@elytracms/studio 0.0.78 → 0.0.80

package/dist/components/project-session.js

@@ -2,7 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useCallback, useEffect } from 'react';
 import { getStudioOperations, loadHydratedCms, loadProjectSession } from '@elytracms/studio/lib/operations';
 import { isPlaygroundMode } from '@elytracms/studio/lib/persistence';
-import { configureContentSession } from '@elytracms/studio/lib/data';
+import { configureContentSession, isContentSessionWrite, markContentSessionStale, notePlaygroundWriteForUnloadGuard, registerContentSessionRefresher, } from '@elytracms/studio/lib/data';
 import { resolveDeploymentLocaleConfig, resolveDeploymentRoutes } from '@elytracms/studio/lib/workspace';
 import { createRequiredContext } from '@elytracms/studio/lib/required-context';
 import { HydrationBoundary, useHydrationPhase } from './use-hydration-phase.js';
@@ -31,23 +31,30 @@ export function contentSessionOf(cms, routes = resolveDeploymentRoutes(), locale
 }
 /**
  * Load the CURRENT persisted CMS state and point the preview content engine at
- * it — the framework-free core of `loadCms` (both modes run it; EC-361). The
- * playground return contract (EC-320) is pinned here: the GATE value is always
- * `{ ok: true, value: null }` in playground — CMS surfaces keep their
- * config/fixture baseline — while the content session above still hydrates
- * from the in-memory adapter (a load failure is loud, never a silent empty
- * preview).
+ * it — the framework-free core of `loadCms` (both modes run it; EC-361).
+ *
+ * EC-461 — the gate value is the REAL hydration result in BOTH modes now. The
+ * old EC-320 playground contract (`{ ok: true, value: null }` — CMS surfaces
+ * keep their static config/fixture baseline forever) was the root of the
+ * playground loss family: every cross-section navigation remounted
+ * `CmsProvider` from the static seed, so same-session edits vanished from the
+ * CMS surfaces even though the in-memory adapter still held them — and any
+ * write issued from that re-seeded session (e.g. an autosave) then clobbered
+ * the adapter's newer record with the stale baseline. The seeded in-memory
+ * adapter IS a persisted backend behind the operations seam (AD-17), so the
+ * playground hydrates from it per CMS mount exactly like connected mode
+ * hydrates from Convex; a fresh boot returns the deterministic seed, so
+ * fixture reproducibility (EC-138) is preserved in substance. A failure is
+ * loud twice over: logged here (for the fire-and-forget refresh callers) and
+ * rendered as the gate's retryable error state.
  */
-export async function loadCmsIntoSession(operations, projectId, playground) {
+export async function loadCmsIntoSession(operations, projectId) {
     const result = await loadHydratedCms(operations, projectId);
     // Keep the preview engine in sync with the freshest persisted content.
     if (result.ok && result.value !== null)
         configureContentSession(contentSessionOf(result.value));
-    if (playground) {
-        if (!result.ok)
-            console.error('[elytra] playground content-session load failed', result.error);
-        return { ok: true, value: null };
-    }
+    if (!result.ok)
+        console.error('[elytra] content-session load failed', result.error);
     return result;
 }
 export function ProjectSessionProvider({ projectId, children, }) {
@@ -71,15 +78,45 @@ export function ProjectSessionProvider({ projectId, children, }) {
     // Leaving the project resets the preview engine to fixtures; the next
     // project's gate reconfigures it before rendering its own children.
     useEffect(() => () => configureContentSession(null), []);
-    // EC-361: the playground runs the SAME load (over the seeded in-memory
-    // adapter) for the content-session side effect, but the GATE value stays
-    // `null` — CMS surfaces keep their config/fixture baseline (EC-320's
-    // static-baseline rule), matching the pre-EC-361 playground contract. The
-    // pure core (`loadCmsIntoSession`, above) carries + pins that contract.
+    // EC-361/EC-461: both modes run the SAME load — the content-session side
+    // effect plus the REAL hydration value for the CMS gates. (EC-320's
+    // playground null-mask is retired: it was the loss family's root — see
+    // `loadCmsIntoSession`.)
     const loadCms = useCallback(async () => {
         const { operations } = await getStudioOperations();
-        return loadCmsIntoSession(operations, projectId, playground);
-    }, [playground, projectId]);
+        return loadCmsIntoSession(operations, projectId);
+    }, [projectId]);
+    // EC-460: keep the preview content session in sync with WRITES. Every
+    // succeeded content-bearing command (documents/schema/assets) on the shared
+    // operations event bus marks the session stale; the registered refresher —
+    // this provider's own `loadCms`, i.e. the identical hydration path both
+    // modes already run — re-points it (debounced, and only while a preview
+    // consumer is mounted; see `content-session-refresh.ts`). Before this, the
+    // session refreshed only at boot + CMS-surface mounts, so a canvas opened
+    // after authoring/publishing resolved listings and relation picks against a
+    // stale snapshot: the EC-276 empty-listing / 1-of-3-relations family.
+    useEffect(() => {
+        const unregister = registerContentSessionRefresher(() => loadCms());
+        let unsubscribe;
+        let cancelled = false;
+        void getStudioOperations().then(({ operations }) => {
+            if (cancelled)
+                return;
+            unsubscribe = operations.events.subscribe((event) => {
+                if (isContentSessionWrite(event))
+                    markContentSessionStale();
+                // EC-461: the first authored playground write arms the beforeunload
+                // guard for the rest of the page's life (module-level — surviving this
+                // provider's unmount, because the in-memory world does too).
+                notePlaygroundWriteForUnloadGuard(event);
+            });
+        });
+        return () => {
+            cancelled = true;
+            unregister();
+            unsubscribe?.();
+        };
+    }, [loadCms]);
     // EC-361: playground boot hydration for the content preview engine — the same
     // loader connected mode gates on, fired WITHOUT gating so the synchronous
     // playground first render (EC-138) is preserved. `loadCms` owns the
@@ -94,28 +131,27 @@ export function ProjectSessionProvider({ projectId, children, }) {
 }
 export { useProjectSession };
 /**
- * Gate one CMS surface mount on a FRESH persisted CMS load (Convex mode).
+ * Gate one CMS surface mount on a FRESH persisted CMS load — BOTH modes.
  * Render-prop: hands the hydrated content (or `null` → fixture fallback,
- * first-run) to the caller once it resolved. Playground renders synchronously
- * with `null`. Unlike `ProjectSessionProvider`, this gate owns no
- * `configureContentSession` side effect of its own — `loadCms` (from
- * `useProjectSession`) already calls it internally when it resolves — so no
- * `onResolved`/`enabled` is passed here.
+ * first-run / un-baselined kit) to the caller once it resolved. Unlike
+ * `ProjectSessionProvider`, this gate owns no `configureContentSession` side
+ * effect of its own — `loadCms` (from `useProjectSession`) already calls it
+ * internally when it resolves — so no `onResolved`/`enabled` is passed here.
  *
- * EC-361: in playground the gate stays synchronous (fixture baseline, EC-138),
- * but `loadCms` is still fired per mount for its content-session side effect —
- * the preview engine refreshes from the in-memory adapter on the same
- * per-CMS-mount rhythm connected mode gets from the gated load.
+ * EC-461: the playground gates on the SAME async hydration as connected mode
+ * (over the seeded in-memory adapter, resolved in microtasks). The old
+ * synchronous `null` fast-path (EC-320/EC-361) made every remounted CMS
+ * session re-seed the STATIC baseline, which both hid and then destroyed
+ * same-session edits — the playground loss family. A fresh playground boot
+ * hydrates the deterministic seed, so fixture reproducibility is unchanged in
+ * substance; only a microtask-long loading frame replaced the synchronous
+ * first render HERE (`ProjectSessionProvider`'s EC-138 playground fast-path is
+ * untouched).
  */
 export function CmsSessionGate({ children, }) {
     const { loadCms } = useProjectSession();
-    const playground = isPlaygroundMode();
-    useEffect(() => {
-        if (playground)
-            void loadCms();
-    }, [playground, loadCms]);
     const { phase, retry } = useHydrationPhase(loadCms, {
-        playground,
+        playground: false,
         playgroundValue: null,
     });
     return (_jsx(HydrationBoundary, { phase: phase, retry: retry, children: children }));

