@elytracms/studio 0.0.1

package/dist/lib/assets/delete-asset.d.ts

@@ -0,0 +1,34 @@
+import type { AssetRepository, BlobStorageAdapter, ReferenceIndexRepository } from '@elytracms/persistence';
+/**
+ * Reference-respecting asset deletion (EC-151, reworked EC-202). Deleting an
+ * asset that is referenced is blocked until explicitly confirmed; the usage
+ * count comes from the **EC-155 reference index** (`references.inbound` for the
+ * `{ type: 'asset' }` target) — index-accurate, replacing the interim string
+ * scan (`find-asset-usages`), which could miss rich-text asset hrefs and
+ * false-positive on unrelated strings. Deleting an unused asset removes bytes
+ * (blob) AND the metadata record. Results are structured data — never throws.
+ */
+export interface DeleteAssetDeps {
+    assets: AssetRepository;
+    blobs: BlobStorageAdapter;
+    /** The EC-155 reference index — the accurate inbound-usage source (EC-202). */
+    references: Pick<ReferenceIndexRepository, 'inbound'>;
+}
+export type DeleteAssetResult = {
+    outcome: 'deleted';
+}
+/** The asset is referenced and `confirmInUse` was not set: nothing was removed. */
+ | {
+    outcome: 'blocked';
+    usageCount: number;
+} | {
+    outcome: 'not-found';
+} | {
+    outcome: 'error';
+    message: string;
+};
+export interface DeleteAssetOptions {
+    /** Caller has seen the usage count and explicitly confirmed deletion. */
+    confirmInUse?: boolean;
+}
+export declare function deleteAsset(deps: DeleteAssetDeps, projectId: string, assetId: string, options?: DeleteAssetOptions): Promise<DeleteAssetResult>;

package/dist/lib/assets/delete-asset.js

@@ -0,0 +1,34 @@
+import { RecordNotFoundError } from '@elytracms/persistence';
+export async function deleteAsset(deps, projectId, assetId, options = {}) {
+    try {
+        const asset = await deps.assets.findAsset(projectId, assetId);
+        if (!asset)
+            return { outcome: 'not-found' };
+        const usageCount = await assetUsageCount(deps, projectId, assetId);
+        if (usageCount > 0 && options.confirmInUse !== true) {
+            return { outcome: 'blocked', usageCount };
+        }
+        // Bytes first, metadata last: a failure midway leaves a visible metadata
+        // record (re-deletable) rather than invisible orphaned bytes.
+        await deps.blobs.delete(asset.storageKey);
+        await deps.assets.removeAsset(projectId, assetId);
+        return { outcome: 'deleted' };
+    }
+    catch (error) {
+        if (error instanceof RecordNotFoundError)
+            return { outcome: 'not-found' };
+        return { outcome: 'error', message: error instanceof Error ? error.message : String(error) };
+    }
+}
+/**
+ * Distinct inbound usages of an asset from the reference index (EC-202). One
+ * `source + path` (e.g. `post:hello · values/cover`) can carry both a draft and
+ * a published index entry — that is a single usage, so variants collapse before
+ * counting (the gate is "is this referenced", not "how many index rows").
+ */
+async function assetUsageCount(deps, projectId, assetId) {
+    const inbound = await deps.references.inbound(projectId, { type: 'asset', id: assetId });
+    const distinct = new Set(inbound.map((entry) => `${entry.source.type}:${entry.source.id}:${entry.path}`));
+    return distinct.size;
+}
+//# sourceMappingURL=delete-asset.js.map

package/dist/lib/assets/delete-asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-asset.js","sourceRoot":"","sources":["../../../src/lib/assets/delete-asset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAoC5D,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAqB,EACrB,SAAiB,EACjB,OAAe,EACf,UAA8B,EAAE;IAEhC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;QAE3C,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QAClE,IAAI,UAAU,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAC3C,CAAC;QAED,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACjD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;QACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC9F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAqB,EACrB,SAAiB,EACjB,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAChF,CAAA;IACD,OAAO,QAAQ,CAAC,IAAI,CAAA;AACtB,CAAC"}

package/dist/lib/assets/image-dimensions.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Client-side image dimension detection (EC-151). Uses `createImageBitmap`
+ * when available (injectable for tests); failure is never fatal — an asset
+ * without detectable dimensions simply stores no width/height.
+ */
+export interface ImageDimensions {
+    width: number;
+    height: number;
+}
+type BitmapFactory = (blob: Blob) => Promise<{
+    width: number;
+    height: number;
+    close?: () => void;
+}>;
+export declare function detectImageDimensions(file: Blob & {
+    type: string;
+}, createBitmap?: BitmapFactory | undefined): Promise<ImageDimensions | undefined>;
+export {};

