@byline/admin 3.17.0 → 3.18.0

package/dist/forms/form-renderer.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { getClientConfig } from "@byline/core";
 import { useTranslation } from "@byline/i18n/react";
 import { Alert, Button, ComboButton } from "@byline/ui/react";
 import classnames from "classnames";
@@ -32,6 +33,15 @@ const FormContent = ({ mode, fields, onSubmit, onCancel, onStatusChange, onUnpub
     const [pendingSystemFieldsSubmit, setPendingSystemFieldsSubmit] = useState(null);
     const [contentLocale, setContentLocale] = useState(initialLocale ?? defaultLocale);
     const { uploadField } = useBylineFieldServices();
+    const pathSlugifier = getClientConfig().slugifier;
+    const pathSourceLocked = useMemo(()=>{
+        if (!useAsPath) return false;
+        const source = fields.find((f)=>f.name === useAsPath);
+        return null != source && ('counter' === source.type || true === source.readOnly);
+    }, [
+        useAsPath,
+        fields
+    ]);
     useEffect(()=>{
         if (initialLocale) setContentLocale(initialLocale);
     }, [
@@ -345,7 +355,9 @@ const FormContent = ({ mode, fields, onSubmit, onCancel, onStatusChange, onUnpub
                                 collectionPath: collectionPath ?? '',
                                 defaultLocale: defaultLocale,
                                 activeLocale: contentLocale,
-                                mode: mode
+                                mode: mode,
+                                slugifier: pathSlugifier,
+                                sourceLocked: pathSourceLocked
                             }),
                             tree && 'edit' === mode && 'string' == typeof initialData?.id && /*#__PURE__*/ jsx(TreePlacementWidget, {
                                 collectionPath: collectionPath ?? '',

package/dist/forms/path-widget.d.ts

@@ -1,3 +1,4 @@
+import type { SlugifierFn } from '@byline/core';
 export interface PathWidgetProps {
     /** The collection's `useAsPath` source field name, when configured. */
     useAsPath: string | undefined;
@@ -16,6 +17,23 @@ export interface PathWidgetProps {
     activeLocale: string;
     /** `'create'` shows the live derived preview as placeholder text. */
     mode: 'create' | 'edit';
+    /**
+     * Installation slugifier used to derive the live preview. Must match the
+     * server-side `ServerConfig.slugifier` so the preview agrees with what is
+     * persisted. Defaults to the built-in `slugify` when omitted — callers
+     * that keep the default slugifier need not pass this.
+     */
+    slugifier?: SlugifierFn;
+    /**
+     * When `true`, the `useAsPath` source field's value is not editable through
+     * this form (e.g. it is an allocator-assigned `counter`, or an otherwise
+     * read-only field). Its value is either server-assigned — and so not
+     * reproducible client-side — or simply cannot change, which means the
+     * source-derived live preview and the "Regenerate" affordance are
+     * meaningless. When set, the widget suppresses both and just shows the
+     * persisted path. Defaults to `false`.
+     */
+    sourceLocked?: boolean;
 }
 /**
  * System-managed `path` widget.
@@ -33,4 +51,4 @@ export interface PathWidgetProps {
  * Stable override handles: `.byline-form-path`, `.byline-form-path-header`,
  * `.byline-form-path-regenerate`.
  */
-export declare const PathWidget: ({ useAsPath, collectionPath, defaultLocale, activeLocale, mode, }: PathWidgetProps) => import("react").JSX.Element;
+export declare const PathWidget: ({ useAsPath, collectionPath, defaultLocale, activeLocale, mode, slugifier, sourceLocked, }: PathWidgetProps) => import("react").JSX.Element;

