@elytracms/studio 0.0.85 → 0.0.87

package/dist/lib/clipboard/paste-issues.d.ts

@@ -2,19 +2,24 @@ import type { ComponentNode } from '@elytracms/core/project-graph';
 /**
  * Permissive-paste validation (EC-175): pasting NEVER refuses a structurally
  * valid fragment. Instead, the inserted subtree is diffed against the TARGET
- * project's registry and data sources at paste time (cross-project semantics:
- * the fragment's source project is irrelevant — what matters is what *this*
- * project can resolve), and every mismatch becomes a visible, node-addressed
- * issue the notice deep-links. The renderer's existing fallbacks keep the
- * pasted nodes visible meanwhile.
+ * project's registry at paste time (cross-project semantics: the fragment's
+ * source project is irrelevant — what matters is what *this* project can
+ * resolve), and every mismatch becomes a visible, node-addressed issue the
+ * notice deep-links. The renderer's existing fallbacks keep the pasted nodes
+ * visible meanwhile.
  *
- * EC-494: this diff runs STUDIO-side (it needs the target registry and the session's
- * data sources), so it holds the active locale and can call `translate` directly —
- * no message ref has to cross a boundary, unlike the engine-built clipboard errors
- * in `@elytracms/core/clipboard`.
+ * EC-574: the second half of this diff — binding source ids the target could
+ * not resolve — went with the data-binding subsystem. A pasted node carrying a
+ * retired binding member is reported by the composition validator
+ * (`legacy-node-member`) when the document is validated, not here.
+ *
+ * EC-494: this diff runs STUDIO-side (it needs the target registry), so it holds
+ * the active locale and can call `translate` directly — no message ref has to
+ * cross a boundary, unlike the engine-built clipboard errors in
+ * `@elytracms/core/clipboard`.
  */
 export interface PasteIssue {
-    kind: 'missing-component' | 'unresolved-binding';
+    kind: 'missing-component';
     message: string;
     /** The inserted node carrying the problem — deep-link target. */
     nodeId: string;
@@ -22,18 +27,15 @@ export interface PasteIssue {
 export interface PasteDiff {
     /** Distinct component ids absent from the target registry. */
     missingComponents: string[];
-    /** Distinct binding source ids the target cannot resolve. */
-    unresolvedBindings: string[];
     issues: PasteIssue[];
 }
 /**
  * Diff an inserted subtree (with its final, session-assigned node ids)
- * against the target project's registry + known data sources.
+ * against the target project's registry.
  */
 export declare function diffPastedSubtree(args: {
     node: ComponentNode;
     hasComponent: (componentId: string) => boolean;
-    knownSourceIds: ReadonlySet<string>;
 }): PasteDiff;
-/** “Pasted — 2 bindings unresolved, 1 component missing”, or just “Pasted”. */
+/** “Pasted — 1 component missing”, or just “Pasted”. */
 export declare function pasteSummaryMessage(diff: PasteDiff): string;

package/dist/lib/clipboard/paste-issues.js

@@ -8,62 +8,25 @@ function walk(node, visit) {
 }
 /**
  * Diff an inserted subtree (with its final, session-assigned node ids)
- * against the target project's registry + known data sources.
+ * against the target project's registry.
  */
 export function diffPastedSubtree(args) {
     const missingComponents = new Map(); // componentId -> first nodeId
-    const unresolvedBindings = new Map(); // nodeId+sourceId -> issue
-    const unresolvedSourceIds = new Set();
     walk(args.node, (node) => {
         if (!args.hasComponent(node.componentId) && !missingComponents.has(node.componentId)) {
             missingComponents.set(node.componentId, node.id);
         }
-        const bindings = [];
-        for (const value of Object.values(node.props ?? {})) {
-            if (value.kind === 'binding')
-                bindings.push(value.binding);
-        }
-        if (node.condition)
-            bindings.push(node.condition.source);
-        for (const binding of bindings) {
-            if (args.knownSourceIds.has(binding.sourceId))
-                continue;
-            unresolvedSourceIds.add(binding.sourceId);
-            const key = `${node.id} ${binding.sourceId}`;
-            if (!unresolvedBindings.has(key)) {
-                unresolvedBindings.set(key, {
-                    kind: 'unresolved-binding',
-                    message: translate('builder.clipboard.issue.unresolvedBinding', {
-                        sourceId: binding.sourceId,
-                    }),
-                    nodeId: node.id,
-                });
-            }
-        }
     });
-    const issues = [
-        ...[...unresolvedBindings.values()],
-        ...[...missingComponents.entries()].map(([componentId, nodeId]) => ({
-            kind: 'missing-component',
-            message: translate('builder.clipboard.issue.missingComponent', { componentId }),
-            nodeId,
-        })),
-    ];
-    return {
-        missingComponents: [...missingComponents.keys()],
-        unresolvedBindings: [...unresolvedSourceIds],
-        issues,
-    };
+    const issues = [...missingComponents.entries()].map(([componentId, nodeId]) => ({
+        kind: 'missing-component',
+        message: translate('builder.clipboard.issue.missingComponent', { componentId }),
+        nodeId,
+    }));
+    return { missingComponents: [...missingComponents.keys()], issues };
 }
-/** “Pasted — 2 bindings unresolved, 1 component missing”, or just “Pasted”. */
+/** “Pasted — 1 component missing”, or just “Pasted”. */
 export function pasteSummaryMessage(diff) {
     const parts = [];
-    const bindings = diff.issues.filter((i) => i.kind === 'unresolved-binding').length;
-    if (bindings > 0) {
-        parts.push(translate(bindings === 1
-            ? 'builder.clipboard.summary.bindingUnresolvedOne'
-            : 'builder.clipboard.summary.bindingsUnresolved', { count: bindings }));
-    }
     if (diff.missingComponents.length > 0) {
         const n = diff.missingComponents.length;
         parts.push(translate(n === 1

