@elytracms/studio 0.0.27 → 0.0.28

package/dist/components/users/users-collection-view-source.js

@@ -0,0 +1,157 @@
+import { useCallback, useMemo, useState } from 'react';
+import { studioPath } from '@elytracms/studio/router';
+import { defaultViewState } from '@elytracms/studio/lib/cms-views';
+import { useAuth } from '../auth-context';
+import { useUsers } from './users-store';
+import { usersCollectionDef } from './users-schema';
+/** The users rail is not localized — one implicit locale keeps the lens honest. */
+const USERS_LOCALE = 'en';
+const USERS_LOCALE_CONFIG = { default: USERS_LOCALE, locales: [USERS_LOCALE] };
+/** The built-in field names — everything else in `values` is a custom `meta` field. */
+const IDENTITY_FIELDS = new Set(['name', 'email', 'role']);
+/** Project the auth-identity + membership join into the lens's `values` shape. */
+export function userToDocument(record) {
+    return {
+        collection: usersCollectionDef.id,
+        id: record.id,
+        values: {
+            // Display title falls through empties (name → email → id) so a nameless,
+            // blank-email member never renders as a blank row; `email` keeps its real value.
+            name: record.name || record.email || record.id,
+            email: record.email,
+            role: record.roles[0] ?? 'viewer',
+            ...(record.meta ?? {}),
+        },
+    };
+}
+/**
+ * Principal-based field access for the users rail (EC-240, AD-18). `role` is
+ * authority: **read-only when you are editing YOURSELF** — you don't change your
+ * own role (the server integrity floor also guards it) — and **editable otherwise**
+ * (the rail is admin-only, so a non-self editor is an admin acting on someone else).
+ * Identity fields (name/email) follow their schema `form.readOnly`; everything else
+ * is editable. Pure, so the self/other rule is unit-testable without the auth hook.
+ */
+export function userFieldAccess(field, record, currentUserId) {
+    if (field.name === 'role') {
+        return record?.id === currentUserId ? 'read' : 'edit';
+    }
+    return field.form?.readOnly ? 'read' : 'edit';
+}
+/** Map an edited lens document back to the write contract (role + custom `meta`). */
+export function documentToSaveInput(doc) {
+    const values = doc.values ?? {};
+    const meta = {};
+    for (const [key, value] of Object.entries(values)) {
+        if (!IDENTITY_FIELDS.has(key))
+            meta[key] = value;
+    }
+    const role = typeof values.role === 'string' ? values.role : 'viewer';
+    return { id: doc.id, roles: [role], ...(Object.keys(meta).length > 0 ? { meta } : {}) };
+}
+/**
+ * Assemble a {@link CollectionViewSource} for the **users rail** (EC-240, AD-19) —
+ * the reuse proof that the portable list/edit surfaces serve a non-`cmsDocuments`
+ * rail. Mirrors {@link useCmsCollectionViewSource}, over the users store instead of
+ * the CMS store, with the users capability profile: admin-only, no
+ * publish/versions/create/import (identities are minted by sign-up and their bytes
+ * are auth-owned), remove allowed (revoke membership). Identity fields are
+ * read-only; an admin edits a member's role (and future custom `meta` fields).
+ *
+ * Must be mounted under a `UsersProvider` (for {@link useUsers}).
+ */
+export function useUsersCollectionViewSource(projectId) {
+    const users = useUsers();
+    // The signed-in principal — so `role` locks to read-only when an admin opens
+    // their OWN record (self ≠ other; the server floor enforces it regardless).
+    const auth = useAuth();
+    const currentUserId = auth.session?.user?.id;
+    const [viewState, setViewStateRaw] = useState(() => defaultViewState(usersCollectionDef));
+    const [lastError, setLastError] = useState(null);
+    const documents = useCallback(() => users.users.map(userToDocument), [users.users]);
+    const get = useCallback((ref) => {
+        const record = users.users.find((u) => u.id === ref.id);
+        return record ? userToDocument(record) : undefined;
+    }, [users.users]);
+    const titleOf = useCallback((ref) => {
+        const record = users.users.find((u) => u.id === ref.id);
+        return record?.name || record?.email || ref.id;
+    }, [users.users]);
+    const setViewState = useCallback((update) => {
+        setViewStateRaw((prev) => (typeof update === 'function' ? update(prev) : update));
+    }, []);
+    const save = useCallback((doc) => {
+        void users.save(documentToSaveInput(doc)).then((result) => {
+            if (!result.ok)
+                setLastError({ code: 'unknown', message: result.message });
+        });
+    }, [users]);
+    const remove = useCallback((ref) => {
+        void users.remove(ref.id).then((result) => {
+            if (!result.ok)
+                setLastError({ code: 'unknown', message: result.message });
+        });
+    }, [users]);
+    return useMemo(() => {
+        const capabilities = {
+            publish: false,
+            versions: false,
+            locales: false,
+            inlineEdit: false,
+            create: false, // identities are minted by sign-up, never here
+            remove: true, // revoke membership (does not delete the auth identity)
+            bulk: false,
+            liveUrl: false,
+            hierarchy: false,
+            importExport: false, // credential records are never dumped to raw JSON
+            adminOnly: true,
+        };
+        const source = {
+            collectionId: usersCollectionDef.id,
+            schema: usersCollectionDef,
+            capabilities,
+            projectId,
+            localeConfig: USERS_LOCALE_CONFIG,
+            activeLocale: USERS_LOCALE,
+            documents,
+            get,
+            titleOf,
+            // Users carry no relation fields in v1, so there are no cross-collection
+            // candidates to resolve; the lens is the only collection in scope.
+            referenceCandidates: () => [],
+            collections: [usersCollectionDef],
+            // The users rail now has a per-member detail surface (EC-240): rows link to
+            // it, and the edit shell's back-crumb / post-delete nav return to the list.
+            detailPath: (id) => studioPath.user(id),
+            listPath: studioPath.users(),
+            isFieldReadOnly: (field) => field.form?.readOnly ?? false,
+            // Principal-based tri-state: `role` is read-only for self, editable for an
+            // admin acting on another; identity fields follow their schema readOnly.
+            fieldAccess: (field, record) => userFieldAccess(field, record, currentUserId),
+            validate: () => [],
+            lastError,
+            clearLastError: () => setLastError(null),
+            viewState: () => viewState,
+            setViewState,
+            // create is gated off (capabilities.create === false); never reached.
+            create: () => {
+                throw new Error('users are created by sign-up, not the users rail');
+            },
+            save,
+            remove,
+        };
+        return source;
+    }, [
+        projectId,
+        currentUserId,
+        documents,
+        get,
+        titleOf,
+        setViewState,
+        save,
+        remove,
+        viewState,
+        lastError,
+    ]);
+}
+//# sourceMappingURL=users-collection-view-source.js.map