package/dist/forms/path-widget.js

@@ -12,25 +12,28 @@ function coerceToString(value) {
     if (value instanceof Date) return value.toISOString();
     return String(value);
 }
-const PathWidget = ({ useAsPath, collectionPath, defaultLocale, activeLocale, mode })=>{
+const PathWidget = ({ useAsPath, collectionPath, defaultLocale, activeLocale, mode, slugifier, sourceLocked = false })=>{
     const { setSystemPath } = useFormContext();
     const { t } = useTranslation('byline-admin');
     const systemPath = useSystemPath();
     const sourceValue = useFieldValue(useAsPath ?? '');
+    const runSlugify = slugifier ?? slugify;
     const isReadOnly = activeLocale !== defaultLocale;
     const livePreview = useMemo(()=>{
-        if (!useAsPath) return '';
+        if (!useAsPath || sourceLocked) return '';
         const asString = coerceToString(sourceValue);
         if (0 === asString.length) return '';
-        return slugify(asString, {
+        return runSlugify(asString, {
             locale: defaultLocale,
             collectionPath
         });
     }, [
         useAsPath,
+        sourceLocked,
         sourceValue,
         defaultLocale,
-        collectionPath
+        collectionPath,
+        runSlugify
     ]);
     const inputValue = systemPath ?? '';
     const handleChange = useCallback((next)=>{
@@ -46,14 +49,15 @@ const PathWidget = ({ useAsPath, collectionPath, defaultLocale, activeLocale, mo
     ]);
     const formatted = useMemo(()=>{
         if (0 === inputValue.length) return '';
-        return slugify(inputValue, {
+        return runSlugify(inputValue, {
             locale: defaultLocale,
             collectionPath
         });
     }, [
         inputValue,
         defaultLocale,
-        collectionPath
+        collectionPath,
+        runSlugify
     ]);
     const validationHint = inputValue.length > 0 && formatted !== inputValue ? t('pathWidget.suggestedHint', {
         formatted

package/dist/modules/admin-account/errors.d.ts

@@ -20,8 +20,8 @@
  * code per condition.
  */
 export declare const AdminAccountErrorCodes: {
-    readonly NOT_FOUND: "admin.account.notFound";
-    readonly INVALID_CURRENT_PASSWORD: "admin.account.invalidCurrentPassword";
+    readonly NOT_FOUND: 'admin.account.notFound';
+    readonly INVALID_CURRENT_PASSWORD: 'admin.account.invalidCurrentPassword';
 };
 export type AdminAccountErrorCode = (typeof AdminAccountErrorCodes)[keyof typeof AdminAccountErrorCodes];
 export interface AdminAccountErrorOptions {

package/dist/modules/admin-activity/abilities.d.ts

@@ -20,7 +20,7 @@ import type { AbilityRegistry } from '@byline/auth';
  * append-only and is written by the lifecycle write-points, never edited.
  */
 export declare const ADMIN_ACTIVITY_ABILITIES: {
-    readonly read: "admin.activity.read";
+    readonly read: 'admin.activity.read';
 };
 export type AdminActivityAbilityKey = (typeof ADMIN_ACTIVITY_ABILITIES)[keyof typeof ADMIN_ACTIVITY_ABILITIES];
 /**

package/dist/modules/admin-permissions/abilities.d.ts

@@ -19,8 +19,8 @@ import type { AbilityRegistry } from '@byline/auth';
  * every permission-managing role.
  */
 export declare const ADMIN_PERMISSIONS_ABILITIES: {
-    readonly read: "admin.permissions.read";
-    readonly update: "admin.permissions.update";
+    readonly read: 'admin.permissions.read';
+    readonly update: 'admin.permissions.update';
 };
 export type AdminPermissionsAbilityKey = (typeof ADMIN_PERMISSIONS_ABILITIES)[keyof typeof ADMIN_PERMISSIONS_ABILITIES];
 export declare function registerAdminPermissionsAbilities(registry: AbilityRegistry): void;

package/dist/modules/admin-permissions/errors.d.ts

@@ -14,8 +14,8 @@
  * inspector is read-only and never throws either of these.
  */
 export declare const AdminPermissionsErrorCodes: {
-    readonly ROLE_NOT_FOUND: "admin.permissions.roleNotFound";
-    readonly ABILITY_UNREGISTERED: "admin.permissions.abilityUnregistered";
+    readonly ROLE_NOT_FOUND: 'admin.permissions.roleNotFound';
+    readonly ABILITY_UNREGISTERED: 'admin.permissions.abilityUnregistered';
 };
 export type AdminPermissionsErrorCode = (typeof AdminPermissionsErrorCodes)[keyof typeof AdminPermissionsErrorCodes];
 export interface AdminPermissionsErrorOptions {

