@elytracms/next 0.0.85 → 0.0.87

package/dist/index.d.ts

@@ -1,14 +1,13 @@
 import { ComponentType, ReactNode } from 'react';
 import { ComponentRegistry, ComponentIssue, ComponentManifest } from '@elytracms/core/component-registry';
 export { ComponentManifest, PropField, SlotSpec, defineComponent } from '@elytracms/core/component-registry';
-import { ComponentImplementations, ResolveBinding, RelationTarget, DocumentBodyItem } from '@elytracms/core/runtime-renderer';
+import { ComponentImplementations, RelationTarget, DocumentBodyItem } from '@elytracms/core/runtime-renderer';
 export { ComponentImplementations, RenderAsset } from '@elytracms/core/runtime-renderer';
+import { HostComponentEntry } from '@elytracms/core/studio-core';
 import { ResolvePageResult, ResolvedAsset, Perspective, ContentClient, CacheTags, ContentDocumentSource, ResolvedDocument } from '@elytracms/core/content';
 export { Perspective } from '@elytracms/core/content';
 import { LocaleConfig, Locale, RouteRecord, CollectionDef, RedirectRecord } from '@elytracms/core/cms-core';
-export { CmsDocument, CollectionDef, FieldDef, Locale, LocaleConfig, LocaleUrlPath, RedirectRecord, RouteRecord, documentSchema, fallbackHomeRoutes, localeConfigSchema, localeUrlPath, mergeRouteRecords, redirectRecordSchema, routeRecordSchema, splitLocalePath } from '@elytracms/core/cms-core';
-import { ComponentNode } from '@elytracms/core/project-graph';
-export { ComponentNode } from '@elytracms/core/project-graph';
+export { CmsDocument, CollectionDef, FieldDef, Locale, LocaleConfig, LocaleRequest, LocaleStrategy, LocaleUrlPath, RedirectRecord, RouteRecord, documentSchema, fallbackHomeRoutes, localeConfigSchema, localeUrlPath, mergeRouteRecords, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection } from '@elytracms/core/cms-core';
 import { AssetRecord, PersistenceAdapter } from '@elytracms/core/persistence';
 export { AssetRecord } from '@elytracms/core/persistence';
 import { Metadata, MetadataRoute } from 'next';
@@ -16,12 +15,19 @@ import { z } from 'zod';
 export { z } from 'zod';
 import { ImageLoader } from 'next/image';
 import { HostImageRenderer } from './host-image.js';
-import { HostComponentEntry } from '@elytracms/core/studio-core';
+export { ComponentNode } from '@elytracms/core/project-graph';
 
 /**
  * One host-repo component: the manifest the builder edits against plus the
  * real React implementation that renders it (vision AD-2 — project components
  * are real code in the host repo, never generated).
+ *
+ * This is the STRICT shape — the one a hand-authored component module should
+ * export (`export const heroComponent: HostComponent = …`), so the compiler
+ * checks the implementation where it is written. It is assignable to the
+ * config's {@link HostComponentEntry}, which is what {@link defineHostComponents}
+ * accepts, so both hand-built lists and the config's own list register through
+ * the one signature (EC-541).
  */
 interface HostComponent {
     manifest: ComponentManifest;
@@ -36,7 +42,11 @@ interface HostComponent {
 interface HostComponents {
     registry: ComponentRegistry;
     implementations: ComponentImplementations;
-    /** Structural registration issues (duplicate ids, invalid namespaces). */
+    /**
+     * Structural registration issues: the registry's own (duplicate ids, invalid
+     * namespaces, …) plus `invalid-implementation` for an entry whose
+     * `implementation` is not a React component (EC-541).
+     */
     issues: readonly ComponentIssue[];
 }
 interface DefineHostComponentsOptions {
@@ -53,73 +63,30 @@ interface DefineHostComponentsOptions {
  * default. A host implementation registered under a primitive id replaces the
  * default implementation (the manifest of the first registration wins, which
  * is the primitive's — by design, so prop schemas stay canonical).
- */
-declare function defineHostComponents(components?: readonly HostComponent[], options?: DefineHostComponentsOptions): HostComponents;
-
-/**
- * Binding payloads for the embedded runtime (EC-144): one payload value per
- * binding `sourceId`. The catch-all route helper provides `document` (the
- * route-bound resolved document) and `params` (dynamic route params) by
- * default; hosts add more through the route helper's `payloads` factory
- * (e.g. a `listDocuments` result for a posts repeater).