package/dist/components/project-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-session.js","sourceRoot":"","sources":["../../src/components/project-session.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAO3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACxG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AA2D5E,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,iBAAiB,EAAE,GACtE,qBAAqB,CAAsB,gBAAgB,CAAC,CAAA;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,SAAiC,uBAAuB,EAAE,EAC1D,eAAyC,6BAA6B,EAAE;IAExE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA4B,EAC5B,SAAiB,EACjB,UAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC3D,uEAAuE;IACvE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/F,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,SAAS,EACT,QAAQ,GAIT;IACC,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;IAErC,MAAM,MAAM,GAAG,WAAW,CACxB,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAC/F,CAAC,SAAS,CAAC,CACZ,CAAA;IACD,wEAAwE;IACxE,4EAA4E;IAC5E,gEAAgE;IAChE,wEAAwE;IACxE,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,OAAsC,EAAE,EAAE;QACxE,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAA;IACjE,CAAC,EAAE,EAAE,CAAC,CAAA;IACN,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAgC,MAAM,EAAE;QAChF,UAAU;QACV,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,IAAI;QACb,UAAU;KACX,CAAC,CAAA;IAEF,sEAAsE;IACtE,oEAAoE;IACpE,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAExD,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAkD,EAAE;QACnF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAClD,OAAO,kBAAkB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IAC9D,CAAC,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;IAE3B,8EAA8E;IAC9E,0EAA0E;IAC1E,oEAAoE;IACpE,+EAA+E;IAC/E,2EAA2E;IAC3E,8DAA8D;IAC9D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU;YAAE,KAAK,OAAO,EAAE,CAAA;IAChC,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAEzB,OAAO,CACL,KAAC,iBAAiB,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CACZ,KAAC,qBAAqB,CAAC,QAAQ,IAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YACxD,QAAQ,GACsB,CAClC,GACiB,CACrB,CAAA;AACH,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,GAGT;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,EAAE,CAAA;IACvC,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;IACrC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU;YAAE,KAAK,OAAO,EAAE,CAAA;IAChC,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAqB,OAAO,EAAE;QACtE,UAAU;QACV,eAAe,EAAE,IAAI;KACtB,CAAC,CAAA;IACF,OAAO,CACL,KAAC,iBAAiB,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAC1C,QAAQ,GACS,CACrB,CAAA;AACH,CAAC","sourcesContent":["import { useCallback, useEffect } from 'react'\nimport type { ReactNode } from 'react'\nimport type { LocaleConfig, RouteRecord } from '@elytracms/core/cms-core'\nimport { getStudioOperations, loadHydratedCms, loadProjectSession } from '@elytracms/studio/lib/operations'\nimport type {\n  HydratedCms,\n  HydratedProjectSession,\n  OperationResult,\n  OperationsClient,\n} from '@elytracms/studio/lib/operations'\nimport { isPlaygroundMode } from '@elytracms/studio/lib/persistence'\nimport { configureContentSession } from '@elytracms/studio/lib/data'\nimport type { ContentSessionState } from '@elytracms/studio/lib/data'\nimport { resolveDeploymentLocaleConfig, resolveDeploymentRoutes } from '@elytracms/studio/lib/workspace'\nimport { createRequiredContext } from '@elytracms/studio/lib/required-context'\nimport { HydrationBoundary, useHydrationPhase } from './use-hydration-phase'\n\n/**\n * Project-session hydration gate (Milestone B sign-off fix, EC-177 gap 1).\n *\n * In Convex mode every project session must BOOT from persistence: the\n * builder from the latest persisted graph revision, the CMS from the saved\n * schema + documents, publishing from the persisted environment states.\n * This provider runs the `@elytracms/core/operations` hydration queries\n * (`lib/operations/session-hydration`) and — like `DeploymentSetupGate` — gates its\n * children on a deterministic loading state, so fixture content never\n * flashes (and is never editable) before the persisted state arrives.\n *\n * Playground mode renders children synchronously with `session: null`\n * (fixtures), byte-identical to the pre-hydration behavior — the EC-138\n * determinism contract.\n *\n * Side effect on hydration: the content preview engine\n * (`lib/data/collection-content`) is pointed at the hydrated documents\n * BEFORE children render, so \"Preview with\" lists and section previews show\n * live entries, not fixture titles.\n *\n * EC-361 — the playground gets the SAME side effect, without the render gate:\n * the seeded in-memory adapter IS a persisted backend behind the operations\n * seam (AD-17), so the content session hydrates from it through the identical\n * `loadHydratedCms` loader connected mode uses — fire-and-forget after the\n * synchronous first render (EC-138 stays intact), refreshed per CMS surface\n * mount exactly like connected's `CmsSessionGate` → `loadCms` rhythm. Canvas\n * listing/relation population therefore resolves from in-memory session\n * documents with connected-mode semantics (published-ness = the version\n * pointer; the Draft view resolves live rows) instead of the blanket-empty\n * session the playground used to run with. The React `session`/`loadCms`\n * VALUES stay `null` in playground — the CMS surfaces keep their fixture\n * baseline (EC-320's static-baseline rule); only the preview content engine\n * reads persisted state.\n *\n * EC-308/AD-17 note — this gate deliberately does NOT read through the\n * `useOperationQuery` cache seam. It is boot/session orchestration, not a\n * cacheable server read: (1) the synchronous playground first-render is the\n * EC-138 determinism contract (a pull-query is async even when disabled);\n * (2) `configureContentSession` must run synchronously BEFORE children mount,\n * which a post-render query effect cannot guarantee; (3) `CmsSessionGate` is\n * intentionally fresh-per-visit (it remounts to show edits persisted since\n * project open) — the opposite of a cached read. It still reads through the\n * operations client (no transport bypass), and uses a user-driven retry epoch,\n * not freshness machinery — so it is outside the patchwork AD-17 retires.\n */\n\nexport interface ProjectSessionStore {\n  /** Hydrated persisted state (Convex mode); `null` in playground (fixtures). */\n  session: HydratedProjectSession | null\n  /**\n   * Load the CURRENT persisted CMS state (fresh query — the CMS section\n   * remounts per visit and must show edits persisted since project open).\n   * Playground resolves `null` immediately (fixtures).\n   */\n  loadCms(): Promise<OperationResult<HydratedCms | null>>\n}\n\nconst { Context: ProjectSessionContext, useRequired: useProjectSession } =\n  createRequiredContext<ProjectSessionStore>('ProjectSession')\n\n/**\n * Compose the preview content-session state from a hydrated CMS load plus the\n * config-owned deployment seams — the ONE place hydrated content meets config:\n *\n * - `routes` (EC-291): the config-sourced routes, so the canvas `resolveLink`\n *   derives a rich-text link's URL exactly as delivery does.\n * - `localeConfig` (EC-385): the active config project's declared locales\n *   (AD-11 — locales are structure, structure is code), so canvas content\n *   clients evaluate locale-shaped values (EC-018 fallback, localized\n *   filter/sort) over the PROJECT's locale set, never the sample `en/de`\n *   fixture. Without a config project (env-only wiring) the key stays absent\n *   and the preview engine keeps its sample-config default, mirroring the CMS\n *   surface ladder (`resolveCmsInitialLocaleConfig`).\n *\n * The parameters exist purely as a unit-test seam (house pattern, same as\n * `resolveCmsInitialCollections`); app code always uses the defaults.\n */\nexport function contentSessionOf(\n  cms: HydratedCms | null,\n  routes: readonly RouteRecord[] = resolveDeploymentRoutes(),\n  localeConfig: LocaleConfig | undefined = resolveDeploymentLocaleConfig(),\n): ContentSessionState | null {\n  if (!cms) return null\n  return { ...cms, routes, ...(localeConfig ? { localeConfig } : {}) }\n}\n\n/**\n * Load the CURRENT persisted CMS state and point the preview content engine at\n * it — the framework-free core of `loadCms` (both modes run it; EC-361). The\n * playground return contract (EC-320) is pinned here: the GATE value is always\n * `{ ok: true, value: null }` in playground — CMS surfaces keep their\n * config/fixture baseline — while the content session above still hydrates\n * from the in-memory adapter (a load failure is loud, never a silent empty\n * preview).\n */\nexport async function loadCmsIntoSession(\n  operations: OperationsClient,\n  projectId: string,\n  playground: boolean,\n): Promise<OperationResult<HydratedCms | null>> {\n  const result = await loadHydratedCms(operations, projectId)\n  // Keep the preview engine in sync with the freshest persisted content.\n  if (result.ok && result.value !== null) configureContentSession(contentSessionOf(result.value))\n  if (playground) {\n    if (!result.ok) console.error('[elytra] playground content-session load failed', result.error)\n    return { ok: true, value: null }\n  }\n  return result\n}\n\nexport function ProjectSessionProvider({\n  projectId,\n  children,\n}: {\n  projectId: string\n  children: ReactNode\n}) {\n  const playground = isPlaygroundMode()\n\n  const loader = useCallback(\n    () => getStudioOperations().then(({ operations }) => loadProjectSession(operations, projectId)),\n    [projectId],\n  )\n  // Point the preview content engine at the hydrated documents BEFORE any\n  // child renders (panels read it module-level, synchronously), composed with\n  // the config-owned routes (EC-291) + locale config (EC-385) via\n  // `contentSessionOf`. `enabled: true` below runs this in the playground\n  // fast-path too (with `session: null`) — the one divergence from\n  // `CmsSessionGate`, which owns no such side effect.