@drawnagency/primitives 0.1.109 → 0.1.111

package/src/hooks/useEditorPublish.ts

@@ -253,11 +253,27 @@ export function useEditorPublish({
   async function gatherDocumentPayload(
     pending: { id: string; entry: DocumentManifestEntry }[],
     manifest: DocumentManifest,
-  ): Promise<{ uploads: DocumentUploadPayload[]; entries: { id: string; entry: DocumentManifestEntry }[] }> {
+  ): Promise<{
+    uploads: DocumentUploadPayload[];
+    entries: { id: string; entry: DocumentManifestEntry }[];
+    /** Staged here, but already on the branch — nothing to send, yet still to
+     *  be promoted out of `pendingDocuments`. */
+    alreadyCommitted: string[];
+  }> {
     const uploads: DocumentUploadPayload[] = [];
     const entries: { id: string; entry: DocumentManifestEntry }[] = [];
+    const alreadyCommitted: string[] = [];
     for (const { id, entry } of pending) {
-      if (manifest[id]) continue; // already committed by another writer
+      if (manifest[id]) {
+        // Committed by another writer (a peer, or the MCP connector) while it
+        // was staged locally. Dropping it outright meant it never reached
+        // committedDocumentIds, so onDocumentsPublished never fired for it and
+        // pendingDocuments kept it — hasPendingEdits() then stayed true
+        // FOREVER: every Save posted a no-op and the dirty indicator never
+        // cleared. It is committed, so treat it as committed.
+        alreadyCommitted.push(id);
+        continue;
+      }
       if (entry.storage === "git") {
         const blob = await getPendingDocumentBlob(id);
         if (!blob) continue;
@@ -265,7 +281,7 @@ export function useEditorPublish({
       }
       entries.push({ id, entry });
     }
-    return { uploads, entries };
+    return { uploads, entries, alreadyCommitted };
   }
 
   async function performSave(args: {
@@ -501,7 +517,10 @@ export function useEditorPublish({
       // replace nav.json) — the save succeeded, but part of it was refused, and
       // the editor believing it landed is exactly the silence the guard exists
       // to break.
-      if (responseData.warnings?.length) args.onSaveWarnings?.(responseData.warnings);
+      // Always reported, empty included: a later clean save left the previous
+      // save's banner on screen, so a warning the user had already dealt with
+      // read as still true.
+      args.onSaveWarnings?.(responseData.warnings ?? []);
 
       return {
         sha: responseData.sha,
@@ -512,7 +531,11 @@ export function useEditorPublish({
         // Read AFTER the final request: committedDocuments is complete and the
         // deletions (which ride only that request) have landed.
         committedDocumentManifest: documentManifestToSend(),
-        committedDocumentIds,
+        // Merged only into the RETURN value, never into the local
+        // committedDocumentIds — that array's length gates leadChunksCommitted,
+        // and an already-committed document advanced no draft head this save,
+        // so counting it there would wrongly suppress 409 auto-recovery.
+        committedDocumentIds: [...gatheredDocs.alreadyCommitted, ...committedDocumentIds],
         committedDocumentDeletions: args.pendingDocumentDeletions,
       };
     } catch (error) {
@@ -719,6 +742,11 @@ export function useEditorPublish({
   }, [flushNow, cancelPendingFlush, isConfigDirty, clearConfigDirty, siteIndexRef, siteConfig, sections, deletedSectionIds, onSuccess, mediaManifest, manifestDirty, clearManifestDirty, pendingMediaItems, pendingMediaDeletions, onMediaPublished, onShasUpdated, showFeedback, recoverConflict, onBaselineCommitted, saveChunkBudget, getEditGeneration, pendingDocumentDeletions]);
 
   const handlePublish = useCallback(async () => {
+    // Same in-flight guard every save path has. Without it a double-click fired
+    // two promotions: the second raced the first's branch delete and came back
+    // as a bare "Publish failed" for a publish that had actually succeeded.
+    if (inFlightRef.current) return;
+    inFlightRef.current = true;
     setPublishAction("publishing");
     setPublishFeedback(null);
 
