@elytracms/studio 0.0.62 → 0.0.63

package/dist/customization.js.map

@@ -1 +1 @@
-{"version":3,"file":"customization.js","sourceRoot":"","sources":["../src/customization.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAOnE,OAAO,EAAE,GAAG,EAAE,MAAM,wCAAwC,CAAA;AAO5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAA","sourcesContent":["/**\n * `@elytracms/studio/customization` — the public customization API for a consuming\n * repo's `studio.config.tsx` (EC-236/237/238/239).\n *\n * Everything a repo customizes about the builder UI is **live studio code passed by\n * reference** through `defineStudio({...})` — the section rail (`nav.*`), custom\n * field renderers, and (in time) branding. This config is studio-only: it is handed\n * to `createStudio(config, studioConfig)` at the mount and never enters the shared\n * `elytra.config.ts` / the `frontend/` delivery bundle. The customization principle\n * in one import surface: direct values, no registries, no string ids — the lone\n * string seam is `fieldRenderers`' control key, which the delivery-shared schema\n * references via `form.control`.\n *\n * @example\n * ```tsx\n * // studio.config.tsx\n * import { defineStudio, nav } from '@elytracms/studio/customization'\n * import { ColorField } from './fields/color'\n *\n * export default defineStudio({\n *   sidebar: [\n *     nav.cms({ label: 'Content' }),\n *     nav.group('Catalog', [\n *       nav.cms({ label: 'Catalog', collections: ['product', 'productCategory'] }),\n *       nav.cms({ label: 'Categories', collection: 'productCategory' }),\n *     ]),\n *     nav.separator(),\n *     nav.assets(),\n *     nav.settings(),\n *   ],\n *   fieldRenderers: { color: ColorField },\n * })\n *\n * // router.tsx (the mount)\n * import { createStudio } from '@elytracms/studio/customization'\n * import config from '../../elytra.config'\n * import studioConfig from './studio.config'\n * createStudio(config, studioConfig)\n * ```\n */\nexport { defineStudio } from './components/app-views/studio-config'\nexport type {\n  StudioConfig,\n  StudioCanvasTheme,\n  CustomFieldRenderer,\n  CustomFieldRendererProps,\n} from './components/app-views/studio-config'\nexport { nav } from './components/app-views/default-modules'\nexport type {\n  CmsViewConfig,\n  BuiltinViewConfig,\n  CustomViewConfig,\n} from './components/app-views/default-modules'\nexport type { AppViewContext, AppViewModule, SidebarNode } from './components/app-views/module'\nexport { createStudio } from './lib/workspace'\n/** A ready-made example renderer; a consuming repo may use it or author its own. */\nexport { colorFieldRenderer } from './components/cms/field-renderer'\n/**\n * Studio-UI localization (EC-241): author a translation catalog for `defineStudio({\n * i18n })`. `msg` is only needed to build an in-repo *source* catalog with translator\n * hints; a plain `MessageCatalog` (flat key → string) is all a consumer supplies.\n */\nexport { msg } from './lib/i18n'\nexport type { MessageCatalog, SourceMessage, StudioI18nConfig } from './lib/i18n'\n"]}
+{"version":3,"file":"customization.js","sourceRoot":"","sources":["../src/customization.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAOnE,OAAO,EAAE,GAAG,EAAE,MAAM,wCAAwC,CAAA;AAO5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE;;;;;;;GAOG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAA","sourcesContent":["/**\n * `@elytracms/studio/customization` — the public customization API for a consuming\n * repo's `studio.config.tsx` (EC-236/237/238/239).\n *\n * Everything a repo customizes about the builder UI is **live studio code passed by\n * reference** through `defineStudio({...})` — the section rail (`nav.*`), custom\n * field renderers, and (in time) branding. This config is studio-only: it is handed\n * to `createStudio(config, studioConfig)` at the mount and never enters the shared\n * `elytra.config.ts` / the `frontend/` delivery bundle. The customization principle\n * in one import surface: direct values, no registries, no string ids — the lone\n * string seam is `fieldRenderers`' control key, which the delivery-shared schema\n * references via `form.control`.