@elytracms/studio 0.0.70 → 0.0.72

package/convex/cms.ts

@@ -3,6 +3,7 @@ import { foldDocument, unfoldDocument } from '@elytracms/core/cms-core'
 import type { CmsDocument } from '@elytracms/core/cms-core'
 import { mutation, query } from './functions'
 import { requireCapability } from './guard'
+import { assertWithinWriteLimits } from './write-limits'
 
 /**
  * CMS document persistence (EC-043). The backend stores **documents only**
@@ -44,6 +45,11 @@ export const upsertDocument = mutation({
   },
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'content.write') // EC-150
+    // EC-304 B-4: defensive server-side depth/byte clamp at the `v.any()` chokepoint,
+    // BEFORE fold/write. Rejects abusive structurally-deep / oversized payloads that a
+    // direct Convex call (bypassing the client-side lens) could otherwise land. Limits
+    // are generous — legitimate content never trips them (see write-limits.ts).
+    assertWithinWriteLimits(args.document, 'document')
     // EC-260: fold for storage. `args.document` arrives UNFOLDED over the 64-level
     // arg wire; the trigger unfolds before extracting references, so folding here
     // (strictly before the `ctx.db` write) never hides a reference from the walker.
@@ -134,6 +140,8 @@ export const saveDocumentVersion = mutation({
   },
   handler: async (ctx, args) => {
     await requireCapability(ctx, 'content.write') // EC-150
+    // EC-304 B-4: same defensive depth/byte clamp on the version snapshot chokepoint.
+    assertWithinWriteLimits(args.snapshot, 'snapshot')
     // EC-302: versions are appended monotonically, so the latest-created row holds
     // the highest version. Read just that one (index-ordered, newest first) instead
     // of collecting the whole — unbounded — history to compute `max+1`.

package/convex/delivery.ts

@@ -1,6 +1,7 @@
 import { v } from 'convex/values'
 import { unfoldValue } from '@elytracms/core/cms-core'
 import { dataSourceSchema } from '@elytracms/core/data-binding'
+import { safeParseTotal } from '@elytracms/core/project-graph'
 import { query } from './functions'
 import type { QueryCtx } from './functions'
 import { requireCapability } from './guard'
@@ -95,8 +96,17 @@ const PROVIDER_FUNCTION_PREFIX = 'provider:'
  * - `rest`-kind sources never leave the deployment (their headers could hold
  *   credentials), and the captured sample/schema envelope (builder preview
  *   state, not delivery config) is stripped for every kind.
+ *
+ * EC-304 B-1: this runs on the PUBLIC `delivery:snapshot` read path, so it must
+ * NEVER throw — a hostile `cms-data-sources` row whose `values.config` decodes to a
+ * multi-thousand-deep JSON payload would overflow the recursive `dataSourceSchema`
+ * and make a plain `.safeParse` THROW a `RangeError`, escaping `loadSnapshot` and
+ * 500-ing the public query for every page of the live site. Both parses here degrade
+ * instead: `JSON.parse` is already `try`/`catch`-guarded, and `safeParseTotal`
+ * turns the schema-side stack overflow into the ordinary `!success` skip below.
+ * (Exported for the EC-304 regression pin.)
  */
-function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
+export function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
   const sources: unknown[] = []
   for (const document of documents) {
     if (typeof document !== 'object' || document === null) continue
@@ -112,7 +122,7 @@ function dataSourcesFromSystemCollection(documents: unknown[]): unknown[] {
     } catch {
       continue
     }
-    const parsed = dataSourceSchema.safeParse(raw)
+    const parsed = safeParseTotal(dataSourceSchema, raw)
     if (!parsed.success) continue
     const source = parsed.data
     if (source.kind === 'rest') continue

package/convex/write-limits.ts

@@ -0,0 +1,62 @@
+import { MAX_UNFOLDED_DOCUMENT_DEPTH, measureMaxDepth } from '@elytracms/core/cms-core'
+
+/**
+ * EC-304 B-4 — a defensive server-side shape/size clamp at the `v.any()` write
+ * chokepoint (`cms:upsertDocument` / `saveDocumentVersion`).
+ *
+ * The canonical Zod write-time lens runs CLIENT-side (the operations layer); a direct
+ * Convex call bypasses it and lands `document`/`snapshot` as `v.any()`. This clamp
+ * re-checks depth + byte size at the Convex trust boundary before `foldDocument`/write.
+ * It is a defensive bound at the EXISTING boundary — NOT a new write path or authority
+ * (the write still requires `content.write`; this only rejects abusive payloads).
+ *
+ * IMPORTANT — this does NOT close EC-304 B-1. B-1's payload hides a deep JSON string
+ * INSIDE a single field-value STRING leaf, so the document is structurally shallow at
+ * this chokepoint and a document-structure depth clamp never sees it. B-1's guard is
+ * the read-side `safeParseTotal` wrap in `delivery.ts` + the rich-text parses. This
+ * clamp only bounds structurally-deep and oversized documents (belt-and-suspenders).
+ *
+ * The limits are deliberately generous — they must NEVER reject legitimate content:
+ *
+ * - DEPTH: `MAX_UNFOLDED_DOCUMENT_DEPTH` (62), the ceiling an unfolded document can
+ *   even cross the Convex mutation-arg wire at (the EC-260 codec folds deep field
+ *   values only for STORAGE; the arg wire is the hard limit). Real content's deepest
+ *   measured nesting is ≈ 29, and the client lens already errors at 63, so this fires
+ *   only on pathological nesting — and converts the otherwise-opaque Convex wire
+ *   rejection into a clear, actionable error. `measureMaxDepth` is safe to run here:
+ *   Convex bounds arg depth at 64, so the received value is never deep enough to
+ *   overflow the measure itself.
+ * - BYTES: 1 MiB, Convex's own per-document value cap. A legitimate document body is
+ *   ≈ 20 KB, so this has ~50× head-room; it only pre-empts the storage-abuse case
+ *   with a clear error instead of an opaque backend failure. `JSON.stringify` is safe
+ *   because the depth check runs first (≤ 62 deep cannot overflow the serializer).
+ */
+export const MAX_WRITE_DOCUMENT_DEPTH = MAX_UNFOLDED_DOCUMENT_DEPTH
+
+/** Convex's documented per-document value size cap (1 MiB). */
+export const MAX_WRITE_DOCUMENT_BYTES = 1_048_576
+
+/**
+ * Throw when `value` exceeds the depth or byte clamp. `label` names the offending
+ * field for the error message (e.g. `"document"` / `"snapshot"`). Runs BEFORE
+ * `foldDocument` and the `ctx.db` write, so an abusive payload never reaches storage.