@@ -749,6 +777,7 @@ export function useEditorPublish({
       console.error("Publish failed:", error);
       showFeedback("Publish failed", 5000);
     } finally {
+      inFlightRef.current = false;
       setPublishAction("idle");
     }
   }, [onShasUpdated, showFeedback, onPublishComplete]);
@@ -762,15 +791,51 @@ export function useEditorPublish({
 
       const hasLocalEdits = await hasPendingEdits();
 
-      let savedSections: { sectionId: string; updatedAt: string; content: SectionContent }[] = [];
-      let uploadedItems: MediaItem[] = [];
       let sentIndex: SiteIndex | null = null;
       let committedManifest: MediaManifest | null = null;
       let committedDocumentManifest: DocumentManifest | null = null;
-      let committedDocumentIds: string[] = [];
-      let committedDocumentDeletions: string[] = [];
+      let baselineSections: LoadedSection[] | null = null;
       if (hasLocalEdits) {
-        ({ savedSections, uploadedItems, sentIndex, committedManifest, committedDocumentManifest, committedDocumentIds, committedDocumentDeletions } = await saveWithConflictRecovery());
+        const saved = await saveWithConflictRecovery();
+        sentIndex = saved.sentIndex;
+        committedManifest = saved.committedManifest;
+        committedDocumentManifest = saved.committedDocumentManifest;
+
+        // Local save bookkeeping runs HERE, before the publish request — not
+        // after it. When it sat below the publish, a publish failure left
+        // savedShaRef at the pre-save head with every dirty row still queued:
+        // the next save re-sent everything against a stale baseVersion (a
+        // guaranteed 409) and re-uploaded the media lead chunks.
+        onShasUpdated(saved.sha, null);
+        try {
+          // C1: read the previous clean baseline BEFORE commitSavedRows clears
+          // the content cache, then re-prime it with the COMMITTED snapshot.
+          const prevBaseline = await getCachedContent();
+          await commitSavedRows(saved.savedSections, saved.uploadedItems);
+          baselineSections = buildCommittedBaseline({
+            baselineSections: prevBaseline?.sections ?? null,
+            fallbackSections: sections,
+            savedRows: saved.savedSections,
+            sentIndex: saved.sentIndex,
+          });
+          // Both sidecars ride the same write as the sha they belong to —
+          // omitting them is what blanked freshly uploaded images ("No Image")
+          // and freshly committed documents ("File missing") on a cache hit.
+          await cacheContent(saved.sha, baselineSections, saved.sentIndex, siteConfig!, {
+            media: saved.committedManifest,
+            documents: saved.committedDocumentManifest,
+          });
+          finishSave(saved.uploadedItems, saved.savedSections.map((r) => r.sectionId));
+          if (saved.committedDocumentIds.length > 0) onDocumentsPublished?.(saved.committedDocumentIds);
+          if (saved.committedDocumentDeletions.length > 0) onDocumentsDeleted?.(saved.committedDocumentDeletions);
+        } catch (cleanupError) {
+          // The save COMMITTED; only the local bookkeeping failed. Publishing on
+          // top of unknown local state would compound it — stop and tell the
+          // editor to reload.
+          console.error("Save succeeded but local cleanup failed:", cleanupError);
+          showFeedback("Saved, but the local cache couldn't be updated — reload the editor before publishing.", 8000);
+          return;
+        }
       }
 
       setPublishAction("publishing");
@@ -791,35 +856,19 @@ export function useEditorPublish({
       }
       const { sha } = publishData;
 
