@elytracms/studio 0.0.52 → 0.0.54

package/dist/lib/ai/node-handler.js

@@ -0,0 +1,48 @@
+const encoder = new TextEncoder();
+function concatBytes(chunks) {
+    let total = 0;
+    for (const chunk of chunks)
+        total += chunk.byteLength;
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+}
+/** Reconstruct a Web `Request` from a Node request (headers, method, buffered body). */
+async function toWebRequest(req) {
+    const chunks = [];
+    for await (const chunk of req) {
+        chunks.push(typeof chunk === 'string' ? encoder.encode(chunk) : chunk);
+    }
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+        if (typeof value === 'string')
+            headers.set(key, value);
+        else if (Array.isArray(value))
+            headers.set(key, value.join(', '));
+    }
+    const forwardedProto = req.headers['x-forwarded-proto'];
+    const proto = (typeof forwardedProto === 'string' && forwardedProto.split(',')[0]?.trim()) || 'http';
+    return new Request(`${proto}://${req.headers.host ?? 'localhost'}${req.url ?? '/'}`, {
+        method: req.method,
+        headers,
+        body: req.method === 'GET' || req.method === 'HEAD' ? undefined : concatBytes(chunks),
+    });
+}
+/**
+ * Wrap an {@link AiRouteHandler} as a Node `(req, res)` handler: buffer the body,
+ * bridge headers both directions, copy status + payload back.
+ */
+export function toNodeHandler(handler) {
+    return async (req, res) => {
+        const request = await toWebRequest(req);
+        const response = await handler(request);
+        res.statusCode = response.status;
+        response.headers.forEach((value, key) => res.setHeader(key, value));
+        res.end(new Uint8Array(await response.arrayBuffer()));
+    };
+}
+//# sourceMappingURL=node-handler.js.map

package/dist/lib/ai/node-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-handler.js","sourceRoot":"","sources":["../../../src/lib/ai/node-handler.ts"],"names":[],"mappings":"AA0BA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,WAAW,CAAC,MAAoB;IACvC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;aACjD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACvD,MAAM,KAAK,GACT,CAAC,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,MAAM,CAAA;IACxF,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE;QACnF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;KACtF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACxE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;QACvC,GAAG,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAA;QAChC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACvD,CAAC,CAAA;AACH,CAAC","sourcesContent":["/**\n * `toNodeHandler` — bridge the framework-agnostic Web `Request → Response`\n * {@link AiRouteHandler} to Node's `(req, res)` signature (EC-371; closes EC-369\n * finding #2, where the identical ~25-line bridge was hand-copied four times across\n * consumers). This is the PROD half of the mounting kit: a Vercel Node function (or\n * any Node server) mounts the route as\n *\n * ```ts\n * // api/ai.ts (Vercel filesystem routing beats the SPA catch-all rewrite)\n * import { toNodeHandler } from '@elytracms/studio/lib/ai'\n * import { aiRouteHandler } from '../src/server/ai-handler.js'\n * export default toNodeHandler(aiRouteHandler)\n * ```\n *\n * The DEV half (`createAiDevPlugin`, Vite middleware + `ssrLoadModule`) reuses this\n * same bridge — one implementation, both mounts. No platform dependency: the classic\n * `(IncomingMessage, ServerResponse)` signature works on every @vercel/node version\n * and on plain `node:http`. Note it buffers the response body (including the chat\n * stream) — the proven Konditorei behavior; native streaming is EC-334's scope.\n */\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { AiRouteHandler } from './types'\n\n/** A Node-mountable request handler (Vercel Node function / `node:http` compatible). */\nexport type NodeAiRouteHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>\n\nconst encoder = new TextEncoder()\n\nfunction concatBytes(chunks: Uint8Array[]): Uint8Array<ArrayBuffer> {\n  let total = 0\n  for (const chunk of chunks) total += chunk.byteLength\n  const out = new Uint8Array(total)\n  let offset = 0\n  for (const chunk of chunks) {\n    out.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return out\n}\n\n/** Reconstruct a Web `Request` from a Node request (headers, method, buffered body). */\nasync function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) {\n    chunks.push(typeof chunk === 'string' ? encoder.encode(chunk) : (chunk as Uint8Array))\n  }\n  const headers = new Headers()\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (typeof value === 'string') headers.set(key, value)\n    else if (Array.isArray(value)) headers.set(key, value.join(', '))\n  }\n  const forwardedProto = req.headers['x-forwarded-proto']\n  const proto =\n    (typeof forwardedProto === 'string' && forwardedProto.split(',')[0]?.trim()) || 'http'\n  return new Request(`${proto}://${req.headers.host ?? 'localhost'}${req.url ?? '/'}`, {\n    method: req.method,\n    headers,\n    body: req.method === 'GET' || req.method === 'HEAD' ? undefined : concatBytes(chunks),\n  })\n}\n\n/**\n * Wrap an {@link AiRouteHandler} as a Node `(req, res)` handler: buffer the body,\n * bridge headers both directions, copy status + payload back.\n */\nexport function toNodeHandler(handler: AiRouteHandler): NodeAiRouteHandler {\n  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const request = await toWebRequest(req)\n    const response = await handler(request)\n    res.statusCode = response.status\n    response.headers.forEach((value, key) => res.setHeader(key, value))\n    res.end(new Uint8Array(await response.arrayBuffer()))\n  }\n}\n"]}

