@brianmsm/quarto-bento 0.1.0 → 0.1.1

package/README.md

@@ -6,7 +6,7 @@ Studio, reviewed QMD synchronization and an offline standalone Bento HTML
 output.
 
 This npm CLI package is named `@brianmsm/quarto-bento` and currently targets
-**Linux only**. Version `0.1.0` is a development release, not a stable v1.
+**Linux only**. Version `0.1.1` is a development release, not a stable v1.
 
 ## Requirements
 
@@ -26,7 +26,7 @@ executable code you trust.
 With Node, Deno and Quarto already installed, install the pinned CLI version:
 
 ```sh
-npm install --global --ignore-scripts @brianmsm/quarto-bento@0.1.0
+npm install -g @brianmsm/quarto-bento@0.1.1
 qbento --version
 qbento doctor
 ```
@@ -34,8 +34,8 @@ qbento doctor
 If your npm global prefix is not writable, use a user-owned prefix instead:
 
 ```sh
-npm install --global --ignore-scripts --prefix "$HOME/.local" \
-  @brianmsm/quarto-bento@0.1.0
+npm install -g --prefix "$HOME/.local" \
+  @brianmsm/quarto-bento@0.1.1
 export PATH="$HOME/.local/bin:$PATH"
 ```
 
@@ -45,10 +45,17 @@ Mise can manage Node, Deno and the npm CLI together. Quarto remains a separate
 user-installed dependency:
 
 ```sh
-mise use -g node@26.10.0 deno@2.9.6 npm:@brianmsm/quarto-bento@0.1.0
+mise use -g node@26.10.0 deno@2.9.6 \
+  'npm:@brianmsm/quarto-bento[allow_low_downloads=true]@0.1.1'
 qbento doctor
 ```
 
+Recent mise versions require explicit approval for new or low-download packages.
+`allow_low_downloads=true` approves only this package after checking its name
+and publisher; it does not enable build scripts or change global security
+settings. See
+[mise npm reputation checks](https://mise.jdx.dev/dev-tools/backends/npm#low-download-and-new-packages).
+
 The package has no npm install hooks or JavaScript package dependencies. The
 [installation guide](https://github.com/brianmsm/quarto-bento/blob/main/docs/NPM.md)
 also covers local tarball installation, requirements and supported scope.

package/distribution/PACKAGING.md

@@ -54,6 +54,6 @@ The full source checkout contains development, acceptance and CI documentation.
 Those source-only files and verification artifacts are not part of this portable
 directory. The separate
 [npm CLI package](https://github.com/brianmsm/quarto-bento/blob/main/docs/NPM.md)
-wraps the portable runtime with a `qbento` launcher for local prefix
-installation; its registry publication and mise-based registry installation are
-still pending.
+wraps the portable runtime with a `qbento` launcher. Version `0.1.0` is
+available for Linux through npm and mise; see that guide for installation
+commands and external Node, Deno and Quarto requirements.