\n *\n * @example\n * ```tsx\n * // studio.config.tsx\n * import { defineStudio, nav } from '@elytracms/studio/customization'\n * import { ColorField } from './fields/color'\n *\n * export default defineStudio({\n *   sidebar: [\n *     nav.cms({ label: 'Content' }),\n *     nav.group('Catalog', [\n *       nav.cms({ label: 'Catalog', collections: ['product', 'productCategory'] }),\n *       nav.cms({ label: 'Categories', collection: 'productCategory' }),\n *     ]),\n *     nav.separator(),\n *     nav.assets(),\n *     nav.settings(),\n *   ],\n *   fieldRenderers: { color: ColorField },\n * })\n *\n * // router.tsx (the mount)\n * import { createStudio } from '@elytracms/studio/customization'\n * import config from '../../elytra.config'\n * import studioConfig from './studio.config'\n * createStudio(config, studioConfig)\n * ```\n */\nexport { defineStudio } from './components/app-views/studio-config'\nexport type {\n  StudioConfig,\n  StudioCanvasTheme,\n  CustomFieldRenderer,\n  CustomFieldRendererProps,\n} from './components/app-views/studio-config'\nexport { nav } from './components/app-views/default-modules'\nexport type {\n  CmsViewConfig,\n  BuiltinViewConfig,\n  CustomViewConfig,\n} from './components/app-views/default-modules'\nexport type { AppViewContext, AppViewModule, SidebarNode } from './components/app-views/module'\nexport { createStudio } from './lib/workspace'\n/** A ready-made example renderer; a consuming repo may use it or author its own. */\nexport { colorFieldRenderer } from './components/cms/field-renderer'\n/**\n * Studio-UI localization (EC-241): author a translation catalog for `defineStudio({\n * i18n })`. `msg` is only needed to build an in-repo *source* catalog with translator\n * hints; a plain `MessageCatalog` (flat key → string) is all a consumer supplies.\n * Prefer `TranslationCatalog` (EC-398) when authoring: it is typed against the EN key\n * set, so unknown/stale keys fail typecheck — engine-shipped locales\n * (`@elytracms/studio/locales/de`) and spread-overrides of them use it.\n */\nexport { msg } from './lib/i18n'\nexport type {\n  MessageCatalog,\n  MessageKey,\n  SourceMessage,\n  StudioI18nConfig,\n  TranslationCatalog,\n} from './lib/i18n'\n"]}

package/dist/lib/auth-errors.d.ts

@@ -1,23 +1,5 @@
+import type { ChangePasswordResult, SignInResult } from './auth/auth-adapter.js';
 import type { OperationError } from './operations/index.js';
-/**
- * Session-expiry detection + plain-language mapping (EC-177 gap 9).
- *
- * An expired Convex session surfaces as a raw backend blob thrown by the
- * transport — e.g. `{"code":"Unauthenticated","message":"Could not verify
- * OIDC token claim…"}` — which `toOperationError` can only normalize to an
- * `unknown`/`backend-unavailable` `OperationError` whose message *is* that
- * blob. Rendering it verbatim is editor-hostile, and the real problem (edits
- * silently stop persisting) is invisible.
- *
- * This module is the one chokepoint that recognizes that shape on the
- * structured `OperationError` (the seam every studio failure already flows
- * through), so UI surfaces never string-match raw messages themselves: the
- * shared banner asks {@link isSessionExpiredError} and renders the
- * plain-language copy + a "Sign in again" action instead.
- */
-/** Editor-facing copy: plain language, no auth/transport jargon. */
-export declare const SESSION_EXPIRED_MESSAGE = "You've been signed out, so your latest changes aren't being saved. Sign in again to keep editing \u2014 you'll come back to this screen.";
-export declare const SIGN_IN_AGAIN_LABEL = "Sign in again";
 /**
  * Does this operation failure mean "the session is no longer valid"?
  *
@@ -29,14 +11,62 @@ export declare const SIGN_IN_AGAIN_LABEL = "Sign in again";
  * message it ships with.
  */
 export declare function isSessionExpiredError(error: OperationError): boolean;
+type SignInFailure = Extract<SignInResult, {
+    ok: false;
+}>;
+/**
+ * Engine-owned sign-in-failure → message-catalog-key mapping (EC-397). The
+ * auth adapters (no-touch `lib/auth/**`) return plain-English `message`
+ * constants on the EC-362/EC-363 classified reasons; this table names the
+ * catalog key that carries each of those messages, so the sign-in screen
+ * localizes failures through the SAME catalog as the rest of the chrome
+ * (a German catalog covers them with no consumer-side mapper — the
+ * pre-EC-375 Naturkinder `authErrorMessage` is retired by this seam).
+ *
+ * A reason can carry several distinct engine messages (`unavailable` spans
+ * the rate-limit, the honest server-error generic, and the playground
+ * sign-up refusal), so each reason lists its candidate keys and a failure is
+ * recognized by **exact EN-message match** against the catalog entry. That
+ * makes English rendering byte-identical by construction and keeps the
+ * fallback honest: any unrecognized message (a future reason, a reworded
+ * adapter constant, a non-engine adapter) falls through to the raw
+ * `result.message` — never a mistranslated or stale mapping.