package/dist/components/users/users-collection-view-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-collection-view-source.js","sourceRoot":"","sources":["../../../src/components/users/users-collection-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAOlE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,mFAAmF;AACnF,MAAM,YAAY,GAAW,IAAI,CAAA;AACjC,MAAM,mBAAmB,GAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,CAAA;AAE5F,uFAAuF;AACvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1D,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO;QACL,UAAU,EAAE,kBAAkB,CAAC,EAAE;QACjC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE;YACN,yEAAyE;YACzE,iFAAiF;YACjF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE;YAC9C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ;YACjC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACvB;KACF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAe,EACf,MAA+B,EAC/B,aAAiC;IAEjC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,MAAM,EAAE,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IACvD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AAC/C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,GAAgB;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,IAAoB,CAAC,CAAC,CAAC,QAAQ,CAAA;IACtF,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;IACxB,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAiB,GAAG,EAAE,CACjE,gBAAgB,CAAC,kBAAkB,CAAC,CACrC,CAAA;IACD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAA;IAEvE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,WAAW,CACrB,CAAC,GAAgB,EAA2B,EAAE;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACvD,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpD,CAAC,EACD,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAA;IACD,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAgB,EAAU,EAAE;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACvD,OAAO,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAA;IAChD,CAAC,EACD,CAAC,KAAK,CAAC,KAAK,CAAC,CACd,CAAA;IACD,MAAM,YAAY,GAAG,WAAW,CAAuC,CAAC,MAAM,EAAE,EAAE;QAChF,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACnF,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,IAAI,GAAG,WAAW,CACtB,CAAC,GAAgB,EAAE,EAAE;QACnB,KAAK,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACxD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;IACJ,CAAC,EACD,CAAC,KAAK,CAAC,CACR,CAAA;IACD,MAAM,MAAM,GAAG,WAAW,CACxB,CAAC,GAAgB,EAAE,EAAE;QACnB,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;IACJ,CAAC,EACD,CAAC,KAAK,CAAC,CACR,CAAA;IAED,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,YAAY,GAA+B;YAC/C,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,KAAK,EAAE,+CAA+C;YAC9D,MAAM,EAAE,IAAI,EAAE,wDAAwD;YACtE,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,KAAK,EAAE,kDAAkD;YACvE,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,MAAM,GAAyB;YACnC,YAAY,EAAE,kBAAkB,CAAC,EAAE;YACnC,MAAM,EAAE,kBAAkB;YAC1B,YAAY;YACZ,SAAS;YACT,YAAY,EAAE,mBAAmB;YACjC,YAAY,EAAE,YAAY;YAC1B,SAAS;YACT,GAAG;YACH,OAAO;YACP,yEAAyE;YACzE,mEAAmE;YACnE,mBAAmB,EAAE,GAAG,EAAE,CAAC,EAAE;YAC7B,WAAW,EAAE,CAAC,kBAAkB,CAAC;YACjC,4EAA4E;YAC5E,4EAA4E;YAC5E,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE;YAC5B,eAAe,EAAE,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,IAAI,KAAK;YACnE,2EAA2E;YAC3E,yEAAyE;YACzE,WAAW,EAAE,CAAC,KAAe,EAAE,MAAoB,EAAe,EAAE,CAClE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC;YAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;YAClB,SAAS;YACT,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;YACxC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;YAC1B,YAAY;YACZ,sEAAsE;YACtE,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;YACrE,CAAC;YACD,IAAI;YACJ,MAAM;SACP,CAAA;QACD,OAAO,MAAM,CAAA;IACf,CAAC,EAAE;QACD,SAAS;QACT,aAAa;QACb,SAAS;QACT,GAAG;QACH,OAAO;QACP,YAAY;QACZ,IAAI;QACJ,MAAM;QACN,SAAS;QACT,SAAS;KACV,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback, useMemo, useState } from 'react'\nimport type { CmsDocument, DocumentRef, FieldDef, Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport type { ProjectRole, SaveUserInput, UserRecord } from '@elytracms/core/persistence'\nimport type { OperationError } from '@elytracms/core/operations'\nimport { studioPath } from '@elytracms/studio/router'\nimport { defaultViewState } from '@elytracms/studio/lib/cms-views'\nimport type { TableViewState } from '@elytracms/studio/lib/cms-views'\nimport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n  FieldAccess,\n} from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport { useAuth } from '../auth-context'\nimport { useUsers } from './users-store'\nimport { usersCollectionDef } from './users-schema'\n\n/** The users rail is not localized — one implicit locale keeps the lens honest. */\nconst USERS_LOCALE: Locale = 'en'\nconst USERS_LOCALE_CONFIG: LocaleConfig = { default: USERS_LOCALE, locales: [USERS_LOCALE] }\n\n/** The built-in field names — everything else in `values` is a custom `meta` field. */\nconst IDENTITY_FIELDS = new Set(['name', 'email', 'role'])\n\n/** Project the auth-identity + membership join into the lens's `values` shape. */\nexport function userToDocument(record: UserRecord): CmsDocument {\n  return {\n    collection: usersCollectionDef.id,\n    id: record.id,\n    values: {\n      // Display title falls through empties (name → email → id) so a nameless,\n      // blank-email member never renders as a blank row; `email` keeps its real value.\n      name: record.name || record.email || record.id,\n      email: record.email,\n      role: record.roles[0] ?? 'viewer',\n      ...(record.meta ?? {}),\n    },\n  }\n}\n\n/**\n * Principal-based field access for the users rail (EC-240, AD-18). `role` is\n * authority: **read-only when you are editing YOURSELF** — you don't change your\n * own role (the server integrity floor also guards it) — and **editable otherwise**\n * (the rail is admin-only, so a non-self editor is an admin acting on someone else).\n * Identity fields (name/email) follow their schema `form.readOnly`; everything else\n * is editable. Pure, so the self/other rule is unit-testable without the auth hook.\n */\nexport function userFieldAccess(\n  field: FieldDef,\n  record: CmsDocument | undefined,\n  currentUserId: string | undefined,\n): FieldAccess {\n  if (field.name === 'role') {\n    return record?.id === currentUserId ? 'read' : 'edit'\n  }\n  return field.form?.readOnly ? 'read' : 'edit'\n}\n\n/** Map an edited lens document back to the write contract (role + custom `meta`). */\nexport function documentToSaveInput(doc: CmsDocument): SaveUserInput {\n  const values = doc.values ?? {}\n  const meta: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(values)) {\n    if (!IDENTITY_FIELDS.has(key)) meta[key] = value\n  }\n  const role = typeof values.role === 'string' ? (values.role as ProjectRole) : 'viewer'\n  return { id: doc.id, roles: [role], ...(Object.keys(meta).length > 0 ? { meta } : {}) }\n}\n\n/**\n * Assemble a {@link CollectionViewSource} for the **users rail** (EC-240, AD-19) —\n * the reuse proof that the portable list/edit surfaces serve a non-`cmsDocuments`\n * rail. Mirrors {@link useCmsCollectionViewSource}, over the users store instead of\n * the CMS store, with the users capability profile: admin-only, no\n * publish/versions/create/import (identities are minted by sign-up and their bytes\n * are auth-owned), remove allowed (revoke membership). Identity fields are\n * read-only; an admin edits a member's role (and future custom `meta` fields).\n *\n * Must be mounted under a `UsersProvider` (for {@link useUsers}).\n */\nexport function useUsersCollectionViewSource(projectId: string): CollectionViewSource {\n  const users = useUsers()\n  // The signed-in principal — so `role` locks to read-only when an admin opens\n  // their OWN record (self ≠ other; the server floor enforces it regardless).\n  const auth = useAuth()\n  const currentUserId = auth.session?.user?.id\n  const [viewState, setViewStateRaw] = useState<TableViewState>(() =>\n    defaultViewState(usersCollectionDef),\n  )\n  const [lastError, setLastError] = useState<OperationError | null>(null)\n\n  const documents = useCallback(() => users.users.map(userToDocument), [users.users])\n  const get = useCallback(\n    (ref: DocumentRef): CmsDocument | undefined => {\n      const record = users.users.find((u) => u.id === ref.id)\n      return record ? userToDocument(record) : undefined\n    },\n    [users.users],\n  )\n  const titleOf = useCallback(\n    (ref: DocumentRef): string => {\n      const record = users.users.find((u) => u.id === ref.id)\n      return record?.name || record?.email || ref.id\n    },\n    [users.users],\n  )\n  const setViewState = useCallback<CollectionViewSource['setViewState']>((update) => {\n    setViewStateRaw((prev) => (typeof update === 'function' ? update(prev) : update))\n  }, [])\n\n  const save = useCallback(\n    (doc: CmsDocument) => {\n      void users.save(documentToSaveInput(doc)).then((result) => {\n        if (!result.ok) setLastError({ code: 'unknown', message: result.message })\n      })\n    },\n    [users],\n  )\n  const remove = useCallback(\n    (ref: DocumentRef) => {\n      void users.remove(ref.id).then((result) => {\n        if (!result.ok) setLastError({ code: 'unknown', message: result.message })\n      })\n    },\n    [users],\n  )\n\n  return useMemo(() => {\n    const capabilities: CollectionViewCapabilities = {\n      publish: false,\n      versions: false,\n      locales: false,\n      inlineEdit: false,\n      create: false, // identities are minted by sign-up, never here\n      remove: true, // revoke membership (does not delete the auth identity)\n      bulk: false,\n      liveUrl: false,\n      hierarchy: false,\n      importExport: false, // credential records are never dumped to raw JSON\n      adminOnly: true,\n    }\n    const source: CollectionViewSource = {\n      collectionId: usersCollectionDef.id,\n      schema: usersCollectionDef,\n      capabilities,\n      projectId,\n      localeConfig: USERS_LOCALE_CONFIG,\n      activeLocale: USERS_LOCALE,\n      documents,\n      get,\n      titleOf,\n      // Users carry no relation fields in v1, so there are no cross-collection\n      // candidates to resolve; the lens is the only collection in scope.\n      referenceCandidates: () => [],\n      collections: [usersCollectionDef],\n      // The users rail now has a per-member detail surface (EC-240): rows link to\n      // it, and the edit shell's back-crumb / post-delete nav return to the list.\n      detailPath: (id: string) => studioPath.user(id),\n      listPath: studioPath.users(),\n      isFieldReadOnly: (field: FieldDef) => field.form?.readOnly ?? false,\n      // Principal-based tri-state: `role` is read-only for self, editable for an\n      // admin acting on another; identity fields follow their schema readOnly.\n      fieldAccess: (field: FieldDef, record?: CmsDocument): FieldAccess =>\n        userFieldAccess(field, record, currentUserId),\n      validate: () => [],\n      lastError,\n      clearLastError: () => setLastError(null),\n      viewState: () => viewState,\n      setViewState,\n      // create is gated off (capabilities.create === false); never reached.\n      create: () => {\n        throw new Error('users are created by sign-up, not the users rail')\n      },\n      save,\n      remove,\n    }\n    return source\n  }, [\n    projectId,\n    currentUserId,\n    documents,\n    get,\n    titleOf,\n    setViewState,\n    save,\n    remove,\n    viewState,\n    lastError,\n  ])\n}\n"]}

