@elytracms/core 0.0.6

package/dist/operations/schema.js

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { collectionDefSchema, fieldDefSchema } from '@elytracms/core/cms-core';
+import { projectIdSchema } from '@elytracms/core/studio-core';
+import { OperationFailure, bindOperation, defineCommand, defineQuery, notFoundError } from './core';
+/**
+ * CMS schema operations: collections and fields (EC-139). The persistence
+ * boundary stores the schema as one record per project (`CmsRepository.saveSchema`),
+ * so collection- and field-level commands load, edit, and re-save it — keeping
+ * the canonical structural validation (duplicate ids, bad select options) in
+ * the repository.
+ */
+export const saveSchemaInputSchema = z.object({
+    projectId: projectIdSchema,
+    collections: z.array(collectionDefSchema),
+});
+export const upsertCollectionInputSchema = z.object({
+    projectId: projectIdSchema,
+    collection: collectionDefSchema,
+});
+export const removeCollectionInputSchema = z.object({
+    projectId: projectIdSchema,
+    collectionId: z.string().min(1),
+});
+export const upsertFieldInputSchema = z.object({
+    projectId: projectIdSchema,
+    collectionId: z.string().min(1),
+    field: fieldDefSchema,
+});
+export const removeFieldInputSchema = z.object({
+    projectId: projectIdSchema,
+    collectionId: z.string().min(1),
+    fieldName: z.string().min(1),
+});
+export const getSchemaInputSchema = z.object({
+    projectId: projectIdSchema,
+});
+/** Load the project's collections, tolerating a not-yet-created schema. */
+async function loadCollections(context, projectId) {
+    const record = await context.adapter.cms.findSchema(projectId);
+    return record ? [...record.collections] : [];
+}
+/** Load a collection or fail with a structured not-found error. */
+async function requireCollection(context, projectId, collectionId) {
+    const collections = await loadCollections(context, projectId);
+    const index = collections.findIndex((c) => c.id === collectionId);
+    if (index < 0) {
+        throw new OperationFailure(notFoundError('collection', `${projectId}/${collectionId}`));
+    }
+    return { collections, index };
+}
+export const schemaOperationDefinitions = {
+    save: defineCommand({
+        name: 'schema.save',
+        domain: 'schema',
+        description: 'Replace the full CMS collection schema of a project.',
+        input: saveSchemaInputSchema,
+        execute: (context, input) => context.adapter.cms.saveSchema(input.projectId, input.collections),
+    }),
+    upsertCollection: defineCommand({
+        name: 'schema.upsertCollection',
+        domain: 'schema',
+        description: 'Add a collection to the project schema, or replace it by id.',
+        input: upsertCollectionInputSchema,
+        execute: async (context, input) => {
+            const collections = await loadCollections(context, input.projectId);
+            const index = collections.findIndex((c) => c.id === input.collection.id);
+            if (index >= 0)
+                collections[index] = input.collection;
+            else
+                collections.push(input.collection);
+            return context.adapter.cms.saveSchema(input.projectId, collections);
+        },
+    }),
+    removeCollection: defineCommand({
+        name: 'schema.removeCollection',
+        domain: 'schema',
+        description: 'Remove a collection from the project schema.',
+        input: removeCollectionInputSchema,
+        execute: async (context, input) => {
+            const { collections } = await requireCollection(context, input.projectId, input.collectionId);
+            return context.adapter.cms.saveSchema(input.projectId, collections.filter((c) => c.id !== input.collectionId));
+        },
+    }),
+    upsertField: defineCommand({
+        name: 'schema.upsertField',
+        domain: 'schema',
+        description: 'Add a field to a collection, or replace it by name.',
+        input: upsertFieldInputSchema,
+        execute: async (context, input) => {
+            const { collections, index } = await requireCollection(context, input.projectId, input.collectionId);
+            const collection = collections[index];
+            const fields = [...collection.fields];
+            const fieldIndex = fields.findIndex((f) => f.name === input.field.name);
+            if (fieldIndex >= 0)
+                fields[fieldIndex] = input.field;
+            else
+                fields.push(input.field);
+            collections[index] = { ...collection, fields };
+            return context.adapter.cms.saveSchema(input.projectId, collections);
+        },
+    }),
+    removeField: defineCommand({
+        name: 'schema.removeField',
+        domain: 'schema',
+        description: 'Remove a field from a collection by name.',
+        input: removeFieldInputSchema,
+        execute: async (context, input) => {
+            const { collections, index } = await requireCollection(context, input.projectId, input.collectionId);
+            const collection = collections[index];
+            if (!collection.fields.some((f) => f.name === input.fieldName)) {
+                throw new OperationFailure(notFoundError('field', `${input.collectionId}/${input.fieldName}`));
