@phis/ui 0.1.0 → 0.2.0

package/runtime-data-provider-client.d.ts

@@ -14,7 +14,7 @@ export { createPhiStaticTableProviderRegistration } from "./components/widgets/c
 export type { PhiStaticTableResource } from "./components/widgets/client/shared/phi-static-table-provider";
 export { createPhiCollectionProviderClient, PhiCollectionProviderClient, usePhiCollectionProvider, usePhiCollectionProviderAction, } from "./components/widgets/client/shared/phi-collection-provider";
 export type { PhiCollectionProviderRegistration, } from "./components/widgets/client/shared/phi-collection-provider";
-export { PhiCardCollectionViewBinding, } from "./components/widgets/client/shared/phi-card-collection-view-binding";
+export { PhiCardCollectionViewBinding, } from "./plugins/runtime-modules/core/widgets/card/collection-view-binding";
 export { createPhiRuntimeModuleDataProviderClientManifest, extendPhiRuntimeModuleDataProviderClientManifest, PhiRuntimeModuleDataProviderClientManifestProvider, } from "./components/runtime/runtime-module-data-provider-client-manifest";
 export type { PhiRuntimeModuleDataProviderClientManifest, } from "./components/runtime/runtime-module-data-provider-client-manifest";
 export type { PhiRuntimeModuleDataProviderClientProps, PhiRuntimeModuleDataProviderClientDefinition, PhiRuntimeModuleDataProviderDescriptor, } from "./types/cms-plugins";

package/runtime-data-provider-client.js

@@ -15,5 +15,5 @@ export { createPhiCollectionProviderClient, PhiCollectionProviderClient, usePhiC
  * it registers, and an Add-on with rows to show should be able to reach for this one rather than draw a
  * collection of its own.
  */
-export { PhiCardCollectionViewBinding, } from "./components/widgets/client/shared/phi-card-collection-view-binding";
+export { PhiCardCollectionViewBinding, } from "./plugins/runtime-modules/core/widgets/card/collection-view-binding";
 export { createPhiRuntimeModuleDataProviderClientManifest, extendPhiRuntimeModuleDataProviderClientManifest, PhiRuntimeModuleDataProviderClientManifestProvider, } from "./components/runtime/runtime-module-data-provider-client-manifest";

package/runtime-render-client.d.ts

@@ -1,2 +1,3 @@
 export { PhiRuntimeModuleRenderClientHost, PhiRuntimeModuleRenderClientManifestProvider, createPhiRuntimeModuleRenderClientManifest, definePhiRuntimeModuleRenderClient, extendPhiRuntimeModuleRenderClientManifest, } from "./components/runtime/runtime-module-render-client-manifest";
 export type { PhiRuntimeModuleRenderClient, PhiRuntimeModuleRenderClientManifest, PhiRuntimeModuleRenderClientProps, } from "./components/runtime/runtime-module-render-client-manifest";
+export { usePhiIntlLocale } from "./components/root/phi-intl-locale";

package/runtime-render-client.js

@@ -1 +1,2 @@
 export { PhiRuntimeModuleRenderClientHost, PhiRuntimeModuleRenderClientManifestProvider, createPhiRuntimeModuleRenderClientManifest, definePhiRuntimeModuleRenderClient, extendPhiRuntimeModuleRenderClientManifest, } from "./components/runtime/runtime-module-render-client-manifest";
+export { usePhiIntlLocale } from "./components/root/phi-intl-locale";

package/runtime-user-state-client.d.ts

@@ -0,0 +1,2 @@
+export { PhiUserStateError, clearPhiUserState, fetchPhiUserState, writePhiUserState, } from "./components/runtime/user-state-client";
+export type { PhiUserStateWriteError } from "./components/runtime/user-state-client";

package/runtime-user-state-client.js

@@ -0,0 +1,2 @@
+"use client";
+export { PhiUserStateError, clearPhiUserState, fetchPhiUserState, writePhiUserState, } from "./components/runtime/user-state-client";

package/server-helpers/area-root-door-warmup.d.ts

@@ -0,0 +1,35 @@
+import "server-only";
+import type { PhiCmsAreaKey } from "../constants/cms-areas";
+import type { PhiBlockRuntime } from "../types";
+import type { PhiCmsCompiledDescriptorCatalog, PhiRuntimeModuleId } from "../types/cms-module-descriptors";
+/**
+ * Where this Area's root leads, worked out without waiting for somebody to ask for it.
+ *
+ * The proxy answers an Area root with a real HTTP 307 once a door is known
+ * ([area-root-door.ts](../gateway/area-root-door.ts)), and that is the difference between one navigation
+ * across an Area boundary and dozens. Without this, a door became known only when the root was actually
+ * rendered -- which is the one address nobody visits, because every link into an Area goes to a Page.
+ *
+ * So the work happens during *any* request in the Area, where everything it needs is already in hand: the
+ * Area preset, the Module selection and the descriptor catalog. The result is only ever the same answer
+ * the root's own render would give, which is why the decision below is the *same function* that render
+ * calls rather than a second reading of the same configuration.
+ *
+ * **What this does not reach**, and it is worth knowing before trying again: the first request into an
+ * Area cannot be helped by it. That request *is* the one that would warm the door, and this runs inside
+ * its own Layout, after the proxy has already let it through. Warming an Area from outside would mean one
+ * render reaching another Area's descriptor catalog, which is the boundary
+ * ([NEXT_INTEGRATION.md](../NEXT_INTEGRATION.md)) this whole mechanism exists to respect. Measured: after
+ * any visit to any Page of an Area, a cross-Area `Link` into it costs one navigation; with nobody having
+ * been in it, 42. TODOS.md carries the two candidates that would close the rest.
+ *
+ * Public is left out. Its root is a locale segment and a landing Page rather than a forward, and the
+ * proxy's Area-root branch never sees it.
+ */
+export declare function warmPhiAreaRootDoor({ area, config, runtime, catalog, activeModuleIds, }: {
+    area: PhiCmsAreaKey;
+    config: Record<string, unknown> | null | undefined;
+    runtime: PhiBlockRuntime;
+    catalog: PhiCmsCompiledDescriptorCatalog;
+    activeModuleIds: ReadonlySet<PhiRuntimeModuleId>;
+}): Promise<void>;

