@elytracms/studio 0.0.81 → 0.0.82

package/dist/lib/i18n/types.d.ts

@@ -32,16 +32,22 @@ export interface StudioI18nConfig {
      */
     defaultLocale?: string;
     /**
-     * **Pin** the studio UI to a fixed locale, overriding browser detection. Set this
-     * for a single-language deployment (e.g. a German site whose editors work in German).
+     * **Pin** the studio UI to a fixed locale, overriding browser detection. **This is the
+     * supported way to choose the studio's language** (EC-513) — set it for any deployment
+     * whose editors work in one language, which is what both production consumers do.
      *
-     * Why it exists: browser detection reads `navigator.languages`, which is **client-only**
-     * — under SSR the server can't see it, so it renders the default locale while the client
-     * renders the browser locale → a hydration mismatch (server text ≠ client text). A pin is
-     * read from *config*, which is imported identically on server and client, so both render
-     * the same locale with no header plumbing and no first-paint flash. When a locale is not
-     * available (not `defaultLocale` and not in `locales`) the pin is ignored (with a console
-     * signal) and detection resumes. Omit it to keep browser-preferred detection.
+     * Why prefer it: browser detection reads `navigator.languages`, which is **client-only**.
+     * The server renders the default locale, and the studio therefore boots in that locale
+     * and hands over to the browser's preference only after hydration — correct, but it
+     * means a moment of default-locale chrome on a cold load. A pin is read from *config*,
+     * imported identically on server and client, so the right language is there from the
+     * first byte.
+     *
+     * There is deliberately **no server-side locale seam** (no `Accept-Language` resolver):
+     * locale resolution is client-side, and a pin is how a host states the answer up front.
+     *
+     * A locale that is not available (neither `defaultLocale` nor a key of `locales`) is
+     * ignored with a console signal, and detection resumes. Omit it to follow the browser.
      */
     locale?: string;
     /**

package/dist/lib/i18n/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/i18n/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgDH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,WAAoB;IACvD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAA;AAC3E,CAAC","sourcesContent":["/**\n * Studio-UI localization types (EC-241) — the leaf module both the message catalog\n * and the resolver import, so nothing here may import studio runtime code (keeps the\n * `defineStudio` config surface free of import cycles).\n *\n * This is the **studio-chrome** axis (engine-owned strings). Schema labels are a\n * separate mechanism — a {@link import('@elytracms/core/cms-core').LocalizedString}\n * on the field/collection def, resolved via `resolveLabel`. Content-*value*\n * localization is a third, unrelated axis (`cms-core/localization.ts`).\n */\n\n/** A source-catalog entry: the English string + an optional translator hint. */\nexport interface SourceMessage {\n  /** The English (source-of-truth) string. */\n  message: string\n  /**\n   * Translator hint/context — the same word can translate differently by context\n   * (the standard `msgctxt`/Lingui-comment idea). **Authoring/translation-time only:**\n   * it lives on the in-engine source catalog and is NOT shipped in the flat\n   * consumer-provided translation catalogs.\n   */\n  description?: string\n}\n\n/** The in-engine English source catalog: message key → {@link SourceMessage}. */\nexport type SourceCatalog = Record<string, SourceMessage>\n\n/** A consumer-provided translation catalog: flat message key → localized string. */\nexport type MessageCatalog = Record<string, string>\n\n/** The studio-UI localization config passed to `defineStudio({ i18n })` (EC-241). */\nexport interface StudioI18nConfig {\n  /**\n   * The locale used when the browser's preferred locale matches nothing available.\n   * Defaults to `'en'` (the in-engine source language).\n   */\n  defaultLocale?: string\n  /**\n   * **Pin** the studio UI to a fixed locale, overriding browser detection. Set this\n   * for a single-language deployment (e.g. a German site whose editors work in German).\n   *\n   * Why it exists: browser detection reads `navigator.languages`, which is **client-only**\n   * — under SSR the server can't see it, so it renders the default locale while the client\n   * renders the browser locale → a hydration mismatch (server text ≠ client text). A pin is\n   * read from *config*, which is imported identically on server and client, so both render\n   * the same locale with no header plumbing and no first-paint flash. When a locale is not\n   * available (not `defaultLocale` and not in `locales`) the pin is ignored (with a console\n   * signal) and detection resumes. Omit it to keep browser-preferred detection.\n   */\n  locale?: string\n  /**\n   * Imported translation catalogs keyed by locale code, e.g. `{ de: deMessages }`.\n   * English is always available as the built-in source, so it need not be listed.\n   */\n  locales?: Record<string, MessageCatalog>\n}\n\n/**\n * Author a source-catalog entry with an optional translator hint (EC-241). Kept in\n * this leaf module so `messages.en.ts` can build the catalog without importing the\n * resolver (which would import studio runtime code).\n */\nexport function msg(message: string, description?: string): SourceMessage {\n  return description !== undefined ? { message, description } : { message }\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/i18n/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsDH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,WAAoB;IACvD,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAA;AAC3E,CAAC","sourcesContent":["/**\n * Studio-UI localization types (EC-241) — the leaf module both the message catalog\n * and the resolver import, so nothing here may import studio runtime code (keeps the\n * `defineStudio` config surface free of import cycles).