@weatherboard/annotation 0.4.0 → 0.7.0

package/ADOPTING.md

@@ -41,8 +41,12 @@ npm i @weatherboard/annotation
 npm i -D @weatherboard/annotation-next
 ```
 
-The runtime package has **zero dependencies** and ships in your app. The
-transform runs only in your build.
+The runtime package has **one dependency**, `modern-screenshot` (MIT), and ships
+in your app. It is the approved exception to this package's no-dependencies
+rule (A-2385): it renders the viewport screenshot, and it is loaded with a
+dynamic `import()` at capture time only, so your bundler splits it into its own
+chunk and an armed page that is never clicked never fetches it. The transform
+runs only in your build.
 
 **What breaks:** `-D` on the second one is not cosmetic. `annotation-next`
 depends on a Babel parser, and npm installs a package's `dependencies` whichever
@@ -98,23 +102,40 @@ pointed at production anyway.
 
 ```ts
 // middleware.ts
-import { ANNOTATION_ARMED_COOKIE, readAnnotationToken } from "@weatherboard/annotation/protocol";
+import {
+  ANNOTATION_ARMED_COOKIE,
+  ANNOTATION_ARMED_COOKIES,
+  ANNOTATION_TOKEN_PARAMS,
+  readAnnotationToken,
+} from "@weatherboard/annotation/protocol";
 
 const presented = readAnnotationToken(request.nextUrl.searchParams);
 const expected = process.env.ANNOTATION_TOKEN;
+const attempted = ANNOTATION_TOKEN_PARAMS.some((name) => request.nextUrl.searchParams.has(name));
+const overHttps = request.nextUrl.protocol === "https:";
 
 if (expected && presented && presented.length === expected.length && presented === expected) {
-  const overHttps = request.nextUrl.protocol === "https:";
   response.cookies.set(ANNOTATION_ARMED_COOKIE, "1", {
     httpOnly: false,           // the client bundle is what reads it
     sameSite: overHttps ? "none" : "lax",
     secure: overHttps,
     path: "/",
   });
+} else if (attempted) {
+  for (const name of ANNOTATION_ARMED_COOKIES) {
+    response.cookies.set(name, "", {
+      httpOnly: false,
+      sameSite: overHttps ? "none" : "lax",
+      secure: overHttps,
+      path: "/",
+      maxAge: 0,
+      expires: new Date(0),
+    });
+  }
 }
 ```
 
-Four details, each of which has cost somebody a day:
+Five details, each of which has cost somebody a day:
 
 - **The cookie holds `1`, never the token.** It records that the token was
   presented once, so navigation inside the frame stays armed without the secret
@@ -127,6 +148,10 @@ Four details, each of which has cost somebody a day:
 - **…but `None` is only honoured with `Secure`**, and `Secure` is dropped over
   plain http — so a local `next dev` would set a cookie the browser silently
   discards. Fall back to `Lax`, which is same-origin anyway.
+- **A fresh rejected token expires both cookie spellings.** A browser may still
+  carry a valid cookie from an earlier link. Leaving it in place turns the new
+  rejection into an accepted launch and lets the old capture/read/run context
+  survive under a different review link.
 
 ### First-party, the cookie is an ordinary one — use `armedCookie()` (A-241)
 
@@ -140,14 +165,65 @@ Do not re-derive the attributes. `@weatherboard/annotation/protocol` exports the
 cookie itself, so the two halves cannot disagree:
 
 ```ts
-import { armedCookie, clearedCookie, ANNOTATION_ARMED_COOKIE } from "@weatherboard/annotation/protocol";
+import {
+  armedCookie,
+  clearedCookie,
+  ANNOTATION_ARMED_COOKIES,
+  ANNOTATION_TOKEN_PARAMS,
+  readAnnotationToken,
+} from "@weatherboard/annotation/protocol";
 
