@elytracms/studio 0.0.80 → 0.0.82

package/dist/lib/persona/labels.js

@@ -6,35 +6,49 @@ import { humanizeName } from '../utils.js';
  *
  * A non-technical editor must never see a manifest/binding/path-token/validation
  * identifier on — or one click off — the editor path. The engine speaks in stable
- * machine codes (`issueCodeSchema`, `cmsIssueCodeSchema`, `operationErrorCodeSchema`)
- * and machine ids (`base.Heading`, `r-blog-slug-en`); this module is the
- * single translation layer the editor-facing surfaces route through.
+ * machine codes (`cmsIssueCodeSchema`, `operationErrorCodeSchema`) and machine ids
+ * (`base.Heading`, `r-blog-slug-en`); this module is the single translation layer the
+ * editor-facing surfaces route through.
  *
  * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a
- * code in `@elytracms/core/project-graph`, `@elytracms/core/cms-core`, or `@elytracms/core/operations`
+ * code in `@elytracms/core/cms-core` or `@elytracms/core/operations`
  * fails typecheck here until it is given an editor-facing label — the persona
- * boundary cannot silently regress. Engineers keep the raw code: every surface that
+ * boundary cannot silently regress. A table is only worth that guard while something
+ * renders it: EC-509 deleted two that nothing did (see below). Engineers keep the raw
+ * code: every surface that
  * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable
  * via hover/devtools, never rendered as visible copy).
  */
-const GRAPH_ISSUE_LABELS = {
-    'invalid-component-name': 'Invalid component',
-    'unknown-component': 'Unknown component',
-    'duplicate-node-id': 'Duplicate item',
-    'unknown-prop': 'Unknown setting',
-    'invalid-prop': 'Invalid setting',
-    'binding-not-allowed': 'Data not allowed here',
-    'unresolved-binding': 'Missing data',
-    'missing-required-slot': 'Missing content',
-    'unknown-slot': 'Unknown content area',
-    'forbidden-component': 'Not allowed here',
-    'server-only-component': 'Not available in the editor',
-    'invalid-container-direction': 'Invalid layout',
-    'invalid-container-alignment': 'Invalid alignment',
-    'invalid-container-gap': 'Invalid spacing',
-    'invalid-container-columns': 'Invalid columns',
-    'invalid-container-responsive': 'Invalid responsive setting',
-};
+/**
+ * EC-509 — two label tables were DELETED here rather than localized, because measuring
+ * first showed nothing rendered them.
+ *
+ * `GRAPH_ISSUE_LABELS`/`graphIssueLabel` (16 entries, project-graph `IssueCode`) and
+ * `CONDITION_OPERATOR_LABELS`/`conditionOperatorLabel` (8, `ConditionOperator`) had
+ * **zero call sites** outside this file and its own test — measured by grep over
+ * `packages/` + `apps/`, with `cmsIssueLabel` (4 sites) and `operationErrorLabel` (1)
+ * as the known-positive control that the search finds a render site when one exists.
+ *
+ * The graph table was unreachable structurally, not just unused: the ONE live path from
+ * graph validation into the studio is `cms-composition-validators.ts`, which maps a
+ * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and
+ * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an
+ * exhaustiveness guard exists to force a label for cannot reach an editor surface.
+ * `ConditionOperator` is live in the runtime renderer's condition gate
+ * (`runtime-renderer/render.tsx:48`) but has no studio surface: v1 canvas is static
+ * props, editor bindings parked, so no inspector ever shows an operator to name.
+ *
+ * **This overturns an EC-210 decision** (2026-06-17), which kept `graphIssueLabel` when
+ * the validation panel was removed, on the rationale that it was "the EC-192 boundary's
+ * exhaustiveness guard, not panel code". That was right then and its premise is false
+ * now — the guard guards a boundary with no traffic, so it only forced editor copy for
+ * strings no editor can see. Localizing them would have added 24 keys to the same
+ * effect. If a surface ever renders these codes it needs labels written for it, and
+ * will write them localized from the start.
+ *
+ * Neither symbol is referenced by either consumer repo (measured read-only) and neither
+ * appears in docs.
+ */
 /**
  * EC-443: the CMS issue titles live in the EC-241 message catalog
  * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review
@@ -69,60 +83,186 @@ const CMS_ISSUE_LABEL_KEYS = {
     'unknown-alias': 'cms.issue.unknown-alias',
     'unfilled-slot': 'cms.issue.unfilled-slot',
     'custom-validation': 'cms.issue.custom-validation',
+    'unaddressable-url': 'cms.issue.unaddressable-url',
     'unknown-version': 'cms.issue.unknown-version',
 };
-const OPERATION_ERROR_LABELS = {
-    validation: "Couldn't save",
-    'not-found': 'Not found',
-    conflict: 'Already exists',
-    'backend-unavailable': 'Connection problem',
-    unauthorized: 'Not allowed',
-    unknown: 'Something went wrong',
+/**
+ * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.
+ *
+ * `invalid-field-value` reads "Invalid value", which is right when the value is
+ * rejected (wrong type, not among its options) and wrong when it is not: EC-472
+ * deliberately STORES `0202-09-18` as a legal ISO date and merely flags the year as
+ * probably unintended. A title calling that invalid contradicts the value the editor
+ * can plainly see was accepted, on all three surfaces at once.
+ *
+ * Keyed on SEVERITY rather than on the implausible-year case specifically, because
+ * the overstatement belongs to the severity: any future warning under this code has
+ * the same property (the value was kept), and the fix then needs no new entry. A
+ * sparse `Partial` on purpose — a code with no entry keeps one title for both
+ * severities, which is the correct default and keeps
+ * {@link CMS_ISSUE_LABEL_KEYS} the single exhaustive map.
+ */
+const CMS_ISSUE_WARNING_LABEL_KEYS = {
+    'invalid-field-value': 'cms.issue.invalid-field-value.warning',
+};
+/**
+ * EC-494: the badge titles live in the EC-241 catalog (`operations.errorLabel.<code>`),
+ * exactly as EC-443 moved the CMS issue titles. **Measured before changing it:** this
+ * map was a hard-coded English `Record`, so once the EC-494 bodies localized the banner
+ * rendered a German sentence under an English badge — the inverse of the bug this
+ * ticket exists for, and not what the ticket said was there. Still the exhaustive
+ * `Record` over the Zod enum, so a new code fails typecheck until it has a key.
+ */
+const OPERATION_ERROR_LABEL_KEYS = {
+    validation: 'operations.errorLabel.validation',
+    'not-found': 'operations.errorLabel.not-found',
+    conflict: 'operations.errorLabel.conflict',
+    'backend-unavailable': 'operations.errorLabel.backend-unavailable',
+    unauthorized: 'operations.errorLabel.unauthorized',
+    unknown: 'operations.errorLabel.unknown',
 };
 const EXPORT_TARGET_LABELS = {
     nextjs: 'Next.js',
 };
-/**
- * Plain-language labels for condition operators. Exhaustive over
- * `conditionOperatorSchema` — a new operator fails typecheck here until it has an
- * editor-facing label. The raw operator (`eq`, `gte`, …) is a machine token an
- * editor must never read in the inspector.
- */
-const CONDITION_OPERATOR_LABELS = {
-    truthy: 'Is set',
-    exists: 'Exists',
-    eq: 'Equals',
-    neq: 'Does not equal',
-    gt: 'Greater than',
-    gte: 'At least',
-    lt: 'Less than',
-    lte: 'At most',
-};
-/** Plain-language title for a graph validation issue code. */
-export function graphIssueLabel(code) {
-    return GRAPH_ISSUE_LABELS[code];
-}
 /**
  * Plain-language title for a CMS validation issue code — localized against the
  * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;
  * a cast could smuggle one) degrades to its humanized form, never the raw enum.
+ *
+ * `severity` is optional and additive (EC-507): pass the issue's own severity and a
+ * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses
+ * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —
+ * the parameter is optional so that a pure/unit caller naming only a code still
+ * compiles, not because a surface may skip it.
  */
-export function cmsIssueLabel(code) {
-    const key = CMS_ISSUE_LABEL_KEYS[code];
+export function cmsIssueLabel(code, severity) {
+    const key = (severity === 'warning' ? CMS_ISSUE_WARNING_LABEL_KEYS[code] : undefined) ??
+        CMS_ISSUE_LABEL_KEYS[code];
     return key !== undefined ? translate(key) : humanizeName(code);
 }
-/** Plain-language title for an operation failure code. */
+/**
+ * The localized text of a {@link CustomizationIssue} (EC-478) — the ONE place the
+ * studio turns a config-level finding into rendered prose.