\n *\n * This is the **studio-chrome** axis (engine-owned strings). Schema labels are a\n * separate mechanism — a {@link import('@elytracms/core/cms-core').LocalizedString}\n * on the field/collection def, resolved via `resolveLabel`. Content-*value*\n * localization is a third, unrelated axis (`cms-core/localization.ts`).\n */\n\n/** A source-catalog entry: the English string + an optional translator hint. */\nexport interface SourceMessage {\n  /** The English (source-of-truth) string. */\n  message: string\n  /**\n   * Translator hint/context — the same word can translate differently by context\n   * (the standard `msgctxt`/Lingui-comment idea). **Authoring/translation-time only:**\n   * it lives on the in-engine source catalog and is NOT shipped in the flat\n   * consumer-provided translation catalogs.\n   */\n  description?: string\n}\n\n/** The in-engine English source catalog: message key → {@link SourceMessage}. */\nexport type SourceCatalog = Record<string, SourceMessage>\n\n/** A consumer-provided translation catalog: flat message key → localized string. */\nexport type MessageCatalog = Record<string, string>\n\n/** The studio-UI localization config passed to `defineStudio({ i18n })` (EC-241). */\nexport interface StudioI18nConfig {\n  /**\n   * The locale used when the browser's preferred locale matches nothing available.\n   * Defaults to `'en'` (the in-engine source language).\n   */\n  defaultLocale?: string\n  /**\n   * **Pin** the studio UI to a fixed locale, overriding browser detection. **This is the\n   * supported way to choose the studio's language** (EC-513) — set it for any deployment\n   * whose editors work in one language, which is what both production consumers do.\n   *\n   * Why prefer it: browser detection reads `navigator.languages`, which is **client-only**.\n   * The server renders the default locale, and the studio therefore boots in that locale\n   * and hands over to the browser's preference only after hydration — correct, but it\n   * means a moment of default-locale chrome on a cold load. A pin is read from *config*,\n   * imported identically on server and client, so the right language is there from the\n   * first byte.\n   *\n   * There is deliberately **no server-side locale seam** (no `Accept-Language` resolver):\n   * locale resolution is client-side, and a pin is how a host states the answer up front.\n   *\n   * A locale that is not available (neither `defaultLocale` nor a key of `locales`) is\n   * ignored with a console signal, and detection resumes. Omit it to follow the browser.\n   */\n  locale?: string\n  /**\n   * Imported translation catalogs keyed by locale code, e.g. `{ de: deMessages }`.\n   * English is always available as the built-in source, so it need not be listed.\n   */\n  locales?: Record<string, MessageCatalog>\n}\n\n/**\n * Author a source-catalog entry with an optional translator hint (EC-241). Kept in\n * this leaf module so `messages.en.ts` can build the catalog without importing the\n * resolver (which would import studio runtime code).\n */\nexport function msg(message: string, description?: string): SourceMessage {\n  return description !== undefined ? { message, description } : { message }\n}\n"]}

package/dist/lib/operations/studio-operations.js

@@ -1,6 +1,7 @@
 import { activeDeploymentKey, selectPersistenceAdapter } from '../persistence/index.js';
 import { attachSessionExpiryReporting } from '../session-expiry.js';
 import { attachConfiguredRevalidationWebhooks } from '../webhooks/index.js';
+import { sessionValidateDocument } from '../cms/document-gate.js';
 import { attachReferenceIndex, createChangesets, createOperations, createRoleAuthorization, } from './operations-package.js';
 /**
  * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):
@@ -15,7 +16,17 @@ export function createStudioOperations(adapter, options = {}) {
     const authorized = options.actor
         ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }
         : {};
-    const operations = createOperations({ adapter, ...authorized });
+    // EC-497: the publish gate validates with the CMS session's canonical option
+    // bag — the same one the detail editor, bulk publish, cell edit, import and
+    // every AI path use — instead of deciding its own (weaker, mode-dependent)
+    // strength off the adapter-served schema record. The seam reads a validator the
+    // mounted session published; with no session it returns `undefined` and the gate
+    // takes its documented fallback.
+    const operations = createOperations({
+        adapter,
+        validateDocument: sessionValidateDocument,
+        ...authorized,
+    });
     // EC-277: when the adapter maintains the index in its own write path (AD-6 "at the
     // source" — the Convex provider does this server-side, so a raw `convex run` is
     // caught too), the client-side subscriber would only double the work. Attach it
@@ -25,7 +36,13 @@ export function createStudioOperations(adapter, options = {}) {
     const references = adapter.maintainsReferenceIndex
         ? noopReferenceIndexAttachment()
         : attachReferenceIndex(operations.events, adapter);
-    const changesets = createChangesets({ adapter, events: operations.events, ...authorized });
+    const changesets = createChangesets({
+        adapter,
+        events: operations.events,
+        // EC-497: a changeset-driven publish is gated identically — same seam, same bag.
+        validateDocument: sessionValidateDocument,
+        ...authorized,
+    });
     // EC-146 instant publish: when a host revalidate endpoint is configured via
     // env, every successful publish-shaped command (document upsert/delete/
     // setState, graph publish/unpublish) fires a signed revalidation webhook.