-// after YOUR comparison against YOUR secret has succeeded, and only then:
-response.headers.append("set-cookie", armedCookie());
+const presented = readAnnotationToken(request.nextUrl.searchParams);
+const attempted = ANNOTATION_TOKEN_PARAMS.some((name) => request.nextUrl.searchParams.has(name));
+if (presented && presented === process.env.ANNOTATION_TOKEN) {
+  response.headers.append("set-cookie", armedCookie());
+} else if (attempted) {
+  for (const name of ANNOTATION_ARMED_COOKIES) {
+    response.headers.append("set-cookie", clearedCookie(name));
+  }
+}
+```
+
+Put the package bootstrap in the first raw script in `<head>`, before styles,
+analytics and hydration:
+
+```tsx
+import { annotationBootstrapScript } from "@weatherboard/annotation/bootstrap";
+
+<script dangerouslySetInnerHTML={{ __html: annotationBootstrapScript() }} />
+```
+
+The script synchronously strips `ai_annotate`, its legacy spelling,
+`ai_capture`, `ai_read` and `ai_run`. When middleware accepted the arming link,
+it keeps capture/read/run in this tab's `sessionStorage`, so same-tab routing
+and a hard reload remain armed after the URL is clean. When middleware rejected
+the link, it persists only `{ status: "rejected", capture: "present" | "missing" }`.
+No credential from an unarmed link is stored.
+
+The client mount can consume that signal once and report a generic failure:
+
+```ts
+import {
+  consumeAnnotationAttempt,
+  reportAnnotationStartupFailure,
+} from "@weatherboard/annotation/bootstrap";
+
+const attempt = consumeAnnotationAttempt();
+if (attempt?.status === "rejected") {
+  return reportAnnotationStartupFailure("rejected-arming");
+}
+if (attempt?.capture === "missing") {
+  return reportAnnotationStartupFailure("missing-capture");
+}
 ```
 
-It takes no value argument on purpose — the cookie holds a marker, never the
-token, and the first bullet above is the reason. The page half calls
+The reporter owns one host, `#ai-annotation-startup-status`, and returns a
+cleanup function. Import and mount failures use `"import-failed"` and
+`"mount-failed"`. All copy is package-owned and contains no token or product
+name.
+
+It takes no value argument on purpose — the middleware's arming cookie holds a
+marker, never the token. The page half calls
 `readArming()`, which reads that cookie, strips the tokens out of the URL with
 `replaceState`, and hands the capture token to `httpTransport`.
 
@@ -268,6 +344,32 @@ dynamic import costs a chunk fetch, so the first few milliseconds of an armed
 page are genuinely unobserved. That is the trade. What you must *not* do is defer
 the collector to click time, which observes nothing at all.
 
+### The keyboard shortcut — install it before the armed check (A-2384)
+
+The mount above returns on an unarmed page before importing anything, so a key
+listener inside `mountAnnotation` cannot hear the chord there. Install the
+pre-arm listener from `./bootstrap` **above** that return, on every page:
+
+```ts
+import { DEFAULT_HOTKEY, installAnnotationShortcut } from "@weatherboard/annotation/bootstrap";
+
+useEffect(() => installAnnotationShortcut({
+  build,
+  armUrl: process.env.NEXT_PUBLIC_ANNOTATION_ARM_URL!, // https://<studio>/annotate/arm?product=<id>&target=staging
+  hotkey: DEFAULT_HOTKEY,
+}), []);
+```
+
+and pass the same `hotkey` to `mountAnnotation`. There is no default `armUrl`,
+for the reason step 5 gives for origins. Studio's route does the signed-in
+reviewer check and refuses anything but the registered staging target; your
+middleware still decides arming from the token it is sent back with. A
+production build installs no listener.
+
+**What breaks:** installed below the `isAnnotationArmed` return, the chord
+works only on a page that is already armed, which looks like a shortcut that
+"sometimes" works.
+
 ## 7. `parentOrigin` is one address, not a list
 
 `postMessage`'s second argument is **not an allowlist**. It is an address, and
@@ -490,3 +592,38 @@ misattributed.
 Every step above is a thing that, when absent, produces no error, no warning and
 no log line — only an absence. When you are debugging, prefer the check that
 distinguishes causes over the check that confirms your guess.
+
+## Host-owned contextual feedback
+
+`@weatherboard/annotation/selection` exposes `relativePoint`,
+`captureTextSelection`, `resolveTextSelection` and `prepareTextSelections` without
+arming the developer SDK, mounting UI or sending network requests. Production