package/dist/components/users/users-module.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The studio Users module (EC-240). An admin-only section for managing who has
+ * access to this deployment and their role. AD-19: it is the **reuse proof** for
+ * the portable interaction surfaces — it renders the SAME `LoadedCollectionTable`
+ * the CMS uses for the roster, and the SAME `DetailEditor` body (via
+ * {@link PortableDetailEditor}) for a member's detail, both over a users
+ * {@link useUsersCollectionViewSource} instead of a CMS source. No bespoke roster,
+ * no bespoke editor: filtering, columns, the count, and the edit form all come
+ * from the shared surfaces. The users capability profile (admin-only, no publish/
+ * versions/create/import) drives which regions appear.
+ *
+ * `userId === null` is the roster; a `userId` opens that member's detail (routed
+ * via `studioPath.user`). Both render under one `UsersProvider` + one source.
+ *
+ * Gating is layered: the operations chokepoint AND the Convex handlers enforce
+ * admin-only server-side (a non-admin `users.list` is denied). This UI gate is UX
+ * politeness — a non-admin sees a clear "restricted" state instead of a raw
+ * authorization error, and we skip firing a query we know will be denied.
+ */
+export declare function UsersModule({ projectId, userId, }: {
+    projectId: string;
+    userId?: string | null;
+}): import("react").JSX.Element;