package/dist/modules/admin-permissions/schemas.d.ts

@@ -29,8 +29,8 @@ export declare const abilityDescriptorResponseSchema: z.ZodObject<{
     source: z.ZodNullable<z.ZodEnum<{
         admin: "admin";
         collection: "collection";
-        plugin: "plugin";
         core: "core";
+        plugin: "plugin";
     }>>;
 }, z.core.$strip>;
 export type AbilityDescriptorResponse = z.infer<typeof abilityDescriptorResponseSchema>;
@@ -44,8 +44,8 @@ export declare const abilityGroupResponseSchema: z.ZodObject<{
         source: z.ZodNullable<z.ZodEnum<{
             admin: "admin";
             collection: "collection";
-            plugin: "plugin";
             core: "core";
+            plugin: "plugin";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -63,8 +63,8 @@ export declare const listRegisteredAbilitiesResponseSchema: z.ZodObject<{
         source: z.ZodNullable<z.ZodEnum<{
             admin: "admin";
             collection: "collection";
-            plugin: "plugin";
             core: "core";
+            plugin: "plugin";
         }>>;
     }, z.core.$strip>>;
     groups: z.ZodArray<z.ZodObject<{
@@ -77,8 +77,8 @@ export declare const listRegisteredAbilitiesResponseSchema: z.ZodObject<{
             source: z.ZodNullable<z.ZodEnum<{
                 admin: "admin";
                 collection: "collection";
-                plugin: "plugin";
                 core: "core";
+                plugin: "plugin";
             }>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;

package/dist/modules/admin-roles/abilities.d.ts

@@ -18,10 +18,10 @@ import type { AbilityRegistry } from '@byline/auth';
  * keys there.
  */
 export declare const ADMIN_ROLES_ABILITIES: {
-    readonly read: "admin.roles.read";
-    readonly create: "admin.roles.create";
-    readonly update: "admin.roles.update";
-    readonly delete: "admin.roles.delete";
+    readonly read: 'admin.roles.read';
+    readonly create: 'admin.roles.create';
+    readonly update: 'admin.roles.update';
+    readonly delete: 'admin.roles.delete';
 };
 export type AdminRolesAbilityKey = (typeof ADMIN_ROLES_ABILITIES)[keyof typeof ADMIN_ROLES_ABILITIES];
 /**

package/dist/modules/admin-roles/errors.d.ts

@@ -13,10 +13,10 @@
  * ability keys in logs and admin UI messages.
  */
 export declare const AdminRolesErrorCodes: {
-    readonly NOT_FOUND: "admin.roles.notFound";
-    readonly MACHINE_NAME_IN_USE: "admin.roles.machineNameInUse";
-    readonly VERSION_CONFLICT: "admin.roles.versionConflict";
-    readonly USER_NOT_FOUND: "admin.roles.userNotFound";
+    readonly NOT_FOUND: 'admin.roles.notFound';
+    readonly MACHINE_NAME_IN_USE: 'admin.roles.machineNameInUse';
+    readonly VERSION_CONFLICT: 'admin.roles.versionConflict';
+    readonly USER_NOT_FOUND: 'admin.roles.userNotFound';
 };
 export type AdminRolesErrorCode = (typeof AdminRolesErrorCodes)[keyof typeof AdminRolesErrorCodes];
 export interface AdminRolesErrorOptions {

package/dist/modules/admin-users/abilities.d.ts

@@ -25,11 +25,11 @@ import type { AbilityRegistry } from '@byline/auth';
  * are strictly for administering other admin users.
  */
 export declare const ADMIN_USERS_ABILITIES: {
-    readonly read: "admin.users.read";
-    readonly create: "admin.users.create";
-    readonly update: "admin.users.update";
-    readonly delete: "admin.users.delete";
-    readonly changePassword: "admin.users.changePassword";
+    readonly read: 'admin.users.read';
+    readonly create: 'admin.users.create';
+    readonly update: 'admin.users.update';
+    readonly delete: 'admin.users.delete';
+    readonly changePassword: 'admin.users.changePassword';
 };
 export type AdminUsersAbilityKey = (typeof ADMIN_USERS_ABILITIES)[keyof typeof ADMIN_USERS_ABILITIES];
 /**