+hosts such as Pitch own authentication, capture intent, target persistence and
+permission-scoped reads. Import this subpath directly; importing the root SDK
+still observes its existing production restrictions.
+
+Mark authored text containers with `data-annotation-text="host-field-path"`.
+Capture returns UTF-16 offsets, exact quote and bounded prefix/suffix using CRLF
+normalisation only. A field path is evidence qualified by a host content revision,
+not a permanent identity. Pass whether content is unchanged when resolving;
+edited content requires a unique quote/context match. Missing or ambiguous
+locations must remain reviewable as unplaced feedback. `prepareTextSelections`
+shares one bounded text-map snapshot across annotations in a layout frame; discard
+it after content or layout changes. Neither helper reads application controls as
+authored text or persists DOM nodes.
+
+## After adopting: prove the capture end to end on staging
+
+A package release cannot prove its own capture path, because that needs a host
+that consumes the published version. After a product adopts it on staging:
+
+1. Arm at the Studio arm endpoint, press the chord, and file one capture with
+   its viewport screenshot.
+2. Confirm the capture reached ingest with the screenshot attached, and that the
+   filed issue carries the image.
+3. For the annotate-to-merge loop, the product's registry row must let
+   `workflowAutomationDecision` say yes for that origin: its preview host,
+   image ref and base SHA. Then confirm one `annotation_workflows` row and a
+   sandbox run that opens a pull request.
+4. Record the capture id, the issue, the run id and the pull request on the
+   adoption issue.

package/COMPATIBILITY.md

@@ -95,3 +95,32 @@ whoever drops it, in the same change, and not by whoever finds out.
 
 `0.x` while the wire protocol is still moving. **1.0 is the statement that a
 hundred consumers can rely on it**, not a way to look finished.
+
+### Additive selection subpath (A-391)
+
+The workspace adds `./selection` with ESM, CommonJS and TypeScript exports.
+Existing SDK wire versions and production arming rules are unchanged. Pitch uses
+the workspace source; external consumers need a subsequently published package
+version containing this entry point. The tarball smoke test verifies its exports;
+this feature does not itself publish an npm release.
+
+### In-app shortcut and cross-tab arming (A-2384)
+
+Version 0.7.0 adds `hotkey` to `mountAnnotation` and `installAnnotationShortcut`
+to `./bootstrap`. Both are opt-in: absent `hotkey` means what it meant before, an
+immediately visible toolbar. Passing a chord (`DEFAULT_HOTKEY` is
+`Mod+Shift+Period`) starts an armed toolbar dormant and toggles it. The
+bootstrap listener re-arms through Studio's `/annotate/arm` when no fresh
+mounted toolbar claims the chord, and carries an open intent in session storage
+so the next armed mount opens. `showResult` attaches a dormant toolbar.
+`readArming` copies accepted capture and read tokens into a secure, expiring
+first-party cookie; a new tab uses it when its session storage has no token.
+The arming marker remains the middleware's decision, and the console still
+verifies tokens at its endpoint.
+
+### Additive bootstrap subpath and hosted-mode metadata (A-1375)
+
+Version 0.6.0 adds `./bootstrap` for synchronous credential stripping,
+per-tab continuation and token-free startup status. It also adds the exact
+`x-weatherboard-annotation-mode: first-party` constants to `./protocol`. The
+wire payload version and all existing names remain unchanged.

package/README.md

@@ -11,8 +11,11 @@ sentence. What comes back is not a screenshot and a guess — it is the file and
 line that rendered that element, the ancestors that led to it, the console
 errors and failed requests from that session, and the build the page came from.
 
-Zero dependencies. It runs inside your production site, so it has no business
-adding to your supply chain.
+One runtime dependency, by exception: `modern-screenshot` (MIT), which renders
+the viewport into the screenshot a capture carries. It is loaded with a dynamic
+`import()` on the first capture only, so a page that is never annotated
+downloads none of it. Nothing else: it runs inside your production site, so it
+has no business adding to your supply chain.
 
 ## Install
 
@@ -20,23 +23,37 @@ adding to your supply chain.
 npm i @weatherboard/annotation
 ```
 