+            }
+            collections[index] = {
+                ...collection,
+                fields: collection.fields.filter((f) => f.name !== input.fieldName),
+            };
+            return context.adapter.cms.saveSchema(input.projectId, collections);
+        },
+    }),
+    get: defineQuery({
+        name: 'schema.get',
+        domain: 'schema',
+        description: 'Load the persisted CMS schema of a project.',
+        input: getSchemaInputSchema,
+        execute: (context, input) => context.adapter.cms.getSchema(input.projectId),
+    }),
+};
+export function createSchemaOperations(runtime) {
+    return {
+        save: bindOperation(runtime, schemaOperationDefinitions.save),
+        upsertCollection: bindOperation(runtime, schemaOperationDefinitions.upsertCollection),
+        removeCollection: bindOperation(runtime, schemaOperationDefinitions.removeCollection),
+        upsertField: bindOperation(runtime, schemaOperationDefinitions.upsertField),
+        removeField: bindOperation(runtime, schemaOperationDefinitions.removeField),
+        get: bindOperation(runtime, schemaOperationDefinitions.get),
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/operations/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/operations/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAA;AAGnG;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,eAAe;IAC1B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CAC1C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,mBAAmB;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,eAAe;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,eAAe;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,KAAK,EAAE,cAAc;CACtB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,eAAe;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAA;AAEF,2EAA2E;AAC3E,KAAK,UAAU,eAAe,CAC5B,OAAyB,EACzB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,iBAAiB,CAC9B,OAAyB,EACzB,SAAiB,EACjB,YAAoB;IAEpB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;IACjE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,YAAY,EAAE,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,IAAI,EAAE,aAAa,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,sDAAsD;QACnE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC;KAChG,CAAC;IACF,gBAAgB,EAAE,aAAa,CAAC;QAC9B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,8DAA8D;QAC3E,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YACxE,IAAI,KAAK,IAAI,CAAC;gBAAE,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAA;;gBAChD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACrE,CAAC;KACF,CAAC;IACF,gBAAgB,EAAE,aAAa,CAAC;QAC9B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,8CAA8C;QAC3D,KAAK,EAAE,2BAA2B;QAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;YAC7F,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CACnC,KAAK,CAAC,SAAS,EACf,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,CACvD,CAAA;QACH,CAAC;KACF,CAAC;IACF,WAAW,EAAE,aAAa,CAAC;QACzB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,qDAAqD;QAClE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,iBAAiB,CACpD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,YAAY,CACnB,CAAA;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;YACtC,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvE,IAAI,UAAU,IAAI,CAAC;gBAAE,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;;gBAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC7B,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAA;YAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACrE,CAAC;KACF,CAAC;IACF,WAAW,EAAE,aAAa,CAAC;QACzB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,2CAA2C;QACxD,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,iBAAiB,CACpD,OAAO,EACP,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,YAAY,CACnB,CAAA;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAE,CAAA;YACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,gBAAgB,CACxB,aAAa,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CACnE,CAAA;YACH,CAAC;YACD,WAAW,CAAC,KAAK,CAAC,GAAG;gBACnB,GAAG,UAAU;gBACb,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC;aACpE,CAAA;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACrE,CAAC;KACF,CAAC;IACF,GAAG,EAAE,WAAW,CAAC;QACf,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,6CAA6C;QAC1D,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;KAC5E,CAAC;CACM,CAAA;AAEV,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,OAAO;QACL,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC;QAC7D,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,gBAAgB,CAAC;QACrF,WAAW,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,WAAW,CAAC;QAC3E,WAAW,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,WAAW,CAAC;QAC3E,GAAG,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,CAAC,GAAG,CAAC;KAC5D,CAAA;AACH,CAAC"}

package/dist/operations/tokens.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import type { PersistenceAdapter, ProjectRole } from '@elytracms/core/persistence';
+import type { OperationsRuntime } from './core';
+/**
+ * Revocable per-project CLI tokens (EC-150; consumed by the EC-147/148 sync
+ * CLI, which sends them as `Authorization: Bearer <token>`).