package/distribution/manifest.json

@@ -3,7 +3,7 @@
   "kind": "development-portable",
   "qbentoSource": {
     "kind": "git",
-    "commit": "05e70bbefebad5f540083bba25444dda0caef0d8",
+    "commit": "281d90bcfbbf003c4b7547fe7522c0f22cd7d151",
     "dirty": false
   },
   "bento": {
@@ -22,8 +22,8 @@
     },
     {
       "path": "PACKAGING.md",
-      "bytes": 3378,
-      "sha256": "1b493f5a9e9911f37babdc3011d3dc31be9518acbb611427073158e62515e8a8",
+      "bytes": 3418,
+      "sha256": "715fd578bd128109feb5c173a4cf2def56f5dafae90a9f40e597dfc2a991d1a2",
       "executable": false
     },
     {
@@ -100,14 +100,14 @@
     },
     {
       "path": "runtime/src/cli.ts",
-      "bytes": 7860,
-      "sha256": "2c7d208b6d0433f1bfac734b6ccc13ccbef9148563ed7052415c9f2fe7df4a25",
+      "bytes": 8288,
+      "sha256": "8228662370e715dc1f8a0a35557534494bb9ae6aa5199a620116531cc5717ff1",
       "executable": false
     },
     {
       "path": "runtime/src/core/agent.ts",
-      "bytes": 18163,
-      "sha256": "c0064079521e2f3644f774eb41e40c3c5bf7a6e0b09e263900e5d7d94b89b83d",
+      "bytes": 17613,
+      "sha256": "4c0052728393470b44b651a473dd62640a3d6f7fc69ff30bec73f4a2fa97b430",
       "executable": false
     },
     {
@@ -190,8 +190,8 @@
     },
     {
       "path": "runtime/src/core/project.ts",
-      "bytes": 25362,
-      "sha256": "d76c2d968929770e6e20b556eb1d66eb3382b7e70f68fb5af50876a645cddaae",
+      "bytes": 28033,
+      "sha256": "14c9f362149fdab17fd77c6b0f2f799595fb0b6ab5b32133fc9484092b15f7a8",
       "executable": false
     },
     {
@@ -220,8 +220,8 @@
     },
     {
       "path": "runtime/src/core/sync.ts",
-      "bytes": 84614,
-      "sha256": "0536e9e53719d859bbd551ff1a77daf2fb26c8c479ef98f0e6e5f065e1eb6b38",
+      "bytes": 89455,
+      "sha256": "96d2f32d2cebe259bb973d7ed7affb8b5fb5a5662b89f37e106c7415d60a98aa",
       "executable": false
     },
     {
@@ -580,8 +580,8 @@
     },
     {
       "path": "runtime/src/studio/client.js",
-      "bytes": 26480,
-      "sha256": "8513fcac98f8289b086d5d8d493a01dfd11c82c8063e9b1e164b74f252d3d651",
+      "bytes": 30201,
+      "sha256": "b8332ae52fa538fd41356fdc47d96b7391701ee64c57388ab7edc96ccc61a3da",
       "executable": false
     },
     {
@@ -592,8 +592,8 @@
     },
     {
       "path": "runtime/src/studio/index.html",
-      "bytes": 11633,
-      "sha256": "9904a23f2c04dda243b3cc67b1be135160aa19cc0e6abaea586a52078f5cb821",
+      "bytes": 11979,
+      "sha256": "18196400f39939f2fc4fb773bbba39355558d6b375ba2c7815f423e8dcb5e38d",
       "executable": false
     },
     {
@@ -616,8 +616,8 @@
     },
     {
       "path": "runtime/src/studio/server.ts",
-      "bytes": 16113,
-      "sha256": "2eb1a146f4dfc9e2006ac93a3e9779da8dd4d1135d522c751f655128a00eafdc",
+      "bytes": 17070,
+      "sha256": "ea54191f6d8c453de2ac5193dc388ec98933c42e6948a371cf6d17f70e091f25",
       "executable": false
     },
     {

package/distribution/runtime/src/cli.ts

@@ -1,6 +1,11 @@
 #!/usr/bin/env -S deno run --allow-read --allow-write --allow-run --allow-env --allow-net=127.0.0.1
 import { captureProject, readProject, renderProject } from "./core/project.ts";
-import { applySync, previewSync } from "./core/sync.ts";
+import {
+  applySync,
+  previewSelectedSync,
+  previewSync,
+  readSyncSelectionFile,
+} from "./core/sync.ts";
 import { recoverProject } from "./core/recovery.ts";
 import { extractDocument } from "./render/html.ts";
 import { startStudio } from "./studio/server.ts";
@@ -20,7 +25,7 @@ capture [edited.html]   Explicitly capture native local HTML edits
 status | diff          Inspect durable pending changes
 get                    Read the saved deck, revision, provenance and pending edits
 patch <payload.json>   Apply bounded structured edits to saved state; never writes QMD
-sync [--apply plan.json] Preview source changes or apply an inspected plan
+sync [--select selection.json | --apply plan.json] Preview all/selected source changes or apply an inspected plan
 reconcile [--apply resolution.json] Execute conflict preview, or apply {plan,choices} to saved state
 recover [inspect|finish|rollback] Inspect or explicitly recover an interrupted operation
 init [--extension-only] Install the offline Quarto integration without replacing existing configuration
@@ -86,16 +91,23 @@ if (import.meta.main) {
       }
       case "sync": {
         if (!source) throw new Error("QMD path required");
-        if (extra === "--apply") {
-          if (!Deno.args[3]) {
-            throw new Error("Inspected JSON plan path required");
-          }
+        if (extra === "--apply" && Deno.args[3] && Deno.args.length === 4) {
           result = await applySync(
             source,
             JSON.parse(await Deno.readTextFile(Deno.args[3])),
           );
-        } else if (extra === undefined) result = await previewSync(source);
-        else throw new Error("Use sync source.qmd [--apply plan.json]");
+        } else if (
+          extra === "--select" && Deno.args[3] && Deno.args.length === 4
+        ) {
+          result = await previewSelectedSync(
+            source,
+            await readSyncSelectionFile(Deno.args[3]),
+          );
+        } else if (extra === undefined && Deno.args.length === 2) {
+          result = await previewSync(source);
+        } else {throw new Error(
+            "Use sync source.qmd [--select selection.json | --apply plan.json]",
+          );}
         break;
       }
       case "recover": {
@@ -165,7 +177,8 @@ if (import.meta.main) {
         } catch (error) {
           if (
             !(error instanceof Error) ||
-            !error.message.startsWith("NO_BASELINE:")
+            ((error as { code?: string }).code !== "NO_BASELINE" &&
+              !error.message.startsWith("NO_BASELINE:"))
           ) throw error;
           await renderProject(source);
         }

