —\n  // a schedule written directly to Firestore must not auto-publish on an\n  // unentitled plan.\n  const org = (await getOrgForHost(hostId))?.org ?? {}\n  if (!checkEntitlement(org, 'scheduledPublishing')) {\n    // Record the refusal instead of leaving it pending (AGL-1185).\n    //\n    // The refusal itself is correct and unchanged. What was wrong is that it\n    // left no trace: the schedule stayed `pending` and permanently due, so the\n    // moment the org upgraded to Business the next beat — every minute since\n    // AGL-1159 — published it. Content scheduled on a plan that could not\n    // honour it, and forgotten, would surface during an upgrade, which is\n    // exactly when nobody is looking for it.\n    //\n    // Safe to write here because the dueness check above has already passed, so\n    // this can only ever mark a schedule that came due and was declined. A\n    // future-dated schedule is returned long before this point and is untouched.\n    //\n    // Terminal on purpose: upgrading does not resurrect it. A schedule whose\n    // time passed while unentitled is stale by the time the plan changes, and\n    // re-running it is the surprise this removes. Rescheduling is a deliberate\n    // act, and the console can now say why the original never ran.\n    //\n    // Fail-open like every other write here — a failure leaves it pending,\n    // which is today's behaviour, and the next beat retries.\n    try {\n      await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('hosts')\n        .doc(hostId)\n        .collection(collectionName)\n        .doc(docId)\n        .update({ 'publishSchedule.status': 'skipped-unentitled' })\n    } catch (error) {\n      console.error(error)\n    }\n    return parent.versionId\n  }\n\n  // Scheduled unpublish (AGL-113, screens only): drop the routing-map entry\n  // so the path 404s on the next revalidate. This render still serves the\n  // current version — the map is matched before this runs.\n  if (schedule.action === 'unpublish') {\n    if (collectionName === 'screens') {\n      try {\n        const firestore = firebaseAdmin.app().firestore()\n        const hostRef = firestore.collection('hosts').doc(hostId)\n        await Promise.all([\n          hostRef.update({\n            [`screens.${docId}`]: FieldValue.delete(),\n          }),\n          hostRef.collection(collectionName).doc(docId).update({\n            'publishSchedule.status': 'applied',\n            // Route no longer live — drop the published date to match the\n            // interactive unpublish path (constants/screen-publishing.ts).\n            publishedAt: FieldValue.delete(),\n          }),\n        ])\n      } catch (error) {\n        console.error(error)\n      }\n    }\n    return parent.versionId\n  }\n\n  if (!schedule.versionId) return parent.versionId\n\n  // Register the routing entry, not just the version pointer (AGL-1589).\n  //\n  // Until this, a due publish wrote `versionId` + `status: 'applied'` and\n  // nothing else — never `hosts/{hostId}.screens.{screenId}`, the map the\n  // tenant matches request paths against. A REPUBLISH was therefore correct\n  // (the entry already existed, and only the version needed swapping) and a\n  // FIRST publish silently was not: the schedule reported success, the\n  // activity log said published, and the URL kept 404ing. Scheduled\n  // publishing is a Business feature, so that was a paying customer's page.\n  //\n  // Mirrors `publishScreenRoute` (constants/screen-publishing.ts): the\n  // composed path into the host's map, `publishedAt` stamped on the screen.\n  // The stored `slug` is not rewritten — the path was composed FROM it, so\n  // there is nothing to change.\n  //\n  // Screens only. A layout has no address of its own, exactly as the\n  // unpublish branch above is screens-only.\n  //\n  // In practice the CRON BEAT is the only caller that reaches a first publish:\n  // the lazy ISR path resolves a request path through the routing map before\n  // it ever loads a screen, so an unrouted screen 404s without its schedule\n  // being read. That is the same map this now writes — which is why the bug\n  // could not heal itself on the next visit.\n  const firestore = firebaseAdmin.app().firestore()\n  const hostRef = firestore.collection('hosts').doc(hostId)\n  const docRef = hostRef.collection(collectionName).doc(docId)\n\n  let routePath: string | undefined\n  // Decided from the routing map as read below — BEFORE the batch registers\n  // this entry (AGL-1588). Left undefined outside the screens branch, where\n  // no route is going live and no `site_published` is sent at all.\n  let firstPublish: boolean | undefined\n  // The placeholder home page this publish takes `/` from, if it does\n  // (AGL-3408) — its entry leaves the map in the same commit.\n  let releasedPlaceholder: string | undefined\n  if (collectionName === 'screens') {\n    try {\n      const host = await hostRef.get()\n      const routing = (host.get('screens') ?? {}) as Record<string, string>\n      // An existing entry is the republish case: the route is already live,\n      // this only swaps which version it serves, and there is nothing to\n      // register and no activation to report.\n      if (!routing[docId]) {\n        // The same predicate the console's three publish surfaces use, so a\n        // `first_publish` breakdown means one thing across all four senders.