@elytracms/studio 0.0.80 → 0.0.82

package/dist/lib/i18n/types.d.ts

@@ -32,16 +32,22 @@ export interface StudioI18nConfig {
      */
     defaultLocale?: string;
     /**
-     * **Pin** the studio UI to a fixed locale, overriding browser detection. Set this
-     * for a single-language deployment (e.g. a German site whose editors work in German).
+     * **Pin** the studio UI to a fixed locale, overriding browser detection. **This is the
+     * supported way to choose the studio's language** (EC-513) — set it for any deployment
+     * whose editors work in one language, which is what both production consumers do.
      *
-     * Why it exists: browser detection reads `navigator.languages`, which is **client-only**
-     * — under SSR the server can't see it, so it renders the default locale while the client
-     * renders the browser locale → a hydration mismatch (server text ≠ client text). A pin is
-     * read from *config*, which is imported identically on server and client, so both render
-     * the same locale with no header plumbing and no first-paint flash. When a locale is not
-     * available (not `defaultLocale` and not in `locales`) the pin is ignored (with a console
-     * signal) and detection resumes. Omit it to keep browser-preferred detection.
+     * Why prefer it: browser detection reads `navigator.languages`, which is **client-only**.
+     * The server renders the default locale, and the studio therefore boots in that locale
+     * and hands over to the browser's preference only after hydration — correct, but it
+     * means a moment of default-locale chrome on a cold load. A pin is read from *config*,
+     * imported identically on server and client, so the right language is there from the
+     * first byte.
+     *
+     * There is deliberately **no server-side locale seam** (no `Accept-Language` resolver):
+     * locale resolution is client-side, and a pin is how a host states the answer up front.
+     *
+     * A locale that is not available (neither `defaultLocale` nor a key of `locales`) is
+     * ignored with a console signal, and detection resumes. Omit it to follow the browser.
      */
     locale?: string;
     /**

package/dist/lib/i18n/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/i18n/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgDH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,WAAoB;IACvD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAA;AAC3E,CAAC","sourcesContent":["/**\n * Studio-UI localization types (EC-241) — the leaf module both the message catalog\n * and the resolver import, so nothing here may import studio runtime code (keeps the\n * `defineStudio` config surface free of import cycles).\n *\n * This is the **studio-chrome** axis (engine-owned strings). Schema labels are a\n * separate mechanism — a {@link import('@elytracms/core/cms-core').LocalizedString}\n * on the field/collection def, resolved via `resolveLabel`. Content-*value*\n * localization is a third, unrelated axis (`cms-core/localization.ts`).\n */\n\n/** A source-catalog entry: the English string + an optional translator hint. */\nexport interface SourceMessage {\n  /** The English (source-of-truth) string. */\n  message: string\n  /**\n   * Translator hint/context — the same word can translate differently by context\n   * (the standard `msgctxt`/Lingui-comment idea). **Authoring/translation-time only:**\n   * it lives on the in-engine source catalog and is NOT shipped in the flat\n   * consumer-provided translation catalogs.\n   */\n  description?: string\n}\n\n/** The in-engine English source catalog: message key → {@link SourceMessage}. */\nexport type SourceCatalog = Record<string, SourceMessage>\n\n/** A consumer-provided translation catalog: flat message key → localized string. */\nexport type MessageCatalog = Record<string, string>\n\n/** The studio-UI localization config passed to `defineStudio({ i18n })` (EC-241). */\nexport interface StudioI18nConfig {\n  /**\n   * The locale used when the browser's preferred locale matches nothing available.\n   * Defaults to `'en'` (the in-engine source language).\n   */\n  defaultLocale?: string\n  /**\n   * **Pin** the studio UI to a fixed locale, overriding browser detection. Set this\n   * for a single-language deployment (e.g. a German site whose editors work in German).\n   *\n   * Why it exists: browser detection reads `navigator.languages`, which is **client-only**\n   * — under SSR the server can't see it, so it renders the default locale while the client\n   * renders the browser locale → a hydration mismatch (server text ≠ client text). A pin is\n   * read from *config*, which is imported identically on server and client, so both render\n   * the same locale with no header plumbing and no first-paint flash. When a locale is not\n   * available (not `defaultLocale` and not in `locales`) the pin is ignored (with a console\n   * signal) and detection resumes. Omit it to keep browser-preferred detection.\n   */\n  locale?: string\n  /**\n   * Imported translation catalogs keyed by locale code, e.g. `{ de: deMessages }`.\n   * English is always available as the built-in source, so it need not be listed.\n   */\n  locales?: Record<string, MessageCatalog>\n}\n\n/**\n * Author a source-catalog entry with an optional translator hint (EC-241). Kept in\n * this leaf module so `messages.en.ts` can build the catalog without importing the\n * resolver (which would import studio runtime code).\n */\nexport function msg(message: string, description?: string): SourceMessage {\n  return description !== undefined ? { message, description } : { message }\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/i18n/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsDH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,WAAoB;IACvD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAA;AAC3E,CAAC","sourcesContent":["/**\n * Studio-UI localization types (EC-241) — the leaf module both the message catalog\n * and the resolver import, so nothing here may import studio runtime code (keeps the\n * `defineStudio` config surface free of import cycles).\n *\n * This is the **studio-chrome** axis (engine-owned strings). Schema labels are a\n * separate mechanism — a {@link import('@elytracms/core/cms-core').LocalizedString}\n * on the field/collection def, resolved via `resolveLabel`. Content-*value*\n * localization is a third, unrelated axis (`cms-core/localization.ts`).\n */\n\n/** A source-catalog entry: the English string + an optional translator hint. */\nexport interface SourceMessage {\n  /** The English (source-of-truth) string. */\n  message: string\n  /**\n   * Translator hint/context — the same word can translate differently by context\n   * (the standard `msgctxt`/Lingui-comment idea). **Authoring/translation-time only:**\n   * it lives on the in-engine source catalog and is NOT shipped in the flat\n   * consumer-provided translation catalogs.\n   */\n  description?: string\n}\n\n/** The in-engine English source catalog: message key → {@link SourceMessage}. */\nexport type SourceCatalog = Record<string, SourceMessage>\n\n/** A consumer-provided translation catalog: flat message key → localized string. */\nexport type MessageCatalog = Record<string, string>\n\n/** The studio-UI localization config passed to `defineStudio({ i18n })` (EC-241). */\nexport interface StudioI18nConfig {\n  /**\n   * The locale used when the browser's preferred locale matches nothing available.\n   * Defaults to `'en'` (the in-engine source language).\n   */\n  defaultLocale?: string\n  /**\n   * **Pin** the studio UI to a fixed locale, overriding browser detection. **This is the\n   * supported way to choose the studio's language** (EC-513) — set it for any deployment\n   * whose editors work in one language, which is what both production consumers do.\n   *\n   * Why prefer it: browser detection reads `navigator.languages`, which is **client-only**.\n   * The server renders the default locale, and the studio therefore boots in that locale\n   * and hands over to the browser's preference only after hydration — correct, but it\n   * means a moment of default-locale chrome on a cold load. A pin is read from *config*,\n   * imported identically on server and client, so the right language is there from the\n   * first byte.\n   *\n   * There is deliberately **no server-side locale seam** (no `Accept-Language` resolver):\n   * locale resolution is client-side, and a pin is how a host states the answer up front.\n   *\n   * A locale that is not available (neither `defaultLocale` nor a key of `locales`) is\n   * ignored with a console signal, and detection resumes. Omit it to follow the browser.\n   */\n  locale?: string\n  /**\n   * Imported translation catalogs keyed by locale code, e.g. `{ de: deMessages }`.\n   * English is always available as the built-in source, so it need not be listed.\n   */\n  locales?: Record<string, MessageCatalog>\n}\n\n/**\n * Author a source-catalog entry with an optional translator hint (EC-241). Kept in\n * this leaf module so `messages.en.ts` can build the catalog without importing the\n * resolver (which would import studio runtime code).\n */\nexport function msg(message: string, description?: string): SourceMessage {\n  return description !== undefined ? { message, description } : { message }\n}\n"]}