package/dist/lib/assets/image-dimensions.js

@@ -0,0 +1,26 @@
+/**
+ * Client-side image dimension detection (EC-151). Uses `createImageBitmap`
+ * when available (injectable for tests); failure is never fatal — an asset
+ * without detectable dimensions simply stores no width/height.
+ */
+export async function detectImageDimensions(file, createBitmap = typeof createImageBitmap === 'function'
+    ? createImageBitmap
+    : undefined) {
+    if (!file.type.startsWith('image/'))
+        return undefined;
+    if (!createBitmap)
+        return undefined;
+    try {
+        const bitmap = await createBitmap(file);
+        const dimensions = bitmap.width > 0 && bitmap.height > 0
+            ? { width: bitmap.width, height: bitmap.height }
+            : undefined;
+        bitmap.close?.();
+        return dimensions;
+    }
+    catch {
+        // Undecodable image (corrupt bytes, unsupported format) — not an error.
+        return undefined;
+    }
+}
+//# sourceMappingURL=image-dimensions.js.map

package/dist/lib/assets/image-dimensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-dimensions.js","sourceRoot":"","sources":["../../../src/lib/assets/image-dimensions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA6B,EAC7B,eAA0C,OAAO,iBAAiB,KAAK,UAAU;IAC/E,CAAC,CAAC,iBAAiB;IACnB,CAAC,CAAC,SAAS;IAEb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,UAAU,GACd,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACnC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YAChD,CAAC,CAAC,SAAS,CAAA;QACf,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;QAChB,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/lib/assets/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Asset upload, deletion, and usage logic (EC-151). Pure/injectable modules:
+ * the studio UI consumes these; storage is reached only through the
+ * `BlobStorageAdapter` boundary.
+ */
+export * from './upload-state';
+export * from './image-dimensions';
+export * from './upload';
+export * from './delete-asset';

package/dist/lib/assets/index.js

@@ -0,0 +1,10 @@
+/**
+ * Asset upload, deletion, and usage logic (EC-151). Pure/injectable modules:
+ * the studio UI consumes these; storage is reached only through the
+ * `BlobStorageAdapter` boundary.
+ */
+export * from './upload-state';
+export * from './image-dimensions';
+export * from './upload';
+export * from './delete-asset';
+//# sourceMappingURL=index.js.map

package/dist/lib/assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,UAAU,CAAA;AACxB,cAAc,gBAAgB,CAAA"}

package/dist/lib/assets/upload-state.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Upload state machine (EC-151). Pure, deterministic transition logic for the
+ * studio upload flow: request upload URL → transfer bytes → confirm metadata.
+ * Failure at any stage is an explicit, visible state with a retry affordance —
+ * never a silent loss. Kept free of DOM/network so it unit-tests as plain data.
+ */
+export type UploadStage = 'prepare' | 'transfer' | 'confirm';
+export type UploadPhase = 'idle' | 'preparing' | 'uploading' | 'confirming' | 'done' | 'failed';
+export interface UploadFailure {
+    stage: UploadStage;
+    message: string;
+    /** Whether retrying the same file can plausibly succeed (default true). */
+    retryable: boolean;
+}
+export interface UploadState {
+    phase: UploadPhase;
+    /** Byte progress in [0, 1]; only meaningful while `uploading`. */
+    progress: number;
+    /** 1-based attempt counter; increments on `retry`. */
+    attempt: number;
+    failure?: UploadFailure;
+    /** The created asset id once `done`. */
+    assetId?: string;
+}
+export type UploadEvent = {
+    type: 'start';
+} | {
+    type: 'url-ready';
+} | {
+    type: 'progress';
+    loaded: number;
+    total: number;
+} | {
+    type: 'transferred';
+} | {
+    type: 'confirmed';
+    assetId: string;
+} | {
+    type: 'failed';
+    stage: UploadStage;
+    message: string;
+    retryable?: boolean;
+} | {
+    type: 'retry';
+} | {
+    type: 'reset';
+};
+export declare const initialUploadState: UploadState;
+/**
+ * Pure reducer. Invalid transitions return the state unchanged (deterministic,
+ * never throws) so a late progress event after a failure cannot corrupt the UI.
+ */
+export declare function uploadReducer(state: UploadState, event: UploadEvent): UploadState;