+ *
+ * The producing layer (`studio-core/customization.ts`, `app-views/default-modules.tsx`,
+ * `builder/reuse.ts`) cannot own the wording: the EC-236 seam lives in `packages/core`,
+ * a leaf of the DAG that may not import this catalog. So it emits a
+ * `CustomizationMessageRef` — a stable key plus its interpolation values, all of
+ * which are IDENTIFIERS (entry ids, extension points, component ids) and therefore the
+ * same in every language — and this resolves it against the active UI locale. Same
+ * shape as {@link cmsIssueLabel}, one layer down: the engine speaks codes and keys, the
+ * studio speaks the editor's language.
+ *
+ * `messageRef.reason` fills the `{reason}` slot of `invalid-override`, whose detail is
+ * itself prose (a `validate` rejection) and so carries its own key. A ref-less issue —
+ * a third-party producer of this published type — degrades to its English
+ * `issue.message`, which is honest: a visible English sentence beats a missing key.
+ */
+export function customizationIssueMessage(issue) {
+    const ref = issue.messageRef;
+    if (!ref)
+        return issue.message;
+    const vars = { ...ref.vars };
+    if (ref.reason)
+        vars.reason = translate(ref.reason.key, ref.reason.vars);
+    return translate(ref.key, vars);
+}
+/**
+ * The localized BODY of a {@link CmsValidationIssue} (EC-487) — the ONE place the
+ * studio turns a CMS validation finding into rendered prose, exactly as
+ * {@link customizationIssueMessage} does one layer up.
+ *
+ * EC-443 localized the issue TITLES ({@link cmsIssueLabel}); the bodies stayed English
+ * because their producers live in `packages/core`, below this catalog in the DAG. So
+ * the producer emits a `CmsMessageRef` — a stable key plus its interpolation values,
+ * all of which are IDENTIFIERS (field/collection/route ids, locales, patterns, counts)
+ * and therefore the same in every language — and this resolves it against the active
+ * UI locale.
+ *
+ * `messageRef.details` fill placeholders whose text is itself prose, keyed by
+ * placeholder name. A placeholder with no entry keeps whatever the producer put in
+ * `vars` — the honest outcome for prose the engine did not author (a config-as-code
+ * `validate` message, a composition finding), which then stays in its original
+ * language rather than vanishing. A ref-less issue — a third-party producer of this
+ * published type — degrades to its English `issue.message`: a visible English sentence
+ * beats a missing key.
+ */
+export function cmsValidationIssueMessage(issue) {
+    return resolveMessageRef(issue.messageRef, issue.message);
+}
+/**
+ * EC-494 — the ONE resolver every carried message ref goes through.
+ *
+ * Four published types now carry the same `{ key, vars?, details? }` reference —
+ * `CmsValidationIssue` (EC-487), `CustomizationIssue` (EC-478, via its own `reason`
+ * slot), and now `OperationIssue`/`OperationError` and the clipboard + content-query
+ * errors. They are separate declarations only because the EC-265 DAG forbids the
+ * lower subpaths from importing `cms-core`; the RESOLUTION is one rule, so it lives
+ * in one function.
+ *
+ * `fallback` is the producer's prebuilt English, rendered whenever there is no ref —
+ * a third-party producer, a Zod diagnostic, a persistence-layer message, a
+ * config-authored `validate` string. A visible English sentence beats a missing key
+ * (EC-443).
+ */
+function resolveMessageRef(ref, fallback) {
+    if (!ref)
+        return fallback;
+    const vars = { ...ref.vars };
+    for (const [placeholder, nested] of Object.entries(ref.details ?? {})) {
+        vars[placeholder] = translate(nested.key, nested.vars);
+    }
+    return translate(ref.key, vars);
+}
+/**
+ * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).
+ *
+ * These issues cross a process boundary: `operations/documents.ts` rebuilds a
+ * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the
+ * producer cannot translate and the catalog key rides on the wire instead. A ref-less
+ * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer
+ * of this published type — keeps its English.
+ */
+export function operationIssueMessage(issue) {
+    return resolveMessageRef(issue.messageRef, issue.message);
+}
+/**
+ * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line
+ * beside the localized badge in `OperationErrorBanner`. Localizing only the issue
+ * lines would have left exactly one English sentence under a German badge.
+ */
+export function operationErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,
+ * `foreign-format`, `unsupported-version`, `invalid-payload`) or build
+ * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.
+ */
+export function clipboardErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's
+ * per-clause line and the canvas listing notice, both of which render errors built by
+ * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.
+ */
+export function contentQueryErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * Plain-language title for an operation failure code — localized against the active
+ * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle
+ * one) degrades to the generic title, never the raw enum.
+ */
 export function operationErrorLabel(code) {
-    return OPERATION_ERROR_LABELS[code] ?? OPERATION_ERROR_LABELS.unknown;
+    const key = OPERATION_ERROR_LABEL_KEYS[code];
+    return translate(key ?? OPERATION_ERROR_LABEL_KEYS.unknown);
 }
 /** Friendly name for a project export target (`nextjs` → `Next.js`). */
 export function exportTargetLabel(target) {
     return EXPORT_TARGET_LABELS[target] ?? humanizeName(target);
 }
-/** Plain-language label for a condition operator (`gte` → `At least`). */
-export function conditionOperatorLabel(operator) {
-    return CONDITION_OPERATOR_LABELS[operator];
-}
 /** The leaf of a component id, namespace stripped (`base.Heading` → `Heading`). */
 export function componentLeafId(componentId) {
     const dot = componentId.lastIndexOf('.');

package/dist/lib/persona/labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../../src/lib/persona/labels.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAGvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,kBAAkB,GAA8B;IACpD,wBAAwB,EAAE,mBAAmB;IAC7C,mBAAmB,EAAE,mBAAmB;IACxC,mBAAmB,EAAE,gBAAgB;IACrC,cAAc,EAAE,iBAAiB;IACjC,cAAc,EAAE,iBAAiB;IACjC,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,cAAc;IACpC,uBAAuB,EAAE,iBAAiB;IAC1C,cAAc,EAAE,sBAAsB;IACtC,qBAAqB,EAAE,kBAAkB;IACzC,uBAAuB,EAAE,6BAA6B;IACtD,6BAA6B,EAAE,gBAAgB;IAC/C,6BAA6B,EAAE,mBAAmB;IAClD,uBAAuB,EAAE,iBAAiB;IAC1C,2BAA2B,EAAE,iBAAiB;IAC9C,8BAA8B,EAAE,4BAA4B;CAC7D,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAiC;IACzD,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,oBAAoB,EAAE,8BAA8B;IACpD,2BAA2B,EAAE,qCAAqC;IAClE,sBAAsB,EAAE,gCAAgC;IACxD,qBAAqB,EAAE,+BAA+B;IACtD,wBAAwB,EAAE,kCAAkC;IAC5D,qBAAqB,EAAE,+BAA+B;IACtD,yBAAyB,EAAE,mCAAmC;IAC9D,6BAA6B,EAAE,uCAAuC;IACtE,uBAAuB,EAAE,iCAAiC;IAC1D,eAAe,EAAE,yBAAyB;IAC1C,oBAAoB,EAAE,8BAA8B;IACpD,gBAAgB,EAAE,0BAA0B;IAC5C,yBAAyB,EAAE,mCAAmC;IAC9D,gBAAgB,EAAE,0BAA0B;IAC5C,eAAe,EAAE,yBAAyB;IAC1C,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,wBAAwB,EAAE,kCAAkC;IAC5D,0BAA0B,EAAE,oCAAoC;IAChE,iBAAiB,EAAE,2BAA2B;IAC9C,eAAe,EAAE,yBAAyB;IAC1C,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,iBAAiB,EAAE,2BAA2B;CAC/C,CAAA;AAED,MAAM,sBAAsB,GAAuC;IACjE,UAAU,EAAE,eAAe;IAC3B,WAAW,EAAE,WAAW;IACxB,QAAQ,EAAE,gBAAgB;IAC1B,qBAAqB,EAAE,oBAAoB;IAC3C,YAAY,EAAE,aAAa;IAC3B,OAAO,EAAE,sBAAsB;CAChC,CAAA;AAED,MAAM,oBAAoB,GAA2B;IACnD,MAAM,EAAE,SAAS;CAClB,CAAA;AAED;;;;;GAKG;AACH,MAAM,yBAAyB,GAAsC;IACnE,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,QAAQ;IACZ,GAAG,EAAE,gBAAgB;IACrB,EAAE,EAAE,cAAc;IAClB,GAAG,EAAE,UAAU;IACf,EAAE,EAAE,WAAW;IACf,GAAG,EAAE,SAAS;CACf,CAAA;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,IAAe;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAuB,CAAA;IAC5D,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;AAChE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAA;AACvE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,QAA2B;IAChE,OAAO,yBAAyB,CAAC,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,QAAwC,EACxC,MAAe;IAEf,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACxG,OAAO,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import type { IssueCode, ConditionOperator } from '@elytracms/core/project-graph'\nimport type { CmsIssueCode } from '@elytracms/core/cms-core'\nimport { resolveLabel } from '@elytracms/core/cms-core'\nimport type { OperationErrorCode } from '@elytracms/core/operations'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { localizedLabel, translate } from '@elytracms/studio/lib/i18n'\nimport { humanizeName } from '../utils'\n\n/**\n * Persona-aware labels (EC-192 item 2, Milestone B promise).