-## Six entry points
+## Eight entry points
 
 They are split by **who imports them**, not by topic.
 
 | Import | Runs where | For |
 |---|---|---|
 | `@weatherboard/annotation` | The browser | The page SDK — overlay, target resolution, state collection, screenshots |
+| `@weatherboard/annotation/bootstrap` | The browser, before hydration | Immediate URL stripping, arming reads and token-free startup status |
 | `@weatherboard/annotation/protocol` | Anywhere, no DOM | The wire names and the two readers. This is what a middleware imports |
 | `@weatherboard/annotation/host` | The reviewing console | The parent half of the channel |
 | `@weatherboard/annotation/anchor` | The browser | `resolveAnchor` — where a capture's marker goes, or why it goes nowhere |
 | `@weatherboard/annotation/read` | The browser | `createAnnotationReader` — the captures already made on this page |
 | `@weatherboard/annotation/markers` | The browser | The marker layer and its panel |
+| `@weatherboard/annotation/selection` | The browser | Authored-content text/point selection and placement helpers |
 
-The last three are separate for one reason: they run only in a product that
-RENDERS markers, and a product that merely captures should not pay for them. They
-are subpaths rather than a tree-shaking promise for the same reason `/protocol`
-is.
+The final four remain separate because products can choose capture, marker
+rendering and authored-content selection independently. A product that merely
+captures should not pay for readers, marker UI or selection helpers. They are
+subpaths rather than a tree-shaking promise for the same reason `/protocol` is.
+
+`/bootstrap` is also a subpath rather than a tree-shaking promise. Put
+`annotationBootstrapScript()` in the first raw script in `<head>`, then keep the
+root entry behind a dynamic import. A normal visitor pays for URL and cookie
+reads without downloading the toolbar or state collector.
+
+Package-authored browser UI keeps its styles zero-dependency too. Declare
+colour, spacing and radius literals once as local `--ai-*` custom properties,
+then consume them with `var()` in the same style string. Do not import a
+product's design tokens: a toolbar or startup notice runs inside somebody
+else's page, where those names and values are not ours. New runtime surfaces
+must pass `pnpm gyde:check`; do not add their findings to the allowance ledger.
 
 `/protocol` is a subpath rather than a tree-shaking promise on purpose: an edge
 middleware is often bundled as CJS, and CJS does not shake. Importing the root
@@ -44,6 +61,52 @@ there would drag the overlay into a bundle that has no `document`.
 
 ## The page half
 
+### The in-app shortcut (A-2384)
+
+The shortcut has two halves, because a host loads the toolbar only on an armed
+page (ADOPTING.md, step 6) and an ordinary staging page has nothing loaded to
+hear a key.
+
+1. **Pre-arm, on every page.** From the small `./bootstrap` entry point, next to
+   the bootstrap script:
+
+   ```ts
+   import { DEFAULT_HOTKEY, installAnnotationShortcut } from "@weatherboard/annotation/bootstrap";
+
+   installAnnotationShortcut({
+     build,   // the same BuildInfo the mount gets; production installs nothing
+     armUrl: process.env.NEXT_PUBLIC_ANNOTATION_ARM_URL, // Studio's /annotate/arm?product=<id>&target=staging
+     hotkey: DEFAULT_HOTKEY,
+   });
+   ```
+
+2. **The mount, on an armed page.** Pass the middleware-backed `readArming()`
+   result and the same `hotkey` to `mountAnnotation()`.
+
+With a fresh token the mounted toolbar claims the chord and toggles itself.
+Otherwise — nothing mounted, no token, a token within five minutes of expiry,
+or a session ended with Done — the chord is unclaimed, and the pre-arm listener
+writes a credential-free open intent to session storage and navigates the tab
+to `armUrl` with a `return` path from which every annotation parameter has
+been removed. Studio checks the signed-in reviewer, mints the tokens and sends
+the tab back; the host's middleware arms on that request, the bootstrap script
+strips the query, and the mount opens the toolbar once because the intent is
+under ten minutes old. One chord arms and opens. `e2e/shortcut.spec.ts` runs
+that loop in Chromium, through to a capture with a screenshot.
+
+The hotkey is opt-in: with no `hotkey` (absent or `null`) the toolbar shows
+immediately, as every mount before 0.7.0 did. `DEFAULT_HOTKEY` is
+`Mod+Shift+Period`, and `Mod` accepts Command or Control. The chord works while
+a form field has focus. A result shown by `showResult` always reveals the
+toolbar.
+
+`readArming` strips credentials from the deep link, keeps them in session
+storage, and copies an accepted token pair to an expiring
+`Secure; SameSite=Lax; Path=/` cookie so a new tab can recover them. That
+cookie is sent on product-origin requests, so product request logs must exclude
+its value. The package reads the signed token's expiry without verifying the
+signature; the console verifies it when used.
+
 ```ts
 import { createAnnotationSdk, isAnnotationArmed, readAnnotationToken } from "@weatherboard/annotation";
 
@@ -63,11 +126,21 @@ right is yours, because only you hold the secret.
 