package/dist/lib/assets/upload-state.js

@@ -0,0 +1,59 @@
+/**
+ * Upload state machine (EC-151). Pure, deterministic transition logic for the
+ * studio upload flow: request upload URL → transfer bytes → confirm metadata.
+ * Failure at any stage is an explicit, visible state with a retry affordance —
+ * never a silent loss. Kept free of DOM/network so it unit-tests as plain data.
+ */
+export const initialUploadState = { phase: 'idle', progress: 0, attempt: 0 };
+const clamp01 = (n) => (Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : 0);
+/**
+ * Pure reducer. Invalid transitions return the state unchanged (deterministic,
+ * never throws) so a late progress event after a failure cannot corrupt the UI.
+ */
+export function uploadReducer(state, event) {
+    switch (event.type) {
+        case 'start':
+            if (state.phase !== 'idle')
+                return state;
+            return { phase: 'preparing', progress: 0, attempt: 1 };
+        case 'url-ready':
+            if (state.phase !== 'preparing')
+                return state;
+            return { ...state, phase: 'uploading', progress: 0 };
+        case 'progress':
+            if (state.phase !== 'uploading')
+                return state;
+            return { ...state, progress: clamp01(event.total > 0 ? event.loaded / event.total : 0) };
+        case 'transferred':
+            if (state.phase !== 'uploading' && state.phase !== 'preparing')
+                return state;
+            return { ...state, phase: 'confirming', progress: 1 };
+        case 'confirmed':
+            if (state.phase !== 'confirming')
+                return state;
+            return { ...state, phase: 'done', progress: 1, assetId: event.assetId };
+        case 'failed':
+            if (state.phase === 'done' || state.phase === 'idle')
+                return state;
+            return {
+                ...state,
+                phase: 'failed',
+                failure: {
+                    stage: event.stage,
+                    message: event.message,
+                    retryable: event.retryable ?? true,
+                },
+            };
+        case 'retry':
+            if (state.phase !== 'failed' || state.failure?.retryable === false)
+                return state;
+            return { phase: 'preparing', progress: 0, attempt: state.attempt + 1 };
+        case 'reset':
+            return initialUploadState;
+        default: {
+            const never = event;
+            return never;
+        }
+    }
+}
+//# sourceMappingURL=upload-state.js.map

package/dist/lib/assets/upload-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-state.js","sourceRoot":"","sources":["../../../src/lib/assets/upload-state.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkCH,MAAM,CAAC,MAAM,kBAAkB,GAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;AAEzF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAE7F;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,KAAkB;IAClE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YACxC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;QACxD,KAAK,WAAW;YACd,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACtD,KAAK,UAAU;YACb,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YAC7C,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1F,KAAK,aAAa;YAChB,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;YAC5E,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACvD,KAAK,WAAW;YACd,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;gBAAE,OAAO,KAAK,CAAA;YAC9C,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACzE,KAAK,QAAQ;YACX,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YAClE,OAAO;gBACL,GAAG,KAAK;gBACR,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;iBACnC;aACF,CAAA;QACH,KAAK,OAAO;YACV,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,SAAS,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAA;YAChF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAA;QACxE,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAA;QAC3B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,KAAK,GAAU,KAAK,CAAA;YAC1B,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/assets/upload.d.ts

