@elytracms/studio 0.0.51 → 0.0.53

package/convex/auth.ts

@@ -1,11 +1,140 @@
 import { convexAuth } from '@convex-dev/auth/server'
 import { Password } from '@convex-dev/auth/providers/Password'
+import type { AnyDataModel, GenericMutationCtx } from 'convex/server'
 import { ConvexError } from 'convex/values'
+import type { GenericId } from 'convex/values'
 import { classifyInviteSignup, normalizeInviteEmail } from '@elytracms/core/persistence'
+import type { InviteSignupDecision } from '@elytracms/core/persistence'
 
 /** The provider list `convexAuth` accepts, derived from its own signature. */
 type ConvexAuthProviders = Parameters<typeof convexAuth>[0]['providers']
 
+/** The (non-schema-bound) mutation ctx the `convexAuth` callbacks receive. */
+type AuthCallbackCtx = GenericMutationCtx<AnyDataModel>
+
+/**
+ * Gather the invite-gate facts for a principal and classify them (EC-324).
+ * The ONE decision lives in the pure `classifyInviteSignup`
+ * (`@elytracms/core/persistence`, shared with its tests):
+ *
+ * - **existing member** → normal re-sign-in; no-op (also recovers a member-less
+ *   account it created earlier and never lets the deployment lock itself out).
+ * - **first user** (no members yet) → bootstrap as `admin`.
+ * - **invited** → grant the invited role (+ consume the invite).
+ * - **uninvited** → REJECT (closes the EC-304 open-sign-up hole).
+ */
+async function decideInviteGate(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'>; email: string | null },
+): Promise<{ decision: InviteSignupDecision; invite: { _id: string; role: string } | null }> {
+  // The convexAuth callback ctx is `AnyDataModel` (not schema-bound), so use
+  // `.filter()` rather than `.withIndex()` here. The members/invites tables are
+  // tiny (single-tenant), and this runs only at account creation / sign-in.
+  const existingMember = await ctx.db
+    .query('members')
+    .filter((q) => q.eq(q.field('userId'), args.userId))
+    .first()
+  const anyMember = existingMember ?? (await ctx.db.query('members').first())
+  const email = args.email ? normalizeInviteEmail(args.email) : null
+  const invite = email
+    ? await ctx.db
+        .query('invites')
+        .filter((q) => q.eq(q.field('email'), email))
+        .first()
+    : null
+
+  const decision = classifyInviteSignup({
+    hasAnyMember: anyMember !== null,
+    existingRole: existingMember?.role ?? null,
+    invite: invite ? { role: invite.role } : null,
+  })
+  return { decision, invite }
+}
+
+/**
+ * EC-358 — the ACCOUNT-CREATION gate. Wired as `afterUserCreatedOrUpdated`,
+ * which Convex Auth calls inside the SAME `auth:store` mutation that creates
+ * the principal's rows — after the `users` insert, **before** the
+ * `authAccounts` insert (`upsertUserAndAccount`). A Convex mutation is one
+ * atomic transaction, so throwing here rolls the `users` insert back and the
+ * `authAccounts` row is never written: an uninvited sign-up leaves ZERO rows.
+ *
+ * Why this hook: the EC-324 gate lived only in `beforeSessionCreation`, which
+ * runs in a LATER store mutation — by then the password `authAccounts` + `users`
+ * rows were already committed, so a rejected uninvited sign-up left an orphan
+ * account carrying an attacker-chosen password that a later invite would
+ * silently promote (proven live 2026-07-08). The alternative pre-create hook,
+ * `createOrUpdateUser`, REPLACES the library's user-creation/linking mechanics
+ * wholesale — a far bigger seam than this scope allows; this hook keeps the
+ * default mechanics and only adds the veto.
+ *
+ * Only REJECT throws here; membership granting/consuming stays in
+ * `beforeSessionCreation` (the account-creation callback also fires for
+ * verification/OAuth account flows where a session may not follow immediately).
+ * For credentials providers this fires exactly on `createAccount` (sign-UP),
+ * not on re-sign-in.
+ */
+export async function gateAccountCreation(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'>; profile: { email?: string } },
+): Promise<void> {
+  const email = typeof args.profile.email === 'string' ? args.profile.email : null
+  const { decision } = await decideInviteGate(ctx, { userId: args.userId, email })
+  if (decision.kind === 'reject') throw new ConvexError(decision.reason)
+}
+
+/**
+ * Invite-based onboarding gate + first-principal bootstrap (EC-324 / EC-150).
+ * Wired as `beforeSessionCreation`: fires on EVERY sign-in (not just account
+ * creation), right before the session is persisted — throwing here rejects the
+ * sign-in. See {@link decideInviteGate} for the decision table.
+ *
+ * The `ConvexError` message ("not-invited: …") survives to the client even in
+ * production, so the sign-in screen tells the truth instead of the old
+ * "password too short". The `ConvexAuthAdapter` classifies it to a distinct
+ * `not-invited` `SignInResult` reason.
+ *
+ * Single-tenant: one `members` table per deployment. Invite mechanism: a plain