+ * `lib/auth-errors.test.ts` runs the real classifier over every branch to
+ * pin that adapter copy and catalog never drift apart silently.
+ */
+export declare const SIGN_IN_ERROR_KEYS: Record<SignInFailure['reason'], readonly string[]>;
+/**
+ * Resolve a failed {@link SignInResult} to its message-catalog key, or `null`
+ * when the failure is not an engine-known shape (render `result.message` raw
+ * — the honest fallback). Pure; accepts the failure structurally so callers
+ * and tests can probe unknown future reasons without casts.
+ */
+export declare function signInErrorMessageKey(failure: {
+    reason: string;
+    message: string;
+}): string | null;
+type ChangePasswordFailure = Extract<ChangePasswordResult, {
+    ok: false;
+}>;
+/**
+ * Engine-owned change-password-failure → message-catalog-key mapping (EC-412)
+ * — the {@link SIGN_IN_ERROR_KEYS} design extended to the account credential
+ * panel. The reasons are the {@link ChangePasswordResult} failure union;
+ * `unavailable` again spans several deliberate messages (the
+ * deployment-misconfigured remedy, the EC-377 rate limit, and the honest
+ * server-error generic), so recognition is by reason + exact EN-message match
+ * and every unrecognized shape falls through to the raw `result.message`.
+ * `lib/auth-errors.test.ts` runs the real `classifyChangePasswordError` over
+ * every branch to pin adapter copy and catalog together.
+ */
+export declare const CHANGE_PASSWORD_ERROR_KEYS: Record<ChangePasswordFailure['reason'], readonly string[]>;
 /**
- * Where the "Sign in again" action navigates: the sign-in screen, carrying the
- * current location so a successful sign-in returns the editor to the exact
- * screen they were on (the sign-in route's `redirect` search param, EC-150).
- * External/protocol-relative targets are rejected, mirroring
- * `postSignInTarget`.
+ * Resolve a failed {@link ChangePasswordResult} to its message-catalog key, or
+ * `null` when the failure is not an engine-known shape (render
+ * `result.message` raw — the honest fallback).
  */
-export declare function signInHref(location: {
-    pathname: string;
-    search?: string;
-}): string;
+export declare function changePasswordErrorMessageKey(failure: {
+    reason: string;
+    message: string;
+}): string | null;
+export {};

package/dist/lib/auth-errors.js

@@ -1,3 +1,4 @@
+import { EN_MESSAGES } from './i18n/messages.en.js';
 /**
  * Session-expiry detection + plain-language mapping (EC-177 gap 9).
  *
@@ -10,13 +11,13 @@
  *
  * This module is the one chokepoint that recognizes that shape on the
  * structured `OperationError` (the seam every studio failure already flows
- * through), so UI surfaces never string-match raw messages themselves: the
- * shared banner asks {@link isSessionExpiredError} and renders the
- * plain-language copy + a "Sign in again" action instead.
+ * through), so UI surfaces never string-match raw messages themselves. Since
+ * EC-403 an expired session is an app-level state: `lib/session-expiry.ts`
+ * runs this predicate over every failed operation on the lifecycle bus and
+ * raises the blocking in-place re-auth overlay (the
+ * `error.sessionExpiredTitle` / `error.sessionExpired` catalog keys) — the
+ * shared banner only uses it to route expiry AWAY from per-surface rendering.
  */
-/** Editor-facing copy: plain language, no auth/transport jargon. */
-export const SESSION_EXPIRED_MESSAGE = "You've been signed out, so your latest changes aren't being saved. Sign in again to keep editing — you'll come back to this screen.";
-export const SIGN_IN_AGAIN_LABEL = 'Sign in again';
 /**
  * Extract the `code` of a JSON object embedded in a transport error message.
  * Convex auth failures carry `{"code":"Unauthenticated", …}`, sometimes
@@ -60,15 +61,92 @@ export function isSessionExpiredError(error) {
     return /could not verify oidc token/i.test(error.message);
 }
 /**
- * Where the "Sign in again" action navigates: the sign-in screen, carrying the
- * current location so a successful sign-in returns the editor to the exact
- * screen they were on (the sign-in route's `redirect` search param, EC-150).
- * External/protocol-relative targets are rejected, mirroring
- * `postSignInTarget`.