package/dist/lib/locale/binding-fallback.d.ts

@@ -25,4 +25,11 @@ export interface BoundValueFallback extends DisplayedFallback {
  * `null` when the binding is not CMS-shaped, points at no field, or the value
  * is a real translation.
  */
-export declare function cmsBindingFallback(binding: BindingReference, source: DataSource | undefined, locale: Locale): BoundValueFallback | null;
+export declare function cmsBindingFallback(binding: BindingReference, source: DataSource | undefined, 
+/**
+ * The locale to judge fallback in. Optional (EC-479): the ambient studio locale
+ * is `null` until a project's locale config is installed, and the content engine
+ * then resolves in the session's own default — so a caller that has no locale
+ * omits it rather than substituting one.
+ */
+locale?: Locale): BoundValueFallback | null;

package/dist/lib/locale/binding-fallback.js

@@ -16,7 +16,14 @@ function pathOfToken(token) {
  * `null` when the binding is not CMS-shaped, points at no field, or the value
  * is a real translation.
  */
-export function cmsBindingFallback(binding, source, locale) {
+export function cmsBindingFallback(binding, source, 
+/**
+ * The locale to judge fallback in. Optional (EC-479): the ambient studio locale
+ * is `null` until a project's locale config is installed, and the content engine
+ * then resolves in the session's own default — so a caller that has no locale
+ * omits it rather than substituting one.
+ */
+locale) {
     if (source === undefined || !isCmsSource(source))
         return null;
     if (binding.mode !== 'value' && binding.mode !== 'repeaterItem')