package/server-helpers/area-root-door-warmup.js

@@ -0,0 +1,71 @@
+import "server-only";
+import { peekPhiAreaRootDoor, rememberPhiAreaRootDoor } from "../gateway/area-root-door";
+import { findFirstPhiCmsNavigationLinkPath } from "../components/regions/presets/navigation-redirect";
+import { resolvePhiCmsActiveNavigationSurfaces } from "../plugins/runtime-modules/descriptor-compiler";
+import { resolvePhiAreaRootRouteNavKey } from "../plugins/runtime-modules/area-root-route";
+import { resolvePhiAreaRootRouteDecision } from "./area-root-route";
+import { localizeAreaPath } from "../helpers/locale";
+/**
+ * Where this Area's root leads, worked out without waiting for somebody to ask for it.
+ *
+ * The proxy answers an Area root with a real HTTP 307 once a door is known
+ * ([area-root-door.ts](../gateway/area-root-door.ts)), and that is the difference between one navigation
+ * across an Area boundary and dozens. Without this, a door became known only when the root was actually
+ * rendered -- which is the one address nobody visits, because every link into an Area goes to a Page.
+ *
+ * So the work happens during *any* request in the Area, where everything it needs is already in hand: the
+ * Area preset, the Module selection and the descriptor catalog. The result is only ever the same answer
+ * the root's own render would give, which is why the decision below is the *same function* that render
+ * calls rather than a second reading of the same configuration.
+ *
+ * **What this does not reach**, and it is worth knowing before trying again: the first request into an
+ * Area cannot be helped by it. That request *is* the one that would warm the door, and this runs inside
+ * its own Layout, after the proxy has already let it through. Warming an Area from outside would mean one
+ * render reaching another Area's descriptor catalog, which is the boundary
+ * ([NEXT_INTEGRATION.md](../NEXT_INTEGRATION.md)) this whole mechanism exists to respect. Measured: after
+ * any visit to any Page of an Area, a cross-Area `Link` into it costs one navigation; with nobody having
+ * been in it, 42. TODOS.md carries the two candidates that would close the rest.
+ *
+ * Public is left out. Its root is a locale segment and a landing Page rather than a forward, and the
+ * proxy's Area-root branch never sees it.
+ */
+export async function warmPhiAreaRootDoor({ area, config, runtime, catalog, activeModuleIds, }) {
+    if (area === "public") {
+        return;
+    }
+    if (await peekPhiAreaRootDoor(area)) {
+        return;
+    }
+    /*
+     * `requestedStoragePath` is `/` because the question is about the root, whatever this request asked
+     * for. A `page` decision means the Builder chose a landing Page, so there is no door at all and
+     * nothing to remember: the proxy stays cold for this Area and the render answers, which is correct
+     * because the render does not forward either.
+     */
+    const decision = await resolvePhiAreaRootRouteDecision({
+        config,
+        requestedStoragePath: "/",
+        runtime,
+        area,
+        catalog,
+        activeModuleIds,
+    });
+    if (decision?.kind === "page") {
+        return;
+    }
+    /*
+     * `null` is the untouched case, where the code-owned preset answers by forwarding to the first entry of
+     * the Area's own Navigation -- the same walk `buildPhiAreaRootRedirectTree` makes, over the same
+     * unfiltered surface, skipping the root's own path so a sidebar still pointing at `/` cannot send the
+     * door back to itself.
+     */
+    const areaLocalPath = decision?.kind === "forward"
+        ? decision.path
+        : findFirstPhiCmsNavigationLinkPath(resolvePhiCmsActiveNavigationSurfaces({ catalog, area, activeModuleIds })
+            .find((surface) => surface.navKey === resolvePhiAreaRootRouteNavKey(area))
+            ?.items ?? [], "/");
+    if (!areaLocalPath) {
+        return;
+    }
+    rememberPhiAreaRootDoor(area, localizeAreaPath(runtime.locale.current, area, areaLocalPath));
+}

package/server-helpers/area-root-route.js

@@ -22,7 +22,6 @@ export async function resolvePhiAreaPageReferencePath({ runtime, reference, area
             area,
             catalog,
             activeModuleIds,
-            viewer: runtime.viewer,
         });
     }
     const projection = await resolveSiteInternalReferences({