package/dist/lib/ai/provenance.d.ts

@@ -10,7 +10,7 @@
  * this marker to its result; wiring it into `documents.upsert` /
  * `DocumentVersionRecord` (and any UI) is deferred to EC-199. No behaviour here.
  */
-import type { AiProvenance, AiProvider } from './types';
+import type { AiProvenance, AiProvider } from './types.js';
 /** The origin discriminator for assistant-authored writes. */
 export declare const AI_ORIGIN: "assistant";
 /**

package/dist/lib/ai/route-provider.d.ts

@@ -16,7 +16,7 @@
  * SDK. The capability gate passes: the route only ever fronts a gate-checked provider
  * (validated at the server mount), so the proxy declares both required capabilities.
  */
-import type { AiProvider } from './types';
+import type { AiProvider } from './types.js';
 /** How extra request headers are supplied — a static set or a (possibly async) thunk. */
 export type RouteHeaders = HeadersInit | (() => HeadersInit | undefined | Promise<HeadersInit | undefined>);
 export interface RouteProviderOptions {

package/dist/lib/ai/route.d.ts

@@ -24,7 +24,7 @@
  * execute in the client with the user's own session. A body with `messages` and no
  * `kind` is still treated as a chat request (back-compat with the phase-1 contract).
  */
-import type { AiRouteHandler, AiRouteHandlerOptions } from './types';
+import type { AiRouteHandler, AiRouteHandlerOptions } from './types.js';
 /** The wire discriminator selecting which model operation the route proxies. */
 export type AiRouteKind = 'chat' | 'generate';
 /**

package/dist/lib/ai/shape.d.ts

@@ -1,5 +1,5 @@
 import type { CollectionDef, JsonSchema } from '@elytracms/core/cms-core';
-import type { RelationCandidates } from './types';
+import type { RelationCandidates } from './types.js';
 /** A relation field's resolved candidate set — how the engine maps ids → reference envelopes. */
 export interface TargetRelationField {
     fieldName: string;

package/dist/lib/ai/translate-document.d.ts

@@ -1,5 +1,5 @@
 import type { CmsDocument, CollectionDef, Locale, LocaleConfig } from '@elytracms/core/cms-core';
-import type { AiProvenance, AiProvider, ResolvedKnowledge } from './types';
+import type { AiProvenance, AiProvider, ResolvedKnowledge } from './types.js';
 /** Default translatable units per `generate` call. */
 export declare const DEFAULT_TRANSLATE_BATCH_SIZE = 12;
 /** Default number of `generate` calls in flight at once (mirrors the precedent's limiter of 6). */

package/dist/lib/ai/translate-document.js

@@ -29,9 +29,9 @@
  */
 import { autoDeriveSlug, documentDefaultLocale, isFieldLocalized } from '@elytracms/core/cms-core';
 import { activeLocaleValues, fieldConnection, hasLocaleVariant, setFieldValue, } from '@elytracms/studio/lib/locale';
-import { assembleKnowledgeBlock } from './knowledge';
-import { aiProvenance } from './provenance';
-import { extractRichTextUnits, rebuildRichText } from './rich-text-translate';
+import { assembleKnowledgeBlock } from './knowledge.js';
+import { aiProvenance } from './provenance.js';
+import { extractRichTextUnits, rebuildRichText } from './rich-text-translate.js';
 /** Default translatable units per `generate` call. */
 export const DEFAULT_TRANSLATE_BATCH_SIZE = 12;
 /** Default number of `generate` calls in flight at once (mirrors the precedent's limiter of 6). */

package/dist/lib/ai/vite.d.ts

@@ -0,0 +1,32 @@
+import type { Plugin } from 'vite';
+/** Env keys the plugin surfaces from `.env*` files into `process.env` for the handler. */
+export declare const DEFAULT_AI_DEV_ENV_KEYS: readonly ["ANTHROPIC_API_KEY", "VITE_CONVEX_SITE_URL", "VITE_CONVEX_URL"];
+export interface AiDevPluginOptions {
+    /** The handler module (Vite root-relative), default `/src/server/ai-handler.ts`. */
+    handlerModulePath?: string;
+    /** The mounted route path (default {@link DEFAULT_AI_ENDPOINT}, `/api/ai`). */
+    route?: string;
+    /** The handler module's export name (default `aiRouteHandler`). */
+    exportName?: string;
+    /** Extra env keys to surface into `process.env` (merged over the defaults). */
+    envKeys?: readonly string[];
+    /**
+     * INSECURE, dev-only: let requests presenting NO credential pass the session gate.
+     * A playground studio has no Convex session, so without this the assistant panel
+     * answers 401 there. `'playground-mode'` scopes the bypass to dev servers booted
+     * with `VITE_ELYTRA_MODE=playground` (the recommended setting); `true` applies it
+     * to every dev boot. Defaults OFF. It cannot reach production: the plugin is
+     * `apply: 'serve'`, the handshake env var is set only in `configureServer`, and
+     * the resolver additionally refuses it under `NODE_ENV=production`. A PRESENTED
+     * token must still verify for real — the bypass never masks a bad credential.
+     */
+    insecureAllowAnonymousSessions?: boolean | 'playground-mode';
+}
+/** Resolve the anonymous-bypass opt-in against the loaded env (pure; unit-pinned). */
+export declare function resolveInsecureAnonymousOptIn(optIn: boolean | 'playground-mode' | undefined, env: Record<string, string | undefined>): boolean;
+/**
+ * Mount the AI route in the Vite dev server. Dev-only by construction
+ * (`apply: 'serve'`); a production deploy mounts the same handler module via
+ * `toNodeHandler` in its serverless entry instead.
+ */
+export declare function createAiDevPlugin(options?: AiDevPluginOptions): Plugin;