+ *
+ * Lifecycle:
+ * 1. `tokens.issue` (admin-only via the EC-150 role hook) generates the
+ *    plaintext once, persists only its SHA-256 hash, and returns the plaintext
+ *    in the result — it is never stored or retrievable again.
+ * 2. The CLI presents the plaintext; the builder-side endpoint (EC-156 HTTP
+ *    wiring) calls {@link verifyCliToken}, which hashes and looks it up.
+ * 3. `tokens.revoke` stamps `revokedAt`; revoked tokens never verify again but
+ *    stay listed for auditability.
+ *
+ * Token issuance UI is deliberately out of scope for v1 — admins issue tokens
+ * via the operations layer (CLI/ops tooling); see the EC-150 task notes.
+ */
+/** Plaintext token shape: `ect_` + 48 hex chars (24 random bytes). */
+export declare const CLI_TOKEN_PREFIX = "ect_";
+/** Hex SHA-256 via Web Crypto — available in browsers, Node 18+, and Convex. */
+export declare function sha256Hex(value: string): Promise<string>;
+/** Generate a fresh plaintext token (the only moment it exists outside the caller). */
+export declare function generateCliToken(): string;
+/** Safe, listable view of a stored token — never includes the hash. */
+export interface CliTokenSummary {
+    readonly id: string;
+    readonly label: string;
+    readonly createdAt: string;
+    readonly revokedAt?: string;
+}
+export declare const issueTokenInputSchema: z.ZodObject<{
+    label: z.ZodString;
+}, z.core.$strip>;
+export declare const revokeTokenInputSchema: z.ZodObject<{
+    tokenId: z.ZodString;
+}, z.core.$strip>;
+export declare const listTokensInputSchema: z.ZodObject<{}, z.core.$strip>;
+export declare const tokenOperationDefinitions: {
+    readonly issue: import("./core").OperationDefinition<z.ZodObject<{
+        label: z.ZodString;
+    }, z.core.$strip>, {
+        token: string;
+        summary: CliTokenSummary;
+    }>;
+    readonly revoke: import("./core").OperationDefinition<z.ZodObject<{
+        tokenId: z.ZodString;
+    }, z.core.$strip>, CliTokenSummary>;
+    readonly list: import("./core").OperationDefinition<z.ZodObject<{}, z.core.$strip>, CliTokenSummary[]>;
+};
+export declare function createTokenOperations(runtime: OperationsRuntime): {
+    issue: (input: {
+        label: string;
+    }) => Promise<import("./core").OperationResult<{
+        token: string;
+        summary: CliTokenSummary;
+    }>>;
+    revoke: (input: {
+        tokenId: string;
+    }) => Promise<import("./core").OperationResult<CliTokenSummary>>;
+    list: (input: Record<string, never>) => Promise<import("./core").OperationResult<CliTokenSummary[]>>;
+};
+export type TokenOperations = ReturnType<typeof createTokenOperations>;
+/** Result of a successful CLI token verification. */
+export interface VerifiedCliToken {
+    /**
+     * The capability the token grants. CLI tokens push component manifests and
+     * pull project data — `editor`-level content access, never administration.