\n  const onResolved = useCallback((session: HydratedProjectSession | null) => {\n    configureContentSession(contentSessionOf(session?.cms ?? null))\n  }, [])\n  const { phase, retry } = useHydrationPhase<HydratedProjectSession | null>(loader, {\n    playground,\n    playgroundValue: null,\n    enabled: true,\n    onResolved,\n  })\n\n  // Leaving the project resets the preview engine to fixtures; the next\n  // project's gate reconfigures it before rendering its own children.\n  useEffect(() => () => configureContentSession(null), [])\n\n  // EC-361: the playground runs the SAME load (over the seeded in-memory\n  // adapter) for the content-session side effect, but the GATE value stays\n  // `null` — CMS surfaces keep their config/fixture baseline (EC-320's\n  // static-baseline rule), matching the pre-EC-361 playground contract. The\n  // pure core (`loadCmsIntoSession`, above) carries + pins that contract.\n  const loadCms = useCallback(async (): Promise<OperationResult<HydratedCms | null>> => {\n    const { operations } = await getStudioOperations()\n    return loadCmsIntoSession(operations, projectId, playground)\n  }, [playground, projectId])\n\n  // EC-361: playground boot hydration for the content preview engine — the same\n  // loader connected mode gates on, fired WITHOUT gating so the synchronous\n  // playground first render (EC-138) is preserved. `loadCms` owns the\n  // `configureContentSession` side effect; the resolved value is discarded here.\n  // Runs after `useHydrationPhase`'s fast-path effect (registered above) has\n  // reset the session, so the hydrated state always lands last.\n  useEffect(() => {\n    if (playground) void loadCms()\n  }, [playground, loadCms])\n\n  return (\n    <HydrationBoundary phase={phase} retry={retry}>\n      {(session) => (\n        <ProjectSessionContext.Provider value={{ session, loadCms }}>\n          {children}\n        </ProjectSessionContext.Provider>\n      )}\n    </HydrationBoundary>\n  )\n}\n\nexport { useProjectSession }\n\n/**\n * Gate one CMS surface mount on a FRESH persisted CMS load (Convex mode).\n * Render-prop: hands the hydrated content (or `null` → fixture fallback,\n * first-run) to the caller once it resolved. Playground renders synchronously\n * with `null`. Unlike `ProjectSessionProvider`, this gate owns no\n * `configureContentSession` side effect of its own — `loadCms` (from\n * `useProjectSession`) already calls it internally when it resolves — so no\n * `onResolved`/`enabled` is passed here.\n *\n * EC-361: in playground the gate stays synchronous (fixture baseline, EC-138),\n * but `loadCms` is still fired per mount for its content-session side effect —\n * the preview engine refreshes from the in-memory adapter on the same\n * per-CMS-mount rhythm connected mode gets from the gated load.\n */\nexport function CmsSessionGate({\n  children,\n}: {\n  children: (cms: HydratedCms | null) => ReactNode\n}) {\n  const { loadCms } = useProjectSession()\n  const playground = isPlaygroundMode()\n  useEffect(() => {\n    if (playground) void loadCms()\n  }, [playground, loadCms])\n  const { phase, retry } = useHydrationPhase<HydratedCms | null>(loadCms, {\n    playground,\n    playgroundValue: null,\n  })\n  return (\n    <HydrationBoundary phase={phase} retry={retry}>\n      {children}\n    </HydrationBoundary>\n  )\n}\n"]}
+{"version":3,"file":"project-session.js","sourceRoot":"","sources":["../../src/components/project-session.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAO3G,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AACxG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAmE5E,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,iBAAiB,EAAE,GACtE,qBAAqB,CAAsB,gBAAgB,CAAC,CAAA;AAE9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,SAAiC,uBAAuB,EAAE,EAC1D,eAAyC,6BAA6B,EAAE;IAExE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA4B,EAC5B,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAC3D,uEAAuE;IACvE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/F,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IACnF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EACrC,SAAS,EACT,QAAQ,GAIT;IACC,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;IAErC,MAAM,MAAM,GAAG,WAAW,CACxB,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAC/F,CAAC,SAAS,CAAC,CACZ,CAAA;IACD,wEAAwE;IACxE,4EAA4E;IAC5E,gEAAgE;IAChE,wEAAwE;IACxE,iEAAiE;IACjE,oDAAoD;IACpD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,OAAsC,EAAE,EAAE;QACxE,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAA;IACjE,CAAC,EAAE,EAAE,CAAC,CAAA;IACN,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAgC,MAAM,EAAE;QAChF,UAAU;QACV,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,IAAI;QACb,UAAU;KACX,CAAC,CAAA;IAEF,sEAAsE;IACtE,oEAAoE;IACpE,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAExD,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,yBAAyB;IACzB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAkD,EAAE;QACnF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAClD,OAAO,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IAClD,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,sEAAsE;IACtE,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,UAAU,GAAG,+BAA+B,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QACnE,IAAI,WAAqC,CAAA;QACzC,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,KAAK,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;YACjD,IAAI,SAAS;gBAAE,OAAM;YACrB,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClD,IAAI,qBAAqB,CAAC,KAAK,CAAC;oBAAE,uBAAuB,EAAE,CAAA;gBAC3D,oEAAoE;gBACpE,uEAAuE;gBACvE,6DAA6D;gBAC7D,iCAAiC,CAAC,KAAK,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;YAChB,UAAU,EAAE,CAAA;YACZ,WAAW,EAAE,EAAE,CAAA;QACjB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,8EAA8E;IAC9E,0EAA0E;IAC1E,oEAAoE;IACpE,+EAA+E;IAC/E,2EAA2E;IAC3E,8DAA8D;IAC9D,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU;YAAE,KAAK,OAAO,EAAE,CAAA;IAChC,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAEzB,OAAO,CACL,KAAC,iBAAiB,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CACZ,KAAC,qBAAqB,CAAC,QAAQ,IAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YACxD,QAAQ,GACsB,CAClC,GACiB,CACrB,CAAA;AACH,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,GAGT;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,EAAE,CAAA;IACvC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAqB,OAAO,EAAE;QACtE,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,IAAI;KACtB,CAAC,CAAA;IACF,OAAO,CACL,KAAC,iBAAiB,IAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAC1C,QAAQ,GACS,CACrB,CAAA;AACH,CAAC","sourcesContent":["import { useCallback, useEffect } from 'react'\nimport type { ReactNode } from 'react'\nimport type { LocaleConfig, RouteRecord } from '@elytracms/core/cms-core'\nimport { getStudioOperations, loadHydratedCms, loadProjectSession } from '@elytracms/studio/lib/operations'\nimport type {\n  HydratedCms,\n  HydratedProjectSession,\n  OperationResult,\n  OperationsClient,\n} from '@elytracms/studio/lib/operations'\nimport { isPlaygroundMode } from '@elytracms/studio/lib/persistence'\nimport {\n  configureContentSession,\n  isContentSessionWrite,\n  markContentSessionStale,\n  notePlaygroundWriteForUnloadGuard,\n  registerContentSessionRefresher,\n} from '@elytracms/studio/lib/data'\nimport type { ContentSessionState } from '@elytracms/studio/lib/data'\nimport { resolveDeploymentLocaleConfig, resolveDeploymentRoutes } from '@elytracms/studio/lib/workspace'\nimport { createRequiredContext } from '@elytracms/studio/lib/required-context'\nimport { HydrationBoundary, useHydrationPhase } from './use-hydration-phase'\n\n/**\n * Project-session hydration gate (Milestone B sign-off fix, EC-177 gap 1).\n *\n * In Convex mode every project session must BOOT from persistence: the\n * builder from the latest persisted graph revision, the CMS from the saved\n * schema + documents, publishing from the persisted environment states.\n * This provider runs the `@elytracms/core/operations` hydration queries\n * (`lib/operations/session-hydration`) and — like `DeploymentSetupGate` — gates its\n * children on a deterministic loading state, so fixture content never\n * flashes (and is never editable) before the persisted state arrives.\n *\n * Playground mode renders children synchronously with `session: null`\n * (fixtures), byte-identical to the pre-hydration behavior — the EC-138\n * determinism contract.\n *\n * Side effect on hydration: the content preview engine\n * (`lib/data/collection-content`) is pointed at the hydrated documents\n * BEFORE children render, so \"Preview with\" lists and section previews show\n * live entries, not fixture titles.\n *\n * EC-361 — the playground gets the SAME side effect, without the render gate:\n * the seeded in-memory adapter IS a persisted backend behind the operations\n * seam (AD-17), so the content session hydrates from it through the identical\n * `loadHydratedCms` loader connected mode uses — fire-and-forget after the\n * synchronous first render (EC-138 stays intact), refreshed per CMS surface\n * mount exactly like connected's `CmsSessionGate` → `loadCms` rhythm. Canvas\n * listing/relation population therefore resolves from in-memory session\n * documents with connected-mode semantics (published-ness = the version\n * pointer; the Draft view resolves live rows) instead of the blanket-empty\n * session the playground used to run with.\n *\n * EC-461 — `CmsSessionGate`/`loadCms` hydrate the CMS surfaces from the\n * adapter in the playground too now. The old EC-320 \"static-baseline rule\"\n * (gate value pinned `null`; CMS sessions re-seeded the fixture baseline on\n * every mount) is retired: it made every cross-section navigation silently\n * revert the visible world to the seed, and a subsequent autosave from that\n * re-seeded session destroyed the adapter's newer record — the EC-276/EC-461\n * playground loss family. Only this provider's OWN `session` value keeps the\n * playground `null` fast-path (boot determinism, EC-138 below).