package/server-helpers/auth-ui-provider.d.ts

@@ -0,0 +1,2 @@
+import type { PhiBlockRuntime, PhiCmsAreaKey, PhiRuntimeModuleCatalog, PhiRuntimeModuleId } from "../types";
+export declare function resolvePhiAuthUiRuntimeProjection(catalog: PhiRuntimeModuleCatalog, activeModuleIds: ReadonlySet<PhiRuntimeModuleId>, area: PhiCmsAreaKey): PhiBlockRuntime["authUiProvider"];

package/server-helpers/auth-ui-provider.js

@@ -0,0 +1,28 @@
+import { createPhiControllerSignalAddress, createPhiSignalAddress } from "../types/signals";
+export function resolvePhiAuthUiRuntimeProjection(catalog, activeModuleIds, area) {
+    const providers = [...activeModuleIds].flatMap((moduleId) => {
+        const definition = catalog.get(moduleId)?.definition;
+        const provider = definition?.authUiProvider;
+        const controller = definition?.controller;
+        if (!provider || !controller) {
+            return [];
+        }
+        const capabilities = provider.capabilitiesByArea[area];
+        return capabilities?.length ? [{ moduleId, provider, controller, capabilities }] : [];
+    });
+    if (providers.length > 1) {
+        throw new Error(`Area resolves more than one Auth UI provider: ${providers.map(({ moduleId }) => moduleId).join(", ")}.`);
+    }
+    const resolved = providers[0];
+    if (!resolved) {
+        return null;
+    }
+    const loginOverlayId = resolved.provider.loginOverlayByArea?.[area];
+    return {
+        loginOverlayAddress: loginOverlayId == null ? null : createPhiSignalAddress("cms", loginOverlayId),
+        moduleId: resolved.moduleId,
+        providerKey: resolved.provider.providerKey,
+        capabilities: resolved.capabilities,
+        controllerAddress: createPhiControllerSignalAddress(resolved.controller.pluginKey, resolved.controller.key, "default"),
+    };
+}

package/server-helpers/cms-link-targets.d.ts

@@ -0,0 +1,16 @@
+import "server-only";
+import type { PhiBlockRuntime } from "../types";
+import type { PhiResolvedLinkTargets } from "../types/references";
+import type { PhiResolvedCmsRenderableTree } from "../types/cms";
+/**
+ * Every Page this render's Widgets link to, resolved in one go before anything draws.
+ *
+ * The pass sits beside the feature pass for the same reason that one does: the tree is already in hand
+ * here, and what a render needs from outside itself is cheaper to ask for once than to discover Widget
+ * by Widget. `REFERENCES.md` requires exactly that -- resolvers batch per render -- and the alternative
+ * is what a Card grid would otherwise do: twelve Cards, twelve round trips to the same endpoint, for
+ * twelve answers that could have been one.
+ *
+ * A page that links to nothing gets `null` and costs nothing, which is most pages.
+ */
+export declare function resolvePhiCmsTreeLinkTargets(tree: Pick<PhiResolvedCmsRenderableTree, "layoutNodes" | "contentWidgets" | "overlays">, runtime: Pick<PhiBlockRuntime, "site" | "locale" | "area" | "viewer">): Promise<PhiResolvedLinkTargets | null>;

package/server-helpers/cms-link-targets.js

@@ -0,0 +1,48 @@
+import "server-only";
+import { collectPhiLinkTargetReferences, } from "../helpers/link-target";
+import { resolvePhiWidgetInternalReferences } from "../components/widgets/helpers/internal-reference-resolver.server";
+/**
+ * Every Page this render's Widgets link to, resolved in one go before anything draws.
+ *
+ * The pass sits beside the feature pass for the same reason that one does: the tree is already in hand
+ * here, and what a render needs from outside itself is cheaper to ask for once than to discover Widget
+ * by Widget. `REFERENCES.md` requires exactly that -- resolvers batch per render -- and the alternative
+ * is what a Card grid would otherwise do: twelve Cards, twelve round trips to the same endpoint, for
+ * twelve answers that could have been one.
+ *
+ * A page that links to nothing gets `null` and costs nothing, which is most pages.
+ */
+export async function resolvePhiCmsTreeLinkTargets(tree, runtime) {
+    const references = new Map();
+    for (const node of [...tree.overlays, ...tree.layoutNodes, ...tree.contentWidgets]) {
+        collectPhiLinkTargetReferences(node.config, references);
+    }
+    if (references.size === 0) {
+        return null;
+    }
+    /*
+     * Grouped by the Area each target named, because the resolver answers per Area: it reads the Page
+     * Scopes of one Area and asks that Area's route table about Module Pages. Nearly every page groups
+     * into one bucket -- a link that names no Area is asking in this one -- so the ordinary render still
+     * costs a single round trip, and a page that reaches into another Area costs one more.
+     */
+    const byArea = new Map();
+    for (const entry of references.values()) {
+        const area = entry.area ?? runtime.area;
+        byArea.set(area, [...(byArea.get(area) ?? []), entry.reference]);
+    }
+    try {
+        const resolved = await Promise.all([...byArea].map(([area, pageReferences]) => resolvePhiWidgetInternalReferences({ runtime, area, pageReferences, assetIds: [] })));
+        return new Map(resolved.flatMap((entry) => [...entry.pagePaths]));
+    }
+    catch (error) {
+        /*
+         * A resolver that could not be reached leaves every target unresolved, which draws every link as
+         * plain text. That is the contract's answer for one reference that does not resolve, and it is the
+         * right answer for all of them at once: a page that cannot say where its links lead should say
+         * nothing, not send readers to addresses it guessed.
+         */
+        console.error("Failed to resolve the Page targets for this render.", error);
+        return null;
+    }
+}