+     */
+    readonly role: ProjectRole;
+}
+/**
+ * Server-side verification for the EC-147 Bearer token: hash the presented
+ * plaintext, look it up, and reject revoked/unknown tokens. The builder's
+ * registry-sync HTTP endpoint (EC-156) calls this before touching any
+ * repository.
+ */
+export declare function verifyCliToken(adapter: PersistenceAdapter, token: string): Promise<VerifiedCliToken | null>;

package/dist/operations/tokens.js

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+import { bindOperation, defineCommand, defineQuery } from './core';
+/**
+ * Revocable per-project CLI tokens (EC-150; consumed by the EC-147/148 sync
+ * CLI, which sends them as `Authorization: Bearer <token>`).
+ *
+ * Lifecycle:
+ * 1. `tokens.issue` (admin-only via the EC-150 role hook) generates the
+ *    plaintext once, persists only its SHA-256 hash, and returns the plaintext
+ *    in the result — it is never stored or retrievable again.
+ * 2. The CLI presents the plaintext; the builder-side endpoint (EC-156 HTTP
+ *    wiring) calls {@link verifyCliToken}, which hashes and looks it up.
+ * 3. `tokens.revoke` stamps `revokedAt`; revoked tokens never verify again but
+ *    stay listed for auditability.
+ *
+ * Token issuance UI is deliberately out of scope for v1 — admins issue tokens
+ * via the operations layer (CLI/ops tooling); see the EC-150 task notes.
+ */
+/** Plaintext token shape: `ect_` + 48 hex chars (24 random bytes). */
+export const CLI_TOKEN_PREFIX = 'ect_';
+const TOKEN_RANDOM_BYTES = 24;
+/** Hex SHA-256 via Web Crypto — available in browsers, Node 18+, and Convex. */
+export async function sha256Hex(value) {
+    const bytes = new TextEncoder().encode(value);
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Generate a fresh plaintext token (the only moment it exists outside the caller). */
+export function generateCliToken() {
+    const bytes = new Uint8Array(TOKEN_RANDOM_BYTES);
+    globalThis.crypto.getRandomValues(bytes);
+    return `${CLI_TOKEN_PREFIX}${[...bytes].map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+}
+function toSummary(record) {
+    return {
+        id: record.id,
+        label: record.label,
+        createdAt: record.createdAt,
+        ...(record.revokedAt ? { revokedAt: record.revokedAt } : {}),
+    };
+}
+export const issueTokenInputSchema = z.object({
+    label: z.string().min(1).max(80),
+});
+export const revokeTokenInputSchema = z.object({
+    tokenId: z.string().min(1),
+});
+export const listTokensInputSchema = z.object({});
+export const tokenOperationDefinitions = {
+    issue: defineCommand({
+        name: 'tokens.issue',
+        domain: 'tokens',
+        description: 'Issue a revocable CLI sync token for a project. Returns the plaintext exactly once; only its SHA-256 hash is stored.',
+        input: issueTokenInputSchema,
+        // Never log the (future) plaintext: summarize by label only.
+        summarize: (input) => JSON.stringify({ label: input.label }),
+        execute: async (context, input) => {
+            const token = generateCliToken();
+            const record = await context.adapter.cliTokens.createToken({
+                label: input.label,
+                tokenHash: await sha256Hex(token),
+            });
+            return { token, summary: toSummary(record) };
+        },
+    }),
+    revoke: defineCommand({
+        name: 'tokens.revoke',
+        domain: 'tokens',
+        description: 'Revoke a CLI token. Revoked tokens never verify again but stay listed.',
+        input: revokeTokenInputSchema,
+        execute: async (context, input) => toSummary(await context.adapter.cliTokens.revokeToken(input.tokenId)),
+    }),
+    list: defineQuery({
+        name: 'tokens.list',
+        domain: 'tokens',
+        description: 'List the CLI tokens of this deployment (metadata only — hashes are never returned).',
+        input: listTokensInputSchema,
+        execute: async (context) => (await context.adapter.cliTokens.listTokens()).map(toSummary),
+    }),
+};
+export function createTokenOperations(runtime) {
+    return {
+        issue: bindOperation(runtime, tokenOperationDefinitions.issue),
+        revoke: bindOperation(runtime, tokenOperationDefinitions.revoke),
+        list: bindOperation(runtime, tokenOperationDefinitions.list),
+    };
+}
+/**
+ * Server-side verification for the EC-147 Bearer token: hash the presented
+ * plaintext, look it up, and reject revoked/unknown tokens. The builder's
+ * registry-sync HTTP endpoint (EC-156) calls this before touching any
+ * repository.