package/dist/lib/operations/studio-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAgD7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAC/D,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,CAAA;IAC1F,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,oCAAoC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { attachConfiguredRevalidationWebhooks } from '../webhooks'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  const operations = createOperations({ adapter, ...authorized })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({ adapter, events: operations.events, ...authorized })\n  // EC-146 instant publish: when a host revalidate endpoint is configured via\n  // env, every successful publish-shaped command (document upsert/delete/\n  // setState, graph publish/unpublish) fires a signed revalidation webhook.\n  // No env (dev/tests) → no-op.\n  attachConfiguredRevalidationWebhooks(operations.events)\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n  return { operations, changesets, adapter, references }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}
+{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,oCAAoC,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAgD7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,iCAAiC;IACjC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8BAA8B;IAC9B,oCAAoC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACvD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { attachConfiguredRevalidationWebhooks } from '../webhooks'\nimport { sessionValidateDocument } from '../cms/document-gate'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-497: the publish gate validates with the CMS session's canonical option\n  // bag — the same one the detail editor, bulk publish, cell edit, import and\n  // every AI path use — instead of deciding its own (weaker, mode-dependent)\n  // strength off the adapter-served schema record. The seam reads a validator the\n  // mounted session published; with no session it returns `undefined` and the gate\n  // takes its documented fallback.\n  const operations = createOperations({\n    adapter,\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    events: operations.events,\n    // EC-497: a changeset-driven publish is gated identically — same seam, same bag.\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-146 instant publish: when a host revalidate endpoint is configured via\n  // env, every successful publish-shaped command (document upsert/delete/\n  // setState, graph publish/unpublish) fires a signed revalidation webhook.\n  // No env (dev/tests) → no-op.\n  attachConfiguredRevalidationWebhooks(operations.events)\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n  return { operations, changesets, adapter, references }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}

package/dist/lib/persistence/deployment-readiness.js

@@ -2,6 +2,16 @@ import { checkDeploymentReady, expectedDeploymentEnv } from '@elytracms/core/exp
 /** Map the studio's resolved state onto the core readiness facts (pure). */
 export function studioReadinessFacts(inputs) {
     const { backend, workspace, collections, reachable, effectiveUrl } = inputs;
+    // The `config` fact carries `issueCount` only on the INVALID branch — deliberately,
+    // not by omission (EC-506, decided 2026-08-01). `elytra doctor` sets it on the valid
+    // branch too (`cli/src/doctor.js` `configFactsFromOutcome`), which is what makes
+    // `deployment-ready.ts`'s `config-valid` `warn` branch reachable there and not here.
+    // The studio cannot supply it: `WorkspaceState`'s `config` variant carries no issues,
+    // deliberately (see `lib/workspace/workspace-source.ts` for the full argument and the
+    // resurface trigger). The divergence is LATENT, not live — the resolver has no
+    // warning-severity producer, so on a valid config `issues.length` is 0 and both tools
+    // render the same `ok`. When the first config warning exists, close this with the
+    // rest of EC-506, not on its own.
     const config = workspace.kind === 'invalid'
         ? { valid: false, source: workspace.source, issueCount: workspace.issues.length }
         : workspace.kind === 'config'

package/dist/lib/persistence/deployment-readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-readiness.js","sourceRoot":"","sources":["../../../src/lib/persistence/deployment-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAA;AA2C1G,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAE3E,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;QACjF,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;YAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAEvB,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,QAAQ;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IAExD,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,kFAAkF;IAClF,MAAM,aAAa,GACjB,WAAW,CAAC,IAAI,KAAK,QAAQ;QAC3B,CAAC,CAAC;YACE,QAAQ,EAAE,qBAAqB,CAAC;gBAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;gBACpD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC;YACF,iBAAiB,EAAE,kFAAkF;SACtG;QACH,CAAC,CAAC,SAAS,CAAA;IAEf,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,WAAW;QACX,MAAM;QACN,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,yBAAyB,CAAC,MAA6B;IACrE,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3D,CAAC","sourcesContent":["import { checkDeploymentReady, expectedDeploymentEnv } from '@elytracms/core/export-sync/deployment-ready'\nimport type {\n  DeclaredEnvVar,\n  DeploymentReadinessFacts,\n  DeploymentReadinessReport,\n} from '@elytracms/core/export-sync/deployment-ready'\nimport type { CollectionDef } from '@elytracms/core/cms-core'\nimport type { StudioBackendConfig } from './backend-mode'\nimport type { WorkspaceState } from '../workspace'\n\n/**\n * Studio-side adapter for the shared `checkDeploymentReady` contract (EC-258).