package/dist/components/users/users-module.js

@@ -0,0 +1,61 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { AlertTriangle, RotateCcw, ShieldAlert } from 'lucide-react';
+import { Button, Heading, Row, Stack, Text } from '@elytracms/studio/ui';
+import { useProjectRole } from '../auth-context';
+import { UsersProvider, useUsers } from './users-store';
+import { useUsersCollectionViewSource } from './users-collection-view-source';
+import { CollectionViewProvider } from '../collection-view/collection-view-context';
+import { LoadedCollectionTable } from '../cms/collection-table';
+import { PortableDetailEditor } from '../cms/detail-editor';
+/**
+ * The studio Users module (EC-240). An admin-only section for managing who has
+ * access to this deployment and their role. AD-19: it is the **reuse proof** for
+ * the portable interaction surfaces — it renders the SAME `LoadedCollectionTable`
+ * the CMS uses for the roster, and the SAME `DetailEditor` body (via
+ * {@link PortableDetailEditor}) for a member's detail, both over a users
+ * {@link useUsersCollectionViewSource} instead of a CMS source. No bespoke roster,
+ * no bespoke editor: filtering, columns, the count, and the edit form all come
+ * from the shared surfaces. The users capability profile (admin-only, no publish/
+ * versions/create/import) drives which regions appear.
+ *
+ * `userId === null` is the roster; a `userId` opens that member's detail (routed
+ * via `studioPath.user`). Both render under one `UsersProvider` + one source.
+ *
+ * Gating is layered: the operations chokepoint AND the Convex handlers enforce
+ * admin-only server-side (a non-admin `users.list` is denied). This UI gate is UX
+ * politeness — a non-admin sees a clear "restricted" state instead of a raw
+ * authorization error, and we skip firing a query we know will be denied.
+ */
+export function UsersModule({ projectId, userId = null, }) {
+    const role = useProjectRole(projectId);
+    // `useProjectRole` conflates "loading" and "not a member" as null; in the studio
+    // a member always reaches here, so null resolves to the real role momentarily.
+    if (role === null) {
+        return (_jsx(Stack, { className: "h-full place-items-center p-8", align: "center", justify: "center", children: _jsx(Text, { size: "sm", tone: "muted", children: "Checking access\u2026" }) }));
+    }
+    if (role !== 'admin')
+        return _jsx(RestrictedState, {});
+    return (_jsx(UsersProvider, { projectId: projectId, children: _jsx(UsersSurface, { projectId: projectId, userId: userId }) }));
+}
+/** The non-admin gate: honest about why the surface is empty. */
+function RestrictedState() {
+    return (_jsxs(Stack, { gap: "2", align: "center", justify: "center", className: "h-full p-8 text-center", children: [_jsx(ShieldAlert, { className: "size-6 text-muted-foreground" }), _jsx(Heading, { level: 2, size: "h3", children: "Admins only" }), _jsx(Text, { size: "sm", tone: "muted", className: "max-w-sm", children: "Managing users and roles requires the admin role on this deployment. Ask an admin to grant you access." })] }));
+}
+/** The loaded surface: the portable list (or a member's detail) over the users source. */
+function UsersSurface({ projectId, userId }) {
+    const store = useUsers();
+    const source = useUsersCollectionViewSource(projectId);
+    if (store.status === 'error') {
+        return (_jsxs(Stack, { gap: "2", className: "p-6", "data-testid": "users-error", children: [_jsxs(Row, { gap: "2", children: [_jsx(AlertTriangle, { className: "size-4 text-destructive" }), _jsx(Text, { weight: "semibold", children: "Users failed to load" })] }), _jsx(Text, { size: "sm", tone: "muted", children: store.errorMessage ?? 'The persistence backend is unreachable.' }), _jsx(Row, { children: _jsxs(Button, { variant: "outline", size: "sm", onClick: () => void store.refresh(), children: [_jsx(RotateCcw, {}), " Retry"] }) })] }));
+    }
+    if (store.status === 'loading') {
+        return (_jsx(Stack, { className: "h-full place-items-center p-8", align: "center", justify: "center", children: _jsx(Text, { size: "sm", tone: "muted", children: "Loading users\u2026" }) }));
+    }
+    // A member's detail opens in the portable edit shell (AD-19); the list otherwise.
+    // The shell mounts its own CollectionViewProvider, so only the list wraps here.
+    if (userId !== null) {
+        return _jsx(PortableDetailEditor, { source: source, projectId: projectId, documentId: userId });
+    }
+    return (_jsx(CollectionViewProvider, { source: source, children: _jsx(LoadedCollectionTable, { projectId: projectId }) }));
+}
+//# sourceMappingURL=users-module.js.map