- *
- * This is a deliberately small, pure resolver — the embedded runtime never
- * imports `@elytracms/core/data-binding` (a builder-side package). Semantics mirror
- * EC-023 tokens: a binding token is a JSON Pointer (RFC 6901) into the
- * payload; a miss resolves to `undefined`, never a throw (the renderer turns
- * unresolvable bindings into visible fallback behavior, EC-015).
- */
-type BindingPayloads = Record<string, unknown>;
-/**
- * Marker key of an {@link SourcePayloadError} payload. A plain string property
- * (not a Symbol) on purpose: the route helper's cached path JSON-serializes
- * payloads through `unstable_cache`, and the marker must survive that
- * round-trip.
- */
-declare const SOURCE_PAYLOAD_ERROR_KEY = "__elytraSourcePayloadError";
-/**
- * Explicit issue payload for a source whose stored query was REJECTED at
- * delivery (EC-177 gap 3) — e.g. a sort/filter field that is no longer
- * filterable in the live schema. Materialization stores this instead of a
- * silently-absent payload; `createBindingResolver` throws on it, which the
- * renderer converts into its visible per-node render-error fallback (EC-015).
- * Validation principle: a broken stored query is a visible state, never an
- * empty section.
- */
-interface SourcePayloadError {
-    [SOURCE_PAYLOAD_ERROR_KEY]: true;
-    sourceId: string;
-    /** Human-readable messages of the structured query errors. */
-    messages: string[];
-}
-/** Build the explicit issue payload for one failed source query. */
-declare function sourcePayloadError(sourceId: string, messages: readonly string[]): SourcePayloadError;
-/** `true` when a payload value is an explicit {@link SourcePayloadError}. */
-declare function isSourcePayloadError(value: unknown): value is SourcePayloadError;
-/**
- * Resolve a JSON Pointer token within a payload value. Numeric segments index
- * arrays; string segments index plain objects. Any miss (unknown key,
- * out-of-range index, traversal through a primitive) yields `undefined`.
- */
-declare function resolvePayloadToken(payload: unknown, token: string): unknown;
-/**
- * Create the renderer's `ResolveBinding` over a payload map. Mode semantics
- * (brief §4.6, uniform binding model):
- *
- * - `value` / `object` / `condition` — the value at the token within the
- *   payload named by `sourceId`.
- * - `spread` — same lookup; the renderer spreads the resulting object.
- * - `repeaterItem` — the token resolves against the active repeater item,
- *   not the root payload.
- *
- * Total for data misses: an unknown `sourceId` or missing path resolves to
- * `undefined` — the renderer (EC-015) degrades visibly instead of crashing.
- * An explicit {@link SourcePayloadError} payload (a REJECTED stored query, not
- * merely missing data) throws instead: the renderer catches per node and
- * renders its visible render-error fallback with the query error message;
- * conditions treat the throw as `false` (the node hides) — never a page crash.
- */
-declare function createBindingResolver(payloads: BindingPayloads): ResolveBinding;
+ *
+ * Accepts the CONFIG's entry shape (`implementation: unknown`) rather than the
+ * strict {@link HostComponent}: the config declares implementations opaquely,
+ * and EC-539 made `createElytraHost({ ...site })` the contract, so a
+ * compile-time check at this seam was already gone for the recommended path.
+ * The check is RUNTIME instead (EC-541), through core's one registration step
+ * `registerImplementations` (EC-555 — the studio registry and the preview
+ * harness call the same one): a value that is not a component is
+ * recorded as an `invalid-implementation` issue naming the component id and
+ * the received kind, and is NOT put into `implementations` — so the renderer
+ * takes its missing-component path (a visible EC-015 fallback) instead of
+ * crashing the server render on `createElement` ("Element type is invalid")
+ * or, for a string, silently rendering an HTML tag. The manifest still
+ * registers, so the registry's own issues (duplicate id, invalid id) for that
+ * entry are reported alongside.
+ *
+ * One consequence of the `unknown` parameter: an INLINE
+ * `implementation: (props) => …` literal no longer gets `props` contextually
+ * typed (it is `noImplicitAny` under strict). Annotate the parameter, or
+ * author the entry as a {@link HostComponent} — which is the documented shape
+ * anyway. (An overload pair was tried and does not restore it: TypeScript
+ * resolves the context-sensitive literal against the wider overload.)