package/dist/lib/locale/binding-fallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding-fallback.js","sourceRoot":"","sources":["../../../src/lib/locale/binding-fallback.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAsB1F,SAAS,WAAW,CAAC,MAAkB;IACrC,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAA;AAC9B,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAyB,EACzB,MAA8B,EAC9B,MAAc;IAEd,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAA;IAE5E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAwB,CAAA;IAC9C,IAAI,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,CAAA;IAClD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEpC,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;IAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACpC,UAAU,GAAG,KAAK,CAAC,EAAE,CAAA;IACvB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;IAC9E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO;QACL,KAAK;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAA;AACH,CAAC","sourcesContent":["import type { Locale } from '@elytracms/core/cms-core'\nimport type { BindingReference } from '@elytracms/core/project-graph'\nimport type { CmsSource, DataSource } from '@elytracms/core/data-binding'\nimport { listQueryOfConfig } from '../bindings/section-bindings'\nimport type { QueryCmsConfig } from '../bindings/section-bindings'\nimport { getCollectionDocument, runCollectionListQuery } from '../data/collection-content'\nimport type { DisplayedFallback } from './fallback'\n\n/**\n * Fallback visibility for BOUND content (EC-176): given a stored content\n * binding and its CMS source, decide whether the value the canvas currently\n * previews for the active locale is served via EC-018 locale fallback. Used\n * by the inspector's Content tab — the surface that explains what a bound\n * field shows (the canvas overlay itself is out of this wave's reach; see\n * EC-176 notes).\n *\n * Deterministic over the playground delivery engine: the same\n * `@elytracms/core/content` resolution that produced the previewed value reports\n * which fields fell back (`ResolutionInfo.localeFallbacks`), so the label can\n * never disagree with the displayed value.\n */\n\n/** A previewed bound value that fell back, plus which field it came from. */\nexport interface BoundValueFallback extends DisplayedFallback {\n  field: string\n}\n\nfunction isCmsSource(source: DataSource): source is CmsSource {\n  return source.kind === 'cms'\n}\n\n/** JSON-pointer-ish token → path segments ('/0/title' → ['0', 'title']). */\nfunction pathOfToken(token: string): string[] {\n  return token\n    .split('/')\n    .filter((segment) => segment.length > 0)\n    .map((segment) => segment.replaceAll('~1', '/').replaceAll('~0', '~'))\n}\n\n/**\n * Whether the bound field's previewed value (first entry for list/repeater\n * bindings, the bound document otherwise) is a locale fallback in `locale`.\n * `null` when the binding is not CMS-shaped, points at no field, or the value\n * is a real translation.\n */\nexport function cmsBindingFallback(\n  binding: BindingReference,\n  source: DataSource | undefined,\n  locale: Locale,\n): BoundValueFallback | null {\n  if (source === undefined || !isCmsSource(source)) return null\n  if (binding.mode !== 'value' && binding.mode !== 'repeaterItem') return null\n\n  const config = source.config as QueryCmsConfig\n  let path = pathOfToken(binding.token)\n  if (path.length === 0) return null\n\n  // List-shaped value bindings carry a leading entry index; repeater-item\n  // bindings preview the first entry (the same convention as ContentPreview).\n  let entryIndex = 0\n  const listShaped = config.documentId === undefined\n  if (binding.mode === 'value' && listShaped) {\n    const head = path[0]!\n    if (!/^\\d+$/.test(head)) return null\n    entryIndex = Number(head)\n    path = path.slice(1)\n  }\n  const field = path[0]\n  if (field === undefined) return null\n\n  // Resolve the previewed document's id, then ask the delivery engine which\n  // fields fell back for it in the active locale.\n  let documentId = config.documentId\n  if (documentId === undefined) {\n    const list = runCollectionListQuery(config.collectionId, listQueryOfConfig(config), locale)\n    if (!list.ok) return null\n    const entry = list.documents[entryIndex]\n    if (entry === undefined) return null\n    documentId = entry.id\n  }\n\n  const { info } = getCollectionDocument(config.collectionId, documentId, locale)\n  if (info === null) return null\n  const fellBack = info.localeFallbacks.find((entry) => entry.path[0] === field)\n  if (fellBack === undefined) return null\n  return {\n    field,\n    sourceLocale: fellBack.sourceLocale,\n    requestedLocale: fellBack.requestedLocale,\n  }\n}\n"]}
+{"version":3,"file":"binding-fallback.js","sourceRoot":"","sources":["../../../src/lib/locale/binding-fallback.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAsB1F,SAAS,WAAW,CAAC,MAAkB;IACrC,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAA;AAC9B,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAyB,EACzB,MAA8B;AAC9B;;;;;GAKG;AACH,MAAe;IAEf,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAA;IAE5E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAwB,CAAA;IAC9C,IAAI,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,KAAK,SAAS,CAAA;IAClD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEpC,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;IAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACpC,UAAU,GAAG,KAAK,CAAC,EAAE,CAAA;IACvB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;IAC9E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO;QACL,KAAK;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAA;AACH,CAAC","sourcesContent":["import type { Locale } from '@elytracms/core/cms-core'\nimport type { BindingReference } from '@elytracms/core/project-graph'\nimport type { CmsSource, DataSource } from '@elytracms/core/data-binding'\nimport { listQueryOfConfig } from '../bindings/section-bindings'\nimport type { QueryCmsConfig } from '../bindings/section-bindings'\nimport { getCollectionDocument, runCollectionListQuery } from '../data/collection-content'\nimport type { DisplayedFallback } from './fallback'\n\n/**\n * Fallback visibility for BOUND content (EC-176): given a stored content\n * binding and its CMS source, decide whether the value the canvas currently\n * previews for the active locale is served via EC-018 locale fallback. Used\n * by the inspector's Content tab — the surface that explains what a bound\n * field shows (the canvas overlay itself is out of this wave's reach; see\n * EC-176 notes).\n *\n * Deterministic over the playground delivery engine: the same\n * `@elytracms/core/content` resolution that produced the previewed value reports\n * which fields fell back (`ResolutionInfo.localeFallbacks`), so the label can\n * never disagree with the displayed value.\n */\n\n/** A previewed bound value that fell back, plus which field it came from. */\nexport interface BoundValueFallback extends DisplayedFallback {\n  field: string\n}\n\nfunction isCmsSource(source: DataSource): source is CmsSource {\n  return source.kind === 'cms'\n}\n\n/** JSON-pointer-ish token → path segments ('/0/title' → ['0', 'title']). */\nfunction pathOfToken(token: string): string[] {\n  return token\n    .split('/')\n    .filter((segment) => segment.length > 0)\n    .map((segment) => segment.replaceAll('~1', '/').replaceAll('~0', '~'))\n}\n\n/**\n * Whether the bound field's previewed value (first entry for list/repeater\n * bindings, the bound document otherwise) is a locale fallback in `locale`.\n * `null` when the binding is not CMS-shaped, points at no field, or the value\n * is a real translation.\n */\nexport function cmsBindingFallback(\n  binding: BindingReference,\n  source: DataSource | undefined,\n  /**\n   * The locale to judge fallback in. Optional (EC-479): the ambient studio locale\n   * is `null` until a project's locale config is installed, and the content engine\n   * then resolves in the session's own default — so a caller that has no locale\n   * omits it rather than substituting one.\n   */\n  locale?: Locale,\n): BoundValueFallback | null {\n  if (source === undefined || !isCmsSource(source)) return null\n  if (binding.mode !== 'value' && binding.mode !== 'repeaterItem') return null\n\n  const config = source.config as QueryCmsConfig\n  let path = pathOfToken(binding.token)\n  if (path.length === 0) return null\n\n  // List-shaped value bindings carry a leading entry index; repeater-item\n  // bindings preview the first entry (the same convention as ContentPreview).\n  let entryIndex = 0\n  const listShaped = config.documentId === undefined\n  if (binding.mode === 'value' && listShaped) {\n    const head = path[0]!\n    if (!/^\\d+$/.test(head)) return null\n    entryIndex = Number(head)\n    path = path.slice(1)\n  }\n  const field = path[0]\n  if (field === undefined) return null\n\n  // Resolve the previewed document's id, then ask the delivery engine which\n  // fields fell back for it in the active locale.\n  let documentId = config.documentId\n  if (documentId === undefined) {\n    const list = runCollectionListQuery(config.collectionId, listQueryOfConfig(config), locale)\n    if (!list.ok) return null\n    const entry = list.documents[entryIndex]\n    if (entry === undefined) return null\n    documentId = entry.id\n  }\n\n  const { info } = getCollectionDocument(config.collectionId, documentId, locale)\n  if (info === null) return null\n  const fellBack = info.localeFallbacks.find((entry) => entry.path[0] === field)\n  if (fellBack === undefined) return null\n  return {\n    field,\n    sourceLocale: fellBack.sourceLocale,\n    requestedLocale: fellBack.requestedLocale,\n  }\n}\n"]}

package/dist/lib/locale/locale-store.d.ts

@@ -11,20 +11,49 @@ import type { Locale, LocaleConfig } from '@elytracms/core/cms-core';
  *
  * Deliberately NOT part of `lib/data/data-store` — the locale is studio
  * state, not a data source.
+ *
+ * EC-479/EC-483 — **before a project's locale config is installed, this store
+ * holds `null`, not a locale.** It used to open on the engine's `en/de`
+ * `sampleLocaleConfig` fixture, which is the worst fallback in the family: the
+ * default locale is the literal STORAGE KEY for every localized field value
+ * (`documents.ts:88`), so a fabricated one writes a German project's content
+ * under `en` and correcting it later is a data migration, not a config edit. The
+ * locale is a deliberate choice at project creation (EC-483) and reaches the
+ * studio through {@link configureStudioLocales} from the project's own config —
+ * so "not loaded" is an honest state that surfaces, never an invented one that
+ * silently becomes a key.
+ */
+/**
+ * `{ config, active }` once a project's locales are installed; `{ null, null }`
+ * before that. The two fields move together by construction — there is no state
+ * with a config but no active locale, or an active locale nobody declared.
  */
-interface StudioLocaleState {
+export type StudioLocaleState = {
     readonly config: LocaleConfig;
     readonly active: Locale;
-}
+} | {
+    readonly config: null;
+    readonly active: null;
+};
 /** Snapshot of `{ config, active }` — stable identity until the next change. */
 export declare function getStudioLocaleState(): StudioLocaleState;
-/** The active studio locale every surface renders in. */
-export declare function getStudioLocale(): Locale;
-/** The project locale config driving the switcher options. */
-export declare function getStudioLocaleConfig(): LocaleConfig;
+/**
+ * The active studio locale every surface renders in — `null` until a project's
+ * locale config is installed. A caller that genuinely needs a locale reads the
+ * PROJECT's own default (`CmsStore.localeConfig.default`, the content session's
+ * config); it must never substitute one of its own.
+ */
+export declare function getStudioLocale(): Locale | null;
+/**
+ * The project locale config driving the switcher options — `null` until one is
+ * installed (the studio has no locales of its own to offer).
+ */
+export declare function getStudioLocaleConfig(): LocaleConfig | null;
 /**
  * Switch the ambient locale. Unknown locales are ignored (the switcher only
- * offers configured ones; programmatic callers get a no-op, never a crash).
+ * offers configured ones; programmatic callers get a no-op, never a crash), and
+ * so is any switch attempted before a config is installed — there is nothing to
+ * validate the locale against.
  */
 export declare function setStudioLocale(locale: Locale): void;
 /**
@@ -35,6 +64,9 @@ export declare function setStudioLocale(locale: Locale): void;
 export declare function configureStudioLocales(config: LocaleConfig): void;
 /** Subscribe to locale/config changes. Returns the unsubscribe function. */
 export declare function subscribeStudioLocale(listener: () => void): () => void;
-/** Reset to the sample defaults (tests only — module state is shared). */
+/**
+ * Reset to the pre-config "not loaded" state (tests only — module state is
+ * shared). Never re-seeds a fixture config: a test that queries localized content
+ * must say which locale it means, exactly like a project does.
+ */
 export declare function resetStudioLocale(): void;
-export {};