+ * Engine-owned sign-in-failure → message-catalog-key mapping (EC-397). The
+ * auth adapters (no-touch `lib/auth/**`) return plain-English `message`
+ * constants on the EC-362/EC-363 classified reasons; this table names the
+ * catalog key that carries each of those messages, so the sign-in screen
+ * localizes failures through the SAME catalog as the rest of the chrome
+ * (a German catalog covers them with no consumer-side mapper — the
+ * pre-EC-375 Naturkinder `authErrorMessage` is retired by this seam).
+ *
+ * A reason can carry several distinct engine messages (`unavailable` spans
+ * the rate-limit, the honest server-error generic, and the playground
+ * sign-up refusal), so each reason lists its candidate keys and a failure is
+ * recognized by **exact EN-message match** against the catalog entry. That
+ * makes English rendering byte-identical by construction and keeps the
+ * fallback honest: any unrecognized message (a future reason, a reworded
+ * adapter constant, a non-engine adapter) falls through to the raw
+ * `result.message` — never a mistranslated or stale mapping.
+ * `lib/auth-errors.test.ts` runs the real classifier over every branch to
+ * pin that adapter copy and catalog never drift apart silently.
+ */
+export const SIGN_IN_ERROR_KEYS = {
+    'invalid-credentials': [
+        'auth.signIn.error.invalidCredentials',
+        'auth.signIn.error.invalidCredentialsSignUp',
+    ],
+    'account-exists': ['auth.signIn.error.accountExists'],
+    'deployment-misconfigured': ['auth.signIn.error.deploymentMisconfigured'],
+    'not-invited': ['auth.signIn.error.notInvited'],
+    unavailable: [
+        'auth.signIn.error.tooManyAttempts',
+        'auth.signIn.error.serverError',
+        'auth.signIn.error.serverErrorSignUp',
+        'auth.signIn.error.unavailable',
+        'auth.signIn.error.playgroundSignUp',
+    ],
+};
+/**
+ * Resolve a failure `{ reason, message }` against a reason → candidate-keys
+ * table by **exact EN-message match** (the EC-397 recognition rule): the
+ * matched key's catalog entry carries the same English, so EN rendering stays
+ * byte-identical, and anything unrecognized returns `null` — the caller
+ * renders the raw message, never a stale mapping.
+ */
+function errorMessageKey(table, failure) {
+    const candidates = table[failure.reason];
+    return candidates?.find((key) => EN_MESSAGES[key]?.message === failure.message) ?? null;
+}
+/**
+ * Resolve a failed {@link SignInResult} to its message-catalog key, or `null`
+ * when the failure is not an engine-known shape (render `result.message` raw
+ * — the honest fallback). Pure; accepts the failure structurally so callers
+ * and tests can probe unknown future reasons without casts.
+ */
+export function signInErrorMessageKey(failure) {
+    return errorMessageKey(SIGN_IN_ERROR_KEYS, failure);
+}
+/**
+ * Engine-owned change-password-failure → message-catalog-key mapping (EC-412)
+ * — the {@link SIGN_IN_ERROR_KEYS} design extended to the account credential
+ * panel. The reasons are the {@link ChangePasswordResult} failure union;
+ * `unavailable` again spans several deliberate messages (the
+ * deployment-misconfigured remedy, the EC-377 rate limit, and the honest
+ * server-error generic), so recognition is by reason + exact EN-message match
+ * and every unrecognized shape falls through to the raw `result.message`.
+ * `lib/auth-errors.test.ts` runs the real `classifyChangePasswordError` over
+ * every branch to pin adapter copy and catalog together.
+ */
+export const CHANGE_PASSWORD_ERROR_KEYS = {
+    'invalid-credentials': ['account.password.error.currentIncorrect'],
+    'weak-password': ['account.password.error.weakPassword'],
+    'not-authenticated': ['account.password.error.notSignedIn'],
+    unavailable: [
+        'account.password.error.deploymentMisconfigured',
+        'account.password.error.tooManyAttempts',
+        'account.password.error.serverError',
+    ],
+    unsupported: ['account.password.error.playgroundUnsupported'],
+};
+/**
+ * Resolve a failed {@link ChangePasswordResult} to its message-catalog key, or
+ * `null` when the failure is not an engine-known shape (render
+ * `result.message` raw — the honest fallback).
  */
-export function signInHref(location) {
-    const target = `${location.pathname}${location.search ?? ''}`;
-    const redirect = target.startsWith('/') && !target.startsWith('//') ? target : '/';
-    return `/sign-in?redirect=${encodeURIComponent(redirect)}`;
+export function changePasswordErrorMessageKey(failure) {
+    return errorMessageKey(CHANGE_PASSWORD_ERROR_KEYS, failure);
 }
+// `signInHref` (the banner's navigating "Sign in again" action) was retired by
+// EC-403: re-auth happens in place via the blocking overlay — a navigation
+// would destroy exactly the unsaved editor state the treatment protects.