+ */
+declare function defineHostComponents(components?: readonly HostComponentEntry[], options?: DefineHostComponentsOptions): HostComponents;
 
 /**
  * `<CanvasRenderer />` (EC-144, vision AD-1): an async React Server Component
@@ -134,13 +101,6 @@ interface CanvasRendererProps {
     result: ResolvePageResult;
     /** Host component surface from `defineHostComponents`. */
     components: HostComponents;
-    /**
-     * Binding payloads keyed by `sourceId`. Defaults to
-     * `{ document, params }` derived from the result.
-     */
-    payloads?: BindingPayloads;
-    /** Full custom binding resolver — overrides `payloads` when provided. */
-    resolveBinding?: ResolveBinding;
     /**
      * Delivery-shaped assets the page may reference (EC-195, from the render
      * outcome). An `asset`-typed Image prop resolves through these to a url +
@@ -194,8 +154,6 @@ interface DeliveryPresentation {
     /** Field names whose values form the body, in render order. */
     body?: readonly string[];
 }
-/** Default payloads: the route-bound document and the dynamic route params. */
-declare function defaultBindingPayloads(result: ResolvePageResult): BindingPayloads;
 /**
  * Render a resolved page server-side. Async so hosts can compose it like any
  * other RSC; resolution itself is synchronous (the content was prefetched by
@@ -221,22 +179,10 @@ declare function bodyItemsOf(document: Record<string, unknown> | null | undefine
  *
  * Accessors are synchronous over a prefetched `ContentLookup` (vision AD-4);
  * any fetching happens when the source is loaded, before clients are minted.
+ *
+ * EC-574: the `CanvasDataSource` shape and the `sources` member (the data-binding
+ * subsystem's per-section query definitions, EC-166) are gone with that subsystem.
  */
-/**
- * One data-source definition the published graph's bindings reference
- * (EC-166 delivery): the structural shape of an `@elytracms/core/data-binding`
- * `DataSource`, declared here so the embedded runtime stays free of
- * builder-side packages. Only `cms`-kind sources with the EC-166 per-scope id
- * prefixes (`cms.section.<nodeId>` / `cms.template.<pageId>`) participate in
- * automatic payload materialization; everything else is ignored.
- */
-interface CanvasDataSource {
-    kind: string;
-    id: string;
-    label?: string;
-    /** Kind-specific config; cms query configs parse via `@elytracms/core/content`. */
-    config?: unknown;
-}
 interface ContentSource {
     /** The project's locale configuration (default + supported set, EC-018). */
     readonly locales: LocaleConfig;
@@ -267,15 +213,6 @@ interface ContentSource {
      * picker decides, exactly as before.
      */
     readonly collections?: readonly CollectionDef[];
-    /**
-     * Data-source definitions the graph's bindings reference (EC-166 delivery,
-     * additive). When present, the route helper materializes per-section list
-     * sources automatically by replaying their stored where/sort/limit through
-     * `listDocuments` — see `materializeSourcePayloads`. Optional so existing
-     * custom sources stay valid; absent definitions degrade to unresolved
-     * bindings (the renderer's visible fallbacks), never a crash.
-     */
-    readonly sources?: readonly CanvasDataSource[];
     /**
      * The project's delivery-shaped assets (EC-195, additive). Lets the route
      * helper bake the assets a page may reference into the (serializable) render
@@ -295,60 +232,6 @@ interface ContentSource {
  */
 declare function mergeCacheTags(first: CacheTags, ...rest: readonly CacheTags[]): CacheTags;
 
-/**
- * Automatic payload materialization for EC-166 repeating sections — the
- * delivery half of the builder's collection-driven LAYOUTS (EC-187: layouts
- * are the only graph trees that can bind section sources now). A published
- * layout may carry bindings against per-scope CMS sources; the renderer needs
- * the source PAYLOADS:
- *
- * - **Repeating sections** (`cms.section.<nodeId>`): the stored source config
- *   carries the closed AD-3 query. For every section source a referenced
- *   layout tree actually binds, the stored where/sort/limit replays through
- *   the request client's `listDocuments` — published perspective and ambient
- *   locale come from the client itself. The list result's `CacheTags` (the
- *   fetch-time doc tags of what was actually returned plus the coarse
- *   collection tag — the EC-146 contract) are surfaced so the route helper
- *   merges them into the request tag set.