package/distribution/runtime/src/core/agent.ts

@@ -1,6 +1,5 @@
 /** Bounded pure-data agent operations over the same saved project as Studio. */
 import { normalizeNotesText, notesIdentity } from "../source/notes.ts";
-import { basename, join } from "node:path";
 import { projectPaths, readProject, saveProject } from "./project.ts";
 import { applySlideAction } from "./slide-actions.ts";
 import { assertJson } from "../state/json.ts";
@@ -253,26 +252,8 @@ function validatePatch(value: unknown): asserts value is AgentPatch {
   }
 }
 
-/** Refuse reading another QMD's deck from a shared directory. */
+/** Validate agent data after the shared read-only source binding check. */
 async function readBoundProject(source: string) {
-  const paths = projectPaths(source);
-  let binding;
-  try {
-    binding = JSON.parse(
-      await Deno.readTextFile(join(paths.stateDir, "project.json")),
-    );
-  } catch (error) {
-    if (error instanceof Deno.errors.NotFound) {
-      fail("NO_BASELINE", "Render this QMD before using the agent API.");
-    }
-    throw error;
-  }
-  if (binding?.version !== 1 || binding.source !== basename(paths.source)) {
-    fail(
-      "PROJECT_SOURCE_MISMATCH",
-      ".qbento belongs to a different QMD source.",
-    );
-  }
   const state = await readProject(source);
   assertProjectDocument(state.emitted);
   return state;

package/distribution/runtime/src/core/project.ts

@@ -89,6 +89,88 @@ async function exists(path: string) {
     throw e;
   }
 }
+/** Check persisted source identity without creating state, locks or recovery files. */
+async function readProjectBinding(
+  paths: ReturnType<typeof projectPaths>,
+): Promise<boolean> {
+  let stateInfo;
+  try {
+    stateInfo = await Deno.lstat(paths.stateDir);
+  } catch (error) {
+    if (error instanceof Deno.errors.NotFound) return false;
+    throw error;
+  }
+  if (stateInfo.isSymlink || !stateInfo.isDirectory) {
+    throw new StateError(
+      "UNSAFE_STATE_PATH",
+      ".qbento must be a real directory.",
+    );
+  }
+  const identity = resolve(paths.stateDir, "project.json");
+  let info;
+  try {
+    info = await Deno.lstat(identity);
+  } catch (error) {
+    if (error instanceof Deno.errors.NotFound) {
+      // Missing identity is not a new project when durable or recoverable state
+      // remains. In particular, `edit` must never adopt it for another QMD.
+      for (
+        const file of [
+          "state.json",
+          "state.previous.json",
+          "render-transaction.json",
+          "sync-transaction.json",
+          "sync-approved.json",
+        ]
+      ) {
+        if (await exists(resolve(paths.stateDir, file))) {
+          throw new StateError(
+            "PROJECT_BINDING_MISSING",
+            "Saved project state has no source binding. Restore .qbento/project.json from the matching project backup before continuing.",
+          );
+        }
+      }
+      return false;
+    }
+    throw error;
+  }
+  if (info.isSymlink || !info.isFile) {
+    throw new StateError(
+      "UNSAFE_STATE_PATH",
+      ".qbento/project.json must be a regular file.",
+    );
+  }
+  let binding;
+  try {
+    binding = JSON.parse(await Deno.readTextFile(identity));
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error;
+    throw new StateError(
+      "PROJECT_SOURCE_MISMATCH",
+      "Cannot verify .qbento source identity: project.json is invalid JSON.",
+    );
+  }
+  if (binding?.version !== 1 || binding.source !== basename(paths.source)) {
+    throw new StateError(
+      "PROJECT_SOURCE_MISMATCH",
+      ".qbento belongs to a different QMD source.",
+    );
+  }
+  return true;
+}
+
+/** Require a verified binding before exposing an existing saved project. */
+export async function assertProjectBinding(source: string) {
+  const paths = projectPaths(source);
+  if (!await readProjectBinding(paths)) {
+    throw new StateError(
+      "NO_BASELINE",
+      "Render this QMD before reading its project.",
+    );
+  }
+  return paths;
+}
+
 export async function withProject<T>(
   source: string,
   action: (
@@ -97,6 +179,9 @@ export async function withProject<T>(
   ) => Promise<T>,
 ): Promise<T> {
   const paths = projectPaths(source);
+  // Fail closed before creating even a lock when identity was lost. Recheck
+  // under the operation lock below to retain protection against concurrent edits.
+  await readProjectBinding(paths);
   await Deno.mkdir(paths.stateDir, { recursive: true });
   const stateInfo = await Deno.lstat(paths.stateDir);
   if (stateInfo.isSymlink || !stateInfo.isDirectory) {
@@ -122,23 +207,17 @@ export async function withProject<T>(
         started: new Date().toISOString(),
       }),
     );
-    const identity = resolve(paths.stateDir, "project.json");
-    if (await exists(identity)) {
-      const meta = JSON.parse(await Deno.readTextFile(identity));
-      if (meta.version !== 1 || meta.source !== basename(paths.source)) {
-        throw new Error(
-          "PROJECT_SOURCE_MISMATCH: .qbento belongs to a different source",
-        );
-      }
-    } else {await Deno.writeTextFile(
-        identity,
+    if (!await readProjectBinding(paths)) {
+      await Deno.writeTextFile(
+        resolve(paths.stateDir, "project.json"),
         JSON.stringify(
           { version: 1, source: basename(paths.source) },
           null,
           2,
         ) + "\n",
         { createNew: true },
-      );}
+      );
+    }
     if (await exists(resolve(paths.stateDir, "render-transaction.json"))) {
       throw new Error(
         "RECOVERY_REQUIRED: inspect the interrupted render transaction before continuing",
@@ -715,8 +794,14 @@ export async function saveProject(
   });
 }
 export async function readProject(source: string): Promise<ProjectState> {
-  const state = await new StateStore(projectPaths(source).stateDir).load();
-  if (!state) throw new Error("NO_BASELINE: render this project first");
+  const paths = await assertProjectBinding(source);
+  const state = await new StateStore(paths.stateDir).load();
+  if (!state) {
+    throw new StateError(
+      "NO_BASELINE",
+      "Render this QMD before reading its project.",
+    );
+  }
   return state;
 }
 
