@batterai/host 0.1.0

package/dist/content-source/conformance/cases-writes.js

@@ -0,0 +1,73 @@
+export function registerWriteCases(target, hooks) {
+    const { test, expect } = hooks;
+    test("CAS: stale precondition refused; fresh precondition accepted (then restored)", async () => {
+        const page = await target.source.listInstances(target.contentTypeId, { pageSize: 1 }, undefined, target.editor);
+        const inst = page.items[0];
+        const subject = { kind: "instance", contentTypeId: target.contentTypeId, instanceId: inst.id };
+        const current = await target.source.getVersion(subject, target.editor);
+        expect(current).toBeDefined();
+        try {
+            let staleRefused = false;
+            try {
+                await target.source.writeInstanceField(target.contentTypeId, inst.id, target.writableField, inst.values[target.writableField], "v-stale-never-issued", target.editor);
+            }
+            catch {
+                staleRefused = true;
+            }
+            expect(staleRefused).toBe(true);
+            const result = await target.source.writeInstanceField(target.contentTypeId, inst.id, target.writableField, inst.values[target.writableField], current, target.editor);
+            expect(result.version).toBeDefined();
+            expect(result.version).not.toBe(current);
+            // Tolerance calibration (locked decision §1.3): quality metadata is read
+            // by the KIT, never branched on by consumers. A version-token adapter
+            // must mint a DISTINCT token for two immediately-consecutive writes
+            // (raceWindowMs 0); a timestamp adapter is exempted from the rapid-double-
+            // write distinctness check WITHIN its declared window — the declaration is
+            // the documented tolerance, not a silent pass.
+            if (target.source.capabilities.concurrency.strategy === "version-token") {
+                const second = await target.source.writeInstanceField(target.contentTypeId, inst.id, target.writableField, inst.values[target.writableField], result.version, target.editor);
+                expect(second.version).not.toBe(result.version);
+            }
+        }
+        finally {
+            await target.cleanup();
+        }
+    });
+    test("create (plan §2.6): native creates {id, version} that roundtrips; skipped when create:'none'", async () => {
+        // The create case is capability-gated (I-5): a 'none' adapter never
+        // reaches createInstance, so the conformance kit must NOT call it —
+        // skip with a trivial pass. Also skip when no create fixture is wired
+        // (keeps read-only conformance targets green).
+        if (target.source.capabilities.create.mode === "absent" || target.create === undefined) {
+            expect(target.source.capabilities.create).toBe(target.source.capabilities.create);
+            return;
+        }
+        const { initialValues, expectCreated } = target.create;
+        // create:'native' MUST implement the (optional) createInstance method —
+        // declaring the capability without the method is a conformance failure.
+        // Bind to a local so TS narrowing survives the await inside the try.
+        const createInstance = target.source.createInstance?.bind(target.source);
+        if (!createInstance) {
+            throw new Error("adapter declares create:'native' but does not implement createInstance");
+        }
+        try {
+            const created = await createInstance(target.contentTypeId, initialValues, target.editor);
+            expect(typeof created.id).toBe("string");
+            expect(created.version).toBeDefined();
+            // The record must be readable at its new id, with initialValues
+            // merged over schema defaults (invariant: what you created is there).
+            const fetched = await target.source.getInstance(target.contentTypeId, created.id, target.editor);
+            expect(fetched).toBeDefined();
+            expect(fetched.values[expectCreated.field]).toEqual(expectCreated.value);
+            // The returned version is a live CAS token for the created record —
+            // getVersion agrees, so the editor session continues CAS-guarded.
+            const subject = { kind: "instance", contentTypeId: target.contentTypeId, instanceId: created.id };
+            const version = await target.source.getVersion(subject, target.editor);
+            expect(version).toBe(created.version);
+        }
+        finally {
+            await target.cleanup();
+        }
+    });
+}
+//# sourceMappingURL=cases-writes.js.map