package/dist/modules/admin-users/errors.d.ts

@@ -18,11 +18,11 @@
  * alongside the matching ability keys in logs and admin UI messages.
  */
 export declare const AdminUsersErrorCodes: {
-    readonly NOT_FOUND: "admin.users.notFound";
-    readonly EMAIL_IN_USE: "admin.users.emailInUse";
-    readonly SELF_DELETE_FORBIDDEN: "admin.users.selfDeleteForbidden";
-    readonly SELF_DISABLE_FORBIDDEN: "admin.users.selfDisableForbidden";
-    readonly VERSION_CONFLICT: "admin.users.versionConflict";
+    readonly NOT_FOUND: 'admin.users.notFound';
+    readonly EMAIL_IN_USE: 'admin.users.emailInUse';
+    readonly SELF_DELETE_FORBIDDEN: 'admin.users.selfDeleteForbidden';
+    readonly SELF_DISABLE_FORBIDDEN: 'admin.users.selfDisableForbidden';
+    readonly VERSION_CONFLICT: 'admin.users.versionConflict';
 };
 export type AdminUsersErrorCode = (typeof AdminUsersErrorCodes)[keyof typeof AdminUsersErrorCodes];
 export interface AdminUsersErrorOptions {

package/dist/modules/admin-users/schemas.d.ts

@@ -11,12 +11,12 @@ export declare const listAdminUsersRequestSchema: z.ZodObject<{
     pageSize: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
     query: z.ZodOptional<z.ZodString>;
     order: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        created_at: "created_at";
         email: "email";
-        given_name: "given_name";
         family_name: "family_name";
-        username: "username";
-        created_at: "created_at";
+        given_name: "given_name";
         updated_at: "updated_at";
+        username: "username";
     }>>>;
     desc: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
 }, z.core.$strip>;
@@ -121,12 +121,12 @@ export declare const adminUserListResponseSchema: z.ZodObject<{
         page_size: z.ZodNumber;
         query: z.ZodString;
         order: z.ZodEnum<{
+            created_at: "created_at";
             email: "email";
-            given_name: "given_name";
             family_name: "family_name";
-            username: "username";
-            created_at: "created_at";
+            given_name: "given_name";
             updated_at: "updated_at";
+            username: "username";
         }>;
         desc: z.ZodBoolean;
     }, z.core.$strip>;