-      if (hasLocalEdits) {
+      if (hasLocalEdits && baselineSections && sentIndex) {
         try {
-          // C1 parity with handleSave: read the previous clean baseline before
-          // the invalidation, then re-cache the COMMITTED snapshot (sent content
-          // + sent index — never the live view state, which may carry mid-flight
-          // edits) against the PUBLISHED sha; the draft branch is gone after
-          // publish, so this is the snapshot a later cache hit restores.
-          const prevBaseline = await getCachedContent();
-          await commitSavedRows(savedSections, uploadedItems);
-          const baselineSections = buildCommittedBaseline({
-            baselineSections: prevBaseline?.sections ?? null,
-            fallbackSections: sections,
-            savedRows: savedSections,
-            sentIndex: sentIndex!,
-          });
-          // Both sidecars ride the same write as the sha they belong to: publish
-          // deleted the draft, so main's head IS this sha and the next load hits
-          // this row. Omitting them here is what blanked freshly uploaded images
-          // ("No Image", while the published site was correct) and freshly
-          // committed documents ("File missing").
-          await cacheContent(sha, baselineSections, sentIndex!, siteConfig!, {
+          // Re-key the SAME committed snapshot at the published sha: the draft
+          // branch is gone after publish, so this is what a later cache hit
+          // restores. Everything else was already committed above — but both
+          // sidecars have to ride this write too, or the re-keyed row is the
+          // one that blanks images and documents.
+          await cacheContent(sha, baselineSections, sentIndex, siteConfig!, {
             media: committedManifest!,
             documents: committedDocumentManifest!,
           });
-          finishSave(uploadedItems, savedSections.map((s) => s.sectionId));
-          if (committedDocumentIds.length > 0) onDocumentsPublished?.(committedDocumentIds);
-          if (committedDocumentDeletions.length > 0) onDocumentsDeleted?.(committedDocumentDeletions);
         } catch (cleanupError) {
-          console.error("Publish succeeded but local cleanup failed:", cleanupError);
+          console.error("Publish succeeded but the cache re-key failed:", cleanupError);
           onShasUpdated(null, sha);
           onPublishComplete?.();
           showFeedback("Published, but the local cache couldn't be updated — reload the editor.", 8000);

package/src/hooks/useFocusTrap.ts

@@ -55,3 +55,21 @@ export function useFocusTrap(ref: RefObject<HTMLElement | null>, active: boolean
     };
   }, [active, ref]);
 }
+
+/**
+ * Focus the first control on open, hand focus back on close — and nothing else.
+ * For non-modal surfaces (`aria-modal="false"`), where trapping Tab contradicts
+ * the declaration and leaves a keyboard user with no way out.
+ */
+export function useInitialFocus(ref: RefObject<HTMLElement | null>, active: boolean) {
+  useEffect(() => {
+    if (!active || !ref.current) return;
+    const previouslyFocused = document.activeElement as HTMLElement | null;
+    ref.current.querySelector<HTMLElement>(FOCUSABLE_SELECTOR)?.focus();
+    return () => {
+      if (previouslyFocused && document.body.contains(previouslyFocused)) {
+        previouslyFocused.focus();
+      }
+    };
+  }, [active, ref]);
+}

package/src/hooks/useMediaPipeline.ts

@@ -87,12 +87,29 @@ export function useMediaPipeline({
   // the ref the error branch below would close over the first render's handler.
   const onUploadErrorRef = useRef(onUploadError);
   onUploadErrorRef.current = onUploadError;
+  const onUploadNoticeRef = useRef(onUploadNotice);
+  onUploadNoticeRef.current = onUploadNotice;
 
   // Read inside uploadDocument's async body, where a state snapshot taken at
   // render time would be stale across the hash await.
   const pendingDocumentDeletionsRef = useRef<string[]>(pendingDocumentDeletions);
   pendingDocumentDeletionsRef.current = pendingDocumentDeletions;
 
+  // The two delete handlers below used to run their reference-repair pass INSIDE
+  // a setSections updater, calling markSectionDirty (a Dexie write) and
+  // setDirtySectionIds from it. State updaters must be pure — StrictMode
+  // double-invokes them in dev, and React may re-run or discard them at any
+  // time. Reading the list from a ref lets the pass run outside the updater.
+  const sectionsRef = useRef<LoadedSection[]>(sections);
+  sectionsRef.current = sections;
+
+  // handleMediaUpload's dedup check runs inside an `await` loop, where the
+  // `pendingMediaItems` state captured at render time goes stale. Mirroring the
+  // hashes here means the check reads whatever the latest render committed
+  // rather than the snapshot the batch started with.
+  const pendingHashesRef = useRef<Set<string>>(new Set());
+  pendingHashesRef.current = new Set(pendingMediaItems.map((i) => i.hash));
+
   /** Re-adding a document that is deleted-but-unsaved un-dooms it rather than
    *  letting the upload dedup swallow it — the twin of the image pipeline's
    *  `isDeleted` escape below. The ref is updated eagerly so two re-adds in one
@@ -118,6 +135,9 @@ export function useMediaPipeline({
   const uploadTargetsRef = useRef<Map<string, string | null>>(new Map());
   const hiddenUploadsRef = useRef<Map<string, boolean>>(new Map());
   const destroyedRef = useRef(false);
+  // Queue-teardown bookkeeping for the media-config-change notice below.
+  const prevMediaConfigKeyRef = useRef<string | null>(null);
+  const droppedOnTeardownRef = useRef(0);
 