- *
- * The `cms.template.<pageId>` "current document" source is RETIRED (EC-187):
- * there is no template page, and a routed page document's `body` uses static
- * props (v1). A collection detail route's document is read by the dev route
- * component directly via the route's `document` ref.
- *
- * Everything degrades visibly, never a crash:
- *
- * - a missing source definition, a non-cms kind, or a malformed config leaves
- *   the payload absent, so the binding resolves to `undefined` and the
- *   renderer shows its EC-015 fallback (an empty list renders the section's
- *   empty state);
- * - a structured query error (the stored query was REJECTED at delivery, e.g.
- *   a sort field no longer filterable in the live schema) stores an explicit
- *   {@link sourcePayloadError} payload instead — the binding resolver throws
- *   on it and the renderer shows its visible per-node render-error fallback,
- *   not a silently empty section (EC-177 gap 3).
- */
-/** Collect every binding `sourceId` referenced in a node tree (props, conditions, slots). */
-declare function collectBindingSourceIds(node: ComponentNode, into?: Set<string>): Set<string>;
-interface MaterializeSourcePayloadsInput {
-    /** Accessor client bound to this request's perspective + locale. */
-    client: ContentClient;
-    result: ResolvePageResult;
-    /** Source definitions from the `ContentSource` (absent ones simply skip). */
-    sources: readonly CanvasDataSource[];
-}
-interface MaterializedSourcePayloads {
-    payloads: BindingPayloads;
-    /** `CacheTags` of every accessor call made here (one entry per section list). */
-    tags: CacheTags[];
-}
-/**
- * Materialize the EC-166 source payloads for one resolved page. Pure over the
- * prefetched source — `listDocuments` is synchronous; tags are returned (not
- * applied) so the caller owns the merge.
- */
-declare function materializeSourcePayloads(input: MaterializeSourcePayloadsInput): MaterializedSourcePayloads;
-
 /**
  * Bridge from a `PersistenceAdapter` to the synchronous `ContentLookup` the
  * accessors (EC-143) read through: prefetch the project's collections,
@@ -379,12 +262,6 @@ interface ContentSnapshotOptions {
      * config declares.
      */
     locales: LocaleConfig;
-    /**
-     * Data-source definitions the graph's bindings reference (EC-166): section
-     * sources (`cms.section.<nodeId>`) carry their stored where/sort/limit, and
-     * the route helper materializes their payloads automatically.
-     */
-    sources?: readonly CanvasDataSource[];
 }
 interface ContentSnapshot extends ContentSource {
     readonly projectId: string;
@@ -419,11 +296,6 @@ interface StaticContentData {
      * explicit unresolved-placeholder scheme (never a silent empty string).
      */
     assetUrl?: (asset: AssetRecord) => string;
-    /**
-     * Data-source definitions section bindings reference (EC-166 delivery).
-     * Absent definitions degrade to unresolved bindings, never a crash.
-     */
-    sources?: readonly CanvasDataSource[];
 }
 
 /**
@@ -444,8 +316,9 @@ declare function createContentSnapshot(adapter: PersistenceAdapter, projectId: s
 
 /**
  * The pure half of the catch-all route helper (EC-144): URL → outcome, with
- * no Next.js imports — so redirects, 404s, locale handling, payload assembly,
- * and tag merging are all unit-testable as plain functions. `route.tsx` maps
+ * no Next.js imports — so redirects, 404s, locale handling, asset/relation/
+ * listing/link baking, and tag merging are all unit-testable as plain
+ * functions. `route.tsx` maps
  * each outcome onto `redirect()` / `permanentRedirect()` / `notFound()` /
  * `<CanvasRenderer />`.
  */
@@ -486,27 +359,6 @@ interface CanvasWrapContext extends CanvasRequestInfo {
      */
     result: ResolvePageResult;
 }
-/** What the host's payload factory sees for one request. */
-interface CanvasPayloadContext {
-    /** Accessor client bound to this request's perspective + locale. */
-    client: ContentClient;
-    result: ResolvePageResult;
-    perspective: Perspective;
-    /** The normalized request path (locale prefix stripped). */
-    path: string;
-    params: Record<string, string>;
-    /**
-     * Register the `CacheTags` of any extra accessor call this factory makes
-     * (e.g. `listDocuments`) so they join the request's merged tag set — the
-     * EC-146 invalidation hook sees everything the request actually read.