\n * Maps the studio's resolved state — backend mode (`resolveBackendConfig`),\n * workspace config (`getWorkspaceState`), config-owned collections\n * (`resolveDeploymentCollections`), and an optional reachability probe outcome —\n * onto the core-owned {@link DeploymentReadinessFacts}, then composes the report.\n *\n * A PURE mapper: the async I/O (the `adapter.status()` reachability probe) lives in\n * the boot `DeploymentSetupGate`, which passes the outcome in. `authKeys` is\n * deliberately left unprobed here — the deployment's JWKS endpoint is CORS-blocked\n * from the browser, so the auth-signing-keys check resolves to `unknown` at boot\n * (EC-257's honest sign-in error is the browser's actionable surface; the\n * `elytra doctor` CLI probes it definitively from node). `session` is left unset —\n * this gate runs before auth, so the per-user bucket stays `unknown` (never a false\n * fail) until a signed-in surface supplies it.\n */\nexport interface StudioReadinessInputs {\n  backend: StudioBackendConfig\n  /** The active project's effective deployment URL (`resolveDeploymentUrl`); defaults to `backend.url`. */\n  effectiveUrl?: string\n  workspace: WorkspaceState\n  collections: readonly CollectionDef[]\n  /** Reachability probe outcome (`adapter.status()`); omitted when not probed (playground / unconfigured). */\n  reachable?: { available: boolean; detail?: string }\n  /**\n   * Whether `defineStudio({ ai })` is configured and enabled (EC-399) — drives the\n   * AI provider-key expectation in the deployment-env checks.\n   */\n  aiRouteConfigured?: boolean\n  /** Consumer-declared deployment-env expectations (EC-399) — merged into the engine contract. */\n  declaredEnv?: readonly DeclaredEnvVar[]\n}\n\n/** Map the studio's resolved state onto the core readiness facts (pure). */\nexport function studioReadinessFacts(inputs: StudioReadinessInputs): DeploymentReadinessFacts {\n  const { backend, workspace, collections, reachable, effectiveUrl } = inputs\n\n  const config: DeploymentReadinessFacts['config'] =\n    workspace.kind === 'invalid'\n      ? { valid: false, source: workspace.source, issueCount: workspace.issues.length }\n      : workspace.kind === 'config'\n        ? { valid: true, source: workspace.source }\n        : { valid: true }\n\n  const backendFact: DeploymentReadinessFacts['backend'] =\n    backend.kind === 'convex'\n      ? { kind: 'convex', url: effectiveUrl ?? backend.url }\n      : backend.kind === 'playground'\n        ? { kind: 'playground' }\n        : { kind: 'unconfigured', detail: backend.detail }\n\n  // Expected-env facts (EC-399): the studio surfaces the SAME contract the CLI\n  // checks, but the browser can read neither the Convex deployment env nor the\n  // studio host's server env (the AI key is deliberately never VITE_-prefixed) —\n  // so no presence source is gathered and every env check surfaces as an honest\n  // `unknown` pointing at `elytra doctor`, exactly the auth-signing-keys precedent.\n  const deploymentEnv: DeploymentReadinessFacts['deploymentEnv'] =\n    backendFact.kind === 'convex'\n      ? {\n          expected: expectedDeploymentEnv({\n            aiRouteConfigured: inputs.aiRouteConfigured ?? false,\n            ...(inputs.declaredEnv ? { declared: inputs.declaredEnv } : {}),\n          }),\n          unavailableDetail: 'Not readable from the browser — run `elytra doctor` to check it (presence only).',\n        }\n      : undefined\n\n  return {\n    backend: backendFact,\n    ...(reachable ? { reachable } : {}),\n    collections,\n    config,\n    ...(deploymentEnv ? { deploymentEnv } : {}),\n  }\n}\n\n/** Compose the studio's deployment-readiness report (pure). */\nexport function studioDeploymentReadiness(inputs: StudioReadinessInputs): DeploymentReadinessReport {\n  return checkDeploymentReady(studioReadinessFacts(inputs))\n}\n"]}
+{"version":3,"file":"deployment-readiness.js","sourceRoot":"","sources":["../../../src/lib/persistence/deployment-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAA;AA2C1G,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;IAE3E,oFAAoF;IACpF,qFAAqF;IACrF,iFAAiF;IACjF,qFAAqF;IACrF,sFAAsF;IACtF,sFAAsF;IACtF,+EAA+E;IAC/E,sFAAsF;IACtF,kFAAkF;IAClF,kCAAkC;IAClC,MAAM,MAAM,GACV,SAAS,CAAC,IAAI,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;QACjF,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;YAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAEvB,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,QAAQ;QACvB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE;QACtD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IAExD,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,kFAAkF;IAClF,MAAM,aAAa,GACjB,WAAW,CAAC,IAAI,KAAK,QAAQ;QAC3B,CAAC,CAAC;YACE,QAAQ,EAAE,qBAAqB,CAAC;gBAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;gBACpD,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC;YACF,iBAAiB,EAAE,kFAAkF;SACtG;QACH,CAAC,CAAC,SAAS,CAAA;IAEf,OAAO;QACL,OAAO,EAAE,WAAW;QACpB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,WAAW;QACX,MAAM;QACN,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,yBAAyB,CAAC,MAA6B;IACrE,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3D,CAAC","sourcesContent":["import { checkDeploymentReady, expectedDeploymentEnv } from '@elytracms/core/export-sync/deployment-ready'\nimport type {\n  DeclaredEnvVar,\n  DeploymentReadinessFacts,\n  DeploymentReadinessReport,\n} from '@elytracms/core/export-sync/deployment-ready'\nimport type { CollectionDef } from '@elytracms/core/cms-core'\nimport type { StudioBackendConfig } from './backend-mode'\nimport type { WorkspaceState } from '../workspace'\n\n/**\n * Studio-side adapter for the shared `checkDeploymentReady` contract (EC-258).