   // Shared persistence path for every pending media item — the processing
   // queue's small-file finalize AND the direct-to-bucket large-video upload
@@ -167,6 +187,25 @@ export function useMediaPipeline({
   useEffect(() => {
     if (!siteConfig) return;
     destroyedRef.current = false;
+    // Changing the media settings (sizes/quality/max size) rebuilds the queue and
+    // everything still in it is dropped on the floor. Silently, until now: the
+    // files just stopped existing, mid-progress-bar. Decided HERE rather than in
+    // the cleanup because only this side can see whether the key actually
+    // changed — the effect also re-runs on an incidental identity change, and
+    // that teardown drops nothing the user cares about.
+    if (
+      prevMediaConfigKeyRef.current !== null &&
+      prevMediaConfigKeyRef.current !== mediaConfigKey &&
+      droppedOnTeardownRef.current > 0
+    ) {
+      const dropped = droppedOnTeardownRef.current;
+      onUploadNoticeRef.current?.(
+        `${dropped} upload${dropped === 1 ? "" : "s"} stopped because the image settings changed — add ${dropped === 1 ? "it" : "them"} again.`,
+      );
+      setProcessingItems([]);
+    }
+    droppedOnTeardownRef.current = 0;
+    prevMediaConfigKeyRef.current = mediaConfigKey;
     const mediaConfig = siteConfig.media;
     const queue = new ProcessingQueue({
       sizes: mediaConfig.sizes,
@@ -258,7 +297,20 @@ export function useMediaPipeline({
                 void finalize(localUrls, blobsMap, width, height);
               },
               () => {
-                void finalize(localUrls, blobsMap, result.width, result.height);
+                // The worker cannot decode a video, so it emits width/height 0 and
+                // poster generation is the ONLY source of real dimensions. Falling
+                // back to result.width/height therefore persisted a 0x0 item, which
+                // MediaItemSchema (positive ints) then rejected on every subsequent
+                // save — the editor could save nothing at all until the pending item
+                // was removed by hand, and the error named the manifest, not the
+                // video. Drop the file with a per-file error instead.
+                for (const url of Object.values(localUrls)) URL.revokeObjectURL(url);
+                uploadTargetsRef.current.delete(event.item.hash);
+                hiddenUploadsRef.current.delete(event.item.hash);
+                uploadCallbacksRef.current.delete(event.item.hash);
+                onUploadErrorRef.current?.(
+                  `"${event.item.originalName}" couldn't be read — the browser can't decode this video. Try re-encoding it as H.264 MP4.`,
+                );
               },
             );
           } else {
@@ -274,6 +326,8 @@ export function useMediaPipeline({
     queueRef.current = queue;
     return () => {
       destroyedRef.current = true;
+      const { active, queued } = queue.getStatus();
+      droppedOnTeardownRef.current = active + queued;
       queue.destroy();
       uploadCallbacksRef.current = new Map();
       uploadTargetsRef.current = new Map();
@@ -409,6 +463,8 @@ export function useMediaPipeline({
     if (!queue) return;
 
     let alreadyExisting = 0;
+    // Hashes enqueued by THIS batch — see the dedup check below.
+    const enqueuedThisBatch = new Set<string>();
     for (const file of files) {
       // Documents never touch the rasterizer: their bytes must reach the repo
       // or the bucket untransformed. Branch before every image-shaped gate
@@ -444,12 +500,17 @@ export function useMediaPipeline({
 
       const isDeleted = pendingDeletions.includes(hash);
       const existsInManifest = hash in mediaManifest.images;
-      const existsInPending = pendingMediaItems.some((i) => i.hash === hash);
+      // `enqueuedThisBatch` is what catches the same file dropped twice in ONE
+      // batch: nothing has re-rendered yet, so neither the state snapshot nor
+      // the ref has heard about the first copy, and both used to reach
+      // queue.add — producing duplicate React keys in MediaLibraryModal.
+      const existsInPending = pendingHashesRef.current.has(hash) || enqueuedThisBatch.has(hash);
       if ((existsInManifest || existsInPending) && !isDeleted) {
         alreadyExisting++;
         continue;
       }
 