+ * email allowlist (`invites` table) — the simplest server-enforced design, no
+ * token infrastructure.
+ */
+export async function gateSessionCreation(
+  ctx: AuthCallbackCtx,
+  args: { userId: GenericId<'users'> },
+): Promise<void> {
+  const now = new Date().toISOString()
+  const user = await ctx.db.get(args.userId)
+  const rawEmail = (user as { email?: string } | null)?.email
+  const { decision, invite } = await decideInviteGate(ctx, {
+    userId: args.userId,
+    email: rawEmail ?? null,
+  })
+
+  switch (decision.kind) {
+    case 'existing-member':
+      return
+    case 'bootstrap-admin':
+      await ctx.db.insert('members', {
+        userId: args.userId,
+        role: 'admin',
+        createdAt: now,
+        updatedAt: now,
+      })
+      return
+    case 'grant-role':
+      await ctx.db.insert('members', {
+        userId: args.userId,
+        role: decision.role,
+        createdAt: now,
+        updatedAt: now,
+      })
+      if (invite) await ctx.db.delete(invite._id as GenericId<'invites'>)
+      return
+    case 'reject':
+      throw new ConvexError(decision.reason)
+  }
+}
+
 /**
  * EC-252 — the studio's Convex Auth (EC-150) as a **default + override seam**. Only the
  * PROVIDER choice is legitimately consumer-specific; the first-principal admin bootstrap
@@ -30,69 +159,13 @@ export function defineStudioAuth(options?: { providers?: ConvexAuthProviders })
   return convexAuth({
     providers: options?.providers ?? [Password],
     callbacks: {
-      /**
-       * Invite-based onboarding gate + first-principal bootstrap (EC-324 / EC-150).
-       * Fires on EVERY sign-in (not just account creation), right before the session
-       * is persisted — throwing here rejects the sign-in. The ONE decision lives in
-       * the pure `classifyInviteSignup` (shared with its tests):
-       *
-       * - **existing member** → normal re-sign-in; no-op (also recovers a member-less
-       *   account it created earlier and never lets the deployment lock itself out).
-       * - **first user** (no members yet) → bootstrap as `admin` (was the only case).
-       * - **invited** → grant the invited role + CONSUME the invite (delete the row).
-       * - **uninvited** → REJECT. This closes the open-sign-up hole (EC-304): an
-       *   anonymous person can no longer self-register into the deployment. The
-       *   `ConvexError` message ("not-invited: …") survives to the client even in
-       *   production, so the sign-in screen tells the truth.
-       *
-       * Single-tenant: one `members` table per deployment. Invite mechanism: a plain
-       * email allowlist (`invites` table) — the simplest server-enforced design, no
-       * token infrastructure.
-       */
+      /** EC-358: reject uninvited account creation BEFORE any row commits. */
+      async afterUserCreatedOrUpdated(ctx, { userId, profile }) {
+        await gateAccountCreation(ctx, { userId, profile })
+      },
+      /** EC-324: the every-sign-in gate — bootstrap / grant / consume / reject. */
       async beforeSessionCreation(ctx, { userId }) {
-        const now = new Date().toISOString()
-        // The convexAuth callback ctx is `AnyDataModel` (not schema-bound), so use
-        // `.filter()` rather than `.withIndex()` here. The members/invites tables are
-        // tiny (single-tenant), and this runs only at sign-in.
-        const existingMember = await ctx.db
-          .query('members')
-          .filter((q) => q.eq(q.field('userId'), userId))
-          .first()
-        const anyMember = existingMember ?? (await ctx.db.query('members').first())
-        const user = await ctx.db.get(userId)
-        const rawEmail = (user as { email?: string } | null)?.email
-        const email = rawEmail ? normalizeInviteEmail(rawEmail) : null
-        const invite = email
-          ? await ctx.db
-              .query('invites')
-              .filter((q) => q.eq(q.field('email'), email))
-              .first()
-          : null
-
-        const decision = classifyInviteSignup({
-          hasAnyMember: anyMember !== null,
-          existingRole: existingMember?.role ?? null,
-          invite: invite ? { role: invite.role } : null,
-        })
-
-        switch (decision.kind) {
-          case 'existing-member':
-            return
-          case 'bootstrap-admin':
-            await ctx.db.insert('members', { userId, role: 'admin', createdAt: now, updatedAt: now })
-            return
-          case 'grant-role':
-            await ctx.db.insert('members', {
-              userId,
-              role: decision.role,
-              createdAt: now,
-              updatedAt: now,
-            })
-            if (invite) await ctx.db.delete(invite._id)
-            return
-          case 'reject':
-            throw new ConvexError(decision.reason)
-        }
+        await gateSessionCreation(ctx, { userId })
       },
     },
   })