package/dist/lib/clipboard/paste-issues.js.map

@@ -1 +1 @@
-{"version":3,"file":"paste-issues.js","sourceRoot":"","sources":["../../../src/lib/clipboard/paste-issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAgCtD,SAAS,IAAI,CAAC,IAAmB,EAAE,KAAoC;IACrE,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,8BAA8B;IAClF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsB,CAAA,CAAC,2BAA2B;IACpF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACrF,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,QAAQ,GAAuB,EAAE,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YACvD,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAA;YAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,SAAS,CAAC,2CAA2C,EAAE;wBAC9D,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC;oBACF,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAiB;QAC3B,GAAG,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACrC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAc,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,SAAS,CAAC,0CAA0C,EAAE,EAAE,WAAW,EAAE,CAAC;YAC/E,MAAM;SACP,CAAC,CACH;KACF,CAAA;IACD,OAAO;QACL,iBAAiB,EAAE,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAChD,kBAAkB,EAAE,CAAC,GAAG,mBAAmB,CAAC;QAC5C,MAAM;KACP,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,IAAe;IACjD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,MAAM,CAAA;IAClF,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,SAAS,CACP,QAAQ,KAAK,CAAC;YACZ,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,8CAA8C,EAClD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CACF,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAA;QACvC,KAAK,CAAC,IAAI,CACR,SAAS,CACP,CAAC,KAAK,CAAC;YACL,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,6CAA6C,EACjD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CACF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,SAAS,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAA;AACnD,CAAC","sourcesContent":["import type { BindingReference, ComponentNode } from '@elytracms/core/project-graph'\nimport { translate } from '@elytracms/studio/lib/i18n'\n\n/**\n * Permissive-paste validation (EC-175): pasting NEVER refuses a structurally\n * valid fragment. Instead, the inserted subtree is diffed against the TARGET\n * project's registry and data sources at paste time (cross-project semantics:\n * the fragment's source project is irrelevant — what matters is what *this*\n * project can resolve), and every mismatch becomes a visible, node-addressed\n * issue the notice deep-links. The renderer's existing fallbacks keep the\n * pasted nodes visible meanwhile.\n *\n * EC-494: this diff runs STUDIO-side (it needs the target registry and the session's\n * data sources), so it holds the active locale and can call `translate` directly —\n * no message ref has to cross a boundary, unlike the engine-built clipboard errors\n * in `@elytracms/core/clipboard`.\n */\n\nexport interface PasteIssue {\n  kind: 'missing-component' | 'unresolved-binding'\n  message: string\n  /** The inserted node carrying the problem — deep-link target. */\n  nodeId: string\n}\n\nexport interface PasteDiff {\n  /** Distinct component ids absent from the target registry. */\n  missingComponents: string[]\n  /** Distinct binding source ids the target cannot resolve. */\n  unresolvedBindings: string[]\n  issues: PasteIssue[]\n}\n\nfunction walk(node: ComponentNode, visit: (node: ComponentNode) => void): void {\n  visit(node)\n  for (const children of Object.values(node.slots ?? {})) {\n    for (const child of children) walk(child, visit)\n  }\n}\n\n/**\n * Diff an inserted subtree (with its final, session-assigned node ids)\n * against the target project's registry + known data sources.\n */\nexport function diffPastedSubtree(args: {\n  node: ComponentNode\n  hasComponent: (componentId: string) => boolean\n  knownSourceIds: ReadonlySet<string>\n}): PasteDiff {\n  const missingComponents = new Map<string, string>() // componentId -> first nodeId\n  const unresolvedBindings = new Map<string, PasteIssue>() // nodeId+sourceId -> issue\n  const unresolvedSourceIds = new Set<string>()\n  walk(args.node, (node) => {\n    if (!args.hasComponent(node.componentId) && !missingComponents.has(node.componentId)) {\n      missingComponents.set(node.componentId, node.id)\n    }\n    const bindings: BindingReference[] = []\n    for (const value of Object.values(node.props ?? {})) {\n      if (value.kind === 'binding') bindings.push(value.binding)\n    }\n    if (node.condition) bindings.push(node.condition.source)\n    for (const binding of bindings) {\n      if (args.knownSourceIds.has(binding.sourceId)) continue\n      unresolvedSourceIds.add(binding.sourceId)\n      const key = `${node.id} ${binding.sourceId}`\n      if (!unresolvedBindings.has(key)) {\n        unresolvedBindings.set(key, {\n          kind: 'unresolved-binding',\n          message: translate('builder.clipboard.issue.unresolvedBinding', {\n            sourceId: binding.sourceId,\n          }),\n          nodeId: node.id,\n        })\n      }\n    }\n  })\n  const issues: PasteIssue[] = [\n    ...[...unresolvedBindings.values()],\n    ...[...missingComponents.entries()].map(\n      ([componentId, nodeId]): PasteIssue => ({\n        kind: 'missing-component',\n        message: translate('builder.clipboard.issue.missingComponent', { componentId }),\n        nodeId,\n      }),\n    ),\n  ]\n  return {\n    missingComponents: [...missingComponents.keys()],\n    unresolvedBindings: [...unresolvedSourceIds],\n    issues,\n  }\n}\n\n/** “Pasted — 2 bindings unresolved, 1 component missing”, or just “Pasted”. */\nexport function pasteSummaryMessage(diff: PasteDiff): string {\n  const parts: string[] = []\n  const bindings = diff.issues.filter((i) => i.kind === 'unresolved-binding').length\n  if (bindings > 0) {\n    parts.push(\n      translate(\n        bindings === 1\n          ? 'builder.clipboard.summary.bindingUnresolvedOne'\n          : 'builder.clipboard.summary.bindingsUnresolved',\n        { count: bindings },\n      ),\n    )\n  }\n  if (diff.missingComponents.length > 0) {\n    const n = diff.missingComponents.length\n    parts.push(\n      translate(\n        n === 1\n          ? 'builder.clipboard.summary.componentMissingOne'\n          : 'builder.clipboard.summary.componentsMissing',\n        { count: n },\n      ),\n    )\n  }\n  return parts.length > 0\n    ? translate('builder.clipboard.summary.pastedWith', { parts: parts.join(', ') })\n    : translate('builder.clipboard.summary.pasted')\n}\n"]}
+{"version":3,"file":"paste-issues.js","sourceRoot":"","sources":["../../../src/lib/clipboard/paste-issues.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAmCtD,SAAS,IAAI,CAAC,IAAmB,EAAE,KAAoC;IACrE,KAAK,CAAC,IAAI,CAAC,CAAA;IACX,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA,CAAC,8BAA8B;IAClF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACrF,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,MAAM,GAAiB,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC/D,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAc,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,SAAS,CAAC,0CAA0C,EAAE,EAAE,WAAW,EAAE,CAAC;QAC/E,MAAM;KACP,CAAC,CACH,CAAA;IACD,OAAO,EAAE,iBAAiB,EAAE,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;AACrE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAAC,IAAe;IACjD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAA;QACvC,KAAK,CAAC,IAAI,CACR,SAAS,CACP,CAAC,KAAK,CAAC;YACL,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,6CAA6C,EACjD,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CACF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,SAAS,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAA;AACnD,CAAC","sourcesContent":["import type { ComponentNode } from '@elytracms/core/project-graph'\nimport { translate } from '@elytracms/studio/lib/i18n'\n\n/**\n * Permissive-paste validation (EC-175): pasting NEVER refuses a structurally\n * valid fragment. Instead, the inserted subtree is diffed against the TARGET\n * project's registry at paste time (cross-project semantics: the fragment's\n * source project is irrelevant — what matters is what *this* project can\n * resolve), and every mismatch becomes a visible, node-addressed issue the\n * notice deep-links. The renderer's existing fallbacks keep the pasted nodes\n * visible meanwhile.\n *\n * EC-574: the second half of this diff — binding source ids the target could\n * not resolve — went with the data-binding subsystem. A pasted node carrying a\n * retired binding member is reported by the composition validator\n * (`legacy-node-member`) when the document is validated, not here.\n *\n * EC-494: this diff runs STUDIO-side (it needs the target registry), so it holds\n * the active locale and can call `translate` directly — no message ref has to\n * cross a boundary, unlike the engine-built clipboard errors in\n * `@elytracms/core/clipboard`.\n */\n\nexport interface PasteIssue {\n  kind: 'missing-component'\n  message: string\n  /** The inserted node carrying the problem — deep-link target. */\n  nodeId: string\n}\n\nexport interface PasteDiff {\n  /** Distinct component ids absent from the target registry. */\n  missingComponents: string[]\n  issues: PasteIssue[]\n}\n\nfunction walk(node: ComponentNode, visit: (node: ComponentNode) => void): void {\n  visit(node)\n  for (const children of Object.values(node.slots ?? {})) {\n    for (const child of children) walk(child, visit)\n  }\n}\n\n/**\n * Diff an inserted subtree (with its final, session-assigned node ids)\n * against the target project's registry.\n */\nexport function diffPastedSubtree(args: {\n  node: ComponentNode\n  hasComponent: (componentId: string) => boolean\n}): PasteDiff {\n  const missingComponents = new Map<string, string>() // componentId -> first nodeId\n  walk(args.node, (node) => {\n    if (!args.hasComponent(node.componentId) && !missingComponents.has(node.componentId)) {\n      missingComponents.set(node.componentId, node.id)\n    }\n  })\n  const issues: PasteIssue[] = [...missingComponents.entries()].map(\n    ([componentId, nodeId]): PasteIssue => ({\n      kind: 'missing-component',\n      message: translate('builder.clipboard.issue.missingComponent', { componentId }),\n      nodeId,\n    }),\n  )\n  return { missingComponents: [...missingComponents.keys()], issues }\n}\n\n/** “Pasted — 1 component missing”, or just “Pasted”. */\nexport function pasteSummaryMessage(diff: PasteDiff): string {\n  const parts: string[] = []\n  if (diff.missingComponents.length > 0) {\n    const n = diff.missingComponents.length\n    parts.push(\n      translate(\n        n === 1\n          ? 'builder.clipboard.summary.componentMissingOne'\n          : 'builder.clipboard.summary.componentsMissing',\n        { count: n },\n      ),\n    )\n  }\n  return parts.length > 0\n    ? translate('builder.clipboard.summary.pastedWith', { parts: parts.join(', ') })\n    : translate('builder.clipboard.summary.pasted')\n}\n"]}