package/dist/vendor/noble-argon2/blake2.js

@@ -1,7 +1,7 @@
 import { BSIGMA, G1s, G2s } from "./_blake.js";
 import { SHA256_IV } from "./_md.js";
 import { abytes, aexists, anumber, aoutput, clean, createHasher, swap32IfBE, swap8IfBE, u32 } from "./utils.js";
-import * as __rspack_external__u64_js_3c1fe104 from "./_u64.js";
+import * as __rspack_external__u64_js_5917676b from "./_u64.js";
 const B2B_IV = /* @__PURE__ */ Uint32Array.from([
     0xf3bcc908,
     0x6a09e667,
@@ -27,25 +27,25 @@ function G1b(a, b, c, d, msg, x) {
     let Bl = BBUF[2 * b], Bh = BBUF[2 * b + 1];
     let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1];
     let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1];
-    let ll = __rspack_external__u64_js_3c1fe104.add3L(Al, Bl, Xl);
-    Ah = __rspack_external__u64_js_3c1fe104.add3H(ll, Ah, Bh, Xh);
+    let ll = __rspack_external__u64_js_5917676b.add3L(Al, Bl, Xl);
+    Ah = __rspack_external__u64_js_5917676b.add3H(ll, Ah, Bh, Xh);
     Al = 0 | ll;
     ({ Dh, Dl } = {
         Dh: Dh ^ Ah,
         Dl: Dl ^ Al
     });
     ({ Dh, Dl } = {
-        Dh: __rspack_external__u64_js_3c1fe104.rotr32H(Dh, Dl),
-        Dl: __rspack_external__u64_js_3c1fe104.rotr32L(Dh, Dl)
+        Dh: __rspack_external__u64_js_5917676b.rotr32H(Dh, Dl),
+        Dl: __rspack_external__u64_js_5917676b.rotr32L(Dh, Dl)
     });
-    ({ h: Ch, l: Cl } = __rspack_external__u64_js_3c1fe104.add(Ch, Cl, Dh, Dl));
+    ({ h: Ch, l: Cl } = __rspack_external__u64_js_5917676b.add(Ch, Cl, Dh, Dl));
     ({ Bh, Bl } = {
         Bh: Bh ^ Ch,
         Bl: Bl ^ Cl
     });
     ({ Bh, Bl } = {
-        Bh: __rspack_external__u64_js_3c1fe104.rotrSH(Bh, Bl, 24),
-        Bl: __rspack_external__u64_js_3c1fe104.rotrSL(Bh, Bl, 24)
+        Bh: __rspack_external__u64_js_5917676b.rotrSH(Bh, Bl, 24),
+        Bl: __rspack_external__u64_js_5917676b.rotrSL(Bh, Bl, 24)
     });
     BBUF[2 * a] = Al, BBUF[2 * a + 1] = Ah;
     BBUF[2 * b] = Bl, BBUF[2 * b + 1] = Bh;
@@ -58,25 +58,25 @@ function G2b(a, b, c, d, msg, x) {
     let Bl = BBUF[2 * b], Bh = BBUF[2 * b + 1];
     let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1];
     let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1];
-    let ll = __rspack_external__u64_js_3c1fe104.add3L(Al, Bl, Xl);
-    Ah = __rspack_external__u64_js_3c1fe104.add3H(ll, Ah, Bh, Xh);
+    let ll = __rspack_external__u64_js_5917676b.add3L(Al, Bl, Xl);
+    Ah = __rspack_external__u64_js_5917676b.add3H(ll, Ah, Bh, Xh);
     Al = 0 | ll;
     ({ Dh, Dl } = {
         Dh: Dh ^ Ah,
         Dl: Dl ^ Al
     });
     ({ Dh, Dl } = {
-        Dh: __rspack_external__u64_js_3c1fe104.rotrSH(Dh, Dl, 16),
-        Dl: __rspack_external__u64_js_3c1fe104.rotrSL(Dh, Dl, 16)
+        Dh: __rspack_external__u64_js_5917676b.rotrSH(Dh, Dl, 16),
+        Dl: __rspack_external__u64_js_5917676b.rotrSL(Dh, Dl, 16)
     });
-    ({ h: Ch, l: Cl } = __rspack_external__u64_js_3c1fe104.add(Ch, Cl, Dh, Dl));
+    ({ h: Ch, l: Cl } = __rspack_external__u64_js_5917676b.add(Ch, Cl, Dh, Dl));
     ({ Bh, Bl } = {
         Bh: Bh ^ Ch,
         Bl: Bl ^ Cl
     });
     ({ Bh, Bl } = {
-        Bh: __rspack_external__u64_js_3c1fe104.rotrBH(Bh, Bl, 63),
-        Bl: __rspack_external__u64_js_3c1fe104.rotrBL(Bh, Bl, 63)
+        Bh: __rspack_external__u64_js_5917676b.rotrBH(Bh, Bl, 63),
+        Bl: __rspack_external__u64_js_5917676b.rotrBL(Bh, Bl, 63)
     });
     BBUF[2 * a] = Al, BBUF[2 * a + 1] = Ah;
     BBUF[2 * b] = Bl, BBUF[2 * b + 1] = Bh;
@@ -226,7 +226,7 @@ class _BLAKE2b extends _BLAKE2 {
     compress(msg, offset, isLast) {
         this.get().forEach((v, i)=>BBUF[i] = v);
         BBUF.set(B2B_IV, 16);
-        let { h, l } = __rspack_external__u64_js_3c1fe104.fromBig(BigInt(this.length));
+        let { h, l } = __rspack_external__u64_js_5917676b.fromBig(BigInt(this.length));
         BBUF[24] = B2B_IV[8] ^ l;
         BBUF[25] = B2B_IV[9] ^ h;
         if (isLast) {
@@ -376,7 +376,7 @@ class _BLAKE2s extends _BLAKE2 {
         this.v7 = 0 | v7;
     }
     compress(msg, offset, isLast) {
-        const { h, l } = __rspack_external__u64_js_3c1fe104.fromBig(BigInt(this.length));
+        const { h, l } = __rspack_external__u64_js_5917676b.fromBig(BigInt(this.length));
         const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = compress(BSIGMA, offset, msg, 10, this.v0, this.v1, this.v2, this.v3, this.v4, this.v5, this.v6, this.v7, B2S_IV[0], B2S_IV[1], B2S_IV[2], B2S_IV[3], l ^ B2S_IV[4], h ^ B2S_IV[5], isLast ? ~B2S_IV[6] : B2S_IV[6], B2S_IV[7]);
         this.v0 ^= v0 ^ v8;
         this.v1 ^= v1 ^ v9;