 //# sourceMappingURL=auth-errors.js.map

package/dist/lib/auth-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-errors.js","sourceRoot":"","sources":["../../src/lib/auth-errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAClC,qIAAqI,CAAA;AAEvI,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAElD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACjE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAA;YAChD,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAA;IAClF,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAA;IACtE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,OAAO,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,QAA+C;IACxE,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;IAClF,OAAO,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC5D,CAAC","sourcesContent":["import type { OperationError } from './operations'\n\n/**\n * Session-expiry detection + plain-language mapping (EC-177 gap 9).\n *\n * An expired Convex session surfaces as a raw backend blob thrown by the\n * transport — e.g. `{\"code\":\"Unauthenticated\",\"message\":\"Could not verify\n * OIDC token claim…\"}` — which `toOperationError` can only normalize to an\n * `unknown`/`backend-unavailable` `OperationError` whose message *is* that\n * blob. Rendering it verbatim is editor-hostile, and the real problem (edits\n * silently stop persisting) is invisible.\n *\n * This module is the one chokepoint that recognizes that shape on the\n * structured `OperationError` (the seam every studio failure already flows\n * through), so UI surfaces never string-match raw messages themselves: the\n * shared banner asks {@link isSessionExpiredError} and renders the\n * plain-language copy + a \"Sign in again\" action instead.\n */\n\n/** Editor-facing copy: plain language, no auth/transport jargon. */\nexport const SESSION_EXPIRED_MESSAGE =\n  \"You've been signed out, so your latest changes aren't being saved. Sign in again to keep editing — you'll come back to this screen.\"\n\nexport const SIGN_IN_AGAIN_LABEL = 'Sign in again'\n\n/**\n * Extract the `code` of a JSON object embedded in a transport error message.\n * Convex auth failures carry `{\"code\":\"Unauthenticated\", …}`, sometimes\n * wrapped in client prefixes (`[CONVEX M(graph:save)] … Server Error: {…}`).\n */\nfunction embeddedJsonCode(message: string): string | undefined {\n  const start = message.indexOf('{')\n  const end = message.lastIndexOf('}')\n  if (start === -1 || end <= start) return undefined\n  try {\n    const parsed: unknown = JSON.parse(message.slice(start, end + 1))\n    if (parsed !== null && typeof parsed === 'object') {\n      const code = (parsed as { code?: unknown }).code\n      if (typeof code === 'string') return code\n    }\n  } catch {\n    // Not a JSON payload — fall through to the marker checks.\n  }\n  return undefined\n}\n\n/**\n * Does this operation failure mean \"the session is no longer valid\"?\n *\n * Only the transport-shaped codes can carry the backend auth blob: structured\n * studio-level failures (`validation`, `unauthorized` from the role hook,\n * `not-found`, `conflict`) are never session expiry. Within those, detect the\n * Convex unauthenticated shape: an embedded `{\"code\":\"Unauthenticated\"}`\n * payload, the bare `Unauthenticated` server-error marker, or the OIDC claim\n * message it ships with.\n */\nexport function isSessionExpiredError(error: OperationError): boolean {\n  if (error.code !== 'unknown' && error.code !== 'backend-unavailable') return false\n  if (embeddedJsonCode(error.message) === 'Unauthenticated') return true\n  if (/\\bUnauthenticated\\b/.test(error.message)) return true\n  return /could not verify oidc token/i.test(error.message)\n}\n\n/**\n * Where the \"Sign in again\" action navigates: the sign-in screen, carrying the\n * current location so a successful sign-in returns the editor to the exact\n * screen they were on (the sign-in route's `redirect` search param, EC-150).\n * External/protocol-relative targets are rejected, mirroring\n * `postSignInTarget`.\n */\nexport function signInHref(location: { pathname: string; search?: string }): string {\n  const target = `${location.pathname}${location.search ?? ''}`\n  const redirect = target.startsWith('/') && !target.startsWith('//') ? target : '/'\n  return `/sign-in?redirect=${encodeURIComponent(redirect)}`\n}\n"]}