\n        firstPublish = isFirstPublishedRoute(\n          routing,\n          host.get('defaultHomeScreenId'),\n        )\n        const defaultHomeScreenId = host.get('defaultHomeScreenId')\n        const resolved = await resolveScheduledRoutePath({\n          hostRef,\n          screenId: docId,\n          routing,\n          defaultHomeScreenId,\n        })\n        if ('refused' in resolved) {\n          // Record the refusal rather than publishing a pointer at a page\n          // nobody can reach — the AGL-1185 posture, for the same reason: an\n          // unrecorded decline is indistinguishable from success, and leaving\n          // it `pending` would re-attempt it on every beat forever. Terminal:\n          // fixing the address is a deliberate act in the console, and\n          // rescheduling is part of it.\n          try {\n            await docRef.update({\n              'publishSchedule.status': 'skipped-unroutable',\n            })\n          } catch (error) {\n            console.error(error)\n          }\n          return parent.versionId\n        }\n        routePath = resolved.path\n        if (\n          routePath === SCREEN_ROOT_PATH &&\n          defaultHomeScreenId &&\n          defaultHomeScreenId !== docId &&\n          routing[defaultHomeScreenId] === SCREEN_ROOT_PATH\n        ) {\n          releasedPlaceholder = defaultHomeScreenId\n        }\n      }\n    } catch (error) {\n      // Fail-open like every other write here: leave the schedule pending and\n      // let the next beat (or revalidate) retry. Publishing the pointer while\n      // the routing question is unanswered is the failure being fixed.\n      console.error(error)\n      return parent.versionId\n    }\n  }\n\n  try {\n    const applied = {\n      versionId: schedule.versionId,\n      'publishSchedule.status': 'applied',\n    }\n    if (routePath) {\n      // ONE atomic commit, and the order matters more than the write count:\n      // a status of `applied` with no routing entry is permanent (nothing\n      // retries a terminal status), so the entry and the status must land\n      // together or not at all. A failed commit leaves the schedule pending\n      // and the next beat runs it again.\n      const batch = firestore.batch()\n      batch.update(hostRef, {\n        [`screens.${docId}`]: routePath,\n        // The first real home page replaces the placeholder (AGL-3408), in\n        // the same commit, so `/` is never answered by two screens.\n        ...(releasedPlaceholder\n          ? {\n              [`screens.${releasedPlaceholder}`]: FieldValue.delete(),\n              defaultHomeScreenId: FieldValue.delete(),\n            }\n          : {}),\n      })\n      if (releasedPlaceholder) {\n        batch.set(\n          hostRef.collection('screens').doc(releasedPlaceholder),\n          { publishedAt: FieldValue.delete() },\n          { merge: true },\n        )\n      }\n      batch.update(docRef, { ...applied, publishedAt: Timestamp.now() })\n      await batch.commit()\n\n      // A route just went live with no browser anywhere near it, which is\n      // precisely what the client-side `site_published` in\n      // `publishScreenRoute` cannot see (AGL-1562, AGL-1589). Awaited, not\n      // floated: this render/beat is the only thing keeping the process\n      // alive. It never throws, and it returns immediately when the\n      // Measurement Protocol is not configured — the normal state on a\n      // self-hosted deployment and in development.\n      //\n      // ⚠️ NOT the state of our own tenant app any more. This comment used to\n      // say GA4_MEASUREMENT_ID / GA4_API_SECRET were unset on the\n      // aglyn-tenant Vercel project; both landed on 2026-08-17 12:15 UTC and\n      // the sender is LIVE on this path. The stale version of this note is\n      // part of what made a 2026-08-19 smoke pass conclude every server-side\n      // event was dead (AGL-2327). See docs/ANALYTICS.md.\n      await sendGa4SitePublished({ hostId, firstPublish })\n    } else {\n      await docRef.update(applied)\n    }\n  } catch (error) {\n    console.error(error)\n  }\n  // Serve the scheduled version for this render either way — the schedule\n  // is due, and the write (or its retry next revalidate) makes it durable.\n  return schedule.versionId\n}\n\nexport default applyDuePublishSchedule\n"],"names":["blockingRouteOwner","checkEntitlement","composeScreenRoutePath","SCREEN_KIND_EMAIL","SCREEN_ROOT_PATH","isFirstPublishedRoute","firebaseAdmin","getOrgForHost","sendGa4SitePublished","FieldValue","Timestamp","MAX_ANCESTOR_READS","resolveScheduledRoutePath","options","hostRef","screenId","routing","defaultHomeScreenId","screens","collection","screensById","currentId","depth","snapshot","doc","get","exists","refused","slug","parentId","path","owner","applyDuePublishSchedule","schedule","hostId","collectionName","docId","parent","publishSchedule","publishAtMs","publishAt","seconds","status","Date","now","versionId","org","app","firestore","update","error","console","action","Promise","all","delete","publishedAt","docRef","routePath","firstPublish","releasedPlaceholder","host","resolved","applied","batch","set","merge","commit"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,kBAAkB,EAClBC,gBAAgB,EAChBC,sBAAsB,EACtBC,iBAAiB,EACjBC,gBAAgB,QACX,sBAAqB;AAC5B,6EAA6E;AAC7E,2EAA2