# Owner-managed links and optional counts

Each default link is a native Spacefast redirect rule. Use the owner’s existing authenticated connection, with no application link API or database. Read the complete current settings and settingsDigest before planning; send a compare-and-swap update preserving unrelated settings, read the result and verify exact HTTP status and Location anonymously.

The formatted scripts/redirect-plan.mjs supports create, edit, disable, import and export. The snapshot includes its verified liveUrl. Requests accept prefix (`/r/` by default, `/` for root aliases), alias, destination and status (302 or301). Root aliases may be one character; /r/ aliases require three. Reserved page names and overlapping rules are rejected. Destination credentials, unsafe protocols and same-site short-link chains are rejected. Supply authoredRoutes in the snapshot to reject collisions with other project pages. Never overwrite a conflicting existing link.

A create/edit plan returns spaceId, body and artifacts. Pass only spaceId/body to the provider operation. Artifacts include the exact short URL and a local QR SVG, with a quiet zone and independent decoding tests. Optional third CLI argument writes the QR to a private local file. A planning result does not prove a link exists: always verify after the authenticated update.

Use 302 for editable destinations; use301 only for intentionally permanent links because clients can retain the old destination. Version2 exports contain explicit source, destination and status, so root and /r/ aliases round-trip without changing paths. Old version1 imports remain supported.

Protect every publish with scripts/link-guard.mjs. See the build recipe for capture, deploy, verify and conflict-safe restore-plan commands. Exports and verification reports are private; do not package them. Provider approvals remain required for settings writes.

## Counting options

Spacefast traffic summaries and edge logs can help answer approximate traffic questions through the owner’s connection. Top-path summaries are not exact per-link counts, and limited log windows may omit requests. Explain those limits when returning numbers.

For durable counts opt in to optional/counter/server.ts in your own clone. It uses native server endpoints and append-only database events, records only the alias, and provides an authenticated owner-only paginated count query. The default build does not activate it. /c/ aliases use302 and no-store; do not add native redirects that bypass these endpoints. Sum every page at one cutoff to produce a complete processed-request count. Bots, scanners and repeated requests count; redirects cached before reaching the endpoint do not. This is not a unique-person metric.

Public learning tools are read-only. A site visit, QR code or skill download never authorizes changing another owner’s links or reading their private count query.