package/dist/lib/clipboard/paste-target.d.ts

@@ -6,15 +6,61 @@ import type { ComponentManifest } from '@elytracms/core/component-registry';
  * the anchor node's child slot when it has one, else *after* the anchor as a
  * sibling, else appended to the page root. Pure and selection-driven so the
  * canvas, the page tree, and keyboard paste all share one rule.
+ *
+ * EC-545: the resolved slot's `allow` leash is checked HERE, for the pasted
+ * subtree's root, through the same `slotAllows` the drop rule reads — so a
+ * component drag-and-drop refuses is refused by clipboard too, and a caller
+ * cannot reach an `InsertTarget` without passing the check (the rejection is a
+ * separate member of the result union, not a flag beside the target). Nested
+ * validity of the pasted subtree stays with the publish gate, exactly like a
+ * drop.
+ *
+ * EC-554: the composition FIELD's top-level `allow` is checked here too, through
+ * the same `placementRefusal` → `fieldAllowAt` the drop rule and the insert offer
+ * read — a paste that lands as a direct child of the composition root must be in
+ * the field's vocabulary.
  */
 export interface PasteTarget {
+    ok: true;
     target: InsertTarget;
     /** Human label of where the paste lands (notices/debugging). */
     destinationLabel: string;
 }
+/** The resolved slot's own `allow` list excludes the pasted root (EC-545). */
+export interface PasteSlotRejection {
+    ok: false;
+    code: 'not-allowed';
+    /** The pasted root the slot refuses. */
+    componentId: string;
+    /** The resolved slot whose `allow` list excludes it. */
+    slot: string;
+    /** Human label of the refused destination (`Section · body`). */
+    destinationLabel: string;
+}
+/**
+ * The composition field's top-level `allow` excludes the pasted root (EC-554).
+ * Deliberately carries NO slot/destination label: the refused slot is the
+ * invisible synthetic root's (`Stack · children`), and the reason to show is the
+ * FIELD — the notice names it from the editor's field scope.
+ */
+export interface PasteFieldRejection {
+    ok: false;
+    code: 'field-not-allowed';
+    /** The pasted root the field vocabulary refuses. */
+    componentId: string;
+}
+export type PasteRejection = PasteSlotRejection | PasteFieldRejection;
+export type PasteResolution = PasteTarget | PasteRejection;
 export declare function resolvePasteTarget(args: {
     root: ComponentNode;
     /** The anchor node (usually the selection); `null` falls back to the root. */
     anchorId: string | null;
+    /** The pasted subtree's root component — the id the slot leash judges. */
+    componentId: string;
     getManifest: (componentId: string) => ComponentManifest | undefined;
-}): PasteTarget;
+    /**
+     * The composition field's top-level `allow` (EC-554) — `undefined` when the
+     * field declares none. Required so no caller can forget to pass it.
+     */
+    fieldAllow: readonly string[] | undefined;
+}): PasteResolution;

package/dist/lib/clipboard/paste-target.js

@@ -1,29 +1,37 @@
 import { getNode, getParentInfo } from '@elytracms/core/project-graph';
-import { manifestRules, primaryInsertSlot } from '@elytracms/studio/lib/dnd/drop-rules';
+import { manifestRules, placementRefusal, primaryInsertSlot } from '@elytracms/studio/lib/dnd/drop-rules';
 import { shortId } from '@elytracms/studio/lib/persona/labels';
 export function resolvePasteTarget(args) {
-    const { root, getManifest } = args;
+    const { root, componentId, getManifest, fieldAllow } = args;
     const anchor = args.anchorId !== null ? getNode(root, args.anchorId) : undefined;
     const node = anchor ?? root;
+    const leashed = (slot, slotRule, target, destinationLabel) => {
+        const refusal = placementRefusal({ root, parentId: target.parentId, slot: slotRule, fieldAllow, componentId });
+        if (refusal === 'field')
+            return { ok: false, code: 'field-not-allowed', componentId };
+        if (refusal === 'slot')
+            return { ok: false, code: 'not-allowed', componentId, slot, destinationLabel };
+        return { ok: true, target, destinationLabel };
+    };
     // EC-386: the shared slot rule (`primaryInsertSlot` over the merged
     // `manifestRules` vocabulary) — a blocks-prop region (e.g. a Section's `body`)
     // receives the paste exactly like the insert dialog and a DnD `into`.
     const manifest = getManifest(node.componentId);
     const childSlot = primaryInsertSlot(manifestRules(manifest));
     if (childSlot) {
-        return {
-            target: { parentId: node.id, slot: childSlot.name },
-            destinationLabel: `${shortId(node.componentId)} · ${childSlot.name}`,
-        };
+        return leashed(childSlot.name, childSlot, { parentId: node.id, slot: childSlot.name }, `${shortId(node.componentId)} · ${childSlot.name}`);
     }
     const info = getParentInfo(root, node.id);
     if (info) {
-        return {
-            target: { parentId: info.parent.id, slot: info.slot, index: info.index + 1 },
-            destinationLabel: `${shortId(info.parent.componentId)} · ${info.slot}`,
-        };
+        // A sibling paste is governed by the PARENT's slot leash (the drop rule's
+        // before/after case). An unknown parent manifest imposes no allow-list;
+        // validation owns that issue.
+        const parentSlot = manifestRules(getManifest(info.parent.componentId))?.slots.find((s) => s.name === info.slot);
+        return leashed(info.slot, parentSlot, { parentId: info.parent.id, slot: info.slot, index: info.index + 1 }, `${shortId(info.parent.componentId)} · ${info.slot}`);
     }
     // Leaf root with no declared slots (degenerate graphs): append to `children`.
-    return { target: { parentId: root.id, slot: 'children' }, destinationLabel: 'root' };
+    // No slot rule exists, but the paste still lands at the root — the field leash
+    // applies.
+    return leashed('children', undefined, { parentId: root.id, slot: 'children' }, 'root');
 }
 //# sourceMappingURL=paste-target.js.map