\n * Maps the studio's resolved state — backend mode (`resolveBackendConfig`),\n * workspace config (`getWorkspaceState`), config-owned collections\n * (`resolveDeploymentCollections`), and an optional reachability probe outcome —\n * onto the core-owned {@link DeploymentReadinessFacts}, then composes the report.\n *\n * A PURE mapper: the async I/O (the `adapter.status()` reachability probe) lives in\n * the boot `DeploymentSetupGate`, which passes the outcome in. `authKeys` is\n * deliberately left unprobed here — the deployment's JWKS endpoint is CORS-blocked\n * from the browser, so the auth-signing-keys check resolves to `unknown` at boot\n * (EC-257's honest sign-in error is the browser's actionable surface; the\n * `elytra doctor` CLI probes it definitively from node). `session` is left unset —\n * this gate runs before auth, so the per-user bucket stays `unknown` (never a false\n * fail) until a signed-in surface supplies it.\n */\nexport interface StudioReadinessInputs {\n  backend: StudioBackendConfig\n  /** The active project's effective deployment URL (`resolveDeploymentUrl`); defaults to `backend.url`. */\n  effectiveUrl?: string\n  workspace: WorkspaceState\n  collections: readonly CollectionDef[]\n  /** Reachability probe outcome (`adapter.status()`); omitted when not probed (playground / unconfigured). */\n  reachable?: { available: boolean; detail?: string }\n  /**\n   * Whether `defineStudio({ ai })` is configured and enabled (EC-399) — drives the\n   * AI provider-key expectation in the deployment-env checks.\n   */\n  aiRouteConfigured?: boolean\n  /** Consumer-declared deployment-env expectations (EC-399) — merged into the engine contract. */\n  declaredEnv?: readonly DeclaredEnvVar[]\n}\n\n/** Map the studio's resolved state onto the core readiness facts (pure). */\nexport function studioReadinessFacts(inputs: StudioReadinessInputs): DeploymentReadinessFacts {\n  const { backend, workspace, collections, reachable, effectiveUrl } = inputs\n\n  // The `config` fact carries `issueCount` only on the INVALID branch — deliberately,\n  // not by omission (EC-506, decided 2026-08-01). `elytra doctor` sets it on the valid\n  // branch too (`cli/src/doctor.js` `configFactsFromOutcome`), which is what makes\n  // `deployment-ready.ts`'s `config-valid` `warn` branch reachable there and not here.\n  // The studio cannot supply it: `WorkspaceState`'s `config` variant carries no issues,\n  // deliberately (see `lib/workspace/workspace-source.ts` for the full argument and the\n  // resurface trigger). The divergence is LATENT, not live — the resolver has no\n  // warning-severity producer, so on a valid config `issues.length` is 0 and both tools\n  // render the same `ok`. When the first config warning exists, close this with the\n  // rest of EC-506, not on its own.\n  const config: DeploymentReadinessFacts['config'] =\n    workspace.kind === 'invalid'\n      ? { valid: false, source: workspace.source, issueCount: workspace.issues.length }\n      : workspace.kind === 'config'\n        ? { valid: true, source: workspace.source }\n        : { valid: true }\n\n  const backendFact: DeploymentReadinessFacts['backend'] =\n    backend.kind === 'convex'\n      ? { kind: 'convex', url: effectiveUrl ?? backend.url }\n      : backend.kind === 'playground'\n        ? { kind: 'playground' }\n        : { kind: 'unconfigured', detail: backend.detail }\n\n  // Expected-env facts (EC-399): the studio surfaces the SAME contract the CLI\n  // checks, but the browser can read neither the Convex deployment env nor the\n  // studio host's server env (the AI key is deliberately never VITE_-prefixed) —\n  // so no presence source is gathered and every env check surfaces as an honest\n  // `unknown` pointing at `elytra doctor`, exactly the auth-signing-keys precedent.\n  const deploymentEnv: DeploymentReadinessFacts['deploymentEnv'] =\n    backendFact.kind === 'convex'\n      ? {\n          expected: expectedDeploymentEnv({\n            aiRouteConfigured: inputs.aiRouteConfigured ?? false,\n            ...(inputs.declaredEnv ? { declared: inputs.declaredEnv } : {}),\n          }),\n          unavailableDetail: 'Not readable from the browser — run `elytra doctor` to check it (presence only).',\n        }\n      : undefined\n\n  return {\n    backend: backendFact,\n    ...(reachable ? { reachable } : {}),\n    collections,\n    config,\n    ...(deploymentEnv ? { deploymentEnv } : {}),\n  }\n}\n\n/** Compose the studio's deployment-readiness report (pure). */\nexport function studioDeploymentReadiness(inputs: StudioReadinessInputs): DeploymentReadinessReport {\n  return checkDeploymentReady(studioReadinessFacts(inputs))\n}\n"]}

package/dist/lib/persona/labels.d.ts

@@ -1,16 +1,21 @@
-import type { IssueCode, ConditionOperator } from '@elytracms/core/project-graph';
-import type { CmsIssueCode, CmsValidationIssue } from '@elytracms/core/cms-core';
-import type { OperationErrorCode } from '@elytracms/core/operations';
+import type { CmsIssueCode, CmsIssueSeverity, CmsValidationIssue } from '@elytracms/core/cms-core';
+import type { OperationError, OperationErrorCode, OperationIssue } from '@elytracms/core/operations';
+import type { BuildFragmentError, FragmentParseError } from '@elytracms/core/clipboard';
+import type { ContentQueryError } from '@elytracms/core/content';
 import type { CustomizationIssue } from '@elytracms/core/studio-core';
 import type { ComponentManifest } from '@elytracms/core/component-registry';
-/** Plain-language title for a graph validation issue code. */
-export declare function graphIssueLabel(code: IssueCode): string;
 /**
  * Plain-language title for a CMS validation issue code — localized against the
  * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;
  * a cast could smuggle one) degrades to its humanized form, never the raw enum.