package/dist/components/users/users-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-module.js","sourceRoot":"","sources":["../../../src/components/users/users-module.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAA;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,SAAS,EACT,MAAM,GAAG,IAAI,GAId;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAA;IAEtC,iFAAiF;IACjF,+EAA+E;IAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CACL,KAAC,KAAK,IAAC,SAAS,EAAC,+BAA+B,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,YAC9E,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,sCAErB,GACD,CACT,CAAA;IACH,CAAC;IACD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAC,eAAe,KAAG,CAAA;IAEhD,OAAO,CACL,KAAC,aAAa,IAAC,SAAS,EAAE,SAAS,YACjC,KAAC,YAAY,IAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAI,GACxC,CACjB,CAAA;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,eAAe;IACtB,OAAO,CACL,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,SAAS,EAAC,wBAAwB,aAC/E,KAAC,WAAW,IAAC,SAAS,EAAC,8BAA8B,GAAG,EACxD,KAAC,OAAO,IAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAC,IAAI,4BAElB,EACV,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAC,SAAS,EAAC,UAAU,uHAG1C,IACD,CACT,CAAA;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAgD;IACvF,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;IACxB,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAA;IAEtD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CACL,MAAC,KAAK,IAAC,GAAG,EAAC,GAAG,EAAC,SAAS,EAAC,KAAK,iBAAa,aAAa,aACtD,MAAC,GAAG,IAAC,GAAG,EAAC,GAAG,aACV,KAAC,aAAa,IAAC,SAAS,EAAC,yBAAyB,GAAG,EACrD,KAAC,IAAI,IAAC,MAAM,EAAC,UAAU,qCAA4B,IAC/C,EACN,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,YACzB,KAAK,CAAC,YAAY,IAAI,yCAAyC,GAC3D,EACP,KAAC,GAAG,cACF,MAAC,MAAM,IAAC,OAAO,EAAC,SAAS,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,aACrE,KAAC,SAAS,KAAG,cACN,GACL,IACA,CACT,CAAA;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CACL,KAAC,KAAK,IAAC,SAAS,EAAC,+BAA+B,EAAC,KAAK,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,YAC9E,KAAC,IAAI,IAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,oCAErB,GACD,CACT,CAAA;IACH,CAAC;IAED,kFAAkF;IAClF,gFAAgF;IAChF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,KAAC,oBAAoB,IAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAI,CAAA;IAC3F,CAAC;IAED,OAAO,CACL,KAAC,sBAAsB,IAAC,MAAM,EAAE,MAAM,YACpC,KAAC,qBAAqB,IAAC,SAAS,EAAE,SAAS,GAAI,GACxB,CAC1B,CAAA;AACH,CAAC","sourcesContent":["import { AlertTriangle, RotateCcw, ShieldAlert } from 'lucide-react'\nimport { Button, Heading, Row, Stack, Text } from '@elytracms/studio/ui'\nimport { useProjectRole } from '../auth-context'\nimport { UsersProvider, useUsers } from './users-store'\nimport { useUsersCollectionViewSource } from './users-collection-view-source'\nimport { CollectionViewProvider } from '../collection-view/collection-view-context'\nimport { LoadedCollectionTable } from '../cms/collection-table'\nimport { PortableDetailEditor } from '../cms/detail-editor'\n\n/**\n * The studio Users module (EC-240). An admin-only section for managing who has\n * access to this deployment and their role. AD-19: it is the **reuse proof** for\n * the portable interaction surfaces — it renders the SAME `LoadedCollectionTable`\n * the CMS uses for the roster, and the SAME `DetailEditor` body (via\n * {@link PortableDetailEditor}) for a member's detail, both over a users\n * {@link useUsersCollectionViewSource} instead of a CMS source. No bespoke roster,\n * no bespoke editor: filtering, columns, the count, and the edit form all come\n * from the shared surfaces. The users capability profile (admin-only, no publish/\n * versions/create/import) drives which regions appear.\n *\n * `userId === null` is the roster; a `userId` opens that member's detail (routed\n * via `studioPath.user`). Both render under one `UsersProvider` + one source.\n *\n * Gating is layered: the operations chokepoint AND the Convex handlers enforce\n * admin-only server-side (a non-admin `users.list` is denied). This UI gate is UX\n * politeness — a non-admin sees a clear \"restricted\" state instead of a raw\n * authorization error, and we skip firing a query we know will be denied.\n */\nexport function UsersModule({\n  projectId,\n  userId = null,\n}: {\n  projectId: string\n  userId?: string | null\n}) {\n  const role = useProjectRole(projectId)\n\n  // `useProjectRole` conflates \"loading\" and \"not a member\" as null; in the studio\n  // a member always reaches here, so null resolves to the real role momentarily.\n  if (role === null) {\n    return (\n      <Stack className=\"h-full place-items-center p-8\" align=\"center\" justify=\"center\">\n        <Text size=\"sm\" tone=\"muted\">\n          Checking access…\n        </Text>\n      </Stack>\n    )\n  }\n  if (role !== 'admin') return <RestrictedState />\n\n  return (\n    <UsersProvider projectId={projectId}>\n      <UsersSurface projectId={projectId} userId={userId} />\n    </UsersProvider>\n  )\n}\n\n/** The non-admin gate: honest about why the surface is empty. */\nfunction RestrictedState() {\n  return (\n    <Stack gap=\"2\" align=\"center\" justify=\"center\" className=\"h-full p-8 text-center\">\n      <ShieldAlert className=\"size-6 text-muted-foreground\" />\n      <Heading level={2} size=\"h3\">\n        Admins only\n      </Heading>\n      <Text size=\"sm\" tone=\"muted\" className=\"max-w-sm\">\n        Managing users and roles requires the admin role on this deployment. Ask an admin to grant\n        you access.\n      </Text>\n    </Stack>\n  )\n}\n\n/** The loaded surface: the portable list (or a member's detail) over the users source. */\nfunction UsersSurface({ projectId, userId }: { projectId: string; userId: string | null }) {\n  const store = useUsers()\n  const source = useUsersCollectionViewSource(projectId)\n\n  if (store.status === 'error') {\n    return (\n      <Stack gap=\"2\" className=\"p-6\" data-testid=\"users-error\">\n        <Row gap=\"2\">\n          <AlertTriangle className=\"size-4 text-destructive\" />\n          <Text weight=\"semibold\">Users failed to load</Text>\n        </Row>\n        <Text size=\"sm\" tone=\"muted\">\n          {store.errorMessage ?? 'The persistence backend is unreachable.'}\n        </Text>\n        <Row>\n          <Button variant=\"outline\" size=\"sm\" onClick={() => void store.refresh()}>\n            <RotateCcw /> Retry\n          </Button>\n        </Row>\n      </Stack>\n    )\n  }\n\n  if (store.status === 'loading') {\n    return (\n      <Stack className=\"h-full place-items-center p-8\" align=\"center\" justify=\"center\">\n        <Text size=\"sm\" tone=\"muted\">\n          Loading users…\n        </Text>\n      </Stack>\n    )\n  }\n\n  // A member's detail opens in the portable edit shell (AD-19); the list otherwise.\n  // The shell mounts its own CollectionViewProvider, so only the list wraps here.\n  if (userId !== null) {\n    return <PortableDetailEditor source={source} projectId={projectId} documentId={userId} />\n  }\n\n  return (\n    <CollectionViewProvider source={source}>\n      <LoadedCollectionTable projectId={projectId} />\n    </CollectionViewProvider>\n  )\n}\n"]}

package/dist/components/users/users-schema.d.ts

@@ -0,0 +1,19 @@
+import type { CollectionDef } from '@elytracms/core/cms-core';
+/**
+ * The built-in **users** field lens (EC-240, AD-19). Users are a separate rail —
+ * NOT a `cmsDocuments` collection (`collectionKindSchema` is `document|asset`) —
+ * so this `CollectionDef` exists only to drive the portable list/edit surfaces
+ * over the users {@link CollectionViewSource}. The rail's *user-ness* comes from
+ * the source's capabilities (admin-only, no publish/versions/create), never the
+ * schema `kind`.
+ *
+ * Identity fields (`name`, `email`) are **auth-owned** and read-only here — an
+ * admin manages a member's *role* (and, later, project-declared custom fields
+ * over the `meta` bag, mirroring assets); the person edits their own name/email
+ * via account settings. A v1 default; a project may extend the field set later.
+ */
+export declare const USER_ROLE_OPTIONS: {
+    value: import("@elytracms/core/persistence").ProjectRole;
+    label: string;
+}[];
+export declare const usersCollectionDef: CollectionDef;

package/dist/components/users/users-schema.js

@@ -0,0 +1,38 @@
+import { collectionDefSchema } from '@elytracms/core/cms-core';
+import { roleOptions } from '@elytracms/core/persistence';
+/**
+ * The built-in **users** field lens (EC-240, AD-19). Users are a separate rail —
+ * NOT a `cmsDocuments` collection (`collectionKindSchema` is `document|asset`) —
+ * so this `CollectionDef` exists only to drive the portable list/edit surfaces
+ * over the users {@link CollectionViewSource}. The rail's *user-ness* comes from
+ * the source's capabilities (admin-only, no publish/versions/create), never the
+ * schema `kind`.
+ *
+ * Identity fields (`name`, `email`) are **auth-owned** and read-only here — an
+ * admin manages a member's *role* (and, later, project-declared custom fields
+ * over the `meta` bag, mirroring assets); the person edits their own name/email
+ * via account settings. A v1 default; a project may extend the field set later.
+ */
+// Derived from the ONE role policy (EC-240c) — no hardcoded duplicate of the role
+// set. Reflects the shipped default today; a project's custom policy flows through.
+export const USER_ROLE_OPTIONS = roleOptions();
+export const usersCollectionDef = collectionDefSchema.parse({
+    id: 'user',
+    // Users aren't a CMS `kind`; 'document' just satisfies the lens schema. The
+    // source's capabilities (adminOnly, no publish/versions/create) carry the semantics.
+    kind: 'document',
+    titleField: 'name',
+    form: { label: 'Users', labelSingular: 'user' },
+    fields: [
+        { name: 'name', type: 'text', form: { label: 'Name', readOnly: true }, filterable: true },
+        { name: 'email', type: 'text', form: { label: 'Email', readOnly: true }, filterable: true },
+        {
+            name: 'role',
+            type: 'select',
+            options: [...USER_ROLE_OPTIONS],
+            filterable: true,
+            form: { label: 'Role' },
+        },
+    ],
+});
+//# sourceMappingURL=users-schema.js.map