-     */
-    addTags(tags: CacheTags): void;
-}
-/**
- * Builds the binding payloads for a page render. The defaults
- * (`document`, `params`) are always present; factory entries win on conflict.
- */
-type CanvasPayloadsFactory = (ctx: CanvasPayloadContext) => BindingPayloads | Promise<BindingPayloads>;
 type CanvasPageOutcome = {
     kind: 'redirect';
     target: string;
@@ -518,7 +370,6 @@ type CanvasPageOutcome = {
 } | {
     kind: 'render';
     result: ResolvePageResult;
-    payloads: BindingPayloads;
     /**
      * The delivery-shaped assets the page may reference (EC-195). Baked into
      * the outcome (serializable) so the renderer resolves `asset`-typed Image
@@ -572,7 +423,6 @@ type CanvasPageOutcome = {
 declare function pathFromSlug(slug: readonly string[] | undefined): string;
 
 interface ResolveCanvasPageOptions {
-    payloads?: CanvasPayloadsFactory;
     /**
      * Component registry (EC-205): when provided, the baked {@link CanvasPageOutcome}
      * `assets` are PAGE-SCOPED to exactly the asset ids this page's composition +
@@ -598,6 +448,13 @@ interface CanvasCacheOptions {
      * Omit only when the emitter also emits unscoped tags (see `cache.ts`).
      */
     scope?: string;
+    /**
+     * Which content world `loadContent` reads — the delivery kit passes its
+     * `contentMode` (`'live' | 'fallback' | 'empty'`), so entries written in one
+     * world can never be served in another (EC-543, see `canvasCacheKey`). A host
+     * driving this helper directly with a single world may omit it.
+     */
+    mode?: string;
 }
 /**
  * What the route helper tells the content loader about the request it is
@@ -624,22 +481,18 @@ interface CanvasRouteOptions {
     loadContent: (request: CanvasContentRequest) => Promise<ContentSource>;
     /** Host component surface from `defineHostComponents`. */
     components: HostComponents;
-    /** Extra binding payloads per request (e.g. `listDocuments` for a list page). */
-    payloads?: CanvasPayloadsFactory;
     /**
      * EC-146 instant publish: cache the published-perspective resolution in
      * Next's data cache (`unstable_cache`), tagged with the response's own
      * fetch-time tags, invalidated by the `/api/revalidate` webhook. Draft mode
      * always bypasses this cache entirely. Tag-driven only — no time-based
-     * revalidation (the AD-5 model). Cached values are JSON-serialized, so
-     * payload factories must return plain data on the cached path.
+     * revalidation (the AD-5 model). Cached values are JSON-serialized plain data.
      */
     cache?: CanvasCacheOptions;
     /**
      * EC-146 hook: receives the merged `CacheTags` of everything this request
-     * read (the `resolvePage` tags plus any tags the payload factory
-     * registered via `addTags`). On a cache hit these are the stored tags of
-     * the run that wrote the entry.
+     * read (the `resolvePage` tags plus the baked relations/listings/links). On a
+     * cache hit these are the stored tags of the run that wrote the entry.
      */
     onTags?: (tags: CacheTags, info: CanvasRequestInfo) => void;
     /** Override the generated `<head>` metadata for a resolved page. */
@@ -1411,7 +1264,9 @@ declare function createPreviewRoute(options: PreviewRouteOptions): PreviewRouteH
 /**
  * Create the preview-disable route handler (e.g.
  * `app/api/preview/disable/route.ts`). Disabling needs no token — it only
- * ever reduces visibility back to the published perspective.
+ * ever reduces visibility back to the published perspective. The `redirect`
+ * target passes the same same-site check as the enable route; an off-site one
+ * redirects to `/` instead.
  */
 declare function createPreviewDisableRoute(): PreviewRouteHandlers;
 
@@ -1503,13 +1358,16 @@ interface ElytraHostOptions {
      * / `WorkspaceProjectEntry` annotation did not. Both production consumers hit
      * exactly that and each carried one hand-restated `components` line (EC-539).
      *
-     * What this costs, stated plainly rather than glossed: a list passed HERE no
-     * longer gets a compile-time check that each `implementation` is really a
-     * component, and nothing yet checks it at runtime either — a garbage value
-     * would reach the renderer. `defineHostComponents` keeps the strict
-     * {@link HostComponent} signature, so a hand-built list passed there directly
-     * is still checked. Closing the gap properly needs a registration issue code
-     * in the core registry; booked as EC-541 rather than smuggled in here.