\n *\n * A non-technical editor must never see a manifest/binding/path-token/validation\n * identifier on — or one click off — the editor path. The engine speaks in stable\n * machine codes (`issueCodeSchema`, `cmsIssueCodeSchema`, `operationErrorCodeSchema`)\n * and machine ids (`base.Heading`, `r-blog-slug-en`); this module is the\n * single translation layer the editor-facing surfaces route through.\n *\n * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a\n * code in `@elytracms/core/project-graph`, `@elytracms/core/cms-core`, or `@elytracms/core/operations`\n * fails typecheck here until it is given an editor-facing label — the persona\n * boundary cannot silently regress. Engineers keep the raw code: every surface that\n * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable\n * via hover/devtools, never rendered as visible copy).\n */\n\nconst GRAPH_ISSUE_LABELS: Record<IssueCode, string> = {\n  'invalid-component-name': 'Invalid component',\n  'unknown-component': 'Unknown component',\n  'duplicate-node-id': 'Duplicate item',\n  'unknown-prop': 'Unknown setting',\n  'invalid-prop': 'Invalid setting',\n  'binding-not-allowed': 'Data not allowed here',\n  'unresolved-binding': 'Missing data',\n  'missing-required-slot': 'Missing content',\n  'unknown-slot': 'Unknown content area',\n  'forbidden-component': 'Not allowed here',\n  'server-only-component': 'Not available in the editor',\n  'invalid-container-direction': 'Invalid layout',\n  'invalid-container-alignment': 'Invalid alignment',\n  'invalid-container-gap': 'Invalid spacing',\n  'invalid-container-columns': 'Invalid columns',\n  'invalid-container-responsive': 'Invalid responsive setting',\n}\n\n/**\n * EC-443: the CMS issue titles live in the EC-241 message catalog\n * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review\n * lane localize with the rest of the chrome. This map stays the exhaustive\n * `Record` over the Zod enum — a new code still fails typecheck here until it\n * gets an editor-facing catalog key (the persona boundary cannot silently\n * regress); {@link cmsIssueLabel} resolves it through `translate`.\n */\nconst CMS_ISSUE_LABEL_KEYS: Record<CmsIssueCode, string> = {\n  'duplicate-collection': 'cms.issue.duplicate-collection',\n  'duplicate-field': 'cms.issue.duplicate-field',\n  'unknown-collection': 'cms.issue.unknown-collection',\n  'invalid-collection-config': 'cms.issue.invalid-collection-config',\n  'invalid-field-config': 'cms.issue.invalid-field-config',\n  'reserved-field-name': 'cms.issue.reserved-field-name',\n  'missing-required-field': 'cms.issue.missing-required-field',\n  'invalid-field-value': 'cms.issue.invalid-field-value',\n  'unknown-relation-target': 'cms.issue.unknown-relation-target',\n  'unpublished-relation-target': 'cms.issue.unpublished-relation-target',\n  'cardinality-violation': 'cms.issue.cardinality-violation',\n  'unknown-asset': 'cms.issue.unknown-asset',\n  'duplicate-document': 'cms.issue.duplicate-document',\n  'unknown-locale': 'cms.issue.unknown-locale',\n  'missing-localized-value': 'cms.issue.missing-localized-value',\n  'route-conflict': 'cms.issue.route-conflict',\n  'redirect-loop': 'cms.issue.redirect-loop',\n  'unknown-route-target': 'cms.issue.unknown-route-target',\n  'hierarchy-cycle': 'cms.issue.hierarchy-cycle',\n  'document-nesting-depth': 'cms.issue.document-nesting-depth',\n  'singleton-document-drift': 'cms.issue.singleton-document-drift',\n  'duplicate-alias': 'cms.issue.duplicate-alias',\n  'unknown-alias': 'cms.issue.unknown-alias',\n  'unfilled-slot': 'cms.issue.unfilled-slot',\n  'custom-validation': 'cms.issue.custom-validation',\n  'unknown-version': 'cms.issue.unknown-version',\n}\n\nconst OPERATION_ERROR_LABELS: Record<OperationErrorCode, string> = {\n  validation: \"Couldn't save\",\n  'not-found': 'Not found',\n  conflict: 'Already exists',\n  'backend-unavailable': 'Connection problem',\n  unauthorized: 'Not allowed',\n  unknown: 'Something went wrong',\n}\n\nconst EXPORT_TARGET_LABELS: Record<string, string> = {\n  nextjs: 'Next.js',\n}\n\n/**\n * Plain-language labels for condition operators. Exhaustive over\n * `conditionOperatorSchema` — a new operator fails typecheck here until it has an\n * editor-facing label. The raw operator (`eq`, `gte`, …) is a machine token an\n * editor must never read in the inspector.\n */\nconst CONDITION_OPERATOR_LABELS: Record<ConditionOperator, string> = {\n  truthy: 'Is set',\n  exists: 'Exists',\n  eq: 'Equals',\n  neq: 'Does not equal',\n  gt: 'Greater than',\n  gte: 'At least',\n  lt: 'Less than',\n  lte: 'At most',\n}\n\n/** Plain-language title for a graph validation issue code. */\nexport function graphIssueLabel(code: IssueCode): string {\n  return GRAPH_ISSUE_LABELS[code]\n}\n\n/**\n * Plain-language title for a CMS validation issue code — localized against the\n * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;\n * a cast could smuggle one) degrades to its humanized form, never the raw enum.\n */\nexport function cmsIssueLabel(code: CmsIssueCode): string {\n  const key = CMS_ISSUE_LABEL_KEYS[code] as string | undefined\n  return key !== undefined ? translate(key) : humanizeName(code)\n}\n\n/** Plain-language title for an operation failure code. */\nexport function operationErrorLabel(code: OperationErrorCode): string {\n  return OPERATION_ERROR_LABELS[code] ?? OPERATION_ERROR_LABELS.unknown\n}\n\n/** Friendly name for a project export target (`nextjs` → `Next.js`). */\nexport function exportTargetLabel(target: string): string {\n  return EXPORT_TARGET_LABELS[target] ?? humanizeName(target)\n}\n\n/** Plain-language label for a condition operator (`gte` → `At least`). */\nexport function conditionOperatorLabel(operator: ConditionOperator): string {\n  return CONDITION_OPERATOR_LABELS[operator]\n}\n\n/** The leaf of a component id, namespace stripped (`base.Heading` → `Heading`). */\nexport function componentLeafId(componentId: string): string {\n  const dot = componentId.lastIndexOf('.')\n  return dot === -1 ? componentId : componentId.slice(dot + 1)\n}\n\n/**\n * Strip the `base.`/`project.` namespace prefix from a component id for compact,\n * editor-facing labels (`base.Heading` → `Heading`). Unlike {@link componentLeafId}\n * it removes only those two known prefixes, so a dotted custom id keeps its shape.\n */\nexport function shortId(componentId: string): string {\n  return componentId.replace('base.', '').replace('project.', '')\n}\n\n/**\n * The human display name of a component TYPE for editor-facing surfaces: the\n * manifest's authored `title` (EC-407: resolved through {@link resolveLabel}, so a\n * `{ en, de }` localized title renders in the active studio-UI locale) when present,\n * else the humanized leaf of its id (`base.Heading` → `Heading`,\n * `project.MarketingHero` → `Marketing hero`). Never the raw namespaced id.\n *\n * `locale` is optional: omit it (the render-site default) to resolve against the\n * active studio-UI locale non-reactively; pass it explicitly for pure/unit callers.\n */\nexport function componentDisplayName(\n  componentId: string,\n  manifest?: ComponentManifest | undefined,\n  locale?: string,\n): string {\n  const resolved =\n    locale === undefined ? localizedLabel(manifest?.title) : (resolveLabel(manifest?.title, locale) ?? '')\n  return resolved || humanizeName(componentLeafId(componentId))\n}\n"]}
+{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../../src/lib/persona/labels.