package/dist/lib/clipboard/paste-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"paste-target.js","sourceRoot":"","sources":["../../../src/lib/clipboard/paste-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGtE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AAgB9D,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAA;IAE3B,oEAAoE;IACpE,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YACnD,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE;SACrE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE;YAC5E,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE;SACvE,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAA;AACtF,CAAC","sourcesContent":["import { getNode, getParentInfo } from '@elytracms/core/project-graph'\nimport type { ComponentNode, InsertTarget } from '@elytracms/core/project-graph'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { manifestRules, primaryInsertSlot } from '@elytracms/studio/lib/dnd/drop-rules'\nimport { shortId } from '@elytracms/studio/lib/persona/labels'\n\n/**\n * Paste landing-spot resolution (EC-175) — the same placement rule the Insert\n * dialog uses (`insert-context.ts`): a pasted subtree lands *into*\n * the anchor node's child slot when it has one, else *after* the anchor as a\n * sibling, else appended to the page root. Pure and selection-driven so the\n * canvas, the page tree, and keyboard paste all share one rule.\n */\n\nexport interface PasteTarget {\n  target: InsertTarget\n  /** Human label of where the paste lands (notices/debugging). */\n  destinationLabel: string\n}\n\nexport function resolvePasteTarget(args: {\n  root: ComponentNode\n  /** The anchor node (usually the selection); `null` falls back to the root. */\n  anchorId: string | null\n  getManifest: (componentId: string) => ComponentManifest | undefined\n}): PasteTarget {\n  const { root, getManifest } = args\n  const anchor = args.anchorId !== null ? getNode(root, args.anchorId) : undefined\n  const node = anchor ?? root\n\n  // EC-386: the shared slot rule (`primaryInsertSlot` over the merged\n  // `manifestRules` vocabulary) — a blocks-prop region (e.g. a Section's `body`)\n  // receives the paste exactly like the insert dialog and a DnD `into`.\n  const manifest = getManifest(node.componentId)\n  const childSlot = primaryInsertSlot(manifestRules(manifest))\n  if (childSlot) {\n    return {\n      target: { parentId: node.id, slot: childSlot.name },\n      destinationLabel: `${shortId(node.componentId)} · ${childSlot.name}`,\n    }\n  }\n\n  const info = getParentInfo(root, node.id)\n  if (info) {\n    return {\n      target: { parentId: info.parent.id, slot: info.slot, index: info.index + 1 },\n      destinationLabel: `${shortId(info.parent.componentId)} · ${info.slot}`,\n    }\n  }\n\n  // Leaf root with no declared slots (degenerate graphs): append to `children`.\n  return { target: { parentId: root.id, slot: 'children' }, destinationLabel: 'root' }\n}\n"]}
+{"version":3,"file":"paste-target.js","sourceRoot":"","sources":["../../../src/lib/clipboard/paste-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGtE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAEzG,OAAO,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAA;AA2D9D,MAAM,UAAU,kBAAkB,CAAC,IAYlC;IACC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAA;IAE3B,MAAM,OAAO,GAAG,CACd,IAAY,EACZ,QAA8B,EAC9B,MAAoB,EACpB,gBAAwB,EACP,EAAE;QACnB,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;QAC9G,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAA;QACrF,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAA;QACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IAC/C,CAAC,CAAA;IAED,oEAAoE;IACpE,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,OAAO,CACZ,SAAS,CAAC,IAAI,EACd,SAAS,EACT,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,0EAA0E;QAC1E,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/G,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,UAAU,EACV,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,EACpE,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CACrD,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,WAAW;IACX,OAAO,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAA;AACxF,CAAC","sourcesContent":["import { getNode, getParentInfo } from '@elytracms/core/project-graph'\nimport type { ComponentNode, InsertTarget } from '@elytracms/core/project-graph'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { manifestRules, placementRefusal, primaryInsertSlot } from '@elytracms/studio/lib/dnd/drop-rules'\nimport type { SlotRule } from '@elytracms/studio/lib/dnd/drop-rules'\nimport { shortId } from '@elytracms/studio/lib/persona/labels'\n\n/**\n * Paste landing-spot resolution (EC-175) — the same placement rule the Insert\n * dialog uses (`insert-context.ts`): a pasted subtree lands *into*\n * the anchor node's child slot when it has one, else *after* the anchor as a\n * sibling, else appended to the page root. Pure and selection-driven so the\n * canvas, the page tree, and keyboard paste all share one rule.\n *\n * EC-545: the resolved slot's `allow` leash is checked HERE, for the pasted\n * subtree's root, through the same `slotAllows` the drop rule reads — so a\n * component drag-and-drop refuses is refused by clipboard too, and a caller\n * cannot reach an `InsertTarget` without passing the check (the rejection is a\n * separate member of the result union, not a flag beside the target). Nested\n * validity of the pasted subtree stays with the publish gate, exactly like a\n * drop.\n *\n * EC-554: the composition FIELD's top-level `allow` is checked here too, through\n * the same `placementRefusal` → `fieldAllowAt` the drop rule and the insert offer\n * read — a paste that lands as a direct child of the composition root must be in\n * the field's vocabulary.\n */\n\nexport interface PasteTarget {\n  ok: true\n  target: InsertTarget\n  /** Human label of where the paste lands (notices/debugging). */\n  destinationLabel: string\n}\n\n/** The resolved slot's own `allow` list excludes the pasted root (EC-545). */\nexport interface PasteSlotRejection {\n  ok: false\n  code: 'not-allowed'\n  /** The pasted root the slot refuses. */\n  componentId: string\n  /** The resolved slot whose `allow` list excludes it. */\n  slot: string\n  /** Human label of the refused destination (`Section · body`). */\n  destinationLabel: string\n}\n\n/**\n * The composition field's top-level `allow` excludes the pasted root (EC-554).\n * Deliberately carries NO slot/destination label: the refused slot is the\n * invisible synthetic root's (`Stack · children`), and the reason to show is the\n * FIELD — the notice names it from the editor's field scope.\n */\nexport interface PasteFieldRejection {\n  ok: false\n  code: 'field-not-allowed'\n  /** The pasted root the field vocabulary refuses. */\n  componentId: string\n}\n\nexport type PasteRejection = PasteSlotRejection | PasteFieldRejection\n\nexport type PasteResolution = PasteTarget | PasteRejection\n\nexport function resolvePasteTarget(args: {\n  root: ComponentNode\n  /** The anchor node (usually the selection); `null` falls back to the root. */\n  anchorId: string | null\n  /** The pasted subtree's root component — the id the slot leash judges. */\n  componentId: string\n  getManifest: (componentId: string) => ComponentManifest | undefined\n  /**\n   * The composition field's top-level `allow` (EC-554) — `undefined` when the\n   * field declares none. Required so no caller can forget to pass it.\n   */\n  fieldAllow: readonly string[] | undefined\n}): PasteResolution {\n  const { root, componentId, getManifest, fieldAllow } = args\n  const anchor = args.anchorId !== null ? getNode(root, args.anchorId) : undefined\n  const node = anchor ?? root\n\n  const leashed = (\n    slot: string,\n    slotRule: SlotRule | undefined,\n    target: InsertTarget,\n    destinationLabel: string,\n  ): PasteResolution => {\n    const refusal = placementRefusal({ root, parentId: target.parentId, slot: slotRule, fieldAllow, componentId })\n    if (refusal === 'field') return { ok: false, code: 'field-not-allowed', componentId }\n    if (refusal === 'slot') return { ok: false, code: 'not-allowed', componentId, slot, destinationLabel }\n    return { ok: true, target, destinationLabel }\n  }\n\n  // EC-386: the shared slot rule (`primaryInsertSlot` over the merged\n  // `manifestRules` vocabulary) — a blocks-prop region (e.g. a Section's `body`)\n  // receives the paste exactly like the insert dialog and a DnD `into`.\n  const manifest = getManifest(node.componentId)\n  const childSlot = primaryInsertSlot(manifestRules(manifest))\n  if (childSlot) {\n    return leashed(\n      childSlot.name,\n      childSlot,\n      { parentId: node.id, slot: childSlot.name },\n      `${shortId(node.componentId)} · ${childSlot.name}`,\n    )\n  }\n\n  const info = getParentInfo(root, node.id)\n  if (info) {\n    // A sibling paste is governed by the PARENT's slot leash (the drop rule's\n    // before/after case). An unknown parent manifest imposes no allow-list;\n    // validation owns that issue.\n    const parentSlot = manifestRules(getManifest(info.parent.componentId))?.slots.find((s) => s.name === info.slot)\n    return leashed(\n      info.slot,\n      parentSlot,\n      { parentId: info.parent.id, slot: info.slot, index: info.index + 1 },\n      `${shortId(info.parent.componentId)} · ${info.slot}`,\n    )\n  }\n\n  // Leaf root with no declared slots (degenerate graphs): append to `children`.\n  // No slot rule exists, but the paste still lands at the root — the field leash\n  // applies.\n  return leashed('children', undefined, { parentId: root.id, slot: 'children' }, 'root')\n}\n"]}