package/dist/lib/locale/locale-store.js

@@ -1,8 +1,7 @@
-import { createLocaleConfig, isKnownLocale, sampleLocaleConfig } from '@elytracms/core/cms-core';
-let state = {
-    config: sampleLocaleConfig,
-    active: sampleLocaleConfig.default,
-};
+import { createLocaleConfig, isKnownLocale } from '@elytracms/core/cms-core';
+/** The pre-config state: no project locales have been installed yet. */
+const NOT_LOADED = { config: null, active: null };
+let state = NOT_LOADED;
 const listeners = new Set();
 function emit() {
     for (const listener of listeners)
@@ -12,22 +11,34 @@ function emit() {
 export function getStudioLocaleState() {
     return state;
 }
-/** The active studio locale every surface renders in. */
+/**
+ * The active studio locale every surface renders in — `null` until a project's
+ * locale config is installed. A caller that genuinely needs a locale reads the
+ * PROJECT's own default (`CmsStore.localeConfig.default`, the content session's
+ * config); it must never substitute one of its own.
+ */
 export function getStudioLocale() {
     return state.active;
 }
-/** The project locale config driving the switcher options. */
+/**
+ * The project locale config driving the switcher options — `null` until one is
+ * installed (the studio has no locales of its own to offer).
+ */
 export function getStudioLocaleConfig() {
     return state.config;
 }
 /**
  * Switch the ambient locale. Unknown locales are ignored (the switcher only
- * offers configured ones; programmatic callers get a no-op, never a crash).
+ * offers configured ones; programmatic callers get a no-op, never a crash), and
+ * so is any switch attempted before a config is installed — there is nothing to
+ * validate the locale against.
  */
 export function setStudioLocale(locale) {
+    if (state.config === null)
+        return;
     if (locale === state.active || !isKnownLocale(state.config, locale))
         return;
-    state = { ...state, active: locale };
+    state = { config: state.config, active: locale };
     emit();
 }
 /**
@@ -37,10 +48,14 @@ export function setStudioLocale(locale) {
  */
 export function configureStudioLocales(config) {
     const normalized = createLocaleConfig({ default: config.default, locales: config.locales });
-    const sameConfig = normalized.default === state.config.default &&
-        normalized.locales.length === state.config.locales.length &&
-        normalized.locales.every((locale, i) => locale === state.config.locales[i]);
-    const active = isKnownLocale(normalized, state.active) ? state.active : normalized.default;
+    const current = state.config;
+    const sameConfig = current !== null &&
+        normalized.default === current.default &&
+        normalized.locales.length === current.locales.length &&
+        normalized.locales.every((locale, i) => locale === current.locales[i]);
+    const active = state.active !== null && isKnownLocale(normalized, state.active)
+        ? state.active
+        : normalized.default;
     if (sameConfig && active === state.active)
         return;
     state = { config: normalized, active };
@@ -53,9 +68,13 @@ export function subscribeStudioLocale(listener) {
         listeners.delete(listener);
     };
 }
-/** Reset to the sample defaults (tests only — module state is shared). */
+/**
+ * Reset to the pre-config "not loaded" state (tests only — module state is
+ * shared). Never re-seeds a fixture config: a test that queries localized content
+ * must say which locale it means, exactly like a project does.
+ */
 export function resetStudioLocale() {
-    state = { config: sampleLocaleConfig, active: sampleLocaleConfig.default };
+    state = NOT_LOADED;
     emit();
 }
 //# sourceMappingURL=locale-store.js.map