package/dist/content-source/conformance/cases-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cases-writes.js","sourceRoot":"","sources":["../../../src/content-source/conformance/cases-writes.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,kBAAkB,CAAC,MAAyB,EAAE,KAAuB;IACnF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAE/B,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACxG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CACpC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,sBAA+B,EAAE,MAAM,CAAC,MAAM,CAClF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CACnD,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAC1D,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,yEAAyE;YACzE,sEAAsE;YACtE,oEAAoE;YACpE,2EAA2E;YAC3E,2EAA2E;YAC3E,+CAA+C;YAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CACnD,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,EACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CACjE,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CACF,8FAA8F,EAC9F,KAAK,IAAI,EAAE;QACT,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,+CAA+C;QAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvD,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,CAAC,OAAQ,OAAO,CAAC,EAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YAEtC,gEAAgE;YAChE,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACjG,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAE1E,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/content-source/conformance/session-required.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Shared assertion helper for delegated-auth calibration (decision 012 phase
+ * 1). Every case file that branches on `auth.mode === "delegated"` checks the
+ * SAME shape — the call rejects with an error whose `name === "SessionRequired"`
+ * (the kit's per-adapter-class convention). Extracted so
+ * cases-reads/-isolation/-permissions/-delegation don't fork the assertion.
+ */
+import type { ExpectFn } from "./target";
+export declare function expectSessionRequired(expect: ExpectFn, fn: () => Promise<unknown>): Promise<void>;
+//# sourceMappingURL=session-required.d.ts.map

package/dist/content-source/conformance/session-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-required.d.ts","sourceRoot":"","sources":["../../../src/content-source/conformance/session-required.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvG"}

package/dist/content-source/conformance/session-required.js

@@ -0,0 +1,11 @@
+export async function expectSessionRequired(expect, fn) {
+    let name;
+    try {
+        await fn();
+    }
+    catch (e) {
+        name = e instanceof Error ? e.name : undefined;
+    }
+    expect(name).toBe("SessionRequired");
+}
+//# sourceMappingURL=session-required.js.map

package/dist/content-source/conformance/session-required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-required.js","sourceRoot":"","sources":["../../../src/content-source/conformance/session-required.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAgB,EAAE,EAA0B;IACtF,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AACvC,CAAC"}

package/dist/content-source/conformance/sessionless-viewer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Kit-internal hostile input for the D1 behavioral cases (decision 012 phase 2).
+ *
+ * Public delivery is explicit via `publicDeliveryViewer`. This helper is only
+ * the hostile bare-sessionless input for D1: runtime attackers don't respect
+ * types, so delegated adapters must refuse it before I/O.
+ */
+import type { Viewer } from "../viewer";
+import type { ConformanceTarget } from "./target";
+/** A bare viewer with NO session or public-delivery marker. */
+export declare function sessionlessViewer(target: ConformanceTarget): Viewer;
+//# sourceMappingURL=sessionless-viewer.d.ts.map

package/dist/content-source/conformance/sessionless-viewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionless-viewer.d.ts","sourceRoot":"","sources":["../../../src/content-source/conformance/sessionless-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAEnE"}

package/dist/content-source/conformance/sessionless-viewer.js

@@ -0,0 +1,5 @@
+/** A bare viewer with NO session or public-delivery marker. */
+export function sessionlessViewer(target) {
+    return { locale: target.editor.locale };
+}
+//# sourceMappingURL=sessionless-viewer.js.map

package/dist/content-source/conformance/sessionless-viewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionless-viewer.js","sourceRoot":"","sources":["../../../src/content-source/conformance/sessionless-viewer.ts"],"names":[],"mappings":"AAUA,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAuB,CAAC;AAC/D,CAAC"}