+     * What the widening costs, and where it is paid (EC-541): a list passed HERE
+     * gets no compile-time check that each `implementation` is really a
+     * component. The check is RUNTIME instead — `defineHostComponents` takes the
+     * same `HostComponentEntry` shape (no cast, one signature) and tests every
+     * implementation on registration; a value that is not a component becomes an
+     * `invalid-implementation` issue in `components.issues` and is withheld from
+     * the implementation map, so its nodes render the visible missing-component
+     * fallback rather than crashing the server render. Authoring a component
+     * module as the strict {@link HostComponent} keeps the compile-time check at
+     * the place the implementation is written.
      */
     components?: readonly HostComponentEntry[];
     /**
@@ -1533,8 +1391,10 @@ interface ElytraHostOptions {
      * The no-backend content fallback, used whenever `ELYTRA_CONVEX_URL` +
      * `ELYTRA_PROJECT_ID` are not both set. Default: a build-safe EMPTY source —
      * consumer CI builds green with no backend, and every URL is a clean 404
-     * until content exists. The starter template overrides this with its seeded
-     * in-memory world.
+     * until content exists — in every cache state, not only a cold one, because
+     * the content mode is part of the route's data-cache key (see
+     * {@link ElytraContentMode}). The starter template overrides this with its
+     * seeded in-memory world.
      */
     fallbackContent?: (request: CanvasContentRequest) => Promise<ContentSource>;
     /** Chrome-globals conventions (settings/navigation collection ids, items fields). */
@@ -1544,8 +1404,6 @@ interface ElytraHostOptions {
 }
 /** Pass-through canvas-route options the kit does not own. */
 interface HostCanvasRouteOptions {
-    /** Extra binding payloads per request (see `CanvasRouteOptions.payloads`). */
-    payloads?: CanvasPayloadsFactory;
     /** Tag observation hook (see `CanvasRouteOptions.onTags`). */
     onTags?: (tags: CacheTags, info: CanvasRequestInfo) => void;
     /** Metadata override (see `CanvasRouteOptions.metadata`). */
@@ -1560,6 +1418,8 @@ interface HostCanvasRouteOptions {
      * Tagged data cache (instant publish). Default: enabled, scoped to the
      * kit's content scope so the studio's webhook tags match. `false` disables
      * caching entirely; an explicit `CanvasCacheOptions` overrides the scope.
+     * The kit's {@link ElytraHost.contentMode} is always part of the entry key
+     * (EC-543) — an override can replace the scope, never drop the mode.
      */
     cache?: CanvasCacheOptions | false;
 }
@@ -1584,6 +1444,15 @@ interface LoadGlobalsOptions {
  * §5 gets no signal that the thing under test was never exercised. Declared
  * once, read here, so a host can *say* which world it is in instead of
  * re-deriving it from `env` and drifting.
+ *
+ * **The mode is also part of the route's data-cache key** (EC-543). A cache
+ * entry outlives the process that wrote it and a hit never runs the loader, so
+ * until 0.0.85 the "clean 404" above held only on a COLD cache: measured, a
+ * `next start` with both env vars blanked and a warm `.next/cache` from a live
+ * run answered `200` with the live world's bytes on every cached URL while
+ * reporting `empty` — the wrong-world failure EC-527 removed, one layer down.
+ * Keyed on the mode (`canvasCacheKey`, `cache.ts`), a world change is a cold
+ * miss per URL, never a stale hit, in either direction.
  */
 type ElytraContentMode = 'live' | 'fallback' | 'empty';
 /** The delivery host handle {@link createElytraHost} yields. */
@@ -1687,13 +1556,13 @@ interface LiveContentOptions {
 /**
  * The `delivery.ts` payload shape (validated field-by-field below). A
  * deployment IS one environment (EC-179); the snapshot carries content only
- * (EC-287) — documents, assets, editorial redirects (EC-303), and persisted
- * data-source definitions (EC-166).
+ * (EC-287) — documents, assets, editorial redirects (EC-303). (A `sources`
+ * strand from an older deployment is ignored — it belonged to the deleted
+ * data-binding subsystem, EC-574.)