package/dist/widgets/source-locale-badge/source-locale-badge.d.ts

@@ -10,21 +10,7 @@ export interface SourceLocaleBadgeProps {
     locale: string;
     className?: string;
 }
-/**
- * Small neutral badge indicating a document's content **source locale** — the
- * locale it was authored in (its anchor: fallback floor, path locale,
- * completeness yardstick). Rendered next to the document title in the edit and
- * list views. Mirrors the localized-field {@link LocaleBadge} in spirit but uses
- * the shared {@link Badge} with the `noeffect` (neutral) intent.
- *
- * NOTE: currently rendered for *every* document so the anchor is visible during
- * development. The intended end state is to show it only when `locale` differs
- * from the system's current default content locale (a normal single-default
- * install then shows nothing). See docs/07-internationalization/index.md.
- *
- * Stable override handle: `.byline-source-locale-badge`.
- */
-export declare const SourceLocaleBadge: {
-    ({ locale, className }: SourceLocaleBadgeProps): import("react").JSX.Element;
-    displayName: string;
-};
+export declare function SourceLocaleBadge({ locale, className }: SourceLocaleBadgeProps): import("react").JSX.Element;
+export declare namespace SourceLocaleBadge {
+    var displayName: string;
+}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@byline/admin",
   "private": false,
   "license": "MPL-2.0",
-  "version": "3.17.0",
+  "version": "3.18.0",
   "engines": {
     "node": ">=20.9.0"
   },
@@ -153,31 +153,31 @@
     "classnames": "^2.5.1",
     "jose": "^6.2.3",
     "react-diff-viewer-continued": "^4.2.2",
-    "uuid": "^14.0.0",
+    "uuid": "^14.0.1",
     "zod": "^4.4.3",
-    "@byline/auth": "3.17.0",
-    "@byline/i18n": "3.17.0",
-    "@byline/core": "3.17.0",
-    "@byline/ui": "3.17.0"
+    "@byline/auth": "3.18.0",
+    "@byline/i18n": "3.18.0",
+    "@byline/ui": "3.18.0",
+    "@byline/core": "3.18.0"
   },
   "peerDependencies": {
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.15",
-    "@rsbuild/plugin-react": "^2.0.0",
-    "@rslib/core": "^0.21.5",
-    "@types/node": "^25.9.1",
-    "@types/react": "19.2.15",
+    "@biomejs/biome": "2.5.2",
+    "@rsbuild/plugin-react": "^2.1.0",
+    "@rslib/core": "^0.23.2",
+    "@types/node": "^26.1.0",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "react": "19.2.6",
-    "react-dom": "19.2.6",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "rimraf": "^6.1.3",
-    "tsx": "^4.22.3",
-    "typescript": "6.0.3",
+    "tsx": "^4.23.0",
+    "typescript": "^7.0.2",
     "typescript-plugin-css-modules": "^5.2.0",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.10"
   },
   "publishConfig": {
     "access": "public",

package/src/forms/form-renderer.tsx

@@ -18,6 +18,7 @@ import type {
   TabSetDefinition,
   WorkflowStatus,
 } from '@byline/core'
+import { getClientConfig } from '@byline/core'
 import type { DocumentPatch } from '@byline/core/patches'
 import { useTranslation } from '@byline/i18n/react'
 import { Alert, Button, ComboButton } from '@byline/ui/react'
@@ -241,6 +242,19 @@ const FormContent = ({
   const [contentLocale, setContentLocale] = useState(initialLocale ?? defaultLocale)
   const { uploadField } = useBylineFieldServices()
 