package/convex/invites.ts

@@ -1,5 +1,7 @@
 import { v } from 'convex/values'
+import { selectOrphanCredentialPurges } from '@elytracms/core/persistence'
 import { mutation, query } from './functions'
+import type { MutationCtx } from './functions'
 import { requireCapability } from './guard'
 
 /**
@@ -17,6 +19,78 @@ import { requireCapability } from './guard'
 
 const normalizeEmail = (email: string): string => email.trim().toLowerCase()
 
+/**
+ * EC-358 — an invite must never adopt pre-existing orphan credentials.
+ *
+ * Threat: an attacker pre-registers a password for someone's email; before
+ * EC-358's account-creation gate that left an orphan (member-less)
+ * `users` + `authAccounts` pair, and a later invite for that email would have
+ * silently promoted the ATTACKER's credentials at their next sign-in. Creating
+ * an invite is therefore the purge chokepoint: purging at gate-promotion time
+ * would be too late by construction — the promotion is *triggered by* whoever
+ * holds the password. Purged here, the invited person always sets their own.
+ *
+ * WHAT is purged, per member-less user matching the invited email (selection is
+ * the pure `selectOrphanCredentialPurges`, normalized-email matched): their
+ * `authSessions` (+ `authRefreshTokens`), `authAccounts`
+ * (+ `authVerificationCodes`), and the `users` row itself — so no stale session
+ * or reset code survives the credential purge. A user with a `members` row is
+ * NEVER touched, whatever their email. Runs in the invite-creation mutation, so
+ * purge + invite land in one atomic transaction.
+ *
+ * The `users` table is tiny (single-tenant studio principals), so the
+ * collect-and-match scan is fine — and required, because the auth provider
+ * stores emails as typed at sign-up (an index lookup on the normalized email
+ * would miss case-varied orphans the sign-in gate would still promote).
+ */
+export async function purgeOrphanCredentials(
+  ctx: Pick<MutationCtx, 'db'>,
+  invitedEmail: string,
+): Promise<number> {
+  const members = await ctx.db.query('members').collect()
+  const memberIds = new Set(members.map((member) => member.userId))
+  const users = await ctx.db.query('users').collect()
+  const purgeIds = new Set(
+    selectOrphanCredentialPurges(
+      invitedEmail,
+      users.map((user) => ({
+        id: String(user._id),
+        email: user.email ?? null,
+        isMember: memberIds.has(String(user._id)),
+      })),
+    ),
+  )
+  const orphans = users.filter((user) => purgeIds.has(String(user._id)))
+  for (const orphan of orphans) {
+    const sessions = await ctx.db
+      .query('authSessions')
+      .withIndex('userId', (q) => q.eq('userId', orphan._id))
+      .collect()
+    for (const session of sessions) {
+      const tokens = await ctx.db
+        .query('authRefreshTokens')
+        .withIndex('sessionId', (q) => q.eq('sessionId', session._id))
+        .collect()
+      for (const token of tokens) await ctx.db.delete(token._id)
+      await ctx.db.delete(session._id)
+    }
+    const accounts = await ctx.db
+      .query('authAccounts')
+      .withIndex('userIdAndProvider', (q) => q.eq('userId', orphan._id))
+      .collect()
+    for (const account of accounts) {
+      const codes = await ctx.db
+        .query('authVerificationCodes')
+        .withIndex('accountId', (q) => q.eq('accountId', account._id))
+        .collect()
+      for (const code of codes) await ctx.db.delete(code._id)
+      await ctx.db.delete(account._id)
+    }
+    await ctx.db.delete(orphan._id)
+  }
+  return orphans.length
+}
+
 export const list = query({
   args: {},
   handler: async (ctx) => {
@@ -37,6 +111,9 @@ export const create = mutation({
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'project.administer')
     const email = normalizeEmail(args.email)
+    // EC-358: never adopt orphan credentials — purge member-less auth rows for
+    // this email atomically with the invite, so the invitee sets their own password.
+    await purgeOrphanCredentials(ctx, email)
     const existing = await ctx.db
       .query('invites')
       .withIndex('by_email', (q) => q.eq('email', email))