E;AAC3E,gDAAgD;AAChD,SAASC,qBAAqB,QAAQ,0CAAyC;AAC/E,SACEC,aAAa,EACbC,aAAa,EACbC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,UAAU,EAAEC,SAAS,QAAQ,2BAA0B;AAEhE,4EAA4E,GAC5E,MAAMC,qBAAqB;AAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,eAAeC,0BAA0BC,OAMxC;IACC,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,mBAAmB,EAAE,GAAGJ;IAC5D,MAAMK,UAAUJ,QAAQK,UAAU,CAAC;IACnC,MAAMC,cAAiE,CAAC;IAExE,IAAIC,YAAgCN;IACpC,IAAK,IAAIO,QAAQ,GAAGD,aAAaC,QAAQX,oBAAoBW,SAAS,EAAG;QACvE,IAAIF,WAAW,CAACC,UAAU,EAAE,OAAM,yCAAyC;QAC3E,MAAME,WAAW,MAAML,QAAQM,GAAG,CAACH,WAAWI,GAAG;QACjD,IAAI,CAACF,SAASG,MAAM,EAAE;QACtB,IAAIL,cAAcN,UAAU;YAC1B,IACEQ,SAASE,GAAG,CAAC,gBAAgB,QAC7BF,SAASE,GAAG,CAAC,YAAYtB,mBACzB;gBACA,OAAO;oBAAEwB,SAAS;gBAAa;YACjC;QACF;QACAP,WAAW,CAACC,UAAU,GAAG;YACvBO,MAAML,SAASE,GAAG,CAAC;YACnBI,UAAUN,SAASE,GAAG,CAAC;QACzB;QACAJ,YAAYE,SAASE,GAAG,CAAC;IAC3B;IAEA,MAAMK,OAAO5B,uBAAuBa,UAAUK;IAC9C,IAAI,CAACU,MAAM,OAAO;QAAEH,SAAS;IAAU;IACvC,MAAMI,QAAQ/B,mBAAmBgB,SAASc,MAAMb;IAChD,IAAIc,SAASA,UAAUhB,UAAU,OAAO;QAAEY,SAAS;IAAa;IAChE,OAAO;QAAEG;IAAK;AAChB;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeE,wBAAwBnB,OAK7C;;QAGsBoB,qBASR;IAXb,MAAM,EAAEC,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGxB;IAClD,MAAMoB,WAAWI,OAAOC,eAAe;IACvC,MAAMC,cAAc,SAACN,6BAAAA,sBAAAA,SAAUO,SAAS,qBAAnBP,oBAAqBQ,OAAO,mBAAI,KAAK;IAC1D,IAAIR,CAAAA,4BAAAA,SAAUS,MAAM,MAAK,aAAaH,cAAcI,KAAKC,GAAG,IAAI;QAC9D,OAAOP,OAAOQ,SAAS;IACzB;IAEA,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,mBAAmB;IACnB,MAAMC,gBAAO,QAAA,MAAMvC,cAAc2B,4BAArB,AAAC,MAA8BY,GAAG,oBAAI,CAAC;IACnD,IAAI,CAAC7C,iBAAiB6C,KAAK,wBAAwB;QACjD,+DAA+D;QAC/D,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,yCAAyC;QACzC,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,6EAA6E;QAC7E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,IAAI;YACF,MAAMxC,cACHyC,GAAG,GACHC,SAAS,GACT7B,UAAU,CAAC,SACXK,GAAG,CAACU,QACJf,UAAU,CAACgB,gBACXX,GAAG,CAACY,OACJa,MAAM,CAAC;gBAAE,0BAA0B;YAAqB;QAC7D,EAAE,OAAOC,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;QACA,OAAOb,OAAOQ,SAAS;IACzB;IAEA,0EAA0E;IAC1E,wEAAwE;IACxE,yDAAyD;IACzD,IAAIZ,SAASmB,MAAM,KAAK,aAAa;QACnC,IAAIjB,mBAAmB,WAAW;YAChC,IAAI;gBACF,MAAMa,YAAY1C,cAAcyC,GAAG,GAAGC,SAAS;gBAC/C,MAAMlC,UAAUkC,UAAU7B,UAAU,CAAC,SAASK,GAAG,CAACU;gBAClD,MAAMmB,QAAQC,GAAG,CAAC;oBAChBxC,QAAQmC,MAAM,CAAC;wBACb,CAAC,CAAC,QAAQ,EAAEb,OAAO,CAAC,EAAE3B,WAAW8C,MAAM;oBACzC;oBACAzC,QAAQK,UAAU,CAACgB,gBAAgBX,GAAG,CAACY,OAAOa,MAAM,CAAC;wBACnD,0BAA0B;wBAC1B,8DAA8D;wBAC9D,+DAA+D;wBAC/DO,aAAa/C,WAAW8C,MAAM;oBAChC;iBACD;YACH,EAAE,OAAOL,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;QACA,OAAOb,OAAOQ,SAAS;IACzB;IAEA,IAAI,CAACZ,SAASY,SAAS,EAAE,OAAOR,OAAOQ,SAAS;IAEhD,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,8BAA8B;IAC9B,EAAE;IACF,mEAAmE;IACnE,0CAA0C;IAC1C,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAMG,YAAY1C,cAAcyC,GAAG,GAAGC,SAAS;IAC/C,MAAMlC,UAAUkC,UAAU7B,UAAU,CAAC,SAASK,GAAG,CAACU;IAClD,MAAMuB,SAAS3C,QAAQK,UAAU,CAACgB,gBAAgBX,GAAG,CAACY;IAEtD,IAAIsB;IACJ,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAIC;IACJ,oEAAoE;IACpE,4DAA4D;IAC5D,IAAIC;IACJ,IAAIzB,mBAAmB,WAAW;QAChC,IAAI;gBAEe0B;YADjB,MAAMA,OAAO,MAAM/C,QAAQW,GAAG;YAC9B,MAAMT,WAAW6C,YAAAA,KAAKpC,GAAG,CAAC,sBAAToC,YAAuB,CAAC;YACzC,sEAAsE;YACtE,mEAAmE;YACnE,wCAAwC;YACxC,IAAI,CAAC7C,OAAO,CAACoB,MAAM,EAAE;gBACnB,oEAAoE;gBACpE,qEAAqE;gBACrEuB,eAAetD,sBACbW,SACA6C,KAAKpC,GAAG,CAAC;gBAEX,MAAMR,sBAAsB4C,KAAKpC,GAAG,CAAC;gBACrC,MAAMqC,WAAW,MAAMlD,0BAA0B;oBAC/CE;oBACAC,UAAUqB;oBACVpB;oBACAC;gBACF;gBACA,IAAI,aAAa6C,UAAU;oBACzB,gEAAgE;oBAChE,mEAAmE;oBACnE,oEAAoE;oBACpE,oEAAoE;oBACpE,6DAA6D;oBAC7D,8BAA8B;oBAC9B,IAAI;wBACF,MAAML,OAAOR,MAAM,CAAC;4BAClB,0BAA0B;wBAC5B;oBACF,EAAE,OAAOC,OAAO;wBACdC,QAAQD,KAAK,CAACA;oBAChB;oBACA,OAAOb,OAAOQ,SAAS;gBACzB;gBACAa,YAAYI,SAAShC,IAAI;gBACzB,IACE4B,cAActD,oBACda,uBACAA,wBAAwBmB,SACxBpB,OAAO,CAACC,oBAAoB,KAAKb,kBACjC;oBACAwD,sBAAsB3C;gBACxB;YACF;QACF,EAAE,OAAOiC,OAAO;YACd,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjEC,QAAQD,KAAK,CAACA;YACd,OAAOb,OAAOQ,SAAS;QACzB;IACF;IAEA,IAAI;QACF,MAAMkB,UAAU;YACdlB,WAAWZ,SAASY,SAAS;YAC7B,0BAA0B;QAC5B;QACA,IAAIa,WAAW;YACb,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,mCAAmC;YACnC,MAAMM,QAAQhB,UAAUgB,KAAK;YAC7BA,MAAMf,MAAM,CAACnC,SAAS;gBACpB,CAAC,CAAC,QAAQ,EAAEsB,OAAO,CAAC,EAAEsB;eAGlBE,sBACA;gBACE,CAAC,CAAC,QAAQ,EAAEA,qBAAqB,CAAC,EAAEnD,WAAW8C,MAAM;gBACrDtC,qBAAqBR,WAAW8C,MAAM;YACxC,IACA,CAAC;YAEP,IAAIK,qBAAqB;gBACvBI,MAAMC,GAAG,CACPnD,QAAQK,UAAU,CAAC,WAAWK,GAAG,CAACoC,sBAClC;oBAAEJ,aAAa/C,WAAW8C,MAAM;gBAAG,GACnC;oBAAEW,OAAO;gBAAK;YAElB;YACAF,MAAMf,MAAM,CAACQ,QAAQ,aAAKM;gBAASP,aAAa9C,UAAUkC,GAAG;;YAC7D,MAAMoB,MAAMG,MAAM;YAElB,oEAAoE;YACpE,qDAAqD;YACrD,qEAAqE;YACrE,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,4DAA4D;YAC5D,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM3D,qBAAqB;gBAAE0B;gBAAQyB;YAAa;QACpD,OAAO;YACL,MAAMF,OAAOR,MAAM,CAACc;QACtB;IACF,EAAE,OAAOb,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;IACA,wEAAwE;IACxE,yEAAyE;IACzE,OAAOjB,SAASY,SAAS;AAC3B;AAEA,eAAeb,wBAAuB"}