package/dist/lib/locale/locale-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"locale-store.js","sourceRoot":"","sources":["../../../src/lib/locale/locale-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAsBhG,IAAI,KAAK,GAAsB;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,kBAAkB,CAAC,OAAO;CACnC,CAAA;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAA;AAEvC,SAAS,IAAI;IACX,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,EAAE,CAAA;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB;IAClC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAM;IAC3E,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACpC,IAAI,EAAE,CAAA;AACR,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3F,MAAM,UAAU,GACd,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO;QAC3C,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;QACzD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAA;IAC1F,IAAI,UAAU,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAM;IACjD,KAAK,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,QAAoB;IACxD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB;IAC/B,KAAK,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAA;IAC1E,IAAI,EAAE,CAAA;AACR,CAAC","sourcesContent":["import { createLocaleConfig, isKnownLocale, sampleLocaleConfig } from '@elytracms/core/cms-core'\nimport type { Locale, LocaleConfig } from '@elytracms/core/cms-core'\n\n/**\n * The studio's ambient locale (EC-176) — framework-free core.\n *\n * One studio-level active locale, set once via the locale switcher, that the\n * builder canvas preview, the CMS table, and the detail editor all follow.\n * Module-level (not React context) on purpose: the playground's content\n * client (`lib/data/collection-content`) reads it at query time without any\n * provider plumbing, and React surfaces subscribe through\n * `useStudioLocale` (`useSyncExternalStore`).\n *\n * Deliberately NOT part of `lib/data/data-store` — the locale is studio\n * state, not a data source.\n */\n\ninterface StudioLocaleState {\n  readonly config: LocaleConfig\n  readonly active: Locale\n}\n\nlet state: StudioLocaleState = {\n  config: sampleLocaleConfig,\n  active: sampleLocaleConfig.default,\n}\n\nconst listeners = new Set<() => void>()\n\nfunction emit(): void {\n  for (const listener of listeners) listener()\n}\n\n/** Snapshot of `{ config, active }` — stable identity until the next change. */\nexport function getStudioLocaleState(): StudioLocaleState {\n  return state\n}\n\n/** The active studio locale every surface renders in. */\nexport function getStudioLocale(): Locale {\n  return state.active\n}\n\n/** The project locale config driving the switcher options. */\nexport function getStudioLocaleConfig(): LocaleConfig {\n  return state.config\n}\n\n/**\n * Switch the ambient locale. Unknown locales are ignored (the switcher only\n * offers configured ones; programmatic callers get a no-op, never a crash).\n */\nexport function setStudioLocale(locale: Locale): void {\n  if (locale === state.active || !isKnownLocale(state.config, locale)) return\n  state = { ...state, active: locale }\n  emit()\n}\n\n/**\n * Install the project's locale config (e.g. when a CMS session or builder\n * shell mounts with a starter kit's locales). The active locale is kept when\n * it is still configured, otherwise it snaps back to the new default.\n */\nexport function configureStudioLocales(config: LocaleConfig): void {\n  const normalized = createLocaleConfig({ default: config.default, locales: config.locales })\n  const sameConfig =\n    normalized.default === state.config.default &&\n    normalized.locales.length === state.config.locales.length &&\n    normalized.locales.every((locale, i) => locale === state.config.locales[i])\n  const active = isKnownLocale(normalized, state.active) ? state.active : normalized.default\n  if (sameConfig && active === state.active) return\n  state = { config: normalized, active }\n  emit()\n}\n\n/** Subscribe to locale/config changes. Returns the unsubscribe function. */\nexport function subscribeStudioLocale(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => {\n    listeners.delete(listener)\n  }\n}\n\n/** Reset to the sample defaults (tests only — module state is shared). */\nexport function resetStudioLocale(): void {\n  state = { config: sampleLocaleConfig, active: sampleLocaleConfig.default }\n  emit()\n}\n"]}
+{"version":3,"file":"locale-store.js","sourceRoot":"","sources":["../../../src/lib/locale/locale-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAqC5E,wEAAwE;AACxE,MAAM,UAAU,GAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAEpE,IAAI,KAAK,GAAsB,UAAU,CAAA;AAEzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAA;AAEvC,SAAS,IAAI;IACX,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,EAAE,CAAA;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB;IAClC,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAM;IACjC,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAM;IAC3E,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAChD,IAAI,EAAE,CAAA;AACR,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAA;IAC5B,MAAM,UAAU,GACd,OAAO,KAAK,IAAI;QAChB,UAAU,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACtC,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;QACpD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC;QAC9D,CAAC,CAAC,KAAK,CAAC,MAAM;QACd,CAAC,CAAC,UAAU,CAAC,OAAO,CAAA;IACxB,IAAI,UAAU,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAM;IACjD,KAAK,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IACtC,IAAI,EAAE,CAAA;AACR,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,QAAoB;IACxD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,KAAK,GAAG,UAAU,CAAA;IAClB,IAAI,EAAE,CAAA;AACR,CAAC","sourcesContent":["import { createLocaleConfig, isKnownLocale } from '@elytracms/core/cms-core'\nimport type { Locale, LocaleConfig } from '@elytracms/core/cms-core'\n\n/**\n * The studio's ambient locale (EC-176) — framework-free core.\n *\n * One studio-level active locale, set once via the locale switcher, that the\n * builder canvas preview, the CMS table, and the detail editor all follow.\n * Module-level (not React context) on purpose: the playground's content\n * client (`lib/data/collection-content`) reads it at query time without any\n * provider plumbing, and React surfaces subscribe through\n * `useStudioLocale` (`useSyncExternalStore`).\n *\n * Deliberately NOT part of `lib/data/data-store` — the locale is studio\n * state, not a data source.\n *\n * EC-479/EC-483 — **before a project's locale config is installed, this store\n * holds `null`, not a locale.** It used to open on the engine's `en/de`\n * `sampleLocaleConfig` fixture, which is the worst fallback in the family: the\n * default locale is the literal STORAGE KEY for every localized field value\n * (`documents.ts:88`), so a fabricated one writes a German project's content\n * under `en` and correcting it later is a data migration, not a config edit. The\n * locale is a deliberate choice at project creation (EC-483) and reaches the\n * studio through {@link configureStudioLocales} from the project's own config —\n * so \"not loaded\" is an honest state that surfaces, never an invented one that\n * silently becomes a key.\n */\n\n/**\n * `{ config, active }` once a project's locales are installed; `{ null, null }`\n * before that. The two fields move together by construction — there is no state\n * with a config but no active locale, or an active locale nobody declared.\n */\nexport type StudioLocaleState =\n  | { readonly config: LocaleConfig; readonly active: Locale }\n  | { readonly config: null; readonly active: null }\n\n/** The pre-config state: no project locales have been installed yet. */\nconst NOT_LOADED: StudioLocaleState = { config: null, active: null }\n\nlet state: StudioLocaleState = NOT_LOADED\n\nconst listeners = new Set<() => void>()\n\nfunction emit(): void {\n  for (const listener of listeners) listener()\n}\n\n/** Snapshot of `{ config, active }` — stable identity until the next change. */\nexport function getStudioLocaleState(): StudioLocaleState {\n  return state\n}\n\n/**\n * The active studio locale every surface renders in — `null` until a project's\n * locale config is installed. A caller that genuinely needs a locale reads the\n * PROJECT's own default (`CmsStore.localeConfig.default`, the content session's\n * config); it must never substitute one of its own.\n */\nexport function getStudioLocale(): Locale | null {\n  return state.active\n}\n\n/**\n * The project locale config driving the switcher options — `null` until one is\n * installed (the studio has no locales of its own to offer).\n */\nexport function getStudioLocaleConfig(): LocaleConfig | null {\n  return state.config\n}\n\n/**\n * Switch the ambient locale. Unknown locales are ignored (the switcher only\n * offers configured ones; programmatic callers get a no-op, never a crash), and\n * so is any switch attempted before a config is installed — there is nothing to\n * validate the locale against.\n */\nexport function setStudioLocale(locale: Locale): void {\n  if (state.config === null) return\n  if (locale === state.active || !isKnownLocale(state.config, locale)) return\n  state = { config: state.config, active: locale }\n  emit()\n}\n\n/**\n * Install the project's locale config (e.g. when a CMS session or builder\n * shell mounts with a starter kit's locales). The active locale is kept when\n * it is still configured, otherwise it snaps back to the new default.\n */\nexport function configureStudioLocales(config: LocaleConfig): void {\n  const normalized = createLocaleConfig({ default: config.default, locales: config.locales })\n  const current = state.config\n  const sameConfig =\n    current !== null &&\n    normalized.default === current.default &&\n    normalized.locales.length === current.locales.length &&\n    normalized.locales.every((locale, i) => locale === current.locales[i])\n  const active =\n    state.active !== null && isKnownLocale(normalized, state.active)\n      ? state.active\n      : normalized.default\n  if (sameConfig && active === state.active) return\n  state = { config: normalized, active }\n  emit()\n}\n\n/** Subscribe to locale/config changes. Returns the unsubscribe function. */\nexport function subscribeStudioLocale(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => {\n    listeners.delete(listener)\n  }\n}\n\n/**\n * Reset to the pre-config \"not loaded\" state (tests only — module state is\n * shared). Never re-seeds a fixture config: a test that queries localized content\n * must say which locale it means, exactly like a project does.\n */\nexport function resetStudioLocale(): void {\n  state = NOT_LOADED\n  emit()\n}\n"]}