package/dist/components/account/account-settings.js

@@ -3,10 +3,10 @@ import { UserCog } from 'lucide-react';
 import { Heading, Stack, Text } from '@elytracms/studio/ui';
 import { listStoreState, useOperationQuery } from '@elytracms/studio/lib/query';
 import { translate } from '@elytracms/studio/lib/i18n';
-import { useAuth } from '../auth-context';
-import { PortableDetailEditor } from '../cms/detail-editor';
-import { CredentialPanel } from './credential-panel';
-import { useSelfAccountViewSource } from './self-account-view-source';
+import { useAuth } from '../auth-context.js';
+import { PortableDetailEditor } from '../cms/detail-editor.js';
+import { CredentialPanel } from './credential-panel.js';
+import { useSelfAccountViewSource } from './self-account-view-source.js';
 /**
  * The **account-settings** surface (EC-240 H-tail items 1–4). A member — admin or
  * not — opens their OWN record here (via the user menu → `users/<selfId>`). It is

package/dist/components/account/credential-panel.js

@@ -3,7 +3,7 @@ import { useState } from 'react';
 import { KeyRound, ShieldCheck } from 'lucide-react';
 import { Button, Card, CardContent, Field, Heading, Input, Row, Stack, Text, toast, } from '@elytracms/studio/ui';
 import { translate } from '@elytracms/studio/lib/i18n';
-import { useAuth } from '../auth-context';
+import { useAuth } from '../auth-context.js';
 /**
  * The credential seam (EC-240 H-tail item 3) — part of the account **property
  * surface**, never a modal. Two blocks:

package/dist/components/account/self-account-view-source.js

@@ -1,8 +1,8 @@
 import { useCallback } from 'react';
 import { studioPath } from '@elytracms/studio/router';
-import { useAuth } from '../auth-context';
-import { selfAccountCollectionDef } from './self-account-schema';
-import { normalizeOkResult, useRailViewSource } from '../rail-view-source';
+import { useAuth } from '../auth-context.js';
+import { selfAccountCollectionDef } from './self-account-schema.js';
+import { normalizeOkResult, useRailViewSource } from '../rail-view-source.js';
 /** The account surface is not localized — one implicit locale keeps the lens honest. */
 const ACCOUNT_LOCALE = 'en';
 const ACCOUNT_LOCALE_CONFIG = { default: ACCOUNT_LOCALE, locales: [ACCOUNT_LOCALE] };

package/dist/components/ai/ai-chat-panel-lazy.js

@@ -11,7 +11,7 @@ import { translate } from '@elytracms/studio/lib/i18n';
  * critical path (pinned by the `lib/ai` bundle test). Same pattern as
  * `version-compare-lazy` / `rich-text/lazy`.
  */
-const AiChatPanelImpl = lazy(() => import('./ai-chat-panel').then((module) => ({ default: module.AiChatPanel })));
+const AiChatPanelImpl = lazy(() => import('./ai-chat-panel.js').then((module) => ({ default: module.AiChatPanel })));
 function AiPanelFallback() {
     return (_jsx("aside", { className: "flex h-full min-h-0 w-[360px] shrink-0 flex-col border-l border-border bg-card", children: _jsx("div", { className: "grid min-h-0 flex-1 place-items-center p-6", children: _jsx(Text, { size: "sm", tone: "muted", children: translate('ai.panel.loading') }) }) }));
 }