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAMvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAiC;IACzD,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,oBAAoB,EAAE,8BAA8B;IACpD,2BAA2B,EAAE,qCAAqC;IAClE,sBAAsB,EAAE,gCAAgC;IACxD,qBAAqB,EAAE,+BAA+B;IACtD,wBAAwB,EAAE,kCAAkC;IAC5D,qBAAqB,EAAE,+BAA+B;IACtD,yBAAyB,EAAE,mCAAmC;IAC9D,6BAA6B,EAAE,uCAAuC;IACtE,uBAAuB,EAAE,iCAAiC;IAC1D,eAAe,EAAE,yBAAyB;IAC1C,oBAAoB,EAAE,8BAA8B;IACpD,gBAAgB,EAAE,0BAA0B;IAC5C,yBAAyB,EAAE,mCAAmC;IAC9D,gBAAgB,EAAE,0BAA0B;IAC5C,eAAe,EAAE,yBAAyB;IAC1C,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,wBAAwB,EAAE,kCAAkC;IAC5D,0BAA0B,EAAE,oCAAoC;IAChE,iBAAiB,EAAE,2BAA2B;IAC9C,eAAe,EAAE,yBAAyB;IAC1C,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,mBAAmB,EAAE,6BAA6B;IAClD,iBAAiB,EAAE,2BAA2B;CAC/C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,4BAA4B,GAA0C;IAC1E,qBAAqB,EAAE,uCAAuC;CAC/D,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAuC;IACrE,UAAU,EAAE,kCAAkC;IAC9C,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,gCAAgC;IAC1C,qBAAqB,EAAE,2CAA2C;IAClE,YAAY,EAAE,oCAAoC;IAClD,OAAO,EAAE,+BAA+B;CACzC,CAAA;AAED,MAAM,oBAAoB,GAA2B;IACnD,MAAM,EAAE,SAAS;CAClB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,QAA2B;IAC3E,MAAM,GAAG,GACP,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,oBAAoB,CAAC,IAAI,CAAwB,CAAA;IACpD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CACxB,GAQa,EACb,QAAgB;IAEhB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IACzB,MAAM,IAAI,GAAoC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7D,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8C;IAClF,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAuB,CAAA;IAClE,OAAO,SAAS,CAAC,GAAG,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAA;AAC7D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;AAC7D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,QAAwC,EACxC,MAAe;IAEf,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACxG,OAAO,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import type { CmsIssueCode, CmsIssueSeverity, CmsValidationIssue } from '@elytracms/core/cms-core'\nimport { resolveLabel } from '@elytracms/core/cms-core'\nimport type { OperationError, OperationErrorCode, OperationIssue } from '@elytracms/core/operations'\nimport type { BuildFragmentError, FragmentParseError } from '@elytracms/core/clipboard'\nimport type { ContentQueryError } from '@elytracms/core/content'\nimport type { CustomizationIssue } from '@elytracms/core/studio-core'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { localizedLabel, translate } from '@elytracms/studio/lib/i18n'\nimport { humanizeName } from '../utils'\n\n/**\n * Persona-aware labels (EC-192 item 2, Milestone B promise).\n *\n * A non-technical editor must never see a manifest/binding/path-token/validation\n * identifier on — or one click off — the editor path. The engine speaks in stable\n * machine codes (`cmsIssueCodeSchema`, `operationErrorCodeSchema`) and machine ids\n * (`base.Heading`, `r-blog-slug-en`); this module is the single translation layer the\n * editor-facing surfaces route through.\n *\n * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a\n * code in `@elytracms/core/cms-core` or `@elytracms/core/operations`\n * fails typecheck here until it is given an editor-facing label — the persona\n * boundary cannot silently regress. A table is only worth that guard while something\n * renders it: EC-509 deleted two that nothing did (see below). Engineers keep the raw\n * code: every surface that\n * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable\n * via hover/devtools, never rendered as visible copy).\n */\n\n/**\n * EC-509 — two label tables were DELETED here rather than localized, because measuring\n * first showed nothing rendered them.\n *\n * `GRAPH_ISSUE_LABELS`/`graphIssueLabel` (16 entries, project-graph `IssueCode`) and\n * `CONDITION_OPERATOR_LABELS`/`conditionOperatorLabel` (8, `ConditionOperator`) had\n * **zero call sites** outside this file and its own test — measured by grep over\n * `packages/` + `apps/`, with `cmsIssueLabel` (4 sites) and `operationErrorLabel` (1)\n * as the known-positive control that the search finds a render site when one exists.\n *\n * The graph table was unreachable structurally, not just unused: the ONE live path from\n * graph validation into the studio is `cms-composition-validators.ts`, which maps a\n * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and\n * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an\n * exhaustiveness guard exists to force a label for cannot reach an editor surface.\n * `ConditionOperator` is live in the runtime renderer's condition gate\n * (`runtime-renderer/render.tsx:48`) but has no studio surface: v1 canvas is static\n * props, editor bindings parked, so no inspector ever shows an operator to name.\n *\n * **This overturns an EC-210 decision** (2026-06-17), which kept `graphIssueLabel` when\n * the validation panel was removed, on the rationale that it was \"the EC-192 boundary's\n * exhaustiveness guard, not panel code\". That was right then and its premise is false\n * now — the guard guards a boundary with no traffic, so it only forced editor copy for\n * strings no editor can see. Localizing them would have added 24 keys to the same\n * effect. If a surface ever renders these codes it needs labels written for it, and\n * will write them localized from the start.\n *\n * Neither symbol is referenced by either consumer repo (measured read-only) and neither\n * appears in docs.\n */\n\n/**\n * EC-443: the CMS issue titles live in the EC-241 message catalog\n * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review\n * lane localize with the rest of the chrome. This map stays the exhaustive\n * `Record` over the Zod enum — a new code still fails typecheck here until it\n * gets an editor-facing catalog key (the persona boundary cannot silently\n * regress); {@link cmsIssueLabel} resolves it through `translate`.\n */\nconst CMS_ISSUE_LABEL_KEYS: Record<CmsIssueCode, string> = {\n  'duplicate-collection': 'cms.issue.duplicate-collection',\n  'duplicate-field': 'cms.issue.duplicate-field',\n  'unknown-collection': 'cms.issue.unknown-collection',\n  'invalid-collection-config': 'cms.issue.invalid-collection-config',\n  'invalid-field-config': 'cms.issue.invalid-field-config',\n  'reserved-field-name': 'cms.issue.reserved-field-name',\n  'missing-required-field': 'cms.issue.missing-required-field',\n  'invalid-field-value': 'cms.issue.invalid-field-value',\n  'unknown-relation-target': 'cms.issue.unknown-relation-target',\n  'unpublished-relation-target': 'cms.issue.unpublished-relation-target',\n  'cardinality-violation': 'cms.issue.cardinality-violation',\n  'unknown-asset': 'cms.issue.unknown-asset',\n  'duplicate-document': 'cms.issue.duplicate-document',\n  'unknown-locale': 'cms.issue.unknown-locale',\n  'missing-localized-value': 'cms.issue.missing-localized-value',\n  'route-conflict': 'cms.issue.route-conflict',\n  'redirect-loop': 'cms.issue.redirect-loop',\n  'unknown-route-target': 'cms.issue.unknown-route-target',\n  'hierarchy-cycle': 'cms.issue.hierarchy-cycle',\n  'document-nesting-depth': 'cms.issue.document-nesting-depth',\n  'singleton-document-drift': 'cms.issue.singleton-document-drift',\n  'duplicate-alias': 'cms.issue.duplicate-alias',\n  'unknown-alias': 'cms.issue.unknown-alias',\n  'unfilled-slot': 'cms.issue.unfilled-slot',\n  'custom-validation': 'cms.issue.custom-validation',\n  'unaddressable-url': 'cms.issue.unaddressable-url',\n  'unknown-version': 'cms.issue.unknown-version',\n}\n\n/**\n * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.\n *\n * `invalid-field-value` reads \"Invalid value\", which is right when the value is\n * rejected (wrong type, not among its options) and wrong when it is not: EC-472\n * deliberately STORES `0202-09-18` as a legal ISO date and merely flags the year as\n * probably unintended. A title calling that invalid contradicts the value the editor\n * can plainly see was accepted, on all three surfaces at once.\n *\n * Keyed on SEVERITY rather than on the implausible-year case specifically, because\n * the overstatement belongs to the severity: any future warning under this code has\n * the same property (the value was kept), and the fix then needs no new entry. A\n * sparse `Partial` on purpose — a code with no entry keeps one title for both\n * severities, which is the correct default and keeps\n * {@link CMS_ISSUE_LABEL_KEYS} the single exhaustive map.\n */\nconst CMS_ISSUE_WARNING_LABEL_KEYS: Partial<Record<CmsIssueCode, string>> = {\n  'invalid-field-value': 'cms.issue.invalid-field-value.warning',\n}\n\n/**\n * EC-494: the badge titles live in the EC-241 catalog (`operations.errorLabel.<code>`),\n * exactly as EC-443 moved the CMS issue titles. **Measured before changing it:** this\n * map was a hard-coded English `Record`, so once the EC-494 bodies localized the banner\n * rendered a German sentence under an English badge — the inverse of the bug this\n * ticket exists for, and not what the ticket said was there. Still the exhaustive\n * `Record` over the Zod enum, so a new code fails typecheck until it has a key.\n */\nconst OPERATION_ERROR_LABEL_KEYS: Record<OperationErrorCode, string> = {\n  validation: 'operations.errorLabel.validation',\n  'not-found': 'operations.errorLabel.not-found',\n  conflict: 'operations.errorLabel.conflict',\n  'backend-unavailable': 'operations.errorLabel.backend-unavailable',\n  unauthorized: 'operations.errorLabel.unauthorized',\n  unknown: 'operations.errorLabel.unknown',\n}\n\nconst EXPORT_TARGET_LABELS: Record<string, string> = {\n  nextjs: 'Next.js',\n}\n\n/**\n * Plain-language title for a CMS validation issue code — localized against the\n * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;\n * a cast could smuggle one) degrades to its humanized form, never the raw enum.