+ */
+export function assertWithinWriteLimits(value: unknown, label: string): void {
+  const { depth } = measureMaxDepth(value)
+  if (depth > MAX_WRITE_DOCUMENT_DEPTH) {
+    throw new Error(
+      `${label} nests ${depth} levels deep, past the ${MAX_WRITE_DOCUMENT_DEPTH}-level write limit — split it into smaller linked documents.`,
+    )
+  }
+  const bytes = byteLength(JSON.stringify(value))
+  if (bytes > MAX_WRITE_DOCUMENT_BYTES) {
+    throw new Error(
+      `${label} is ${bytes} bytes, past the ${MAX_WRITE_DOCUMENT_BYTES}-byte (1 MiB) write limit.`,
+    )
+  }
+}
+
+/** UTF-8 byte length of a string, using the web-standard `TextEncoder` (available in Convex). */
+function byteLength(text: string): number {
+  return new TextEncoder().encode(text).length
+}

package/dist/components/account/self-account-view-source.js

@@ -19,6 +19,7 @@ export const ACCOUNT_CAPABILITIES = {
     locales: false,
     inlineEdit: false,
     create: false,
+    duplicate: false,
     remove: false,
     bulk: false,
     liveUrl: false,

package/dist/components/account/self-account-view-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"self-account-view-source.js","sourceRoot":"","sources":["../../../src/components/account/self-account-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAGnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAMrD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,wFAAwF;AACxF,MAAM,cAAc,GAAW,IAAI,CAAA;AACnC,MAAM,qBAAqB,GAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,CAAA;AAElG;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B;IAC9D,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;CACpB,CAAA;AAED,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAErD,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO;QACL,UAAU,EAAE,wBAAwB,CAAC,EAAE;QACvC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ;SAClC;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAgB,EAChB,QAAoB;IAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAuC,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,QAAQ,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAA;IAC5D,IAAI,UAAU,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IAEtB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACnE,MAAM,GAAG,GAAG,WAAW,CACrB,CAAC,GAAgB,EAA2B,EAAE,CAC5C,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EACvD,CAAC,IAAI,CAAC,CACP,CAAA;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAE7E,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,GAAgB,EAA0D,EAAE;QACjF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3C,sEAAsE;QACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,kEAAkE;YAClE,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAA;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QAChF,CAAC;QACD,6EAA6E;QAC7E,MAAM,OAAO,EAAE,CAAA;QACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC,EACD,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACtB,CAAA;IAED,MAAM,QAAQ,GAAG,WAAW,CAC1B,KAAK,IAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EACjD,EAAE,CACH,CAAA;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAyB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACpE,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAgB,EAAE;QACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,iBAAiB,CAAC;QACvB,SAAS;QACT,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE,oBAAoB;QAClC,YAAY,EAAE,qBAAqB;QACnC,SAAS;QACT,GAAG;QACH,OAAO;QACP,iFAAiF;QACjF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC;QACjG,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,iBAAiB;QACzB,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,iBAAiB;QACtC,qBAAqB,EAAE,GAA0B,EAAE,CAAC,IAAI;KACzD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback } from 'react'\nimport type { CmsDocument, CmsValidationIssue, DocumentRef, Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport type { UserRecord } from '@elytracms/core/persistence'\nimport { studioPath } from '@elytracms/studio/router'\nimport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n} from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport type { OperationError } from '@elytracms/core/operations'\nimport { translate } from '@elytracms/studio/lib/i18n'\nimport { updateProfileErrorMessageKey } from '@elytracms/studio/lib/auth-errors'\nimport { useAuth } from '../auth-context'\nimport { selfAccountCollectionDef } from './self-account-schema'\nimport { normalizeOkResult, useRailViewSource } from '../rail-view-source'\n\n/** The account surface is not localized — one implicit locale keeps the lens honest. */\nconst ACCOUNT_LOCALE: Locale = 'en'\nconst ACCOUNT_LOCALE_CONFIG: LocaleConfig = { default: ACCOUNT_LOCALE, locales: [ACCOUNT_LOCALE] }\n\n/**\n * The capability profile of the account surface (EC-240 H-tail): a single self\n * record edited in place — no publish/versions/create/remove/import. The record\n * is the caller's own; there is nothing to delete or list.\n */\nexport const ACCOUNT_CAPABILITIES: CollectionViewCapabilities = {\n  publish: false,\n  versions: false,\n  locales: false,\n  inlineEdit: false,\n  create: false,\n  remove: false,\n  bulk: false,\n  liveUrl: false,\n  hierarchy: false,\n  importExport: false,\n}\n\n/** Everything in `values` that is NOT an editable identity field is display-only. */\nconst EDITABLE_IDENTITY = new Set(['name', 'avatar'])\n\n/** Project the self record into the account lens's `values`. */\nexport function selfToDocument(record: UserRecord): CmsDocument {\n  return {\n    collection: selfAccountCollectionDef.id,\n    id: record.id,\n    values: {\n      name: record.name ?? '',\n      avatar: record.avatar ?? '',\n      email: record.email,\n      role: record.roles[0] ?? 'viewer',\n    },\n  }\n}\n\n/**\n * Compute the identity diff (name / avatar) an edited account document carries —\n * the exact seam handed to `AuthAdapter.updateProfile`. Pure so the split-write is\n * unit-testable: only the fields the person changed are sent (an empty diff is a\n * no-op the caller can short-circuit). Never carries `email`/`role` — those are\n * read-only on this surface and are not auth-adapter-writable here.\n */\nexport function accountIdentityDiff(\n  doc: CmsDocument,\n  previous: UserRecord,\n): { name?: string; avatar?: string } {\n  const values = doc.values ?? {}\n  const diff: { name?: string; avatar?: string } = {}\n  const nextName = typeof values.name === 'string' ? values.name : ''\n  const nextAvatar = typeof values.avatar === 'string' ? values.avatar : ''\n  if (nextName !== (previous.name ?? '')) diff.name = nextName\n  if (nextAvatar !== (previous.avatar ?? '')) diff.avatar = nextAvatar\n  return diff\n}\n\n/**\n * Assemble a {@link CollectionViewSource} for the **account-settings** surface\n * (EC-240 H-tail). Reuses the portable edit shell over the caller's OWN record —\n * name/avatar editable, email/role read-only (per the schema). The `save` routes\n * the identity diff to `AuthAdapter.updateProfile` (auth-owned) — NOT the\n * members-rail `users.save` — then refreshes the loaded record. `EDITABLE_IDENTITY`\n * marks which fields the save may write; everything else is display-only.