package/dist/lib/cms/document-gate.d.ts

@@ -10,17 +10,26 @@ import type { CmsDocument, CmsValidationIssue } from '@elytracms/core/cms-core';
  * `createStudioOperations` hands this module's reader to the operations layer
  * once, at bootstrap.
  *
- * The reader deliberately returns `undefined` when nothing is registered rather
- * than an empty issue list: `undefined` means "no session context here" and puts
- * the operations gate on its documented adapter-record fallback, whereas `[]`
- * would silently claim the document is clean. A gate that cannot see must say so,
- * not pass.
+ * **EC-546 — a gate that cannot see says so.** The first cut had the reader return
+ * `undefined` with nothing registered, meaning "no session context here", and
+ * the operations gate answered that by falling back to an optionless
+ * `validateDocument` over the adapter's schema record: scalar rules only, no
+ * store, no locale config, no composition or embed leash. Measured: a document
+ * carrying a component outside its slot's `allow` published through
+ * `createStudioOperations` whenever the stack was empty. That is the exact
+ * weaker, mode-dependent gate EC-497 removed, kept alive by a mount-state side
+ * channel. So the reader now answers with issues ONLY: with nothing registered it
+ * returns one blocking `error` issue — the publish is refused and the refusal is
+ * visible — and the operations layer no longer has a fallback to take (its
+ * `DocumentValidator` cannot return `undefined`).
  *
  * This module imports nothing but types, so hanging the seam off it never drags
  * the CMS session (or the component registry behind the composition validators)
  * into the operations bootstrap's module graph.
  */
 export type SessionDocumentValidator = (document: CmsDocument) => readonly CmsValidationIssue[];
+/** The catalog key of the refusal the reader emits with no session mounted (EC-546). */
+export declare const NO_VALIDATION_SESSION_MESSAGE_KEY = "cms.issueMessage.noValidationSession";
 /** Publish the session's canonical document validator (`null` clears the stack). */
 export declare function setSessionDocumentValidator(next: SessionDocumentValidator | null): void;
 /**
@@ -30,8 +39,9 @@ export declare function setSessionDocumentValidator(next: SessionDocumentValidat
  */
 export declare function clearSessionDocumentValidator(owned: SessionDocumentValidator): void;
 /**
- * The reader handed to `createOperations`. `undefined` = no session ⇒ the gate
- * falls back; see {@link SessionDocumentValidator} and the operations layer's
- * `DocumentValidator`.
+ * The reader handed to `createOperations`. The innermost session's verdict, or —
+ * with no session mounted — the blocking refusal described on
+ * {@link SessionDocumentValidator}. Never `undefined`: the operations layer's
+ * `DocumentValidator` has no fallback to offer and no longer accepts one (EC-546).
  */
-export declare function sessionValidateDocument(document: CmsDocument): readonly CmsValidationIssue[] | undefined;
+export declare function sessionValidateDocument(document: CmsDocument): readonly CmsValidationIssue[];

package/dist/lib/cms/document-gate.js

@@ -8,6 +8,25 @@
  * published. Popping restores the outer session instead.
  */
 const registered = [];
+/** The catalog key of the refusal the reader emits with no session mounted (EC-546). */
+export const NO_VALIDATION_SESSION_MESSAGE_KEY = 'cms.issueMessage.noValidationSession';
+/**
+ * The verdict with no session mounted: one blocking issue, never a pass and never
+ * `undefined`. `custom-validation` is the code for a rule the engine's field
+ * vocabulary does not name — this is a host rule ("publish only through a mounted
+ * session"), not a finding about the document — and the message carries the
+ * meaning. Published via the same `messageRef` the engine's issues use, so the
+ * studio's operation-error banner renders it in the active locale (EC-494).
+ */
+const NO_SESSION_REFUSAL = [
+    {
+        code: 'custom-validation',
+        severity: 'error',
+        message: 'No validation session is mounted — refusing to publish unvalidated.',
+        messageRef: { key: NO_VALIDATION_SESSION_MESSAGE_KEY },
+        path: [],
+    },
+];
 /** Publish the session's canonical document validator (`null` clears the stack). */
 export function setSessionDocumentValidator(next) {
     if (next === null) {
@@ -30,11 +49,13 @@ export function clearSessionDocumentValidator(owned) {
         registered.splice(at, 1);
 }
 /**
- * The reader handed to `createOperations`. `undefined` = no session ⇒ the gate
- * falls back; see {@link SessionDocumentValidator} and the operations layer's
- * `DocumentValidator`.
+ * The reader handed to `createOperations`. The innermost session's verdict, or —
+ * with no session mounted — the blocking refusal described on
+ * {@link SessionDocumentValidator}. Never `undefined`: the operations layer's
+ * `DocumentValidator` has no fallback to offer and no longer accepts one (EC-546).
  */
 export function sessionValidateDocument(document) {
-    return registered.at(-1)?.(document);
+    const session = registered.at(-1);
+    return session ? session(document) : NO_SESSION_REFUSAL;
 }
 //# sourceMappingURL=document-gate.js.map