package/dist/lib/ai/vite.js

@@ -0,0 +1,97 @@
+/**
+ * `@elytracms/studio/lib/ai/vite` — `createAiDevPlugin`, the DEV half of the AI
+ * route mounting kit (EC-371; closes EC-369 finding #2). A studio app is a client
+ * SPA with no server build, so in dev the host route lives as a Vite dev-server
+ * middleware: this plugin loads the framework-agnostic `Request → Response` handler
+ * module through Vite's SSR pipeline (so its `@elytracms/*` imports resolve like the
+ * rest of the app) and bridges Node req/res via the shared {@link toNodeHandler}.
+ *
+ * It also owns the env bridge the resolver needs (the piece the template had
+ * drifted on): `loadEnv` surfaces `ANTHROPIC_API_KEY` / `VITE_CONVEX_SITE_URL` /
+ * `VITE_CONVEX_URL` from `.env`/`.env.local` into `process.env` for the SSR-loaded
+ * handler — Vite only exposes `VITE_`-prefixed vars via `import.meta.env`, and a
+ * `VITE_` prefix on the provider key would leak it into the client bundle.
+ *
+ * SEPARATE ENTRY on purpose: this module statically imports `vite`, which is a
+ * dev-only tool. It is NOT re-exported from the `lib/ai` barrel (pinned in
+ * `bundle.test.ts`), and the plugin is `apply: 'serve'` — no production build or
+ * serverless mount ever includes it. Production mounts use `toNodeHandler` from
+ * `@elytracms/studio/lib/ai` directly.
+ */
+import { loadEnv } from 'vite';
+import { INSECURE_ANONYMOUS_SESSION_ENV_VALUE, INSECURE_ANONYMOUS_SESSION_ENV_VAR, } from './convex-session.js';
+import { toNodeHandler } from './node-handler.js';
+import { DEFAULT_AI_ENDPOINT } from './route-provider.js';
+/** Env keys the plugin surfaces from `.env*` files into `process.env` for the handler. */
+export const DEFAULT_AI_DEV_ENV_KEYS = [
+    'ANTHROPIC_API_KEY',
+    'VITE_CONVEX_SITE_URL',
+    'VITE_CONVEX_URL',
+];
+/** Resolve the anonymous-bypass opt-in against the loaded env (pure; unit-pinned). */
+export function resolveInsecureAnonymousOptIn(optIn, env) {
+    if (optIn === true)
+        return true;
+    if (optIn === 'playground-mode')
+        return env.VITE_ELYTRA_MODE === 'playground';
+    return false;
+}
+function jsonError(code, status) {
+    return new Response(JSON.stringify({ error: code }), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+/**
+ * Mount the AI route in the Vite dev server. Dev-only by construction
+ * (`apply: 'serve'`); a production deploy mounts the same handler module via
+ * `toNodeHandler` in its serverless entry instead.
+ */
+export function createAiDevPlugin(options = {}) {
+    const handlerModulePath = options.handlerModulePath ?? '/src/server/ai-handler.ts';
+    const route = options.route ?? DEFAULT_AI_ENDPOINT;
+    const exportName = options.exportName ?? 'aiRouteHandler';
+    let env = {};
+    return {
+        name: 'elytra-ai-route',
+        apply: 'serve',
+        configResolved(config) {
+            env = loadEnv(config.mode, config.root, '');
+            for (const key of [...DEFAULT_AI_DEV_ENV_KEYS, ...(options.envKeys ?? [])]) {
+                if (env[key] && !process.env[key])
+                    process.env[key] = env[key];
+            }
+        },
+        configureServer(server) {
+            if (resolveInsecureAnonymousOptIn(options.insecureAllowAnonymousSessions, env)) {
+                process.env[INSECURE_ANONYMOUS_SESSION_ENV_VAR] = INSECURE_ANONYMOUS_SESSION_ENV_VALUE;
+                server.config.logger.warn(`[elytra-ai] insecureAllowAnonymousSessions is ON for this dev server: ${route} ` +
+                    'accepts requests without a session token (requests presenting a token are still verified).');
+            }
+            // Per request: SSR-load the handler (picks up its @elytracms/* imports through
+            // Vite) and run it; a load/handler failure is a structured 500, never a crash.
+            const bridge = toNodeHandler(async (request) => {
+                try {
+                    const mod = (await server.ssrLoadModule(handlerModulePath));
+                    const handler = mod[exportName];
+                    if (typeof handler !== 'function')
+                        return jsonError('route-handler-missing', 500);
+                    return await handler(request);
+                }
+                catch {
+                    return jsonError('route-error', 500);
+                }
+            });
+            server.middlewares.use((req, res, next) => {
+                if (!req.url || !req.url.startsWith(route))
+                    return next();
+                void bridge(req, res).catch(() => {
+                    if (!res.headersSent)
+                        res.statusCode = 500;
+                    res.end();
+                });
+            });
+        },
+    };
+}
+//# sourceMappingURL=vite.js.map