@@ -725,7 +810,14 @@ export async function readProjectDiagnostics(
   source: string,
 ): Promise<Diagnostic[]> {
   const paths = projectPaths(source);
+  const bound = await readProjectBinding(paths);
   const state = await new StateStore(paths.stateDir).load();
+  if (state && !bound) {
+    throw new StateError(
+      "NO_BASELINE",
+      "Restore the source binding before reading saved diagnostics.",
+    );
+  }
   const registry = await loadDesignRegistry(paths.directory);
   const mapping = scanSource(await Deno.readTextFile(paths.source));
   const designDiagnostics = missingDesignDiagnostics(mapping, state, registry);

package/distribution/runtime/src/core/sync.ts

@@ -59,7 +59,7 @@ import {
 /** Approved bounded text synchronization with a durable, recoverable QMD transaction. */
 import { verifiedSourceSlide } from "./source-scope.ts";
 import { basename, dirname, resolve } from "node:path";
-import { projectPaths, withProject } from "./project.ts";
+import { assertProjectBinding, projectPaths, withProject } from "./project.ts";
 import {
   canonical,
   clone,
@@ -218,6 +218,14 @@ export interface SyncApprovalEnvelope {
 export interface SyncOptions {
   confirmedDeleteIds?: string[];
 }
+/** A reviewed selection is bound to one saved document revision. */
+export interface SyncSelection {
+  version: 1;
+  docId: string;
+  expectedRevision: number;
+  selectedChangeIds: string[];
+  confirmedDeleteIds?: string[];
+}
 export interface SyncItem {
   changeId: string;
   target: Change["target"];
@@ -968,6 +976,28 @@ async function buildPlan(
     }
     return p;
   });
+  // Fresh execution retires all pending content beneath an approved deletion.
+  // A selective plan must never label that content as excluded and then lose it.
+  const selectedIds = new Set(ids);
+  for (const deletion of selected) {
+    if (!["delete-slide", "delete-element"].includes(deletion.kind)) continue;
+    const required = state.pending.filter((pending) =>
+      !selectedIds.has(pending.id) &&
+      pending.target.slideId === deletion.target.slideId &&
+      (deletion.kind === "delete-slide" ||
+        pending.target.elementId === deletion.target.elementId)
+    );
+    if (required.length) {
+      fail(
+        "PARTIAL_DELETE_SELECTION",
+        `Deleting this ${
+          deletion.kind === "delete-slide" ? "slide" : "element"
+        } would retire unselected pending edits. Select those edits together with the deletion, or restore/review them before deleting. Required additional change IDs: ${
+          JSON.stringify(required.map((pending) => pending.id))
+        }`,
+      );
+    }
+  }
   if (
     selected.some((change) =>
       change.kind === "delete-element" &&
@@ -2069,6 +2099,7 @@ async function readableSnapshot(source: string) {
   const paths = projectPaths(source);
   await safeDirectory(paths.stateDir);
   await regular(paths.source);
+  await assertProjectBinding(source);
   for (
     const name of [
       "operation.lock",
@@ -2084,17 +2115,6 @@ async function readableSnapshot(source: string) {
       );
     }
   }
-  const identity = resolve(paths.stateDir, "project.json");
-  if (await present(identity)) {
-    await regular(identity);
-    const value = JSON.parse(await Deno.readTextFile(identity));
-    if (value.version !== 1 || value.source !== basename(paths.source)) {
-      fail(
-        "PROJECT_SOURCE_MISMATCH",
-        "This .qbento state belongs to another source.",
-      );
-    }
-  }
   const store = new StateStore(paths.stateDir), state = await store.load();
   if (!state) {
     fail("NO_BASELINE", "Render and save the project before synchronizing.");
@@ -2121,6 +2141,120 @@ export async function previewSync(
   const { paths, state, text } = await readableSnapshot(source);
   return buildPlan(paths.source, text, state, selectedChangeIds, options);
 }
+const MAX_SYNC_SELECTION_BYTES = 1024 * 1024;