package/dist/lib/cms/document-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"document-gate.js","sourceRoot":"","sources":["../../../src/lib/cms/document-gate.ts"],"names":[],"mappings":"AAyBA;;;;;;;;GAQG;AACH,MAAM,UAAU,GAA+B,EAAE,CAAA;AAEjD,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,IAAqC;IAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;QACrB,OAAM;IACR,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAA+B;IAC3E,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqB;IAErB,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC","sourcesContent":["import type { CmsDocument, CmsValidationIssue } from '@elytracms/core/cms-core'\n\n/**\n * The publish-gate seam (EC-497) — a framework-free module store, the same shape\n * as the current-document seam (`lib/ai-current-document`).\n *\n * `createOperations` is a module singleton built long before (and independently\n * of) any React tree, while gate-strength validation needs the live CMS session:\n * its document store, its asset oracle, its published-ness pointer. So the CMS\n * session PUBLISHES a validator here while mounted, and\n * `createStudioOperations` hands this module's reader to the operations layer\n * once, at bootstrap.\n *\n * The reader deliberately returns `undefined` when nothing is registered rather\n * than an empty issue list: `undefined` means \"no session context here\" and puts\n * the operations gate on its documented adapter-record fallback, whereas `[]`\n * would silently claim the document is clean. A gate that cannot see must say so,\n * not pass.\n *\n * This module imports nothing but types, so hanging the seam off it never drags\n * the CMS session (or the component registry behind the composition validators)\n * into the operations bootstrap's module graph.\n */\nexport type SessionDocumentValidator = (document: CmsDocument) => readonly CmsValidationIssue[]\n\n/**\n * Registered sessions, innermost LAST — a stack, not a single slot, because more\n * than one `CmsProvider` can be mounted at a time: the \"Use in document…\"\n * transfer dialog mounts its own over the app's\n * (`components/transfer-dialog.tsx:92`). With a single slot, closing that dialog\n * would clear the seam and silently drop the publish gate back to its fallback\n * for the rest of the app's life — a regression invisible until something\n * published. Popping restores the outer session instead.\n */\nconst registered: SessionDocumentValidator[] = []\n\n/** Publish the session's canonical document validator (`null` clears the stack). */\nexport function setSessionDocumentValidator(next: SessionDocumentValidator | null): void {\n  if (next === null) {\n    registered.length = 0\n    return\n  }\n  const at = registered.indexOf(next)\n  if (at >= 0) registered.splice(at, 1)\n  registered.push(next)\n}\n\n/**\n * Remove this validator — the unmount race guard. Removing an INNER session\n * leaves the outer one in place; removing one that already left is a no-op (a\n * remount registers the new validator before the old effect's cleanup runs).\n */\nexport function clearSessionDocumentValidator(owned: SessionDocumentValidator): void {\n  const at = registered.indexOf(owned)\n  if (at >= 0) registered.splice(at, 1)\n}\n\n/**\n * The reader handed to `createOperations`. `undefined` = no session ⇒ the gate\n * falls back; see {@link SessionDocumentValidator} and the operations layer's\n * `DocumentValidator`.\n */\nexport function sessionValidateDocument(\n  document: CmsDocument,\n): readonly CmsValidationIssue[] | undefined {\n  return registered.at(-1)?.(document)\n}\n"]}
+{"version":3,"file":"document-gate.js","sourceRoot":"","sources":["../../../src/lib/cms/document-gate.ts"],"names":[],"mappings":"AAgCA;;;;;;;;GAQG;AACH,MAAM,UAAU,GAA+B,EAAE,CAAA;AAEjD,wFAAwF;AACxF,MAAM,CAAC,MAAM,iCAAiC,GAAG,sCAAsC,CAAA;AAEvF;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAkC;IACxD;QACE,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,qEAAqE;QAC9E,UAAU,EAAE,EAAE,GAAG,EAAE,iCAAiC,EAAE;QACtD,IAAI,EAAE,EAAE;KACT;CACF,CAAA;AAED,oFAAoF;AACpF,MAAM,UAAU,2BAA2B,CAAC,IAAqC;IAC/E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;QACrB,OAAM;IACR,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAA+B;IAC3E,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAqB;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAA;AACzD,CAAC","sourcesContent":["import type { CmsDocument, CmsValidationIssue } from '@elytracms/core/cms-core'\n\n/**\n * The publish-gate seam (EC-497) — a framework-free module store, the same shape\n * as the current-document seam (`lib/ai-current-document`).\n *\n * `createOperations` is a module singleton built long before (and independently\n * of) any React tree, while gate-strength validation needs the live CMS session:\n * its document store, its asset oracle, its published-ness pointer. So the CMS\n * session PUBLISHES a validator here while mounted, and\n * `createStudioOperations` hands this module's reader to the operations layer\n * once, at bootstrap.\n *\n * **EC-546 — a gate that cannot see says so.** The first cut had the reader return\n * `undefined` with nothing registered, meaning \"no session context here\", and\n * the operations gate answered that by falling back to an optionless\n * `validateDocument` over the adapter's schema record: scalar rules only, no\n * store, no locale config, no composition or embed leash. Measured: a document\n * carrying a component outside its slot's `allow` published through\n * `createStudioOperations` whenever the stack was empty. That is the exact\n * weaker, mode-dependent gate EC-497 removed, kept alive by a mount-state side\n * channel. So the reader now answers with issues ONLY: with nothing registered it\n * returns one blocking `error` issue — the publish is refused and the refusal is\n * visible — and the operations layer no longer has a fallback to take (its\n * `DocumentValidator` cannot return `undefined`).\n *\n * This module imports nothing but types, so hanging the seam off it never drags\n * the CMS session (or the component registry behind the composition validators)\n * into the operations bootstrap's module graph.\n */\nexport type SessionDocumentValidator = (document: CmsDocument) => readonly CmsValidationIssue[]\n\n/**\n * Registered sessions, innermost LAST — a stack, not a single slot, because more\n * than one `CmsProvider` can be mounted at a time: the \"Use in document…\"\n * transfer dialog mounts its own over the app's\n * (`components/transfer-dialog.tsx:92`). With a single slot, closing that dialog\n * would clear the seam and silently drop the publish gate back to its fallback\n * for the rest of the app's life — a regression invisible until something\n * published. Popping restores the outer session instead.\n */\nconst registered: SessionDocumentValidator[] = []\n\n/** The catalog key of the refusal the reader emits with no session mounted (EC-546). */\nexport const NO_VALIDATION_SESSION_MESSAGE_KEY = 'cms.issueMessage.noValidationSession'\n\n/**\n * The verdict with no session mounted: one blocking issue, never a pass and never\n * `undefined`. `custom-validation` is the code for a rule the engine's field\n * vocabulary does not name — this is a host rule (\"publish only through a mounted\n * session\"), not a finding about the document — and the message carries the\n * meaning. Published via the same `messageRef` the engine's issues use, so the\n * studio's operation-error banner renders it in the active locale (EC-494).\n */\nconst NO_SESSION_REFUSAL: readonly CmsValidationIssue[] = [\n  {\n    code: 'custom-validation',\n    severity: 'error',\n    message: 'No validation session is mounted — refusing to publish unvalidated.',\n    messageRef: { key: NO_VALIDATION_SESSION_MESSAGE_KEY },\n    path: [],\n  },\n]\n\n/** Publish the session's canonical document validator (`null` clears the stack). */\nexport function setSessionDocumentValidator(next: SessionDocumentValidator | null): void {\n  if (next === null) {\n    registered.length = 0\n    return\n  }\n  const at = registered.indexOf(next)\n  if (at >= 0) registered.splice(at, 1)\n  registered.push(next)\n}\n\n/**\n * Remove this validator — the unmount race guard. Removing an INNER session\n * leaves the outer one in place; removing one that already left is a no-op (a\n * remount registers the new validator before the old effect's cleanup runs).\n */\nexport function clearSessionDocumentValidator(owned: SessionDocumentValidator): void {\n  const at = registered.indexOf(owned)\n  if (at >= 0) registered.splice(at, 1)\n}\n\n/**\n * The reader handed to `createOperations`. The innermost session's verdict, or —\n * with no session mounted — the blocking refusal described on\n * {@link SessionDocumentValidator}. Never `undefined`: the operations layer's\n * `DocumentValidator` has no fallback to offer and no longer accepts one (EC-546).\n */\nexport function sessionValidateDocument(document: CmsDocument): readonly CmsValidationIssue[] {\n  const session = registered.at(-1)\n  return session ? session(document) : NO_SESSION_REFUSAL\n}\n"]}

package/dist/lib/cms/published-documents.js

@@ -5,6 +5,7 @@ const PUBLISHED_RELOAD_OPS = [
     'documents.unpublish',
     'documents.restore',
     'documents.delete',
+    'documents.clear',
 ];
 const EMPTY_POOL = new Map();
 /**