package/dist/lib/ai/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.js","sourceRoot":"","sources":["../../../src/lib/ai/vite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EACL,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAGtD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;CACT,CAAA;AAwBV,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAC3C,KAA8C,EAC9C,GAAuC;IAEvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,GAAG,CAAC,gBAAgB,KAAK,YAAY,CAAA;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;QACnD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B,EAAE;IAChE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAA;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAA;IACzD,IAAI,GAAG,GAAuC,EAAE,CAAA;IAEhD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,OAAO;QACd,cAAc,CAAC,MAAM;YACnB,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,uBAAuB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3E,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QACD,eAAe,CAAC,MAAqB;YACnC,IAAI,6BAA6B,CAAC,OAAO,CAAC,8BAA8B,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,GAAG,oCAAoC,CAAA;gBACtF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACvB,yEAAyE,KAAK,GAAG;oBAC/E,4FAA4F,CAC/F,CAAA;YACH,CAAC;YAED,+EAA+E;YAC/E,+EAA+E;YAC/E,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAgB,EAAqB,EAAE;gBACzE,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAA4B,CAAA;oBACtF,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;oBAC/B,IAAI,OAAO,OAAO,KAAK,UAAU;wBAAE,OAAO,SAAS,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;oBACjF,OAAO,MAAO,OAA0B,CAAC,OAAO,CAAC,CAAA;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACxC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,EAAE,CAAA;gBACzD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC/B,IAAI,CAAC,GAAG,CAAC,WAAW;wBAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBAC1C,GAAG,CAAC,GAAG,EAAE,CAAA;gBACX,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["/**\n * `@elytracms/studio/lib/ai/vite` — `createAiDevPlugin`, the DEV half of the AI\n * route mounting kit (EC-371; closes EC-369 finding #2). A studio app is a client\n * SPA with no server build, so in dev the host route lives as a Vite dev-server\n * middleware: this plugin loads the framework-agnostic `Request → Response` handler\n * module through Vite's SSR pipeline (so its `@elytracms/*` imports resolve like the\n * rest of the app) and bridges Node req/res via the shared {@link toNodeHandler}.\n *\n * It also owns the env bridge the resolver needs (the piece the template had\n * drifted on): `loadEnv` surfaces `ANTHROPIC_API_KEY` / `VITE_CONVEX_SITE_URL` /\n * `VITE_CONVEX_URL` from `.env`/`.env.local` into `process.env` for the SSR-loaded\n * handler — Vite only exposes `VITE_`-prefixed vars via `import.meta.env`, and a\n * `VITE_` prefix on the provider key would leak it into the client bundle.\n *\n * SEPARATE ENTRY on purpose: this module statically imports `vite`, which is a\n * dev-only tool. It is NOT re-exported from the `lib/ai` barrel (pinned in\n * `bundle.test.ts`), and the plugin is `apply: 'serve'` — no production build or\n * serverless mount ever includes it. Production mounts use `toNodeHandler` from\n * `@elytracms/studio/lib/ai` directly.\n */\nimport { loadEnv } from 'vite'\nimport type { Plugin, ViteDevServer } from 'vite'\nimport {\n  INSECURE_ANONYMOUS_SESSION_ENV_VALUE,\n  INSECURE_ANONYMOUS_SESSION_ENV_VAR,\n} from './convex-session'\nimport { toNodeHandler } from './node-handler'\nimport { DEFAULT_AI_ENDPOINT } from './route-provider'\nimport type { AiRouteHandler } from './types'\n\n/** Env keys the plugin surfaces from `.env*` files into `process.env` for the handler. */\nexport const DEFAULT_AI_DEV_ENV_KEYS = [\n  'ANTHROPIC_API_KEY',\n  'VITE_CONVEX_SITE_URL',\n  'VITE_CONVEX_URL',\n] as const\n\nexport interface AiDevPluginOptions {\n  /** The handler module (Vite root-relative), default `/src/server/ai-handler.ts`. */\n  handlerModulePath?: string\n  /** The mounted route path (default {@link DEFAULT_AI_ENDPOINT}, `/api/ai`). */\n  route?: string\n  /** The handler module's export name (default `aiRouteHandler`). */\n  exportName?: string\n  /** Extra env keys to surface into `process.env` (merged over the defaults). */\n  envKeys?: readonly string[]\n  /**\n   * INSECURE, dev-only: let requests presenting NO credential pass the session gate.\n   * A playground studio has no Convex session, so without this the assistant panel\n   * answers 401 there. `'playground-mode'` scopes the bypass to dev servers booted\n   * with `VITE_ELYTRA_MODE=playground` (the recommended setting); `true` applies it\n   * to every dev boot. Defaults OFF. It cannot reach production: the plugin is\n   * `apply: 'serve'`, the handshake env var is set only in `configureServer`, and\n   * the resolver additionally refuses it under `NODE_ENV=production`. A PRESENTED\n   * token must still verify for real — the bypass never masks a bad credential.\n   */\n  insecureAllowAnonymousSessions?: boolean | 'playground-mode'\n}\n\n/** Resolve the anonymous-bypass opt-in against the loaded env (pure; unit-pinned). */\nexport function resolveInsecureAnonymousOptIn(\n  optIn: boolean | 'playground-mode' | undefined,\n  env: Record<string, string | undefined>,\n): boolean {\n  if (optIn === true) return true\n  if (optIn === 'playground-mode') return env.VITE_ELYTRA_MODE === 'playground'\n  return false\n}\n\nfunction jsonError(code: string, status: number): Response {\n  return new Response(JSON.stringify({ error: code }), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  })\n}\n\n/**\n * Mount the AI route in the Vite dev server. Dev-only by construction\n * (`apply: 'serve'`); a production deploy mounts the same handler module via\n * `toNodeHandler` in its serverless entry instead.\n */\nexport function createAiDevPlugin(options: AiDevPluginOptions = {}): Plugin {\n  const handlerModulePath = options.handlerModulePath ?? '/src/server/ai-handler.ts'\n  const route = options.route ?? DEFAULT_AI_ENDPOINT\n  const exportName = options.exportName ?? 'aiRouteHandler'\n  let env: Record<string, string | undefined> = {}\n\n  return {\n    name: 'elytra-ai-route',\n    apply: 'serve',\n    configResolved(config) {\n      env = loadEnv(config.mode, config.root, '')\n      for (const key of [...DEFAULT_AI_DEV_ENV_KEYS, ...(options.envKeys ?? [])]) {\n        if (env[key] && !process.env[key]) process.env[key] = env[key]\n      }\n    },\n    configureServer(server: ViteDevServer) {\n      if (resolveInsecureAnonymousOptIn(options.insecureAllowAnonymousSessions, env)) {\n        process.env[INSECURE_ANONYMOUS_SESSION_ENV_VAR] = INSECURE_ANONYMOUS_SESSION_ENV_VALUE\n        server.config.logger.warn(\n          `[elytra-ai] insecureAllowAnonymousSessions is ON for this dev server: ${route} ` +\n            'accepts requests without a session token (requests presenting a token are still verified).',\n        )\n      }\n\n      // Per request: SSR-load the handler (picks up its @elytracms/* imports through\n      // Vite) and run it; a load/handler failure is a structured 500, never a crash.\n      const bridge = toNodeHandler(async (request: Request): Promise<Response> => {\n        try {\n          const mod = (await server.ssrLoadModule(handlerModulePath)) as Record<string, unknown>\n          const handler = mod[exportName]\n          if (typeof handler !== 'function') return jsonError('route-handler-missing', 500)\n          return await (handler as AiRouteHandler)(request)\n        } catch {\n          return jsonError('route-error', 500)\n        }\n      })\n\n      server.middlewares.use((req, res, next) => {\n        if (!req.url || !req.url.startsWith(route)) return next()\n        void bridge(req, res).catch(() => {\n          if (!res.headersSent) res.statusCode = 500\n          res.end()\n        })\n      })\n    },\n  }\n}\n"]}