@@ -0,0 +1,56 @@
+import type { AssetRecord, AssetRepository, BlobStorageAdapter } from '@elytracms/persistence';
+import type { ImageDimensions } from './image-dimensions';
+import type { UploadFailure, UploadState } from './upload-state';
+/**
+ * Upload orchestration (EC-151): request upload URL → transfer bytes →
+ * confirm by writing the EC-044 metadata record (dimensions, mime, serve URL).
+ * Storage is reached *only* through the {@link BlobStorageAdapter}; every
+ * effect is injectable so the whole flow unit-tests without a browser or a
+ * live Convex deployment.
+ */
+/** The structural slice of a browser `File` the upload flow needs. */
+export interface UploadableFile {
+    name: string;
+    type: string;
+    size: number;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}
+/** Sends bytes to an upload URL, reporting progress; returns the assigned storage key. */
+export type UploadTransport = (uploadUrl: string, file: UploadableFile, onProgress: (loaded: number, total: number) => void) => Promise<{
+    storageKey: string;
+}>;
+/**
+ * Default browser transport: XMLHttpRequest POST for real byte progress
+ * (fetch has no upload progress without streams support everywhere).
+ */
+export declare const xhrUploadTransport: UploadTransport;
+export interface UploadDeps {
+    blobs: BlobStorageAdapter;
+    assets: AssetRepository;
+    /** Client-direct transport; only used when `blobs.createUploadUrl` exists. */
+    transport?: UploadTransport;
+    /** Injectable dimension detection; defaults to `createImageBitmap`-based. */
+    detectDimensions?: (file: UploadableFile) => Promise<ImageDimensions | undefined>;
+}
+export interface UploadRequest {
+    projectId: string;
+    file: UploadableFile;
+    alt?: string;
+    /** Observe every state transition (drives progress UI). */
+    onState?: (state: UploadState) => void;
+}
+export type UploadResult = {
+    ok: true;
+    asset: AssetRecord;
+    state: UploadState;
+} | {
+    ok: false;
+    failure: UploadFailure;
+    state: UploadState;
+};
+/**
+ * Run one upload attempt. Resolves with a discriminated result — it never
+ * throws, and a failed transfer leaves no metadata record behind. Pass the
+ * previous `state` to retry (the attempt counter carries over).
+ */
+export declare function runUpload(deps: UploadDeps, request: UploadRequest, previous?: UploadState): Promise<UploadResult>;

package/dist/lib/assets/upload.js

@@ -0,0 +1,125 @@
+import { detectImageDimensions } from './image-dimensions';
+import { initialUploadState, uploadReducer } from './upload-state';
+/**
+ * Default browser transport: XMLHttpRequest POST for real byte progress
+ * (fetch has no upload progress without streams support everywhere).
+ */
+export const xhrUploadTransport = (uploadUrl, file, onProgress) => new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open('POST', uploadUrl);
+    if (file.type)
+        xhr.setRequestHeader('Content-Type', file.type);
+    xhr.upload.onprogress = (event) => {
+        if (event.lengthComputable)
+            onProgress(event.loaded, event.total);
+    };
+    xhr.onerror = () => reject(new Error('Network error while uploading bytes.'));
+    xhr.onabort = () => reject(new Error('Upload was aborted.'));
+    xhr.onload = () => {
+        if (xhr.status < 200 || xhr.status >= 300) {
+            reject(new Error(`Upload failed with HTTP ${xhr.status}.`));
+            return;
+        }
+        try {
+            const payload = JSON.parse(xhr.responseText);
+            if (typeof payload.storageId === 'string' && payload.storageId.length > 0) {
+                resolve({ storageKey: payload.storageId });
+            }
+            else {
+                reject(new Error('Upload response did not include a storageId.'));
+            }
+        }
+        catch {
+            reject(new Error('Upload response was not valid JSON.'));
+        }
+    };
+    void file.arrayBuffer().then((bytes) => xhr.send(bytes), () => reject(new Error('Could not read file bytes.')));
+});
+async function defaultDetectDimensions(file) {
+    if (typeof Blob === 'undefined' || !(file instanceof Blob))
+        return undefined;
+    return detectImageDimensions(file);
+}
+function failureOf(stage, error) {
+    return {
+        stage,
+        message: error instanceof Error ? error.message : String(error),
+        retryable: true,
+    };
+}
+/**
+ * Run one upload attempt. Resolves with a discriminated result — it never
+ * throws, and a failed transfer leaves no metadata record behind. Pass the
+ * previous `state` to retry (the attempt counter carries over).
+ */
+export async function runUpload(deps, request, previous) {
+    let state = previous ?? initialUploadState;
+    const dispatch = (event) => {
+        state = uploadReducer(state, event);
+        request.onState?.(state);
+    };
+    dispatch(state.phase === 'failed' ? { type: 'retry' } : { type: 'start' });
+    const { blobs, assets } = deps;
+    const { projectId, file } = request;
+    // --- prepare + transfer ---------------------------------------------------
+    let storageKey;
+    try {
+        if (blobs.createUploadUrl && deps.transport) {
+            const uploadUrl = await blobs.createUploadUrl();
+            dispatch({ type: 'url-ready' });
+            try {
+                const sent = await deps.transport(uploadUrl, file, (loaded, total) => dispatch({ type: 'progress', loaded, total }));
+                storageKey = sent.storageKey;
+            }
+            catch (error) {
+                dispatch({ type: 'failed', ...failureOf('transfer', error) });
+                return { ok: false, failure: failureOf('transfer', error), state };
+            }
+        }
+        else {
+            // Backend without client-direct uploads: push bytes through the adapter.
+            dispatch({ type: 'url-ready' });
+            const bytes = new Uint8Array(await file.arrayBuffer());
+            try {
+                if (blobs.store) {
+                    storageKey = await blobs.store(bytes, file.type);
+                }
+                else {
+                    storageKey = `${projectId}/${file.name}`;
+                    await blobs.put(storageKey, bytes, file.type);
+                }
+            }
+            catch (error) {
+                dispatch({ type: 'failed', ...failureOf('transfer', error) });
+                return { ok: false, failure: failureOf('transfer', error), state };
+            }
+        }
+    }
+    catch (error) {
+        dispatch({ type: 'failed', ...failureOf('prepare', error) });
+        return { ok: false, failure: failureOf('prepare', error), state };
+    }
+    dispatch({ type: 'transferred' });
+    // --- confirm: metadata record linked to the stored blob --------------------
+    try {
+        const detect = deps.detectDimensions ?? defaultDetectDimensions;
+        const dimensions = await detect(file);
+        const url = (await blobs.resolveUrl?.(storageKey)) ?? blobs.url(storageKey);
+        const asset = await assets.upsertAsset(projectId, {
+            filename: file.name,
+            contentType: file.type || 'application/octet-stream',
+            byteSize: file.size,
+            storageKey,
+            url,
+            ...(dimensions ? { width: dimensions.width, height: dimensions.height } : {}),
+            ...(request.alt !== undefined ? { alt: request.alt } : {}),
+        });
+        dispatch({ type: 'confirmed', assetId: asset.id });
+        return { ok: true, asset, state };
+    }
+    catch (error) {
+        dispatch({ type: 'failed', ...failureOf('confirm', error) });
+        return { ok: false, failure: failureOf('confirm', error), state };
+    }
+}
+//# sourceMappingURL=upload.js.map