+{"version":3,"file":"auth-errors.js","sourceRoot":"","sources":["../../src/lib/auth-errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACjE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAA;YAChD,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAA;IAClF,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAA;IACtE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1D,OAAO,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAID;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuD;IACpF,qBAAqB,EAAE;QACrB,sCAAsC;QACtC,4CAA4C;KAC7C;IACD,gBAAgB,EAAE,CAAC,iCAAiC,CAAC;IACrD,0BAA0B,EAAE,CAAC,2CAA2C,CAAC;IACzE,aAAa,EAAE,CAAC,8BAA8B,CAAC;IAC/C,WAAW,EAAE;QACX,mCAAmC;QACnC,+BAA+B;QAC/B,qCAAqC;QACrC,+BAA+B;QAC/B,oCAAoC;KACrC;CACF,CAAA;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,KAAoD,EACpD,OAA4C;IAE5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,OAAO,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;AACrD,CAAC;AAID;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAGnC;IACF,qBAAqB,EAAE,CAAC,yCAAyC,CAAC;IAClE,eAAe,EAAE,CAAC,qCAAqC,CAAC;IACxD,mBAAmB,EAAE,CAAC,oCAAoC,CAAC;IAC3D,WAAW,EAAE;QACX,gDAAgD;QAChD,wCAAwC;QACxC,oCAAoC;KACrC;IACD,WAAW,EAAE,CAAC,8CAA8C,CAAC;CAC9D,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAG7C;IACC,OAAO,eAAe,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAA;AAC7D,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,yEAAyE","sourcesContent":["import type { ChangePasswordResult, SignInResult } from './auth/auth-adapter'\nimport { EN_MESSAGES } from './i18n/messages.en'\nimport type { OperationError } from './operations'\n\n/**\n * Session-expiry detection + plain-language mapping (EC-177 gap 9).\n *\n * An expired Convex session surfaces as a raw backend blob thrown by the\n * transport — e.g. `{\"code\":\"Unauthenticated\",\"message\":\"Could not verify\n * OIDC token claim…\"}` — which `toOperationError` can only normalize to an\n * `unknown`/`backend-unavailable` `OperationError` whose message *is* that\n * blob. Rendering it verbatim is editor-hostile, and the real problem (edits\n * silently stop persisting) is invisible.\n *\n * This module is the one chokepoint that recognizes that shape on the\n * structured `OperationError` (the seam every studio failure already flows\n * through), so UI surfaces never string-match raw messages themselves. Since\n * EC-403 an expired session is an app-level state: `lib/session-expiry.ts`\n * runs this predicate over every failed operation on the lifecycle bus and\n * raises the blocking in-place re-auth overlay (the\n * `error.sessionExpiredTitle` / `error.sessionExpired` catalog keys) — the\n * shared banner only uses it to route expiry AWAY from per-surface rendering.\n */\n\n/**\n * Extract the `code` of a JSON object embedded in a transport error message.\n * Convex auth failures carry `{\"code\":\"Unauthenticated\", …}`, sometimes\n * wrapped in client prefixes (`[CONVEX M(graph:save)] … Server Error: {…}`).\n */\nfunction embeddedJsonCode(message: string): string | undefined {\n  const start = message.indexOf('{')\n  const end = message.lastIndexOf('}')\n  if (start === -1 || end <= start) return undefined\n  try {\n    const parsed: unknown = JSON.parse(message.slice(start, end + 1))\n    if (parsed !== null && typeof parsed === 'object') {\n      const code = (parsed as { code?: unknown }).code\n      if (typeof code === 'string') return code\n    }\n  } catch {\n    // Not a JSON payload — fall through to the marker checks.\n  }\n  return undefined\n}\n\n/**\n * Does this operation failure mean \"the session is no longer valid\"?\n *\n * Only the transport-shaped codes can carry the backend auth blob: structured\n * studio-level failures (`validation`, `unauthorized` from the role hook,\n * `not-found`, `conflict`) are never session expiry. Within those, detect the\n * Convex unauthenticated shape: an embedded `{\"code\":\"Unauthenticated\"}`\n * payload, the bare `Unauthenticated` server-error marker, or the OIDC claim\n * message it ships with.\n */\nexport function isSessionExpiredError(error: OperationError): boolean {\n  if (error.code !== 'unknown' && error.code !