package/dist/lib/locale/locale-switcher.d.ts

@@ -3,7 +3,9 @@
  * builder toolbar and the CMS surface header, both driving the same
  * studio-level active locale. Options come from the project locale config;
  * the default locale is marked. Renders nothing for single-locale projects —
- * no per-control locale ceremony anywhere else.
+ * no per-control locale ceremony anywhere else — nor before a project's locale
+ * config has been installed (EC-479: there is nothing to switch between, and the
+ * engine no longer supplies its own `en/de` fixture to pretend otherwise).
  */
 export declare function LocaleSwitcher({ className }: {
     className?: string;

package/dist/lib/locale/locale-switcher.js

@@ -8,11 +8,13 @@ import { useStudioLocale } from './use-studio-locale.js';
  * builder toolbar and the CMS surface header, both driving the same
  * studio-level active locale. Options come from the project locale config;
  * the default locale is marked. Renders nothing for single-locale projects —
- * no per-control locale ceremony anywhere else.
+ * no per-control locale ceremony anywhere else — nor before a project's locale
+ * config has been installed (EC-479: there is nothing to switch between, and the
+ * engine no longer supplies its own `en/de` fixture to pretend otherwise).
  */
 export function LocaleSwitcher({ className }) {
     const { locale, config, setLocale } = useStudioLocale();
-    if (config.locales.length <= 1)
+    if (config === null || config.locales.length <= 1)
         return null;
     return (_jsxs("div", { role: "group", "aria-label": "Active locale", "data-testid": "locale-switcher", className: cn('flex items-center gap-1 rounded-md bg-muted/50 p-0.5', className), children: [_jsx(Globe, { "aria-hidden": true, className: "ml-1 size-3.5 self-center text-muted-foreground" }), config.locales.map((option) => {
                 const isDefault = option === config.default;

package/dist/lib/locale/locale-switcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"locale-switcher.js","sourceRoot":"","sources":["../../../src/lib/locale/locale-switcher.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAA0B;IAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,CAAA;IACvD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE3C,OAAO,CACL,eACE,IAAI,EAAC,OAAO,gBACD,eAAe,iBACd,iBAAiB,EAC7B,SAAS,EAAE,EAAE,CAAC,sDAAsD,EAAE,SAAS,CAAC,aAEhF,KAAC,KAAK,yBAAa,SAAS,EAAC,iDAAiD,GAAG,EAChF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,MAAM,CAAC,OAAO,CAAA;gBAC3C,OAAO,CACL,kBAEE,IAAI,EAAC,QAAQ,kBACC,MAAM,KAAK,MAAM,EAC/B,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,iBAC7E,iBAAiB,MAAM,EAAE,EACtC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAChC,SAAS,EAAE,EAAE,CACX,2EAA2E,EAC3E,MAAM,KAAK,MAAM;wBACf,CAAC,CAAC,yCAAyC;wBAC3C,CAAC,CAAC,6CAA6C,CAClD,aAEA,MAAM,EACN,SAAS,CAAC,CAAC,CAAC,eAAM,SAAS,EAAC,iCAAiC,uBAAS,CAAC,CAAC,CAAC,IAAI,KAdzE,MAAM,CAeJ,CACV,CAAA;YACH,CAAC,CAAC,IACE,CACP,CAAA;AACH,CAAC","sourcesContent":["import { Globe } from 'lucide-react'\nimport { cn } from '../utils'\nimport { localeChipLabel } from './fallback'\nimport { useStudioLocale } from './use-studio-locale'\n\n/**\n * The ambient locale switcher (EC-176): one segmented control, mounted in the\n * builder toolbar and the CMS surface header, both driving the same\n * studio-level active locale. Options come from the project locale config;\n * the default locale is marked. Renders nothing for single-locale projects —\n * no per-control locale ceremony anywhere else.\n */\nexport function LocaleSwitcher({ className }: { className?: string }) {\n  const { locale, config, setLocale } = useStudioLocale()\n  if (config.locales.length <= 1) return null\n\n  return (\n    <div\n      role=\"group\"\n      aria-label=\"Active locale\"\n      data-testid=\"locale-switcher\"\n      className={cn('flex items-center gap-1 rounded-md bg-muted/50 p-0.5', className)}\n    >\n      <Globe aria-hidden className=\"ml-1 size-3.5 self-center text-muted-foreground\" />\n      {config.locales.map((option) => {\n        const isDefault = option === config.default\n        return (\n          <button\n            key={option}\n            type=\"button\"\n            aria-pressed={option === locale}\n            title={isDefault ? `${localeChipLabel(option)} (default locale)` : localeChipLabel(option)}\n            data-testid={`locale-option-${option}`}\n            onClick={() => setLocale(option)}\n            className={cn(\n              'rounded-[5px] px-2 py-0.5 text-xs font-medium uppercase transition-colors',\n              option === locale\n                ? 'bg-background text-foreground shadow-sm'\n                : 'text-muted-foreground hover:text-foreground',\n            )}\n          >\n            {option}\n            {isDefault ? <span className=\"ml-0.5 text-muted-foreground/70\">·</span> : null}\n          </button>\n        )\n      })}\n    </div>\n  )\n}\n"]}
+{"version":3,"file":"locale-switcher.js","sourceRoot":"","sources":["../../../src/lib/locale/locale-switcher.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,EAAE,EAAE,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,SAAS,EAA0B;IAClE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,CAAA;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAE9D,OAAO,CACL,eACE,IAAI,EAAC,OAAO,gBACD,eAAe,iBACd,iBAAiB,EAC7B,SAAS,EAAE,EAAE,CAAC,sDAAsD,EAAE,SAAS,CAAC,aAEhF,KAAC,KAAK,yBAAa,SAAS,EAAC,iDAAiD,GAAG,EAChF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,MAAM,CAAC,OAAO,CAAA;gBAC3C,OAAO,CACL,kBAEE,IAAI,EAAC,QAAQ,kBACC,MAAM,KAAK,MAAM,EAC/B,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,iBAC7E,iBAAiB,MAAM,EAAE,EACtC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAChC,SAAS,EAAE,EAAE,CACX,2EAA2E,EAC3E,MAAM,KAAK,MAAM;wBACf,CAAC,CAAC,yCAAyC;wBAC3C,CAAC,CAAC,6CAA6C,CAClD,aAEA,MAAM,EACN,SAAS,CAAC,CAAC,CAAC,eAAM,SAAS,EAAC,iCAAiC,uBAAS,CAAC,CAAC,CAAC,IAAI,KAdzE,MAAM,CAeJ,CACV,CAAA;YACH,CAAC,CAAC,IACE,CACP,CAAA;AACH,CAAC","sourcesContent":["import { Globe } from 'lucide-react'\nimport { cn } from '../utils'\nimport { localeChipLabel } from './fallback'\nimport { useStudioLocale } from './use-studio-locale'\n\n/**\n * The ambient locale switcher (EC-176): one segmented control, mounted in the\n * builder toolbar and the CMS surface header, both driving the same\n * studio-level active locale. Options come from the project locale config;\n * the default locale is marked. Renders nothing for single-locale projects —\n * no per-control locale ceremony anywhere else — nor before a project's locale\n * config has been installed (EC-479: there is nothing to switch between, and the\n * engine no longer supplies its own `en/de` fixture to pretend otherwise).\n */\nexport function LocaleSwitcher({ className }: { className?: string }) {\n  const { locale, config, setLocale } = useStudioLocale()\n  if (config === null || config.locales.length <= 1) return null\n\n  return (\n    <div\n      role=\"group\"\n      aria-label=\"Active locale\"\n      data-testid=\"locale-switcher\"\n      className={cn('flex items-center gap-1 rounded-md bg-muted/50 p-0.5', className)}\n    >\n      <Globe aria-hidden className=\"ml-1 size-3.5 self-center text-muted-foreground\" />\n      {config.locales.map((option) => {\n        const isDefault = option === config.default\n        return (\n          <button\n            key={option}\n            type=\"button\"\n            aria-pressed={option === locale}\n            title={isDefault ? `${localeChipLabel(option)} (default locale)` : localeChipLabel(option)}\n            data-testid={`locale-option-${option}`}\n            onClick={() => setLocale(option)}\n            className={cn(\n              'rounded-[5px] px-2 py-0.5 text-xs font-medium uppercase transition-colors',\n              option === locale\n                ? 'bg-background text-foreground shadow-sm'\n                : 'text-muted-foreground hover:text-foreground',\n            )}\n          >\n            {option}\n            {isDefault ? <span className=\"ml-0.5 text-muted-foreground/70\">·</span> : null}\n          </button>\n        )\n      })}\n    </div>\n  )\n}\n"]}