package/server-helpers/cms-request.d.ts

@@ -1,10 +1,9 @@
 import "server-only";
 import { type PhiCmsAreaKey } from "../constants/cms-areas";
 import type { PhiResolvedCmsAreaPresetPayload, PhiResolvedCmsPagePayload } from "../types/cms";
-import type { PhiBlockRuntime } from "../types";
 import type { PhiResolvedCmsRequest, PhiRuntimeModuleCatalog, PhiRuntimeModuleId } from "../types/cms-plugins";
 import type { PhiCapabilitySnapshot } from "../types/server-capabilities";
-import { type PhiSiteRequestContext } from "./runtime";
+import type { PhiSiteRequestContext } from "../types/site-request-context";
 type LoadPhiResolvedCmsPage = (path: string, sourcePreset?: {
     ownerModuleId: PhiRuntimeModuleId;
     presetKey: string;
@@ -32,10 +31,17 @@ export type ResolvePhiCmsRequestArgs = {
      * path would resolve to -- the same routing, access and root-route decisions -- without touching
      * request state and without asset work, and returns once the Page is decided. Anything rendered
      * from a lookup result would draw unprojected Backgrounds; a lookup is for reading the Page node.
+     *
+     * `"refusal"` resolves a `not-found`, `unauthorized` or `forbidden` tree, which Next renders beside
+     * the Page of every matched route whether it is shown or not. It draws like a render, but it binds
+     * the request-scoped state only when nothing else has: the refusal is not the address that was
+     * asked for, and its `/error/...` path resolves no Area preset, so claiming the request would hand
+     * the Shell the default Module selection instead of the Site's own. A refusal raised above every
+     * Area layout has no Page beside it, and there it does claim.
      */
-    purpose?: "render" | "lookup";
+    purpose?: "render" | "lookup" | "refusal";
 };
-export declare function resolveActivePresetModuleKeys(runtimeModuleCatalog: PhiRuntimeModuleCatalog, area: PhiCmsAreaKey, areaPreset: Pick<PhiResolvedCmsAreaPresetPayload, "preset"> | null, serverCapabilities: PhiCapabilitySnapshot | null, viewer?: PhiBlockRuntime["viewer"]): Set<`${string}/${string}`>;
+export declare function resolveActivePresetModuleKeys(runtimeModuleCatalog: PhiRuntimeModuleCatalog, area: PhiCmsAreaKey, areaPreset: Pick<PhiResolvedCmsAreaPresetPayload, "preset"> | null, serverCapabilities: PhiCapabilitySnapshot | null): Set<`${string}/${string}`>;
 export declare function resolvePhiCmsRequest({ siteKey, locale, area, path, cookieHeader, apiBaseUrl, internalToken, requestContext, searchParams, loadResolvedCmsPage, loadExactCmsArea, runtimeModuleCatalog, purpose, }: ResolvePhiCmsRequestArgs): Promise<PhiResolvedCmsRequest | null>;
-export declare const loadPhiResolvedCmsRequest: (siteKey: string, locale: string, area: PhiCmsAreaKey, path: string, cookieHeader: string, apiBaseUrl: string | undefined, internalToken: string | undefined, requestContext: PhiSiteRequestContext | undefined, searchParams: Record<string, string | undefined> | undefined, runtimeModuleCatalog: PhiRuntimeModuleCatalog) => Promise<PhiResolvedCmsRequest | null>;
+export declare const loadPhiResolvedCmsRequest: (siteKey: string, locale: string, area: PhiCmsAreaKey, path: string, cookieHeader: string, apiBaseUrl: string | undefined, internalToken: string | undefined, requestContext: PhiSiteRequestContext | undefined, searchParams: Record<string, string | undefined> | undefined, runtimeModuleCatalog: PhiRuntimeModuleCatalog, purpose?: ResolvePhiCmsRequestArgs["purpose"]) => Promise<PhiResolvedCmsRequest | null>;
 export {};