+{"version":3,"sources":["../../../../../../libs/tenant/runtime/src/lib/apply-publish-schedule.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type * as Aglyn from '@aglyn/aglyn/server'\nimport {\n  blockingRouteOwner,\n  checkEntitlement,\n  composeScreenRoutePath,\n  SCREEN_KIND_EMAIL,\n  SCREEN_KIND_GROUP,\n  SCREEN_ROOT_PATH,\n  toScreenRouteNode,\n} from '@aglyn/aglyn/server'\n// Deep import, like the Measurement Protocol sender's: `analytics-events.ts`\n// is deliberately DOM-free so both sides of the publish path can share the\n// one definition of `first_publish` (AGL-1588).\nimport { isFirstPublishedRoute } from '@aglyn/aglyn/app-utils/analytics-events'\nimport {\n  firebaseAdmin,\n  getOrgForHost,\n  sendGa4SitePublished,\n} from '@aglyn/tenant-data-admin'\nimport { FieldValue, Timestamp } from 'firebase-admin/firestore'\n\n/** Parent chains deeper than `composeScreenRoutePath` accepts are invalid. */\nconst MAX_ANCESTOR_READS = 32\n\n/**\n * Why a due publish declined to make the screen reachable. Recorded on the\n * schedule as `skipped-unroutable` — see {@link resolveScheduledRoutePath}.\n */\ntype RouteRefusal = 'not-a-page' | 'no-path' | 'path-taken'\n\n/**\n * The routing-map path a due publish should register for a screen that has\n * no entry yet, or the reason it must not get one (AGL-1589).\n *\n * Reads the screen and walks its ancestor chain (one doc per level, bounded)\n * because the composed path is `parent segments + own slug` and the executor\n * is handed only the version pointer and the schedule. Runs at most once per\n * schedule that actually comes due, and never for the common case — a screen\n * whose route is already live is answered from the host document alone.\n *\n * The three refusals are all \"this cannot become an address\", and all three\n * are silent no-ops if left unrecorded, which is the bug this issue is about:\n *\n * - `not-a-page` — an email document (AGL-1383) or a page group (AGL-3463).\n *   Neither has a URL, the serve path refuses to render either, and a routing\n *   entry would make it BILLABLE against `screensPerHost` without making it\n *   reachable. `kind: 'template'` is deliberately NOT refused: a collection\n *   entry template is routed on purpose, which is how the compose pipeline\n *   picks it up (AGL-1400).\n * - `no-path` — the screen or an ancestor has no slug, so there is no address\n *   to publish at.\n * - `path-taken` — another screen already holds the address. The interactive\n *   path refuses this with a message (\"Another screen is already published at\n *   …\"); registering it anyway would put two screens at one path and could\n *   take a LIVE page off the site, which is a worse bug than the one being\n *   fixed here.\n */\nasync function resolveScheduledRoutePath(options: {\n  hostRef: FirebaseFirestore.DocumentReference\n  screenId: string\n  routing: Record<string, string>\n  /** The placeholder home page, which does not block `/` (AGL-3408). */\n  defaultHomeScreenId?: string\n}): Promise<{ path: string } | { refused: RouteRefusal }> {\n  const { hostRef, screenId, routing, defaultHomeScreenId } = options\n  const screens = hostRef.collection('screens')\n  const screensById: Record<string, Aglyn.ScreenRouteNode | undefined> = {}\n\n  let currentId: string | undefined = screenId\n  for (let depth = 0; currentId && depth < MAX_ANCESTOR_READS; depth += 1) {\n    if (screensById[currentId]) break // cycle — composeScreenRoutePath refuses\n    const snapshot = await screens.doc(currentId).get()\n    if (!snapshot.exists) break\n    if (currentId === screenId) {\n      if (\n        snapshot.get('deletedAt') != null ||\n        snapshot.get('kind') === SCREEN_KIND_EMAIL ||\n        snapshot.get('kind') === SCREEN_KIND_GROUP\n      ) {\n        return { refused: 'not-a-page' }\n      }\n    }\n    // The kind rides along so a GROUP ancestor composes as nothing rather\n    // than as a slugless page that refuses the path (AGL-3463).\n    screensById[currentId] = toScreenRouteNode({\n      slug: snapshot.get('slug'),\n      parentId: snapshot.get('parentId'),\n      kind: snapshot.get('kind'),\n    })\n    currentId = snapshot.get('parentId')\n  }\n\n  const path = composeScreenRoutePath(screenId, screensById)\n  if (!path) return { refused: 'no-path' }\n  const owner = blockingRouteOwner(routing, path, defaultHomeScreenId)\n  if (owner && owner !== screenId) return { refused: 'path-taken' }\n  return { path }\n}\n\n/**\n * Lazy scheduled-publishing executor (AGL-61): if the doc carries a pending\n * `publishSchedule` whose time has passed, flip the `versionId` pointer,\n * register the screen's routing entry when the route is not live yet\n * (AGL-1589), and mark the schedule applied. Runs during ISR revalidation,\n * so a schedule\n * takes effect on the first regeneration after its time (within the\n * revalidate window) — no dedicated cron needed. Returns the effective\n * versionId; fail-open on write errors (the pointer flips next revalidate).\n */\nexport async function applyDuePublishSchedule(options: {\n  hostId: Aglyn.HostUid\n  collectionName: 'screens' | 'layouts'\n  docId: string\n  parent: Pick<Aglyn.AglynScreen, 'versionId' | 'publishSchedule'>\n}): Promise<Aglyn.VersionUid | undefined> {\n  const { hostId, collectionName, docId, parent } = options\n  const schedule = parent.publishSchedule\n  const publishAtMs = (schedule?.publishAt?.seconds ?? 0) * 1000\n  if (schedule?.status !== 'pending' || publishAtMs > Date.now()) {\n    return parent.versionId\n  }\n\n  // Plan gate (AGL-471): the console gates *writing* a schedule on the\n  // scheduledPublishing entitlement, but this executor is the authority —\n  // a schedule written directly to Firestore must not auto-publish on an\n  // unentitled plan.