package/dist/lib/assets/upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/lib/assets/upload.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAE1D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AA0BlE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CACjF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAA;IAChC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,IAAI,CAAC,IAAI;QAAE,GAAG,CAAC,gBAAgB,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAK,CAAC,gBAAgB;YAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IACnE,CAAC,CAAA;IACD,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAA;IAC7E,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAC5D,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE;QAChB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAA4B,CAAA;YACvE,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1E,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAA;IACD,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CACtD,CAAA;AACH,CAAC,CAAC,CAAA;AAuBJ,KAAK,UAAU,uBAAuB,CAAC,IAAoB;IACzD,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5E,OAAO,qBAAqB,CAAC,IAA+B,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAA6B,EAAE,KAAc;IAC9D,OAAO;QACL,KAAK;QACL,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,SAAS,EAAE,IAAI;KAChB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,IAAI,KAAK,GAAG,QAAQ,IAAI,kBAAkB,CAAA;IAC1C,MAAM,QAAQ,GAAG,CAAC,KAAkB,EAAQ,EAAE;QAC5C,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACnC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC,CAAA;IACD,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAE1E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAEnC,6EAA6E;IAC7E,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAA;YAC/C,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACnE,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC9C,CAAA;gBACD,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;YACpE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YACtD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAChB,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAClD,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;oBACxC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC/C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;IACD,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IAEjC,8EAA8E;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAA;QAC/D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE;YAChD,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,0BAA0B;YACpD,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,UAAU;YACV,GAAG;YACH,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAA;QACF,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACnE,CAAC;AACH,CAAC"}