\n *\n * `severity` is optional and additive (EC-507): pass the issue's own severity and a\n * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses\n * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —\n * the parameter is optional so that a pure/unit caller naming only a code still\n * compiles, not because a surface may skip it.\n */\nexport function cmsIssueLabel(code: CmsIssueCode, severity?: CmsIssueSeverity): string {\n  const key =\n    (severity === 'warning' ? CMS_ISSUE_WARNING_LABEL_KEYS[code] : undefined) ??\n    (CMS_ISSUE_LABEL_KEYS[code] as string | undefined)\n  return key !== undefined ? translate(key) : humanizeName(code)\n}\n\n/**\n * The localized text of a {@link CustomizationIssue} (EC-478) — the ONE place the\n * studio turns a config-level finding into rendered prose.\n *\n * The producing layer (`studio-core/customization.ts`, `app-views/default-modules.tsx`,\n * `builder/reuse.ts`) cannot own the wording: the EC-236 seam lives in `packages/core`,\n * a leaf of the DAG that may not import this catalog. So it emits a\n * `CustomizationMessageRef` — a stable key plus its interpolation values, all of\n * which are IDENTIFIERS (entry ids, extension points, component ids) and therefore the\n * same in every language — and this resolves it against the active UI locale. Same\n * shape as {@link cmsIssueLabel}, one layer down: the engine speaks codes and keys, the\n * studio speaks the editor's language.\n *\n * `messageRef.reason` fills the `{reason}` slot of `invalid-override`, whose detail is\n * itself prose (a `validate` rejection) and so carries its own key. A ref-less issue —\n * a third-party producer of this published type — degrades to its English\n * `issue.message`, which is honest: a visible English sentence beats a missing key.\n */\nexport function customizationIssueMessage(issue: CustomizationIssue): string {\n  const ref = issue.messageRef\n  if (!ref) return issue.message\n  const vars = { ...ref.vars }\n  if (ref.reason) vars.reason = translate(ref.reason.key, ref.reason.vars)\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized BODY of a {@link CmsValidationIssue} (EC-487) — the ONE place the\n * studio turns a CMS validation finding into rendered prose, exactly as\n * {@link customizationIssueMessage} does one layer up.\n *\n * EC-443 localized the issue TITLES ({@link cmsIssueLabel}); the bodies stayed English\n * because their producers live in `packages/core`, below this catalog in the DAG. So\n * the producer emits a `CmsMessageRef` — a stable key plus its interpolation values,\n * all of which are IDENTIFIERS (field/collection/route ids, locales, patterns, counts)\n * and therefore the same in every language — and this resolves it against the active\n * UI locale.\n *\n * `messageRef.details` fill placeholders whose text is itself prose, keyed by\n * placeholder name. A placeholder with no entry keeps whatever the producer put in\n * `vars` — the honest outcome for prose the engine did not author (a config-as-code\n * `validate` message, a composition finding), which then stays in its original\n * language rather than vanishing. A ref-less issue — a third-party producer of this\n * published type — degrades to its English `issue.message`: a visible English sentence\n * beats a missing key.\n */\nexport function cmsValidationIssueMessage(issue: CmsValidationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * EC-494 — the ONE resolver every carried message ref goes through.\n *\n * Four published types now carry the same `{ key, vars?, details? }` reference —\n * `CmsValidationIssue` (EC-487), `CustomizationIssue` (EC-478, via its own `reason`\n * slot), and now `OperationIssue`/`OperationError` and the clipboard + content-query\n * errors. They are separate declarations only because the EC-265 DAG forbids the\n * lower subpaths from importing `cms-core`; the RESOLUTION is one rule, so it lives\n * in one function.\n *\n * `fallback` is the producer's prebuilt English, rendered whenever there is no ref —\n * a third-party producer, a Zod diagnostic, a persistence-layer message, a\n * config-authored `validate` string. A visible English sentence beats a missing key\n * (EC-443).\n */\nfunction resolveMessageRef(\n  ref:\n    | {\n        readonly key: string\n        readonly vars?: Readonly<Record<string, string | number>>\n        readonly details?: Readonly<\n          Record<string, { readonly key: string; readonly vars?: Readonly<Record<string, string | number>> }>\n        >\n      }\n    | undefined,\n  fallback: string,\n): string {\n  if (!ref) return fallback\n  const vars: Record<string, string | number> = { ...ref.vars }\n  for (const [placeholder, nested] of Object.entries(ref.details ?? {})) {\n    vars[placeholder] = translate(nested.key, nested.vars)\n  }\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).\n *\n * These issues cross a process boundary: `operations/documents.ts` rebuilds a\n * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the\n * producer cannot translate and the catalog key rides on the wire instead. A ref-less\n * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer\n * of this published type — keeps its English.\n */\nexport function operationIssueMessage(issue: OperationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line\n * beside the localized badge in `OperationErrorBanner`. Localizing only the issue\n * lines would have left exactly one English sentence under a German badge.\n */\nexport function operationErrorMessage(error: OperationError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,\n * `foreign-format`, `unsupported-version`, `invalid-payload`) or build\n * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.\n */\nexport function clipboardErrorMessage(error: FragmentParseError | BuildFragmentError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's\n * per-clause line and the canvas listing notice, both of which render errors built by\n * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.\n */\nexport function contentQueryErrorMessage(error: ContentQueryError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * Plain-language title for an operation failure code — localized against the active\n * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle\n * one) degrades to the generic title, never the raw enum.\n */\nexport function operationErrorLabel(code: OperationErrorCode): string {\n  const key = OPERATION_ERROR_LABEL_KEYS[code] as string | undefined\n  return translate(key ?? OPERATION_ERROR_LABEL_KEYS.unknown)\n}\n\n/** Friendly name for a project export target (`nextjs` → `Next.js`). */\nexport function exportTargetLabel(target: string): string {\n  return EXPORT_TARGET_LABELS[target] ?? humanizeName(target)\n}\n\n/** The leaf of a component id, namespace stripped (`base.Heading` → `Heading`). */\nexport function componentLeafId(componentId: string): string {\n  const dot = componentId.lastIndexOf('.')\n  return dot === -1 ? componentId : componentId.slice(dot + 1)\n}\n\n/**\n * Strip the `base.`/`project.` namespace prefix from a component id for compact,\n * editor-facing labels (`base.Heading` → `Heading`). Unlike {@link componentLeafId}\n * it removes only those two known prefixes, so a dotted custom id keeps its shape.\n */\nexport function shortId(componentId: string): string {\n  return componentId.replace('base.', '').replace('project.', '')\n}\n\n/**\n * The human display name of a component TYPE for editor-facing surfaces: the\n * manifest's authored `title` (EC-407: resolved through {@link resolveLabel}, so a\n * `{ en, de }` localized title renders in the active studio-UI locale) when present,\n * else the humanized leaf of its id (`base.Heading` → `Heading`,\n * `project.MarketingHero` → `Marketing hero`). Never the raw namespaced id.\n *\n * `locale` is optional: omit it (the render-site default) to resolve against the\n * active studio-UI locale non-reactively; pass it explicitly for pure/unit callers.\n */\nexport function componentDisplayName(\n  componentId: string,\n  manifest?: ComponentManifest | undefined,\n  locale?: string,\n): string {\n  const resolved =\n    locale === undefined ? localizedLabel(manifest?.title) : (resolveLabel(manifest?.title, locale) ?? '')\n  return resolved || humanizeName(componentLeafId(componentId))\n}\n"]}

package/dist/lib/routes/route-issues.d.ts

@@ -0,0 +1,9 @@
+import type { CmsValidationIssue, RouteRecord } from '@elytracms/core/cms-core';
+import type { RedirectEntry } from '@elytracms/core/persistence';
+/**
+ * The project's structural URL-map issues: route conflicts (from config routes),
+ * redirect loops (from the enabled editorial redirects), and declarations that cannot
+ * serve content at all (EC-484). Pure and total — it never throws, and an empty result
+ * means "no structural problem", not "not checked".