package/dist/content-source/conformance/target.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Conformance-kit shared types (extracted from conformance-kit.ts for A6).
+ * The `ConformanceTarget` interface every adapter fixture implements, plus the
+ * framework-agnostic hook types the kit runs against (bun:test and any future
+ * runner). Re-exported from conformance-kit.ts so importers stay unchanged.
+ */
+import type { InstanceId } from "@batterai/bind-core";
+import type { ContentSource, EntityProvider } from "../content-source";
+import type { CanvasAction } from "../permissions";
+import type { Viewer } from "../viewer";
+import type { ContentTypeId, Locale } from "@batterai/bind-core";
+export interface ConformanceTarget {
+    readonly name: string;
+    readonly source: ContentSource;
+    readonly provider: EntityProvider;
+    readonly editor: Viewer;
+    /** A content type with >= 5 instances and a reference field. */
+    readonly contentTypeId: ContentTypeId;
+    readonly referenceField: string;
+    /** A sortable scalar field whose ascending order differs from id order. */
+    readonly sortField: string;
+    /** A field that must NEVER flow into Canvas — stripped by unconditional
+     * restrictedFields projection for EVERY viewer (decision 012 phase 2). Must
+     * be distinct from sort/reference/writable/absent fields (those stay visible). */
+    readonly restrictedField: string;
+    /** A writable field for CAS tests (mutations restored by the harness). */
+    readonly writableField: string;
+    /** A field DECLARED in the ContentType projection that no document carries
+     * (schema-drift; §6 null/missing cell): the CMS PoCs enforce required-ness
+     * on every stored field, so real-world absence enters via projection, and
+     * adapters must carry it as ABSENT — never "" or a fabricated value. */
+    readonly absentField: string;
+    /** Insert a NEW instance mid-pagination (concurrent-insert stability). */
+    insertBetween(afterId: InstanceId): Promise<InstanceId>;
+    /** Cleanup for insertBetween/write mutations (snapshot/reset discipline §12). */
+    cleanup(): Promise<void>;
+    /** Create-conformance fixture (plan §2.6). Present ONLY for adapters whose
+     * source declares `create: 'native'`; the create case skips itself when the
+     * capability is 'none' OR this fixture is absent. `initialValues` is the
+     * record to create; `expectCreated` names one field->value pair that MUST be
+     * present on the created instance after a getInstance roundtrip (merge check).
+     * Ids created here are cleaned up via `cleanup()`. */
+    readonly create?: {
+        readonly initialValues: Readonly<Record<string, unknown>>;
+        readonly expectCreated: {
+            readonly field: string;
+            readonly value: unknown;
+        };
+    };
+    /** Draft/publish isolation fixture (G3). Present ONLY for adapters whose
+     * source declares `draftPublish: 'native' | 'bridged'` AND that wire a real
+     * draft layer; the isolation case skips itself when the capability is absent
+     * OR this fixture is missing (keeps draft-less targets green, mirroring the
+     * `create` skip). `writeDraft` performs one draft edit and reports where it
+     * landed: the PUBLISHED read (public viewer) MUST still see `publishedValue`
+     * (the draft is invisible — the isolation claim), while the DRAFT read
+     * (editor viewer) MUST see `draftValue`. Mutations are undone via `cleanup()`. */
+    readonly draftPublish?: {
+        writeDraft(): Promise<{
+            readonly instanceId: InstanceId;
+            readonly field: string;
+            /** What a PUBLISHED (public-viewer) read must still return — never the draft. */
+            readonly publishedValue: unknown;
+            /** What a DRAFT (editor-viewer) read must return — the pending edit. */
+            readonly draftValue: unknown;
+        }>;
+    };
+    /** Localization fixture (Wave 1, Task 4.1). Present ONLY when the adapter
+     * declares a strategy other than 'none'; the case skips (trivially passes)
+     * otherwise — and the proven-absent discipline applies: strategy 'none' +
+     * fixture present is a misdeclaration the case fails loudly. `locales` are two
+     * locales with KNOWN different values of `localizedField` on `instanceId`;
+     * `expected` is that field's value per locale (same list position). */
+    readonly localization?: {
+        readonly localizedField: string;
+        readonly locales: readonly [Locale, Locale];
+        readonly expected: readonly [unknown, unknown];
+        readonly instanceId: InstanceId;
+    };
+    /** Native-ACL fidelity fixture (decision 012 phase 4, delegation-fidelity leg).
+     * Present ONLY for targets declaring `acl.document: "native"`; the fidelity
+     * case skips it otherwise (projected targets — Strapi/local — legitimately
+     * grant a uniform base, so asserting a CMS-derived grant there would be wrong).
+     * `expectAllowed` names EXACTLY the Canvas actions the CMS grants `editor` on
+     * `contentTypeId`; permit's grant for each action must equal
+     * `expectAllowed.includes(action)`. Keep it a plain list — the denial-mapping
+     * detail is proven by the adapter's unit tests, not here. */
+    readonly nativeAcl?: {
+        readonly expectAllowed: readonly CanvasAction[];
+    };
+}
+export type TestFn = (name: string, fn: () => Promise<void> | void) => void;
+export type ExpectFn = (actual: unknown) => {
+    toBe(v: unknown): void;
+    toBeDefined(): void;
+    toBeUndefined(): void;
+    toEqual(v: unknown): void;
+    toBeGreaterThanOrEqual(n: number): void;
+    toContain(v: unknown): void;
+    not: {
+        toBe(v: unknown): void;
+        toContain(v: unknown): void;
+    };
+};
+/** The framework-agnostic hooks a case group needs (describe/test/expect). */
+export interface ConformanceHooks {
+    describe: (name: string, fn: () => void) => void;
+    test: TestFn;
+    expect: ExpectFn;
+}
+//# sourceMappingURL=target.d.ts.map