package/dist/components/users/users-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-schema.js","sourceRoot":"","sources":["../../../src/components/users/users-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEzD;;;;;;;;;;;;GAYG;AACH,kFAAkF;AAClF,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,EAAE,CAAA;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAkB,mBAAmB,CAAC,KAAK,CAAC;IACzE,EAAE,EAAE,MAAM;IACV,4EAA4E;IAC5E,qFAAqF;IACrF,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;IAC/C,MAAM,EAAE;QACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACzF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QAC3F;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,GAAG,iBAAiB,CAAC;YAC/B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;SACxB;KACF;CACF,CAAC,CAAA","sourcesContent":["import { collectionDefSchema } from '@elytracms/core/cms-core'\nimport type { CollectionDef } from '@elytracms/core/cms-core'\nimport { roleOptions } from '@elytracms/core/persistence'\n\n/**\n * The built-in **users** field lens (EC-240, AD-19). Users are a separate rail —\n * NOT a `cmsDocuments` collection (`collectionKindSchema` is `document|asset`) —\n * so this `CollectionDef` exists only to drive the portable list/edit surfaces\n * over the users {@link CollectionViewSource}. The rail's *user-ness* comes from\n * the source's capabilities (admin-only, no publish/versions/create), never the\n * schema `kind`.\n *\n * Identity fields (`name`, `email`) are **auth-owned** and read-only here — an\n * admin manages a member's *role* (and, later, project-declared custom fields\n * over the `meta` bag, mirroring assets); the person edits their own name/email\n * via account settings. A v1 default; a project may extend the field set later.\n */\n// Derived from the ONE role policy (EC-240c) — no hardcoded duplicate of the role\n// set. Reflects the shipped default today; a project's custom policy flows through.\nexport const USER_ROLE_OPTIONS = roleOptions()\n\nexport const usersCollectionDef: CollectionDef = collectionDefSchema.parse({\n  id: 'user',\n  // Users aren't a CMS `kind`; 'document' just satisfies the lens schema. The\n  // source's capabilities (adminOnly, no publish/versions/create) carry the semantics.\n  kind: 'document',\n  titleField: 'name',\n  form: { label: 'Users', labelSingular: 'user' },\n  fields: [\n    { name: 'name', type: 'text', form: { label: 'Name', readOnly: true }, filterable: true },\n    { name: 'email', type: 'text', form: { label: 'Email', readOnly: true }, filterable: true },\n    {\n      name: 'role',\n      type: 'select',\n      options: [...USER_ROLE_OPTIONS],\n      filterable: true,\n      form: { label: 'Role' },\n    },\n  ],\n})\n"]}

package/dist/components/users/users-store.d.ts

@@ -0,0 +1,40 @@
+import type { ReactNode } from 'react';
+import type { SaveUserInput, UserRecord } from '@elytracms/core/persistence';
+/**
+ * Studio users store (EC-240, 240b). The users rail — role + custom fields
+ * joined to auth identity — read + written through the shared operations client
+ * (`users.*` commands: validate → authorize → mutate → event), the same seam the
+ * assets store uses. Admin-only: every `users.*` operation is gated at the
+ * chokepoint AND server-side, so a non-admin session sees an authorization error
+ * rather than data. Mirrors `assets-store.tsx`, minus the blob/upload machinery
+ * (users have no bytes).
+ */
+export interface UsersStore {
+    /** The active project (deployment) whose members this rail manages. */
+    projectId: string;
+    status: 'loading' | 'ready' | 'error';
+    errorMessage?: string;
+    users: readonly UserRecord[];
+    /** Grant/modify a user's role(s) + custom fields (admin-only). */
+    save(input: SaveUserInput): Promise<{
+        ok: true;
+        user: UserRecord;
+    } | {
+        ok: false;
+        message: string;
+    }>;
+    /** Revoke a user's studio membership (does not delete the auth identity). */
+    remove(userId: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        message: string;
+    }>;
+    /** Re-list from the backend (the public escape hatch). */
+    refresh(): Promise<void>;
+}
+export declare function UsersProvider({ projectId, children, }: {
+    projectId: string;
+    children: ReactNode;
+}): import("react").JSX.Element;
+export declare function useUsers(): UsersStore;