\n *\n * EC-308/AD-17 note — this gate deliberately does NOT read through the\n * `useOperationQuery` cache seam. It is boot/session orchestration, not a\n * cacheable server read: (1) the synchronous playground first-render is the\n * EC-138 determinism contract (a pull-query is async even when disabled);\n * (2) `configureContentSession` must run synchronously BEFORE children mount,\n * which a post-render query effect cannot guarantee; (3) `CmsSessionGate` is\n * intentionally fresh-per-visit (it remounts to show edits persisted since\n * project open) — the opposite of a cached read. It still reads through the\n * operations client (no transport bypass), and uses a user-driven retry epoch,\n * not freshness machinery — so it is outside the patchwork AD-17 retires.\n */\n\nexport interface ProjectSessionStore {\n  /** Hydrated persisted state (Convex mode); `null` in playground (fixtures). */\n  session: HydratedProjectSession | null\n  /**\n   * Load the CURRENT persisted CMS state (fresh query — the CMS section\n   * remounts per visit and must show edits persisted since project open).\n   * EC-461: the playground resolves the seeded in-memory adapter's state the\n   * same way (`null` only while nothing is persisted — e.g. an un-baselined\n   * kit project), so remounted CMS sessions carry same-session edits.\n   */\n  loadCms(): Promise<OperationResult<HydratedCms | null>>\n}\n\nconst { Context: ProjectSessionContext, useRequired: useProjectSession } =\n  createRequiredContext<ProjectSessionStore>('ProjectSession')\n\n/**\n * Compose the preview content-session state from a hydrated CMS load plus the\n * config-owned deployment seams — the ONE place hydrated content meets config:\n *\n * - `routes` (EC-291): the config-sourced routes, so the canvas `resolveLink`\n *   derives a rich-text link's URL exactly as delivery does.\n * - `localeConfig` (EC-385): the active config project's declared locales\n *   (AD-11 — locales are structure, structure is code), so canvas content\n *   clients evaluate locale-shaped values (EC-018 fallback, localized\n *   filter/sort) over the PROJECT's locale set, never the sample `en/de`\n *   fixture. Without a config project (env-only wiring) the key stays absent\n *   and the preview engine keeps its sample-config default, mirroring the CMS\n *   surface ladder (`resolveCmsInitialLocaleConfig`).\n *\n * The parameters exist purely as a unit-test seam (house pattern, same as\n * `resolveCmsInitialCollections`); app code always uses the defaults.\n */\nexport function contentSessionOf(\n  cms: HydratedCms | null,\n  routes: readonly RouteRecord[] = resolveDeploymentRoutes(),\n  localeConfig: LocaleConfig | undefined = resolveDeploymentLocaleConfig(),\n): ContentSessionState | null {\n  if (!cms) return null\n  return { ...cms, routes, ...(localeConfig ? { localeConfig } : {}) }\n}\n\n/**\n * Load the CURRENT persisted CMS state and point the preview content engine at\n * it — the framework-free core of `loadCms` (both modes run it; EC-361).\n *\n * EC-461 — the gate value is the REAL hydration result in BOTH modes now. The\n * old EC-320 playground contract (`{ ok: true, value: null }` — CMS surfaces\n * keep their static config/fixture baseline forever) was the root of the\n * playground loss family: every cross-section navigation remounted\n * `CmsProvider` from the static seed, so same-session edits vanished from the\n * CMS surfaces even though the in-memory adapter still held them — and any\n * write issued from that re-seeded session (e.g. an autosave) then clobbered\n * the adapter's newer record with the stale baseline. The seeded in-memory\n * adapter IS a persisted backend behind the operations seam (AD-17), so the\n * playground hydrates from it per CMS mount exactly like connected mode\n * hydrates from Convex; a fresh boot returns the deterministic seed, so\n * fixture reproducibility (EC-138) is preserved in substance. A failure is\n * loud twice over: logged here (for the fire-and-forget refresh callers) and\n * rendered as the gate's retryable error state.\n */\nexport async function loadCmsIntoSession(\n  operations: OperationsClient,\n  projectId: string,\n): Promise<OperationResult<HydratedCms | null>> {\n  const result = await loadHydratedCms(operations, projectId)\n  // Keep the preview engine in sync with the freshest persisted content.\n  if (result.ok && result.value !== null) configureContentSession(contentSessionOf(result.value))\n  if (!result.ok) console.error('[elytra] content-session load failed', result.error)\n  return result\n}\n\nexport function ProjectSessionProvider({\n  projectId,\n  children,\n}: {\n  projectId: string\n  children: ReactNode\n}) {\n  const playground = isPlaygroundMode()\n\n  const loader = useCallback(\n    () => getStudioOperations().then(({ operations }) => loadProjectSession(operations, projectId)),\n    [projectId],\n  )\n  // Point the preview content engine at the hydrated documents BEFORE any\n  // child renders (panels read it module-level, synchronously), composed with\n  // the config-owned routes (EC-291) + locale config (EC-385) via\n  // `contentSessionOf`. `enabled: true` below runs this in the playground\n  // fast-path too (with `session: null`) — the one divergence from\n  // `CmsSessionGate`, which owns no such side effect.\n  const onResolved = useCallback((session: HydratedProjectSession | null) => {\n    configureContentSession(contentSessionOf(session?.cms ?? null))\n  }, [])\n  const { phase, retry } = useHydrationPhase<HydratedProjectSession | null>(loader, {\n    playground,\n    playgroundValue: null,\n    enabled: true,\n    onResolved,\n  })\n\n  // Leaving the project resets the preview engine to fixtures; the next\n  // project's gate reconfigures it before rendering its own children.\n  useEffect(() => () => configureContentSession(null), [])\n\n  // EC-361/EC-461: both modes run the SAME load — the content-session side\n  // effect plus the REAL hydration value for the CMS gates. (EC-320's\n  // playground null-mask is retired: it was the loss family's root — see\n  // `loadCmsIntoSession`.)\n  const loadCms = useCallback(async (): Promise<OperationResult<HydratedCms | null>> => {\n    const { operations } = await getStudioOperations()\n    return loadCmsIntoSession(operations, projectId)\n  }, [projectId])\n\n  // EC-460: keep the preview content session in sync with WRITES. Every\n  // succeeded content-bearing command (documents/schema/assets) on the shared\n  // operations event bus marks the session stale; the registered refresher —\n  // this provider's own `loadCms`, i.e. the identical hydration path both\n  // modes already run — re-points it (debounced, and only while a preview\n  // consumer is mounted; see `content-session-refresh.ts`). Before this, the\n  // session refreshed only at boot + CMS-surface mounts, so a canvas opened\n  // after authoring/publishing resolved listings and relation picks against a\n  // stale snapshot: the EC-276 empty-listing / 1-of-3-relations family.\n  useEffect(() => {\n    const unregister = registerContentSessionRefresher(() => loadCms())\n    let unsubscribe: (() => void) | undefined\n    let cancelled = false\n    void getStudioOperations().then(({ operations }) => {\n      if (cancelled) return\n      unsubscribe = operations.events.subscribe((event) => {\n        if (isContentSessionWrite(event)) markContentSessionStale()\n        // EC-461: the first authored playground write arms the beforeunload\n        // guard for the rest of the page's life (module-level — surviving this\n        // provider's unmount, because the in-memory world does too).\n        notePlaygroundWriteForUnloadGuard(event)\n      })\n    })\n    return () => {\n      cancelled = true\n      unregister()\n      unsubscribe?.()\n    }\n  }, [loadCms])\n\n  // EC-361: playground boot hydration for the content preview engine — the same\n  // loader connected mode gates on, fired WITHOUT gating so the synchronous\n  // playground first render (EC-138) is preserved. `loadCms` owns the\n  // `configureContentSession` side effect; the resolved value is discarded here.\n  // Runs after `useHydrationPhase`'s fast-path effect (registered above) has\n  // reset the session, so the hydrated state always lands last.\n  useEffect(() => {\n    if (playground) void loadCms()\n  }, [playground, loadCms])\n\n  return (\n    <HydrationBoundary phase={phase} retry={retry}>\n      {(session) => (\n        <ProjectSessionContext.Provider value={{ session, loadCms }}>\n          {children}\n        </ProjectSessionContext.Provider>\n      )}\n    </HydrationBoundary>\n  )\n}\n\nexport { useProjectSession }\n\n/**\n * Gate one CMS surface mount on a FRESH persisted CMS load — BOTH modes.\n * Render-prop: hands the hydrated content (or `null` → fixture fallback,\n * first-run / un-baselined kit) to the caller once it resolved. Unlike\n * `ProjectSessionProvider`, this gate owns no `configureContentSession` side\n * effect of its own — `loadCms` (from `useProjectSession`) already calls it\n * internally when it resolves — so no `onResolved`/`enabled` is passed here.\n *\n * EC-461: the playground gates on the SAME async hydration as connected mode\n * (over the seeded in-memory adapter, resolved in microtasks). The old\n * synchronous `null` fast-path (EC-320/EC-361) made every remounted CMS\n * session re-seed the STATIC baseline, which both hid and then destroyed\n * same-session edits — the playground loss family. A fresh playground boot\n * hydrates the deterministic seed, so fixture reproducibility is unchanged in\n * substance; only a microtask-long loading frame replaced the synchronous\n * first render HERE (`ProjectSessionProvider`'s EC-138 playground fast-path is\n * untouched).\n */\nexport function CmsSessionGate({\n  children,\n}: {\n  children: (cms: HydratedCms | null) => ReactNode\n}) {\n  const { loadCms } = useProjectSession()\n  const { phase, retry } = useHydrationPhase<HydratedCms | null>(loadCms, {\n    playground: false,\n    playgroundValue: null,\n  })\n  return (\n    <HydrationBoundary phase={phase} retry={retry}>\n      {children}\n    </HydrationBoundary>\n  )\n}\n"]}