package/dist/content-source/conformance/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../../src/content-source/conformance/target.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;sFAEkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;4EAGwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,iFAAiF;IACjF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB;;;;;0DAKsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,aAAa,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC;KAC7E,CAAC;IAEF;;;;;;;sFAOkF;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,UAAU,IAAI,OAAO,CAAC;YACpB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;YAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,iFAAiF;YACjF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;YACjC,wEAAwE;YACxE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;SAC9B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;2EAKuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;KACjC,CAAC;IAEF;;;;;;;iEAO6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;KACjD,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC;AAC5E,MAAM,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK;IAC1C,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,WAAW,IAAI,IAAI,CAAC;IACpB,aAAa,IAAI,IAAI,CAAC;IACtB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,sBAAsB,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,GAAG,EAAE;QAAE,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9D,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;CAClB"}

package/dist/content-source/conformance/target.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=target.js.map

package/dist/content-source/conformance/target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.js","sourceRoot":"","sources":["../../../src/content-source/conformance/target.ts"],"names":[],"mappings":""}

package/dist/content-source/conformance-kit.d.ts

@@ -0,0 +1,4 @@
+import type { ConformanceHooks, ConformanceTarget } from "./conformance/target";
+export type { ConformanceTarget } from "./conformance/target";
+export declare function runConformanceKit(target: ConformanceTarget, hooks: ConformanceHooks): void;
+//# sourceMappingURL=conformance-kit.d.ts.map

package/dist/content-source/conformance-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance-kit.d.ts","sourceRoot":"","sources":["../../src/content-source/conformance-kit.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAkB1F"}

package/dist/content-source/conformance-kit.js

@@ -0,0 +1,41 @@
+/**
+ * THE adapter conformance kit (plan §7 + §8 Phase 6): one suite, every
+ * adapter. "Vendor-neutral" is proven by running THIS — same assertions
+ * against local, Payload, and Strapi (zero L0–L2 forks). Lives in host so
+ * adapters (L3) can import it without a lateral adapter→adapter edge.
+ *
+ * Framework-agnostic: takes describe/test/expect hooks so bun:test and any
+ * future runner can host it.
+ *
+ * A6 decomposition: the `ConformanceTarget` interface + hook types live in
+ * `./conformance/target`, and the (order-sensitive) case bodies live in
+ * `./conformance/cases-reads`, `-writes`, `-isolation`. This module is the thin
+ * assembler that wires the ONE `describe` and calls the case groups in the
+ * SAME order adapters snapshot/depend on. `ConformanceTarget` is re-exported so
+ * importers (adapter tests, the host barrel) stay unchanged.
+ */
+import { registerReadCases } from "./conformance/cases-reads.js";
+import { registerWriteCases } from "./conformance/cases-writes.js";
+import { registerPermissionCases } from "./conformance/cases-permissions.js";
+import { registerIsolationCases } from "./conformance/cases-isolation.js";
+import { registerDelegationCases } from "./conformance/cases-delegation.js";
+import { registerFidelityCases } from "./conformance/cases-fidelity.js";
+export function runConformanceKit(target, hooks) {
+    const { describe } = hooks;
+    describe(`conformance: ${target.name}`, () => {
+        // Registration order IS the case order the suite runs and adapters depend
+        // on: reads (capabilities/describe/restricted-field/pagination) → writes
+        // (CAS/create) → permissions (permit + hidden==refused
+        // agreement) → isolation (draft/publish G3) → delegation (auth.mode ===
+        // "delegated" only; a no-op for every ambient adapter today, last). The
+        // fidelity leg (valid session honored / CMS refusal surfaces / native-ACL
+        // grant match) runs after delegation, also delegated-only.
+        registerReadCases(target, hooks);
+        registerWriteCases(target, hooks);
+        registerPermissionCases(target, hooks);
+        registerIsolationCases(target, hooks);
+        registerDelegationCases(target, hooks);
+        registerFidelityCases(target, hooks);
+    });
+}
+//# sourceMappingURL=conformance-kit.js.map