package/dist/lib/ai-panel.js

@@ -1,5 +1,5 @@
 import { useSyncExternalStore } from 'react';
-import { createBooleanPreference } from './local-preference';
+import { createBooleanPreference } from './local-preference.js';
 /**
  * The AI assistant panel's open/closed state (EC-199) — a framework-free module
  * store, like the ambient locale (`lib/locale`). Module-level on purpose: the toggle

package/dist/lib/assets/index.d.ts

@@ -3,7 +3,7 @@
  * the studio UI consumes these; storage is reached only through the
  * `BlobStorageAdapter` boundary.
  */
-export * from './upload-state';
-export * from './image-dimensions';
-export * from './upload';
-export * from './delete-asset';
+export * from './upload-state.js';
+export * from './image-dimensions.js';
+export * from './upload.js';
+export * from './delete-asset.js';

package/dist/lib/assets/index.js

@@ -3,8 +3,8 @@
  * the studio UI consumes these; storage is reached only through the
  * `BlobStorageAdapter` boundary.
  */
-export * from './upload-state';
-export * from './image-dimensions';
-export * from './upload';
-export * from './delete-asset';
+export * from './upload-state.js';
+export * from './image-dimensions.js';
+export * from './upload.js';
+export * from './delete-asset.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/assets/upload.d.ts