package/dist/lib/cms/published-documents.js.map

@@ -1 +1 @@
-{"version":3,"file":"published-documents.js","sourceRoot":"","sources":["../../../src/lib/cms/published-documents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAsB/D,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,kBAAkB;CACV,CAAA;AAEV,MAAM,UAAU,GAAqC,IAAI,GAAG,EAAE,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA4B,EAC5B,SAAiB,EACjB,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAA;IAChG,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,YAAoB;IAEpB,MAAM,KAAK,GAAG,iBAAiB,CAA2B;QACxD,4EAA4E;QAC5E,QAAQ,EAAE,CAAC,oBAAoB,EAAE,SAAS,IAAI,GAAG,EAAE,YAAY,CAAC;QAChE,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAmB,EAAE,YAAY,CAAC;QAC7F,YAAY,EAAE,oBAAoB;QAClC,OAAO,EAAE,SAAS,KAAK,SAAS;KACjC,CAAC,CAAA;IACF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACzE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAC1F,CAAC","sourcesContent":["import type { CmsDocument } from '@elytracms/core/cms-core'\nimport type { OperationsClient } from '../operations'\nimport { useOperationQuery } from '@elytracms/studio/lib/query'\n\n/**\n * The PUBLISHED-perspective documents of a collection (EC-205, \"live = published\")\n * — the pinned published snapshot of each currently-published document, keyed by\n * id. Live surfaces (a document's live URL + \"View live\", EC-216) MUST derive\n * from this, never from the draft rows the studio edits: an unpublished document,\n * or an unpublished `slug`/`parent` edit, must never leak into a \"live\" URL. The\n * pool is exactly the set the live site would serve, so composing a nested page's\n * URL from these ancestors yields the URL the live site actually resolves.\n *\n * EC-308/AD-17: loaded + kept fresh through the one `useOperationQuery` cache\n * seam — invalidated only when a publish/unpublish/restore/delete command\n * succeeds (NOT on every autosave upsert — a draft edit doesn't change what's\n * published). Cost: ONE bulk `documents.listPublished` read (EC-307).\n */\nexport interface PublishedDocuments {\n  /** Pinned published snapshot per published document id. Empty while loading. */\n  byId: ReadonlyMap<string, CmsDocument>\n  status: 'loading' | 'ready'\n}\n\n/** Commands that change which version is pinned live (and thus the pool). */\nconst PUBLISHED_RELOAD_OPS = [\n  'documents.publish',\n  'documents.unpublish',\n  'documents.restore',\n  'documents.delete',\n] as const\n\nconst EMPTY_POOL: ReadonlyMap<string, CmsDocument> = new Map()\n\n/**\n * Build the published pool of a collection (pure over the operations client): the\n * pinned published snapshot of every currently-published document, keyed by id.\n * EC-307: one bulk `documents.listPublished` read — the backend resolves each\n * `publishedVersion` pointer to its recorded snapshot — instead of a `list` plus a\n * per-document `listVersions` fan-out. Read failures degrade to an empty pool.\n */\nexport async function loadPublishedDocuments(\n  operations: OperationsClient,\n  projectId: string,\n  collectionId: string,\n): Promise<Map<string, CmsDocument>> {\n  const result = await operations.documents.listPublished({ projectId, collection: collectionId })\n  if (!result.ok) return new Map()\n  const byId = new Map<string, CmsDocument>()\n  for (const snapshot of result.value) byId.set(snapshot.id, snapshot)\n  return byId\n}\n\nexport function usePublishedDocuments(\n  projectId: string | undefined,\n  collectionId: string,\n): PublishedDocuments {\n  const query = useOperationQuery<Map<string, CmsDocument>>({\n    // Playground/fixture mode (no backend) is `enabled: false` → never queried.\n    queryKey: ['publishedDocuments', projectId ?? '∅', collectionId],\n    loader: (operations) => loadPublishedDocuments(operations, projectId as string, collectionId),\n    invalidateOn: PUBLISHED_RELOAD_OPS,\n    enabled: projectId !== undefined,\n  })\n  if (projectId === undefined) return { byId: EMPTY_POOL, status: 'ready' }\n  return { byId: query.data ?? EMPTY_POOL, status: query.isPending ? 'loading' : 'ready' }\n}\n"]}
+{"version":3,"file":"published-documents.js","sourceRoot":"","sources":["../../../src/lib/cms/published-documents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAsB/D,6EAA6E;AAC7E,MAAM,oBAAoB,GAAG;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,kBAAkB;IAClB,iBAAiB;CACT,CAAA;AAEV,MAAM,UAAU,GAAqC,IAAI,GAAG,EAAE,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA4B,EAC5B,SAAiB,EACjB,YAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAA;IAChG,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IACpE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAA6B,EAC7B,YAAoB;IAEpB,MAAM,KAAK,GAAG,iBAAiB,CAA2B;QACxD,4EAA4E;QAC5E,QAAQ,EAAE,CAAC,oBAAoB,EAAE,SAAS,IAAI,GAAG,EAAE,YAAY,CAAC;QAChE,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,UAAU,EAAE,SAAmB,EAAE,YAAY,CAAC;QAC7F,YAAY,EAAE,oBAAoB;QAClC,OAAO,EAAE,SAAS,KAAK,SAAS;KACjC,CAAC,CAAA;IACF,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IACzE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;AAC1F,CAAC","sourcesContent":["import type { CmsDocument } from '@elytracms/core/cms-core'\nimport type { OperationsClient } from '../operations'\nimport { useOperationQuery } from '@elytracms/studio/lib/query'\n\n/**\n * The PUBLISHED-perspective documents of a collection (EC-205, \"live = published\")\n * — the pinned published snapshot of each currently-published document, keyed by\n * id. Live surfaces (a document's live URL + \"View live\", EC-216) MUST derive\n * from this, never from the draft rows the studio edits: an unpublished document,\n * or an unpublished `slug`/`parent` edit, must never leak into a \"live\" URL. The\n * pool is exactly the set the live site would serve, so composing a nested page's\n * URL from these ancestors yields the URL the live site actually resolves.\n *\n * EC-308/AD-17: loaded + kept fresh through the one `useOperationQuery` cache\n * seam — invalidated only when a publish/unpublish/restore/delete command\n * succeeds (NOT on every autosave upsert — a draft edit doesn't change what's\n * published). Cost: ONE bulk `documents.listPublished` read (EC-307).\n */\nexport interface PublishedDocuments {\n  /** Pinned published snapshot per published document id. Empty while loading. */\n  byId: ReadonlyMap<string, CmsDocument>\n  status: 'loading' | 'ready'\n}\n\n/** Commands that change which version is pinned live (and thus the pool). */\nconst PUBLISHED_RELOAD_OPS = [\n  'documents.publish',\n  'documents.unpublish',\n  'documents.restore',\n  'documents.delete',\n  'documents.clear',\n] as const\n\nconst EMPTY_POOL: ReadonlyMap<string, CmsDocument> = new Map()\n\n/**\n * Build the published pool of a collection (pure over the operations client): the\n * pinned published snapshot of every currently-published document, keyed by id.\n * EC-307: one bulk `documents.listPublished` read — the backend resolves each\n * `publishedVersion` pointer to its recorded snapshot — instead of a `list` plus a\n * per-document `listVersions` fan-out. Read failures degrade to an empty pool.\n */\nexport async function loadPublishedDocuments(\n  operations: OperationsClient,\n  projectId: string,\n  collectionId: string,\n): Promise<Map<string, CmsDocument>> {\n  const result = await operations.documents.listPublished({ projectId, collection: collectionId })\n  if (!result.ok) return new Map()\n  const byId = new Map<string, CmsDocument>()\n  for (const snapshot of result.value) byId.set(snapshot.id, snapshot)\n  return byId\n}\n\nexport function usePublishedDocuments(\n  projectId: string | undefined,\n  collectionId: string,\n): PublishedDocuments {\n  const query = useOperationQuery<Map<string, CmsDocument>>({\n    // Playground/fixture mode (no backend) is `enabled: false` → never queried.\n    queryKey: ['publishedDocuments', projectId ?? '∅', collectionId],\n    loader: (operations) => loadPublishedDocuments(operations, projectId as string, collectionId),\n    invalidateOn: PUBLISHED_RELOAD_OPS,\n    enabled: projectId !== undefined,\n  })\n  if (projectId === undefined) return { byId: EMPTY_POOL, status: 'ready' }\n  return { byId: query.data ?? EMPTY_POOL, status: query.isPending ? 'loading' : 'ready' }\n}\n"]}