+  // Path-widget wiring. The live preview must use the installation's
+  // client-side slugifier (same function as `ServerConfig.slugifier`) so it
+  // agrees with the persisted path. And when the `useAsPath` source is a
+  // server-assigned `counter` or a read-only field, its value can't be
+  // reproduced or changed through the form, so the widget suppresses its
+  // source-derived preview and "Regenerate" affordance.
+  const pathSlugifier = getClientConfig().slugifier
+  const pathSourceLocked = useMemo(() => {
+    if (!useAsPath) return false
+    const source = fields.find((f) => f.name === useAsPath)
+    return source != null && (source.type === 'counter' || source.readOnly === true)
+  }, [useAsPath, fields])
+
   // Sync contentLocale when the route re-fetches with a different locale.
   useEffect(() => {
     if (initialLocale) setContentLocale(initialLocale)
@@ -672,6 +686,8 @@ const FormContent = ({
               defaultLocale={defaultLocale}
               activeLocale={contentLocale}
               mode={mode}
+              slugifier={pathSlugifier}
+              sourceLocked={pathSourceLocked}
             />
           )}
           {tree && mode === 'edit' && typeof initialData?.id === 'string' && (

package/src/forms/path-widget.test.tsx

@@ -105,6 +105,9 @@ describe('PathWidget', () => {
     props: Partial<{
       useAsPath: string | undefined
       mode: 'create' | 'edit'
+      activeLocale: string
+      slugifier: (value: string, ctx: { locale: string; collectionPath: string }) => string
+      sourceLocked: boolean
     }> = {}
   ) => {
     act(() => {
@@ -113,7 +116,10 @@ describe('PathWidget', () => {
           useAsPath={props.useAsPath ?? 'title'}
           collectionPath="pages"
           defaultLocale="en"
+          activeLocale={props.activeLocale ?? 'en'}
           mode={props.mode ?? 'create'}
+          slugifier={props.slugifier}
+          sourceLocked={props.sourceLocked}
         />
       )
     })
@@ -214,4 +220,31 @@ describe('PathWidget', () => {
     render({ mode: 'edit', useAsPath: undefined })
     expect(container.querySelector('button')).toBeNull()
   })
+
+  it('derives the preview with the provided slugifier instead of the default', () => {
+    // A custom slugifier that zero-pads a numeric serial to 7 digits — the
+    // shape used when a `counter` field feeds the path.
+    const padSerial = (value: string) => value.padStart(7, '0')
+    setFixture({ systemPath: null, sourceValue: 1 })
+    render({ mode: 'create', slugifier: padSerial })
+
+    const input = getInput()
+    // Default slugify would yield "1"; the custom slugifier yields "0000001".
+    expect(input.getAttribute('placeholder')).toBe('Will be saved as "0000001"')
+  })
+
+  it('suppresses the create-mode placeholder preview when the source is locked', () => {
+    setFixture({ systemPath: null, sourceValue: 1 })
+    render({ mode: 'create', sourceLocked: true })
+    expect(getInput().getAttribute('placeholder')).toBeNull()
+  })
+
+  it('suppresses the Regenerate button when the source is locked', () => {
+    // Persisted path differs from what a naive re-derivation would produce,
+    // which would normally surface Regenerate — but a locked (server-assigned)
+    // source can't be regenerated from the form, so it must stay hidden.
+    setFixture({ systemPath: '0000001', sourceValue: 1 })
+    render({ mode: 'edit', sourceLocked: true })
+    expect(container.querySelector('button')).toBeNull()
+  })
 })

package/src/forms/path-widget.tsx

@@ -10,6 +10,7 @@
 
 import { useCallback, useMemo } from 'react'
 