+ */
+export async function verifyCliToken(adapter, token) {
+    if (!token || !token.startsWith(CLI_TOKEN_PREFIX))
+        return null;
+    const record = await adapter.cliTokens.findByHash(await sha256Hex(token));
+    if (!record || record.revokedAt)
+        return null;
+    return { role: 'editor' };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/operations/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/operations/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAGlE;;;;;;;;;;;;;;;GAeG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAEtC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACtE,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,kBAAkB,CAAC,CAAA;IAChD,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,GAAG,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;AAChG,CAAC;AAUD,SAAS,SAAS,CAAC,MAAsB;IACvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAEjD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,KAAK,EAAE,aAAa,CAAC;QACnB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,QAAQ;QAChB,WAAW,EACT,sHAAsH;QACxH,KAAK,EAAE,qBAAqB;QAC5B,6DAA6D;QAC7D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;gBACzD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC;aAClC,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAA;QAC9C,CAAC;KACF,CAAC;IACF,MAAM,EAAE,aAAa,CAAC;QACpB,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,wEAAwE;QACrF,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAChC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;KACxE,CAAC;IACF,IAAI,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,QAAQ;QAChB,WAAW,EACT,qFAAqF;QACvF,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;KAC1F,CAAC;CACM,CAAA;AAEV,MAAM,UAAU,qBAAqB,CAAC,OAA0B;IAC9D,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC;QAC9D,MAAM,EAAE,aAAa,CAAC,OAAO,EAAE,yBAAyB,CAAC,MAAM,CAAC;QAChE,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC;KAC7D,CAAA;AACH,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA2B,EAC3B,KAAa;IAEb,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC3B,CAAC"}

package/dist/persistence/adapter.d.ts

@@ -0,0 +1,79 @@
+import { type BackendStatus, type Clock } from './core';
+import type { GraphRepository } from './graph';
+import type { CmsRepository } from './cms';
+import type { AssetRepository, BlobStorageAdapter } from './assets';
+import type { PublishingRepository } from './publishing';
+import type { ReferenceIndexRepository } from './references';
+import type { MembersRepository } from './members';
+import type { CliTokenRepository } from './cli-tokens';
+import type { BackendValidationInput, BackendValidationResult } from './backend-validation';
+/**
+ * The aggregate persistence boundary (brief §4.10, §10). Core packages depend on
+ * this interface — never on Convex directly. A Convex-backed implementation and
+ * the in-memory implementation below both satisfy it, so the Studio, seeds, and
+ * tests are provider-agnostic.
+ */
+export interface PersistenceAdapter {
+    readonly graphs: GraphRepository;
+    readonly cms: CmsRepository;
+    readonly assets: AssetRepository;
+    readonly publishing: PublishingRepository;
+    /** Reference index — outbound/inbound reference entries per variant (EC-155, AD-6). */
+    readonly references: ReferenceIndexRepository;
+    /**
+     * Whether this adapter keeps the reference index current in its own write path
+     * (EC-277, AD-6 "maintained at the source"). When `true`, the studio bootstrap
+     * does NOT attach the legacy client-side `attachReferenceIndex` subscriber —
+     * maintenance lives in the store (in-process via `withMaintainedReferenceIndex`,
+     * or server-side in the Convex mutations). Absent/`false` for a bare adapter
+     * that still relies on the subscriber.