  */
 interface DeliverySnapshotPayload {
     projectId: string;
     redirects?: unknown[];
-    sources?: unknown;
     documents: unknown[];
     assets: unknown[];
 }
@@ -1755,13 +1624,25 @@ type PreviewEvaluation = {
     message: string;
 };
 /**
- * Only same-site path targets are accepted (`/...` but not `//host`), so the
- * preview endpoint can never be used as an open redirect.
+ * The ONE same-site check for a preview redirect target, shared by the enable and
+ * disable routes, so the preview endpoints can never be used as an open redirect.
+ * `null` means rejected; an empty value yields `fallback`.
+ *
+ * EC-594: the parser a browser uses decides, not a blocklist of shapes (the old
+ * blocklist caught `//host` and backslashes — EC-304 B-3 — but not `/<TAB>/host`,
+ * which the parser collapses to `//host`):
+ *
+ * - only a path-absolute reference (`/…`) is accepted — a relative one would be
+ *   resolved against the route's own path by a browser, so it has no fixed meaning;
+ * - any C0 control or DEL is rejected outright;
+ * - the value is resolved against a fixed origin and must stay on it;
+ * - what is returned is the parser's normalised `pathname + search + hash`, never
+ *   the raw input — and that returned target must itself stay on the origin, since
+ *   dot-segment removal can leave a pathname starting with `//` (`/.//host`,
+ *   `/..//host`, `/%2e//host`), which as a `Location` is scheme-relative.
  *
- * EC-304 B-3: a backslash is rejected too — browsers normalize `\`→`/` when resolving
- * a URL, so `/\host`, `/\/host` and `\\host` all resolve off-origin the same way
- * `//host` does. A leading single `/` followed by a non-slash, with no backslash
- * anywhere, is the only accepted same-site shape.
+ * A scheme-relative or absolute value naming the resolution origin itself resolves
+ * on it and yields its path — harmless, because only that path is returned.
  */
 declare function safeRedirectTarget(value: string | null | undefined, fallback?: string): string | null;
 /**
@@ -1787,4 +1668,4 @@ declare function evaluatePreviewRequest(requestUrl: string | URL, expectedToken:
  */
 declare const PACKAGE = "@elytracms/next";
 
-export { type AssetImageLoaderOptions, type BindingPayloads, type CacheWrapper, type CacheWrapperOptions, type CachedEntry, type CanvasCacheOptions, type CanvasContentRequest, type CanvasDataSource, type CanvasPageOutcome, type CanvasPayloadContext, type CanvasPayloadsFactory, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DefineHostComponentsOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type LiveContentOptions, type LoadGlobalsOptions, type MaterializeSourcePayloadsInput, type MaterializedSourcePayloads, type NextImagePrimitiveOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, REVALIDATE_SIGNATURE_HEADER, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidatePayload, type RevalidateRouteHandlers, type RevalidateRouteOptions, type SiteGlobals, type SitemapParamsProvider, type SitemapRouteContext, type SitemapSkippedRoute, type SourcePayloadError, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasPageMetadata, canvasSitemapEntries, collectBindingSourceIds, collectionCacheTag, createAssetImageLoader, createBindingResolver, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defaultBindingPayloads, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, isSourcePayloadError, loadCachedEntry, loadLiveContent, materializeSourcePayloads, mergeCacheTags, nextCacheTags, nextImagePrimitive, pathFromSlug, projectSweepTag, resolveCanvasPage, resolveGlobals, resolveHostEnv, resolvePayloadToken, revalidatePayloadSchema, routeCacheTag, safeRedirectTarget, scopeCacheTag, signRevalidateBody, sourcePayloadError };
+export { type AssetImageLoaderOptions, type CacheWrapper, type CacheWrapperOptions, type CachedEntry, type CanvasCacheOptions, type CanvasContentRequest, type CanvasPageOutcome, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DefineHostComponentsOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type LiveContentOptions, type LoadGlobalsOptions, type NextImagePrimitiveOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, REVALIDATE_SIGNATURE_HEADER, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidatePayload, type RevalidateRouteHandlers, type RevalidateRouteOptions, type SiteGlobals, type SitemapParamsProvider, type SitemapRouteContext, type SitemapSkippedRoute, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasPageMetadata, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadCachedEntry, loadLiveContent, mergeCacheTags, nextCacheTags, nextImagePrimitive, pathFromSlug, projectSweepTag, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidatePayloadSchema, routeCacheTag, safeRedirectTarget, scopeCacheTag, signRevalidateBody };