package/dist/components/ai/ai-chat-panel.js

@@ -8,10 +8,10 @@ import { STUDIO_PROJECT_ROUTE, studioPath, useNavigate } from '@elytracms/studio
 import { resolveDeploymentAi } from '@elytracms/studio/lib/workspace';
 import { getStudioOperations } from '@elytracms/studio/lib/operations';
 import { AiRouteError, chatReducer, initialChatState, resolveAiConfig, resolveKnowledge, runCreateFlow, } from '@elytracms/studio/lib/ai';
-import { useCms } from '../cms/cms-store';
-import { validateComposition, validateRichTextEmbeds } from '../cms/cms-composition-validators';
-import { AssistantTurn, Conversation, ConversationEmpty, PromptInput, ToolStatus, UserTurn, } from './chat-ui';
-import { ProposalCard } from './proposal-card';
+import { useCms } from '../cms/cms-store.js';
+import { validateComposition, validateRichTextEmbeds } from '../cms/cms-composition-validators.js';
+import { AssistantTurn, Conversation, ConversationEmpty, PromptInput, ToolStatus, UserTurn, } from './chat-ui.js';
+import { ProposalCard } from './proposal-card.js';
 import { setAiPanelOpen } from '@elytracms/studio/lib/ai-panel';
 /**
  * The AI assistant chat panel (EC-199) — the right-hand collapsible surface in the CMS

package/dist/components/ai/ai-cms-panel.js

@@ -2,7 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useMemo } from 'react';
 import { resolveDeploymentAi } from '@elytracms/studio/lib/workspace';
 import { useAiPanelOpen } from '@elytracms/studio/lib/ai-panel';
-import { AiChatPanel } from './ai-chat-panel-lazy';
+import { AiChatPanel } from './ai-chat-panel-lazy.js';
 /**
  * The CMS-area mount of the AI assistant (EC-199): a right-hand sibling of the CMS
  * content, shown on BOTH the collection list and the document editor. Gated twice —

package/dist/components/ai/proposal-card.js

@@ -6,10 +6,10 @@ import { resolveLabel } from '@elytracms/core/cms-core';
 import { Badge, Button, Row, Spacer, Stack, Text } from '@elytracms/studio/ui';
 import { translate } from '@elytracms/studio/lib/i18n';
 import { proposalDocuments } from '@elytracms/studio/lib/ai';
-import { useCms } from '../cms/cms-store';
-import { useCmsCollectionViewSource } from '../collection-view/cms-collection-view-source';
-import { CollectionViewProvider } from '../collection-view/collection-view-context';
-import { DocumentDiffView } from '../cms/document-diff-view';
+import { useCms } from '../cms/cms-store.js';
+import { useCmsCollectionViewSource } from '../collection-view/cms-collection-view-source.js';
+import { CollectionViewProvider } from '../collection-view/collection-view-context.js';
+import { DocumentDiffView } from '../cms/document-diff-view.js';
 /**
  * The AI proposal review (EC-199): a valid, leash-compliant draft the editor reviews
  * as a DIFF (the shared EC-317 {@link DocumentDiffView} — never a second renderer)

package/dist/components/ai/translate-document-action.js

@@ -16,7 +16,7 @@ import { resolveDeploymentAi } from '@elytracms/studio/lib/workspace';
  * the translation engine + operations write) loads ONLY when the editor opens it, via a
  * dynamic `import()`, so an unconfigured studio pulls none of it onto the critical path.
  */
-const TranslateDocumentDialog = lazy(() => import('./translate-document-dialog').then((m) => ({ default: m.TranslateDocumentDialog })));
+const TranslateDocumentDialog = lazy(() => import('./translate-document-dialog.js').then((m) => ({ default: m.TranslateDocumentDialog })));
 export function TranslateDocumentAction(props) {
     const [open, setOpen] = useState(false);
     const { collection, localeConfig, localesEnabled, projectId } = props;

package/dist/components/ai/translate-document-dialog.d.ts

@@ -1,4 +1,4 @@
-import type { TranslateDocumentActionProps } from './translate-document-action';
+import type { TranslateDocumentActionProps } from './translate-document-action.js';
 export declare function TranslateDocumentDialog({ projectId, collection, docRef, document, localeConfig, onApplied, open, onOpenChange, }: TranslateDocumentActionProps & {
     open: boolean;
     onOpenChange: (open: boolean) => void;