package/dist/lib/assets/asset-url.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Asset URL scheme classification (EC-459). `InMemoryBlobStorage` (playground's
+ * default blob backend, `@elytracms/core/persistence`) mints an opaque
+ * `memory://blobs/<key>` locator for stored bytes — correct for Node tests and
+ * inspection, but not a resource a browser can ever fetch. Every studio surface
+ * that puts an asset's `url` in an `<img src>` must gate on "is this actually
+ * displayable", not "is this specifically `http(s)`" — the fix wiring
+ * (`browser-blob-storage.ts`) replaces `memory://` with a `blob:` object URL,
+ * which the OLD `url.startsWith('http')` gates here would have kept rejecting.
+ *
+ * Pure and dependency-free so it is trivially Node-testable; every surface that
+ * decides "show the `<img>` or the placeholder" imports this one predicate so
+ * the decision can never drift between call sites again.
+ */
+/**
+ * True when `url` is a scheme a browser can fetch/render (`http(s):`, `blob:`,
+ * `data:`) — false for `undefined`, empty, and opaque backend-internal locators
+ * like `memory://blobs/…` that must never reach an `<img>`/`<a href>`.
+ */
+export declare function isDisplayableAssetUrl(url: string | undefined | null): url is string;

package/dist/lib/assets/asset-url.js

@@ -0,0 +1,25 @@
+/**
+ * Asset URL scheme classification (EC-459). `InMemoryBlobStorage` (playground's
+ * default blob backend, `@elytracms/core/persistence`) mints an opaque
+ * `memory://blobs/<key>` locator for stored bytes — correct for Node tests and
+ * inspection, but not a resource a browser can ever fetch. Every studio surface
+ * that puts an asset's `url` in an `<img src>` must gate on "is this actually
+ * displayable", not "is this specifically `http(s)`" — the fix wiring
+ * (`browser-blob-storage.ts`) replaces `memory://` with a `blob:` object URL,
+ * which the OLD `url.startsWith('http')` gates here would have kept rejecting.
+ *
+ * Pure and dependency-free so it is trivially Node-testable; every surface that
+ * decides "show the `<img>` or the placeholder" imports this one predicate so
+ * the decision can never drift between call sites again.
+ */
+/** Schemes a browser can actually load pixels from in an `<img src>`. */
+const DISPLAYABLE_URL_PATTERN = /^(https?:|blob:|data:)/i;
+/**
+ * True when `url` is a scheme a browser can fetch/render (`http(s):`, `blob:`,
+ * `data:`) — false for `undefined`, empty, and opaque backend-internal locators
+ * like `memory://blobs/…` that must never reach an `<img>`/`<a href>`.
+ */
+export function isDisplayableAssetUrl(url) {
+    return typeof url === 'string' && DISPLAYABLE_URL_PATTERN.test(url);
+}
+//# sourceMappingURL=asset-url.js.map

package/dist/lib/assets/asset-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-url.js","sourceRoot":"","sources":["../../../src/lib/assets/asset-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,yEAAyE;AACzE,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAA8B;IAClE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACrE,CAAC","sourcesContent":["/**\n * Asset URL scheme classification (EC-459). `InMemoryBlobStorage` (playground's\n * default blob backend, `@elytracms/core/persistence`) mints an opaque\n * `memory://blobs/<key>` locator for stored bytes — correct for Node tests and\n * inspection, but not a resource a browser can ever fetch. Every studio surface\n * that puts an asset's `url` in an `<img src>` must gate on \"is this actually\n * displayable\", not \"is this specifically `http(s)`\" — the fix wiring\n * (`browser-blob-storage.ts`) replaces `memory://` with a `blob:` object URL,\n * which the OLD `url.startsWith('http')` gates here would have kept rejecting.\n *\n * Pure and dependency-free so it is trivially Node-testable; every surface that\n * decides \"show the `<img>` or the placeholder\" imports this one predicate so\n * the decision can never drift between call sites again.\n */\n\n/** Schemes a browser can actually load pixels from in an `<img src>`. */\nconst DISPLAYABLE_URL_PATTERN = /^(https?:|blob:|data:)/i\n\n/**\n * True when `url` is a scheme a browser can fetch/render (`http(s):`, `blob:`,\n * `data:`) — false for `undefined`, empty, and opaque backend-internal locators\n * like `memory://blobs/…` that must never reach an `<img>`/`<a href>`.\n */\nexport function isDisplayableAssetUrl(url: string | undefined | null): url is string {\n  return typeof url === 'string' && DISPLAYABLE_URL_PATTERN.test(url)\n}\n"]}