+     */
+    readonly maintainsReferenceIndex?: boolean;
+    /** Per-project membership roles — admin/editor/viewer (EC-150, AD-7). */
+    readonly members: MembersRepository;
+    /** Revocable per-project CLI sync tokens, stored hashed (EC-150). */
+    readonly cliTokens: CliTokenRepository;
+    /** Blob storage boundary for asset bytes. */
+    readonly blobs: BlobStorageAdapter;
+    /** Backend identity + reachability, for degraded-state UI. */
+    status(): Promise<BackendStatus>;
+    /** Server-side validation service (brief §4.11, EC-047). */
+    validate(input: BackendValidationInput): BackendValidationResult;
+}
+export interface InMemoryPersistenceAdapterOptions {
+    /** Shared deterministic clock across all repositories. */
+    clock?: Clock;
+    graphs?: GraphRepository;
+    cms?: CmsRepository;
+    assets?: AssetRepository;
+    publishing?: PublishingRepository;
+    references?: ReferenceIndexRepository;
+    members?: MembersRepository;
+    cliTokens?: CliTokenRepository;
+    blobs?: BlobStorageAdapter;
+    /**
+     * EC-277: keep the reference index current in the write path (AD-6). When set,
+     * each document/graph/publishing write reindexes the affected source in the same
+     * call, so the index never relies on a client-side subscriber. Default `false`.
+     */
+    maintainReferenceIndex?: boolean;
+}
+/**
+ * In-memory implementation of {@link PersistenceAdapter} (brief §10). Backs
+ * deterministic fixtures, tests, smoke validation, and browser inspection before
+ * (and alongside) Convex.
+ */
+export declare class InMemoryPersistenceAdapter implements PersistenceAdapter {
+    readonly graphs: GraphRepository;
+    readonly cms: CmsRepository;
+    readonly assets: AssetRepository;
+    readonly publishing: PublishingRepository;
+    readonly references: ReferenceIndexRepository;
+    readonly members: MembersRepository;
+    readonly cliTokens: CliTokenRepository;
+    readonly blobs: BlobStorageAdapter;
+    readonly maintainsReferenceIndex: boolean;
+    constructor(options?: InMemoryPersistenceAdapterOptions);
+    status(): Promise<BackendStatus>;
+    validate(input: BackendValidationInput): BackendValidationResult;
+}

package/dist/persistence/adapter.js

@@ -0,0 +1,55 @@
+import { createSequentialClock, } from './core';
+import { InMemoryGraphRepository } from './graph';
+import { InMemoryCmsRepository } from './cms';
+import { InMemoryAssetRepository, InMemoryBlobStorage } from './assets';
+import { InMemoryPublishingRepository } from './publishing';
+import { InMemoryReferenceIndexRepository } from './references';
+import { InMemoryMembersRepository } from './members';
+import { InMemoryCliTokenRepository } from './cli-tokens';
+import { validateForPersistence } from './backend-validation';
+import { maintainReferenceIndex } from './self-maintaining-adapter';
+/**
+ * In-memory implementation of {@link PersistenceAdapter} (brief §10). Backs
+ * deterministic fixtures, tests, smoke validation, and browser inspection before
+ * (and alongside) Convex.