+function validateSyncSelection(value: unknown): asserts value is SyncSelection {
+  if (
+    typeof value !== "object" || value === null || Array.isArray(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value))
+  ) fail("INVALID_SELECTION", "Expected a sync selection object.");
+  const request = value as Record<string, unknown>;
+  const allowed = [
+    "version",
+    "docId",
+    "expectedRevision",
+    "selectedChangeIds",
+    "confirmedDeleteIds",
+  ];
+  const identity = (id: unknown): id is string =>
+    typeof id === "string" && id.length > 0 && id.length <= 4096 &&
+    id.trim() === id &&
+    Array.from(id).every((character) => {
+      const code = character.charCodeAt(0);
+      return code >= 32 && code !== 127;
+    });
+  const ids = (list: unknown): list is string[] =>
+    Array.isArray(list) && list.length <= 10000 && list.every(identity) &&
+    new Set(list).size === list.length;
+  if (
+    Object.keys(request).some((key) => !allowed.includes(key)) ||
+    request.version !== 1 || !identity(request.docId) ||
+    !Number.isSafeInteger(request.expectedRevision) ||
+    (request.expectedRevision as number) < 0 ||
+    !ids(request.selectedChangeIds) ||
+    (request.confirmedDeleteIds !== undefined &&
+      !ids(request.confirmedDeleteIds))
+  ) {
+    fail(
+      "INVALID_SELECTION",
+      "Expected version 1, docId, a nonnegative expectedRevision and unique selectedChangeIds; only confirmedDeleteIds is optional.",
+    );
+  }
+  if (
+    new TextEncoder().encode(JSON.stringify(request)).length >
+      MAX_SYNC_SELECTION_BYTES
+  ) {
+    fail("SYNC_INPUT_TOO_LARGE", "Selection exceeds the 1 MiB limit.");
+  }
+}
+/** Read-only public preview; selection never bypasses normal source/plan checks. */
+export async function previewSelectedSync(
+  source: string,
+  request: unknown,
+): Promise<SyncPlan> {
+  validateSyncSelection(request);
+  const { paths, state, text } = await readableSnapshot(source);
+  if (state.docId !== request.docId) {
+    fail(
+      "UNRELATED_DOCUMENT",
+      "Get the current document before selecting changes.",
+    );
+  }
+  if (state.revision !== request.expectedRevision) {
+    fail("STALE_REVISION", "Get the current deck before selecting changes.");
+  }
+  return buildPlan(paths.source, text, state, request.selectedChangeIds, {
+    confirmedDeleteIds: request.confirmedDeleteIds,
+  });
+}
+/** Bounded UTF-8 JSON input; refuses links and nonregular files before opening. */
+export async function readSyncSelectionFile(path: string): Promise<unknown> {
+  const info = await Deno.lstat(path);
+  if (!info.isFile || info.isSymlink) {
+    fail(
+      "SYNC_INPUT_FILE",
+      "Selection input must be a regular JSON file, not a symlink.",
+    );
+  }
+  const file = await Deno.open(path, { read: true });
+  try {
+    const opened = await file.stat();
+    if (!opened.isFile) {
+      fail("SYNC_INPUT_FILE", "Selection input must be a regular JSON file.");
+    }
+    if (opened.size > MAX_SYNC_SELECTION_BYTES) {
+      fail("SYNC_INPUT_TOO_LARGE", "Selection exceeds the 1 MiB limit.");
+    }
+    const chunks: Uint8Array[] = [];
+    let size = 0;
+    while (true) {
+      const chunk = new Uint8Array(16 * 1024), read = await file.read(chunk);
+      if (read === null) break;
+      size += read;
+      if (size > MAX_SYNC_SELECTION_BYTES) {
+        fail("SYNC_INPUT_TOO_LARGE", "Selection exceeds the 1 MiB limit.");
+      }
+      chunks.push(chunk.subarray(0, read));
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.length;
+    }
+    try {
+      return JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      );
+    } catch {
+      fail(
+        "SYNC_INVALID_JSON",
+        "Selection input must contain valid UTF-8 JSON.",
+      );
+    }
+  } finally {
+    file.close();
+  }
+}
 /** Explicit approved action; leaves pending semantic edits until a future render confirms them. */
 export async function applySync(
   source: string,