package/dist/components/app-views/default-modules.d.ts

@@ -4,7 +4,7 @@ import type { CollectionDef, CollectionFieldOverride, CollectionFormMeta } from
 import type { SectionId } from '@elytracms/core/studio-core';
 import type { InstantiatedKit } from '@elytracms/core/starter-kits';
 import type { HydratedCms } from '@elytracms/studio/lib/operations';
-import { type AppViewContext, type AppViewDeepLink, type AppViewModule, type NavPermission, type SidebarViewNode } from './module';
+import { type AppViewContext, type AppViewDeepLink, type AppViewModule, type NavPermission, type SidebarViewNode } from './module.js';
 /**
  * EC-237/239 — the studio's BUILT-IN views + the consumer-facing `nav` namespace,
  * an instance of the EC-236 customization seam.
@@ -188,9 +188,9 @@ export declare const nav: {
     /** A fully custom view — pass your own `render` (and optional `parsePath`). */
     readonly view: (config: CustomViewConfig) => SidebarViewNode;
     /** A labelled group of views (a header with sub-entries). */
-    readonly group: (label: string, children: SidebarViewNode[]) => import("./module").SidebarGroupNode;
+    readonly group: (label: string, children: SidebarViewNode[]) => import("./module.js").SidebarGroupNode;
     /** A divider between rail sections. */
-    readonly separator: () => import("./module").SidebarSeparatorNode;
+    readonly separator: () => import("./module.js").SidebarSeparatorNode;
 };
 /**
  * The CMS schema source for a project mount (bug fix, playground-collections):

package/dist/components/app-views/default-modules.js

@@ -8,26 +8,26 @@ import { localizedLabel, translate } from '@elytracms/studio/lib/i18n';
 import { getInstantiatedKit } from '@elytracms/studio/lib/starters/kit-session';
 import { isPlaygroundMode } from '@elytracms/studio/lib/persistence';
 import { resolveDeploymentCollections } from '@elytracms/studio/lib/workspace';
-import { cmsDeepLink, componentsDeepLink, usersDeepLink, redirectsDeepLink, assetsDeepLink, groupNode, separatorNode, viewNode, } from './module';
-import { SectionSurface } from '../section-surface';
-import { SectionStateView } from '../section-state';
-import { SettingsForm } from '../settings-form';
-import { AssetsModule } from '../assets/assets-module';
-import { UsersModule } from '../users/users-module';
-import { RedirectsModule } from '../redirects/redirects-module';
-import { redirectsCollectionDef } from '../redirects/redirects-schema';
-import { ExtensionsView } from '../extensions/extensions-view';
-import { RegistryBrowser } from '../components/registry-browser';
-import { ComponentsIndex } from '../components/components-index';
-import { ComponentDetail } from '../components/component-detail';
-import { CmsSessionGate } from '../project-session';
-import { CmsProvider, useCms } from '../cms/cms-store';
-import { AiCmsPanel } from '../ai/ai-cms-panel';
-import { focusCollectionList } from '../cms/collection-focus';
-import { CmsIndex } from '../cms/cms-index';
-import { CollectionTable } from '../cms/collection-table';
-import { DetailEditor } from '../cms/detail-editor';
-import { OperationErrorBanner } from '../operation-error';
+import { cmsDeepLink, componentsDeepLink, usersDeepLink, redirectsDeepLink, assetsDeepLink, groupNode, separatorNode, viewNode, } from './module.js';
+import { SectionSurface } from '../section-surface.js';
+import { SectionStateView } from '../section-state.js';
+import { SettingsForm } from '../settings-form.js';
+import { AssetsModule } from '../assets/assets-module.js';
+import { UsersModule } from '../users/users-module.js';
+import { RedirectsModule } from '../redirects/redirects-module.js';
+import { redirectsCollectionDef } from '../redirects/redirects-schema.js';
+import { ExtensionsView } from '../extensions/extensions-view.js';
+import { RegistryBrowser } from '../components/registry-browser.js';
+import { ComponentsIndex } from '../components/components-index.js';
+import { ComponentDetail } from '../components/component-detail.js';
+import { CmsSessionGate } from '../project-session.js';
+import { CmsProvider, useCms } from '../cms/cms-store.js';
+import { AiCmsPanel } from '../ai/ai-cms-panel.js';
+import { focusCollectionList } from '../cms/collection-focus.js';
+import { CmsIndex } from '../cms/cms-index.js';
+import { CollectionTable } from '../cms/collection-table.js';
+import { DetailEditor } from '../cms/detail-editor.js';
+import { OperationErrorBanner } from '../operation-error.js';
 function slugify(label) {
     return label.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'view';
 }

package/dist/components/app-views/sidebar.d.ts

@@ -1,7 +1,7 @@
 import type { LucideIcon } from 'lucide-react';
 import type { CustomizationIssue, Project, SectionAvailability } from '@elytracms/core/studio-core';
 import type { CollectionDef } from '@elytracms/core/cms-core';
-import { type AppViewModule, type NavPermission, type NavPermissionContext, type SidebarNode } from './module';
+import { type AppViewModule, type NavPermission, type NavPermissionContext, type SidebarNode } from './module.js';
 /**
  * EC-237 — resolving the configurable section rail, an instance of the EC-236
  * customization seam.