\n */\nexport function useSelfAccountViewSource(input: {\n  projectId: string\n  self: UserRecord\n  refresh: () => Promise<void>\n}): CollectionViewSource {\n  const { projectId, self, refresh } = input\n  const auth = useAuth()\n\n  const documents = useCallback(() => [selfToDocument(self)], [self])\n  const get = useCallback(\n    (ref: DocumentRef): CmsDocument | undefined =>\n      ref.id === self.id ? selfToDocument(self) : undefined,\n    [self],\n  )\n  const titleOf = useCallback(() => self.name || self.email || self.id, [self])\n\n  const save = useCallback(\n    async (doc: CmsDocument): Promise<{ ok: true } | { ok: false; message: string }> => {\n      const diff = accountIdentityDiff(doc, self)\n      // No identity change (e.g. a read-only-only edit) → nothing to write.\n      if (diff.name === undefined && diff.avatar === undefined) return { ok: true }\n      const result = await auth.updateProfile(diff)\n      if (!result.ok) {\n        // EC-416: engine-classified failures localize through the message\n        // catalog; an unrecognized shape renders the adapter's raw English\n        // message — honest, never a stale mapping (the EC-397/EC-412 pattern).\n        const errorKey = updateProfileErrorMessageKey(result)\n        return { ok: false, message: errorKey ? translate(errorKey) : result.message }\n      }\n      // Reflect the new identity in the loaded record (session already refreshed).\n      await refresh()\n      return { ok: true }\n    },\n    [auth, self, refresh],\n  )\n\n  const noRemove = useCallback(\n    async (): Promise<{ ok: true }> => ({ ok: true }),\n    [],\n  )\n  const noValidation = useCallback((): CmsValidationIssue[] => [], [])\n  const createUnsupported = useCallback((): DocumentRef => {\n    throw new Error('the account surface has no create')\n  }, [])\n\n  return useRailViewSource({\n    projectId,\n    schema: selfAccountCollectionDef,\n    capabilities: ACCOUNT_CAPABILITIES,\n    localeConfig: ACCOUNT_LOCALE_CONFIG,\n    documents,\n    get,\n    titleOf,\n    // Editable-identity fields drive writability; the rest are read-only per schema.\n    isFieldReadOnly: (field) => !EDITABLE_IDENTITY.has(field.name) || (field.form?.readOnly ?? false),\n    detailPath: (id: string) => studioPath.user(id),\n    listPath: studioPath.users(),\n    validate: noValidation,\n    create: createUnsupported,\n    save,\n    remove: noRemove,\n    normalizeSaveResult: normalizeOkResult,\n    normalizeRemoveResult: (): OperationError | null => null,\n  })\n}\n"]}
+{"version":3,"file":"self-account-view-source.js","sourceRoot":"","sources":["../../../src/components/account/self-account-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAGnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAMrD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,wFAAwF;AACxF,MAAM,cAAc,GAAW,IAAI,CAAA;AACnC,MAAM,qBAAqB,GAAiB,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,CAAA;AAElG;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA+B;IAC9D,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;CACpB,CAAA;AAED,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AAErD,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,MAAkB;IAC/C,OAAO;QACL,UAAU,EAAE,wBAAwB,CAAC,EAAE;QACvC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,QAAQ;SAClC;KACF,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAgB,EAChB,QAAoB;IAEpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAuC,EAAE,CAAA;IACnD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,IAAI,QAAQ,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAA;IAC5D,IAAI,UAAU,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IAEtB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACnE,MAAM,GAAG,GAAG,WAAW,CACrB,CAAC,GAAgB,EAA2B,EAAE,CAC5C,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EACvD,CAAC,IAAI,CAAC,CACP,CAAA;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAE7E,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,GAAgB,EAA0D,EAAE;QACjF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3C,sEAAsE;QACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,kEAAkE;YAClE,mEAAmE;YACnE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAA;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QAChF,CAAC;QACD,6EAA6E;QAC7E,MAAM,OAAO,EAAE,CAAA;QACf,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrB,CAAC,EACD,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACtB,CAAA;IAED,MAAM,QAAQ,GAAG,WAAW,CAC1B,KAAK,IAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EACjD,EAAE,CACH,CAAA;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAyB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACpE,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAgB,EAAE;QACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO,iBAAiB,CAAC;QACvB,SAAS;QACT,MAAM,EAAE,wBAAwB;QAChC,YAAY,EAAE,oBAAoB;QAClC,YAAY,EAAE,qBAAqB;QACnC,SAAS;QACT,GAAG;QACH,OAAO;QACP,iFAAiF;QACjF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,IAAI,KAAK,CAAC;QACjG,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE;QAC5B,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,iBAAiB;QACzB,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,iBAAiB;QACtC,qBAAqB,EAAE,GAA0B,EAAE,CAAC,IAAI;KACzD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback } from 'react'\nimport type { CmsDocument, CmsValidationIssue, DocumentRef, Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport type { UserRecord } from '@elytracms/core/persistence'\nimport { studioPath } from '@elytracms/studio/router'\nimport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n} from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport type { OperationError } from '@elytracms/core/operations'\nimport { translate } from '@elytracms/studio/lib/i18n'\nimport { updateProfileErrorMessageKey } from '@elytracms/studio/lib/auth-errors'\nimport { useAuth } from '../auth-context'\nimport { selfAccountCollectionDef } from './self-account-schema'\nimport { normalizeOkResult, useRailViewSource } from '../rail-view-source'\n\n/** The account surface is not localized — one implicit locale keeps the lens honest. */\nconst ACCOUNT_LOCALE: Locale = 'en'\nconst ACCOUNT_LOCALE_CONFIG: LocaleConfig = { default: ACCOUNT_LOCALE, locales: [ACCOUNT_LOCALE] }\n\n/**\n * The capability profile of the account surface (EC-240 H-tail): a single self\n * record edited in place — no publish/versions/create/remove/import. The record\n * is the caller's own; there is nothing to delete or list.\n */\nexport const ACCOUNT_CAPABILITIES: CollectionViewCapabilities = {\n  publish: false,\n  versions: false,\n  locales: false,\n  inlineEdit: false,\n  create: false,\n  duplicate: false,\n  remove: false,\n  bulk: false,\n  liveUrl: false,\n  hierarchy: false,\n  importExport: false,\n}\n\n/** Everything in `values` that is NOT an editable identity field is display-only. */\nconst EDITABLE_IDENTITY = new Set(['name', 'avatar'])\n\n/** Project the self record into the account lens's `values`. */\nexport function selfToDocument(record: UserRecord): CmsDocument {\n  return {\n    collection: selfAccountCollectionDef.id,\n    id: record.id,\n    values: {\n      name: record.name ?? '',\n      avatar: record.avatar ?? '',\n      email: record.email,\n      role: record.roles[0] ?? 