package/distribution/runtime/src/studio/client.js

@@ -8,6 +8,7 @@ let state, bridge, syncPlan, reconcilePlan, busy = false, previewGeneration = 0;
 let diagnosticGeneration = 0, projectDiagnostics = [], renderDiagnostics = [];
 let renderDiagnosticSnapshot;
 let connectedApi, connectedSnapshot;
+let syncReviewSnapshot, syncPlanSelection;
 async function api(path, body) {
   const response = await fetch("/api/" + path, {
     method: body === undefined ? "GET" : "POST",
@@ -293,7 +294,10 @@ function showPatches(plan) {
     section.append(title, message);
     $("patches").append(section);
   }
-  if (plan.structure || plan.identities || plan.graphs || plan.languages) {
+  if (
+    plan.structure || plan.identities || plan.graphs || plan.languages ||
+    plan.attributes || plan.notes || plan.annotations?.patches.length
+  ) {
     const section = document.createElement("section"),
       title = document.createElement("h3"),
       result = document.createElement("pre");
@@ -303,35 +307,103 @@ function showPatches(plan) {
     $("patches").append(section);
   }
 }
+function syncChangeLabel(change) {
+  const kinds = {
+    "delete-element": "Eliminar elemento",
+    "delete-slide": "Eliminar diapositiva",
+    "create-element": "Crear elemento",
+    "create-slide": "Crear diapositiva",
+    "slide-order": "Orden de diapositivas",
+  };
+  const fields = {
+    html: "Texto",
+    notes: "Notas",
+    content: "Contenido",
+    grammarName: "Lenguaje del código",
+  };
+  const property = change.path.join(".");
+  const action = kinds[change.kind] || fields[property] || property || "Cambio";
+  return `${change.target.slideId || "Presentación"}${
+    change.target.elementId ? " · " + change.target.elementId : ""
+  } · ${action}`;
+}
+function currentSyncSelection() {
+  return [...$("sync-selection").querySelectorAll("input")]
+    .filter((box) => box.checked).map((box) => box.dataset.change);
+}
+function sameSyncSelection(left, right) {
+  return left.length === right.length && left.every((id) => right.includes(id));
+}
+function requiredSyncDeleteBoxes(selected) {
+  return [...$("delete-confirmations").querySelectorAll("input")].filter(
+    (box) => {
+      const required = !syncReviewSnapshot ||
+        selected.includes(box.dataset.change);
+      box.disabled = !required;
+      return required;
+    },
+  );
+}
 async function prepareSyncPreview() {
   if (busy) return;
   const generation = ++previewGeneration;
   syncPlan = undefined;
   $("apply").disabled = true;
   $("patches").replaceChildren();
-  const boxes = [...$("delete-confirmations").querySelectorAll("input")];
+  const selected = currentSyncSelection();
+  if (syncReviewSnapshot) {
+    const excluded = syncReviewSnapshot.pending.filter((change) =>
+      !selected.includes(change.id)
+    );
+    $("sync-selection-summary").textContent =
+      `${selected.length} seleccionados; ${excluded.length} excluidos y conservados pendientes.` +
+      (excluded.length
+        ? ` Excluidos: ${excluded.map(syncChangeLabel).join("; ")}.`
+        : "");
+  }
+  const boxes = requiredSyncDeleteBoxes(selected);
   if (boxes.some((box) => !box.checked)) {
     $("sync-note").textContent =
-      "Confirma cada eliminación para preparar la propuesta. Puedes restaurar elementos desde Comparar con QMD y diapositivas desde Diapositivas.";
+      "Confirma cada eliminación seleccionada para preparar la propuesta o exclúyela. Puedes restaurar elementos desde Comparar con QMD y diapositivas desde Diapositivas.";
     return;
   }
   $("sync-note").textContent = "Preparando los cambios propuestos…";
   try {
     const plan = await api("sync/preview", {
-      confirmedDeleteIds: boxes.map((box) => box.dataset.change),
+      ...(syncReviewSnapshot
+        ? {
+          version: 1,
+          docId: syncReviewSnapshot.docId,
+          expectedRevision: syncReviewSnapshot.revision,
+          selectedChangeIds: selected,
+        }
+        : {}),
+      confirmedDeleteIds: boxes.filter((box) => box.checked)
+        .map((box) => box.dataset.change),
     });
     if (generation !== previewGeneration) return;
-    if (plan.stateRevision !== state.revision) {
+    if (
+      plan.stateRevision !== state.revision ||
+      (syncReviewSnapshot && syncReviewSnapshot.docId !== state.docId)
+    ) {
       throw new Error(
         "El proyecto cambió mientras se preparaba la revisión. Recarga antes de sincronizar.",