+      enqueuedThisBatch.add(hash);
       uploadTargetsRef.current.set(hash, targetFolderId);
 
       let kind: "image" | "animated" | "video" = "image";
@@ -465,7 +526,7 @@ export function useMediaPipeline({
           : `${alreadyExisting} files already exist in the library and were left where they are.`,
       );
     }
-  }, [siteConfig, mediaManifest, pendingMediaItems, pendingDeletions, onUploadError, onUploadNotice, uploadLargeVideo, documents]);
+  }, [siteConfig, mediaManifest, pendingDeletions, onUploadError, onUploadNotice, uploadLargeVideo, documents]);
 
   const handleMediaDelete = useCallback(async (ids: string[]) => {
     const idSet = new Set(ids);
@@ -498,18 +559,21 @@ export function useMediaPipeline({
     });
     setPendingDeletions((prev) => [...prev, ...ids]);
 
-    setSections((prev) =>
-      prev.map((loaded) => {
-        const referenced = collectImageIds(loaded.section);
-        const hasRef = ids.some((id) => referenced.has(id));
-        if (!hasRef) return loaded;
-
-        const cleared = clearImageIds(loaded.section, idSet);
-        markSectionDirty(loaded.section.id, cleared as SectionContent);
-        setDirtySectionIds((prev) => new Set(prev).add(loaded.section.id));
-        return { ...loaded, section: { id: loaded.section.id, ...(cleared as Record<string, unknown>) } as typeof loaded.section };
-      }),
-    );
+    const clearedIds: string[] = [];
+    const repaired = sectionsRef.current.map((loaded) => {
+      const referenced = collectImageIds(loaded.section);
+      const hasRef = ids.some((id) => referenced.has(id));
+      if (!hasRef) return loaded;
+
+      const cleared = clearImageIds(loaded.section, idSet);
+      clearedIds.push(loaded.section.id);
+      markSectionDirty(loaded.section.id, cleared as SectionContent);
+      return { ...loaded, section: { id: loaded.section.id, ...(cleared as Record<string, unknown>) } as typeof loaded.section };
+    });
+    setSections(repaired);
+    if (clearedIds.length > 0) {
+      setDirtySectionIds((prev) => new Set([...prev, ...clearedIds]));
+    }
 
     if (siteConfig?.logo && onSiteConfigChange) {
       const logoIds = collectImageIds(siteConfig.logo);
@@ -541,17 +605,20 @@ export function useMediaPipeline({
       setPendingDocumentDeletions((prev) => [...prev, ...committedIds.filter((id) => !prev.includes(id))]);
     }
 
-    setSections((prev) =>
-      prev.map((loaded) => {
-        const { changed, section } = clearDocumentRefs(loaded.section, idSet);
-        if (!changed) return loaded;
-        // A nested hit returns the rewritten CONTAINER — the section that owns
-        // the child's bytes, and so the one that gets dirtied and saved.
-        markSectionDirty(section.id, section as SectionContent);
-        setDirtySectionIds((dirty) => new Set(dirty).add(section.id));
-        return { ...loaded, section };
-      }),
-    );
+    const repairedIds: string[] = [];
+    const repaired = sectionsRef.current.map((loaded) => {
+      const { changed, section } = clearDocumentRefs(loaded.section, idSet);
+      if (!changed) return loaded;
+      // A nested hit returns the rewritten CONTAINER — the section that owns
+      // the child's bytes, and so the one that gets dirtied and saved.
+      repairedIds.push(section.id);
+      markSectionDirty(section.id, section as SectionContent);
+      return { ...loaded, section };
+    });
+    setSections(repaired);
+    if (repairedIds.length > 0) {
+      setDirtySectionIds((dirty) => new Set([...dirty, ...repairedIds]));
+    }
 