package/dist/lib/auth/auth-adapter.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Project-owned auth boundary (EC-150, vision AD-7). The studio talks to
+ * authentication ONLY through {@link AuthAdapter} — the Convex Auth
+ * implementation (`convex-auth-adapter.ts`) and the deterministic local
+ * implementation (`local-auth-adapter.ts`) both satisfy it, mirroring how
+ * `PersistenceAdapter` keeps Convex out of the app's type graph.
+ *
+ * Swapping providers (e.g. Convex Auth → Clerk) means writing one new
+ * implementation of this interface and teaching `selectAuthAdapter` to pick
+ * it; no UI or store code changes.
+ */
+/** The signed-in user as the studio sees it. */
+export interface AuthUser {
+    /** Stable user id — the key `projectMembers.userId` is matched against. */
+    readonly id: string;
+    readonly email: string;
+    readonly name?: string;
+    /**
+     * Global (workspace-level) capability flags forwarded onto the operations
+     * `Principal.roles`, e.g. `system` (internal tooling only). Per-project roles
+     * do NOT live here — they live in the members repository. Currently no
+     * browser-session flag is granted: project creation is config/CLI-owned
+     * (AD-11), so there is no `create-projects` capability.
+     */
+    readonly globalFlags?: readonly string[];
+}
+export interface AuthSession {
+    readonly user: AuthUser;
+}
+export interface SignInCredentials {
+    readonly email: string;
+    readonly password: string;
+}
+/** Structured sign-in outcome — invalid credentials are a state, not a throw. */
+export type SignInResult = {
+    readonly ok: true;
+    readonly session: AuthSession;
+} | {
+    readonly ok: false;
+    readonly reason: 'invalid-credentials' | 'account-exists' | 'unavailable';
+    readonly message: string;
+};
+export interface AuthAdapter {
+    /** Restore the current session, if any (page load / refresh). */
+    currentSession(): Promise<AuthSession | null>;
+    /** Password sign-in. Resolves a structured result; never throws for bad input. */
+    signIn(credentials: SignInCredentials): Promise<SignInResult>;
+    /**
+     * Create a password account and sign in (EC-179). One project per backend, so
+     * a freshly-provisioned deployment starts with no users — the first member
+     * registers here, then is granted a role. `account-exists` is a state, not a
+     * throw.
+     */
+    signUp(credentials: SignInCredentials): Promise<SignInResult>;
+    /** End the session (idempotent). */
+    signOut(): Promise<void>;
+}

package/dist/lib/auth/auth-adapter.js

@@ -0,0 +1,13 @@
+/**
+ * Project-owned auth boundary (EC-150, vision AD-7). The studio talks to
+ * authentication ONLY through {@link AuthAdapter} — the Convex Auth
+ * implementation (`convex-auth-adapter.ts`) and the deterministic local
+ * implementation (`local-auth-adapter.ts`) both satisfy it, mirroring how
+ * `PersistenceAdapter` keeps Convex out of the app's type graph.
+ *
+ * Swapping providers (e.g. Convex Auth → Clerk) means writing one new
+ * implementation of this interface and teaching `selectAuthAdapter` to pick
+ * it; no UI or store code changes.
+ */
+export {};
+//# sourceMappingURL=auth-adapter.js.map

package/dist/lib/auth/auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-adapter.js","sourceRoot":"","sources":["../../../src/lib/auth/auth-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -0,0 +1,39 @@
+import type { ConvexHttpClient } from 'convex/browser';
+import type { AuthAdapter, AuthSession, SignInCredentials, SignInResult } from './auth-adapter';
+import type { SessionStore } from './local-auth-adapter';
+/**
+ * Per-deployment token key (EC-179, vision AD-8). One project per backend, so a
+ * session is scoped to its deployment: signing into Aurora's backend must not
+ * carry a JWT to Northwind's. Keying the stored token by the deployment URL
+ * makes each backend's session independent — switching to a project on a
+ * not-yet-authenticated backend reads no token and the guard asks for sign-in.
+ * (A future shared external IdP — WorkOS/Clerk — would issue one identity valid
+ * on every deployment, collapsing this back to a single session.)
+ */
+export declare function tokenStorageKey(deploymentUrl?: string): string;
+/**
+ * Best-effort "is there a session for this deployment?" — a synchronous token
+ * presence check used to label per-backend projects in the switcher/launcher
+ * (EC-179). It does not validate the token (an expired one still redirects to
+ * sign-in on entry); it just answers "has the user signed into this backend?".
+ */
+export declare function hasStoredConvexSession(deploymentUrl: string, store?: SessionStore): boolean;
+export declare class ConvexAuthAdapter implements AuthAdapter {
+    private readonly client;
+    private readonly store;
+    private readonly tokenKey;
+    constructor(client: ConvexHttpClient, store?: SessionStore, 
+    /** Deployment URL the token is scoped to (per-backend sessions, EC-179). */
+    deploymentUrl?: string);
+    currentSession(): Promise<AuthSession | null>;
+    signIn(credentials: SignInCredentials): Promise<SignInResult>;
+    signUp(credentials: SignInCredentials): Promise<SignInResult>;
+    /**
+     * Shared password flow (EC-150/EC-179). `signIn` and `signUp` differ only by
+     * the Convex Auth `flow` param; both return a token + load `users:me`.
+     */
+    private authenticate;
+    signOut(): Promise<void>;
+    private toUser;
+    private clearToken;
+}