+ *
+ * `severity` is optional and additive (EC-507): pass the issue's own severity and a
+ * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses
+ * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —
+ * the parameter is optional so that a pure/unit caller naming only a code still
+ * compiles, not because a surface may skip it.
  */
-export declare function cmsIssueLabel(code: CmsIssueCode): string;
+export declare function cmsIssueLabel(code: CmsIssueCode, severity?: CmsIssueSeverity): string;
 /**
  * The localized text of a {@link CustomizationIssue} (EC-478) — the ONE place the
  * studio turns a config-level finding into rendered prose.
@@ -51,12 +56,42 @@ export declare function customizationIssueMessage(issue: CustomizationIssue): st
  * beats a missing key.
  */
 export declare function cmsValidationIssueMessage(issue: CmsValidationIssue): string;
-/** Plain-language title for an operation failure code. */
+/**
+ * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).
+ *
+ * These issues cross a process boundary: `operations/documents.ts` rebuilds a
+ * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the
+ * producer cannot translate and the catalog key rides on the wire instead. A ref-less
+ * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer
+ * of this published type — keeps its English.
+ */
+export declare function operationIssueMessage(issue: OperationIssue): string;
+/**
+ * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line
+ * beside the localized badge in `OperationErrorBanner`. Localizing only the issue
+ * lines would have left exactly one English sentence under a German badge.
+ */
+export declare function operationErrorMessage(error: OperationError): string;
+/**
+ * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,
+ * `foreign-format`, `unsupported-version`, `invalid-payload`) or build
+ * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.
+ */
+export declare function clipboardErrorMessage(error: FragmentParseError | BuildFragmentError): string;
+/**
+ * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's
+ * per-clause line and the canvas listing notice, both of which render errors built by
+ * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.
+ */
+export declare function contentQueryErrorMessage(error: ContentQueryError): string;
+/**
+ * Plain-language title for an operation failure code — localized against the active
+ * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle
+ * one) degrades to the generic title, never the raw enum.
+ */
 export declare function operationErrorLabel(code: OperationErrorCode): string;
 /** Friendly name for a project export target (`nextjs` → `Next.js`). */
 export declare function exportTargetLabel(target: string): string;
-/** Plain-language label for a condition operator (`gte` → `At least`). */
-export declare function conditionOperatorLabel(operator: ConditionOperator): string;
 /** The leaf of a component id, namespace stripped (`base.Heading` → `Heading`). */
 export declare function componentLeafId(componentId: string): string;
 /**

package/dist/lib/persona/labels.js

@@ -6,35 +6,49 @@ import { humanizeName } from '../utils.js';
  *
  * A non-technical editor must never see a manifest/binding/path-token/validation
  * identifier on — or one click off — the editor path. The engine speaks in stable
- * machine codes (`issueCodeSchema`, `cmsIssueCodeSchema`, `operationErrorCodeSchema`)
- * and machine ids (`base.Heading`, `r-blog-slug-en`); this module is the
- * single translation layer the editor-facing surfaces route through.
+ * machine codes (`cmsIssueCodeSchema`, `operationErrorCodeSchema`) and machine ids
+ * (`base.Heading`, `r-blog-slug-en`); this module is the single translation layer the
+ * editor-facing surfaces route through.
  *
  * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a
- * code in `@elytracms/core/project-graph`, `@elytracms/core/cms-core`, or `@elytracms/core/operations`
+ * code in `@elytracms/core/cms-core` or `@elytracms/core/operations`
  * fails typecheck here until it is given an editor-facing label — the persona
- * boundary cannot silently regress. Engineers keep the raw code: every surface that
+ * boundary cannot silently regress. A table is only worth that guard while something
+ * renders it: EC-509 deleted two that nothing did (see below). Engineers keep the raw
+ * code: every surface that
  * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable
  * via hover/devtools, never rendered as visible copy).