     setLocalChangesExist(true);
   }, [documents, documentManifest, markSectionDirty, setSections, setDirtySectionIds, setLocalChangesExist]);
@@ -695,22 +762,27 @@ export function useMediaPipeline({
   // instead of stringifying every section and regex-scanning it per known id.
   // Counts every referenced imageId; the consumer (MediaLibraryModal) only looks
   // up manifest/pending ids, so extra keys for any dangling references are inert.
-  const referenceCountMap = useMemo((): Record<string, number> => {
+  //
+  // Deliberately a THUNK, not a useMemo. As a memo it recursed through every
+  // section plus the whole siteConfig on every keystroke, for a consumer (the
+  // media modal) that is closed almost all of the time. EditorShell calls this
+  // when the modal opens.
+  const computeReferenceCountMap = useCallback((): Record<string, number> => {
     const counts = new Map<string, number>();
-    for (const { section } of sections) tallyImageIds(section, counts);
+    for (const { section } of sectionsRef.current) tallyImageIds(section, counts);
     if (siteConfig) tallyImageIds(siteConfig, counts);
     return Object.fromEntries(counts);
-  }, [sections, siteConfig]);
+  }, [siteConfig]);
 
-  // The document twin of referenceCountMap, feeding the media modal's document
-  // usage pills and its delete confirmation. Unlike images, documents are never
-  // referenced by siteConfig — only by `document` sections, nested ones
-  // included (tallyDocumentIds recurses).
-  const documentReferenceCountMap = useMemo((): Record<string, number> => {
+  // The document twin, feeding the media modal's document usage pills and its
+  // delete confirmation. Unlike images, documents are never referenced by
+  // siteConfig — only by `document` sections, nested ones included
+  // (tallyDocumentIds recurses).
+  const computeDocumentReferenceCountMap = useCallback((): Record<string, number> => {
     const counts = new Map<string, number>();
-    for (const { section } of sections) tallyDocumentIds(section, counts);
+    for (const { section } of sectionsRef.current) tallyDocumentIds(section, counts);
     return Object.fromEntries(counts);
-  }, [sections]);
+  }, []);
 
   // --- Unified enqueue ---
 
@@ -820,8 +892,8 @@ export function useMediaPipeline({
     handleFolderDelete,
     handleMediaMove,
     handleFolderUpload,
-    referenceCountMap,
-    documentReferenceCountMap,
+    computeReferenceCountMap,
+    computeDocumentReferenceCountMap,
     contextValue,
     enqueueFile,
     pendingDocuments: documents.pendingDocuments,
@@ -829,6 +901,7 @@ export function useMediaPipeline({
     documentUploadProgress: documents.documentUploadProgress,
     uploadDocument: documents.uploadDocument,
     publishDocuments: documents.publishDocuments,
+    unstageAllDocuments: documents.unstageAllDocuments,
     hydratePendingDocuments: documents.hydratePendingDocuments,
   };
 }

package/src/hooks/useSanitizedHtml.ts

@@ -0,0 +1,29 @@
+import { useEffect, useState } from "react";
+import { ensureSanitizer, isSanitizerReady, sanitizeHtml } from "../lib/sanitize";
+
+/**
+ * Sanitized HTML for `dangerouslySetInnerHTML`, withheld until DOMPurify has
+ * loaded. `sanitizeHtml` is synchronous and returns its input unchanged while
+ * the dynamic import is in flight, so calling it directly injects raw stored
+ * markup on first paint — the editor loads section JSON straight from GitHub and
+ * never passes it through core's server-side sanitizer. Returning "" until the
+ * purifier resolves is the same gate ChatPanel applies to streamed markdown.
+ *
+ * On the server this is a straight pass-through (see `isSanitizerReady`).
+ */
+export function useSanitizedHtml(html: string): string {
+  const [ready, setReady] = useState(isSanitizerReady);
+
+  useEffect(() => {
+    if (ready) return;
+    let alive = true;
+    void ensureSanitizer().then(() => {
+      if (alive) setReady(true);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [ready]);
+
+  return ready ? sanitizeHtml(html) : "";
+}

package/src/lib/audience-secret.ts

@@ -97,3 +97,4 @@ export async function openAudiencePassword(sealed: string | null | undefined): P
     return null;
   }
 }
+

package/src/lib/block-move.ts

@@ -51,7 +51,15 @@ function defaultNewId(): string {
     : `block-${Math.random().toString(36).slice(2)}`;
 }
 