@@ -1,6 +1,6 @@
 import type { AssetRecord, AssetRepository, BlobStorageAdapter } from '@elytracms/core/persistence';
-import type { ImageDimensions } from './image-dimensions';
-import type { UploadFailure, UploadState } from './upload-state';
+import type { ImageDimensions } from './image-dimensions.js';
+import type { UploadFailure, UploadState } from './upload-state.js';
 /**
  * Upload orchestration (EC-151): request upload URL → transfer bytes →
  * confirm by writing the EC-044 metadata record (dimensions, mime, serve URL).

package/dist/lib/assets/upload.js

@@ -1,5 +1,5 @@
-import { detectImageDimensions } from './image-dimensions';
-import { initialUploadState, uploadReducer } from './upload-state';
+import { detectImageDimensions } from './image-dimensions.js';
+import { initialUploadState, uploadReducer } from './upload-state.js';
 /**
  * Default browser transport: XMLHttpRequest POST for real byte progress
  * (fetch has no upload progress without streams support everywhere).

package/dist/lib/auth/convex-auth-adapter.d.ts

@@ -1,6 +1,6 @@
 import type { ConvexHttpClient } from 'convex/browser';
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter';
-import type { SessionStore } from './local-auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
+import type { SessionStore } from './local-auth-adapter.js';
 /**
  * Classify a thrown sign-in error as a DEPLOYMENT-setup failure rather than a
  * credential problem (EC-257). Matches the Convex Auth signing-path throws:

package/dist/lib/auth/convex-auth-adapter.js

@@ -1,4 +1,4 @@
-import { actionRef, mutationRef, queryRef } from '../persistence/convex-client';
+import { actionRef, mutationRef, queryRef } from '../persistence/convex-client.js';
 /**
  * Convex Auth implementation of the project-owned {@link AuthAdapter}
  * (EC-150). Decision record (also in `convex/auth.ts`): **Convex Auth** over

package/dist/lib/auth/dev-auto-login-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Dev-only unattended-auth decorator (testing de-friction). Wraps any
  * {@link AuthAdapter}: when no session can be restored, it transparently signs

package/dist/lib/auth/index.d.ts

@@ -1,12 +1,12 @@
-import type { StudioBackendMode } from '../persistence/backend-mode';
-import type { AuthAdapter } from './auth-adapter';
-export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter';
-export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
-export type { SessionStore } from './local-auth-adapter';
-export { ConvexAuthAdapter } from './convex-auth-adapter';
-export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
-export type { AuthStatus, RouteGuardDecision } from './route-guard';
+import type { StudioBackendMode } from '../persistence/backend-mode.js';
+import type { AuthAdapter } from './auth-adapter.js';
+export type { AuthAdapter, AuthSession, AuthUser, ChangePasswordInput, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileInput, UpdateProfileResult, } from './auth-adapter.js';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter.js';
+export type { SessionStore } from './local-auth-adapter.js';
+export { ConvexAuthAdapter } from './convex-auth-adapter.js';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard.js';
+export type { AuthStatus, RouteGuardDecision } from './route-guard.js';
 /**
  * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
  * exactly: Convex mode means Convex Auth (over the same shared client the

package/dist/lib/auth/index.js

@@ -1,13 +1,13 @@
-import { getConvexClient } from '../persistence/convex-client';
-import { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode';
-import { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace';
-import { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter';
-import { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-import { LocalAuthAdapter } from './local-auth-adapter';
-export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter';
-export { ConvexAuthAdapter } from './convex-auth-adapter';
-export { DevAutoLoginAdapter } from './dev-auto-login-adapter';
-export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard';
+import { getConvexClient } from '../persistence/convex-client.js';
+import { resolveBackendConfig, resolveDevAutoLogin } from '../persistence/backend-mode.js';
+import { deploymentUrlForSlug, resolveDeploymentUrl } from '../workspace/index.js';
+import { ConvexAuthAdapter, hasStoredConvexSession } from './convex-auth-adapter.js';
+import { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+import { LocalAuthAdapter } from './local-auth-adapter.js';
+export { LocalAuthAdapter, LOCAL_DEV_CREDENTIALS } from './local-auth-adapter.js';
+export { ConvexAuthAdapter } from './convex-auth-adapter.js';
+export { DevAutoLoginAdapter } from './dev-auto-login-adapter.js';
+export { SIGN_IN_PATH, isPublicPath, postSignInTarget, resolveRouteGuard, sessionPrincipal, } from './route-guard.js';
 /**
  * Select the auth backend (EC-150/EC-153), mirroring `selectPersistenceAdapter`
  * exactly: Convex mode means Convex Auth (over the same shared client the