== 'backend-unavailable') return false\n  if (embeddedJsonCode(error.message) === 'Unauthenticated') return true\n  if (/\\bUnauthenticated\\b/.test(error.message)) return true\n  return /could not verify oidc token/i.test(error.message)\n}\n\ntype SignInFailure = Extract<SignInResult, { ok: false }>\n\n/**\n * Engine-owned sign-in-failure → message-catalog-key mapping (EC-397). The\n * auth adapters (no-touch `lib/auth/**`) return plain-English `message`\n * constants on the EC-362/EC-363 classified reasons; this table names the\n * catalog key that carries each of those messages, so the sign-in screen\n * localizes failures through the SAME catalog as the rest of the chrome\n * (a German catalog covers them with no consumer-side mapper — the\n * pre-EC-375 Naturkinder `authErrorMessage` is retired by this seam).\n *\n * A reason can carry several distinct engine messages (`unavailable` spans\n * the rate-limit, the honest server-error generic, and the playground\n * sign-up refusal), so each reason lists its candidate keys and a failure is\n * recognized by **exact EN-message match** against the catalog entry. That\n * makes English rendering byte-identical by construction and keeps the\n * fallback honest: any unrecognized message (a future reason, a reworded\n * adapter constant, a non-engine adapter) falls through to the raw\n * `result.message` — never a mistranslated or stale mapping.\n * `lib/auth-errors.test.ts` runs the real classifier over every branch to\n * pin that adapter copy and catalog never drift apart silently.\n */\nexport const SIGN_IN_ERROR_KEYS: Record<SignInFailure['reason'], readonly string[]> = {\n  'invalid-credentials': [\n    'auth.signIn.error.invalidCredentials',\n    'auth.signIn.error.invalidCredentialsSignUp',\n  ],\n  'account-exists': ['auth.signIn.error.accountExists'],\n  'deployment-misconfigured': ['auth.signIn.error.deploymentMisconfigured'],\n  'not-invited': ['auth.signIn.error.notInvited'],\n  unavailable: [\n    'auth.signIn.error.tooManyAttempts',\n    'auth.signIn.error.serverError',\n    'auth.signIn.error.serverErrorSignUp',\n    'auth.signIn.error.unavailable',\n    'auth.signIn.error.playgroundSignUp',\n  ],\n}\n\n/**\n * Resolve a failure `{ reason, message }` against a reason → candidate-keys\n * table by **exact EN-message match** (the EC-397 recognition rule): the\n * matched key's catalog entry carries the same English, so EN rendering stays\n * byte-identical, and anything unrecognized returns `null` — the caller\n * renders the raw message, never a stale mapping.\n */\nfunction errorMessageKey(\n  table: Record<string, readonly string[] | undefined>,\n  failure: { reason: string; message: string },\n): string | null {\n  const candidates = table[failure.reason]\n  return candidates?.find((key) => EN_MESSAGES[key]?.message === failure.message) ?? null\n}\n\n/**\n * Resolve a failed {@link SignInResult} to its message-catalog key, or `null`\n * when the failure is not an engine-known shape (render `result.message` raw\n * — the honest fallback). Pure; accepts the failure structurally so callers\n * and tests can probe unknown future reasons without casts.\n */\nexport function signInErrorMessageKey(failure: {\n  reason: string\n  message: string\n}): string | null {\n  return errorMessageKey(SIGN_IN_ERROR_KEYS, failure)\n}\n\ntype ChangePasswordFailure = Extract<ChangePasswordResult, { ok: false }>\n\n/**\n * Engine-owned change-password-failure → message-catalog-key mapping (EC-412)\n * — the {@link SIGN_IN_ERROR_KEYS} design extended to the account credential\n * panel. The reasons are the {@link ChangePasswordResult} failure union;\n * `unavailable` again spans several deliberate messages (the\n * deployment-misconfigured remedy, the EC-377 rate limit, and the honest\n * server-error generic), so recognition is by reason + exact EN-message match\n * and every unrecognized shape falls through to the raw `result.message`.\n * `lib/auth-errors.test.ts` runs the real `classifyChangePasswordError` over\n * every branch to pin adapter copy and catalog together.\n */\nexport const CHANGE_PASSWORD_ERROR_KEYS: Record<\n  ChangePasswordFailure['reason'],\n  readonly string[]\n> = {\n  'invalid-credentials': ['account.password.error.currentIncorrect'],\n  'weak-password': ['account.password.error.weakPassword'],\n  'not-authenticated': ['account.password.error.notSignedIn'],\n  unavailable: [\n    'account.password.error.deploymentMisconfigured',\n    'account.password.error.tooManyAttempts',\n    'account.password.error.serverError',\n  ],\n  unsupported: ['account.password.error.playgroundUnsupported'],\n}\n\n/**\n * Resolve a failed {@link ChangePasswordResult} to its message-catalog key, or\n * `null` when the failure is not an engine-known shape (render\n * `result.message` raw — the honest fallback).\n */\nexport function changePasswordErrorMessageKey(failure: {\n  reason: string\n  message: string\n}): string | null {\n  return errorMessageKey(CHANGE_PASSWORD_ERROR_KEYS, failure)\n}\n\n// `signInHref` (the banner's navigating \"Sign in again\" action) was retired by\n// EC-403: re-auth happens in place via the blocking overlay — a navigation\n// would destroy exactly the unsaved editor state the treatment protects.\n"]}