package/dist/content-source/conformance-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance-kit.js","sourceRoot":"","sources":["../../src/content-source/conformance-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,MAAM,UAAU,iBAAiB,CAAC,MAAyB,EAAE,KAAuB;IAClF,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,QAAQ,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE;QAC3C,0EAA0E;QAC1E,yEAAyE;QACzE,uDAAuD;QACvD,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/content-source/content-source.d.ts

@@ -0,0 +1,153 @@
+/**
+ * The multi-CMS seam (decision 004 §1): EntityProvider (schema + ACLs) and
+ * ContentSource (instances + writes + capabilities). "Support CMS N" = a new
+ * adapter implementing these — zero edits to L0–L2.
+ */
+import type { ContentType, ContentTypeId, Instance, InstanceId, RepeaterQuery } from "@batterai/bind-core";
+import type { FieldAccess, Viewer } from "./viewer";
+import type { ActionGrants, PermissionSubject } from "./permissions";
+import type { FieldSchema } from "@batterai/bind-core";
+import type { ContentVersionToken, VersionedSubject } from "../lifecycle/version-token";
+export interface DescribedField {
+    readonly schema: FieldSchema;
+    readonly access: FieldAccess;
+}
+export interface DescribedContentType {
+    readonly contentType: ContentType;
+    /** Invariant E's output: a field the viewer can't read is ABSENT here —
+     * never present-but-flagged (existence must not leak). */
+    readonly readableFields: readonly DescribedField[];
+}
+export interface EntityProvider {
+    /** The Build tab's ONLY data source; published-vs-draft aware. */
+    describe(contentTypeId: ContentTypeId, viewer: Viewer): Promise<DescribedContentType>;
+}
+export interface InstancePage {
+    readonly items: readonly Instance[];
+    readonly cursor?: string;
+    readonly hasMore: boolean;
+}
+export type PushdownOp = "eq" | "neq" | "gt" | "lt" | "gte" | "lte" | "and" | "or";
+/** Quality axis for concurrency: strategy is metadata for host/conformance —
+ * consumers never branch on it. raceWindowMs is the DECLARED worst-case window
+ * in which two same-subject writes can interleave undetected: 0 for a real
+ * version token; > 0 for a timestamp bridge (Strapi updatedAt = 1000ms —
+ * second-resolution comparisons plus clock skew, declared not hidden). */
+export interface ConcurrencyCapability {
+    readonly strategy: "version-token" | "timestamp";
+    readonly raceWindowMs: number;
+}
+/** Access-control provenance per axis (decision 004 declared-fallback). */
+export interface AclCapability {
+    /** 'native' = the CMS's own access control answers permit(); 'projected' =
+     * the adapter derives grants from its own config (declared fallback). */
+    readonly document: "native" | "projected";
+    readonly field: "native" | "projected";
+}
+/** How the adapter authenticates to the CMS (decision 012 + 013).
+ *  - "delegated": authoring/write/preview operations run as the end user
+ *    carried in viewer.session. Read methods may also serve an explicit
+ *    public-delivery viewer with no Authorization header; a bare missing
+ *    session is still refused BEFORE any CMS I/O.
+ *  - "ambient": the adapter has its own ambient identity (in-memory/dev
+ *    harness); sessionless viewers are served. Real CMS adapters must be
+ *    "delegated" (decision 012). */
+export interface AuthCapability {
+    readonly mode: "delegated" | "ambient";
+}
+/** Adapters declare what they can do — gaps are BRIDGED or reported, never
+ * silently assumed (plan Phase 6/6.5 bridging as a first-class type). Consumers
+ * branch ONLY on presence (present/absent) and permission (allowed/denied);
+ * native-vs-bridged and the tolerance parameters are observability/conformance
+ * metadata, never a consumer switch (locked decision 2026-07-07 §1.3). */
+export interface AdapterCapabilities {
+    readonly concurrency: ConcurrencyCapability;
+    readonly pagination: {
+        readonly mode: "keyset" | "bridged-keyset";
+    };
+    readonly populate: {
+        readonly maxDepth: number;
+    };
+    readonly acl: AclCapability;
+    readonly auth: AuthCapability;
+    readonly draftPublish: {
+        readonly mode: "native" | "bridged" | "absent";
+    };
+    readonly localization: {
+        readonly strategy: "field-level" | "entry-level" | "none";
+    };
+    /** Enumerated ops the adapter can push down to its native query layer.
+     * Empty array = no pushdown (filter/sort correct per returned page only —