  */
-const GRAPH_ISSUE_LABELS = {
-    'invalid-component-name': 'Invalid component',
-    'unknown-component': 'Unknown component',
-    'duplicate-node-id': 'Duplicate item',
-    'unknown-prop': 'Unknown setting',
-    'invalid-prop': 'Invalid setting',
-    'binding-not-allowed': 'Data not allowed here',
-    'unresolved-binding': 'Missing data',
-    'missing-required-slot': 'Missing content',
-    'unknown-slot': 'Unknown content area',
-    'forbidden-component': 'Not allowed here',
-    'server-only-component': 'Not available in the editor',
-    'invalid-container-direction': 'Invalid layout',
-    'invalid-container-alignment': 'Invalid alignment',
-    'invalid-container-gap': 'Invalid spacing',
-    'invalid-container-columns': 'Invalid columns',
-    'invalid-container-responsive': 'Invalid responsive setting',
-};
+/**
+ * EC-509 — two label tables were DELETED here rather than localized, because measuring
+ * first showed nothing rendered them.
+ *
+ * `GRAPH_ISSUE_LABELS`/`graphIssueLabel` (16 entries, project-graph `IssueCode`) and
+ * `CONDITION_OPERATOR_LABELS`/`conditionOperatorLabel` (8, `ConditionOperator`) had
+ * **zero call sites** outside this file and its own test — measured by grep over
+ * `packages/` + `apps/`, with `cmsIssueLabel` (4 sites) and `operationErrorLabel` (1)
+ * as the known-positive control that the search finds a render site when one exists.
+ *
+ * The graph table was unreachable structurally, not just unused: the ONE live path from
+ * graph validation into the studio is `cms-composition-validators.ts`, which maps a
+ * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and
+ * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an
+ * exhaustiveness guard exists to force a label for cannot reach an editor surface.
+ * `ConditionOperator` is live in the runtime renderer's condition gate
+ * (`runtime-renderer/render.tsx:48`) but has no studio surface: v1 canvas is static
+ * props, editor bindings parked, so no inspector ever shows an operator to name.
+ *
+ * **This overturns an EC-210 decision** (2026-06-17), which kept `graphIssueLabel` when
+ * the validation panel was removed, on the rationale that it was "the EC-192 boundary's
+ * exhaustiveness guard, not panel code". That was right then and its premise is false
+ * now — the guard guards a boundary with no traffic, so it only forced editor copy for
+ * strings no editor can see. Localizing them would have added 24 keys to the same
+ * effect. If a surface ever renders these codes it needs labels written for it, and
+ * will write them localized from the start.
+ *
+ * Neither symbol is referenced by either consumer repo (measured read-only) and neither
+ * appears in docs.
+ */
 /**
  * EC-443: the CMS issue titles live in the EC-241 message catalog
  * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review
@@ -69,46 +83,61 @@ const CMS_ISSUE_LABEL_KEYS = {
     'unknown-alias': 'cms.issue.unknown-alias',
     'unfilled-slot': 'cms.issue.unfilled-slot',
     'custom-validation': 'cms.issue.custom-validation',
+    'unaddressable-url': 'cms.issue.unaddressable-url',
     'unknown-version': 'cms.issue.unknown-version',
 };
-const OPERATION_ERROR_LABELS = {
-    validation: "Couldn't save",
-    'not-found': 'Not found',
-    conflict: 'Already exists',
-    'backend-unavailable': 'Connection problem',
-    unauthorized: 'Not allowed',
-    unknown: 'Something went wrong',
+/**
+ * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.
+ *
+ * `invalid-field-value` reads "Invalid value", which is right when the value is
+ * rejected (wrong type, not among its options) and wrong when it is not: EC-472
+ * deliberately STORES `0202-09-18` as a legal ISO date and merely flags the year as
+ * probably unintended. A title calling that invalid contradicts the value the editor
+ * can plainly see was accepted, on all three surfaces at once.
+ *
+ * Keyed on SEVERITY rather than on the implausible-year case specifically, because
+ * the overstatement belongs to the severity: any future warning under this code has
+ * the same property (the value was kept), and the fix then needs no new entry. A
+ * sparse `Partial` on purpose — a code with no entry keeps one title for both
+ * severities, which is the correct default and keeps
+ * {@link CMS_ISSUE_LABEL_KEYS} the single exhaustive map.
+ */
+const CMS_ISSUE_WARNING_LABEL_KEYS = {
+    'invalid-field-value': 'cms.issue.invalid-field-value.warning',
+};
+/**
+ * EC-494: the badge titles live in the EC-241 catalog (`operations.errorLabel.<code>`),
+ * exactly as EC-443 moved the CMS issue titles. **Measured before changing it:** this
+ * map was a hard-coded English `Record`, so once the EC-494 bodies localized the banner
+ * rendered a German sentence under an English badge — the inverse of the bug this
+ * ticket exists for, and not what the ticket said was there. Still the exhaustive
+ * `Record` over the Zod enum, so a new code fails typecheck until it has a key.