 ```ts
 // middleware.ts
-import { ANNOTATION_ARMED_COOKIE, readAnnotationToken } from "@weatherboard/annotation/protocol";
+import {
+  ANNOTATION_ARMED_COOKIE,
+  ANNOTATION_ARMED_COOKIES,
+  ANNOTATION_TOKEN_PARAMS,
+  readAnnotationToken,
+} from "@weatherboard/annotation/protocol";
 
 const token = readAnnotationToken(request.nextUrl.searchParams);
-if (token !== undefined && token === process.env.ANNOTATION_TOKEN) {
+const attempted = ANNOTATION_TOKEN_PARAMS.some((name) => request.nextUrl.searchParams.has(name));
+if (token !== null && token === process.env.ANNOTATION_TOKEN) {
   response.cookies.set(ANNOTATION_ARMED_COOKIE, "1", { httpOnly: false, sameSite: "lax" });
+} else if (attempted) {
+  for (const name of ANNOTATION_ARMED_COOKIES) {
+    response.cookies.set(name, "", { path: "/", maxAge: 0, expires: new Date(0) });
+  }
 }
 ```
 
@@ -75,7 +148,8 @@ if (token !== undefined && token === process.env.ANNOTATION_TOKEN) {
 for an absent *or empty* parameter. An empty token compared with `===` against
 your secret is a rejection; an empty token treated as present is an app armed
 with the empty string, which fails later and reads like a bad secret rather than
-a missing one.
+a missing one. A fresh rejected attempt must expire **both** supported cookie
+spellings so an already-armed browser cannot reuse its previous session.
 
 ## Source refs
 

package/dist/anchor.cjs

@@ -1,2 +1,2 @@
-"use strict";var f=Object.defineProperty;var x=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var T=Object.prototype.hasOwnProperty;var R=(e,n)=>{for(var t in n)f(e,t,{get:n[t],enumerable:!0})},b=(e,n,t,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of E(n))!T.call(e,r)&&r!==t&&f(e,r,{get:()=>n[r],enumerable:!(o=x(n,r))||o.enumerable});return e};var y=e=>b(f({},"__esModule",{value:!0}),e);var L={};R(L,{anchorFromTarget:()=>S,resolveAnchor:()=>A,tallyAnchors:()=>_});module.exports=y(L);var u="data-src";function g(e){return e.selection==="region"?"region":"element"}var m=8;function s(e){if(!e)return null;let n=e.lastIndexOf(":");if(n<=0)return null;let t=e.lastIndexOf(":",n-1);if(t<=0)return null;let o=e.slice(0,t),r=Number(e.slice(t+1,n)),i=Number(e.slice(n+1));return!o||!Number.isFinite(r)||!Number.isFinite(i)?null:{file:o,line:r,column:i}}function d(e,n=m){let t=[],o=e;for(;o&&t.length<n;){let r=s(o.getAttribute(u));if(r){let i=t[t.length-1];i&&i.file===r.file&&i.line===r.line||t.push(r)}o=o.parentElement}return t}function h(e){let n=e;for(;n;){if(s(n.getAttribute(u)))return n;n=n.parentElement}return null}function l(e,n){return e.file!==n.file||e.line!==n.line?!1:e.column===void 0||n.column===void 0?!0:e.column===n.column}function k(e,n){if(e.length===0)return!1;if(e.length<m){if(n.length!==e.length)return!1}else if(n.length<e.length)return!1;return e.every((t,o)=>{let r=n[o];return r!==void 0&&l(t,r)})}function N(e,n){let t={file:e.file,line:e.line};e.column!==void 0&&(t.column=e.column);let o=n.querySelectorAll(`[${u}]`),r=[];for(let i=0;i<o.length;i++){let a=o[i],c=s(a.getAttribute(u));if(!c||!l(t,c))continue;let p=s(h(a.parentElement)?.getAttribute(u)??null);p&&l(p,c)||r.push(a)}return r}function A(e,n){switch(e.kind){case"route":{if(!e.path)return"none";let t=n.location?.pathname;return!t||t!==e.path?"none":n.body??"none"}case"dom-path":{if(!e.path)return"none";let t;try{t=n.querySelectorAll(e.path)}catch{return"none"}return t.length===0?"none":t.length>1?"ambiguous":t[0]}case"source-ref":{if(e.chain.length===0)return"none";let t=N(e,n).filter(o=>k(e.chain,d(o)));return t.length===0?"none":t.length>1?"ambiguous":t[0]}default:return"none"}}function S(e,n={}){let t=()=>n.path===void 0?