package/server-helpers/cms-request.js

@@ -8,7 +8,7 @@ import { resolvePhiCmsRoutePage } from "../plugins/runtime-modules/route-page-re
 import { PhiCmsFlags } from "../constants/phi-cms";
 import { hasPhiFlag } from "../helpers/flags";
 import { resolvePhiRuntimeModuleServerBinding } from "../plugins/runtime-modules/server-capabilities";
-import { resolvePhiAuthUiRuntimeProjection } from "../plugins/runtime-modules/auth/ui-provider";
+import { resolvePhiAuthUiRuntimeProjection } from "./auth-ui-provider";
 import { applyPhiBackgroundAssetProjection, resolvePhiBackgroundAssetProjection, } from "../components/widgets/helpers/background-reference-resolver.server";
 import { getPhiCmsPage, getPhiExactSiteArea } from "./cms";
 import { buildPhiLocalCmsAreaPayload } from "./cms-area";
@@ -16,7 +16,7 @@ import { resolvePhiAreaPageReferencePath, resolvePhiAreaRootRouteDecision } from
 import { fetchSiteNavigationFolderTarget } from "../gateway/site-nav";
 import { applyPhiAreaRootRouteDecision, buildPhiFolderAddressRedirectPage } from "../helpers/cms-area-root-route";
 import { resolvePhiCmsReviewParams, resolvePhiCmsRevisionFromSearchParams, resolvePhiCmsThemeReviewRequestContext, } from "./cms-review";
-import { setPhiRequestNavigationContext, setPhiRequestRuntime, } from "./request-runtime";
+import { maybeGetPhiRequestRuntime, setPhiRequestNavigationContext, setPhiRequestRuntime, } from "./request-runtime";
 import { buildPhiBlockRuntime, loadPhiSiteRequestContext, } from "./runtime";
 import { trForLocale } from "./translate";
 import { readPhiAreaLandingSelection, readPhiAreaPresetRuntimeModuleIds, readPhiAreaPublicRoutePaths, } from "../helpers/cms-area-config";
@@ -56,7 +56,7 @@ function resolveAreaOwnedStoragePath(path, areaMask) {
     }
     return null;
 }
-export function resolveActivePresetModuleKeys(runtimeModuleCatalog, area, areaPreset, serverCapabilities, viewer) {
+export function resolveActivePresetModuleKeys(runtimeModuleCatalog, area, areaPreset, serverCapabilities) {
     const platformModuleId = runtimeModuleCatalog.platformModuleId;
     if (!platformModuleId) {
         throw new Error("Runtime module catalog has no Platform contribution.");
@@ -72,9 +72,8 @@ export function resolveActivePresetModuleKeys(runtimeModuleCatalog, area, areaPr
     for (const moduleKey of resolvePhiRuntimeModuleIdsForArea(area, configuredModuleKeys, [...runtimeModuleCatalog.values()].map((entry) => entry.definition))) {
         const definition = runtimeModuleCatalog.get(moduleKey)?.definition;
         if (definition) {
-            if (viewer && !canPhiViewerAccess(viewer, definition.accessPolicy)) {
-                continue;
-            }
+            // A Module is on for an Area or it is not. It is never switched off for one reader (ACCESS.md):
+            // what its Widgets show may differ per person, that it is loaded may not.
             const bindingResolution = resolvePhiRuntimeModuleServerBinding(definition.serverBinding, serverCapabilities);
             if (!bindingResolution.available) {
                 console.warn("[phi-runtime-modules] Server capability requirement unavailable.", {
@@ -120,6 +119,16 @@ function buildPhiRuntimePage(pagePayload) {
 }
 export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookieHeader, apiBaseUrl, internalToken, requestContext, searchParams, loadResolvedCmsPage, loadExactCmsArea, runtimeModuleCatalog, purpose = "render", }) {
     const areaMask = resolvePhiCmsAreaMask(area);
+    /*
+     * Whether this resolution speaks for the request.
+     *
+     * A refusal boundary does so only where nothing has been resolved at all, which is the root refusal
+     * route with no Area layout above it. The test is the request's runtime rather than its Area: a
+     * refusal answers in Public whichever Area caught it, so asking whether *that* Area is spoken for
+     * would let a Public refusal claim an App request.
+     */
+    const ownsRequestState = purpose === "render"
+        || (purpose === "refusal" && !maybeGetPhiRequestRuntime());
     const baseRequestContext = requestContext ??
         (await loadPhiSiteRequestContext(siteKey, locale, cookieHeader, apiBaseUrl, internalToken));
     const resolvedRequestContext = await resolvePhiCmsThemeReviewRequestContext({
@@ -132,7 +141,7 @@ export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookie
         areaMask,
         request: searchParams ? { searchParams } : undefined,
     });
-    if (purpose === "render") {
+    if (ownsRequestState) {
         setPhiRequestRuntime(runtime);
     }
     const catalog = resolvePhiCmsDescriptorCatalog(runtimeModuleCatalog);
@@ -158,12 +167,12 @@ export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookie
     const effectiveAreaPreset = exactAreaPreset ?? localAreaPreset;
     const siteId = localAreaPreset?.preset.preset.siteId ?? resolvedRequestContext.site.id;
     const areaOwnedStoragePath = resolveAreaOwnedStoragePath(path, areaMask);
-    const activeModuleKeys = resolveActivePresetModuleKeys(runtimeModuleCatalog, requestedAreaKey, effectiveAreaPreset, resolvedRequestContext.serverCapabilities, runtime.viewer);
+    const activeModuleKeys = resolveActivePresetModuleKeys(runtimeModuleCatalog, requestedAreaKey, effectiveAreaPreset, resolvedRequestContext.serverCapabilities);
     const runtimeWithAuthProvider = {
         ...runtime,
         authUiProvider: resolvePhiAuthUiRuntimeProjection(runtimeModuleCatalog, activeModuleKeys, requestedAreaKey),
     };
-    if (purpose === "render") {
+    if (ownsRequestState) {
         setPhiRequestRuntime(runtimeWithAuthProvider);
         setPhiRequestNavigationContext(requestedAreaKey, catalog, activeModuleKeys);
     }
@@ -174,7 +183,6 @@ export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookie
         catalog,
         area: requestedAreaKey,
         activeModuleIds: activeModuleKeys,
-        viewer: runtime.viewer,
         publicRoutePaths: readPhiAreaPublicRoutePaths(effectiveAreaPreset?.preset.preset.config),
         landingSelection: readPhiAreaLandingSelection(effectiveAreaPreset?.preset.preset.config),
     });
@@ -247,12 +255,17 @@ export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookie
     const resolvedPage = loadedPage && rootRouteDecision
         ? applyPhiAreaRootRouteDecision(loadedPage, rootRouteDecision, requestedAreaKey)
         : loadedPage ?? folderRedirectPage;
-    const accessiblePage = resolvedPage &&
-        canPhiViewerAccess(runtime.viewer, resolvedPage.page.page.accessPolicy)
-        ? resolvedPage
-        : null;
-    const effectivePage = accessiblePage
-        ? mapResolvedPageToRequestedContext(accessiblePage, areaMask, path)
+    /*
+     * The Page a request resolved to, whoever asked.
+     *
+     * There is no viewer here and there must not be: an address answers the same Page for everybody the
+     * Area let in (ACCESS.md). A Module that may not show this person what the Page holds answers that
+     * inside the Page -- in its own tree loader, with what it is willing to show -- and its data refuses
+     * server-side regardless of what was rendered. Deciding it here instead made the address itself
+     * disappear, which is a different and much larger claim.
+     */
+    const effectivePage = resolvedPage
+        ? mapResolvedPageToRequestedContext(resolvedPage, areaMask, path)
         : null;
     const resolvedContent = effectivePage;
     if (!resolvedContent) {
@@ -287,7 +300,7 @@ export async function resolvePhiCmsRequest({ siteKey, locale, area, path, cookie
         serverCapabilities: resolvedRequestContext.serverCapabilities,
     };
 }
-export const loadPhiResolvedCmsRequest = cache(async function loadPhiResolvedCmsRequest(siteKey, locale, area, path, cookieHeader, apiBaseUrl, internalToken, requestContext, searchParams, runtimeModuleCatalog) {
+export const loadPhiResolvedCmsRequest = cache(async function loadPhiResolvedCmsRequest(siteKey, locale, area, path, cookieHeader, apiBaseUrl, internalToken, requestContext, searchParams, runtimeModuleCatalog, purpose = "render") {
     const revision = resolvePhiCmsRevisionFromSearchParams(searchParams);
     const review = resolvePhiCmsReviewParams(searchParams);
     return resolvePhiCmsRequest({
@@ -300,6 +313,7 @@ export const loadPhiResolvedCmsRequest = cache(async function loadPhiResolvedCms
         internalToken,
         requestContext,
         searchParams,
+        purpose,
         runtimeModuleCatalog,
         loadExactCmsArea: (requestPath, sourcePreset) => getPhiExactSiteArea({
             path: requestPath,