'viewer',\n    },\n  }\n}\n\n/**\n * Compute the identity diff (name / avatar) an edited account document carries —\n * the exact seam handed to `AuthAdapter.updateProfile`. Pure so the split-write is\n * unit-testable: only the fields the person changed are sent (an empty diff is a\n * no-op the caller can short-circuit). Never carries `email`/`role` — those are\n * read-only on this surface and are not auth-adapter-writable here.\n */\nexport function accountIdentityDiff(\n  doc: CmsDocument,\n  previous: UserRecord,\n): { name?: string; avatar?: string } {\n  const values = doc.values ?? {}\n  const diff: { name?: string; avatar?: string } = {}\n  const nextName = typeof values.name === 'string' ? values.name : ''\n  const nextAvatar = typeof values.avatar === 'string' ? values.avatar : ''\n  if (nextName !== (previous.name ?? '')) diff.name = nextName\n  if (nextAvatar !== (previous.avatar ?? '')) diff.avatar = nextAvatar\n  return diff\n}\n\n/**\n * Assemble a {@link CollectionViewSource} for the **account-settings** surface\n * (EC-240 H-tail). Reuses the portable edit shell over the caller's OWN record —\n * name/avatar editable, email/role read-only (per the schema). The `save` routes\n * the identity diff to `AuthAdapter.updateProfile` (auth-owned) — NOT the\n * members-rail `users.save` — then refreshes the loaded record. `EDITABLE_IDENTITY`\n * marks which fields the save may write; everything else is display-only.\n */\nexport function useSelfAccountViewSource(input: {\n  projectId: string\n  self: UserRecord\n  refresh: () => Promise<void>\n}): CollectionViewSource {\n  const { projectId, self, refresh } = input\n  const auth = useAuth()\n\n  const documents = useCallback(() => [selfToDocument(self)], [self])\n  const get = useCallback(\n    (ref: DocumentRef): CmsDocument | undefined =>\n      ref.id === self.id ? selfToDocument(self) : undefined,\n    [self],\n  )\n  const titleOf = useCallback(() => self.name || self.email || self.id, [self])\n\n  const save = useCallback(\n    async (doc: CmsDocument): Promise<{ ok: true } | { ok: false; message: string }> => {\n      const diff = accountIdentityDiff(doc, self)\n      // No identity change (e.g. a read-only-only edit) → nothing to write.\n      if (diff.name === undefined && diff.avatar === undefined) return { ok: true }\n      const result = await auth.updateProfile(diff)\n      if (!result.ok) {\n        // EC-416: engine-classified failures localize through the message\n        // catalog; an unrecognized shape renders the adapter's raw English\n        // message — honest, never a stale mapping (the EC-397/EC-412 pattern).\n        const errorKey = updateProfileErrorMessageKey(result)\n        return { ok: false, message: errorKey ? translate(errorKey) : result.message }\n      }\n      // Reflect the new identity in the loaded record (session already refreshed).\n      await refresh()\n      return { ok: true }\n    },\n    [auth, self, refresh],\n  )\n\n  const noRemove = useCallback(\n    async (): Promise<{ ok: true }> => ({ ok: true }),\n    [],\n  )\n  const noValidation = useCallback((): CmsValidationIssue[] => [], [])\n  const createUnsupported = useCallback((): DocumentRef => {\n    throw new Error('the account surface has no create')\n  }, [])\n\n  return useRailViewSource({\n    projectId,\n    schema: selfAccountCollectionDef,\n    capabilities: ACCOUNT_CAPABILITIES,\n    localeConfig: ACCOUNT_LOCALE_CONFIG,\n    documents,\n    get,\n    titleOf,\n    // Editable-identity fields drive writability; the rest are read-only per schema.\n    isFieldReadOnly: (field) => !EDITABLE_IDENTITY.has(field.name) || (field.form?.readOnly ?? false),\n    detailPath: (id: string) => studioPath.user(id),\n    listPath: studioPath.users(),\n    validate: noValidation,\n    create: createUnsupported,\n    save,\n    remove: noRemove,\n    normalizeSaveResult: normalizeOkResult,\n    normalizeRemoveResult: (): OperationError | null => null,\n  })\n}\n"]}

package/dist/components/assets/assets-collection-view-source.js

@@ -34,6 +34,7 @@ export const ASSET_COLLECTION_CAPABILITIES = {
     locales: false,
     inlineEdit: false,
     create: false,
+    duplicate: false, // EC-442: blob duplication is a different feature, out of scope
     remove: true,
     bulk: true,
     liveUrl: false,

package/dist/components/assets/assets-collection-view-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets-collection-view-source.js","sourceRoot":"","sources":["../../../src/components/assets/assets-collection-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE5C,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGrF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAGrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,wFAAwF;AACxF,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,oBAAoB,GAAiB;IACzC,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,CAAC,aAAa,CAAC;CACzB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA+B;IACvE,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,KAAK;CACjB,CAAA;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,MAAmB,EAAE,IAAY;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,QAAQ,CAAA;QACxB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,WAAW,CAAA;QAC3B,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,QAAQ,CAAA;QACxB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,UAAU,CAAA;QAC1B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB,EAAE,MAAmB;IAC5E,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAClF,MAAM,CAAC,GAAG,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACtD,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,GAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QACjD,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;iFACiF;AACjF,SAAS,iBAAiB;IACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,MAAyB;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IACnF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,0BAA0B,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,uBAAuB;SAC5H,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAiB,EACjB,MAAqB;IAErB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAE5E,MAAM,SAAS,GAAG,WAAW,CAC3B,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACnE,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB,CAAA;IACD,MAAM,GAAG,GAAG,WAAW,CACrB,CAAC,GAAgB,EAA2B,EAAE;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,CAAC,EACD,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB,CAAA;IACD,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAgB,EAAU,EAAE;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,OAAO,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAA;IACpD,CAAC,EACD,CAAC,KAAK,CAAC,MAAM,CAAC,CACf,CAAA;IACD,MAAM,QAAQ,GAAG,WAAW,CAC1B,CAAC,GAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EAC7F,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,MAAM,IAAI,GAAG,WAAW,CACtB,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,EACnG,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAA;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/E,4EAA4E;IAC5E,kEAAkE;IAClE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAClE,CAAC,KAAK,CAAC,CACR,CAAA;IAED,OAAO,iBAAiB,CAAC;QACvB,SAAS;QACT,MAAM;QACN,YAAY,EAAE,6BAA6B;QAC3C,YAAY,EAAE,oBAAoB;QAClC,SAAS;QACT,GAAG;QACH,OAAO;QACP,kFAAkF;QAClF,2EAA2E;QAC3E,+EAA+E;QAC/E,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE;QAC7B,sEAAsE;QACtE,yEAAyE;QACzE,0BAA0B;QAC1B,eAAe,EAAE,oBAAoB;QACrC,QAAQ;QACR,MAAM,EAAE,iBAAiB;QACzB,IAAI;QACJ,MAAM;QACN,UAAU;QACV,mBAAmB,EAAE,iBAAiB;QACtC,qBAAqB,EAAE,0BAA0B;KAClD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback, useMemo } from 'react'\nimport type { CmsDocument, CollectionDef, DocumentRef, Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport { createCollectionRegistry, validateDocument } from '@elytracms/core/cms-core'\nimport type { AssetRecord, ReferenceTarget } from '@elytracms/core/persistence'\nimport type { OperationError } from '@elytracms/core/operations'\nimport { studioPath } from '@elytracms/studio/router'\nimport type { DeleteAssetResult } from '@elytracms/studio/lib/assets'\nimport type { CollectionViewSource, CollectionViewCapabilities } from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport { useAssets } from './assets-store'\nimport { SYSTEM_ASSET_FIELDS } from './asset-metadata'\nimport { normalizeOkResult, useRailViewSource } from '../rail-view-source'\n\n/** The assets rail is not localized in v1 (EC-301: asset metadata is non-localized). */\nconst ASSETS_LOCALE: Locale = 'en'\nconst ASSETS_LOCALE_CONFIG: LocaleConfig = {\n  default: ASSETS_LOCALE,\n  locales: [ASSETS_LOCALE],\n}\n\n/**\n * The capability profile of the assets rail (EC-319, EC-433). Hoisted to a\n * module-level constant (no prop/state dependency) so it's both the value the\n * hook returns AND independently unit-testable.\n *\n * `create` is off — a new asset comes from an upload, never a blank draft.\n * `remove` + `bulk` are ON since EC-433: the list's row/bulk delete used to be\n * off deliberately because the generic `ReferenceConfirmDialog` enumerated\n * inbound references as `{ type: 'document' }` targets — the wrong index shape\n * for an asset — which would have shown \"not referenced\" for an asset that IS\n * referenced. That pre-flight now queries the shape THIS source declares via\n * {@link assetReferenceTarget} (`{ type: 'asset' }`, the same lookup the\n * detail surface runs), and the confirmed delete dispatches the SAME checked\n * store delete the detail surface uses (`deleteAsset`: original + EC-400 thumb\n * blobs, then the record — EC-420 lqips ride on the record). Nothing else\n * applies to assets: no publish/versions/locales/inline-edit/live-URL/\n * hierarchy/import-export.\n */\nexport const ASSET_COLLECTION_CAPABILITIES: CollectionViewCapabilities = {\n  publish: false,\n  versions: false,\n  locales: false,\n  inlineEdit: false,\n  create: false,\n  remove: true,\n  bulk: true,\n  liveUrl: false,\n  hierarchy: false,\n  importExport: false,\n  adminOnly: false,\n}\n\n/** Read one of the record's fixed, upload-managed columns by field name. */\nfunction systemFieldValue(record: AssetRecord, name: string): unknown {\n  switch (name) {\n    case 'filename':\n      return record.filename\n    case 'url':\n      return record.url\n    case 'contentType':\n      return record.contentType\n    case 'byteSize':\n      return record.byteSize\n    case 'width':\n      return record.width\n    case 'height':\n      return record.height\n    case 'storageKey':\n      return record.storageKey\n    case 'title':\n      return record.title\n    default:\n      return undefined\n  }\n}\n\n/**\n * Project a stored asset record into the lens's `values` shape (EC-319), reading\n * only the schema's DECLARED fields — the same \"schema is a lens\" projection the\n * redirects/users rails use. A system column (`filename`, `url`, dimensions, …)\n * reads straight off the record; everything else — the built-in `alt`, a\n * project's own `copyright`/`credit`, or an EC-311 additive field — round-trips\n * through the record's open `meta` bag (EC-301). `alt` is schema-driven but ALSO\n * has a legacy record column: the meta value wins, falling back to the column\n * (matches delivery's `meta.alt ?? record.alt` read and the image field's\n * options dialog).\n */\nexport function assetToDocument(collection: CollectionDef, record: AssetRecord): CmsDocument {\n  const values: Record<string, unknown> = {}\n  for (const field of collection.fields) {\n    if (field.name === 'alt') {\n      const metaAlt = typeof record.meta?.alt === 'string' ? record.meta.alt : undefined\n      values.alt = metaAlt ?? record.alt\n      continue\n    }\n    values[field.name] = SYSTEM_ASSET_FIELDS.has(field.name)\n      ? systemFieldValue(record, field.name)\n      : record.meta?.[field.name]\n  }\n  return { collection: collection.id, id: record.id, values }\n}\n\n/**\n * The inverse of {@link assetToDocument}: the schema-driven meta bag a save\n * writes back — every declared field OUTSIDE the system set (EC-301/EC-311),\n * keyed exactly as the record stores it. System columns are upload-managed and\n * never written here.\n */\nexport function documentToAssetMetaPatch(\n  collection: CollectionDef,\n  doc: CmsDocument,\n): Record<string, unknown> {\n  const values = doc.values ?? {}\n  const meta: Record<string, unknown> = {}\n  for (const field of collection.fields) {\n    if (SYSTEM_ASSET_FIELDS.has(field.name)) continue\n    if (field.name in values) meta[field.name] = values[field.name]\n  }\n  return meta\n}\n\n/** `create` when `capabilities.create === false` — never reached from the UI\n *  (list/detail never call it); an explicit throw rather than a silent no-op. */\nfunction createUnsupported(): DocumentRef {\n  throw new Error('assets are created by upload, not the assets rail')\n}\n\n/** Assets' `remove()` returns an `outcome`-discriminated {@link DeleteAssetResult}\n *  (not the `{ ok }` shape users/redirects use, EC-327). `'error'` surfaces as-is;\n *  `'blocked'` (the unconfirmed usage gate fired — nothing was removed) surfaces\n *  as an explicit failure too (EC-433): a delete that left the asset in place\n *  must NEVER look like success. It is unreachable from this rail's UI — every\n *  delete path confirms through the reference dialog and dispatches with\n *  `confirmInUse` — but stays honest for any direct caller. `'not-found'` maps\n *  to success (idempotent delete: the desired end state — gone — holds). */\nexport function normalizeAssetRemoveResult(result: DeleteAssetResult): OperationError | null {\n  if (result.outcome === 'error') return { code: 'unknown', message: result.message }\n  if (result.outcome === 'blocked') {\n    return {\n      code: 'unknown',\n      message: `Asset is referenced in ${result.usageCount} ${result.usageCount === 1 ? 'place' : 'places'} and was not deleted.`,\n    }\n  }\n  return null\n}\n\n/**\n * How an asset row is addressed in the EC-155 reference index (EC-433):\n * `{ type: 'asset' }`, never the document shape — so the delete confirmation's\n * inbound pre-flight counts the SAME references `loadInboundAssetReferenceViews`\n * (the detail surface's check) does.