package/dist/components/app-views/sidebar.js

@@ -1,8 +1,8 @@
 import { useMemo } from 'react';
 import { resolveOverrides } from '@elytracms/core/studio-core';
 import { resolveDeploymentCollections, resolveDeploymentSidebar } from '@elytracms/studio/lib/workspace';
-import { firstAvailableView, moduleAvailability, viewNode, } from './module';
-import { DEFAULT_VIEWS } from './default-modules';
+import { firstAvailableView, moduleAvailability, viewNode, } from './module.js';
+import { DEFAULT_VIEWS } from './default-modules.js';
 /** The default rail: every non-hidden built-in view as a plain entry, in canonical order. */
 function defaultRail() {
     return DEFAULT_VIEWS.filter((view) => !view.hidden).map(viewNode);

package/dist/components/app-views/studio-config.d.ts

@@ -2,7 +2,7 @@ import type { ReactNode } from 'react';
 import type { FieldDef } from '@elytracms/core/cms-core';
 import type { StudioI18nConfig } from '@elytracms/studio/lib/i18n';
 import type { StudioAiConfig } from '@elytracms/studio/lib/ai';
-import type { SidebarNode } from './module';
+import type { SidebarNode } from './module.js';
 /**
  * EC-236 — the studio customization config: the single, studio-only home for
  * everything a consuming repo customizes about the builder UI.

package/dist/components/assets/asset-detail.js

@@ -5,15 +5,15 @@ import { Link, STUDIO_PROJECT_ROUTE, useNavigate } from '@elytracms/studio/route
 import { localizedLabel, translate } from '@elytracms/studio/lib/i18n';
 import { buildAssetReferenceImpact, loadInboundAssetReferenceViews } from '@elytracms/studio/lib/references';
 import { Button, Dialog, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle, Field, Heading, Panel, PanelBody, PanelHeader, Row, Spacer, Stack, Text, } from '@elytracms/studio/ui';
-import { FieldControl } from '../cms/field-control';
-import { fieldLabel } from '../cms/cms-labels';
-import { ReferenceImpactRows } from '../cms/reference-confirm';
-import { ReferencesPanel } from '../references/references-panel';
-import { useSetBreadcrumb } from '../breadcrumb-context';
-import { useCollectionView } from '../collection-view/collection-view-context';
-import { FocalCropPreviews, FocalPointPicker, useAssetRecord } from './asset-thumb';
-import { assetMetaFieldsOf, formatBytes, pruneMeta } from './asset-metadata';
-import { useAssets } from './assets-store';
+import { FieldControl } from '../cms/field-control.js';
+import { fieldLabel } from '../cms/cms-labels.js';
+import { ReferenceImpactRows } from '../cms/reference-confirm.js';
+import { ReferencesPanel } from '../references/references-panel.js';
+import { useSetBreadcrumb } from '../breadcrumb-context.js';
+import { useCollectionView } from '../collection-view/collection-view-context.js';
+import { FocalCropPreviews, FocalPointPicker, useAssetRecord } from './asset-thumb.js';
+import { assetMetaFieldsOf, formatBytes, pruneMeta } from './asset-metadata.js';
+import { useAssets } from './assets-store.js';
 /**
  * The assets rail's DETAIL surface (EC-319). Pragmatic call: assets don't fit
  * the portable `PortableDetailEditor` shell cleanly — there's no dirty/Save/