+ */
+export class InMemoryPersistenceAdapter {
+    graphs;
+    cms;
+    assets;
+    publishing;
+    references;
+    members;
+    cliTokens;
+    blobs;
+    maintainsReferenceIndex = false;
+    constructor(options = {}) {
+        const clock = options.clock ?? createSequentialClock();
+        this.graphs = options.graphs ?? new InMemoryGraphRepository({ clock });
+        this.cms = options.cms ?? new InMemoryCmsRepository({ clock });
+        this.assets = options.assets ?? new InMemoryAssetRepository({ clock });
+        this.publishing = options.publishing ?? new InMemoryPublishingRepository({ clock });
+        this.references = options.references ?? new InMemoryReferenceIndexRepository();
+        this.members = options.members ?? new InMemoryMembersRepository({ clock });
+        this.cliTokens = options.cliTokens ?? new InMemoryCliTokenRepository({ clock });
+        this.blobs = options.blobs ?? new InMemoryBlobStorage();
+        // EC-277: opt into write-path index maintenance (AD-6 "at the source"). Wrap
+        // the write-bearing repos so a raw `cms.upsertDocument` — no operations layer,
+        // no subscriber — reindexes in the same call, mirroring the Convex server-side
+        // mutations. Off by default so existing callers' behaviour is unchanged.
+        if (options.maintainReferenceIndex) {
+            const maintained = maintainReferenceIndex({ cms: this.cms, graphs: this.graphs, publishing: this.publishing }, () => this);
+            this.cms = maintained.cms;
+            this.graphs = maintained.graphs;
+            this.publishing = maintained.publishing;
+            this.maintainsReferenceIndex = true;
+        }
+    }
+    async status() {
+        return { backend: 'in-memory', available: true };
+    }
+    validate(input) {
+        return validateForPersistence(input);
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/persistence/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/persistence/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAGtB,MAAM,QAAQ,CAAA;AACf,OAAO,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAA;AAE7C,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAEvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAE3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,cAAc,CAAA;AAE/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAErD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAuDnE;;;;GAIG;AACH,MAAM,OAAO,0BAA0B;IAC5B,MAAM,CAAiB;IACvB,GAAG,CAAe;IAClB,MAAM,CAAiB;IACvB,UAAU,CAAsB;IAChC,UAAU,CAA0B;IACpC,OAAO,CAAmB;IAC1B,SAAS,CAAoB;IAC7B,KAAK,CAAoB;IACzB,uBAAuB,GAAY,KAAK,CAAA;IAEjD,YAAY,UAA6C,EAAE;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAA;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,4BAA4B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACnF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,gCAAgC,EAAE,CAAA;QAC9E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,yBAAyB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAA;QACvD,6EAA6E;QAC7E,+EAA+E;QAC/E,+EAA+E;QAC/E,yEAAyE;QACzE,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,sBAAsB,CACvC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EACnE,GAAG,EAAE,CAAC,IAAI,CACX,CAAA;YACD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAA;YACzB,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAA;YACvC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAA;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAClD,CAAC;IAED,QAAQ,CAAC,KAA6B;QACpC,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;CACF"}

package/dist/persistence/assets.d.ts

@@ -0,0 +1,120 @@
+import { z } from 'zod';
+import { type Clock, type IdFactory } from './core';
+/**
+ * Persisted asset metadata (brief §7.4, §8.6, §10). The bytes themselves live in
+ * a {@link BlobStorageAdapter}; this record is the queryable metadata that CMS
+ * `asset` fields point at by id.
+ */
+export declare const assetRecordSchema: z.ZodObject<{
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    id: z.ZodString;
+    projectId: z.ZodString;
+    filename: z.ZodString;
+    contentType: z.ZodString;
+    byteSize: z.ZodNumber;
+    width: z.ZodOptional<z.ZodNumber>;
+    height: z.ZodOptional<z.ZodNumber>;
+    alt: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    storageKey: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+    focalPoint: z.ZodOptional<z.ZodObject<{
+        x: z.ZodNumber;
+        y: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AssetRecord = z.infer<typeof assetRecordSchema>;
+export interface NewAssetInput {
+    id?: string;
+    filename: string;
+    contentType: string;
+    byteSize: number;
+    width?: number;
+    height?: number;
+    alt?: string;
+    /** Editable display title (EC-152 asset library metadata). */
+    title?: string;
+    /** Defaults to a key derived from the asset id. */
+    storageKey?: string;
+    /** Resolvable serve URL for the stored bytes (EC-151). */
+    url?: string;
+    /** Normalized image focal point `{ x, y }` in 0–1 (EC-230). */
+    focalPoint?: {
+        x: number;
+        y: number;
+    };
+}
+/**
+ * Storage boundary for asset *bytes* (brief §8.6). Project-owned and swappable
+ * (Convex file storage, S3, etc.); the in-memory implementation backs tests and
+ * local inspection. Metadata stays in the {@link AssetRepository}.