package/server-helpers/cms-review.d.ts

@@ -1,5 +1,5 @@
 import "server-only";
-import type { PhiSiteRequestContext } from "./runtime";
+import type { PhiSiteRequestContext } from "../types/site-request-context";
 export type PhiCmsReviewKind = "area" | "page" | "navigation" | "theme";
 export type PhiCmsReviewParams = {
     kind: PhiCmsReviewKind;

package/server-helpers/cms-root.d.ts

@@ -11,6 +11,13 @@ type PhiCmsRequestSearchParams = Record<string, string | undefined>;
 type PhiCmsServerRequest = {
     pathname?: string;
     searchParams?: PhiCmsRequestSearchParams;
+    /**
+     * Whether the browser is navigating rather than asking for a document.
+     *
+     * Told by the proxy, because Next consumes `RSC` before a Server Component can read it
+     * (`constants/http-headers.ts`). A static render never sees one and says so.
+     */
+    clientNavigation?: boolean;
 };
 export declare function hasPhiCmsRevisionPreview(searchParams?: PhiCmsRequestSearchParams): boolean;
 export declare function loadPhiCmsRootScope({ root, path, cmsBridge, }: LoadPhiCmsRootRequestArgs): Promise<{
@@ -23,7 +30,7 @@ export declare function loadPhiCmsRootScope({ root, path, cmsBridge, }: LoadPhiC
             providerKey: `${string}/${string}`;
             controllerAddress: import("@phis/contracts/signals").PhiControllerSignalAddress;
             capabilities: readonly string[];
-            accountSecurityPath?: `/${string}`;
+            loginOverlayAddress: import("@phis/contracts/signals").PhiSignalAddress | null;
         } | null | undefined;
         site: import("../types").PhiBlockRuntimeSite;
         locale: import("../types").PhiBlockRuntimeLocale;
@@ -35,7 +42,7 @@ export declare function loadPhiCmsRootScope({ root, path, cmsBridge, }: LoadPhiC
         };
     };
     cookieHeader: string;
-    requestContext: import("./runtime").PhiSiteRequestContext;
+    requestContext: import("../types/site-request-context").PhiSiteRequestContext;
 }>;
 export declare function loadPhiCmsRootRequest({ root, path, cmsBridge, }: LoadPhiCmsRootRequestArgs): Promise<{
     resolvedRoute: import("./cms-route").PhiResolvedRootRoute;
@@ -46,7 +53,7 @@ export declare function loadPhiCmsRootRequest({ root, path, cmsBridge, }: LoadPh
             providerKey: `${string}/${string}`;
             controllerAddress: import("@phis/contracts/signals").PhiControllerSignalAddress;
             capabilities: readonly string[];
-            accountSecurityPath?: `/${string}`;
+            loginOverlayAddress: import("@phis/contracts/signals").PhiSignalAddress | null;
         } | null | undefined;
         site: import("../types").PhiBlockRuntimeSite;
         locale: import("../types").PhiBlockRuntimeLocale;
@@ -57,7 +64,7 @@ export declare function loadPhiCmsRootRequest({ root, path, cmsBridge, }: LoadPh
             searchParams?: Record<string, string | undefined>;
         };
     };
-    requestContext: import("./runtime").PhiSiteRequestContext;
+    requestContext: import("../types/site-request-context").PhiSiteRequestContext;
     resolvedAreaPreset: PhiResolvedCmsAreaPresetTree | null;
     resolvedRequest: PhiResolvedCmsRequest | null;
 }>;