package/dist/lib/locale/use-studio-locale.d.ts

@@ -1,9 +1,14 @@
 import type { Locale, LocaleConfig } from '@elytracms/core/cms-core';
 export interface StudioLocale {
-    /** The ambient active locale every studio surface renders in. */
-    locale: Locale;
-    /** The project locale config driving the switcher options. */
-    config: LocaleConfig;
+    /**
+     * The ambient active locale every studio surface renders in — `null` before a
+     * project's locale config is installed (EC-479: the engine no longer opens on
+     * its own `en/de` fixture). A surface that must render in *some* locale reads
+     * the project's own default; it never invents one.
+     */
+    locale: Locale | null;
+    /** The project locale config driving the switcher options — `null` until installed. */
+    config: LocaleConfig | null;
     setLocale: (locale: Locale) => void;
 }
 /** Subscribe a React surface to the studio's ambient locale (EC-176). */

package/dist/lib/locale/use-studio-locale.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-studio-locale.js","sourceRoot":"","sources":["../../../src/lib/locale/use-studio-locale.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAA;AAE5C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAA;AAUvB,yEAAyE;AACzE,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAChC,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,CACrB,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;AACnF,CAAC","sourcesContent":["import { useSyncExternalStore } from 'react'\nimport type { Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport {\n  getStudioLocaleState,\n  setStudioLocale,\n  subscribeStudioLocale,\n} from './locale-store'\n\nexport interface StudioLocale {\n  /** The ambient active locale every studio surface renders in. */\n  locale: Locale\n  /** The project locale config driving the switcher options. */\n  config: LocaleConfig\n  setLocale: (locale: Locale) => void\n}\n\n/** Subscribe a React surface to the studio's ambient locale (EC-176). */\nexport function useStudioLocale(): StudioLocale {\n  const state = useSyncExternalStore(\n    subscribeStudioLocale,\n    getStudioLocaleState,\n    getStudioLocaleState,\n  )\n  return { locale: state.active, config: state.config, setLocale: setStudioLocale }\n}\n"]}
+{"version":3,"file":"use-studio-locale.js","sourceRoot":"","sources":["../../../src/lib/locale/use-studio-locale.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAA;AAE5C,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,gBAAgB,CAAA;AAevB,yEAAyE;AACzE,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,oBAAoB,CAChC,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,CACrB,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,CAAA;AACnF,CAAC","sourcesContent":["import { useSyncExternalStore } from 'react'\nimport type { Locale, LocaleConfig } from '@elytracms/core/cms-core'\nimport {\n  getStudioLocaleState,\n  setStudioLocale,\n  subscribeStudioLocale,\n} from './locale-store'\n\nexport interface StudioLocale {\n  /**\n   * The ambient active locale every studio surface renders in — `null` before a\n   * project's locale config is installed (EC-479: the engine no longer opens on\n   * its own `en/de` fixture). A surface that must render in *some* locale reads\n   * the project's own default; it never invents one.\n   */\n  locale: Locale | null\n  /** The project locale config driving the switcher options — `null` until installed. */\n  config: LocaleConfig | null\n  setLocale: (locale: Locale) => void\n}\n\n/** Subscribe a React surface to the studio's ambient locale (EC-176). */\nexport function useStudioLocale(): StudioLocale {\n  const state = useSyncExternalStore(\n    subscribeStudioLocale,\n    getStudioLocaleState,\n    getStudioLocaleState,\n  )\n  return { locale: state.active, config: state.config, setLocale: setStudioLocale }\n}\n"]}

package/dist/lib/operations/studio-operations.js

@@ -1,6 +1,7 @@
 import { activeDeploymentKey, selectPersistenceAdapter } from '../persistence/index.js';
 import { attachSessionExpiryReporting } from '../session-expiry.js';
 import { attachConfiguredRevalidationWebhooks } from '../webhooks/index.js';
+import { sessionValidateDocument } from '../cms/document-gate.js';
 import { attachReferenceIndex, createChangesets, createOperations, createRoleAuthorization, } from './operations-package.js';
 /**
  * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):
@@ -15,7 +16,17 @@ export function createStudioOperations(adapter, options = {}) {
     const authorized = options.actor
         ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }
         : {};
-    const operations = createOperations({ adapter, ...authorized });
+    // EC-497: the publish gate validates with the CMS session's canonical option
+    // bag — the same one the detail editor, bulk publish, cell edit, import and
+    // every AI path use — instead of deciding its own (weaker, mode-dependent)
+    // strength off the adapter-served schema record. The seam reads a validator the
+    // mounted session published; with no session it returns `undefined` and the gate
+    // takes its documented fallback.
+    const operations = createOperations({
+        adapter,
+        validateDocument: sessionValidateDocument,
+        ...authorized,
+    });
     // EC-277: when the adapter maintains the index in its own write path (AD-6 "at the
     // source" — the Convex provider does this server-side, so a raw `convex run` is
     // caught too), the client-side subscriber would only double the work. Attach it
@@ -25,7 +36,13 @@ export function createStudioOperations(adapter, options = {}) {
     const references = adapter.maintainsReferenceIndex
         ? noopReferenceIndexAttachment()
         : attachReferenceIndex(operations.events, adapter);
-    const changesets = createChangesets({ adapter, events: operations.events, ...authorized });
+    const changesets = createChangesets({
+        adapter,
+        events: operations.events,
+        // EC-497: a changeset-driven publish is gated identically — same seam, same bag.
+        validateDocument: sessionValidateDocument,
+        ...authorized,
+    });
     // EC-146 instant publish: when a host revalidate endpoint is configured via
     // env, every successful publish-shaped command (document upsert/delete/
     // setState, graph publish/unpublish) fires a signed revalidation webhook.