package/dist/components/users/users-store.js

@@ -0,0 +1,87 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useCallback, useContext, useMemo } from 'react';
+import { getStudioOperations } from '@elytracms/studio/lib/operations';
+import { useOperationCache, useOperationQuery } from '@elytracms/studio/lib/query';
+const UsersContext = createContext(null);
+const EMPTY_USERS = [];
+/** Cache key for a project's users rail (shared by the query and its patches). */
+function usersQueryKey(projectId) {
+    return ['users', projectId];
+}
+/** Load a project's studio users (pure over the operations client). A list
+ *  failure throws so the query surfaces it as an error status. */
+async function loadUsers(operations, projectId) {
+    const result = await operations.users.list({ projectId });
+    if (!result.ok)
+        throw new Error(result.error.message);
+    return [...result.value];
+}
+export function UsersProvider({ projectId, children, }) {
+    // The users list, read through the one operations-backed query cache
+    // (EC-308/AD-17). This provider is the sole writer of its project's users, so
+    // its own mutations patch the cache in place rather than re-listing.
+    const query = useOperationQuery({
+        queryKey: usersQueryKey(projectId),
+        loader: (operations) => loadUsers(operations, projectId),
+    });
+    const cache = useOperationCache();
+    const refetch = query.refetch;
+    const users = query.data ?? EMPTY_USERS;
+    const status = query.isPending
+        ? 'loading'
+        : query.isError
+            ? 'error'
+            : 'ready';
+    const errorMessage = query.isError && query.error instanceof Error ? query.error.message : undefined;
+    const refresh = useCallback(async () => {
+        await refetch();
+    }, [refetch]);
+    const save = useCallback(async (input) => {
+        // Writes go through the `users.save` command via the shared operations
+        // client (EC-141) — validate → authorize (admin) → mutate → event.
+        const { operations } = await getStudioOperations();
+        const result = await operations.users.save({
+            projectId,
+            userId: input.id,
+            // 240a bridge: the contract's `roles: string[]` is permissive (240c-ready);
+            // the operation input constrains it to the current enum + re-validates at
+            // runtime. The cast crosses that permissive→strict seam.
+            roles: input.roles,
+            ...(input.meta !== undefined ? { meta: input.meta } : {}),
+        });
+        if (!result.ok)
+            return { ok: false, message: result.error.message };
+        // Patch the one updated record into the cache rather than re-listing.
+        const saved = result.value;
+        cache.patch(usersQueryKey(projectId), (prev) => {
+            const rest = (prev ?? []).filter((u) => u.id !== saved.id);
+            return [...rest, saved].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        });
+        return { ok: true, user: saved };
+    }, [projectId, cache]);
+    const remove = useCallback(async (userId) => {
+        const { operations } = await getStudioOperations();
+        const result = await operations.users.remove({ projectId, userId });
+        if (!result.ok)
+            return { ok: false, message: result.error.message };
+        cache.patch(usersQueryKey(projectId), (prev) => (prev ?? []).filter((u) => u.id !== userId));
+        return { ok: true };
+    }, [projectId, cache]);
+    const store = useMemo(() => ({
+        projectId,
+        status,
+        ...(errorMessage !== undefined ? { errorMessage } : {}),
+        users,
+        save,
+        remove,
+        refresh,
+    }), [projectId, status, errorMessage, users, save, remove, refresh]);
+    return _jsx(UsersContext.Provider, { value: store, children: children });
+}
+export function useUsers() {
+    const store = useContext(UsersContext);
+    if (!store)
+        throw new Error('useUsers must be used within a <UsersProvider>.');
+    return store;
+}
+//# sourceMappingURL=users-store.js.map

package/dist/components/users/users-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users-store.js","sourceRoot":"","sources":["../../../src/components/users/users-store.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAGvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAEtE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AA0BlF,MAAM,YAAY,GAAG,aAAa,CAAoB,IAAI,CAAC,CAAA;AAE3D,MAAM,WAAW,GAA0B,EAAE,CAAA;AAE7C,kFAAkF;AAClF,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;AAC7B,CAAC;AAED;kEACkE;AAClE,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE,SAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrD,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAC5B,SAAS,EACT,QAAQ,GAIT;IACC,qEAAqE;IACrE,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,KAAK,GAAG,iBAAiB,CAAe;QAC5C,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC;KACzD,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAA;IACvC,MAAM,MAAM,GAAyB,KAAK,CAAC,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,OAAO;YACb,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAA;IACb,MAAM,YAAY,GAChB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAEjF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;YACzC,SAAS;YACT,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,4EAA4E;YAC5E,0EAA0E;YAC1E,yDAAyD;YACzD,KAAK,EAAE,KAAK,CAAC,KAAsB;YACnC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACnE,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAC1B,KAAK,CAAC,KAAK,CAAe,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1D,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClF,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAClC,CAAC,EACD,CAAC,SAAS,EAAE,KAAK,CAAC,CACnB,CAAA;IAED,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACnE,KAAK,CAAC,KAAK,CAAe,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAC5C,CAAA;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC,EACD,CAAC,SAAS,EAAE,KAAK,CAAC,CACnB,CAAA;IAED,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC;QACL,SAAS;QACT,MAAM;QACN,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK;QACL,IAAI;QACJ,MAAM;QACN,OAAO;KACR,CAAC,EACF,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAChE,CAAA;IAED,OAAO,KAAC,YAAY,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAAyB,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAC9E,OAAO,KAAK,CAAA;AACd,CAAC","sourcesContent":["import { createContext, useCallback, useContext, useMemo } from 'react'\nimport type { ReactNode } from 'react'\nimport type { ProjectRole, SaveUserInput, UserRecord } from '@elytracms/core/persistence'\nimport { getStudioOperations } from '@elytracms/studio/lib/operations'\nimport type { OperationsClient } from '@elytracms/studio/lib/operations'\nimport { useOperationCache, useOperationQuery } from '@elytracms/studio/lib/query'\n\n/**\n * Studio users store (EC-240, 240b). The users rail — role + custom fields\n * joined to auth identity — read + written through the shared operations client\n * (`users.*` commands: validate → authorize → mutate → event), the same seam the\n * assets store uses. Admin-only: every `users.*` operation is gated at the\n * chokepoint AND server-side, so a non-admin session sees an authorization error\n * rather than data. Mirrors `assets-store.tsx`, minus the blob/upload machinery\n * (users have no bytes).\n */\n\nexport interface UsersStore {\n  /** The active project (deployment) whose members this rail manages. */\n  projectId: string\n  status: 'loading' | 'ready' | 'error'\n  errorMessage?: string\n  users: readonly UserRecord[]\n  /** Grant/modify a user's role(s) + custom fields (admin-only). */\n  save(input: SaveUserInput): Promise<{ ok: true; user: UserRecord } | { ok: false; message: string }>\n  /** Revoke a user's studio membership (does not delete the auth identity). */\n  remove(userId: string): Promise<{ ok: true } | { ok: false; message: string }>\n  /** Re-list from the backend (the public escape hatch). */\n  refresh(): Promise<void>\n}\n\nconst UsersContext = createContext<UsersStore | null>(null)\n\nconst EMPTY_USERS: readonly UserRecord[] = []\n\n/** Cache key for a project's users rail (shared by the query and its patches). */\nfunction usersQueryKey(projectId: string): readonly [string, string] {\n  return ['users', projectId]\n}\n\n/** Load a project's studio users (pure over the operations client). A list\n *  failure throws so the query surfaces it as an error status. */\nasync function loadUsers(operations: OperationsClient, projectId: string): Promise<UserRecord[]> {\n  const result = await operations.users.list({ projectId })\n  if (!result.ok) throw new Error(result.error.message)\n  return [...result.value]\n}\n\nexport function UsersProvider({\n  projectId,\n  children,\n}: {\n  projectId: string\n  children: ReactNode\n}) {\n  // The users list, read through the one operations-backed query cache\n  // (EC-308/AD-17). This provider is the sole writer of its project's users, so\n  // its own mutations patch the cache in place rather than re-listing.\n  const query = useOperationQuery<UserRecord[]>({\n    queryKey: usersQueryKey(projectId),\n    loader: (operations) => loadUsers(operations, projectId),\n  })\n  const cache = useOperationCache()\n  const refetch = query.refetch\n  const users = query.data ?? EMPTY_USERS\n  const status: UsersStore['status'] = query.isPending\n    ? 'loading'\n    : query.isError\n      ? 'error'\n      : 'ready'\n  const errorMessage =\n    query.isError && query.error instanceof Error ? query.error.message : undefined\n\n  const refresh = useCallback(async () => {\n    await refetch()\n  }, [refetch])\n\n  const save = useCallback<UsersStore['save']>(\n    async (input) => {\n      // Writes go through the `users.save` command via the shared operations\n      // client (EC-141) — validate → authorize (admin) → mutate → event.\n      const { operations } = await getStudioOperations()\n      const result = await operations.users.save({\n        projectId,\n        userId: input.id,\n        // 240a bridge: the contract's `roles: string[]` is permissive (240c-ready);\n        // the operation input constrains it to the current enum + re-validates at\n        // runtime. The cast crosses that permissive→strict seam.\n        roles: input.roles as ProjectRole[],\n        ...(input.meta !== undefined ? { meta: input.meta } : {}),\n      })\n      if (!result.ok) return { ok: false, message: result.error.message }\n      // Patch the one updated record into the cache rather than re-listing.\n      const saved = result.value\n      cache.patch<UserRecord[]>(usersQueryKey(projectId), (prev) => {\n        const rest = (prev ?? []).filter((u) => u.id !== saved.id)\n        return [...rest, saved].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))\n      })\n      return { ok: true, user: saved }\n    },\n    [projectId, cache],\n  )\n\n  const remove = useCallback<UsersStore['remove']>(\n    async (userId) => {\n      const { operations } = await getStudioOperations()\n      const result = await operations.users.remove({ projectId, userId })\n      if (!result.ok) return { ok: false, message: result.error.message }\n      cache.patch<UserRecord[]>(usersQueryKey(projectId), (prev) =>\n        (prev ?? []).filter((u) => u.id !== userId),\n      )\n      return { ok: true }\n    },\n    [projectId, cache],\n  )\n\n  const store = useMemo<UsersStore>(\n    () => ({\n      projectId,\n      status,\n      ...(errorMessage !== undefined ? { errorMessage } : {}),\n      users,\n      save,\n      remove,\n      refresh,\n    }),\n    [projectId, status, errorMessage, users, save, remove, refresh],\n  )\n\n  return <UsersContext.Provider value={store}>{children}</UsersContext.Provider>\n}\n\nexport function useUsers(): UsersStore {\n  const store = useContext(UsersContext)\n  if (!store) throw new Error('useUsers must be used within a <UsersProvider>.')\n  return store\n}\n"]}

