`access-gate` | ArcBlock

Web Device layout component — not an AUP primitive; not an AUP Web-only widget; not a Markdown directive.

Default-theme package: providers/runtime/web-device/themes/default/components/access-gate/ (manifest.json + render.js + style.css). Resolved through the layout component chain (runtime surface → theme → optional site override). SiteServer mounts it into the article body slot on a denied detail; you do not put it in layout.aup yourself.

Purpose

The stop under a first-screen teaser (or alone when preview: false). Title stays in post-hero. This component is the rule, the message, and the Sign in action.

Boundaries

Do not call this an AUP primitive or put it under docs/aup/primitives/.
Do not mix other layout components' contracts on this page.
Manifest props are the author-facing contract; invented props are not portable.
The component never receives the protected body. excerpt is a declared public field only.
seoStrategy on the manifest is none. Gated pages force noindex in SiteServer, not here.

Author entry

Not a hand-written layout.aup section. The runtime resolves access-gate after decideWebAccess returns preview-shell or promo-shell.

Common props (from manifest): kind, requiredRole, excerpt, loginHref, signInLabel, message, signedIn.

Prop	Values / default
`kind`	`preview-shell` or `promo-shell`
`requiredRole`	Role the caller is missing
`excerpt`	Declared excerpt. Empty when a teaser is already in the page
`loginHref`	Default `/.well-known/service/login`. Live pages pass `return_to` and `cancel_to` for the current path
`signInLabel`	Default `Sign in` (locale copy from SiteServer)
`message`	Default: preview → `The rest of this piece is for {role}.`; promo → `This piece is for {role}.` Named roles `member` / `admin` / `owner` become `members` / `admins` / `owners`. Any other string is shown as-is; missing role → `signed-in readers`
`signedIn`	`true` omits the Sign in button

If the theme package is missing, renderAccessGateMarkup in packages/core/src/blocklet/web-access-gate.ts emits the same markup.

Surfaces

layout body slot on a denied content detail. Not the document Markdown directive surface.

Public status

released

Fallback

Missing package → core markup. Missing loginHref → /.well-known/service/login. signedIn: true → no button.

Sample

No isolated docs-safe live mock on this page. The contract is proven by a denied content detail in site chrome. Open any listed record whose access is above the caller, signed out.

Live anonymous HTML (ARC 2.0.0-beta.35, 2026-08-15):

<aside class="access-gate" data-kind="promo-shell" data-required-role="admin">
  <div class="access-gate-rule" aria-hidden="true"></div>
  <p class="access-gate-message">The rest of this piece is for admins.</p>
  <p class="access-gate-action">
    <a class="access-gate-signin"
       href="/.well-known/service/login?return_to=%2Fen%2Farticles%2Faccess-fixture-team%2F&amp;cancel_to=%2Fen%2Farticles%2Faccess-fixture-team%2F">Sign in</a>
  </p>
</aside>

data-kind stays promo-shell when preview is omitted. The message uses preview phrasing because a teaser is present.

Evidence

Item	Path
Theme package	`providers/runtime/web-device/themes/default/components/access-gate/`
Manifest	`…/access-gate/manifest.json`
Renderer	`…/access-gate/render.js`
Styles	`…/access-gate/style.css`
Fallback markup	`packages/core/src/blocklet/web-access-gate.ts` (`renderAccessGateMarkup`)
Mount	`providers/runtime/web-device/src/site-server.ts`
Internal matrix	`docs/aup/capability-matrix.md` §3 (internal, non-routed)
Matrix row concept	layout-component · `access-gate`

Notes

Shipped in arc#4065. Author fields: Restrict who can read a page.