package/dist/lib/cms-views/view-model.d.ts

@@ -38,8 +38,8 @@ export type FilterClause = z.infer<typeof filterClauseSchema>;
 export declare const viewSortSchema: z.ZodObject<{
     field: z.ZodString;
     dir: z.ZodEnum<{
-        asc: "asc";
         desc: "desc";
+        asc: "asc";
     }>;
 }, z.core.$strip>;
 export type ViewSort = z.infer<typeof viewSortSchema>;
@@ -63,8 +63,8 @@ export declare const tableViewStateSchema: z.ZodObject<{
     sort: z.ZodNullable<z.ZodObject<{
         field: z.ZodString;
         dir: z.ZodEnum<{
-            asc: "asc";
             desc: "desc";
+            asc: "asc";
         }>;
     }, z.core.$strip>>;
     columns: z.ZodArray<z.ZodString>;
@@ -305,8 +305,8 @@ export declare const configViewSchema: z.ZodObject<{
     sort: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         field: z.ZodString;
         dir: z.ZodEnum<{
-            asc: "asc";
             desc: "desc";
+            asc: "asc";
         }>;
     }, z.core.$strip>>>;
     columns: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/lib/data/index.d.ts

@@ -1,6 +1,3 @@
-export * from './data-store.js';
-export * from './sample-capture.js';
-export * from './sources-store.js';
 export * from './collection-content.js';
 export * from './content-session-refresh.js';
 export * from './playground-unload-guard.js';

package/dist/lib/data/index.js

@@ -1,10 +1,8 @@
-export * from './data-store.js';
-export * from './sample-capture.js';
-export * from './sources-store.js';
+// EC-574: the data-source store, sample capture, providers and sources-store that
+// used to live here went with the data-binding subsystem. What remains is the
+// canvas's content session (collection-content), its write-sync refresh and the
+// playground unload guard.
 export * from './collection-content.js';
 export * from './content-session-refresh.js';
 export * from './playground-unload-guard.js';
-// Data providers (EC-167) are imported from './providers' directly: the module
-// exports a `DataProvider` domain type that would collide with the store's
-// `<DataProvider>` React provider in a wildcard barrel.
 //# sourceMappingURL=index.js.map

package/dist/lib/data/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/data/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,2BAA2B,CAAA;AACzC,+EAA+E;AAC/E,2EAA2E;AAC3E,wDAAwD","sourcesContent":["export * from './data-store'\nexport * from './sample-capture'\nexport * from './sources-store'\nexport * from './collection-content'\nexport * from './content-session-refresh'\nexport * from './playground-unload-guard'\n// Data providers (EC-167) are imported from './providers' directly: the module\n// exports a `DataProvider` domain type that would collide with the store's\n// `<DataProvider>` React provider in a wildcard barrel.\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/data/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,8EAA8E;AAC9E,gFAAgF;AAChF,2BAA2B;AAC3B,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,2BAA2B,CAAA","sourcesContent":["// EC-574: the data-source store, sample capture, providers and sources-store that\n// used to live here went with the data-binding subsystem. What remains is the\n// canvas's content session (collection-content), its write-sync refresh and the\n// playground unload guard.\nexport * from './collection-content'\nexport * from './content-session-refresh'\nexport * from './playground-unload-guard'\n"]}

package/dist/lib/dnd/drop-rules.d.ts

@@ -4,8 +4,9 @@ import type { ComponentManifest } from '@elytracms/core/component-registry';
  * Drag & drop eligibility rules (EC-160 + EC-162, vision §3.1) — pure
  * graph-level functions with **no DOM or UI dependencies**. The canvas and the
  * page tree both resolve drops through `resolveDrop`, so the two surfaces can
- * never disagree about what a manifest slot allow-list permits, which children
- * a component accepts, or whether a move would create a cycle.
+ * never disagree about what a manifest slot allow-list permits, what the
+ * composition field's top-level vocabulary permits at the root (EC-554), which
+ * children a component accepts, or whether a move would create a cycle.
  *
  * The drop-zone model is position-based: `into` a slot, `before`/`after` a
  * sibling along the parent's flow axis, and the EC-162 gesture positions
@@ -72,6 +73,11 @@ export type DropRejectionCode =
  | 'no-slot'
 /** The target slot's manifest allow-list rejects the dragged component. */
  | 'not-allowed'
+/**
+ * EC-554: the composition FIELD's top-level `allow` rejects the component
+ * landing as a direct child of the composition root (see {@link fieldAllowAt}).
+ */
+ | 'field-not-allowed'
 /** Moving a node into itself or its own subtree (cycle). */
  | 'own-subtree'
 /** The page root cannot be moved, and nothing can drop beside it. */
@@ -119,6 +125,37 @@ export declare function primaryInsertSlot(manifest: ManifestRules | undefined):
 export declare function canNestInto(getManifest: ManifestLookup, componentId: string): boolean;
 /** True when a slot's allow-list (if any) permits the component id. */
 export declare function slotAllows(slot: SlotRule | undefined, componentId: string): boolean;
+/**
+ * The composition FIELD's top-level vocabulary as it applies to a placement under
+ * `parentId` (EC-188, EC-554) — the ONE reader of a field's `allow` on the studio
+ * side: every insertion surface (the insert offer in `insert-context`, drag-and-drop
+ * on the canvas and the page tree incl. the wrap gesture, paste) asks here, so no
+ * surface can apply the field leash differently or not at all.
+ *
+ * A field `allow` governs only the value's TOP level — a direct child of the
+ * composition root, mirroring `validateCompositionValue` — so this returns the
+ * field vocabulary when `parentId` IS the root node and `undefined` (no field
+ * constraint) anywhere deeper. Keyed on node IDENTITY, never on the component id:
+ * the composition editor's synthetic root is a `base.Stack`, which is also a
+ * nestable block, and a rule keyed on the component id would leash every nested
+ * Stack. EC-544: an omitted `allow` is `undefined` here (any registered
+ * component); a declared list is a closed set.
+ */
+export declare function fieldAllowAt(root: ComponentNode, parentId: string, fieldAllow: readonly string[] | undefined): readonly string[] | undefined;
+/**
+ * Which declared leash refuses `componentId` landing under `parentId` in `slot`
+ * (EC-545 slot leash, EC-554 field leash) — `null` when both admit it. The field
+ * is judged first: it can only refuse at the composition root, where the slot is
+ * the invisible synthetic root's and the field is the declaration the author sees.
+ */
+export declare function placementRefusal(args: {
+    root: ComponentNode;
+    /** The node the placement lands under (the insertion target's `parentId`). */
+    parentId: string;
+    slot: SlotRule | undefined;
+    fieldAllow: readonly string[] | undefined;
+    componentId: string;
+}): 'field' | 'slot' | null;
 /**
  * Resolve a prospective drop into either an executable plan (one `move` or
  * `insert` builder action → one operations command → one undo step) or a
@@ -128,6 +165,12 @@ export declare function slotAllows(slot: SlotRule | undefined, componentId: stri
 export declare function resolveDrop(args: {
     root: ComponentNode;
     getManifest: ManifestLookup;
+    /**
+     * The composition field's top-level `allow` (EC-554) — `undefined` when the
+     * field declares none. Required so no surface can forget to pass it; judged
+     * through {@link fieldAllowAt} for drops whose parent is the root.
+     */
+    fieldAllow: readonly string[] | undefined;
     subject: DragSubject;
     location: DropLocation;
 }): DropResolution;