{kind:"route"}:{kind:"route",path:n.path};if(g(e)==="region")return t();let o=e.sourceChain??[],r=o[0],i=e.source??r;if(i&&r&&l(i,r)){let a={kind:"source-ref",file:i.file,line:i.line,chain:o};return i.column!==void 0&&(a.column=i.column),n.ordinal!==void 0&&(a.ordinal=n.ordinal),a}return e.domPath?{kind:"dom-path",path:e.domPath}:t()}function _(e,n){let t={total:e.length,placed:0,ambiguous:0,unresolved:0};for(let o of e){let r=A(o,n);r==="ambiguous"?t.ambiguous+=1:r==="none"?t.unresolved+=1:t.placed+=1}return t}
+"use strict";var f=Object.defineProperty;var x=Object.getOwnPropertyDescriptor;var E=Object.getOwnPropertyNames;var b=Object.prototype.hasOwnProperty;var T=(e,n)=>{for(var t in n)f(e,t,{get:n[t],enumerable:!0})},R=(e,n,t,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let r of E(n))!b.call(e,r)&&r!==t&&f(e,r,{get:()=>n[r],enumerable:!(o=x(n,r))||o.enumerable});return e};var y=e=>R(f({},"__esModule",{value:!0}),e);var O={};T(O,{anchorFromTarget:()=>S,resolveAnchor:()=>A,tallyAnchors:()=>_});module.exports=y(O);var u="data-src";function g(e){return e.selection==="region"?"region":"element"}var m=8;function s(e){if(!e)return null;let n=e.lastIndexOf(":");if(n<=0)return null;let t=e.lastIndexOf(":",n-1);if(t<=0)return null;let o=e.slice(0,t),r=Number(e.slice(t+1,n)),i=Number(e.slice(n+1));return!o||!Number.isFinite(r)||!Number.isFinite(i)?null:{file:o,line:r,column:i}}function d(e,n=m){let t=[],o=e;for(;o&&t.length<n;){let r=s(o.getAttribute(u));if(r){let i=t[t.length-1];i&&i.file===r.file&&i.line===r.line||t.push(r)}o=o.parentElement}return t}function h(e){let n=e;for(;n;){if(s(n.getAttribute(u)))return n;n=n.parentElement}return null}function l(e,n){return e.file!==n.file||e.line!==n.line?!1:e.column===void 0||n.column===void 0?!0:e.column===n.column}function k(e,n){if(e.length===0)return!1;if(e.length<m){if(n.length!==e.length)return!1}else if(n.length<e.length)return!1;return e.every((t,o)=>{let r=n[o];return r!==void 0&&l(t,r)})}function N(e,n){let t={file:e.file,line:e.line};e.column!==void 0&&(t.column=e.column);let o=n.querySelectorAll(`[${u}]`),r=[];for(let i=0;i<o.length;i++){let a=o[i],c=s(a.getAttribute(u));if(!c||!l(t,c))continue;let p=s(h(a.parentElement)?.getAttribute(u)??null);p&&l(p,c)||r.push(a)}return r}function A(e,n){switch(e.kind){case"route":{if(!e.path)return"none";let t=n.location?.pathname;return!t||t!==e.path?"none":n.body??"none"}case"dom-path":{if(!e.path)return"none";let t;try{t=n.querySelectorAll(e.path)}catch{return"none"}return t.length===0?"none":t.length>1?"ambiguous":t[0]}case"source-ref":{if(e.chain.length===0)return"none";let t=N(e,n).filter(o=>k(e.chain,d(o)));return t.length===0?"none":t.length>1?"ambiguous":t[0]}default:return"none"}}function S(e,n={}){let t=()=>n.path===void 0?{kind:"route"}:{kind:"route",path:n.path};if(g(e)==="region")return t();let o=e.sourceChain??[],r=o[0],i=e.source??r;if(i&&r&&l(i,r)){let a={kind:"source-ref",file:i.file,line:i.line,chain:o};return i.column!==void 0&&(a.column=i.column),n.ordinal!==void 0&&(a.ordinal=n.ordinal),a}return e.domPath?{kind:"dom-path",path:e.domPath}:t()}function _(e,n){let t={total:e.length,placed:0,ambiguous:0,unresolved:0};for(let o of e){let r=A(o,n);r==="ambiguous"?t.ambiguous+=1:r==="none"?t.unresolved+=1:t.placed+=1}return t}
 //# sourceMappingURL=anchor.cjs.map