+ */
+export declare function routeValidationIssues(routes: readonly RouteRecord[], redirects?: readonly RedirectEntry[]): readonly CmsValidationIssue[];

package/dist/lib/routes/route-issues.js

@@ -0,0 +1,117 @@
+import { createRouter, isHierarchyTemplate, routeReachabilityIssues } from '@elytracms/core/cms-core';
+/**
+ * The studio's URL-map validation (EC-469) — the pure core.
+ *
+ * `createRouter` has always computed structural issues (**route conflicts** and
+ * **redirect loops**) and, before this, no studio surface showed them. The delivery
+ * content client exposes them as `routerIssues`, but that path never reaches the
+ * studio: its only producer, the Convex `createContent` kit, has no studio caller —
+ * it serves the delivery host. So the studio computes them from the two inputs it
+ * already holds, which is also the only way it can: routes come from config
+ * (`resolveDeploymentRoutes`), redirects come from the editorial rail.
+ *
+ * This is NOT a revived Routes view (EC-303 retired that, correctly — routes are
+ * code). It is validation of the code + data the studio already reads.
+ *
+ * **Fidelity is the whole point**, so both of delivery's input rules are applied
+ * here, not approximated:
+ *
+ * - **Hierarchy mounts are filtered out** (`content/client.ts` does exactly this
+ *   before constructing its router). A mount (`/:path*`, EC-218) is resolved
+ *   per-request against the parent chain, not by the router. Counting it as a route
+ *   makes `/:slug` + `/:path*` look like a conflict — measured — which the runtime
+ *   does not consider one. A false alarm here would be worse than no alarm: it would
+ *   teach developers to ignore the surface.
+ * - **Only ENABLED redirects count** (the Convex content kit filters `row.enabled`).
+ *   `enabled` is the switch for *pausing* a redirect, so a paused chain is not live
+ *   and must not be reported as a loop.
+ *
+ * `unknown-route-target` is deliberately NOT produced by the ROUTER here. Despite the
+ * ticket's framing it is not a router issue: the *resolver* raises it per resolved URL
+ * against the documents that exist (`content/client.ts`), so it needs a URL and a
+ * document pool, neither of which a project-level check has.
+ *
+ * ## Unreachable declarations (EC-484)
+ *
+ * Beside the two router codes, this reports declarations that serve NOTHING —
+ * measured, previously silent everywhere: an all-dynamic route (`/:slug`) matching
+ * every URL at a depth a hierarchy mount serves; and a catch-all with a dynamic prefix
+ * (`/:lang/:path*`), which every router drops and no mount is built from.
+ *
+ * **EC-488 narrowed the first one.** It used to mean the mount's root pages 404 though
+ * they exist in the studio; the resolver now falls through to the mounts when a matched
+ * route resolves no document, so those pages serve and the finding is a `warning` about
+ * content-decided precedence (a page whose composed path collides with the route
+ * collection's slug is still silently shadowed). The severity comes from the shared
+ * `routeReachabilityIssues`, so this surface tracks it without a change here.
+ *
+ * This one belongs in the studio, unlike the mount-vs-mount conflicts EC-482 left to
+ * `elytra doctor`, because of who meets the symptom: a 404 on a page the editor can
+ * see in the studio is what an editor reports and a developer cannot reproduce from a
+ * document. Naming it at the rail foot turns "the About page is broken" into a route
+ * id. It is also not a new precedent — this function has surfaced the code-side
+ * `route-conflict` since EC-469.
+ *
+ * The COLLECTION-dependent half of EC-484 (a mount whose collection has no `parent`
+ * self-relation, so it can never compose a path) is not here: this core is given
+ * routes and redirects, and `elytra doctor` — which loads the collections anyway —
+ * reports it at build time, where a developer fixes it.
+ */
+/**
+ * Collapse the several reports of ONE redirect cycle into one finding.
+ *
+ * `createRouter` walks every redirect and reports a loop per distinct loop *entry
+ * point* (`routes.ts`, EC-020) — correct for a machine, but a 2-hop cycle then reads
+ * as two separate bugs at the rail foot, and fixing one makes both vanish. Every
+ * rotation of a cycle visits the same set of paths, so the sorted member set is a
+ * stable identity for the cycle: dedupe on it, keep the first, and two genuinely
+ * different cycles still report separately. Presentation only — nothing is hidden, and
+ * `createRouter`'s shared behaviour is untouched.
+ */
+function collapseLoops(issues) {
+    const seen = new Set();
+    const out = [];
+    for (const issue of issues) {
+        if (issue.code !== 'redirect-loop') {
+            out.push(issue);
+            continue;
+        }
+        const chain = issue.meta?.chain;
+        const key = Array.isArray(chain)
+            ? [...new Set(chain.map(String))].sort().join('|')
+            : issue.path.join('/');
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(issue);
+    }
+    return out;
+}
+/** Project the stored editorial records onto the routing shape delivery resolves. */
+function liveRedirects(redirects) {
+    return redirects
+        .filter((entry) => entry.enabled)
+        .map((entry) => ({
+        id: entry.id,
+        from: entry.from,
+        to: entry.to,
+        permanent: entry.permanent,
+    }));
+}
+/**
+ * The project's structural URL-map issues: route conflicts (from config routes),
+ * redirect loops (from the enabled editorial redirects), and declarations that cannot
+ * serve content at all (EC-484). Pure and total — it never throws, and an empty result
+ * means "no structural problem", not "not checked".
+ */
+export function routeValidationIssues(routes, redirects = []) {
+    const routable = routes.filter((route) => !isHierarchyTemplate(route));
+    return [
+        ...collapseLoops(createRouter(routable, liveRedirects(redirects)).issues),
+        // Routes only: the reachability checks that need the collection set stay with
+        // `elytra doctor`, which has it. Passing no collections is the documented way to
+        // ask for exactly the route-side half.