package/dist/lib/auth/local-auth-adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AuthAdapter, AuthSession, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter';
+import type { AuthAdapter, AuthSession, ChangePasswordResult, SignInCredentials, SignInResult, UpdateProfileResult } from './auth-adapter.js';
 /**
  * Deterministic local auth (EC-150) for the in-memory persistence mode: the
  * whole sign-in → role-enforcement → sign-out flow works offline, in tests,

package/dist/lib/auth/route-guard.d.ts

@@ -1,5 +1,5 @@
 import type { Principal } from '@elytracms/core/operations';
-import type { AuthSession } from './auth-adapter';
+import type { AuthSession } from './auth-adapter.js';
 /**
  * Pure route-guard + principal-mapping logic (EC-150), kept free of React and
  * router types so it is unit-testable and deterministic. The `__root` layout

package/dist/lib/auth-errors.d.ts

@@ -1,4 +1,4 @@
-import type { OperationError } from './operations';
+import type { OperationError } from './operations/index.js';
 /**
  * Session-expiry detection + plain-language mapping (EC-177 gap 9).
  *

package/dist/lib/clipboard/index.d.ts

@@ -2,6 +2,6 @@
  * Studio clipboard helpers (EC-175): paste-target resolution, permissive-paste
  * diffing, and the OS-clipboard transport over the EC-174 fragment format.
  */
-export * from './paste-target';
-export * from './paste-issues';
-export * from './os-clipboard';
+export * from './paste-target.js';
+export * from './paste-issues.js';
+export * from './os-clipboard.js';

package/dist/lib/clipboard/index.js

@@ -2,7 +2,7 @@
  * Studio clipboard helpers (EC-175): paste-target resolution, permissive-paste
  * diffing, and the OS-clipboard transport over the EC-174 fragment format.
  */
-export * from './paste-target';
-export * from './paste-issues';
-export * from './os-clipboard';
+export * from './paste-target.js';
+export * from './paste-issues.js';
+export * from './os-clipboard.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/cms/published-documents.d.ts

@@ -1,5 +1,5 @@
 import type { CmsDocument } from '@elytracms/core/cms-core';
-import type { OperationsClient } from '../operations';
+import type { OperationsClient } from '../operations/index.js';
 /**
  * The PUBLISHED-perspective documents of a collection (EC-205, "live = published")
  * — the pinned published snapshot of each currently-published document, keyed by

package/dist/lib/cms-views/index.d.ts

@@ -4,5 +4,5 @@
  * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
  * resolves the named views a collection declares in `cms/`.
  */
-export * from './view-model';
-export * from './selection';
+export * from './view-model.js';
+export * from './selection.js';

package/dist/lib/cms-views/index.js

@@ -4,6 +4,6 @@
  * (EC-246b) — the DB saved-view store is retired; `view-model.configViewsFor`
  * resolves the named views a collection declares in `cms/`.
  */
-export * from './view-model';
-export * from './selection';
+export * from './view-model.js';
+export * from './selection.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/collection-view/collection-view-source.d.ts

@@ -1,10 +1,10 @@
 import type { CmsDocument, CollectionDef, DocumentRef, DocumentUrl, FieldDef, Locale, LocaleConfig, LocalizedString, RestoreScope } from '@elytracms/core/cms-core';
 import type { CmsValidationIssue } from '@elytracms/core/cms-core';
 import type { OperationError } from '@elytracms/core/operations';
-import type { TableViewState } from '../cms-views/view-model';
-import type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit';
-import type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions';
-import type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store';
+import type { TableViewState } from '../cms-views/view-model.js';
+import type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit.js';
+import type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions.js';
+import type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store.js';
 /**
  * `CollectionViewSource` — the studio's UNIVERSAL interaction seam (EC-240,
  * vision AD-19).

package/dist/lib/data/collection-content.js

@@ -1,6 +1,6 @@
 import { createContentClient, createContentContext, } from '@elytracms/core/content';
 import { documentKey, resolveDocumentTitle, sampleLocaleConfig } from '@elytracms/core/cms-core';
-import { getStudioLocale } from '../locale/locale-store';
+import { getStudioLocale } from '../locale/locale-store.js';
 /**
  * Default (no-session) collection schema: EMPTY. The studio ships no demo content
  * (Oli, 2026-06-19) — with no backend/content session configured, there is nothing

package/dist/lib/data/data-store.js

@@ -1,14 +1,14 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { useCallback, useEffect, useMemo, useReducer, useState } from 'react';
 import { SourceRegistry, captureSample, inferSchema, resolveBinding, resolveCondition, tokensForSchema, } from '@elytracms/core/data-binding';
-import { getStudioOperations } from '../operations';
+import { getStudioOperations } from '../operations/index.js';
 import { useOperationCache, useOperationQuery } from '@elytracms/studio/lib/query';
 import { createRequiredContext } from '@elytracms/studio/lib/required-context';
-import { STUDIO_SYSTEM_COLLECTION_IDS } from '../operations/session-hydration';
-import { resolveDeploymentCollections } from '../workspace';
-import { hasContentSession } from './collection-content';
-import { captureSourceSample, cmsSourceForCollection } from './sample-capture';
-import { deleteDataSource, loadDataSources, saveDataSource } from './sources-store';
+import { STUDIO_SYSTEM_COLLECTION_IDS } from '../operations/session-hydration.js';
+import { resolveDeploymentCollections } from '../workspace/index.js';
+import { hasContentSession } from './collection-content.js';
+import { captureSourceSample, cmsSourceForCollection } from './sample-capture.js';
+import { deleteDataSource, loadDataSources, saveDataSource } from './sources-store.js';
 function upsert(sources, source) {
     const exists = sources.some((s) => s.id === source.id);
     return exists ? sources.map((s) => (s.id === source.id ? source : s)) : [...sources, source];