\n */\nexport function assetReferenceTarget(ref: DocumentRef): ReferenceTarget {\n  return { type: 'asset', id: ref.id }\n}\n\n/**\n * Assemble a {@link CollectionViewSource} for the **assets rail** (EC-319) — the\n * portable list surface over the existing asset library store instead of a\n * bespoke listing. `schema` is the DEPLOYMENT-resolved `kind:'asset'` collection\n * (EC-311: a project's own declared fields, or a mount's `nav.assets({ fields })`\n * override merged over it — see `resolveAssetsSchema` in `app-views/default-modules.tsx`),\n * never a hardcoded engine default — so a project's `copyright`/`credit`/… fields\n * (and any EC-311 override) drive the list's columns/filters exactly as they\n * drive the image field's options dialog.\n *\n * Must be mounted under an `<AssetsProvider>` (for {@link useAssets}) — already\n * ambient at the project level (EC-195), so callers rarely mount their own.\n *\n * The shared scaffold (`useRailViewSource`, EC-327) owns `viewState`/`lastError`\n * plumbing and the assembled source; this hook supplies only the asset-store\n * reads/writes, the capability profile, and the projections above.\n */\nexport function useAssetsCollectionViewSource(\n  projectId: string,\n  schema: CollectionDef,\n): CollectionViewSource {\n  const store = useAssets()\n  const registry = useMemo(() => createCollectionRegistry([schema]), [schema])\n\n  const documents = useCallback(\n    () => store.assets.map((record) => assetToDocument(schema, record)),\n    [store.assets, schema],\n  )\n  const get = useCallback(\n    (ref: DocumentRef): CmsDocument | undefined => {\n      const record = store.assets.find((a) => a.id === ref.id)\n      return record ? assetToDocument(schema, record) : undefined\n    },\n    [store.assets, schema],\n  )\n  const titleOf = useCallback(\n    (ref: DocumentRef): string => {\n      const record = store.assets.find((a) => a.id === ref.id)\n      return record?.title ?? record?.filename ?? ref.id\n    },\n    [store.assets],\n  )\n  const validate = useCallback(\n    (doc: CmsDocument) => validateDocument(registry, doc, { localeConfig: ASSETS_LOCALE_CONFIG }),\n    [registry],\n  )\n  const save = useCallback(\n    (doc: CmsDocument) => store.updateMetadata(doc.id, { meta: documentToAssetMetaPatch(schema, doc) }),\n    [schema, store],\n  )\n  // The unconfirmed delete (the store's usage gate still applies — a referenced\n  // asset comes back `blocked`, surfaced via `lastError`). The UI's delete paths\n  // never land here: row/bulk deletes confirm through the reference dialog and\n  // dispatch `bulkRemove` below.\n  const remove = useCallback((ref: DocumentRef) => store.remove(ref.id), [store])\n  // The CONFIRMED delete the bulk/row path dispatches (EC-433): the reference\n  // dialog has already enumerated inbound usages (asset-shaped, see\n  // `assetReferenceTarget`), so this passes `confirmInUse` exactly like the\n  // detail surface's confirmed delete — same blob + thumb + cache handling.\n  const bulkRemove = useCallback(\n    (ref: DocumentRef) => store.remove(ref.id, { confirmInUse: true }),\n    [store],\n  )\n\n  return useRailViewSource({\n    projectId,\n    schema,\n    capabilities: ASSET_COLLECTION_CAPABILITIES,\n    localeConfig: ASSETS_LOCALE_CONFIG,\n    documents,\n    get,\n    titleOf,\n    // No `referenceCandidates`/`collections`/`isFieldReadOnly` override: assets carry\n    // no relation/asset fields of their own (v1) — nothing cross-collection to\n    // resolve — and read-only follows the factory's default `form.readOnly` check.\n    detailPath: (id: string) => studioPath.asset(id),\n    listPath: studioPath.assets(),\n    // EC-433: the delete confirmation must enumerate ASSET-shaped inbound\n    // references — the document-shaped default would report \"not referenced\"\n    // for a referenced asset.\n    referenceTarget: assetReferenceTarget,\n    validate,\n    create: createUnsupported,\n    save,\n    remove,\n    bulkRemove,\n    normalizeSaveResult: normalizeOkResult,\n    normalizeRemoveResult: normalizeAssetRemoveResult,\n  })\n}\n"]}
+{"version":3,"file":"assets-collection-view-source.js","sourceRoot":"","sources":["../../../src/components/assets/assets-collection-view-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE5C,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGrF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAGrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,wFAAwF;AACxF,MAAM,aAAa,GAAW,IAAI,CAAA;AAClC,MAAM,oBAAoB,GAAiB;IACzC,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,CAAC,aAAa,CAAC;CACzB,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA+B;IACvE,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,KAAK,EAAE,gEAAgE;IAClF,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,KAAK;CACjB,CAAA;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,MAAmB,EAAE,IAAY;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,QAAQ,CAAA;QACxB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,WAAW,CAAA;QAC3B,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,QAAQ,CAAA;QACxB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,UAAU,CAAA;QAC1B,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,KAAK,CAAA;QACrB;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB,EAAE,MAAmB;IAC5E,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAClF,MAAM,CAAC,GAAG,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACtD,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAyB,EACzB,GAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QACjD,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;iFACiF;AACjF,SAAS,iBAAiB;IACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;4EAO4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,MAAyB;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IACnF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,0BAA0B,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,uBAAuB;SAC5H,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAgB;IACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,SAAiB,EACjB,MAAqB;IAErB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAE5E,MAAM,SAAS,GAAG,WAAW,CAC3B,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACnE,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB,CAAA;IACD,MAAM,GAAG,GAAG,WAAW,CACrB,CAAC,GAAgB,EAA2B,EAAE;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,CAAC,EACD,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB,CAAA;IACD,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,GAAgB,EAAU,EAAE;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QACxD,OAAO,MAAM,EAAE,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAA;IACpD,CAAC,EACD,CAAC,KAAK,CAAC,MAAM,CAAC,CACf,CAAA;IACD,MAAM,QAAQ,GAAG,WAAW,CAC1B,CAAC,GAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EAC7F,CAAC,QAAQ,CAAC,CACX,CAAA;IACD,MAAM,IAAI,GAAG,WAAW,CACtB,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,EACnG,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAA;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/E,4EAA4E;IAC5E,kEAAkE;IAClE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAClE,CAAC,KAAK,CAAC,CACR,CAAA;IAED,OAAO,iBAAiB,CAAC;QACvB,SAAS;QACT,MAAM;QACN,YAAY,EAAE,6BAA6B;QAC3C,YAAY,EAAE,oBAAoB;QAClC,SAAS;QACT,GAAG;QACH,OAAO;QACP,kFAAkF;QAClF,2EAA2E;QAC3E,+EAA+E;QAC/E,UAAU,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE;QAC7B,sEAAsE;QACtE,yEAAyE;QACzE,0BAA0B;QAC1B,eAAe,EAAE,oBAAoB;QACrC,QAAQ;QACR,MAAM,EAAE,iBAAiB;QACzB,IAAI;QACJ,MAAM;QACN,UAAU;QACV,mBAAmB,EAAE,iBAAiB;QACtC,qBAAqB,EAAE,0BAA0B;KAClD,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { useCallback, useMemo } from 'react'\nimport type { CmsDocument, CollectionDef, DocumentRef, Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport { createCollectionRegistry, validateDocument } from '@elytracms/core/cms-core'\nimport type { AssetRecord, ReferenceTarget } from '@elytracms/core/persistence'\nimport type { OperationError } from '@elytracms/core/operations'\nimport { studioPath } from '@elytracms/studio/router'\nimport type { DeleteAssetResult } from '@elytracms/studio/lib/assets'\nimport type { CollectionViewSource, CollectionViewCapabilities } from '@elytracms/studio/lib/collection-view/collection-view-source'\nimport { useAssets } from './assets-store'\nimport { SYSTEM_ASSET_FIELDS } from './asset-metadata'\nimport { normalizeOkResult, useRailViewSource } from '../rail-view-source'\n\n/** The assets rail is not localized in v1 (EC-301: asset metadata is non-localized). */\nconst ASSETS_LOCALE: Locale = 'en'\nconst ASSETS_LOCALE_CONFIG: LocaleConfig = {\n  default: ASSETS_LOCALE,\n  locales: [ASSETS_LOCALE],\n}\n\n/**\n * The capability profile of the assets rail (EC-319, EC-433). Hoisted to a\n * module-level constant (no prop/state dependency) so it's both the value the\n * hook returns AND independently unit-testable.\n *\n * `create` is off — a new asset comes from an upload, never a blank draft.\n * `remove` + `bulk` are ON since EC-433: the list's row/bulk delete used to be\n * off deliberately because the generic `ReferenceConfirmDialog` enumerated\n * inbound references as `{ type: 'document' }` targets — the wrong index shape\n * for an asset — which would have shown \"not referenced\" for an asset that IS\n * referenced. That pre-flight now queries the shape THIS source declares via\n * {@link assetReferenceTarget} (`{ type: 'asset' }`, the same lookup the\n * detail surface runs), and the confirmed delete dispatches the SAME checked\n * store delete the detail surface uses (`deleteAsset`: original + EC-400 thumb\n * blobs, then the record — EC-420 lqips ride on the record). Nothing else\n * applies to assets: no publish/versions/locales/inline-edit/live-URL/\n * hierarchy/import-export.\n */\nexport const ASSET_COLLECTION_CAPABILITIES: CollectionViewCapabilities = {\n  publish: false,\n  versions: false,\n  locales: false,\n  inlineEdit: false,\n  create: false,\n  duplicate: false, // EC-442: blob duplication is a different feature, out of scope\n  remove: true,\n  bulk: true,\n  liveUrl: false,\n  hierarchy: false,\n  importExport: false,\n  adminOnly: false,\n}\n\n/** Read one of the record's fixed, upload-managed columns by field name. */\nfunction systemFieldValue(record: AssetRecord, name: string): unknown {\n  switch (name) {\n    case 'filename':\n      return record.filename\n    case 'url':\n      return record.url\n    case 'contentType':\n      return record.contentType\n    case 'byteSize':\n      return record.byteSize\n    case 'width':\n      return record.width\n    case 'height':\n      return record.height\n    case 'storageKey':\n      return record.storageKey\n    case 'title':\n      return record.title\n    default:\n      return undefined\n  }\n}\n\n/**\n * Project a stored asset record into the lens's `values` shape (EC-319), reading\n * only the schema's DECLARED fields — the same \"schema is a lens\" projection the\n * redirects/users rails use. A system column (`filename`, `url`, dimensions, …)\n * reads straight off the record; everything else — the built-in `alt`, a\n * project's own `copyright`/`credit`, or an EC-311 additive field — round-trips\n * through the record's open `meta` bag (EC-301). `alt` is schema-driven but ALSO\n * has a legacy record column: the meta value wins, falling back to the column\n * (matches delivery's `meta.alt ?? record.alt` read and the image field's\n * options dialog).\n */\nexport function assetToDocument(collection: CollectionDef, record: AssetRecord): CmsDocument {\n  const values: Record<string, unknown> = {}\n  for (const field of collection.fields) {\n    if (field.name === 'alt') {\n      const metaAlt = typeof record.meta?.alt === 'string' ? record.meta.alt : undefined\n      values.alt = metaAlt ?? record.alt\n      continue\n    }\n    values[field.name] = SYSTEM_ASSET_FIELDS.has(field.name)\n      ? systemFieldValue(record, field.name)\n      : record.meta?.[field.name]\n  }\n  return { collection: collection.id, id: record.id, values }\n}\n\n/**\n * The inverse of {@link assetToDocument}: the schema-driven meta bag a save\n * writes back — every declared field OUTSIDE the system set (EC-301/EC-311),\n * keyed exactly as the record stores it. System columns are upload-managed and\n * never written here.\n */\nexport function documentToAssetMetaPatch(\n  collection: CollectionDef,\n  doc: CmsDocument,\n): Record<string, unknown> {\n  const values = doc.values ?? {}\n  const meta: Record<string, unknown> = {}\n  for (const field of collection.fields) {\n    if (SYSTEM_ASSET_FIELDS.has(field.name)) continue\n    if (field.name in values) meta[field.name] = values[field.name]\n  }\n  return meta\n}\n\n/** `create` when `capabilities.create === false` — never reached from the UI\n *  (list/detail never call it); an explicit throw rather than a silent no-op. */\nfunction createUnsupported(): DocumentRef {\n  throw new Error('assets are created by upload, not the assets rail')\n}\n\n/** Assets' `remove()` returns an `outcome`-discriminated {@link DeleteAssetResult}\n *  (not the `{ ok }` shape users/redirects use, EC-327). `'error'` surfaces as-is;\n *  `'blocked'` (the unconfirmed usage gate fired — nothing was removed) surfaces\n *  as an explicit failure too (EC-433): a delete that left the asset in place\n *  must NEVER look like success. It is unreachable from this rail's UI — every\n *  delete path confirms through the reference dialog and dispatches with\n *  `confirmInUse` — but stays honest for any direct caller. `'not-found'` maps\n *  to success (idempotent delete: the desired end state — gone — holds). */\nexport function normalizeAssetRemoveResult(result: DeleteAssetResult): OperationError | null {\n  if (result.outcome === 'error') return { code: 'unknown', message: result.message }\n  if (result.outcome === 'blocked') {\n    return {\n      code: 'unknown',\n      message: `Asset is referenced in ${result.usageCount} ${result.usageCount === 1 ? 'place' : 'places'} and was not deleted.`,\n    }\n  }\n  return null\n}\n\n/**\n * How an asset row is addressed in the EC-155 reference index (EC-433):\n * `{ type: 'asset' }`, never the document shape — so the delete confirmation's\n * inbound pre-flight counts the SAME references `loadInboundAssetReferenceViews`\n * (the detail surface's check) does.\n */\nexport function assetReferenceTarget(ref: DocumentRef): ReferenceTarget {\n  return { type: 'asset', id: ref.id }\n}\n\n/**\n * Assemble a {@link CollectionViewSource} for the **assets rail** (EC-319) — the\n * portable list surface over the existing asset library store instead of a\n * bespoke listing. `schema` is the DEPLOYMENT-resolved `kind:'asset'` collection\n * (EC-311: a project's own declared fields, or a mount's `nav.assets({ fields })`\n * override merged over it — see `resolveAssetsSchema` in `app-views/default-modules.tsx`),\n * never a hardcoded engine default — so a project's `copyright`/`credit`/… fields\n * (and any EC-311 override) drive the list's columns/filters exactly as they\n * drive the image field's options dialog.