package/dist/lib/cms-views/index.d.ts

@@ -1,9 +1,8 @@
 /**
- * Saved views & table-view model for the CMS collection table (EC-169):
- * the pure filter/sort/column model (`view-model`), row selection
- * (`selection`), and project-scoped persistence through `@elytracms/core/operations`
- * (`views-store`).
+ * The table-view model for the CMS collection table: the pure filter/sort/column
+ * model (`view-model`) and row selection (`selection`). Views are config-as-code
+ * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
+ * resolves the named views a collection declares in `cms/`.
  */
 export * from './view-model';
 export * from './selection';
-export * from './views-store';

package/dist/lib/cms-views/index.js

@@ -1,10 +1,9 @@
 /**
- * Saved views & table-view model for the CMS collection table (EC-169):
- * the pure filter/sort/column model (`view-model`), row selection
- * (`selection`), and project-scoped persistence through `@elytracms/core/operations`
- * (`views-store`).
+ * The table-view model for the CMS collection table: the pure filter/sort/column
+ * model (`view-model`) and row selection (`selection`). Views are config-as-code
+ * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
+ * resolves the named views a collection declares in `cms/`.
  */
 export * from './view-model';
 export * from './selection';
-export * from './views-store';
 //# sourceMappingURL=index.js.map

package/dist/lib/cms-views/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/cms-views/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA","sourcesContent":["/**\n * Saved views & table-view model for the CMS collection table (EC-169):\n * the pure filter/sort/column model (`view-model`), row selection\n * (`selection`), and project-scoped persistence through `@elytracms/core/operations`\n * (`views-store`).\n */\nexport * from './view-model'\nexport * from './selection'\nexport * from './views-store'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/cms-views/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA","sourcesContent":["/**\n * The table-view model for the CMS collection table: the pure filter/sort/column\n * model (`view-model`) and row selection (`selection`). Views are config-as-code\n * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`\n * resolves the named views a collection declares in `cms/`.\n */\nexport * from './view-model'\nexport * from './selection'\n"]}

package/dist/lib/cms-views/view-model.d.ts

@@ -142,8 +142,55 @@ export interface AppliedViewState {
 export declare function applyViewState(collection: CollectionDef, docs: readonly CmsDocument[], localeConfig: LocaleConfig, state: TableViewState, isPublished?: IsPublished): AppliedViewState;
 /** The id of the unnamed built-in "All documents" view. */
 export declare const ALL_VIEW_ID = "all";
-/** The default (unnamed) view: no filters, no sort, every field visible. */
 export declare function defaultViewState(collection: CollectionDef): TableViewState;
+/**
+ * A config-declared view (EC-246b) — the flat authoring shape a collection
+ * declares in `cms/` config: `{ name, filters?, sort?, columns?, hidden? }`.
+ * Filters/sort/columns sit at the top level (no nested `state` wrapper). The
+ * studio validates + interprets these; `cms-core` stores them opaquely (it
+ * can't reference the filter vocabulary without a layering cycle).
+ */
+export declare const configViewSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        op: z.ZodEnum<{
+            in: "in";
+            eq: "eq";
+            gt: "gt";
+            gte: "gte";
+            lt: "lt";
+            lte: "lte";
+        }>;
+        value: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>;
+    }, z.core.$strip>>>;
+    sort: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        field: z.ZodString;
+        dir: z.ZodEnum<{
+            desc: "desc";
+            asc: "asc";
+        }>;
+    }, z.core.$strip>>>;
+    columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hidden: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type ConfigView = z.infer<typeof configViewSchema>;
+/** A resolved view: identity + the table state it restores (matches `SavedView`). */
+export interface ResolvedView {
+    id: string;
+    name: string;
+    state: TableViewState;
+}
+/**
+ * Resolve a collection's config-declared `views` into full {@link ResolvedView}s
+ * (EC-246b). Each is validated with {@link configViewSchema}; malformed entries
+ * and duplicate ids are dropped (defensive). Columns fall back to the collection
+ * default when a view doesn't pin them, so a filter-only view still renders every
+ * column. Config views are shared and change only in
+ * code — the runtime never mutates them.
+ */
+export declare function configViewsFor(collection: CollectionDef): ResolvedView[];
 /** Deep-cloned canonical form (stable key order via the Zod shape). */
 export declare function normalizeViewState(state: TableViewState): TableViewState;
 /** Structural equality on normalized states — drives the "unsaved changes" affordance. */