+     * the documented invariant-I tolerance). Replaces the old flat native|none flag. */
+    readonly pushdown: {
+        readonly ops: readonly PushdownOp[];
+    };
+    /** Create-on-first-write support (plan §2.6). 'native' = the adapter's CMS
+     * create path is wired; 'absent' = instance-less detail pages render
+     * read-only-with-reason at pre-focus time (I-5), never a save-time surprise.
+     * Declared, never assumed (decision 004: gaps are declared). */
+    readonly create: {
+        readonly mode: "native" | "absent";
+    };
+    /** Wave-2 axes, declared now so the vocabulary is closed and 'absent' is
+     * provable from day one (no adapter may omit them). */
+    readonly history: {
+        readonly mode: "native" | "absent";
+    };
+    readonly bulkWrite: {
+        readonly mode: "native" | "bridged" | "absent";
+    };
+    readonly preview: {
+        readonly mode: "native" | "absent";
+    };
+}
+export interface WriteResult {
+    readonly version: ContentVersionToken;
+}
+/** Result of createInstance (plan §2.6): the real instance id the record was
+ * created under, plus the CAS token so the editor session continues
+ * CAS-guarded against the created record (the draft->real instance swap). */
+export interface CreateResult {
+    readonly id: InstanceId;
+    readonly version: ContentVersionToken;
+}
+/** Canonical refusal for decision 012 delegated auth: thrown BEFORE any CMS
+ * I/O when `viewer.session` is absent or unusable. Adapters MAY throw this
+ * directly, or their own equivalent whose `name` the conformance kit
+ * recognizes as `"SessionRequired"`. Only meaningful for adapters declaring
+ * `capabilities.auth.mode === "delegated"`. */
+export declare class SessionRequired extends Error {
+    constructor();
+}
+export interface ContentSource {
+    readonly capabilities: AdapterCapabilities;
+    /** Host-decided per-viewer action grants (locked decision 2026-07-07 §1.2):
+     * Canvas renders an action iff capability AND permit agree; every mutation is
+     * re-checked at the adapter regardless (permit is discovery, not the gate).
+     * Decision 012 phase 2: battery-editor owns no tenancy/access clamp — permit
+     * reflects only the capability axis; the CMS is the sole access authority.
+     * Delegated adapters refuse a bare sessionless viewer before any I/O. Reason
+     * REQUIRED on every denial (invariant P). */
+    permit(subject: PermissionSubject, viewer: Viewer): Promise<ActionGrants>;
+    /** Cursor/keyset — never offset; stable under concurrent inserts. */
+    listInstances(contentTypeId: ContentTypeId, query: RepeaterQuery, cursor: string | undefined, viewer: Viewer): Promise<InstancePage>;
+    getInstance(contentTypeId: ContentTypeId, instanceId: InstanceId, viewer: Viewer): Promise<Instance | undefined>;
+    /** THE batched reference primitive: ONE call per (contentType) group per
+     * wave — never per-row I/O (invariant C; suite C counts these). */
+    getInstancesByIds(contentTypeId: ContentTypeId, instanceIds: readonly InstanceId[], viewer: Viewer): Promise<readonly Instance[]>;
+    /** Current version token for CAS reads (edit-session open). */
+    getVersion(subject: VersionedSubject, viewer: Viewer): Promise<ContentVersionToken | undefined>;
+    /** Field write with CAS precondition per capabilities.concurrency. Adapters throw
+     * their own stale/authz errors; the host wraps them (decision 004 §5.3). */
+    writeInstanceField(contentTypeId: ContentTypeId, instanceId: InstanceId, field: string, value: unknown, expectedVersion: ContentVersionToken | undefined, viewer: Viewer): Promise<WriteResult>;
+    /** Create a NEW instance (plan §2.6): the first commit on an instance-less
+     * detail page. `initialValues` are merged OVER the content type's schema
+     * defaults (FieldSchema.defaultValue). Returns the real id + version so the
+     * host swaps the real instance into the page-entity frame and continues the
+     * session CAS-guarded. Only meaningful when capabilities.create.mode === 'native';
+     * a 'none' adapter degrades to read-only-with-reason before this is ever
+     * reached (I-5) and OMITS this method entirely (optional); the host and
+     * conformance kit null-check before calling. */
+    createInstance?(contentTypeId: ContentTypeId, initialValues: Readonly<Record<string, unknown>>, viewer: Viewer): Promise<CreateResult>;
+}
+//# sourceMappingURL=content-source.d.ts.map