package/dist/components/assets/asset-grid.js

@@ -5,13 +5,13 @@ import { Link, STUDIO_PROJECT_ROUTE } from '@elytracms/studio/router';
 import { applyViewState } from '@elytracms/studio/lib/cms-views';
 import { localizedLabel, translate } from '@elytracms/studio/lib/i18n';
 import { Code, Grid, Panel, Row, Separator, Spacer, Stack, Text } from '@elytracms/studio/ui';
-import { FilterControl } from '../cms/filter-builder';
-import { ViewTabs } from '../cms/view-bar';
-import { useSetBreadcrumb } from '../breadcrumb-context';
-import { useCollectionView } from '../collection-view/collection-view-context';
-import { AssetThumb } from './asset-thumb';
-import { formatBytes } from './asset-metadata';
-import { useAssets } from './assets-store';
+import { FilterControl } from '../cms/filter-builder.js';
+import { ViewTabs } from '../cms/view-bar.js';
+import { useSetBreadcrumb } from '../breadcrumb-context.js';
+import { useCollectionView } from '../collection-view/collection-view-context.js';
+import { AssetThumb } from './asset-thumb.js';
+import { formatBytes } from './asset-metadata.js';
+import { useAssets } from './assets-store.js';
 /**
  * The assets rail's GRID surface (EC-319) — the thumbnail-first counterpart to
  * `LoadedCollectionTable`, over the SAME portable `CollectionViewSource` (the

package/dist/components/assets/asset-thumb.d.ts

@@ -1,5 +1,5 @@
 import type { AssetRecord } from '@elytracms/core/persistence';
-import type { FocalPoint } from './focal-point';
+import type { FocalPoint } from './focal-point.js';
 /** Resolve an asset record by id from the ambient library, if one is mounted. */
 export declare function useAssetRecord(assetId: string | null | undefined): AssetRecord | undefined;
 /**

package/dist/components/assets/asset-thumb.js

@@ -4,8 +4,8 @@ import { Image } from 'lucide-react';
 import { Text } from '@elytracms/studio/ui';
 import { translate } from '@elytracms/studio/lib/i18n';
 import { cn } from '@elytracms/studio/lib/utils';
-import { useOptionalAssets } from './assets-store';
-import { CENTER_FOCAL_POINT, focalPointFromPoint, focalPointObjectPosition, } from './focal-point';
+import { useOptionalAssets } from './assets-store.js';
+import { CENTER_FOCAL_POINT, focalPointFromPoint, focalPointObjectPosition, } from './focal-point.js';
 /** Resolve an asset record by id from the ambient library, if one is mounted. */
 export function useAssetRecord(assetId) {
     const store = useOptionalAssets();

package/dist/components/assets/assets-collection-view-source.js

@@ -1,9 +1,9 @@
 import { useCallback, useMemo } from 'react';
 import { createCollectionRegistry, validateDocument } from '@elytracms/core/cms-core';
 import { studioPath } from '@elytracms/studio/router';
-import { useAssets } from './assets-store';
-import { SYSTEM_ASSET_FIELDS } from './asset-metadata';
-import { normalizeOkResult, useRailViewSource } from '../rail-view-source';
+import { useAssets } from './assets-store.js';
+import { SYSTEM_ASSET_FIELDS } from './asset-metadata.js';
+import { normalizeOkResult, useRailViewSource } from '../rail-view-source.js';
 /** The assets rail is not localized in v1 (EC-301: asset metadata is non-localized). */
 const ASSETS_LOCALE = 'en';
 const ASSETS_LOCALE_CONFIG = {

package/dist/components/assets/assets-module.js

@@ -3,14 +3,14 @@ import { useRef, useState } from 'react';
 import { LayoutGrid, List, RotateCcw, Upload, X } from 'lucide-react';
 import { Badge, Button, Panel, PanelBody, PanelHeader, Row, SegmentedControl, Stack, Text, } from '@elytracms/studio/ui';
 import { translate } from '@elytracms/studio/lib/i18n';
-import { useAssets } from './assets-store';
-import { useAssetsCollectionViewSource } from './assets-collection-view-source';
-import { CollectionViewProvider } from '../collection-view/collection-view-context';
-import { RailStoreStatus } from '../rail-store-status';
-import { LoadedCollectionTable } from '../cms/collection-table';
-import { AssetGridView } from './asset-grid';
-import { AssetDetail } from './asset-detail';
-import { readAssetsViewMode, storeAssetsViewMode, } from './assets-view-preference';
+import { useAssets } from './assets-store.js';
+import { useAssetsCollectionViewSource } from './assets-collection-view-source.js';
+import { CollectionViewProvider } from '../collection-view/collection-view-context.js';
+import { RailStoreStatus } from '../rail-store-status.js';
+import { LoadedCollectionTable } from '../cms/collection-table.js';
+import { AssetGridView } from './asset-grid.js';
+import { AssetDetail } from './asset-detail.js';
+import { readAssetsViewMode, storeAssetsViewMode, } from './assets-view-preference.js';
 /**
  * The studio Assets module (EC-319). The reuse proof (alongside users/redirects)
  * that the portable list surface serves a rail with an entirely different