package/server-helpers/cms-root.js

@@ -1,6 +1,8 @@
 import "server-only";
 import { cache } from "react";
 import { cookies, headers } from "next/headers";
+import { notFound } from "next/navigation";
+import { isPhiReservedCmsRoot } from "../helpers/cms-routing";
 import { resolvePhiCmsAreaMask } from "../constants/cms-areas";
 import { resolveCmsRootRoute } from "./cms-route";
 import { buildPhiLocalCmsAreaPayload } from "./cms-area";
@@ -9,10 +11,10 @@ import { resolvePhiCmsReviewParams, resolvePhiCmsRevisionFromSearchParams, resol
 import { setPhiRequestNavigationContext, setPhiRequestRuntime, } from "./request-runtime";
 import { buildPhiBlockRuntime, loadPhiSiteRequestContext } from "./runtime";
 import { composePhiCmsActiveAreaOverlayPresets, resolvePhiCmsAreaShellPresetBinding, resolvePhiCmsDescriptorCatalog, } from "../plugins/runtime-modules/descriptor-compiler";
-import { resolvePhiAuthUiRuntimeProjection } from "../plugins/runtime-modules/auth/ui-provider";
+import { resolvePhiAuthUiRuntimeProjection } from "./auth-ui-provider";
 import { resolveActivePresetModuleKeys } from "./cms-request";
 import { applyPhiBackgroundAssetProjection, resolvePhiBackgroundAssetProjection, } from "../components/widgets/helpers/background-reference-resolver.server";
-import { PHIS_REQUEST_PATH_HEADER, PHIS_REQUEST_SEARCH_HEADER } from "../constants/http-headers";
+import { PHIS_CLIENT_NAVIGATION_HEADER, PHIS_REQUEST_PATH_HEADER, PHIS_REQUEST_SEARCH_HEADER, } from "../constants/http-headers";
 import { isPhiStaticCmsSiteBridge } from "./static-render";
 /**
  * The request's query, as far as this render knows it.
@@ -61,6 +63,8 @@ async function loadPhiCmsServerRequest(cmsBridge, root, path) {
             request: {
                 pathname: `/${[root, ...(path ?? [])].join("/")}`,
                 searchParams: {},
+                // Only the proxy reaches this tree, and only with a document request.
+                clientNavigation: false,
             },
             cookieHeader: "",
         };
@@ -71,6 +75,7 @@ async function loadPhiCmsServerRequest(cmsBridge, root, path) {
         request: {
             pathname: normalizeRequestPathname(requestHeaders.get(PHIS_REQUEST_PATH_HEADER)),
             searchParams: parseSearchParamsHeader(requestHeaders.get(PHIS_REQUEST_SEARCH_HEADER)),
+            clientNavigation: requestHeaders.get(PHIS_CLIENT_NAVIGATION_HEADER) === "1",
         },
         cookieHeader: cookieStore.toString(),
     };
@@ -81,6 +86,14 @@ const loadPhiCmsRootScopeCached = cache(async function loadPhiCmsRootScopeCached
     if (!siteKey) {
         throw new Error("PhiCmsSiteBridge.runtime.siteKey is required for CMS root rendering.");
     }
+    /*
+     * A root the Site does not own is refused before anything is resolved. Reading it as an unprefixed
+     * Public address would forward a missing `/_next/...` asset to the Site's home page, at the price of
+     * a full root resolution per request; see `isPhiReservedCmsRoot`.
+     */
+    if (isPhiReservedCmsRoot(root)) {
+        notFound();
+    }
     const path = pathKey.length > 0 ? pathKey.split("\u0000") : undefined;
     const { request, cookieHeader } = await loadPhiCmsServerRequest(cmsBridge, root, path);
     const effectivePath = path && path.length > 0 ? path : derivePathSegmentsFromRequestPath(root, request.pathname);
@@ -128,7 +141,7 @@ const loadPhiCmsRootScopeCached = cache(async function loadPhiCmsRootScopeCached
         }),
     ]);
     const baseResolvedAreaPreset = exactAreaPreset?.preset ?? localAreaPreset?.preset ?? null;
-    const activeModuleIds = resolveActivePresetModuleKeys(cmsBridge.runtimeModuleCatalog, resolvedRoute.area, baseResolvedAreaPreset ? { preset: baseResolvedAreaPreset } : null, requestContext.serverCapabilities, runtime.viewer);
+    const activeModuleIds = resolveActivePresetModuleKeys(cmsBridge.runtimeModuleCatalog, resolvedRoute.area, baseResolvedAreaPreset ? { preset: baseResolvedAreaPreset } : null, requestContext.serverCapabilities);
     const composedAreaPreset = baseResolvedAreaPreset
         ? await composePhiCmsActiveAreaOverlayPresets({
             tree: baseResolvedAreaPreset,
@@ -173,7 +186,7 @@ const loadPhiCmsRootScopeCached = cache(async function loadPhiCmsRootScopeCached
  */
 async function resolvePhiCmsRootPathKey(root, path, cmsBridge) {
     if (path?.length) {
-        return path.join("\u0000");
+        return path.map(decodePhiCmsPathSegment).join("\u0000");
     }
     // A static route always names its segments, so no segments is the root and nothing is derived.
     if (isPhiStaticCmsSiteBridge(cmsBridge)) {
@@ -183,8 +196,26 @@ async function resolvePhiCmsRootPathKey(root, path, cmsBridge) {
     const derived = derivePathSegmentsFromRequestPath(root, request.pathname);
     return derived?.length ? derived.join("\u0000") : "";
 }
+/**
+ * One segment in the form the Site stores paths in: decoded.
+ *
+ * The same request reaches this file in both spellings -- Next hands the Page `%C3%BCber-uns` and other
+ * readers `über-uns`, and the proxy's path header is always encoded -- so a key built from either as it
+ * came gave the Layout and the Page two cache entries, and the Layout resolved the encoded one to a 404.
+ * An encoded segment decodes to the stored one; a decoded one has nothing left to decode, unless it
+ * holds a `%` that is no escape, which is then kept as written.
+ */
+function decodePhiCmsPathSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return segment;
+    }
+}
 export async function loadPhiCmsRootScope({ root, path, cmsBridge, }) {
-    return loadPhiCmsRootScopeCached(root, await resolvePhiCmsRootPathKey(root, path, cmsBridge), cmsBridge);
+    const decodedRoot = decodePhiCmsPathSegment(root);
+    return loadPhiCmsRootScopeCached(decodedRoot, await resolvePhiCmsRootPathKey(decodedRoot, path, cmsBridge), cmsBridge);
 }
 const loadPhiCmsRootRequestCached = cache(async function loadPhiCmsRootRequestCached(root, pathKey, cmsBridge) {
     const path = pathKey.length > 0 ? pathKey.split("\u0000") : undefined;
@@ -226,7 +257,8 @@ const loadPhiCmsRootRequestCached = cache(async function loadPhiCmsRootRequestCa
     };
 });
 export async function loadPhiCmsRootRequest({ root, path, cmsBridge, }) {
-    return loadPhiCmsRootRequestCached(root, await resolvePhiCmsRootPathKey(root, path, cmsBridge), cmsBridge);
+    const decodedRoot = decodePhiCmsPathSegment(root);
+    return loadPhiCmsRootRequestCached(decodedRoot, await resolvePhiCmsRootPathKey(decodedRoot, path, cmsBridge), cmsBridge);
 }
 function normalizeRequestPathname(rawValue) {
     if (!rawValue?.trim()) {
@@ -239,7 +271,7 @@ function derivePathSegmentsFromRequestPath(root, pathname) {
     if (!pathname) {
         return undefined;
     }
-    const segments = pathname.split("/").filter(Boolean);
+    const segments = pathname.split("/").filter(Boolean).map(decodePhiCmsPathSegment);
     if (segments.length === 0) {
         return undefined;
     }