+ */
+export interface BlobStorageAdapter {
+    put(key: string, data: Uint8Array, contentType?: string): Promise<void>;
+    get(key: string): Promise<Uint8Array | undefined>;
+    /** A resolvable locator for the blob (e.g. a CDN/file URL). */
+    url(key: string): string;
+    has(key: string): Promise<boolean>;
+    delete(key: string): Promise<void>;
+    /**
+     * Store bytes under a backend-assigned key and return it (EC-151). Backends
+     * like Convex file storage mint their own ids, so callers cannot choose the
+     * key up front the way {@link put} assumes. Optional; in-memory implements it
+     * deterministically.
+     */
+    store?(data: Uint8Array, contentType?: string): Promise<string>;
+    /**
+     * Mint a short-lived URL the client can POST bytes to directly (EC-151,
+     * Convex `storage.generateUploadUrl()`). Optional — backends without
+     * client-direct uploads omit it and callers fall back to {@link store}/{@link put}.
+     */
+    createUploadUrl?(): Promise<string>;
+    /**
+     * Resolve the serve URL for a stored blob asynchronously (EC-151, Convex
+     * `storage.getUrl()`). Returns `undefined` when the blob does not exist.
+     * Optional; backends with synchronous stable URLs can rely on {@link url}.
+     */
+    resolveUrl?(key: string): Promise<string | undefined>;
+}
+export declare class InMemoryBlobStorage implements BlobStorageAdapter {
+    private readonly blobs;
+    /** Deterministic backend-assigned keys (no Date/random). */
+    private seq;
+    put(key: string, data: Uint8Array): Promise<void>;
+    get(key: string): Promise<Uint8Array | undefined>;
+    url(key: string): string;
+    has(key: string): Promise<boolean>;
+    delete(key: string): Promise<void>;
+    store(data: Uint8Array): Promise<string>;
+    resolveUrl(key: string): Promise<string | undefined>;
+}
+/** Persists asset metadata records (brief §7.4, §8.6, §10). */
+export interface AssetRepository {
+    upsertAsset(projectId: string, input: NewAssetInput): Promise<AssetRecord>;
+    getAsset(projectId: string, id: string): Promise<AssetRecord>;
+    findAsset(projectId: string, id: string): Promise<AssetRecord | undefined>;
+    listAssets(projectId: string): Promise<AssetRecord[]>;
+    removeAsset(projectId: string, id: string): Promise<void>;
+    /** Resolve persisted metadata for the asset ids referenced by CMS fields. */
+    resolveMany(projectId: string, ids: readonly string[]): Promise<Map<string, AssetRecord>>;
+}
+export interface InMemoryAssetRepositoryOptions {
+    clock?: Clock;
+    idFactory?: IdFactory;
+    seed?: readonly AssetRecord[];
+}
+export declare class InMemoryAssetRepository implements AssetRepository {
+    /** projectId → (assetId → record). */
+    private readonly byProject;
+    private readonly clock;
+    private readonly nextId;
+    constructor(options?: InMemoryAssetRepositoryOptions);
+    private projectMap;
+    upsertAsset(projectId: string, input: NewAssetInput): Promise<AssetRecord>;
+    getAsset(projectId: string, id: string): Promise<AssetRecord>;
+    findAsset(projectId: string, id: string): Promise<AssetRecord | undefined>;
+    listAssets(projectId: string): Promise<AssetRecord[]>;
+    removeAsset(projectId: string, id: string): Promise<void>;
+    resolveMany(projectId: string, ids: readonly string[]): Promise<Map<string, AssetRecord>>;
+}