package/dist/lib/data/index.d.ts

@@ -1,4 +1,4 @@
-export * from './data-store';
-export * from './sample-capture';
-export * from './sources-store';
-export * from './collection-content';
+export * from './data-store.js';
+export * from './sample-capture.js';
+export * from './sources-store.js';
+export * from './collection-content.js';

package/dist/lib/data/index.js

@@ -1,7 +1,7 @@
-export * from './data-store';
-export * from './sample-capture';
-export * from './sources-store';
-export * from './collection-content';
+export * from './data-store.js';
+export * from './sample-capture.js';
+export * from './sources-store.js';
+export * from './collection-content.js';
 // Data providers (EC-167) are imported from './providers' directly: the module
 // exports a `DataProvider` domain type that would collide with the store's
 // `<DataProvider>` React provider in a wildcard barrel.

package/dist/lib/data/sample-capture.js

@@ -1,8 +1,8 @@
 import { captureSample } from '@elytracms/core/data-binding';
-import { humanizeName } from '../utils';
-import { listQueryOfConfig } from '../bindings/section-bindings';
-import { getCollectionDocument, hasContentSession, playgroundCollection, runCollectionListQuery, } from './collection-content';
-import { providerIdOfSource, providerPayload } from './providers';
+import { humanizeName } from '../utils.js';
+import { listQueryOfConfig } from '../bindings/section-bindings.js';
+import { getCollectionDocument, hasContentSession, playgroundCollection, runCollectionListQuery, } from './collection-content.js';
+import { providerIdOfSource, providerPayload } from './providers.js';
 /**
  * Data-source sample capture (EC-083/EC-166/EC-167). The hosted builder is
  * separate from the site it exports: actually performing a REST fetch / external

package/dist/lib/data/sources-store.d.ts

@@ -1,6 +1,6 @@
 import type { DataSource } from '@elytracms/core/data-binding';
 import type { CmsDocument, CollectionDef } from '@elytracms/core/cms-core';
-import type { OperationResult, OperationsClient } from '../operations';
+import type { OperationResult, OperationsClient } from '../operations/index.js';
 /**
  * Data-source persistence for the Builder's data layer (LIVE-mode gap fix).
  *

package/dist/lib/diff-view-preference.js

@@ -6,7 +6,7 @@
  * best-effort instead of a new persistence mechanism. Unavailable storage (SSR,
  * privacy mode) degrades to the default every session — never a crash.
  */
-import { createEnumPreference } from './local-preference';
+import { createEnumPreference } from './local-preference.js';
 export const DIFF_VIEW_STORAGE_KEY = 'elytra-version-diff-view';
 export const DEFAULT_DIFF_VIEW_MODE = 'sideBySide';
 const preference = createEnumPreference(DIFF_VIEW_STORAGE_KEY, ['sideBySide', 'unified'], DEFAULT_DIFF_VIEW_MODE);

package/dist/lib/dnd/gap-drag.d.ts

@@ -1,5 +1,5 @@
 import type { ComponentNode, SpacingTokenName } from '@elytracms/core/project-graph';
-import type { FlowAxis } from './drop-rules';
+import type { FlowAxis } from './drop-rules.js';
 /**
  * Tokenized gap-drag math (EC-163, vision §3.1 / AD-10) — pure functions with
  * no DOM dependencies, shared by the canvas spacing handles. The drag model is

package/dist/lib/i18n/i18n.d.ts

@@ -1,5 +1,5 @@
 import type { LocalizedString } from '@elytracms/core/cms-core';
-import type { MessageCatalog, SourceCatalog } from './types';
+import type { MessageCatalog, SourceCatalog } from './types.js';
 /**
  * Pick the best available locale for the browser's ordered language preferences
  * (EC-241): an exact tag match wins, else the base language (`de-DE` → `de`), else

package/dist/lib/i18n/i18n.js

@@ -1,7 +1,7 @@
 import { useMemo } from 'react';
 import { resolveLabel } from '@elytracms/core/cms-core';
 import { resolveDeploymentI18n } from '@elytracms/studio/lib/workspace';
-import { EN_MESSAGES } from './messages.en';
+import { EN_MESSAGES } from './messages.en.js';
 /**
  * Studio-UI localization runtime (EC-241). Resolves the active UI locale from the
  * **browser's preferred locale** (no persisted selector in v1 — that rides EC-240's