package/dist/content-source/content-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-source.d.ts","sourceRoot":"","sources":["../../src/content-source/content-source.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,QAAQ,EACR,UAAU,EACV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAExF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;8DAC0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;AAEnF;;;;0EAI0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,WAAW,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B;6EACyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CAAC;CACxC;AAED;;;;;;;oCAOoC;AACpC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;CACxC;AAED;;;;0EAI0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,CAAA;KAAE,CAAC;IACpE,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa,GAAG,MAAM,CAAA;KAAE,CAAC;IACrF;;wFAEoF;IACpF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,CAAC;IAC3D;;;oEAGgE;IAChE,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;IACxD;2DACuD;IACvD,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;IACzD,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;KAAE,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;;6EAE6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;CACvC;AAED;;;;+CAI+C;AAC/C,qBAAa,eAAgB,SAAQ,KAAK;;CAKzC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAE3C;;;;;;iDAM6C;IAC7C,MAAM,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1E,qEAAqE;IACrE,aAAa,CACX,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzB,WAAW,CACT,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAEjC;uEACmE;IACnE,iBAAiB,CACf,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAEhG;gFAC4E;IAC5E,kBAAkB,CAChB,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,OAAO,EACd,eAAe,EAAE,mBAAmB,GAAG,SAAS,EAChD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;;;;oDAOgD;IAChD,cAAc,CAAC,CACb,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAChD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1B"}

package/dist/content-source/content-source.js

@@ -0,0 +1,12 @@
+/** Canonical refusal for decision 012 delegated auth: thrown BEFORE any CMS
+ * I/O when `viewer.session` is absent or unusable. Adapters MAY throw this
+ * directly, or their own equivalent whose `name` the conformance kit
+ * recognizes as `"SessionRequired"`. Only meaningful for adapters declaring
+ * `capabilities.auth.mode === "delegated"`. */
+export class SessionRequired extends Error {
+    constructor() {
+        super("viewer.session is required for delegated-auth adapters");
+        this.name = "SessionRequired";
+    }
+}
+//# sourceMappingURL=content-source.js.map

package/dist/content-source/content-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-source.js","sourceRoot":"","sources":["../../src/content-source/content-source.ts"],"names":[],"mappings":"AAiHA;;;;+CAI+C;AAC/C,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC;QACE,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF"}