       );
     }
+    if (
+      syncReviewSnapshot && !sameSyncSelection(plan.selectedChangeIds, selected)
+    ) {
+      throw new Error(
+        "La propuesta no coincide con la selección revisada. Prepara una revisión nueva.",
+      );
+    }
     syncPlan = plan;
+    syncPlanSelection = selected;
     showPatches(syncPlan);
     const hasChanges = syncPlan.patch.patches.length ||
       syncPlan.identities?.patches.length ||
       syncPlan.attributes?.patches.length || syncPlan.notes?.patches.length ||
-      syncPlan.graphs?.patches.length ||
+      syncPlan.languages?.patches.length || syncPlan.graphs?.patches.length ||
       syncPlan.annotations?.patches.length ||
       syncPlan.structure;
     $("sync-note").textContent = hasChanges
@@ -356,9 +428,25 @@ $("review").onclick = async () => {
         "Otra pestaña ha cambiado el proyecto. Conserva tus cambios y recarga antes de sincronizar.",
       );
     }
+    previewGeneration++;
     syncPlan = undefined;
+    syncReviewSnapshot = { ...saved, docId: state.docId };
     $("apply").disabled = true;
     $("patches").replaceChildren();
+    $("sync-selection").replaceChildren();
+    for (const change of saved.pending) {
+      const label = document.createElement("label"),
+        checkbox = document.createElement("input");
+      checkbox.type = "checkbox";
+      checkbox.checked = true;
+      checkbox.dataset.change = change.id;
+      checkbox.onchange = prepareSyncPreview;
+      label.append(
+        checkbox,
+        document.createTextNode(` ${syncChangeLabel(change)}`),
+      );
+      $("sync-selection").append(label);
+    }
     $("delete-confirmations").replaceChildren();
     for (
       const change of saved.pending.filter((item) =>
@@ -389,25 +477,37 @@ $("review").onclick = async () => {
 };
 $("apply").onclick = async () => {
   if (!syncPlan || busy) return;
+  const selected = currentSyncSelection();
+  if (requiredSyncDeleteBoxes(selected).some((box) => !box.checked)) return;
   if (
-    [...$("delete-confirmations").querySelectorAll("input")].some((box) =>
-      !box.checked
+    syncReviewSnapshot && (
+      syncReviewSnapshot.docId !== state.docId ||
+      syncReviewSnapshot.revision !== state.revision ||
+      !sameSyncSelection(selected, syncPlanSelection) ||
+      !sameSyncSelection(selected, syncPlan.selectedChangeIds)
     )
-  ) return;
+  ) {
+    syncPlan = undefined;
+    $("apply").disabled = true;
+    $("sync-note").textContent =
+      "La selección cambió. Prepara una revisión nueva antes de aplicar.";
+    return;
+  }
   setBusy(true);
   $("busy").textContent = "Aplicando los cambios revisados al QMD…";
   $("sync-note").textContent = $("busy").textContent;
   $("apply").disabled = true;
   $("close").disabled = true;
   $("delete-confirmations").inert = true;
+  $("sync-selection").inert = true;
   previewGeneration++;
   try {
     const receipt = await api("sync/apply", syncPlan);
     state.revision = receipt.revision;
     syncPlan = undefined;
     $("sync-note").textContent = receipt.annotations?.diagnostics.length
-      ? "Cambios semánticos aplicados al QMD; las anotaciones opcionales se han omitido por los diagnósticos revisados. Recalcula para actualizar la presentación."
-      : "Cambios aplicados al QMD. Recalcula para actualizar la presentación.";
+      ? "Cambios semánticos aplicados al QMD; las anotaciones opcionales se han omitido por los diagnósticos revisados. Los cambios aplicados seguirán pendientes hasta Recalcular y verificar el resultado."
+      : "Cambios aplicados al QMD. Seguirán pendientes hasta Recalcular y verificar el resultado. Los cambios excluidos se conservan.";
     status("QMD sincronizado; listo para recalcular");
   } catch (error) {
     $("sync-note").textContent = error.message;
@@ -415,6 +515,7 @@ $("apply").onclick = async () => {
     setBusy(false);
     $("close").disabled = false;
     $("delete-confirmations").inert = false;
+    $("sync-selection").inert = false;
     $("apply").disabled = !syncPlan;
   }
 };
@@ -427,6 +528,7 @@ $("review-dialog").addEventListener("cancel", (event) => {
 $("review-dialog").addEventListener("close", () => {
   previewGeneration++;
   syncPlan = undefined;
+  syncReviewSnapshot = undefined;
 });
 function reloadEditor() {
   $("editor").contentWindow.__qbentoManagedReload = true;