+ */
+const OPERATION_ERROR_LABEL_KEYS = {
+    validation: 'operations.errorLabel.validation',
+    'not-found': 'operations.errorLabel.not-found',
+    conflict: 'operations.errorLabel.conflict',
+    'backend-unavailable': 'operations.errorLabel.backend-unavailable',
+    unauthorized: 'operations.errorLabel.unauthorized',
+    unknown: 'operations.errorLabel.unknown',
 };
 const EXPORT_TARGET_LABELS = {
     nextjs: 'Next.js',
 };
-/**
- * Plain-language labels for condition operators. Exhaustive over
- * `conditionOperatorSchema` — a new operator fails typecheck here until it has an
- * editor-facing label. The raw operator (`eq`, `gte`, …) is a machine token an
- * editor must never read in the inspector.
- */
-const CONDITION_OPERATOR_LABELS = {
-    truthy: 'Is set',
-    exists: 'Exists',
-    eq: 'Equals',
-    neq: 'Does not equal',
-    gt: 'Greater than',
-    gte: 'At least',
-    lt: 'Less than',
-    lte: 'At most',
-};
-/** Plain-language title for a graph validation issue code. */
-export function graphIssueLabel(code) {
-    return GRAPH_ISSUE_LABELS[code];
-}
 /**
  * Plain-language title for a CMS validation issue code — localized against the
  * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;
  * a cast could smuggle one) degrades to its humanized form, never the raw enum.
+ *
+ * `severity` is optional and additive (EC-507): pass the issue's own severity and a
+ * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses
+ * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —
+ * the parameter is optional so that a pure/unit caller naming only a code still
+ * compiles, not because a surface may skip it.
  */
-export function cmsIssueLabel(code) {
-    const key = CMS_ISSUE_LABEL_KEYS[code];
+export function cmsIssueLabel(code, severity) {
+    const key = (severity === 'warning' ? CMS_ISSUE_WARNING_LABEL_KEYS[code] : undefined) ??
+        CMS_ISSUE_LABEL_KEYS[code];
     return key !== undefined ? translate(key) : humanizeName(code);
 }
 /**
@@ -159,27 +188,81 @@ export function customizationIssueMessage(issue) {
  * beats a missing key.
  */
 export function cmsValidationIssueMessage(issue) {
-    const ref = issue.messageRef;
+    return resolveMessageRef(issue.messageRef, issue.message);
+}
+/**
+ * EC-494 — the ONE resolver every carried message ref goes through.
+ *
+ * Four published types now carry the same `{ key, vars?, details? }` reference —
+ * `CmsValidationIssue` (EC-487), `CustomizationIssue` (EC-478, via its own `reason`
+ * slot), and now `OperationIssue`/`OperationError` and the clipboard + content-query
+ * errors. They are separate declarations only because the EC-265 DAG forbids the
+ * lower subpaths from importing `cms-core`; the RESOLUTION is one rule, so it lives
+ * in one function.
+ *
+ * `fallback` is the producer's prebuilt English, rendered whenever there is no ref —
+ * a third-party producer, a Zod diagnostic, a persistence-layer message, a
+ * config-authored `validate` string. A visible English sentence beats a missing key
+ * (EC-443).
+ */
+function resolveMessageRef(ref, fallback) {
     if (!ref)
-        return issue.message;
+        return fallback;
     const vars = { ...ref.vars };
     for (const [placeholder, nested] of Object.entries(ref.details ?? {})) {
         vars[placeholder] = translate(nested.key, nested.vars);
     }
     return translate(ref.key, vars);
 }
-/** Plain-language title for an operation failure code. */
+/**
+ * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).
+ *
+ * These issues cross a process boundary: `operations/documents.ts` rebuilds a
+ * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the
+ * producer cannot translate and the catalog key rides on the wire instead. A ref-less
+ * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer
+ * of this published type — keeps its English.
+ */
+export function operationIssueMessage(issue) {
+    return resolveMessageRef(issue.messageRef, issue.message);
+}
+/**
+ * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line
+ * beside the localized badge in `OperationErrorBanner`. Localizing only the issue
+ * lines would have left exactly one English sentence under a German badge.
+ */
+export function operationErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,
+ * `foreign-format`, `unsupported-version`, `invalid-payload`) or build
+ * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.
+ */
+export function clipboardErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's
+ * per-clause line and the canvas listing notice, both of which render errors built by
+ * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.
+ */
+export function contentQueryErrorMessage(error) {
+    return resolveMessageRef(error.messageRef, error.message);
+}
+/**
+ * Plain-language title for an operation failure code — localized against the active
+ * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle
+ * one) degrades to the generic title, never the raw enum.
+ */
 export function operationErrorLabel(code) {
-    return OPERATION_ERROR_LABELS[code] ?? OPERATION_ERROR_LABELS.unknown;
+    const key = OPERATION_ERROR_LABEL_KEYS[code];
+    return translate(key ?? OPERATION_ERROR_LABEL_KEYS.unknown);
 }
 /** Friendly name for a project export target (`nextjs` → `Next.js`). */
 export function exportTargetLabel(target) {
     return EXPORT_TARGET_LABELS[target] ?? humanizeName(target);
 }
-/** Plain-language label for a condition operator (`gte` → `At least`). */
-export function conditionOperatorLabel(operator) {
-    return CONDITION_OPERATOR_LABELS[operator];
-}
 /** The leaf of a component id, namespace stripped (`base.Heading` → `Heading`). */
 export function componentLeafId(componentId) {
     const dot = componentId.lastIndexOf('.');