\n  const org = (await getOrgForHost(hostId))?.org ?? {}\n  if (!checkEntitlement(org, 'scheduledPublishing')) {\n    // Record the refusal instead of leaving it pending (AGL-1185).\n    //\n    // The refusal itself is correct and unchanged. What was wrong is that it\n    // left no trace: the schedule stayed `pending` and permanently due, so the\n    // moment the org upgraded to Business the next beat — every minute since\n    // AGL-1159 — published it. Content scheduled on a plan that could not\n    // honour it, and forgotten, would surface during an upgrade, which is\n    // exactly when nobody is looking for it.\n    //\n    // Safe to write here because the dueness check above has already passed, so\n    // this can only ever mark a schedule that came due and was declined. A\n    // future-dated schedule is returned long before this point and is untouched.\n    //\n    // Terminal on purpose: upgrading does not resurrect it. A schedule whose\n    // time passed while unentitled is stale by the time the plan changes, and\n    // re-running it is the surprise this removes. Rescheduling is a deliberate\n    // act, and the console can now say why the original never ran.\n    //\n    // Fail-open like every other write here — a failure leaves it pending,\n    // which is today's behaviour, and the next beat retries.\n    try {\n      await firebaseAdmin\n        .app()\n        .firestore()\n        .collection('hosts')\n        .doc(hostId)\n        .collection(collectionName)\n        .doc(docId)\n        .update({ 'publishSchedule.status': 'skipped-unentitled' })\n    } catch (error) {\n      console.error(error)\n    }\n    return parent.versionId\n  }\n\n  // Scheduled unpublish (AGL-113, screens only): drop the routing-map entry\n  // so the path 404s on the next revalidate. This render still serves the\n  // current version — the map is matched before this runs.\n  //\n  // THIS screen's entry only (AGL-3463). A scheduled unpublish of a parent\n  // leaves every page nested under it serving at its own address, exactly as\n  // the console's unpublish does; a page below only goes when it is\n  // unpublished itself.\n  if (schedule.action === 'unpublish') {\n    if (collectionName === 'screens') {\n      try {\n        const firestore = firebaseAdmin.app().firestore()\n        const hostRef = firestore.collection('hosts').doc(hostId)\n        await Promise.all([\n          hostRef.update({\n            [`screens.${docId}`]: FieldValue.delete(),\n          }),\n          hostRef.collection(collectionName).doc(docId).update({\n            'publishSchedule.status': 'applied',\n            // Route no longer live — drop the published date to match the\n            // interactive unpublish path (constants/screen-publishing.ts).\n            publishedAt: FieldValue.delete(),\n          }),\n        ])\n      } catch (error) {\n        console.error(error)\n      }\n    }\n    return parent.versionId\n  }\n\n  if (!schedule.versionId) return parent.versionId\n\n  // Register the routing entry, not just the version pointer (AGL-1589).\n  //\n  // Until this, a due publish wrote `versionId` + `status: 'applied'` and\n  // nothing else — never `hosts/{hostId}.screens.{screenId}`, the map the\n  // tenant matches request paths against. A REPUBLISH was therefore correct\n  // (the entry already existed, and only the version needed swapping) and a\n  // FIRST publish silently was not: the schedule reported success, the\n  // activity log said published, and the URL kept 404ing. Scheduled\n  // publishing is a Business feature, so that was a paying customer's page.\n  //\n  // Mirrors `publishScreenRoute` (constants/screen-publishing.ts): the\n  // composed path into the host's map, `publishedAt` stamped on the screen.\n  // The stored `slug` is not rewritten — the path was composed FROM it, so\n  // there is nothing to change.\n  //\n  // Screens only. A layout has no address of its own, exactly as the\n  // unpublish branch above is screens-only.\n  //\n  // Only THIS screen's entry is written, never a descendant's (AGL-3463): a\n  // scheduled publish of a parent neither puts the drafts beneath it live\n  // nor moves a page below that kept its own address.\n  //\n  // In practice the CRON BEAT is the only caller that reaches a first publish:\n  // the lazy ISR path resolves a request path through the routing map before\n  // it ever loads a screen, so an unrouted screen 404s without its schedule\n  // being read. That is the same map this now writes — which is why the bug\n  // could not heal itself on the next visit.\n  const firestore = firebaseAdmin.app().firestore()\n  const hostRef = firestore.collection('hosts').doc(hostId)\n  const docRef = hostRef.collection(collectionName).doc(docId)\n\n  let routePath: string | undefined\n  // Decided from the routing map as read below — BEFORE the batch registers\n  // this entry (AGL-1588). Left undefined outside the screens branch, where\n  // no route is going live and no `site_published` is sent at all.\n  let firstPublish: boolean | undefined\n  // The placeholder home page this publish takes `/` from, if it does\n  // (AGL-3408) — its entry leaves the map in the same commit.\n  let releasedPlaceholder: string | undefined\n  // This IS the placeholder home page, published by its owner (AGL-3478): a\n  // schedule is somebody's deliberate act, and the platform never writes one.