package/dist/lib/assets/browser-blob-storage.d.ts

@@ -0,0 +1,80 @@
+import type { BlobStorageAdapter } from '@elytracms/core/persistence';
+/**
+ * Studio-side (playground-only) blob storage wrapper (EC-459).
+ *
+ * Root cause this fixes: `InMemoryBlobStorage` (`@elytracms/core/persistence`)
+ * mints `url(key)` as an opaque `memory://blobs/<key>` locator. That is correct
+ * for its job — Node tests and programmatic inspection never need a real
+ * browser resource — but the studio's upload flow (`upload.ts`) bakes
+ * `blobs.resolveUrl?.(storageKey) ?? blobs.url(storageKey)` straight into the
+ * persisted `AssetRecord.url` (and the EC-400 thumb variant's `url`). Every
+ * surface that then puts that value in an `<img src>` — the asset library grid,
+ * the compact field preview, the focal-point editor, and (worst of all, no
+ * gating at all) the canvas iframe's resolved-asset renderer — hands the
+ * browser a URL it can never fetch. Pixels never render; the canvas iframe
+ * shows an actual broken-image icon (`naturalWidth === 0`).
+ *
+ * The fix: wrap the byte store, not replace it. `put`/`store` still delegate
+ * unchanged to `inner` (an `InMemoryBlobStorage` by default, or any adapter a
+ * test wants), so bytes live exactly where they always did. The moment bytes
+ * are known, THIS wrapper additionally mints a real browser-displayable URL
+ * (an object URL by default) and serves THAT from `url()`/`resolveUrl()` —
+ * so the value the upload flow bakes into the record is something an `<img>`
+ * can actually load. `@elytracms/core`'s `InMemoryBlobStorage` is untouched and
+ * stays platform-neutral (it still runs fine under Node tests); the one
+ * DOM-touching function (`objectUrlMinter`, using the real `Blob`/`URL` globals)
+ * is injected, so this whole orchestrator — caching, delegation, revoke-on-
+ * delete/overwrite — is unit-testable in Node with a fake minter.
+ *
+ * Playground-only by construction: nothing calls this in the Convex/connected
+ * path, and the `BlobStorageAdapter` interface is unchanged, so the delivery
+ * wire and the connected-mode adapter are untouched.
+ */
+/** Mints a browser-displayable URL from raw bytes. Injected for Node testability. */
+export type UrlMinter = (data: Uint8Array, contentType: string) => string;
+/** Releases a previously-minted URL's resources (e.g. `URL.revokeObjectURL`). */
+export type UrlRevoker = (url: string) => void;
+/**
+ * The real browser minter: an object URL backed by a same-process `Blob`.
+ * Deliberately thin and untested in Node (mirrors `canvasVariantEncoder` in
+ * `thumbnail.ts` — a DOM shell around a pure/injectable orchestrator).
+ */
+export declare const objectUrlMinter: UrlMinter;
+/** The real browser revoker: releases an object URL's underlying resources. */
+export declare const objectUrlRevoker: UrlRevoker;
+export interface BrowserBlobStorageOptions {
+    /** The wrapped adapter that actually holds the bytes. Defaults to a fresh `InMemoryBlobStorage`. */
+    inner?: BlobStorageAdapter;
+    /** Defaults to {@link objectUrlMinter}; tests inject a deterministic fake. */
+    mint?: UrlMinter;
+    /** Defaults to {@link objectUrlRevoker}; tests inject a fake to assert revocation. */
+    revoke?: UrlRevoker;
+}
+/**
+ * Wraps a `BlobStorageAdapter` so `url()`/`resolveUrl()` return a browser-
+ * displayable URL instead of the inner adapter's opaque locator (EC-459). See
+ * the module doc above for the full rationale.
+ */
+export declare class BrowserBlobStorage implements BlobStorageAdapter {
+    private readonly inner;
+    private readonly mint;
+    private readonly revoke;
+    /** storageKey → minted display URL, populated at the moment bytes are known. */
+    private readonly displayUrls;
+    constructor(options?: BrowserBlobStorageOptions);
+    /**
+     * Mint (or re-mint) the display URL for `key`. A re-put under the same key
+     * (re-upload / overwrite) revokes the stale URL first, so no object URL leaks
+     * and no surface can ever show stale bytes under a reused key.
+     */
+    private remember;
+    put(key: string, data: Uint8Array, contentType?: string): Promise<void>;
+    get(key: string): Promise<Uint8Array | undefined>;
+    url(key: string): string;
+    has(key: string): Promise<boolean>;
+    delete(key: string): Promise<void>;
+    store(data: Uint8Array, contentType?: string): Promise<string>;
+    resolveUrl(key: string): Promise<string | undefined>;
+}
+/** Convenience factory — `createBrowserBlobStorage()` wraps a fresh `InMemoryBlobStorage`. */
+export declare function createBrowserBlobStorage(options?: BrowserBlobStorageOptions): BlobStorageAdapter;

package/dist/lib/assets/browser-blob-storage.js

@@ -0,0 +1,86 @@
+import { InMemoryBlobStorage } from '@elytracms/core/persistence';
+/**
+ * The real browser minter: an object URL backed by a same-process `Blob`.
+ * Deliberately thin and untested in Node (mirrors `canvasVariantEncoder` in
+ * `thumbnail.ts` — a DOM shell around a pure/injectable orchestrator).
+ */
+export const objectUrlMinter = (data, contentType) => URL.createObjectURL(new Blob([data.slice()], { type: contentType || 'application/octet-stream' }));
+/** The real browser revoker: releases an object URL's underlying resources. */
+export const objectUrlRevoker = (url) => {
+    URL.revokeObjectURL(url);
+};
+/**
+ * Wraps a `BlobStorageAdapter` so `url()`/`resolveUrl()` return a browser-
+ * displayable URL instead of the inner adapter's opaque locator (EC-459). See
+ * the module doc above for the full rationale.
+ */
+export class BrowserBlobStorage {
+    inner;
+    mint;
+    revoke;
+    /** storageKey → minted display URL, populated at the moment bytes are known. */
+    displayUrls = new Map();
+    constructor(options = {}) {
+        this.inner = options.inner ?? new InMemoryBlobStorage();
+        this.mint = options.mint ?? objectUrlMinter;
+        this.revoke = options.revoke ?? objectUrlRevoker;
+    }
+    /**
+     * Mint (or re-mint) the display URL for `key`. A re-put under the same key
+     * (re-upload / overwrite) revokes the stale URL first, so no object URL leaks
+     * and no surface can ever show stale bytes under a reused key.
+     */
+    remember(key, data, contentType) {
+        const previous = this.displayUrls.get(key);
+        if (previous)
+            this.revoke(previous);
+        this.displayUrls.set(key, this.mint(data, contentType ?? 'application/octet-stream'));
+    }
+    async put(key, data, contentType) {
+        await this.inner.put(key, data, contentType);
+        this.remember(key, data, contentType);
+    }
+    async get(key) {
+        return this.inner.get(key);
+    }
+    url(key) {
+        // Fall back to the inner adapter's own locator only when this wrapper never
+        // saw the bytes (e.g. a seed record whose metadata carries no stored blob at
+        // all) — the same "no bytes, no pretending" behaviour the inner adapter has
+        // always had; nothing here silently invents a broken image.
+        return this.displayUrls.get(key) ?? this.inner.url(key);
+    }
+    async has(key) {
+        return this.inner.has(key);
+    }
+    async delete(key) {
+        await this.inner.delete(key);
+        const cached = this.displayUrls.get(key);
+        if (cached) {
+            this.revoke(cached);
+            this.displayUrls.delete(key);
+        }
+    }
+    async store(data, contentType) {
+        if (!this.inner.store) {
+            throw new Error('BrowserBlobStorage requires an inner adapter that implements store().');
+        }
+        const key = await this.inner.store(data, contentType);
+        this.remember(key, data, contentType);
+        return key;
+    }
+    async resolveUrl(key) {
+        const cached = this.displayUrls.get(key);
+        if (cached)
+            return cached;
+        // Not minted through THIS wrapper — fall back to whatever the inner adapter
+        // can resolve (still `undefined` when genuinely no bytes exist: scope §5,
+        // an explicit missing state, never a silently broken image).
+        return this.inner.resolveUrl ? this.inner.resolveUrl(key) : undefined;
+    }
+}
+/** Convenience factory — `createBrowserBlobStorage()` wraps a fresh `InMemoryBlobStorage`. */
+export function createBrowserBlobStorage(options) {
+    return new BrowserBlobStorage(options);
+}
+//# sourceMappingURL=browser-blob-storage.js.map