package/dist/lib/operations/studio-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAgD7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAC/D,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAC1F,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,oCAAoC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { attachConfiguredRevalidationWebhooks } from '../webhooks'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  const operations = createOperations({ adapter, ...authorized })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({ adapter, events: operations.events, ...authorized })\n  // EC-146 instant publish: when a host revalidate endpoint is configured via\n  // env, every successful publish-shaped command (document upsert/delete/\n  // setState, graph publish/unpublish) fires a signed revalidation webhook.\n  // No env (dev/tests) → no-op.\n  attachConfiguredRevalidationWebhooks(operations.events)\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n  return { operations, changesets, adapter, references }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}
+{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAgD7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,iCAAiC;IACjC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,oCAAoC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { attachConfiguredRevalidationWebhooks } from '../webhooks'\nimport { sessionValidateDocument } from '../cms/document-gate'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-497: the publish gate validates with the CMS session's canonical option\n  // bag — the same one the detail editor, bulk publish, cell edit, import and\n  // every AI path use — instead of deciding its own (weaker, mode-dependent)\n  // strength off the adapter-served schema record. The seam reads a validator the\n  // mounted session published; with no session it returns `undefined` and the gate\n  // takes its documented fallback.\n  const operations = createOperations({\n    adapter,\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    events: operations.events,\n    // EC-497: a changeset-driven publish is gated identically — same seam, same bag.\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-146 instant publish: when a host revalidate endpoint is configured via\n  // env, every successful publish-shaped command (document upsert/delete/\n  // setState, graph publish/unpublish) fires a signed revalidation webhook.\n  // No env (dev/tests) → no-op.\n  attachConfiguredRevalidationWebhooks(operations.events)\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n  return { operations, changesets, adapter, references }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}

package/dist/lib/persistence/convex-adapter.d.ts

@@ -1,6 +1,6 @@
 import type { ConvexHttpClient } from 'convex/browser';
 import type { CollectionDef } from '@elytracms/core/cms-core';
-import type { AssetRepository, BackendStatus, BackendValidationInput, BackendValidationResult, BlobStorageAdapter, CliTokenRepository, CmsRepository, DeliveryRepository, MembersRepository, PersistenceAdapter, ReferenceIndexRepository, RedirectRepository, UserRepository, InviteRepository } from '@elytracms/core/persistence';
+import type { AssetRepository, BackendStatus, BackendValidationInput, BackendValidationResult, BlobStorageAdapter, CmsRepository, DeliveryRepository, MembersRepository, PersistenceAdapter, ReferenceIndexRepository, RedirectRepository, UserRepository, InviteRepository } from '@elytracms/core/persistence';
 /**
  * Convex-backed {@link PersistenceAdapter} (brief §10, EC-039). Every repository
  * is implemented against the Convex functions in `apps/builder/convex/*`, mapping
@@ -19,8 +19,6 @@ export declare class ConvexPersistenceAdapter implements PersistenceAdapter {
     readonly users: UserRepository;
     /** Editorial redirects rail — data-backed 301/302 forwards (EC-303). */
     readonly redirects: RedirectRepository;
-    /** Revocable CLI sync tokens, stored hashed (EC-150). */
-    readonly cliTokens: CliTokenRepository;
     /** Convex file storage behind the EC-133 blob boundary (EC-151). */
     readonly blobs: BlobStorageAdapter;
     /** Delivery-pipeline (instant-publish) health, read-only (EC-268/EC-329). */

package/dist/lib/persistence/convex-adapter.js

@@ -612,58 +612,6 @@ class ConvexInviteRepository {
         }
     }
 }
-function cliTokenRecordFromDoc(doc) {
-    return {
-        id: doc.tokenId,
-        label: doc.label,
-        tokenHash: doc.tokenHash,
-        createdAt: doc.createdAt,
-        ...(doc.revokedAt ? { revokedAt: doc.revokedAt } : {}),
-    };
-}
-class ConvexCliTokenRepository {
-    client;
-    clock;
-    constructor(client, clock = realClock) {
-        this.client = client;
-        this.clock = clock;
-    }
-    async createToken(input) {
-        const doc = (await this.client.mutation(mutationRef('cliTokens:create'), {
-            tokenId: newId('tok'),
-            label: input.label,
-            tokenHash: input.tokenHash,
-            createdAt: this.clock(),
-        }));
-        return cliTokenRecordFromDoc(doc);
-    }
-    async listTokens() {
-        const docs = (await this.client.query(queryRef('cliTokens:list'), {}));
-        return docs.map(cliTokenRecordFromDoc);
-    }
-    async revokeToken(tokenId) {
-        try {
-            const doc = (await this.client.mutation(mutationRef('cliTokens:revoke'), {
-                tokenId,
-                revokedAt: this.clock(),
-            }));
-            return cliTokenRecordFromDoc(doc);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (/not-found/i.test(message)) {
-                throw new RecordNotFoundError('cli-token', tokenId);
-            }
-            throw error;
-        }
-    }
-    async findByHash(tokenHash) {
-        const doc = (await this.client.query(queryRef('cliTokens:byHash'), {
-            tokenHash,
-        }));
-        return doc ? cliTokenRecordFromDoc(doc) : undefined;
-    }
-}
 function redirectEntryFromDoc(doc, projectId) {
     return {
         id: doc.redirectId,
@@ -764,8 +712,6 @@ export class ConvexPersistenceAdapter {
     users;
     /** Editorial redirects rail — data-backed 301/302 forwards (EC-303). */
     redirects;
-    /** Revocable CLI sync tokens, stored hashed (EC-150). */
-    cliTokens;
     /** Convex file storage behind the EC-133 blob boundary (EC-151). */
     blobs;
     /** Delivery-pipeline (instant-publish) health, read-only (EC-268/EC-329). */
@@ -794,7 +740,6 @@ export class ConvexPersistenceAdapter {
         this.users = new ConvexUserRepository(client);
         this.invites = new ConvexInviteRepository(client);
         this.redirects = new ConvexRedirectRepository(client);
-        this.cliTokens = new ConvexCliTokenRepository(client);
         this.blobs = new ConvexBlobStorage(client);
         this.delivery = new ConvexDeliveryRepository(client);
     }