\n  // From here it is their home page, so the marker goes in the same commit —\n  // a starter must not unpublish it — and the publish is an activation.\n  let publishesPlaceholder = false\n  if (collectionName === 'screens') {\n    try {\n      const host = await hostRef.get()\n      const routing = (host.get('screens') ?? {}) as Record<string, string>\n      const defaultHomeScreenId = host.get('defaultHomeScreenId')\n      publishesPlaceholder =\n        Boolean(defaultHomeScreenId) && defaultHomeScreenId === docId\n      // An existing entry is the republish case: the route is already live,\n      // this only swaps which version it serves, and there is nothing to\n      // register and no activation to report — except on the placeholder,\n      // whose live route the platform registered rather than its owner.\n      if (!routing[docId] || publishesPlaceholder) {\n        // The same predicate the console's three publish surfaces use, so a\n        // `first_publish` breakdown means one thing across all four senders.\n        firstPublish = isFirstPublishedRoute(routing, defaultHomeScreenId)\n      }\n      if (!routing[docId]) {\n        const resolved = await resolveScheduledRoutePath({\n          hostRef,\n          screenId: docId,\n          routing,\n          defaultHomeScreenId,\n        })\n        if ('refused' in resolved) {\n          // Record the refusal rather than publishing a pointer at a page\n          // nobody can reach — the AGL-1185 posture, for the same reason: an\n          // unrecorded decline is indistinguishable from success, and leaving\n          // it `pending` would re-attempt it on every beat forever. Terminal:\n          // fixing the address is a deliberate act in the console, and\n          // rescheduling is part of it.\n          try {\n            await docRef.update({\n              'publishSchedule.status': 'skipped-unroutable',\n            })\n          } catch (error) {\n            console.error(error)\n          }\n          return parent.versionId\n        }\n        routePath = resolved.path\n        if (\n          routePath === SCREEN_ROOT_PATH &&\n          defaultHomeScreenId &&\n          defaultHomeScreenId !== docId &&\n          routing[defaultHomeScreenId] === SCREEN_ROOT_PATH\n        ) {\n          releasedPlaceholder = defaultHomeScreenId\n        }\n      }\n    } catch (error) {\n      // Fail-open like every other write here: leave the schedule pending and\n      // let the next beat (or revalidate) retry. Publishing the pointer while\n      // the routing question is unanswered is the failure being fixed.\n      console.error(error)\n      return parent.versionId\n    }\n  }\n\n  try {\n    const applied = {\n      versionId: schedule.versionId,\n      'publishSchedule.status': 'applied',\n    }\n    if (routePath || publishesPlaceholder) {\n      // ONE atomic commit, and the order matters more than the write count:\n      // a status of `applied` with no routing entry is permanent (nothing\n      // retries a terminal status), so the entry and the status must land\n      // together or not at all. A failed commit leaves the schedule pending\n      // and the next beat runs it again.\n      const batch = firestore.batch()\n      batch.update(hostRef, {\n        ...(routePath ? { [`screens.${docId}`]: routePath } : {}),\n        // The first real home page replaces the placeholder (AGL-3408), in\n        // the same commit, so `/` is never answered by two screens.\n        ...(releasedPlaceholder\n          ? {\n              [`screens.${releasedPlaceholder}`]: FieldValue.delete(),\n              defaultHomeScreenId: FieldValue.delete(),\n            }\n          : {}),\n        ...(publishesPlaceholder\n          ? { defaultHomeScreenId: FieldValue.delete() }\n          : {}),\n      })\n      if (releasedPlaceholder) {\n        batch.set(\n          hostRef.collection('screens').doc(releasedPlaceholder),\n          { publishedAt: FieldValue.delete() },\n          { merge: true },\n        )\n      }\n      batch.update(docRef, { ...applied, publishedAt: Timestamp.now() })\n      await batch.commit()\n\n      // A route just went live with no browser anywhere near it, which is\n      // precisely what the client-side `site_published` in\n      // `publishScreenRoute` cannot see (AGL-1562, AGL-1589). Awaited, not\n      // floated: this render/beat is the only thing keeping the process\n      // alive. It never throws, and it returns immediately when the\n      // Measurement Protocol is not configured — the normal state on a\n      // self-hosted deployment and in development.\n      //\n      // ⚠️ NOT the state of our own tenant app any more. This comment used to\n      // say GA4_MEASUREMENT_ID / GA4_API_SECRET were unset on the\n      // aglyn-tenant Vercel project; both landed on 2026-08-17 12:15 UTC and\n      // the sender is LIVE on this path. The stale version of this note is\n      // part of what made a 2026-08-19 smoke pass conclude every server-side\n      // event was dead (AGL-2327). See docs/ANALYTICS.md.\n      await sendGa4SitePublished({ hostId, firstPublish })\n    } else {\n      await docRef.update(applied)\n    }\n  } catch (error) {\n    console.error(error)\n  }\n  // Serve the scheduled version for this render either way — the schedule\n  // is due, and the write (or its retry next revalidate) makes it durable.