-const DEFAULT_CHILD_META = (type: string): SectionMeta => ({ type, status: "draft", access: [] });
+// A container's children carry no status/access of their own — they inherit the
+// container's. Promoting one to the page root therefore inherits that container's
+// meta: defaulting to `status: "draft"` silently pulled a block that viewers
+// could see out of the published site, with nothing in the editor saying so.
+const promotedChildMeta = (type: string, source: SectionMeta | undefined): SectionMeta => ({
+  type,
+  status: source?.status ?? "draft",
+  access: [...(source?.access ?? [])],
+});
 
 function isContainerSection(section: Section): boolean {
   return Array.isArray((section.content as { children?: unknown })?.children);
@@ -141,7 +149,10 @@ export function applyBlockMove(
 
   if (toContainerId === ROOT_CONTAINER_ID) {
     const { layout: _dropLayout, ...rootBlock } = moving as Section & { layout?: unknown };
-    const meta = DEFAULT_CHILD_META(rootBlock.type);
+    const meta = promotedChildMeta(
+      rootBlock.type,
+      sections.find((l) => l.section.id === fromContainerId)?.meta,
+    );
     const rootOrder = nextIndex.pages.find((p) => p.id === rootPageId)?.order ?? [];
     nextIndex = addSectionToPage(nextIndex, rootPageId, rootBlock.id, meta,
       visibleInsertPosition(rootOrder, visibleRootIds(nextIndex, rootPageId, nextSections), toIndex));

package/src/lib/contrast.ts

@@ -1,3 +1,14 @@
+/** Hex → sRGB bytes, expanding the 3-digit form. */
+function toRgb(hex: string): [number, number, number] {
+  const h = hex.replace("#", "");
+  const x = h.length === 3 ? h[0] + h[0] + h[1] + h[1] + h[2] + h[2] : h;
+  return [
+    parseInt(x.slice(0, 2), 16),
+    parseInt(x.slice(2, 4), 16),
+    parseInt(x.slice(4, 6), 16),
+  ];
+}
+
 export function deriveContrast(hex: string): string {
   const h = hex.replace("#", "");
   const expanded = h.length === 3
@@ -15,25 +26,14 @@ export function deriveContrast(hex: string): string {
  * uses). Returns near-black for light backgrounds, white for dark ones.
  */
 export function contrastColor(hex: string): "#1a1a1a" | "#ffffff" {
-  const h = hex.replace("#", "");
-  const r = parseInt(h.slice(0, 2), 16);
-  const g = parseInt(h.slice(2, 4), 16);
-  const b = parseInt(h.slice(4, 6), 16);
+  // Through toRgb so a 3-digit hex expands first. Slicing "fff" directly gave
+  // b = NaN, the comparison came out false, and #fff got white text on white.
+  const [r, g, b] = toRgb(hex);
   return (r * 299 + g * 587 + b * 114) / 1000 > 150 ? "#1a1a1a" : "#ffffff";
 }
 
 // --- WCAG 2.x contrast (relative-luminance based) -------------------------
 
-function toRgb(hex: string): [number, number, number] {
-  const h = hex.replace("#", "");
-  const x = h.length === 3 ? h[0] + h[0] + h[1] + h[1] + h[2] + h[2] : h;
-  return [
-    parseInt(x.slice(0, 2), 16),
-    parseInt(x.slice(2, 4), 16),
-    parseInt(x.slice(4, 6), 16),
-  ];
-}
-
 /** WCAG relative luminance of an sRGB hex color (0 = black, 1 = white). */
 export function relativeLuminance(hex: string): number {
   const [r, g, b] = toRgb(hex).map((c) => {