package/dist/lib/assets/browser-blob-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-blob-storage.js","sourceRoot":"","sources":["../../../src/lib/assets/browser-blob-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAyCjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAc,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAC9D,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAc,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,IAAI,0BAA0B,EAAE,CAAC,CAAC,CAAA;AAEhH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAe,CAAC,GAAG,EAAE,EAAE;IAClD,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;AAC1B,CAAC,CAAA;AAWD;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAoB;IACzB,IAAI,CAAW;IACf,MAAM,CAAY;IACnC,gFAAgF;IAC/D,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExD,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAA;QACvD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAAA;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAA;IAClD,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,GAAW,EAAE,IAAgB,EAAE,WAA+B;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,IAAI,0BAA0B,CAAC,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,IAAgB,EAAE,WAAoB;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,4DAA4D;QAC5D,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAgB,EAAE,WAAoB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACrC,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,4EAA4E;QAC5E,0EAA0E;QAC1E,6DAA6D;QAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvE,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,UAAU,wBAAwB,CAAC,OAAmC;IAC1E,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;AACxC,CAAC","sourcesContent":["import { InMemoryBlobStorage } from '@elytracms/core/persistence'\nimport type { BlobStorageAdapter } from '@elytracms/core/persistence'\n\n/**\n * Studio-side (playground-only) blob storage wrapper (EC-459).\n *\n * Root cause this fixes: `InMemoryBlobStorage` (`@elytracms/core/persistence`)\n * mints `url(key)` as an opaque `memory://blobs/<key>` locator. That is correct\n * for its job — Node tests and programmatic inspection never need a real\n * browser resource — but the studio's upload flow (`upload.ts`) bakes\n * `blobs.resolveUrl?.(storageKey) ?? blobs.url(storageKey)` straight into the\n * persisted `AssetRecord.url` (and the EC-400 thumb variant's `url`). Every\n * surface that then puts that value in an `<img src>` — the asset library grid,\n * the compact field preview, the focal-point editor, and (worst of all, no\n * gating at all) the canvas iframe's resolved-asset renderer — hands the\n * browser a URL it can never fetch. Pixels never render; the canvas iframe\n * shows an actual broken-image icon (`naturalWidth === 0`).\n *\n * The fix: wrap the byte store, not replace it. `put`/`store` still delegate\n * unchanged to `inner` (an `InMemoryBlobStorage` by default, or any adapter a\n * test wants), so bytes live exactly where they always did. The moment bytes\n * are known, THIS wrapper additionally mints a real browser-displayable URL\n * (an object URL by default) and serves THAT from `url()`/`resolveUrl()` —\n * so the value the upload flow bakes into the record is something an `<img>`\n * can actually load. `@elytracms/core`'s `InMemoryBlobStorage` is untouched and\n * stays platform-neutral (it still runs fine under Node tests); the one\n * DOM-touching function (`objectUrlMinter`, using the real `Blob`/`URL` globals)\n * is injected, so this whole orchestrator — caching, delegation, revoke-on-\n * delete/overwrite — is unit-testable in Node with a fake minter.\n *\n * Playground-only by construction: nothing calls this in the Convex/connected\n * path, and the `BlobStorageAdapter` interface is unchanged, so the delivery\n * wire and the connected-mode adapter are untouched.\n */\n\n/** Mints a browser-displayable URL from raw bytes. Injected for Node testability. */\nexport type UrlMinter = (data: Uint8Array, contentType: string) => string\n\n/** Releases a previously-minted URL's resources (e.g. `URL.revokeObjectURL`). */\nexport type UrlRevoker = (url: string) => void\n\n/**\n * The real browser minter: an object URL backed by a same-process `Blob`.\n * Deliberately thin and untested in Node (mirrors `canvasVariantEncoder` in\n * `thumbnail.ts` — a DOM shell around a pure/injectable orchestrator).\n */\nexport const objectUrlMinter: UrlMinter = (data, contentType) =>\n  URL.createObjectURL(new Blob([data.slice() as BlobPart], { type: contentType || 'application/octet-stream' }))\n\n/** The real browser revoker: releases an object URL's underlying resources. */\nexport const objectUrlRevoker: UrlRevoker = (url) => {\n  URL.revokeObjectURL(url)\n}\n\nexport interface BrowserBlobStorageOptions {\n  /** The wrapped adapter that actually holds the bytes. Defaults to a fresh `InMemoryBlobStorage`. */\n  inner?: BlobStorageAdapter\n  /** Defaults to {@link objectUrlMinter}; tests inject a deterministic fake. */\n  mint?: UrlMinter\n  /** Defaults to {@link objectUrlRevoker}; tests inject a fake to assert revocation. */\n  revoke?: UrlRevoker\n}\n\n/**\n * Wraps a `BlobStorageAdapter` so `url()`/`resolveUrl()` return a browser-\n * displayable URL instead of the inner adapter's opaque locator (EC-459). See\n * the module doc above for the full rationale.\n */\nexport class BrowserBlobStorage implements BlobStorageAdapter {\n  private readonly inner: BlobStorageAdapter\n  private readonly mint: UrlMinter\n  private readonly revoke: UrlRevoker\n  /** storageKey → minted display URL, populated at the moment bytes are known. */\n  private readonly displayUrls = new Map<string, string>()\n\n  constructor(options: BrowserBlobStorageOptions = {}) {\n    this.inner = options.inner ?? new InMemoryBlobStorage()\n    this.mint = options.mint ?? objectUrlMinter\n    this.revoke = options.revoke ?? objectUrlRevoker\n  }\n\n  /**\n   * Mint (or re-mint) the display URL for `key`. A re-put under the same key\n   * (re-upload / overwrite) revokes the stale URL first, so no object URL leaks\n   * and no surface can ever show stale bytes under a reused key.\n   */\n  private remember(key: string, data: Uint8Array, contentType: string | undefined): void {\n    const previous = this.displayUrls.get(key)\n    if (previous) this.revoke(previous)\n    this.displayUrls.set(key, this.mint(data, contentType ?? 'application/octet-stream'))\n  }\n\n  async put(key: string, data: Uint8Array, contentType?: string): Promise<void> {\n    await this.inner.put(key, data, contentType)\n    this.remember(key, data, contentType)\n  }\n\n  async get(key: string): Promise<Uint8Array | undefined> {\n    return this.inner.get(key)\n  }\n\n  url(key: string): string {\n    // Fall back to the inner adapter's own locator only when this wrapper never\n    // saw the bytes (e.g. a seed record whose metadata carries no stored blob at\n    // all) — the same \"no bytes, no pretending\" behaviour the inner adapter has\n    // always had; nothing here silently invents a broken image.\n    return this.displayUrls.get(key) ?? this.inner.url(key)\n  }\n\n  async has(key: string): Promise<boolean> {\n    return this.inner.has(key)\n  }\n\n  async delete(key: string): Promise<void> {\n    await this.inner.delete(key)\n    const cached = this.displayUrls.get(key)\n    if (cached) {\n      this.revoke(cached)\n      this.displayUrls.delete(key)\n    }\n  }\n\n  async store(data: Uint8Array, contentType?: string): Promise<string> {\n    if (!this.inner.store) {\n      throw new Error('BrowserBlobStorage requires an inner adapter that implements store().')\n    }\n    const key = await this.inner.store(data, contentType)\n    this.remember(key, data, contentType)\n    return key\n  }\n\n  async resolveUrl(key: string): Promise<string | undefined> {\n    const cached = this.displayUrls.get(key)\n    if (cached) return cached\n    // Not minted through THIS wrapper — fall back to whatever the inner adapter\n    // can resolve (still `undefined` when genuinely no bytes exist: scope §5,\n    // an explicit missing state, never a silently broken image).\n    return this.inner.resolveUrl ? this.inner.resolveUrl(key) : undefined\n  }\n}\n\n/** Convenience factory — `createBrowserBlobStorage()` wraps a fresh `InMemoryBlobStorage`. */\nexport function createBrowserBlobStorage(options?: BrowserBlobStorageOptions): BlobStorageAdapter {\n  return new BrowserBlobStorage(options)\n}\n"]}