\n  return schedule.versionId\n}\n\nexport default applyDuePublishSchedule\n"],"names":["blockingRouteOwner","checkEntitlement","composeScreenRoutePath","SCREEN_KIND_EMAIL","SCREEN_KIND_GROUP","SCREEN_ROOT_PATH","toScreenRouteNode","isFirstPublishedRoute","firebaseAdmin","getOrgForHost","sendGa4SitePublished","FieldValue","Timestamp","MAX_ANCESTOR_READS","resolveScheduledRoutePath","options","hostRef","screenId","routing","defaultHomeScreenId","screens","collection","screensById","currentId","depth","snapshot","doc","get","exists","refused","slug","parentId","kind","path","owner","applyDuePublishSchedule","schedule","hostId","collectionName","docId","parent","publishSchedule","publishAtMs","publishAt","seconds","status","Date","now","versionId","org","app","firestore","update","error","console","action","Promise","all","delete","publishedAt","docRef","routePath","firstPublish","releasedPlaceholder","publishesPlaceholder","host","Boolean","resolved","applied","batch","set","merge","commit"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAGD,SACEA,kBAAkB,EAClBC,gBAAgB,EAChBC,sBAAsB,EACtBC,iBAAiB,EACjBC,iBAAiB,EACjBC,gBAAgB,EAChBC,iBAAiB,QACZ,sBAAqB;AAC5B,6EAA6E;AAC7E,2EAA2E;AAC3E,gDAAgD;AAChD,SAASC,qBAAqB,QAAQ,0CAAyC;AAC/E,SACEC,aAAa,EACbC,aAAa,EACbC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,UAAU,EAAEC,SAAS,QAAQ,2BAA0B;AAEhE,4EAA4E,GAC5E,MAAMC,qBAAqB;AAQ3B;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,eAAeC,0BAA0BC,OAMxC;IACC,MAAM,EAAEC,OAAO,EAAEC,QAAQ,EAAEC,OAAO,EAAEC,mBAAmB,EAAE,GAAGJ;IAC5D,MAAMK,UAAUJ,QAAQK,UAAU,CAAC;IACnC,MAAMC,cAAiE,CAAC;IAExE,IAAIC,YAAgCN;IACpC,IAAK,IAAIO,QAAQ,GAAGD,aAAaC,QAAQX,oBAAoBW,SAAS,EAAG;QACvE,IAAIF,WAAW,CAACC,UAAU,EAAE,OAAM,yCAAyC;QAC3E,MAAME,WAAW,MAAML,QAAQM,GAAG,CAACH,WAAWI,GAAG;QACjD,IAAI,CAACF,SAASG,MAAM,EAAE;QACtB,IAAIL,cAAcN,UAAU;YAC1B,IACEQ,SAASE,GAAG,CAAC,gBAAgB,QAC7BF,SAASE,GAAG,CAAC,YAAYxB,qBACzBsB,SAASE,GAAG,CAAC,YAAYvB,mBACzB;gBACA,OAAO;oBAAEyB,SAAS;gBAAa;YACjC;QACF;QACA,sEAAsE;QACtE,4DAA4D;QAC5DP,WAAW,CAACC,UAAU,GAAGjB,kBAAkB;YACzCwB,MAAML,SAASE,GAAG,CAAC;YACnBI,UAAUN,SAASE,GAAG,CAAC;YACvBK,MAAMP,SAASE,GAAG,CAAC;QACrB;QACAJ,YAAYE,SAASE,GAAG,CAAC;IAC3B;IAEA,MAAMM,OAAO/B,uBAAuBe,UAAUK;IAC9C,IAAI,CAACW,MAAM,OAAO;QAAEJ,SAAS;IAAU;IACvC,MAAMK,QAAQlC,mBAAmBkB,SAASe,MAAMd;IAChD,IAAIe,SAASA,UAAUjB,UAAU,OAAO;QAAEY,SAAS;IAAa;IAChE,OAAO;QAAEI;IAAK;AAChB;AAEA;;;;;;;;;CASC,GACD,OAAO,eAAeE,wBAAwBpB,OAK7C;;QAGsBqB,qBASR;IAXb,MAAM,EAAEC,MAAM,EAAEC,cAAc,EAAEC,KAAK,EAAEC,MAAM,EAAE,GAAGzB;IAClD,MAAMqB,WAAWI,OAAOC,eAAe;IACvC,MAAMC,cAAc,SAACN,6BAAAA,sBAAAA,SAAUO,SAAS,qBAAnBP,oBAAqBQ,OAAO,mBAAI,KAAK;IAC1D,IAAIR,CAAAA,4BAAAA,SAAUS,MAAM,MAAK,aAAaH,cAAcI,KAAKC,GAAG,IAAI;QAC9D,OAAOP,OAAOQ,SAAS;IACzB;IAEA,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,mBAAmB;IACnB,MAAMC,gBAAO,QAAA,MAAMxC,cAAc4B,4BAArB,AAAC,MAA8BY,GAAG,oBAAI,CAAC;IACnD,IAAI,CAAChD,iBAAiBgD,KAAK,wBAAwB;QACjD,+DAA+D;QAC/D,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,yCAAyC;QACzC,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,6EAA6E;QAC7E,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,EAAE;QACF,uEAAuE;QACvE,yDAAyD;QACzD,IAAI;YACF,MAAMzC,cACH0C,GAAG,GACHC,SAAS,GACT9B,UAAU,CAAC,SACXK,GAAG,CAACW,QACJhB,UAAU,CAACiB,gBACXZ,GAAG,CAACa,OACJa,MAAM,CAAC;gBAAE,0BAA0B;YAAqB;QAC7D,EAAE,OAAOC,OAAO;YACdC,QAAQD,KAAK,CAACA;QAChB;QACA,OAAOb,OAAOQ,SAAS;IACzB;IAEA,0EAA0E;IAC1E,wEAAwE;IACxE,yDAAyD;IACzD,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB;IACtB,IAAIZ,SAASmB,MAAM,KAAK,aAAa;QACnC,IAAIjB,mBAAmB,WAAW;YAChC,IAAI;gBACF,MAAMa,YAAY3C,cAAc0C,GAAG,GAAGC,SAAS;gBAC/C,MAAMnC,UAAUmC,UAAU9B,UAAU,CAAC,SAASK,GAAG,CAACW;gBAClD,MAAMmB,QAAQC,GAAG,CAAC;oBAChBzC,QAAQoC,MAAM,CAAC;wBACb,CAAC,CAAC,QAAQ,EAAEb,OAAO,CAAC,EAAE5B,WAAW+C,MAAM;oBACzC;oBACA1C,QAAQK,UAAU,CAACiB,gBAAgBZ,GAAG,CAACa,OAAOa,MAAM,CAAC;wBACnD,0BAA0B;wBAC1B,8DAA8D;wBAC9D,+DAA+D;wBAC/DO,aAAahD,WAAW+C,MAAM;oBAChC;iBACD;YACH,EAAE,OAAOL,OAAO;gBACdC,QAAQD,KAAK,CAACA;YAChB;QACF;QACA,OAAOb,OAAOQ,SAAS;IACzB;IAEA,IAAI,CAACZ,SAASY,SAAS,EAAE,OAAOR,OAAOQ,SAAS;IAEhD,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,kEAAkE;IAClE,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,8BAA8B;IAC9B,EAAE;IACF,mEAAmE;IACnE,0CAA0C;IAC1C,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,oDAAoD;IACpD,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAMG,YAAY3C,cAAc0C,GAAG,GAAGC,SAAS;IAC/C,MAAMnC,UAAUmC,UAAU9B,UAAU,CAAC,SAASK,GAAG,CAACW;IAClD,MAAMuB,SAAS5C,QAAQK,UAAU,CAACiB,gBAAgBZ,GAAG,CAACa;IAEtD,IAAIsB;IACJ,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,IAAIC;IACJ,oEAAoE;IACpE,4DAA4D;IAC5D,IAAIC;IACJ,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,IAAIC,uBAAuB;IAC3B,IAAI1B,mBAAmB,WAAW;QAChC,IAAI;gBAEe2B;YADjB,MAAMA,OAAO,MAAMjD,QAAQW,GAAG;YAC9B,MAAMT,WAAW+C,YAAAA,KAAKtC,GAAG,CAAC,sBAATsC,YAAuB,CAAC;YACzC,MAAM9C,sBAAsB8C,KAAKtC,GAAG,CAAC;YACrCqC,uBACEE,QAAQ/C,wBAAwBA,wBAAwBoB;YAC1D,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,IAAI,CAACrB,OAAO,CAACqB,MAAM,IAAIyB,sBAAsB;gBAC3C,oEAAoE;gBACpE,qEAAqE;gBACrEF,eAAevD,sBAAsBW,SAASC;YAChD;YACA,IAAI,CAACD,OAAO,CAACqB,MAAM,EAAE;gBACnB,MAAM4B,WAAW,MAAMrD,0BAA0B;oBAC/CE;oBACAC,UAAUsB;oBACVrB;oBACAC;gBACF;gBACA,IAAI,aAAagD,UAAU;oBACzB,gEAAgE;oBAChE,mEAAmE;oBACnE,oEAAoE;oBACpE,oEAAoE;oBACpE,6DAA6D;oBAC7D,8BAA8B;oBAC9B,IAAI;wBACF,MAAMP,OAAOR,MAAM,CAAC;4BAClB,0BAA0B;wBAC5B;oBACF,EAAE,OAAOC,OAAO;wBACdC,QAAQD,KAAK,CAACA;oBAChB;oBACA,OAAOb,OAAOQ,SAAS;gBACzB;gBACAa,YAAYM,SAASlC,IAAI;gBACzB,IACE4B,cAAcxD,oBACdc,uBACAA,wBAAwBoB,SACxBrB,OAAO,CAACC,oBAAoB,KAAKd,kBACjC;oBACA0D,sBAAsB5C;gBACxB;YACF;QACF,EAAE,OAAOkC,OAAO;YACd,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjEC,QAAQD,KAAK,CAACA;YACd,OAAOb,OAAOQ,SAAS;QACzB;IACF;IAEA,IAAI;QACF,MAAMoB,UAAU;YACdpB,WAAWZ,SAASY,SAAS;YAC7B,0BAA0B;QAC5B;QACA,IAAIa,aAAaG,sBAAsB;YACrC,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,mCAAmC;YACnC,MAAMK,QAAQlB,UAAUkB,KAAK;YAC7BA,MAAMjB,MAAM,CAACpC,SAAS,aAChB6C,YAAY;gBAAE,CAAC,CAAC,QAAQ,EAAEtB,OAAO,CAAC,EAAEsB;YAAU,IAAI,CAAC,GAGnDE,sBACA;gBACE,CAAC,CAAC,QAAQ,EAAEA,qBAAqB,CAAC,EAAEpD,WAAW+C,MAAM;gBACrDvC,qBAAqBR,WAAW+C,MAAM;YACxC,IACA,CAAC,GACDM,uBACA;gBAAE7C,qBAAqBR,WAAW+C,MAAM;YAAG,IAC3C,CAAC;YAEP,IAAIK,qBAAqB;gBACvBM,MAAMC,GAAG,CACPtD,QAAQK,UAAU,CAAC,WAAWK,GAAG,CAACqC,sBAClC;oBAAEJ,aAAahD,WAAW+C,MAAM;gBAAG,GACnC;oBAAEa,OAAO;gBAAK;YAElB;YACAF,MAAMjB,MAAM,CAACQ,QAAQ,aAAKQ;gBAAST,aAAa/C,UAAUmC,GAAG;;YAC7D,MAAMsB,MAAMG,MAAM;YAElB,oEAAoE;YACpE,qDAAqD;YACrD,qEAAqE;YACrE,kEAAkE;YAClE,8DAA8D;YAC9D,iEAAiE;YACjE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,4DAA4D;YAC5D,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,oDAAoD;YACpD,MAAM9D,qBAAqB;gBAAE2B;gBAAQyB;YAAa;QACpD,OAAO;YACL,MAAMF,OAAOR,MAAM,CAACgB;QACtB;IACF,EAAE,OAAOf,OAAO;QACdC,QAAQD,KAAK,CAACA;IAChB;IACA,wEAAwE;IACxE,yEAAyE;IACzE,OAAOjB,SAASY,SAAS;AAC3B;AAEA,eAAeb,wBAAuB"}

package/src/lib/compose-screen-nodes.d.ts

@@ -127,6 +127,13 @@ export declare function composeNodesWithChrome(options: {
     screenNodes: Record<string, any> | Promise<Record<string, any>>;
     /** Entry-template tokens (AGL-105) substituted before denormalize. */
     tokens?: Record<string, string>;
+    /**
+     * The one record this page renders (AGL-3475) — a record template's routed
+     * record. Its `{{item.*}}` tokens are put into the page after the repeats
+     * expand, and into each repeat's filter before, exactly as a repeat puts
+     * its rows into its copies.
+     */
+    record?: Aglyn.PageRecordScope | null;
     /** Routed content collection (AGL-551) for Collection entries blocks. */
     collection?: ComposeCollectionContext;
     /**
@@ -184,6 +191,8 @@ export declare function composeScreenNodes(options: {
     screen: Aglyn.AglynScreen;
     /** Entry-template tokens (AGL-105) substituted before denormalize. */
     tokens?: Record<string, string>;
+    /** The one record a record template renders (AGL-3475). */
+    record?: Aglyn.PageRecordScope | null;
     /** Routed content collection (AGL-551) for Collection entries blocks. */
     collection?: ComposeCollectionContext;
     /**

package/src/lib/compose-screen-nodes.js

@@ -416,21 +416,27 @@ export async function composeNodesWithChrome(options) {
     // asked is the composed one — after grafting — because that is the map the
     // expansion reads: a repeatable living in a layout or a reusable component
     // is invisible in `screenNodes`, and reading only the screen's keys would
-    // silently render one template row where the author put a list. The
+    // silently render an empty list where the author put rows. The
     // screen's own keys were issued beside the chrome reads above; a key only a
     // layout or a component adds is read here, for that key alone.
     //
     // The rows come from the plugin that keeps them, through the repeat-rows
     // contract; this composition names no collection. A declared source whose
     // reader is missing THROWS rather than answering "no rows", so a broken boot
-    // keeps the last good render instead of replacing every list with one row.
+    // keeps the last good render instead of emptying every list. A repeat its
+    // rows answer nothing for renders zero copies, never its raw template
+    // (AGL-3496).
     const composedRepeatKeys = Aglyn.repeatKeys(grafted);
     const unreadRepeatKeys = composedRepeatKeys.filter((key)=>!screenRepeatKeys.includes(key));
     const repeatRows = unreadRepeatKeys.length ? _extends({}, screenRepeatRows, await readRepeatRows({
         hostId,
         keys: unreadRepeatKeys
     })) : screenRepeatRows;
-    const repeated = Aglyn.expandRepeatables(grafted, repeatRows);
+    // A record template's routed record (AGL-3475): its values reach each
+    // repeat's filter before the expansion, and every token the expansion left
+    // — the page's own `{{item.*}}`, never a copy's — right after it.
+    const filtered = Aglyn.substituteRepeatFilterRecordTokens(grafted, options.record);
+    const repeated = Aglyn.substituteNodesRecordTokens(Aglyn.expandRepeatables(filtered, repeatRows), options.record);
     // Collection entries blocks (AGL-551) expand alongside repeatables:
     // per-entry {{entry.*}} tokens substitute inside the clones here, while
     // page-level tokens wait for resolveNamedTokens below.
@@ -649,7 +655,10 @@ export async function composeNodesWithChrome(options) {
             var _res_version;
             return (_ref = (_res_version = res.version) == null ? void 0 : _res_version.nodes) != null ? _ref : {};
         }, ()=>({})),
-        tokens: options.tokens,
+        tokens: options.tokens
+    }, options.record ? {
+        record: options.record
+    } : {}, {
         collection: options.collection,
         host: options.host,
         socialImages: options.socialImages