+        ...routeReachabilityIssues(routes),
+    ];
+}
+//# sourceMappingURL=route-issues.js.map

package/dist/lib/routes/route-issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-issues.js","sourceRoot":"","sources":["../../../src/lib/routes/route-issues.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAIrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,MAAqC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAyB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACf,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAA;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAClD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,SAAmC;IACxD,OAAO,SAAS;SACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;SAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC,CAAA;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA8B,EAC9B,YAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;IACtE,OAAO;QACL,GAAG,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,8EAA8E;QAC9E,iFAAiF;QACjF,uCAAuC;QACvC,GAAG,uBAAuB,CAAC,MAAM,CAAC;KACnC,CAAA;AACH,CAAC","sourcesContent":["import { createRouter, isHierarchyTemplate, routeReachabilityIssues } from '@elytracms/core/cms-core'\nimport type { CmsValidationIssue, RedirectRecord, RouteRecord } from '@elytracms/core/cms-core'\nimport type { RedirectEntry } from '@elytracms/core/persistence'\n\n/**\n * The studio's URL-map validation (EC-469) — the pure core.\n *\n * `createRouter` has always computed structural issues (**route conflicts** and\n * **redirect loops**) and, before this, no studio surface showed them. The delivery\n * content client exposes them as `routerIssues`, but that path never reaches the\n * studio: its only producer, the Convex `createContent` kit, has no studio caller —\n * it serves the delivery host. So the studio computes them from the two inputs it\n * already holds, which is also the only way it can: routes come from config\n * (`resolveDeploymentRoutes`), redirects come from the editorial rail.\n *\n * This is NOT a revived Routes view (EC-303 retired that, correctly — routes are\n * code). It is validation of the code + data the studio already reads.\n *\n * **Fidelity is the whole point**, so both of delivery's input rules are applied\n * here, not approximated:\n *\n * - **Hierarchy mounts are filtered out** (`content/client.ts` does exactly this\n *   before constructing its router). A mount (`/:path*`, EC-218) is resolved\n *   per-request against the parent chain, not by the router. Counting it as a route\n *   makes `/:slug` + `/:path*` look like a conflict — measured — which the runtime\n *   does not consider one. A false alarm here would be worse than no alarm: it would\n *   teach developers to ignore the surface.\n * - **Only ENABLED redirects count** (the Convex content kit filters `row.enabled`).\n *   `enabled` is the switch for *pausing* a redirect, so a paused chain is not live\n *   and must not be reported as a loop.\n *\n * `unknown-route-target` is deliberately NOT produced by the ROUTER here. Despite the\n * ticket's framing it is not a router issue: the *resolver* raises it per resolved URL\n * against the documents that exist (`content/client.ts`), so it needs a URL and a\n * document pool, neither of which a project-level check has.\n *\n * ## Unreachable declarations (EC-484)\n *\n * Beside the two router codes, this reports declarations that serve NOTHING —\n * measured, previously silent everywhere: an all-dynamic route (`/:slug`) matching\n * every URL at a depth a hierarchy mount serves; and a catch-all with a dynamic prefix\n * (`/:lang/:path*`), which every router drops and no mount is built from.\n *\n * **EC-488 narrowed the first one.** It used to mean the mount's root pages 404 though\n * they exist in the studio; the resolver now falls through to the mounts when a matched\n * route resolves no document, so those pages serve and the finding is a `warning` about\n * content-decided precedence (a page whose composed path collides with the route\n * collection's slug is still silently shadowed). The severity comes from the shared\n * `routeReachabilityIssues`, so this surface tracks it without a change here.\n *\n * This one belongs in the studio, unlike the mount-vs-mount conflicts EC-482 left to\n * `elytra doctor`, because of who meets the symptom: a 404 on a page the editor can\n * see in the studio is what an editor reports and a developer cannot reproduce from a\n * document. Naming it at the rail foot turns \"the About page is broken\" into a route\n * id. It is also not a new precedent — this function has surfaced the code-side\n * `route-conflict` since EC-469.\n *\n * The COLLECTION-dependent half of EC-484 (a mount whose collection has no `parent`\n * self-relation, so it can never compose a path) is not here: this core is given\n * routes and redirects, and `elytra doctor` — which loads the collections anyway —\n * reports it at build time, where a developer fixes it.\n */\n\n/**\n * Collapse the several reports of ONE redirect cycle into one finding.\n *\n * `createRouter` walks every redirect and reports a loop per distinct loop *entry\n * point* (`routes.ts`, EC-020) — correct for a machine, but a 2-hop cycle then reads\n * as two separate bugs at the rail foot, and fixing one makes both vanish. Every\n * rotation of a cycle visits the same set of paths, so the sorted member set is a\n * stable identity for the cycle: dedupe on it, keep the first, and two genuinely\n * different cycles still report separately. Presentation only — nothing is hidden, and\n * `createRouter`'s shared behaviour is untouched.\n */\nfunction collapseLoops(issues: readonly CmsValidationIssue[]): CmsValidationIssue[] {\n  const seen = new Set<string>()\n  const out: CmsValidationIssue[] = []\n  for (const issue of issues) {\n    if (issue.code !== 'redirect-loop') {\n      out.push(issue)\n      continue\n    }\n    const chain = issue.meta?.chain\n    const key = Array.isArray(chain)\n      ? [...new Set(chain.map(String))].sort().join('|')\n      : issue.path.join('/')\n    if (seen.has(key)) continue\n    seen.add(key)\n    out.push(issue)\n  }\n  return out\n}\n\n/** Project the stored editorial records onto the routing shape delivery resolves. */\nfunction liveRedirects(redirects: readonly RedirectEntry[]): RedirectRecord[] {\n  return redirects\n    .filter((entry) => entry.enabled)\n    .map((entry) => ({\n      id: entry.id,\n      from: entry.from,\n      to: entry.to,\n      permanent: entry.permanent,\n    }))\n}\n\n/**\n * The project's structural URL-map issues: route conflicts (from config routes),\n * redirect loops (from the enabled editorial redirects), and declarations that cannot\n * serve content at all (EC-484). Pure and total — it never throws, and an empty result\n * means \"no structural problem\", not \"not checked\".\n */\nexport function routeValidationIssues(\n  routes: readonly RouteRecord[],\n  redirects: readonly RedirectEntry[] = [],\n): readonly CmsValidationIssue[] {\n  const routable = routes.filter((route) => !isHierarchyTemplate(route))\n  return [\n    ...collapseLoops(createRouter(routable, liveRedirects(redirects)).issues),\n    // Routes only: the reachability checks that need the collection set stay with\n    // `elytra doctor`, which has it. Passing no collections is the documented way to\n    // ask for exactly the route-side half.\n    ...routeReachabilityIssues(routes),\n  ]\n}\n"]}

package/dist/lib/webhooks/dispatcher.d.ts

@@ -3,8 +3,11 @@ import type { OperationEvent, OperationEventBus } from '@elytracms/core/operatio
  * Revalidation webhook dispatcher (EC-146): subscribes to the EC-139
  * operations event bus and POSTs a signed `{projectId, event, tags,
  * timestamp}` payload to every configured host revalidate endpoint whenever a
- * publish-shaped command succeeds (document upsert/delete/setState, graph
- * publish/unpublish). The host's `createRevalidateRoute` (`@elytracms/next`)
+ * command that can change **published** output succeeds (document
+ * publish/unpublish/pinVersion/delete, editorial redirect save/remove, plus
+ * asset edits — EC-501 narrowed this from "any document write": a draft save
+ * cannot move published state, so it fires nothing; EC-510 added the redirect
+ * writes, which plainly can). The host's `createRevalidateRoute` (`@elytracms/next`)
  * verifies the HMAC and maps the tags onto `revalidateTag`.
  *
  * This runs **wherever the operations client runs** — in the v1 studio that

package/dist/lib/webhooks/dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../../src/lib/webhooks/dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAkE5C,KAAK,UAAU,OAAO,CACpB,QAAyB,EACzB,MAAqB,EACrB,SAAiB,EACjB,OAAqB;IAErB,MAAM,OAAO,GAA6B;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS;KACV,CAAA;IACD,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,CAAC,wBAAwB,CAAC,EAAE,SAAS;SACtC;QACD,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACzF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,EACzB,OAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE9C,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAQ,EAAE;QAC/C,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,GAAG,OAAO;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACN,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC9C,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,4DAA4D;YAC5D,IAAI,OAAsB,CAAA;YAC1B,GAAG,CAAC;gBACF,OAAO,GAAG,OAAO,CAAA;gBACjB,MAAM,OAAO,CAAA;YACf,CAAC,QAAQ,OAAO,KAAK,OAAO,EAAC;QAC/B,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import type { OperationEvent, OperationEventBus } from '@elytracms/core/operations'\nimport { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing'\nimport { webhookTagsForEvent } from './tags'\nimport type { WebhookTagSet } from './tags'\n\n/**\n * Revalidation webhook dispatcher (EC-146): subscribes to the EC-139\n * operations event bus and POSTs a signed `{projectId, event, tags,\n * timestamp}` payload to every configured host revalidate endpoint whenever a\n * publish-shaped command succeeds (document upsert/delete/setState, graph\n * publish/unpublish). The host's `createRevalidateRoute` (`@elytracms/next`)\n * verifies the HMAC and maps the tags onto `revalidateTag`.