package/dist/lib/assets/index.d.ts

@@ -9,3 +9,5 @@ export * from './thumbnail.js';
 export * from './backfill-thumbs.js';
 export * from './upload.js';
 export * from './delete-asset.js';
+export * from './asset-url.js';
+export * from './browser-blob-storage.js';

package/dist/lib/assets/index.js

@@ -9,4 +9,6 @@ export * from './thumbnail.js';
 export * from './backfill-thumbs.js';
 export * from './upload.js';
 export * from './delete-asset.js';
+export * from './asset-url.js';
+export * from './browser-blob-storage.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/assets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA;AACxB,cAAc,gBAAgB,CAAA","sourcesContent":["/**\n * Asset upload, deletion, and usage logic (EC-151). Pure/injectable modules:\n * the studio UI consumes these; storage is reached only through the\n * `BlobStorageAdapter` boundary.\n */\nexport * from './upload-state'\nexport * from './image-dimensions'\nexport * from './thumbnail'\nexport * from './backfill-thumbs'\nexport * from './upload'\nexport * from './delete-asset'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA;AACxB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA","sourcesContent":["/**\n * Asset upload, deletion, and usage logic (EC-151). Pure/injectable modules:\n * the studio UI consumes these; storage is reached only through the\n * `BlobStorageAdapter` boundary.\n */\nexport * from './upload-state'\nexport * from './image-dimensions'\nexport * from './thumbnail'\nexport * from './backfill-thumbs'\nexport * from './upload'\nexport * from './delete-asset'\nexport * from './asset-url'\nexport * from './browser-blob-storage'\n"]}

package/dist/lib/data/collection-content.d.ts

@@ -1,4 +1,4 @@
-import type { GetDocumentResult, ListDocumentsQuery, ListDocumentsResult, ResolvedDocument } from '@elytracms/core/content';
+import type { ContentQueryError, GetDocumentResult, ListDocumentsQuery, ListDocumentsResult, ResolvedDocument } from '@elytracms/core/content';
 import type { CmsDocument, CollectionDef, DocumentRef, Locale, LocaleConfig, RouteRecord } from '@elytracms/core/cms-core';
 import type { AssetRecord } from '@elytracms/core/persistence';
 import type { ListingQuery } from '@elytracms/core/runtime-renderer';
@@ -72,6 +72,14 @@ export declare const playgroundCollections: readonly CollectionDef[];
  * published-only — this does not weaken `live-is-published-only`.
  */
 export type CanvasPerspective = 'draft' | 'published';
+/** The current content-session epoch — bumps on every `configureContentSession`. */
+export declare function contentSessionEpoch(): number;
+/**
+ * Subscribe to content-session swaps (EC-460). The listener fires after every
+ * `configureContentSession`; returns the unsubscribe. Shaped for
+ * `useSyncExternalStore(subscribeContentSession, contentSessionEpoch)`.
+ */
+export declare function subscribeContentSession(listener: () => void): () => void;
 /**
  * Point the preview engine at a project's hydrated content — Convex hydration
  * or the playground's in-memory persisted state (EC-361), both through the same
@@ -118,6 +126,17 @@ export declare function resolveCanvasRelation(ref: DocumentRef, locale?: Locale,
  * state. Reuses the same `listDocuments` path as `runCollectionListQuery`.
  */
 export declare function resolveCanvasListing(query: ListingQuery, locale?: Locale, perspective?: CanvasPerspective): ResolvedDocument[];
+/**
+ * Statically validate a listing block's query against the ACTIVE session schema
+ * (EC-460, the never-silent rule): the exact `validateWhere`/`validateSort`/
+ * `validateLimit` checks `listDocuments` runs, WITHOUT executing the query — so
+ * the canvas can surface a config-invalid listing (a filter/sort field the
+ * collection doesn't declare `filterable`, an unknown collection) as a visible
+ * notice instead of the block's indistinguishable empty state. With no content
+ * session configured (boot instants, fixtures) there is no schema to judge
+ * against, so it reports nothing rather than false-flagging every listing.
+ */
+export declare function validateCanvasListingQuery(query: ListingQuery): ContentQueryError[];
 /**
  * Resolve a rich-text internal link's target document to its URL path for the canvas
  * (EC-291) — the studio analog of the host's baked links map. Derives the URL through

package/dist/lib/data/collection-content.js

@@ -1,4 +1,4 @@
-import { createContentClient, createContentContext, } from '@elytracms/core/content';
+import { createContentClient, createContentContext, queryError, validateLimit, validateSort, validateWhere, } from '@elytracms/core/content';
 import { documentKey, resolveDocumentTitle, sampleLocaleConfig } from '@elytracms/core/cms-core';
 import { getStudioLocale } from '../locale/locale-store.js';
 /**
@@ -14,6 +14,26 @@ let contentSession = null;
 let lookup = createLookup(playgroundCollections, [], []);
 // Keyed by `${locale}:${perspective}` (EC-300) — one deterministic client per pair.
 const clients = new Map();
+// EC-460: a monotonically increasing session epoch + listener set, so a REACT
+// surface (the canvas render context) can re-render when the session is
+// re-pointed at fresher content. The session itself stays a module global (the
+// EC-361 design); this only makes "it changed" observable — `configureContentSession`
+// remains the single setter.
+let sessionEpoch = 0;
+const sessionListeners = new Set();
+/** The current content-session epoch — bumps on every `configureContentSession`. */
+export function contentSessionEpoch() {
+    return sessionEpoch;
+}
+/**
+ * Subscribe to content-session swaps (EC-460). The listener fires after every
+ * `configureContentSession`; returns the unsubscribe. Shaped for
+ * `useSyncExternalStore(subscribeContentSession, contentSessionEpoch)`.
+ */
+export function subscribeContentSession(listener) {
+    sessionListeners.add(listener);
+    return () => sessionListeners.delete(listener);
+}
 /**
  * Point the preview engine at a project's hydrated content — Convex hydration
  * or the playground's in-memory persisted state (EC-361), both through the same
@@ -25,6 +45,9 @@ export function configureContentSession(next) {
         ? createLookup(next.collections, next.documents, next.publishedKeys, next.assets)
         : createLookup(playgroundCollections, [], []);
     clients.clear();
+    sessionEpoch += 1;
+    for (const listener of [...sessionListeners])
+        listener();
 }
 /** Whether a hydrated content session is configured (Convex mode). */
 export function hasContentSession() {
@@ -191,6 +214,33 @@ export function resolveCanvasListing(query, locale = getStudioLocale(), perspect
     });
     return result.ok ? result.documents : [];
 }
+/**
+ * Statically validate a listing block's query against the ACTIVE session schema
+ * (EC-460, the never-silent rule): the exact `validateWhere`/`validateSort`/
+ * `validateLimit` checks `listDocuments` runs, WITHOUT executing the query — so
+ * the canvas can surface a config-invalid listing (a filter/sort field the
+ * collection doesn't declare `filterable`, an unknown collection) as a visible
+ * notice instead of the block's indistinguishable empty state. With no content
+ * session configured (boot instants, fixtures) there is no schema to judge
+ * against, so it reports nothing rather than false-flagging every listing.
+ */
+export function validateCanvasListingQuery(query) {
+    if (contentSession === null)
+        return [];
+    const collection = playgroundCollection(query.collection);
+    if (!collection) {
+        return [
+            queryError('unknown-collection', `Collection "${query.collection}" is not defined.`, [
+                'collection',
+            ]),
+        ];
+    }
+    return [
+        ...validateWhere(collection, query.where),
+        ...(query.sort ? validateSort(collection, query.sort) : []),
+        ...(query.limit !== undefined ? validateLimit(query.limit) : []),
+    ];
+}
 /**
  * Resolve a rich-text internal link's target document to its URL path for the canvas
  * (EC-291) — the studio analog of the host's baked links map. Derives the URL through