package/server-helpers/cms-route.js

@@ -1,5 +1,5 @@
 import "server-only";
-import { isKnownSpecialCmsRoot, normalizePhiCmsRouteSegment, } from "../helpers/cms-routing";
+import { canonicalHrefUnlessCurrent, isKnownSpecialCmsRoot, normalizePhiCmsRouteSegment, } from "../helpers/cms-routing";
 import { normalizeSiteLocale, } from "../helpers/site-locale-config";
 import { maybeGetPhiRequestRuntime } from "./request-runtime";
 import { resolvePhiRequestLocale } from "./request-locale";
@@ -50,8 +50,6 @@ export async function resolveCmsRootRoute(root, segments, runtime = {}) {
         locale: normalizedLocale,
         area: "public",
         cmsPath: buildCmsPathFromSegments(normalizedSegments),
-        canonicalHref: normalizedRoot === normalizedLocale
-            ? null
-            : buildCanonicalHref(normalizedLocale, normalizedSegments),
+        canonicalHref: canonicalHrefUnlessCurrent(buildCanonicalHref(normalizedLocale, normalizedSegments), buildCanonicalHref(normalizedRoot, normalizedSegments)),
     };
 }

package/server-helpers/public-login-route.d.ts

@@ -1,5 +1,4 @@
 import "server-only";
-import type { PhiBlockRuntime } from "../types";
 import type { PhiCmsSiteBridge } from "../types/cms-plugins";
 import type { PhiCapabilitySnapshot } from "../types/server-capabilities";
 /**
@@ -12,7 +11,7 @@ import type { PhiCapabilitySnapshot } from "../types/server-capabilities";
  *
  * Only the redirect path pays for this: an unauthenticated visitor reaching a staff Area.
  */
-export declare const resolvePhiPublicLoginHref: (cmsBridge: PhiCmsSiteBridge, locale: string, viewer?: PhiBlockRuntime["viewer"], serverCapabilities?: PhiCapabilitySnapshot | null) => Promise<string | null>;
+export declare const resolvePhiPublicLoginHref: (cmsBridge: PhiCmsSiteBridge, locale: string, serverCapabilities?: PhiCapabilitySnapshot | null) => Promise<string | null>;
 /**
  * The same lookup for a request whose Area payload was refused before any runtime resolved: there is no
  * viewer and no capability snapshot to filter with, so the anonymous route table decides. Returns the