package/dist/content-source/permissions.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Permission-discovery surface (locked decision 2026-07-07 §1.2): two axes gate
+ * every Canvas action — capability (can this host do X at all) × permission (may
+ * THIS viewer do X now). `permit` answers the permission axis per-request; the
+ * host re-checks every mutation regardless (permit is discovery, not the gate).
+ * Neutral core — the descriptor types + the shared grant math live here in host
+ * (L2); native/projected behavior lives in the adapters (L3).
+ */
+import type { ContentTypeId, InstanceId } from "@batterai/bind-core";
+export type CanvasAction = "read" | "update" | "create" | "delete" | "publish";
+/** Invariant-P shape: reason REQUIRED when !allowed — Canvas hides the action
+ * and can explain why; a bare false is a conformance failure. */
+export interface ActionGrant {
+    readonly allowed: boolean;
+    readonly reason?: string;
+}
+export type ActionGrants = Readonly<Record<CanvasAction, ActionGrant>>;
+/** instanceId absent = type-level question (create, list). */
+export interface PermissionSubject {
+    readonly contentTypeId: ContentTypeId;
+    readonly instanceId?: InstanceId;
+}
+export declare const CANVAS_ACTIONS: readonly CanvasAction[];
+/**
+ * Shared grant math so the three adapters don't fork the same capability-
+ * coupling rules (§2.2). An adapter computes its NATIVE or PROJECTED base
+ * grants, then this clamps them by the capability invariants every host must
+ * satisfy:
+ *  - an absent `create` capability forces `create` denied-with-reason;
+ *  - an absent `draftPublish` capability forces `publish` denied-with-reason.
+ *
+ * Decision 012 phase 2: the viewer-kind (public) clamp is GONE. battery-editor
+ * is not a second authority — every request carries a delegated CMS session
+ * (delegated adapters refuse sessionless before I/O; that stays) and the CMS
+ * decides what that session may write. We only reflect what the host can do at
+ * all (the capability axis). Pure function — trivially testable without I/O.
+ */
+export declare function clampGrants(base: ActionGrants, capabilities: {
+    readonly create: {
+        readonly mode: "native" | "absent";
+    };
+    readonly draftPublish: {
+        readonly mode: "native" | "bridged" | "absent";
+    };
+}): ActionGrants;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/content-source/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/content-source/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/E;iEACiE;AACjE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvE,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAMjD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,YAAY,EAAE;IACZ,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;KAAE,CAAC;CAC3E,GACA,YAAY,CAUd"}

package/dist/content-source/permissions.js

@@ -0,0 +1,33 @@
+export const CANVAS_ACTIONS = [
+    "read",
+    "update",
+    "create",
+    "delete",
+    "publish",
+];
+/**
+ * Shared grant math so the three adapters don't fork the same capability-
+ * coupling rules (§2.2). An adapter computes its NATIVE or PROJECTED base
+ * grants, then this clamps them by the capability invariants every host must
+ * satisfy:
+ *  - an absent `create` capability forces `create` denied-with-reason;
+ *  - an absent `draftPublish` capability forces `publish` denied-with-reason.
+ *
+ * Decision 012 phase 2: the viewer-kind (public) clamp is GONE. battery-editor
+ * is not a second authority — every request carries a delegated CMS session
+ * (delegated adapters refuse sessionless before I/O; that stays) and the CMS
+ * decides what that session may write. We only reflect what the host can do at
+ * all (the capability axis). Pure function — trivially testable without I/O.
+ */
+export function clampGrants(base, capabilities) {
+    const deny = (reason) => ({ allowed: false, reason });
+    const grants = { ...base };
+    if (capabilities.create.mode === "absent") {
+        grants.create = deny("create is not supported by this host");
+    }
+    if (capabilities.draftPublish.mode === "absent") {
+        grants.publish = deny("draft/publish is not supported by this host");
+    }
+    return grants;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/content-source/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/content-source/permissions.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;CACV,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,IAAkB,EAClB,YAGC;IAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3B,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,YAAY,CAAC,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}