package/distribution/runtime/src/studio/index.html

@@ -170,6 +170,11 @@
       background: #156f65;
       color: white;
     }
+    #sync-selection label,
+    #delete-confirmations label {
+      display: block;
+      margin: 10px 0;
+    }
     #sync-note {
       line-height: 1.5;
     }
@@ -209,7 +214,7 @@
         role="status">Recalculando. Tus cambios están guardados.</div>
     </main>
     <dialog
-      id="review-dialog"><h2>Revisar cambios hacia QMD</h2><p id="sync-note">Guardar conserva el proyecto; sincronizar aplica únicamente los cambios que revisas aquí.</p><div id="delete-confirmations"></div><div id="patches"></div><details><summary>Origen y detalle de los cambios</summary><div id="changes"></div></details><button id="apply" disabled>Aplicar estos cambios a QMD</button> <button id="close">Cerrar</button></dialog>
+      id="review-dialog"><h2>Revisar cambios hacia QMD</h2><p id="sync-note">Guardar conserva el proyecto; sincronizar aplica únicamente los cambios que revisas aquí.</p><p>Selecciona los cambios que quieres sincronizar. Los cambios excluidos se conservan pendientes. Los miembros de un componente deben revisarse juntos.</p><div id="sync-selection"></div><p id="sync-selection-summary" role="status"></p><div id="delete-confirmations"></div><div id="patches"></div><details><summary>Origen y detalle de los cambios</summary><div id="changes"></div></details><button id="apply" disabled>Aplicar estos cambios a QMD</button> <button id="close">Cerrar</button></dialog>
     <dialog
       id="slides-dialog"><h2>Diapositivas</h2><p>Ocultar conserva el contenido y lo omite en la presentación y el PDF. Marcar para eliminar guarda una eliminación pendiente; después debes revisarla y confirmarla para modificar QMD. Puedes restaurarla antes de sincronizar.</p><p id="slides-note" role="status"></p><div id="slide-list"></div><button id="slides-close">Cerrar</button></dialog>
     <dialog id="layouts-dialog" aria-labelledby="layouts-title">

package/distribution/runtime/src/studio/server.ts

@@ -20,7 +20,7 @@ import {
   renderProject,
   saveProject,
 } from "../core/project.ts";
-import { applySync, previewSync } from "../core/sync.ts";
+import { applySync, previewSelectedSync, previewSync } from "../core/sync.ts";
 import { applyReconcile, previewReconcile } from "../core/reconcile.ts";
 import {
   applySlideAction,
@@ -80,6 +80,8 @@ export async function readStudioBody(
 }
 
 export async function startStudio(source: string, port = 0) {
+  // Refuse a mismatched QMD before exposing any editor or state endpoint.
+  await readProject(source);
   const token = crypto.randomUUID() + crypto.randomUUID();
   const shell = await loadBentoShell();
   const bridge = await Deno.readTextFile(
@@ -315,11 +317,37 @@ export async function startStudio(source: string, port = 0) {
           }
           const text = await readStudioBody(req);
           if (text === null) return respond('{"error":"Plan too large"}', 413);
-          const { confirmedDeleteIds } = JSON.parse(text);
+          const payload = JSON.parse(text);
+          if (
+            !payload || typeof payload !== "object" || Array.isArray(payload)
+          ) {
+            throw new StateError(
+              "INVALID_SELECTION",
+              "Expected a sync preview object.",
+            );
+          }
+          const selected = [
+            "version",
+            "docId",
+            "expectedRevision",
+            "selectedChangeIds",
+          ]
+            .some((key) => Object.hasOwn(payload, key));
+          if (
+            !selected &&
+            Object.keys(payload).some((key) => key !== "confirmedDeleteIds")
+          ) {
+            throw new StateError(
+              "INVALID_SELECTION",
+              "Unknown sync preview field.",
+            );
+          }
           return respond(JSON.stringify(
-            await previewSync(source, undefined, {
-              confirmedDeleteIds,
-            }),
+            selected
+              ? await previewSelectedSync(source, payload)
+              : await previewSync(source, undefined, {
+                confirmedDeleteIds: payload.confirmedDeleteIds,
+              }),
           ));
         }
         if (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brianmsm/quarto-bento",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Offline Quarto and Bento authoring with retained design and reviewed QMD synchronization",
   "type": "module",
   "bin": {