package/dist/lib/i18n/index.d.ts

@@ -9,4 +9,5 @@
 export type { SourceMessage, SourceCatalog, MessageCatalog, StudioI18nConfig } from './types.js';
 export { msg } from './types.js';
 export { EN_MESSAGES } from './messages.en.js';
+export type { MessageKey, TranslationCatalog } from './messages.en.js';
 export { resolveActiveLocale, resolveStudioI18n, translate, localizedLabel, msgLabel, resolveMsgLabel, useT, useUiLocale, useLabel, parseAcceptLanguage, setServerLanguagesResolver, setUiLocaleForTests, resetStudioI18nForTests, } from './i18n.js';

package/dist/lib/i18n/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/i18n/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,QAAQ,EACR,eAAe,EACf,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,QAAQ,CAAA","sourcesContent":["/**\n * `@elytracms/studio/lib/i18n` — studio-UI localization (EC-241).\n *\n * - Public config surface (`StudioI18nConfig`, `MessageCatalog`, `msg`) is re-exported\n *   from `@elytracms/studio/customization` so a consumer authors catalogs there.\n * - Studio components localize chrome via `translate`/`useT` and schema labels via\n *   `useLabel`.\n */\nexport type { SourceMessage, SourceCatalog, MessageCatalog, StudioI18nConfig } from './types'\nexport { msg } from './types'\nexport { EN_MESSAGES } from './messages.en'\nexport {\n  resolveActiveLocale,\n  resolveStudioI18n,\n  translate,\n  localizedLabel,\n  msgLabel,\n  resolveMsgLabel,\n  useT,\n  useUiLocale,\n  useLabel,\n  parseAcceptLanguage,\n  setServerLanguagesResolver,\n  setUiLocaleForTests,\n  resetStudioI18nForTests,\n} from './i18n'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/i18n/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,QAAQ,EACR,eAAe,EACf,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,QAAQ,CAAA","sourcesContent":["/**\n * `@elytracms/studio/lib/i18n` — studio-UI localization (EC-241).\n *\n * - Public config surface (`StudioI18nConfig`, `MessageCatalog`, `msg`) is re-exported\n *   from `@elytracms/studio/customization` so a consumer authors catalogs there.\n * - Studio components localize chrome via `translate`/`useT` and schema labels via\n *   `useLabel`.\n */\nexport type { SourceMessage, SourceCatalog, MessageCatalog, StudioI18nConfig } from './types'\nexport { msg } from './types'\nexport { EN_MESSAGES } from './messages.en'\nexport type { MessageKey, TranslationCatalog } from './messages.en'\nexport {\n  resolveActiveLocale,\n  resolveStudioI18n,\n  translate,\n  localizedLabel,\n  msgLabel,\n  resolveMsgLabel,\n  useT,\n  useUiLocale,\n  useLabel,\n  parseAcceptLanguage,\n  setServerLanguagesResolver,\n  setUiLocaleForTests,\n  resetStudioI18nForTests,\n} from './i18n'\n"]}

package/dist/lib/i18n/messages.de.d.ts

@@ -0,0 +1,24 @@
+import type { TranslationCatalog } from './messages.en.js';
+/**
+ * The engine-shipped **German** studio-chrome catalog (EC-398), importable as
+ * `@elytracms/studio/locales/de` and passed by reference into
+ * `defineStudio({ i18n: { locales: { de: deMessages } } })` — translations stay
+ * code passed directly (EC-241's principle; no registry, no runtime fetch). A
+ * consumer overrides individual strings by spreading:
+ * `{ ...deMessages, 'some.key': 'eigene Formulierung' }`.
+ *
+ * Seeded 2026-07-15 as the best-of merge of the two hand-maintained consumer
+ * catalogs (Naturkinder wins conflicts) + fresh translations for the keys both
+ * lacked (incl. EC-397's sign-in/boot copy). Typed against
+ * {@link TranslationCatalog} so an unknown/stale key fails typecheck;
+ * `messages.de.test.ts` pins EXACT key parity with the EN source (no missing,
+ * no stale, matching `{var}` placeholders) — a new engine string fails the
+ * engine build until it is translated here.
+ *
+ * Sections mirror `messages.en.ts` so the files diff side-by-side.
+ *
+ * Glossar: Sammlung · Dokument · Feld · Medien · Komponente · Weiterleitung ·
+ * Verweis · Version · Entwurf · veröffentlichen · Benutzer · Rolle ·
+ * Einstellungen · Bereitstellung.
+ */
+export declare const deMessages: TranslationCatalog;