\n *\n * Must be mounted under an `<AssetsProvider>` (for {@link useAssets}) — already\n * ambient at the project level (EC-195), so callers rarely mount their own.\n *\n * The shared scaffold (`useRailViewSource`, EC-327) owns `viewState`/`lastError`\n * plumbing and the assembled source; this hook supplies only the asset-store\n * reads/writes, the capability profile, and the projections above.\n */\nexport function useAssetsCollectionViewSource(\n  projectId: string,\n  schema: CollectionDef,\n): CollectionViewSource {\n  const store = useAssets()\n  const registry = useMemo(() => createCollectionRegistry([schema]), [schema])\n\n  const documents = useCallback(\n    () => store.assets.map((record) => assetToDocument(schema, record)),\n    [store.assets, schema],\n  )\n  const get = useCallback(\n    (ref: DocumentRef): CmsDocument | undefined => {\n      const record = store.assets.find((a) => a.id === ref.id)\n      return record ? assetToDocument(schema, record) : undefined\n    },\n    [store.assets, schema],\n  )\n  const titleOf = useCallback(\n    (ref: DocumentRef): string => {\n      const record = store.assets.find((a) => a.id === ref.id)\n      return record?.title ?? record?.filename ?? ref.id\n    },\n    [store.assets],\n  )\n  const validate = useCallback(\n    (doc: CmsDocument) => validateDocument(registry, doc, { localeConfig: ASSETS_LOCALE_CONFIG }),\n    [registry],\n  )\n  const save = useCallback(\n    (doc: CmsDocument) => store.updateMetadata(doc.id, { meta: documentToAssetMetaPatch(schema, doc) }),\n    [schema, store],\n  )\n  // The unconfirmed delete (the store's usage gate still applies — a referenced\n  // asset comes back `blocked`, surfaced via `lastError`). The UI's delete paths\n  // never land here: row/bulk deletes confirm through the reference dialog and\n  // dispatch `bulkRemove` below.\n  const remove = useCallback((ref: DocumentRef) => store.remove(ref.id), [store])\n  // The CONFIRMED delete the bulk/row path dispatches (EC-433): the reference\n  // dialog has already enumerated inbound usages (asset-shaped, see\n  // `assetReferenceTarget`), so this passes `confirmInUse` exactly like the\n  // detail surface's confirmed delete — same blob + thumb + cache handling.\n  const bulkRemove = useCallback(\n    (ref: DocumentRef) => store.remove(ref.id, { confirmInUse: true }),\n    [store],\n  )\n\n  return useRailViewSource({\n    projectId,\n    schema,\n    capabilities: ASSET_COLLECTION_CAPABILITIES,\n    localeConfig: ASSETS_LOCALE_CONFIG,\n    documents,\n    get,\n    titleOf,\n    // No `referenceCandidates`/`collections`/`isFieldReadOnly` override: assets carry\n    // no relation/asset fields of their own (v1) — nothing cross-collection to\n    // resolve — and read-only follows the factory's default `form.readOnly` check.\n    detailPath: (id: string) => studioPath.asset(id),\n    listPath: studioPath.assets(),\n    // EC-433: the delete confirmation must enumerate ASSET-shaped inbound\n    // references — the document-shaped default would report \"not referenced\"\n    // for a referenced asset.\n    referenceTarget: assetReferenceTarget,\n    validate,\n    create: createUnsupported,\n    save,\n    remove,\n    bulkRemove,\n    normalizeSaveResult: normalizeOkResult,\n    normalizeRemoveResult: normalizeAssetRemoveResult,\n  })\n}\n"]}

package/dist/components/cms/collection-table.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Link, STUDIO_PROJECT_ROUTE, studioPath, useNavigate } from '@elytracms/studio/router';
-import { ArrowDown, ArrowUp, CornerDownRight, Download, Eye, EyeOff, ExternalLink, MoreHorizontal, Pencil, Plus, Trash2, Upload, } from 'lucide-react';
+import { ArrowDown, ArrowUp, Copy, CornerDownRight, Download, Eye, EyeOff, ExternalLink, MoreHorizontal, Pencil, Plus, Trash2, Upload, } from 'lucide-react';
 import { useMemo, useState } from 'react';
 import { orderHierarchically, resolveDocumentForLocale, resolveDocumentTitle, validateCollectionShape, } from '@elytracms/core/cms-core';
-import { Button, Code, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger, Row, Separator, Spacer, Stack, Text, } from '@elytracms/studio/ui';
+import { Button, Code, DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger, Row, Separator, Spacer, Stack, Text, toast, } from '@elytracms/studio/ui';
 import { cn } from '@elytracms/studio/lib/utils';
 import { localizedLabel, translate } from '@elytracms/studio/lib/i18n';
 import { LocaleSwitcher, resolveDisplayedValue } from '@elytracms/studio/lib/locale';
@@ -19,6 +19,7 @@ import { cmsIssueLabel } from '@elytracms/studio/lib/persona/labels';
 import { TriangleAlert } from 'lucide-react';
 import { BulkBar, BulkReportPanel } from './bulk-bar.js';
 import { rowActionsFor } from './row-actions.js';
+import { duplicateFromSource } from './duplicate-document.js';
 import { CHECKBOX_COLUMN_WIDTH_REM, PRIMARY_COLUMN_WIDTH_REM, ROW_ACTIONS_COLUMN_WIDTH_REM, STATE_COLUMN_WIDTH_REM, URL_COLUMN_WIDTH_REM, columnWidthRem, } from './column-width.js';
 import { ReferenceConfirmDialog } from './reference-confirm.js';
 import { FilterControl } from './filter-builder.js';
@@ -167,6 +168,20 @@ export function LoadedCollectionTable({ projectId, toolbarExtra, }) {
             navigate({ to: STUDIO_PROJECT_ROUTE, params: { projectId, _splat: splat } });
             return;
         }
+        // EC-442: duplicate the row's draft into a fresh DRAFT document (never
+        // auto-published) through the seam's existing create+save write paths,
+        // then land on the new draft's editor — the same navigation `+ New` takes.
+        // The action is offered iff `capabilities.create` + a detail surface
+        // (`rowActionsFor`), the New button's exact gate.
+        if (action === 'duplicate') {
+            const newRef = duplicateFromSource(source, doc);
+            toast.success(translate('cms.editor.duplicateCreated'));
+            const splat = source.detailPath?.(newRef.id);
+            if (splat === undefined)
+                return;
+            navigate({ to: STUDIO_PROJECT_ROUTE, params: { projectId, _splat: splat } });
+            return;
+        }
         if (action === 'publish') {
             void handleBulk(action, [doc.id]);
             return;
@@ -290,6 +305,8 @@ function RowActionItem({ action, onSelect }) {
     switch (action) {
         case 'open':
             return (_jsxs(DropdownMenuItem, { onClick: onSelect, "data-testid": "row-action-open", children: [_jsx(Pencil, {}), " ", translate('cms.list.rowAction.open')] }));
+        case 'duplicate':
+            return (_jsxs(DropdownMenuItem, { onClick: onSelect, "data-testid": "row-action-duplicate", children: [_jsx(Copy, {}), " ", translate('common.duplicate')] }));
         case 'publish':
             return (_jsxs(DropdownMenuItem, { onClick: onSelect, "data-testid": "row-action-publish", children: [_jsx(Eye, {}), " ", translate('cms.list.bulk.publish')] }));
         case 'unpublish':