+import type { SlugifierFn } from '@byline/core'
 import { slugify } from '@byline/core'
 import { useTranslation } from '@byline/i18n/react'
 import { Input, Label } from '@byline/ui/react'
@@ -47,6 +48,23 @@ export interface PathWidgetProps {
   activeLocale: string
   /** `'create'` shows the live derived preview as placeholder text. */
   mode: 'create' | 'edit'
+  /**
+   * Installation slugifier used to derive the live preview. Must match the
+   * server-side `ServerConfig.slugifier` so the preview agrees with what is
+   * persisted. Defaults to the built-in `slugify` when omitted — callers
+   * that keep the default slugifier need not pass this.
+   */
+  slugifier?: SlugifierFn
+  /**
+   * When `true`, the `useAsPath` source field's value is not editable through
+   * this form (e.g. it is an allocator-assigned `counter`, or an otherwise
+   * read-only field). Its value is either server-assigned — and so not
+   * reproducible client-side — or simply cannot change, which means the
+   * source-derived live preview and the "Regenerate" affordance are
+   * meaningless. When set, the widget suppresses both and just shows the
+   * persisted path. Defaults to `false`.
+   */
+  sourceLocked?: boolean
 }
 
 /**
@@ -71,12 +89,20 @@ export const PathWidget = ({
   defaultLocale,
   activeLocale,
   mode,
+  slugifier,
+  sourceLocked = false,
 }: PathWidgetProps) => {
   const { setSystemPath } = useFormContext()
   const { t } = useTranslation('byline-admin')
   const systemPath = useSystemPath()
   const sourceValue = useFieldValue<unknown>(useAsPath ?? '')
 
+  // The installation slugifier, or the built-in default. Server-side path
+  // derivation uses `ServerConfig.slugifier`; this must be the same function
+  // (registered via `ClientConfig.slugifier`) or the preview will disagree
+  // with what the server persists.
+  const runSlugify = slugifier ?? slugify
+
   // Phase 1: paths are written/edited only under the default content
   // locale. When editing a translation, the widget locks down — the
   // input is read-only, the Regenerate action is suppressed, and a
@@ -87,11 +113,13 @@ export const PathWidget = ({
   // field value if no override were set. Used as placeholder in create
   // mode and as the target of the "Regenerate" action.
   const livePreview = useMemo(() => {
-    if (!useAsPath) return ''
+    // A locked source (server-assigned counter / read-only field) can't be
+    // previewed or regenerated from the form — suppress the derivation.
+    if (!useAsPath || sourceLocked) return ''
     const asString = coerceToString(sourceValue)
     if (asString.length === 0) return ''
-    return slugify(asString, { locale: defaultLocale, collectionPath })
-  }, [useAsPath, sourceValue, defaultLocale, collectionPath])
+    return runSlugify(asString, { locale: defaultLocale, collectionPath })
+  }, [useAsPath, sourceLocked, sourceValue, defaultLocale, collectionPath, runSlugify])
 
   const inputValue = systemPath ?? ''
 
@@ -115,8 +143,8 @@ export const PathWidget = ({
   // field-hook advisory behaviour).
   const formatted = useMemo(() => {
     if (inputValue.length === 0) return ''
-    return slugify(inputValue, { locale: defaultLocale, collectionPath })
-  }, [inputValue, defaultLocale, collectionPath])
+    return runSlugify(inputValue, { locale: defaultLocale, collectionPath })
+  }, [inputValue, defaultLocale, collectionPath, runSlugify])
 
   const validationHint =
     inputValue.length > 0 && formatted !== inputValue

package/src/forms/upload-executor.ts

@@ -97,10 +97,10 @@ export async function executeUploads(
 /**
  * Extract the leaf field name from a `fieldPath`. Top-level upload
  * fields (`'image'`, `'avatar'`) pass through unchanged; nested paths
- * (`'profile.avatar'`) reduce to their last segment, since the
- * server-side resolver matches against top-level field names today.
- * Nested upload fields would need a richer transport selector when
- * they land — the host resolver is the natural place to extend.
+ * (`'files[0].filesGroup.publicationFile'`) reduce to their last
+ * segment. The server-side resolver walks the schema recursively and
+ * matches upload fields by leaf name at any nesting depth, so leaf
+ * names must be unique among a collection's upload-capable fields.
  */
 function uploadFieldName(fieldPath: string): string {
   const dot = fieldPath.lastIndexOf('.')