\n *\n * This runs **wherever the operations client runs** — in the v1 studio that\n * is the browser, so deliveries are cross-origin `fetch` calls. CORS\n * implications (documented honestly):\n *\n * - the custom signature header always triggers a preflight, so the host\n *   endpoint must answer `OPTIONS` and allow the studio origin —\n *   `createRevalidateRoute({ allowOrigin })` does both;\n * - the shared secret necessarily ships in the studio bundle in this mode.\n *   Acceptable for v1 (the secret only gates cache invalidation, never\n *   content access); the server-side Convex action variant\n *   (`apps/builder/convex/webhooks.ts`) keeps the secret out of the browser\n *   for Convex-backed deployments.\n *\n * Deliveries are fire-and-forget on a serial queue (same pattern as the\n * EC-155 reference index): a slow or unreachable host never blocks the\n * command pipeline, failures surface through `onError` only, and tests await\n * `flush()` for determinism.\n */\n\nexport interface WebhookEndpoint {\n  /** Absolute URL of the host's revalidate route, e.g. `https://site/api/revalidate`. */\n  url: string\n  /** Shared HMAC secret for this endpoint. */\n  secret: string\n}\n\nexport interface WebhookDispatcherOptions {\n  endpoints: readonly WebhookEndpoint[]\n  /**\n   * All locales the project serves. Document events sweep the collection\n   * membership tag once per locale (`collection:<name>:<locale>`).\n   */\n  locales: readonly string[]\n  /** Injectable transport (tests); defaults to global `fetch`. */\n  fetchFn?: typeof fetch\n  /** Injectable clock (tests); payload `timestamp` is `now().toISOString()`. */\n  now?: () => Date\n  /** Delivery failures land here (never thrown into the command pipeline). */\n  onError?: (error: unknown, context: { url: string; event: OperationEvent }) => void\n}\n\nexport interface WebhookDispatcherAttachment {\n  detach(): void\n  /** Await all queued deliveries (tests / shutdown). */\n  flush(): Promise<void>\n}\n\n/** The signed payload shape (mirror of `revalidatePayloadSchema` in @elytracms/next). */\nexport interface RevalidateWebhookPayload {\n  projectId: string\n  event: string\n  tags: string[]\n  timestamp: string\n}\n\nasync function deliver(\n  endpoint: WebhookEndpoint,\n  tagSet: WebhookTagSet,\n  timestamp: string,\n  fetchFn: typeof fetch,\n): Promise<void> {\n  const payload: RevalidateWebhookPayload = {\n    projectId: tagSet.projectId,\n    event: tagSet.event,\n    tags: tagSet.tags,\n    timestamp,\n  }\n  // Sign the exact string that goes on the wire.\n  const rawBody = JSON.stringify(payload)\n  const signature = await signWebhookBody(rawBody, endpoint.secret)\n  const response = await fetchFn(endpoint.url, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      [WEBHOOK_SIGNATURE_HEADER]: signature,\n    },\n    body: rawBody,\n  })\n  if (!response.ok) {\n    throw new Error(`Revalidation webhook to ${endpoint.url} answered ${response.status}.`)\n  }\n}\n\n/**\n * Attach the dispatcher to an event bus; returns a detach/flush handle.\n * With no endpoints configured this still subscribes but never queues work.\n */\nexport function attachRevalidationWebhooks(\n  events: OperationEventBus,\n  options: WebhookDispatcherOptions,\n): WebhookDispatcherAttachment {\n  const fetchFn = options.fetchFn ?? fetch\n  const now = options.now ?? (() => new Date())\n\n  let pending: Promise<void> = Promise.resolve()\n\n  const listener = (event: OperationEvent): void => {\n    if (options.endpoints.length === 0) return\n    const tagSet = webhookTagsForEvent(event, { locales: options.locales })\n    if (!tagSet) return\n    const timestamp = now().toISOString()\n    for (const endpoint of options.endpoints) {\n      pending = pending\n        .then(() => deliver(endpoint, tagSet, timestamp, fetchFn))\n        .catch((error: unknown) => {\n          options.onError?.(error, { url: endpoint.url, event })\n        })\n    }\n  }\n\n  const unsubscribe = events.subscribe(listener)\n  return {\n    detach: unsubscribe,\n    flush: async () => {\n      // Drain until no new deliveries were queued while awaiting.\n      let current: Promise<void>\n      do {\n        current = pending\n        await current\n      } while (current !== pending)\n    },\n  }\n}\n"]}
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../../src/lib/webhooks/dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAqE5C,KAAK,UAAU,OAAO,CACpB,QAAyB,EACzB,MAAqB,EACrB,SAAiB,EACjB,OAAqB;IAErB,MAAM,OAAO,GAA6B;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS;KACV,CAAA;IACD,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,CAAC,wBAAwB,CAAC,EAAE,SAAS;SACtC;QACD,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACzF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,EACzB,OAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE9C,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAQ,EAAE;QAC/C,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,GAAG,OAAO;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACN,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC9C,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,4DAA4D;YAC5D,IAAI,OAAsB,CAAA;YAC1B,GAAG,CAAC;gBACF,OAAO,GAAG,OAAO,CAAA;gBACjB,MAAM,OAAO,CAAA;YACf,CAAC,QAAQ,OAAO,KAAK,OAAO,EAAC;QAC/B,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import type { OperationEvent, OperationEventBus } from '@elytracms/core/operations'\nimport { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing'\nimport { webhookTagsForEvent } from './tags'\nimport type { WebhookTagSet } from './tags'\n\n/**\n * Revalidation webhook dispatcher (EC-146): subscribes to the EC-139\n * operations event bus and POSTs a signed `{projectId, event, tags,\n * timestamp}` payload to every configured host revalidate endpoint whenever a\n * command that can change **published** output succeeds (document\n * publish/unpublish/pinVersion/delete, editorial redirect save/remove, plus\n * asset edits — EC-501 narrowed this from \"any document write\": a draft save\n * cannot move published state, so it fires nothing; EC-510 added the redirect\n * writes, which plainly can). The host's `createRevalidateRoute` (`@elytracms/next`)\n * verifies the HMAC and maps the tags onto `revalidateTag`.\n *\n * This runs **wherever the operations client runs** — in the v1 studio that\n * is the browser, so deliveries are cross-origin `fetch` calls. CORS\n * implications (documented honestly):\n *\n * - the custom signature header always triggers a preflight, so the host\n *   endpoint must answer `OPTIONS` and allow the studio origin —\n *   `createRevalidateRoute({ allowOrigin })` does both;\n * - the shared secret necessarily ships in the studio bundle in this mode.\n *   Acceptable for v1 (the secret only gates cache invalidation, never\n *   content access); the server-side Convex action variant\n *   (`apps/builder/convex/webhooks.ts`) keeps the secret out of the browser\n *   for Convex-backed deployments.\n *\n * Deliveries are fire-and-forget on a serial queue (same pattern as the\n * EC-155 reference index): a slow or unreachable host never blocks the\n * command pipeline, failures surface through `onError` only, and tests await\n * `flush()` for determinism.\n */\n\nexport interface WebhookEndpoint {\n  /** Absolute URL of the host's revalidate route, e.g. `https://site/api/revalidate`. */\n  url: string\n  /** Shared HMAC secret for this endpoint. */\n  secret: string\n}\n\nexport interface WebhookDispatcherOptions {\n  endpoints: readonly WebhookEndpoint[]\n  /**\n   * All locales the project serves. Document events sweep the collection\n   * membership tag once per locale (`collection:<name>:<locale>`).\n   */\n  locales: readonly string[]\n  /** Injectable transport (tests); defaults to global `fetch`. */\n  fetchFn?: typeof fetch\n  /** Injectable clock (tests); payload `timestamp` is `now().toISOString()`. */\n  now?: () => Date\n  /** Delivery failures land here (never thrown into the command pipeline). */\n  onError?: (error: unknown, context: { url: string; event: OperationEvent }) => void\n}\n\nexport interface WebhookDispatcherAttachment {\n  detach(): void\n  /** Await all queued deliveries (tests / shutdown). */\n  flush(): Promise<void>\n}\n\n/** The signed payload shape (mirror of `revalidatePayloadSchema` in @elytracms/next). */\nexport interface RevalidateWebhookPayload {\n  projectId: string\n  event: string\n  tags: string[]\n  timestamp: string\n}\n\nasync function deliver(\n  endpoint: WebhookEndpoint,\n  tagSet: WebhookTagSet,\n  timestamp: string,\n  fetchFn: typeof fetch,\n): Promise<void> {\n  const payload: RevalidateWebhookPayload = {\n    projectId: tagSet.projectId,\n    event: tagSet.event,\n    tags: tagSet.tags,\n    timestamp,\n  }\n  // Sign the exact string that goes on the wire.\n  const rawBody = JSON.stringify(payload)\n  const signature = await signWebhookBody(rawBody, endpoint.secret)\n  const response = await fetchFn(endpoint.url, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      [WEBHOOK_SIGNATURE_HEADER]: signature,\n    },\n    body: rawBody,\n  })\n  if (!response.ok) {\n    throw new Error(`Revalidation webhook to ${endpoint.url} answered ${response.status}.`)\n  }\n}\n\n/**\n * Attach the dispatcher to an event bus; returns a detach/flush handle.\n * With no endpoints configured this still subscribes but never queues work.\n */\nexport function attachRevalidationWebhooks(\n  events: OperationEventBus,\n  options: WebhookDispatcherOptions,\n): WebhookDispatcherAttachment {\n  const fetchFn = options.fetchFn ?? fetch\n  const now = options.now ?? (() => new Date())\n\n  let pending: Promise<void> = Promise.resolve()\n\n  const listener = (event: OperationEvent): void => {\n    if (options.endpoints.length === 0) return\n    const tagSet = webhookTagsForEvent(event, { locales: options.locales })\n    if (!tagSet) return\n    const timestamp = now().toISOString()\n    for (const endpoint of options.endpoints) {\n      pending = pending\n        .then(() => deliver(endpoint, tagSet, timestamp, fetchFn))\n        .catch((error: unknown) => {\n          options.onError?.(error, { url: endpoint.url, event })\n        })\n    }\n  }\n\n  const unsubscribe = events.subscribe(listener)\n  return {\n    detach: unsubscribe,\n    flush: async () => {\n      // Drain until no new deliveries were queued while awaiting.\n      let current: Promise<void>\n      do {\n        current = pending\n        await current\n      } while (current !== pending)\n    },\n  }\n}\n"]}